Homelab status,
in the open.

Summary

The project moved from pre-design into its first working public services. The Canada-side VPN architecture was clarified, the public domain was activated, and two static sites were deployed through a Git-driven Cloudflare Pages workflow.

Architecture and planning

• Produced a phased Proxmox and Canada–China connectivity design.
• Defined phase one as individual China devices connecting to a Canada-hosted tunnel endpoint for Canadian Internet egress.
• Deferred site-to-site routing until a Ubiquiti gateway can be installed locally in China during a future visit.
• Preserved a core reliability rule: homelab failures must not interrupt either household's ordinary local Internet.

Documentation and operations

• Added AGENTS.md as the operating context for future Codex and automation sessions running from the Proxmox management VM.
• Added docs/recommendations.md to consolidate the prioritized implementation backlog, reliability guidance, and follow-up decisions.
• Added docs/runbooks/google-cloudflare-access.md with sanitized Google OAuth and Cloudflare Access setup, validation, rotation, and recovery procedures.
• Kept credentials, personal account lists, Client IDs designated private, Client Secrets, and recovery material outside the public repository.
• Established the Wiki as a daily project changelog: multiple pushes on the same Vancouver calendar day update one consolidated Daily Status Report.
• Prepared a SER8 installation runbook covering factory Windows preservation, hardware validation, the Proxmox pre-wipe gate, and management VM bootstrap.
• Selected a clean-reinstall Windows recovery strategy: validate the hardware and preserve activation, driver, and system inventory before the Proxmox wipe, without retaining a full factory disk image.

Canada LAN address plan

The SER8 reservation is planned but will not become active until the hardware arrives. The gateway address, DHCP range, and VLAN inventory still need to be recorded before the Proxmox host is commissioned.

Public web foundation

• Registered and activated mzliu.ca with Cloudflare.
• Built a dependency-free static portal with a locally stored hero image.
• Deployed the portal from GitHub using Cloudflare Pages.
• Connected the apex domain to the production Pages deployment.
• Verified that GitHub pushes trigger automatic production deployments.

Pictures service

• Published a dedicated gallery at pics.mzliu.ca.
• Added a responsive grid with 16 pictures per page.
• Added a full-screen viewer with previous/next and keyboard navigation.
• Protected the gallery with Cloudflare Access and Google authentication.
• Restricted authorization to explicitly approved accounts.
• Planned the next stage: migrate pics.mzliu.ca to Immich hosted on the SER8 after storage, backups, authentication, and rollback are ready.

Remote connectivity roles

• The parents' devices will use Shadowrocket with a local ruleset: Chinese destinations go DIRECT through China Unicom, while non-Chinese destinations go through PROXY to a Canada-hosted VLESS server.
• VLESS will run in a dedicated Proxmox-managed VM and provide Canadian Internet egress without access to the Canada LAN or administration services.
• WireGuard is a separate Michael-only management path into the Canada LAN. The parents' devices will not receive WireGuard access.

Service namespace

Security posture

The public portal remains independent of the future SER8, while private or administrative services will receive individual access controls. Credentials, recovery material, public WAN addresses, and detailed private topology are excluded from this public wiki. The basic RFC 1918 LAN plan above is intentionally published as project documentation.