Stack analysis: feature gaps and divergence from other homelabs #116

New issue

Open

opened 2026-08-17 15:07:10 -04:00 by mysticalsoap · 1 comment

mysticalsoap commented

2026-08-17 15:07:10 -04:00

Owner

Analyze the stack via the repo and wiki and point out feature gaps and general improvements, especially things missing or different compared to other homelabbers. Plenty of additions are already planned; the interesting output is specifically where this stack diverges.

mysticalsoap added the

general-admin

label

2026-08-17 15:07:10 -04:00

mysticalsoap referenced this issue

2026-08-17 17:49:57 -04:00

Wiki pass under the new comment/doc style rules #94

mysticalsoap commented

2026-08-17 17:50:17 -04:00

Author

Owner

Analysis done (repo + _helper/docs + open issues). Confirmed gaps filed as issues, each with the reasoning inside:

#121 — brute-force detection doesn't follow the ForwardAuth trades to Vaultwarden/Navidrome (the one real security follow-through the bypass model still owes)
#122 — Vaultwarden OIDC SSO exists upstream now; the exclusion reasoning predates it
#123 — no UPS (2026-08-10 outage was the rehearsal)
#124 — btrfs scrub misses the root fs and /mnt/support
#125 — offsite RPO is the USB swap cadence; VPS append-only restic copy fixes it
#126 — unhealthy containers alert nothing (Monitoring.md already says so)
#127 — no CAA record

Refinements commented on #94 (five concrete doc-drift items), #109 (VPN hub belongs on the VPS, not a home port), #101 (frps transport.tls.force + non-root unit).

Divergences that are deliberate and hold up (no action): frp+VPS instead of Cloudflare Tunnel, Renovate+digest pins instead of Watchtower, route-allowlisted socket proxies instead of raw docker.sock mounts, offline offsite instead of cloud, single host instead of Proxmox/VM sprawl (Podman migration is the tracked answer to its isolation half). Full writeup in the session log.

Analysis done (repo + `_helper/docs` + open issues). Confirmed gaps filed as issues, each with the reasoning inside: - #121 — brute-force detection doesn't follow the ForwardAuth trades to Vaultwarden/Navidrome (the one real security follow-through the bypass model still owes) - #122 — Vaultwarden OIDC SSO exists upstream now; the exclusion reasoning predates it - #123 — no UPS (2026-08-10 outage was the rehearsal) - #124 — btrfs scrub misses the root fs and /mnt/support - #125 — offsite RPO is the USB swap cadence; VPS append-only restic copy fixes it - #126 — unhealthy containers alert nothing (Monitoring.md already says so) - #127 — no CAA record Refinements commented on #94 (five concrete doc-drift items), #109 (VPN hub belongs on the VPS, not a home port), #101 (frps `transport.tls.force` + non-root unit). Divergences that are deliberate and hold up (no action): frp+VPS instead of Cloudflare Tunnel, Renovate+digest pins instead of Watchtower, route-allowlisted socket proxies instead of raw docker.sock mounts, offline offsite instead of cloud, single host instead of Proxmox/VM sprawl (Podman migration is the tracked answer to its isolation half). Full writeup in the session log.

mysticalsoap referenced this issue

2026-08-21 13:15:43 -04:00

No egress shaping: a saturated uplink collapses downstream throughput #156