# Infrastructure TODO List

**Created:** 2025-12-29
**Last Updated:** 2025-12-29
**Status:** Active development tasks

This document tracks all incomplete infrastructure tasks and future improvements.

---

## ✅ Completed Items

### 1. Fix Home Assistant Public Domain Access

**Status**: ✅ COMPLETED (2025-12-29)

**What was done**:
1. Updated Caddy to use HTTPS backend for Home Assistant
2. Added VPS WireGuard IP (10.0.8.1) to Home Assistant's trusted_proxies
3. Verified bob.nianticbooks.com is accessible

**Result**: All 5 public domains now working:
- ✅ freddesk.nianticbooks.com → Proxmox
- ✅ bob.nianticbooks.com → Home Assistant
- ✅ ad5m.nianticbooks.com → 3D Printer
- ✅ auth.nianticbooks.com → Authentik SSO
- ✅ bible.nianticbooks.com → Bible reading plan

### 2. Deploy RustDesk ID Server

**Status**: ✅ COMPLETED (2025-12-25)

**What was deployed**:
1. ID Server (hbbs) on main-pve LXC 123 at 10.0.10.23
2. Relay Server (hbbr) on VPS at 66.63.182.168:21117
3. Generated encryption key pair
4. Verified client connectivity

**Result**: RustDesk fully operational
- ✅ ID Server (hbbs): 10.0.10.23 ports 21115, 21116, 21118
- ✅ Relay Server (hbbr): VPS port 21117
- ✅ Public Key: `sfYuCTMHxrA22kukomb/RAKYyUgr8iaMfm/U4CFLfL0=`
- ✅ Client Configuration: ID Server `66.63.182.168`, Key included
- ✅ Version: 1.1.14 (both servers)

**Documentation**:
- SERVICES.md - Service inventory and health checks
- guides/RUSTDESK-DEPLOYMENT-COMPLETE.md - Complete deployment guide

---

## Medium Priority

### 3. Deploy Prometheus + Grafana Monitoring

**Status**: ✅ DISCOVERED - Already deployed (2025-12-29)

**Current State**:
- **Location**: 10.0.10.25 (responding to ping)
- **Grafana**: Port 3000 ✅ Running (redirects to /login)
- **Prometheus**: Port 9090 ✅ Running
- **Deployment Method**: TBD (need to investigate)

**Remaining Configuration Tasks**:
1. Document deployment method (Docker Compose, systemd, VM/Container type)
2. Configure PostgreSQL database on 10.0.10.20 for Grafana (if not already done)
3. Set up Authentik SSO for Grafana
4. Configure Prometheus monitoring targets:
   - Proxmox nodes (via node_exporter)
   - VPS (WireGuard tunnel metrics)
   - PostgreSQL
   - Home Assistant
   - Other services
5. Import Grafana dashboards:
   - Proxmox overview
   - PostgreSQL metrics
   - Network metrics
6. Set up alerting (email/Slack)
7. Optionally add Caddy public route

**Priority**: Low-Medium (services running, configuration needed)

**Note**: This was discovered during the infrastructure audit. The basic services are operational, but monitoring targets and dashboards need configuration.

---

## Low Priority (Cleanup)

### 4. Remove Deprecated VMs

**Objective**: Reclaim resources from unused services

**Status**: ⏸️ Deferred - Non-critical

#### 4.1 Remove Spoolman VM

**Current State**:
- IP: 10.0.10.71 (allocated but not in use)
- Reason: Bambu printer incompatible, service no longer needed

**Steps**:
1. Verify no dependencies: `pct/qm status <VMID>`
2. Backup if needed: `vzdump <VMID> --storage backup`
3. Stop VM/container: `pct stop <VMID>` or `qm stop <VMID>`
4. Delete: `pct destroy <VMID>` or `qm destroy <VMID>`
5. Remove Pangolin route (if exists)
6. Update IP-ALLOCATION.md to mark 10.0.10.71 as available
7. Update documentation

**Priority**: Low

**Estimated Time**: 15 minutes

#### 4.2 Remove Authelia VM

**Current State**:
- IP: 10.0.10.112 (allocated but not in use)
- Reason: Replaced by Authentik SSO

**Steps**:
1. Verify Authentik is working for all services
2. Backup Authelia config for reference (if needed)
3. Stop VM/container: `pct stop <VMID>` or `qm stop <VMID>`
4. Delete: `pct destroy <VMID>` or `qm destroy <VMID>`
5. Update IP-ALLOCATION.md to mark 10.0.10.112 as available (or remove from list)
6. Update documentation

**Priority**: Low

**Estimated Time**: 15 minutes

---

## Future Enhancements

### 5. n8n + Claude Code Advanced Features

**Objective**: Enhance n8n and Claude Code integration

**Status**: ✅ Basic integration working, advanced features optional

**Remaining Optional Tasks** (from MIGRATION-CHECKLIST.md 6.4):
- [ ] Session management workflow (UUID generation, multi-turn conversations)
- [ ] Slack integration (Slack → n8n → Claude Code → Slack)
- [ ] Tool deployment with `--dangerously-skip-permissions` flag
- [ ] Error handling (network disconnect, invalid commands)
- [ ] Resource monitoring during heavy Claude operations
- [ ] Production hardening:
  - SSH timeout configuration
  - Output length limits
  - Logging for Claude executions
  - Error notifications
  - Optional Caddy route for public n8n access (with Authentik SSO)

**Reference**:
- MIGRATION-CHECKLIST.md section 6.4
- N8N-CLAUDE-STATUS.md

**Priority**: Low (nice-to-have, basic functionality working)

**Estimated Time**: 2-4 hours for each feature

---

### 6. Home Assistant Enhancements

#### 6.1 Configure Local HTTPS Certificates

**Objective**: Use local CA certificates for internal HTTPS access

**Status**: ⏸️ Deferred (CA setup complete, deployment pending)

**Details**:
- CA already set up (HTTPS-SETUP-STATUS.md from 2025-12-06)
- Certificates generated for services
- Need to deploy certificates to Home Assistant and other services

**Steps** (from HTTPS-SETUP-STATUS.md):
1. Copy certificates to Home Assistant:
   ```bash
   scp ~/certs/bob.crt ~/certs/bob.key root@10.0.10.24:/config/ssl/
   ```
2. Update Home Assistant configuration:
   ```yaml
   http:
     ssl_certificate: /config/ssl/bob.crt
     ssl_key: /config/ssl/bob.key
     server_port: 8123
   ```
3. Restart Home Assistant
4. Trust CA on client devices

**Note**: Current setup uses local CA certificate. Public domain uses Caddy with Let's Encrypt.

**Priority**: Low (HTTPS already working with local CA cert)

**Estimated Time**: 30 minutes

#### 6.2 Integrate More Services with Authentik SSO

**Objective**: Single sign-on for additional services

**Status**: 📋 Planned

**Completed**:
- ✅ Proxmox (all 3 hosts)
- ✅ Grafana (OAuth2 configured)

**Not Possible**:
- ❌ n8n (requires Enterprise license for OIDC/SSO)

**Pending**:
- [ ] Home Assistant (complex - requires proxy provider or LDAP)
- [ ] Other services as they're deployed

**Priority**: Low (manual login acceptable for now)

**Estimated Time**: 1-2 hours per service

---

### 7. Backup Strategy Completion

**Objective**: Implement full 3-tier backup system

**Status**: ✅ Tier 1 complete, Tier 2-3 planned

**Current State** (from CLAUDE.md):
- ✅ Tier 1 (Local/OMV NFS): Fully operational
  - PostgreSQL backups: Daily 2:00 AM
  - Proxmox VM/container backups: Daily 2:30 AM
  - Retention: 7 days daily, 4 weeks weekly, 3 months monthly

**Remaining Tiers**:
- [ ] Tier 2: Off-site external drives (manual rotation)
- [ ] Tier 3: Backblaze B2 cloud storage (automated)

**Reference**:
- guides/HOMELAB-BACKUP-STRATEGY.md
- guides/BACKUP-QUICK-START.md

**Priority**: Medium (Tier 1 provides good protection, Tier 2-3 for disaster recovery)

**Estimated Time**: 2-4 hours for Tier 3 cloud setup

---

### 8. Monitoring & Alerting

**Objective**: Proactive monitoring of infrastructure health

**Status**: 📋 Planned (prerequisite: Prometheus + Grafana deployment)

**Components**:
- [ ] Service uptime monitoring
- [ ] Resource utilization (CPU, RAM, disk)
- [ ] Network connectivity (WireGuard tunnel status)
- [ ] Backup success/failure alerts
- [ ] Certificate expiration warnings
- [ ] Disk space alerts (OMV storage)

**Alerting Methods**:
- Email
- Slack/Discord webhook
- Home Assistant notifications

**Priority**: Medium (blocked by Prometheus deployment)

**Estimated Time**: 2-3 hours (after Prometheus is deployed)

---

### 9. Cleanup and Archive Old Documentation

**Objective**: Remove or archive outdated status documents

**Status**: 📋 Pending

**Files to Archive or Update**:
1. **wireguard-setup-progress.md**
   - Status: Outdated (from November 2025)
   - Contains old troubleshooting info that's no longer relevant
   - WireGuard now operational (verified 2025-12-29)
   - Action: Archive to `docs/archive/` or delete

2. **HTTPS-SETUP-STATUS.md**
   - Status: Partially outdated (from December 6, 2025)
   - CA setup complete, but local cert deployment not done
   - Services using Caddy with Let's Encrypt for public access
   - Action: Archive or update with current HTTPS status

3. **N8N-CLAUDE-STATUS.md**
   - Status: Partially outdated
   - Basic integration complete
   - Many "TODO" items that are now optional
   - Action: Archive or consolidate into SERVICES.md

**Priority**: Low

**Estimated Time**: 30 minutes

---

## Documentation Maintenance

### 10. Keep Documentation Updated

**Objective**: Maintain accurate infrastructure documentation

**Regular Tasks**:
- [ ] Update SERVICES.md when services change
- [ ] Update IP-ALLOCATION.md for new devices
- [ ] Update MIGRATION-CHECKLIST.md for completed phases
- [ ] Update INFRASTRUCTURE-TODO.md (this file) as tasks are completed
- [ ] Update CLAUDE.md when architecture changes

**Frequency**: As changes occur

**Priority**: Ongoing

---

## Quick Reference: IP Addresses Still Available

### Reserved but Unused (Available for new services):
- 10.0.10.6-9 (infrastructure expansion)
- 10.0.10.11-12, 10.0.10.14-19 (management)
- 10.0.10.23 (RustDesk - planned)
- 10.0.10.25 (Prometheus/Grafana - planned)
- 10.0.10.26 (production services)
- 10.0.10.28 (was ESPHome - now runs as HA add-on, IP available)
- 10.0.10.31-39 (IoT devices)
- 10.0.10.41-49 (utility services)

### To Be Reclaimed (after cleanup):
- 10.0.10.71 (Spoolman - to be removed)
- 10.0.10.112 (Authelia - to be removed)

---

## Notes

- All critical infrastructure is operational (verified 2025-12-29)
- WireGuard tunnel stable and functional
- Public domains working (except Home Assistant HTTPS backend)
- PostgreSQL shared database serving multiple services
- Authentik SSO integrated with Proxmox cluster
- Automated backups operational (Tier 1 local/NFS)

**Next High-Value Tasks**:
1. ✅ ~~Fix Home Assistant public domain~~ - COMPLETED
2. ✅ ~~Discover/Document Prometheus + Grafana~~ - COMPLETED
3. ✅ ~~Discover/Document RustDesk~~ - COMPLETED
4. Configure Prometheus monitoring targets and Grafana dashboards
5. Cleanup deprecated VMs (Spoolman, Authelia)

---

**Last Updated**: 2025-12-29
**Updated By**: Fred (with Claude Code)
