¶ Overview
This is a list of projects I have queued up along with justifcations and any preliminary research for executing them. Each project should be set up in its own section.
¶ Priority (in work notes to self)
¶ Potential packages
This section holds interesting apps I have discovered along the way to try:
¶ LogSeq Sync Services
The Logseq application appears to have a beta synchronization service that can be self-hosted. I currently use LogSeq as my primary note taking application.
¶ Docker Instances
This is specific to docker machines running in proxmox in the home. The comments do not extend to the internet-hosted host-1 which is also running docker natively on debian.
Work out a way to add certificates to these applications when it is just a simple docker host. This appears to be non-trivial. This is most pronoucned right now on the DNS server which cannot support more secure protocols. Given the closed nature of the network, this is not a major issue for security. But it is a pain as more apps and browsers expect to attach a secure connection to DNS (using protocols like DoH).
One promising approach I wish to take for homelab services that are not running in kubernetes is the hashicorp vault agent project. This is like certbot for local services, but using hashicorp vault as a back-end for certificate issuance. It will write updated certificats to a new local directory drive. I am not sure I need any such solution yet for applications running on the public server (host-1) as they are already sitting behind a traefik instance that does HTTPS termination. But this will remain to be seen.
¶ Keycloak
Work out how to set up passkeys on keycloak. Add other users
I have enabled login via google.
I had Brandon walk through the setup and give feedback. He claimed that he had to do the 2 Factor enrollment twice. Specifically said:
Need a user maintenance page to reconfigure 2 factory auth. Ended up setting up Google authenticator twice
I also noticed that the links sent out via email have scary sources: These are mailjet click links. I can at least set up my own domain for this: (e.g. links.rachelski.net) so it looks like the links may no be phishing.
I should also add an accounts page at https://rachelski.net that sends people to: https://auth.rachelski.net/realms/rachelski-net/account
Ensure that when user logs out of home page, they are sent back to the proper login. Today, they are sent to the caddy default login page.
¶ Jellyfin
Add authentication with Keycloak to Jellyfin
¶ Retire the Synology DDNS service
The NAS still runs a Synology DDNS service that keeps mrachelski.synology.me pointed at the household IP address. Nothing should depend on it any more: UPnP is off on the router and all VaultWarden clients have been reconfigured to use other names.
- Check that no DNS records in the
rachelski.netzone (desec.io) are still CNAME'd tomrachelski.synology.me - Turn off the DDNS service on the NAS
- Update the DDNS sections on the NAS Overview and Rachelski Home Network pages
¶ Dozzle
looks like a very interesting diagnostic tool around logs: FAQ | Dozzle https://share.google/ro6hfDaVDgZ4xiUbS
¶ Proxmox Backup Server
certificate fingerprint: b1:10:22:9f:ec:35:a2:93:54:6e
f3:b7:72:5c:f6:21:62:f0:81:eb:7c:65:e3:3d:69:3c:67:e4:df:cb:3e
¶ Plaintext secrets to rotate
Live secrets are written in plain text in the places below. Anyone who can read the repo (or this wiki) can see them, so this needs fixing before giving another admin access to Gitea or the wiki (see Setting up a new administrator). For each one: rotate the secret, move it out of the file (BitWarden, Vault, or a git-ignored file), and remove it from git history.
Committed to Gitea repos:
| Repo | File | What |
|---|---|---|
traefik |
.env |
traefik dashboard username and password hash |
traefik |
desc_token.txt |
deSEC API token (controls rachelski.net DNS and the wildcard certificate) |
identity |
docker-compose/identity/db_password.txt |
Keycloak's Postgres password |
gitea |
docker-compose.yml |
database password, mail password, SECRET_KEY, INTERNAL_TOKEN |
docker-bounca |
.env |
BounCA admin and mail passwords, Django secret |
net-1 |
caddy/Caddyfile |
Keycloak client secret for caddy-portal |
net-1 |
caddy/ddns-updater/data/config.json |
deSEC tokens |
lynx |
docker-compose.yaml |
database password and APP_SECRET |
k3s |
terraform/provider.tf, bootstrap/network/provider.tf |
Lynx (Terraform state) logins |
identity |
terraform-k8s/provider.tf |
Lynx login |
documentation |
provider.tf |
Lynx login |
Elsewhere:
| Where | What |
|---|---|
vaultwarden repo (local only, not on Gitea), README.md |
Vaultwarden ADMIN_TOKEN |
~/projects/diskstation/kopia/archive/repository.config-1 on my workstation (not a repo) |
Hetzner Storage Box password from an old setup |
vault/data/init.txt and unseal_keys.txt on the NAS (hcl-vault) |
Vault root token and unseal keys. The hcl-vault README already says to move init.txt off the NAS |
| Quick Notes | host-1 CrowdSec firewall-bouncer API key |
| Condo Network Overview, Villa Makalena Network | WiFi password |