# Homelab improvements — plan brief

**How to use this:** Don't read everything. Pick something that sounds interesting and say it in chat — e.g. *"let's talk about backups"* or *"TB-003"*. We'll have a short conversation first. You can do, defer, drop, or change any item.

**Status:** Draft · **Host:** valhalla

---

## Talk first — plan level

Before any phase or task, we should answer:

1. **What feels urgent?** Backup? Security? Finishing romhacks? Something else entirely?
2. **What can wait or die?** Throwing items out is success — tell me what doesn't interest you.
3. **How do you want to work?** One item per session, or a theme (e.g. "media day")?

### What we decided (plan level)

| | |
|---|---|
| **Priority theme** | Quick wins complete (TB-001–005, TB-002–004, TB-033) — new services underway (Immich done, ownCloud→Nextcloud+OnlyOffice done) |
| **Explicitly dropped** | TB-017 (MinIO consolidation), TB-018 (Plane), TB-029 (Firefly), TB-030 (AdGuard — at router), TB-032 (Wiki.js — using BookStack) |
| **Notes** | Quick wins shipped 2026-06-11 (`51acb44` + follow-ups). Recyclarr `@daily`; infra pinned; jd + LAN lockdown on minio/homarr/docs. |

---

## Menu — pick one to talk about

Each link opens an **interview-first** task brief. The conversation is the task.

### Safety & quick wins — **complete** (2026-06-11)

| Say this… | About |
|-----------|--------|
| [TB-001](tasks/TB-001-backup-stack.md) | Automated backups — **done** (Kopia + B2) |
| [TB-033](tasks/TB-033-public-surface-audit.md) | Public surface audit — **done** |
| [TB-003](tasks/TB-003-recyclarr.md) | Recyclarr — **done** (`@daily` sync) |
| [TB-004](tasks/TB-004-pin-infra-tags.md) | Infra image pins — **done** |
| [TB-002](tasks/TB-002-jd-caddy-block.md) | jd.ginnoir.com — **done** |

### Security & cleanup

| Say this… | About |
|-----------|--------|
| [TB-005](tasks/TB-005-obsidian-hardening.md) | Obsidian vault hardening — **done** (LAN/tailnet only) |
| [TB-006](tasks/TB-006-authentik-forward-auth.md) | Login on admin UIs via Authentik |
| [TB-013](tasks/TB-013-code-server-mount.md) | code-server sees your whole home dir |
| [TB-014](tasks/TB-014-registry-auth.md) | Docker registry has no password |
| [TB-008](tasks/TB-008-retire-deluge.md) | Maybe remove Deluge (you have qBit too) |
| [TB-009](tasks/TB-009-bookstack-decision.md) | BookStack vs Obsidian — pick one? |
| [TB-010](tasks/TB-010-dev-stack-env-migration.md) | dev stack env file cleanup |
| [TB-011](tasks/TB-011-reap-orphan-volumes.md) | Delete old Docker volumes |

### Finish what's started

| Say this… | About |
|-----------|--------|
| [TB-007](tasks/TB-007-romhacks-handoff.md) | ROM hacks pipeline → RomM (incomplete) |
| [TB-012](tasks/TB-012-maintainerr.md) | Clean stale Overseerr requests |
| [TB-016](tasks/TB-016-document-plex.md) | Write down how Plex fits in |

### New services

| Say this… | About |
|-----------|--------|
| [TB-019](tasks/TB-019-immich.md) | Family photos — **done** (photos.ginnoir.com) |
| [TB-021](tasks/TB-021-paperless-ngx.md) | Scan/OCR documents — **dropped** (became Nextcloud migration) |
| [TB-022](tasks/TB-022-readarr.md) | Automate ebooks |
| [TB-023](tasks/TB-023-autobrr.md) | Torrent announce automation |
| [TB-024](tasks/TB-024-syncthing.md) | Device file sync |
| [TB-025](tasks/TB-025-metrics-beszel.md) | CPU/disk metrics dashboard |
| [TB-026](tasks/TB-026-igir-container.md) | Automate ROM library cleanup |
| [TB-020](tasks/TB-020-mealie.md) | Recipes — **deferred to famapp** |

### Active interest

| Say this… | About |
|-----------|--------|
| [TB-015](tasks/TB-015-vault-secrets-integration.md) | Move credentials into Vault |
| [TB-027](tasks/TB-027-jellyfin.md) | Replace Plex with Jellyfin? |
| [TB-028](tasks/TB-028-home-assistant.md) | Home automation |
| [TB-031](tasks/TB-031-pingvin-share.md) | Temporary file share links |

### Dropped

| | |
|---|---|
| TB-017 | MinIO consolidation — don't want it |
| TB-018 | Plane — removing it |
| TB-029 | Firefly III — no interest |
| TB-030 | AdGuard Home — handled at router |
| TB-032 | Wiki.js — using BookStack |

---

<details>
<summary>Background (optional — skip if overwhelming)</summary>

Homelab is ~50 containers, 15 stacks, Caddy ingress, git-push deploys. **Quick wins (TB-001–005, TB-002–004, TB-033) done 2026-06-11.** Main gaps: TB-006 Authentik rollout, romhacks handoff (TB-007), cleanup items.

Repo conventions: `stack.env` secrets, `edge` network, `internal_only` for LAN admin UIs, `./scripts/gen-bookmarks.ps1` after Caddy changes.

</details>