Mark TB-005 Obsidian hardening complete.

Record deployed internal_only gate and update plan brief gaps.
2026-06-10 22:47:02 -05:00
parent 80b0fc6904
commit 1253825541
3 changed files with 10 additions and 10 deletions
@@ -18,7 +18,7 @@ Before any phase or task, we should answer:

 | | |
 |---|---|
-| **Priority theme** | Backups done (TB-001 complete) |
+| **Priority theme** | Backups + Obsidian hardening done (TB-001, TB-005 complete) |
 | **Explicitly dropped** | _(none yet)_ |
 | **Notes** | _(conversation notes go here)_ |

@@ -42,7 +42,7 @@ Each link opens an **interview-first** task brief. The conversation is the task.

 | Say this… | About |
 |-----------|--------|
-| [TB-005](tasks/TB-005-obsidian-hardening.md) | Your Obsidian vault is public-facing |
+| [TB-005](tasks/TB-005-obsidian-hardening.md) | Obsidian vault hardening — **done** (LAN/tailnet only) |
 | [TB-006](tasks/TB-006-authentik-forward-auth.md) | Login on admin UIs via Authentik |
 | [TB-013](tasks/TB-013-code-server-mount.md) | code-server sees your whole home dir |
 | [TB-014](tasks/TB-014-registry-auth.md) | Docker registry has no password |
@@ -91,7 +91,7 @@ Each link opens an **interview-first** task brief. The conversation is the task.
 <details>
 <summary>Background (optional — skip if overwhelming)</summary>

-Homelab is ~50 containers, 15 stacks, Caddy ingress, git-push deploys. Main gaps from analysis: no backups, Obsidian public, Authentik barely used, romhacks pipeline half-done.
+Homelab is ~50 containers, 15 stacks, Caddy ingress, git-push deploys. Main gaps from analysis: Authentik barely used, romhacks pipeline half-done, public-surface audit still open (TB-033).

 Repo conventions: `stack.env` secrets, `edge` network, `internal_only` for LAN admin UIs, `./scripts/gen-bookmarks.ps1` after Caddy changes.

@@ -38,7 +38,7 @@ Parent: [PLAN-BRIEF.md](../PLAN-BRIEF.md) · Template: [_TEMPLATE.md](_TEMPLATE.
 | TB-002 | jd.ginnoir.com | [→](TB-002-jd-caddy-block.md) |
 | TB-003 | Recyclarr | [→](TB-003-recyclarr.md) |
 | TB-004 | Pin infra tags | [→](TB-004-pin-infra-tags.md) |
-| TB-005 | Obsidian hardening | [→](TB-005-obsidian-hardening.md) |
+| TB-005 | Obsidian hardening ✓ | [→](TB-005-obsidian-hardening.md) |
 | TB-006 | Authentik admin login | [→](TB-006-authentik-forward-auth.md) |
 | TB-007 | Romhacks handoff | [→](TB-007-romhacks-handoff.md) |
 | TB-008 | Retire Deluge | [→](TB-008-retire-deluge.md) |
@@ -1,7 +1,7 @@
 # TB-005 — Obsidian / CouchDB hardening

-**Status:** done (pending deploy)  
-**Your call:** Do it — LAN/tailnet only via `internal_only`
+**Status:** done — deployed 2026-06-10  
+**Your call:** **Do it** — LAN/tailnet only via `internal_only`

 ---

@@ -34,8 +34,8 @@
 | | |
 |---|---|
 | **Decision** | Do it — `internal_only` (LAN + tailnet); no public access |
-| **Notes** | All LiveSync clients on tailnet; Authentik not needed |
-| **Date** | 2026-06-10 |
+| **Notes** | `import internal_only` on obsidian.ginnoir.com. All LiveSync clients on tailnet; Authentik not needed. CouchDB password rotation deferred. |
+| **Date** | 2026-06-10 (decided + deployed) |

 ---

@@ -54,7 +54,7 @@ Caddyfile, stacks/notes/

 ### Done when

- [ ] You can still sync where you need to
- [ ] Admin/_utils not wide open
+- [x] You can still sync where you need to (tailnet)
+- [x] Admin/_utils not wide open (`internal_only` — LAN + 100.64.0.0/10 only)

 </details>