Setting up a new client VPS (194.164.95.50) for a B2B fresh produce business requiring a web-based database with role-based access control, similar to the GP Booking App architecture.
194.164.95.50rootclient-infra (bridge, 172.18.0.0/16)wikijs, forgejo, keycloak/opt/postgres/pw.txtixgwikijs, forgejo/opt/postgres/kc-admin-pw.txtagents/vps-system-prompt/opt/wiki-manage.py/opt/kcadmin.sh — Keycloak admin CLI wrapper/opt/wiki-manage.py — Wiki.js page management via DB/auto-loginThe user matthew_ixg cannot log in via Keycloak SSO — the redirect back to Wiki.js fails. Other users (testuser) work fine. The issue is being investigated. Root cause appears to be related to:
@exlinc/keycloak-passport passport strategyThe IXG box now runs the same async handoff model as the primary: the two agents exchange notes
through its own Wiki.js instead of ad-hoc file drops. Previously the only channel was one-way briefs in
/opt/opencode/tasks/ (e.g. the User Guides Viewer brief) — those still stand.
Created on the IXG wiki (with the box's own /opt/wiki-manage.py): section agents/handoff/ holding
index (protocol: note format, never-run-both-agents, cold-start bootstrap, token-efficiency rules,
monthly archiving), the two inboxes from-hermes / from-opencode, and the two resume notes
hermes-resume / opencode-resume. from-hermes carries one seeded Status: OPEN note telling
OpenCode to read the protocol, start its resume note and check the inbox each session.
Both agents now point at it — all of the layers that actually load:
~/.hermes/SOUL.md and all threeixg-docs, ixg-marketing, ixg-demo), because the profiles are what run the/root/AGENTS.md — the file OpenCode actually reads, since it is~ — and also into the older /opt/opencode/agent/AGENTS.md workspace copy, so theAll six files were backed up (*.bak-20260917) before the append. /opt/hermes-skills-sync.py was run
so the agents/hermes/skills/soul mirror reflects the new SOUL.md (0 pending changes).
Verified: all five pages read back, return HTTP 200 both locally and on the wiki's own domain, and
render with the right titles; the agents/handoff node is isFolder=true with all five children in the
sidebar; every write reported Render: OK; hermes doctor reports no config errors (only the
pre-existing missing ~/.local/bin/hermes symlink and optional API keys).
Open findings on the box — user decision, not actioned:
/root/AGENTS.md and/opt/opencode/agent/AGENTS.md) list the Keycloak, Forgejo and Postgres passwords plus a Forgejo OIDChome page call IXG a "B2B fresh produce/opt/wiki-manage.py is the early copy (~7.7 KB: --get/--list +--folder, --move, --archive, --prune, --dedupe). The protocol's monthly