# USW Pro HD 24 Exact Change Sheet

> For Doris: this is the mechanical switch-port sheet for tomorrow. Do not freestyle. Change one thing, validate, then continue.

Source basis:
- live UniFi read-only recon on 2026-05-22
- /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md
- /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md

## Core principle
- Uplink/AP/infra ports stay Management or trunked as appropriate.
- Server-class hosts leave Trusted and move to Servers.
- Unknown live ports get eyeballed before change.
- Do not bulk-edit profiles blindly.
- Rocinante is the live operator box, so keep it stable until the main server batch is complete or an alternate admin path is proven.
- Nomad, Serenity, and PD may need to move as one controlled wave because of NFS/shared-service coupling; validate the batch immediately.

---

## 1. Desired profile set for tomorrow

Current relevant profiles seen live:
- Management
- Trusted
- IoT
- Camera
- Old IoT

Needed for tomorrow:
- Management
- Trusted
- Servers
- IoT
- Camera
- Guest
- Old IoT
- trunk/uplink profile if you choose to normalize uplinks now

If `Servers` does not exist yet:
- create it before changing server ports
- use it as the target for the core host ports below

## 2. USW Pro HD 24 live ports that matter

### Port 1
- Name: `U7 Pro (Upstairs)`
- Current profile: `Management`
- Link: up
- Speed: 2.5G
- Role: AP uplink / infrastructure
- Tomorrow action: leave on Management unless/until you replace with an explicit trunk/uplink profile
- Risk: high if changed incorrectly
- Validation after any change:
  - U7 Pro remains online in UniFi
  - wireless clients stay associated
  - management plane remains reachable

### Port 2
- Name: `Port 2`
- Current observed live client: `Rocinante`
- Current explicit profile visibility: not clearly returned by API
- Link: up
- Speed: 2.5G
- Role: server/core host
- Tomorrow action: inspect in UniFi UI first, confirm current native network/profile, but keep Rocinante in place as the live operator station until the Nomad/Serenity/PD batch is done or a backup admin path is proven
- Risk: medium because profile visibility was ambiguous in API data
- Validation after move:
  - Rocinante gets expected Servers subnet/gateway
  - reachable from Trusted as intended
  - any expected service ports work

### Port 3
- Name: `FlyingDutchman`
- Current profile: `Trusted`
- Link: up
- Speed: 2.5G
- Role: human endpoint / gaming PC unless proven otherwise
- Tomorrow action: leave on `Trusted` tomorrow unless you deliberately reclassify it later; default assumption is that it should stay with trusted human endpoints
- Risk: medium
- Validation after move:
  - host gets expected subnet/gateway
  - reachable from Trusted as intended
  - only move if this box is actually supposed to live with the homelab service lane

### Port 22
- Name: `Port 22`
- Current live client: `Nomad`
- Current profile: `Trusted`
- Link: up
- Speed: 2.5G
- Role: core host
- Tomorrow action: move to `Servers`
- Risk: medium
- Validation after move:
  - Nomad gets expected Servers address
  - Doris pages / services expected on Nomad still reachable from Trusted

### Port 23
- Name: `Docker Server`
- Current live client: `PlausibleDeniability`
- Current profile: `Trusted`
- Link: up
- Speed: 10G
- Role: primary core server
- Tomorrow action: move to `Servers`
- Risk: high-ish because this is central infrastructure
- Validation after move:
  - PD gets expected Servers address
  - SSH to `pd` still works from Trusted/admin lane
  - critical services still reachable from Trusted
  - no surprise breakage to shared homelab functions

### Port 24
- Name: `Serenity 10G (1)`
- Current live client: `Serenity`
- Current profile: `Trusted`
- Link: up
- Speed: 10G
- Role: core host
- Tomorrow action: move to `Servers`
- Risk: medium-high
- Validation after move:
  - Serenity gets expected Servers address
  - intended services still reachable from Trusted

### Port 27
- Name: `Port 27`
- Current profile: `Management`
- Link: up
- Speed: 10G
- Role: likely infra/uplink
- Tomorrow action: do not touch unless you have positively identified what it is
- Risk: very high
- Validation if ever touched:
  - upstream/downstream infra remains healthy
  - no switch isolation or mgmt loss

## 3. Recommended exact move order for server ports

Use this order, not random order:

1. Port 2 -> Rocinante
- inspect/profile-confirm first
- do not move it early if it is your live admin path

2. Port 22 -> Nomad
- first member of the controlled three-host batch

3. Port 24 -> Serenity
- second member of the controlled three-host batch

4. Port 23 -> PlausibleDeniability
- third member of the controlled three-host batch

5. Port 3 -> FlyingDutchman
- default action is no move; only revisit if you intentionally decide it belongs in Servers after all

If you want the most conservative variant:
- leave Rocinante on Trusted during the live work
- move Nomad, Serenity, and PD as the only server-lane batch
- leave FlyingDutchman on Trusted

## 4. Per-port execution script

For each independent server port or server batch:
1. open switch port in UniFi UI
2. confirm live client identity matches expectation
3. screenshot current state
4. if touching Nomad/Serenity/PD, pre-stage the exact order before the first change
5. change profile from `Trusted` (or current) -> `Servers`
6. wait for link/client/IP reassignment
7. verify host gets expected subnet/gateway
8. verify reachability from Rocinante/admin path
9. verify expected service behavior
10. if it was the three-host batch, verify cross-host dependencies before anything else
11. only then proceed to next port

## 5. Ports to explicitly leave alone tomorrow

Leave alone unless a later issue forces action:
- Port 1 (U7 Pro upstairs)
- Port 27 (likely infra/uplink)
- all inactive ports
- any uplink/trunk-ish port not positively identified

## 6. Potential follow-up ports outside the main switch

USW-24-PoE notable live port:
- Port 24 -> profile `Management` -> link up at 1G
- Tomorrow action: read-only verify what it is before touching
- Do not change it casually during the same window unless you have confirmed its role

## 7. Success criteria for this port sheet

Successful tomorrow outcome:
- Nomad, Serenity, and PD are no longer sitting on Trusted access ports
- Rocinante is either still the live admin box by deliberate choice or moved cleanly after the main batch is complete
- FlyingDutchman stays on Trusted unless deliberately reclassified with reason
- AP/uplink/infra ports remain stable
- no server move proceeds without validation

## 8. Red flags

Stop immediately if:
- a moved host does not pull the expected subnet
- SSH/admin access path disappears unexpectedly
- a port identity in the UI does not match expected host
- changing one port breaks unrelated infra
- PD move causes unclear blast radius and you cannot explain it within a couple minutes
