diff --git a/RESUME.md b/RESUME.md index 816ce6b..df2d401 100644 --- a/RESUME.md +++ b/RESUME.md @@ -6,10 +6,8 @@ Last updated: 2026-05-22. Update this at the end of every session. ### πŸ”΄ Critical β€” security risk or unrecoverable data loss - [ ] **Password rotation: `tapirnase`** β€” shared across WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, Backrest repo password. Single sniff = broad blast radius. Rotate per-service. See `services/homelab-architecture.md` Β§operational rules. -- [ ] **UniFi MFA JWT in homepage logs** β€” JWT found in `homepage/config/logs/homepage.log`. Rotate + scrub. See `services/homelab-architecture.md`. - [ ] **UNAS personal data off-host** β€” ~820 GB Immich library + UNAS bulk have zero off-host copy. Deploy rclone sync: `media/images/library` β†’ jottacloud:Photos + full UNAS β†’ jottacloud:UNAS. See `services/backrest.md` phase 1a. - [ ] **Nextcloud Borg passphrase β†’ Vaultwarden** β€” passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b. -- [ ] **LiteLLM DB password** β€” placeholder `litellm_password_here` in `.env` + CT 113 user. Generate real password; update both. See `services/backrest.md` blind spot #6. ### 🟠 High β€” known broken / verification needed - [ ] **Arcane OIDC secret** β€” rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates. @@ -19,10 +17,7 @@ Last updated: 2026-05-22. Update this at the end of every session. - [ ] **Zoraxy audit** β€” CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency. See `services/zoraxy.md`. ### 🟑 Medium β€” incomplete migrations / cleanup debt -- [ ] **Drop stale `daytona` DB** β€” Daytona decommissioned 2026-05-20; DB still on shared-postgres CT 113. Drop it. -- [ ] **Remove old CT 111 Docker volumes** β€” `coder-db` + `gitea-db` may be stale after migration to CT 113. Verify and remove. -- [ ] **Migration dump cleanup** β€” `/mnt/pve/unas/dump/*-migration-20260521.sql` (~492 MB). Keep or delete. -- [ ] **Docker disk reclaim** β€” ~13 GB reclaimable on CT 104 (8.3 GB unused images, 4.6 GB build cache). `docker system prune -a` after confirming. See `infra/proxmox-state.md` Β§10c. +- [ ] **Docker disk reclaim** β€” ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` Β§10c. - [ ] **Dormant stacks audit** β€” ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` Β§10c. - [ ] **Config-to-git** β€” push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3. - [ ] **D-Link hardening** β€” admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.