diff --git a/docs/roadmap.md b/docs/roadmap.md index 6de3c814..04ee6f92 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -872,22 +872,43 @@ what left this one unfireable for months. [#257](https://github.com/Gerrrt/HomeLab/issues/257): ADR-0020 decides only that no Alertmanager goes *inside* the stack, and the lab is otherwise being built to go quiet. -- **[#96](https://github.com/Gerrrt/HomeLab/issues/96) Procure `ifrit` and build - the playground** — only after the main network is finished. The isolation - mechanism ADR-0007 deferred is settled by ADR-0014: `ifrit` is single-homed on - ImaginationLAN, the targets sit on a bridge with no physical port on a subnet - the firewall does not route, the attack VM does not forward, and the - hypervisor management planes close at the host. ADR-0017 settles the rest — - buy for IOPS and quiet rather than for threads, because the range's whole - operation is snapshot-and-revert and `Saruman`'s complaint is already - spindles; socketed RAM, because `prometheus`'s is soldered; `172.30.30.0/24` - on the isolated bridge with no gateway anywhere on it; and no backups, no - monitoring and no patching for the guests, so the least important part of the - lab joins none of the estate's loops. "After the main network is finished" - now names issues: #101 first, because an attack VM pointed at an - uninstrumented estate teaches nothing; #234 before the segment holds - attackers; #235 decided — the iLO stays, ADR-0033 — before this build makes - it true. What is left is the purchase itself and the build. +- **[#421](https://github.com/Gerrrt/HomeLab/issues/421) Buy `ifrit` and build + the range** — only after the main network is finished. This entry was keyed to + [#96](https://github.com/Gerrrt/HomeLab/issues/96) until 2026-09-17, and #96 + closed on the decision and the runbook on 2026-09-04: the purchase it ended + by naming had no tracker at all for five days, and this file + went on pointing at the closed issue for another eight after #421 was opened — + the same shape as #102 → #404 and #95 → #413. The isolation mechanism ADR-0007 + deferred is settled by ADR-0014: `ifrit` is single-homed on ImaginationLAN, + the targets sit on a bridge with no physical port on a subnet the firewall + does not route, the attack VM does not forward, and the hypervisor management + planes close at the host. ADR-0017 settles the rest — buy for IOPS and quiet + rather than for threads, because the range's whole operation is + snapshot-and-revert and `Saruman`'s complaint is already spindles; socketed + RAM, because `prometheus`'s is soldered; `172.30.30.0/24` on the isolated + bridge with no gateway anywhere on it; and no backups, no monitoring and no + patching for the guests, so the least important part of the lab joins none of + the estate's loops. "After the main network is finished" named three issues + when that sentence was written, and **two of them have closed since**: + [#234](https://github.com/Gerrrt/HomeLab/issues/234)'s tripwire was armed and + verified on 2026-09-08, and + [#235](https://github.com/Gerrrt/HomeLab/issues/235) was decided the same day + — the iLO stays, [ADR-0033](adr/0033-keep-the-ilo-on-the-lab-segment.md) — + with the hardening that decision owed done on 2026-09-09. Both are recorded in + full under *Done* below, which is why this paragraph does not restate them. + What is left of the gate is + [#101](https://github.com/Gerrrt/HomeLab/issues/101), and it is an umbrella + rather than a thing anyone builds: what it means here is the domain + ([#414](https://github.com/Gerrrt/HomeLab/issues/414)) and the SOC stack + ([#266](https://github.com/Gerrrt/HomeLab/issues/266) Wazuh and + [#267](https://github.com/Gerrrt/HomeLab/issues/267) Velociraptor), because an + attack VM pointed at an uninstrumented estate teaches nothing. This paragraph + ended "what is left is the purchase itself and the build" until 2026-09-17, + which read as though the money were the next thing to spend. **The purchase is + gated on #414 being built, and it is the last purchase on the estate's list, + not the next** — which is what *Everything still to buy* at the top of this + file has said since #421 was opened, and what this entry now agrees with + rather than contradicts. → [runbook](runbooks/build-the-playground.md) - **[#418](https://github.com/Gerrrt/HomeLab/issues/418) Fit the two SSDs in `Saruman`.** Two Samsung SM863a 960 GB SATA enterprise drives, bought diff --git a/docs/runbooks/build-the-lab-guest.md b/docs/runbooks/build-the-lab-guest.md index f9b5536e..db274468 100644 --- a/docs/runbooks/build-the-lab-guest.md +++ b/docs/runbooks/build-the-lab-guest.md @@ -37,7 +37,7 @@ is already built and validated; what is missing is somewhere to run it. | | Decision | Why this and not the obvious alternative | | --- | --- | --- | | Name | `alexander` | A Final Fantasy summon, like `shiva` and `ifrit` already on this segment. A fortress, which is what the defended estate's own observer is | -| Address | `10.0.30.40/24` | Statics on this segment live **below `.100`**; the pool is `.100–.200`. Continues the decade spacing — `shiva` .10, `Saruman` .20 (after #96), `ifrit` .30 | +| Address | `10.0.30.40/24` | Statics on this segment live **below `.100`**; the pool is `.100–.200`. Continues the decade spacing — `shiva` .10, `Saruman` .20 (after #421), `ifrit` .30 | | Kind | **VM, not LXC** | `stacks/lab` uses `cgroup: host`, `cap_drop: [ALL]` and a Docker socket mount. Docker in an LXC needs nesting and keyctl workarounds, and those settings behave differently under one. A VM has no such asterisks | | OS | **Ubuntu Server LTS** — `alexander` runs 26.04 | See below. This is the one that would have bitten quietly | | Disk | 64 GB | Prometheus is capped at 4 GB and Loki keeps 15 days of a small estate. 64 GB leaves room without pretending the spindles are free | diff --git a/docs/runbooks/build-the-playground.md b/docs/runbooks/build-the-playground.md index 8d9f27ad..06029675 100644 --- a/docs/runbooks/build-the-playground.md +++ b/docs/runbooks/build-the-playground.md @@ -29,13 +29,23 @@ than assumed"; §8 is that check, and it is the reason this file exists. ## 0. Before you start -Three things belong ahead of this work, per ADR-0017: +ADR-0017 put three things ahead of this work, and **two of them are done**. +This table read as three open to-dos until 2026-09-17, by which point two of +its rows had been closed for over a week. The tracker for the buy and the build +is [#421](https://github.com/Gerrrt/HomeLab/issues/421); #96 closed on the +decision and on this runbook. -| | Why it is first | -| --- | --- | -| [#101](https://github.com/Gerrrt/HomeLab/issues/101) — `stacks/lab/` on `Saruman` | An attack VM pointed at an estate with no Wazuh, no Velociraptor and no domain teaches nothing. This is the half that carries the value | -| [#234](https://github.com/Gerrrt/HomeLab/issues/234) — the ImaginationLAN tripwire | The only thing watching the boundary this build creates. It is a no-op until the segment holds attackers, which is what §5 makes it | -| [#235](https://github.com/Gerrrt/HomeLab/issues/235) — whether `shiva` stays on VLAN 30 | Decided: it stays ([ADR-0033](../adr/0033-keep-the-ilo-on-the-lab-segment.md)). Before §5 puts a Kali VM in its broadcast domain, do the iLO hardening that ADR lists — IPMI-over-LAN and unused services off | +| | State | Why it is ahead of §1 | +| --- | --- | --- | +| [#101](https://github.com/Gerrrt/HomeLab/issues/101) — the defended estate on `Saruman` | **The one that still gates this build.** The umbrella is not a thing anyone builds: what this waits on is the lab domain ([#414](https://github.com/Gerrrt/HomeLab/issues/414)) and the SOC stack — [#266](https://github.com/Gerrrt/HomeLab/issues/266) Wazuh and [#267](https://github.com/Gerrrt/HomeLab/issues/267) Velociraptor, in `stacks/soc/` on `odin` per [ADR-0030](../adr/0030-give-the-security-tooling-its-own-guest-and-its-own-stack.md). Whether each is built is on its own issue | An attack VM pointed at an estate with no Wazuh, no Velociraptor and no domain teaches nothing. This is the half that carries the value | +| [#234](https://github.com/Gerrrt/HomeLab/issues/234) — the ImaginationLAN tripwire | **Armed and verified 2026-09-08**, and nothing here re-arms it. §8 and §9 assume it is already live | The only thing watching the boundary this build creates. It is a no-op until the segment holds attackers, which is what §5 makes it | +| [#235](https://github.com/Gerrrt/HomeLab/issues/235) — whether `shiva` stays on VLAN 30 | **Decided: it stays** ([ADR-0033](../adr/0033-keep-the-ilo-on-the-lab-segment.md)), **and the hardening that decision named was done 2026-09-09** — IPMI-over-LAN, SSH and iLO Federation off, the BMC's credential shared with nothing in the house, its security log read for a baseline, and the redundant `10.0.30.10 → 10.0.99.20/udp` return-path rule deleted from `morpheus`. Read [`SECURITY.md`](../../SECURITY.md)'s row for it rather than doing it again | Before §5 puts a Kali VM in its broadcast domain, the BMC already in that domain has to be the hardened one. A decision taken afterwards is taken under a fact that is already true | + +So what genuinely remains ahead of §1 is the estate and the machine. `ifrit` is +unpurchased, and the purchase is gated on #414's domain being built: it is the +**last** purchase on the estate's list, not the next. ADR-0017 and #421 carry +the spec to buy against, and nothing below this section can be started without +the box. You will also need a free Green access port on `neo` and an outlet on the PDU. `ifrit` does **not** hang off the unmanaged shelf switch: that switch is fed