ADR-0008 puts the family's credentials, photos and documents inside the estate — settle the continuity story before building it

[Gerrrt]

ADR-0008:45-49 places, on one mini PC on VLAN 99:

Vaultwarden, Immich, Paperless-ngx and Home Assistant, behind Caddy and step-ca for certificates, with AdGuard Home, ntfy and Homepage alongside. Everything here holds data whose loss or exposure genuinely hurts.

The trust reasoning is right, and this issue isn't an argument against the placement. What the ADR doesn't weigh is who can reach that data when I can't — and per #102 none of it is built yet, which is the only reason this is cheap to settle. It gets expensive the day the data moves in.

The shape of the problem

That tier ends up holding the password manager (the keys to every other account), the photo archive, and the scanned documents. It sits behind self-hosted TLS from an internal CA, on a single mini PC, on a VLAN that exists because pfSense says so.

If that box is down and I'm unavailable, the credentials needed to recover everything else are behind the thing that broke. And because step-ca issues the certs, a browser won't complete the handshake even if the box is limping — so the failure isn't graceful, it's a wall. Recovery requires exactly the skills the person doing the recovering doesn't have.

What this asks for

Not a redesign — a stated constraint, in ADR-0008 or a superseding ADR: which sensitive-tier services must stay reachable when the estate is down, and what the out-of-estate path is for each.

Working answers:

• Vaultwarden — either the family vault lives in hosted Bitwarden (same clients; Vaultwarden keeps my own use) or the emergency kit exists on paper, with emergency access configured and tested from the other person's own device. The age key has one holder and one copy #106 is this same shape one layer down: one key, one holder.
• Immich and Paperless-ngx — a copy outside the estate. These are the only two categories here that can't be re-bought or re-derived from the hardware.
• step-ca — nothing a non-technical person must reach in an emergency should depend on a private CA, or on its expiry.
• Home Assistant — worth a separate thought if it ever holds locks or heating. Then it's fail-closed on a physical door, which is a different severity class from a dead dashboard.

That constraint changes the build order, which is the practical reason to decide it now: satisfying it before the data is in there is a configuration choice, and afterwards it's a migration.