Skip to content

Add HomeBox to the sensitive tier, and give docs/hardware.md a place to keep serials #148

Description

@Gerrrt

Beyond ADR-0008's nine. This one has a second job beyond the obvious.

What and why

HomeBox (SysAdminsMedia) AGPL-3.0 Docker/Goawesome-selfhosted README.md:1205.

Home inventory: items, locations, purchase dates, warranty expiry, receipts and manuals as attachments. A single Go binary with SQLite.

The homelab-specific argument

docs/hardware.md records the rack in detail — every U, every device, every accessory with a purchase link. What it deliberately does not carry is the operational detail behind each item: serial numbers, purchase dates, warranty windows, and the iLO Advanced licence key.

That is the right call for a public repository. docs/security.md is already explicit about what this repo does not publish, and serials belong on that list.

But "not in the repo" has so far meant "nowhere", and that gap has already cost something measurable. ADR-0008 records that oracle was documented as an i5-1235U with 32 GB and a 2 TB SSD when it is a dual-core A6-9200 with 4 GB and a 5400 rpm disk — and that the wrong entry was load-bearing in planning. An inventory with purchase records is how that particular error gets caught, because a machine bought on a known date for a known price is much harder to misremember.

Directly useful for open work: #92 (buy a spare ProDesk), #93 (UPS battery — a pack has a fitted date and a replacement interval), #110 (rack shelf, spec settled at the rack on a specific date).

Placement

Sensitive tier, VLAN 99. Serials, purchase records and licence keys are exactly the material the repository withholds; they should not sit on a lower-trust segment.

What it needs

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

  • Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
  • Any new credential goes in secrets/*.sops.yaml — note the inventory itself will hold licence keys and serials, so its backup is sensitive
  • Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#102 (the mini PC), #129 (Caddy). Useful for #92, #93, #110.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions