Modules covering /volume1/docker or any path with container-owned files
need uid=root/gid=root to avoid Permission denied errors. Added a second
example block, explained why it is safe alongside read only=yes and
hosts allow, and updated the troubleshooting table accordingly.
https://claude.ai/code/session_017P1M5Gava6kdP4VemtJpqU
Adds --exclude flags for Synology-specific dirs (@eaDir, #recycle, @tmp,
@sharebin, .SynologyWorkingDirectory) to prevent polluting the UNAS share
with thumbnail caches and recycle bin data. Adds --no-perms --no-owner
--no-group to avoid silent CIFS permission errors stalling the transfer.
Applies exclusions to pilot, full run, and verification dry-run commands.
Adds UniFi Drive 4.3.5 manual re-index note to troubleshooting table.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New section §10 documents the runtime split:
- Technitium on bare metal (official install.sh) — critical infra, avoids
Docker-needs-DNS bootstrap, minimum failure surface
- Caddy in Docker via caddy:builder with the Cloudflare DNS plugin baked
in at build time, reusing this repo's existing Caddyfile_template and
substitute_env.sh workflow. Adds template Dockerfile + compose.
- Netbird agent via official pkgs.netbird.io install script as a host
systemd service, keeping tunnel state outside the Caddy container.
Folds in design review feedback:
- Split Caddy into its own DMZ zone (VLAN 15) on a dedicated host
- Public ingress via Netbird VPS + agent on Caddy host (no WAN port-forward)
- Replace brittle ':53 block' with DNAT redirect for FAMILY/MEDIA/IOT/GUEST,
silently capturing hardcoded resolvers without source-IP mismatch breakage
- Document UniFi 9.x intra-zone default-allow as the rationale for keeping
FAMILY/MEDIA and IOT/GUEST as separate zones
- Add Technitium Allowed Networks ACL prerequisite for cross-subnet queries
- Caddy host hardening: SSH source-lock, wt0 firewall, no Docker socket,
cap_drop ALL, Netbird as host service
Captures the pfSense → UDM Pro cutover with 5 custom zones replacing
7 per-interface rule sets. Consolidates LAN/Office/AdBlock into
TRUSTED so Proxmox-hosted Caddy and apps share one VLAN, while
keeping MEDIA and FAMILY as their own firewalled zones restricted to
Caddy + DNS + internet (no UDM admin, no NAS, no workstations).
Repo is being renamed from synology-docker-services to
homelab-blueprint to reflect the actual scope (compose stacks,
network/rack docs, DNS recipes, Caddy config) and the Synology
retirement called out in the migration guide.
Per review on PR #19: the link description, §7.3, and the BoM
already state the link is RJ45-to-RJ45; explicitly noting the
absence of an SFP module is noise.
The CRS309's GbE RJ45 port is a full switchport that also accepts
802.3at PoE-in, so a single Cat6 from a Lite-8 PoE+ port to the
CRS309 GbE port carries both the 1G trunk and the power. §7.4
already described this; §7.3, the link table, the topology
mermaid, the migration sequence, the PoE budget, and the BoM
contradicted it by assuming a 1G SFP-to-RJ45 module on a CRS309
SFP+ cage (physically impossible to also pass PoE).
Aligned all of the above with the RJ45-to-RJ45 design and removed
the UACC-CM-RJ45-1G line from the shopping list.
Each box is 36 chars wide, every U gets a single line (no inner row
separators), and multi-U devices are marked with '}' on each occupied
line. Verified all 17 diagram lines render at exactly 74 chars so the
two columns stay aligned in any monospace renderer.
The side-by-side layout broke alignment because Unicode box-drawing
glyphs (▣, ░) and nested box characters render at different widths
across fonts. Stacking the two diagrams vertically and switching to
plain ASCII (+, -, |) makes them legible in any monospace font.
§12.6 ASCII rack diagram side-by-side, §12.7 Mermaid equivalent for
GitHub-rendered viewing. Standalone copy at docs/network/rack-layout.md
so the visual is reachable without scrolling through the full migration
guide.
§11 documents the explicit decision to defer 2.5GbE at the desk, the
constraints that block a quick fix (NUC 1G NIC, Lite-8 1G ports, CRS309
has no 2.5G RJ45), and two upgrade paths for when it's revisited.
§12 captures the current 15U Linkbasic rack contents, a recommended
target layout that puts the patch panel between Lite-8 and CRS309 for
short patches, uses rear-routed DACs through a brush panel so MS-A2 and
UNAS Pro don't have to sit adjacent to the CRS309, and pairs MS-A2 with
the Wyse 5070 on a shared 2U vented shelf. Also includes a physical
migration order, cable-management discipline, and a power-draw delta.
Shopping list renumbered §11 → §13.
- Add §2 "Current Topology" with Lite-8 port map and mermaid diagram so
readers can see what's changing, not just the destination.
- Retire the TP-Link TL-SG1016DE office switch; office devices fold back
onto Lite-8 ports 6/7/8 (U3425we monitor, Wyse 5070, optional NUC drop).
- Pin Wyse 5070 as the dedicated Home Assistant host (HA + Mosquitto +
Z2M stay on it; only the uplink moves).
- Remove Node-RED from the service map — being decommissioned.
- Add §6 "Service Placement" mapping every Docker stack from the repo to
its target host, plus UNAS Pro NFS share layout.
- New gotchas: Lite-8 port budget, Z2M-over-TCP, Emby VAAPI on MS-A2,
Beszel host networking, KVM pass-through caveat.
DS920+ is fully retired (no backup role). Intel NUC repurposed as
desktop replacing Mac mini. SMLIGHT SLZB-06U Zigbee coordinator is
PoE-powered from the Lite-8, so it's added to the PoE budget table —
new total ~30-35 W of 52 W, but all 4 PoE+ ports are now used.
https://claude.ai/code/session_011ttbGhvdo5k2GTn69kceA2
Replace UDM Pro / USW-Aggregation / UGREEN DXP8800 Plus / Intel NUC
build with MS-A2 (Proxmox + pfSense VM), MikroTik CRS309-1G-8S+IN,
and UniFi NAS Pro 2U. Power CRS309 via PoE-in from Lite-8, keep
1G SFP-to-RJ45 for Lite-8 uplink (thermal), and host the UniFi
Network Application on the NAS Pro. Mermaid diagram switched to
vertical layout.
https://claude.ai/code/session_011ttbGhvdo5k2GTn69kceA2
head -1 always returned the first (empty) match when a key existed with
an empty value in .env, causing auto-generated secrets like
NODE_RED_CREDENTIAL_SECRET to be ignored during substitution.
