WireGuard to the lab jumpbox: terminate on VLAN 30, route it, and record what it costs

README.md

@@ -92,8 +92,8 @@ documents for different readers.
   the Makefile, the scripts, the workflow and the runbooks resolves its image
   from `compose.yaml` too, so an image that is not pinned there cannot be run
   at all.
-- **Documented decisions and runbooks.** 40 ADRs covering what was chosen
-  and what was rejected — including the costs accepted knowingly; 25
+- **Documented decisions and runbooks.** 41 ADRs covering what was chosen
+  and what was rejected — including the costs accepted knowingly; 26
   runbooks for the operations that are easy to get wrong at 1am, one of which
   is the handover page a successor reads first.
 
@@ -207,7 +207,7 @@ Full topology and data flow in [`docs/architecture.md`](docs/architecture.md).
 ├── docs/
 │   ├── architecture.md  network.md  hardware.md
 │   ├── observability.md  security.md  roadmap.md
-│   ├── adr/                  # 39 architecture decision records
+│   ├── adr/                  # 41 architecture decision records
 │   └── runbooks/             # successor handover (start here), deploy, converge,
 │                             #   add device, rotate creds, certs, key backup,
 │                             #   purge, restore the firewall, restore the stack,

docs/adr/0008-place-services-by-data-trust.md

@@ -119,3 +119,12 @@ earned its place. This leaves the "no MFA on the internal services" gap in
   revisited. Both changes push toward a dedicated services segment and toward
   Authelia, and both were declined here on the strength of *two users, no remote
   access*. When that premise changes, so does the decision.
+
+  > *The second half of that premise changed in 2026-09.
+  > [ADR-0041](0041-terminate-the-remote-path-on-the-lab-and-route-it.md) opens
+  > a WireGuard path that terminates on the lab and reaches the lab only, so
+  > "no remote access" becomes "no remote access to the house". It fires
+  > [ADR-0022](0022-expire-the-sso-deferral-when-the-tier-holds-real-data.md)'s
+  > second trigger and re-accepts the deferral with reasons, which is what that
+  > ADR provides for. The placement reasoning above is unchanged and this ADR
+  > is not superseded.*

docs/adr/0011-keep-the-wiki-internal.md

@@ -58,6 +58,17 @@ machinery for publishing a service exists and reusing it would be cheap.
 > no `rdr` port forwards, and WAN (`em0`) has no inbound pass rules beyond DHCP
 > client replies. *"No port forward, no external hostname, no reverse-proxy
 > entry"* is the live state of the firewall, not only an intention.
+>
+> **Update · 2026-09.** The measurement above is now dated.
+> [ADR-0041](0041-terminate-the-remote-path-on-the-lab-and-route-it.md) decides
+> a WireGuard endpoint on the lab jumpbox, and building it makes `morpheus`
+> carry exactly one `rdr` and one inbound WAN pass. **The decision below is
+> unchanged and so is its reasoning**: the wiki is still not published, still
+> has no external hostname and still sits behind no reverse proxy, and reaching
+> it still means being inside the house — or, from ADR-0041 onward, on a tunnel
+> that terminates on VLAN 30 and cannot route to `oracle` at all. What expires
+> is the estate-wide claim that nothing is reachable from outside, not this
+> ADR's answer for this service.
 
 ## Decision
 

docs/adr/0014-put-ifrit-on-imaginationlan-and-give-the-targets-no-route.md

@@ -11,6 +11,18 @@
 > socketed RAM, and no backups, monitoring or patching for the range. Nothing
 > here is amended; the constraints below are what
 > [`build-the-playground.md`](../runbooks/build-the-playground.md) checks.
+>
+> ---
+>
+> **The last Consequence below names remote access into VLAN 30 as something
+> that reopens this decision. It has been wanted, and
+> [ADR-0041](0041-terminate-the-remote-path-on-the-lab-and-route-it.md),
+> 2026-09, is the ADR that answers it.** What moved is the premise, not the
+> decision: `ifrit` stays on ImaginationLAN, its targets still have no route,
+> and every constraint below still holds. What ADR-0041 adds to this segment is
+> a second source subnet — `172.31.0.0/24`, the WireGuard peers — which is why
+> it also widens the tripwire this ADR decided. `172.30.` is the range;
+> `172.31.` is the tunnel. Nothing here is amended.
 
 ## Context
 

docs/adr/0022-expire-the-sso-deferral-when-the-tier-holds-real-data.md

@@ -2,6 +2,20 @@
 
 **Status:** Accepted · 2026-09
 
+> [!NOTE]
+> **Trigger 2 fired in 2026-09, and the deferral was re-accepted rather than
+> ended.**
+> [ADR-0041](0041-terminate-the-remote-path-on-the-lab-and-route-it.md) opens a
+> WireGuard path terminating on the lab, which takes ADR-0008's *no external
+> exposure* premise — the thing this trigger makes testable. It is recorded as
+> fired there rather than argued around, and re-accepted on the grounds this
+> ADR provides for: nothing in the table below becomes reachable, the tier is
+> unbuilt, and the two-users premise is unchanged. What did become externally
+> reachable is the lab's own Grafana on `alexander`, which the table below
+> already condemns as unable to carry a second factor in any edition.
+> **Triggers 1 and 3 are untouched and keep their full force.** Nothing here is
+> amended.
+
 ## Context
 
 [ADR-0008](0008-place-services-by-data-trust.md) defers Authelia knowingly and