truenas-stacks/home/doris-dashboard/docs/network-cutover-minute-checklist.md

Home Network Redesign Minute-by-Minute Cutover Checklist

For Doris: this is the live change-window script. Use it like a pilot checklist, not a brainstorming prompt.

Goal: execute the redesign tomorrow with deliberate pauses, validation after every block of changes, and clean rollback points.

Assumptions:

• You have UniFi admin access.
• One stable Trusted admin client remains connected the entire time.
• You are not trying to empty Legacy CIA completely in one heroic swing.

---

T-30 to T-15 minutes: staging and sanity

• Open the runbook:
  • /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md
• Open firewall rule order:
  • /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-firewall-rule-order.md
• Open Legacy CIA worksheet:
  • /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/legacy-cia-triage-worksheet.md
• Open visual artifacts:
  • http://10.5.30.7:8787/network-redesign.html
  • http://10.5.30.7:8787/network-web.html
• Confirm Rocinante is the live control box.
• Confirm fallback route to UniFi exists in case Rocinante loses the lane mid-change.
• Decide whether U6 LR is in or out for tomorrow.
• Do not start until you know where rollback begins.

Minute 0-10: baseline capture

• Screenshot/export current networks.
• Screenshot/export current SSIDs.
• Screenshot/export firewall rules and order.
• Screenshot/export port profiles.
• Screenshot/export current switch port assignments.
• Screenshot/export AP config/broadcast mappings.
• Record current IP/MAC for:
  • PD
  • Serenity
  • Nomad
  • Rocinante
  • doorbell
  • Protect chimes
  • ecobees
  • MyQ
  • Samsung FamilyHub
  • LG dryer
  • known Google/cast devices
• Snapshot which clients are on Management now.
• Snapshot which clients are on Legacy CIA now.

Stop/go check:

• If baseline capture is incomplete, stop.

Minute 10-20: create/normalize objects only

• Create or confirm target networks:
  • Mgmt 10
  • Trusted 20
  • Servers 30
  • IoT 40
  • Guest 50
  • Cameras 60
  • Legacy CIA retained
• Create or confirm port profiles.
• Create or confirm SSIDs:
  • Trusted
  • Trusted-Compat if needed
  • IoT
  • Guest
  • Security
  • CIA Via only if still needed as temporary quarantine SSID
• Create/stage rule objects/groups.
• Enter staged firewall rules in proper order if not already present.

Stop/go check:

• Nothing should have moved yet.
• Trusted admin client must still be fine.

Minute 20-35: management cleanup first

• Confirm UDM, switches, and APs are mapped to Management intent.
• Remove obvious non-infrastructure devices from Management.
• Identify any stragglers remaining in Management and list them.
• If Security lane is ready, prepare to move chimes immediately.

Validation:

• UniFi still sees gateway, switches, APs.
• Trusted admin client can still reach controller.
• No surprise disconnects.

Rollback trigger:

• If management reachability degrades, revert the last infra change immediately.

Minute 35-50: stand up Cameras / Security lane

• Activate/validate Cameras VLAN 60.
• Activate Security SSID if needed.
• Move Protect chimes.
• Move doorbell if ready.
• Confirm no security devices remain polluting Management.

Validation:

• device rejoins expected lane
• app/admin/Protect behavior still works
• no broad emergency rules added yet

Rollback trigger:

• If doorbell/chimes become unrecoverable fast, revert that device only.

Minute 50-75: move core servers to Servers VLAN 30

Order recommendation for this window:

1. keep Rocinante in place as the live operator station
2. move Nomad
3. move Serenity
4. move PD
5. move Rocinante only after the main batch is validated, or defer it
6. leave FlyingDutchman on Trusted unless you explicitly decide to reclassify it later

For the Nomad/Serenity/PD batch:

• pre-stage the exact three-host move order before the first change
• move Nomad to Servers VLAN/profile
• move Serenity to Servers VLAN/profile
• move PD to Servers VLAN/profile
• verify IP/gateway/subnet for all three
• verify from Rocinante
• verify NFS/shared-service paths recover cleanly
• note any reservation/DNS fix needed before continuing

Validation after the batch:

• each host responds as expected
• shared services still work
• PD is still reachable from Rocinante
• no accidental management loss

Rollback trigger:

• If the batch breaks and root cause is not obvious quickly, revert the last moved host first and unwind in reverse order.

Minute 75-100: easy-value IoT migration

Move in this general order:

1. MyQ
2. Samsung FamilyHub
3. LG dryer
4. ecobees if confidence remains high

For each device/class:

• move to IoT VLAN 40 / IoT SSID
• wait for reassociation
• verify cloud/app control
• verify no stupid broad helper rule was needed

Validation:

• app works
• device online
• no Management exposure

Rollback trigger:

• If household-critical behavior breaks, revert only that device and continue with safer devices.

Minute 100-115: Legacy CIA triage pass

• Open the triage worksheet.
• For every remaining Legacy CIA client, mark:
  • migrate later
  • quarantine
  • kill candidate
• Keep useful-but-fragile leftovers on Legacy CIA.
• Apply quarantine firewall posture.
• Ensure no new devices are intentionally assigned there.

Validation:

• Legacy CIA is now explicitly a quarantine lane, not fake production IoT.
• Remaining devices are explainable.

Minute 115-130: Google / discovery problem children only if time remains

• Pick one Google/cast device only.
• Try moving it to IoT.
• Test casting/discovery from Trusted.
• If it needs exceptions, create only host-specific narrow ones.
• If it gets ugly, stop and revert that one device.

Success condition:

• either one working pattern discovered
• or explicit deferral decided without poisoning policy

Minute 130-140: Guest and SSID cleanup

• Verify Guest SSID -> VLAN 50.
• Test internet-only behavior.
• Disable stale SSIDs that are no longer needed.
• Keep Trusted-Compat only if it solved a real problem.
• Keep CIA Via only if remaining quarantined devices still require it.

Minute 140-150: final validation sweep

From Trusted:

• internet works
• UniFi admin works
• PD/Serenity/Nomad/Rocinante reachable as intended

From Guest:

• internet works
• local IPs blocked

From IoT moved devices:

• app control works

From Cameras/Security:

• doorbell/chimes online as expected

From Management perspective:

• infra only, or any temporary exception is explicitly documented

From Legacy CIA perspective:

• only leftovers remain
• quarantine posture is active

Minute 150-165: document what survived the window

• Record exact devices moved successfully.
• Record exact devices reverted.
• Record temporary exceptions added.
• Record which devices remain on Legacy CIA and why.
• Record whether U6 LR remains out of scope or becomes next task.

Minute 165-180: stop, do not improvise

If minimum success criteria are met, stop.

Minimum success criteria:

• Management cleaned up materially
• Cameras lane exists
• Servers lane exists and core hosts are moved or clearly staged
• IoT lane exists and easy-value devices moved
• Legacy CIA converted into explicit quarantine/sunset lane
• no broad insecure panic rules were added

If not met:

• roll back only the broken last-mile changes
• do not keep piling on work while tired

Emergency rollback strip

If something goes sideways:

1. revert the last moved client/device
2. revert the last SSID/VLAN assignment change
3. revert the last firewall rule change/order change
4. restore management-plane reachability first
5. only continue after stability is back

Out of scope unless everything is shockingly smooth

• full emptying of Legacy CIA
• perfect cast/mDNS handling for every Google thing
• RF fine-tuning
• U6 LR optimization work
• cleanup of every stale historical object in UniFi