# Project Status

> **Last Updated:** 2025-12-03
> **Version:** 0.11.0-pydantic-ai

## Current Phase

**Active Work:** AI Infrastructure Optimization & System Hardening
**Status:** ✅ **STABLE** - PydanticAI Implementation Complete, All Systems Operational

See [PLANS.md](PLANS.md) for complete implementation roadmap and [CHANGELOG.md](CHANGELOG.md) for version history.

## In Progress

### Priority 1: Security & SSO Implementation (Authentik)
- [x] **Milestone 1: Authentik Deployment**
  - [x] Deploy Authentik server and worker containers
  - [x] Configure shared PostgreSQL database (authentik_user, authentik database)
  - [x] Configure shared Redis (DB 0)
  - [x] Fix health checks (Python urllib instead of wget/curl)
  - [x] Create NPM proxy host for auth.schweitz.net
  - [x] Generate admin recovery key and set password
  - [x] Memory optimization: 563MB total (80-90% reduction vs previous attempt)

- [x] **Milestone 2: Google OAuth Integration**
  - [x] Create Google OAuth credentials (Client ID/Secret)
  - [x] Configure Authentik Google source via API
  - [x] Configure identification stage to show social login
  - [x] Test Google OAuth login (successful)
  - [x] Verify user creation (jpmschweitzer@gmail.com - external type)

- [x] **Milestone 3: Forward Auth for Organizr** ✅ COMPLETE (2025-11-21)
  - [x] Create Authentik Proxy Provider (Organizr Proxy) via API
  - [x] Create Authentik Application (Organizr) via API
  - [x] ~~Assign provider to embedded outpost~~ (embedded outpost failed)
  - [x] **Deploy standalone outpost container** (authentik-proxy on port 9443)
  - [x] Configure Redis connection for standalone outpost
  - [x] Verify outpost endpoints operational
  - [x] **Configure NPM forward auth for home.schweitz.net**
  - [x] Test SSO access to Organizr (Google OAuth login working)
  - [x] Verify no redirect loops
  - [x] Fix Organizr auto-login (moved headers to location / block)

**Resolution:** Embedded outpost has version-specific issues in 2024.8.4. Deployed standalone `authentik-proxy` container successfully. Forward auth fully operational with Organizr auto-login working.

**Standalone Outpost Details:**
- Container: `authentik-proxy` (port 9445:9443)
- Status: ✅ Healthy (websocket connected, ping endpoint responding)
- Memory: ~150MB
- Provider: Organizr Proxy (forward_single mode)
- Token: `9blMGz71CFMJszs7AedQefgydpTnwvybjmMn0AlYilIKBV5LIq7snqnCodwX`

**NPM Configuration:**
- Applied to: home.schweitz.net (Organizr) ONLY
- Forward auth: https://localhost:9445/outpost.goauthentik.io (NPM on host network)
- WebSocket support: Enabled
- Headers: X-authentik-username, X-authentik-email, X-authentik-groups, X-authentik-name, X-authentik-uid
- Status: ✅ Fully operational, tested in incognito

**Critical Fix:** Authentication headers must be set inside `location /` block, not at server level, for proper forwarding to backend applications.

### Priority 2: Core-API Refactoring & Infrastructure Management ✅ COMPLETE
- [x] **Code Cleanup:** Restructure Core API into function-specific controller files
  - [x] Create `/controllers` directory structure
  - [x] Create `/clients` directory structure
  - [x] Create `base.py` controller base class
  - [x] Add infrastructure settings to `config.py`
  - [x] Create credentials management system
  - [x] Update `main.py` routing to include infrastructure controller
  - [x] Separate AI Orchestrator logic into `ai_controller.py`
  - [x] Extract webscraper to `tools_controller.py`
  - [x] Create `health_controller.py` for monitoring endpoints

- [x] **Infrastructure Management Controller:** Build automation API for service management
  - [x] Portainer Integration (HTTP client with access token)
  - [x] NPM Integration (HTTP client with JWT bearer token + auto-refresh)
  - [x] Read/List Endpoints (all implemented & tested)
  - [x] Write Endpoints (POST/PUT/DELETE all implemented & tested)
  - [x] Portainer API Token generated programmatically
  - [ ] Uptime Kuma Integration (deferred - complex Socket.IO)
  - [ ] Replace ad-hoc shell scripts in `/stacks` with API endpoints
  - [ ] Add CLI wrapper for common operations

### Priority 3: AI Orchestrator Phase 2 (Memory Systems) ✅ COMPLETE
- [x] Implement Tier 1: ConversationBufferMemory (in-memory, last 10 turns)
- [x] Implement Tier 2/3: Unified Qdrant storage (persistent + semantic search)
- [x] Create Qdrant collection (core_api_conversations with 768d nomic-embed-text)
- [x] Implement auto-consolidation service (triggers at 10 turns)
- [x] Add memory persistence across container restarts
- [x] Implement dual-retrieval (buffer + Qdrant)
- [x] **Phase 2.5: Multi-Tenancy** (user_id isolation with default "llm-testuser")

**Implementation Details:**
- **Tier 1 (Buffer):** In-memory storage for last 10 turns (< 1ms access)
- **Tier 2/3 (Qdrant):** Unified persistent storage + semantic search (768d embeddings)
- **Auto-Consolidation:** Automatically moves buffer → Qdrant at 10 turns
- **Multi-Tenancy:** Single collection with user_id filtering (default: "llm-testuser")
- **Embedding Model:** nomic-embed-text (768 dimensions, via Ollama)
- **Memory Retrieval:** Dual-check buffer + Qdrant for cross-restart persistence
- **Status:** 32 points stored, tested with multiple users, recall working after restarts

### Priority 4: AI Orchestrator - PydanticAI Implementation ✅ COMPLETE (2025-12-03)
- [x] **Phase 3:** Research Capabilities (web search, web scraping) - COMPLETE
- [x] **Framework Cleanup:** Remove obsolete frameworks (ADK, LangChain, LangGraph, OllamaNative)
- [x] **PydanticAI Agent:** Primary agent with tool calling and memory support
- [x] **Tool System:** Local tools + OpenAPI discovery from core-api
- [x] **Memory Integration:** 3-tier system with Qdrant vector storage
- [x] **Code Cleanup:** Removed all diagnostic files and obsolete implementations
- [x] **Documentation Update:** Updated all docs to reflect PydanticAI architecture
- [x] Production testing and validation

**Current Implementation (as of 2025-12-03):**
- **Framework:** PydanticAI with native Ollama SDK
- **Model:** mistral-nemo:latest (optimized for tool calling)
- **System Prompt:** Tatlock persona with infrastructure tool guidance
- **Agent:** PydanticAgent (primary) + SimpleLiteLLMAgent (fallback)
- **Tool Discovery:** Local tools + OpenAPI auto-discovery from core-api
- **Architecture:** Clean PydanticAI-only implementation

**Tools Available:**
- **Core Tools (6):** get_current_time, get_current_date, calculate_date_difference, add_days_to_date, calculate, web_search
- **Infrastructure Tools (28+):** Discovered via OpenAPI from core-api (services, DNS, domains, monitoring, etc.)

**Benefits:**
- ✅ Type-safe tool definitions with Pydantic validation
- ✅ Native Ollama SDK integration (no compatibility layers)
- ✅ Dynamic tool discovery via OpenAPI spec
- ✅ Clean architecture with single framework
- ✅ Better maintainability (no framework confusion)

**Performance Metrics:**
- **Simple queries:** ~1-3s response time
- **Tool-using queries:** ~2-8s response time
- **Memory:** Persistent across restarts via Qdrant
- **VRAM usage:** ~4-6GB with mistral-nemo:latest

**Optional Future Enhancements (deferred):**
- Multi-agent routing patterns (Phase 4+)
- Code specialist agent with codestral (Phase 4+)
- Time-based memory consolidation
- User filtering in Qdrant queries
- User management API endpoints

## Current Blockers

**None** - SSO implementation complete for critical services. Remaining service rollout deferred in favor of other priorities.

## Key Metrics

| Metric | Target | Current | Status |
|--------|--------|---------|--------|
| **Containers Running** | 15+ | 22 | 🟢 All Services Operational |
| **GPU Accessible** | Yes | Yes | 🟢 Working (RTX 2080 Ti) |
| **Storage Used** | <80% | 58% HDD (3.6TB/3.7TB) | 🟢 Healthy |
| **Services Accessible** | All | 21/21 | 🟢 Complete |
| **Remote Access** | Working | Ready | 🟢 Headscale + NPM |
| **Firewall Active** | Yes | Yes | 🟢 UFW Configured |
| **Backups Configured** | Yes | Yes | 🟢 Daily @ 3 AM |
| **AI Orchestrator** | Phase 6 | Phase 4 ✅ | 🟢 PydanticAI Complete |
| **SSO (Authentik)** | Phase 5 | Core Complete ✅ | 🟢 Organizr + Core API Protected |

## Quick Reference

### Documentation
- [Implementation Plans](PLANS.md) - Master plan tracker and roadmap
- [Changelog](CHANGELOG.md) - Version history
- [Container Reference](docs/reference/CONTAINERS.md) - All deployed services
- [System Specifications](docs/reference/SYSTEM.md) - Hardware and software details
- [Agent Guidelines](AGENTS.md) - Development conventions

### Key Paths
- **SSD configs:** `/home/jpmschweitzer/docker-data/`
- **HDD content:** `/mnt/media/`
- **Stacks:** Managed in Portainer web UI
- **Scripts:** `/mnt/media/Projects/portainer-core/scripts/`

### Active Services & URLs

**Infrastructure:**
- **Portainer:** http://192.168.86.149:8080 (container management)
- **Nginx Proxy Manager:** http://192.168.86.149:8000 (reverse proxy admin)
- **Authentik:** https://auth.schweitz.net (SSO identity provider - Google OAuth enabled)
- **Ollama:** http://192.168.86.149:11434 (ML models API)

**Networking:**
- **Headscale:** http://192.168.86.149:8085 (mesh VPN control)

**Monitoring:**
- **Uptime Kuma:** http://192.168.86.149:3001 (service monitoring)
- **Netdata:** http://192.168.86.149:19999 (system metrics)
- **Organizr:** http://192.168.86.149:8084 OR https://home.schweitz.net (unified dashboard)

**Applications:**
- **Open WebUI:** http://192.168.86.149:8081 (LLM chat interface)
- **Core API:** http://192.168.86.149:8083 (infrastructure management & AI orchestration)
- **Jellyfin:** http://192.168.86.149:8096 OR https://media.schweitz.net (GPU media server)
- **Nextcloud:** http://192.168.86.149:8082 OR https://cloud.schweitz.net (cloud storage)
- **Gitea:** http://192.168.86.149:3002 OR https://git.schweitz.net (Git hosting, SSH: 2222)
- **Samba:** \\\\192.168.86.149 or \\\\tower-of-joy (file shares: Media, Downloads, Backups)

**Background Services:**
- **Watchtower:** Automatic updates daily @ 4 AM
- **Maintenance:** Automated backups daily @ 3 AM

---

*For detailed implementation history and completed work, see [CHANGELOG.md](CHANGELOG.md)*