The estate has no remote access at all. Every path in is a workstation
physically on Hicks. That is a defensible posture, and it is also why nothing in
docs/ describes an alternative — worth fixing deliberately rather than
improvising one under time pressure.
The design
The jumpbox from #436 becomes a
WireGuard peer and a subnet router, so a device on the house network reaches
lab hosts directly rather than remote-desktopping in and hopping onward.
Two properties of WireGuard are worth stating, because they are easy to get
backwards and getting them backwards is a segmentation failure:
AllowedIPs is asymmetric. On a client it acts as a route — which
CIDRs go down the tunnel. On a server it acts as an access control list —
which source addresses that peer may present, hence /32.- Forwarding and NAT belong in
PostUp/PostDown, not in
/etc/sysctl.conf. That way the jumpbox forwards only while the tunnel is
up, and the capability disappears with it. That is a genuinely good property
and this estate should want it.
The constraint that decides the scope
ADR-0022
names "any reachability from outside the house, including a VPN terminating on
99" as one of three triggers that end the SSO deferral.
So this terminates on VLAN 30 and reaches the lab only. That is a
convenience for lab work and trips nothing.
Terminating on Winterfell, or routing to the sensitive tier, is a trigger —
and the honest move is to record that as a decision rather than discover it
afterwards, which is the precise failure ADR-0022 exists to remove.
Verification
With the tunnel up, reach the lab. With it down, reach nothing — and confirm on
the jumpbox that no masquerade rule exists while it is down.
An AllowedIPs that is quietly wider than the lab is the thing to catch here,
and it will not announce itself.
Purchases this needs
None.
Corrected 2026-09-19
#495 delivered the decision and the procedure, not the tunnel: ADR-0042 and docs/runbooks/open-the-remote-path.md. Nothing is built. The design section above is superseded by those two documents and should be read there, not here — two copies is how they drift. The jumpbox has a name and an address now: phoenix, 10.0.30.70, built under #436, and architecture.md marks it Not built yet.
A blocker the body did not know about. ADR-0042 §5: this estate has no reachable UDP endpoint — the WAN address is ISP-assigned by DHCP and there is no dynamic DNS. open-the-remote-path.md §0 says not to start §1 until that is answered. It is now #530, and it precedes this issue. Which also means "Purchases this needs: None" is wrong — one of the two answers is a static address from the ISP, a recurring cost.
Waits on: #436 (phoenix), #530 (the endpoint).
The estate has no remote access at all. Every path in is a workstation
physically on Hicks. That is a defensible posture, and it is also why nothing in
docs/describes an alternative — worth fixing deliberately rather thanimprovising one under time pressure.
The design
The jumpbox from #436 becomes a
WireGuard peer and a subnet router, so a device on the house network reaches
lab hosts directly rather than remote-desktopping in and hopping onward.
Two properties of WireGuard are worth stating, because they are easy to get
backwards and getting them backwards is a segmentation failure:
AllowedIPsis asymmetric. On a client it acts as a route — whichCIDRs go down the tunnel. On a server it acts as an access control list —
which source addresses that peer may present, hence
/32.PostUp/PostDown, not in/etc/sysctl.conf. That way the jumpbox forwards only while the tunnel isup, and the capability disappears with it. That is a genuinely good property
and this estate should want it.
The constraint that decides the scope
ADR-0022
names "any reachability from outside the house, including a VPN terminating on
99" as one of three triggers that end the SSO deferral.
So this terminates on VLAN 30 and reaches the lab only. That is a
convenience for lab work and trips nothing.
Terminating on Winterfell, or routing to the sensitive tier, is a trigger —
and the honest move is to record that as a decision rather than discover it
afterwards, which is the precise failure ADR-0022 exists to remove.
Verification
With the tunnel up, reach the lab. With it down, reach nothing — and confirm on
the jumpbox that no masquerade rule exists while it is down.
An
AllowedIPsthat is quietly wider than the lab is the thing to catch here,and it will not announce itself.
Purchases this needs
None.
Corrected 2026-09-19
#495 delivered the decision and the procedure, not the tunnel: ADR-0042 and
docs/runbooks/open-the-remote-path.md. Nothing is built. The design section above is superseded by those two documents and should be read there, not here — two copies is how they drift. The jumpbox has a name and an address now:phoenix,10.0.30.70, built under #436, andarchitecture.mdmarks it Not built yet.A blocker the body did not know about. ADR-0042 §5: this estate has no reachable UDP endpoint — the WAN address is ISP-assigned by DHCP and there is no dynamic DNS.
open-the-remote-path.md§0 says not to start §1 until that is answered. It is now #530, and it precedes this issue. Which also means "Purchases this needs: None" is wrong — one of the two answers is a static address from the ISP, a recurring cost.Waits on: #436 (phoenix), #530 (the endpoint).