From f44c156d7faab07f5fc82197ade7c2cd28918698 Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 19 Aug 2026 23:19:05 +0000 Subject: [PATCH] docs: close out the roadmap items this run finished MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Grafana behind TLS is done and moves to Done, with the detail that matters — Prometheus verifies it with ca_file and server_name rather than insecure_skip_verify. Three completions that were never roadmap items but belong in the record: Alertmanager now points at a real receiver, where the ntfy.example.invalid placeholder had meant no alert was ever delivered; four dashboards now show their own component's firing alerts, where forty rules previously existed with nothing surfacing them; and the UPS dashboard no longer reports a battery the rack does not have. Corrects a Done entry that has gone stale: the SNMP rotation says three of four devices. All four are rotated. The switch also still holds its previous community, which is an accepted residual rather than an omission, and saying "three of four" hides both halves of that. The ifXTable item gains the two things a future attempt needs. It is newly actionable — the switch has only polled at all since the three stacked faults in #22 were cleared — and it has a trap: this firmware returns ifSpecific with a zero-length value that makes snmp-exporter discard the entire response, so the walk enumerates columns and must stay clear of column 22. Nothing here changes what runs. --- docs/roadmap.md | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 1f361be..b8a7ba3 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -16,9 +16,6 @@ inventory. Ordered roughly by how much it matters. - [ ] Move to SNMPv3 authPriv where the hardware supports it. pfSense, the APC and iLO all do; the MokerLink switch does not, which is the blocker for doing it uniformly. -- [ ] Put Grafana behind TLS rather than plain HTTP on the management VLAN. - The CA and a `grafana.matrix.elysium` leaf already exist — see - [runbook](runbooks/generate-certificates.md) — so this is wiring, not PKI. - [ ] Decide whether the lab VLAN needs egress filtering before the deliberately-vulnerable playground exists. @@ -28,6 +25,12 @@ inventory. Ordered roughly by how much it matters. current `ifTable` counters are 32-bit and wrap in roughly 34 seconds at gigabit line rate, so sustained high-throughput ports under-report. The `SwitchCounterWrapSuspected` alert detects this but does not fix it. + Now actionable — the switch has only been polling since the three faults + in [#22](https://github.com/Gerrrt/HomeLab/issues/22) were cleared. Mind + the trap documented in `generator.yaml`: this switch returns `ifSpecific` + with a zero-length value that makes snmp-exporter discard the whole + response, so the walk lists individual columns and must stay clear of + column 22. - [ ] Deploy Alloy to the remaining hosts — currently only the monitoring host and one other report in. `shiva` and `oracle` are next. - [ ] Add blackbox-exporter for uptime and TLS-expiry checks on internal @@ -77,9 +80,21 @@ inventory. Ordered roughly by how much it matters. validated in CI by booting the pinned Loki image against them - [x] Replace the CA and leaf certificates that leaked, and add tooling so issuing one is a command rather than a research project +- [x] Serve Grafana over TLS with that CA, verified end to end — Prometheus + scrapes it with `ca_file` and `server_name` rather than + `insecure_skip_verify` +- [x] Point Alertmanager at a real receiver. The webhook was the + `ntfy.example.invalid` placeholder for the entire life of the stack, so + no alert had ever been delivered +- [x] Surface firing alerts on the dashboards. Forty rules and one routing tree + existed with nothing showing them; four dashboards now carry a table of + their own component's alerts +- [x] Stop the UPS dashboard reporting a battery that is not there — the + management card fabricates charge, runtime and status - [x] Purge the shared SNMP community, the inline Grafana password and the TLS private keys under `certificates/` from git history, and delete the `.gitleaksignore` that acknowledged them -- [x] Give every SNMP device its own community, and rotate three of the four on - the hardware (pfSense, the APC NMC, iLO), confirming each refuses the old - shared string +- [x] Give every SNMP device its own community and rotate all four on the + hardware, confirming pfSense, the APC NMC and iLO each refuse the old + shared string. The switch accepts its new one but also still holds its + previous community — an accepted residual, recorded in `SECURITY.md`