admin-log: add conflict-free clementine/vs-only paths onto main

2026/2026-08-17--decidim.md

@@ -0,0 +1,43 @@
+# Decidim — decidim.hacktivism.ch (2026-08-17)
+
+Site: **https://decidim.hacktivism.ch/**  
+Port **9027** → Caddy. Stack: `koopa-decidim` + `koopa-decidim-sidekiq` + `koopa-decidim-db` + `koopa-decidim-redis`. Image `decidim/decidim:0.30.8`.
+
+Live: `~/koopa-decidim/` (compose mirror `configs/decidim/`). Secrets only on host (`.env`, `users.env`).
+
+Instance name **hacktivism**. Theme: exchange-dark (gold `#e8a838`, bg `#1a1410`) via `theme/hacktivism.css`. Analog: `configs/lemmy/`.
+
+Admin users are on the host (`~/koopa-decidim/users.env`), not in this repo.
+
+Caddy: `sudo /home/hernani/koopa-caddy/apply.sh`  
+Boot: `scripts/decidim/install-systemd.sh` (linger already yes on koopa).
+
+## Cookie / privacy
+
+Stock Decidim still emits `#dc-dialog-wrapper` (Accept all / essential / Settings). This instance has no third-party trackers; privacy is default.
+
+- CSS: `#dc-dialog-wrapper, .cookies__container { display: none !important; }`
+- JS: `/hacktivism-consent.js` sets `decidim-consent={"essential":true}` if missing
+- Live 2026-08-17: HTML 200, CSS/JS 200, hide rules in public `/hacktivism.css`
+
+## Reboot (checked 2026-08-17)
+
+| Item | Value |
+|------|--------|
+| linger `hernani` | yes |
+| `container-koopa-decidim-db` | enabled + active |
+| `container-koopa-decidim` | enabled + active |
+| `container-koopa-lemmy-db` / `container-koopa-lemmy` | enabled + active |
+| listen | `:9027` `:9026` |
+
+login-health: probes + containers + linger + these units enabled. Loopback HTTP on :9027 is **301** (app wants HTTPS; TLS is Caddy). Probe allows 301. After reboot: login-health only unless asked.
+
+## Public example + isoc
+
+- Process **example** (published, not private): `https://decidim.hacktivism.ch/processes/example`
+  — title **Öffentliche digitale Allmende** (public-by-default reading).
+- Published meeting **Offene Runde: Lesen ohne Konto** + one public proposal + background page.
+- Homepage block `highlighted_processes` published.
+- Participant `isoc` on the host (`users.env`); password not in this repo.
+- Avatar: gold ISOC globe (same crop as Bonfire `@isoc`); host file `~/koopa-decidim/assets/img/isoc-gold.png`, not in this repo.
+- Seed: `scripts/decidim/seed-example.sh` / `configs/decidim/seed_example.rb`.

2026/2026-09-05--hernani-ollama-user+power.md

@@ -0,0 +1,16 @@
+# koopa: hernani user Ollama + power sampling (2026-09-05)
+
+Freigabe: operator — install Ollama under hernani (no root package); loopback only; laptop tunnels.
+
+## Ollama
+
+- Binary: `~hernani/.local/bin/ollama` (v0.33.3 from GitHub `ollama-linux-amd64.tar.zst`)
+- Unit: `~/.config/systemd/user/ollama.service` · `OLLAMA_HOST=127.0.0.1:11434` · enabled
+- Access: SSH as **hernani** from clementine/magikoopa → LocalForward (helper `koopa-ollama-tunnel` → laptop `:11438`)
+- Models: small + exotic pulls (see pull log `/tmp/ollama-koopa-pull-20260905.log`) — prefer ≤3B
+
+## Power / energy
+
+- Deployed `host-power.py` to `~hernani/.local/bin/host-power`
+- Laptop: `remote-power koopa` / `koopa-power` → JSON watts; combo derives Wh
+- RAPL `energy_uj` root-only → quality **estimated** until Freigabe for `enable-host-power-access.sh --apply`

2026/2026-09-07--git-meta-origin-forgejo.md

@@ -0,0 +1,55 @@
+# `$HOME/git/` meta-repo origin on git.hacktivism.ch (2026-09-07)
+
+## Remote
+
+| Item | Value |
+|------|--------|
+| Host | **Forgejo rootless** `https://git.hacktivism.ch/` |
+| Repo | **hernani/git** (meta-repo: non-secret globals only) |
+| Visibility | **private** (`DEFAULT_PRIVATE` template is public — create with `private:true`) |
+| Default branch | `main` |
+| SSH clone (FQDN form) | `git@git.hacktivism.ch:hernani/git.git` |
+| SSH URL (API form) | `ssh://git@git.hacktivism.ch:9200/hernani/git.git` |
+| Local tree | `$HOME/git/` (`PATH[git-root]`) |
+
+Unauth HTTPS browse of a private repo → **404** (expected).
+
+## Local setup (done 2026-09-07 ~14:21)
+
+```bash
+cd "$HOME/git"
+git remote add origin git@git.hacktivism.ch:hernani/git.git
+git push -u origin main
+```
+
+SSH Host `git.hacktivism.ch`: `HostName 127.0.0.1`, `Port 9200`, `User git`, `ProxyJump hernani@koopa`, `IdentityFile ~/.ssh/id_ed25519`.
+
+## Create via One-Shot-Token (on koopa)
+
+Do **not** use xAI / host-expert-ssh mutate for this. SSH as `hernani` → local HTTP **9024**.
+
+```bash
+# unique token name (default gitea-admin may already exist)
+podman exec koopa-forgejo gitea admin user generate-access-token \
+  --username hernani \
+  --token-name "oneshot-git-meta-$(date +%s)" \
+  --scopes write:repository,write:admin \
+  --raw
+# → TOKEN (never log / never commit)
+
+curl -sS -X POST \
+  -H "Authorization: token ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"git","private":true,"auto_init":false,"default_branch":"main"}' \
+  http://127.0.0.1:9024/api/v1/admin/users/hernani/repos
+# expect HTTP 201, full_name=hernani/git
+```
+
+Token delete via API often **403** with those scopes — purge leftover `oneshot-*` in Forgejo UI if needed.
+
+## Related
+
+- This admin-log’s own origin: `2026-07-10--admin-log-origin-forgejo.md` (public)
+- Forgejo install: `2026-07-10--forgejo-rootless.md`
+- Host skill quirk: private repos need explicit `private:true`
+- Meta Must: no secrets / no child worktrees in this Forgejo repo