Sync network redesign repo state and cutover artifacts

home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md

@@ -0,0 +1,138 @@
+# UniFi Read-Only Recon Notes
+
+Date: 2026-05-22
+Mode: read-only only
+Auth status: verified working with upgraded Doris admin login
+
+## Scope completed
+- authenticated login verified
+- network object inventory read
+- SSID inventory read
+- port profile inventory read
+- client inventory read
+- AP/client mapping read
+- wired switch-port/client mapping read
+- firewall/policy endpoint probes read
+
+## High-value findings
+
+### 1. Firewall model / current policy state
+- `firewallrule`: 200, count 0
+- `firewallgroup`: 200, count 0
+- `firewallzone`: 400
+- `trafficrule`: 400
+- `routing`: 200, count 0
+
+Interpretation:
+- there are currently no custom classic firewall rules in the Network app dataset returned by the API
+- no custom firewall groups are defined there either
+- zone/traffic-rule endpoints are not active in the way this API helper expected
+- practical implication: tomorrow’s segmentation policy work is largely greenfield, not cleanup of a big custom ruleset
+
+### 2. Current network objects
+- Management -> corporate -> untagged -> `10.5.0.1/24`
+- Trusted -> corporate -> VLAN 51 -> `10.5.1.1/24`
+- Old IoT -> corporate -> VLAN 2 -> `192.168.1.1/24`
+- IoT -> corporate -> VLAN 510 -> `10.5.10.1/24`
+- Camera -> corporate -> VLAN 520 -> `10.5.20.1/24`
+- Guest -> guest -> VLAN 590 -> `10.5.90.1/24`
+
+### 3. Current SSIDs
+- `CIA Via` -> Old IoT
+- `UNEF's Playhouse` -> Camera
+- `Whiskey Neat Fuck Ice` -> Trusted
+- `Yer a Wifi Harry` -> Trusted
+
+### 4. Management offenders
+Both Management-lane clients are Wi‑Fi clients on the U7 Pro and both are unnamed `espressif` devices on the default `UniFi Wireless` SSID.
+
+- `espressif` -> `10.5.0.123` -> U7 Pro -> SSID `UniFi Wireless`
+- `espressif` -> `10.5.0.189` -> U7 Pro -> SSID `UniFi Wireless`
+
+Interpretation:
+- these are almost certainly stray ESP-class smart devices and exactly the kind of junk that should not live on Management
+- tomorrow we should either identify and move them, or quarantine them if they are brittle
+
+### 5. Old IoT live inventory
+All are currently on SSID `CIA Via` via the U7 Pro.
+
+Likely migrate-first / easy-value:
+- `MyQ-29B` -> `192.168.1.130`
+- `Main-Floor` ecobee -> `192.168.1.102`
+- `Upstairs` ecobee -> `192.168.1.131`
+- `LG_Smart_Dryer2_open` -> `192.168.1.186`
+- `Samsung-FamilyHub` -> `192.168.1.149`
+
+Likely migrate-later / discovery pain:
+- `Google-Home-Mini` -> `192.168.1.185`
+- `3c:8d:20:f3:92:36` -> Google -> `192.168.1.192`
+- `90:ca:fa:b6:7f:6e` -> Google -> `192.168.1.129`
+
+Likely quarantine until identified better:
+- `5c:61:99:41:73:40` -> Cloud Network Technology Singapore -> `192.168.1.172`
+- `60:74:f4:54:fd:ec` -> Private -> `192.168.1.136`
+- `60:74:f4:7b:6a:11` -> Private -> `192.168.1.117`
+- `c0:f5:35:20:5d:94` -> AMPAK -> `192.168.1.183`
+- `d4:ad:fc:60:90:6a` -> Shenzhen Intellirocks -> `192.168.1.100`
+- `d4:ad:fc:ea:7f:65` -> Shenzhen Intellirocks -> `192.168.1.101`
+
+### 6. Camera lane live state
+- `front-doorbell` is already on Camera network at `10.5.20.217`
+
+Interpretation:
+- the doorbell is already where it belongs logically
+- tomorrow’s security cleanup work is mainly about chimes and future policy tightening
+
+### 7. Trusted lane still carrying infrastructure-class hosts
+Trusted currently includes:
+- `PlausibleDeniability` -> `10.5.1.6`
+- `Serenity` -> `10.5.1.5`
+- `Nomad` -> `10.5.1.16`
+- `Rocinante` -> `10.5.1.112`
+- `FlyingDutchman` -> `10.5.1.111`
+
+Interpretation:
+- tomorrow’s server-lane work is real and necessary
+- these should not stay blended into the human client lane long-term
+
+### 8. AP/client mapping
+- `U7 Pro`: 26 clients
+- `wired/unknown`: 5 clients
+
+Interpretation:
+- almost all current active wireless load is concentrated on the U7 Pro
+- the U6 LR is presently not carrying client load
+
+### 9. Wired client to switch-port mapping
+On `USW Pro HD 24`:
+- port 2 -> `Rocinante`
+- port 3 -> `FlyingDutchman`
+- port 22 -> `Nomad`
+- port 23 -> `PlausibleDeniability`
+- port 24 -> `Serenity`
+
+### 10. Important switch-port assignments
+On `USW Pro HD 24`:
+- port 1 -> profile `Management` -> `U7 Pro (Upstairs)`
+- port 22 -> profile `Trusted` -> `Nomad`
+- port 23 -> profile `Trusted` -> `Docker Server` / PD
+- port 24 -> profile `Trusted` -> `Serenity 10G (1)`
+- port 27 -> profile `Management` -> up at 10G
+- port 3 -> profile `Trusted` -> `FlyingDutchman`
+- port 2 -> up at 2.5G with no explicit profile shown -> `Rocinante`
+
+On `USW-24-PoE`:
+- port 24 -> profile `Management` -> up at 1G
+- many inactive preassigned ports exist for `IoT`, `Old IoT`, and `Management`
+
+Interpretation:
+- the core server moves tomorrow are mechanically straightforward because their live ports are visible
+- PD / Serenity / Nomad / FlyingDutchman are explicitly sitting on Trusted access profiles today
+- Rocinante needs a quick extra look because the client is live on port 2 but that port did not show an explicit profile name in the returned record
+
+## Recommended next actions for tomorrow
+1. identify the two Management `espressif` devices before or during the window
+2. move/changeprofile for server ports on the USW Pro HD 24 one at a time
+3. treat Google devices as late-batch or defer
+4. treat unknown Old IoT clients as quarantine by default, not migration by default
+5. keep Camera cleanup focused on chimes and policy, because the doorbell is already in the correct lane