Live-checked docker_stacks.yml directly. Total/dockerfile-strategy
counts (41/36) and the pinned_manual holdouts were already accurate.
But docker-socket-proxy and kodi's mariadb service were wrongly listed
as still hitting Docker Hub directly - both actually float a :latest
pull against a dedicated in-fleet mirror stack (docker-socket-proxy-
mirror, mariadb-latest) built via the normal dockerfile pattern. Fixed
the table and documented the real mechanism. Same gap existed in the
KB note, fixed there too.
The rest of the doc consistently says 'browser-facing zone'/'app-to-app
zone' and never states the literal domain suffixes. One evidence code
block leaked both real domains as part of the FQDNs being resolved -
fixed to match the doc's own established pattern. Caught because I'd
only sanitize-checked my own diff, not the whole file - full-file grep
for thesabear.net now confirms zero literal domain mentions.
Live audit found 4 records in the reverse zone, all wrong: 2 malformed
PTR entries (name/value swapped, never actually resolved), 1 orphaned
record from a decommissioned host, 1 correct-looking but misleading
record (proxy host's PTR pointing at one proxied app's name instead of
its own identity). All fixed live on Technitium today, not just
documented. Doc updated to describe the real defect and the fix.
The 6-tier dependency ladder doesn't mirror that doc's trust-boundary
structure (4 boundaries, 3 routing authorities - a different taxonomy).
The 6-tier list only exists in the live code; no public doc documents
it, so the doc now describes it standalone instead of pointing at a
file that doesn't actually contain it.
Same status the disaster-recovery.md conversation already ruled out of
the public repo - operationally true, not employer-facing. KB and
NocoDB job notes keep the real detail; only the public prose changes.
Live-verified against real infrastructure: Kopia's real repo/disk,
PBS's real datastore path, os_update role's real batch/abort behavior
against the actual Ansible code, and the real tag-driven
roles_metadata.yml mechanism behind Layer 1's rebuild claim. Caught a
real KB staleness in the process (PBS datastore usage, 3 weeks stale)
and fixed it properly - removed the point-in-time number entirely
rather than refreshing it, since a data-snapshot doesn't belong in
Trilium at all per the existing content-philosophy rule. Replaced
both mermaid diagrams with real branch/decoupling-shaped Nextcloud
diagrams. All 3 source KB notes stamped.
Found by actually re-checking the running function instead of stopping
at what was already written: each finding has a "Copy Debug Prompt"
button generating a ready-to-paste AI-triage prompt, with a built-in
"don't act without approval" instruction baked into the template
itself. Embedded the real board screenshot (redacted) - dependency
ladder, Wazuh KPIs, Active Issues strip, per-host tile grid - since a
doc about a visual dashboard needs to actually show it, not just
describe it in command output.
Live-verified every specific claim directly against the real Node-RED
function source (not just trusted from the KB): the 104,443-char
function size, all 5 Wazuh finding categories, Vault's live PKI cert
endpoints, the real DNS Security Signals implementation, the
fleetAudit global pattern, the 12-app Slack channel map, the
acknowledge key format and localStorage key name, and the Mustache
triple-brace URL gotcha. Replaced both mermaid diagrams: the flat
data-sources fan-in became a real specifics table (redundant diagram
cut per the diagramming standing process), and the acknowledge-flow
diagram was rebuilt as a real Nextcloud diagram. Stamped both source
KB notes.
Live-verified against the real Technitium server: spot-checked
caddy-only/local-only hosts and Postiz's zero-presence claim via
direct DNS resolution, confirmed the forwarder list directly from the
real dns.config (pfSense + Quad9 only, no Cloudflare), and confirmed
the reverse zone's real /24 scope plus its sparse PTR content via
live reverse lookups - fixed the KB stamp accordingly after an
earlier version of it claimed these weren't re-checked. Replaced the
mermaid zone-routing diagram with a real branch-shaped Nextcloud
diagram. Real command output embedded throughout instead of
paraphrased claims.
Live-verified the container_update role's strategy_dockerfile.yml
task file exists at the exact path the KB names, stamped the source
note. Replaced the mermaid cheap-check flowchart with a real
branch-shaped Nextcloud diagram. Added: the real Vault-backed push
auth mechanism (Gitea PAT -> Vault Agent -> docker login
--password-stdin, same pattern as everywhere else in the fleet), the
real docker manifest inspect command instead of a vague "digest
check", real app names in the holdouts table instead of generic
descriptions (matching how the rest of this repo already names real
apps), the anonymous-volume-pruning detail, and a real (redacted)
screenshot of the actual Gitea package registry showing genuine
self-built container images.
Live-verified against the real Wazuh manager (agent_control -l: 11
active agents matching exactly; docker ps: real manager container
name) and stamped both source KB notes. Replaced both mermaid
flowcharts with real branch-shaped Nextcloud diagrams (alert-handling
gate, compliance-hardening gate). Added real evidence throughout: the
live agent roster, a real synthetic SSH-failure line piped through
wazuh-logtest showing actual decoding/rule-match output (MITRE ATT&CK
+ compliance tags included), and real rule IDs in the runbook table
instead of vague categories. New content: the fleet-wide agent
log-queue-overflow bug found and fixed via a dedicated tuning role,
and the compose-stack-vs-rules version-control split.
Swapped the curl/jq text block for what the doc actually needed:
real screenshots of the live Dashy Fleet Schedule Heatmap widget -
one showing a populated cell clicked open (proving the TIP's
click-to-expand claim is real, not just described), one showing the
"no fixed time" section for the 15 jobs excluded from the grid.
Live-pulled the actual 50-row NocoDB inventory (also caught and fixed
a stale KB fact along the way - the note pointed at the wrong NocoDB
deployment entirely, nocodb-content/automation instead of the real
nocodb/rocky-docker instance). Replaced the vague weight-formula prose
with the real numbers, cut the mermaid diagram that only restated the
prose above it, and added five real stories mined from populating the
table by hand: a three-way monthly collision fix, a cascading
Kopia->ClamAV reschedule, a duration figure corrected 8x after
checking real completed-run data, the heaviest job in the whole fleet
(not a backup), and a 404 that looked like an auth problem and
wasn't. Enriched the pending PBS datastore bug with its real
resolution options and added a second real gap: Technitium's
blocklist auto-update is configured but silently a no-op.
The zone-band labels spelled out *.local.thesabear.net and
*.caddy.thesabear.net literally - the same internal zone naming
pattern already sanitized out of this doc's prose, missed on the
diagram itself. Replaced with generic zone names, no domain.
Sequence diagram showing the browser carries every hop itself -
Authentik and the app never talk directly - with only the OAuth
authorize/token exchange crossing from the browser-facing zone into
the service-to-service zone. Built to the public-repo diagram
conventions in CLAUDE.md (labelBackgroundColor + matching rich-text
span, off-line label positioning, line-color-matched labels, legend
instead of a color-explaining caption).
Asset renames (matching the new Nextcloud source naming convention —
doc name first, then description):
- architecture-trust-depth.svg -> architecture-overview-trust-depth.svg
- firewall-docker-bypass.svg -> firewall-and-network-docker-bypass.svg
- secrets-lifecycle.svg -> secrets-and-pki-lifecycle.svg
- trust-boundaries-blast-radius.svg -> readme-trust-boundaries-blast-radius.svg
Updated all 4 markdown references accordingly.
Also refreshed diagram exports (secret-distribution-flows.svg, and the
4 renamed ones) with today's fixes, and folded in the earlier pending
sso-and-identity.md work: precise live-verified native-OIDC app list
(12 apps, not ~9), the Proxmox no-Proxy-Provider exception, real API
evidence for it, and the automation-bot migration story.
Root cause was the edge's own labelBackgroundColor style property,
left enabled with no explicit value in the app, distinct from the
label's HTML text styling entirely. Set it explicitly to #1C1D1E,
then stripped a competing plain-white background layer draw.io's
export was still injecting on top of it.
draw.io's export was auto-injecting its own adaptive-background CSS
onto edge labels regardless of source content, with a fallback that
didn't match the page. Stripped background-color entirely so labels
sit directly on the page background with nothing to mismatch.
Nextcloud's draw.io export was inconsistently applying its own
page-level adaptive-background variable to some edge labels instead
of the authored value, making them render darker than the rest.
Post-processed the exported SVG to normalize every label to the same
background value.
Add the Suricata dual-layer detail (DNS lockdown, Vault protection
each enforced independently at two layers) and honest live-backend
churn instead of a flat inventory list. Drop the disabled-LAN-frontend
TIP entirely — not worth keeping in the public doc.
Pulled every pfSense child note (Default Policy, Proxmox Firewall Usage,
VM-Level Firewalld Strategy, WAN Rules, Security Tooling, Failure Impact,
HAProxy, Aliases, DNS & Resolver Config, LAN Rules, NAT, VPN), not just
the originally-scoped subset. Live-verified firewalld defaults, SSH
rich-rule restrictions, and Vault's per-client rules directly against
the running hosts - all matched exactly.
Caught and fixed a real staleness bug in the KB itself: WAN Rules and
Security Tooling (both dated a week old) still described CrowdSec as
active, but the more recent Aliases note (updated yesterday, checked
against pfSense's actual config.xml) confirmed the package has been
fully purged. Fixed both stale notes and the public doc, which had
already inherited the wrong claim.
Folded in the staged PAM defense-in-depth note properly - found the
fuller, better story directly in the Ansible role's source comments
(the bug hit twice, on two different hosts, before the permanent fix).
Added the LAN lockdown narrative this doc was missing, the DNS
bypass-block defense-in-depth story, and the this-week port-alias
conversion. Cut two redundant Mermaid diagrams. Added real evidence:
four pfSense screenshots already validated for architecture-overview.md
reused here since they directly prove this doc's own claims, plus two
real firewall-cmd command outputs from live verification this session.
Source Trilium notes (Authentik/SSO Integration, Gitea Access Model)
live-verified and stamped this session - authentik_api_token confirmed
in vault.yml, automation-bot confirmed as a real non-admin Gitea account
via the API.
Cut the redundant Mermaid diagram (prose right below it said the same
thing). Restored the LDAP/superuser-outpost exception from the source
note as a compact callout rather than a full section, proportionate to
its actual weight. Added the real reasoning for centralizing auth and
the proxy-layer defense-in-depth argument, a table of the ~9 apps
running real native OIDC/SAML on top of the universal Proxy Provider
baseline (corrected after initially misstating it as either/or), the
provider-removal discipline, and two screenshots proving the Write/
Read-only access split instead of just asserting it.
Edge-label captions were using an ambient light-dark() background that
didn't match Gitea's actual dark theme. Fixed to a plain rgb(13,17,23),
matching the corrected CLAUDE.md diagram convention.
Source Trilium note (Secret Distribution Model) was live-verified and
stamped this session - Certificate Flow, App Secret Flow, Configuration
Distribution Flow, and the technitium_api_token Vault-KV exception all
confirmed against the real hosts, not just trusted from the KB.
Replaced the Mermaid diagram, which incorrectly showed the Configuration
Distribution Flow feeding into Vault directly, with a corrected version:
that flow is a control-plane gate on what Vault Agent renders, not a
peer data flow. Added a real Vault Agent log excerpt proving the full
redeploy chain (restart -> render -> reload_command -> container
recreated) actually happens, and restored the technitium_api_token
exception that was in the source note but missing from this doc.
Publishing a ranked list of a live system's own weak points - including
explicitly naming the "single highest-value target" - is a real security
problem for a public repo, not a portfolio concern. Removed the section
and the matching stat-table row. Left the fixed cert-renewal incident in
place since there's nothing exploitable in a resolved issue.
Access model now covers the narrowly-scoped read-only utility policies
(ansible sync roles, metrics-reader, pki-reader) alongside the
host-scoped svc-* pattern - the fuller picture confirmed live against
Vault's actual ACL policy list, not just the original narrower claim.
Added two real screenshots: the live policy list, and an actual audit
log entry showing a KV read with every secret value as hmac-sha256:...
instead of plaintext - proof for the audit-trail claim instead of just
an assertion of it.
Removed the before/after plaintext-secrets Mermaid diagram (the bullets
right below it already said the same thing more clearly) and the
Architecture flowchart (its per-host labels were silently missing
registry-token and Hawser-secret details that didn't fit in the boxes).
Replaced the flowchart with an accurate, complete "who gets what" table
sourced directly from Trilium, one sentence for the proxy-routing fact
it was trying to show, and a new sequence diagram for the actual secret
lifecycle (auth -> render -> read -> async rotation) - a genuinely
different kind of diagram since that's process/time-ordered information
a table can't represent well.
Also restored real specificity Trilium had that the doc had flattened
into vague language: the cert-renewal row now names Technitium
specifically and states the actual incident (an expired cert silently
served for 19 days before the auto-rebuild hook existed), and the audit
trail row now states the real rotation policy (weekly, 8 generations).
Removed the dependency-graph Mermaid diagram (had backwards Vault
dependency arrows, contradicted the documented ingress model) and the
four-boundary Mermaid diagram (fully redundant with the table below it).
Verified every remaining claim against Trilium's Traffic Flow Model and
fixed two that didn't hold up: the DNS-bypass failure behavior overstated
an unconditional SSO bypass, and the notifications failure behavior had
an unsourced claim about backlog retry.
Added the real story behind the trust-boundary hardening (three stages
of the same "trusted by default" flaw getting found and closed, not a
changelog of dated facts), a new trust-depth diagram showing that being
"inside the network" still enforces its own internal boundaries, and
real pfSense screenshots proving the LAN lockdown rules actually exist
in production, not just in the doc.
Two real, working scripts: an Ansible playbook run-menu (the same
pattern used identically across both the fleet-config and infra-
provisioning repos), and cuesplit, a frame-accurate FLAC/.cue
splitting utility. Sanitized paths only, logic untouched.
README gets a new "Scripts & Tooling" section pointing at it, placed
right after "What's Running" alongside the other repo-structure
pointer.
Adds the two Dockerfiles nextcloud's compose build: contexts were
already referencing but never had (custom smbclient support for the
main container, a documentserver base for euro-office) - both had
their real internal-CA-trust mechanism replaced with a comment
explaining what's there and why, per the standing rule against
publishing that detail.
Also fixes a compose bug: kodi-ma-bridge's `environment:` key had
been dropped, leaving KEY=value pairs nested under `env_file:` (which
expects file paths, not inline vars) - would have made docker-compose
try to open a file literally named `TZ=${TZ}`.
Rest of this commit is manual cleanup (comment tidying, dropped
personal media-library volume mounts, a couple of .env comment
trims).
Replaced 29 host-port values across 27 stacks with the app's own
well-known default (read directly from each compose file's own
container-side port mapping) instead of the arbitrary port numbers
this fleet actually assigns to avoid collisions across ~44 services
on one host. More recognizable to a reader, and removes the last
fleet-specific detail these files carried.
Also removes a stale adminer service from n8n's stack entirely
(compose service + .env var) - it's no longer actually deployed.
Adds cloudcommander and it-tools .env files. it-tools' private .env
had two real domains (it-tools.local.thesabear.net,
it-tools.thesabear.net) that the public compose file doesn't
reference at all, so dropped along with the unused DOCKER var.
This completes .env/.env.secrets.ctmpl coverage across every
category in stacks/ (identity-and-security, platform, media,
productivity, dev-tools) - every var cross-checked against its
actual public compose file throughout.
Adds real Vault Agent secret templates and non-secret env vars for
all 9 productivity stacks. Sanitized several real leaks: a real
residential public IP (ghost's UMAMI_IGNORE_IP), real personal
domains/email used across joplin/n8n/ghost/paperless-ngx, and a
real embedded OAuth client ID in paperless-ngx's private OIDC config
(dropped entirely - the public compose file doesn't wire up OIDC at
all, so none of that config was needed).
Also dropped n8n secrets referencing the out-of-scope Content
Pipeline system (nocodb-content, Postiz), and did not carry over a
real Redis password found sitting in plaintext in nextcloud's
private .env (unused by the public compose anyway).
Every var cross-checked against what its actual public compose file
references before writing.
Adds real Vault Agent secret templates and non-secret env vars for
all 15 media stacks. Sanitized real leaks found in the source data:
kodi's real username and real hostnames+IPs in KODI_INSTANCES,
tdarr's real IP and hostname reference, immich's real username -
replaced with generic values (IPs use the RFC 5737 documentation
range, 192.0.2.0/24, rather than another real-looking address).
Every var cross-checked against what its actual public compose file
references before writing, learned from the platform batch.
thesabear