214 lines
7.1 KiB
Markdown
214 lines
7.1 KiB
Markdown
# USW Pro HD 24 Exact Change Sheet
|
|
|
|
> For Doris: this is the mechanical switch-port sheet for tomorrow. Do not freestyle. Change one thing, validate, then continue.
|
|
|
|
Historical status note:
|
|
- this is a 2026-05-22 cutover sheet, preserved as evidence of the original plan
|
|
- do not treat its "tomorrow" wording as active backlog without checking later migration result docs
|
|
|
|
Source basis:
|
|
- live UniFi read-only recon on 2026-05-22
|
|
- /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md
|
|
- /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md
|
|
|
|
## Core principle
|
|
- Uplink/AP/infra ports stay Management or trunked as appropriate.
|
|
- Server-class hosts leave Trusted and move to Servers.
|
|
- Unknown live ports get eyeballed before change.
|
|
- Do not bulk-edit profiles blindly.
|
|
- Rocinante is the live operator box, so keep it stable until the main server batch is complete or an alternate admin path is proven.
|
|
- Nomad, Serenity, and PD may need to move as one controlled wave because of NFS/shared-service coupling; validate the batch immediately.
|
|
|
|
---
|
|
|
|
## 1. Desired profile set for tomorrow
|
|
|
|
Current relevant profiles seen live:
|
|
- Management
|
|
- Trusted
|
|
- IoT
|
|
- Camera
|
|
- Old IoT
|
|
|
|
Needed for tomorrow:
|
|
- Management
|
|
- Trusted
|
|
- Servers
|
|
- IoT
|
|
- Camera
|
|
- Guest
|
|
- Old IoT
|
|
- trunk/uplink profile if you choose to normalize uplinks now
|
|
|
|
If `Servers` does not exist yet:
|
|
- create it before changing server ports
|
|
- use it as the target for the core host ports below
|
|
|
|
## 2. USW Pro HD 24 live ports that matter
|
|
|
|
### Port 1
|
|
- Name: `U7 Pro (Upstairs)`
|
|
- Current profile: `Management`
|
|
- Link: up
|
|
- Speed: 2.5G
|
|
- Role: AP uplink / infrastructure
|
|
- Tomorrow action: leave on Management unless/until you replace with an explicit trunk/uplink profile
|
|
- Risk: high if changed incorrectly
|
|
- Validation after any change:
|
|
- U7 Pro remains online in UniFi
|
|
- wireless clients stay associated
|
|
- management plane remains reachable
|
|
|
|
### Port 2
|
|
- Name: `Port 2`
|
|
- Current observed live client: `Rocinante`
|
|
- Current explicit profile visibility: not clearly returned by API
|
|
- Link: up
|
|
- Speed: 2.5G
|
|
- Role: server/core host
|
|
- Tomorrow action: inspect in UniFi UI first, confirm current native network/profile, but keep Rocinante in place as the live operator station until the Nomad/Serenity/PD batch is done or a backup admin path is proven
|
|
- Risk: medium because profile visibility was ambiguous in API data
|
|
- Validation after move:
|
|
- Rocinante gets expected Servers subnet/gateway
|
|
- reachable from Trusted as intended
|
|
- any expected service ports work
|
|
|
|
### Port 3
|
|
- Name: `FlyingDutchman`
|
|
- Current profile: `Trusted`
|
|
- Link: up
|
|
- Speed: 2.5G
|
|
- Role: human endpoint / gaming PC unless proven otherwise
|
|
- Tomorrow action: leave on `Trusted` tomorrow unless you deliberately reclassify it later; default assumption is that it should stay with trusted human endpoints
|
|
- Risk: medium
|
|
- Validation after move:
|
|
- host gets expected subnet/gateway
|
|
- reachable from Trusted as intended
|
|
- only move if this box is actually supposed to live with the homelab service lane
|
|
|
|
### Port 22
|
|
- Name: `Port 22`
|
|
- Current live client: `Nomad`
|
|
- Current profile: `Trusted`
|
|
- Link: up
|
|
- Speed: 2.5G
|
|
- Role: core host
|
|
- Tomorrow action: move to `Servers`
|
|
- Risk: medium
|
|
- Validation after move:
|
|
- Nomad gets expected Servers address
|
|
- Doris pages / services expected on Nomad still reachable from Trusted
|
|
|
|
### Port 23
|
|
- Name: `Docker Server`
|
|
- Current live client: `PlausibleDeniability`
|
|
- Current profile: `Trusted`
|
|
- Link: up
|
|
- Speed: 10G
|
|
- Role: primary core server
|
|
- Tomorrow action: move to `Servers`
|
|
- Risk: high-ish because this is central infrastructure
|
|
- Validation after move:
|
|
- PD gets expected Servers address
|
|
- SSH to `pd` still works from Trusted/admin lane
|
|
- critical services still reachable from Trusted
|
|
- no surprise breakage to shared homelab functions
|
|
|
|
### Port 24
|
|
- Name: `Serenity 10G (1)`
|
|
- Current live client: `Serenity`
|
|
- Current profile: `Trusted`
|
|
- Link: up
|
|
- Speed: 10G
|
|
- Role: core host
|
|
- Tomorrow action: move to `Servers`
|
|
- Risk: medium-high
|
|
- Validation after move:
|
|
- Serenity gets expected Servers address
|
|
- intended services still reachable from Trusted
|
|
|
|
### Port 27
|
|
- Name: `Port 27`
|
|
- Current profile: `Management`
|
|
- Link: up
|
|
- Speed: 10G
|
|
- Role: likely infra/uplink
|
|
- Tomorrow action: do not touch unless you have positively identified what it is
|
|
- Risk: very high
|
|
- Validation if ever touched:
|
|
- upstream/downstream infra remains healthy
|
|
- no switch isolation or mgmt loss
|
|
|
|
## 3. Recommended exact move order for server ports
|
|
|
|
Use this order, not random order:
|
|
|
|
1. Port 2 -> Rocinante
|
|
- inspect/profile-confirm first
|
|
- do not move it early if it is your live admin path
|
|
|
|
2. Port 22 -> Nomad
|
|
- first member of the controlled three-host batch
|
|
|
|
3. Port 24 -> Serenity
|
|
- second member of the controlled three-host batch
|
|
|
|
4. Port 23 -> PlausibleDeniability
|
|
- third member of the controlled three-host batch
|
|
|
|
5. Port 3 -> FlyingDutchman
|
|
- default action is no move; only revisit if you intentionally decide it belongs in Servers after all
|
|
|
|
If you want the most conservative variant:
|
|
- leave Rocinante on Trusted during the live work
|
|
- move Nomad, Serenity, and PD as the only server-lane batch
|
|
- leave FlyingDutchman on Trusted
|
|
|
|
## 4. Per-port execution script
|
|
|
|
For each independent server port or server batch:
|
|
1. open switch port in UniFi UI
|
|
2. confirm live client identity matches expectation
|
|
3. screenshot current state
|
|
4. if touching Nomad/Serenity/PD, pre-stage the exact order before the first change
|
|
5. change profile from `Trusted` (or current) -> `Servers`
|
|
6. wait for link/client/IP reassignment
|
|
7. verify host gets expected subnet/gateway
|
|
8. verify reachability from Rocinante/admin path
|
|
9. verify expected service behavior
|
|
10. if it was the three-host batch, verify cross-host dependencies before anything else
|
|
11. only then proceed to next port
|
|
|
|
## 5. Ports to explicitly leave alone tomorrow
|
|
|
|
Leave alone unless a later issue forces action:
|
|
- Port 1 (U7 Pro upstairs)
|
|
- Port 27 (likely infra/uplink)
|
|
- all inactive ports
|
|
- any uplink/trunk-ish port not positively identified
|
|
|
|
## 6. Potential follow-up ports outside the main switch
|
|
|
|
USW-24-PoE notable live port:
|
|
- Port 24 -> profile `Management` -> link up at 1G
|
|
- Tomorrow action: read-only verify what it is before touching
|
|
- Do not change it casually during the same window unless you have confirmed its role
|
|
|
|
## 7. Success criteria for this port sheet
|
|
|
|
Successful tomorrow outcome:
|
|
- Nomad, Serenity, and PD are no longer sitting on Trusted access ports
|
|
- Rocinante is either still the live admin box by deliberate choice or moved cleanly after the main batch is complete
|
|
- FlyingDutchman stays on Trusted unless deliberately reclassified with reason
|
|
- AP/uplink/infra ports remain stable
|
|
- no server move proceeds without validation
|
|
|
|
## 8. Red flags
|
|
|
|
Stop immediately if:
|
|
- a moved host does not pull the expected subnet
|
|
- SSH/admin access path disappears unexpectedly
|
|
- a port identity in the UI does not match expected host
|
|
- changing one port breaks unrelated infra
|
|
- PD move causes unclear blast radius and you cannot explain it within a couple minutes
|