To be done
21
05 · Roadmap
What's done, what's next, and in what order.
Ordered by what would hurt most if it broke today. Backups go first because they're the one gap you can't fix after the fact.
Completed
20
§1
Still open, by area
A. Backups & durability
| Pick an off-node backup target: a NAS | Not started |
| Scheduled pg_dump for both PostgreSQL instances, plus WAL archiving if dumps aren't enough | Not started |
| Replicate the RustFS buckets to the backup target | Not started |
| Export the MikroTik configuration on a schedule and keep it off the router | Not started |
| Run a real restore test, then write down the procedure that worked | Not started |
B. Identity & secrets
| Decide which services really need Authentik SSO, then move them one at a time with a way back | Not started |
| Make Infisical the real source of truth, then point the Jenkins jobs at it | Not started |
C. High availability
| Keep the monitoring stack alive when a node goes down | Not started |
| Duplicate the critical pieces: proxies, databases and the sites clients use | Not started |
D. Automation
| Turn the base machine setup into Ansible instead of typing it on every host | Not started |
| Describe the VMs and LXC containers with OpenTofu | Not started |
| Configure Wake-on-LAN on pve03 | Not started |
E. Observability
| Write log-based alert rules in Loki (its ruler already points at Alertmanager) | Not started |
| Dedicated security alerting, separate from general monitoring | Not started |
F. Physical infrastructure
| Move the hardware into a proper rack | Not started |
| Redo the Ethernet cabling | Not started |
| Add a UPS so a power cut doesn't take everything down | Not started |
| Hardware for local AI beyond the GTX 1070 | Not started |
G. Edge
| Put the public services behind a CDN with DDoS protection, such as Cloudflare | Not started |
H. Documentation
| Check every service's documented config against the real host | Not started |
| Keep proxy diagrams and firewall docs in sync with Caddy and RouterOS | Not started |
§2
Done
| Item | Status |
|---|---|
| Split one flat network into eight VLANs, each with a single purpose | Complete |
| Default-deny firewall on the MikroTik, with one rule per allowed flow | Complete |
| A second DNS server, synced by TSIG-authenticated zone transfers | Complete |
| Remote access over two WireGuard tunnels, one for work and one for administration | Complete |
| Three Caddy reverse proxies: public, internal and management | Complete |
✓ a clear role for every node✓ every service, address and route documented✓ runbook: add a WireGuard peer✓ runbook: add a WireGuard tunnel✓ runbook: bring a new VLAN online✓ separate prod and dev PostgreSQL✓ S3-compatible storage (RustFS)✓ my own file cloud (OpenCloud)✓ my own photo library (Immich)✓ Jenkins + Harbor pipeline✓ Prometheus, Loki and Alertmanager✓ SSO with MFA (Authentik)✓ secrets manager (Infisical)✓ my own sites, self-hosted✓ one dashboard with every link