truenas-stacks/home/doris-dashboard/docs/usw-pro-hd-24-cutover-port-sheet.md

USW Pro HD 24 Exact Change Sheet

For Doris: this is the mechanical switch-port sheet for tomorrow. Do not freestyle. Change one thing, validate, then continue.

Historical status note:

• this is a 2026-05-22 cutover sheet, preserved as evidence of the original plan
• do not treat its "tomorrow" wording as active backlog without checking later migration result docs

Source basis:

• live UniFi read-only recon on 2026-05-22
• /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md
• /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/network-redesign-implementation-runbook.md

Core principle

• Uplink/AP/infra ports stay Management or trunked as appropriate.
• Server-class hosts leave Trusted and move to Servers.
• Unknown live ports get eyeballed before change.
• Do not bulk-edit profiles blindly.
• Rocinante is the live operator box, so keep it stable until the main server batch is complete or an alternate admin path is proven.
• Nomad, Serenity, and PD may need to move as one controlled wave because of NFS/shared-service coupling; validate the batch immediately.

---

1. Desired profile set for tomorrow

Current relevant profiles seen live:

• Management
• Trusted
• IoT
• Camera
• Old IoT

Needed for tomorrow:

• Management
• Trusted
• Servers
• IoT
• Camera
• Guest
• Old IoT
• trunk/uplink profile if you choose to normalize uplinks now

If Servers does not exist yet:

• create it before changing server ports
• use it as the target for the core host ports below

2. USW Pro HD 24 live ports that matter

Port 1

• Name: U7 Pro (Upstairs)
• Current profile: Management
• Link: up
• Speed: 2.5G
• Role: AP uplink / infrastructure
• Tomorrow action: leave on Management unless/until you replace with an explicit trunk/uplink profile
• Risk: high if changed incorrectly
• Validation after any change:
  • U7 Pro remains online in UniFi
  • wireless clients stay associated
  • management plane remains reachable

Port 2

• Name: Port 2
• Current observed live client: Rocinante
• Current explicit profile visibility: not clearly returned by API
• Link: up
• Speed: 2.5G
• Role: server/core host
• Tomorrow action: inspect in UniFi UI first, confirm current native network/profile, but keep Rocinante in place as the live operator station until the Nomad/Serenity/PD batch is done or a backup admin path is proven
• Risk: medium because profile visibility was ambiguous in API data
• Validation after move:
  • Rocinante gets expected Servers subnet/gateway
  • reachable from Trusted as intended
  • any expected service ports work

Port 3

• Name: FlyingDutchman
• Current profile: Trusted
• Link: up
• Speed: 2.5G
• Role: human endpoint / gaming PC unless proven otherwise
• Tomorrow action: leave on Trusted tomorrow unless you deliberately reclassify it later; default assumption is that it should stay with trusted human endpoints
• Risk: medium
• Validation after move:
  • host gets expected subnet/gateway
  • reachable from Trusted as intended
  • only move if this box is actually supposed to live with the homelab service lane

Port 22

• Name: Port 22
• Current live client: Nomad
• Current profile: Trusted
• Link: up
• Speed: 2.5G
• Role: core host
• Tomorrow action: move to Servers
• Risk: medium
• Validation after move:
  • Nomad gets expected Servers address
  • Doris pages / services expected on Nomad still reachable from Trusted

Port 23

• Name: Docker Server
• Current live client: PlausibleDeniability
• Current profile: Trusted
• Link: up
• Speed: 10G
• Role: primary core server
• Tomorrow action: move to Servers
• Risk: high-ish because this is central infrastructure
• Validation after move:
  • PD gets expected Servers address
  • SSH to pd still works from Trusted/admin lane
  • critical services still reachable from Trusted
  • no surprise breakage to shared homelab functions

Port 24

• Name: Serenity 10G (1)
• Current live client: Serenity
• Current profile: Trusted
• Link: up
• Speed: 10G
• Role: core host
• Tomorrow action: move to Servers
• Risk: medium-high
• Validation after move:
  • Serenity gets expected Servers address
  • intended services still reachable from Trusted

Port 27

• Name: Port 27
• Current profile: Management
• Link: up
• Speed: 10G
• Role: likely infra/uplink
• Tomorrow action: do not touch unless you have positively identified what it is
• Risk: very high
• Validation if ever touched:
  • upstream/downstream infra remains healthy
  • no switch isolation or mgmt loss

3. Recommended exact move order for server ports

Use this order, not random order:

1. Port 2 -> Rocinante

• inspect/profile-confirm first
• do not move it early if it is your live admin path

2. Port 22 -> Nomad

• first member of the controlled three-host batch

3. Port 24 -> Serenity

• second member of the controlled three-host batch

4. Port 23 -> PlausibleDeniability

• third member of the controlled three-host batch

5. Port 3 -> FlyingDutchman

• default action is no move; only revisit if you intentionally decide it belongs in Servers after all

If you want the most conservative variant:

• leave Rocinante on Trusted during the live work
• move Nomad, Serenity, and PD as the only server-lane batch
• leave FlyingDutchman on Trusted

4. Per-port execution script

For each independent server port or server batch:

1. open switch port in UniFi UI
2. confirm live client identity matches expectation
3. screenshot current state
4. if touching Nomad/Serenity/PD, pre-stage the exact order before the first change
5. change profile from Trusted (or current) -> Servers
6. wait for link/client/IP reassignment
7. verify host gets expected subnet/gateway
8. verify reachability from Rocinante/admin path
9. verify expected service behavior
10. if it was the three-host batch, verify cross-host dependencies before anything else
11. only then proceed to next port

5. Ports to explicitly leave alone tomorrow

Leave alone unless a later issue forces action:

• Port 1 (U7 Pro upstairs)
• Port 27 (likely infra/uplink)
• all inactive ports
• any uplink/trunk-ish port not positively identified

6. Potential follow-up ports outside the main switch

USW-24-PoE notable live port:

• Port 24 -> profile Management -> link up at 1G
• Tomorrow action: read-only verify what it is before touching
• Do not change it casually during the same window unless you have confirmed its role

7. Success criteria for this port sheet

Successful tomorrow outcome:

• Nomad, Serenity, and PD are no longer sitting on Trusted access ports
• Rocinante is either still the live admin box by deliberate choice or moved cleanly after the main batch is complete
• FlyingDutchman stays on Trusted unless deliberately reclassified with reason
• AP/uplink/infra ports remain stable
• no server move proceeds without validation

8. Red flags

Stop immediately if:

• a moved host does not pull the expected subnet
• SSH/admin access path disappears unexpectedly
• a port identity in the UI does not match expected host
• changing one port breaks unrelated infra
• PD move causes unclear blast radius and you cannot explain it within a couple minutes