To be done
16
06 — Roadmap
Not a wishlist. A working list.
Filed the way I'd want it handed to me if I inherited this system tomorrow — what's live, what isn't, and why the order matters.
Completed
20
§1
Still open, by area
A. Identity & Secrets
| Actually turn SSO on for every internal service, not just have it available | Not started |
| Stop pasting secrets by hand — make Infisical the real source of truth | Not started |
B. Data Durability & High Availability
| Buy a NAS to centralize data and make backups/migrations possible | Not started |
| Mirror the critical machines — proxies, databases, key sites — so one dying doesn't take everything down | Not started |
| Get backups running on a schedule, automatically | Not started |
C. Automation & Infrastructure-as-Code
| Stop maintaining hosts by hand — automate it | Not started |
| Adopt Ansible and OpenTofu so servers are configured from code, not memory | Not started |
| Fix Wake-on-LAN so machines can be powered on remotely | Not started |
D. Observability
| Turn on log-based alerts in Loki, not just metric-based ones | Not started |
| Make the monitoring stack itself survive a node going down | Not started |
E. Physical Infrastructure
| Move the hardware into a proper rack | Not started |
| Redo the ethernet cabling properly | Not started |
| Buy and install a UPS, so a power blip doesn't take everything down | Not started |
| Get hardware capable of real local AI experimentation | Not started |
F. Security & Edge
| Put public-facing services behind something like Cloudflare for attack protection | Not started |
G. Documentation
| Write up more of the real day-to-day processes, not just the reference pages | Not started |
§2
Filed as done
| Item | Status |
|---|---|
| Split the network into isolated zones instead of one flat trust area | Complete |
| Write firewall rules for exactly what each zone is allowed to reach | Complete |
| Give DNS a second server, so one machine dying doesn't break lookups | Complete |
| Build a secure way to reach everything remotely, without being on-site | Complete |
| Route traffic through three separate proxies, one per trust level | Complete |
✓ every node has a clear job✓ the whole network is documented — services, IPs, all of it✓ runbook for adding a remote-access peer✓ runbook for adding a remote-access tunnel✓ runbook for bringing a new network zone online✓ real databases running✓ S3-compatible file storage✓ my own file cloud (OpenCloud)✓ my own photo cloud (Immich)✓ a complete build-and-deploy pipeline✓ the whole stack is watched — metrics and alerts✓ single sign-on set up (Authentik)✓ centralized secrets set up (Infisical)✓ my own sites and apps, self-hosted✓ every link in one dashboard