メニュー
Server administration knowledge for Evan's personal home server running Arch Linux. Knows all services, their configs, network layout, and operational procedures.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when asked to book a restaurant reservation, view reservations, find a reservation slot, or cancel a reservation.
Use for any request involving Evan's Obsidian vault, notes, or "second brain"; the vault is located at /mnt/documents/obsidian-vault.
Send context from this conversation to another chat session. Use this skill when Evan says things like "send this context to my ansible-personal chat", "create a new session with this debugging info", or "let's take what we learned and continue in the dots workspace".
Find, search, and manage files in Evan's multimedia library at ~/documents/multimedia. Use this skill when Evan asks if he has specific movies/shows/music, searches for media files, checks what's in his collection, or needs to organize media files (videos, music, photos, artwork, etc.).
Source of truth for Evan's commit and pull request workflow. Use this skill for any commit, amend, push, PR task, or fast-tracking a change for quick review.
Send Evan a Telegram notification via purkhiser-bot. Use proactively when Evan is AFK or has said he'll be away and something important needs his attention — SSH agent auth prompts, blocked tasks, errors requiring a decision, long-running tasks completing, or any situation where work cannot proceed without him.
| name | server-admin |
| description | Server administration knowledge for Evan's personal home server running Arch Linux. Knows all services, their configs, network layout, and operational procedures. |
You are running directly on this server as user evan. You can run commands directly on the server.
You have deep knowledge of Evan's personal home server. The server configuration is managed via Ansible in the ~/workspace/ansible-personal repository.
server (single inventory host)play-server.yml → roles/machines/serveransible-playbook play-server.yml (or with --tags <tag> for specific services)evan (uid 1000)lan0 (internal, 10.0.0.0/24)wan0 (external)home.evanpurkhiser.comdnsmasq on lan0, listening only on LAN
10.0.0.100–10.0.0.254systemd-resolved → Cloudflare DNS (1.1.1.1, 1.0.0.1)ufw — deny all by default, allow all on lan0, allow HTTPS (443) and BitTorrent (51413) on wan0tailscaled), provides VPN access| IP | Hostname | Notes |
|---|---|---|
| 10.0.0.2 | unifi-ap | UniFi Access Point |
| 10.0.0.3 | server-bmc | Server BMC |
| 10.0.0.4 | macbook-home | Home MacBook |
| 10.0.0.6 | macbook-work | Work MacBook |
| 10.0.0.20 | lutron-hub | Lutron lighting hub |
| 10.0.0.25 | air-purifier | Air purifier |
| 10.0.0.26 | apple-tv | Apple TV |
| 10.0.0.27 | sonos-amp | Sonos Amp |
| 10.0.0.28 | sonos-sub-mini | Sonos Sub Mini |
| 10.0.0.29 | apple-homepod-bathroom | Bathroom HomePod |
| 10.0.0.30 | apple-homepod-bedroom | Bedroom HomePod |
| 10.0.0.40 | bambulab-p1s | Bambu Lab P1S 3D printer |
| 10.0.0.50 | kindle | Kindle |
/mnt/documentszrepl pushes the documents filesystem to offsite TCP receiver (Tailscale IP)
zrepl_/mnt/documents exported to 10.0.0.0/24, 100.0.0.0/8 (Tailscale), and fe80::/64 — all with all_squash (maps to evan/users)/mnt/documents/downloads/torrents-complete and torrents-incompleteAll HTTPS traffic proxied through Cloudflare (strict SSL with Cloudflare origin cert). Real IP recovered from CF-Connecting-IP header.
| Domain | Backend | Notes |
|---|---|---|
hass.evanpurkhiser.com | 127.0.0.1:8123 | Home Assistant (WebSocket upgrade supported) |
public.evanpurkhiser.com | 127.0.0.1:9005 | Waitress file share (robots.txt disallows crawlers) |
apis.evanpurkhiser.com/meal-log | 127.0.0.1:9006 | Meal log API |
apis.evanpurkhiser.com/instagram-saver | 127.0.0.1:9007 | Instagram saver webhook |
apis.evanpurkhiser.com/atuin-abacus | 127.0.0.1:7071 | Atuin Abacus stats API |
dots.evanpurkhiser.com | GitHub raw (proxied) | Dotfiles installer, proxied from raw.githubusercontent.com |
Default server block returns 444 (immediately close) for unknown hosts.
All containers are managed via systemd units generated by Podman. Auto-update via podman-auto-update.timer (updates containers with io.containers.autoupdate: registry label).
atuin — ports 7070:8888 (server) and 7071:8000 (abacus)atuin-postgres — docker.io/postgres:14, data at /var/lib/atuin/dataatuin-server — ghcr.io/atuinsh/atuin:18.4.0, config at /var/lib/atuin/config, open registration disabledatuin-abacus — ghcr.io/evanpurkhiser/atuin-abacus:latest, stats/analytics API (port 8000), cache TTL 300scontainer-atuin-postgres, container-atuin-server, container-atuin-abacus, pod-atuinhome-assistant — ghcr.io/home-assistant/home-assistant:latest/var/lib/hass/ (configuration.yaml, automations.yaml, scripts.yaml, secrets.yaml, themes/)/dev/zwave (Z-Wave), /dev/zigbee (Zigbee) — GoControl USB adapter, udev rule 99-usb-gocontrol.ruleshttps://hass.evanpurkhiser.com0.0.0.0ansible-playbook play-server.yml --tags hass or sudo systemctl restart container-home-assistantwaitress — ghcr.io/evanpurkhiser/waitress:latest9005:80/mnt/documents:/mnt/documents/mnt/documents/public-share → public.evanpurkhiser.commnt-documents.mountmeal-log — ghcr.io/evanpurkhiser/meal-log:latest9006:8888/var/lib/meal-log/etc/meal-log.conf (OpenAI token, Cloudflare R2 credentials for image storage in meal-log-images bucket)instagram-saver — ghcr.io/evanpurkhiser/instagram-saver:latest9007:8888/etc/instagram-saver.conf (Google Places API key, OpenAI token)All timers are monitored via Sentry Cron Monitors.
| Service | Schedule | Purpose |
|---|---|---|
auto-system-update.timer | Sat 09:00 | Pacman system update with AI summary; uses OpenAI API; config at /etc/auto-system-update.conf |
bambulab-lights-off.timer | Every 15 min | Turns off Bambu Lab P1S printer lights when idle; IP 10.0.0.40; config at /etc/bambulab-lights-off.conf |
record-file-history.timer | Mon 00:00 | Records filenames from /mnt/documents to /mnt/documents/archived/file-history |
speedtest-monitor.timer | 08:05 and 22:05 (±1hr random) | Runs speedtest --secure --json >> /var/local/speedtest-monitor.json |
venmo-auto-cashout.timer | Every minute | Auto-cashes out Venmo balance to bank; config at /etc/venmo-auto-cashout.conf; state DB at /var/lib/venmo-auto-cashout/transactions.db; LunchMoney category z-venmo |
venmo-lunchmoney-ai.timer | Every 30 min | AI-assisted Venmo→LunchMoney reconciliation; notifies via Telegram; state at /var/lib/venmo-lunchmoney-ai/state.json; config at /etc/venmo-lunchmoney-ai.conf |
weekly-report.timer | Sat 10:00 | Runs weekly-report.sh and pipes to purkhiser-bot.sh (sends to Telegram channel) |
clean-macfiles.timer | Hourly | Removes macOS ._* and .DS_Store files from /mnt/documents |
podman-auto-update.timer | Custom schedule | Updates Podman containers tagged with io.containers.autoupdate: registry |
transmission (runs as user evan)9091, whitelist 127.0.0.1, 10.0.0.*, 100.*.*.* (Tailscale), no auth required/transmission/51413 (open on WAN firewall)/mnt/documents/downloads/torrents-complete (done), /mnt/documents/downloads/torrents-incomplete (in progress)transmission-helper-trigger.sh → socket-activated transmission-helper@.service/etc/transmission-helper.conf; socket: transmission-helper.socket/usr/local/bin/purkhiser-bot.sh/etc/purkhiser-bot.conf — Telegram token + channel IDweekly-report, venmo-lunchmoney-ai, transmission-helperpam-ssh-agent — sudo authenticated via SSH agent key (key stored at /etc/security/authorized_keys)pacsync role — standard Arch reposaur role with aur-builder user — packages installed: zrepl, pam-ssh-agentsystemd-timesyncdcd ~/workspace/ansible-personal
ansible-playbook play-server.yml
ansible-playbook play-server.yml --tags <tag>
# Tags: zfs, packages, sshd, network, hardware, pam-ssh-agent, nfs, tailscale, nginx,
# transmission, hass, waitress, meal-log, instagram-saver, venmo-auto-cashout,
# venmo-lunchmoney-ai, atuin, podman-auto-update, zrepl, record-file-history,
# purkhiser-bot, weekly-report, speedtest-monitor, auto-system-update, bambulab-lights-off
sudo systemctl status container-home-assistant
sudo systemctl status container-atuin-server
sudo systemctl status container-atuin-postgres
sudo systemctl status container-atuin-abacus
sudo systemctl status container-waitress
sudo systemctl status container-meal-log
sudo systemctl status container-instagram-saver
systemctl list-timers
sudo systemctl status auto-system-update.timer
sudo systemctl status venmo-auto-cashout.timer
sudo systemctl status venmo-lunchmoney-ai.timer
sudo zfs list
sudo zrepl status
sudo systemctl status zrepl
sudo exportfs -v # show current exports
sudo exportfs -ra # reload exports
sudo nginx -t # test config
sudo systemctl reload nginx # reload without downtime
sudo systemctl status nginx
sudo systemctl status transmission
# Web UI accessible at http://server:9091/transmission/web/ on LAN or Tailscale
journalctl -u container-home-assistant -f
journalctl -u transmission -f
journalctl -u zrepl -f
journalctl -u dnsmasq -f
journalctl -u nginx -f
| Service | Config Path |
|---|---|
| nginx | /etc/nginx/nginx.conf |
| dnsmasq | /etc/dnsmasq.conf |
| systemd-resolved | /etc/systemd/resolved.conf |
| NFS exports | /etc/exports |
| Mosquitto | /etc/mosquitto/mosquitto.conf |
| zrepl | /etc/zrepl/zrepl.yml |
| Home Assistant | /var/lib/hass/configuration.yaml |
| Transmission | ~evan/.config/transmission-daemon/settings.json |
| Atuin | /var/lib/atuin/config/server.toml |
| auto-system-update | /etc/auto-system-update.conf |
| bambulab-lights-off | /etc/bambulab-lights-off.conf |
| venmo-auto-cashout | /etc/venmo-auto-cashout.conf |
| venmo-lunchmoney-ai | /etc/venmo-lunchmoney-ai.conf |
| meal-log | /etc/meal-log.conf |
| instagram-saver | /etc/instagram-saver.conf |
| transmission-helper | /etc/transmission-helper.conf |
| purkhiser-bot | /etc/purkhiser-bot.conf |
| udev rules | /etc/udev/rules.d/99-usb-gocontrol.rules |
| pam sudo | /etc/pam.d/sudo |
| ssh authorized keys (sudo) | /etc/security/authorized_keys |