From b090b4a4a88312f8798478f7586ee1a44544964a Mon Sep 17 00:00:00 2001 From: "fkrebs (via Claude)" Date: Fri, 22 May 2026 23:25:39 +0200 Subject: [PATCH] backlog: reorder by urgency (critical/high/medium/planned) --- RESUME.md | 81 +++++++++++++++++++++++-------------------------------- 1 file changed, 33 insertions(+), 48 deletions(-) diff --git a/RESUME.md b/RESUME.md index 3fb9fea..816ce6b 100644 --- a/RESUME.md +++ b/RESUME.md @@ -2,58 +2,43 @@ Last updated: 2026-05-22. Update this at the end of every session. -## Open items (priority order) +## Open items (urgency order) -### Backup gaps -- [x] ~~**Pocket-ID backup**~~ — done 2026-05-22. Pre-hook on CT 103 exports via `pocket-id export` + copies keys to UNAS staging; `services-backup-plan` → jottacloud. Verified snapshot includes Pocket-ID data. -- [ ] **Backrest media-repo** — `video-projects-plan` and `media-backup-plan` were at 0 snapshots but both restic processes were actively running as of 2026-05-22 19:10. Verify snapshots landed after they complete. -- [x] ~~**Gitea repos**~~ — already in `services-backup-plan` → jottacloud. DB on CT 113 (WAL-G). -- [x] ~~**Coder workspace homes**~~ — already in `services-backup-plan` → jottacloud. +### 🔴 Critical — security risk or unrecoverable data loss +- [ ] **Password rotation: `tapirnase`** — shared across WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, Backrest repo password. Single sniff = broad blast radius. Rotate per-service. See `services/homelab-architecture.md` §operational rules. +- [ ] **UniFi MFA JWT in homepage logs** — JWT found in `homepage/config/logs/homepage.log`. Rotate + scrub. See `services/homelab-architecture.md`. +- [ ] **UNAS personal data off-host** — ~820 GB Immich library + UNAS bulk have zero off-host copy. Deploy rclone sync: `media/images/library` → jottacloud:Photos + full UNAS → jottacloud:UNAS. See `services/backrest.md` phase 1a. +- [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b. +- [ ] **LiteLLM DB password** — placeholder `litellm_password_here` in `.env` + CT 113 user. Generate real password; update both. See `services/backrest.md` blind spot #6. -### Infrastructure -- [ ] **CT 109 "ops"** — planned LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Not yet built. See `infra/proxmox-state.md` §16. -- [ ] **Second NVMe** — needed before Postgres consolidation (CT 113) and rpool mirror. Unblocks moving remaining per-stack PG containers to CT 113. -- [x] ~~**Vaultwarden NFS cleanup**~~ — `/mnt/pve/unas/services/vaultwarden/` deleted 2026-05-22. -- [x] ~~**apps/backrest rename**~~ — done 2026-05-22 (renamed from PVE host via ZFS subvolume path; idmapped LXC blocked it from inside CT 104). +### 🟠 High — known broken / verification needed +- [ ] **Arcane OIDC secret** — rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates. +- [ ] **Backrest media-repo** — `video-projects-plan` and `media-backup-plan` were at 0 snapshots as of 2026-05-22 19:10. Verify snapshots landed. +- [ ] **AdGuard split-horizon DNS** — internal clients still resolve to public IPs. Rewrite rules audit. See `services/adguard-dns.md`. +- [ ] **WAL-G monitoring** — silent stall went undetected for 13 h. Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap. +- [ ] **Zoraxy audit** — CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency. See `services/zoraxy.md`. -### MCP / AI stack -- [ ] **Consolidate syncstack → MCP gateway** — `syncstack.py` cron is fragile; move LiteLLM model polling + LobeChat model-list sync into `mcp-gateway/server.py` alongside the existing plugin sync loop. Delete syncstack container + cron after. -- [ ] **crawl4ai SSE StreamConsumed** — intermittent 502s on first request after gateway restart (race with in-flight requests from old code). Investigate if still present after a clean restart cycle; likely harmless but worth confirming. +### 🟡 Medium — incomplete migrations / cleanup debt +- [ ] **Drop stale `daytona` DB** — Daytona decommissioned 2026-05-20; DB still on shared-postgres CT 113. Drop it. +- [ ] **Remove old CT 111 Docker volumes** — `coder-db` + `gitea-db` may be stale after migration to CT 113. Verify and remove. +- [ ] **Migration dump cleanup** — `/mnt/pve/unas/dump/*-migration-20260521.sql` (~492 MB). Keep or delete. +- [ ] **Docker disk reclaim** — ~13 GB reclaimable on CT 104 (8.3 GB unused images, 4.6 GB build cache). `docker system prune -a` after confirming. See `infra/proxmox-state.md` §10c. +- [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c. +- [ ] **Config-to-git** — push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3. +- [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`. +- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up. -### Security / secrets -- [ ] **Password rotation: `tapirnase`** — used as WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, and Backrest repo password. Single sniff = broad blast radius. Rotate all per-service. See `services/homelab-architecture.md` §operational rules. -- [ ] **LiteLLM DB password** — placeholder `litellm_password_here` in `.env` + CT 113 user. Generate real password and update both. See `services/backrest.md` blind spot #6. -- [ ] **Infisical secrets migration** — CT 112 provisioned but migration not started. Phase 1-4: move 85+ `.env` keys into central store. See `services/secrets-manager.md`. -- [ ] **UniFi MFA JWT in homepage logs** — JWT found in `homepage/config/logs/homepage.log`. Rotate JWT + scrub log. See `services/homelab-architecture.md`. -- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21 but auth flow not wired up. Complete integration. -- [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase stored only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b. - -### Backup gaps (extended) -- [ ] **UNAS personal data off-host** — ~820 GB Immich library + UNAS bulk not replicated off-host. Deploy rclone sync jobs: `media/images/library` → jottacloud:Photos + full UNAS → jottacloud:UNAS. See `services/backrest.md` phase 1a. -- [ ] **Config-to-git** — daily cron to push zoraxy, adguard, pve, ha configs to `fkrebs/{zoraxy,adguard,pve,ha}-conf` Gitea repos. Repos exist, scripts not deployed. See `services/backrest.md` phase 3. -- [ ] **Migration dump cleanup** — `/mnt/pve/unas/dump/*-migration-20260521.sql` (~492 MB, 2026-05-21). Decide keep or delete. See `services/backrest.md` blind spot #7. - -### Database cleanup -- [ ] **Drop stale `daytona` DB** — Daytona decommissioned 2026-05-20; DB still on shared-postgres (CT 113). Drop it. See `services/databases.md`. -- [ ] **Remove old CT 111 Docker volumes** — `coder-db` + `gitea-db` Docker volumes on CT 111 may be stale after migration to CT 113. Verify and remove. See `services/databases.md`. - -### Infrastructure (extended) -- [ ] **ZFS ARC tuning** — `zfs_arc_max` artificially capped at 6.2 GiB; raise to 16 GiB once CT 101 memory is right-sized. See `infra/proxmox-state.md` §3. -- [ ] **Docker disk reclaim** — ~13 GB reclaimable on CT 104 (8.3 GB unused images, 4.6 GB build cache). Run `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c. -- [ ] **Dormant stacks audit** — ~10 stacks defined but not running on CT 104 (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned, or delete. See `infra/proxmox-state.md` §10c. - -### Services / integrations -- [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → LiteLLM embeddings → LobeChat knowledge base. See `services/doc-ingestion.md`. -- [ ] **WAL-G monitoring** — silent stall went undetected for 13 h (failed_count=0). Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap. -- [ ] **ComfyUI async queue** — current MCP tool blocks 90–300 s per call. Implement job-queue pattern: `generate_image()` returns job ID; `get_job_status()` polls. See `services/comfyui.md`. -- [ ] **Arcane → CT 109 migration** — when CT 109 lands, move Arcane from CT 104; edge agents on CT 104/113 reconnect. Procedure documented in `services/arcane.md`. -- [ ] **Additional MCP servers** — community MCPs exist for: Gitea, Paperless, Karakeep, Vaultwarden, Proxmox-VE, Audiobookshelf. Evaluate and wire into gateway. - -### Audits / housekeeping -- [ ] **Zoraxy audit** — CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency (Tinyauth gaps). See `services/zoraxy.md`. -- [ ] **Arcane OIDC secret** — rotation was done 2026-05-22 but Arcane has known issues with OIDC. Verify it still authenticates cleanly. -- [ ] **AdGuard split-horizon DNS** — some internal services still resolve to public IPs instead of LAN IPs for internal clients. Needs rewrite rules audit in `services/adguard-dns.md`. -- [ ] **D-Link hardening** — admin UI reachable from any LAN device; SNMP community strings unverified; HTTP-only admin. Enable trusted-host allowlist, disable/harden SNMP, add TLS. See `services/homelab-architecture.md`. +### 🔵 Planned — requires infrastructure or significant effort +- [ ] **CT 109 "ops"** — LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Blocks monitoring stack + Arcane migration. See `infra/proxmox-state.md` §16. +- [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items. +- [ ] **Infisical secrets migration** — CT 112 provisioned; migration not started. Phase 1-4: move 85+ `.env` keys. See `services/secrets-manager.md`. +- [ ] **Consolidate syncstack → MCP gateway** — move LiteLLM model polling + LobeChat sync into gateway's loop; delete syncstack cron. +- [ ] **ZFS ARC tuning** — raise `zfs_arc_max` from 6.2 GiB → 16 GiB once CT 101 memory right-sized. See `infra/proxmox-state.md` §3. +- [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`. +- [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`. +- [ ] **Additional MCP servers** — community MCPs exist for Gitea, Paperless, Karakeep, Vaultwarden, Proxmox-VE, Audiobookshelf. Evaluate + wire in. +- [ ] **Arcane → CT 109 migration** — blocked by CT 109. Procedure documented in `services/arcane.md`. +- [ ] **crawl4ai SSE StreamConsumed** — intermittent 502s on gateway restart. Confirm resolved after clean restart cycle. ## Recently completed (session continued ×2, 2026-05-22)