update readme

README.md

@@ -10,16 +10,6 @@
 [![YouTube](https://img.shields.io/badge/YouTube-red?style=for-the-badge&logo=youtube&logoColor=white)](https://www.youtube.com/@nomadianation)
 -->
 
-I'm a curious, self-taught technologist who runs a real, multi-host homelab as a production-grade playground. Most homelabs are a media server with some extra apps bolted on. This one is a platform: The same categories of systems a company's platform/security team owns, run at homelab scale, for real, 24/7, by one person. What started as a hobby project has grown into a full-on journey into DevOps, automation, infrastructure, and security;
-
-- **Proxmox** — a hypervisor cluster running a fleet of hardened VMs/LXCs provisioned via Terraform
-- **Terraform+Packer**- for bootstrapping new hosts for the fleet, from hardened, minimal images and continuously re-hardened by Ansible
-- **HashiCorp Vault** — issuing PKI certs and managing every application secret
-- **Caddy + Authentik** — a two-zone reverse-proxy design fronted by SSO, behind pfSense and firewalld for real network segmentation
-- **Kestra** — human-gated fleet orchestration across the fleet, scheduled flows backed by Ansible roles and playbooks
-- **Gitea** — a self-hosted registry building and shipping every container image in-fleet
-- **Wazuh + a custom Dashy dashboard** — a self-built SOC watching all of it
-
 <table>
 <tr>
 <td align="center"><strong>11</strong><br/>fleet hosts</td>
@@ -30,6 +20,16 @@ I'm a curious, self-taught technologist who runs a real, multi-host homelab as a
 </tr>
 </table>
 
+I'm a curious, self-taught technologist who runs a real, multi-host homelab as a production-grade playground. Most homelabs are a media server with some extra apps bolted on. This one is a platform: The same categories of systems a company's platform/security team owns, run at homelab scale, for real, 24/7, by one person. What started as a hobby project has grown into a full-on journey into DevOps, automation, infrastructure, and security;
+
+- **Proxmox** — a hypervisor cluster running a fleet of hardened VMs/LXCs provisioned via Terraform
+- **Terraform+Packer**- for bootstrapping new hosts for the fleet, from hardened, minimal images and continuously re-hardened by Ansible
+- **HashiCorp Vault** — issuing PKI certs and managing every application secret
+- **Caddy + Authentik** — a two-zone reverse-proxy design fronted by SSO, behind pfSense and firewalld for real network segmentation
+- **Kestra** — human-gated fleet orchestration across the fleet, scheduled flows backed by Ansible roles and playbooks
+- **Gitea** — a self-hosted registry building and shipping every container image in-fleet
+- **Wazuh + a custom Dashy dashboard** — a self-built SOC watching all of it
+
 ## The decision that shows the most
 
 Most self-hosted setups have one trust boundary: "you're on the LAN, you're trusted." That's the easy answer, and it's wrong — a single compromised container can reach everything else with no further resistance. The other easy answer, mutual TLS on every single connection with no exceptions, is also wrong: real overhead, real certificate-lifecycle burden, on traffic that doesn't need it — exactly the kind of complexity that gets quietly disabled under pressure, which is worse than never building it.