1Password CLI & Docker Deployment Guide#

2026-08-03 Troubleshooting popups for MCP server with account tokens - To implement on VM’s using OP: agy –conversation=22663bf8-df61-4167-99ad-7a3d9884c879 1

1. Installation#

1.1. Install 1Password CLI (Linux VM)#

# 1. Add the key
curl -sS [https://downloads.1password.com/linux/keys/1password.asc](https://downloads.1password.com/linux/keys/1password.asc) | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg

# 2. Add the repository
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] [https://downloads.1password.com/linux/debian/amd64](https://downloads.1password.com/linux/debian/amd64) stable main' | sudo tee /etc/apt/sources.list.d/1password.list

# 3. Update and Install
sudo apt update && sudo apt install 1password-cli

1.2. Install 1Password CLI (LXC)#

# 1. Add the key
# 1. Ensure system initialization package is present
sudo apt update && sudo apt install systemd-sysv -y

# 2. Add the key securely
curl -sS [https://downloads.1password.com/linux/keys/1password.asc](https://downloads.1password.com/linux/keys/1password.asc) | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg

# 3. Add the official repository
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] [https://downloads.1password.com/linux/debian/amd64](https://downloads.1password.com/linux/debian/amd64) stable main' | sudo tee /etc/apt/sources.list.d/1password.list

# 4. Update repositories and install the CLI
sudo apt update && sudo apt install 1password-cli -y

1.3. Install 1Password CLI (macOS)#

# Install via Homebrew
brew install 1password-cli

2. Authentication & Account Setup#

2.1. Initial Account Setup (One-time)#

To add your 1Password account to the CLI manually:

Linux Initial Setup Guide#

1. Initial System Setup#

Timezone & Updates#

timedatectl set-timezone America/Toronto

apt update && apt full-upgrade -y

Warpification (Terminal UI)#

echo -e '\n# Auto-Warpify\nprintf '\''\eP$f{"hook": "SourcedRcFileForWarp", "value": { "shell": "bash", "uname": "'$(uname)'" }}\x9c'\'' ' >> ~/.bashrc

Essential Package Installation#

For Virtual Machines (Full Suite):

apt install gdebi curl sudo gpg ethtool ngrep lshw lsscsi cifs-utils ncdu etherwake lshw sudo tasksel fail2ban openssh-server qemu-guest-agent unzip smbclient fio iperf3 nmap net-tools apt-transport-https software-properties-common wget duf tldr zip git eza snapd samba glances -y

For LXC Containers (Lightweight):

Nextcloud Installation & Optimization Guide#

Antigracity-cli chat during last update: agy –conversation=208181d3-885d-4b18-8544-403c7747e6d1

1. PHP Configuration#

Ensure PHP 8.3 is tuned for Nextcloud performance.

Edit php.ini#

nano /etc/php/8.3/apache2/php.ini

Modify these values (remove the ; prefix):

memory_limit = 512M
upload_max_filesize = 200M
max_execution_time = 360
post_max_size = 200M
date.timezone = America/Toronto

; OPcache Settings
opcache.enable=1
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=10000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

Enable Apache Modules & APCu#

a2enmod dir env headers mime rewrite ssl

systemctl restart apache2

# Enable CLI for memory caching
nano /etc/php/8.3/mods-available/apcu.ini

Add:

Pangolin Tunnel Setup Guide#

Current VPS and SSH Access (Verified 2026-08-12)#

The current Pangolin VPS is hosted by RackNerd:

• VPS hostname: RN-VPS
• VPS public IP: 72.11.147.220
• Operating system: Ubuntu
• SSH port: TCP 22
• Current home public IP: 208.96.219.86 (may change when the ISP address changes)

SSH access is restricted by multiple layers:

1. UFW: incoming traffic is denied by default; TCP port 22 is allowed only from the current home public IP.
2. Fail2ban: the sshd jail has the current home public IP in ignoreip, so it is not accidentally banned. The value must also be present persistently in /etc/fail2ban/jail.local.
3. CrowdSec: the Pangolin container can enforce decisions through the Ubuntu host firewall via the INPUT and DOCKER-USER iptables chains.

The backup LXC connects outbound to the VPS. It does not require an inbound connection from the VPS to the home network. If the ISP IP changes, update both UFW and Fail2ban before the next backup.

UniFi Device SSH Configuration#

This guide covers hardening and configuring SSH access for UniFi consoles (UDM-SE, UNVR, UNAS-Pro) and management of secondary devices like Switches and Access Points.

1. Console Configuration (UDM-SE, UNVR, UNAS-Pro)#

SSH Key Setup#

1. Edit the authorized keys file to add your public keys:

nano .ssh/authorized_keys

# Restart the service
systemctl restart sshd

Install Tailscale#

For complete subnet advertising (10.1.0.0/16), exit node setup, and route approval guidelines, see the Tailscale Guide.

Windows 11 Optimization & SSH Setup#

This guide covers privacy hardening by disabling the “Recall” feature and setting up SSH keys for remote access to your homelab infrastructure.

1. Managing Windows Recall (AI Privacy)#

Windows Recall captures snapshots of your screen to help you find things you’ve seen. For increased privacy, you can manage this feature via the Deployment Image Servicing and Management (DISM) tool.

Check Status#

Run Command Prompt (CMD) as Administrator and execute: