# TOOLS.md - Local Notes

Skills define _how_ tools work. This file is for _your_ specifics — the stuff that's unique to your setup.

## What Goes Here

Things like:

- Camera names and locations
- SSH hosts and aliases
- Preferred voices for TTS
- Speaker/room names
- Device nicknames
- Anything environment-specific

## Examples

```markdown
### Cameras

- living-room → Main area, 180° wide angle
- front-door → Entrance, motion-triggered

### SSH

- home-server → 192.168.1.100, user: admin

### TTS

- Preferred voice: "Nova" (warm, slightly British)
- Default speaker: Kitchen HomePod
```

## Why Separate?

Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.

---

Add whatever helps you do your job. This is your cheat sheet.

## Related

- [Agent workspace](/concepts/agent-workspace)

---

## Beawit Vault (beavault)

**URL:** https://beavault.beawit.net:8200  
**Purpose:** Centralized secret management for all API tokens, credentials, and sensitive configuration

### Accessing Vault

Vault uses AppRole authentication. Credentials are stored in:
- `/home/jcbeasley/Documents/vault-approles.txt`

### Authentication

```bash
# Get vault token using automation role
curl -sk -X POST \
  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
  "https://beavault.beawit.net:8200/v1/auth/approle/login" | jq -r '.auth.client_token'
```

### Reading Secrets

```bash
VAULT_TOKEN="<token_from_above>"
curl -sk -H "X-Vault-Token: $VAULT_TOKEN" \
  "https://beavault.beawit.net:8200/v1/kv/data/api/<category>/<key>"
```

### Vault Structure

Secrets are organized under `kv/data/api/`:

| Category | Contents |
|----------|----------|
| `ai-ml` | DeepSeek, Groq, OpenRouter, Mistral, etc. |
| `infrastructure` | NocoDB, Metabase, Qdrant, Odoo, Gitea, etc. |
| `integration` | N8N, HomeAssistant, Skybox, Tavily |
| `business` | Stripe, Apollo, Hunter, Kimai, InvoiceNinja |
| `external` | Email, SnipeIT, FreePBX, SearXNG |
| `communication` | Discord, Twitter, Uptime Kuma |
| `monitoring` | Uptime Kuma, SpeedTracker |
| `search` | SerpAPI, Firecrawl, ImageRouter |
| `media` | Pexels, YouTube, Freepik, JSON2Video |
| `credentials` | DB configs, collection names, paths |

## Available Infrastructure

### rustfs (S3-Compatible Object Storage)
- **Endpoint:** `http://192.168.19.17:9002`
- **Bucket:** `duma-memories`
- **Access Key:** `rustfsadmin`
- **Secret Key:** `[in vault: rustfs-secret-key]`
- **Usage:** Agent memory storage, file backups

### Qdrant (Vector Database)
- **URL:** `http://192.168.19.17:6333`
- **API Key:** `[in vault: qdrant-api-key]`
- **Usage:** Semantic memory, experience retrieval

### NocoDB (Database GUI)
- **URL:** `http://192.168.25.5:8080`
- **Token:** `[in vault: nocodb-token]`
- **Table ID:** `ml5pemji4c85n6e`
- **Usage:** Structured data, agent runs logging

### Metabase
- **URL:** `http://metabase.beawit.net:3000`
- **Username:** `jc.beasley@beawit.net`
- **Password:** `[in vault: metabase-password]`

### Odoo
- **URL:** `http://192.168.16.4:8069`
- **API Key:** `[in vault: odoo-api-key]`

### Service-Specific Access

For read-only access to specific paths, use the appropriate service role:

- `svc-ai-ml` - AI/ML services
- `svc-infrastructure` - Infrastructure services  
- `svc-business` - Business services
- `svc-communication` - Communication services
- `svc-monitoring` - Monitoring services
- `svc-media` - Media services
- `svc-search` - Search services
- `svc-integration` - Integration services
- `svc-external` - External services
- `svc-credentials` - Credential configs

See `/home/jcbeasley/Documents/vault-approles.txt` for role IDs and secret IDs.
