diff --git a/2026-TODO-LIST.md b/2026-TODO-LIST.md deleted file mode 100644 index a949cf5..0000000 --- a/2026-TODO-LIST.md +++ /dev/null @@ -1,316 +0,0 @@ -Git, Gitea, Bind9, Postgres, Nginx and other python app and html web servers running in KVM for initial control. Here's my re-prioritized and optimized version of my in-progress list. I re-ordered it from foundational → infrastructure → security/monitoring → services (the way most stable labs are built). Suggested better or more modern alternatives where they make sense for a typical lab/self-hosted environment in 2026. - -**Phase 1: Base & Networking (Must be first)** - -1. OPNsense (or OpenWRT on edge devices) - → Best open-source firewall/router today. Great UI, Zenarmor, WireGuard, etc. - -2. KVM/QEMU + Open vSwitch (or Proxmox VE as a full stack) - → Proxmox is usually the smarter choice for most people unless you specifically want to stay ultra-minimal. - -3. WireGuard + Netbird (or Tailscale/Headscale) - → Modern zero-trust mesh VPN. Netbird is excellent. - -4. Technitium DNS (or AdGuard Home + Unbound) - → Very solid self-hosted DNS + DHCP + blocking. - -5. piKVM (or alternatives like TinyPilot) - → Great for remote management of bare-metal machines. - - -**Phase 2: Identity, Storage & Orchestration** - -6. FreeIPA (or Keycloak + Authelia/Zitadel for OIDC) - → FreeIPA is heavy but powerful if you want full LDAP/Kerberos. Many people now prefer lighter OIDC stacks. - -7. TrueNAS Scale (or plain ZFS + Samba/NFS on Debian) - → Best file server experience. NFS + ZFS snapshots + replication. - -8. Ansible + Terraform (IaC) - → Keep this early — it will make everything else reproducible. - -9. Podman + Buildah + Skopeo (rootless) + Quadlet - → Better than Docker for security. Skip full Kubernetes unless you really need it. - -10. Incus (or LXC/LXD) + Proxmox - → Incus is the spiritual successor to LXD and very nice for lightweight containers/Vms. - - -**Phase 3: Core Services & Monitoring** - -11. Caddy (or Traefik / Nginx Proxy Manager) - → Caddy is fantastic with automatic HTTPS. - -12. PostgreSQL (primary DB) - -13. Nginx / Unit (as application server where needed) - -14. Cert-Manager (or use Caddy’s built-in ACME) - -15. Prometheus + Grafana + Loki (or Netdata + Uptime Kuma) - → Graphical metrics. Loki + Grafana is a strong combo. - -16. Graylog or VictoriaLogs + Netdata (or Zabbix/OBS) - → Logging stack. - -17. ntopng (traffic monitoring) - -18. Suricata (or CrowdSec + Fail2Ban) - → IDS/IPS. CrowdSec is much easier for homelabs. - - -**Phase 4: Applications & Self-Hosted Services** - -19. Nextcloud (or ownCloud Infinite Scale) - -20. Immich (photos) — excellent choice - -21. Jellyfin + Navidrome (music) - -22. Home Assistant - -23. Matrix (Synapse or Dendrite) + Element - -24. PeerTube - -25. Discourse (forum) - -26. Etherpad or Hedgedoc - -27. Wiki.js (or Bookstack / DokuWiki) - -28. Invoice Ninja - -29. qBittorrent (or Jellyseerr + \*arr stack if you go that route) - -30. Odoo (or Dolibarr / ERPNext) — lighter alternatives exist - - -**Phase 5: Nice-to-Haves / Advanced** - -- XMPP (e.g. Prosody + Snikket) — low priority unless you have specific need - -- Sphinx documentation - -- Pasetbin (or Pastefy, PrivateBin) - -- Webmin — mostly replaced by Cockpit / Portainer / custom Ansible - -- VyOS — good for advanced routing but OPNsense usually suffices - -- OpenBSD — great for specific hardened services - -- Jenkins — consider Woodpecker CI, Forgejo Actions, or Gitea/Forgejo + Drone instead (lighter) - -- Spiffe/Spire — overkill for most homelabs - -- DOCSIS 4 — very niche - -- oVirt — mostly replaced by Proxmox - -- AWS Quickstart / AsciiDoc — not relevant unless you're doing cloud migration docs - -- Automatic upgrades (use unattended-upgrades + Ansible) - - -**Quick Wins / Modern Stack Suggestion (2026)** - -- Hypervisor: Proxmox VE - -- Firewall: OPNsense - -- Containers: Podman + Quadlet (or Incus) - -- Reverse Proxy: Caddy - -- Auth: Keycloak or Zitadel - -- Monitoring: Netdata + Grafana + Loki - -- VPN: Netbird or Headscale - -- DNS: Technitium - - - -This ordering dramatically reduces pain. Build the foundation (networking + storage + IaC) first — everything else becomes much easier and more reliable.Would you like me to: - - ------------------ - -Here’s a realistic phased installation plan based on your list, reordered for stability, security, and dependency flow. - - -**Phase 1: Foundation (Week 1 – Get the base rock-solid)** - - - -1. OPNsense (primary firewall/router) - -2. WireGuard + Netbird (mesh VPN) - -3. Technitium DNS - -4. KVM/QEMU + Open vSwitch → Strongly consider Proxmox VE instead (much easier management) - -5. piKVM (for bare metal remote access) - -6. Ansible + Terraform (start writing playbooks early) - - -Goal: Reliable networking, remote access, and automation foundation. - - -**Phase 2: Storage & Virtualization (Week 1–2)** - -7. TrueNAS Scale (or ZFS on Linux) – NFS + Samba shares - -8. Incus (lightweight containers/VMs) or continue with Proxmox - -9. Podman + Buildah + Skopeo (rootless container runtime) - - -Goal: Secure storage with snapshots + solid container/VM layer. - - -**Phase 3: Identity, Security & Monitoring (Week 2–3)** - -10. Keycloak (or FreeIPA if you need full LDAP) + OIDC - -11. Caddy (reverse proxy + automatic HTTPS) - -12. Cert-Manager (if not using Caddy) - -13. Prometheus + Grafana + Loki (metrics + logs) - -14. Suricata + CrowdSec (IDS/IPS + modern blocking) - -15. ntopng (network visibility) - - -Goal: Secure access, observability, and threat protection before exposing services. - - -**Phase 4: Core Productivity Services (Week 3–4)** - -16. Nextcloud - -17. Immich (photos) - -18. PostgreSQL (primary database) - -19. Home Assistant - -20. Matrix Chat (Synapse/Dendrite + Element) - -21. Jellyfin + Navidrome - -22. Wiki.js - -23. Discourse (if you want a forum) - - -**Phase 5: Additional Services (Month 2+)** - -24. PeerTube - -25. Invoice Ninja - -26. qBittorrent (+ optional \*arr stack) - -27. Etherpad or Hedgedoc - -28. Odoo (or lighter ERP like Dolibarr) - -29. XMPP (Prosody/Snikket) – only if needed - -30. NGINX / Unit (for specific apps) - -31. Sphinx Documentation / internal docs - - -**Phase 6: Advanced / Specialized (Later)** - -- Jenkins → Replace with Forgejo + Woodpecker CI (lighter) - -- VyOS / OpenBSD (specific hardened routers/services) - -- Spiffe/Spire, oVirt, DOCSIS 4 – only if you have a clear need - -- Pasetbin, Webmin (low priority) - -- Automatic security upgrades (Ansible + unattended-upgrades) - - -**Recommended Modern Lab Stack Summary (2026)** - -- Hypervisor: Proxmox VE - -- Firewall: OPNsense - -- VPN: Netbird - -- Proxy: Caddy - -- Containers: Podman + Incus - -- Monitoring: Netdata/Grafana + Loki - -- Auth: Keycloak - -- Storage: TrueNAS Scale - - ------------------ - -OLD LISt - -Pangolin CADDY -OPNSense / OpenWRT KEA DHCP IPV6 OpenVswitch -FreeIPA/FreeRadius/OIDC IPA Zitadel ID/KeyCloak/Authentik -KVM / Qemu / OpenVSwitch -AnsibleTerraform ANSIBLE -Kubernetes / LXConsole / Incus RANCHER / K3S / K8S / RKE / Portainer.io -XMPP -Podman, Buildah, Skopeo, Nomad DOCKER ALT., Portainer.io -FLECTRA/OODOO ERP -HA NFS / ZFS File Server TrueNAS -netboot.xyz / DistroBox NETBOOT, iPXE (DRBL,Clonezilla) -Jenkins - -Sphinx Documentation -JELLYFIN Navidrome Sonarr Radarr Streamyfin -PEERTUBE PEERTUBE & JITSI -Suricata/SNORT/Graylog GRAYLOG / Uptime Kuma -Graphical Metrics GRAFANA Loki / PROMETHEUS /Alert Mgr. -DOCSIS 4 -NextCloud -Ovirt -Devops CNCF Flux / Renovate Bot -Object Storage MINIO -NGINX / Gunicorn / Django UNIT,containerd, WASM, APACHE -EMAIL EXIM GITEA SERVER EMAILS -PostgreSQL PGADMIN4 -Automatic Upgrades ? Disable Automatic -AWS Quickstart / AsciiDoc -Discourse -EtherPad -HomeAssistant -Matrix Chat -NGINX / UNIT UNIT WASM, APACHE -ntopng -pasetbin -Spiffe Spire BoKS/Keon -Suricata/SNORT/Graylog -VEOS VectorEngine NEC -VyOS and OpenBSD -wiki.js JS WIKI / MediaWIKI -Wireguard Nginx Proxy Manager -CertManager Mesh Central -QbitTorrent Remotely -Invoice Ninja Guacamole Remote access -Webmin Netbird Wireguard VPN -pikvm MediaWiki -Technitum DNS -Netbird VPN, Wireguard -immich photos diff --git a/TODO.txt b/OLD-Todo-List similarity index 100% rename from TODO.txt rename to OLD-Todo-List