fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record unifi firewall enforcement and closeout
Some checks failed
secret-guardrails / artifact-secret-scan (push) Has been cancelled
Details
secret-guardrails / gitleaks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-23 02:08:15 +00:00
parent bec21292de
commit 462b39e572
14 changed files with 841 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/architecture/ARCHITECTURE_OVERVIEW.md
View File

@@ -13,7 +13,15 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
## Network
- **LAN subnet:** 10.5.1.0/24
- **Management:** 10.5.0.0/24
- **Trusted:** 10.5.1.0/24
- **IoT:** 10.5.10.0/24
- **Cameras:** 10.5.20.0/24
- **Servers:** 10.5.30.0/24
- **Guest:** 10.5.90.0/24
- **Legacy quarantine:** 192.168.1.0/24 (`Old IoT`)
- **UniFi policy zones:** `Internal` = Management + Trusted + Servers, `Untrusted` = IoT + Cameras + Old IoT, `Hotspot` = Guest
- **Current custom firewall hardening:** `Allow Internal to Untrusted` plus an explicit `Block Untrusted to Gateway Admin Surfaces` rule to keep IoT/Camera/Old IoT clients off the UDM Pro admin TCP ports while leaving the existing zone defaults in place
- **Tailscale:** Serenity reachable at 100.94.87.79
- **NFS:** Serenity exports `/mnt/user/data` and `/mnt/user/immich` → mounted on PD at `/mnt/unraid/` via post-init script
- **Docker networking:** Cross-stack communication via named external networks (`ai-services`, `ix-databases_shared-databases`)