diff --git a/300 areas/360 Dev-Ops Network Computers/FAMILY CONSOLE.md b/300 areas/360 Dev-Ops Network Computers/FAMILY CONSOLE.md
new file mode 100644
index 0000000..0dcdd1d
--- /dev/null
+++ b/300 areas/360 Dev-Ops Network Computers/FAMILY CONSOLE.md	
@@ -0,0 +1,52 @@
+---
+created: 2026-08-26
+modified: 2026-08-26
+type: note
+tags:
+  - family
+  - home-lab
+  - console
+  - portal
+  - maintenance
+aliases:
+  - Family Console
+  - Home Lab Console
+---
+# FAMILY CONSOLE
+
+Single reference for the self-hosted **Family Home Lab** console. Consolidates the four daily FAMILY notes (Build Status, Enterprise Architecture, S3/Garage, dsh Harness). Authoritative code/plan: `/home/sam/home_network/custom_tools/family_home_lab/` (repo on `.27` desktop; pushed to Gitea `sam/family_home_lab`).
+
+## What it is
+A private web **dashboard + tool launcher + chat tieren** for the family. Log in at `https://console.lab.audasmedia.com.au` and reach every self-hosted service in the home lab (media, docs, storage, AI, notes, portfolio), one per-user account.
+
+## Where it runs / how traffic flows
+- **Portal + core stack** run on the **`.13` server** (`/home/sam/Docker/Containers/family-home-lab/`): FastAPI + Jinja2 + HTMX portal on port `8500`, with Postgres (users/prefs), Redis, RabbitMQ, Celery, Garage S3.
+- **Reverse proxy / DNS**: existing **Caddy on `.35`**; public zone `*.lab.audasmedia.com.au` → `.35` → `.13`. `*.home.lab` are LAN-only.
+- **Data** under `/mnt/data/family-home-lab/` (garage, shared-media, dsh, pi-dashboard) — covered by Borg backup on `.13`.
+
+## How it works (key pieces)
+- **Accounts:** four users `sam` / `jo` / `harry` / `finn`. Login = bcrypt password in Postgres (changeable via the portal **Password** page). No SSO — every app keeps its own login.
+- **Home dash:** a categorized catalogue with a search box listing all services. Cards open tools; badges mark LAN-only / has-own-login / admin.
+- **Files:** upload from your browser → files appear in the webtop tools (e.g. GIMP) under `/media/<user>/`, with thumbnail + view + download (console → email etc.).
+- **Transcriber:** audio → MIDI (Basic Pitch) and sheet music (MuScriptor).
+- **Admin** (sam only): add/rename users, change passwords, **Pi Dashboard** (live pi agent sessions synced from the pi host), manage the tool catalogue.
+
+## Chat bot (dsh)
+A per-user DeepSeek chat harness (`dsh-sam·jo·harry·finn.lab`), **custom FastAPI + SSE**, one container each on `.13` (ports 3081–3084). Includes:
+- **Model picker** — chat (opencode-go flash) · reasoning (deepseek flash) · coding (deepseek pro) · **multimodal (GLM-5v)**. Default is opencode-go flash.
+- **Memory** — conversations saved with a sidebar (list/new/delete).
+- **Web & doc summarise**, **image ingest**, **image generate**, **video/screen-recording analyze** (ffmpeg → GLM).
+- **Hardened** — no shell/system calls: `cap_drop ALL`, read-only rootfs, non-root; read /workspace per user (on `/mnt/data/.../dsh/<user>/`).
+- Vision/media go through **OpenRouter**; text chat through **OmniRoute** on `.13:20129`.
+
+## Insights for future LLMs / maintenance (how to fix, edit, add)
+- **Edit → deploy flow:** change code in the repo (`.27`), commit + push to Gitea, then `scp`/rsync the changed folders to the matching `.13` dir and `docker compose up -d --build <service>`. Caddy edits happen on **`.35`** (back up `Caddyfile` first; reload with `caddy reload`).
+- **Auth gotcha:** Caddy basic-auth was **removed from the browser media/chat tools** earlier because it broke their asset loading (401s) — those have no login now. Apps with their own login kept it. Keep this in mind when adding a web tool.
+- **OmniRoute:** the built-in `auto/best-*` pools are flaky (stream empty). **Don't add combos via its API** (creates empty combos). dsh pins **deterministic** provider/model strings instead. OmniRoute is now behind Caddy basic-auth + a strong password (was being brute-forced).
+- **Secrets hygiene:** never put `.env`, API keys, or passwords in the repo. `.gitignore` covers `.env`/`.pi/`. OmniRoute/OpenRouter tokens are held by Sam (keep out of memory/notes).
+- **Kids:** jo/harry/finn get a reduced view (no AI/chat, no admin-only tools) and no shell in dsh.
+- **Storage:** Garage S3 buckets `sam, jo-media, harry, finn, shared-media` (S3 needs ≥3-char names). Per-user files land in `shared-media/<user>/`.
+
+## Related
+- Repo: `/home/sam/home_network/custom_tools/family_home_lab/` (`README.md`, `docs/websites.md`, `plan.md`)
+- [[Websites on Nixos-Dekstop 13]] · [[Home Network Map Overview]] · [[Docker Containers]]
\ No newline at end of file