Roadmap

From bare metal to hardened lab, in phases.

current

Foundation

  • Active box (NAS 1): OS + Docker
  • Passive boxes NAS 2 / 3 / 4: disks + SSH only
  • Istanbul ⇄ Tallinn mesh up (Pangolin sites)
  • Baseline monitoring probes
next

Edge

  • Pangolin deploy (isolated compose project)
  • Domain + DNS pointing at home IP
  • Router port-forwards: 443/tcp + 51820/udp → edge only
  • DDNS if the IP is dynamic
next

Platform

  • Dokploy up on NAS 1
  • First side project deployed publicly
  • Per-project databases + secrets
next

Photos

  • Immich + PostgreSQL on NAS 1
  • Family phone sync (source of truth until sync completes)
  • Storage layout on the active disks
next

Backup chain

  • Nightly restic jobs → NAS 2 (LAN) + NAS 3 (mesh)
  • NAS 3 → NAS 4 restic copy on brother’s LAN
  • pg_dump included in every snapshot
  • Healthchecks + alerting wired
  • Restore drill #1 (documented RTO)
next

Hardening

  • Quarterly restore drills — a backup never restored is a hope
  • Patching cadence for the public edge
  • Evaluate dedicated edge box (Option B) once spare hardware exists