Roadmap

The repo keeps one central backlog, TODO.md, and one list of closed work, COMPLETED.md. The central file holds priorities and an index; the steps for each system live in that system’s own TODO, and a finished item moves to COMPLETED with a link to the record that closed it. This page reads both as of the TODO’s last update on 2026-10-02.

Note: Nothing is on a schedule. The backlog’s Scheduled section is empty, so the order below is the order of the Inbox, not a set of dates.

Open work

Cluster and hardware

• Repair Green’s memory. Open since 2026-09-20, when Green’s first Windows install crashed and an online memory test produced 25 failure lines. A bounded test on 2026-09-27 reproduced the fault six seconds after launch. Isolating the bad module or slot needs physical access, and Green takes no guests until a full test passes.
• Activate win11-dev. The Windows 11 workstation is built and has run on Grey since the verified 2026-09-23 migration; only Windows activation remains.
• Schedule six VM reboots. The 2026-10-02 package updates left newer kernels installed on alpha-prod-01, app-01, edge-01, security-01, splunk-siem and ubuntu-dev. Each reboot needs its service and monitoring checks again afterward.
• Decide the scope of the PXE join key. The key that lets a newly installed node join the cluster is trusted for root on all five nodes. On 2026-07-31 it was scoped to grey-server, and the 2026-08-15 repair of Grey’s key file removed the mechanism that scoped it. Re-scoping it means keeping it outside the cluster-backed key file, which is the arrangement that once diverged silently, so the choice is which cost to carry.
• Finish three records. Capture the live five-node Corosync configuration, date the HA removal, monitor-01 resize and HQ-WS001 memory change from the Proxmox task logs, and find what released about 200 GiB on hddpool-1 between 2026-09-06 and 2026-09-24.
• Keep Galaxy PXE ready. The physical deployment is complete; the one-use service stays ready for the next node.

Network

• Decide how far Threat Management inspection goes. The DMZ joined the inspected networks on 2026-08-30 and Detection Mode moved to Notify and Block on 2026-08-31, so a signature match on any of the seven inspected networks is dropped. Eight routed LANs are still outside inspection: Management, Server-Provision, Proton-WiFi, Cluster-Net, Security-A, MONITOR-A, SERVERS-A and Access-A. That is a throughput trade rather than a switch to flip.
• Upgrade Nginx Proxy Manager to 2.16.0, carefully. A scheduled Dockhand update stopped NPM on 2026-09-25 and cut the connection that would have replaced it. NPM is now pinned and excluded from updates. First I confirm the 2026-09-26 scheduled run left it alone, then I plan the manual upgrade.
• NetBird has no open items since the 2026-07-12 descope. An orphaned VLAN 90 resource was noted on 2026-09-25.

Identity and endpoints

• Active Directory. The forest has run on two Windows Server 2025 controllers since 2026-09-09. Still open: browser workflow exercises in Windows Admin Center, replacing its gateway certificate before 2026-11-10, renewing the WinRM certificate before 2027-09-12, RSAT on ObiPC, restoring the temporary testing state (the admin password policy and unique passwords on four accounts), auditing credential-validation failures on both controllers, and a BitLocker baseline for physical workstations.
• Observe offline sign-in and unlock. I applied the online-sign-in policy on 2026-09-19 and verified both domain workstations; the interactive checks remain.
• Physical-access exercise follow-ups. The 2026-09-27 review of ObiPC found 22 failed interactive events and no successful human sign-in in the 72 hours examined. Audit coverage, centralized detection and retest criteria are next.
• Finish the ObiPC restriction project. The domain controls went in on 2026-09-12, the machine was rebuilt after the 2026-09-18 recovery-menu wipe, and the lockdown leaves Action1 and App Portal as the only install paths. Remaining: observe the user-side policies at the next sign-in, BitLocker with TPM and PIN, deploy Git, Node.js and Python through Action1, decide a OneDrive path exception, and review the Script audit log before enforcing that rule collection.
• Finish the App Portal rollout. Server and both PCs run 0.6.0. Remaining: report two job-reporting defects upstream, prove directory sign-in against the released server, confirm the Discord silent switch, decide how pinned installer hashes are refreshed, remove the pre-0.6.0 copy from docker-main, and add client enrollment codes and signed releases.
• Complete the Action1 Deployer on HQ-MGT01. The whole-domain scope is saved and three machines show Connected. Domain controller deployment still returns access denied, and I need to decide whether the console exclusion on ObiPC goes back on.
• Microsoft Intune. Two managed devices. Open: FileVault key escrow to match the BitLocker baseline, Platform SSO, and whether the two hybrid-joined Windows workstations should be co-managed. There is deliberately no compliance policy, so the Compliant status both devices report carries no information, and no Conditional Access policy may require a compliant device.
• Finish the MeshCentral pilot. Agents are installed on four machines, including ObiPC since 2026-09-18. Next is testing console access while logged out, Ctrl+Alt+Delete, UAC elevation and reconnect after a reboot, and deciding on session recording, which is the one thing that grows without bound. RustDesk retires only after those tests pass.

Security and monitoring

• Wazuh. Phase two of file-integrity monitoring covers the other 14 agents. Release the twelve agent package holds one host at a time, then move edge-01 off 4.14.5. There is no active response, by decision.
• Splunk Enterprise. Collect Rocky host logs and Proxmox host logs, add an ips_category breakdown and a machine and severity filter to the Wazuh dashboard, and write a verification script for the wazuh_insights app.
• Splunk Enterprise Security. Risk-based alerting, the asset and identity framework, a watched-path alert once file-integrity phase two lands, and a review of ES roles.
• Prometheus. UniFi gateway metrics are still open. Fifty targets in six jobs remain after the 2026-09-27 retirement of What’s Up Docker, and 23 Grafana rules deliver to Discord.

Automation and services

• Ansible. The SSH key onboarding play should create a missing .ssh directory with the right owner, and the 2026-07-29 rework of the reboot wait has not yet run against a real reboot.
• Coolify. Decide whether to delete a stale second server record on a separate Coolify team that points at a host that does not exist. Found on 2026-09-07.
• Media Stack. Whether to backfill 16 anime episodes that miss their quality cutoff, whether Radarr gets anime handling, and whether Recyclarr should keep the release-group tiers current.
• Diagrams, low priority. Review the authored diagrams and redraw the ones that no longer match. One is known: the Prometheus diagram showed seven targets against a live 57 on 2026-09-24. Searching an SVG for a number proves nothing, so each one has to be opened.

Recently completed

Grouped by area, newest first within each group. COMPLETED.md links each item to the record that closed it.

Cluster and hardware

• 2026-09-24: Recorded the removal of the HA resources for CT 107 and CT 108; Galaxy has no HA resources.
• 2026-09-23: Moved win11-dev from green-server to grey-server with its system, EFI and TPM volumes.
• 2026-09-21: Completed win11-dev as a standalone Windows 11 Pro workstation.
• 2026-09-02: Masked openipmi on the four Lenovo nodes.
• 2026-08-01: Upgraded the cluster to Proxmox VE 9.2.6 and seeded the SSH host key store.
• 2026-07-31: Cleaned up after the five-node expansion and brought Green’s SSH setup in line with the other nodes; closed the Blue duplicate volume group incident.
• 2026-07-26 to 2026-07-29: Purged stale host artifacts, then swept the fleet and reclaimed 60.6 GiB.
• 2026-07-25: Replaced Purple’s boot NVMe.
• 2026-07-13: Restructured the Datacenter firewall into IPSets.
• 2026-07-10: Added the Cluster-Net Corosync link and the docker-network LXC on Access-A.

Network

• 2026-09-02: Stopped Threat Management blocking the automation hosts’ SSH bursts by excluding one outbound scan signature instead of one host at a time.
• 2026-07-27: Consolidated UniFi zones and objects and finished the MGMT-A lockdown.
• 2026-07-12: Migrated Wazuh, monitoring and Splunk from MGMT-A to Security-A, VLAN 72, with UniFi CEF ingestion verified at the new address.
• 2026-07-11 to 2026-07-12: Built the NetBird and Nginx Proxy Manager access stack, enrolled the first peer and routed it into Access-A.

Identity and endpoints

• 2026-09-24: Reviewed ObiPC sign-in events on both domain controllers while the machine was unreachable over SSH.
• 2026-09-23: Disabled the restricted user’s account on both domain controllers, and reviewed the day’s ObiPC events read-only; they showed operational errors and application-control blocks, not another incident.
• 2026-09-20: Added seven AppLocker publisher rules on ObiPC, enabled LDAPS on the domain controllers, and shipped App Portal 0.6.0 with its agent and game catalog.
• 2026-09-19: Deployed the App Portal server on docker-main.
• 2026-09-18: Rebuilt and rejoined ObiPC and locked down its recovery paths and settings after the recovery-menu wipe.

Security and monitoring

• 2026-09-11: Repaired the Wazuh manager’s hash-refresh restart and verified app-01 reconnected after its move to Purple.
• 2026-09-07: Verified the fleet access model on every guest, removed the last passwordless sudo grants for human accounts, aligned root login on the nodes and moved Coolify off root SSH. This closed the fleet access priority opened on 2026-08-14.
• 2026-09-02 to 2026-09-03: Deployed the Discord alert bot; nine more Grafana rules joined the first fifteen, and nine Splunk searches began posting UniFi and Wazuh security events.
• 2026-08-03: Deployed Wazuh agents across the fleet.
• 2026-07-27: Counted Grafana SQLite locks on monitor-01: one successful retry and no errors in 24 hours.
• 2026-07-25 to 2026-07-26: Expanded fleet metrics, built the Grafana overview, and moved monitoring and PeaNUT to monitor-01.
• 2026-07-22: Closed the Grafana plaintext administrator credential incident.
• 2026-07-13: Re-enrolled the Wazuh endpoints and cleaned up the monitoring baseline.

Automation and services

• 2026-09-18: Updated Coolify to 4.3.23 and set up Dockhand’s image cleanup and schedules.
• 2026-09-15: Built Dockhand’s custom-image and agent update workflows.
• 2026-09-04 to 2026-09-05: Put the GTX 1080 Ti to work for Ollama, replaced its model with Qwen 3.5 2B, and published Open WebUI internally.
• 2026-09-06: Ran the documentation staleness audit and its follow-ups.
• 2026-08-19: Moved CLI Proxy API to docker-main.
• 2026-08-07 to 2026-08-09: Brought up the game servers platform on game-01 and replaced its Better Realism Minecraft server with a vanilla one.
• 2026-07-28 to 2026-07-30: Ran the first full fleet maintenance, added TeamSpeak reachability monitoring and TS3 Manager internal HTTPS, and brought Semaphore into parity with the Ansible projects.
• 2026-07-17 to 2026-07-22: Onboarded the Media Stack, passed its end-to-end acquisition test on 2026-07-21, and moved its data to the HDD.
• 2026-07-14 to 2026-07-20: Cleaned up SSH authorized keys, upgraded Ansible and Semaphore, built SSH identity automation and the fleet update playbooks.

Retirements

• 2026-09-26: Homelab Dashboard, with its deployment, access and unreachable alert.
• 2026-09-16: Portainer and its Edge Agents, replaced by Dockhand.
• 2026-09-12: game-01 and its game servers.
• 2026-08-20: supabase-01.
• 2026-08-19: Kasm Workspaces, after its build-out and session isolation work on 2026-07-28.
• 2026-08-14: debian-dev, after ubuntu-dev replaced it. Its workstation baseline and toolchain build had closed on 2026-08-08.
• 2026-08-09: ai-bravo-02 and its TNIO AI bot.
• 2026-08-06: Syncthing, deployed for an Obsidian vault on 2026-07-22.
• 2026-07-28: Termix.
• 2026-07-27: The first Active Directory domain and its three guests. fedora-dev was kept that day and deleted later, confirmed on 2026-08-08.

Repository and documentation

• 2026-08-08: Refreshed the internal documentation site’s host pages from live cluster state after they had published a deleted VM and missed a new one, and fixed the generator that had drifted.
• 2026-08-03: Rewrote the documentation standard and the repository structure: dropped the tier system, retired 1,010 placeholder substitutions while keeping 252 legitimate ones, gave incidents one naming convention and centralized 47 diagrams under Assets/.
• 2026-08-02: Deployed the internal documentation site on docker-main as an unprivileged Nginx container with a read-only root filesystem and every Linux capability dropped.
• 2026-07-27: Moved the pre-scrub Git history bundles and the private redaction map out of the working tree, closing the last follow-up of the preview server incident.
• 2026-07-25: Closed the TeamSpeak credential remediation after confirming the rotated values work and the old ones do not.
• 2026-07-09: Restructured the workspace and organized the older working trees, the first entries in the completed list.