Beyond ADR-0008's nine. This one has a second job beyond the obvious.
What and why
HomeBox (SysAdminsMedia) AGPL-3.0 Docker/Go — awesome-selfhosted README.md:1205.
Home inventory: items, locations, purchase dates, warranty expiry, receipts and manuals as attachments. A single Go binary with SQLite.
The homelab-specific argument
docs/hardware.md records the rack in detail — every U, every device, every accessory with a purchase link. What it deliberately does not carry is the operational detail behind each item: serial numbers, purchase dates, warranty windows, and the iLO Advanced licence key.
That is the right call for a public repository. docs/security.md is already explicit about what this repo does not publish, and serials belong on that list.
But "not in the repo" has so far meant "nowhere", and that gap has already cost something measurable. ADR-0008 records that oracle was documented as an i5-1235U with 32 GB and a 2 TB SSD when it is a dual-core A6-9200 with 4 GB and a 5400 rpm disk — and that the wrong entry was load-bearing in planning. An inventory with purchase records is how that particular error gets caught, because a machine bought on a known date for a known price is much harder to misremember.
Directly useful for open work: #92 (buy a spare ProDesk), #93 (UPS battery — a pack has a fitted date and a replacement interval), #110 (rack shelf, spec settled at the rack on a specific date).
Placement
Sensitive tier, VLAN 99. Serials, purchase records and licence keys are exactly the material the repository withholds; they should not sit on a lower-trust segment.
What it needs
Which VLAN this touches
🔴 99 — Winterfell (management)
Security review
Depends on
#102 (the mini PC), #129 (Caddy). Useful for #92, #93, #110.
Beyond ADR-0008's nine. This one has a second job beyond the obvious.
What and why
HomeBox (SysAdminsMedia)
AGPL-3.0Docker/Go— awesome-selfhostedREADME.md:1205.Home inventory: items, locations, purchase dates, warranty expiry, receipts and manuals as attachments. A single Go binary with SQLite.
The homelab-specific argument
docs/hardware.mdrecords the rack in detail — every U, every device, every accessory with a purchase link. What it deliberately does not carry is the operational detail behind each item: serial numbers, purchase dates, warranty windows, and the iLO Advanced licence key.That is the right call for a public repository.
docs/security.mdis already explicit about what this repo does not publish, and serials belong on that list.But "not in the repo" has so far meant "nowhere", and that gap has already cost something measurable. ADR-0008 records that
oraclewas documented as an i5-1235U with 32 GB and a 2 TB SSD when it is a dual-core A6-9200 with 4 GB and a 5400 rpm disk — and that the wrong entry was load-bearing in planning. An inventory with purchase records is how that particular error gets caught, because a machine bought on a known date for a known price is much harder to misremember.Directly useful for open work: #92 (buy a spare ProDesk), #93 (UPS battery — a pack has a fitted date and a replacement interval), #110 (rack shelf, spec settled at the rack on a specific date).
Placement
Sensitive tier, VLAN 99. Serials, purchase records and licence keys are exactly the material the repository withholds; they should not sit on a lower-trust segment.
What it needs
secrets/*.sops.yaml.docs/hardware.mdends and this begins — otherwise there are two inventories and, per the repository's own warning indocs/roadmap.md, "two places holding the same checkbox is how a checkbox stops being true". Suggested split:hardware.mdkeeps roles, specs and topology; HomeBox keeps serials, dates, warranties and receipts.Which VLAN this touches
🔴 99 — Winterfell (management)
Security review
secrets/*.sops.yaml— note the inventory itself will hold licence keys and serials, so its backup is sensitivedocs/network.mdwith an OUI-truncated MAC — n/aDepends on
#102 (the mini PC), #129 (Caddy). Useful for #92, #93, #110.