On-Premises Microsoft Home Lab

Current Validated State

This public evidence folder summarizes reviewer-safe records from the private home-lab operations repository without exposing private repository links. Public claims use stable classifications instead of date-based proof labels. The direct-evidence/ folder contains sanitized direct artifacts for the current infrastructure claims.

Document

• Title: Jeremy Fontenot’s On-Premises Home Lab Documentation
• Filename: Jeremy-Fontenot-On-Premises-Home-Lab-Documentation.docx
• Download description: Download the Professional Home Lab Documentation (.docx)
• SHA-256: D7E81A06DCFBD2E91EB8F52A02BDC795AC5B7084A70F343233F1104CCD297BDB

Source Commits

• Website source commit at generation: effdbeb0ed8d632a0b0c93328cd593cf85c3eb46
• Home-lab source commit for direct evidence: fb6c286873285778d88d6d5cfde0b9bd00b96f36

Supported Public Claims

• Personal nonproduction lab hosted on Dell PowerEdge R710 with Proxmox VE 9.2.3.
• pfSense, DC01, WS01, and Linux01 are the primary lab VMs described by current records.
• Linux01 current supported placement is VLAN 30 at 10.10.30.20/24; older 10.10.20.x Linux01 evidence is historical.
• DC01 direct evidence supports Windows Server 2022, AD DS, DNS, DHCP, Group Policy Management, Global Catalog status, FSMO ownership, and DC01 IP.
• WS01 direct evidence supports Windows 10 Pro, domain membership, secure channel, and current network state.
• Linux01 direct evidence supports Ubuntu 26.04 LTS, kernel, VLAN 30, current IP/gateway/DNS, current-versus-historical address boundary, and directly proven domain integration indicators.
• Linux01 SSSD remediation is documented as remediated and validated for Linux01 only.
• Backup job configuration and retained backup counts are supported; all-recent-backups-succeeded, recurring disaster-recovery assurance, RTO, and RPO are not claimed.
• One isolated Linux01 restore drill is supported; it does not prove recurring restore assurance.

Direct Evidence Links

• Open direct Proxmox inventory
• Open direct backup configuration
• Open direct backup inventory
• Open direct restore validation
• Open direct DC01 validation
• Open direct WS01 validation
• Open direct Linux01 validation
• Open direct SSSD remediation validation

Limitations

Personal lab evidence does not represent employer production administration, client infrastructure ownership, enterprise scale, guaranteed uptime, full firewall assurance, or full security assurance. Timeout observations remain timeout observations. The restore evidence is one isolated Linux01 restore drill only and does not establish recurring restore assurance, RTO, RPO, SLA, or disaster-recovery readiness.

DC01 System and Role Validation

Claim supported

Direct DC01 inventory supports Windows Server, installed role, domain, Global Catalog, FSMO, and DC01 IP claims for the personal nonproduction lab.

Directly observed values

• Operating system: Microsoft Windows Server 2022 Standard Evaluation.
• Version: 10.0.20348.
• Build number: 20348.
• Active Directory Domain Services installed: AD-Domain-Services, InstallState 1.
• DNS Server installed: DNS, InstallState 1.
• DHCP Server installed: DHCP, InstallState 1.
• Group Policy Management installed: GPMC, InstallState 1.
• Domain DNS root: ad.jeremyfontenot.online.
• NetBIOS domain: JFAD.
• Domain controller host: DC01.ad.jeremyfontenot.online.
• DC01 IPv4 address: 10.10.20.10.
• Global Catalog: true.
• FSMO roles on DC01: PDC Emulator, RID Master, Infrastructure Master, Schema Master, and Domain Naming Master.

Source command or source object

Authenticated DC01 target-local inventory result objects: OperatingSystem, InstalledRolesFeatures, Domain, Forest, and DomainControllers.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

inventories/dc01-inventory-20260626-022543.json

Source file SHA-256

inventories/dc01-inventory-20260626-022543.json: F60A6DD8C9EE42E90B02B210B1B1A775F89E5C3DED26618B593DEE1362C6DE42

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed executing account, privileged group details, SIDs, object GUIDs, GPO GUIDs, unrelated installed features, event details, raw time values not needed for the claim, and unrelated command output. Retained DC01 IP because it is already part of the current public home-lab evidence boundary.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only.
• This artifact validates collected DC01 inventory values only.
• It does not prove ongoing Active Directory health, production readiness, security assurance, employer-system administration, or service availability beyond the captured inventory.

Validation date

2026-06-30

Classification

Validated

Linux01 SSSD Remediation Validation

Claim supported

Direct Linux01 remediation evidence supports a narrow Linux01-only SSSD responder/socket conflict remediation and post-remediation validation.

Directly observed values

• Initial condition: SSSD NSS, PAM, and PAC sockets were enabled and failed.
• Initial condition: SSSD was configured for direct responder activation through services = nss, pam.
• Initial condition: config_file_version = 2 was rejected by SSSD 2.12 config validation.
• Remediation action: removed only the rejected config_file_version = 2 directive.
• Remediation action: disabled conflicting NSS, PAM, and PAC sockets.
• Remediation action: restarted sssd.service.
• Remediation action: cleared failed-unit state.
• Post-remediation service state: sssd.service enabled and active/running.
• Post-remediation failed-unit state: zero failed units.
• SSSD configuration validation: passed.
• AD identity lookup: passed.
• New AD-authenticated SSH session: passed.
• Initial diagnostic SHA-256: 3CAD0FB73202D777D41DEE40D6F4D19D4019B9AD30552B37970B55A5CA5AB3BB.
• Original/backup configuration SHA-256: 23ACE1BECA5FF6F7D58200EFE054EA8E5A938E02F37FCE25B1CA1B5D2F05BD14.
• Post-remediation diagnostic SHA-256: FD55604BFB94487B86FBF631703FA995B9726471689385CCB2D277492AA7CBEE.

Source command or source object

Linux01 SSSD remediation evidence record.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

evidence/linux01-sssd-remediation-20260626-110159.md

Source file SHA-256

evidence/linux01-sssd-remediation-20260626-110159.md: 04773570FBE305353F5EB370B8F9629AC335E35A7BEF7151A2CBB98D7371CC49

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed diagnostic artifact paths, backup filesystem path, account context, raw command history, and implementation details not needed to support the remediation claim. Retained hashes because they are part of the validation evidence.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only.
• Linux01 only.
• This does not claim that all Linux domain-authentication paths were tested.
• This does not prove production readiness, employer-system administration, or recurring assurance.

Validation date

2026-06-30

Classification

Validated

Linux01 System, Network, and Domain Validation

Claim supported

Direct Linux01 inventory, Proxmox inventory, and source reconciliation evidence support Linux01 VM association, Ubuntu version, kernel, VLAN, IP addressing, DNS, gateway, current-versus-historical address boundary, and directly proven domain integration state.

Directly observed values

• Proxmox VM association: VM 400 name linux01, running.
• Operating system: Ubuntu 26.04 LTS.
• Kernel: Linux 7.0.0-22-generic.
• Architecture: x86_64.
• VLAN: 30, from current source reconciliation.
• Interface state: ens18 UP.
• Current IPv4 address: 10.10.30.20/24.
• Default gateway: 10.10.30.1.
• DNS server: 10.10.20.10.
• DNS domain: ad.jeremyfontenot.online.
• Current-versus-historical boundary: current Linux01 address is 10.10.30.20/24; older Linux01 10.10.20.x evidence is historical.
• Domain integration state: realmd reports ad.jeremyfontenot.online configured as a Kerberos member, server software active-directory, client software SSSD, and domain identity resolution returned resolved.
• Kerberos configuration: present.

Source command or source object

• Authenticated Linux01 target-local inventory result objects: Distribution, Kernel, IP addresses, Routes, DNS, realmd, Domain identity resolution, and Kerberos config.
• Proxmox read-only inventory object: virtualMachines[] entry for VM 400.
• Source reconciliation table for Linux01 VLAN and current-versus-historical address boundary.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

• inventories/linux01-inventory-20260626-084312.json
• inventories/proxmox-inventory-20260626-010601.json
• evidence/home-lab-source-reconciliation-20260626-012606.md

Source file SHA-256

• inventories/linux01-inventory-20260626-084312.json: 75F82AF4882FA9C869C78C1AC127C5D4F37C5CB62F4E8894361A352695EFC40D
• inventories/proxmox-inventory-20260626-010601.json: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D
• evidence/home-lab-source-reconciliation-20260626-012606.md: 2D377A7A6703F8C3C5FBB77AA093569806DDB7939CFA88FD6A0ECF801484C3EE

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed executing account, machine identifiers, link-local IPv6 address, raw boot/session identifiers, unrelated package/service details, unnecessary filesystem paths, and distro metadata not needed for the public claim.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only.
• Domain integration is limited to the directly observed realmd, SSSD client, Kerberos config, and identity-resolution indicators.
• This artifact does not claim that all Linux domain-authentication paths were tested.
• Timeout or listener observations are not complete firewall validation.

Validation date

2026-06-30

Classification

Validated

Proxmox Backup Configuration

Claim supported

Direct Proxmox backup configuration evidence supports the configured weekly snapshot job for primary lab VMs.

Directly observed values

• Backup job ID: backup-critical-lab-vms.
• Enabled state: enabled.
• Schedule: Sunday 02:00 (sun 02:00).
• Mode: snapshot.
• Compression: zstd.
• Retention: keep-last=4.
• Storage target: backup-hdd.
• Target VMs: 100, 200, 300, and 400.

Source command or source object

• Proxmox read-only inventory object: backupJobs[].
• Backup and restore validation text: backup job block with prune/retention details.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

• inventories/proxmox-inventory-20260626-010601.json
• evidence/home-lab-backup-restore-validation-20260629.txt

Source file SHA-256

• inventories/proxmox-inventory-20260626-010601.json: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D
• evidence/home-lab-backup-restore-validation-20260629.txt: 4637E848C9B318B8C74BB9C6E4569B3CC03E6686CE64FA367CF6DEC05FA52E13

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed scheduling metadata not needed for the claim, command context, host details, and any unrelated storage, VM, or task information.

Limitations

• Personal nonproduction home lab only.
• Configuration presence does not prove that every recent backup task succeeded.
• This artifact does not claim successful recent backups for VMs 200 or 300 because no direct recent OK task output is published here.
• This artifact does not prove restore integrity, RTO, RPO, recurring restore assurance, or disaster-recovery readiness.

Validation date

2026-06-30

Classification

Configured

Proxmox Backup Inventory

Claim supported

Direct backup inventory evidence supports active backup-hdd storage, retained archive presence by VM count, and the boundary that archive presence is not the same as recurring restore assurance.

Directly observed values

• Storage: backup-hdd.
• Storage path retained as claim-relevant evidence: /mnt/pve/backup-hdd.
• Storage status from current inventory: type dir, content backup, total 982,809,350,144 bytes, used 172,812,951,552 bytes, available 759,996,993,536 bytes.
• Backup validation storage view: 916 GB size, 127 GB used, 743 GB available, 15 percent used.
• Retained backup counts: VM 100 count 4, VM 200 count 4, VM 300 count 4, VM 400 count 4.
• No successful recent per-VM vzdump task status is claimed from this artifact.
• Operational limitation retained: Proxmox thin-pool risk is visible. The retained storage source directly shows a 428 GB thin pool and provisioned VM/snapshot thin volumes that exceed that physical thin-pool size. The requested auto-extension warning is retained as a limitation boundary; the retained source set inspected for this publication does not include a separate thin-pool auto-extension configuration dump.

Source command or source object

• Proxmox read-only inventory object: storage[].
• Backup and restore validation text: backup counts and storage block.
• Retained public storage evidence: Proxmox storage status, logical volume, and thin-pool usage sections.

Source repository

• fontenotjeremy71-hub/jeremy-homelab-ops
• fontenotjeremy71-hub/jeremyfontenot, for the retained older public storage limitation artifact

Source commit

• Operations source: fb6c286873285778d88d6d5cfde0b9bd00b96f36
• Website retained public evidence source: 5813445f3cc828e2146773299c47967292da7fd5

Source path

• inventories/proxmox-inventory-20260626-010601.json
• evidence/home-lab-backup-restore-validation-20260629.txt
• evidence-library/projects/on-prem-home-lab/validated-2026-06-21/text/proxmox-storage-validation.txt

Source file SHA-256

• inventories/proxmox-inventory-20260626-010601.json: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D
• evidence/home-lab-backup-restore-validation-20260629.txt: 4637E848C9B318B8C74BB9C6E4569B3CC03E6686CE64FA367CF6DEC05FA52E13
• evidence-library/projects/on-prem-home-lab/validated-2026-06-21/text/proxmox-storage-validation.txt: 7F069AA31390D90D99F0000D6F6236A2B60F5D28F061668C0BBD5054FA93741F

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed PIDs, unrelated filesystems, device identifiers not needed for the claim, snapshot parent names, raw command history, and backup archive filenames. Retained the backup storage path because it is the public claim being validated.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only.
• Backup archive count does not prove backup integrity.
• No claim is made that all recent backup tasks succeeded.
• The thin-pool warning is an operational limitation and is not framed as a failed backup or failed restore.
• No RTO, RPO, production disaster-recovery readiness, or recurring restore assurance is claimed.

Validation date

2026-06-30

Classification

Documented / Limitation

Proxmox Platform Inventory

Claim supported

Direct Proxmox inventory supports the personal nonproduction lab platform claim for Proxmox VE, primary VM IDs, VM names, running state, allocated vCPU, memory, disk, bridge placement, guest-agent state, and Linux01 VLAN tag where captured.

Directly observed values

• Proxmox VE version: 9.2.3.
• Proxmox kernel: Linux 7.0.12-1-pve.
• VM 100: pfsense-fw, running, 2 vCPU, 4 GB memory, 32 GB disk, bridges vmbr0 and vmbr1, guest agent not configured and not responding.
• VM 200: dc01, running, 2 vCPU, 4 GB memory, 80 GB disk, bridge vmbr1, guest agent not configured and not responding.
• VM 300: ws01, running, 2 vCPU, 4 GB memory, 80 GB disk, bridge vmbr1, guest agent not configured and not responding.
• VM 400: linux01, running, 2 vCPU, 2 GB memory, 40 GB disk, bridge vmbr1, guest agent configured and responding.
• Linux01 VLAN tag: 30, from the retained source reconciliation record.

Source command or source object

• Proxmox read-only inventory object: version, node.kernel, virtualMachines[], and storage[].
• Source reconciliation object: current command/API evidence row for Linux01 Proxmox VM tag.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

• inventories/proxmox-inventory-20260626-010601.json
• evidence/home-lab-source-reconciliation-20260626-012606.md

Source file SHA-256

• inventories/proxmox-inventory-20260626-010601.json: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D
• evidence/home-lab-source-reconciliation-20260626-012606.md: 2D377A7A6703F8C3C5FBB77AA093569806DDB7939CFA88FD6A0ECF801484C3EE

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed node uptime, repository ID, host resource details not needed for the public claim, snapshot parent names, raw paths unrelated to the platform claim, and any fields not required to prove the listed inventory values.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only; this does not prove ongoing availability.
• Proxmox inventory does not prove guest operating-system health, pfSense firewall policy, Active Directory health, backup restore integrity, or Windows service state.
• Linux01 VLAN tag is supported by the reconciliation source, not by the VM list object alone.

Validation date

2026-06-30

Classification

Validated

Proxmox Restore Validation

Claim supported

Direct restore validation evidence supports one isolated Linux01 restore drill from source VM 400 to temporary VM 401.

Directly observed values

• Source VM: 400.
• Temporary restore VM: 401.
• Restored disk size boundary: VM 400 boot disk shown as 40 GB in the retained restore validation source.
• Temporary VM network isolation: temporary VM network isolated before boot.
• Guest validation: Ubuntu 26.04 LTS boot and QEMU Guest Agent response were validated in the retained restore evidence.
• Cleanup: temporary VM 401 was shut down and purged successfully.
• The source set inspected for this publication does not include a retained per-command restore transcript with archive filename, progress percentage, or literal final TASK OK line; those details are therefore not claimed here.
• Operational limitation retained: Proxmox thin-pool risk remains visible and is not framed as a failed restore.

Source command or source object

Backup and restore validation text: VM state and restore drill sections.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

evidence/home-lab-backup-restore-validation-20260629.txt

Source file SHA-256

evidence/home-lab-backup-restore-validation-20260629.txt: 4637E848C9B318B8C74BB9C6E4569B3CC03E6686CE64FA367CF6DEC05FA52E13

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed PIDs and retained only the VM IDs, restore scope, network isolation, guest identity, guest-agent response, and cleanup outcome needed to support the public claim.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only.
• One isolated Linux01 restore drill only.
• No recurring restore assurance.
• No RTO or RPO claim.
• No disaster-recovery readiness, SLA, production, or employer-system claim.
• Thin-pool warnings are operational limitations and are not evidence of a failed restore.

Validation date

2026-06-30

Classification

Tested

WS01 System and Domain Validation

Claim supported

Direct WS01 inventory and Proxmox inventory support the WS01 system, VM association, domain membership, and network-state claims for the personal nonproduction lab.

Directly observed values

• Proxmox VM association: VM 300 name ws01, running.
• Windows edition: Microsoft Windows 10 Pro.
• Windows version: 10.0.19045.
• Windows build: 19045.
• Domain membership: WS01 is part of domain ad.jeremyfontenot.online.
• Secure channel result: true.
• Network interface: Ethernet.
• IPv4 address: 10.10.20.100.
• Default gateway: 10.10.20.1.
• DNS server: 10.10.20.10.
• DHCP enabled: true.
• DHCP server: 10.10.20.10.
• Current supported OS reconciliation: Windows 10 Pro 10.0.19045 is the supported current value in the retained WS01 inventory.

Source command or source object

• Authenticated WS01 target-local inventory result objects: OperatingSystem, NetworkConfiguration, DomainMembership, and SecureChannel.
• Proxmox read-only inventory object: virtualMachines[] entry for VM 300.

Source repository

fontenotjeremy71-hub/jeremy-homelab-ops

Source commit

fb6c286873285778d88d6d5cfde0b9bd00b96f36

Source path

• inventories/ws01-inventory-20260626-012952.json
• inventories/proxmox-inventory-20260626-010601.json

Source file SHA-256

• inventories/ws01-inventory-20260626-012952.json: 1438FA0F72F241E2613C5D35B797492FFC754B0E818A74154DE38DD74082A6B1
• inventories/proxmox-inventory-20260626-010601.json: D652D1EF753E14242C07F84F19FBF09F642F07C3B09CFE2E98AA7F2B176ADE3D

Public artifact SHA-256

Recorded in evidence-library/integrity/evidence-hashes.json for this artifact path. The self-hash is recorded outside this file so the digest does not invalidate itself.

Sanitization performed

Removed executing account, local administrator membership, SIDs, GUIDs, group policy raw details, software inventory, unrelated services, event data, and local profile or path information.

Limitations

• Personal nonproduction home lab only.
• Captured-state evidence only.
• This artifact validates WS01 inventory values and domain membership state only.
• It does not claim production support, employer-system administration, complete endpoint hardening, or complete application/service validation.

Validation date

2026-06-30

Classification

Validated

Redaction Log

No credentials, private keys, tokens, cookies, or secrets were copied. Public summaries avoid private repository links and retain only reviewer-safe claim context.

For the direct evidence artifacts, usernames, executing accounts, MAC addresses, UUIDs, VM generation IDs, UPIDs, PIDs, SIDs, internal object GUIDs, absolute local Windows user paths, unnecessary root paths, unrelated installed features, unrelated command history, unnecessary timestamps, and snapshot parent names were removed or omitted where they were not required to support the stated public claim.

The Proxmox thin-pool warning is retained as an operational limitation. It is not framed as a failed restore or infrastructure failure.

Backup and Restore Validation

Status

Partially validated by retained June 24 documentation. No restore test was repeated during the 2026-06-26 read-only operations run.

Current Evidence

Read-only Proxmox inventory observed an enabled scheduled backup job:

• Job ID: backup-critical-lab-vms
• VMs: 100,200,300,400
• Storage: backup-hdd
• Schedule: sun 02:00
• Mode: snapshot
• Compression: zstd

Storage inventory observed backup storage named backup-hdd at /mnt/pve/backup-hdd.

The June 24 IP-address-documented portfolio documentation records isolated startup restore checks for:

• WS01 restored temporarily as VM 500, with the NIC link down before startup.
• Linux01 restored temporarily as VM 600, with the NIC link down before startup.

The current Proxmox inventory no longer shows VM 500 or VM 600, which is consistent with the documentation stating both temporary restore VMs were removed after validation.

Required Future Validation

Before claiming recurring restore assurance, perform an approved fresh restore validation that documents:

• Exact VM or test restore target
• Backup file selected
• Restore command or UI action
• Network isolation approach
• Validation checks
• Cleanup steps
• Rollback procedure
• Evidence proving successful boot or file-level recovery

Claim Boundary

The current operations repository validates backup job configuration visibility and retains documentation of June 24 isolated startup restore checks. It does not validate current backup archive integrity, recurring restore success, RTO, RPO, or disaster-recovery readiness.

Centralized Logging Expansion Change Plan

Status

Planned. Approval required before implementation.

Current State

June 24 documentation records pfSense forwarding selected system, firewall, authentication, VPN, and gateway events to Linux01 at 10.10.30.20:514, with Linux01 rsyslog listeners and alert-match logging. Current Proxmox metadata validates Linux01 is running on VLAN 30 and QEMU guest agent is responding.

The June 26 authenticated Linux01 target-local inventory validates rsyslog runtime state from inside the guest. Linux01 reports rsyslog active, TCP and UDP 514 listening on 10.10.30.20, remote collector configuration under /etc/rsyslog.d/10-remote-collector.conf, pfSense alert file configuration under /etc/rsyslog.d/05-pfsense-alerts.conf, and rsyslog logrotate configuration under /etc/logrotate.d/rsyslog.

Evidence

• Proxmox current API: Linux01 VM 400 running, tag=30, guest agent responding.
• DNS current command: linux01.ad.jeremyfontenot.online resolves to 10.10.30.20.
• June 24 IP-address-documented documentation: pfSense-to-Linux01 rsyslog forwarding and alert logging documented.
• Current reachability check: TCP 514 from the current client path timed out and is not treated as rsyslog service failure.
• inventories/linux01-inventory-20260626-020257.json: SSH from the management execution path timed out; guest-side rsyslog state was NOT TESTED.
• inventories/linux01-inventory-20260626-084312.json: authenticated target-local Linux01 inventory validates rsyslog service/listener state, route/DNS state, AD integration indicators, disk capacity, and logrotate summary.
• evidence/linux01-local-inventory-validation-20260626-035220.md: sanitized evidence for Linux01 target-local inventory import and validation.

Target State

Expand centralized logging beyond pfSense by adding documented, least-privilege log forwarding or collection for Windows and Proxmox sources without weakening existing firewall policy.

Candidate target design, pending implementation approval:

• Keep Linux01 as the primary syslog receiver because target-local evidence now confirms available root filesystem capacity, active rsyslog listeners on 10.10.30.20:514 for TCP and UDP, and rsyslog log rotation. UFW source restrictions still require a clearer privileged summary before any new source is added.
• Evaluate Windows Event Forwarding for DC01 and WS01 with DC01 as the likely Windows Event Collector only if existing domain policy and firewall posture support it safely. Do not make DC01 a collector until a separate change plan covers subscription type, source computers, event channels, retention, and rollback.
• Evaluate Proxmox remote syslog forwarding to Linux01 or another approved receiver only after documenting source IP, destination IP, protocol, port, and retention.
• Keep Linux local logs on Linux01 in local journald/rsyslog paths unless an approved monitoring platform is introduced.

Exact Systems

• Linux01 VM 400
• DC01 VM 200
• WS01 VM 300
• Proxmox host 192.168.0.242
• pfSense VM 100

Exact Commands

Discovery and planning only until approved:

pwsh -NoProfile -File .\scripts\linux\Get-LinuxReadOnlyInventory.ps1
pwsh -NoProfile -File .\scripts\active-directory\Invoke-DC01LocalReadOnlyCollection.ps1
pwsh -NoProfile -File .\scripts\windows-server\Invoke-WS01LocalReadOnlyCollection.ps1

Implementation commands are intentionally not authorized in this change plan. Linux01 rsyslog state has been validated, but Windows Event Forwarding, Proxmox logging state, pfSense sender configuration, and any firewall or GPO requirements still need a dedicated approved implementation plan.

Target-local validation commands prepared for the next inventory pass:

run_id="$(date -u +%Y%m%d-%H%M%S)"
bash ./Invoke-Linux01LocalReadOnlyCollection.sh "/tmp/linux01-inventory-${run_id}.json"

Required Privileges

• Read-only collection: existing approved sessions.
• Any logging configuration change: administrative privileges on the target system and explicit approval.

Network Requirements

No firewall openings are approved by this plan. Any proposed log path must identify source, destination, protocol, port, and existing firewall state before implementation.

Expected network review before implementation:

• pfSense to Linux01 syslog path: verify existing source restriction, protocol, and port from configuration evidence before changing anything.
• DC01 and WS01 to collector: identify whether Windows Event Forwarding uses existing domain/Kerberos paths or requires new firewall scope. Any firewall or GPO change requires a dedicated approved plan.
• Proxmox to Linux01 syslog: document management-network source, Linux VLAN destination, routing path, and firewall requirements before implementation.

Security Impact

Positive if implemented carefully: stronger audit trail and troubleshooting visibility. Risk if overbroad: excessive log exposure, sensitive log retention, or unnecessary inter-network access.

Security controls required in the implementation plan:

• Exclude credentials, private keys, Kerberos tickets, certificate private material, and sensitive raw log excerpts from repository evidence.
• Prefer source-restricted firewall rules over broad subnet acceptance if any new rules are approved.
• Document whether logs are unauthenticated syslog, authenticated Windows Event Forwarding, or locally collected files.
• Define integrity expectations honestly; plain syslog improves visibility but does not provide strong transport integrity by itself.

Service-Impact Risk

Low for discovery. Medium for configuration changes because logging service reloads or firewall changes could disrupt visibility or access if done incorrectly.

Implementation must avoid service restarts unless the approved plan explicitly requires them. Prefer configuration validation and reload-only workflows where technically appropriate.

Retention, Rotation, and Capacity

Linux01 authenticated inventory currently supports:

• Root filesystem capacity: 19 GiB total, 13 GiB available, 29 percent used.
• Current rsyslog listener state: TCP and UDP 514 listening on 10.10.30.20.
• Current rsyslog destination templates/configuration: /var/log/remote/%FROMHOST-IP%/messages.log and /var/log/remote/pfsense-alerts.log are configured.
• Current logrotate policy for rsyslog-managed files: weekly rotation, four rotations, compression, missing files tolerated, empty files skipped.
• Disk-use alert threshold. Initial planning threshold: warning at 80 percent used, critical at 90 percent used, pending Jeremy approval.
• Failure behavior if Linux01 is unavailable: sources should continue local logging and must not block authentication, DNS, DHCP, routing, or VM operation.

Alerting

Alerting remains planned. Candidate non-invasive alerts after receiver validation:

• Linux01 log filesystem above threshold.
• rsyslog service inactive.
• No pfSense log receipt within an expected interval.
• Proxmox backup job failure or missing latest backup.
• Windows Event Forwarding subscription source inactive, if WEF is later approved.

Validation

• Confirm log sender service state.
• Confirm listener state on Linux01.
• Send one controlled non-sensitive test event.
• Confirm event arrives in the expected file or index.
• Confirm no credentials or private data are written to repository evidence.

Rollback

• Revert only the logging configuration added by the approved implementation.
• Restore any exported pre-change configuration where applicable.
• Restart/reload only affected logging services if required and approved.

Evidence Capture

• Timestamped pre-change inventory.
• Sanitized configuration diff or export.
• Exact command transcript with secrets omitted.
• Controlled test-event result.
• Rollback verification.

Approval Requirement

Explicit Jeremy approval is required before any logging configuration, firewall, service, package, or scheduled-task change.

Claim Boundary

This plan is implementation-ready documentation only. It does not implement centralized logging expansion, change firewall policy, install software, restart services, or modify any infrastructure system. Linux01 rsyslog receiver state is now validated by target-local inventory; additional sources and alerting remain planned until separately approved and implemented.

Home Lab Inventory and Validation Evidence

• Timestamp: 2026-06-26T01:06:01.2273166-05:00
• Source workstation: DESKTOP-MR3F9A1
• Repository: %USERPROFILE%\Documents\projects\jeremy-homelab-ops
• Execution mode: read-only discovery, inventory, and validation
• Infrastructure configuration changes: 0

Commands and Access Paths

• Proxmox inventory: mcp__home_lab read-only Proxmox tools.
• Repository validation: pwsh -NoProfile -File .\tests\Test-RepositoryStructure.ps1 -WriteEvidence
• Connectivity validation: pwsh -NoProfile -File .\scripts\monitoring\Test-HomeLabConnectivity.ps1 -TimeoutMilliseconds 1000
• DNS validation: Resolve-DnsName ad.jeremyfontenot.online -Server 10.10.20.10
• Route validation: route.exe print -4
• Domain discovery: nltest /dsgetdc:ad.jeremyfontenot.online, nltest /dclist:ad.jeremyfontenot.online, nltest /sc_query:JFAD
• Module availability: Get-Command Get-ADDomain, Get-Command Get-GPO, Get-Command Get-DhcpServerv4Scope, Get-Command Get-DnsServerZone

Validated Results

Warnings and Inconclusive Results

Claim Boundary

This evidence records read-only repository validation, Proxmox connector inventory, local route inspection, DNS resolution, and bounded TCP reachability checks. It does not validate pfSense configuration, firewall policy, NAT policy, VPN configuration correctness, Active Directory health, DNS zone health, DHCP scope health, Group Policy processing, WS01 domain relationship, backup restore integrity, or administrative access to Windows guests.

Timeouts, module absence, and nltest failures are recorded observations only. They are not proof that the corresponding infrastructure components are offline, misconfigured, or unavailable.

Home Lab Source of Truth

Status

Current as of the 2026-06-26 read-only reconciliation run.

Source Precedence

1. Current command output, API output, guest-agent output, or authenticated system query.
2. New timestamped evidence collected during this run.
3. Current jeremy-homelab-ops inventories and evidence.
4. Current main branch of fontenotjeremy71-hub/jeremyfontenot.
5. June 24, 2026 IP-address-documented portfolio documentation.
6. June 21, 2026 curated historical evidence.
7. Currently deployed website content.
8. Old prompts, summaries, assumptions, or undocumented memory.

Current Supported Architecture

Historical or Stale Values

Claim Boundary

This file corrects explanatory documentation using current evidence. It does not modify historical evidence and does not claim live guest OS internals unless current command output or explicitly cited retained evidence supports the claim.

The June 26 target-local workflow imported authenticated DC01 evidence in inventories/dc01-inventory-20260626-022543.json and evidence/dc01-local-inventory-validation-20260626-022811.md. It imported authenticated WS01 evidence in inventories/ws01-inventory-20260626-012952.json and evidence/ws01-local-inventory-validation-20260626-033405.md. It also imported authenticated Linux01 evidence in inventories/linux01-inventory-20260626-084312.json and evidence/linux01-local-inventory-validation-20260626-035220.md.

Home Lab Source Reconciliation Evidence

• Timestamp: 2026-06-26T01:26:06.6980689-05:00
• Source workstation: DESKTOP-MR3F9A1
• Operations repository: %USERPROFILE%\Documents\projects\jeremy-homelab-ops
• Portfolio repository: %USERPROFILE%\Documents\projects\jeremyfontenot
• Deployed page inspected: https://jeremyfontenot.online/on-prem-home-lab.html
• Infrastructure changes made: 0

Current Command/API Evidence

Conflicts

Claim Boundary

Current Proxmox API output and current DNS/RDP checks are treated as current observed state. Portfolio and DOCX records are retained as documentation evidence where live command output cannot validate guest internals from this client path. Historical evidence is not rewritten.

Linux01 SSSD Remediation

Summary

• Target: Linux01
• Date: June 26, 2026
• Domain: ad.jeremyfontenot.online
• Classification: SSSD responder activation conflict
• Result: Remediated and validated

Initial Condition

• sssd-nss.socket, sssd-pam.socket, and sssd-pac.socket were enabled and failed.
• /etc/sssd/sssd.conf used direct responder activation with services = nss, pam.
• config_file_version = 2 was rejected by SSSD 2.12 configuration validation.
• Initial diagnostic: artifacts/target-local-collection/Linux01/linux01-sssd-diagnostic-20260626-094322.json
• Initial SHA-256: 3CAD0FB73202D777D41DEE40D6F4D19D4019B9AD30552B37970B55A5CA5AB3BB

Backup

• Backup: /root/sssd.conf.pre-remediation-20260626-095429.bak
• Original and backup SHA-256: 23ace1beca5ff6f7d58200efe054ea8e5a938e02f37fce25b1ca1b5d2f05bd14

Remediation

1. Removed the rejected config_file_version directive.
2. Confirmed sssctl config-check completed with zero issues.
3. Disabled the NSS, PAM, and PAC SSSD socket units.
4. Restarted sssd.service.
5. Cleared the historical failed-unit state.

Validation

• sssd.service is enabled, active, and running.
• No failed systemd units remain.
• All three responder sockets report disabled.
• AD identity lookup succeeded.
• A new AD-authenticated SSH session succeeded.
• Post-remediation diagnostic: artifacts/target-local-collection/Linux01/linux01-sssd-diagnostic-20260626-110159.json
• Post-remediation SHA-256: FD55604BFB94487B86FBF631703FA995B9726471689385CCB2D277492AA7CBEE

Final Status

Linux01 is operating normally using direct SSSD responder activation.