fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync network redesign repo state and cutover artifacts

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-22 20:16:21 +00:00
parent 4b1e3d4061
commit 8c72a0c287
59 changed files with 5389 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files

358
home/doris-dashboard/docs/network-cutover-master-operator-sheet.md Normal file
View File

@@ -0,0 +1,358 @@
# Network Cutover Master Operator Sheet
> For Doris: this is the one-page live operator sheet for tomorrow. Use this instead of bouncing between five docs while tired.
Goal: execute the UniFi network redesign with minimal improvisation, explicit stop/go gates, per-port actions, per-device dispositions, and fast rollback discipline.
Architecture:
- Keep the target lanes clear: Management, Trusted, Servers, IoT, Guest, Cameras.
- Keep Legacy CIA alive only as a quarantine/sunset lane.
- Move true service hosts out of Trusted while keeping human endpoints where they belong.
- Move easy named IoT wins now; quarantine ambiguous junk; Google is in scope, but only through narrow, reversible tests.
Primary references if deeper detail is needed:
- `network-redesign-implementation-runbook.md`
- `network-firewall-rule-order.md`
- `legacy-cia-triage-worksheet.md`
- `unifi-readonly-recon-2026-05-22.md`
- `usw-pro-hd-24-cutover-port-sheet.md`
- `old-iot-tomorrow-disposition-list.md`
---
## 1. Live State Snapshot Already Confirmed
Networks currently present:
- Management -> `10.5.0.1/24`
- Trusted -> VLAN 51 -> `10.5.1.1/24`
- Old IoT -> VLAN 2 -> `192.168.1.1/24`
- IoT -> VLAN 510 -> `10.5.10.1/24`
- Camera -> VLAN 520 -> `10.5.20.1/24`
- Guest -> VLAN 590 -> `10.5.90.1/24`
SSIDs currently present:
- `CIA Via` -> Old IoT
- `UNEF's Playhouse` -> Camera
- `Whiskey Neat Fuck Ice` -> Trusted
- `Yer a Wifi Harry` -> Trusted
Current client counts:
- Management: 2
- Old IoT: 14
- Camera: 1
- Trusted: 14
Current hazards:
- two unnamed `espressif` devices are on Management via `UniFi Wireless` on the U7 Pro
- almost all Wi‑Fi clients are on the U7 Pro
- there are no custom firewall rules/groups yet, so tomorrow’s segmentation policy is basically greenfield
## 2. Tomorrow’s Must-Win Outcomes
By the time we stop, these should be true:
- Management is materially cleaned up
- Cameras lane exists and is not polluted by junk placement mistakes
- Servers lane exists and core hosts are moved or deliberately staged with validation
- IoT lane exists and easy-value devices are moved
- Legacy CIA is explicitly a quarantine/sunset lane
- no broad panic rules were added to compensate for fatigue
In-scope if conditions support it:
- Google/cast migration work, but only through narrow, reversible tests
- U6 LR only if needed to stabilize client behavior or complete the design cleanly
Nice-to-have only if smooth:
- SSID simplification
## 3. Absolute Rules
- Keep one stable admin path alive the whole time.
- Rocinante is the live operator station, so do not move it until the rest of the server batch is done or an alternate admin path is proven.
- Change one meaningful thing, then validate.
- Do not bulk-edit live server ports blindly.
- Nomad, Serenity, and PD can be moved as one controlled batch only because their NFS/shared-service coupling is real; pre-stage everything first, then validate the batch immediately.
- Do not try to empty Legacy CIA completely if the window gets noisy.
- Do not move unknown junk into Management, Trusted, or Servers.
- Do not let Google/cast problems bait you into broad allow rules.
- If management reachability degrades, rollback first, think second.
## 4. Minute-by-Minute Execution Spine
### T-30 to T-15: prep
- [ ] open this file
- [ ] open UniFi admin
- [ ] open Doris visual artifacts if helpful
- [ ] confirm Rocinante is the live control box
- [ ] confirm fallback route into UniFi in case Rocinante loses the lane mid-change
- [ ] decide whether U6 LR is in scope or explicitly out of scope
### Minute 0-10: baseline capture
- [ ] screenshot/export networks
- [ ] screenshot/export SSIDs
- [ ] screenshot/export firewall/rule state
- [ ] screenshot/export port profiles
- [ ] screenshot/export switch port assignments
- [ ] screenshot/export AP mappings
- [ ] snapshot Management client list
- [ ] snapshot Old IoT client list
Stop/go gate:
- [ ] do not proceed until rollback baseline exists
### Minute 10-20: create/normalize objects only
- [ ] create/confirm Servers network object
- [ ] create/confirm any missing profiles
- [ ] create/confirm staged SSIDs if needed
- [ ] create/confirm staged firewall objects/rules
Stop/go gate:
- [ ] no clients should have moved yet
- [ ] Trusted admin path still fine
### Minute 20-35: management cleanup first
- [ ] identify/address the 2 Management `espressif` devices
- [ ] ensure infra devices remain on Management intent
- [ ] remove obvious non-infra junk from Management
Stop/go gate:
- [ ] UniFi still sees gateway/switch/APs
- [ ] admin client still reaches controller
### Minute 35-50: security cleanup
- [ ] validate Camera lane
- [ ] move Protect chimes if ready
- [ ] confirm doorbell remains healthy
### Minute 50-85: core server move wave
- [ ] leave Rocinante in place as the operator station until the main server batch is done
- [ ] keep FlyingDutchman on Trusted unless a later decision explicitly reclassifies it
- [ ] pre-stage the exact three-port sequence: Nomad, Serenity, PD
- [ ] move Nomad, Serenity, and PD in one controlled wave because of NFS/shared-service coupling
- [ ] validate the batch immediately before touching anything else
### Minute 85-110: easy IoT wins
- [ ] MyQ
- [ ] LG dryer
- [ ] Samsung FamilyHub
- [ ] Main-Floor ecobee
- [ ] Upstairs ecobee
### Minute 110-125: Legacy CIA quarantine pass
- [ ] mark leftovers as quarantine/defer
- [ ] do not force migration of unknowns
- [ ] apply harsh quarantine posture
### Minute 125-140: Google test if the window is still stable
- [ ] test one Google/cast device first
- [ ] if ugly, stop and defer
### Minute 140-155: guest/SSID cleanup
- [ ] validate Guest
- [ ] disable only stale SSIDs that are truly no longer needed
### Minute 155-180: final validation and stop
- [ ] Trusted ok
- [ ] server services ok
- [ ] moved IoT devices ok
- [ ] security ok
- [ ] Management materially cleaner
- [ ] Legacy CIA now explicitly quarantine
## 5. Management Offender Sheet
These two devices are currently on Management and need identification or removal from that lane:
1. `espressif`
- IP: `10.5.0.123`
- AP: `U7 Pro`
- SSID: `UniFi Wireless`
- Default call: identify first; if it is smart-junk, move/quarantine off Management
2. `espressif`
- IP: `10.5.0.189`
- AP: `U7 Pro`
- SSID: `UniFi Wireless`
- Default call: identify first; if it is smart-junk, move/quarantine off Management
Operator note:
- these are almost certainly exactly the sort of device that should not live on your infrastructure lane
## 6. Exact Core Port Move Sheet
### Leave Alone Unless Positively Necessary
- USW Pro HD 24 port 1 -> `U7 Pro (Upstairs)` -> profile `Management`
- USW Pro HD 24 port 27 -> likely infra/uplink -> profile `Management`
- USW-24-PoE port 24 -> link up on `Management`, inspect before touching
### Port Move Order
1. USW Pro HD 24 port 2
- Live host: `Rocinante`
- Current profile visibility from API: ambiguous
- Action: inspect in UI first, then move to `Servers` if confirmed
- Validate:
- correct subnet/gateway
- reachable from Trusted
- intended services still work
2. USW Pro HD 24 port 3
- Live host: `FlyingDutchman`
- Current profile: `Trusted`
- Action: keep on `Trusted` tomorrow unless a later decision explicitly reclassifies it; this is John and Manndra's gaming PC, not a homelab service host by default
- Validate:
- host still reachable
- services behave as expected
- Safe default: leave it in Trusted
3. USW Pro HD 24 port 22
- Live host: `Nomad`
- Current profile: `Trusted`
- Action: move as part of the controlled three-host server batch
- Validate:
- expected address
- services reachable from Trusted
4. USW Pro HD 24 port 24
- Live host: `Serenity`
- Current profile: `Trusted`
- Action: move as part of the controlled three-host server batch
- Validate:
- expected address
- intended services reachable
5. USW Pro HD 24 port 23
- Live host: `PlausibleDeniability`
- Current profile: `Trusted`
- Action: move as part of the controlled three-host server batch after Nomad and Serenity are ready
- Validate:
- expected address
- SSH/admin path still works
- critical homelab services still work
- Warning:
- because Nomad, Serenity, and PD are coupled by active shares/services, treat them as one planned wave rather than three unrelated experiments
- Rocinante should stay as the control box until that wave is complete
## 7. Old IoT Device Disposition Sheet
### Migrate Now
1. `MyQ-29B` -> `192.168.1.130` -> target `IoT`
2. `LG_Smart_Dryer2_open` -> `192.168.1.186` -> target `IoT`
3. `Samsung-FamilyHub` -> `192.168.1.149` -> target `IoT`
4. `Main-Floor` ecobee -> `192.168.1.102` -> target `IoT`
5. `Upstairs` ecobee -> `192.168.1.131` -> target `IoT`
Validation for each:
- app still works
- device online
- no broad helper rule was needed
### Migrate Later Only If Calm
6. `Google-Home-Mini` -> `192.168.1.185`
7. `3c:8d:20:f3:92:36` -> Google device -> `192.168.1.192`
8. `90:ca:fa:b6:7f:6e` -> Google device -> `192.168.1.129`
Rule:
- Google is in scope tomorrow, but start with one Google-class device only unless everything is smooth
- if it demands broad discovery hacks, stop and defer
### Quarantine Tomorrow
9. `5c:61:99:41:73:40` -> unknown Cloud Network device
10. `60:74:f4:54:fd:ec` -> Private/randomized
11. `60:74:f4:7b:6a:11` -> Private/randomized
12. `c0:f5:35:20:5d:94` -> AMPAK device
13. `d4:ad:fc:60:90:6a` -> Intellirocks
14. `d4:ad:fc:ea:7f:65` -> Intellirocks
Rule:
- these do not earn clean-IoT membership by being merely online
- leave them on Legacy CIA quarantine until identified better
## 8. Camera/Security Reality Check
Already true:
- `front-doorbell` is already on Camera at `10.5.20.217`
Tomorrow’s security work is therefore mainly:
- move/clean up chimes
- tighten policy
- preserve the doorbell’s healthy state
## 9. Firewall Build Priorities
Build these first:
- established/related allow
- invalid drop
- management shield
- Trusted admin -> Management allow
- Trusted -> Servers allow
- Guest -> internet only
- IoT -> DNS/NTP/internet + specific helpers only
- Camera -> DNS/NTP/internet/Protect only
- Legacy CIA -> DNS/NTP/internet only + explicit one-offs only
- broad internal denies for Guest/IoT/Camera/Legacy CIA
Do not do tomorrow unless proven necessary:
- broad mDNS/cast trust exceptions
- loose `IoT -> Servers any`
- loose `Legacy CIA -> Trusted any`
## 10. Validation Gates
After each meaningful change, check the smallest thing that proves success.
### After management changes
- [ ] UniFi admin still reachable
- [ ] gateway/switch/AP still visible
- [ ] no surprise loss of wireless control
### After each server port move
- [ ] host gets correct subnet/gateway
- [ ] reachable from Trusted
- [ ] expected service path works
### After the Nomad/Serenity/PD batch
- [ ] NFS/shared-service relationships recover cleanly
- [ ] PD remains reachable from Rocinante/admin path
- [ ] no cross-server dependency is hanging half-broken
### After each IoT move
- [ ] device rejoins expected SSID/VLAN
- [ ] app/control works
- [ ] no broad workaround rule added
### After security changes
- [ ] doorbell/chime online
- [ ] expected app/admin behavior works
### After quarantine posture changes
- [ ] Legacy CIA devices still have minimum acceptable functionality
- [ ] they do not have new local trust
## 11. Fast Rollback Strip
If anything goes sideways:
1. revert the last moved device/port first
2. revert the last SSID/VLAN assignment second
3. revert the last firewall rule/order change third
4. restore management-plane reachability before doing anything clever
5. do not stack fresh changes on top of confusion
Immediate rollback triggers:
- loss of UniFi management-plane access
- AP/switch disappears unexpectedly
- moved server loses reachability and root cause is not obvious quickly
- critical household function breaks and cannot be explained fast
- Google weirdness starts baiting sloppy panic rules
## 12. Explicit Stop Condition
Stop when:
- Management is materially cleaner
- Cameras lane is sane
- core server moves are done or deliberately deferred with reasons
- easy-value IoT moves are done
- Legacy CIA is explicitly a quarantine/sunset lane
- the next remaining work item smells like “heroics” instead of “mechanical completion”
That is success.
Not every leftover wart has to die tomorrow.