Skip to content

Add Memos to the sensitive tier #145

Description

@Gerrrt

Beyond ADR-0008's nine.

What and why

Memos MIT Docker/Goawesome-selfhosted README.md:1616.

Quick markdown notes against a single SQLite file. Deliberately the smallest thing in its category: no sync protocol to run, no plugin ecosystem, no editor to install.

Alternatives, all in the list and all heavier in a different direction:

  • SilverBullet (:1621, MIT) — scriptable, more capable, more to learn.
  • TriliumNext Notes (:1623, AGPL-3.0) — hierarchical knowledge base, the right answer for a large structured corpus and overkill for jotting.
  • Joplin (:1612, MIT) — client-side with a sync target, so it wants Nextcloud or similar behind it, which is a dependency this estate is otherwise avoiding.

A note on scope

This is a notes service, not documentation. Repository documentation stays in docs/ where CI can lint it and git log can explain it — that is a property worth protecting, and #124 (no entry point for a successor operator) is a docs/ problem that a notes app must not be allowed to look like a solution to.

Placement

Sensitive tier, VLAN 99. Personal notes accumulate exactly the kind of incidental detail — addresses, account references, half-copied credentials — that argues for the higher-trust segment even though nothing about the service demands it.

What it needs

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

  • Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
  • Any new credential goes in secrets/*.sops.yaml
  • Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#102 (the mini PC), #129 (Caddy).

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions