mirror of
https://github.com/IntenseWebs/personal.git
synced 2026-08-26 13:17:26 -05:00
2026-TODO-LIST.md
This commit is contained in:
IntenseWebs
@@ -0,0 +1,261 @@
|
||||
Git, Gitea, Bind9, Postgres and other python and html web servers running in KVM for initial control. Here's my re-prioritized and optimized version of my list.I re-ordered it from foundational → infrastructure → security/monitoring → services (the way most stable homelabs are built). Suggested better or more modern alternatives where they make sense for a typical homelab/self-hosted environment in 2026.
|
||||
|
||||
**Phase 1: Base & Networking (Must be first)**
|
||||
|
||||
1. OPNsense (or OpenWRT on edge devices)
|
||||
→ Best open-source firewall/router today. Great UI, Zenarmor, WireGuard, etc.
|
||||
|
||||
2. KVM/QEMU + Open vSwitch (or Proxmox VE as a full stack)
|
||||
→ Proxmox is usually the smarter choice for most people unless you specifically want to stay ultra-minimal.
|
||||
|
||||
3. WireGuard + Netbird (or Tailscale/Headscale)
|
||||
→ Modern zero-trust mesh VPN. Netbird is excellent.
|
||||
|
||||
4. Technitium DNS (or AdGuard Home + Unbound)
|
||||
→ Very solid self-hosted DNS + DHCP + blocking.
|
||||
|
||||
5. piKVM (or alternatives like TinyPilot)
|
||||
→ Great for remote management of bare-metal machines.
|
||||
|
||||
|
||||
**Phase 2: Identity, Storage & Orchestration**
|
||||
|
||||
6. FreeIPA (or Keycloak + Authelia/Zitadel for OIDC)
|
||||
→ FreeIPA is heavy but powerful if you want full LDAP/Kerberos. Many people now prefer lighter OIDC stacks.
|
||||
|
||||
7. TrueNAS Scale (or plain ZFS + Samba/NFS on Debian)
|
||||
→ Best file server experience. NFS + ZFS snapshots + replication.
|
||||
|
||||
8. Ansible + Terraform (IaC)
|
||||
→ Keep this early — it will make everything else reproducible.
|
||||
|
||||
9. Podman + Buildah + Skopeo (rootless) + Quadlet
|
||||
→ Better than Docker for security. Skip full Kubernetes unless you really need it.
|
||||
|
||||
10. Incus (or LXC/LXD) + Proxmox
|
||||
→ Incus is the spiritual successor to LXD and very nice for lightweight containers/Vms.
|
||||
|
||||
|
||||
**Phase 3: Core Services & Monitoring**
|
||||
|
||||
11. Caddy (or Traefik / Nginx Proxy Manager)
|
||||
→ Caddy is fantastic with automatic HTTPS.
|
||||
|
||||
12. PostgreSQL (primary DB)
|
||||
|
||||
13. Nginx / Unit (as application server where needed)
|
||||
|
||||
14. Cert-Manager (or use Caddy’s built-in ACME)
|
||||
|
||||
15. Prometheus + Grafana + Loki (or Netdata + Uptime Kuma)
|
||||
→ Graphical metrics. Loki + Grafana is a strong combo.
|
||||
|
||||
16. Graylog or VictoriaLogs + Netdata (or Zabbix/OBS)
|
||||
→ Logging stack.
|
||||
|
||||
17. ntopng (traffic monitoring)
|
||||
|
||||
18. Suricata (or CrowdSec + Fail2Ban)
|
||||
→ IDS/IPS. CrowdSec is much easier for homelabs.
|
||||
|
||||
|
||||
**Phase 4: Applications & Self-Hosted Services**
|
||||
|
||||
19. Nextcloud (or ownCloud Infinite Scale)
|
||||
|
||||
20. Immich (photos) — excellent choice
|
||||
|
||||
21. Jellyfin + Navidrome (music)
|
||||
|
||||
22. Home Assistant
|
||||
|
||||
23. Matrix (Synapse or Dendrite) + Element
|
||||
|
||||
24. PeerTube
|
||||
|
||||
25. Discourse (forum)
|
||||
|
||||
26. Etherpad or Hedgedoc
|
||||
|
||||
27. Wiki.js (or Bookstack / DokuWiki)
|
||||
|
||||
28. Invoice Ninja
|
||||
|
||||
29. qBittorrent (or Jellyseerr + \*arr stack if you go that route)
|
||||
|
||||
30. Odoo (or Dolibarr / ERPNext) — lighter alternatives exist
|
||||
|
||||
|
||||
**Phase 5: Nice-to-Haves / Advanced**
|
||||
|
||||
- XMPP (e.g. Prosody + Snikket) — low priority unless you have specific need
|
||||
|
||||
- Sphinx documentation
|
||||
|
||||
- Pasetbin (or Pastefy, PrivateBin)
|
||||
|
||||
- Webmin — mostly replaced by Cockpit / Portainer / custom Ansible
|
||||
|
||||
- VyOS — good for advanced routing but OPNsense usually suffices
|
||||
|
||||
- OpenBSD — great for specific hardened services
|
||||
|
||||
- Jenkins — consider Woodpecker CI, Forgejo Actions, or Gitea/Forgejo + Drone instead (lighter)
|
||||
|
||||
- Spiffe/Spire — overkill for most homelabs
|
||||
|
||||
- DOCSIS 4 — very niche
|
||||
|
||||
- oVirt — mostly replaced by Proxmox
|
||||
|
||||
- AWS Quickstart / AsciiDoc — not relevant unless you're doing cloud migration docs
|
||||
|
||||
- Automatic upgrades (use unattended-upgrades + Ansible)
|
||||
|
||||
|
||||
**Quick Wins / Modern Stack Suggestion (2026)**
|
||||
|
||||
- Hypervisor: Proxmox VE
|
||||
|
||||
- Firewall: OPNsense
|
||||
|
||||
- Containers: Podman + Quadlet (or Incus)
|
||||
|
||||
- Reverse Proxy: Caddy
|
||||
|
||||
- Auth: Keycloak or Zitadel
|
||||
|
||||
- Monitoring: Netdata + Grafana + Loki
|
||||
|
||||
- VPN: Netbird or Headscale
|
||||
|
||||
- DNS: Technitium
|
||||
|
||||
|
||||
|
||||
This ordering dramatically reduces pain. Build the foundation (networking + storage + IaC) first — everything else becomes much easier and more reliable.Would you like me to:
|
||||
|
||||
|
||||
-----------------
|
||||
|
||||
Here’s a realistic phased installation plan based on your list, reordered for stability, security, and dependency flow.
|
||||
|
||||
|
||||
**Phase 1: Foundation (Week 1 – Get the base rock-solid)**
|
||||
|
||||
|
||||
|
||||
1. OPNsense (primary firewall/router)
|
||||
|
||||
2. WireGuard + Netbird (mesh VPN)
|
||||
|
||||
3. Technitium DNS
|
||||
|
||||
4. KVM/QEMU + Open vSwitch → Strongly consider Proxmox VE instead (much easier management)
|
||||
|
||||
5. piKVM (for bare metal remote access)
|
||||
|
||||
6. Ansible + Terraform (start writing playbooks early)
|
||||
|
||||
|
||||
Goal: Reliable networking, remote access, and automation foundation.
|
||||
|
||||
|
||||
**Phase 2: Storage & Virtualization (Week 1–2)**
|
||||
|
||||
7. TrueNAS Scale (or ZFS on Linux) – NFS + Samba shares
|
||||
|
||||
8. Incus (lightweight containers/VMs) or continue with Proxmox
|
||||
|
||||
9. Podman + Buildah + Skopeo (rootless container runtime)
|
||||
|
||||
|
||||
Goal: Secure storage with snapshots + solid container/VM layer.
|
||||
|
||||
|
||||
**Phase 3: Identity, Security & Monitoring (Week 2–3)**
|
||||
|
||||
10. Keycloak (or FreeIPA if you need full LDAP) + OIDC
|
||||
|
||||
11. Caddy (reverse proxy + automatic HTTPS)
|
||||
|
||||
12. Cert-Manager (if not using Caddy)
|
||||
|
||||
13. Prometheus + Grafana + Loki (metrics + logs)
|
||||
|
||||
14. Suricata + CrowdSec (IDS/IPS + modern blocking)
|
||||
|
||||
15. ntopng (network visibility)
|
||||
|
||||
|
||||
Goal: Secure access, observability, and threat protection before exposing services.
|
||||
|
||||
|
||||
**Phase 4: Core Productivity Services (Week 3–4)**
|
||||
|
||||
16. Nextcloud
|
||||
|
||||
17. Immich (photos)
|
||||
|
||||
18. PostgreSQL (primary database)
|
||||
|
||||
19. Home Assistant
|
||||
|
||||
20. Matrix Chat (Synapse/Dendrite + Element)
|
||||
|
||||
21. Jellyfin + Navidrome
|
||||
|
||||
22. Wiki.js
|
||||
|
||||
23. Discourse (if you want a forum)
|
||||
|
||||
|
||||
**Phase 5: Additional Services (Month 2+)**
|
||||
|
||||
24. PeerTube
|
||||
|
||||
25. Invoice Ninja
|
||||
|
||||
26. qBittorrent (+ optional \*arr stack)
|
||||
|
||||
27. Etherpad or Hedgedoc
|
||||
|
||||
28. Odoo (or lighter ERP like Dolibarr)
|
||||
|
||||
29. XMPP (Prosody/Snikket) – only if needed
|
||||
|
||||
30. NGINX / Unit (for specific apps)
|
||||
|
||||
31. Sphinx Documentation / internal docs
|
||||
|
||||
|
||||
**Phase 6: Advanced / Specialized (Later)**
|
||||
|
||||
- Jenkins → Replace with Forgejo + Woodpecker CI (lighter)
|
||||
|
||||
- VyOS / OpenBSD (specific hardened routers/services)
|
||||
|
||||
- Spiffe/Spire, oVirt, DOCSIS 4 – only if you have a clear need
|
||||
|
||||
- Pasetbin, Webmin (low priority)
|
||||
|
||||
- Automatic security upgrades (Ansible + unattended-upgrades)
|
||||
|
||||
|
||||
**Recommended Modern Lab Stack Summary (2026)**
|
||||
|
||||
- Hypervisor: Proxmox VE
|
||||
|
||||
- Firewall: OPNsense
|
||||
|
||||
- VPN: Netbird
|
||||
|
||||
- Proxy: Caddy
|
||||
|
||||
- Containers: Podman + Incus
|
||||
|
||||
- Monitoring: Netdata/Grafana + Loki
|
||||
|
||||
- Auth: Keycloak
|
||||
|
||||
- Storage: TrueNAS Scale
|
||||
Reference in New Issue
Block a user