Phase J · LMS
Deploy BookStack (10.100.35.122)
Runbook + curriculum wiki.
Back
Delete
Overview
Title
Description
Runbook + curriculum wiki.
Implementation details
Checklist
Add
Validation Record
Expected result
Actual result
Outcome
Pending
Pass
Fail
Validated by / date
Remediation notes
Evidence & Sign-off
Evidence / proof of completion
Sign-off
Notes
Append to activity log
Log
Status
Status
Not Started
Planned
In Progress
Blocked
Ready for Validation
Completed
Deferred
Not Started
Priority
critical
high
medium
low
Assignment
Owner
Due date
Phase
A — Planning & Prerequisites
A2 — Switch Reconfigure — VLAN Plan
B — OPNsense — Re-IP & VLAN Expansion
C — Proxmox — Host Re-IP & SDN
D — Bastion Build
E — AdGuard & Authentik — Core Services
F — Wazuh, Suricata IDS/IPS & Egress Filtering
G — PBS — Proxmox Backup Server
H — Twingate — Remote Access (ZTNA)
I — Guacamole — Student & Ops Access
J — LMS Stack — Moodle, Zammad, BookStack, Grafana
K — Student-Visible Tooling Catalog (27 tools)
L — AI Workbench
M — Pod Orchestration
N — End-to-End Validation & Red-Team Self-Test
O — Documentation & Operational Readiness
Domain
Dependencies
A · Confirm DL360p Gen8 inventory (CPU/RAM/SSD)
A · Approve 10.100.0.0/16 IP plan
A · License reality check for tooling catalog
A · Order + inventory YubiKeys for operator + backup
A2 · Define VLAN table on managed switch
A2 · Configure tagged trunk to OPNsense WAN2/LAN
B · Install OPNsense 24.x on firewall hardware
B · Create VLAN interfaces + gateways
B · Author default-deny inter-VLAN rules
B · Enable Config Revert / snapshot
C · Re-IP Proxmox host to new mgmt VLAN
C · Configure SDN zones + VNets
D · Provision bastion VM (minimal Debian)
D · Enroll sk-ed25519 keys + PAM-U2F sudo
D · Seal break-glass recovery envelope
E · Deploy AdGuard Home + upstream DNS
E · Deploy Authentik + first app SSO
F · Install Wazuh manager + dashboard
F · Enable Suricata IDS/IPS on WAN + LAN
F · Author egress aliases (replaces pfBlockerNG)
G · Install PBS on Shuttle appliance
G · Encrypt datastore + configure verify + prune
G · Test restore of a canary VM
H · Deploy Twingate connector on lab-mgmt
H · Provision operator device + policy
I · Deploy Guacamole (students)
I · Deploy Guacamole-ops (operator)
J · Deploy Moodle (10.100.35.120)
J · Deploy Zammad (10.100.35.121)
J · Deploy Grafana (10.100.35.123)
K · Provision SOC track tools (Persistent tier)
K · Provision Blue track tools
K · Provision Red track tools (Demo tier)
L · Stand up local LLM for ops
M · Author pod template (3–4 VM)
N · Red-team self-test: home LAN unreachable
N · Red-team self-test: no inbound exposure
O · Publish runbooks in BookStack
O · Schedule quarterly DR drill
Ctrl/⌘-click to select multiple.
Blockers