Sync network redesign repo state and cutover artifacts
This commit is contained in:
Fizzlepoof
209
home/doris-dashboard/docs/usw-pro-hd-24-cutover-port-sheet.md
Normal file
209
home/doris-dashboard/docs/usw-pro-hd-24-cutover-port-sheet.md
Normal file
@@ -0,0 +1,209 @@
|
||||
# USW Pro HD 24 Exact Change Sheet
|
||||
|
||||
> For Doris: this is the mechanical switch-port sheet for tomorrow. Do not freestyle. Change one thing, validate, then continue.
|
||||
|
||||
Source basis:
|
||||
- live UniFi read-only recon on 2026-05-22
|
||||
- /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md
|
||||
- /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md
|
||||
|
||||
## Core principle
|
||||
- Uplink/AP/infra ports stay Management or trunked as appropriate.
|
||||
- Server-class hosts leave Trusted and move to Servers.
|
||||
- Unknown live ports get eyeballed before change.
|
||||
- Do not bulk-edit profiles blindly.
|
||||
- Rocinante is the live operator box, so keep it stable until the main server batch is complete or an alternate admin path is proven.
|
||||
- Nomad, Serenity, and PD may need to move as one controlled wave because of NFS/shared-service coupling; validate the batch immediately.
|
||||
|
||||
---
|
||||
|
||||
## 1. Desired profile set for tomorrow
|
||||
|
||||
Current relevant profiles seen live:
|
||||
- Management
|
||||
- Trusted
|
||||
- IoT
|
||||
- Camera
|
||||
- Old IoT
|
||||
|
||||
Needed for tomorrow:
|
||||
- Management
|
||||
- Trusted
|
||||
- Servers
|
||||
- IoT
|
||||
- Camera
|
||||
- Guest
|
||||
- Old IoT
|
||||
- trunk/uplink profile if you choose to normalize uplinks now
|
||||
|
||||
If `Servers` does not exist yet:
|
||||
- create it before changing server ports
|
||||
- use it as the target for the core host ports below
|
||||
|
||||
## 2. USW Pro HD 24 live ports that matter
|
||||
|
||||
### Port 1
|
||||
- Name: `U7 Pro (Upstairs)`
|
||||
- Current profile: `Management`
|
||||
- Link: up
|
||||
- Speed: 2.5G
|
||||
- Role: AP uplink / infrastructure
|
||||
- Tomorrow action: leave on Management unless/until you replace with an explicit trunk/uplink profile
|
||||
- Risk: high if changed incorrectly
|
||||
- Validation after any change:
|
||||
- U7 Pro remains online in UniFi
|
||||
- wireless clients stay associated
|
||||
- management plane remains reachable
|
||||
|
||||
### Port 2
|
||||
- Name: `Port 2`
|
||||
- Current observed live client: `Rocinante`
|
||||
- Current explicit profile visibility: not clearly returned by API
|
||||
- Link: up
|
||||
- Speed: 2.5G
|
||||
- Role: server/core host
|
||||
- Tomorrow action: inspect in UniFi UI first, confirm current native network/profile, but keep Rocinante in place as the live operator station until the Nomad/Serenity/PD batch is done or a backup admin path is proven
|
||||
- Risk: medium because profile visibility was ambiguous in API data
|
||||
- Validation after move:
|
||||
- Rocinante gets expected Servers subnet/gateway
|
||||
- reachable from Trusted as intended
|
||||
- any expected service ports work
|
||||
|
||||
### Port 3
|
||||
- Name: `FlyingDutchman`
|
||||
- Current profile: `Trusted`
|
||||
- Link: up
|
||||
- Speed: 2.5G
|
||||
- Role: human endpoint / gaming PC unless proven otherwise
|
||||
- Tomorrow action: leave on `Trusted` tomorrow unless you deliberately reclassify it later; default assumption is that it should stay with trusted human endpoints
|
||||
- Risk: medium
|
||||
- Validation after move:
|
||||
- host gets expected subnet/gateway
|
||||
- reachable from Trusted as intended
|
||||
- only move if this box is actually supposed to live with the homelab service lane
|
||||
|
||||
### Port 22
|
||||
- Name: `Port 22`
|
||||
- Current live client: `Nomad`
|
||||
- Current profile: `Trusted`
|
||||
- Link: up
|
||||
- Speed: 2.5G
|
||||
- Role: core host
|
||||
- Tomorrow action: move to `Servers`
|
||||
- Risk: medium
|
||||
- Validation after move:
|
||||
- Nomad gets expected Servers address
|
||||
- Doris pages / services expected on Nomad still reachable from Trusted
|
||||
|
||||
### Port 23
|
||||
- Name: `Docker Server`
|
||||
- Current live client: `PlausibleDeniability`
|
||||
- Current profile: `Trusted`
|
||||
- Link: up
|
||||
- Speed: 10G
|
||||
- Role: primary core server
|
||||
- Tomorrow action: move to `Servers`
|
||||
- Risk: high-ish because this is central infrastructure
|
||||
- Validation after move:
|
||||
- PD gets expected Servers address
|
||||
- SSH to `pd` still works from Trusted/admin lane
|
||||
- critical services still reachable from Trusted
|
||||
- no surprise breakage to shared homelab functions
|
||||
|
||||
### Port 24
|
||||
- Name: `Serenity 10G (1)`
|
||||
- Current live client: `Serenity`
|
||||
- Current profile: `Trusted`
|
||||
- Link: up
|
||||
- Speed: 10G
|
||||
- Role: core host
|
||||
- Tomorrow action: move to `Servers`
|
||||
- Risk: medium-high
|
||||
- Validation after move:
|
||||
- Serenity gets expected Servers address
|
||||
- intended services still reachable from Trusted
|
||||
|
||||
### Port 27
|
||||
- Name: `Port 27`
|
||||
- Current profile: `Management`
|
||||
- Link: up
|
||||
- Speed: 10G
|
||||
- Role: likely infra/uplink
|
||||
- Tomorrow action: do not touch unless you have positively identified what it is
|
||||
- Risk: very high
|
||||
- Validation if ever touched:
|
||||
- upstream/downstream infra remains healthy
|
||||
- no switch isolation or mgmt loss
|
||||
|
||||
## 3. Recommended exact move order for server ports
|
||||
|
||||
Use this order, not random order:
|
||||
|
||||
1. Port 2 -> Rocinante
|
||||
- inspect/profile-confirm first
|
||||
- do not move it early if it is your live admin path
|
||||
|
||||
2. Port 22 -> Nomad
|
||||
- first member of the controlled three-host batch
|
||||
|
||||
3. Port 24 -> Serenity
|
||||
- second member of the controlled three-host batch
|
||||
|
||||
4. Port 23 -> PlausibleDeniability
|
||||
- third member of the controlled three-host batch
|
||||
|
||||
5. Port 3 -> FlyingDutchman
|
||||
- default action is no move; only revisit if you intentionally decide it belongs in Servers after all
|
||||
|
||||
If you want the most conservative variant:
|
||||
- leave Rocinante on Trusted during the live work
|
||||
- move Nomad, Serenity, and PD as the only server-lane batch
|
||||
- leave FlyingDutchman on Trusted
|
||||
|
||||
## 4. Per-port execution script
|
||||
|
||||
For each independent server port or server batch:
|
||||
1. open switch port in UniFi UI
|
||||
2. confirm live client identity matches expectation
|
||||
3. screenshot current state
|
||||
4. if touching Nomad/Serenity/PD, pre-stage the exact order before the first change
|
||||
5. change profile from `Trusted` (or current) -> `Servers`
|
||||
6. wait for link/client/IP reassignment
|
||||
7. verify host gets expected subnet/gateway
|
||||
8. verify reachability from Rocinante/admin path
|
||||
9. verify expected service behavior
|
||||
10. if it was the three-host batch, verify cross-host dependencies before anything else
|
||||
11. only then proceed to next port
|
||||
|
||||
## 5. Ports to explicitly leave alone tomorrow
|
||||
|
||||
Leave alone unless a later issue forces action:
|
||||
- Port 1 (U7 Pro upstairs)
|
||||
- Port 27 (likely infra/uplink)
|
||||
- all inactive ports
|
||||
- any uplink/trunk-ish port not positively identified
|
||||
|
||||
## 6. Potential follow-up ports outside the main switch
|
||||
|
||||
USW-24-PoE notable live port:
|
||||
- Port 24 -> profile `Management` -> link up at 1G
|
||||
- Tomorrow action: read-only verify what it is before touching
|
||||
- Do not change it casually during the same window unless you have confirmed its role
|
||||
|
||||
## 7. Success criteria for this port sheet
|
||||
|
||||
Successful tomorrow outcome:
|
||||
- Nomad, Serenity, and PD are no longer sitting on Trusted access ports
|
||||
- Rocinante is either still the live admin box by deliberate choice or moved cleanly after the main batch is complete
|
||||
- FlyingDutchman stays on Trusted unless deliberately reclassified with reason
|
||||
- AP/uplink/infra ports remain stable
|
||||
- no server move proceeds without validation
|
||||
|
||||
## 8. Red flags
|
||||
|
||||
Stop immediately if:
|
||||
- a moved host does not pull the expected subnet
|
||||
- SSH/admin access path disappears unexpectedly
|
||||
- a port identity in the UI does not match expected host
|
||||
- changing one port breaks unrelated infra
|
||||
- PD move causes unclear blast radius and you cannot explain it within a couple minutes
|
||||
Reference in New Issue
Block a user