docs: add Pinokio fleet networking TAC and packaging guides

pmoves/configs/pinokio-network-inventory.yaml

@@ -0,0 +1,247 @@
+# Pinokio Network Auto-Discovery Inventory
+# Classifies all services exposed via Pinokio LWW (LAN-Wide-Web) on the PMOVES fleet.
+#
+# Pinokio 7 LWW automatically discovers ALL localhost TCP listeners and
+# exposes them in the network view. This is always-on — no toggle exists.
+# Non-PMOVES services (Steam, Chrome DevTools, Razer, etc.) also appear.
+#
+# Classification:
+#   intentional  — PMOVES service, expected in network view
+#   noise        — Non-PMOVES listener, harmless but clutters UI
+#   system       — OS/platform service, always running
+#
+# Risk assessment: LAN is trusted home network, Tailscale encrypts cross-machine.
+# Non-PMOVES services don't respond to API calls — noise, not security risk.
+# Filtering would require forking Pinokio's core Caddy logic (high maintenance).
+#
+# Cross-refs:
+#   pmoves/configs/tac_trees/networking-defense-in-depth.tac.yaml
+#   pmoves/configs/tac_trees/node-5090-powerfulmoves.tac.yaml
+
+version: "1.0.0"
+last_audit: "2026-03-22"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Node: 5090 (POWERFULMOVES) — Primary GPU / TTS Host
+# ─────────────────────────────────────────────────────────────────────────────
+nodes:
+  - hostname: POWERFULMOVES
+    tailscale_host: powerfulmoves-1
+    role: primary-gpu-tts
+    pinokio_lww: true
+    services:
+
+      # === PMOVES Intentional Services ===
+      - name: Ultimate-TTS-Studio
+        port: 7860
+        class: intentional
+        owner: pinokio
+        description: "14-engine TTS hub (Gradio)"
+        health_endpoint: "/gradio_api/info"
+
+      - name: Qwen3-TTS
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "Qwen3 standalone TTS with VoiceDesign mode"
+        health_endpoint: "/gradio_api/info"
+
+      - name: VibeVoice-Realtime
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "WebSocket streaming TTS (uvicorn)"
+        health_endpoint: null
+
+      - name: VoxForge-Pro
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "PDF-to-audiobook pipeline"
+        health_endpoint: "/gradio_api/info"
+
+      - name: Ollama
+        port: 11434
+        class: intentional
+        owner: docker
+        description: "Local LLM inference"
+        health_endpoint: "/api/tags"
+
+      - name: N8N
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "Workflow automation"
+        health_endpoint: "/healthz"
+
+      - name: SillyTavern
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "Chat interface for LLMs"
+        health_endpoint: null
+
+      - name: ACE-Step
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "Music generation"
+        health_endpoint: null
+
+      - name: WAN
+        port: dynamic
+        class: intentional
+        owner: pinokio
+        description: "Video generation"
+        health_endpoint: null
+
+      # === Noise Services (auto-discovered, non-PMOVES) ===
+      - name: Steam
+        port: various
+        class: noise
+        owner: valve
+        description: "Steam client — multiple TCP listeners for game downloads/chat"
+
+      - name: Chrome-DevTools
+        port: 9222
+        class: noise
+        owner: google
+        description: "Chrome remote debugging protocol"
+
+      - name: Razer-Synapse
+        port: various
+        class: noise
+        owner: razer
+        description: "Razer peripheral management"
+
+      - name: Logitech-GHub
+        port: various
+        class: noise
+        owner: logitech
+        description: "Logitech peripheral management"
+
+      - name: Docker-Desktop
+        port: various
+        class: system
+        owner: docker
+        description: "Docker Desktop internal listeners"
+
+      - name: Surfshark-VPN
+        port: various
+        class: noise
+        owner: surfshark
+        description: "VPN client internal listeners"
+
+      - name: NVIDIA-Container
+        port: various
+        class: system
+        owner: nvidia
+        description: "NVIDIA container runtime/toolkit"
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Node: Z890 (pmoves-z890) — Infrastructure Coordinator
+  # ─────────────────────────────────────────────────────────────────────────────
+  - hostname: pmoves-z890
+    tailscale_host: pmoves-z890
+    role: infra-coordinator
+    pinokio_lww: true
+    services:
+
+      # === PMOVES Intentional Services ===
+      - name: Pinokio-UI
+        port: 42000
+        class: intentional
+        owner: pinokio
+        description: "Pinokio Electron app"
+        health_endpoint: null
+
+      # === TTS Apps — REMOVED (delegated to 5090) ===
+      # OpenAudio (Fish Speech) — REMOVED 2026-03-22
+      # Qwen3-TTS — REMOVED 2026-03-22
+      # Ultimate-TTS-Studio SUP3R Edition — REMOVED 2026-03-22
+
+      # === Docker Compose Services (exposed via container port mappings) ===
+      - name: NATS
+        port: 4222
+        class: intentional
+        owner: docker-compose
+        description: "JetStream message bus (hub)"
+        health_endpoint: "http://localhost:8222/varz"
+
+      - name: Agent-Zero
+        port: 8080
+        class: intentional
+        owner: docker-compose
+        description: "Control-plane orchestrator"
+        health_endpoint: "/healthz"
+
+      - name: TensorZero
+        port: 3030
+        class: intentional
+        owner: docker-compose
+        description: "Centralized LLM gateway"
+        health_endpoint: null
+
+      - name: Grafana
+        port: 3000
+        class: intentional
+        owner: docker-compose
+        description: "Monitoring dashboards"
+        health_endpoint: "/api/health"
+
+      - name: Prometheus
+        port: 9090
+        class: intentional
+        owner: docker-compose
+        description: "Metrics scraping"
+        health_endpoint: "/-/healthy"
+
+      - name: Supabase-Kong
+        port: 8000
+        class: intentional
+        owner: docker-compose
+        description: "Supabase API gateway"
+        health_endpoint: null
+
+      - name: Flute-Gateway
+        port: 8055
+        class: intentional
+        owner: docker-compose
+        description: "Voice communication layer"
+        health_endpoint: "/healthz"
+
+      # === Noise Services ===
+      - name: Docker-Desktop
+        port: various
+        class: system
+        owner: docker
+        description: "Docker Desktop internal listeners"
+
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Node: 4090 (pmoves-laptop) — Mobile Relay
+  # ─────────────────────────────────────────────────────────────────────────────
+  - hostname: pmoves-laptop
+    tailscale_host: pmoves-laptop
+    role: mobile-relay
+    pinokio_lww: false
+    note: "Consumer node — accesses 5090/Z890 via Pinokio LWW network view"
+    services: []
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Security Posture
+# ─────────────────────────────────────────────────────────────────────────────
+security:
+  risk_level: low
+  rationale: >
+    LAN is trusted home network. Tailscale provides WireGuard encryption for
+    cross-machine traffic. Non-PMOVES noise services (Steam, Chrome, Razer, etc.)
+    don't respond to meaningful API calls — they're TCP listeners that appear in
+    auto-discovery but have no exploitable surface via Pinokio's Caddy proxy.
+  mitigation:
+    - "LWW auto-assigns Caddy share proxy ports 42003+ (one per localhost listener)"
+    - "This inventory file classifies intentional vs noise for audit"
+    - "No PII or secrets exposed through auto-discovered noise services"
+  recommendations:
+    - "Allow TCP 42000-42100 on Tailscale/LAN adapter for cross-machine Pinokio LWW access"
+    - "Periodically re-audit this inventory when new apps are installed"
+    - "If Pinokio adds per-service opt-in, migrate from blanket LWW discovery"