Skip to content

Media server roadmap

This page lists work that will probably happen at some point. It is a backlog, not a schedule: items get picked up as the need arises or as an idea takes hold, not in the order below. Completed work and its evidence belong in operating documentation and Git history, not here.

Backlog

  • WAN failover (5G/LTE second WAN on OPNsense). Targets the top-ranked uptime risk: the single fibre line. Treat it as degraded ops continuity, not fibre parity. Local and VPN playback already survive a WAN outage untouched; failover mainly keeps management access, alert delivery, and monitoring flowing while the fibre is down. Do not expect it to preserve remote Plex: 5G upload is a variable fraction of the 475 Mbit uplink, and consumer 5G is usually behind carrier NAT, so the inbound Caddy path for the public Plex hostname would break (only outbound-initiated tunnel routes survive). Size it for keeping the house reachable, not for 4K remote streaming.
  • External synthetic check of the real user path. Probe the public Plex endpoint end to end from outside the house (WAN -> Cloudflare or Caddy -> Plex). Internal black-box probes cannot see the outages that matter most to remote users.
  • Prove UPS-backed shutdown. If tested UPS coverage is still missing, protect the media server, OPNsense, fibre termination, primary switch, and access point. Prove a controlled shutdown and recovery rather than relying on an estimated runtime.
  • Implement the IoT VLAN. Deploy the Omada Compose project through Ansible's compose_deploy_projects, not install.sh. Bind controller state under appdata so restic protects it, instead of an unprotected Docker named volume.
  • Reassess bounded offsite media availability. Optional. Only worth it if continued playback during a total home power or Internet outage justifies the recurring cost and operational work. Before committing, test a storage-limited subset against representative Plex clients, including sessions that need audio conversion or subtitle burn-in.
  • Proxmox + k3s HA platform. Phased and funding-gated (~EUR 2,000+ for the full path), driven as much by career-pivot learning as by uptime: nested lab + free wins (UPS, healthchecks) -> single Proxmox node (iGPU for Plex QuickSync) -> two nodes + Pi QDevice + ZFS replication -> three nodes + Ceph -> k3s on the cluster. Storage stays single-copy; media library HA is out of scope. OPNsense CARP is a separate, parallel track.
  • Portable, hardware-profiled Ansible. Precursor to any VM work: make the host convergence run cleanly on a fresh guest, not just the current bare-metal box. Split hardware-specific facts (disk by-id maps, GPU node, spindown) from portable roles so the same playbooks configure a disposable VM. This is the first step in the agreed sequence before the Terraform work below.
  • Terraform-created disposable VMs. Precursor to a k3s lab: Terraform provisions throwaway Proxmox VMs, Ansible (now portable, above) configures them. Compose stays the production workload authority until k3s is proven in the lab.
  • Harden the Caddy/Plex ingress. The direct Caddy path on 80/443 is the one always-open inbound surface, and it bypasses the OPNsense CrowdSec bouncer that fronts the tunnel. Decide explicitly whether it needs a bouncer or rate limit, or record the accepted risk.
  • Tested password-manager break-glass. The .env secrets are escrowed in the password manager and a verified offsite secret escrow already exists, so routine restore is covered. The remaining gap is the vault-loss case: prove a restore path when the password manager itself is unavailable. Separate from the deferred SOPS-to-private-repo idea in the security notes.
  • Broader VLAN segmentation. Extend the IoT VLAN work to separate the management/admin plane from workloads. Best folded into the IoT VLAN effort rather than run as its own project.
  • Private status page. Build a small status view from the existing Prometheus and Loki data. Near-zero new infrastructure and useful as a portfolio piece.