diff --git a/plans/homelab-improvements/PLAN-BRIEF.md b/plans/homelab-improvements/PLAN-BRIEF.md index e1e1028..ce35c3c 100644 --- a/plans/homelab-improvements/PLAN-BRIEF.md +++ b/plans/homelab-improvements/PLAN-BRIEF.md @@ -18,7 +18,7 @@ Before any phase or task, we should answer: | | | |---|---| -| **Priority theme** | Backups done (TB-001 complete) | +| **Priority theme** | Backups + Obsidian hardening done (TB-001, TB-005 complete) | | **Explicitly dropped** | _(none yet)_ | | **Notes** | _(conversation notes go here)_ | @@ -42,7 +42,7 @@ Each link opens an **interview-first** task brief. The conversation is the task. | Say this… | About | |-----------|--------| -| [TB-005](tasks/TB-005-obsidian-hardening.md) | Your Obsidian vault is public-facing | +| [TB-005](tasks/TB-005-obsidian-hardening.md) | Obsidian vault hardening — **done** (LAN/tailnet only) | | [TB-006](tasks/TB-006-authentik-forward-auth.md) | Login on admin UIs via Authentik | | [TB-013](tasks/TB-013-code-server-mount.md) | code-server sees your whole home dir | | [TB-014](tasks/TB-014-registry-auth.md) | Docker registry has no password | @@ -91,7 +91,7 @@ Each link opens an **interview-first** task brief. The conversation is the task.
Background (optional — skip if overwhelming) -Homelab is ~50 containers, 15 stacks, Caddy ingress, git-push deploys. Main gaps from analysis: no backups, Obsidian public, Authentik barely used, romhacks pipeline half-done. +Homelab is ~50 containers, 15 stacks, Caddy ingress, git-push deploys. Main gaps from analysis: Authentik barely used, romhacks pipeline half-done, public-surface audit still open (TB-033). Repo conventions: `stack.env` secrets, `edge` network, `internal_only` for LAN admin UIs, `./scripts/gen-bookmarks.ps1` after Caddy changes. diff --git a/plans/homelab-improvements/tasks/README.md b/plans/homelab-improvements/tasks/README.md index 6d0bc11..cd8c76e 100644 --- a/plans/homelab-improvements/tasks/README.md +++ b/plans/homelab-improvements/tasks/README.md @@ -38,7 +38,7 @@ Parent: [PLAN-BRIEF.md](../PLAN-BRIEF.md) · Template: [_TEMPLATE.md](_TEMPLATE. | TB-002 | jd.ginnoir.com | [→](TB-002-jd-caddy-block.md) | | TB-003 | Recyclarr | [→](TB-003-recyclarr.md) | | TB-004 | Pin infra tags | [→](TB-004-pin-infra-tags.md) | -| TB-005 | Obsidian hardening | [→](TB-005-obsidian-hardening.md) | +| TB-005 | Obsidian hardening ✓ | [→](TB-005-obsidian-hardening.md) | | TB-006 | Authentik admin login | [→](TB-006-authentik-forward-auth.md) | | TB-007 | Romhacks handoff | [→](TB-007-romhacks-handoff.md) | | TB-008 | Retire Deluge | [→](TB-008-retire-deluge.md) | diff --git a/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md b/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md index 9a3eb0b..83e7cfc 100644 --- a/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md +++ b/plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md @@ -1,7 +1,7 @@ # TB-005 — Obsidian / CouchDB hardening -**Status:** done (pending deploy) -**Your call:** Do it — LAN/tailnet only via `internal_only` +**Status:** done — deployed 2026-06-10 +**Your call:** **Do it** — LAN/tailnet only via `internal_only` --- @@ -34,8 +34,8 @@ | | | |---|---| | **Decision** | Do it — `internal_only` (LAN + tailnet); no public access | -| **Notes** | All LiveSync clients on tailnet; Authentik not needed | -| **Date** | 2026-06-10 | +| **Notes** | `import internal_only` on obsidian.ginnoir.com. All LiveSync clients on tailnet; Authentik not needed. CouchDB password rotation deferred. | +| **Date** | 2026-06-10 (decided + deployed) | --- @@ -54,7 +54,7 @@ Caddyfile, stacks/notes/ ### Done when -- [ ] You can still sync where you need to -- [ ] Admin/_utils not wide open +- [x] You can still sync where you need to (tailnet) +- [x] Admin/_utils not wide open (`internal_only` — LAN + 100.64.0.0/10 only)