Execution
All Tasks
Every task in Raven Praxis Infrastructure. Click one to edit its details.
40 / 40
| Phase | Task | Priority | Status | Owner | Due |
|---|---|---|---|---|---|
| A | Confirm DL360p Gen8 inventory (CPU/RAM/SSD) 32 logical CPUs, 314.85 GiB RAM, 3 TB SSD verified. | high | Completed | Operator | — |
| A | Approve 10.100.0.0/16 IP plan /24 per VLAN, documented in BookStack draft. | high | Completed | Operator | — |
| A | License reality check for tooling catalog Confirm Persistent vs Trial vs Demo tier for each of 27 tools. | medium | In Progress | Operator | — |
| A | Order + inventory YubiKeys for operator + backup 2x YubiKey 5C NFC minimum, seal one for break-glass. | medium | Planned | Operator | — |
| A2 | Define VLAN table on managed switch VLANs: mgmt, lab-mgmt, students, central-lab, lms, iot, wifi. | high | Not Started | Operator | — |
| A2 | Configure tagged trunk to OPNsense WAN2/LAN All VLANs tagged; no native/untagged on trunk. | high | Not Started | Operator | — |
| B | Install OPNsense 24.x on firewall hardware Fresh install, apply base config, snapshot before rules. | critical | Not Started | Operator | — |
| B | Create VLAN interfaces + gateways One /24 per VLAN, gateway .1. | critical | Not Started | Operator | — |
| B | Author default-deny inter-VLAN rules Explicit allowlists only. Students → lab targets only. | critical | Not Started | Operator | — |
| B | Enable Config Revert / snapshot Confirm OPNsense revert works; document rollback. | medium | Not Started | Operator | — |
| C | Re-IP Proxmox host to new mgmt VLAN Downtime window required. PBS-side reconnect afterwards. | high | Not Started | Operator | — |
| C | Configure SDN zones + VNets One VNet per VLAN participating in virt workloads. | high | Not Started | Operator | — |
| D | Provision bastion VM (minimal Debian) No GUI, no extra services. Wazuh agent installed. | high | Not Started | Operator | — |
| D | Enroll sk-ed25519 keys + PAM-U2F sudo Follow §10.3.1 and §10.3.2 verbatim. | critical | Not Started | Operator | — |
| D | Seal break-glass recovery envelope Physical envelope, tamper-evident, offsite. | high | Not Started | Operator | — |
| E | Deploy AdGuard Home + upstream DNS DNS-over-TLS upstream; blocklists per §11.5.1. | high | Not Started | Operator | — |
| E | Deploy Authentik + first app SSO Bind Guacamole-ops as first SSO consumer. | high | Not Started | Operator | — |
| F | Install Wazuh manager + dashboard 10.100.20.32; enable OPNsense syslog forwarding. | high | Not Started | Operator | — |
| F | Enable Suricata IDS/IPS on WAN + LAN ET Open ruleset; drop mode after tuning. | high | Not Started | Operator | — |
| F | Author egress aliases (replaces pfBlockerNG) OPNsense Aliases + AdGuard blocklists; document deltas. | medium | Not Started | Operator | — |
| G | Install PBS on Shuttle appliance i5-3350P, 32 GB RAM, 3 TB — dedicated datastore. | high | Not Started | Operator | — |
| G | Encrypt datastore + configure verify + prune Encryption key escrowed with break-glass envelope. | critical | Not Started | Operator | — |
| G | Test restore of a canary VM Time restore; record in operations runbook. | critical | Not Started | Operator | — |
| H | Deploy Twingate connector on lab-mgmt Outbound-only. No inbound firewall changes. | high | Not Started | Operator | — |
| H | Provision operator device + policy Device posture check + FIDO2. | medium | Not Started | Operator | — |
| I | Deploy Guacamole (students) Behind Authentik SSO; session recording ON. | high | Not Started | Operator | — |
| I | Deploy Guacamole-ops (operator) Separate instance, restricted to bastion origins. | high | Not Started | Operator | — |
| J | Deploy Moodle (10.100.35.120) Attendance module + activity gating. | high | Not Started | Operator | — |
| J | Deploy Zammad (10.100.35.121) Student + operator queues. | medium | Not Started | Operator | — |
| J | Deploy BookStack (10.100.35.122) Runbook + curriculum wiki. | medium | Not Started | Operator | — |
| J | Deploy Grafana (10.100.35.123) Wazuh + Suricata + AdGuard panels. | medium | Not Started | Operator | — |
| K | Provision SOC track tools (Persistent tier) Wazuh, Suricata, Grafana, MISP, TheHive. | medium | Not Started | Operator | — |
| K | Provision Blue track tools Velociraptor, Sysmon, Elastic (trial). | medium | Not Started | Operator | — |
| K | Provision Red track tools (Demo tier) Caldera, Atomic Red Team. | low | Not Started | Operator | — |
| L | Stand up local LLM for ops Ollama + curated runbook context. | low | Not Started | Operator | — |
| M | Author pod template (3–4 VM) Versioned; teardown is one command. | high | Not Started | Operator | — |
| N | Red-team self-test: home LAN unreachable From student pod, prove no route to home network. | critical | Not Started | Operator | — |
| N | Red-team self-test: no inbound exposure External scan of home WAN IP — expect zero open ports. | critical | Not Started | Operator | — |
| O | Publish runbooks in BookStack One page per phase; link from Grafana. | medium | Not Started | Operator | — |
| O | Schedule quarterly DR drill Calendar event + owner + rollback plan. | medium | Not Started | Operator | — |