Retired systems
Everything I have taken out of the lab, in one table. Each retired system keeps its change records, inventory and evidence under the repo's Archive folder; the larger ones have a page each here.
A retired system is one I have taken out of the running lab on purpose. Its guest or containers are destroyed, its data is deleted, and its DNS record, proxy host, firewall policies, monitoring targets, Wazuh agent and automation inventory entries are removed. Its records stay. They move under Archive/ in the repo at their original path, so the old owner and the dates stay obvious, and the change records, inventory snapshots and evidence come with them.
That split keeps the current records honest. The live inventories describe only what runs today, and nothing in them calls a retired system current. The history stays dated: a change record still says what I saw on the day I wrote it.
Every retired system
Newest retirement first. Where a system has its own page, the name links to it.
| System | What it did | Deployed | Retired | Replaced by or reason |
|---|---|---|---|---|
| Homelab Dashboard | My own dashboard application on docker-main | Not recorded; running by 2026-07-27 | 2026-09-26 | Its container had stopped on 2026-09-22. Homarr replaced it on 2026-09-27 |
| Weebarr | Seasonal anime discovery and requests through Seerr, on media-01 | 2026-09-21 | Gone by 2026-09-24; recorded 2026-09-25 | Not recorded |
| Portainer and its Edge Agents | Docker management for docker-main and four remote Docker hosts | Not recorded; first Edge Agent 2026-04-14 | 2026-09-16 | Dockhand |
| Dockge | Compose stack manager on docker-main | 2026-09-15 | 2026-09-15 | Dockhand, the same day |
game-01 and the game servers | Pelican Panel and Minecraft in CT 123 on green-server | 2026-08-07 | 2026-09-12 | Not recorded; the container was already stopped when I retired it |
supabase-01 | VM 117 on grey-server; its workload is not recorded | Not recorded | Found already deleted on 2026-08-20 | Not recorded |
| Kasm Workspaces | Disposable browser and Linux desktop sessions in sealed lab VLANs | First build July 2026; rebuilt 2026-07-24 | 2026-08-19 | Not recorded |
debian-dev | VM 102, a GNOME development workstation | Not recorded; GNOME installed 2026-07-15 | 2026-08-14 | ubuntu-dev |
| TNIO AI bot | A Discord lore bot for the TNIO community, on ai-bravo-02 | Not recorded; its accuracy work dates from May 2026 | Archived 2026-07-25; guest deleted 2026-08-09 | Not recorded; the guest was already stopped |
| TeamSpeak server 01 | The first of three TeamSpeak voice servers on alpha-prod-01 | Not recorded | 2026-08-09 | Two servers remain; see Voice and community |
| Syncthing | An always-on sync peer for my Obsidian vault | 2026-07-22 | 2026-08-06 | I stopped using the server peer |
| Legacy Ansible controller project | The first Ansible project on ansible-01, connecting as root | 2026-04-09 | 2026-07-29 | The dedicated automation account from 2026-07-25 |
| Termix | A web SSH terminal on docker-main | Not recorded; upgraded from 2.2.1 to 2.5.0 on 2026-07-13 | 2026-07-28 | I stopped using it, and the management VLAN lockdown had already cut its route to the nodes |
| First Active Directory domain | Two Windows Server 2025 domain controllers and a domain-joined test VM | Not recorded | 2026-07-27 | The current forest, built in September; see Active Directory |
ai-alpha-01 | CT 104, a Discord chat assistant | Not recorded | Found already gone on 2026-07-25 | Not recorded |
The inventory also lists fedora-dev (VM 111, confirmed absent on 2026-08-08) and the first kali-pen build. Neither has a record of its own in the archive.
Note: Proxmox reuses guest IDs. CT 104 is now
monitor-01, VM 102 is nowkali-penand VM 105 is nowubuntu-dev, so a guest ID in an old record names the guest that held it on that date.
What a retirement removes
The individual records differ, but by September 2026 every retirement worked through the same layers, and each record says what it found on each one:
| Layer | What comes out |
|---|---|
| Proxmox | The guest, its volumes and, in the later sweeps, its leftover metric files and task logs on every node |
| Docker | Containers, named volumes, images, Compose project directories and any stack Dockhand had imported |
| Network | The internal DNS record, the Nginx Proxy Manager host and its logs, and every firewall policy or port that named it |
| Monitoring | Prometheus targets and blackbox probes, Grafana dashboards, and the Wazuh agent on the manager |
| Automation | Ansible inventories and validators, both in the repo and deployed on ansible-01 |
| Credentials | The service’s dedicated logins and API tokens; shared credentials stay |
| Records | The platform folder moves under Archive/, links are repaired, and the live inventories drop the system |
Smaller retirements
These didn’t need a page of their own.
Termix
Termix 2.5.0 was a web SSH terminal on docker-main, with a Guacamole 1.6.0 daemon beside it. It held nine saved SSH hosts in four folders, including the four Proxmox nodes of the time.
I decommissioned it on 2026-07-28 because I had stopped using it as a management path. The management VLAN lockdown the day before had already cut its route to the Proxmox nodes, so it held an SSH inventory it couldn’t reach, and I didn’t want to maintain a second SSH front end beside the ones I actually use.
The audit found something worse than an unused service. Its key was registered against 14 hosts, but it was only present on four, and on those four it sat in root’s authorized_keys on the hypervisors. A retired web terminal held root on all four nodes, so revoking that key came first. Then I removed the containers, the data volume, the Compose directory with its two application-data tarballs, and the images, deleted its DNS record, proxy host and Prometheus probe, and removed the identity and five Semaphore templates from the SSH key automation. The templates outlived the service on ansible-01 by a day and came out on 2026-07-29.
Legacy Ansible controller project
The first Ansible project on ansible-01 dated from 2026-04-09 and predated everything in the current design. Its ansible.cfg connected as root, and its inventory connected as root to the containers and the management host. Its one playbook, distribute_keys.yml, pushed three authorized keys into root’s key store on those hosts.
The dedicated automation account on 2026-07-25 existed to stop exactly that, so running the old playbook would have put keys back where that work removed them. Nothing referenced it, but it sat right next to Semaphore’s checkout path, where it could be mistaken for live automation. Its inventory also named hosts that were gone or renamed. Before deleting it I checked that none of Semaphore’s 18 templates, its configuration, /etc or any systemd unit referred to it. I archived the four files with the account name and key bodies redacted and deleted them from the controller on 2026-07-29.
The isolated security lab
Archive/Architecture/Isolated-Security-Lab.md is the cross-system design of the Kasm lab: the control plane, the four session lanes, the firewall boundary and the operating rules. It is the same system, so it is covered on the Kasm Workspaces page.
Weebarr
Weebarr 0.2.0 discovered seasonal anime through AniList and sent requests through Seerr, which handed them to the existing Sonarr anime profile. I deployed it on media-01 on 2026-09-21 as one more service in the media stack, behind an internal HTTPS name. It was removed from the host sometime between 2026-09-21 and 2026-09-24; the removal date, the commands and the reason are not recorded. On 2026-09-24 I verified that no container, image, listener, proxy host, DNS record, firewall port or Prometheus probe remained.
NetBird and Nginx Proxy Manager notes
Two archived notes are records of live services, not retired ones:
- The NetBird folder holds only a duplicate copy of a 2026-07-11 Nginx Proxy Manager problem: the advanced-settings control closed an unsaved proxy-host form. I saved the basic host first and added the advanced configuration afterwards. The record now lives once, with Nginx Proxy Manager.
- The Nginx Proxy Manager folder holds the 2026-07-28 record that published Kasm at an internal HTTPS name. It moved to the archive with Kasm and is summarized on that page.