Skip to main content

Operating Principles

Core principles guiding EchoHuman infrastructure design, operations, and documentation.

Infrastructure​

  • Single source of truth: Docusaurus on Vera is the canonical documentation source.
  • Immutable static output: Docusaurus builds to static HTML, served read-only by nginx on VM700.
  • Isolation: EchoHuman services (CRM, Matomo, Docsaurus) are fully isolated Docker stacks with separate networks, volumes, and credentials.
  • No shared databases: EchoHuman services use local Postgres/MariaDB containers, not CT320 (which is reserved for Lifehouse and other hosted services).
  • Minimal external dependencies: WireGuard for admin access, Cloudflare for DNS/DDoS, no other external APIs in core infrastructure.

Services​

  • EchoHuman Twenty CRM: Self-contained stack with server, worker, local Postgres, Redis. First boot ~25–35 min.
  • Matomo Analytics: Self-contained stack with app and MariaDB.
  • Docsaurus: Static Docusaurus build served by nginx. No runtime dependencies.
  • Lifehouse: Hosted/client/workstream service. Not part of EchoHuman repo estate. Runs on VM700 but is managed separately.

Operations​

  • Read-only infrastructure inspection: Use docker ps, pct list, qm list, git status — no modifications without explicit instruction.
  • No destructive commands: Never run docker system prune -a --volumes, git reset --hard, rm -rf, or similar without audit.
  • Backup before change: Snapshot containers/VMs before major changes.
  • Document decisions: All infrastructure changes should be recorded in reports or runbooks.

Documentation​

  • Markdown first: All documentation lives as .md files on Vera.
  • Sidebar-driven navigation: sidebars.js controls what appears in the docs site.
  • No sensitive data in public docs: Passwords, API keys, tokens, credentials must never be committed to Docusaurus.
  • Inventory, don't import: Existing Markdown files are indexed but not all imported into Docusaurus.
  • Research and intelligence methodology: The Research Foundry is the EchoHuman layer for turning accumulated information into structured intelligence. All EchoHuman projects follow the Operating Contract.

Access​

  • WireGuard for admin: Vera connects to Helsinki2 via WireGuard (10.200.0.2 → 10.200.0.1).
  • SSH key auth: All SSH access uses key authentication, no passwords.
  • Cloudflare for public: All public domains proxied through Cloudflare (DDoS protection, IP masking).
  • CT101 Caddy for routing: Single ingress point for all public traffic.

Security​

  • Docsaurus should be password-protected before expanding public documentation.
  • No API tokens in repos: Cloudflare, GitHub, and other API tokens are stored locally, never committed.
  • Minimal public exposure: Only necessary ports (80, 443) exposed to the internet.