fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record Serenity DNS and cloudflared retirement
Some checks failed
secret-guardrails / artifact-secret-scan (push) Has been cancelled
Details
secret-guardrails / gitleaks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-25 22:09:15 +00:00
parent 60de92339d
commit efb237efe7
3 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/planning/SERENITY_CLEANUP_WAVE_1.md
View File

@@ -73,8 +73,8 @@ From the live Serenity audit:
Live execution on 2026-05-25 established:
- `Huntarr` and `omegabrr` were low-risk stale stopped containers and were removed from Serenity
- the recent non-running `Created` containers (`calibre-web`, `SuggestArr`, `Cleanuparr`, `calibre`, `agregarr`) were not blindly pruned because their metadata was touched recently and they may represent intentional but inactive templates
- `Unraid-Cloudflared-Tunnel` is not currently dead: it still has a live tunnel token and active Cloudflare edge registrations, so removal requires a separate usage audit first
- the Serenity Pi-hole HA stack is also not safe to remove blindly yet: `10.5.30.53` is still answering DNS and Serenity is running a backup `keepalived`/Pi-hole stack, so Pi-hole retirement must stay gated on the broader DNS cutover verification
- `Unraid-Cloudflared-Tunnel` was audited, stopped, and removed after verification showed it was only transport-alive and no current public traffic depended on it
- the Serenity Pi-hole HA stack (`binhex-official-pihole`, `pihole-serenity`, `unbound-pihole-serenity`, `keepalived-pihole-serenity`) was then stopped and removed after live mixed-host DNS checks confirmed the Technitium path remained healthy without it
## Wave 1-A: legacy Pi-hole removal
@@ -113,10 +113,13 @@ Before removal, verify only these read-only checks:
### Verification after removal
- Serenity Technitium container remains healthy
- PD and NOMAD Technitium backup flow still looks normal
- no client-facing DNS complaints appear
- no scripts or bookmarks fail because of removed Pi-hole UI endpoints
- Serenity Technitium container remained healthy
- mixed-host DNS checks stayed good after removal:
- from NOMAD, `10.5.30.8` and `10.5.30.10` still resolved both public and homelab names
- from PD, `10.5.30.9` and `10.5.30.10` still resolved both public and homelab names
- `10.5.30.53` continued answering DNS even after Serenity Pi-hole removal, confirming it is no longer tied to the removed Serenity Pi-hole containers
- no immediate client-facing DNS regression was observed during the removal window
- no public regression was observed on sampled hostnames such as `panel.paccoco.com` and `audiobookshelf.paccoco.com`
## Wave 1-B: stale container pruning
@@ -206,6 +209,10 @@ Status after live audit:
3. keep `/mnt/user/appdata/cloudflared` during a cooling-off window even though it appears empty/unneeded
4. later, from the Cloudflare side, delete or repoint the stale tunnel config/hostnames if they still exist there
Status:
- completed on 2026-05-25: `Unraid-Cloudflared-Tunnel` was stopped and removed
- sampled public checks (`panel.paccoco.com`, `audiobookshelf.paccoco.com`) remained healthy after removal
## Wave 1-D: DB-backed migration ordering
These apps should not be deleted in wave 1.