chore: sync homelab ops, identity, and monitoring docs

docs/servers/NOMAD.md

@@ -199,6 +199,46 @@ These are expected to be managed by Wings/Pelican rather than a local compose fi
   - Topic thumbs write back to `doris-digest/data/feedback.json`.
   - Paperless acknowledge/dismiss state writes to `/opt/doris-dashboard/data/paperless_review_state.json` on the live host.
 
+### MeshCore to MQTT relay
+- Install date: 2026-05-18
+- Install root: `/opt/mctomqtt`
+- Config root: `/etc/mctomqtt`
+- Service account: `mctomqtt:mctomqtt`
+- Installer metadata: `.version_info` reports `installer_version: 1.3.0.0-preview`, repo `Cisien/meshcoretomqtt`, branch `main`, commit `10f7c0e`
+- Detected install type marker: `/opt/mctomqtt/.install_type` contains `docker`
+- Runtime model:
+  - Active runtime is a standalone Docker container named `mctomqtt`
+  - Image: `mctomqtt:latest`
+  - Command: `python3 /opt/mctomqtt/mctomqtt.py`
+  - User: `mctomqtt`
+  - Restart policy: `unless-stopped`
+  - Network mode: `bridge`
+  - Config bind mount: `/etc/mctomqtt:/etc/mctomqtt:ro`
+  - Device passthrough: the Heltec serial device is mapped directly into the container at the same `/dev/serial/by-id/... ` path
+- Systemd note:
+  - The packaged repo also includes `/opt/mctomqtt/mctomqtt.service`, but it is not the active runtime on NOMAD
+  - No installed unit was present in `/etc/systemd/system` or `/lib/systemd/system`
+  - The bundled unit expects `/opt/mctomqtt/venv/bin/python3`, but no `venv/` directory exists under `/opt/mctomqtt`
+  - Treat the systemd unit as an unused package artifact for this host unless the deployment model changes later
+- Config layering:
+  - Base reference: `/etc/mctomqtt/config.toml`
+  - Preset overlay: `/etc/mctomqtt/config.d/10-meshmapper.toml`
+  - Local overrides: `/etc/mctomqtt/config.d/99-user.toml`
+- Current local overrides observed:
+  - IATA region code set to `BNA`
+  - Serial device pinned to `/dev/serial/by-id/usb-Espressif_Systems_heltec_wifi_lora_32_v4__16_MB_FLASH__2_MB_PSRAM__441BF670B684-if00`
+  - Enabled broker targets include MeshMapper, LetsMesh US, and NashMe
+  - Credentials/secrets are stored inline in `99-user.toml`; do not mirror them into git-backed docs
+- Container health observed during inspection:
+  - Logs show the relay loading all three config layers, opening the Heltec serial device, and connecting successfully to MeshMapper, NashMe, and LetsMesh US after restart
+  - The current container had been up about 5 minutes during inspection with `MQTT: 3/3`, zero failures, and live RX air-time reported
+  - An earlier start logged one DNS resolution failure for a broker label shown as `custom-2`, but the current running container recovered and all three named brokers connected cleanly
+- Container logs / inspection:
+  - Use `docker logs mctomqtt` for runtime output
+  - Use `docker inspect mctomqtt` for bind mounts, device mappings, and restart policy
+- Documentation linkage:
+  - Related mesh stack notes live in [MESHTASTIC.md](../reference/MESHTASTIC.md)
+
 ### Live deployment path rule
 - On NOMAD, live service roots belong under `/opt/<service>`.
 - That includes host-run services **and** standalone Docker Compose deployments that are not part of the core Project N.O.M.A.D. stack.