From 0d1a66aac47cd8e7752102dc58a920719e9569e3 Mon Sep 17 00:00:00 2001
From: "ryan.toler" <ryan.toler@localhost.com>
Date: Fri, 2 Oct 2026 13:49:35 +0000
Subject: [PATCH] docs: create Homelab

---
 Homelab.md | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 Homelab.md

diff --git a/Homelab.md b/Homelab.md
new file mode 100644
index 0000000..2f00af1
--- /dev/null
+++ b/Homelab.md
@@ -0,0 +1,96 @@
+---
+title: Password Vaults
+description: How passwords are being stored for homelab
+published: true
+date: 2026-10-02T13:49:33.635Z
+tags: 
+editor: markdown
+dateCreated: 2026-10-02T13:49:33.635Z
+---
+
+# Password & Credential Storage Policy
+
+## Summary
+
+As of [10/02/2026], all application admin credentials, local account passwords, and
+manual password-reset instructions are stored in **Vaultwarden**
+(`https://vault.frantecrt.duckdns.com`), not in Wiki.js or any other documentation page.
+
+Documentation pages describe *process* (how to reset, where to find things).
+They never contain the actual secret value.
+
+---
+
+## Where things live now
+
+| Content | Location |
+|---|---|
+| Actual passwords / admin credentials | Vaultwarden ||
+| App how tos like reset and general reasoning | Wiki.js |
+| General app configuration | Git repo |
+
+---
+
+## Vaultwarden structure
+
+- **Collections** are organized per application or system (e.g. `AppX`,
+  `AppY-admin`, `Network-Devices`).
+- Each **item** represents one credential (e.g. "AppX — local admin account").
+- Items are **never** duplicated into Wiki.js pages. Wiki.js pages link to
+  the relevant Vaultwarden item by name/collection instead of quoting the
+  secret.
+
+---
+
+## Accessing credentials
+
+### Web vault
+`https://vault.frantecrt.duckdns.com` — log in with your individual Vaultwarden
+account (not a shared account). Browse to the relevant collection.
+
+### CLI (for scripts / runbooks)
+
+```bash
+bw config server https://vault.frantecrt.duckdns.com
+bw login
+bw unlock
+export BW_SESSION="<session key from unlock output>"
+
+bw get password "AppX Admin"
+bw list items --search "AppX"
+```
+
+Runbook steps that need a credential should reference the `bw get` command
+rather than embedding the value, e.g.:
+
+> Retrieve current admin password: `bw get password "AppX Admin" 
+or link https://vault.frantecrt.duckdns.org/#/vault?itemId=<ITEMID>&action=view`
+
+---
+
+## Access control
+
+- Individual accounts only — no shared logins to Vaultwarden itself.
+- Collections are scoped so people/teams only see credentials relevant to
+  systems they manage.
+- `SIGNUPS_ALLOWED` is disabled after initial account setup; new accounts
+  are created by an admin via the [Vaultwarden admin panel](https://vault.yourdomain.com/admin)
+  (protected separately by `ADMIN_TOKEN`).
+
+---
+
+## Rotation
+
+When a credential is rotated:
+
+1. Update the value in the Vaultwarden item.
+2. Update the Notes field if the reset procedure itself changed.
+3. **Do not** edit a Wiki.js page to reflect the new password — the wiki
+   never contained it in the first place, so there's nothing to update there
+   beyond process changes.
+
+---
+
+## Related docs
+
+- [Deployment: (example only) Wiki.js + Vaultwarden docker-compose stack](#)