truenas-stacks/home/doris-dashboard/docs/network-cutover-master-operator-sheet.md

Network Cutover Master Operator Sheet

For Doris: this is the one-page live operator sheet for tomorrow. Use this instead of bouncing between five docs while tired.

Goal: execute the UniFi network redesign with minimal improvisation, explicit stop/go gates, per-port actions, per-device dispositions, and fast rollback discipline.

Architecture:

• Keep the target lanes clear: Management, Trusted, Servers, IoT, Guest, Cameras.
• Keep Legacy CIA alive only as a quarantine/sunset lane.
• Move true service hosts out of Trusted while keeping human endpoints where they belong.
• Move easy named IoT wins now; quarantine ambiguous junk; Google is in scope, but only through narrow, reversible tests.

Primary references if deeper detail is needed:

• network-redesign-implementation-runbook.md
• network-firewall-rule-order.md
• legacy-cia-triage-worksheet.md
• unifi-readonly-recon-2026-05-22.md
• usw-pro-hd-24-cutover-port-sheet.md
• old-iot-tomorrow-disposition-list.md

---

1. Live State Snapshot Already Confirmed

Networks currently present:

• Management -> 10.5.0.1/24
• Trusted -> VLAN 51 -> 10.5.1.1/24
• Old IoT -> VLAN 2 -> 192.168.1.1/24
• IoT -> VLAN 510 -> 10.5.10.1/24
• Camera -> VLAN 520 -> 10.5.20.1/24
• Guest -> VLAN 590 -> 10.5.90.1/24

SSIDs currently present:

• CIA Via -> Old IoT
• UNEF's Playhouse -> Camera
• Whiskey Neat Fuck Ice -> Trusted
• Yer a Wifi Harry -> Trusted

Current client counts:

• Management: 2
• Old IoT: 14
• Camera: 1
• Trusted: 14

Current hazards:

• two unnamed espressif devices are on Management via UniFi Wireless on the U7 Pro
• almost all Wi‑Fi clients are on the U7 Pro
• there are no custom firewall rules/groups yet, so tomorrow’s segmentation policy is basically greenfield

2. Tomorrow’s Must-Win Outcomes

By the time we stop, these should be true:

• Management is materially cleaned up
• Cameras lane exists and is not polluted by junk placement mistakes
• Servers lane exists and core hosts are moved or deliberately staged with validation
• IoT lane exists and easy-value devices are moved
• Legacy CIA is explicitly a quarantine/sunset lane
• no broad panic rules were added to compensate for fatigue

In-scope if conditions support it:

• Google/cast migration work, but only through narrow, reversible tests
• U6 LR only if needed to stabilize client behavior or complete the design cleanly

Nice-to-have only if smooth:

• SSID simplification

3. Absolute Rules

• Keep one stable admin path alive the whole time.
• Rocinante is the live operator station, so do not move it until the rest of the server batch is done or an alternate admin path is proven.
• Change one meaningful thing, then validate.
• Do not bulk-edit live server ports blindly.
• Nomad, Serenity, and PD can be moved as one controlled batch only because their NFS/shared-service coupling is real; pre-stage everything first, then validate the batch immediately.
• Do not try to empty Legacy CIA completely if the window gets noisy.
• Do not move unknown junk into Management, Trusted, or Servers.
• Do not let Google/cast problems bait you into broad allow rules.
• If management reachability degrades, rollback first, think second.

4. Minute-by-Minute Execution Spine

T-30 to T-15: prep

• open this file
• open UniFi admin
• open Doris visual artifacts if helpful
• confirm Rocinante is the live control box
• confirm fallback route into UniFi in case Rocinante loses the lane mid-change
• decide whether U6 LR is in scope or explicitly out of scope

Minute 0-10: baseline capture

• screenshot/export networks
• screenshot/export SSIDs
• screenshot/export firewall/rule state
• screenshot/export port profiles
• screenshot/export switch port assignments
• screenshot/export AP mappings
• snapshot Management client list
• snapshot Old IoT client list

Stop/go gate:

• do not proceed until rollback baseline exists

Minute 10-20: create/normalize objects only

• create/confirm Servers network object
• create/confirm any missing profiles
• create/confirm staged SSIDs if needed
• create/confirm staged firewall objects/rules

Stop/go gate:

• no clients should have moved yet
• Trusted admin path still fine

Minute 20-35: management cleanup first

• identify/address the 2 Management espressif devices
• ensure infra devices remain on Management intent
• remove obvious non-infra junk from Management

Stop/go gate:

• UniFi still sees gateway/switch/APs
• admin client still reaches controller

Minute 35-50: security cleanup

• validate Camera lane
• move Protect chimes if ready
• confirm doorbell remains healthy

Minute 50-85: core server move wave

• leave Rocinante in place as the operator station until the main server batch is done
• keep FlyingDutchman on Trusted unless a later decision explicitly reclassifies it
• pre-stage the exact three-port sequence: Nomad, Serenity, PD
• move Nomad, Serenity, and PD in one controlled wave because of NFS/shared-service coupling
• validate the batch immediately before touching anything else

Minute 85-110: easy IoT wins

• MyQ
• LG dryer
• Samsung FamilyHub
• Main-Floor ecobee
• Upstairs ecobee

Minute 110-125: Legacy CIA quarantine pass

• mark leftovers as quarantine/defer
• do not force migration of unknowns
• apply harsh quarantine posture

Minute 125-140: Google test if the window is still stable

• test one Google/cast device first
• if ugly, stop and defer

Minute 140-155: guest/SSID cleanup

• validate Guest
• disable only stale SSIDs that are truly no longer needed

Minute 155-180: final validation and stop

• Trusted ok
• server services ok
• moved IoT devices ok
• security ok
• Management materially cleaner
• Legacy CIA now explicitly quarantine

5. Management Offender Sheet

These two devices are currently on Management and need identification or removal from that lane:

1. espressif

• IP: 10.5.0.123
• AP: U7 Pro
• SSID: UniFi Wireless
• Default call: identify first; if it is smart-junk, move/quarantine off Management

2. espressif

• IP: 10.5.0.189
• AP: U7 Pro
• SSID: UniFi Wireless
• Default call: identify first; if it is smart-junk, move/quarantine off Management

Operator note:

• these are almost certainly exactly the sort of device that should not live on your infrastructure lane

6. Exact Core Port Move Sheet

Leave Alone Unless Positively Necessary

• USW Pro HD 24 port 1 -> U7 Pro (Upstairs) -> profile Management
• USW Pro HD 24 port 27 -> likely infra/uplink -> profile Management
• USW-24-PoE port 24 -> link up on Management, inspect before touching

Port Move Order

1. USW Pro HD 24 port 2

• Live host: Rocinante
• Current profile visibility from API: ambiguous
• Action: inspect in UI first, then move to Servers if confirmed
• Validate:
  • correct subnet/gateway
  • reachable from Trusted
  • intended services still work

2. USW Pro HD 24 port 3

• Live host: FlyingDutchman
• Current profile: Trusted
• Action: keep on Trusted tomorrow unless a later decision explicitly reclassifies it; this is John and Manndra's gaming PC, not a homelab service host by default
• Validate:
  • host still reachable
  • services behave as expected
• Safe default: leave it in Trusted

3. USW Pro HD 24 port 22

• Live host: Nomad
• Current profile: Trusted
• Action: move as part of the controlled three-host server batch
• Validate:
  • expected address
  • services reachable from Trusted

4. USW Pro HD 24 port 24

• Live host: Serenity
• Current profile: Trusted
• Action: move as part of the controlled three-host server batch
• Validate:
  • expected address
  • intended services reachable

5. USW Pro HD 24 port 23

• Live host: PlausibleDeniability
• Current profile: Trusted
• Action: move as part of the controlled three-host server batch after Nomad and Serenity are ready
• Validate:
  • expected address
  • SSH/admin path still works
  • critical homelab services still work
• Warning:
  • because Nomad, Serenity, and PD are coupled by active shares/services, treat them as one planned wave rather than three unrelated experiments
  • Rocinante should stay as the control box until that wave is complete

7. Old IoT Device Disposition Sheet

Migrate Now

1. MyQ-29B -> 192.168.1.130 -> target IoT
2. LG_Smart_Dryer2_open -> 192.168.1.186 -> target IoT
3. Samsung-FamilyHub -> 192.168.1.149 -> target IoT
4. Main-Floor ecobee -> 192.168.1.102 -> target IoT
5. Upstairs ecobee -> 192.168.1.131 -> target IoT

Validation for each:

• app still works
• device online
• no broad helper rule was needed

Migrate Later Only If Calm

6. Google-Home-Mini -> 192.168.1.185
7. 3c:8d:20:f3:92:36 -> Google device -> 192.168.1.192
8. 90:ca:fa:b6:7f:6e -> Google device -> 192.168.1.129

Rule:

• Google is in scope tomorrow, but start with one Google-class device only unless everything is smooth
• if it demands broad discovery hacks, stop and defer

Quarantine Tomorrow

9. 5c:61:99:41:73:40 -> unknown Cloud Network device
10. 60:74:f4:54:fd:ec -> Private/randomized
11. 60:74:f4:7b:6a:11 -> Private/randomized
12. c0:f5:35:20:5d:94 -> AMPAK device
13. d4:ad:fc:60:90:6a -> Intellirocks
14. d4:ad:fc:ea:7f:65 -> Intellirocks

Rule:

• these do not earn clean-IoT membership by being merely online
• leave them on Legacy CIA quarantine until identified better

8. Camera/Security Reality Check

Already true:

• front-doorbell is already on Camera at 10.5.20.217

Tomorrow’s security work is therefore mainly:

• move/clean up chimes
• tighten policy
• preserve the doorbell’s healthy state

9. Firewall Build Priorities

Build these first:

• established/related allow
• invalid drop
• management shield
• Trusted admin -> Management allow
• Trusted -> Servers allow
• Guest -> internet only
• IoT -> DNS/NTP/internet + specific helpers only
• Camera -> DNS/NTP/internet/Protect only
• Legacy CIA -> DNS/NTP/internet only + explicit one-offs only
• broad internal denies for Guest/IoT/Camera/Legacy CIA

Do not do tomorrow unless proven necessary:

• broad mDNS/cast trust exceptions
• loose IoT -> Servers any
• loose Legacy CIA -> Trusted any

10. Validation Gates

After each meaningful change, check the smallest thing that proves success.

After management changes

• UniFi admin still reachable
• gateway/switch/AP still visible
• no surprise loss of wireless control

After each server port move

• host gets correct subnet/gateway
• reachable from Trusted
• expected service path works

After the Nomad/Serenity/PD batch

• NFS/shared-service relationships recover cleanly
• PD remains reachable from Rocinante/admin path
• no cross-server dependency is hanging half-broken

After each IoT move

• device rejoins expected SSID/VLAN
• app/control works
• no broad workaround rule added

After security changes

• doorbell/chime online
• expected app/admin behavior works

After quarantine posture changes

• Legacy CIA devices still have minimum acceptable functionality
• they do not have new local trust

11. Fast Rollback Strip

If anything goes sideways:

1. revert the last moved device/port first
2. revert the last SSID/VLAN assignment second
3. revert the last firewall rule/order change third
4. restore management-plane reachability before doing anything clever
5. do not stack fresh changes on top of confusion

Immediate rollback triggers:

• loss of UniFi management-plane access
• AP/switch disappears unexpectedly
• moved server loses reachability and root cause is not obvious quickly
• critical household function breaks and cannot be explained fast
• Google weirdness starts baiting sloppy panic rules

12. Explicit Stop Condition

Stop when:

• Management is materially cleaner
• Cameras lane is sane
• core server moves are done or deliberately deferred with reasons
• easy-value IoT moves are done
• Legacy CIA is explicitly a quarantine/sunset lane
• the next remaining work item smells like “heroics” instead of “mechanical completion”

That is success. Not every leftover wart has to die tomorrow.