From d75bd587921b4876dc8ec316e7d30418e65c32e0 Mon Sep 17 00:00:00 2001
From: jhodgkin <jhodgkin@gmail.com>
Date: Sun, 12 Jul 2026 20:42:05 -0600
Subject: [PATCH] docs: update CLAUDE.md for SSH collector + Vaultwarden entry

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 CLAUDE.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 409124b..c9c5d62 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -22,8 +22,12 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
   in `apps/api/src/index.ts`. Adding a new data source = new collector + config entry, no other wiring.
   - `ProxmoxCollector` (done): one API call to `pve` returns CPU/mem/disk **and PSI pressure**
     (`pressurecpusome`, `pressurememoryfull`) for the host + every LXC. Covers ~22 of ~24 machines.
-  - Everything else (SSH collector for `.180`/`.171`, network discovery, Zabbix alerts) is filed as
-    backlog issues, not yet implemented.
+  - `SshHostCollector` (done): covers `.180` (omv) and `.171` (ripper), the bare-metal boxes Proxmox
+    can't see. Dedicated SSH key with a **forced `command=`** in the remote `authorized_keys` — the
+    server always runs a fixed read-only script regardless of what's exec'd, so a leaked key is still
+    contained. See `docs/ssh-collector-key-setup.md`, including the gotcha that `diskPaths` in
+    `hosts.yaml` must be kept in sync **by hand** with the remote script's `DISK_<label>=` lines.
+  - Everything else (network discovery, Zabbix alerts) is filed as backlog issues, not yet implemented.
 - Auth: local (bcrypt + signed session cookie) is live. `AUTH_MODE=oidc` is a stubbed config value only —
   Authentik wiring is issue #12, not implemented.
 
@@ -35,6 +39,10 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa
 - **Deployment**: CT122 (`homelab-monitor`, 192.168.1.103), unprivileged LXC on `pve`, Docker + Compose.
   SSH alias `homelab-monitor` in `~/.ssh/config` (root, key-based). Not yet exposed externally — see
   issue #13 (needs NPM proxy host + Cloudflare tunnel route).
+- **SSH collector key**: `monitor_ed25519` keypair lives only at `/opt/homelab-monitor/ssh/` on CT122
+  (gitignored, not in the repo). Public key installed on `omv` and `ripper` with a forced command —
+  see `docs/ssh-collector-key-setup.md`.
+- **Vaultwarden**: dashboard admin credentials saved as "Homelab Monitor (dashboard admin)".
 
 ## Known gaps / explicitly deferred (see issues for detail)