diff --git a/docs/roadmap.md b/docs/roadmap.md index ac2026d1..db84e27b 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -244,7 +244,9 @@ either machine is. carries pfSense's stock *Default allow LAN to any*.** `10.7.7.0/24` reaches every VLAN; `network.md` said "Nothing". Bounded by that segment holding only the switch — which is also the device whose SNMP agent serves GETBULK to any - short community (#84) and stays on v2c (#85). Lower risk than #228: getting it wrong + short community (#84) and stays on v2c until #444 replaces it — ADR-0036 + moved #85 to the iLO and the UPS card, and the switch is no longer in that + issue. Lower risk than #228: getting it wrong costs SNMP polling of `neo`, which is monitored. - **[#84](https://github.com/Gerrrt/HomeLab/issues/84) Retire the MokerLink switch's previous SNMP community.** The rows were overwritten and the @@ -550,8 +552,10 @@ what left this one unfireable for months. ## Infrastructure -- **[#92](https://github.com/Gerrrt/HomeLab/issues/92) Get the firewall backup - off `prometheus`, and buy a spare ProDesk.** Half done. Since 2026-09-03 +- **[#92](https://github.com/Gerrrt/HomeLab/issues/92) Rehearse the firewall + restore on `trinity`.** Retitled 2026-09-19 — it used to read *Get the + firewall backup off `prometheus`, and buy a spare ProDesk*; the copy is done + and the buy was withdrawn by ADR-0034. Half done. Since 2026-09-03 `make backup-firewall` copies every export to `oracle` — ciphertext only, the key stays here — and exits non-zero if it cannot, so the nightly job's metric says "stopped leaving this host" rather than "fine". Off-host, not offsite: @@ -837,15 +841,15 @@ what left this one unfireable for months. [#256](https://github.com/Gerrrt/HomeLab/issues/256) on 2026-09-17 — the pass that exists and a dashboard built entirely on `node_*` series, against an alternative the repository had never measured and which would have cost a - fifth rule. The job and the target file are written; the target is commented - until the pool exists, because on TrueNAS every route to an exporter runs - through it. Terminal survives + fifth rule. The job and the target file are written, and the target has been + live since 2026-09-19 (#522); #256 closed on it the same day. Terminal survives in the direction that carries it — CasaBonita stopped being terminal inbound on 2026-09-16 and stays terminal outbound, with #223's tripwire untouched and reading zero packets. Capacity buys a four-bay chassis with two bays filled, because the bay count is the half that - cannot be changed later and the library's size is a number nobody has; both - trays are still empty. + cannot be changed later and the library's size is a number nobody has; the + two filled trays have held the Exos pair since 2026-09-19, and `erebor` is + their mirror. - **[#101](https://github.com/Gerrrt/HomeLab/issues/101) Build ADR-0007's defended estate on `Saruman`** — a Windows domain, Wazuh, Velociraptor, PBS and a second observability stack. The umbrella. The observability half is @@ -923,9 +927,9 @@ what left this one unfireable for months. own premise. Six agents make about 21 GB of alerts a quarter, which the disks do not notice; what runs out is heap-per-shard, at OpenSearch's twenty-five-shards-per-GiB against one daily index each, so retention is - thirty days because that is what a 2 GiB heap buys. `stacks/soc/` is not - yet authored, and nothing stops it being written and CI-validated ahead of - `odin` the way `stacks/lab` was ahead of `alexander`; what it cannot do + thirty days because that is what a 2 GiB heap buys. `stacks/soc/` was + authored and CI-validated in #434 on 2026-09-10, ahead of `odin` the way + `stacks/lab` was ahead of `alexander`; what it cannot do before #414 is say anything, because an agentless Wazuh has nothing to report. [#268](https://github.com/Gerrrt/HomeLab/issues/268) PBS was **decided and @@ -938,8 +942,8 @@ what left this one unfireable for months. the box arriving"* — and **the trigger has fired**: `smaug` has held that address since 2026-09-16. This paragraph said the trigger had moved from a purchase to a build, which was right, and then the build happened. - What has not cleared is the blocker: the pool does not exist, so there is - still nowhere to send anything, and ADR-0027's sync job was designed against + The blocker cleared on 2026-09-19 as well: `erebor` is ONLINE, so there is + somewhere to send it. What is left is that ADR-0027's sync job was designed against a Linux host rather than TrueNAS — on TrueNAS it is PBS in a VM or a change to an NFS/SMB datastore, which are not the same answer. [#485](https://github.com/Gerrrt/HomeLab/issues/485) carries the re-read, diff --git a/docs/runbooks/build-the-nas.md b/docs/runbooks/build-the-nas.md index c94821d8..350ae5b6 100644 --- a/docs/runbooks/build-the-nas.md +++ b/docs/runbooks/build-the-nas.md @@ -653,7 +653,11 @@ measurement. - **[ADR-0027](../adr/0027-defer-proxmox-backup-server-until-there-is-somewhere-to-send-it.md)'s PBS**, whose sync job wants another PBS instance — on TrueNAS that is PBS in a VM or a change to an NFS/SMB datastore. + [#485](https://github.com/Gerrrt/HomeLab/issues/485) carries it. - **The off-host copy of `erebor/apps`**, which §4 decided should exist and this runbook does not build. + [#484](https://github.com/Gerrrt/HomeLab/issues/484) carries it, with the + finding that `jellyfin-config` lives on `erebor/ix-apps`, not `erebor/apps`. - **Plex**, deferred by ADR-0016 against a test nobody has run: whether any screen on 40 lacks a working Jellyfin client. + [#139](https://github.com/Gerrrt/HomeLab/issues/139) carries the test.