Completes the orchestration/registry/content batch - Kestra's
check-pause-approve-apply pattern, the self-hosted build pipeline,
the SOC dashboard's 14-source aggregation, the cron heatmap, and the
in-progress content pipeline, all in the diagram+callout+table style.
Mermaid diagrams up front, GFM alert callouts for key decisions and
gotchas, tables instead of bullet walls - replaces plain prose with
the visual template established for security-monitoring.md.
Secrets & PKI, Secret Distribution Model, SSO & Identity,
Firewall & Network Segmentation, DNS Naming Model, and Security
Monitoring - the first batch of per-system write-ups linked from
the new README, sourced and sanitized from the internal KB.
Replaces the bio-first README with a single-page overview covering
every system in the homelab (secrets/PKI, SSO, firewall, observability,
security monitoring, orchestration, notifications, registry/build,
Dashy SOC board, cron scheduler, content pipeline, IaC, disaster
recovery) plus a sanitized architecture diagram, linking out to a
full docs/ write-up for each. Bio/social links moved to the bottom.
Body text was describing a setup that no longer exists (GitLab
pipelines, a private registry) - replaced with what's actually running
(Gitea, Caddy/Authentik, Ansible/Kestra/n8n) and pointed the
"what you'll find" section at the new per-repo folder structure.
Fixed the LinkedIn link (was missing its scheme), added
Instagram/TikTok/YouTube, dropped the Bookstack wiki link.
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
Caddy (+ a truncated/sanitized example Caddyfile showing the mTLS +
Authentik forward-auth pattern without the real subdomain list),
Hawser, Gitea (private instance only, dropped the public-mirror
service - that's already its own public thing), Kestra (genericized
the ansible-repo/SSH-key bind mounts), Mosquitto, n8n, NetBox,
Node-RED.
Several of these had drifted so far they were unrecognizable (Nextcloud
was a bare minio stub, Ollama was missing the ollama service entirely,
Immich was missing 2 of 4 services). Also removed a real, exposed
Authentik OAuth client_id/secret that was sitting in Paperless-NGX's
entry (confirmed stale/rotated already, but shouldn't have been public
regardless) and stripped internal Caddy CA trust details from every
file per the same rule applied to nocodb/dashy etc.
audiobookshelf, bazarr, beets, dashy, dockhand, docker-socket-proxy,
emby, ghost (+umami), jellyfin, kodi-mariadb, kopia, lidarr,
music-assistant, prowlarr, qbittorrent, radarr, seerr, sonarr, tdarr,
tinymediamanager, trilium — these run in the fleet today but had no
public entry at all. Same sanitization convention as the rest of the
repo (paths -> /path/to/..., secrets left as bare ${VAR} refs, no CA
trust details).
The public repo hadn't been touched since its initial import: 14 of its
Docker entries (Airsonic, Diun, Duplicati, Gitlab, Gotify, Grocy,
Jenkins, Jitsi, MariaDB, Minio, Organizr, Semaphore, Uptime Kuma,
Whoogle) no longer exist anywhere in the fleet. Also strips the
internal Caddy CA trust mount from the nocodb entry added earlier today
- that's an internal PKI detail, not something to showcase publicly.
thesabear