Document VM 102 security stack and update IPs to 192.168.1.105.

Add ARCHITECTURE.md and HOMELAB_IPS.md, refresh inventory and app configs for Postgres, Neo4j, Homelab Command, pgAdmin, Homarr, and Homepage links. Co-authored-by: Cursor <cursoragent@cursor.com>
Add home-security-agent with PostgreSQL persistence for dashboard.
2026-05-25 23:15:42 +02:00 · 2026-05-17 21:57:16 +02:00
30 changed files with 1265 additions and 28 deletions
@@ -1,7 +1,10 @@
 # Private homelab — echte credentials (repo is privé op Gitea)

 NAS_IP=192.168.1.211
+# Proxmox VM 102 — Postgres, Neo4j, Homelab Command, syslog, NATS, security agent
+VM102_IP=192.168.1.105
 POSTGRES_USER=mo
+PG_HOST=192.168.1.105
 POSTGRES_PASSWORD=WaQTUw2t
 POSTGRES_DB=homelab
 PG_HOST_PORT=5433
@@ -0,0 +1,150 @@
+# Homelab architectuur
+
+Overzicht van hoe de diensten bij elkaar hangen na de verplaatsing van de **security stack** naar Proxmox VM 102. Vaste IP-referentie: [HOMELAB_IPS.md](HOMELAB_IPS.md).
+
+## Fysieke hosts
+
+```mermaid
+flowchart TB
+  subgraph lan [LAN 192.168.1.0/24]
+    NAS["Synology NAS\n192.168.1.211"]
+    VM102["Proxmox VM 102 Postgress\n192.168.1.105"]
+    VM105["Proxmox VM 105 docker\n192.168.1.227"]
+    PVE216["Proxmox pve\n192.168.1.216"]
+    PVE56["Proxmox dell\n192.168.1.56"]
+    UDM["UniFi / gateway\n192.168.1.24"]
+    HA["Home Assistant\n192.168.1.235"]
+  end
+  User["Browser / Git client"] --> NAS
+  User --> VM102
+```
+
+## Security stack (productie op VM 102)
+
+Het hart van monitoring, syslog, graph en agent-draait op **één VM**. De NAS toont nog dashboards in Homarr/Homepage en beheert Git + metrics.
+
+```mermaid
+flowchart LR
+  subgraph sources [Data-bronnen LAN]
+    UniFi[UniFi controller .24]
+    SyslogDev[Routers / switches / APs]
+    Zeek[Zeek / Suricata]
+  end
+
+  subgraph vm102 [VM 102 — 192.168.1.105]
+    UI[homelab-command :8765]
+    SyslogUDP[Syslog UDP :5514]
+    PG[(postgres-homelab :5433)]
+    Neo[(Neo4j :49153 / UI :49154)]
+    NATS[NATS :4222]
+    Mesh[mesh-normalizer]
+    Agent[el-kadi-security-agent]
+  end
+
+  subgraph nas [NAS — 192.168.1.211]
+    Gitea[Gitea :3000]
+    PgAdmin[pgAdmin :5434]
+    Graf[Grafana :3002]
+    Prom[Prometheus :9090]
+    PGexp[postgres-exporter :9187]
+    AdGuard[AdGuard :3001]
+    PGBkp[(postgres-homelab backup :5433)]
+  end
+
+  User2[Gebruiker] --> UI
+  User2 --> PgAdmin
+  PgAdmin --> PG
+  Graf --> PG
+  Prom --> PGexp
+  PGexp --> PG
+
+  SyslogDev -->|UDP 5514| SyslogUDP
+  UniFi -->|API| UI
+  Zeek -->|NATS publish| NATS
+  NATS --> Mesh
+  SyslogUDP --> PG
+  UI --> PG
+  UI --> Neo
+  Mesh --> PG
+  Agent --> PG
+  AdGuard -->|DNS stats API| UI
+
+  PG -.->|rollback kopie| PGBkp
+```
+
+## Datastromen
+
+| Stroom | Van | Naar | Poort / protocol |
+|--------|-----|------|------------------|
+| Dashboard UI | Browser | VM 102 | HTTP 8765 |
+| SQL (homelab DB) | homelab-command, agent, mesh | Postgres VM 102 | 5433 |
+| Syslog ingest | Netwerkapparaten | homelab-command | UDP 5514 → `mesh.syslog_entries` |
+| Zeek/Suricata events | Sensors | NATS → mesh-normalizer | 4222 → Postgres |
+| Netwerk-topologie | homelab-command | Neo4j VM 102 | Bolt 49153 |
+| DB beheer | pgAdmin (NAS) | Postgres VM 102 | 5433 |
+| Metrics | Prometheus (NAS) | postgres-exporter → VM 102 | 9187 scrape |
+| Git configs | Ontwikkelaar | Gitea (NAS) | 3000 / SSH 2222 |
+
+## NAS — overige Docker (niet op VM 102)
+
+```mermaid
+flowchart TB
+  NAS["192.168.1.211"]
+  NAS --> Gitea
+  NAS --> AdGuard
+  NAS --> Portainer
+  NAS --> Homarr
+  NAS --> Homepage
+  NAS --> PromGraf[Prometheus + Grafana]
+  NAS --> PgAdmin
+  NAS --> PGbak[Postgres backup]
+```
+
+| Service | Poort | Opmerking |
+|---------|-------|-----------|
+| Gitea | 3000 | Config-repo's, Git SSH 2222 |
+| AdGuard | 3001 | DNS (dashboard haalt stats op) |
+| Portainer | 9000 | Containerbeheer NAS |
+| Homarr / Homepage | 4755 / 3010 | Links naar `.105` voor security |
+| Grafana | 3002 | Postgres-datasource → `.105:5433` |
+| Prometheus | 9090 | Scrapes o.a. Neo4j `.105:2004` |
+| postgres (backup) | 5433 | Oude kopie; stoppen na validatie |
+
+## Proxmox VM 105 docker (apart)
+
+| VM | IP | Rol |
+|----|-----|-----|
+| 102 Postgress | 192.168.1.105 | Security + Postgres + Neo4j |
+| 105 docker | 192.168.1.227 | `office_desk_agent` :8000 (Proxmox/office tooling) |
+
+## Repo-structuur (Gitea)
+
+```mermaid
+flowchart LR
+  Gitea["Gitea :3000\n192.168.1.211"]
+  Gitea --> CFG[homelab-configs\nDocker compose per app]
+  Gitea --> CMD[homelab-command\nDashboard broncode]
+  CFG --> DeployNAS[Deploy NAS apps]
+  CFG --> DeployVM[Documentatie VM 102]
+  CMD --> BuildVM[Build op VM 102\n~/homelab-command]
+```
+
+| Repository | Inhoud |
+|------------|--------|
+| `homelab-configs` | Compose, env-voorbeelden, Homarr/Homepage, monitoring |
+| `homelab-command` | FastAPI dashboard, mesh-ingest, Grafana-dockerfile |
+
+## Snelle URL-lijst
+
+| Wat | URL |
+|-----|-----|
+| Security dashboard | http://192.168.1.105:8765/dashboard |
+| Neo4j Browser | http://192.168.1.105:49154 |
+| pgAdmin | http://192.168.1.211:5434 |
+| Gitea | http://192.168.1.211:3000 |
+| Grafana | http://192.168.1.211:3002 |
+| Portainer | http://192.168.1.211:9000 |
+
+## Rollback
+
+- Postgres: zie [homelab-command/docs/POSTGRES_ROLLBACK.md](http://192.168.1.211:3000/mo/homelab-command/src/branch/main/docs/POSTGRES_ROLLBACK.md) (in homelab-command repo) — `PG_HOST` terug naar `.211`, NAS-container herstarten.
@@ -0,0 +1,30 @@
+# Homelab IP-adressen (referentie)
+
+## Waar draait wat?
+
+| IP | Host | Services |
+|----|------|----------|
+| **192.168.1.105** | Proxmox VM 102 `Postgress` | Postgres :5433, Neo4j :49153–49155, Dashboard :8765, Syslog UDP :5514, NATS :4222, Security agent |
+| **192.168.1.211** | Synology NAS | Gitea :3000, pgAdmin :5434, Grafana :3002, Prometheus :9090, AdGuard :3001, Portainer :9000, Postgres **backup** :5433 |
+| **192.168.1.227** | Proxmox VM 105 `docker` | Office desk agent :8000 |
+| **192.168.1.216** | Proxmox pve | API :8006 |
+| **192.168.1.56** | Proxmox dell | API :8006 |
+
+## Standaard URLs (productie)
+
+- Dashboard: http://192.168.1.105:8765/dashboard
+- Neo4j Browser: http://192.168.1.105:49154
+- pgAdmin: http://192.168.1.211:5434 (server → `192.168.1.105:5433`)
+- Gitea: http://192.168.1.211:3000
+
+## Env-variabelen (`.env` in repo)
+
+```env
+NAS_IP=192.168.1.211
+VM102_IP=192.168.1.105
+PG_HOST=192.168.1.105
+```
+
+## Syslog
+
+Remote syslog → **192.168.1.105:5514** (niet `.211`).
@@ -1,17 +1,29 @@
 # Homelab inventaris — alles thuis

-Private repo. Laatst bijgewerkt vanaf NAS `192.168.1.211`.
+Private repo. Laatst bijgewerkt: security stack op VM 102 (`192.168.1.105`), overige apps op NAS (`192.168.1.211`).
+
+## Proxmox VM 102 Postgress — `192.168.1.105` (productie security)
+
+| App | Map / pad op VM | IP:poort | Status |
+|-----|-----------------|----------|--------|
+| PostgreSQL | `~/homelab-postgres/` | :5433 | running |
+| Neo4j | `~/neo4j/` | :49153–49155 | running |
+| Homelab Command | `~/homelab-command/` | :8765 | running |
+| Syslog UDP | homelab-command | :5514 | → `.105` |
+| NATS + mesh-normalizer | `~/homelab-command/` | :4222 | running |
+| Security Agent | `~/home-security-agent/` | host | running |
+
+**Dashboard:** http://192.168.1.105:8765/dashboard · **Neo4j UI:** http://192.168.1.105:49154

 ## Synology NAS — Docker (actief)

 | App | Map | IP:poort | Status |
 |-----|-----|----------|--------|
-| PostgreSQL | [apps/postgres](apps/postgres/) | :5433 | running |
-| pgAdmin | [apps/pgadmin](apps/pgadmin/) | :5434 | running |
+| PostgreSQL (backup) | [apps/postgres](apps/postgres/) | 192.168.1.211:5433 | running · fallback |
+| pgAdmin | [apps/pgadmin](apps/pgadmin/) | :5434 | running → DB op `.105` |
 | Gitea | [apps/gitea](apps/gitea/) | :3000 | running |
 | AdGuard Home | [apps/adguard](apps/adguard/) | :53, :3001 | running |
 | DuckDNS | [apps/duckdns](apps/duckdns/) | — | running |
-| Neo4j | [apps/neo4j](apps/neo4j/) | :49153–49155 | running |
 | Homarr | [apps/homarr](apps/homarr/) | :4755 | running |
 | Homepage | [apps/homepage](apps/homepage/) | http://192.168.1.192:3000 (pve CT 120) | running |
 | Portainer | [apps/portainer](apps/portainer/) | :9000 | running |
@@ -19,8 +31,6 @@ Private repo. Laatst bijgewerkt vanaf NAS `192.168.1.211`.
 | Excalidraw | [apps/excalidraw](apps/excalidraw/) | :3765 | running |
 | Prometheus | [apps/monitoring](apps/monitoring/) | :9090 | running |
 | Grafana | [apps/monitoring](apps/monitoring/) | :3002 | running |
-| Homelab Command | [homelab-command repo](http://192.168.1.211:3000/mo/homelab-command) | :8765 | running |
-| NATS + mesh | [apps/monitoring](apps/monitoring/) | :4222 | running |

 ## Synology NAS — Docker (gestopt / image aanwezig)

@@ -81,6 +91,8 @@ python3 scripts/pull-lxc-from-proxmox.py   # op NAS, via Proxmox SSH
 | IP | Rol |
 |----|-----|
 | 192.168.1.211 | Synology NAS |
+| 192.168.1.105 | Proxmox VM 102 Postgress (Postgres, Neo4j, Homelab Command) |
+| 192.168.1.227 | Proxmox VM 105 docker (office agent) |
 | 192.168.1.216 | Proxmox pve |
 | 192.168.1.56 | Proxmox dell |
 | 192.168.1.24 | UniFi controller |
@@ -1,6 +1,6 @@
 # Homelab Infrastructure Configuration

-Private Gitea-repo met **alle configs per applicatie** voor Synology NAS (`192.168.1.211`) en Proxmox hosts.
+Private Gitea-repo met **alle configs per applicatie** voor Synology NAS (`192.168.1.211`) en Proxmox VM 102 (`192.168.1.105`). Zie [HOMELAB_IPS.md](HOMELAB_IPS.md).

 **Snel herstellen:** [RESTORE.md](RESTORE.md)  
 **Volledige inventaris:** [INVENTORY.md](INVENTORY.md)  
@@ -4007,7 +4007,7 @@
    {
      "id": "1446d0cd-5449-4e41-b68b-15b4052f6325",
      "name": "Neo4j Browser",
-      "url": "http://192.168.1.211:49154",
+      "url": "http://192.168.1.105:49154",
      "appearance": {
        "iconUrl": "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/neo4j.png",
        "appNameStatus": "normal",
@@ -4028,7 +4028,7 @@
      },
      "behaviour": {
        "isOpeningNewTab": true,
-        "externalUrl": "http://192.168.1.211:49154"
+        "externalUrl": "http://192.168.1.105:49154"
      },
      "area": {
        "type": "category",
@@ -4066,7 +4066,7 @@
    {
      "id": "039d3bf6-bf8a-4944-a8b1-7cc886daebe7",
      "name": "HA Voice Ctrl",
-      "url": "http://192.168.1.211:8765",
+      "url": "http://192.168.1.105:8765",
      "appearance": {
        "iconUrl": "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/home-assistant.png",
        "appNameStatus": "normal",
@@ -4087,7 +4087,7 @@
      },
      "behaviour": {
        "isOpeningNewTab": true,
-        "externalUrl": "http://192.168.1.211:8765"
+        "externalUrl": "http://192.168.1.105:8765"
      },
      "area": {
        "type": "category",
@@ -5426,7 +5426,7 @@
    {
      "id": "9be593d8-a4b4-460a-8998-6cafefb4271e",
      "name": "Home Control",
-      "url": "http://192.168.1.211:8765/dashboard#live",
+      "url": "http://192.168.1.105:8765/dashboard#live",
      "appearance": {
        "iconUrl": "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/svg/crafty-controller.svg",
        "appNameStatus": "normal",
@@ -5447,7 +5447,7 @@
      },
      "behaviour": {
        "isOpeningNewTab": true,
-        "externalUrl": "http://192.168.1.211:8765/dashboard#live"
+        "externalUrl": "http://192.168.1.105:8765/dashboard#live"
      },
      "area": {
        "type": "category",
@@ -0,0 +1,14 @@
+# Telegram (verplicht voor meldingen)
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_CHAT_ID=
+
+# PostgreSQL — observaties voor dashboard http://192.168.1.211:8765
+PG_HOST=192.168.1.211
+PG_PORT=5433
+PG_USER=mo
+PG_PASSWORD=WaQTUw2t
+PG_DATABASE=homelab
+
+# Optioneel: LLM-agent (zonder key = regel-gebaseerde modus)
+OPENAI_API_KEY=
+AGENT_MODEL=gpt-4o-mini
@@ -0,0 +1,14 @@
+# Telegram (verplicht voor meldingen)
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_CHAT_ID=
+
+# PostgreSQL — observaties voor dashboard http://192.168.1.105:8765
+PG_HOST=192.168.1.105
+PG_PORT=5433
+PG_USER=mo
+PG_PASSWORD=
+PG_DATABASE=homelab
+
+# Optioneel: LLM-agent (zonder key = regel-gebaseerde modus)
+OPENAI_API_KEY=
+AGENT_MODEL=gpt-4o-mini
@@ -0,0 +1,14 @@
+FROM python:3.11-slim-bookworm
+
+RUN apt-get update && apt-get install -y --no-install-recommends iputils-ping docker.io \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY agent ./agent
+COPY config ./config
+
+ENV PYTHONUNBUFFERED=1
+CMD ["python", "-m", "agent.main"]
@@ -0,0 +1,79 @@
+# EL-KADI Home Security Agent
+
+**Autonome** security agent voor thuis — zonder Wazuh, Uptime Kuma, n8n of Security Mesh.
+
+De agent:
+1. **Observeert** zelf (HTTP/TCP, Docker, Proxmox, LAN-gateway)
+2. **Redeneert** (OpenAI met tools, of regels zonder API-key)
+3. **Onthoudt** incidenten (SQLite, dedupe)
+4. **Meld** via **Telegram**
+
+## Starten
+
+```bash
+cd /volume1/docker/homelab-configs/apps/home-security-agent
+cp .env.example .env
+# Vul TELEGRAM_BOT_TOKEN en TELEGRAM_CHAT_ID in
+# Optioneel: OPENAI_API_KEY voor agentische modus
+
+docker-compose up -d --build
+```
+
+Eén run testen:
+
+```bash
+docker-compose run --rm security-agent python -m agent.main once
+```
+
+## Configuratie
+
+| Bestand | Doel |
+|---------|------|
+| `config/targets.yaml` | Wat gemonitord wordt |
+| `config/policies.yaml` | Interval, quiet hours, severity |
+| `.env` | Telegram + OpenAI |
+
+## Agentische modus (LLM)
+
+Met `OPENAI_API_KEY` krijgt het model tools (`probe_tcp`, `probe_http`, `probe_proxmox`) en mag zelf verifiëren voordat het alert=true zet.
+
+Zonder key: **regel-engine** (down services → Telegram).
+
+## Uitbreiden
+
+Voeg in `targets.yaml` services toe. Voor diepere agent-gedrag later:
+
+- SSH-log tail (auth failures)
+- Proxmox API (VM status) als aparte tool
+- LAN device discovery + `known_hosts` whitelist
+- Lokale Ollama (`AGENT_MODEL` + OpenAI-compatible URL)
+
+## Dashboard
+
+Alle observaties gaan naar **PostgreSQL** (`agent.observation_runs`, `agent.findings`, `agent.incidents`).
+
+Bekijk ze in **Homelab Command**: http://192.168.1.105:8765/dashboard#security (tab Security → Home Security Agent).
+
+Eénmalig schema:
+
+```bash
+docker exec -i postgres-homelab psql -U mo -d homelab < migrations/004_home_agent_observations.sql
+# Postgres draait op VM 102: ssh mo@192.168.1.105 → docker exec postgres-homelab psql ...
+```
+
+Of vanuit homelab-command: `scripts/apply_mesh_migrations.sh` (past alle `migrations/*.sql` toe).
+
+## Architectuur
+
+```
+┌─────────────┐     ┌──────────────┐     ┌────────────┐     ┌──────────┐
+│  Observer   │────▶│    Brain     │────▶│ PostgreSQL │────▶│ Dashboard│
+│ (eigen      │     │ LLM + tools  │     │ agent.*    │     │ :8765     │
+│  probes)    │     │ of regels    │     └────────────┘     └──────────┘
+└─────────────┘     └──────┬───────┘            │
+                           │                    │
+                    ┌──────▼───────┐     ┌──────▼───────┐
+                    │ SQLite state │     │  Telegram    │
+                    │ dedupe       │     │  meldingen   │
+                    └──────────────┘     └──────────────┘
+```
@@ -0,0 +1 @@
+# EL-KADI Home Security Agent
@@ -0,0 +1,243 @@
+"""Agentisch brein — LLM met tools, of regel-fallback zonder API."""
+import json
+import os
+from dataclasses import dataclass
+from datetime import datetime
+from typing import List, Optional
+
+from agent.observer import (
+    ObservationReport,
+    load_yaml,
+    probe_http,
+    probe_proxmox,
+    probe_tcp,
+)
+from agent.state import recent_incidents
+
+
+@dataclass
+class AgentDecision:
+    alert: bool
+    severity: str
+    title: str
+    body: str
+    fingerprint: str
+    actions: List[str]
+
+
+TOOLS_SCHEMA = [
+    {
+        "type": "function",
+        "function": {
+            "name": "probe_tcp",
+            "description": "Test of een TCP-poort open is op een host",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "host": {"type": "string"},
+                    "port": {"type": "integer"},
+                },
+                "required": ["host", "port"],
+            },
+        },
+    },
+    {
+        "type": "function",
+        "function": {
+            "name": "probe_http",
+            "description": "HTTP GET check op een URL",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "url": {"type": "string"},
+                    "insecure_tls": {"type": "boolean"},
+                },
+                "required": ["url"],
+            },
+        },
+    },
+    {
+        "type": "function",
+        "function": {
+            "name": "probe_proxmox",
+            "description": "Check Proxmox web UI bereikbaarheid",
+            "parameters": {
+                "type": "object",
+                "properties": {"host": {"type": "string"}},
+                "required": ["host"],
+            },
+        },
+    },
+]
+
+
+def _run_tool(name: str, args: dict) -> str:
+    if name == "probe_tcp":
+        ok, detail = probe_tcp(args["host"], int(args["port"]))
+        return json.dumps({"ok": ok, "detail": detail})
+    if name == "probe_http":
+        ok, detail = probe_http(args["url"], insecure=bool(args.get("insecure_tls")))
+        return json.dumps({"ok": ok, "detail": detail})
+    if name == "probe_proxmox":
+        ok, detail = probe_proxmox(args["host"])
+        return json.dumps({"ok": ok, "detail": detail})
+    return json.dumps({"error": "unknown tool"})
+
+
+def _rule_based_decide(report: ObservationReport, policies: dict) -> AgentDecision:
+    rules = policies.get("rules") or {}
+    failed = [f for f in report.findings if not f.ok]
+    if not failed:
+        return AgentDecision(
+            alert=False,
+            severity="info",
+            title="Alles OK",
+            body=f"{len(report.findings)} checks geslaagd.",
+            fingerprint="all_ok",
+            actions=[],
+        )
+
+    worst = "low"
+    lines = []
+    for f in failed:
+        lines.append(f"• {f.kind}/{f.name}: {f.detail}")
+        if f.kind == "proxmox" and not f.ok:
+            worst = rules.get("proxmox_unreachable", "critical")
+        elif f.kind == "nas" and not f.ok:
+            worst = max_sev(worst, rules.get("nas_unreachable", "critical"))
+        elif f.kind == "service" and not f.ok:
+            worst = max_sev(worst, rules.get("any_service_down", "high"))
+        elif f.kind == "docker" and not f.ok:
+            worst = max_sev(worst, "high")
+
+    fp = "fail:" + "|".join(sorted(f"{f.kind}:{f.name}" for f in failed))[:200]
+    return AgentDecision(
+        alert=True,
+        severity=worst,
+        title=f"{len(failed)} probleem(en) gedetecteerd",
+        body="\n".join(lines),
+        fingerprint=fp,
+        actions=["Herhaal check over 5 min", "Controleer host handmatig"],
+    )
+
+
+def max_sev(a: str, b: str) -> str:
+    order = ["info", "low", "medium", "high", "critical"]
+    return a if order.index(a) >= order.index(b) else b
+
+
+def _in_quiet_hours(policies: dict) -> bool:
+    qh = policies.get("quiet_hours") or {}
+    if not qh:
+        return False
+    try:
+        from zoneinfo import ZoneInfo
+
+        tz = ZoneInfo(qh.get("timezone", "UTC"))
+    except Exception:
+        tz = None
+    now = datetime.now(tz) if tz else datetime.now()
+    start = qh.get("start", "23:00")
+    end = qh.get("end", "07:00")
+    h, m = map(int, now.strftime("%H %M").split())
+    cur = h * 60 + m
+    sh, sm = map(int, start.split(":"))
+    eh, em = map(int, end.split(":"))
+    s, e = sh * 60 + sm, eh * 60 + em
+    if s <= e:
+        return s <= cur < e
+        return cur >= s or cur < e
+    return False
+
+
+def decide(report: ObservationReport) -> AgentDecision:
+    policies = load_yaml("policies.yaml")
+    history = recent_incidents(8)
+
+    api_key = os.environ.get("OPENAI_API_KEY", "").strip()
+    model = os.environ.get("AGENT_MODEL", "gpt-4o-mini")
+
+    if not api_key:
+        return _rule_based_decide(report, policies)
+
+    try:
+        from openai import OpenAI
+
+        client = OpenAI(api_key=api_key)
+        system = """Je bent de autonome security agent voor het EL-KADI homelab thuis.
+Je krijgt ruwe observaties (eigen probes, geen Wazuh/Uptime Kuma).
+Beslis of de gebruiker een Telegram-melding moet krijgen.
+Wees conservatief: alleen alert bij echt problemen of verdachte wijzigingen.
+Antwoord uiteindelijk ALTIJD met JSON:
+{"alert":bool,"severity":"info|low|medium|high|critical","title":"...","body":"...","fingerprint":"korte_sleutel","actions":["..."]}
+Je mag tools aanroepen om te verifiëren voordat je alert=true zet."""
+
+        user_msg = json.dumps(
+            {
+                "observations": report.to_dict(),
+                "recent_incidents": history,
+                "policies": {
+                    "quiet_hours": policies.get("quiet_hours"),
+                    "dedupe_minutes": policies.get("dedupe_minutes"),
+                },
+            },
+            indent=2,
+            default=str,
+        )
+
+        messages = [
+            {"role": "system", "content": system},
+            {"role": "user", "content": user_msg},
+        ]
+
+        for _ in range(5):
+            resp = client.chat.completions.create(
+                model=model,
+                messages=messages,
+                tools=TOOLS_SCHEMA,
+                tool_choice="auto",
+            )
+            msg = resp.choices[0].message
+            if msg.tool_calls:
+                messages.append(msg)
+                for tc in msg.tool_calls:
+                    result = _run_tool(tc.function.name, json.loads(tc.function.arguments))
+                    messages.append(
+                        {
+                            "role": "tool",
+                            "tool_call_id": tc.id,
+                            "content": result,
+                        }
+                    )
+                continue
+            text = (msg.content or "").strip()
+            if "```" in text:
+                text = text.split("```")[1].replace("json", "").strip()
+            data = json.loads(text)
+            return AgentDecision(
+                alert=bool(data.get("alert")),
+                severity=str(data.get("severity", "medium")),
+                title=str(data.get("title", "Security")),
+                body=str(data.get("body", "")),
+                fingerprint=str(data.get("fingerprint", "llm")),
+                actions=list(data.get("actions") or []),
+            )
+    except Exception as e:
+        dec = _rule_based_decide(report, policies)
+        dec.body += f"\n\n(LLM fallback: {e})"
+        return dec
+
+    return _rule_based_decide(report, policies)
+
+
+def should_notify(decision: AgentDecision, policies: dict) -> bool:
+    if not decision.alert:
+        return False
+    allowed = policies.get("severity_telegram") or ["critical", "high"]
+    if decision.severity not in allowed:
+        return False
+    if _in_quiet_hours(policies):
+        return decision.severity == (policies.get("quiet_hours") or {}).get(
+            "allow_severity", "critical"
+        )
+    return True
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""EL-KADI Home Security Agent — autonome loop."""
+import os
+import sys
+import time
+from pathlib import Path
+
+# Package root on path
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+
+from dotenv import load_dotenv
+
+load_dotenv(ROOT / ".env")
+
+from agent.brain import decide, should_notify
+from agent.observer import load_yaml, run_observation
+from agent.pg_store import (
+    persist_incident as pg_record_incident,
+    persist_observation,
+    was_notified_recently_pg,
+)
+from agent.state import log_run, record_incident, was_notified_recently
+from agent.telegram_notify import format_alert, send_message
+
+
+def _record_incident(
+    run_id,
+    fingerprint: str,
+    severity: str,
+    title: str,
+    body: str,
+    notified: bool,
+) -> None:
+    record_incident(fingerprint, severity, title, body, notified)
+    pg_record_incident(run_id, fingerprint, severity, title, body, notified)
+
+
+def run_once() -> int:
+    policies = load_yaml("policies.yaml")
+    report = run_observation()
+    decision = decide(report)
+    log_run(decision.title, report.to_dict())
+    run_id = persist_observation(report, decision)
+
+    print(f"[{report.timestamp}] {decision.severity}: {decision.title} (alert={decision.alert})")
+    if run_id:
+        print(f"  → PostgreSQL run #{run_id}")
+
+    if not should_notify(decision, policies):
+        if decision.alert:
+            _record_incident(run_id, decision.fingerprint, decision.severity, decision.title, decision.body, False)
+        return 0
+
+    dedupe = int(policies.get("dedupe_minutes", 30))
+    if was_notified_recently(decision.fingerprint, dedupe) or was_notified_recently_pg(
+        decision.fingerprint, dedupe
+    ):
+        print(f"  dedupe skip ({decision.fingerprint})")
+        return 0
+
+    text = format_alert(decision.severity, decision.title, decision.body, decision.actions)
+    if send_message(text):
+        _record_incident(run_id, decision.fingerprint, decision.severity, decision.title, decision.body, True)
+        print("  → Telegram verzonden")
+        return 0
+
+    print("  → Telegram mislukt (check TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID)")
+    _record_incident(run_id, decision.fingerprint, decision.severity, decision.title, decision.body, False)
+    return 1
+
+
+def main():
+    if len(sys.argv) > 1 and sys.argv[1] == "once":
+        sys.exit(run_once())
+
+    policies = load_yaml("policies.yaml")
+    interval = int(policies.get("interval_seconds", 300))
+    print(f"EL-KADI Security Agent — loop elke {interval}s (Ctrl+C stop)")
+    while True:
+        try:
+            run_once()
+        except KeyboardInterrupt:
+            raise
+        except Exception as e:
+            print(f"run error: {e}")
+        time.sleep(interval)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,159 @@
+"""Directe observatie — geen Wazuh/Uptime Kuma/n8n."""
+import socket
+import subprocess
+from dataclasses import dataclass, field
+from datetime import datetime
+from typing import Any
+
+import httpx
+import yaml
+
+CONFIG_DIR = __import__("pathlib").Path(__file__).resolve().parent.parent / "config"
+
+
+@dataclass
+class Finding:
+    kind: str
+    name: str
+    ok: bool
+    detail: str
+    meta: dict = field(default_factory=dict)
+
+
+@dataclass
+class ObservationReport:
+    timestamp: str
+    findings: list[Finding]
+
+    def to_dict(self) -> dict:
+        return {
+            "timestamp": self.timestamp,
+            "findings": [
+                {"kind": f.kind, "name": f.name, "ok": f.ok, "detail": f.detail, "meta": f.meta}
+                for f in self.findings
+            ],
+            "summary": {
+                "total": len(self.findings),
+                "failed": sum(1 for f in self.findings if not f.ok),
+            },
+        }
+
+
+def load_yaml(name: str) -> dict:
+    with open(CONFIG_DIR / name, encoding="utf-8") as f:
+        return yaml.safe_load(f) or {}
+
+
+def probe_tcp(host: str, port: int, timeout: float = 4) -> tuple[bool, str]:
+    try:
+        with socket.create_connection((host, port), timeout=timeout):
+            return True, "open"
+    except Exception as e:
+        return False, str(e)
+
+
+def probe_http(url: str, insecure: bool = False, timeout: float = 8) -> tuple[bool, str]:
+    try:
+        r = httpx.get(url, timeout=timeout, verify=not insecure, follow_redirects=True)
+        if r.status_code < 500:
+            return True, f"HTTP {r.status_code}"
+        return False, f"HTTP {r.status_code}"
+    except Exception as e:
+        return False, str(e)
+
+
+def probe_proxmox(host: str, port: int = 8006) -> tuple[bool, str]:
+    ok, detail = probe_tcp(host, port)
+    if not ok:
+        return False, detail
+    try:
+        r = httpx.get(f"https://{host}:{port}/", timeout=6, verify=False)
+        return r.status_code in (200, 301, 302, 401, 403), f"HTTPS {r.status_code}"
+    except Exception as e:
+        return False, str(e)
+
+
+def docker_container_states() -> list[Finding]:
+    """Leest lokale Docker socket (NAS)."""
+    findings = []
+    try:
+        out = subprocess.run(
+            ["docker", "ps", "-a", "--format", "{{.Names}}|{{.Status}}"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        if out.returncode != 0:
+            return [Finding("docker", "docker", False, out.stderr.strip() or "docker ps failed")]
+        for line in out.stdout.strip().splitlines():
+            if not line or "|" not in line:
+                continue
+            name, status = line.split("|", 1)
+            up = status.lower().startswith("up")
+            findings.append(
+                Finding(
+                    "docker",
+                    name,
+                    up,
+                    status,
+                    {"exited": "exited" in status.lower()},
+                )
+            )
+    except FileNotFoundError:
+        findings.append(Finding("docker", "docker", False, "docker CLI niet beschikbaar"))
+    return findings
+
+
+def lan_ping_watch(subnet: str, sample_hosts: list[str] | None = None) -> list[Finding]:
+    """Lightweight: ping gateway + optioneel lijst — geen mass scan standaard."""
+    findings = []
+    gateway = ".".join(subnet.split(".")[:3]) + ".1"
+    ok, detail = _ping_once(gateway)
+    findings.append(Finding("lan", "gateway", ok, detail, {"ip": gateway}))
+    return findings
+
+
+def _ping_once(ip: str) -> tuple[bool, str]:
+    try:
+        out = subprocess.run(
+            ["ping", "-c", "1", "-W", "2", ip],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        return out.returncode == 0, "reachable" if out.returncode == 0 else "no reply"
+    except Exception as e:
+        return False, str(e)
+
+
+def run_observation() -> ObservationReport:
+    targets = load_yaml("targets.yaml")
+    findings: list[Finding] = []
+
+    nas = targets.get("nas") or {}
+    host = nas.get("host", "192.168.1.211")
+    for chk in nas.get("checks") or []:
+        name = chk.get("name", "check")
+        if chk.get("type") == "tcp":
+            ok, detail = probe_tcp(host, int(chk["port"]))
+        elif chk.get("type") == "http":
+            ok, detail = probe_http(chk["url"])
+        else:
+            ok, detail = False, "unknown check type"
+        findings.append(Finding("nas", name, ok, detail))
+
+    for px in targets.get("proxmox_hosts") or []:
+        ok, detail = probe_proxmox(px["host"], int(px.get("port", 8006)))
+        findings.append(Finding("proxmox", px.get("name", px["host"]), ok, detail))
+
+    for svc in targets.get("services") or []:
+        ok, detail = probe_http(svc["url"], insecure=bool(svc.get("insecure_tls")))
+        findings.append(Finding("service", svc.get("name", svc["url"]), ok, detail))
+
+    findings.extend(docker_container_states())
+
+    lan = targets.get("lan_watch") or {}
+    if lan.get("enabled"):
+        findings.extend(lan_ping_watch(lan.get("subnet", "192.168.1.0/24")))
+
+    return ObservationReport(timestamp=datetime.utcnow().isoformat() + "Z", findings=findings)
@@ -0,0 +1,152 @@
+"""PostgreSQL — alle observaties voor dashboard :8765."""
+from __future__ import annotations
+
+import json
+import logging
+import os
+from datetime import datetime, timezone
+from typing import Any, Optional
+
+import psycopg2
+import psycopg2.extras
+
+from agent.brain import AgentDecision
+from agent.observer import ObservationReport
+
+logger = logging.getLogger(__name__)
+
+
+def _pg_enabled() -> bool:
+    return os.getenv("PG_DISABLED", "").lower() not in ("1", "true", "yes")
+
+
+def _connect():
+    url = os.getenv("DATABASE_URL", "").strip()
+    if url:
+        return psycopg2.connect(url)
+    return psycopg2.connect(
+        host=os.getenv("PG_HOST", "192.168.1.105"),
+        port=int(os.getenv("PG_PORT", "5433")),
+        user=os.getenv("PG_USER", "mo"),
+        password=os.getenv("PG_PASSWORD", ""),
+        dbname=os.getenv("PG_DATABASE", "homelab"),
+    )
+
+
+def _parse_ts(ts: str) -> datetime:
+    if ts.endswith("Z"):
+        ts = ts[:-1] + "+00:00"
+    return datetime.fromisoformat(ts)
+
+
+def persist_observation(report: ObservationReport, decision: AgentDecision) -> Optional[int]:
+    """Schrijf run + findings naar agent.*; retourneert run_id."""
+    if not _pg_enabled():
+        return None
+    summary = report.to_dict().get("summary") or {}
+    decision_json = {
+        "alert": decision.alert,
+        "severity": decision.severity,
+        "title": decision.title,
+        "body": decision.body,
+        "fingerprint": decision.fingerprint,
+        "actions": decision.actions,
+    }
+    try:
+        conn = _connect()
+        conn.autocommit = False
+        with conn.cursor() as cur:
+            cur.execute("SET search_path TO agent, public;")
+            cur.execute(
+                """
+                INSERT INTO observation_runs
+                  (observed_at, total_checks, failed_checks, summary, decision)
+                VALUES (%s, %s, %s, %s::jsonb, %s::jsonb)
+                RETURNING id
+                """,
+                (
+                    _parse_ts(report.timestamp),
+                    int(summary.get("total", len(report.findings))),
+                    int(summary.get("failed", sum(1 for f in report.findings if not f.ok))),
+                    json.dumps(report.to_dict(), default=str),
+                    json.dumps(decision_json, default=str),
+                ),
+            )
+            run_id = cur.fetchone()[0]
+            rows = [
+                (
+                    run_id,
+                    f.kind,
+                    f.name,
+                    f.ok,
+                    f.detail,
+                    json.dumps(f.meta or {}, default=str),
+                )
+                for f in report.findings
+            ]
+            if rows:
+                psycopg2.extras.execute_batch(
+                    cur,
+                    """
+                    INSERT INTO findings (run_id, kind, name, ok, detail, meta)
+                    VALUES (%s, %s, %s, %s, %s, %s::jsonb)
+                    """,
+                    rows,
+                )
+        conn.commit()
+        conn.close()
+        logger.info("PostgreSQL run %s: %d findings", run_id, len(rows))
+        return int(run_id)
+    except Exception as e:
+        logger.warning("PostgreSQL observatie mislukt: %s", e)
+        return None
+
+
+def persist_incident(
+    run_id: Optional[int],
+    fingerprint: str,
+    severity: str,
+    title: str,
+    body: str,
+    notified: bool,
+) -> None:
+    if not _pg_enabled():
+        return
+    try:
+        conn = _connect()
+        conn.autocommit = True
+        with conn.cursor() as cur:
+            cur.execute("SET search_path TO agent, public;")
+            cur.execute(
+                """
+                INSERT INTO incidents (run_id, fingerprint, severity, title, body, notified)
+                VALUES (%s, %s, %s, %s, %s, %s)
+                """,
+                (run_id, fingerprint, severity, title, body, notified),
+            )
+        conn.close()
+    except Exception as e:
+        logger.warning("PostgreSQL incident mislukt: %s", e)
+
+
+def was_notified_recently_pg(fingerprint: str, minutes: int) -> bool:
+    if not _pg_enabled():
+        return False
+    try:
+        conn = _connect()
+        with conn.cursor() as cur:
+            cur.execute("SET search_path TO agent, public;")
+            cur.execute(
+                """
+                SELECT 1 FROM incidents
+                WHERE fingerprint = %s AND notified = true
+                  AND created_at > NOW() - (%s || ' minutes')::interval
+                LIMIT 1
+                """,
+                (fingerprint, str(int(minutes))),
+            )
+            row = cur.fetchone()
+        conn.close()
+        return row is not None
+    except Exception:
+        return False
@@ -0,0 +1,75 @@
+"""SQLite — geheugen van de agent (dedupe, incidenten)."""
+import json
+import sqlite3
+from datetime import datetime, timedelta
+from pathlib import Path
+
+DB_PATH = Path(__file__).resolve().parent.parent / "data" / "agent.db"
+
+
+def connect():
+    DB_PATH.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(DB_PATH)
+    conn.row_factory = sqlite3.Row
+    conn.executescript(
+        """
+        CREATE TABLE IF NOT EXISTS incidents (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            fingerprint TEXT NOT NULL,
+            severity TEXT NOT NULL,
+            title TEXT NOT NULL,
+            body TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            notified INTEGER DEFAULT 0
+        );
+        CREATE INDEX IF NOT EXISTS idx_fp ON incidents(fingerprint);
+        CREATE TABLE IF NOT EXISTS runs (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            started_at TEXT NOT NULL,
+            summary TEXT,
+            raw_observations TEXT
+        );
+        """
+    )
+    return conn
+
+
+def was_notified_recently(fingerprint: str, minutes: int) -> bool:
+    since = (datetime.utcnow() - timedelta(minutes=minutes)).isoformat()
+    conn = connect()
+    row = conn.execute(
+        "SELECT 1 FROM incidents WHERE fingerprint=? AND notified=1 AND created_at>?",
+        (fingerprint, since),
+    ).fetchone()
+    conn.close()
+    return row is not None
+
+
+def record_incident(fingerprint: str, severity: str, title: str, body: str, notified: bool):
+    conn = connect()
+    conn.execute(
+        "INSERT INTO incidents (fingerprint, severity, title, body, created_at, notified) VALUES (?,?,?,?,?,?)",
+        (fingerprint, severity, title, body, datetime.utcnow().isoformat(), 1 if notified else 0),
+    )
+    conn.commit()
+    conn.close()
+
+
+def recent_incidents(limit: int = 10) -> list[dict]:
+    conn = connect()
+    rows = conn.execute(
+        "SELECT severity, title, body, created_at FROM incidents ORDER BY id DESC LIMIT ?",
+        (limit,),
+    ).fetchall()
+    conn.close()
+    return [dict(r) for r in rows]
+
+
+def log_run(summary: str, observations: dict):
+    conn = connect()
+    conn.execute(
+        "INSERT INTO runs (started_at, summary, raw_observations) VALUES (?,?,?)",
+        (datetime.utcnow().isoformat(), summary, json.dumps(observations, default=str)),
+    )
+    conn.commit()
+    conn.close()
@@ -0,0 +1,42 @@
+"""Telegram — enige externe meldkanaal."""
+import os
+import httpx
+
+
+def send_message(text: str, parse_mode: str = "HTML") -> bool:
+    token = os.environ.get("TELEGRAM_BOT_TOKEN", "").strip()
+    chat_id = os.environ.get("TELEGRAM_CHAT_ID", "").strip()
+    if not token or not chat_id:
+        return False
+    url = f"https://api.telegram.org/bot{token}/sendMessage"
+    # Telegram max ~4096
+    if len(text) > 4000:
+        text = text[:3990] + "…"
+    r = httpx.post(
+        url,
+        data={"chat_id": chat_id, "text": text, "parse_mode": parse_mode},
+        timeout=30,
+    )
+    return r.status_code == 200
+
+
+def format_alert(severity: str, title: str, body: str, actions=None) -> str:
+    icon = {"critical": "🔴", "high": "🟠", "medium": "🟡", "low": "🔵", "info": "⚪"}.get(
+        severity, "⚪"
+    )
+    lines = [
+        f"{icon} <b>EL-KADI SECURITY</b> · {severity.upper()}",
+        f"<b>{_esc(title)}</b>",
+        "",
+        _esc(body),
+    ]
+    if actions:
+        lines.append("")
+        lines.append("<b>Agent acties:</b>")
+        for a in actions:
+            lines.append(f"• {_esc(a)}")
+    return "\n".join(lines)
+
+
+def _esc(s: str) -> str:
+    return s.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
@@ -0,0 +1,20 @@
+# Agent-gedrag
+interval_seconds: 300
+quiet_hours:
+  start: "23:00"
+  end: "07:00"
+  timezone: Europe/Brussels
+  allow_severity: critical
+
+dedupe_minutes: 30
+
+severity_telegram:
+  - critical
+  - high
+
+# Zonder LLM: regels
+rules:
+  any_service_down: high
+  proxmox_unreachable: critical
+  nas_unreachable: critical
+  unknown_lan_device: medium
@@ -0,0 +1,44 @@
+# Doelen die de agent zelf monitort (geen Wazuh/Uptime Kuma/n8n)
+nas:
+  host: 192.168.1.211
+  checks:
+    - name: NAS SSH
+      type: tcp
+      port: 22
+    - name: Gitea
+      type: http
+      url: http://192.168.1.211:3000
+    - name: AdGuard
+      type: http
+      url: http://192.168.1.211:3001
+
+proxmox_hosts:
+  - name: pve
+    host: 192.168.1.216
+    port: 8006
+    tls: true
+  - name: dell-proxmox
+    host: 192.168.1.56
+    port: 8006
+    tls: true
+
+services:
+  - name: Homepage
+    url: http://192.168.1.192:3000
+  - name: Home Assistant
+    url: http://192.168.1.235:8123
+  - name: UniFi
+    url: https://192.168.1.24
+    insecure_tls: true
+  - name: Frigate
+    url: https://192.168.1.185:30058
+    insecure_tls: true
+  - name: Homelab Command
+    url: http://192.168.1.105:8765
+
+# Optioneel: bekende apparaten op LAN (ARP/ping — geen externe SIEM)
+lan_watch:
+  enabled: true
+  subnet: 192.168.1.0/24
+  # Bekende MACs → negeer of label (vul aan na eerste scan)
+  known_hosts: []
@@ -0,0 +1,20 @@
+# Autonome home security agent — geen Wazuh/Uptime Kuma/n8n
+services:
+  security-agent:
+    build: .
+    container_name: el-kadi-security-agent
+    restart: unless-stopped
+    network_mode: host
+    env_file:
+      - .env
+    environment:
+      PG_HOST: ${PG_HOST:-192.168.1.105}
+      PG_PORT: ${PG_PORT:-5433}
+      PG_USER: ${PG_USER:-mo}
+      PG_PASSWORD: ${PG_PASSWORD:-}
+      PG_DATABASE: ${PG_DATABASE:-homelab}
+    volumes:
+      - ./config:/app/config:ro
+      - ./data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    working_dir: /app
@@ -0,0 +1,51 @@
+-- Home Security Agent — observaties voor dashboard :8765 (schema agent.*)
+
+CREATE SCHEMA IF NOT EXISTS agent;
+
+CREATE TABLE IF NOT EXISTS agent.observation_runs (
+  id              bigserial PRIMARY KEY,
+  observed_at     timestamptz NOT NULL,
+  total_checks    integer NOT NULL DEFAULT 0,
+  failed_checks   integer NOT NULL DEFAULT 0,
+  summary         jsonb NOT NULL DEFAULT '{}',
+  decision        jsonb,
+  created_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS ix_agent_runs_observed
+  ON agent.observation_runs (observed_at DESC);
+
+CREATE TABLE IF NOT EXISTS agent.findings (
+  id              bigserial PRIMARY KEY,
+  run_id          bigint NOT NULL REFERENCES agent.observation_runs(id) ON DELETE CASCADE,
+  kind            text NOT NULL,
+  name            text NOT NULL,
+  ok              boolean NOT NULL,
+  detail          text,
+  meta            jsonb NOT NULL DEFAULT '{}',
+  created_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS ix_agent_findings_run ON agent.findings (run_id);
+CREATE INDEX IF NOT EXISTS ix_agent_findings_failed ON agent.findings (run_id, ok) WHERE NOT ok;
+
+CREATE TABLE IF NOT EXISTS agent.incidents (
+  id              bigserial PRIMARY KEY,
+  run_id          bigint REFERENCES agent.observation_runs(id) ON DELETE SET NULL,
+  fingerprint     text NOT NULL,
+  severity        text NOT NULL,
+  title           text NOT NULL,
+  body            text,
+  notified        boolean NOT NULL DEFAULT false,
+  created_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS ix_agent_incidents_created
+  ON agent.incidents (created_at DESC);
+
+CREATE INDEX IF NOT EXISTS ix_agent_incidents_fp
+  ON agent.incidents (fingerprint, created_at DESC);
+
+GRANT USAGE ON SCHEMA agent TO PUBLIC;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA agent TO PUBLIC;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA agent TO PUBLIC;
@@ -0,0 +1,5 @@
+httpx==0.28.1
+pyyaml==6.0.2
+openai==1.58.1
+python-dotenv==1.0.1
+psycopg2-binary==2.9.10
@@ -207,9 +207,9 @@

    - HA Voice Ctrl:
        icon: home-assistant.png
-        href: http://192.168.1.211:8765
+        href: http://192.168.1.105:8765
        description: HA Voice Ctrl
-        siteMonitor: http://192.168.1.211:8765
+        siteMonitor: http://192.168.1.105:8765
        statusStyle: dot

 - Productivity:
@@ -302,9 +302,9 @@

    - Neo4j Browser:
        icon: neo4j.png
-        href: http://192.168.1.211:49154
+        href: http://192.168.1.105:49154
        description: Neo4j Browser
-        siteMonitor: http://192.168.1.211:49154
+        siteMonitor: http://192.168.1.105:49154
        statusStyle: dot

    - OnlyOffice:
@@ -478,9 +478,9 @@

    - Home Control:
        icon: mdi-server-network-#14b8a6
-        href: http://192.168.1.211:8765/dashboard#live
+        href: http://192.168.1.105:8765/dashboard#live
        description: Home Control
-        siteMonitor: http://192.168.1.211:8765
+        siteMonitor: http://192.168.1.105:8765
        statusStyle: dot

 - Web Design:
@@ -14,7 +14,7 @@ services:
      POSTGRES_DATABASE: ${JOPLIN_DB:-joplin}
      POSTGRES_USER: ${POSTGRES_USER:-mo}
      POSTGRES_PORT: 5432
-      POSTGRES_HOST: postgres-homelab
+      POSTGRES_HOST: ${POSTGRES_HOST:-192.168.1.105}
    depends_on:
      - joplin-db

@@ -41,7 +41,7 @@ services:
    ports:
      - "${POSTGRES_EXPORTER_PORT:-9187}:9187"
    environment:
-      DATA_SOURCE_NAME: "postgresql://${PG_USER:-mo}:${PG_PASSWORD}@postgres-homelab:5432/${PG_DATABASE:-homelab}?sslmode=disable"
+      DATA_SOURCE_NAME: "postgresql://${PG_USER:-mo}:${PG_PASSWORD}@${PG_HOST:-192.168.1.105}:${PG_PORT:-5433}/${PG_DATABASE:-homelab}?sslmode=disable"
    networks:
      - homelab-monitor

@@ -12,14 +12,14 @@ scrape_configs:
    static_configs:
      - targets: ["postgres-exporter-homelab:9187"]
        labels:
-          instance: postgres-homelab
+          instance: postgres-vm102

  # Neo4j 4.4+ enterprise metrics.prometheus.enabled → endpoint op poort 2004
  - job_name: neo4j
    scrape_interval: 30s
    metrics_path: /metrics
    static_configs:
-      - targets: ["neo4j:2004"]
+      - targets: ["192.168.1.105:2004"]
        labels:
          instance: neo4j

@@ -2,7 +2,8 @@

 | | |
 |---|---|
+| **Productie** | **192.168.1.105** — Bolt :49153, Browser :49154 (`~/neo4j/` op VM 102) |
+| **NAS compose** | Oude map; stack verplaatst naar VM 102 |
 | **Poort** | 49153 |
-| **Start** | `docker compose up -d` |

 Zie [apps/README.md](../README.md) en [RESTORE.md](../../RESTORE.md).
@@ -22,6 +22,7 @@ services:
      # Masquerade root URL voor nginx reverse proxy
      - PGADMIN_CONFIG_SERVER_MODE=True
      - PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False
+      - PGADMIN_SERVER_JSON_FILE=/pgadmin4/servers.json

    volumes:
      - pgadmin-data:/var/lib/pgadmin        # persistentie: server lijst, instellingen
@@ -1,8 +1,23 @@
 {
  "Servers": {
    "1": {
-      "Name": "Homelab PostgreSQL",
-      "Group": "Servers",
+      "Name": "Homelab PostgreSQL (VM102)",
+      "Group": "Homelab",
+      "Host": "192.168.1.105",
+      "Port": 5433,
+      "MaintenanceDB": "homelab",
+      "Username": "mo",
+      "Password": "WaQTUw2t",
+      "SSLMode": "prefer",
+      "PassFile": "",
+      "SSLCert": "",
+      "SSLKey": "",
+      "SSLRootCert": "",
+      "Comment": "Proxmox VM 102 Postgress — productie homelab DB"
+    },
+    "2": {
+      "Name": "Homelab PostgreSQL NAS backup",
+      "Group": "Homelab",
      "Host": "192.168.1.211",
      "Port": 5433,
      "MaintenanceDB": "homelab",
@@ -13,7 +28,7 @@
      "SSLCert": "",
      "SSLKey": "",
      "SSLRootCert": "",
-      "Comment": "Synology NAS — Homelab dashboard database"
+      "Comment": "Oude NAS-kopie — rollback / vergelijken"
    }
  }
 }
@@ -2,7 +2,8 @@

 | | |
 |---|---|
+| **Productie** | **192.168.1.105:5433** (VM 102, `~/homelab-postgres/`) |
+| **NAS backup** | 192.168.1.211:5433 (`docker compose up -d` in deze map) |
 | **Poort** | 5433 |
-| **Start** | `docker compose up -d` |

 Zie [apps/README.md](../README.md) en [RESTORE.md](../../RESTORE.md).