truenas-stacks/home/doris-dashboard/docs/network-cutover-master-operator-sheet.md

# Network Cutover Master Operator Sheet

> For Doris: this is the one-page live operator sheet for tomorrow. Use this instead of bouncing between five docs while tired.

Historical status note:
- this file is a 2026-05-22 live cutover sheet, not the current remaining-work source of truth
- do not treat its open checkboxes or "tomorrow" language as active backlog
- current truth lives in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`

Goal: execute the UniFi network redesign with minimal improvisation, explicit stop/go gates, per-port actions, per-device dispositions, and fast rollback discipline.

Architecture:
- Keep the target lanes clear: Management, Trusted, Servers, IoT, Guest, Cameras.
- Keep Legacy CIA alive only as a quarantine/sunset lane.
- Move true service hosts out of Trusted while keeping human endpoints where they belong.
- Move easy named IoT wins now; quarantine ambiguous junk; Google is in scope, but only through narrow, reversible tests.

Primary references if deeper detail is needed:
- `network-redesign-implementation-runbook.md`
- `network-firewall-rule-order.md`
- `legacy-cia-triage-worksheet.md`
- `unifi-readonly-recon-2026-05-22.md`
- `usw-pro-hd-24-cutover-port-sheet.md`
- `old-iot-tomorrow-disposition-list.md`

---

## 1. Live State Snapshot Already Confirmed

Networks currently present:
- Management -> `10.5.0.1/24`
- Trusted -> VLAN 51 -> `10.5.1.1/24`
- Old IoT -> VLAN 2 -> `192.168.1.1/24`
- IoT -> VLAN 510 -> `10.5.10.1/24`
- Camera -> VLAN 520 -> `10.5.20.1/24`
- Guest -> VLAN 590 -> `10.5.90.1/24`

SSIDs currently present:
- `CIA Via` -> Old IoT
- `UNEF's Playhouse` -> Camera
- `Whiskey Neat Fuck Ice` -> Trusted
- `Yer a Wifi Harry` -> Trusted

Current client counts:
- Management: 2
- Old IoT: 14
- Camera: 1
- Trusted: 14

Current hazards:
- the two historical `espressif` Management hazards are now known Protect WiFi chimes, not unidentified junk
- almost all Wi‑Fi clients are on the U7 Pro
- there are no custom firewall rules/groups yet, so tomorrow’s segmentation policy is basically greenfield

## 2. Tomorrow’s Must-Win Outcomes

By the time we stop, these should be true:
- Management is materially cleaned up
- Cameras lane exists and is not polluted by junk placement mistakes
- Servers lane exists and core hosts are moved or deliberately staged with validation
- IoT lane exists and easy-value devices are moved
- Legacy CIA is explicitly a quarantine/sunset lane
- no broad panic rules were added to compensate for fatigue

In-scope if conditions support it:
- Google/cast migration work, but only through narrow, reversible tests
- U6 LR only if needed to stabilize client behavior or complete the design cleanly

Nice-to-have only if smooth:
- SSID simplification

## 3. Absolute Rules

- Keep one stable admin path alive the whole time.
- Rocinante is the live operator station, so do not move it until the rest of the server batch is done or an alternate admin path is proven.
- Change one meaningful thing, then validate.
- Do not bulk-edit live server ports blindly.
- Nomad, Serenity, and PD can be moved as one controlled batch only because their NFS/shared-service coupling is real; pre-stage everything first, then validate the batch immediately.
- Do not try to empty Legacy CIA completely if the window gets noisy.
- Do not move unknown junk into Management, Trusted, or Servers.
- Do not let Google/cast problems bait you into broad allow rules.
- If management reachability degrades, rollback first, think second.

## 4. Minute-by-Minute Execution Spine

### T-30 to T-15: prep
- [ ] open this file
- [ ] open UniFi admin
- [ ] open Doris visual artifacts if helpful
- [ ] confirm Rocinante is the live control box
- [ ] confirm fallback route into UniFi in case Rocinante loses the lane mid-change
- [ ] decide whether U6 LR is in scope or explicitly out of scope

### Minute 0-10: baseline capture
- [ ] screenshot/export networks
- [ ] screenshot/export SSIDs
- [ ] screenshot/export firewall/rule state
- [ ] screenshot/export port profiles
- [ ] screenshot/export switch port assignments
- [ ] screenshot/export AP mappings
- [ ] snapshot Management client list
- [ ] snapshot Old IoT client list

Stop/go gate:
- [ ] do not proceed until rollback baseline exists

### Minute 10-20: create/normalize objects only
- [ ] create/confirm Servers network object
- [ ] create/confirm any missing profiles
- [ ] create/confirm staged SSIDs if needed
- [ ] create/confirm staged firewall objects/rules

Stop/go gate:
- [ ] no clients should have moved yet
- [ ] Trusted admin path still fine

### Minute 20-35: management cleanup first
- [ ] confirm the two former Management `espressif` devices are still understood as the documented Protect-chime exception
- [ ] ensure infra devices remain on Management intent
- [ ] remove obvious non-infra junk from Management

Stop/go gate:
- [ ] UniFi still sees gateway/switch/APs
- [ ] admin client still reaches controller

### Minute 35-50: security cleanup
- [ ] validate Camera lane
- [ ] move Protect chimes only if Protect health is explicitly validated during the move
- [ ] confirm doorbell remains healthy

### Minute 50-85: core server move wave
- [ ] leave Rocinante in place as the operator station until the main server batch is done
- [ ] keep FlyingDutchman on Trusted unless a later decision explicitly reclassifies it
- [ ] pre-stage the exact three-port sequence: Nomad, Serenity, PD
- [ ] move Nomad, Serenity, and PD in one controlled wave because of NFS/shared-service coupling
- [ ] validate the batch immediately before touching anything else

### Minute 85-110: easy IoT wins
- [ ] MyQ
- [ ] LG dryer
- [ ] Samsung FamilyHub
- [ ] Main-Floor ecobee
- [ ] Upstairs ecobee

### Minute 110-125: Legacy CIA quarantine pass
- [ ] mark leftovers as quarantine/defer
- [ ] do not force migration of unknowns
- [ ] apply harsh quarantine posture

### Minute 125-140: Google test if the window is still stable
- [ ] test one Google/cast device first
- [ ] if ugly, stop and defer

### Minute 140-155: guest/SSID cleanup
- [ ] validate Guest
- [ ] disable only stale SSIDs that are truly no longer needed

### Minute 155-180: final validation and stop
- [ ] Trusted ok
- [ ] server services ok
- [ ] moved IoT devices ok
- [ ] security ok
- [ ] Management materially cleaner
- [ ] Legacy CIA now explicitly quarantine

## 5. Management Offender Sheet

These two devices were the historical Management offenders that needed identification. They are no longer mystery devices, and they are not a rediscovery task:

1. `espressif`
- IP: `10.5.0.123`
- AP: `U7 Pro`
- SSID: `UniFi Wireless`
- Current call: known Protect WiFi chime; keep on the documented Management/default-SSID exception unless doing an explicit Protect-validation move

2. `espressif`
- IP: `10.5.0.189`
- AP: `U7 Pro`
- SSID: `UniFi Wireless`
- Current call: known Protect WiFi chime; keep on the documented Management/default-SSID exception unless doing an explicit Protect-validation move

Operator note:
- target architecture still says these belong with security estate, but the current known-good live state keeps them on Management/default `UniFi Wireless` because the Camera override failed in Protect

## 6. Exact Core Port Move Sheet

### Leave Alone Unless Positively Necessary
- USW Pro HD 24 port 1 -> `U7 Pro (Upstairs)` -> profile `Management`
- USW Pro HD 24 port 27 -> likely infra/uplink -> profile `Management`
- USW-24-PoE port 24 -> link up on `Management`, inspect before touching

### Port Move Order

1. USW Pro HD 24 port 2
- Live host: `Rocinante`
- Current profile visibility from API: ambiguous
- Action: inspect in UI first, then move to `Servers` if confirmed
- Validate:
  - correct subnet/gateway
  - reachable from Trusted
  - intended services still work

2. USW Pro HD 24 port 3
- Live host: `FlyingDutchman`
- Current profile: `Trusted`
- Action: keep on `Trusted` tomorrow unless a later decision explicitly reclassifies it; this is John and Manndra's gaming PC, not a homelab service host by default
- Validate:
  - host still reachable
  - services behave as expected
- Safe default: leave it in Trusted

3. USW Pro HD 24 port 22
- Live host: `Nomad`
- Current profile: `Trusted`
- Action: move as part of the controlled three-host server batch
- Validate:
  - expected address
  - services reachable from Trusted

4. USW Pro HD 24 port 24
- Live host: `Serenity`
- Current profile: `Trusted`
- Action: move as part of the controlled three-host server batch
- Validate:
  - expected address
  - intended services reachable

5. USW Pro HD 24 port 23
- Live host: `PlausibleDeniability`
- Current profile: `Trusted`
- Action: move as part of the controlled three-host server batch after Nomad and Serenity are ready
- Validate:
  - expected address
  - SSH/admin path still works
  - critical homelab services still work
- Warning:
  - because Nomad, Serenity, and PD are coupled by active shares/services, treat them as one planned wave rather than three unrelated experiments
  - Rocinante should stay as the control box until that wave is complete

## 7. Old IoT Device Disposition Sheet

### Migrate Now
1. `MyQ-29B` -> `192.168.1.130` -> target `IoT`
2. `LG_Smart_Dryer2_open` -> `192.168.1.186` -> target `IoT`
3. `Samsung-FamilyHub` -> `192.168.1.149` -> target `IoT`
4. `Main-Floor` ecobee -> `192.168.1.102` -> target `IoT`
5. `Upstairs` ecobee -> `192.168.1.131` -> target `IoT`

Validation for each:
- app still works
- device online
- no broad helper rule was needed

### Migrate Later Only If Calm
6. `Google-Home-Mini` -> `192.168.1.185`
7. `3c:8d:20:f3:92:36` -> Google device -> `192.168.1.192`
8. `90:ca:fa:b6:7f:6e` -> Google device -> `192.168.1.129`

Rule:
- Google is in scope tomorrow, but start with one Google-class device only unless everything is smooth
- if it demands broad discovery hacks, stop and defer

### Quarantine Tomorrow
9. `5c:61:99:41:73:40` -> unknown Cloud Network device
10. `60:74:f4:54:fd:ec` -> Private/randomized
11. `60:74:f4:7b:6a:11` -> Private/randomized
12. `c0:f5:35:20:5d:94` -> AMPAK device
13. `d4:ad:fc:60:90:6a` -> Intellirocks
14. `d4:ad:fc:ea:7f:65` -> Intellirocks

Rule:
- these do not earn clean-IoT membership by being merely online
- leave them on Legacy CIA quarantine until identified better

## 8. Camera/Security Reality Check

Already true:
- `front-doorbell` is already on Camera at `10.5.20.217`

Current known-good chime exception:
- Protect WiFi Chime `upstairs landing` is intentionally on Management/default `UniFi Wireless` at `10.5.0.123`
- Protect WiFi Chime `Living Room` is intentionally on Management/default `UniFi Wireless` at `10.5.0.189`

If revisiting security work, the goal is therefore:
- preserve the doorbell’s healthy state
- tighten policy carefully
- only revisit chime placement during an explicit Protect-validation test

## 9. Firewall Build Priorities

Build these first:
- established/related allow
- invalid drop
- management shield
- Trusted admin -> Management allow
- Trusted -> Servers allow
- Guest -> internet only
- IoT -> DNS/NTP/internet + specific helpers only
- Camera -> DNS/NTP/internet/Protect only
- Legacy CIA -> DNS/NTP/internet only + explicit one-offs only
- broad internal denies for Guest/IoT/Camera/Legacy CIA

Do not do tomorrow unless proven necessary:
- broad mDNS/cast trust exceptions
- loose `IoT -> Servers any`
- loose `Legacy CIA -> Trusted any`

## 10. Validation Gates

After each meaningful change, check the smallest thing that proves success.

### After management changes
- [ ] UniFi admin still reachable
- [ ] gateway/switch/AP still visible
- [ ] no surprise loss of wireless control

### After each server port move
- [ ] host gets correct subnet/gateway
- [ ] reachable from Trusted
- [ ] expected service path works

### After the Nomad/Serenity/PD batch
- [ ] NFS/shared-service relationships recover cleanly
- [ ] PD remains reachable from Rocinante/admin path
- [ ] no cross-server dependency is hanging half-broken

### After each IoT move
- [ ] device rejoins expected SSID/VLAN
- [ ] app/control works
- [ ] no broad workaround rule added

### After security changes
- [ ] doorbell/chime online
- [ ] expected app/admin behavior works

### After quarantine posture changes
- [ ] Legacy CIA devices still have minimum acceptable functionality
- [ ] they do not have new local trust

## 11. Fast Rollback Strip

If anything goes sideways:
1. revert the last moved device/port first
2. revert the last SSID/VLAN assignment second
3. revert the last firewall rule/order change third
4. restore management-plane reachability before doing anything clever
5. do not stack fresh changes on top of confusion

Immediate rollback triggers:
- loss of UniFi management-plane access
- AP/switch disappears unexpectedly
- moved server loses reachability and root cause is not obvious quickly
- critical household function breaks and cannot be explained fast
- Google weirdness starts baiting sloppy panic rules

## 12. Explicit Stop Condition

Stop when:
- Management is materially cleaner
- Cameras lane is sane
- core server moves are done or deliberately deferred with reasons
- easy-value IoT moves are done
- Legacy CIA is explicitly a quarantine/sunset lane
- the next remaining work item smells like “heroics” instead of “mechanical completion”

That is success.
Not every leftover wart has to die tomorrow.