Infrastructure Assessment

OpenBSD Perimeter (theseus - 192.168.1.2 / 10.0.0.1)

- Network: pf-aegis firewall with 5 segments (Host, VPN, WiFi, VM, Internet). All services bind to 10.0.0.1.
- DNS: unbound (caching, port 53) + nsd (authoritative, port 53535).
- Mail: smtpd + dovecot with DKIM. Virtual users via vmail.
- Web: relayd terminates TLS, forwards to httpd on 127.0.0.1:8080.
- VPN: openiked (IKEv2, certificate-based).
- Git: gitolite (SSH auth) + git-daemon (public read) + cgit (web).

Linux Compute Node (caravela - 192.168.1.4)

- AI/LLM: ollama serving models on 192.168.1.4:11434.
- Agent: hermes-agent installed system-wide, utilizing OpenRouter/Gemini/Ollama.