Session Summary - 2026-01-16¶

Overview¶

Completed all remaining improvement items from the 2026-01-15 codebase review, documented home devices, and made a major architecture decision: moved Headscale from RPi 5 to VPSfor 24/7 mesh availability. Completed all 24 items from comprehensive codebase review.Added comprehensive security hardeningbased on full codebase audit.Session 2: Completed 12 infrastructure improvements (quick wins + medium priority) from improvement opportunities audit.

Result:24/24 improvements +21/22 security fixes+12/12 infrastructure improvements

Completed Tasks¶

Medium Priority (4 items)¶

#	Task	File Created

Low Priority (2 items)¶

#	Task	Action

New Documentation¶

VLAN Design (`docs/vlan-design.md`)¶

VLAN 1 (Management): Servers, admin devices
VLAN 10 (IoT): Cameras, smart devices - no internet
VLAN 20 (Guest): Internet-only access
OPNsense firewall rules
Camera isolation strategy
Switch configuration (MokerLink + PoE)

Backup Test Procedure (`docs/backup-test-procedure.md`)¶

Monthly test schedule (first Sunday)
7 test procedures:
Restic repository health
Snapshot verification
Headscale restore test
Vaultwarden restore test
Home Assistant restore test
Offsite backup verification
Full restore drill (quarterly)
Test results template
RTO/RPO targets

Certificate Strategy (`docs/certificate-strategy.md`)¶

Decision: Tailscale HTTPS for internal services
Public services: Let's Encrypt via Caddy
Static sites: Cloudflare edge certificates
Internal services: Tailscale MagicDNS certificates
Auto-renewal cron script
Certificate inventory

Home Devices (`docs/home-devices.md`)¶

14 devices served by homelab services
4 mobile: Samsung A16 (x2), Pixel 6, iPhone 14 Pro Max
4 computers: MacBook Air M1, MacBook Pro 2012, ThinkPad X240, Acer C720
2 entertainment: LG Smart TV, Apple TV 4th Gen
2 audio: Yamaha RX-V671, Infinity Speakers
2 office: HP Deskjet printer, Brother scanner
Service access matrix per family member
Network/VLAN assignment

Architecture Change: Headscale to VPS¶

Problem: User concerns about mobile kit (RPi 5 + Beryl AX) running 24/7:

Paraguay heat - reduce active equipment in home
Fire hazards - fewer devices running overnight
Energy consumption - RPi 5 + router unnecessary when sleeping

Solution: Move Headscale from RPi 5 to VPS

Component	Before	After

Files Updated¶

docs/services.md - Moved Headscale to VPS section
docs/hardware.md - RPi 5 now "Pi-hole (mobile DNS)"
docs/mobile-homelab.md - Complete rewrite for on-demand operation
docs/architecture-review.md - Updated diagrams
docs/monitoring-strategy.md - Mobile kit alerts now info-level (not critical)

Files Created¶

docker/vps/networking/headscale/docker-compose.yml - Headscale + backup sidecar
docker/vps/networking/headscale/backup.sh - Hourly SQLite backup script

2.5G Switch Clarification¶

Primary use: NAS ↔ MacBook fast file transfers
Cameras don't benefit (1G PoE switch sufficient)
Optional: can connect casually when needed

Other Updates¶

docs/domain-research.md: Added archive notice (superseded by domain-strategy.md)
docs/hardware.md:
Documented NAS PSU: picoPSU-160-XT + 220W brick (192W DC-DC, 2013)
Fixed NAS services list (Frigate runs on Docker VM, not NAS)

Commits¶

Hash	Description

Network Diagram Update¶

Finalized network topology using both switches:

MokerLink 2.5G - Main backbone with VLAN trunking (8 ports)
TP-Link PoE - Camera power on VLAN 10 access port (unmanaged)
Entertainment devices added: Yamaha RX-V671, Apple TV, LG TV

See docs/fixed-homelab.md and docs/vlan-design.md for updated diagrams.

New Improvement Plan (2026-01-16)¶

Comprehensive codebase review identified 24 improvement items. All 24 complete.

Phase 1: Critical (7/7 Complete)¶

Item	File Created

Phase 2: High (5/5 Complete)¶

Item	File Created

Phase 3: Medium (12/12 Complete)¶

Item	File Created/Modified

Improvements Summary (2026-01-15 to 2026-01-16)¶

All 12 items from codebase review now complete:

#	Task	Status	Session

| 1 | Update architecture-review.md domains | ✅ | 01-15 | | 2 | Fix Frigate location in services.md | ✅ | 01-15 | | 3 | Docker VM docker-compose files | ✅ | 01-15 | | 4 | NAS docker-compose files | ✅ | 01-15 | | 5 | Port 8080 conflict | ✅ | 01-15 | | 6 | NUT configuration | ✅ | 01-15 | | 7 | Monitoring strategy | ✅ | 01-15 | | 8 | VLAN documentation | ✅ | 01-16 | | 9 | Backup test procedure | ✅ | 01-16 | | 10 | Certificate strategy | ✅ | 01-16 | | 11 | Archive domain-research.md | ✅ | 01-16 | | 12 | NAS PSU model | ✅ | 01-16 |

Security Hardening¶

Created comprehensive security documentation and fixed all critical/high priority vulnerabilities.

New Documentation¶

docs/security-hardening.md - Complete security guide covering:
2FA setup for all services (YubiKey, TOTP)
Fail2ban configuration (SSH, Headscale, Vaultwarden)
Firewall rules (UFW for VPS, OPNsense for fixed)
DNS privacy (DoH via Cloudflared)
IP privacy and anti-doxxing measures
Container security best practices
Incident response procedures
docs/sessions/security-fixes-2026-01-16.md - Security audit findings and remediation plan

Security Fixes Applied (21/22)¶

Critical (2/2 Complete)¶

#	Issue	Fix

| 1 | Pi-hole default password changeme | Changed to ${PIHOLE_PASSWORD:?required} (all 3 instances) | | 2 | Frigate placeholder USER:PASS | Changed to {REOLINK_USER}:{REOLINK_PASS} placeholders |

High Priority (8/8 Complete)¶

#	Issue	Fix

Medium Priority (11/12 Complete)¶

#	Issue	Fix

| 11 | CORS wildcard * | Changed to https://cronova.dev | | 12 | Samba credentials in command | Added ${SAMBA_PASSWORD:?required} validation | | 13-14 | Pi-hole default passwords | Fixed in Critical #1 | | 15 | Restic plaintext creds | Changed to $RESTIC_USER:$RESTIC_HTPASSWD | | 16 | No health checks | Added to 7 critical services | | 17 | SOPS age key placeholder | Added setup warning comment | | 18 | NFS security not documented | Added Security Considerations section | | 19 | Credential examples in comments | Replaced with env var placeholders in 10 files | | 21 | Missing cap_drop | Added cap_drop: ALL to 10 services | | 22 | Network topology in public docs | Sanitized IPs and personal info |

Image Version Pins¶

Service	Before	After

Remaining (1 item)¶

#	Issue	Status

| 20 | Containers running as root | Acceptable - many containers require root |

Hardware Added¶

YubiKey 5C NFC (2021) - Hardware 2FA for critical services
Kindle Paperwhite 2018 (2020) - Added to accessories inventory

Infrastructure Improvements (Session 2)¶

Completed all 12 quick win and medium priority items from docs/sessions/improvement-opportunities-2026-01-16.md.

Quick Wins (6/6 Complete)¶

#	Task	Files Modified

Medium Priority (6/6 Complete)¶

#	Task	Files Modified

New Files Created¶

File	Purpose

Watchtower Auto-Update Policy¶

Auto-update enabled (15 containers)¶

Media: Jellyfin, Sonarr, Radarr, Prowlarr, qBittorrent
Networking: Pi-hole (×3), Caddy (×2), DERP
Storage: Syncthing, Samba, Restic REST (×2)
Other: Mosquitto

Manual update required¶

Vaultwarden - Password manager, test first
Headscale - Mesh coordinator, coordinate nodes
Frigate - NVR, breaking changes possible
Home Assistant - Automations, manual testing

Session 2 Commits¶

Hash	Description

Next Steps¶

Documentation: All 24 original improvements + 12 infrastructure improvements complete.

Security: 21/22 fixes complete. Only #20 (root containers) remains - acceptable risk.

Infrastructure: 12/12 quick wins + medium priority items complete.

Remaining lower priority items (#13-19)¶

#	Item	Effort

Deployment priorities:

Deploy Headscale on VPS - First service to enable mesh
Hardware arrival - Wait for RPi 5 PSU to arrive
Deploy mobile kit - Pi-hole on RPi 5 (Headscale now on VPS)
Deploy fixed homelab - Proxmox on Mini PC
Purchase verava.ai - Complete domain strategy

New resources available¶

docs/setup-runbook.md - Full deployment guide
docs/network-topology.md - Network visualization
docker/shared/common.env - Shared environment variables
docker/shared/backup/restic-backup.sh - Backup sidecar script
scripts/backup-verify.sh - Monthly backup verification
ansible/ - Infrastructure automation playbooks

Next Session Plan¶

Priority: Begin Deployment¶

Documentation and infrastructure prep complete. Ready to deploy.

Phase 1: VPS Foundation¶

Deploy Headscale - Mesh coordinator (enables everything else)
SSH to VPS
Create directories, deploy compose file
Configure ACLs
Register first node (MacBook)
Deploy VPS Caddy - Reverse proxy
TLS for vault.cronova.dev, derp.cronova.dev
Static sites (status page)
Deploy VPS Pi-hole - Fallback DNS
Configure upstream (Cloudflare + Quad9)
Basic blocklists
Deploy DERP relay - NAT traversal helper
Configure in Headscale

Phase 2: Fixed Homelab (requires hardware)¶

Proxmox on Mini PC
Docker VM setup
NAS configuration
Service deployment

Optional: Lower Priority Items¶

If time permits, address #13-19 from improvement opportunities:

Prometheus/Grafana monitoring (#15)
DR testing automation (#16)

Prerequisites Check¶

[ ] VPS SSH access working
[ ] Domain DNS configured (cronova.dev → VPS IP)
[ ] .env files prepared with secrets
[ ] Tailscale auth key generated

Reference Documents¶

docs/setup-runbook.md - Step-by-step deployment
docs/services.md - Service matrix
docker/vps/ - VPS compose files

Notes¶

Pre-push hook requires TTY for main branch confirmation
picoPSU from 2013 still functional - consider replacement as future purchase
Mobile kit now on-demand operation (7AM-7PM) - reduces heat/energy concerns
Mesh works 24/7 via VPS even when mobile kit is off
Security audit completed - 22 issues identified, 21 fixed
All containers now have security_opt: no-new-privileges:true
All containers now have cap_drop: ALL (with specific cap_add where needed)
All images pinned to specific versions (no more :latest)
Resource limits added to prevent runaway containers
Health checks added to critical services
Credential examples replaced with env var placeholders
Network topology sanitized in public docs (removed specific IPs, family names)

Session Summary - 2026-01-16¶

Overview¶

Completed Tasks¶

Medium Priority (4 items)¶

Low Priority (2 items)¶

New Documentation¶

VLAN Design (docs/vlan-design.md)¶

Backup Test Procedure (docs/backup-test-procedure.md)¶

Certificate Strategy (docs/certificate-strategy.md)¶

Home Devices (docs/home-devices.md)¶

Architecture Change: Headscale to VPS¶

Files Updated¶

Files Created¶

2.5G Switch Clarification¶

Other Updates¶

Commits¶

Network Diagram Update¶

New Improvement Plan (2026-01-16)¶

Phase 1: Critical (7/7 Complete)¶

Phase 2: High (5/5 Complete)¶

Phase 3: Medium (12/12 Complete)¶

Improvements Summary (2026-01-15 to 2026-01-16)¶

Security Hardening¶

New Documentation¶

Security Fixes Applied (21/22)¶

Critical (2/2 Complete)¶

High Priority (8/8 Complete)¶

Medium Priority (11/12 Complete)¶

Image Version Pins¶

Remaining (1 item)¶

Hardware Added¶

Infrastructure Improvements (Session 2)¶

Quick Wins (6/6 Complete)¶

Medium Priority (6/6 Complete)¶

New Files Created¶

Watchtower Auto-Update Policy¶

Auto-update enabled (15 containers)¶

Manual update required¶

Session 2 Commits¶

Next Steps¶

Remaining lower priority items (#13-19)¶

New resources available¶

Next Session Plan¶

Priority: Begin Deployment¶

Phase 1: VPS Foundation¶

Phase 2: Fixed Homelab (requires hardware)¶

Optional: Lower Priority Items¶

Prerequisites Check¶

Reference Documents¶

Notes¶

VLAN Design (`docs/vlan-design.md`)¶

Backup Test Procedure (`docs/backup-test-procedure.md`)¶

Certificate Strategy (`docs/certificate-strategy.md`)¶

Home Devices (`docs/home-devices.md`)¶