fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record unifi firewall enforcement and closeout
Some checks failed
secret-guardrails / artifact-secret-scan (push) Has been cancelled
Details
secret-guardrails / gitleaks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-23 02:08:15 +00:00
parent bec21292de
commit 462b39e572
14 changed files with 841 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/architecture/ARCHITECTURE_OVERVIEW.md
View File

@@ -13,7 +13,15 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
## Network
- **LAN subnet:** 10.5.1.0/24
- **Management:** 10.5.0.0/24
- **Trusted:** 10.5.1.0/24
- **IoT:** 10.5.10.0/24
- **Cameras:** 10.5.20.0/24
- **Servers:** 10.5.30.0/24
- **Guest:** 10.5.90.0/24
- **Legacy quarantine:** 192.168.1.0/24 (`Old IoT`)
- **UniFi policy zones:** `Internal` = Management + Trusted + Servers, `Untrusted` = IoT + Cameras + Old IoT, `Hotspot` = Guest
- **Current custom firewall hardening:** `Allow Internal to Untrusted` plus an explicit `Block Untrusted to Gateway Admin Surfaces` rule to keep IoT/Camera/Old IoT clients off the UDM Pro admin TCP ports while leaving the existing zone defaults in place
- **Tailscale:** Serenity reachable at 100.94.87.79
- **NFS:** Serenity exports `/mnt/user/data` and `/mnt/user/immich` → mounted on PD at `/mnt/unraid/` via post-init script
- **Docker networking:** Cross-stack communication via named external networks (`ai-services`, `ix-databases_shared-databases`)

21
docs/architecture/NETWORKING_MODEL.md
View File

@@ -1,7 +1,7 @@
# Homelab Networking Model
## Physical Network
- **Gear:** Unifi throughout
- **Gear:** UniFi throughout
- **Gateway / controller:** UDM Pro (`10.5.0.1`, WAN `69.166.182.157`)
- **Core / access switching:**
- USW-24-PoE (`10.5.0.10`)
@@ -9,12 +9,23 @@
- **Wi-Fi access points:**
- U7 Pro (`10.5.0.21`) — active
- U6 LR (`10.5.0.20`) — currently disconnected in UniFi as of 2026-05-21
- **Main LAN:** 10.5.1.x (Trusted VLAN)
- **Management VLAN:** 10.5.0.x
- **Other VLANs:** Cameras, Guest, IoT / Old IoT
- **Management subnet:** `10.5.0.0/24`
- **Trusted subnet:** `10.5.1.0/24` (VLAN 51)
- **IoT subnet:** `10.5.10.0/24` (VLAN 510)
- **Camera subnet:** `10.5.20.0/24` (VLAN 520)
- **Servers subnet:** `10.5.30.0/24` (VLAN 30)
- **Guest subnet:** `10.5.90.0/24` (VLAN 590)
- **Legacy quarantine:** `192.168.1.0/24` (`Old IoT`, VLAN 2)
- **UniFi policy zones:**
- `Internal` = Management + Trusted + Servers
- `Untrusted` = IoT + Camera + Old IoT
- `Hotspot` = Guest
- **Current custom policy additions on top of UniFi defaults:**
- `Allow Internal to Untrusted`
- `Block Untrusted to Gateway Admin Surfaces` (blocks IoT/Camera/Old IoT access to the UDM Pro admin TCP ports while leaving DHCP/DNS/mDNS/internet behavior to the existing zone defaults)
- **Serenity IP:** 10.5.30.5
- **N.O.M.A.D. IP:** 10.5.30.7
- **PlausibleDeniability:** 10.5.30.6 (static on LAN)
- **PlausibleDeniability:** 10.5.30.6 (Servers VLAN)
## Remote Access
- **Pangolin VPS + Newt:** Services exposed as subdomains via reverse proxy. Newt agents run on PD and N.O.M.A.D.