Living operations references for two production homelab servers. These are the sanitized, published copies of internal docs — hostnames, tunnel IDs, mesh addresses and credential locations redacted — produced by a verification-gated publishing pipeline that refuses to publish if any sensitive value survives redaction. The technical content, failure analysis and remediation steps are unmodified.
Bulk storage and the services layer — the box everything else leans on.
The security and investigation host — detection and OSINT tooling.
The two docs above aren't posted homelab notes — they're generated. An internal
Obsidian doc goes through sanitize.py, which strips private blocks, drops
whole sections and table rows, and applies substitutions to redact hostnames, UUIDs,
serials and credential locations. It then scans its own output with a tripwire
pass and refuses to publish — writing nothing — if anything sensitive
survived. Substitutions handle what you knew about when you wrote the rules;
the tripwire catches the service you stood up last Tuesday and forgot. A failing build
is the system working.