Status — in progress¶
Manually maintained
This page is updated by hand after each work session (last update
2026-08-12). An auto-refresh job that regenerates it from ops is a
planned upgrade — until then, cross-check against RUNBOOK.md in the
Sandlands folder if something looks stale.
Waiting on Elliott¶
These need the operator — Claude's permission gate or physical/console access blocks them.
| Item | What to do | Why it matters |
|---|---|---|
| Vault password check | Confirm the Kopia repo password (from /etc/backup-stack/kopia.env on ops) is actually stored in the password manager |
Without it the entire Kopia repo is unreadable — no repo password, no restores |
| Proxmox 2FA | Web UI → Datacenter → Users → root@pam → TFA → add TOTP | The PVE UI is LAN-wide and single-factor; that password is the keys to every VM |
| Tailnet ACL + key expiry | In the Tailscale admin console: disable key expiry for ops; add an ACL so the travelling tablet — and any tag:family RustDesk devices — can't reach the whole LAN via the subnet route |
ops key expiry (2027-02-05) would silently kill remote backups; the tablet is the theft-risk device, and family RustDesk clients shouldn't inherit the whole-LAN route (Remote desktop) |
| VPS: accept-routes + reboot | sudo tailscale set --accept-routes then sudo reboot |
VPS can't see the LAN over the tailnet yet; 355 days uptime with a pending kernel. Minecraft proxy blips ~1 min |
| Confirm VPS UFW merge | sudo ufw status verbose on the VPS — verify rustdesk-setup.sh's ufw enable kept the WireGuard (51820/udp) and Bedrock UDP rules from vps-harden.sh |
The two scripts each manage UFW independently; a dropped 51820 rule would break the Minecraft WireGuard path |
| pve patch window | apt update && apt full-upgrade then reboot, when home |
11 pending security updates, 140-day-old kernel. Reboot takes all guests down briefly |
| DSM snapshot checklist | Enable NAS-side snapshots per the checklist (manual, DSM UI) | Second line of defence for the backup shares until the UNAS migration |
| DHCP reservations | Reserve BC:24:11:87:C1:39 → 192.168.1.190 for ops in the router UI |
If ops changes IP, every client's Kopia config and the subnet route break |
| B2 decision | Either enable B2 for the Kopia repo (~$0.40/mo at current size) or trim the MacBook policy and re-enable the Drive mirror | Kopia data currently has no off-site copy (owner's choice, standing risk). See Off-site |
| Stray root tarball on mc VM | Clean the legacy root-owned junk (incl. a stray ~12M tarball) out of /home/minecraft/bedrock_backups/ on VM 103 |
Dead weight that gets swept into every Kopia snapshot of that directory |
| Destroy LXC 101 (after 2026-09-09) | ssh pve 'pct destroy 101' |
Final PBS decommission step — 30-day cooling-off. (All other cleanup commands were run by 2026-08-12.) |
Phase 2 queue¶
Endpoint onboarding, roughly in order. Onboarding a Kopia endpoint is one
command on ops: add-backup-endpoint.sh <name> — see
Onboarding.
- [ ] Windows PCs (pc1 Elliott, pc2 Rory): Veeam Agent image backups →
NAS + KopiaUI for files; then set real times in the
wol-*.timerunits and flipWOL_ENABLED=1on ops (timers gated off until Veeam exists) - [ ] Tablet: KopiaUI over the tailnet (WiFi-only, so WoL doesn't apply)
- [ ] VPS: kopia client over Tailscale (needs
sudo tailscale set --accept-routeson the VPS first — see Waiting on Elliott) - [ ] Lightroom originals on the MacBook: fold into the Kopia policy once the off-site (B2) question is settled
- [ ] Media server: Jellyfin LXC with
/dev/dri(QuickSync) — after the RAM upgrade on the OptiPlex
Recently landed¶
- 2026-08-12 — this wiki went live at
wiki.byers.cc(Cloudflare Pages - Access, repo
github.com/elliottbyers/byers-homelab-wiki); verified: anonymous requests are redirected to the Access login
| Date | What |
|---|---|
| 2026-08-12 | RustDesk OSS remote-desktop server stood up on the VPS, VPN-only via Tailscale at rust.byers.cc; external scan confirms 21115–21119 closed to the public / open on the tailnet. New page: Remote desktop |
| 2026-08-12 | This wiki created; security audit (four-lens, read-only) — quick fixes applied same day, operator items above |
| 2026-08-11 | Minecraft→VPS backup leg fully retired after the NAS leg passed a restore drill; VPS disk back to 24% |
| 2026-08-09 | PBS decommissioned (zero successful backups ever over NFS); replaced by nightly vzdump → NAS with Drive mirror |
| 2026-08-08 | Kopia stack live on ops; MacBook onboarded (KopiaUI); Tailscale subnet router approved |