The 'Every system, at a glance' table and the Systems section covered
the same 16 things in the same order - removed the table, kept the
narrative section since that's where the actual selling has to happen.
Rewrote every paragraph to lead with what the system does and its
real scope (what an employer needs to see) instead of a debugging
edge case or failure-mode trivia standing in for the description.
README is short/sharp facts, docs/*.md is full depth/process/reasoning
- that split had collapsed into either near-duplicate text in both
files or the fact missing from the README entirely. README now states
the OIDC zone-crossing fact in one crisp sentence; the full doc has
the complete step-by-step breakdown. The LDAP superuser workaround
claim is removed from both - the source material frames it as
contingency guidance for a scenario that may never have come up, not
documented deployed behavior, so it doesn't belong in either file.
The source material says header-based forward-auth is 'the viable
path instead, if SSO is wanted for an app like this' - conditional
contingency guidance for a scenario that may not have actually come
up, not a description of something built and running. Presenting it
as live, deployed behavior in both docs/sso-and-identity.md and the
README was a real accuracy error. Removed from both; the doc still
covers what's actually confirmed (Authentik, dual-zone registration,
native OIDC vs. proxy forward-auth split, least-privilege Git access).
The paragraphs were near-duplicates of each doc's own opening -
added nothing beyond the table row above them or the full doc below.
Rewrote every one to lead with a different angle/detail than its
doc (the before/after story, the concrete failure math, the vendor
limitation) instead of restating the same sentences shorter. Also
removed every remaining 'documented honestly / rather than hidden /
caught during an audit' self-referential phrasing - state the fact,
don't narrate the act of documenting it.
New opening frames the repo as a platform, not a media-server-plus-
extras, and draws the direct line to what an employer's platform/
security team actually owns. Added a condensed version of the
trust-boundary story (the single hardest decision in the repo) right
in the README, ahead of the systems table, so a reader gets a real
'this person thinks like an engineer' moment before they even scroll.
Diagram: switched to LR layout, color-coded by role (edge/core/
observability), dropped the repeated 'reports to' labels that were
clipping in the browser - same fix already applied to
architecture-overview.md. Added a stat strip (11 hosts, 55 stacks,
16 systems, 4 boundaries, 13 flows) and a scannable systems-at-a-
glance table above the detailed sections, so a reader gets the full
picture in a 10-second skim before the deeper 2-minute read.
Replaces the bio-first README with a single-page overview covering
every system in the homelab (secrets/PKI, SSO, firewall, observability,
security monitoring, orchestration, notifications, registry/build,
Dashy SOC board, cron scheduler, content pipeline, IaC, disaster
recovery) plus a sanitized architecture diagram, linking out to a
full docs/ write-up for each. Bio/social links moved to the bottom.
Body text was describing a setup that no longer exists (GitLab
pipelines, a private registry) - replaced with what's actually running
(Gitea, Caddy/Authentik, Ansible/Kestra/n8n) and pointed the
"what you'll find" section at the new per-repo folder structure.
Fixed the LinkedIn link (was missing its scheme), added
Instagram/TikTok/YouTube, dropped the Bookstack wiki link.
thesabear