jarvis
fea42f892b
All services reassigned to MK7 (Swarm Manager) or swarm-distributed. Per Bobby: Mark5, Bones, Neo, Mark44 are NOT part of this homelab services stack. Phase 1 infra (Traefik, DNS, AdGuard, Portainer, Prometheus, Beszel, Dozzle, Authelia, Homepage) → MK7 Phase 2 media (Jellyfin, Sonarr, Radarr, Prowlarr) → Swarm distributed Phase 3 dashboards (Grafana, Homepage) → Swarm distributed Also updates: - Backup target: MK7 secondary storage (was Bones) - Network/DNS/Security model: all refs to Bones/Neo/Mark5/Mark44 corrected
2.4 KiB
2.4 KiB
Iron Legion Homelab Services Stack — Open Questions & Blockers
Blocker Status
| # | Question | Impact | Default if Unresolved |
|---|---|---|---|
| 1 | Domain name — Does Bobby own a domain (e.g., bobbysh.me) or do we use a fake TLD (labs.internal)? |
Critical — TLS certs, Authelia, and DNS all depend on this. | Use labs.internal + self-signed CA |
| 2 | Technitium upstream — DoH, DoT, or plain UDP to upstream resolver (e.g., Cloudflare 1.1.1.1)? | Low — can default to DoH | DoH → https://cloudflare-dns.com/dns-query |
| 3 | Pi-hole vs Technitium conflict — Both run on MK7 port 53. Run Pi-hole on non-standard port with Technitium as conditional forwarder? Or separate nodes? | Critical — port 53 collision | Technitium on 53, Pi-hole on 5053, forward to Pi-hole from Technitium |
| 4 | Jellyfin media storage — External USB on MK7? SMB share? NVMe? | Medium | External USB mounted at /media on MK7 |
| 5 | Backup target on MK7 — Capacity? Dedicated drive? Rsync target path? | Medium | /backups/<service-name>/ on MK7 secondary storage |
| 6 | Nextcloud database — Use existing PostgreSQL on MK7, or deploy Nextcloud AIO (bundled)? | Medium — affects resource allocation on MK7 | Deploy standalone PostgreSQL container on MK7 for Nextcloud AIO is too heavy |
| 7 | GPU on MK7 — NVIDIA driver runtime for Jellyfin transcode? | Low — falls back to CPU transcode | Use jellyfin/jellyfin with NVIDIA_VISIBLE_DEVICES env if available |
| 8 | Notification routing — Discord webhook? SMTP? File only? | Low — default file works | File notifications in /opt/iron-legion/authelia/notifications/ |
| 9 | Tailscale ACL policy — Draft exists in Section 7. Bobby must review and apply in Tailscale admin console. | Low | Stay permissive until Bobby approves |
| 10 | Beszel alert thresholds — CPU %, memory %, disk % triggers not defined. | Low | Defaults in Beszel container |
Outstanding Decisions Required
- Pi-hole inclusion — Not in Bobby's original list. I added it as a DNS-layer complement to Technitium. Remove if Bobby doesn't want it.
- Authelia two-factor method — TOTP via app (Google Authenticator) vs WebAuthn/FIDO2 keys?
- Home vs remote access — If Bobby wants to share Jellyfin with friends/family outside Tailscale, public domain + Authelia guard is required.