Philosophy
v3.0 is a clean-slate rebuild with institutional knowledge from v2. Every decision is deliberate, documented, and built toward future goals (Kubernetes, GitOps, HA). Where v2 evolved organically, v3 is designed intentionally.Design Principles
| Principle | Applied In v2? | v3 Commitment |
|---|---|---|
| Bare-metal NAS separation | No (TrueNAS as VM) | Dedicated NAS host |
| Proxmox OS redundancy | No (single NVMe) | Mirrored NVMe boot |
| Proper VLAN segmentation with rules | Partial (no FW rules) | Full inter-VLAN firewall |
| UPS protection | No | Required before power-on |
| Kubernetes-ready architecture | No | Designed for future k3s |
Phased Build Approach
Phases are sequential. Each phase has clear entry criteria (what must be true before starting) and exit criteria (what must be true to consider the phase done). Do not skip phases.Phase 0 — Procurement
Hardware acquisition and physical rack build
Phase 1 — Network
VLANs, firewall rules, and network foundation
Phase 2 — NAS
Unraid build and storage commissioning
Phase 3 — Proxmox
Proxmox cluster and core VM infrastructure
Phase 4 — Services
Service migration from v2 to v3
Phase 5 — Hardening
Operational hardening and validation
Phase 6 — Kubernetes
Future k3s deployment (sandbox first)
Phase Status
| Phase | Status | Notes |
|---|---|---|
| Phase 0 | ✅ Procurement complete | Physical build in progress |
| Phase 1 | 🔄 Planned | Network foundation |
| Phase 2 | 🔄 Planned | NAS commissioning |
| Phase 3 | 🔄 Planned | Proxmox cluster setup |
| Phase 4 | 🔄 Planned | Service migration |
| Phase 5 | 🔄 Planned | Operational hardening |
| Phase 6 | 📋 Future | Kubernetes learning environment |
Entry and Exit Criteria
Every phase follows this structure:Migration Strategy
v2 services stay untouched while v3 is built on new infrastructure. During Phase 4, services are migrated gradually per-service by flipping AdGuard DNS rewrites. No big-bang cutover.
- v2 services currently live on 192.168.20.0 (Trusted VLAN)
- v3 services are built on 192.168.30.0 (Services VLAN)
- Services run in parallel until v3 is validated
- DNS rewrites flip from v2 IPs to v3 IPs per-service
- Instant rollback by reversing the DNS rewrite