Homelab Roadmap
Current Priority
Section titled “Current Priority”The current priority is the complete Weather App documentation migration. The documentation site now has semantic presentation rules, readable tables, desktop/mobile visual regression checks, component tests, schema validation, freshness checks and prose policy tests. The next step is to move the remaining Weather App source documentation into structured service pages, runbooks, procedures and ADR-linked records, then simplify the application repository so it keeps a polished project README instead of duplicated long-form reports.
Phases
Section titled “Phases”| Phase | Focus | Evidence |
|---|---|---|
| 0 | Documentation presentation and verification baseline | Worktree hygiene, semantic lists, readable tables, visual regression checks and unit/component/schema tests |
| 1 | Documentation migration and governance | Weather App report migration, service pages, visual diagrams, runbooks, ADR coverage and freshness data |
| 2 | Shared delivery controls | GitLab templates, all-framework Checkov, DAG pipelines, Plumber PBOM, Renovate policy and local CI validation |
| 3 | Application delivery standard | Weather App React Doctor, deterministic tests, signed artifacts and digest promotion |
| 4 | Repository template | Copier template extracted from stable mise/Makefile/SOPS/Plumber and Renovate baselines |
| 5 | Platform substrate and network foundation | ADR-0013, Proxmox vs NixOS/Incus evaluation, OPNsense/VLAN strategy, host hardening and backup network |
| 6 | Trusted admin plane | Authentik, OpenBao, PKI, MFA, break-glass access and backup restoration |
| 7 | Kubernetes workload plane | Distribution ADR, Argo CD App of Apps, Cilium, External Secrets, Kyverno and cert-manager |
| 8 | Workload onboarding | Weather App Argo migration and YourBOX platform integration through Helm contracts |
| 9 | GOAD automation and isolation | Packer, Terraform, Ansible, hostile VLAN boundaries and Wazuh/ELK telemetry |
| 10 | Operations and resilience | Prometheus, Loki, ELK/OpenSearch, DORA, restore drills, rollbacks and incident exercises |
Application Boundaries
Section titled “Application Boundaries”Weather App and YourBOX are independent application repositories. Their source-level roadmaps, tests and feature implementation remain in their own repositories. This roadmap covers the shared delivery contracts and the platform capabilities they consume.
YourBOX joins the platform as a stateful media workload. Its integration contract includes PostgreSQL as the transactional source of truth, Meilisearch for catalog search, object storage for video assets, Authentik OIDC, OpenBao-backed runtime secrets and an ADR-gated cache and messaging layer. The Symfony modernization itself is tracked in the YourBOX repository.
Delivery Ownership
Section titled “Delivery Ownership”Each repository maintains its own detailed implementation roadmap and verification gates. The documentation repository records operational decisions and the program sequence; it does not merge application source code, generic CI templates or platform automation into a single repository.
| Repository | Delivery Responsibility | Current Sequence |
|---|---|---|
portfolio-docs |
Documentation quality, migration, test coverage, publishing decision and operational evidence | Presentation and test baseline, then source migration and publishing ADR |
gitlab-ci-templates |
Versioned GitLab CI contracts, policy checks, Renovate and local validation fixtures | Governance, all-framework Checkov contract, DAG validation and provenance workflows |
weather-app |
React/Node workload, Helm chart, deterministic tests and CI template consumption | Policy baseline, React Doctor, template migration and digest promotion |
homelab-platform |
Platform substrate, OPNsense, trusted services, Kubernetes, GitOps and operations | Repository baseline, substrate ADR, network foundation, admin plane, Kubernetes decision and bootstrap |
GOAD |
Controlled AD-lab automation, isolation and detection exercises | Ownership boundary, Packer/Terraform/Ansible overlay, isolation and telemetry |
yourbox |
Stateful media workload platform integration after application contracts are available | Identity, data services, Argo onboarding and operational evidence |
Open Decisions
Section titled “Open Decisions”- Decide how much historical Flux and Minikube evidence remains in the Weather App repository after the stable operational content is migrated into this documentation site.
- Decide the homelab substrate through ADR-0013 by comparing Proxmox with a NixOS plus Incus platform. Until this ADR is accepted, Proxmox-specific docs remain current-state evidence, not immutable target architecture.
- Select the Kubernetes distribution through an ADR comparing Talos, k3s and RKE2 against the selected substrate resource budget, lifecycle model and operational surface.
- Select Valkey or Redis and the appropriate topology before exposing a shared cache service.
- Select RabbitMQ or Kafka only after a workload trial proves the need for a shared messaging bus.
Delivery Policy
Section titled “Delivery Policy”- Keep application, platform, CI templates and documentation logically separated.
- Use Renovate for controlled dependency and pinned-image updates before extracting a Copier template. Copier distributes a stable structural baseline; it does not replace dependency update automation.
- Run Checkov with all supported frameworks in pre-commit, local verification and CI. Repository configuration scopes source directories and excludes only generated content.
- Keep platform mutation behind Terraform plans, Ansible check mode and diffs, Kubernetes server dry-runs or diffs, Helm rendering or diffs, NixOS rebuild dry-runs, Incus diffs where available and Argo CD application diffs.
- Promote the same signed image digest across environments. SemVer tags remain readable release references but are not deployment authority.