Replace the DNAT implementation steps with an accurate account of what
works in UniFi Network 10.4.57: Dest. NAT only supports WAN port-forwarding
and cannot redirect internal VLAN DNS traffic. Document the deployed
DHCP enforcement approach as the current strategy and preserve the DNAT
field reference for when UniFi adds LAN-facing support.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add exact UniFi 9.x NAT panel steps for DNS DNAT redirect (FAMILY, MEDIA,
IOT, GUEST) and verification procedure to the zone migration guide. Add
Client VLAN Access section to the Caddy README with firewall rules for
FAMILY and MEDIA to reach Caddy over HTTPS.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Modules covering /volume1/docker or any path with container-owned files
need uid=root/gid=root to avoid Permission denied errors. Added a second
example block, explained why it is safe alongside read only=yes and
hosts allow, and updated the troubleshooting table accordingly.
https://claude.ai/code/session_017P1M5Gava6kdP4VemtJpqU
Adds --exclude flags for Synology-specific dirs (@eaDir, #recycle, @tmp,
@sharebin, .SynologyWorkingDirectory) to prevent polluting the UNAS share
with thumbnail caches and recycle bin data. Adds --no-perms --no-owner
--no-group to avoid silent CIFS permission errors stalling the transfer.
Applies exclusions to pilot, full run, and verification dry-run commands.
Adds UniFi Drive 4.3.5 manual re-index note to troubleshooting table.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New section §10 documents the runtime split:
- Technitium on bare metal (official install.sh) — critical infra, avoids
Docker-needs-DNS bootstrap, minimum failure surface
- Caddy in Docker via caddy:builder with the Cloudflare DNS plugin baked
in at build time, reusing this repo's existing Caddyfile_template and
substitute_env.sh workflow. Adds template Dockerfile + compose.
- Netbird agent via official pkgs.netbird.io install script as a host
systemd service, keeping tunnel state outside the Caddy container.
Folds in design review feedback:
- Split Caddy into its own DMZ zone (VLAN 15) on a dedicated host
- Public ingress via Netbird VPS + agent on Caddy host (no WAN port-forward)
- Replace brittle ':53 block' with DNAT redirect for FAMILY/MEDIA/IOT/GUEST,
silently capturing hardcoded resolvers without source-IP mismatch breakage
- Document UniFi 9.x intra-zone default-allow as the rationale for keeping
FAMILY/MEDIA and IOT/GUEST as separate zones
- Add Technitium Allowed Networks ACL prerequisite for cross-subnet queries
- Caddy host hardening: SSH source-lock, wt0 firewall, no Docker socket,
cap_drop ALL, Netbird as host service
Captures the pfSense → UDM Pro cutover with 5 custom zones replacing
7 per-interface rule sets. Consolidates LAN/Office/AdBlock into
TRUSTED so Proxmox-hosted Caddy and apps share one VLAN, while
keeping MEDIA and FAMILY as their own firewalled zones restricted to
Caddy + DNS + internet (no UDM admin, no NAS, no workstations).
Repo is being renamed from synology-docker-services to
homelab-blueprint to reflect the actual scope (compose stacks,
network/rack docs, DNS recipes, Caddy config) and the Synology
retirement called out in the migration guide.
Per review on PR #19: the link description, §7.3, and the BoM
already state the link is RJ45-to-RJ45; explicitly noting the
absence of an SFP module is noise.
The CRS309's GbE RJ45 port is a full switchport that also accepts
802.3at PoE-in, so a single Cat6 from a Lite-8 PoE+ port to the
CRS309 GbE port carries both the 1G trunk and the power. §7.4
already described this; §7.3, the link table, the topology
mermaid, the migration sequence, the PoE budget, and the BoM
contradicted it by assuming a 1G SFP-to-RJ45 module on a CRS309
SFP+ cage (physically impossible to also pass PoE).
Aligned all of the above with the RJ45-to-RJ45 design and removed
the UACC-CM-RJ45-1G line from the shopping list.
