Sync network redesign repo state and cutover artifacts

2026-05-22 20:16:21 +00:00
parent 4b1e3d4061
commit 8c72a0c287
59 changed files with 5389 additions and 244 deletions
--- a/home/doris-dashboard/docs/network-cutover-minute-checklist.md
+++ b/home/doris-dashboard/docs/network-cutover-minute-checklist.md
@@ -0,0 +1,261 @@
+# Home Network Redesign Minute-by-Minute Cutover Checklist
+
+> For Doris: this is the live change-window script. Use it like a pilot checklist, not a brainstorming prompt.
+
+Goal: execute the redesign tomorrow with deliberate pauses, validation after every block of changes, and clean rollback points.
+
+Assumptions:
+- You have UniFi admin access.
+- One stable Trusted admin client remains connected the entire time.
+- You are not trying to empty Legacy CIA completely in one heroic swing.
+
+---
+
+## T-30 to T-15 minutes: staging and sanity
+
+- [ ] Open the runbook:
+  - `/home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md`
+- [ ] Open firewall rule order:
+  - `/home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-firewall-rule-order.md`
+- [ ] Open Legacy CIA worksheet:
+  - `/home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/legacy-cia-triage-worksheet.md`
+- [ ] Open visual artifacts:
+  - `http://10.5.30.7:8787/network-redesign.html`
+  - `http://10.5.30.7:8787/network-web.html`
+- [ ] Confirm Rocinante is the live control box.
+- [ ] Confirm fallback route to UniFi exists in case Rocinante loses the lane mid-change.
+- [ ] Decide whether U6 LR is in or out for tomorrow.
+- [ ] Do not start until you know where rollback begins.
+
+## Minute 0-10: baseline capture
+
+- [ ] Screenshot/export current networks.
+- [ ] Screenshot/export current SSIDs.
+- [ ] Screenshot/export firewall rules and order.
+- [ ] Screenshot/export port profiles.
+- [ ] Screenshot/export current switch port assignments.
+- [ ] Screenshot/export AP config/broadcast mappings.
+- [ ] Record current IP/MAC for:
+  - PD
+  - Serenity
+  - Nomad
+  - Rocinante
+  - doorbell
+  - Protect chimes
+  - ecobees
+  - MyQ
+  - Samsung FamilyHub
+  - LG dryer
+  - known Google/cast devices
+- [ ] Snapshot which clients are on Management now.
+- [ ] Snapshot which clients are on Legacy CIA now.
+
+Stop/go check:
+- [ ] If baseline capture is incomplete, stop.
+
+## Minute 10-20: create/normalize objects only
+
+- [ ] Create or confirm target networks:
+  - Mgmt 10
+  - Trusted 20
+  - Servers 30
+  - IoT 40
+  - Guest 50
+  - Cameras 60
+  - Legacy CIA retained
+- [ ] Create or confirm port profiles.
+- [ ] Create or confirm SSIDs:
+  - Trusted
+  - Trusted-Compat if needed
+  - IoT
+  - Guest
+  - Security
+  - CIA Via only if still needed as temporary quarantine SSID
+- [ ] Create/stage rule objects/groups.
+- [ ] Enter staged firewall rules in proper order if not already present.
+
+Stop/go check:
+- [ ] Nothing should have moved yet.
+- [ ] Trusted admin client must still be fine.
+
+## Minute 20-35: management cleanup first
+
+- [ ] Confirm UDM, switches, and APs are mapped to Management intent.
+- [ ] Remove obvious non-infrastructure devices from Management.
+- [ ] Identify any stragglers remaining in Management and list them.
+- [ ] If Security lane is ready, prepare to move chimes immediately.
+
+Validation:
+- [ ] UniFi still sees gateway, switches, APs.
+- [ ] Trusted admin client can still reach controller.
+- [ ] No surprise disconnects.
+
+Rollback trigger:
+- [ ] If management reachability degrades, revert the last infra change immediately.
+
+## Minute 35-50: stand up Cameras / Security lane
+
+- [ ] Activate/validate Cameras VLAN 60.
+- [ ] Activate Security SSID if needed.
+- [ ] Move Protect chimes.
+- [ ] Move doorbell if ready.
+- [ ] Confirm no security devices remain polluting Management.
+
+Validation:
+- [ ] device rejoins expected lane
+- [ ] app/admin/Protect behavior still works
+- [ ] no broad emergency rules added yet
+
+Rollback trigger:
+- [ ] If doorbell/chimes become unrecoverable fast, revert that device only.
+
+## Minute 50-75: move core servers to Servers VLAN 30
+
+Order recommendation for this window:
+1. keep Rocinante in place as the live operator station
+2. move Nomad
+3. move Serenity
+4. move PD
+5. move Rocinante only after the main batch is validated, or defer it
+6. leave FlyingDutchman on Trusted unless you explicitly decide to reclassify it later
+
+For the Nomad/Serenity/PD batch:
+- [ ] pre-stage the exact three-host move order before the first change
+- [ ] move Nomad to Servers VLAN/profile
+- [ ] move Serenity to Servers VLAN/profile
+- [ ] move PD to Servers VLAN/profile
+- [ ] verify IP/gateway/subnet for all three
+- [ ] verify from Rocinante
+- [ ] verify NFS/shared-service paths recover cleanly
+- [ ] note any reservation/DNS fix needed before continuing
+
+Validation after the batch:
+- [ ] each host responds as expected
+- [ ] shared services still work
+- [ ] PD is still reachable from Rocinante
+- [ ] no accidental management loss
+
+Rollback trigger:
+- [ ] If the batch breaks and root cause is not obvious quickly, revert the last moved host first and unwind in reverse order.
+
+## Minute 75-100: easy-value IoT migration
+
+Move in this general order:
+1. MyQ
+2. Samsung FamilyHub
+3. LG dryer
+4. ecobees if confidence remains high
+
+For each device/class:
+- [ ] move to IoT VLAN 40 / IoT SSID
+- [ ] wait for reassociation
+- [ ] verify cloud/app control
+- [ ] verify no stupid broad helper rule was needed
+
+Validation:
+- [ ] app works
+- [ ] device online
+- [ ] no Management exposure
+
+Rollback trigger:
+- [ ] If household-critical behavior breaks, revert only that device and continue with safer devices.
+
+## Minute 100-115: Legacy CIA triage pass
+
+- [ ] Open the triage worksheet.
+- [ ] For every remaining Legacy CIA client, mark:
+  - migrate later
+  - quarantine
+  - kill candidate
+- [ ] Keep useful-but-fragile leftovers on Legacy CIA.
+- [ ] Apply quarantine firewall posture.
+- [ ] Ensure no new devices are intentionally assigned there.
+
+Validation:
+- [ ] Legacy CIA is now explicitly a quarantine lane, not fake production IoT.
+- [ ] Remaining devices are explainable.
+
+## Minute 115-130: Google / discovery problem children only if time remains
+
+- [ ] Pick one Google/cast device only.
+- [ ] Try moving it to IoT.
+- [ ] Test casting/discovery from Trusted.
+- [ ] If it needs exceptions, create only host-specific narrow ones.
+- [ ] If it gets ugly, stop and revert that one device.
+
+Success condition:
+- [ ] either one working pattern discovered
+- [ ] or explicit deferral decided without poisoning policy
+
+## Minute 130-140: Guest and SSID cleanup
+
+- [ ] Verify Guest SSID -> VLAN 50.
+- [ ] Test internet-only behavior.
+- [ ] Disable stale SSIDs that are no longer needed.
+- [ ] Keep Trusted-Compat only if it solved a real problem.
+- [ ] Keep CIA Via only if remaining quarantined devices still require it.
+
+## Minute 140-150: final validation sweep
+
+From Trusted:
+- [ ] internet works
+- [ ] UniFi admin works
+- [ ] PD/Serenity/Nomad/Rocinante reachable as intended
+
+From Guest:
+- [ ] internet works
+- [ ] local IPs blocked
+
+From IoT moved devices:
+- [ ] app control works
+
+From Cameras/Security:
+- [ ] doorbell/chimes online as expected
+
+From Management perspective:
+- [ ] infra only, or any temporary exception is explicitly documented
+
+From Legacy CIA perspective:
+- [ ] only leftovers remain
+- [ ] quarantine posture is active
+
+## Minute 150-165: document what survived the window
+
+- [ ] Record exact devices moved successfully.
+- [ ] Record exact devices reverted.
+- [ ] Record temporary exceptions added.
+- [ ] Record which devices remain on Legacy CIA and why.
+- [ ] Record whether U6 LR remains out of scope or becomes next task.
+
+## Minute 165-180: stop, do not improvise
+
+If minimum success criteria are met, stop.
+
+Minimum success criteria:
+- [ ] Management cleaned up materially
+- [ ] Cameras lane exists
+- [ ] Servers lane exists and core hosts are moved or clearly staged
+- [ ] IoT lane exists and easy-value devices moved
+- [ ] Legacy CIA converted into explicit quarantine/sunset lane
+- [ ] no broad insecure panic rules were added
+
+If not met:
+- [ ] roll back only the broken last-mile changes
+- [ ] do not keep piling on work while tired
+
+## Emergency rollback strip
+
+If something goes sideways:
+1. revert the last moved client/device
+2. revert the last SSID/VLAN assignment change
+3. revert the last firewall rule change/order change
+4. restore management-plane reachability first
+5. only continue after stability is back
+
+## Out of scope unless everything is shockingly smooth
+
+- full emptying of Legacy CIA
+- perfect cast/mDNS handling for every Google thing
+- RF fine-tuning
+- U6 LR optimization work
+- cleanup of every stale historical object in UniFi