Local AI Showcases - Chat Edition

Machine: lol the basement lab is a constellation of machines

Problem: I needed to test out a wiki.

Prompt:

We need a wiki for the lab, i want you to stand up the Outline wiki, nginx TLS-fronted, backed by our Postgres, with Microsoft/Entra sign-in as the only login. Done = I can browse to it and complete a "Continue with Microsoft" login end to end.

we want to use the URL https://wiki.top-s3cret-lab-domain.com to reach the wiki

Use the right tool for each job:
- Proxmox — build the ubuntu VM on the same lab subnet and our usual initial sizing
- RCON — install it on the new VM first so it's remotely manageable; wait for it to load and confirm XConnect can reach it before proceeding. curl -fsSk https://xconnect.top-s3cret-lab-domain.com/bootstrap/install.sh | RCON_JOIN_TOKEN=obviously_not_real_7R2zviGYo sh
- Cloudflare-DNS MCP — create an unproxied DNS-only A record wiki.top-s3cret-lab-domain.com → the VM's IP.
- certbot MCP — find the cert that covers wiki.top-s3cret-lab-domain.com. If one exists deliver it to the box via the pull link and wire nginx; since this box is brand new, that's the initial (bootstrap) delivery — also set up the monthly keyhash refresh for future renewals. If no cert covers the name, STOP and tell me.
- XConnect — on database.top-s3cret-lab-domain.top, create a dedicated outline Postgres role + database.
- Azure CLI MCP — create the Entra app registration in our tenant and wire up SSO, make sure user assignment is required, and assign users Three and Meta as users of the app. Add Three as the apps OWNER.

Outline's requirements — don't skip these:
- Postgres (the DB above) and Redis (required — run Redis alongside Outline on the new VM).
- Run Outline as a container; FILE_STORAGE=local on a persistent volume from docker.getoutline.com/outlinewiki/outline:latest
- Generate SECRET_KEY and UTILS_SECRET (32-byte hex) on the box; set URL=https://wiki.top-s3cret-lab-domain.com, DATABASE_URL, REDIS_URL.
- nginx reverse-proxies 443 → Outline (127.0.0.1:3000) and must forward websocket upgrade headers.
- Entra: web redirect URI = https://wiki.top-s3cret-lab-domain.com/auth/azure.callback, a client secret, delegated openid profile email offline_access + User.Read. Wire AZURE_CLIENT_ID/SECRET/TENANT_ID into Outline. Confirm the exact auth env-var names and callback path against Outline's docs for the version you deploy (they've changed across releases).

Guardrails:
- Verify each layer before moving on (DNS resolves → TLS serves the wiki cert → app is up → login works). Don't declare success until the Microsoft login actually completes.
- Before anything irreversible (deleting the VM, dropping a DB, replacing an existing DNS record), stop and wait for user confirmation.
- Keep secrets (client secret, SECRET_KEY, cert key) out of chat — write them straight into the box's env file.

Model: Deepseek v4 on VLLM

Harness: Turnstone

Result: A wiki, stood up and running with a vm, database, dns, certificate, single sign on in azure entra id…

No but seriously, i posted a whole series of youtube videos in another thread. Infrastructure-as-Code is dead, long live Infrastructure-as-Claude!