From 6ce11ed843b5b07ce73d4dd213178448e1b886ed Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Fri, 4 Sep 2026 05:43:03 +0000 Subject: [PATCH 1/2] docs: describe what the Hicks interface enforces, not what it did (#228) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Hicks tab was narrowed on 2026-09-02 and nothing in the repository recorded it. Read on morpheus 2026-09-04, pfctl -sr and -vsr with the interface tables resolved: ten host- and port-scoped passes into Winterfell sit above a logged Block access to Winterfell, and everything else from 50 to 99 is dropped. The block has taken 22 packets; of the passes above it, only Allow NTP and Allow HTTP to Mjolnir are at zero. network.md said "Internet, 99, 30" in the Reaches column, and its Hicks notes said "only specific hosts on this VLAN may reach Winterfell, and only on management ports". That had the narrowing backwards in both halves: every pass is sourced from the segment, not from named hosts, and the restriction is by destination and port. Both are corrected, and the ten passes are enumerated where the claim used to be. Two further things that read against the ruleset: - The note saying corporate laptops "have no management access" is not enforced by anything. No alias holds 10.0.50.69 or 10.0.50.70 and no rule names them, so they carry exactly the access every other Hicks device has. It is now written as the policy it is rather than as a control. - The Prometheus and Loki ingest ports are no longer reachable from Hicks. security.md said a workstation there could write to the metric and log stores without a credential; Block access to Winterfell drops 9090 and 3100, and what remains in that set is a host already on Winterfell and 10.0.30.110's explicit pass. #182 still owns closing it properly — a control that rests on one un-reviewed rule ordering is not authentication. ImaginationLAN is untouched and is still reached entire, on every protocol and port, because no rule blocks it and the catch-all is reached. That is #228's posture decision and is not made here. Allow Hicks access to ImaginationLAN now sits on the Hicks interface, where it matches at last and grants nothing the catch-all was not already granting. Per ADR-0001, ADR-0013 and ADR-0016 are left as written; both describe the ruleset of 2026-09-01 and both now say so where they are cited. README.md and SECURITY.md restated the same claim and are corrected with them, and roadmap.md's #228 entry drops the line about network.md being wrong, which this change makes untrue. Co-Authored-By: Claude Opus 5 --- README.md | 11 ++++++--- SECURITY.md | 2 +- docs/network.md | 64 ++++++++++++++++++++++++++++++++++++++++++------ docs/roadmap.md | 5 ++-- docs/security.md | 35 ++++++++++++++++++++------ 5 files changed, 96 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index 2dcd70c..028b7b0 100644 --- a/README.md +++ b/README.md @@ -133,10 +133,13 @@ Dotted lines are the paths this diagram draws, and they are not the whole story. Default deny holds for every segment except Hicks and the switch LAN, both of which reach further than any diagram of exceptions suggests — so what a segment can actually reach is recorded per segment in -[`network.md`](docs/network.md)'s *Reaches* column, and the enforced rules as a -list in [ADR-0013](docs/adr/0013-segment-access-as-implemented.md). A count was -the wrong instrument and this README carried the wrong count for months. Segment -colour matches the patch cable in the rack; a dashed border means egress only. +[`network.md`](docs/network.md)'s *Reaches* column, which is the document to +read for the current state. +[ADR-0013](docs/adr/0013-segment-access-as-implemented.md) holds the method and +the reasoning, and describes the ruleset as it stood on 2026-09-01; the Hicks +interface was narrowed the day after. A count was the wrong instrument and this +README carried the wrong count for months. Segment colour matches the patch +cable in the rack; a dashed border means egress only. Full topology and data flow in [`docs/architecture.md`](docs/architecture.md). ## Stack diff --git a/SECURITY.md b/SECURITY.md index a199d36..4ac0314 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -45,7 +45,7 @@ is a very different thing from an overlooked one. Full detail in | Alertmanager webhook URL and the MokerLink SNMP community, in a local Claude Code session transcript | Found 2026-08-20 by a value-level sweep of the host. Redacted in place; mode 600, never committed or synced. The webhook topic was rotated — on the public ntfy instance the topic name *is* the credential, there is nothing to revoke — and delivery re-verified end to end. The switch community deliberately was not: rotating it means the `neo` residual above all over again. | | Pre-purge objects still served by GitHub after the history rewrite | The 2026-08-19 rewrite (`021d2b6`) removed both secrets above from every *reachable* commit, but GitHub still serves the orphaned objects by SHA. Verified 2026-08-26: `647d90a`, `21afcad`, `efb2632` and `ee3d443` all still resolve through the API, and the tree at `21afcad` still lists `certificates/Gandalf.Gondor.Lab/ca-key.pem` and `cert-key.pem`. Garbage collection requested from GitHub Support on 2026-08-26 — **pending**; this is the [purge runbook](docs/runbooks/purge-git-history.md)'s *Afterwards* step, and it is the last one outstanding. The repository has no forks and a network count of 0, so nothing else is perpetuating them. Both credentials were rotated *before* the rewrite, so this changes nothing about their status: the old keys and the old community remain superseded and must still be treated as public. Re-check with `gh api repos/Gerrrt/HomeLab/commits/647d90a --jq .sha` — a `404` means GitHub has collected them. | | Alertmanager published on `0.0.0.0`, letting anyone who could reach it silence an alert | Fixed 2026-08-30 — 9093 now binds to `127.0.0.1` ([#70](https://github.com/Gerrrt/HomeLab/issues/70), [ADR-0012](docs/adr/0012-publish-only-ports-with-an-off-host-consumer.md)). This was the sharpest of the three because a silence switches off monitoring and the record of it lives in the system being switched off. Nothing off-host ever used the port: silences are reached through Grafana, which proxies Alertmanager over the compose network behind a login, so closing it cost no capability. | -| Prometheus and Loki published on `0.0.0.0` with no authentication | **Accepted residual, not a fix in progress.** Anything that can route to `10.0.99.20` can read every metric and log line, inject metrics through Prometheus' remote-write receiver, and delete log ranges through Loki's delete API. Both stay published because `oracle`'s Alloy agent remote-writes to 9090 and pushes to 3100 — it is not a scrape target, so those ports are its only path. Firewall default-deny is the whole control: only Hicks (50) and Winterfell (99) can reach the host at all, and never an untrusted segment. Closing it properly means authentication in front of the ingest ports and a credential on every agent, which is a separate piece of work — see below. | +| Prometheus and Loki published on `0.0.0.0` with no authentication | **Accepted residual, not a fix in progress.** Anything that can route to `10.0.99.20:9090` or `:3100` can read every metric and log line, inject metrics through Prometheus' remote-write receiver, and delete log ranges through Loki's delete API. Both stay published because `oracle`'s Alloy agent remote-writes to 9090 and pushes to 3100 — it is not a scrape target, so those ports are its only path. Firewall default-deny is the whole control, and since 2026-09-02 it is narrower than it was: the ingest ports are reachable from Winterfell (99) itself and from `10.0.30.110` on ImaginationLAN, which has an explicit pass for `Saruman`'s Alloy agent. Hicks (50) reaches `10.0.99.20` on `3000` only — a logged *Block access to Winterfell* drops the rest — and no untrusted segment reaches it at all. `docs/network.md` lists what Hicks may reach. Closing it properly means authentication in front of the ingest ports and a credential on every agent, which is a separate piece of work — see below. | | The monitoring host's disk and swap are unencrypted | **Accepted residual, not a fix in progress** — see below. | The switch is the honest gap, and it is a deliberate one. `neo` (10.7.7.2) is diff --git a/docs/network.md b/docs/network.md index 885b4ad..3ab9125 100644 --- a/docs/network.md +++ b/docs/network.md @@ -22,7 +22,7 @@ above CasaBonita, which the spectrum does not. Reasoning in | WAN | — | — | ISP-assigned | Uplink | — | | LAN | — | — | `10.7.7.0/24` | Switch management only | Everything[^lan] | | [Winterfell](#winterfell--vlan-99--management) | 99 | 🔴 Red | `10.0.99.0/24` | Infrastructure management | Internet | -| [Hicks](#hicks--vlan-50--trusted) | 50 | 🟠 Orange | `10.0.50.0/24` | Trusted workstations | Internet, 99, 30 | +| [Hicks](#hicks--vlan-50--trusted) | 50 | 🟠 Orange | `10.0.50.0/24` | Trusted workstations | Internet, 30, named ports on 99[^hicks] | | [CasaBonita](#casabonita--vlan-40--media) | 40 | 🟡 Yellow | `10.0.40.0/24` | TVs and consoles | Internet | | [ImaginationLAN](#imaginationlan--vlan-30--lab) | 30 | 🟢 Green | `10.0.30.0/24` | Hypervisor / lab | Internet | | [Skids](#skids--vlan-20--iot) | 20 | 🔵 Blue | `10.0.20.0/24` | IoT and cameras | Internet | @@ -33,6 +33,18 @@ above CasaBonita, which the spectrum does not. Reasoning in one device and said "Nothing" here until [ADR-0013](adr/0013-segment-access-as-implemented.md) read the ruleset. +[^hicks]: Hicks is the only segment with a path into management, and since + 2026-09-02 that path is a list of destinations rather than the segment: ten + passes sit above a logged *Block access to Winterfell* and everything else + from 50 to 99 is dropped. They are enumerated in the Hicks notes below. + ImaginationLAN is not blocked, so the catch-all under those rules still + grants that segment entire — + [#228](https://github.com/Gerrrt/HomeLab/issues/228) owns that half. + [ADR-0013](adr/0013-segment-access-as-implemented.md) read the ruleset on + 2026-09-01, the day before the narrowing landed, and describes the wider + state; it is left as written, per + [ADR-0001](adr/0001-record-architecture-decisions.md). + Hostnames are thematic rather than functional — `morpheus` is the firewall, `mjolnir` the UPS, `Saruman` the hypervisor. The Role column is the source of truth for what a box actually does. @@ -94,7 +106,8 @@ truth for what a box actually does. 🔴 **Red** on the rack. Infrastructure. The only segment that can administer other segments, and the -only one Hicks is permitted to reach for management. +only one Hicks is permitted to reach for management — on the named ports +listed under [Hicks](#hicks--vlan-50--trusted), and nothing else. | Hostname | IP | MAC (OUI) | Device | OS | Location | Role | | --- | --- | --- | --- | --- | --- | --- | @@ -111,7 +124,9 @@ only one Hicks is permitted to reach for management. built from. - Port 3 of the main switch feeds an 8-port unmanaged switch[^tp-linkswitch] that `prometheus` and `oracle` hang off. -- pfSense's admin UI is reachable on this interface from Hicks only. +- pfSense's admin UI is reachable on this interface from Hicks only, by a + named pass to `10.0.99.1:443`. Winterfell itself is blocked from it: the 99 + interface drops HTTP and HTTPS to `10.0.99.1` above its egress rule. - DHCP enabled, with static reservations for everything listed. - `oracle` runs the Lemmiwinks wiki and its Postgres — it has since 2025-11-12, and [ADR-0011](adr/0011-keep-the-wiki-internal.md) depends on it — and holds @@ -154,10 +169,45 @@ Personal and work machines. The only segment with a path into management. ### Notes - Desktops are wired Cat6; one eero is wired as backhaul, the other two mesh. -- Corporate laptops live here but have no management access. They are treated as - untrusted endpoints that happen to sit on a trusted segment. -- Only specific hosts on this VLAN may reach Winterfell, and only on management - ports. +- **What this segment reaches on Winterfell is a list of destinations, not the + segment.** Ten passes sit above a logged *Block access to Winterfell*, and + everything else from 50 to 99 is dropped: + + | Destination | Ports | + | --- | --- | + | `10.0.99.0/24` — the segment | `22/tcp`, ICMP echo | + | `10.0.99.1` — `morpheus` | `443/tcp` admin UI, `53/tcp+udp` resolver, `123/udp` NTP | + | `10.0.99.10` — `mjolnir` | `80,443/tcp` UPS card | + | `10.0.99.20` — `prometheus` | `3000/tcp` Grafana | + | `10.0.99.30` — `oracle` | `80,443/tcp` the wiki | + + **The source is the segment, not named hosts.** Every one of those passes is + `vlan50 → …`, so any device on Hicks may use any of them. This note used to + say the opposite — "only specific hosts, and only on management ports" — and + had the narrowing backwards in both halves: it is by destination and port, and + never by host. +- **Corporate laptops are subject to exactly the same rules as everything else + here.** They are intended to be treated as untrusted endpoints that happen to + sit on a trusted segment, and nothing on the firewall enforces that: no alias + holds `10.0.50.69` or `10.0.50.70`, and no rule names them. It is a policy + about how they are used, and it is written here as one rather than as a + control. +- **Prometheus' and Loki's ingest ports are not on the list above.** `9090` and + `3100` are published without authentication + ([#182](https://github.com/Gerrrt/HomeLab/issues/182)) and were reachable from + this segment for as long as the catch-all was the only rule between them; + *Block access to Winterfell* now drops them. Narrower, not gone: + `10.0.30.110` still has an explicit pass to both ports for `Saruman`'s Alloy + agent, and nothing stops a host already on Winterfell. +- **ImaginationLAN is still reached entire**, on every protocol and port, + because no rule blocks it and the catch-all below is reached. + [#228](https://github.com/Gerrrt/HomeLab/issues/228) is where that gets + decided. *Allow Hicks access to ImaginationLAN* now sits on **this** interface + — ADR-0013 found it on the ImaginationLAN interface, where a rule can never + match traffic that enters on Hicks — and grants nothing the catch-all was not + already granting. +- The switch LAN is blocked apart from `10.7.7.2:80`, the switch's own web UI; + the block below that pass is logged. [^Desktop1]: [Build 1](https://pcpartpicker.com/b/KXv323) [^Desktop2]: [Build 2](https://pcpartpicker.com/list/XgZpfd) diff --git a/docs/roadmap.md b/docs/roadmap.md index d8d7a4f..7c00f06 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -30,8 +30,9 @@ issues intact. Nothing was summarised away. date. It is enforcing rather than decorative: the Winterfell block has dropped 22 packets, and the passes above it carry the real traffic — 834,283 through *Allow SSH to Winterfell* alone — with only *Allow NTP* and *Allow HTTP to - Mjolnir* still at zero. `network.md`'s segment table still says Hicks reaches - "Internet, 99, 30", and that row is now wrong in the direction of too wide. + Mjolnir* still at zero. `network.md` and both security documents described the + wider state until they were corrected against this read; the description is no + longer the outstanding part, the posture is. **ImaginationLAN is the half still open.** No rule blocks it, so the catch-all grants the segment entire, on every protocol and port. *Allow Hicks access to diff --git a/docs/security.md b/docs/security.md index af68bc2..edfd6c7 100644 --- a/docs/security.md +++ b/docs/security.md @@ -71,9 +71,20 @@ segment explicitly before its egress rule, and the narrow exceptions that exist **It does not hold for Hicks (50), and it does not hold for the switch LAN.** Hicks blocks CasaBonita, Skids and Degens and then passes to `any`, so it reaches -all of Winterfell and all of ImaginationLAN on every protocol and port — not the -management path this section used to describe. The switch LAN carries pfSense's -stock *Default allow LAN to any* rule and reaches every segment. +**all of ImaginationLAN** on every protocol and port, which no rule grants and no +rule denies. [#228](https://github.com/Gerrrt/HomeLab/issues/228) is where that +gets decided. The switch LAN carries pfSense's stock *Default allow LAN to any* +rule and reaches every segment. + +**Winterfell is the half that has since been narrowed.** On 2026-09-02 the Hicks +interface gained ten host- and port-scoped passes into 99 and a logged *Block +access to Winterfell* under them, so Hicks now reaches management on an +enumerated list — SSH and ping to the segment, the firewall's admin UI, resolver +and NTP, the wiki, Grafana, and the UPS card — and nothing else. +[`network.md`](network.md#hicks--vlan-50--trusted) holds the list and is the +document to read for it. ADR-0013 read the ruleset the day before that landed +and describes the wider state; it is left as written, per ADR-0001, and this +section is where the current posture lives. This section previously said "three exceptions", ADR-0002 said two, and ADR-0008 said five. All three were counts, and a count cannot express "reachable because @@ -97,14 +108,24 @@ them silently; the restore runbook checks for them. A fourth, on ImaginationLAN, is decided by ADR-0014 and lands with `ifrit` ([#234](https://github.com/Gerrrt/HomeLab/issues/234)). -Segmentation is doing more work here than it should have to. A workstation on -Hicks that can reach `10.0.99.20` can write to the metric and log stores without -a credential, because Prometheus and Loki publish unauthenticated ingest ports -for `oracle`'s agent to use — which is exactly the failure ADR-0002 predicted +Segmentation is doing more work here than it should have to. Prometheus and Loki +publish unauthenticated ingest ports for `oracle`'s agent to use, so anything +that can route to `10.0.99.20:9090` or `:3100` can write to the metric and log +stores without a credential — which is exactly the failure ADR-0002 predicted when it recorded that "a compromised workstation reaches Winterfell". That is an accepted residual, recorded in [`SECURITY.md`](../SECURITY.md), not a solved problem. +**What has changed is who "anything" is.** A workstation on Hicks was in that +set for as long as the catch-all was the only rule in the way; since 2026-09-02 +it reaches `10.0.99.20` on `3000` only and *Block access to Winterfell* drops +the ingest ports. What remains in the set is a host already on Winterfell, and +`10.0.30.110` on ImaginationLAN, which has an explicit pass to both ports for +`Saruman`'s Alloy agent. The residual narrowed by a firewall change nobody +recorded; [#182](https://github.com/Gerrrt/HomeLab/issues/182) still owns +closing it properly, because a control that depends on one un-reviewed rule +ordering is not authentication. + What has been taken off the firewall's shoulders is Alertmanager. It had no off-host client, so it now binds to `127.0.0.1` and reaching VLAN 99 no longer lets anyone silence an alert; see From dca8dda6b0b486689949b09e1f28dc6f6dea156d Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Fri, 4 Sep 2026 13:32:45 +0000 Subject: [PATCH 2/2] docs: stop claiming Hicks is the only path into management (#228) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review of #272 caught a contradiction: the new footnote said Hicks is "the only segment with a path into management" while the segment table two rows above says the switch LAN reaches Everything. Reading for it found a second exception the footnote also missed — ImaginationLAN carries two host-scoped passes to 10.0.99.20, for Saruman's Alloy agent and the iLO's return path. The pre-existing sentence at the head of the Hicks section made the same "only" claim and is corrected with it. Also from the review: security.md said Hicks reaching all of ImaginationLAN is something "no rule grants and no rule denies". The catch-all is itself a grant, and since 2026-09-02 there is also a rule that names the segment. Say what is true — nothing denies it, and what grants it is the catch-all rather than a decision about that segment. And write both ingest ports as full host:port pairs in the two places that abbreviated the second to ":3100". Co-Authored-By: Claude Opus 5 --- SECURITY.md | 2 +- docs/network.md | 16 ++++++++++------ docs/security.md | 18 ++++++++++-------- 3 files changed, 21 insertions(+), 15 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 4ac0314..cdd0530 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -45,7 +45,7 @@ is a very different thing from an overlooked one. Full detail in | Alertmanager webhook URL and the MokerLink SNMP community, in a local Claude Code session transcript | Found 2026-08-20 by a value-level sweep of the host. Redacted in place; mode 600, never committed or synced. The webhook topic was rotated — on the public ntfy instance the topic name *is* the credential, there is nothing to revoke — and delivery re-verified end to end. The switch community deliberately was not: rotating it means the `neo` residual above all over again. | | Pre-purge objects still served by GitHub after the history rewrite | The 2026-08-19 rewrite (`021d2b6`) removed both secrets above from every *reachable* commit, but GitHub still serves the orphaned objects by SHA. Verified 2026-08-26: `647d90a`, `21afcad`, `efb2632` and `ee3d443` all still resolve through the API, and the tree at `21afcad` still lists `certificates/Gandalf.Gondor.Lab/ca-key.pem` and `cert-key.pem`. Garbage collection requested from GitHub Support on 2026-08-26 — **pending**; this is the [purge runbook](docs/runbooks/purge-git-history.md)'s *Afterwards* step, and it is the last one outstanding. The repository has no forks and a network count of 0, so nothing else is perpetuating them. Both credentials were rotated *before* the rewrite, so this changes nothing about their status: the old keys and the old community remain superseded and must still be treated as public. Re-check with `gh api repos/Gerrrt/HomeLab/commits/647d90a --jq .sha` — a `404` means GitHub has collected them. | | Alertmanager published on `0.0.0.0`, letting anyone who could reach it silence an alert | Fixed 2026-08-30 — 9093 now binds to `127.0.0.1` ([#70](https://github.com/Gerrrt/HomeLab/issues/70), [ADR-0012](docs/adr/0012-publish-only-ports-with-an-off-host-consumer.md)). This was the sharpest of the three because a silence switches off monitoring and the record of it lives in the system being switched off. Nothing off-host ever used the port: silences are reached through Grafana, which proxies Alertmanager over the compose network behind a login, so closing it cost no capability. | -| Prometheus and Loki published on `0.0.0.0` with no authentication | **Accepted residual, not a fix in progress.** Anything that can route to `10.0.99.20:9090` or `:3100` can read every metric and log line, inject metrics through Prometheus' remote-write receiver, and delete log ranges through Loki's delete API. Both stay published because `oracle`'s Alloy agent remote-writes to 9090 and pushes to 3100 — it is not a scrape target, so those ports are its only path. Firewall default-deny is the whole control, and since 2026-09-02 it is narrower than it was: the ingest ports are reachable from Winterfell (99) itself and from `10.0.30.110` on ImaginationLAN, which has an explicit pass for `Saruman`'s Alloy agent. Hicks (50) reaches `10.0.99.20` on `3000` only — a logged *Block access to Winterfell* drops the rest — and no untrusted segment reaches it at all. `docs/network.md` lists what Hicks may reach. Closing it properly means authentication in front of the ingest ports and a credential on every agent, which is a separate piece of work — see below. | +| Prometheus and Loki published on `0.0.0.0` with no authentication | **Accepted residual, not a fix in progress.** Anything that can route to `10.0.99.20:9090` or `10.0.99.20:3100` can read every metric and log line, inject metrics through Prometheus' remote-write receiver, and delete log ranges through Loki's delete API. Both stay published because `oracle`'s Alloy agent remote-writes to 9090 and pushes to 3100 — it is not a scrape target, so those ports are its only path. Firewall default-deny is the whole control, and since 2026-09-02 it is narrower than it was: the ingest ports are reachable from Winterfell (99) itself and from `10.0.30.110` on ImaginationLAN, which has an explicit pass for `Saruman`'s Alloy agent. Hicks (50) reaches `10.0.99.20` on `3000` only — a logged *Block access to Winterfell* drops the rest — and no untrusted segment reaches it at all. `docs/network.md` lists what Hicks may reach. Closing it properly means authentication in front of the ingest ports and a credential on every agent, which is a separate piece of work — see below. | | The monitoring host's disk and swap are unencrypted | **Accepted residual, not a fix in progress** — see below. | The switch is the honest gap, and it is a deliberate one. `neo` (10.7.7.2) is diff --git a/docs/network.md b/docs/network.md index 3ab9125..cf18be9 100644 --- a/docs/network.md +++ b/docs/network.md @@ -33,12 +33,14 @@ above CasaBonita, which the spectrum does not. Reasoning in one device and said "Nothing" here until [ADR-0013](adr/0013-segment-access-as-implemented.md) read the ruleset. -[^hicks]: Hicks is the only segment with a path into management, and since +[^hicks]: Hicks has the broadest path into management of any VLAN, and since 2026-09-02 that path is a list of destinations rather than the segment: ten - passes sit above a logged *Block access to Winterfell* and everything else - from 50 to 99 is dropped. They are enumerated in the Hicks notes below. - ImaginationLAN is not blocked, so the catch-all under those rules still - grants that segment entire — + passes sit above a logged *Block access to Winterfell*, everything else from + 50 to 99 is dropped, and the ten are enumerated in the Hicks notes below. It + is not the only way into 99 — the switch LAN reaches every segment, and two + host-scoped passes carry ImaginationLAN to `10.0.99.20`. Going the other + way, nothing blocks Hicks from ImaginationLAN, so the catch-all under those + rules still grants that segment entire — [#228](https://github.com/Gerrrt/HomeLab/issues/228) owns that half. [ADR-0013](adr/0013-segment-access-as-implemented.md) read the ruleset on 2026-09-01, the day before the narrowing landed, and describes the wider @@ -148,7 +150,9 @@ listed under [Hicks](#hicks--vlan-50--trusted), and nothing else. 🟠 **Orange** on the rack. -Personal and work machines. The only segment with a path into management. +Personal and work machines. The VLAN with the broadest path into management, +though not the only one — the switch LAN reaches every segment, and +ImaginationLAN has two host-scoped passes to `10.0.99.20`. | Hostname | IP | MAC (OUI) | Device | OS | Zone | Role | | --- | --- | --- | --- | --- | --- | --- | diff --git a/docs/security.md b/docs/security.md index edfd6c7..863459d 100644 --- a/docs/security.md +++ b/docs/security.md @@ -71,9 +71,11 @@ segment explicitly before its egress rule, and the narrow exceptions that exist **It does not hold for Hicks (50), and it does not hold for the switch LAN.** Hicks blocks CasaBonita, Skids and Degens and then passes to `any`, so it reaches -**all of ImaginationLAN** on every protocol and port, which no rule grants and no -rule denies. [#228](https://github.com/Gerrrt/HomeLab/issues/228) is where that -gets decided. The switch LAN carries pfSense's stock *Default allow LAN to any* +**all of ImaginationLAN** on every protocol and port. Nothing denies it, and what +grants it is the catch-all rather than a decision about that segment — the one +rule that names ImaginationLAN grants nothing the catch-all was not already +granting. [#228](https://github.com/Gerrrt/HomeLab/issues/228) is where that gets +decided. The switch LAN carries pfSense's stock *Default allow LAN to any* rule and reaches every segment. **Winterfell is the half that has since been narrowed.** On 2026-09-02 the Hicks @@ -110,11 +112,11 @@ is decided by ADR-0014 and lands with `ifrit` Segmentation is doing more work here than it should have to. Prometheus and Loki publish unauthenticated ingest ports for `oracle`'s agent to use, so anything -that can route to `10.0.99.20:9090` or `:3100` can write to the metric and log -stores without a credential — which is exactly the failure ADR-0002 predicted -when it recorded that "a compromised workstation reaches Winterfell". That is an -accepted residual, recorded in [`SECURITY.md`](../SECURITY.md), not a solved -problem. +that can route to `10.0.99.20:9090` or `10.0.99.20:3100` can write to the metric +and log stores without a credential — which is exactly the failure ADR-0002 +predicted when it recorded that "a compromised workstation reaches Winterfell". +That is an accepted residual, recorded in [`SECURITY.md`](../SECURITY.md), not a +solved problem. **What has changed is who "anything" is.** A workstation on Hicks was in that set for as long as the catch-all was the only rule in the way; since 2026-09-02