# TOOLS.md - Local Notes

Skills define _how_ tools work. This file is for _your_ specifics — the stuff that's unique to your setup.

## What Goes Here

Things like:

- Camera names and locations
- SSH hosts and aliases
- Preferred voices for TTS
- Speaker/room names
- Device nicknames
- Anything environment-specific

## Examples

```markdown
### Cameras

- living-room → Main area, 180° wide angle
- front-door → Entrance, motion-triggered

### SSH

- home-server → 192.168.1.100, user: admin

### TTS

- Preferred voice: "Nova" (warm, slightly British)
- Default speaker: Kitchen HomePod
```

## Why Separate?

Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.

---

Add whatever helps you do your job. This is your cheat sheet.

## Related

- [Agent workspace](/concepts/agent-workspace)

---

## Beawit Vault (beavault)

**URL:** https://beavault.beawit.net:8200  
**Purpose:** Centralized secret management for all API tokens, credentials, and sensitive configuration

### Accessing Vault

Vault uses AppRole authentication. Credentials are stored in:
- `/home/jcbeasley/Documents/vault-approles.txt`

### Authentication

```bash
# Get vault token using automation role
curl -sk -X POST \
  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
  "https://beavault.beawit.net:8200/v1/auth/approle/login" | jq -r '.auth.client_token'
```

### Reading Secrets

```bash
VAULT_TOKEN="<token_from_above>"
curl -sk -H "X-Vault-Token: $VAULT_TOKEN" \
  "https://beavault.beawit.net:8200/v1/kv/data/api/<category>/<key>"
```

### Vault Structure

Secrets are organized under `kv/data/api/`:

| Category | Contents |
|----------|----------|
| `ai-ml` | DeepSeek, Groq, OpenRouter, Mistral, etc. |
| `infrastructure` | NocoDB, Metabase, Qdrant, Odoo, Gitea, etc. |
| `integration` | N8N, HomeAssistant, Skybox, Tavily |
| `business` | Stripe, Apollo, Hunter, Kimai, InvoiceNinja |
| `external` | Email, SnipeIT, FreePBX, SearXNG |
| `communication` | Discord, Twitter, Uptime Kuma |
| `monitoring` | Uptime Kuma, SpeedTracker |
| `search` | SerpAPI, Firecrawl, ImageRouter |
| `media` | Pexels, YouTube, Freepik, JSON2Video |
| `credentials` | DB configs, collection names, paths |

### Service-Specific Access

For read-only access to specific paths, use the appropriate service role:

- `svc-ai-ml` - AI/ML services
- `svc-infrastructure` - Infrastructure services  
- `svc-business` - Business services
- `svc-communication` - Communication services
- `svc-monitoring` - Monitoring services
- `svc-media` - Media services
- `svc-search` - Search services
- `svc-integration` - Integration services
- `svc-external` - External services
- `svc-credentials` - Credential configs

See `/home/jcbeasley/Documents/vault-approles.txt` for role IDs and secret IDs.