truenas-stacks/home/doris-dashboard/docs/hermes-dashboard-trusted-access-apply-2026-05-24.md

Hermes dashboard Trusted-only Policy Engine apply — 2026-05-24

Live change summary

Applied the narrow UniFi Policy Engine service slice that makes the Hermes dashboard on Nomad effectively Trusted-only.

Dashboard endpoint:

• 10.5.30.7:9119

Apply time artifact stamp:

• 2026-05-24-061715

What changed

Created these two custom firewall policies:

1. Allow Trusted to Hermes Dashboard

• id: 6a1297eefb913dd84d4a3fbb
• action: ALLOW
• protocol: tcp
• source: 10.5.1.0/24
• destination: 10.5.30.7
• destination port: 9119
• schedule: ALWAYS

2. Block Management and Servers to Hermes Dashboard

• id: 6a1297eefb913dd84d4a3fc0
• action: BLOCK
• protocol: tcp
• source: 10.5.0.0/24, 10.5.30.0/24
• destination: 10.5.30.7
• destination port: 9119
• schedule: ALWAYS

Verification result

• Pre-apply baseline did not already contain either Hermes-dashboard policy.
• Post-apply readback shows both rules present as non-predefined custom policies.
• Apply helper returned no API errors.

Artifacts

Baselines and apply output saved in:

• home/doris-dashboard/docs/baselines/unifi-firewall-policies-custom-2026-05-24-061715-pre-hermes-dashboard-slice.json
• home/doris-dashboard/docs/baselines/unifi-hermes-dashboard-policy-apply-2026-05-24-061715.json
• home/doris-dashboard/docs/baselines/unifi-firewall-policies-custom-2026-05-24-061715-post-hermes-dashboard-slice.json

Helper added to repo and copied to PD runtime for repeatable staging/apply:

• repo: automation/bin/unifi_stage_hermes_dashboard_policy.py
• PD runtime: /mnt/docker-ssd/docker/compose/automation/bin/unifi_stage_hermes_dashboard_policy.py

Representative lane probe after apply

Follow-up live check from PD showed an important enforcement caveat.

From PD (10.5.30.6) to Nomad (10.5.30.7:9119):

• direct TCP connect succeeded
• HTTP GET succeeded with 200 OK
• route on PD is on-link: 10.5.30.7 dev enp3s0f0 src 10.5.30.6

Interpretation:

• PD and Nomad are both on the Servers subnet (10.5.30.0/24)
• this flow stays L2-local and does not traverse the UniFi gateway
• therefore the gateway Policy Engine block does not stop PD from reaching the dashboard even though the custom rule exists

What the current rule set still likely achieves:

• Trusted clients on 10.5.1.0/24 can reach the dashboard
• routed Management-lane access should still be governed by the custom block
• same-subnet Servers peers are not isolated by this gateway-only approach

Operator validation still worth doing

Because same-subnet east-west traffic bypasses the gateway enforcement point, the right checks are now:

• from a Trusted client: confirm http://hermes.home.paccoco.com:9119 or the intended dashboard URL still loads
• from a Management client on a different subnet: confirm 10.5.30.7:9119 is blocked
• do not treat PD->Nomad reachability as proof the rule failed globally; it specifically proves intra-subnet server peers need host-local enforcement if they must be excluded

If true Trusted-only must exclude PD and other Servers peers

Use one of these instead of relying only on the gateway policy:

• add a host firewall on Nomad permitting only Trusted-source addresses/subnets to port 9119
• move the dashboard to a lane where disallowed sources must cross a routed boundary
• use switch/ACL mechanisms that can enforce same-subnet isolation if available

Rollback

Fastest rollback is to delete the two Hermes-dashboard custom rules by id or rerun a small helper update that disables/removes them:

• 6a1297eefb913dd84d4a3fbb
• 6a1297eefb913dd84d4a3fc0