[Gerrrt]

Closes #94.

oracle was checked before the question was answered, and the check changed the
question. It has run the Lemmiwinks wiki and its Postgres since 2025-11-12 —
ADR-0011
names the host and makes it the middle documentation tier, and
prometheus/targets/blackbox.yaml has been probing it twice on host: oracle
the whole time. Meanwhile three places said it had no role: the host table in
architecture.md, the VLAN 99 notes in network.md, and backup-firewall.sh's
header ("It has no role (#94)"). check_docs.py reads that architecture row for
the word "Alloy" and for a stacks/ path and never for what it claims the host
does, which is how a wrong sentence sat next to a checked one for months.

The decision — ADR-0015

oracle stays powered and takes the small off-host jobs: work whose whole value
is that it is not running on the monitoring host.

Job	State
The wiki and its Postgres	Running since 2025-11-12 — ratified, not newly assigned
The off-host copy of the firewall export	Running since 2026-09-03 (#92)
Alloy agent	Deployed 2026-08-30; #94 asked for this "either way"
The off-host copy of the volume backup sets	New — the remaining half of #92
The dead man's switch watcher	New — #67

Both new jobs are decided here and built under their own issues; nothing is
implemented by this PR.

The volume sets fit and are already in the right shape to leave: a set is 867 MB
of five .tar.gz.age archives, KEEP is 7, so 6.1 GB against 67 GB free, and
backup-volumes.sh encrypts to the .sops.yaml recipient before anything
touches the disk — so the copy on oracle has the property the firewall copy
has, ciphertext with no key on the far side.

Rejected, with reasons in the ADR: a second age recipient (the runbook
answers that gap with an offline key and a second person, and a private key
there would put the backups and the means to open them on one disk); ADR-0007's
second stack and ADR-0008's sensitive tier (two cores, 4 GB, 5400 rpm);
bringing wlp22s0 up to give the watcher an independent notification path,
which is tempting and dual-homes a VLAN 99 host onto an untrusted segment; and
switching it off, which was never really on offer.

Honest limits, stated in the ADR

• Off-host is not off-site and here it is not even off-shelf. Both laptops share
  a shelf, a switch, a mains and a roof.
• The watcher catches a silently dead notification path — No dead man's switch on the notification path #67's actual
  complaint — and cannot report a mains cut, because the switch between the two
  laptops has no battery (Rack the shelf switch in U4 — buy it with the UPS pack #110). Its silence during a power cut is expected
  behaviour, and whoever writes that runbook should say so.

Also here

• Corrections to architecture.md, network.md and backup-firewall.sh's
  header, which all described a machine with no role.
• Roadmap: Decide what oracle is for #94 moves to Done; No dead man's switch on the notification path #67 and Rehearse the firewall restore on trinity #92 pick up the part this settles.
• A new gap, filed rather than fixed: Put the wiki on oracle into the repository, and back up its database #251 — the wiki is not in this repository
  (hand-run containers, anonymous content volume, nothing backing up either
  volume, /etc/wiki/.db-secret at mode 664).

Every figure in the ADR was measured on the host on 2026-09-03, not quoted from
the inventory that was wrong about this machine once already. make validate
passes.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

ADR-0015 includes an ambiguous/incorrect repository path reference for the blackbox targets file that should be corrected for documentation accuracy.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR clarifies and formalizes oracle’s role in the HomeLab documentation by introducing ADR-0015 (“off-host jobs”) and correcting multiple docs/scripts that previously described oracle as having no/unclear purpose, despite already hosting the wiki and being probed by blackbox.

Changes:

• Add ADR-0015 documenting the decision to keep oracle powered and assign it the “small off-host jobs” role.
• Update existing docs (architecture.md, network.md, roadmap.md) to reflect oracle’s actual/current responsibilities and related follow-up gaps/issues.
• Adjust backup-firewall.sh header comments to align with the new declared role.

File summaries

File	Description
scripts/backup-firewall.sh	Updates header commentary to reflect oracle’s declared “off-host jobs” role per ADR-0015.
docs/roadmap.md	Moves #94 to Done and updates roadmap context to reference ADR-0015; adds #251 gap tracking.
docs/network.md	Updates VLAN 99 host role/notes for oracle (wiki + off-host jobs) and adds supporting context.
docs/architecture.md	Corrects oracle’s host mapping entry to describe the wiki + off-host responsibilities and notes hand-run containers.
docs/adr/0015-give-oracle-the-off-host-jobs.md	New ADR establishing oracle as the host for small off-host jobs and documenting constraints/rejections.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gerrrt]

Overlaps with #253, which edits the same two rows for a different reason — the oracle line in network.md's VLAN 99 table (OS cell there, Role cell here) and the host table in architecture.md. Whichever merges second needs a rebase; the conflicts are cell-level and adjacent, not contradictory. I'll do it as soon as the first one lands.