truenas-stacks/home/doris-dashboard/docs/network-cutover-red-team-card.md

Network Cutover Red Team Card

Use this during the live window when your brain gets dumb.

Historical status note:

• this card belongs to the 2026-05-22 cutover-planning wave
• keep it as operator evidence, but do not treat it as the current backlog without checking later migration result docs

Goal:

• make one clean change
• validate it
• either continue or revert

If you feel rushed, stop.

---

DO

• Keep one known-good Trusted admin client online the entire time.
• Keep Rocinante alive as the live control box until the main server batch is done or a fallback admin path is proven.
• Keep UniFi open.
• Keep the master operator sheet open.
• Change one thing at a time.
• Validate after every host, SSID, profile, or firewall change.
• Revert the last change fast if the break is not obvious.
• Write down temporary exceptions immediately.
• Treat Legacy CIA as quarantine, not a place to hide problems.

DO NOT

• Do not move unrelated core hosts casually.
• Do not move Rocinante early if you are actively driving the migration from it.
• Do not touch port 27 casually.
• Do not touch port 1 unless intentionally normalizing infra.
• Do not "clean up" Google/cast weirdness early.
• Do not add broad allow-any-any panic rules.
• Do not keep pushing forward while tired or annoyed.
• Do not trust memory when the docs already exist.

---

FIRST IF BROKEN

1. Ask: what was the very last change?
2. Revert that exact change first.
3. Restore management reachability before anything else.
4. Confirm UniFi gateway, switch, and AP visibility.
5. Confirm the Trusted admin client still reaches the controller.
6. Only then decide whether to retry.

If management breaks:

• revert the last infra/profile/VLAN change immediately
• stop until control-plane access is stable

If the Nomad/Serenity/PD batch breaks:

• revert the last moved host first and unwind in reverse order
• do not start debugging Google nonsense in the middle of a storage/service outage

If a server breaks:

• revert only that server/port/profile
• do not move the next server yet

If an IoT device breaks:

• revert only that device
• keep the rest of the window moving

If Google/cast gets weird:

• defer it
• do not poison policy for the whole network

---

SAFE ORDER

1. Baseline capture
2. Create/confirm objects only
3. Management cleanup
4. Security/chimes/camera lane
5. Server ports one by one
6. Easy IoT wins
7. Legacy CIA quarantine pass
8. Google weirdness only if time and confidence remain
9. Guest/SSID cleanup
10. Final validation
11. Stop

---

SUCCESS LOOKS LIKE

• Management materially cleaner
• Camera/Security lane exists
• Servers lane exists and core hosts are moved or clearly staged
• Easy-value IoT devices are moved
• Legacy CIA is now an explicit quarantine/sunset lane
• No broad insecure emergency rules were added

HARD STOP

Stop if:

• you lose clear management reachability
• you are stacking unresolved breakage
• you are guessing instead of validating
• you catch yourself saying "it’ll probably be fine"

That sentence means stop.