# Ticket: Move Pi instance to server

## Metadata
- Type: Ticket
- Status: Done / follow-ups split
- Project: Nimrod / Homelab Operations
- Created: 2026-06-06
- Updated: 2026-06-06
- Priority: High

## Goal

Move this Pi/Nimrod working instance from the current local environment to a server-hosted environment so the assistant workspace is more durable, available, and closer to homelab infrastructure.

## Why

A server-hosted Pi instance can improve continuity for agent work, reduce dependency on the current local container/session, and provide a stable place for long-running operations, remote administration, and multi-agent coordination.

## Scope

Included:
- Decide target host/VM/LXC
- Define storage, backup, secrets, SSH, and access model
- Move or clone the Nimrod repository safely
- Preserve git history and current working state intentionally
- Configure Pi, project extensions, SSH keys, tokens, and known hosts safely
- Verify that Pi can operate from the server context

Not included:
- Exposing Pi publicly without explicit approval
- Moving unrelated personal secrets without a secrets-management plan
- Running autonomous agents continuously without controls

## Acceptance Criteria

This ticket is done when:
- [x] Target server/VM/LXC is selected — dedicated Proxmox LXC 104 `nimrod` at `192.168.0.222`.
- [x] Security model is documented — LAN-only manual SSH, key-only `piagent`, no public exposure; see change log and inventory.
- [x] Migration plan includes backup/rollback — base snapshot `base-runtime-repo-20260606`; rollback notes in `docs/server-change-log.md`.
- [x] Nimrod repo is present on the server — `/home/piagent/projects/nimrod` at commit `052f1a5`.
- [x] Pi runs successfully from the server context — `pi --version` returns `0.78.1` under Node `v22.22.3`.
- [x] Required project extensions/tools work — smoke test confirmed by user: this Pi session is running from LXC 104 `nimrod`.
- [x] SSH access to managed hosts works from the server, as approved — LXC 104 verified SSH key access to Proxmox `buntbox01`.
- [x] Current local working state is either committed, archived, or intentionally transferred — repo state committed as `052f1a5` before transfer; migration documentation updates are committed after this ticket cleanup.

## Decisions

- Target: new dedicated Proxmox LXC rather than existing guest.
- Initial run model: manual SSH workflow, not systemd/autonomous service or web UI.
- Secrets/access material: copied only approved assistant SSH key/known_hosts and Proxmox token; Google token material was not copied.
- Canonical Git remote: deferred; current transfer used committed local repo state via git bundle.
- Hostname: use `nimrod.dropcutstud.io` as the intended internal service/admin name when the internal DNS/Tailscale naming standard is implemented.
- Network access: keep LAN-only for now; add Tailscale under the internal DNS/Tailscale ticket rather than making an ad hoc change here.
- Backup/update cadence: rely on the current Proxmox snapshot for rollback, then fold LXC 104 into the managed VM/LXC backup and update standards.
- Proxmox bootstrap token: reduction/rotation is required but moved to the consolidated secrets/access-management work so it can be done deliberately without breaking current administration.

## Plan / Next Actions

- [x] Triage current dirty repo state before migration
- [x] Choose target host and isolation model
- [x] Draft migration plan inline with safety gates and questionnaire decisions
- [x] Commit current Nimrod repo state before transfer
- [x] Perform bootstrap migration in a reversible way
- [x] Verify Pi binary and remote-admin SSH operation from LXC 104
- [x] Smoke-test an actual interactive Pi session from `/home/piagent/projects/nimrod` — confirmed by user in live LXC session.
- [x] Decide hostname/Tailscale/backups/update cadence — documented as defaults/deferred follow-ups above.
- [x] Split Proxmox bootstrap token reduction/rotation to consolidated secrets/access-management work.
- [x] Commit migration documentation updates

## Notes

- User correctly identified that a subagent should have been used for the install pass. Recovery used reviewer and implementer subagents for state review, runtime/repo setup, and secret transfer.
- LXC 104 `nimrod` is live at `192.168.0.222` with snapshot `base-runtime-repo-20260606`.
- Smoke test confirmed: current Pi session is running from LXC 104 `nimrod` in `/home/piagent/projects/nimrod`.
- This ticket depends on repo/workspace isolation decisions and should not blindly copy ambiguous dirty state.
- Follow-ups after closing this ticket: internal DNS/Tailscale registration, managed backup/update enrollment, and Proxmox bootstrap token reduction/rotation.