project-charlie/docs/roadmap.md

Roadmap

Phase 1 — reorg + Charlie repos

• Inventory /mnt/nas/ stacks.
• Push Charlie/project-charlie.
• Snapshot volume1/ubuntu on miquella.
• Tier 1 pilot (ddclient, homarr, vaultwarden).
• Tier 2 (caddy, gssh, directoryadmin, mediacompose).
• Tier 3 (ldap, authentik, bookstack, monica, miniflux, planka, audiobookshelf, gitea).
• Tier 4 — collapse upstream-cloned stacks (mealie, paperless-ngx, victoriametrics, searxng, invidious).
• Tier 5 — long tail. See repos.md.
• Sweep /mnt/nas/home/*.retired/ after stability check.
• Delete /mnt/nas/home/ once empty.
• Mohg inventory + migration.

Phase 2 — CI

• Design runner stack — Charlie/runners. Open question: secrets sourcing (vaultwarden? Gitea Actions secrets? SOPS?).
• Stand up runners on morgott + melina, register org-scope to Charlie.
• First end-to-end pipeline: push to Charlie/ddclient → webhook → redeploy on morgott.
• Build pipelines on amacocian/* source repos to push images to gitea registry (replaces "build on laptop").
• Per-stack deploy.yaml workflows in every Charlie/<stack>.

Phase 3 — Automation

• Diun watching registries → webhook → redeploy workflow with force-pull.
• Retire watchtower.
• Drift detection: running compose vs repo compose.
• Backup verification against miquella.
• Cert/secret expiry checks (authentik, caddy, signing CA).
• Secret rotation pass — every stack with secrets exposed during reorg (most of them).

Phase 4 — NAS layout polish

• Rename /mnt/nas/media-server/ → /mnt/nas/media/ and update mediacompose .env.
• Rename /mnt/nas/ldap/ → /mnt/nas/ldap-certs/.
• Move /mnt/nas/portainer/data/ → /mnt/nas/data/portainer/ (when portainer migrates).