# TOOLS.md - Local Notes

Skills define _how_ tools work. This file is for environment-specific details: SSH hosts, device nicknames, voice preferences.

## Keychain

**Bitwarden** is the primary password manager.

| Tier | Location | What goes here |
|------|----------|----------------|
| 1 | `secretariat/keychain/` | API keys, service passwords, reissuable tokens. Check here first. |
| 2 | Bitwarden | Service passwords and login credentials |
| 3 | MLSBKC (USB, VeraCrypt) | SSN, bank accounts, master passwords, ID scans, tax returns. Irreversible-damage secrets. |

If `secretariat/keychain/` says `[MLSBKC/...]`, the secret is on the USB. If not found, ask Junwon.

**Mounting MLSBKC:** It's a VeraCrypt volume on a USB drive. Does NOT automount.
1. VeraCrypt password: `secretariat/keychain/mlsbkc-veracrypt.txt`
2. Mac sudo password: `secretariat/keychain/devices.txt` (mlsb-center)
3. Run: `echo "[sudo pw]" | sudo -S /usr/local/bin/veracrypt --text --non-interactive /dev/disk4s2 --password="[veracrypt pw]"`
4. Mounts as `/Volumes/MLSBKC`

New secrets: reversible (can revoke) → `secretariat/keychain/`. Irreversible (identity theft, financial fraud) → MLSBKC.

## Email

IMAP/SMTP only (not browser).
- ace@manglasabang.com, ace@palace.fund (Purelymail)
- HTML format, mobile-optimized (big fonts)
- Replies go through `marked()` — use GFM table syntax, never code fences (they render as `<pre>`, not `<table>`)

## Git Identity

- **Author/Committer:** `Ace Manglasabang <ace@manglasabang.com>`
- Never add Co-Authored-By: Claude or AI attribution. Ace is the author.
- Always set both explicitly. Don't rely on global git config.

## Package Manager

**pnpm** is the standard package manager across all projects. Never use npm or yarn.
- Install: `pnpm install` (not `npm install`)
- Run scripts: `pnpm exec <cmd>` or `pnpm run <script>`
- Dockerfiles: `corepack enable && corepack prepare pnpm@latest --activate`, then `pnpm install --frozen-lockfile`
- `node_modules/` is gitignored. Never commit it.

## Design

**Figma** (free plan, MCP: `mcp__figma__*`) is the design tool for wireframes and UI design. Chrome browser automation (`mcp__claude-in-chrome__*`) can also interact with Figma's web editor directly. Free plan has 6 AI tool calls/month — use Chrome automation for bulk wireframing work.

## Task Management

**Linear** (MCP: `mcp__linear-server__*`) is the task tracker.

## palacering.com Routing

**Uses `palaceplatform/caddy/`** — NOT Cloudflare Tunnel. Decision: Caddy is more flexible.

- Caddyfile: `palaceplatform/caddy/Caddyfile`
- Binary: `palaceplatform/caddy/caddy`
- Launchd: `com.manglasabang.caddy` (symlink → palaceplatform caddy plist)
- DNS: `palacering.com A 100.100.65.72` (Tailscale IP, DNS-only, no Cloudflare proxy — private network only)
- Env: `secretariat/keychain/caddy.env` (CLOUDFLARE_API_TOKEN for TLS DNS challenge)

To add a new palacering.com route: edit the Caddyfile, then reload via `curl -X POST http://localhost:2019/load -H "Content-Type: text/caddyfile" --data-binary @Caddyfile`.

## palacestableserver VM

Stable/beta server for Palace Ring. All Palace Ring beta users will be hosted here. Everything runs in Docker. Credentials: `secretariat/keychain/palacestableserver.txt`.

| Field | Value |
|-------|-------|
| IPv4 | 5.78.153.101 |
| SSH | `ssh -i secretariat/keychain/palacelab-vm root@5.78.153.101` |
| Stack | Ubuntu 24.04, Docker 29.3, Caddy (auto HTTPS) |
| Firewall | 22, 80, 443 only |
| Domain | stable.palacering.com |
| Compose | `/opt/palacestableserver/docker-compose.yml` |

**Postgres:** Running at `127.0.0.1:5432`, db `palacering`, user `palacering`. Schema: `users (id, username, password_hash, created_at)`.

**Caddy:** `/etc/caddy/Caddyfile`. Use `127.0.0.1` not `localhost` in reverse_proxy.

## Service Logins

| Service | Login | Account |
|---------|-------|---------|
| Cloudflare | Email/password | junwon@junwon.com (Bitwarden) |
| Neon | GitHub SSO | — |
| Supabase | GitHub SSO | — |

## Browser

- **Voice mode:** voice `bm_lewis`, speed `1.2`