# USW Pro HD 24 Exact Change Sheet > For Doris: this is the mechanical switch-port sheet for tomorrow. Do not freestyle. Change one thing, validate, then continue. Source basis: - live UniFi read-only recon on 2026-05-22 - /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md - /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md ## Core principle - Uplink/AP/infra ports stay Management or trunked as appropriate. - Server-class hosts leave Trusted and move to Servers. - Unknown live ports get eyeballed before change. - Do not bulk-edit profiles blindly. - Rocinante is the live operator box, so keep it stable until the main server batch is complete or an alternate admin path is proven. - Nomad, Serenity, and PD may need to move as one controlled wave because of NFS/shared-service coupling; validate the batch immediately. --- ## 1. Desired profile set for tomorrow Current relevant profiles seen live: - Management - Trusted - IoT - Camera - Old IoT Needed for tomorrow: - Management - Trusted - Servers - IoT - Camera - Guest - Old IoT - trunk/uplink profile if you choose to normalize uplinks now If `Servers` does not exist yet: - create it before changing server ports - use it as the target for the core host ports below ## 2. USW Pro HD 24 live ports that matter ### Port 1 - Name: `U7 Pro (Upstairs)` - Current profile: `Management` - Link: up - Speed: 2.5G - Role: AP uplink / infrastructure - Tomorrow action: leave on Management unless/until you replace with an explicit trunk/uplink profile - Risk: high if changed incorrectly - Validation after any change: - U7 Pro remains online in UniFi - wireless clients stay associated - management plane remains reachable ### Port 2 - Name: `Port 2` - Current observed live client: `Rocinante` - Current explicit profile visibility: not clearly returned by API - Link: up - Speed: 2.5G - Role: server/core host - Tomorrow action: inspect in UniFi UI first, confirm current native network/profile, but keep Rocinante in place as the live operator station until the Nomad/Serenity/PD batch is done or a backup admin path is proven - Risk: medium because profile visibility was ambiguous in API data - Validation after move: - Rocinante gets expected Servers subnet/gateway - reachable from Trusted as intended - any expected service ports work ### Port 3 - Name: `FlyingDutchman` - Current profile: `Trusted` - Link: up - Speed: 2.5G - Role: human endpoint / gaming PC unless proven otherwise - Tomorrow action: leave on `Trusted` tomorrow unless you deliberately reclassify it later; default assumption is that it should stay with trusted human endpoints - Risk: medium - Validation after move: - host gets expected subnet/gateway - reachable from Trusted as intended - only move if this box is actually supposed to live with the homelab service lane ### Port 22 - Name: `Port 22` - Current live client: `Nomad` - Current profile: `Trusted` - Link: up - Speed: 2.5G - Role: core host - Tomorrow action: move to `Servers` - Risk: medium - Validation after move: - Nomad gets expected Servers address - Doris pages / services expected on Nomad still reachable from Trusted ### Port 23 - Name: `Docker Server` - Current live client: `PlausibleDeniability` - Current profile: `Trusted` - Link: up - Speed: 10G - Role: primary core server - Tomorrow action: move to `Servers` - Risk: high-ish because this is central infrastructure - Validation after move: - PD gets expected Servers address - SSH to `pd` still works from Trusted/admin lane - critical services still reachable from Trusted - no surprise breakage to shared homelab functions ### Port 24 - Name: `Serenity 10G (1)` - Current live client: `Serenity` - Current profile: `Trusted` - Link: up - Speed: 10G - Role: core host - Tomorrow action: move to `Servers` - Risk: medium-high - Validation after move: - Serenity gets expected Servers address - intended services still reachable from Trusted ### Port 27 - Name: `Port 27` - Current profile: `Management` - Link: up - Speed: 10G - Role: likely infra/uplink - Tomorrow action: do not touch unless you have positively identified what it is - Risk: very high - Validation if ever touched: - upstream/downstream infra remains healthy - no switch isolation or mgmt loss ## 3. Recommended exact move order for server ports Use this order, not random order: 1. Port 2 -> Rocinante - inspect/profile-confirm first - do not move it early if it is your live admin path 2. Port 22 -> Nomad - first member of the controlled three-host batch 3. Port 24 -> Serenity - second member of the controlled three-host batch 4. Port 23 -> PlausibleDeniability - third member of the controlled three-host batch 5. Port 3 -> FlyingDutchman - default action is no move; only revisit if you intentionally decide it belongs in Servers after all If you want the most conservative variant: - leave Rocinante on Trusted during the live work - move Nomad, Serenity, and PD as the only server-lane batch - leave FlyingDutchman on Trusted ## 4. Per-port execution script For each independent server port or server batch: 1. open switch port in UniFi UI 2. confirm live client identity matches expectation 3. screenshot current state 4. if touching Nomad/Serenity/PD, pre-stage the exact order before the first change 5. change profile from `Trusted` (or current) -> `Servers` 6. wait for link/client/IP reassignment 7. verify host gets expected subnet/gateway 8. verify reachability from Rocinante/admin path 9. verify expected service behavior 10. if it was the three-host batch, verify cross-host dependencies before anything else 11. only then proceed to next port ## 5. Ports to explicitly leave alone tomorrow Leave alone unless a later issue forces action: - Port 1 (U7 Pro upstairs) - Port 27 (likely infra/uplink) - all inactive ports - any uplink/trunk-ish port not positively identified ## 6. Potential follow-up ports outside the main switch USW-24-PoE notable live port: - Port 24 -> profile `Management` -> link up at 1G - Tomorrow action: read-only verify what it is before touching - Do not change it casually during the same window unless you have confirmed its role ## 7. Success criteria for this port sheet Successful tomorrow outcome: - Nomad, Serenity, and PD are no longer sitting on Trusted access ports - Rocinante is either still the live admin box by deliberate choice or moved cleanly after the main batch is complete - FlyingDutchman stays on Trusted unless deliberately reclassified with reason - AP/uplink/infra ports remain stable - no server move proceeds without validation ## 8. Red flags Stop immediately if: - a moved host does not pull the expected subnet - SSH/admin access path disappears unexpectedly - a port identity in the UI does not match expected host - changing one port breaks unrelated infra - PD move causes unclear blast radius and you cannot explain it within a couple minutes