Fold operator answers to OQ-1/2/3 into the specs; refine OQ-4 to the one
remaining decision (ACME DNS-01 access). ADR-0012 supersedes ADR-0008.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Operator answers folded into the specs:
- OQ-3 VPN: ExpressVPN, cluster-controlled SINGLE shared in-cluster tunnel
(OpenVPN UDP / non-TCP), rules enforced outside the service. New ADR-0012
supersedes ADR-0008 (Gluetun-sidecar default dropped). Central kill-switch.
- OQ-1 WAN/edge: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
VLAN/VPN/services). Multi-WAN out of scope; segmentation + VPN in-cluster;
edge = NAT + manual port-forward. Gateway VIP resolved to Cilium L2
announcement. T-3.3 marked won't-do.
- OQ-2 storage: bulk media lives outside the cluster (backing TBD, non-blocking)
via a 'bulk' external-mount indirection; Plex metadata DB stays on Longhorn.
Split out a separate OQ-BKP for the off-cluster DR backup target (Phase 4).
- OQ-4 refined: wildcard record covers reachability but NOT ACME DNS-01 (needs
TXT-write access) and does not match *.home.* depth. Still OPEN: Cloudflare
API token (Option A) vs acme-dns delegation (Option B). T-2.4/T-2.5 blocked.
Updated: docs 00,01,03,04,08,09; ADR-0008/0012 + index; task board.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
jakman85andClaude Opus 4.8