fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

backlog: sync to truth — drop 4 already-done items, correct disk numbers

Browse Source
This commit is contained in:
Florian Krebs
2026-05-22 23:27:07 +02:00
parent b090b4a4a8
commit 05ad2b7d26
1 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RESUME.md
+1 -6
View File
@@ -6,10 +6,8 @@ Last updated: 2026-05-22. Update this at the end of every session.
### 🔴 Critical — security risk or unrecoverable data loss ### 🔴 Critical — security risk or unrecoverable data loss
- [ ] **Password rotation: `tapirnase`** — shared across WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, Backrest repo password. Single sniff = broad blast radius. Rotate per-service. See `services/homelab-architecture.md` §operational rules. - [ ] **Password rotation: `tapirnase`** — shared across WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, Backrest repo password. Single sniff = broad blast radius. Rotate per-service. See `services/homelab-architecture.md` §operational rules.
- [ ] **UniFi MFA JWT in homepage logs** — JWT found in `homepage/config/logs/homepage.log`. Rotate + scrub. See `services/homelab-architecture.md`.
- [ ] **UNAS personal data off-host** — ~820 GB Immich library + UNAS bulk have zero off-host copy. Deploy rclone sync: `media/images/library` → jottacloud:Photos + full UNAS → jottacloud:UNAS. See `services/backrest.md` phase 1a. - [ ] **UNAS personal data off-host** — ~820 GB Immich library + UNAS bulk have zero off-host copy. Deploy rclone sync: `media/images/library` → jottacloud:Photos + full UNAS → jottacloud:UNAS. See `services/backrest.md` phase 1a.
- [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b. - [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b.
- [ ] **LiteLLM DB password** — placeholder `litellm_password_here` in `.env` + CT 113 user. Generate real password; update both. See `services/backrest.md` blind spot #6.
### 🟠 High — known broken / verification needed ### 🟠 High — known broken / verification needed
- [ ] **Arcane OIDC secret** — rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates. - [ ] **Arcane OIDC secret** — rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates.
@@ -19,10 +17,7 @@ Last updated: 2026-05-22. Update this at the end of every session.
- [ ] **Zoraxy audit** — CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency. See `services/zoraxy.md`. - [ ] **Zoraxy audit** — CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency. See `services/zoraxy.md`.
### 🟡 Medium — incomplete migrations / cleanup debt ### 🟡 Medium — incomplete migrations / cleanup debt
- [ ] **Drop stale `daytona` DB** — Daytona decommissioned 2026-05-20; DB still on shared-postgres CT 113. Drop it. - [ ] **Docker disk reclaim** — ~17 GB reclaimable on CT 104 (10.3 GB unused images, 6.9 GB build cache). `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c.
- [ ] **Remove old CT 111 Docker volumes** — `coder-db` + `gitea-db` may be stale after migration to CT 113. Verify and remove.
- [ ] **Migration dump cleanup** — `/mnt/pve/unas/dump/*-migration-20260521.sql` (~492 MB). Keep or delete.
- [ ] **Docker disk reclaim** — ~13 GB reclaimable on CT 104 (8.3 GB unused images, 4.6 GB build cache). `docker system prune -a` after confirming. See `infra/proxmox-state.md` §10c.
- [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c. - [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c.
- [ ] **Config-to-git** — push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3. - [ ] **Config-to-git** — push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3.
- [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`. - [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.