proxmox:
  notes:
  - Initial scaffold populated from repo docs/change log on 2026-06-06; live inventory
    pass still required.
  nodes:
  - name: buntbox01
    ip: 192.168.0.88
    roles:
    - hypervisor
  storage:
  - node: buntbox01
    name: local-lvm
    roles:
    - vm-disks
    - lxc-rootfs
  - node: buntbox01
    name: local
    roles:
    - iso
    - templates
    - backups
  bridges:
  - node: buntbox01
    name: vmbr0
    cidr: 192.168.0.0/24
    gateway: 192.168.0.1
  vmid_ranges:
    infrastructure: null
    experiments: null
    reserved: null
vms:
- vmid: 102
  name: Vaultwarden
  node: buntbox01
  role: secrets-vault
  os: Debian 13
  status: deployed-bootstrap
  ip: 192.168.0.238
  ip_method: dhcp
  fqdn: vw.dropcutstud.io
  exposure: lan-tailscale-only-intent
  resources:
    cpu: 1
    memory_mb: 1024
    disk_gb: 16
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: critical
    status: restore-tested
    scope: application-level-encrypted
    runbook: runbooks/vaultwarden-backup.md
    last_verified: '2026-06-07'
    last_restore_test: '2026-06-07'
  notes:
  - Vaultwarden behind Nginx HTTPS with self-signed internal TLS.
  - Initial account created; open signups disabled per change log.
  - MVP encrypted backup and disposable restore test completed 2026-06-07.
lxcs:
- vmid: 103
  name: searxng
  node: buntbox01
  role: private-search
  status: deployed-bootstrap
  ip: 192.168.0.133
  ip_method: dhcp
  fqdn: search.dropcutstud.io
  exposure: lan-tailscale-only-intent
  runtime: docker-compose
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: sanitized-verified
    scope: config-level-secret-redacted
    off_guest_destination: /home/piagent/backups/searxng on LXC 104
    encryption: bypassed-secret-regenerated-on-restore
    schedule: manual
    runbook: runbooks/searxng-homelab.md
    last_verified: '2026-06-07'
    last_restore_test: null
  notes:
  - 'Current URL: http://192.168.0.133:8080/.'
  - DNS/Tailscale/TLS follow-up incomplete.
- vmid: 104
  name: nimrod
  node: buntbox01
  role: assistant-workspace
  status: deployed-bootstrap
  ip: 192.168.0.222
  ip_method: dhcp
  fqdn: null
  exposure: lan-only-current
  runtime: pi-manual-ssh
  resources:
    cpu: 2
    memory_mb: 4096
    disk_gb: 32
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  snapshots:
  - base-runtime-repo-20260606
  notes:
  - Dedicated Nimrod/Pi LXC created 2026-06-06.
  - Repo cloned at /home/piagent/projects/nimrod from commit 052f1a5.
  - Pi verified with Node 22.22.3 and pi 0.78.1.
  - Approved SSH key and Proxmox token copied under project-local ignored paths; Google
    tokens not copied.
- vmid: 101
  name: amp-gameserver
  node: buntbox01
  role: gameserver
  status: deployed
  ip: 192.168.0.90
  ip_method: static
  fqdn: amp.dropcutstud.io
  exposure: lan-only-current
  runtime: docker-amp
  resources:
    cpu: 4
    memory_mb: 32000
    disk_gb: 200
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: missing
    scope: config-level-needed
  notes:
  - AMP game server host, Debian 12, Docker-based.
  - Runs game server instances via AMP web UI.
  - Manually added to inventory 2026-06-07.
- vmid: 105
  name: reverse-proxy
  node: buntbox01
  role: central-reverse-proxy
  status: deployed-mvp
  ip: 192.168.0.137
  ip_method: dhcp
  fqdn: proxy.dropcutstud.io
  exposure: lan-only-current
  runtime: nginx
  resources:
    cpu: 1
    memory_mb: 1024
    disk_gb: 8
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: partially-verified
    scope: nginx-config-excludes-tls-private-keys
    guest_destination: /var/backups/reverse-proxy
    off_guest_destination: /home/piagent/backups/reverse-proxy on LXC 104
    encryption: required-before-backing-up-tls-private-keys
    schedule: manual
    runbook: runbooks/nginx-reverse-proxy.md
    last_verified: '2026-06-07'
    last_restore_test: null
  snapshots:
  - post-searxng-proxy-mvp
  - post-dashboard-proxy-route
  notes:
  - Central Nginx reverse proxy MVP created 2026-06-07.
  - Temporary self-signed TLS routes search.dropcutstud.io to SearXNG backend at 192.168.0.133:8080.
  - Temporary self-signed TLS routes dashboard.dropcutstud.io to Homepage backend
    at 192.168.0.241:3000.
  - No public exposure; DNS service and final certificate trust remain follow-up work.
- vmid: 106
  name: unbound
  node: buntbox01
  role: internal-dns
  status: deployed-mvp
  ip: 192.168.0.124
  ip_method: dhcp
  fqdn: dns.dropcutstud.io
  exposure: lan-only-current
  runtime: unbound
  resources:
    cpu: 1
    memory_mb: 512
    disk_gb: 8
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: restore-tested
    scope: config-level
    guest_destination: /var/backups/unbound
    off_guest_destination: /home/piagent/backups/unbound on LXC 104
    encryption: not-required-no-secrets
    schedule: manual
    runbook: runbooks/unbound-internal-dns.md
    last_verified: '2026-06-07'
    last_restore_test: '2026-06-07'
  snapshots:
  - post-unbound-internal-dns-mvp
  - post-dashboard-dns-record
  notes:
  - Standalone Unbound internal DNS MVP created 2026-06-07.
  - Provides internal dropcutstud.io records for proxy/search/vaultwarden/nextcloud/dashboard.
  - Router/DHCP/Tailscale integration and stable reservation remain follow-up work.
- vmid: 107
  name: homepage
  node: buntbox01
  role: service-dashboard
  status: deployed-mvp
  ip: 192.168.0.241
  ip_method: dhcp
  fqdn: dashboard.dropcutstud.io
  exposure: lan-only-current
  runtime: docker-compose-homepage
  resources:
    cpu: 1
    memory_mb: 1024
    disk_gb: 8
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: restore-tested
    scope: config-level
    guest_destination: /var/backups/homepage
    off_guest_destination: /home/piagent/backups/homepage on LXC 104
    encryption: not-required-no-secrets
    schedule: manual
    runbook: runbooks/homepage-dashboard.md
    last_verified: '2026-06-07'
    last_restore_test: '2026-06-07'
  snapshots:
  - post-homepage-dashboard-mvp
  notes:
  - Homepage config-as-code dashboard MVP created 2026-06-07.
  - Config under /opt/homepage/config; Docker socket intentionally not mounted.
  - Proxied by reverse-proxy as dashboard.dropcutstud.io with temporary self-signed
    TLS.
  - Manual config-level backup configured, verified, and isolated restore-tested 2026-06-07.
- vmid: 108
  name: pihole
  node: buntbox01
  role: ad-blocking-dns
  status: deployed
  ip: 192.168.0.150
  ip_method: static
  fqdn: null
  exposure: lan-only-current
  runtime: docker-pihole
  resources:
    cpu: 1
    memory_mb: 512
    disk_gb: 8
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: missing
    scope: config-level-needed
    notes:
    - Pi-hole ad-blocking DNS deployed 2026-06-07.
    - 'Upstream DNS: Unbound at 192.168.0.124.'
    - 'Admin web UI at http://192.168.0.150/admin/ password: admin.'
    - DHCP DNS still points at Unbound; change to Pi-hole IP to activate ad-blocking.
- vmid: 109
  name: gluetun
  node: buntbox01
  role: vpn-proxy
  status: deployed
  ip: 192.168.0.151
  ip_method: static
  fqdn: null
  exposure: lan-only-current
  runtime: docker-gluetun
  resources:
    cpu: 1
    memory_mb: 512
    disk_gb: 8
    storage: local-lvm
  network:
    bridge: vmbr0
    public_exposure: false
  backup:
    class: standard
    status: missing
    scope: config-level-needed
  notes:
  - Gluetun PIA VPN proxy deployed 2026-06-07.
  - 'Public IP: 37.19.197.190 (New York).'
  - HTTP proxy at 192.168.0.151:8888.
  - SOCKS5 proxy at 192.168.0.151:8388.
  - DNS through Pi-hole at 192.168.0.150.
  - Credentials stored in .tokens/pia.txt.
ip_allocations:
- ip: 192.168.0.90
  method: static
  owner_type: lxc
  owner_id: 101
  owner_name: amp-gameserver
  status: observed
- ip: 192.168.0.151
  method: static
  owner_type: lxc
  owner_id: 109
  owner_name: gluetun
  status: observed
- ip: 192.168.0.150
  method: static
  owner_type: lxc
  owner_id: 108
  owner_name: pihole
  status: observed
- ip: 192.168.0.238
  method: dhcp
  owner_type: vm
  owner_id: 102
  owner_name: Vaultwarden
  status: observed
- ip: 192.168.0.133
  method: dhcp
  owner_type: lxc
  owner_id: 103
  owner_name: searxng
  status: observed
- ip: 192.168.0.222
  method: dhcp
  owner_type: lxc
  owner_id: 104
  owner_name: nimrod
  status: observed
- ip: 192.168.0.137
  method: dhcp
  owner_type: lxc
  owner_id: 105
  owner_name: reverse-proxy
  status: observed
- ip: 192.168.0.124
  method: dhcp
  owner_type: lxc
  owner_id: 106
  owner_name: unbound
  status: observed
- ip: 192.168.0.241
  method: dhcp
  owner_type: lxc
  owner_id: 107
  owner_name: homepage
  status: observed
service_allocations:
- service: amp-gameserver
  owner_type: lxc
  owner_id: 101
  hostnames:
  - amp.dropcutstud.io
  ports:
  - 8080/tcp
  runbook: runbooks/amp-gameserver.md
- service: vaultwarden
  owner_type: vm
  owner_id: 102
  hostnames:
  - vw.dropcutstud.io
  ports:
  - 80/tcp
  - 443/tcp
  runbook: runbooks/vaultwarden-deployment.md
  ticket: tickets/active/2026-05-18-consolidated-homelab-secrets-management.md
- service: searxng
  owner_type: lxc
  owner_id: 103
  hostnames:
  - search.dropcutstud.io
  ports:
  - 8080/tcp
  runbook: runbooks/searxng-homelab.md
  ticket: tickets/active/2026-06-06-add-searxng-service.md
- service: nimrod-pi
  owner_type: lxc
  owner_id: 104
  hostnames: []
  ports:
  - 22/tcp
  runbook: null
  ticket: tickets/active/2026-06-06-move-pi-instance-to-server.md
- service: reverse-proxy
  owner_type: lxc
  owner_id: 105
  hostnames:
  - proxy.dropcutstud.io
  - search.dropcutstud.io
  ports:
  - 80/tcp
  - 443/tcp
  runbook: runbooks/nginx-reverse-proxy.md
  ticket: tickets/active/2026-06-06-nginx-reverse-proxy-and-tls-standard.md
- service: unbound
  owner_type: lxc
  owner_id: 106
  hostnames:
  - dns.dropcutstud.io
  - unbound.dropcutstud.io
  ports:
  - 53/tcp
  - 53/udp
  runbook: runbooks/unbound-internal-dns.md
  ticket: tickets/active/2026-06-07-standalone-unbound-internal-dns.md
- service: homepage-dashboard
  owner_type: lxc
  owner_id: 107
  hostnames:
  - dashboard.dropcutstud.io
  ports:
  - 3000/tcp
  runbook: runbooks/homepage-dashboard.md
  ticket: tickets/active/2026-06-06-service-dashboard-registration.md
