Build the sensitive-tier host on the ProDesk (ADR-0034)

[Gerrrt]

Where this stands, 2026-09-19

The box is in hand since 2026-09-14 (#492), opened 2026-09-15, named trinity, and its 512 GB SSD is an M.2 stick with the second M.2 slot free (#474) — which is where the I226 card goes. Still in transit: the I226 card on its M.2 adapter and the pfSense installer stick; between them, the whole of what the rehearsal waits on. The stack is authored: seven of ADR-0008's nine services are merged and CI-validated in stacks/sensitive/ (#129–#135), the tier's CA is decided (ADR-0037) and its runbook written, the restore runbook has been run once on the monitoring host.

Three things the body as filed says are gone: the "second drive for the photo library" (the 2 TB USB drive is on hand); the "USB NIC" (morpheus has none — the spare needs the I226 card, restore-the-firewall.md); and the Zigbee/Z-Wave coordinator (ADR-0035: no radio, nothing on Skids needs one). Both "not decided here" items are decided: the 99 → 20 rule is one host to one device on two ports (ADR-0035), and the forwarder change is forward-dns-to-adguard.md. ADR-0037 and ADR-0043 keep the CA off this host: the tier root is cold on prometheus; trinity receives a bundle with the root key removed.

Order of work

0. Before 2026-10-08, the return window (hardware.md): read the i5-8500T, the 32 GB, the 512 GB, the serial and product number off the case, and that it has the onboard NIC alone. The only step here not waiting on a package. Owned jointly with Rehearse the firewall restore on trinity #92.
1. The firewall restore rehearsal — owned by Rehearse the firewall restore on trinity #92; this issue receives the box afterwards, per restore-the-firewall.md step 6.
2. Wipe, and decide disk encryption at build time (ADR-0022 needs the answer before the first real item).
3. Static address, Kea reservation, network.md and hardware.md Compute row.
4. make secrets-init STACK=sensitive; the tier's own age recipient on this host.
5. Mint and install the tier CA per build-the-tier-ca.md; the root key never travels.
6. Format the USB disk ext4 for IMMICH_UPLOAD_LOCATION.
7. Kea reservation for bifrost, then the 99 → 20 pass with the TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only #223 tripwire read immediately after; host overrides on morpheus.
8. Deploy the stack. The deploy checklist is stacks/sensitive/README.md — What make validate still does not prove — and it is the acceptance list for Sensitive tier: Caddy as the reverse proxy and the only published port #129–Sensitive tier: AdGuard Home, as a forwarder behind Unbound and not a client-facing resolver #135.
9. A timer for make backup STACK=sensitive and a copy off the host (README, restore-the-sensitive-tier.md); then Nothing converges stacks/sensitive: the tier with the real data is the only one deployed by hand #533 for converging it.
10. The Immich database-before-first-start restore rehearsal (README) before the first real photo; TOTP enrolments; the ADR-0022 and ADR-0023 records.

Done when

The nine services serve from trinity over leaves from the tier's CA, the backup timer runs and copies off-host, and the return window has passed with the spec read. #129–#135 close on step 8; this closes on step 10.

---

Body as filed, superseded 2026-09-19

The host for ADR-0008's sensitive tier. Sixteen open issues (#129–#137,
#142–#148) say "the mini PC in #102"; #102 closed on 2026-09-04 by splitting
into them, and the machine itself lost its tracker that day. This is the
tracker.

The machine

ADR-0034 decides it: the HP ProDesk 600 G4 bought on 2026-09-08 — i5-8500T,
32 GB, 512 GB SSD, the same model as morpheus. It was bought as the cold
spare for #92 because that was the only ProDesk anyone had been told to buy;
the ADR records why it is a better fit for this tier than the "N100-class"
box the docs assumed, and why the cold spare is deferred rather than bought
twice. In a disaster it is the spare hardware: same model, so a pfSense
restore onto it goes straight through, at the cost of the tier being down
until a replacement arrives — a cost ADR-0023 already accepts.

Order of work — each step is testable only after the one before it

1. Rehearse the firewall restore on it first, on the bench, exactly as
   restore-the-firewall.md §Rehearse
   the restore on the spare says. That closes the rehearsal half of Rehearse the firewall restore on trinity #92 on
   this hardware, before the box holds anything, and answers the questions §3
   of that runbook cannot: what the fresh install assigns to the onboard NIC,
   whether a USB NIC comes back under the same name, how long it takes. Needs
   the pfSense installer stick and a USB NIC.
2. Wipe it, and decide disk encryption at build time (ADR-0022 requires
   the decision, not an answer). The choice for a headless box: a TPM-sealed
   key that unlocks unattended, or a box that stays locked after a power cut
   until someone types a passphrase. ADR-0023 makes the second acceptable —
   the tier is allowed to be down — so pick it deliberately.
3. Address and place it. A static on Winterfell below the DHCP range, a
   Kea reservation, network.md and hardware.md rows. Where it physically
   sits is decided here too: Sensitive tier: Home Assistant, and the 99→20 rule it exists to use #134 notes a USB Zigbee/Z-Wave coordinator has
   to be on this box, and a rack in a closet is a poor place for a radio.
4. stacks/sensitive/ (name to settle), in the ADR-0004 shape: Caddy as
   the only published port (Sensitive tier: Caddy as the reverse proxy and the only published port #129), step-ca (Sensitive tier: step-ca, so issuing a certificate is an API call rather than a runbook #130), then the services — empty.
   scripts/stacks.sh makes a third stack cost nothing in tooling (Every validator is pinned to stacks/observability — a second stack would be checked by nothing #263).
5. Prove the backup and restore path with nothing in it. ADR-0023's
   off-estate encrypted copy, keyed to the second recipient Add a second age recipient so decryption does not depend on one person #294 named. A
   restore that has never been run is a hypothesis, and this box will hold
   the data whose loss actually hurts.
6. TOTP enrolled at first login on Vaultwarden, Paperless-ngx and Home
   Assistant, and security.md naming Immich and AdGuard as unable to carry
   a factor — ADR-0022's floor.
7. Then the first real photo. ADR-0022's trigger fires on it; everything
   above has to exist before it arrives.

Purchases this still needs

• A second drive for the photo library, sized when the library's size is
  known — the G4 has a free bay. 512 GB is fine for everything but Immich.
• A USB NIC for step 1, ideally the same chipset as morpheus's.
• Not a second ProDesk, unless the tier holding real data makes an hour
  of firewall downtime unacceptable — that is ADR-0034's reopen condition.

Not decided here

The width of the 99 → 20 rule for Home Assistant (#134), and ADR-0010's
forwarding change for AdGuard (#135). Both are the roadmap's #102 paragraph
and belong to their issues.

[Gerrrt]

Step 4 is ahead of the hardware: stacks/sensitive/ exists (#415) with
Caddy and step-ca, and passes everything make validate runs. Three
decisions taken today, recorded in the files and here:

• Name and address: trinity, 10.0.99.40 — a static below the DHCP
  range, the next Matrix name, in the architecture table with the not-built
  marker.
• Its own age key and .sops.yaml rule, so trinity opens the tier's
  secrets and none of the estate's. make secrets-init STACK=sensitive on
  the box fills the placeholder.
• step-ca is an intermediate beneath the lab CA, minted on the monitoring
  host; and trinity runs an Alloy agent like oracle, pushing to
  10.0.99.20, no new rule.

What that adds to the order above, between steps 3 and 4:

• Mint the intermediate on the monitoring host (step ca init --root …),
  with the same password that goes into STEPCA_PASSWORD; copy the tree to
  the step-ca-data volume on trinity.
• Issue the leaf: make certs ARGS="--host trinity.matrix.elysium --ip 10.0.99.40 --dns trinity", three files over as the lab runbook does it.

Both belong in the build runbook this issue still owes.

🤖 Generated with Claude Code

[Gerrrt]

Step "purchases this still needs" changes: the second drive is off the list. A 2 TB USB portable drive is on hand and becomes the photo library's disk — Immich's originals on it, its database on the internal SSD, after a wipe and an ext4 format (it was a games console's storage). One consumer spindle with no mirror, so ADR-0023's off-estate copy is what protects it, exactly as would have been true of a bought drive. Recorded in hardware.md.

What this host still needs bought is one thing: a USB NIC for the restore rehearsal in step 1, ideally the same chipset as morpheus's. It is on the roadmap's Everything still to buy list, which is now the only place a purchase is allowed to appear.

🤖 Generated with Claude Code

[Gerrrt]

Correction to the comment above: the one purchase this host still needs for the rehearsal is not a USB NIC. morpheus does not have one — its second interface is an Intel I226-V 2.5 GbE card on an M.2 B+M-key adapter in the G4's second M.2 slot, igc0, carrying the switch-management LAN and every VLAN (read off the box on 2026-09-09; details on #92). A USB adapter would come up under another device name and put a restore onto this box into the interface-assignment dialogue.

So the part to buy before the rehearsal is the same M.2 I226 card morpheus has. The roadmap's shopping list says so as of #425. Two things for the build after the rehearsal:

• If the box's 512 GB SSD is a 2.5" drive, the drive carrier and a card in the second M.2 slot contend for the same space (ServeTheHome's G4 Mini teardown notes this). An M.2 SSD does not conflict.
• ADR-0034 point 3 makes this box the firewall's spare hardware. Leaving the card fitted once trinity is built is what keeps that restore a straight-through one; whether trinity uses the card as its own NIC or leaves it idle is this issue's call.

🤖 Generated with Claude Code

[Gerrrt]

trinity landed 2026-09-15, unopened. Recorded in docs/hardware.md by #472 — arrival only; it still enters the Compute table when this issue builds it, after the restore has been rehearsed on it.

Step 1 is not unblocked. The rehearsal's prerequisites were the box, the I226 card and the pfSense installer stick. The box is here; the card and the stick are not, and they are now the whole of what it waits on. restore-the-firewall.md's list was headed "Before the box arrives" and has been rewritten as a list of what is blocking.

One thing is worth doing today, before the card arrives. The card goes in the G4 Micro's second M.2 slot, and hardware.md has carried this warning since the card was bought:

and if that machine's 512 GB SSD turns out to be a 2.5" drive rather than M.2, the drive carrier and this card contend for the same space.

That was an unknown about a box in a van. It is now an unanswered question about a box in the room, and the card has not shipped — so opening the ProDesk now is the difference between a return and a part that fits nothing. If the SSD is 2.5", the M.2 slot may be occupied by the carrier and the card needs somewhere else to go, or the drive does.

Also owed, and recorded as unread rather than assumed: the i5-8500T, the 32 GB and the 512 GB are the listing's claims and not yet the machine's; the serial and product number off the case; and confirmation that it really does ship with the onboard NIC only.

Not affected: the cold spare stays deferred per ADR-0034, and this is still one box with two jobs.