Fixed one real inaccuracy (Gitea registry scope, Secret Distribution
path count) and replaced generic descriptions with true, specific
detail across all 14 Systems bullets - real incidents, real design
decisions, concrete numbers - each checked against Trilium and, where
relevant, the live Ansible roles rather than trusted at face value.
Also stages a verified-but-unintegrated PAM hardening finding in
docs/firewall-and-network.md for that file's own upcoming audit pass.
Removed by request - it was the one unfinished system in the repo,
and it's the user's call on what represents them publicly. Removed
completely: the README section, docs/content-pipeline.md, and the
two stacks that only existed to back it (postiz, nocodb-content).
Fixed cross-links in dns-naming.md and firewall-and-network.md that
pointed at it (replaced the public-facing-app example with the
still-present Ghost blog), and notifications.md (dropped the
reference, also fixed a leftover 'documented rather than hidden'
phrase in the same paragraph). Stat strip and stack counts updated
(55->53 stacks, 16->15 systems).
Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.
Mermaid diagrams up front, GFM alert callouts for key decisions and
gotchas, tables instead of bullet walls - replaces plain prose with
the visual template established for security-monitoring.md.
Secrets & PKI, Secret Distribution Model, SSO & Identity,
Firewall & Network Segmentation, DNS Naming Model, and Security
Monitoring - the first batch of per-system write-ups linked from
the new README, sourced and sanitized from the internal KB.
thesabear