WRKLOG-2026-03-17

Summary

Monday. Critical backlog from past week requires focused attack. Professional tasks have accumulated to unacceptable levels. P50 Steam test pending (Flatpak installed). Z Fold 7 Termux incident deferred.

URGENT - All Domains

Professional Backlog

Carryover Backlog (CRITICAL)

Task Details Origin Days Status

k3s NAT verification

NAT rule 170 for 10.42.0.0/16 pod network - test internet connectivity

2026-03-09

29

P0 - BLOCKING

Wazuh indexer recovery

Restart pod after NAT confirmed working - SIEM visibility blocked

2026-03-09

29

P0 - Blocked by k3s

Strongline Gateway VLAN fix

8 devices in wrong identity group (David Rukiza assigned)

2026-03-16

22

P0 - TODO

Monad Pipeline Evaluation

Test pipeline creation, input sources, transforms (LEAD ROLE)

2026-03-11

27

P1 - TODO

Vocera EAP-TLS Supplicant Fix

~10 phones failing 802.1X, missing supplicant config

2026-03-12

26

P1 - TODO

ISE MnT Messaging Service

Enable "Use ISE Messaging Service for UDP syslogs delivery"

2026-03-12

26

P2 - TODO

ISE Patch 9 upgrade

ISE 3.2 Patch 9 addresses known replication issues

2026-03-12

26

P2 - TODO
Professional backlog is at critical levels. Multiple tasks over 5 days old.

Personal Blockers

BLOCKERS — Fix Immediately

Task Details Origin Days Impact

Z Fold 7 Termux

gopass and SSH not working

2026-03-10

25

BLOCKER — Cannot access passwords on mobile

gopass v3 organization

Inconsistent structure, poor key-value usage

2026-03-20

15

Inefficient password management, no aggregation

Life Admin

URGENT - Requires Immediate Action

Item Details Deadline Status Impact

Housing Search

Granada Hills area - apartments/rooms

TBD

In Progress

Quality of life, commute

Certification Deadlines

URGENT — Performance Review Deadline (June 1, 2026)

Certification Provider Deadline Status Impact

CISSP

ISC² — Certified Information Systems Security Professional

June 1, 2026

ACTIVE — Phase 0 (Project)

Required for performance review

RHCSA 9

Red Hat Certified System Administrator

June 1, 2026

ACTIVE — 21-phase curriculum (Project)

Required for performance review
55 days remaining until June 1st deadline.

Work (CHLA)

Critical (P0)

Project Description Owner Status Due Blocker

Linux Research (Xianming Ding)

EAP-TLS for Linux workstations, dACL, UFW

Evan

BEHIND

02-24

Certificate "password required" - nmcli fix documented

iPSK Manager

Pre-shared key automation

Ben Castillo

BEHIND

 — 

DB replication issues

MSCHAPv2 Migration

Legacy auth deprecation

Evan

BEHIND

 — 

No progress on planning

Research Segmentation

All endpoints to Untrusted VLAN

Evan

BLOCKED

 — 

CISO decision pending

High Priority (P1)

Project Description Owner Status Target

ISE 3.4 Migration

Upgrade from 3.2p9

Evan

Blocked

Q1 2026

Switch Upgrades

IOS-XE fleet update (C9300, 3560CX)

Evan

Pending

Q1 2026

Spikewell BYOD VPN

dACL SQL, AD group integration

Evan

Active

 — 

Strongline Gateway

MAC capture, Identity Group setup

Evan

Active

 — 

QRadar → Sentinel Migration

Full SIEM platform transition, Monad evaluation

Evan

Active

Q2 2026

Strategic (P2)

Project Description Owner Status

HHS Regulatory Compliance

New HHS security policies implementation

TBD

NOT STARTED

InfoSec Reporting Dashboard

PowerBI metrics for executives

TBD

NOT STARTED

EDR Migration (AMP → Defender)

Endpoint protection consolidation

TBD

NOT STARTED

Azure Legacy Migration

Modern landing zone

Team

In Progress

ChromeOS EAP-TLS

SCEP + Victor, Paul testing

Victor

In Progress

Case Studies (March 2026)

TAC Cases:

Incidents:

Changes:

RCAs:

Today’s Priorities

  • P0 - Strongline Gateway VLAN fix (blocking Arin)

  • P0 - k3s NAT verification (8 days carried - unacceptable)

  • P1 - Monad Pipeline Evaluation (6 days)

  • P1 - Wazuh indexer recovery (blocked by NAT)

Notes

Day-specific work notes here.

Personal

In Progress

Project Description Status Notes

k3s Platform

Production k3s cluster on kvm-01

Active

Prometheus, Grafana, Wazuh deployed

Wazuh Archives

Enable archives indexing in Filebeat

Active

PVC fix pending

kvm-02 Hardware

Supermicro B deployment

Active

Hardware ready, RAM upgrade done

Planned

Project Description Target Blocked By

Vault HA (3-node)

vault-02, vault-03 on kvm-02

Q1 2026

kvm-02 deployment

k3s HA (3-node)

Control plane HA

Q1 2026

kvm-02 deployment

ArgoCD GitOps

k3s GitOps deployment

After k3s stable

 — 

MinIO S3

Object storage for k3s

After ArgoCD

 — 

Domus Inventory

Personal asset management (YAML + CLI + AsciiDoc)

Q2 2026

Schema approved

Active — Infrastructure

Task Details Priority Status Due

Wazuh agent deployment

Deploy agents to all infrastructure hosts

P2

Pending

After archives fix

k3s Platform

Production k3s cluster on kvm-01

P1

In Progress

 — 

Wazuh Archives

Enable archives indexing in Filebeat, PVC fix

P1

In Progress

 — 

kvm-02 Hardware

Supermicro B deployment, RAM upgrade done

P1

In Progress

 — 

Active — Security & Encryption

Task Details Priority Status Due

Configure 4th YubiKey

SSH FIDO2 keys

P1

TODO

 — 

Cold storage M-DISC backup

age-encrypted archives

P1

TODO

After YubiKey setup

Active — Development & Tools

Task Details Priority Status Due

netapi Commercialization

Go CLI rewrite with Cobra-style argument discovery, package for distribution

P0

Active

 — 

Ollama API Service

FastAPI (17 endpoints), productize — config audit, doc tools, runbook gen

P0

Active

 — 

Shell functions (fe, fec, fef)

File hunting helpers

P3

TODO

 — 

Active — Documentation

Task Details Priority Status Due

D2 Catppuccin Mocha styling

domus-* spoke repos (177 files total)

P3

In Progress

 — 

Active — Financial

Task Details Priority Status Due

Amazon order history import

Download CSV from Privacy Central → parse with awk → populate subscriptions tracker

P1

Waiting

Pending Amazon data export (requested 2026-04-04)

Active — Education

Task Details Priority Status Due

No active education tasks — see education trackers

Active — Personal & Life Admin

Task Details Priority Status Due

ThinkPad T16g Setup

Arch install, stow dotfiles, Ollama stack, netapi dev env

P0

Pending

 — 

P50 Arch to Ubuntu migration

CR-2026-03-12

P2

In Progress

 — 

X1 Carbon Ubuntu installs

2 laptops, LUKS encryption

P2

In Progress

 — 

P50 Steam Test

Test Flatpak Steam + apt cleanup of broken i386 packages

P3

Pending

 — 

Documentation Sites

Notes

  • P50 Steam can wait until evening if work priorities demand it

  • Z Fold 7 Termux is URGENT - blocking password access on mobile

Life Admin - Apartment Transition

DMV - REAL ID (Tomorrow Morning)

  • Walk-in - Arrive 7:30am before 8am opening

  • License expired: 47 days (Jan 29, 2026)

  • Must upgrade to REAL ID - standard DL no longer valid for TSA since May 2025

  • Documents needed:

    • Identity: Passport, birth certificate, or naturalization cert

    • SSN: Card, W-2, or paystub with full SSN

    • Residency (2x): Utility bill, bank statement, lease, insurance

Complete online pre-app at realid.dmv.ca.gov first → get confirmation code → faster walk-in (15-20 min vs 1-3 hrs)

Storage - Apartment Transition

Decision: Climate-controlled required for ~90 books

Items Solution Cost Status

10 rare books (15th c.)

Friend’s house

Free

✓ Arranged

Violin

Robert Cauer Violins (luthier)

Free-$50/mo

[ ] Call tomorrow

~90 books, containers, luggage

Extra Space Storage (climate)

~$108-143/mo

[ ] Book online

Violin - Robert Cauer Violins

  • Phone: (323) 460-6815

  • Hours: Tue-Sat 9:30am-5pm (by appointment)

  • Address: 2242 N Cahuenga Blvd, LA 90068

  • Ask: "Can you hold my violin for a few months while I’m between apartments?"

Storage - Extra Space Storage (RECOMMENDED)

Packing for books:

  • Plastic bins (NOT cardboard)

  • Books upright (not flat-stacked)

  • Silica gel packets in each bin

Education

Active Tracks (Focus)

Skills Mastery (Critical)

Certification Deadlines

  • CISSP - Before June 1, 2026 (performance review)

  • RHCSA 9 - Before June 1, 2026 (performance review)

  • LPIC-1 - Renewal required (blocks LPIC-2)

Language Certifications (DELE/SIELE)

Spanish C1 Certification Goals

Certification Provider Target Status Strategy

SIELE C1

Instituto Cervantes / UNAM / Salamanca

Q2 2026

ACTIVE

Computer-based, faster results - take FIRST

DELE C1

Instituto Cervantes

Q3/Q4 2026

PLANNED

After SIELE success, harder exam

DELE C2

Instituto Cervantes

2027

FUTURE

Mastery level - requires extensive immersion
SIELE is computer-adaptive, results in 3 weeks. DELE is paper-based, results in 3-4 months. Do SIELE first to validate readiness.

C1 Skills Required

Skill Description Status Practice Method

Comprensión Lectora

Read complex texts, infer meaning, analyze arguments

🔄 In Progress

Don Quijote, academic articles, RAE

Comprensión Auditiva

Understand extended speech, lectures, media

⚠️ Weak

Spanish news, podcasts, films without subtitles

Expresión Escrita

Formal essays, reports, argumentative texts

🔄 In Progress

Weekly essays with tutor, conectores practice

Expresión Oral

Fluent, spontaneous speech on complex topics

🔄 In Progress

Tutor sessions, presentation practice

Gramática Avanzada

Subjunctive mastery, formal register, nuance

⚠️ Needs Work

Subjuntivo exercises, register switching

Vocabulario C1

Academic, professional, literary vocabulary

🔄 Building

Reading, locuciones, conectores

Legend: ✅ Strong | 🔄 In Progress | ⚠️ Needs Work | ❌ Not Started

Don Quijote Progress

Current Reading Progress

Part Chapters Progress Notes

Primera Parte

52 chapters

0% (0/52)

Fresh start

Segunda Parte

74 chapters

0%

After Primera Parte complete

Total Work: 126 chapters across both parts

Today’s Study

  • Focus: Regex Mastery

  • Progress: TBD

Infrastructure

Documentation Sites

Site URL Status Actions Needed

Domus Digitalis

docs.domusdigitalis.dev

Active

Validate, harden, improve

Architectus

docs.architectus.dev

Active

Public portfolio site - maintain

HA Deployment Status

System Description Status Notes

VyOS HA

vyos-01 (kvm-01) + vyos-02 (kvm-02) with VRRP VIP

✅ COMPLETE

2026-03-07 - pfSense decommissioned

BIND DNS HA

bind-01 (kvm-01) + bind-02 (kvm-02) with AXFR

✅ COMPLETE

Zone transfer operational

Vault HA

Raft cluster (vault-01/02/03)

✅ COMPLETE

Integrated with PKI

Keycloak Rebuild

keycloak-01 corrupted, rebuild from scratch

🔄 NEXT

Priority P3 - SSO broken

FreeIPA HA

ipa-02 replica planned

📋 PLANNED

Linux auth redundancy

AD DC HA

home-dc02 replication

📋 PLANNED

Windows auth redundancy

iPSK Manager HA

ipsk-mgr-02 with MySQL replication

📋 PLANNED

PSK portal redundancy

ISE HA

PAN HA (ise-01 reconfigure)

⏳ DEFERRED

Wait until ise-02 stable

ISE 3.5 Migration

Upgrade path: 3.2p9 → 3.4 (P1) → 3.5 (target)

📋 PLANNED

After 3.4 Migration completes (Q2 2026)

Single Points of Failure (CRITICAL)

These systems have NO redundancy - outage impacts production.
System Impact if Down Mitigation

ISE (ise-02)

All 802.1X stops - wired and wireless auth fails

ise-01 reconfiguration deferred until ise-02 stable

Keycloak (keycloak-01)

SAML/OIDC SSO broken (ISE admin, Grafana, etc.)

NEXT PRIORITY - Rebuild runbook

FreeIPA (ipa-01)

Linux auth, sudo rules, HBAC fails

ipa-02 replica planned

AD DC (home-dc01)

Windows auth, Kerberos, GPO fails

home-dc02 replica planned

iPSK Manager

Self-service PSK portal unavailable

ipsk-mgr-02 with MySQL replication planned

Validation Tasks

Task Details Status

docs.domusdigitalis.dev validation

Test all cross-references, search, rendering

TODO

docs.domusdigitalis.dev hardening

HTTPS, CSP headers, security review

TODO

docs.architectus.dev validation

Public site content review

TODO

Hub-spoke sync verification

All components building correctly

Ongoing

Project Portfolio

Tier 1 Projects (Flagship)

Project Description Status

netapi

Multi-vendor network CLI (ISE, Cloudflare, Keycloak, GitHub, GitLab, Monad)

Polish phase

domus-docs

19-repo Antora aggregator with Cloudflare Pages

Production

architectus.dev

Public learning platform (Linux, Windows, Networking, Security, Cloud)

Production

dotfiles-optimus

GNU Stow modular developer environment

Personal use

dsec

Secrets management CLI (~/.secrets/dsec system)

Production

Principia PKMS

Obsidian-based personal knowledge management

Active

Quick Commands

P50 Steam Test

flatpak run com.valvesoftware.Steam

Strongline Gateway Verification

dsource chla/prod/ise
netapi ise -f json get-endpoints | jq '.[] | select(.macAddress | test("STRONGLINE_MAC_PATTERN")) | \{mac: .macAddress, group: .groupId}'

k3s NAT Test

kubectl run -it --rm debug --image=busybox --restart=Never -- wget -qO- ifconfig.me

Related Documents