Document UniFi baseline secret leak guardrails
This commit is contained in:
Doris
4
.gitignore
vendored
4
.gitignore
vendored
@@ -19,6 +19,10 @@ update-homelab-docs.py
|
||||
# Generated stack config
|
||||
pihole/keepalived.conf
|
||||
|
||||
# Raw secret-bearing infra exports must stay out of the main repo
|
||||
home/doris-dashboard/docs/baselines/*.json
|
||||
!home/doris-dashboard/docs/baselines/README.md
|
||||
|
||||
# Editor
|
||||
.vscode/
|
||||
.idea/
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
# Incident: UniFi Baseline Secret Leak (2026-05-22)
|
||||
|
||||
## Summary
|
||||
|
||||
A raw UniFi baseline export was committed to the main `truenas-stacks` repo during the May 22, 2026 network-cutover documentation pass. GitGuardian later flagged three secret leaks in the latest commits.
|
||||
|
||||
The leaked material came from a controller export artifact, not from a normal `.env` file.
|
||||
|
||||
## What leaked
|
||||
|
||||
The committed file contained three WireGuard secrets in `home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json`:
|
||||
|
||||
1. an embedded `wireguard_client_configuration_file` containing a `PrivateKey = ...`
|
||||
2. one `x_wireguard_private_key`
|
||||
3. another `x_wireguard_private_key`
|
||||
|
||||
## How it happened
|
||||
|
||||
The failure mode was:
|
||||
|
||||
1. a read-only UniFi object baseline was captured to support cautious cutover work
|
||||
2. the export was saved as a raw JSON artifact under `home/doris-dashboard/docs/baselines/`
|
||||
3. that raw export was treated like a harmless recon artifact and committed alongside other network redesign docs
|
||||
4. the export included VPN/WireGuard fields that are safe for controller runtime but unsafe for a git-tracked documentation repo
|
||||
5. GitGuardian detected the leaked keys after push
|
||||
|
||||
## Root cause
|
||||
|
||||
This was a process failure, not a git-crypt failure.
|
||||
|
||||
The repo already had rules for `.env` secrets, but not a strong enough rule for **controller exports / diagnostic baselines / machine snapshots** that may embed secrets even when they are not named `.env`.
|
||||
|
||||
In short:
|
||||
- we protected the usual secret files
|
||||
- we did **not** treat raw infrastructure exports as secret-bearing by default
|
||||
|
||||
## Remediation completed
|
||||
|
||||
The following remediation was performed:
|
||||
|
||||
- the leaked values were removed from the working tree
|
||||
- git history was rewritten to purge the exact leaked values
|
||||
- cleaned history was force-pushed to both `origin` and `github`
|
||||
- raw JSON baseline exports under `home/doris-dashboard/docs/baselines/` were moved out of the main repo policy
|
||||
- the repo now documents that only sanitized summaries or explicitly redacted artifacts belong in the main repo
|
||||
|
||||
## New permanent rules
|
||||
|
||||
1. **Raw controller/API exports do not belong in the main repo.**
|
||||
- Examples: UniFi `networkconf`, `portconf`, full appliance JSON dumps, diagnostic snapshots, vendor backups, tunnel/client config exports.
|
||||
2. **Assume machine exports are secret-bearing until proven otherwise.**
|
||||
- If it came from a controller or appliance, inspect it like a secret file.
|
||||
3. **Only commit one of these:**
|
||||
- a markdown summary
|
||||
- a purpose-built redacted JSON artifact
|
||||
- a generated diff with secret-bearing keys removed
|
||||
4. **Before committing infra artifacts, scan them explicitly.**
|
||||
- Look for terms like `private_key`, `wireguard`, `token`, `secret`, `password`, `Authorization`, `cookie`, `client_secret`.
|
||||
5. **If raw export retention is required, store it outside the main repo.**
|
||||
- Prefer the encrypted secrets repo or another non-public operator-only location.
|
||||
6. **If a secret-bearing export is committed, treat it as an incident.**
|
||||
- redact/remove from current tree
|
||||
- rewrite history
|
||||
- force-push
|
||||
- rotate live credentials/keys as appropriate
|
||||
|
||||
## Operator follow-up still recommended
|
||||
|
||||
History cleanup fixed the repo exposure. If any leaked WireGuard keys were active in production at the time of exposure, rotate them deliberately and update affected clients.
|
||||
|
||||
## Prevent-recurrence checklist
|
||||
|
||||
- [ ] raw exports ignored by default in the repo path where they are commonly captured
|
||||
- [ ] incident documented in `SECRETS_MANAGEMENT.md`
|
||||
- [ ] dashboard baseline directory has a README explaining what may and may not be committed
|
||||
- [ ] future cutover notes point to sanitized summaries rather than raw exports
|
||||
@@ -206,6 +206,39 @@ On a fresh PD after reinstalling TrueNAS:
|
||||
|
||||
---
|
||||
|
||||
## Controller Export / Baseline Artifact Rules
|
||||
|
||||
Raw infrastructure exports must be treated as potentially secret-bearing even when they are not `.env` files.
|
||||
|
||||
Examples:
|
||||
- UniFi `networkconf` / `portconf` dumps
|
||||
- firewall/router/controller JSON exports
|
||||
- VPN client or server config exports
|
||||
- diagnostic snapshots taken from appliances or operator APIs
|
||||
|
||||
### Permanent rules
|
||||
|
||||
- Do **not** commit raw controller or appliance exports to the main repo.
|
||||
- Commit only sanitized markdown summaries or explicitly redacted artifacts.
|
||||
- If raw retention is needed, store the export in the encrypted secrets repo or another operator-only location outside the main repo.
|
||||
- Before committing infra artifacts, scan for obvious secret-bearing keys such as:
|
||||
- `private_key`
|
||||
- `wireguard`
|
||||
- `token`
|
||||
- `secret`
|
||||
- `password`
|
||||
- `Authorization`
|
||||
- `cookie`
|
||||
- `client_secret`
|
||||
|
||||
### Incident reference
|
||||
|
||||
A real leak occurred on 2026-05-22 when a raw UniFi baseline export under `home/doris-dashboard/docs/baselines/` was committed with embedded WireGuard secrets.
|
||||
|
||||
See:
|
||||
- `docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md`
|
||||
- `home/doris-dashboard/docs/baselines/README.md`
|
||||
|
||||
## Security Reminders
|
||||
|
||||
- **Key backup**: `C:\Users\Fizzlepoof\Downloads\.git-crypt-secrets.key` — also store in password manager
|
||||
|
||||
31
home/doris-dashboard/docs/baselines/README.md
Normal file
31
home/doris-dashboard/docs/baselines/README.md
Normal file
@@ -0,0 +1,31 @@
|
||||
# Baselines Directory Policy
|
||||
|
||||
This directory is for **sanitized operator artifacts only**.
|
||||
|
||||
## What belongs here
|
||||
|
||||
- markdown summaries of controller state
|
||||
- redacted JSON examples that have been intentionally scrubbed
|
||||
- operator notes that support future change windows
|
||||
|
||||
## What does not belong here
|
||||
|
||||
- raw UniFi controller exports
|
||||
- full `networkconf` / `portconf` dumps captured straight from the API
|
||||
- VPN client/server config exports
|
||||
- any artifact containing keys, tokens, passwords, cookies, CSRF material, or embedded auth config
|
||||
|
||||
## Why this rule exists
|
||||
|
||||
A raw UniFi baseline export committed during the 2026-05-22 network redesign documentation pass contained WireGuard private keys and triggered a real secret-leak incident.
|
||||
|
||||
See:
|
||||
- `docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md`
|
||||
- `docs/operations/SECRETS_MANAGEMENT.md`
|
||||
|
||||
## Safe workflow
|
||||
|
||||
1. Capture raw exports outside the main repo or in the encrypted secrets repo.
|
||||
2. Inspect them for secret-bearing fields.
|
||||
3. Commit only a markdown summary or an explicitly redacted artifact.
|
||||
4. Prefer human-readable summaries over raw appliance dumps.
|
||||
@@ -1,608 +0,0 @@
|
||||
{
|
||||
"captured_at": "2026-05-21T21:46:53-05:00",
|
||||
"site": "default",
|
||||
"networkconf": [
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"purpose": "wan",
|
||||
"external_id": "d488cbbc-05dd-4bab-9efb-4b58340df685",
|
||||
"wan_type_v6": "disabled",
|
||||
"routing_table_id": 201,
|
||||
"ipv6_wan_delegation_type": "none",
|
||||
"wan_dhcpv6_pd_size_auto": true,
|
||||
"firewall_zone_id": "6963d42a1131084f054618e0",
|
||||
"igmp_proxy_upstream": false,
|
||||
"mac_override_enabled": false,
|
||||
"wan_load_balance_type": "failover-only",
|
||||
"wan_failover_priority": 2,
|
||||
"wan_ipv6_dns_preference": "auto",
|
||||
"wan_networkgroup": "WAN",
|
||||
"wan_dslite_remote_host_auto": false,
|
||||
"wan_smartq_enabled": false,
|
||||
"wan_dns_preference": "auto",
|
||||
"wan_vlan_enabled": false,
|
||||
"wan_load_balance_weight": 99,
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"name": "Internet 1",
|
||||
"report_wan_event": false,
|
||||
"_id": "6963c5831131084f05460929",
|
||||
"attr_no_delete": true,
|
||||
"wan_type": "dhcp",
|
||||
"attr_hidden_id": "WAN"
|
||||
},
|
||||
{
|
||||
"setting_preference": "manual",
|
||||
"purpose": "wan",
|
||||
"wan_dhcp_cos": 0,
|
||||
"external_id": "c10cd8c4-7f9c-4d12-a7ea-e1a34ab8ead7",
|
||||
"wan_type_v6": "disabled",
|
||||
"routing_table_id": 202,
|
||||
"enabled": true,
|
||||
"wan_dhcp_options": [],
|
||||
"ipv6_wan_delegation_type": "none",
|
||||
"wan_dhcpv6_pd_size_auto": true,
|
||||
"firewall_zone_id": "6963d42a1131084f054618e0",
|
||||
"igmp_proxy_upstream": false,
|
||||
"mac_override_enabled": false,
|
||||
"wan_load_balance_type": "weighted",
|
||||
"wan_failover_priority": 1,
|
||||
"ipv6_setting_preference": "manual",
|
||||
"wan_ipv6_dns_preference": "auto",
|
||||
"single_network_lan": "",
|
||||
"wan_dns2": "9.9.9.9",
|
||||
"wan_ipv6_dns1": "",
|
||||
"wan_dns1": "10.5.1.53",
|
||||
"wan_ipv6_dns2": "",
|
||||
"wan_networkgroup": "WAN2",
|
||||
"wan_dslite_remote_host_auto": false,
|
||||
"wan_provider_capabilities": {
|
||||
"upload_kilobits_per_second": 2409000,
|
||||
"download_kilobits_per_second": 2120000
|
||||
},
|
||||
"wan_ip_aliases": [],
|
||||
"wan_smartq_enabled": false,
|
||||
"wan_dns_preference": "manual",
|
||||
"wan_vlan_enabled": false,
|
||||
"wan_load_balance_weight": 50,
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"name": "Internet 2",
|
||||
"report_wan_event": false,
|
||||
"_id": "6963c5831131084f0546092a",
|
||||
"wan_type": "dhcp",
|
||||
"attr_no_delete": true,
|
||||
"igmp_proxy_for": "none"
|
||||
},
|
||||
{
|
||||
"setting_preference": "manual",
|
||||
"dhcpdv6_dns_auto": true,
|
||||
"ipv6_pd_stop": "::7d1",
|
||||
"dhcpd_gateway_enabled": false,
|
||||
"ipv6_client_address_assignment": "slaac",
|
||||
"network_isolation_enabled": false,
|
||||
"dhcp_relay_servers": [],
|
||||
"dhcpd_start": "10.5.0.100",
|
||||
"dhcpd_unifi_controller": "",
|
||||
"ipv6_ra_enabled": true,
|
||||
"domain_name": "localdomain",
|
||||
"ip_subnet": "10.5.0.1/24",
|
||||
"ipv6_interface_type": "none",
|
||||
"dhcpd_wins_2": "",
|
||||
"dhcpdv6_stop": "::7d1",
|
||||
"is_nat": true,
|
||||
"dhcpd_wins_1": "",
|
||||
"dhcpd_dns_enabled": false,
|
||||
"internet_access_enabled": true,
|
||||
"nat_outbound_ip_addresses": [],
|
||||
"dhcp_relay_enabled": false,
|
||||
"dhcpd_conflict_checking": true,
|
||||
"dhcpd_wins_enabled": false,
|
||||
"dhcpdv6_leasetime": 86400,
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"name": "Management",
|
||||
"_id": "6963c5831131084f0546092b",
|
||||
"lte_lan_enabled": true,
|
||||
"purpose": "corporate",
|
||||
"dhcpd_leasetime": 86400,
|
||||
"dhcpguard_enabled": false,
|
||||
"dhcpd_time_offset_enabled": false,
|
||||
"external_id": "652279eb-41e5-440d-aad5-231ca9683890",
|
||||
"ipv6_ra_preferred_lifetime": 14400,
|
||||
"dhcpd_stop": "10.5.0.199",
|
||||
"is_smart_subnet_detected": false,
|
||||
"enabled": true,
|
||||
"dhcpd_enabled": true,
|
||||
"dhcpd_wpad_url": "",
|
||||
"networkgroup": "LAN",
|
||||
"firewall_zone_id": "6963d42a1131084f054618df",
|
||||
"dhcpdv6_start": "::2",
|
||||
"vlan_enabled": false,
|
||||
"ipv6_setting_preference": "auto",
|
||||
"ipv6_aliases": [],
|
||||
"gateway_type": "default",
|
||||
"ipv6_ra_priority": "high",
|
||||
"dhcpd_boot_enabled": false,
|
||||
"ipv6_pd_start": "::2",
|
||||
"upnp_lan_enabled": false,
|
||||
"dhcpd_ntp_enabled": false,
|
||||
"mdns_enabled": true,
|
||||
"ip_aliases": [],
|
||||
"attr_no_delete": true,
|
||||
"attr_hidden_id": "LAN",
|
||||
"dhcpd_tftp_server": "",
|
||||
"auto_scale_enabled": false
|
||||
},
|
||||
{
|
||||
"setting_preference": "manual",
|
||||
"dhcpd_gateway_enabled": false,
|
||||
"network_isolation_enabled": false,
|
||||
"dhcp_relay_servers": [],
|
||||
"dhcpd_dns_1": "192.168.1.10",
|
||||
"dhcpd_start": "10.5.1.100",
|
||||
"dhcpd_unifi_controller": "",
|
||||
"domain_name": "",
|
||||
"ip_subnet": "10.5.1.1/24",
|
||||
"dhcpd_dns_4": "",
|
||||
"ipv6_interface_type": "none",
|
||||
"dhcpd_dns_2": "",
|
||||
"dhcpd_dns_3": "",
|
||||
"dhcpd_wins_2": "",
|
||||
"is_nat": true,
|
||||
"dhcpd_wins_1": "",
|
||||
"dhcpd_dns_enabled": false,
|
||||
"internet_access_enabled": true,
|
||||
"nat_outbound_ip_addresses": [],
|
||||
"dhcp_relay_enabled": false,
|
||||
"dhcpd_conflict_checking": true,
|
||||
"dhcpd_wins_enabled": false,
|
||||
"name": "Trusted",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "6963cb201131084f05461635",
|
||||
"lte_lan_enabled": true,
|
||||
"dhcpd_leasetime": 86400,
|
||||
"purpose": "corporate",
|
||||
"dhcpd_time_offset_enabled": false,
|
||||
"dhcpguard_enabled": false,
|
||||
"external_id": "87b66e27-93a9-4fb7-93d2-3b7bca9e6414",
|
||||
"enabled": true,
|
||||
"dhcpd_stop": "10.5.1.199",
|
||||
"dhcpd_enabled": true,
|
||||
"vlan": 51,
|
||||
"dhcpd_wpad_url": "",
|
||||
"networkgroup": "LAN",
|
||||
"firewall_zone_id": "6963d42a1131084f054618df",
|
||||
"vlan_enabled": true,
|
||||
"ipv6_setting_preference": "manual",
|
||||
"ipv6_aliases": [],
|
||||
"gateway_type": "default",
|
||||
"dhcpd_boot_enabled": false,
|
||||
"upnp_lan_enabled": false,
|
||||
"dhcpd_ntp_enabled": false,
|
||||
"mdns_enabled": true,
|
||||
"ip_aliases": [],
|
||||
"dhcpd_tftp_server": "",
|
||||
"auto_scale_enabled": false
|
||||
},
|
||||
{
|
||||
"setting_preference": "manual",
|
||||
"dhcpd_leasetime": 86400,
|
||||
"purpose": "corporate",
|
||||
"dhcpd_gateway_enabled": false,
|
||||
"dhcpd_time_offset_enabled": false,
|
||||
"dhcpguard_enabled": false,
|
||||
"network_isolation_enabled": true,
|
||||
"dhcp_relay_servers": [],
|
||||
"dhcpd_start": "10.5.10.6",
|
||||
"dhcpd_unifi_controller": "",
|
||||
"external_id": "88180bc3-2c34-4f30-9b57-aed15da2a12a",
|
||||
"enabled": true,
|
||||
"dhcpd_stop": "10.5.10.254",
|
||||
"domain_name": "",
|
||||
"dhcpd_enabled": true,
|
||||
"ip_subnet": "10.5.10.1/24",
|
||||
"vlan": 510,
|
||||
"dhcpd_wpad_url": "",
|
||||
"ipv6_interface_type": "none",
|
||||
"networkgroup": "LAN",
|
||||
"firewall_zone_id": "6963d5a91131084f05461a0d",
|
||||
"vlan_enabled": true,
|
||||
"dhcpd_wins_2": "",
|
||||
"ipv6_setting_preference": "manual",
|
||||
"dhcpd_wins_1": "",
|
||||
"dhcpd_dns_enabled": false,
|
||||
"ipv6_aliases": [],
|
||||
"internet_access_enabled": true,
|
||||
"gateway_type": "default",
|
||||
"nat_outbound_ip_addresses": [],
|
||||
"dhcpd_boot_enabled": false,
|
||||
"dhcp_relay_enabled": false,
|
||||
"dhcpd_conflict_checking": true,
|
||||
"dhcpd_wins_enabled": false,
|
||||
"dhcpd_ntp_enabled": false,
|
||||
"name": "IoT",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"mdns_enabled": true,
|
||||
"ip_aliases": [],
|
||||
"_id": "6963cb461131084f05461642",
|
||||
"lte_lan_enabled": true,
|
||||
"dhcpd_tftp_server": "",
|
||||
"auto_scale_enabled": true
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"dhcpd_leasetime": 86400,
|
||||
"purpose": "guest",
|
||||
"dhcpd_gateway_enabled": false,
|
||||
"dhcpd_time_offset_enabled": false,
|
||||
"dhcpguard_enabled": false,
|
||||
"network_isolation_enabled": false,
|
||||
"dhcp_relay_servers": [],
|
||||
"dhcpd_start": "10.5.90.6",
|
||||
"dhcpd_unifi_controller": "",
|
||||
"external_id": "2986eea1-bf02-4879-a7b0-7d9f91e45c53",
|
||||
"enabled": true,
|
||||
"dhcpd_stop": "10.5.90.254",
|
||||
"domain_name": "",
|
||||
"dhcpd_enabled": true,
|
||||
"ip_subnet": "10.5.90.1/24",
|
||||
"vlan": 590,
|
||||
"dhcpd_wpad_url": "",
|
||||
"ipv6_interface_type": "none",
|
||||
"networkgroup": "LAN",
|
||||
"firewall_zone_id": "6963d42a1131084f054618e3",
|
||||
"vlan_enabled": true,
|
||||
"dhcpd_wins_2": "",
|
||||
"ipv6_setting_preference": "manual",
|
||||
"is_nat": true,
|
||||
"dhcpd_wins_1": "",
|
||||
"dhcpd_dns_enabled": false,
|
||||
"ipv6_aliases": [],
|
||||
"internet_access_enabled": true,
|
||||
"gateway_type": "default",
|
||||
"nat_outbound_ip_addresses": [],
|
||||
"dhcpd_boot_enabled": false,
|
||||
"dhcp_relay_enabled": false,
|
||||
"dhcpd_conflict_checking": true,
|
||||
"dhcpd_wins_enabled": false,
|
||||
"upnp_lan_enabled": false,
|
||||
"dhcpd_ntp_enabled": false,
|
||||
"name": "Guest",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"mdns_enabled": true,
|
||||
"ip_aliases": [],
|
||||
"_id": "6963cb941131084f054616af",
|
||||
"lte_lan_enabled": true,
|
||||
"dhcpd_tftp_server": "",
|
||||
"auto_scale_enabled": true
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"dhcpd_leasetime": 86400,
|
||||
"purpose": "corporate",
|
||||
"dhcpd_gateway_enabled": false,
|
||||
"dhcpd_time_offset_enabled": false,
|
||||
"dhcpguard_enabled": false,
|
||||
"network_isolation_enabled": false,
|
||||
"dhcp_relay_servers": [],
|
||||
"dhcpd_start": "10.5.20.6",
|
||||
"dhcpd_unifi_controller": "",
|
||||
"external_id": "98f2aff1-b394-493d-908f-ced4c83bde99",
|
||||
"enabled": true,
|
||||
"dhcpd_stop": "10.5.20.254",
|
||||
"domain_name": "",
|
||||
"dhcpd_enabled": true,
|
||||
"ip_subnet": "10.5.20.1/24",
|
||||
"vlan": 520,
|
||||
"dhcpd_wpad_url": "",
|
||||
"ipv6_interface_type": "none",
|
||||
"networkgroup": "LAN",
|
||||
"firewall_zone_id": "6963d5a91131084f05461a0d",
|
||||
"vlan_enabled": true,
|
||||
"dhcpd_wins_2": "",
|
||||
"ipv6_setting_preference": "manual",
|
||||
"is_nat": true,
|
||||
"dhcpd_wins_1": "",
|
||||
"dhcpd_dns_enabled": false,
|
||||
"ipv6_aliases": [],
|
||||
"internet_access_enabled": true,
|
||||
"gateway_type": "default",
|
||||
"nat_outbound_ip_addresses": [],
|
||||
"dhcpd_boot_enabled": false,
|
||||
"dhcp_relay_enabled": false,
|
||||
"dhcpd_conflict_checking": true,
|
||||
"dhcpd_wins_enabled": false,
|
||||
"upnp_lan_enabled": false,
|
||||
"dhcpd_ntp_enabled": false,
|
||||
"name": "Camera",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"mdns_enabled": true,
|
||||
"ip_aliases": [],
|
||||
"_id": "6963cbbf1131084f054616c1",
|
||||
"lte_lan_enabled": true,
|
||||
"dhcpd_tftp_server": "",
|
||||
"auto_scale_enabled": true
|
||||
},
|
||||
{
|
||||
"setting_preference": "manual",
|
||||
"dhcpd_leasetime": 86400,
|
||||
"purpose": "corporate",
|
||||
"dhcpd_gateway_enabled": false,
|
||||
"dhcpd_time_offset_enabled": false,
|
||||
"dhcpguard_enabled": false,
|
||||
"network_isolation_enabled": false,
|
||||
"dhcp_relay_servers": [],
|
||||
"dhcpd_start": "192.168.1.100",
|
||||
"dhcpd_unifi_controller": "",
|
||||
"external_id": "9bd0ee41-3303-4c03-ad81-305248301921",
|
||||
"enabled": true,
|
||||
"dhcpd_stop": "192.168.1.199",
|
||||
"domain_name": "",
|
||||
"dhcpd_enabled": true,
|
||||
"ip_subnet": "192.168.1.1/24",
|
||||
"vlan": 2,
|
||||
"dhcpd_wpad_url": "",
|
||||
"ipv6_interface_type": "none",
|
||||
"networkgroup": "LAN",
|
||||
"firewall_zone_id": "6963d5a91131084f05461a0d",
|
||||
"vlan_enabled": true,
|
||||
"dhcpd_wins_2": "",
|
||||
"ipv6_setting_preference": "manual",
|
||||
"is_nat": true,
|
||||
"dhcpd_wins_1": "",
|
||||
"dhcpd_dns_enabled": false,
|
||||
"ipv6_aliases": [],
|
||||
"internet_access_enabled": true,
|
||||
"gateway_type": "default",
|
||||
"nat_outbound_ip_addresses": [],
|
||||
"dhcpd_boot_enabled": false,
|
||||
"dhcp_relay_enabled": false,
|
||||
"dhcpd_conflict_checking": true,
|
||||
"dhcpd_wins_enabled": false,
|
||||
"upnp_lan_enabled": false,
|
||||
"dhcpd_ntp_enabled": false,
|
||||
"name": "Old IoT",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"mdns_enabled": true,
|
||||
"ip_aliases": [],
|
||||
"_id": "6963e11c1131084f054622f1",
|
||||
"lte_lan_enabled": true,
|
||||
"dhcpd_tftp_server": "",
|
||||
"auto_scale_enabled": false
|
||||
},
|
||||
{
|
||||
"wireguard_client_configuration_filename": "Unifi2-US-IL-267.conf",
|
||||
"purpose": "vpn-client",
|
||||
"wireguard_client_mode": "file",
|
||||
"external_id": "8673a0e4-4f1b-42d6-9563-e6f6440065de",
|
||||
"interface_mtu_enabled": false,
|
||||
"routing_table_id": 178,
|
||||
"enabled": true,
|
||||
"vpn_type": "wireguard-client",
|
||||
"mss_clamp": "auto",
|
||||
"ip_subnet": "10.2.0.2/32",
|
||||
"name": "Proton Chicago",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"wireguard_id": 1,
|
||||
"firewall_zone_id": "6963d42a1131084f054618e0",
|
||||
"wireguard_client_configuration_file": "[REDACTED: exported WireGuard client config removed from tracked baseline]",
|
||||
"_id": "696411c51131084f05465f8d"
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"wireguard_interface_binding_mode_ip_version": "v4",
|
||||
"purpose": "remote-user-vpn",
|
||||
"local_port": 51820,
|
||||
"x_wireguard_private_key": "REDACTED",
|
||||
"external_id": "c625964c-8663-4ef0-bf04-53a5466a168c",
|
||||
"enabled": true,
|
||||
"wireguard_local_wan_ip": "any",
|
||||
"vpn_type": "wireguard-server",
|
||||
"ip_subnet": "192.168.2.1/24",
|
||||
"wireguard_interface": "wan2",
|
||||
"name": "One-Click VPN",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"wireguard_id": 1,
|
||||
"firewall_zone_id": "6963d42a1131084f054618e2",
|
||||
"_id": "69a31399822347a1daadae2e"
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"wireguard_interface_binding_mode_ip_version": "v4",
|
||||
"purpose": "remote-user-vpn",
|
||||
"x_wireguard_private_key": "REDACTED",
|
||||
"dhcpd_start": "192.168.3.2",
|
||||
"interface_mtu_enabled": false,
|
||||
"external_id": "2431e2ed-2d1f-48ed-9b2f-3ed5b8021504",
|
||||
"enabled": true,
|
||||
"dhcpd_stop": "192.168.3.254",
|
||||
"vpn_type": "wireguard-server",
|
||||
"ip_subnet": "192.168.3.1/24",
|
||||
"wireguard_interface": "wan2",
|
||||
"wireguard_id": 2,
|
||||
"firewall_zone_id": "6963d42a1131084f054618e2",
|
||||
"vpn_client_configuration_remote_ip_override_enabled": false,
|
||||
"dhcpd_dns_enabled": false,
|
||||
"local_port": 51821,
|
||||
"wireguard_local_wan_ip": "any",
|
||||
"mss_clamp": "auto",
|
||||
"dhcpd_wins_enabled": false,
|
||||
"vpn_binding_mode": "any",
|
||||
"name": "Slate 7",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "69dd799da02014d2f4acc4e9",
|
||||
"mss_clamp_ipv6": "auto"
|
||||
}
|
||||
],
|
||||
"portconf": [
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"port_security_enabled": false,
|
||||
"stormctrl_ucast_rate": 100,
|
||||
"egress_rate_limit_kbps_enabled": false,
|
||||
"stormctrl_mcast_enabled": false,
|
||||
"lldpmed_notify_enabled": false,
|
||||
"tagged_vlan_mgmt": "auto",
|
||||
"multicast_router_networkconf_ids": [],
|
||||
"stormctrl_bcast_enabled": false,
|
||||
"port_keepalive_enabled": false,
|
||||
"stormctrl_mcast_rate": 100,
|
||||
"native_networkconf_id": "6963c5831131084f0546092b",
|
||||
"qos_profile": {
|
||||
"qos_profile_mode": "custom",
|
||||
"qos_policies": []
|
||||
},
|
||||
"port_security_mac_address": [],
|
||||
"dot1x_idle_timeout": 300,
|
||||
"op_mode": "switch",
|
||||
"poe_mode": "auto",
|
||||
"forward": "all",
|
||||
"stormctrl_ucast_enabled": false,
|
||||
"stormctrl_bcast_rate": 100,
|
||||
"isolation": false,
|
||||
"voice_networkconf_id": "",
|
||||
"stp_port_mode": true,
|
||||
"name": "Management",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "6963cdbf1131084f0546177c",
|
||||
"autoneg": true,
|
||||
"lldpmed_enabled": true,
|
||||
"dot1x_ctrl": "force_authorized"
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"port_security_enabled": false,
|
||||
"stormctrl_ucast_rate": 100,
|
||||
"egress_rate_limit_kbps_enabled": false,
|
||||
"stormctrl_mcast_enabled": false,
|
||||
"lldpmed_notify_enabled": false,
|
||||
"tagged_vlan_mgmt": "auto",
|
||||
"multicast_router_networkconf_ids": [],
|
||||
"stormctrl_bcast_enabled": false,
|
||||
"port_keepalive_enabled": false,
|
||||
"excluded_networkconf_ids": [],
|
||||
"stormctrl_mcast_rate": 100,
|
||||
"native_networkconf_id": "6963cb201131084f05461635",
|
||||
"qos_profile": {
|
||||
"qos_profile_mode": "custom",
|
||||
"qos_policies": []
|
||||
},
|
||||
"port_security_mac_address": [],
|
||||
"dot1x_idle_timeout": 300,
|
||||
"op_mode": "switch",
|
||||
"poe_mode": "auto",
|
||||
"forward": "customize",
|
||||
"stormctrl_ucast_enabled": false,
|
||||
"stormctrl_bcast_rate": 100,
|
||||
"isolation": false,
|
||||
"voice_networkconf_id": "",
|
||||
"stp_port_mode": true,
|
||||
"name": "Trusted",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "6963cdfe1131084f0546178d",
|
||||
"autoneg": true,
|
||||
"lldpmed_enabled": true,
|
||||
"dot1x_ctrl": "force_authorized"
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"port_security_enabled": false,
|
||||
"stormctrl_ucast_rate": 100,
|
||||
"egress_rate_limit_kbps_enabled": false,
|
||||
"stormctrl_mcast_enabled": false,
|
||||
"lldpmed_notify_enabled": false,
|
||||
"tagged_vlan_mgmt": "block_all",
|
||||
"multicast_router_networkconf_ids": [],
|
||||
"stormctrl_bcast_enabled": false,
|
||||
"port_keepalive_enabled": false,
|
||||
"stormctrl_mcast_rate": 100,
|
||||
"native_networkconf_id": "6963cb461131084f05461642",
|
||||
"qos_profile": {
|
||||
"qos_profile_mode": "custom",
|
||||
"qos_policies": []
|
||||
},
|
||||
"port_security_mac_address": [],
|
||||
"dot1x_idle_timeout": 300,
|
||||
"op_mode": "switch",
|
||||
"poe_mode": "auto",
|
||||
"forward": "native",
|
||||
"stormctrl_ucast_enabled": false,
|
||||
"stormctrl_bcast_rate": 100,
|
||||
"isolation": false,
|
||||
"voice_networkconf_id": "",
|
||||
"stp_port_mode": true,
|
||||
"name": "IoT",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "6963ce221131084f05461791",
|
||||
"autoneg": true,
|
||||
"lldpmed_enabled": true,
|
||||
"dot1x_ctrl": "force_authorized"
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"port_security_enabled": false,
|
||||
"stormctrl_ucast_rate": 100,
|
||||
"egress_rate_limit_kbps_enabled": false,
|
||||
"stormctrl_mcast_enabled": false,
|
||||
"lldpmed_notify_enabled": false,
|
||||
"tagged_vlan_mgmt": "block_all",
|
||||
"multicast_router_networkconf_ids": [],
|
||||
"stormctrl_bcast_enabled": false,
|
||||
"port_keepalive_enabled": false,
|
||||
"stormctrl_mcast_rate": 100,
|
||||
"native_networkconf_id": "6963cbbf1131084f054616c1",
|
||||
"qos_profile": {
|
||||
"qos_profile_mode": "custom",
|
||||
"qos_policies": []
|
||||
},
|
||||
"port_security_mac_address": [],
|
||||
"dot1x_idle_timeout": 300,
|
||||
"op_mode": "switch",
|
||||
"poe_mode": "auto",
|
||||
"forward": "native",
|
||||
"stormctrl_ucast_enabled": false,
|
||||
"stormctrl_bcast_rate": 100,
|
||||
"isolation": false,
|
||||
"voice_networkconf_id": "",
|
||||
"stp_port_mode": true,
|
||||
"name": "Camera",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "6963ce3b1131084f05461798",
|
||||
"autoneg": true,
|
||||
"lldpmed_enabled": true,
|
||||
"dot1x_ctrl": "force_authorized"
|
||||
},
|
||||
{
|
||||
"setting_preference": "auto",
|
||||
"port_security_enabled": false,
|
||||
"stormctrl_ucast_rate": 100,
|
||||
"egress_rate_limit_kbps_enabled": false,
|
||||
"stormctrl_mcast_enabled": false,
|
||||
"lldpmed_notify_enabled": false,
|
||||
"tagged_vlan_mgmt": "block_all",
|
||||
"multicast_router_networkconf_ids": [],
|
||||
"stormctrl_bcast_enabled": false,
|
||||
"port_keepalive_enabled": false,
|
||||
"stormctrl_mcast_rate": 100,
|
||||
"native_networkconf_id": "6963e11c1131084f054622f1",
|
||||
"qos_profile": {
|
||||
"qos_profile_mode": "custom",
|
||||
"qos_policies": []
|
||||
},
|
||||
"port_security_mac_address": [],
|
||||
"dot1x_idle_timeout": 300,
|
||||
"op_mode": "switch",
|
||||
"poe_mode": "auto",
|
||||
"forward": "native",
|
||||
"stormctrl_ucast_enabled": false,
|
||||
"stormctrl_bcast_rate": 100,
|
||||
"isolation": false,
|
||||
"voice_networkconf_id": "",
|
||||
"stp_port_mode": true,
|
||||
"name": "Old IoT",
|
||||
"site_id": "6963c5321131084f05460911",
|
||||
"_id": "6963e3511131084f054624cf",
|
||||
"autoneg": true,
|
||||
"lldpmed_enabled": true,
|
||||
"dot1x_ctrl": "force_authorized"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -103,7 +103,7 @@ These are still the two management-lane ESP-class offenders to identify or evict
|
||||
- confirmed named host placement for the server batch and Old IoT migration set
|
||||
- confirmed management offenders remain present
|
||||
- confirmed U6 LR still appears offline/disconnected
|
||||
- captured a raw pre-write baseline of `networkconf` and `portconf` at `/home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json`
|
||||
- captured a raw pre-write baseline of `networkconf` and `portconf` outside the main repo; only sanitized summaries/redacted artifacts belong under `docs/baselines/`
|
||||
- authored an idempotent staging helper at `/home/fizzlepoof/repos/truenas-stacks/automation/bin/unifi_stage_low_risk_objects.py`
|
||||
- copied that helper to PD at `/mnt/docker-ssd/docker/compose/automation/bin/unifi_stage_low_risk_objects.py`
|
||||
- confirmed the current Doris UniFi account is still read-only for writes: `POST /rest/networkconf` returns `403 Forbidden`
|
||||
|
||||
Reference in New Issue
Block a user