fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document UniFi baseline secret leak guardrails

Browse Source
This commit is contained in:
Doris
2026-05-22 20:58:41 +00:00
parent 5f56fe75d8
commit c2c71cfe57
6 changed files with 145 additions and 609 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
home/doris-dashboard/docs/baselines/README.md Normal file
View File

@@ -0,0 +1,31 @@
# Baselines Directory Policy
This directory is for **sanitized operator artifacts only**.
## What belongs here
- markdown summaries of controller state
- redacted JSON examples that have been intentionally scrubbed
- operator notes that support future change windows
## What does not belong here
- raw UniFi controller exports
- full `networkconf` / `portconf` dumps captured straight from the API
- VPN client/server config exports
- any artifact containing keys, tokens, passwords, cookies, CSRF material, or embedded auth config
## Why this rule exists
A raw UniFi baseline export committed during the 2026-05-22 network redesign documentation pass contained WireGuard private keys and triggered a real secret-leak incident.
See:
- `docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md`
- `docs/operations/SECRETS_MANAGEMENT.md`
## Safe workflow
1. Capture raw exports outside the main repo or in the encrypted secrets repo.
2. Inspect them for secret-bearing fields.
3. Commit only a markdown summary or an explicitly redacted artifact.
4. Prefer human-readable summaries over raw appliance dumps.

608
home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json
View File

@@ -1,608 +0,0 @@
{
"captured_at": "2026-05-21T21:46:53-05:00",
"site": "default",
"networkconf": [
{
"setting_preference": "auto",
"purpose": "wan",
"external_id": "d488cbbc-05dd-4bab-9efb-4b58340df685",
"wan_type_v6": "disabled",
"routing_table_id": 201,
"ipv6_wan_delegation_type": "none",
"wan_dhcpv6_pd_size_auto": true,
"firewall_zone_id": "6963d42a1131084f054618e0",
"igmp_proxy_upstream": false,
"mac_override_enabled": false,
"wan_load_balance_type": "failover-only",
"wan_failover_priority": 2,
"wan_ipv6_dns_preference": "auto",
"wan_networkgroup": "WAN",
"wan_dslite_remote_host_auto": false,
"wan_smartq_enabled": false,
"wan_dns_preference": "auto",
"wan_vlan_enabled": false,
"wan_load_balance_weight": 99,
"site_id": "6963c5321131084f05460911",
"name": "Internet 1",
"report_wan_event": false,
"_id": "6963c5831131084f05460929",
"attr_no_delete": true,
"wan_type": "dhcp",
"attr_hidden_id": "WAN"
},
{
"setting_preference": "manual",
"purpose": "wan",
"wan_dhcp_cos": 0,
"external_id": "c10cd8c4-7f9c-4d12-a7ea-e1a34ab8ead7",
"wan_type_v6": "disabled",
"routing_table_id": 202,
"enabled": true,
"wan_dhcp_options": [],
"ipv6_wan_delegation_type": "none",
"wan_dhcpv6_pd_size_auto": true,
"firewall_zone_id": "6963d42a1131084f054618e0",
"igmp_proxy_upstream": false,
"mac_override_enabled": false,
"wan_load_balance_type": "weighted",
"wan_failover_priority": 1,
"ipv6_setting_preference": "manual",
"wan_ipv6_dns_preference": "auto",
"single_network_lan": "",
"wan_dns2": "9.9.9.9",
"wan_ipv6_dns1": "",
"wan_dns1": "10.5.1.53",
"wan_ipv6_dns2": "",
"wan_networkgroup": "WAN2",
"wan_dslite_remote_host_auto": false,
"wan_provider_capabilities": {
"upload_kilobits_per_second": 2409000,
"download_kilobits_per_second": 2120000
},
"wan_ip_aliases": [],
"wan_smartq_enabled": false,
"wan_dns_preference": "manual",
"wan_vlan_enabled": false,
"wan_load_balance_weight": 50,
"site_id": "6963c5321131084f05460911",
"name": "Internet 2",
"report_wan_event": false,
"_id": "6963c5831131084f0546092a",
"wan_type": "dhcp",
"attr_no_delete": true,
"igmp_proxy_for": "none"
},
{
"setting_preference": "manual",
"dhcpdv6_dns_auto": true,
"ipv6_pd_stop": "::7d1",
"dhcpd_gateway_enabled": false,
"ipv6_client_address_assignment": "slaac",
"network_isolation_enabled": false,
"dhcp_relay_servers": [],
"dhcpd_start": "10.5.0.100",
"dhcpd_unifi_controller": "",
"ipv6_ra_enabled": true,
"domain_name": "localdomain",
"ip_subnet": "10.5.0.1/24",
"ipv6_interface_type": "none",
"dhcpd_wins_2": "",
"dhcpdv6_stop": "::7d1",
"is_nat": true,
"dhcpd_wins_1": "",
"dhcpd_dns_enabled": false,
"internet_access_enabled": true,
"nat_outbound_ip_addresses": [],
"dhcp_relay_enabled": false,
"dhcpd_conflict_checking": true,
"dhcpd_wins_enabled": false,
"dhcpdv6_leasetime": 86400,
"site_id": "6963c5321131084f05460911",
"name": "Management",
"_id": "6963c5831131084f0546092b",
"lte_lan_enabled": true,
"purpose": "corporate",
"dhcpd_leasetime": 86400,
"dhcpguard_enabled": false,
"dhcpd_time_offset_enabled": false,
"external_id": "652279eb-41e5-440d-aad5-231ca9683890",
"ipv6_ra_preferred_lifetime": 14400,
"dhcpd_stop": "10.5.0.199",
"is_smart_subnet_detected": false,
"enabled": true,
"dhcpd_enabled": true,
"dhcpd_wpad_url": "",
"networkgroup": "LAN",
"firewall_zone_id": "6963d42a1131084f054618df",
"dhcpdv6_start": "::2",
"vlan_enabled": false,
"ipv6_setting_preference": "auto",
"ipv6_aliases": [],
"gateway_type": "default",
"ipv6_ra_priority": "high",
"dhcpd_boot_enabled": false,
"ipv6_pd_start": "::2",
"upnp_lan_enabled": false,
"dhcpd_ntp_enabled": false,
"mdns_enabled": true,
"ip_aliases": [],
"attr_no_delete": true,
"attr_hidden_id": "LAN",
"dhcpd_tftp_server": "",
"auto_scale_enabled": false
},
{
"setting_preference": "manual",
"dhcpd_gateway_enabled": false,
"network_isolation_enabled": false,
"dhcp_relay_servers": [],
"dhcpd_dns_1": "192.168.1.10",
"dhcpd_start": "10.5.1.100",
"dhcpd_unifi_controller": "",
"domain_name": "",
"ip_subnet": "10.5.1.1/24",
"dhcpd_dns_4": "",
"ipv6_interface_type": "none",
"dhcpd_dns_2": "",
"dhcpd_dns_3": "",
"dhcpd_wins_2": "",
"is_nat": true,
"dhcpd_wins_1": "",
"dhcpd_dns_enabled": false,
"internet_access_enabled": true,
"nat_outbound_ip_addresses": [],
"dhcp_relay_enabled": false,
"dhcpd_conflict_checking": true,
"dhcpd_wins_enabled": false,
"name": "Trusted",
"site_id": "6963c5321131084f05460911",
"_id": "6963cb201131084f05461635",
"lte_lan_enabled": true,
"dhcpd_leasetime": 86400,
"purpose": "corporate",
"dhcpd_time_offset_enabled": false,
"dhcpguard_enabled": false,
"external_id": "87b66e27-93a9-4fb7-93d2-3b7bca9e6414",
"enabled": true,
"dhcpd_stop": "10.5.1.199",
"dhcpd_enabled": true,
"vlan": 51,
"dhcpd_wpad_url": "",
"networkgroup": "LAN",
"firewall_zone_id": "6963d42a1131084f054618df",
"vlan_enabled": true,
"ipv6_setting_preference": "manual",
"ipv6_aliases": [],
"gateway_type": "default",
"dhcpd_boot_enabled": false,
"upnp_lan_enabled": false,
"dhcpd_ntp_enabled": false,
"mdns_enabled": true,
"ip_aliases": [],
"dhcpd_tftp_server": "",
"auto_scale_enabled": false
},
{
"setting_preference": "manual",
"dhcpd_leasetime": 86400,
"purpose": "corporate",
"dhcpd_gateway_enabled": false,
"dhcpd_time_offset_enabled": false,
"dhcpguard_enabled": false,
"network_isolation_enabled": true,
"dhcp_relay_servers": [],
"dhcpd_start": "10.5.10.6",
"dhcpd_unifi_controller": "",
"external_id": "88180bc3-2c34-4f30-9b57-aed15da2a12a",
"enabled": true,
"dhcpd_stop": "10.5.10.254",
"domain_name": "",
"dhcpd_enabled": true,
"ip_subnet": "10.5.10.1/24",
"vlan": 510,
"dhcpd_wpad_url": "",
"ipv6_interface_type": "none",
"networkgroup": "LAN",
"firewall_zone_id": "6963d5a91131084f05461a0d",
"vlan_enabled": true,
"dhcpd_wins_2": "",
"ipv6_setting_preference": "manual",
"dhcpd_wins_1": "",
"dhcpd_dns_enabled": false,
"ipv6_aliases": [],
"internet_access_enabled": true,
"gateway_type": "default",
"nat_outbound_ip_addresses": [],
"dhcpd_boot_enabled": false,
"dhcp_relay_enabled": false,
"dhcpd_conflict_checking": true,
"dhcpd_wins_enabled": false,
"dhcpd_ntp_enabled": false,
"name": "IoT",
"site_id": "6963c5321131084f05460911",
"mdns_enabled": true,
"ip_aliases": [],
"_id": "6963cb461131084f05461642",
"lte_lan_enabled": true,
"dhcpd_tftp_server": "",
"auto_scale_enabled": true
},
{
"setting_preference": "auto",
"dhcpd_leasetime": 86400,
"purpose": "guest",
"dhcpd_gateway_enabled": false,
"dhcpd_time_offset_enabled": false,
"dhcpguard_enabled": false,
"network_isolation_enabled": false,
"dhcp_relay_servers": [],
"dhcpd_start": "10.5.90.6",
"dhcpd_unifi_controller": "",
"external_id": "2986eea1-bf02-4879-a7b0-7d9f91e45c53",
"enabled": true,
"dhcpd_stop": "10.5.90.254",
"domain_name": "",
"dhcpd_enabled": true,
"ip_subnet": "10.5.90.1/24",
"vlan": 590,
"dhcpd_wpad_url": "",
"ipv6_interface_type": "none",
"networkgroup": "LAN",
"firewall_zone_id": "6963d42a1131084f054618e3",
"vlan_enabled": true,
"dhcpd_wins_2": "",
"ipv6_setting_preference": "manual",
"is_nat": true,
"dhcpd_wins_1": "",
"dhcpd_dns_enabled": false,
"ipv6_aliases": [],
"internet_access_enabled": true,
"gateway_type": "default",
"nat_outbound_ip_addresses": [],
"dhcpd_boot_enabled": false,
"dhcp_relay_enabled": false,
"dhcpd_conflict_checking": true,
"dhcpd_wins_enabled": false,
"upnp_lan_enabled": false,
"dhcpd_ntp_enabled": false,
"name": "Guest",
"site_id": "6963c5321131084f05460911",
"mdns_enabled": true,
"ip_aliases": [],
"_id": "6963cb941131084f054616af",
"lte_lan_enabled": true,
"dhcpd_tftp_server": "",
"auto_scale_enabled": true
},
{
"setting_preference": "auto",
"dhcpd_leasetime": 86400,
"purpose": "corporate",
"dhcpd_gateway_enabled": false,
"dhcpd_time_offset_enabled": false,
"dhcpguard_enabled": false,
"network_isolation_enabled": false,
"dhcp_relay_servers": [],
"dhcpd_start": "10.5.20.6",
"dhcpd_unifi_controller": "",
"external_id": "98f2aff1-b394-493d-908f-ced4c83bde99",
"enabled": true,
"dhcpd_stop": "10.5.20.254",
"domain_name": "",
"dhcpd_enabled": true,
"ip_subnet": "10.5.20.1/24",
"vlan": 520,
"dhcpd_wpad_url": "",
"ipv6_interface_type": "none",
"networkgroup": "LAN",
"firewall_zone_id": "6963d5a91131084f05461a0d",
"vlan_enabled": true,
"dhcpd_wins_2": "",
"ipv6_setting_preference": "manual",
"is_nat": true,
"dhcpd_wins_1": "",
"dhcpd_dns_enabled": false,
"ipv6_aliases": [],
"internet_access_enabled": true,
"gateway_type": "default",
"nat_outbound_ip_addresses": [],
"dhcpd_boot_enabled": false,
"dhcp_relay_enabled": false,
"dhcpd_conflict_checking": true,
"dhcpd_wins_enabled": false,
"upnp_lan_enabled": false,
"dhcpd_ntp_enabled": false,
"name": "Camera",
"site_id": "6963c5321131084f05460911",
"mdns_enabled": true,
"ip_aliases": [],
"_id": "6963cbbf1131084f054616c1",
"lte_lan_enabled": true,
"dhcpd_tftp_server": "",
"auto_scale_enabled": true
},
{
"setting_preference": "manual",
"dhcpd_leasetime": 86400,
"purpose": "corporate",
"dhcpd_gateway_enabled": false,
"dhcpd_time_offset_enabled": false,
"dhcpguard_enabled": false,
"network_isolation_enabled": false,
"dhcp_relay_servers": [],
"dhcpd_start": "192.168.1.100",
"dhcpd_unifi_controller": "",
"external_id": "9bd0ee41-3303-4c03-ad81-305248301921",
"enabled": true,
"dhcpd_stop": "192.168.1.199",
"domain_name": "",
"dhcpd_enabled": true,
"ip_subnet": "192.168.1.1/24",
"vlan": 2,
"dhcpd_wpad_url": "",
"ipv6_interface_type": "none",
"networkgroup": "LAN",
"firewall_zone_id": "6963d5a91131084f05461a0d",
"vlan_enabled": true,
"dhcpd_wins_2": "",
"ipv6_setting_preference": "manual",
"is_nat": true,
"dhcpd_wins_1": "",
"dhcpd_dns_enabled": false,
"ipv6_aliases": [],
"internet_access_enabled": true,
"gateway_type": "default",
"nat_outbound_ip_addresses": [],
"dhcpd_boot_enabled": false,
"dhcp_relay_enabled": false,
"dhcpd_conflict_checking": true,
"dhcpd_wins_enabled": false,
"upnp_lan_enabled": false,
"dhcpd_ntp_enabled": false,
"name": "Old IoT",
"site_id": "6963c5321131084f05460911",
"mdns_enabled": true,
"ip_aliases": [],
"_id": "6963e11c1131084f054622f1",
"lte_lan_enabled": true,
"dhcpd_tftp_server": "",
"auto_scale_enabled": false
},
{
"wireguard_client_configuration_filename": "Unifi2-US-IL-267.conf",
"purpose": "vpn-client",
"wireguard_client_mode": "file",
"external_id": "8673a0e4-4f1b-42d6-9563-e6f6440065de",
"interface_mtu_enabled": false,
"routing_table_id": 178,
"enabled": true,
"vpn_type": "wireguard-client",
"mss_clamp": "auto",
"ip_subnet": "10.2.0.2/32",
"name": "Proton Chicago",
"site_id": "6963c5321131084f05460911",
"wireguard_id": 1,
"firewall_zone_id": "6963d42a1131084f054618e0",
"wireguard_client_configuration_file": "[REDACTED: exported WireGuard client config removed from tracked baseline]",
"_id": "696411c51131084f05465f8d"
},
{
"setting_preference": "auto",
"wireguard_interface_binding_mode_ip_version": "v4",
"purpose": "remote-user-vpn",
"local_port": 51820,
"x_wireguard_private_key": "REDACTED",
"external_id": "c625964c-8663-4ef0-bf04-53a5466a168c",
"enabled": true,
"wireguard_local_wan_ip": "any",
"vpn_type": "wireguard-server",
"ip_subnet": "192.168.2.1/24",
"wireguard_interface": "wan2",
"name": "One-Click VPN",
"site_id": "6963c5321131084f05460911",
"wireguard_id": 1,
"firewall_zone_id": "6963d42a1131084f054618e2",
"_id": "69a31399822347a1daadae2e"
},
{
"setting_preference": "auto",
"wireguard_interface_binding_mode_ip_version": "v4",
"purpose": "remote-user-vpn",
"x_wireguard_private_key": "REDACTED",
"dhcpd_start": "192.168.3.2",
"interface_mtu_enabled": false,
"external_id": "2431e2ed-2d1f-48ed-9b2f-3ed5b8021504",
"enabled": true,
"dhcpd_stop": "192.168.3.254",
"vpn_type": "wireguard-server",
"ip_subnet": "192.168.3.1/24",
"wireguard_interface": "wan2",
"wireguard_id": 2,
"firewall_zone_id": "6963d42a1131084f054618e2",
"vpn_client_configuration_remote_ip_override_enabled": false,
"dhcpd_dns_enabled": false,
"local_port": 51821,
"wireguard_local_wan_ip": "any",
"mss_clamp": "auto",
"dhcpd_wins_enabled": false,
"vpn_binding_mode": "any",
"name": "Slate 7",
"site_id": "6963c5321131084f05460911",
"_id": "69dd799da02014d2f4acc4e9",
"mss_clamp_ipv6": "auto"
}
],
"portconf": [
{
"setting_preference": "auto",
"port_security_enabled": false,
"stormctrl_ucast_rate": 100,
"egress_rate_limit_kbps_enabled": false,
"stormctrl_mcast_enabled": false,
"lldpmed_notify_enabled": false,
"tagged_vlan_mgmt": "auto",
"multicast_router_networkconf_ids": [],
"stormctrl_bcast_enabled": false,
"port_keepalive_enabled": false,
"stormctrl_mcast_rate": 100,
"native_networkconf_id": "6963c5831131084f0546092b",
"qos_profile": {
"qos_profile_mode": "custom",
"qos_policies": []
},
"port_security_mac_address": [],
"dot1x_idle_timeout": 300,
"op_mode": "switch",
"poe_mode": "auto",
"forward": "all",
"stormctrl_ucast_enabled": false,
"stormctrl_bcast_rate": 100,
"isolation": false,
"voice_networkconf_id": "",
"stp_port_mode": true,
"name": "Management",
"site_id": "6963c5321131084f05460911",
"_id": "6963cdbf1131084f0546177c",
"autoneg": true,
"lldpmed_enabled": true,
"dot1x_ctrl": "force_authorized"
},
{
"setting_preference": "auto",
"port_security_enabled": false,
"stormctrl_ucast_rate": 100,
"egress_rate_limit_kbps_enabled": false,
"stormctrl_mcast_enabled": false,
"lldpmed_notify_enabled": false,
"tagged_vlan_mgmt": "auto",
"multicast_router_networkconf_ids": [],
"stormctrl_bcast_enabled": false,
"port_keepalive_enabled": false,
"excluded_networkconf_ids": [],
"stormctrl_mcast_rate": 100,
"native_networkconf_id": "6963cb201131084f05461635",
"qos_profile": {
"qos_profile_mode": "custom",
"qos_policies": []
},
"port_security_mac_address": [],
"dot1x_idle_timeout": 300,
"op_mode": "switch",
"poe_mode": "auto",
"forward": "customize",
"stormctrl_ucast_enabled": false,
"stormctrl_bcast_rate": 100,
"isolation": false,
"voice_networkconf_id": "",
"stp_port_mode": true,
"name": "Trusted",
"site_id": "6963c5321131084f05460911",
"_id": "6963cdfe1131084f0546178d",
"autoneg": true,
"lldpmed_enabled": true,
"dot1x_ctrl": "force_authorized"
},
{
"setting_preference": "auto",
"port_security_enabled": false,
"stormctrl_ucast_rate": 100,
"egress_rate_limit_kbps_enabled": false,
"stormctrl_mcast_enabled": false,
"lldpmed_notify_enabled": false,
"tagged_vlan_mgmt": "block_all",
"multicast_router_networkconf_ids": [],
"stormctrl_bcast_enabled": false,
"port_keepalive_enabled": false,
"stormctrl_mcast_rate": 100,
"native_networkconf_id": "6963cb461131084f05461642",
"qos_profile": {
"qos_profile_mode": "custom",
"qos_policies": []
},
"port_security_mac_address": [],
"dot1x_idle_timeout": 300,
"op_mode": "switch",
"poe_mode": "auto",
"forward": "native",
"stormctrl_ucast_enabled": false,
"stormctrl_bcast_rate": 100,
"isolation": false,
"voice_networkconf_id": "",
"stp_port_mode": true,
"name": "IoT",
"site_id": "6963c5321131084f05460911",
"_id": "6963ce221131084f05461791",
"autoneg": true,
"lldpmed_enabled": true,
"dot1x_ctrl": "force_authorized"
},
{
"setting_preference": "auto",
"port_security_enabled": false,
"stormctrl_ucast_rate": 100,
"egress_rate_limit_kbps_enabled": false,
"stormctrl_mcast_enabled": false,
"lldpmed_notify_enabled": false,
"tagged_vlan_mgmt": "block_all",
"multicast_router_networkconf_ids": [],
"stormctrl_bcast_enabled": false,
"port_keepalive_enabled": false,
"stormctrl_mcast_rate": 100,
"native_networkconf_id": "6963cbbf1131084f054616c1",
"qos_profile": {
"qos_profile_mode": "custom",
"qos_policies": []
},
"port_security_mac_address": [],
"dot1x_idle_timeout": 300,
"op_mode": "switch",
"poe_mode": "auto",
"forward": "native",
"stormctrl_ucast_enabled": false,
"stormctrl_bcast_rate": 100,
"isolation": false,
"voice_networkconf_id": "",
"stp_port_mode": true,
"name": "Camera",
"site_id": "6963c5321131084f05460911",
"_id": "6963ce3b1131084f05461798",
"autoneg": true,
"lldpmed_enabled": true,
"dot1x_ctrl": "force_authorized"
},
{
"setting_preference": "auto",
"port_security_enabled": false,
"stormctrl_ucast_rate": 100,
"egress_rate_limit_kbps_enabled": false,
"stormctrl_mcast_enabled": false,
"lldpmed_notify_enabled": false,
"tagged_vlan_mgmt": "block_all",
"multicast_router_networkconf_ids": [],
"stormctrl_bcast_enabled": false,
"port_keepalive_enabled": false,
"stormctrl_mcast_rate": 100,
"native_networkconf_id": "6963e11c1131084f054622f1",
"qos_profile": {
"qos_profile_mode": "custom",
"qos_policies": []
},
"port_security_mac_address": [],
"dot1x_idle_timeout": 300,
"op_mode": "switch",
"poe_mode": "auto",
"forward": "native",
"stormctrl_ucast_enabled": false,
"stormctrl_bcast_rate": 100,
"isolation": false,
"voice_networkconf_id": "",
"stp_port_mode": true,
"name": "Old IoT",
"site_id": "6963c5321131084f05460911",
"_id": "6963e3511131084f054624cf",
"autoneg": true,
"lldpmed_enabled": true,
"dot1x_ctrl": "force_authorized"
}
]
}