ADR-0007: build the defended estate on Saruman — the umbrella

[Gerrrt]

ADR-0007
decides that Saruman hosts the defensive lab estate: a Windows domain, Wazuh,
Velociraptor, Proxmox Backup Server, and its own Loki/Grafana/Alloy under
stacks/lab/.

stacks/ contains exactly one directory: observability. None of this exists.

The roadmap has no entry for any of it, which is why this is being filed — an
accepted ADR with no tracked work is indistinguishable from a rejected one after
six months.

Worth deciding before starting

• The second observability stack is the interesting decision. The ADR calls
  for lab telemetry to stay on Saruman rather than flow into the VLAN 99
  stack, which keeps deliberately-hostile data out of the estate's real
  monitoring. That is sound, and it doubles the number of Grafana instances,
  alert routes and age keys to look after. The Makefile is already
  stack-parameterised (STACK ?= observability), so the tooling supports it.
• Saruman has no Alloy agent yet, so the host that is meant to run a
  second stack is currently not monitored by the first one.
• Wazuh in particular is not a small thing to run — it is the heaviest component
  in the ADR by a wide margin.

Probably wants breaking into per-component issues once the shape is settled;
this is the umbrella.

[Gerrrt]

Shape settled and split out in #270.

Two premises above have gone stale since filing: the roadmap has carried an entry for this since, and Saruman got its Alloy agent in #88 on 2026-09-02. The third — "the Makefile is already stack-parameterised, so the tooling supports it" — is half true, and the false half is #263.

ADR-0019 answers the two questions that blocked the first line of work. The stack runs in a guest, not on the hypervisor — Saruman is the one host that must not run Docker, which is why #88 shipped the native .deb there. And it carries its own Prometheus: ADR-0007 named three services while also saying config.alloy is reused with only the two *_URL variables changed, and that file has two sinks, so a lab without a Prometheus points the second at 10.0.99.20 and inverts the isolation the ADR is for.

Seven issues, in order:

• #262 — the guest
• #263 — multi-stack validators and CI
• #264 — stacks/lab/ itself
• #265 — the Windows domain
• #266 — Wazuh
• #267 — Velociraptor
• #268 — PBS

Liveness stays with #257; ADR-0019 decides only that no Alertmanager goes inside the stack. This issue stays open as the umbrella.

[Gerrrt]

Status of the umbrella as of 2026-09-08, read from the issues and the tree
rather than from memory. Every component ADR-0007 named now has an issue and
an ADR; the observability half is built; the security half is decided and not
racked.

Component	Issue	Decided by	State
The guest alexander	#262	ADR-0020	Built, 2026-09-05
stacks/lab/ — Prometheus, Loki, Grafana, Alloy	#264	ADR-0020	Built and running
Multi-stack validators and CI	#263	—	Done (scripts/stacks.sh)
Windows domain	#265	ADR-0029	Decided, runbook written, not built
Wazuh	#266	ADR-0030	Decided — stacks/soc/ on a second guest odin — not built, behind #265
Velociraptor	#267	ADR-0030	Same decision, same guest, not built
Proxmox Backup Server	#268	ADR-0027	Deferred until zion exists
Liveness across the boundary	#257	ADR-0028	Done

Nothing here is buildable from the monitoring host — Saruman is on VLAN 30,
which the monitoring host cannot reach, and the remaining work is hands-on:
six domain guests, then a second guest for the SOC stack. This stays open as
the umbrella until #266 and #267 close.

One thing found on the way: stacks/lab/README.md still said "Nothing here
has ever been deployed" and "4 rules", both stale since #262 and ADR-0029.
Fixed in #398.

🤖 Generated with Claude Code

[Gerrrt]

Status as of 2026-09-09, the day after the table above. Three of its rows moved in one day, and the roadmap paragraph recorded none of it — fixed in #423.

Component	Was (2026-09-08)	Now
Windows domain	#265, decided, not built	#265 closed on the decision; #414 is the build tracker. Still not built — six VMs, the runbook's eleven sections, evenings at Saruman from Hicks
Wazuh, Velociraptor	#266, #267, decided, not built	Unchanged. stacks/soc/ is not authored, and #414 itself says it can be written and CI-validated ahead of odin the way stacks/lab was ahead of alexander. That is the one remaining piece that needs no hands on Saruman
Proxmox Backup Server	#268, deferred until zion exists	zion is bought (#413, a TS150, in transit, two drives still to buy) and not built. ADR-0027's trigger has moved from a purchase to a build: PBS follows the NAS answering on 10.0.40.30, not the box arriving
The spindles everything is sized against	"a single mirrored pair of 7.2K disks", ~90 write IOPS	Two SM863a SSDs bought (#418), in transit. The fit re-derives ADR-0029's duty cycle and #266's indexer sizing; the purchase changes nothing, and the roadmap now says which so "SSDs bought" is not read as "endpoints can run continuously"

Two things done on the way. This issue's title said "nothing of it exists", which has been false since 2026-09-05; retitled to what it is. And docs/network.md's CasaBonita row still said zion was "not yet bought" — #420 updated hardware.md and the roadmap but not that line; #423 carries the one-liner.

Order of the remaining work is unchanged: #414, then stacks/soc/ on odin for #266 and #267, then PBS when zion answers. This stays open until #266 and #267 close.

🤖 Generated with Claude Code

[Gerrrt]

One row of the table above moved today: Wazuh and Velociraptor go from "decided, stacks/soc/ not authored" to authored and CI-validated, not built — #434, the stacks/lab-before-alexander shape. That was the one remaining piece of this umbrella that needed no hands on Saruman. Everything left now does: #414's six domain VMs, then odin from build-the-soc-guest.md, then PBS when zion answers.

🤖 Generated with Claude Code