h5h Homelab

Appearance

Known Issues ​

A living list of deferred bugs, hygiene problems, and follow-up work. Items here are known — don't be surprised by them — but were not fixed in the docs-audit pass because scope was "docs only, leave code alone". PRs welcome.

Security ​

1. CrowdSec credential exposure in git history (rotation still required) ​

  • Current state: code/docker/homepage/services.yaml now uses (no plaintext secret in tracked files).
  • Problem: The previously committed CrowdSec key is still exposed in git history.
  • Fix: Rotate in CrowdSec (cscli machines delete + cscli machines add) and update the new key in code/docker/.env as HOMEPAGE_VAR_CROWDSEC_KEY.
  • Note: File-level cleanup alone does not invalidate compromised historical credentials.

Hygiene ​

2. node_modules/ and dist/ checked into a public repo ​

  • Paths: node_modules/ (repo root), dist/ (repo root).
  • Problem: Both are in .gitignore but are present in the working tree and the index — shouldn't be.
  • Fix: git rm -r --cached node_modules dist && git commit. Repo will shrink substantially.

3. Undefined image-pinning policy ​

  • Files: code/docker/docker-compose.yml — many services at :latest.
  • Fix: Follow the policy in upgrade_runbook.md. Start by pinning services with persistent on-disk format that haven't been pinned yet.

4. CI sed-patches host scripts at runtime (RESOLVED) ​

  • Status: Resolved. protect-data.sh and generate-secrets.sh were refactored to be cross-platform across macOS (Darwin) and Linux. Runtime sed mutations removed from .github/workflows/e2e-tests.yml.

5. postgres.json Grafana dashboard has no data (RESOLVED) ​

  • Status: Resolved. Removed orphaned code/docker/grafana/dashboards/postgres.json until a dedicated postgres_exporter is provisioned.

Orphans ​

6. Unused docker subdirectories (RESOLVED) ​

  • Status: Cleaned. Deleted orphaned code/docker/couchdb/, empty Homepage placeholders (kubernetes.yaml, proxmox.yaml), and 0-byte static files (custom.css, custom.js).
  • code/docker/mailserver/README.md retained as intentional pointer to decisions/0001-no-self-hosted-email.md.
  • code/docker/cloudflared/SETUP.md retained as deprecated manual fallback reference.

Code ​

7. apps/dashboard/ advertises a non-existent service (RESOLVED) ​

  • Status: Resolved. Removed stale "Email" (mail.h5h.me) card from code/apps/dashboard/src/App.jsx.

8. Backup path unification (RESOLVED) ​

  • Status: Resolved. Universal task runner (h5h-runner) streaming directly to Cloudflare R2 via rclone is the primary automated zero-disk backup path. code/scripts/backup.sh is retained strictly as an offline emergency fallback with matching excludes (data/gdrive excluded).

Not-bugs (documented for clarity) ​

  • docker/cloudflared/SETUP.md — intentionally deprecated but retained as a manual fallback. make setup-tunnel is the supported path.
  • docker/mailserver/ — intentionally absent from compose. See ADR 0001.
  • apps/dashboard/ — intentionally not deployed. See ADR 0003.

MIT License

h5h homelab