Skip to content

docs(roadmap): the lab tripwire is armed and verified (#234) #399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Gerrrt merged 1 commit into from
Sep 8, 2026
Merged

docs(roadmap): the lab tripwire is armed and verified (#234) #399

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions docs/roadmap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -600,14 +600,6 @@ Accepted ADRs with no work behind them. Recorded here because an accepted ADR
with nothing tracking it is indistinguishable from a rejected one after six
months.

- **[#234](https://github.com/Gerrrt/HomeLab/issues/234)** ADR-0014's tripwire
on ImaginationLAN — the fourth rule in #223's shape, a Loki rule whose source
is `10.0.30.0/24`, and the restore runbook expecting four where it expects
three. The firewall rule arrived on 2026-09-06 with the untagged-LAN blocks,
pointed at `Internal_Segments` — which names the lab's own subnet, so it
logged 1,239 DNS queries to the lab gateway in three days and nothing else.
The Loki rule, the runbook and the dashboard landed on 2026-09-08; what
closes it is the rule moving to a `House_Segments` alias that excludes 30.
- **[#102](https://github.com/Gerrrt/HomeLab/issues/102)** ADR-0008's sensitive
tier — the mini PC, its nine services and the four firewall rules. Under
**Infrastructure** above, because it has a shape now rather than only a
Expand Down Expand Up @@ -689,6 +681,20 @@ them name the condition that would change the answer.

## Done

- [x] **[#234](https://github.com/Gerrrt/HomeLab/issues/234) Armed the lab
tripwire on ImaginationLAN.** 2026-09-08. The firewall rule arrived on
2026-09-06 with the untagged-LAN blocks, pointed at `Internal_Segments` —
which names the lab's own subnet — and logged 1,239 DNS queries to the
lab gateway in three days and nothing else. Moved to a `House_Segments`
alias (every segment but 30) on 2026-09-08: sixteen minutes later the
rule showed 26 evaluations and 0 packets, the lookups still reaching it
and no longer matching. `LabSegmentReachedInternalNetwork` reads VLAN 30
as a source and excludes it as a destination, so it was right through
the noisy days and fired on none of them; the restore runbook expects
four tripwires and checks the lab's alias by name; the security dashboard
charts the lab boundary beside the terminal one. Loki rules still have no
unit-test harness, so the rule is proven to parse and evaluate, not to
fire — the 1,239 lines were, accidentally, the proof for its source half.
- [x] **[#235](https://github.com/Gerrrt/HomeLab/issues/235) Decided: the iLO
stays on the lab segment.** 2026-09-08.
[ADR-0033](adr/0033-keep-the-ilo-on-the-lab-segment.md). `shiva` is the
Expand Down