From 377f20a8177521a0bc94b4cb087d130ea2e8120c Mon Sep 17 00:00:00 2001 From: "fkrebs (via Claude)" Date: Fri, 22 May 2026 23:50:38 +0200 Subject: [PATCH] todo sync: update Backrest media-repo status, Vaultwarden OIDC status, UNAS off-host context - video-projects-plan has never completed; media-backup-plan last OK 2026-05-21 - Both plans have orphaned runs since 19:10; Backrest restarted at 21:23 - Next runs scheduled 2026-05-25 - Vaultwarden OIDC: no env vars wired in .env as of 2026-05-22 - UNAS off-host: Backrest is the right vehicle; reliability fix is prerequisite Co-Authored-By: Claude Sonnet 4.6 --- RESUME.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/RESUME.md b/RESUME.md index b6510a9..77693d2 100644 --- a/RESUME.md +++ b/RESUME.md @@ -6,12 +6,12 @@ Last updated: 2026-05-22. Update this at the end of every session. ### πŸ”΄ Critical β€” security risk or unrecoverable data loss - [ ] **Password rotation: `tapirnase`** β€” shared across WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, Backrest repo password. Single sniff = broad blast radius. Rotate per-service. See `services/homelab-architecture.md` Β§operational rules. -- [ ] **UNAS personal data off-host** β€” ~820 GB Immich library + UNAS bulk have zero off-host copy. Deploy rclone sync: `media/images/library` β†’ jottacloud:Photos + full UNAS β†’ jottacloud:UNAS. See `services/backrest.md` phase 1a. +- [ ] **UNAS personal data off-host** β€” ~820 GB Immich library partially covered by `media-backup-plan` in Backrest (last OK 2026-05-21 but failing/orphaned). `video-projects-plan` never completed. Backrest is the right vehicle β€” fix reliability first (see 🟠 Backrest item), then verify JottaCloud coverage. See `services/backrest.md` phase 1a. - [ ] **Nextcloud Borg passphrase β†’ Vaultwarden** β€” passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b. ### 🟠 High β€” known broken / verification needed - [ ] **Arcane OIDC secret** β€” rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates. -- [ ] **Backrest media-repo** β€” `video-projects-plan` and `media-backup-plan` were at 0 snapshots as of 2026-05-22 19:10. Verify snapshots landed. +- [ ] **Backrest media-repo** β€” `video-projects-plan` has NEVER completed a successful snapshot. `media-backup-plan` last OK 2026-05-21; failed 2026-05-22 01:30; orphaned restic run in progress since 19:10 (Backrest restarted 21:23, orphaned it). Both plans next scheduled 2026-05-25 02:00/01:30. Monitor for completion; if they fail again, investigate rclone:jottacloud:media auth. - [ ] **AdGuard split-horizon DNS** β€” internal clients still resolve to public IPs. Rewrite rules audit. See `services/adguard-dns.md`. - [ ] **WAL-G monitoring** β€” silent stall went undetected for 13 h. Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap. - [ ] **Zoraxy audit** β€” CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency. See `services/zoraxy.md`. @@ -21,7 +21,7 @@ Last updated: 2026-05-22. Update this at the end of every session. - [ ] **Dormant stacks audit** β€” ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` Β§10c. - [ ] **Config-to-git** β€” push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3. - [ ] **D-Link hardening** β€” admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`. -- [ ] **Vaultwarden OIDC SSO** β€” Pocket-ID client created 2026-05-21, auth flow not wired up. +- [ ] **Vaultwarden OIDC SSO** β€” Pocket-ID client created 2026-05-21, auth flow not wired up. Confirmed no OIDC vars in `/opt/stacks/vaultwarden/.env` as of 2026-05-22. ### πŸ”΅ Planned β€” requires infrastructure or significant effort - [ ] **CT 109 "ops"** β€” LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Blocks monitoring stack + Arcane migration. See `infra/proxmox-state.md` Β§16.