# Reyna Family Network — Full Inventory Report

**Date:** 2026-07-13 10:51 ET (UTC-4)
**Analyst:** Hermes autonomous subagent (Pi .126)
**Sources:** Deco API (mcp__macmini__deco_list_clients), ping sweep 192.168.68.0/24, arp table, Caddyfile /etc/caddy/Caddyfile on .110, docker ps .110, systemctl .110/.124/.126, Hermes jobs.json, local_devices.yaml, Pi-hole port scan, brain search, instatic project notes, smart-home skill references.

---

## Executive Summary

- **6 Deco M5 mesh nodes** (Office master .1 + 5 slaves: Casita .249, Hallway .246, WashMachine .247, Study .248, Barn .250). Firmware 1.9.4 Build 20260312 all online, all wired backhaul.
- **~29 active LAN clients** seen via Deco + ping sweep. Core infra: FamReynaServer .110 (7.6Gi, 17 containers + Jellyfin systemd + Caddy v2.10.2), iMac .124 (15Gi Ubuntu GNOME, Chrome reyna-bot profile :9222, BareBrowse host), Pi aeropi5 .126/.128 (3.9Gi, 3.3Gi swap used – thrashing, Hermes dashboard :9119 admin/reyna2026), emiserver .119 (EMI API, ports 3000/3001/9000/2283/8081/8082/2342, SSH currently password blocked), Mac-mini-M4 .102 (macOS, MCP server 7331, no docker), plus ESP32/Tactility fleet.
- **Caddy on .110 proxies ~29 domains** (reynafamily.com, photos, auto, emiapi, api.emmint, auth, cloud, affine, llama, dashboard, dns, mattermost, media, docker, blog, mixpost, memos, apps, reyna-cli .113, + aeroreyna.tplinkdns.com). Two static "Hello Reyna" placeholders (reynafamily.com root, apifl.emmint.com).
- **Docker stacks on .110:** 17 containers (Instatic :3002 prod, Immich server+postgres+ml+redis, Portainer :9000/:8000, n8n :5678, Nextcloud :8085+mariadb, Memos :5230, Pi-hole :8086+53, Homarr :7575, Authentik :9080/:9443+postgres+worker, withpostgres postgres, EMI backend :3001). Additional compose files present but not running as containers: AppFlowy-Cloud, Appwrite, Mixpost, Keycloack, Gitea-authentik, Cockpit, HomeAssistant, ghost local dir.
- **Jellyfin:** systemd service (not docker) 780Mi now, peak 2.6Gi – significant RAM hog on 7.6Gi box.
- **Duplicate Nextcloud:** snap.nextcloud.* services active (6 units) alongside docker Nextcloud – double DB, confusion, RAM waste.
- **Devices:** 8 ESP32/Tactility-class identified (see Device Inventory). Highlight: .107 Faith+Grace-Poppy book player 320x240 Tactility F=blue G=purple (MAC a6:b0:e1:af:2f:75, IP .107 currently STALE/offline possibly moved to .108), esp32_screen .123 Waveshare RLCD 4.2" ST7305 N16R8, little32 kitchen voice .122, 3x KidsOS Tactility color screens 5C5C .129, 5690 .112, 591C .113.
- **Automations:** 12 Hermes cron jobs (deco watchdog every 5m – 7694 runs, morning briefing 8am, wind-down 20:30 weekdays, Chiapas flight daily, weekly coding recap Mon 8am, 4 plant feeds, water filtration 90d, flood insurance, Orlando quarterly), Pi crontab (iCloud calendar fetch hourly, daily summary 9am, brain sync 23h every 10m, immich doc reminder 1am, brain git sync), systemd timers (fwupd, apt daily, logrotate, e2scrub weekly). n8n workflows unreachable unauthenticated (auto.reynafamily.com / :5678 requires login).
- **Risks:** Pi .126 swapping, .110 RAM contention Jellyfin + 17 containers + snap nextcloud, .200 offline breaking affine.llama reverse proxies, .107 book player offline, sites.reynafamily.com DNS+Caddy block not yet live (script add-sites-caddy.sh exists), Instatic MCP token expires 2026-10-11, Caddyfile typos (X-Forwardyed-For), mixed LB first to .119+127.0.0.1 but .119 not reachable for SSH, no visible backup verification.

---

## Topology Diagram — Mermaid

```mermaid
graph TB
  Internet((Internet)) --> DecoMaster[Deco Master Office .1\nC0-C9-E3-8C-CE-C8\nWAN->LAN]
  DecoMaster -->|wired| Casita[Casita .249]
  DecoMaster -->|wired| Hallway[Hallway .246]
  DecoMaster -->|wired| WashMach[WashMachine .247]
  DecoMaster -->|wired| Study[Study .248]
  DecoMaster -->|wired| Barn[Barn .250]

  DecoMaster ---|wired| Fam110[FamReynaServer .110 / .136\n7.6Gi\nCaddy v2.10.2 :80/443\nDocker 17 cont]\n  DecoMaster ---|wired| EMI119[emiserver .119\nEMI API :3001/:3000/:9000/:2342]
  DecoMaster ---|wired| Pi126[aeropi5 Pi .126/.128\n3.9Gi 3.3Gi swap\nHermes :9119]
  DecoMaster ---|band5| iMac124[iMac .124 15Gi\nChrome reyna-bot :9222\nBareBrowse]
  WashMach ---|wifi5| MacMini102[Mac-mini-M4 .102\nmacOS MCP :7331\nOllama/MCP]
  Hallway ---|wifi2.4/5| KidsOS[KidsOS fleet .112 .113 .129\nTactility 320x240 book players]
  Office ---|band2.4| ESP32Screens[ESP32 fleet\n.123 RLCD 4.2 ST7305\n.122 kitchen voice\n.107 Faith/Grace Poppy]
  Office ---|wired| Switches[TL-SG108E .100 .115 .117\nManaged switches]
  Office ---|wired| NAS[MyCloudEX2Ultra .111]
  Hallway ---|wifi| IoT[Google Home Mini .106/.100\nBlink .104 LG TV .103 etc]

  Fam110 -->|Caddy reverse_proxy| ExtDomains[~29 ext domains\nreynafamily.com/*.reynafamily.com\n*.emmint.com aeroreyna.tplinkdns.com]
  Fam110 -->|docker| Services[(Instatic :3002\nImmich :2283\nNextcloud :8085\nn8n :5678\nPortainer :9000\nAuthentik :9080\nHomarr :7575\nPi-hole :8086/53\nMemos :5230\nMixpost :9010\nJellyfin :8096 systemd\nEMI backend :3001)]

  Pi126 -->|crons 5m| DecoWatch[Deco watchdog\nMongo snapshot + histogram]
  Pi126 -->|Hermes| Automations[Morning brief 8a\nWind-down 20:30 M-F\nChiapas flight 7a\nCoding recap Mon]

  MacMini102 -.->|MCP| DecoAPI[Deco API]
  MacMini102 -.->|MCP| ESP32MCP

  Fam110 -.->|planned| SitesDomain[sites.reynafamily.com -> :3002\nDNS pending]
  Fam110 -.->|.200 offline| AffineLlama[affine:3010 llama:11434 dead]

```

---

## Live Hosts Table (merged ping + Deco + ARP 2026-07-13 ~10:50 ET)

| IP | Hostname (Deco/ARP) | MAC | Link | Deco Node | Type | Status | Notes |
|---|---|---|---|---|---|---|---|
| .1 | Office Deco master | C0-C9-E3-8C-CE-C8 | wired GW | Office | Router | UP | Firmware 1.9.4 |
| .100 | TL-SG108E-Main / 50CasitaTv? conflicting | 24-2F-D0-BA-3F-DF / E4-F0... | wired/band5 | Office/Hallway | Managed switch / Google Home | UP | .100 reused in scans – TL-SG108E-Main primary |
| .102 | Mac-mini-M4 | 5A-D2-AA-CB-96-08 | band5 158d | WashMachine | macOS | UP | MCP server 7331 |
| .103 | LG | F8-B9-5A-E0-78-52 | band5 | Study | TV | UP | |
| .104 | iot_device / blink-sync-module | A0-85-E3-FB-35-5C / 84-28-59-24-D7-CA | band2.4 both reported | Office/Hallway | IoT Blink | UP | duplicate IP in scans indicates DHCP flap |
| .105 | blink-sync-module (per ARP) | 84-28-59-24-D7-CA | band2.4 | Hallway | IoT | UP | |
| .106 | Google-Home-Mini / 50LivingRoom ambiguous | 48-D6-D5-7B-91-C5 / 84-3E-1D-4F-4A-1D | band5 | Office/WashMachine | Speaker / TV | UP | 50LivingRoom at .106 in earlier sweep, Google-Home-Mini also |
| .107 | Faith+Grace-Poppy Tactility Book Player (expected) | a6:b0:e1:af:2f:75 | – | Office (prev) | ESP32-S3 Tactility 320x240 | STALE/OFFLINE | Ping FAIL 2026-07-13, ARP REACHABLE then STALE, not in Deco snapshot – possibly moved to .108 or power off |
| .108 | Mac (random) | 06-79-91-73-6F-6A | band5 77up/80down | Office | MacBook random MAC? | UP | Could be rotated MAC for .107? Investigate |
| .109 | 50CasitaTv / iPhone | DC-72-23-B1-13-BE / 62-0F-E1-3A-4C-4B | band5 | Barn/Hallway | TV / Phone | UP | IP reused - DHCP churn |
| .110 | adolforeynaserver (FamReynaServer) | 18-60-24-78-DB-E8 / 5e:6f... wlan | wired+wifi | Office | Ubuntu Server | UP 28d | Main Docker host, Caddy, Jellyfin |
| .111 | MyCloudEX2Ultra | 00-00-C0-3C-B8-FF | wired | Office | NAS | UP | |
| .112 | kidsOS-5690 / 50LivingRoom | 14-C1-9F-D1-56-90 / 84-3E-1D-4F-4A-1D | band2.4/band5 | WashMachine | KidsOS ESP32 color 320x240 | UP | hostname kidsOS-5690 |
| .113 | kidsOS-591C / reyna-cli | 14-C1-9F-D0-59-1C | band2.4 | Office | KidsOS ESP32 + reyna-cli :8765 | UP | reyna-cli.reynafamily.com -> :8765 |
| .114 | Mac random / iPhone | 82-A1-8E-D4-03-7A / C6-37-18... | band5 | Hallway | Mac/iPhone | UP | |
| .115 | TL-SG108E / Watch | B8-FB-B3-49-A1-75 / 9E-43-8D-D7-7A-8E | wired / band2.4 | Office / Hallway | Switch / Watch | UP | |
| .117 | TL-SG108E-Main / 50CasitaTv | 24-2F-D0-BA-3F-DF / DC-72-23... | wired/band5 | Office/Casita | Switch / TV | UP | |
| .119 | emiserver | C8-5A-CF-0A-7A-A7 | wired | Office | EMI backend Ubuntu? | UP | ports 3000,3001,9000,2283 open, SSH auth fail |
| .120 | MyCloudEX2Ultra dup / Mac random | 00-00-C0-... / 0E-A4-E4-20-5C-1C | wired/band5 | Office/Hallway | NAS/Mac | UP | |
| .121 | E31868152 / Watch | 80-9F-9B-45-9A-FF / 9E... | band2.4 | Barn/Hallway | ? | UP | |
| .122 | little32 kitchen? / iPhone | 62-0F-E1-3A-4C-4B / kitchen | band5 | Hallway/Office? | ESP32 kitchen voice | UP | little32 .122 per local_devices.yaml |
| .123 | esp32screen / FN-LINK | 90-70-69-35-91-EC / 24-18-C6-B5-4A-DC | band2.4 | Office | ESP32 RLCD 4.2" | UP | Waveshare S3 N16R8 ST7305 |
| .124 | adolforeyna-iMac11-3 / aeroreyna-iMac rename | C8-BC-C8-BB-19-2D | band5 | Office | iMac Ubuntu 15Gi | UP 5d | Chrome reyna-bot, launch-reyna-bot.sh |
| .125 | ubuntu-server | 62-09-3C-AD-75-3C | band5 | Hallway | ? possibly iMac alt? | UP | hostname ubuntu-server per Deco latest |
| .126 | aeropi5 Pi (eth) | 2C-CF-67-95-2B-F8 | wired | Office | Pi 4B 3.9Gi | UP 4d | Hermes dashboard :9119 |
| .127 | iPhone HONOR-X7a / redmi | 14-61-A4-4B-31-53 etc | band5 | Barn | Phone | UP | |
| .128 | aeropi5 wlan + iPad | A2-10-C6-24-C2-0A + 2C-CF | wired+band5 | Hallway/Office | Pi wlan + iPad | UP | Pi has dual IPs .126/.128 |
| .129 | iot_device / kidsOS-5C5C / personal_laptop_screen | A0-85-E3... /14-C1-9F-D0-5C-5C | band2.4 etc | Office | KidsOS ESP32 + Laptop MCP screen | UP | .129 used by multiple logical devices – DHCP overlap |
| .133 | TL-SG108E switch | B8-FB-B3-49-A1-75 | wired | Office | Switch | UP | |
| .150 | Adolfos-iPhone / iphone_mcp | 30-35-AD-68-A3-AB | band5 | Office | iPhone MCP | UP | Verified mcp at :8080 |
| .246-250 | Deco slaves | C0-C9-E3-8C-8D-E8 etc | wired | – | Mesh | UP | .246 Hallway, .247 WashMachine, .248 Study, .249 Casita, .250 Barn |

> **Note:** Deco currently reports 25-29 online clients; ping sweep found 28 responsive; ARP shows 40+ entries including FAILED historical. Some IP reuse indicates DHCP lease churn – consider reserving critical infra (.107,.112,.113,.122,.123).

---

## Services Table (host:port, domain, status, owner)

| Service | Domain(s) | Host:Port | Container/Image or Systemd | Status 2026-07-13 | Owner/Auth | Notes |
|---|---|---|---|---|---|---|
| **Instatic Reyna Family** | planned sites.reynafamily.com, reynafamily.com root Hello? | .110:3002 -> app :3001 | instatic-prod-app-1 ghcr.io/corebunch/instatic:latest | Up 52m healthy | Local .env SECRET_KEY + MCP Bearer imcp_Q…6hQQ token expiry 2026-10-11 | compose.prod.yml postgres:16. Token stored ~/.config/instatic-mcp-token 0600 + ~/.hermes/mcp-servers.d/instatic.json npx mcp-remote --allow-http |
| **Immich Photos** | photos.reynafamily.com + office.reynafamily.com (.119) | .110:2283 | immich_server/ghcr...release + postgres 14-vectorchord + ml + redis | Up 7d healthy | – | Upload location via .env UPLOAD_LOCATION=/mnt/mydisk? Check |
| **Nextcloud prod** | cloud.reynafamily.com + cloud.emmint.com (.119) | .110:8085 | nextcloud_app:33 + nextcloud_db mariadb:11.5 | Up 4w | – | Volume /mnt/mydisk/nextcloud/data+db |
| Snap Nextcloud duplicate | – | snap ports 80? | snap.nextcloud.* 6 services | active running | – | CONFLICT with docker Nextcloud, waste RAM |
| **Pi-hole DNS** | dns.reynafamily.com | .110:8086:80 + 53 tcp/udp | pihole | Up 4w healthy | WEBPASSWORD piholeAdmin | etc-pihole & etc-dnsmasq.d volumes |
| **Homarr Dashboard** | dashboard.reynafamily.com | .110:7575 | homarr latest | Up 4w | OIDC via auth.reynafamily.com app homarr | BASE_URL https, SECRET_ENCRYPTION_KEY hardcoded in compose (should be .env) |
| **Authentik SSO** | auth.reynafamily.com + auth.emmint.com points .119:9000 | .110:9080->9000 / 9443 + postgres + worker | authentik-server-1 2026.5.0 | Up 4w healthy | PG auth | compose .env PG_PASS + SECRET_KEY |
| **Portainer** | docker.reynafamily.com | .110:9000:9000 + 8000 | portainer-ce | Up 4w | – |  |
| **n8n Automation** | auto.reynafamily.com | .110:5678 | withpostgres-n8n-1 + postgres:16 | Up 4w | – | Workflows not readable without auth; hosting compose n8n-hosting/docker-caddy/ also present but current uses same image via withpostgres |
| **Memos** | memos.reynafamily.com | .110:5230 127.0.0.1 bound | memos neosmemo/memos | Up 4w | – | |
| **Jellyfin Media** | media.reynafamily.com | .110:8096 systemd :8096 | jellyfin.service bare metal | Active 4w 780Mi now peak 2.6G swap 173M | – | /usr/bin/jellyfin --webdir --ffmpeg=/usr/lib/jellyfin-ffmpeg/ffmpeg |
| **EMI Backend API** | emiapi.reynafamily.com, api.emmint.com (LB first) | .110:3001 + .119:3001 | emi_backend-app-1 built | Up 4w | Mongo URL env | Node Express, socket.io, web-push, stripe |
| **EMI AER tplinkdns** | aeroreyna.tplinkdns.com:2342 and /photos/* path | .119:2342 proxied via .110 Caddy | ? not on .110 – likely docker on .119 | Port 2342 open on .119, Caddy LB | – | STALE Caddyfile block with typo X-Forwardyed-For |
| **Mixpost Social** | mixpost.reynafamily.com | .110:9010 | mixpost latest + mysql:8 + redis | Not in docker ps? compose exists | – | Should be running but not seen – check `docker compose -f ~/mixpost/docker-compose.yml ps` |
| **Appwrite BaaS** | appwrite.reynafamily.com | .110:8090:80 + 449:443 Traefik | appwrite + traefik + mariadb + redis | Not in docker ps list (maybe down) | – | compose in ~/appwrite/appwrite/ |
| **Ghost Blog** | blog.reynafamily.com | .110:2368 expected | ~/ghost/ host? not container | DOWN / not listed | – | ghost local dir exists but no container – may need `ghost install` or docker ghost |
| **Mattermost Chat** | mattermost.reynafamily.com | .110:8065 expected | ? | DOWN – not in docker ps | – | Caddy points but no container |
| **EMI WP1** | wp1.reynafamily.com | .119:8081 | ? on emiserver | Port open .119:8081? Not scanned but expected | – | |
| **EMI frontend** | emi.reynafamily.com | .119:8082 | ? | ? | – | |
| **REYNA-CLI KidsOS** | reyna-cli.reynafamily.com | .113:8765 | kidsOS custom HTTP :8765 -> Tactility | UP per Caddy reachable? Should be | – | .113 is kidsOS-591C ESP32 |
| **AFFiNE Docs** | affine.reynafamily.com | .200:3010 | ? | .200 offline 100% loss | – | Caddy will 502 |
| **Llama Ollama** | llama.reynafamily.com | .200:11434 | ? | .200 offline | – | |
| **Hermes dashboard** | internal http://192.168.68.126:9119 | .126:9119 uvicorn | hermes-agent local | Up | Basic auth admin / hash scrypt$... password reyna2026? | Config model claude-opus-4-20250514-spark-1.1 via meta API |
| **iMac Chrome bot** | barebrowse? | .124:9222 remote-debug | google-chrome-reyna-bot profile + screensaver kiosk profile | Up | launch-reyna-bot.sh with EXTRA flags to suppress default browser infobar | User data dir ~/.config/google-chrome-reyna-bot + google-chrome-screensaver kiosk at :0 |
| **Mac-mini MCP server** | mcp:// .102:7331 | .102:7331 | macmini MCP custom python | Up per deco traffic 34up/158down | Bearer 85d0b0...8a95 | Serves deco_list_clients, calendar, contacts, notes, reminders, codex image, gemini image etc |
| **Desktop client MCP screen** | 127.0.0.1:8080 | .126 local user service reyna-desktop-client.service | python Screen/desktop_client | Running? per local_devices.yaml | WAYLAND_DISPLAY=wayland-0 | |

---

## Caddy Mapping Table (parsed 2026-07-13 from /etc/caddy/Caddyfile)

| Domain | Upstream | LB | Notes | Health |
|---|---|---|---|---|
| auth.reynafamily.com | 127.0.0.1:9080 | – | Authentik prod | ✅ container healthy |
| git.reynafamily.com | 192.168.68.119:3000 | – | Gitea? Port 3000 open on .119 | ✅ open |
| photos.reynafamily.com | 127.0.0.1:2283 | + X-Forwarded-For/Proto | Immich | ✅ |
| auto.reynafamily.com | 127.0.0.1:5678 | + headers | n8n | ✅ responds auth page |
| emiapi.reynafamily.com | 192.168.68.119:3001 127.0.0.1:3001 | first | EMI API failover LB | ✅ both open |
| api.emmint.com (http+https) | same as emiapi | first + log /var/log/caddy/api.emmint.com.access.log | Production EMI API + log | ✅ |
| apifl.emmint.com | respond "Hello Reyna" 200 + log | – | Placeholder | ✅ |
| reyna-cli.reynafamily.com | 192.168.68.113:8765 | + headers | KidsOS 591C CLI | ✅ IP alive, port 8765 not scanned but expected |
| wp1.reynafamily.com | 192.168.68.119:8081 | + headers | WP1 EMI | ❓ not scanned |
| emi.reynafamily.com | 192.168.68.119:8082 | + headers | EMI frontend | ❓ |
| auth.emmint.com | 192.168.68.119:9000 | + headers | Authentik on emiserver? dupe | ✅ port 9000 open on .119 |
| cloud.emmint.com | 192.168.68.119:8085 | + headers | Nextcloud on emiserver? | ❓ port not scanned .119:8085 |
| affine.reynafamily.com | 192.168.68.200:3010 | Host header upstream | AFFiNE | ❌ .200 offline |
| office.reynafamily.com | 192.168.68.119:2283 | Host header | office maybe PhotoPrism on emiserver | ✅ port 2283 open .119 |
| llama.reynafamily.com | 192.168.68.200:11434 | – | Ollama .200 | ❌ |
| appwrite.reynafamily.com | 127.0.0.1:8090 | – | Appwrite Traefik | ❓ container down |
| dashboard.reynafamily.com | 127.0.0.1:7575 | – | Homarr | ✅ |
| dns.reynafamily.com | 127.0.0.1:8086 | – | Pi-hole admin | ✅ |
| cloud.reynafamily.com | 127.0.0.1:8085 | – | Nextcloud prod | ✅ |
| mattermost.reynafamily.com | 127.0.0.1:8065 | – | Mattermost | ❌ no container |
| media.reynafamily.com | 127.0.0.1:8096 | – | Jellyfin | ✅ systemd |
| docker.reynafamily.com | 127.0.0.1:9000 | – | Portainer | ✅ |
| blog.reynafamily.com | 127.0.0.1:2368 | – | Ghost blog | ❌ down |
| mixpost.reynafamily.com | 127.0.0.1:9010 | – | Mixpost | ❓ container list missing |
| memos.reynafamily.com | 127.0.0.1:5230 | – | Memos | ✅ |
| apps.reynafamily.com | 127.0.0.1:3000 | – | Placeholder for generic 3000 | ❓ no service on :3000 .110 |
| reynafamily.com https | respond "Hello Reyna" 200 | – | Root should be Instatic landing but is placeholder | ⚠️ should point to :3002 via sites.reynafamily.com or root |
| aeroreyna.tplinkdns.com:2342 | http://192.168.68.119:2342 | gzip + HSTS | AER direct | ✅ port open |
| aeroreyna.tplinkdns.com | 127.0.0.1:8081 + handle_path /photos/* → 192.168.68.119:2342 | gzip HSTS | Legacy PhotoPrism? Typo X-Forwardyed-For | ⚠️ typo + 8081 not known |
| http://reynafamily.com, www, photos http | redir https 308 | – | HTTP->HTTPS redirect | ✅ |
| **MISSING** sites.reynafamily.com | SHOULD BE 127.0.0.1:3002 | – | Instatic sites – add-sites-caddy.sh prepared but not deployed | ❌ not in Caddyfile yet |

---

## Docker Stacks per Host

### FamReynaServer .110 (adolforeynaserver) – Primary

- **Caddy v2.10.2** systemd (not docker) reverse proxy, TLS via Let's Encrypt presumably.
- **Jellyfin** systemd 2017 pid 4w up, 780Mi.
- **Docker 17 containers** listed in raw_scans/docker_fam.json (see Services Table).
- **Compose files discovered:** ~/instatic/compose.prod.yml & compose.sqlite.yml, ~/memos/compose.yml, ~/immichframe/docker-compose.yml, ~/EMI_backend/docker-compose.yml (EMI API), ~/homarr/docker-compose.yml, ~/n8n-hosting/docker-caddy/docker-compose.yml (old), ~/immich-app/docker-compose.yml, ~/docker-nextcloud/docker-compose.yml, ~/authentik/compose.yml, ~/appwrite/appwrite/docker-compose.yml, ~/AppFlowy-Cloud/docker-compose.yml, ~/mixpost/docker-compose.yml, ~/keycloack/docker-compose.yml, ~/pihole/docker-compose.yml.
- **Systemd timers:** 16 active incl apt-daily, logrotate, fstrim, fwupd, e2scrub_all weekly.
- **Systemd services:** avahi, bluetooth, caddy, containerd, docker, fwupd, jellyfin, lldpd, mariadb (host), NetworkManager, smbd+nmbd, ollama.service (host Ollama!), snap.* nextcloud.
- **Ollama host** on .110 (ollama.service) – not mapped in Caddy? Check `ollama list`.
- **Storage:** /mnt/mydisk/nextcloud/* volumes.

### Pi aeropi5 .126 – Hermes brain

- **RAM:** 3.9Gi total 2.5Gi used 135Mi free 1.7Gi buff/cache 1.4Gi avail, Swap 4.0Gi 3.3Gi used 730Mi free – distress.
- **Hermes:** config.yaml model claude-opus-4-20250514-spark-1.1 via api.meta.ai, 90 max turns, checkpoint disabled, 30 skills, personality kawaii for display.
- **Dashboard:** http://192.168.68.126:9119 admin/reyna2026 basic_auth scrypt hash.
- **Cron jobs:** 12 jobs (see Automations).
- **Crons dir:** ~/.hermes/cron/jobs.json 12 jobs, output dir 21 subdirs.
- **Deco watchdog:** every 5m script `deco_network_watchdog.sh` → uv run python deco_network_watchdog.py, 7694 completions, stores Mongo snapshot + histogram under ~/.hermes/deco_network/ (fetch_errors.jsonl, histogram_1h.json, last_state.json, latest_snapshot.json, linked_deco_changes.jsonl, new_devices.jsonl).
- **System crontab:** calendar fetch hourly iCloud CalDAV, daily summary 9am, brain sync every 10m sync-brain-to-nextcloud.sh, immich doc reminder 1am python scan_and_remind.py, brain git sync 23h.
- **MCP servers:** mcp-servers.d/instatic.json (Bearer imcp_...), macmini 7331 Bearer 85d0b0.
- **Local devices registry:** ~/.hermes/local_devices.yaml 9 devices + aliases (iphone_mcp .150, esp32_screen .123, little32 .122, personal_laptop_screen .129, local_desktop_screen 127.0.0.1, kidsos_5c5c/5690/591c, robot_arm).
- **Scripts:** ~/.hermes/scripts/ ~20 scripts incl deco watchdog, esp32 thumbs/hi, morning briefing whatsapp, wind-down, Chiapas monitor, voicebox watchdog.

### iMac .124 – AI/Browser node DEFAULT

- **Hostname:** adolforeyna-iMac11-3 / aeroreyna-iMac per latest snapshot.
- **RAM:** 15Gi 2Gi used 5.3Gi free 8.4Gi cache 13Gi avail, Swap 4Gi 13Mi used – healthy.
- **OS:** Ubuntu GNOME 26.04 per chrome version, Node v22.22.1 npm 9.2.0.
- **No Docker.**
- **Chrome profiles:** `~/.config/google-chrome-reyna-bot` (Reyna bot remote-debug :9222), `~/.config/google-chrome/` default, `~/.config/google-chrome-screensaver` kiosk file:///home/adolforeyna/.local/share/screensaver.html --kiosk window pos 0,0 – currently running PID 405707 with GPU process etc.
- **bin:** ~/bin/launch-reyna-bot.sh – exports DISPLAY=:0 with XAUTHORITY from /run/user/1000/.mutter-Xwaylandauth.*, sets DBUS, extra flags --no-default-browser-check --no-first-run --disable-search-engine-choice-screen --disable-features=DefaultBrowserInfobar,ChromeWhatsNew,SearchEngineChoiceTrigger --disable-default-apps --no-service-autorun --disable-infobars, ensures profile dir exists.
- **Projects:** ~/Projects (exists) but not listed; ~/bin has at least launch-reyna-bot.sh.

### emiserver .119

- **Hostname:** emiserver per Deco.
- **Wired to Office master.**
- **Ports open 2026-07-13 scan:** 3000 (Gitea?), 3001 (EMI API), 9000 (Authentik? or Portainer?), 2283 (Immich or Photo?), plus expected 8081,8082,2342,8085.
- **SSH:** blocked (publickey,password denied). Need key deploy via FamReynaServer? Earlier attempt via FamReynaServer SSH forwarding also permission denied – need fix authorized_keys.
- **Caddy targets:** most prod emmint.com domains point here.
- **Cannot fully inventory** due to SSH lockout. Suggest add Pi's key to /home/.../.ssh/authorized_keys via physical or FamReynaServer `ssh-copy-id` after fixing password auth temporarily.

### Mac-mini-M4 .102

- **Hostname:** Mac-mini-M4.local, also Mac per Deco random? Actually Deco shows Mac 5A-D2-AA-CB-96-08 at .102 with high traffic 34up/158down – heaviest client.
- **macOS** zsh, no free or systemctl or docker commands (not Ubuntu).
- **MCP server:** http://192.168.68.102:7331/mcp Bearer token 85d0b0… serves Deco tools, calendar, contacts, notes, reminders, codex/gemini image generation.
- **Role:** Default AI + image generation + Deco API bridge.

### .200 affine/llama (down)

- **Expected:** AFFiNE docs :3010 + Ollama :11434
- **Current:** 100% packet loss ping, no ports open. Possibly powered off. Caddy will return 502 for affine.reynafamily.com & llama.reynafamily.com.

### Other dynamic

- **.113 reyna-cli / kidsOS-591C** – ESP32 Tactility HTTP dashboard on :80 and custom :8765, SD card /data, color screen. Verify via curl http://192.168.68.113/ should redirect to /dashboard.html.

---

## Automations Table

| Type | ID / Name | Schedule | Host | Script / Action | Last Status | Notes |
|---|---|---|---|---|---|---|
| Hermes cron script | 45acb3a9f639 Weekday wind-down habit check | 30 20 * * 1-5 | Pi .126 | reyna_family_wind_down_whatsapp.py → WhatsApp group 120363424746547296@g.us | ok 31 runs | deliver local |
| Hermes cron agent | cb19c96b577c Orlando vacation quarterly | 0 9 1 */3 * | Pi | prompt reviews ~/brain/projects/orlando_vacation_offer_followup_2026.md | ok 1 run | deliver origin WhatsApp Adolfo |
| Hermes once | cda06457fbc5 Check water filtration salt/peroxide | once 2026-07-25 09:00 | Pi | reminder 220 Emerald | pending | based Apr25 → Jul25 90d |
| Hermes script | d0814c3e4751 Chiapas flight price monitor | 0 7 * * * | Pi | chiapas_flight_price_monitor.py Kayak watchdog, prints only if price better | ok 39 runs | deliver origin |
| Hermes script | ba70bfbb43a7 Daily morning briefing | 0 8 * * * | Pi | reyna_morning_briefing_whatsapp.py → WA group | ok 42 runs | deliver local |
| Hermes script | 17b2925745b4 Deco network Mongo snapshot + 1h histogram | every 5m interval | Pi cd ~/reyna-cli uv run | deco_network_watchdog.sh → python : fetches Deco clients via Mac mini tool, stores Mongo, local histogram, linkedDeco changes log | ok 7694 runs | terminal toolset, workdir ~/reyna-cli |
| Hermes once | 36e50805edfc Neptune flood insurance autopay | once 2026-07-23 09:00 | Pi | verify $870.23 TNF4366115 invoice 1821199 220 Emerald | pending | deliver to family group |
| Hermes once x4 | plant feed 07-17,07-31,08-14,08-28 | once dates 09:00 | Pi | "Time to feed the plants" DM Adolfo | pending | |
| Hermes agent | 50b9ca5ec3cb weekly-coding-recap | 0 8 * * 1 | Pi | python3 ~/.hermes/scripts/weekly_coding_recap.py → ~/brain/areas/coding/recaps/ ISO week, update coding.md | scheduled weekly | silent unless fail |
| System crontab Pi | calendar_fetch.py | 0 * * * * | Pi | /home.../calendar_fetch.py iCloud CalDAV published URL p176-caldav… | – | hourly |
| System crontab | calendar_daily_summary.py | 0 9 * * * | Pi | daily summary | – | |
| System crontab | sync-brain-to-nextcloud.sh | */10 * * * * | Pi | ~/.openclaw/workspace/scripts/sync-brain-to-nextcloud.sh | – | every 10m |
| System crontab | immich-doc-reminder scan_and_remind.py | 0 1 * * * | Pi | /home/.../Projects/immich-doc-reminder/... | log /tmp/immich-doc-reminder.log | 1am |
| System crontab | brain_git_sync.sh | 0 23 * * * | Pi | ~/.local/bin/brain_git_sync.sh | – | 23h |
| Systemd timers Fam .110 | fwupd-refresh, apt-daily, apt-daily-upgrade, logrotate, man-db, e2scrub_all, fstrim, etc | various | .110 | 16 timers listed | active | apt daily 03:47, upgrade 06:12, logrotate midnight |
| Caddy | auto TLS renew | internal | .110 | Caddy manages Let's Encrypt for ~29 domains | – | |
| Instatic | publishing flow site slug → live | manual | .110 via UI :3002 | Publish page slug grace-book → https://sites.reynafamily.com/grace-book (once DNS+Caddy) | – | admin UI |
| n8n | unknown workflows – requires auth | – | .110:5678 auto.reynafamily.com | Need login to list workflows; hosting compose may have backups in ~/n8n-backups/ | – | UI returns login page today |
| Chrome kiosk | screensaver.html | @boot via PID 405707 | .124 iMac | google-chrome --kiosk --user-data-dir=...screensaver file:///...screensaver.html | running | separate from reyna-bot profile |
| Chrome bot | launch-reyna-bot.sh | manual / systemd? | .124 | remote-debug :9222 --user-data-dir=...reyna-bot | not currently running per ps – only screensaver chrome seen | launch via ~/bin/launch-reyna-bot.sh |

---

## Device Inventory (ESP32 / Pico / Tactility etc)

| DeviceID | Type | Name | Project | IP | MAC | Purpose | Status | Last Seen | Location | Notes |
|---|---|---|---|---|---|---|---|---|---|---|
| esp32_screen | ESP32-S3-RLCD | ESP32 Screen (main) | Waveshare ESP32-S3 4.2" RLCD testbed | 192.168.68.123 | 90-70-69-35-91-EC | Display, screenshot, sensors, video stream, ble_scan | reserved_ip | 2026-07-13 per Deco latest | Office | Waveshare ESP32-S3-WROOM-1-N16R8 16MB Flash 8MB PSRAM ST7305 300×400 reflective, dual mics, RTC, SHTC3, TF battery. Driver repo micheleaiello/ESP32-S3-4.2inch-RLCD-Driver pins MOSI=12 SCK=11 DC=5 CS=40 RST=41. MCP at :80 verified 2026-06-05. |
| little32 | ESP32-S3-screen-audio | Little32 Kitchen ESP32 Screen | Kitchen voice button / Hermes voice gateway | 192.168.68.122 | 62-0F-E1-3A-4C-4B (shared with iPhone rand?) | Display, touch, audio, mic, file_transfer, python | discovered_ip | 2026-06-20 verified ESP32 screen/audio MCP set | Kitchen | Smaller lower-pixel display, keep images simpler high-contrast. Preferred say_hello play_audio_base64. |
| faith_grace_poppy_107 | ESP32-S3-Tactility Book Player | Faith + Grace-Poppy 320x240 F=blue G=purple | Grace/Poppy Storybook Image Voice App – Book Player Tactility app | 192.168.68.107 (expected) | a6:b0:e1:af:2f:75 | Storybook image+audio synced playback | STALE/OFFLINE | 2026-07-13 ARP REACHABLE→STALE, ping fail | Kids room? | From task memory: Faith+Grace-Poppy 320x240 F=blue G=purple Tactility book player. Package /home/adolforeyna/grace_poppy_esp32_package.zip, extracted /home/.../output/grace_poppy_existing/pages_300x400 + mp3. Final ESP32 320x240 ZIP /home/.../output/imagegen/grace-poppy/grace-poppy-generated-all-esp32-320x240.zip. Mp3Player app + AudioTest .123. SD card /sdcard /data. |
| kidsos_5c5c | ESP32-S3-Tactility KidsOS color | KidsOS 5C5C ESP32 Color Screen | Tactility KidsOS dashboard | 192.168.68.129 (shared) | 14-C1-9F-D0-5C-5C | Color screen dashboard, file_transfer, sdcard | mdns_dhcp | 2026-07-02 verified /dashboard.html /fs/list | – | Hostname kidsos-5c5c.local, MAC derived. .129 conflicts with personal_laptop_screen – reserve. |
| kidsos_5690 | ESP32-S3-Tactility KidsOS color | KidsOS 5690 ESP32 Color Screen | Tactility | 192.168.68.112 | 14-C1-9F-D1-56-90 | Dashboard sdcard | mdns_dhcp | 2026-07-02 verified | WashMachine Deco | kidsos-5690.local |
| kidsos_591c_reyna_cli | ESP32-S3-Tactility KidsOS color + reyna-cli | KidsOS 591C ESP32 + reyna-cli service :8765 | reyna-cli.reynafamily.com backend | 192.168.68.113 | 14-C1-9F-D0-59-1C | Dashboard + custom HTTP 8765 CLI | UP | 2026-07-13 ping alive, Caddy proxy target | Office | reyna-cli.reynafamily.com proxies here. |
| robot_arm | Robot Arm MCP | Robot Arm MCP | Robot arm experiments | 192.168.68.116? fallback .116 | – | arm_motion ble_scan file_access execute_python | mdns_or_reserved | per local_devices.yaml | – | Home pose base70 shoulder40 elbow20 pitch90 roll90 grip90. Use get_arm_state before motion. |
| personal_laptop_screen_129 | Laptop MCP Screen | Personal Laptop MCP Screen | Laptop companion client | 192.168.68.129 | – | Full MCP screen 8080 video tcp/udp audio mic file_transfer | discovered_ip | 2026-06-14 smoke test clear_screen draw_text etc | – | Runs? Verify 192.168.68.129:8080/api/mcp – screenshot confirmed text |
| iphone_mcp_150 | iPhone MCP | iPhone MCP | Voicebox / camera | 192.168.68.150 | 30-35-AD-68-A3-AB | display screenshot battery audio mic camera file_transfer video | reserved_ip | 2026-06-05 verified at .150:8080 | – | TTS workflow: mono 16kHz PCM WAV base64 → play_audio_base64 |
| esp32_133_more | ESP32-S3 ? | Test devices for imagegen | grace_poppy tests | – | – | Testing grace pages 130 lowbitrate | – | See /home/.../Projects/... play_grace_pages_130.py | – | From ~/Projects listing basic1 brain-browser eink_api etc |
| **Potential Pico Pi** | RP2040 / Pico W? | Not found in scan | None | – | – | – | Not found | – | – | search_files found no pico platformio.ini |

> Full living inventory maintained separately in `devices_inventory.md`.

---

## Risks / Optimizations

### Critical Risks

1. **Pi .126 Swap Thrashing:** 3.9Gi RAM 2.5Gi used, swap 3.3Gi/4Gi used, only 135Mi free. Load 1.7 avg, up 4d. Hermes + deco watchdog every 5m + brain sync every 10m + Chrome? Risks OOM kills, SD wear, missed crons. Move heavy tasks to iMac .124 (15Gi 13Gi free). Disable `snapd`? Not present.
2. **FamReynaServer RAM contention:** 7.6Gi total 4.7Gi used + 2.1Gi swap used, 17 docker containers + Jellyfin 780Mi peak 2.6Gi + host mariadb + snap nextcloud 6 services + ollama host. Risk: Jellyfin transcode spikes OOM. Mitigate: migrate snap nextcloud to docker only (disable snap), limit Jellyfin transcode threads, set docker memory limits, consider zram.
3. **.200 offline:** affine.reynafamily.com and llama.reynafamily.com 502. Need power check, enable WoL, or remove Caddy blocks if retired.
4. **.107 Faith/Grace book player offline:** Ping fail, ARP STALE, not in Deco snapshot. Could be power, WiFi, or IP moved to .108. Impact: storytime broken. Check physical device, assign DHCP reservation .107 a6:b0:e1:af:2f:75.
5. **SSH lockout emiserver .119:** Cannot inventory .119 fully, cannot rotate keys. Port scan shows services alive but SSH password auth fails, publickey denied. Need to restore Pi's key via FamReynaServer local console or mount SD.
6. **Caddyfile issues:** Typo `X-Forwardyed-For` in aeroreyna.tplinkdns.com block (line ~). Duplicate Nextcloud blocks (cloud.reynafamily.com and cloud.emmint.com same target type). Mixed LB first without health check to .119 which may be down. Missing sites.reynafamily.com block – Instatic publishing blocked until DNS+ Caddy deployed.
7. **Instatic token expiry 2026-10-11:** MCP Bearer token stored plaintext in ~/.hermes/mcp-servers.d/instatic.json + ~/.config/instatic-mcp-token 0600. No auto-rotation. Set reminder weekly-coding-recap already? Add cron 90d before expiry.
8. **Chrome profiles bloat:** iMac runs both screensaver kiosk profile (~300Mi) + reyna-bot profile on demand. Flags suppress infobar but still may show after update. launch-reyna-bot.sh uses `ls -t /run/user/1000/.mutter-Xwaylandauth.*` fragile to Wayland restart. Use `systemd-run --user` or `gnome-extensions`?
9. **Duplicate Nextcloud (snap vs docker):** Both running, double MySQL, double cron, confusion for brain sync which points where? `sync-brain-to-nextcloud.sh` probably uses Nextcloud's WebDAV – which instance? Needs audit.
10. **No backup verification:** `~/nextcloud-backups/`, `~/portainer-backups/`, `~/n8n-backups/` exist per ls, but no recent timestamps checked. Pi-hole FTL.db SQLite binary can't be `cat` – need sqlite3 dump. No offsite.

### Optimizations

- **Assign DHCP reservations** in Deco for critical infra: .110,.102,.119,.123,.122,.107,.112,.113,.126 reserve (currently dynamic). Use Deco app or API.
- **Remove snap nextcloud:** `sudo snap stop nextcloud && snap disable nextcloud` after confirming docker Nextcloud is primary (check ~/brain sync script destination). Saves ~500Mi RAM.
- **Move Jellyfin transcode to RAM /tmp or limit:** config `/etc/jellyfin/encoding.xml` transcode thread count.
- **Sites CNS:** Deploy `add-sites-caddy.sh` now: `sudo bash ~/add-sites-caddy.sh` on .110, then Cloudflare/Namecheap add A record sites.reynafamily.com → public IP (same as reynafamily.com). Verify `curl -k https://sites.reynafamily.com/`. Then update Instatic site settings Base URL.
- **Fix Caddyfile typo:** sed `Forwardyed`→`Forwarded`, run `caddy fmt --overwrite && caddy reload`.
- **Pi swap mitigation:** Enable zram (`sudo apt install zram-tools`), move heavy python venvs to iMac, reduce deco watchdog histogram retention, add monitoring job for swap >80% alert via WhatsApp.
- **Emiserver SSH fix:** On .110, try `ssh -o PasswordAuthentication=yes` if password known, or physical keyboard add Pi's `~/.ssh/id_ed25519.pub` to `~/.ssh/authorized_keys` on .119. Check if .119 is actually .110's own bridge IP confusion (docker net 172.x). Actually .119 may be separate physical Pi.
- **iMac Default for AI:** Move OpenAI/Claude heavy tasks to iMac .124 where 13Gi free RAM, Node 22, Chrome GPU. Use `ssh imac` as default as noted – implement task router.
- **Instatic token rotation SOP:** Document BareBrowse flow: launch reyna-bot profile → open http://192.168.68.110:3002/admin → Generate token → label hermes → save to ~/.config/instatic-mcp-token + update mcp-servers.d JSON. Set quarterly reminder already exists as quarterly? Add specific 90d before expiry (2026-07-11 next).
- **Device naming:** Use local_devices.yaml aliases everywhere (kid1/2/3, little32, rlcd, etc) to avoid IP churn.
- **Monitor .200:** Add deco_network_watchdog to track .200 up/down, alert if down >10m.

---

## Recommendations Prioritized

### P0 (this week)

1. **Fix .107 Faith/Grace book player offline** – power cycle, check /dashboard.html, reserve IP .107 MAC a6:b0:e1:af:2f:75 in Deco app, verify new KidsOS Book Player app works with 320x240 blue/purple theme.
2. **Fix emiserver .119 SSH** – restore key-based access from FamReynaServer and Pi. Inventory docker on .119 (`docker ps` list was unknown). Document compose files.
3. **Deploy sites.reynafamily.com** – run `sudo bash ~/add-sites-caddy.sh` on .110, add DNS A record, test live, update Instatic doc.
4. **Fix Caddy typo + validate** – `grep -n Forwardy ed` fix, `caddy validate`, reload.
5. **Pi swap remediation** – install zram-tools, reboot, check `free -h`, consider moving brain sync script to 30m interval, reduce deco snapshot retention, maybe migrate Hermes dashboard to .110 or .124.

### P1 (this month)

6. **Remove snap Nextcloud duplicate** after confirming which Nextcloud brain sync uses. Save ~500Mi RAM on .110.
7. **Resolve .200 offline** – power on or decommission affine/llama Caddy entries (comment out with `handle`?).
8. **DHCP reservations** for all infra .100-.133 via Deco app, align with local_devices.yaml reserved_ip fields.
9. **Backup verification cron** – weekly job that lists ~/nextcloud-backups, portainer-backups, n8n-backups age and posts to WhatsApp if >7d stale.
10. **Instatic token rotation reminder** – update weekly-coding-recap or create once at 2026-09-20 (21d before 10/11 expiry) with SOP.

### P2 (next quarter)

11. **Centralize monitoring** – Homarr dashboard currently proxies but not populated with all services health – add healthchecks for Jellyfin, EMI API, Immich, Nextcloud.
12. **Migrate heavy AI to iMac .124** – set Hermes delegation to iMac for Chrome/BareBrowse tasks, keep Pi as orchestrator light.
13. **Document ESP32 fleet SOP** – firmware update flow Tactility, book-package layout `/sdcard/books/<slug>/page_XX.jpg + .mp3 + transcript.txt`, how to push new books via `send_esp32_thumbs_all.py`, etc – already partially in brain/projects/grace_poppy_storybook_image_voice_app.md – link in devices_inventory.
14. **Security hardening** – rotate hardcoded homarr SECRET_ENCRYPTION_KEY into .env, Nextcloud mariadb HardPasswordToGuess1234! rotate, pihole WEBPASSWORD piholeAdmin rotate, remove password auth.
15. **Network segmentation** – consider VLAN or separate SSID for ESP32 IoT vs main – currently all main, but okay for home.

---

## Raw Data References

- `~/brain/areas/network/raw_scans/hosts_live.json` – ping sweep + ARP
- `~/brain/areas/network/raw_scans/deco_clients.json` – latest_snapshot.json Deco
- `~/brain/areas/network/raw_scans/docker_fam.json` – docker ps on .110
- `~/brain/areas/network/raw_scans/caddy_parsed.json` – Caddyfile reverse_proxy mapping
- `~/brain/areas/network/raw_scans/crons.json` – Hermes jobs.json + pi crontab
- `~/.hermes/deco_network/latest_snapshot.json` – full Deco snapshot 25 clients
- `~/.hermes/local_devices.yaml` – canonical device registry
- `/etc/caddy/Caddyfile` on .110 – source of truth Caddy v2.10.2
- `~/add-sites-caddy.sh` – provisioner for sites.reynafamily.com
- `~/brain/projects/instatic_reyna_family_2026.md` – token expiry 10/11/2026 note
- `~/brain/projects/grace_poppy_storybook_image_voice_app.md` – book player workflow

---

## Appendix — Key File Paths

- FamReynaServer: `/etc/caddy/Caddyfile`, `~/instatic/compose.prod.yml`, `~/.env`, `~/immich-app/`, `~/docker-nextcloud/`, `~/authentik/`, `~/EMI_backend/`, `~/homarr/`, `~/pihole/`, `~/add-sites-caddy.sh`
- Pi: `~/.hermes/config.yaml`, `~/.hermes/cron/jobs.json`, `~/.hermes/scripts/`, `~/.hermes/deco_network/`, `~/.hermes/local_devices.yaml`, `~/brain/`, `/home/.../reyna-cli/`
- iMac: `~/bin/launch-reyna-bot.sh`, `~/.config/google-chrome-reyna-bot/`, `~/.config/google-chrome-screensaver/`, `~/.local/share/screensaver.html`
- Deco: API via Mac mini MCP `mcp__macmini__deco_list_clients` – data in `~/.hermes/deco_network/`

---

*Generated by Hermes agent autonomous scan 2026-07-13. Next update recommended weekly via cron `weekly-coding-recap` or manual re-scan.*
