Initial import: bare-metal stacks, Server UI, GPU fan, tutorials.

Infrastructure configs for GMKtec K11 (Docker, vLLM, LocalAI, ComfyUI,
control-plane, gpu-fan agent, Server UI with CLI/file explorer/GPU fan curve).

Co-authored-by: Cursor <cursoragent@cursor.com>

stacks/npmplus/scripts/regenerate-admin-cert.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Regenerate NPMPlus admin UI TLS cert (port 81) with SAN for LAN IP access.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+STACK_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${STACK_DIR}"
+
+if [[ -f .env ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  source .env
+  set +a
+fi
+
+DATA_ROOT="${DATA_ROOT:-/data}"
+TLS_DIR="${DATA_ROOT}/apps/npmplus/tls"
+LAN_IP="${LAN_IP:-$(hostname -I 2>/dev/null | awk '{print $1}')}"
+HOST_SHORT="${HOST_SHORT:-$(hostname -s 2>/dev/null || hostname)}"
+
+if [[ -z "${LAN_IP}" ]]; then
+  echo "ERROR: Could not detect LAN IP. Set LAN_IP in environment."
+  exit 1
+fi
+
+if [[ ! -d "${TLS_DIR}" ]]; then
+  echo "ERROR: ${TLS_DIR} not found. Start NPMPlus once: ./scripts/start.sh"
+  exit 1
+fi
+
+SAN="IP:${LAN_IP},DNS:${HOST_SHORT},DNS:localhost"
+TS="$(date +%Y%m%d%H%M%S)"
+
+echo "=== NPMPlus admin cert regeneration ==="
+echo "TLS dir:  ${TLS_DIR}"
+echo "SAN:      ${SAN}"
+echo ""
+
+if [[ "${EUID}" -ne 0 ]]; then
+  echo "Re-run as root to write certs owned by container:"
+  echo "  sudo ${SCRIPT_DIR}/regenerate-admin-cert.sh"
+  exit 1
+fi
+
+for f in dummycert.pem dummykey.pem; do
+  if [[ -f "${TLS_DIR}/${f}" ]]; then
+    cp -a "${TLS_DIR}/${f}" "${TLS_DIR}/${f}.bak.${TS}"
+    echo "Backed up ${f} -> ${f}.bak.${TS}"
+  fi
+done
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "${TMP}"' EXIT
+
+openssl req -x509 -nodes -days 3650 -newkey rsa:4096 \
+  -keyout "${TMP}/dummykey.pem" \
+  -out "${TMP}/dummycert.pem" \
+  -subj "/CN=${HOST_SHORT}" \
+  -addext "subjectAltName=${SAN}"
+
+install -m 600 -o root -g root "${TMP}/dummykey.pem" "${TLS_DIR}/dummykey.pem"
+install -m 644 -o root -g root "${TMP}/dummycert.pem" "${TLS_DIR}/dummycert.pem"
+
+echo ""
+echo "Installed new cert. Verifying SAN:"
+openssl x509 -in "${TLS_DIR}/dummycert.pem" -noout -text | grep -A1 'Subject Alternative Name' || true
+
+if docker ps --format '{{.Names}}' | grep -qx npmplus; then
+  echo ""
+  echo "Restarting npmplus..."
+  docker compose --profile npmplus restart npmplus
+else
+  echo ""
+  echo "Container npmplus not running — start with: ./scripts/start.sh"
+fi
+
+echo ""
+echo "Admin UI: https://${LAN_IP}:81"
+echo "Use HTTPS (not http). Accept the self-signed cert warning once in the browser."