nik/homelab
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: mark all 9 REFACTOR_PLAN.md stages done at the file level
Some checks failed
validate / lint (push) Failing after 7s
Details

Browse Source 
Everything is committed locally on main; nothing has been pushed. See the
session summary for the specific items that still need your input or action
before any of this goes live (secret rotation values, Authentik chart
version, push go-ahead, live storage/Grafana decisions, router archive review).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Nik Afiq 2026-07-23 18:22:53 +09:00
parent 7435b7583f
commit 09d087fb11
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
REFACTOR_PLAN.md
View File

@ -20,11 +20,11 @@ citations, and the highest-severity ones were independently re-verified
| 2 | Validation tooling & clean baseline | Done. `yamllint`/`ansible-lint`/`kubeconform` installed by user; `.yamllint.yml`/`.ansible-lint` added; baseline clean (0 yamllint issues, `kubeconform`: 117+20 resources valid, all playbooks pass `--syntax-check`). Remaining `ansible-lint` findings are either pre-existing role/var naming conventions (out of scope — would require repo-wide renames) or collections-not-installed noise that resolves once `ansible-galaxy collection install -r ansible/requirements.yml` is run. | | 2 | Validation tooling & clean baseline | Done. `yamllint`/`ansible-lint`/`kubeconform` installed by user; `.yamllint.yml`/`.ansible-lint` added; baseline clean (0 yamllint issues, `kubeconform`: 117+20 resources valid, all playbooks pass `--syntax-check`). Remaining `ansible-lint` findings are either pre-existing role/var naming conventions (out of scope — would require repo-wide renames) or collections-not-installed noise that resolves once `ansible-galaxy collection install -r ansible/requirements.yml` is run. |
| 3 | Remove confirmed junk | Done, committed locally. `.DS_Store` confirmed never tracked (no action needed). | | 3 | Remove confirmed junk | Done, committed locally. `.DS_Store` confirmed never tracked (no action needed). |
| 4 | Ansible cleanup | Done, committed locally. | | 4 | Ansible cleanup | Done, committed locally. |
| 5 | Argo CD bootstrap normalization | Not started — highest-risk stage, needs one-Application-at-a-time live rollout with `kubectl diff`, not a blind batch. | | 5 | Argo CD bootstrap normalization | Files done, committed locally, **not pushed — highest-risk stage**. `authentik.yaml`'s chart version is a placeholder needing your input (`helm list -n authentik`); every new/changed Application here needs `kubectl diff` one at a time before/after enabling, not a blind batch push. |
| 6 | Values/DNS consolidation | DNS drift + orphaned entry done, committed locally. Sync-policy normalization (finding #18) done, committed locally, **not pushed** (changes live Argo CD behavior on 5 Applications). | | 6 | Values/DNS consolidation | Done, committed locally, **not pushed**. |
| 7 | Kubernetes correctness & security | Not started. | | 7 | Kubernetes correctness & security | Resource requests/limits + probes done (finding #16), committed locally, **not pushed**. `gitea-backup` RBAC narrowing (#11) done as part of Stage 5's commit. Grafana `runAsNonRoot`/`fsGroup` test (#25) and `:latest` image pinning not done — both need a live test window / registry inspection I didn't do unprompted. |
| 8 | Documentation & DR runbook | Partially done (host tables, ingress/storage doc-drift, ansible role tables) — cold-rebuild runbook not yet written. | | 8 | Documentation & DR runbook | Done, committed locally. |
| 9 | CI & Claude Code guidance | Not started. | | 9 | CI & Claude Code guidance | Done, committed locally, **not pushed** (new CI automation surface). |
**Secret rotation still needs you** (Stage 1): I wired up the `existingSecret`/env-injection plumbing for the Gitea DB password and Dashy API key, but I don't generate or handle the actual new credential values — that's your call per this repo's credential-handling rule. See the session summary for exact steps. **Secret rotation still needs you** (Stage 1): I wired up the `existingSecret`/env-injection plumbing for the Gitea DB password and Dashy API key, but I don't generate or handle the actual new credential values — that's your call per this repo's credential-handling rule. See the session summary for exact steps.