The 'Every system, at a glance' table and the Systems section covered
the same 16 things in the same order - removed the table, kept the
narrative section since that's where the actual selling has to happen.
Rewrote every paragraph to lead with what the system does and its
real scope (what an employer needs to see) instead of a debugging
edge case or failure-mode trivia standing in for the description.
README is short/sharp facts, docs/*.md is full depth/process/reasoning
- that split had collapsed into either near-duplicate text in both
files or the fact missing from the README entirely. README now states
the OIDC zone-crossing fact in one crisp sentence; the full doc has
the complete step-by-step breakdown. The LDAP superuser workaround
claim is removed from both - the source material frames it as
contingency guidance for a scenario that may never have come up, not
documented deployed behavior, so it doesn't belong in either file.
The source material says header-based forward-auth is 'the viable
path instead, if SSO is wanted for an app like this' - conditional
contingency guidance for a scenario that may not have actually come
up, not a description of something built and running. Presenting it
as live, deployed behavior in both docs/sso-and-identity.md and the
README was a real accuracy error. Removed from both; the doc still
covers what's actually confirmed (Authentik, dual-zone registration,
native OIDC vs. proxy forward-auth split, least-privilege Git access).
The paragraphs were near-duplicates of each doc's own opening -
added nothing beyond the table row above them or the full doc below.
Rewrote every one to lead with a different angle/detail than its
doc (the before/after story, the concrete failure math, the vendor
limitation) instead of restating the same sentences shorter. Also
removed every remaining 'documented honestly / rather than hidden /
caught during an audit' self-referential phrasing - state the fact,
don't narrate the act of documenting it.
New opening frames the repo as a platform, not a media-server-plus-
extras, and draws the direct line to what an employer's platform/
security team actually owns. Added a condensed version of the
trust-boundary story (the single hardest decision in the repo) right
in the README, ahead of the systems table, so a reader gets a real
'this person thinks like an engineer' moment before they even scroll.
Diagram: switched to LR layout, color-coded by role (edge/core/
observability), dropped the repeated 'reports to' labels that were
clipping in the browser - same fix already applied to
architecture-overview.md. Added a stat strip (11 hosts, 55 stacks,
16 systems, 4 boundaries, 13 flows) and a scannable systems-at-a-
glance table above the detailed sections, so a reader gets the full
picture in a 10-second skim before the deeper 2-minute read.
Actually fixed the 4 problems named earlier instead of just naming
them: a numbers-at-a-glance strip up top, the trust-boundary diagram
is now color-coded by boundary type, added a concrete blast-radius
table showing exactly what stays up vs goes down per failure, and
replaced vague figures ('~40 stacks', 'every managed host') with
real ones (41 stacks, 11 fleet hosts).
Leads with the hardest actual decision (4 trust boundaries, each
calibrated to a different risk level, enforced by 3 separate routing
authorities) given full narrative depth instead of flat template
treatment. The other 6 traffic laws move to a compact reference
table linking to their own dedicated docs, avoiding redundancy with
content that already lives elsewhere in more depth.
Previously only delivered 2-3 of the 8 traffic categories it claimed
to cover. Now states every law (ingress, east-west, secrets, DNS,
observability, notifications, CI/CD, management) with its own
Law/Flow/Failure-behavior, plus the 4 global architectural laws that
apply across all of them.
Switch to LR layout, restore all 12 observability-reporting edges
(cut them by mistake, they belong in a dependency graph), drop the
repeated 'reports to' label text that was breaking legibility and
let line style (solid=dependency, dotted=async reporting) carry that
distinction instead. Also shortened edge labels on the trust-boundary
diagram to avoid the same clipping issue.
Completes the full depth pass across all 16 docs - real tech names,
why-this-vs-the-alternative reasoning, heavy cross-linking between
every doc, ranked/specific tradeoffs instead of generic hedges.
Same treatment as the security batch - real tech names, 'why this vs
the alternative' reasoning, heavy cross-linking, ranked/specific
tradeoffs instead of generic hedges.
Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.
Names real technology (Technitium) instead of staying vague, adds
explicit cross-links to every other system that actually depends on
DNS, explains why self-hosted DNS was chosen, and adds a 'what I'd
improve' section. Template for redoing the rest.
Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/
with a single stacks/ tree grouped by function (identity-and-security,
platform, media, productivity, dev-tools) - 55 stacks total, every one
a real directory in the private repos today.
Resolves all outstanding drift: adds Wazuh (previously entirely
missing), Firefly III and Postiz (never mirrored), the internal-zone
Caddy instance and the Cron Scheduler's separate NocoDB instance
(both previously conflated with their counterparts under one shared
folder); renames Calibre-Web to calibre-web-automated and splits
Kodi-MariaDB into kodi + mariadb-latest to match what the private
repos actually run now; drops the decommissioned NetBox stack.
Also removes automation/iac/old-content/ and
automation/ansible/old-playbooks/ in the same pass - both folders
were entirely stale content describing a superseded architecture
(GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current
Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.
Completes the docs/ set - all 16 systems now have a full deep-dive
page in the diagram+callout+table style. Architecture overview covers
the 4 trust boundaries and 2 traffic planes; IaC pipeline is a fresh
Packer->Terraform->Ansible writeup replacing the stale old-content/
snapshot; disaster recovery covers the 3 independent backup layers
and the deliberately decoupled OS/app upgrade systems.
Completes the orchestration/registry/content batch - Kestra's
check-pause-approve-apply pattern, the self-hosted build pipeline,
the SOC dashboard's 14-source aggregation, the cron heatmap, and the
in-progress content pipeline, all in the diagram+callout+table style.
Mermaid diagrams up front, GFM alert callouts for key decisions and
gotchas, tables instead of bullet walls - replaces plain prose with
the visual template established for security-monitoring.md.
Secrets & PKI, Secret Distribution Model, SSO & Identity,
Firewall & Network Segmentation, DNS Naming Model, and Security
Monitoring - the first batch of per-system write-ups linked from
the new README, sourced and sanitized from the internal KB.
Replaces the bio-first README with a single-page overview covering
every system in the homelab (secrets/PKI, SSO, firewall, observability,
security monitoring, orchestration, notifications, registry/build,
Dashy SOC board, cron scheduler, content pipeline, IaC, disaster
recovery) plus a sanitized architecture diagram, linking out to a
full docs/ write-up for each. Bio/social links moved to the bottom.
Body text was describing a setup that no longer exists (GitLab
pipelines, a private registry) - replaced with what's actually running
(Gitea, Caddy/Authentik, Ansible/Kestra/n8n) and pointed the
"what you'll find" section at the new per-repo folder structure.
Fixed the LinkedIn link (was missing its scheme), added
Instagram/TikTok/YouTube, dropped the Bookstack wiki link.
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
Caddy (+ a truncated/sanitized example Caddyfile showing the mTLS +
Authentik forward-auth pattern without the real subdomain list),
Hawser, Gitea (private instance only, dropped the public-mirror
service - that's already its own public thing), Kestra (genericized
the ansible-repo/SSH-key bind mounts), Mosquitto, n8n, NetBox,
Node-RED.
Several of these had drifted so far they were unrecognizable (Nextcloud
was a bare minio stub, Ollama was missing the ollama service entirely,
Immich was missing 2 of 4 services). Also removed a real, exposed
Authentik OAuth client_id/secret that was sitting in Paperless-NGX's
entry (confirmed stale/rotated already, but shouldn't have been public
regardless) and stripped internal Caddy CA trust details from every
file per the same rule applied to nocodb/dashy etc.
audiobookshelf, bazarr, beets, dashy, dockhand, docker-socket-proxy,
emby, ghost (+umami), jellyfin, kodi-mariadb, kopia, lidarr,
music-assistant, prowlarr, qbittorrent, radarr, seerr, sonarr, tdarr,
tinymediamanager, trilium — these run in the fleet today but had no
public entry at all. Same sanitization convention as the rest of the
repo (paths -> /path/to/..., secrets left as bare ${VAR} refs, no CA
trust details).
The public repo hadn't been touched since its initial import: 14 of its
Docker entries (Airsonic, Diun, Duplicati, Gitlab, Gotify, Grocy,
Jenkins, Jitsi, MariaDB, Minio, Organizr, Semaphore, Uptime Kuma,
Whoogle) no longer exist anywhere in the fleet. Also strips the
internal Caddy CA trust mount from the nocodb entry added earlier today
- that's an internal PKI detail, not something to showcase publicly.
thesabear