[Gerrrt]

What changed

The docs now say Saruman is at 10.0.30.20, where build-the-playground.md §3 moved it on 2026-11-07. §3 itself is rewritten as it actually ran.

Why

#421: ADR-0014 needs the hypervisor out of ImaginationLAN's .100–.200 DHCP pool before the attack VM starts leasing from it. Refs #421.

Blast radius

Docs, the diagram, the Glance link and comments only. The firewall and host changes were made by hand on 2026-11-07, and this PR records them. The pfSense rules for .20 keep their copy descriptions, which end in (.20).

• No change to network segmentation or firewall rules (the rules changed by hand; this PR only records it)
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

The move was checked live over .20:

• Loki has Saruman log lines, and pfctl shows states from .20 to 9090 and 3100.
• upsc -c lists 10.0.30.20.
• smaug-iso is active after a remount.
• 8006 answers from Hicks and is refused from morpheus.
• phoenix gets API 200 with TLS verified.
• The certificate names include 10.0.30.20.
• The same 10 guests stayed running.

After that, the .110 rules were deleted.

make validate passed, but 43 of its checks were skipped for lack of Docker. markdownlint (npx markdownlint-cli2) passes, as do check_docs.py and lint.sh.

• make validate passes (43 checks skipped)
• Deployed to the lab and confirmed working
• Docs updated

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved findings include an API check that skips endpoint/TLS verification on configured hosts, an inaccurate historical IP record, a stale diagram PNG, and an outdated firewall reference in SECURITY.md.

3 open issues

• Update the firewall boundary host in SECURITY.md · New
• Preserve the historical .110 address in the build record · New
• API check is skipped for already-configured phoenix · New

What changed in this PR

Records Saruman’s completed move to 10.0.30.20, outside the DHCP pool used by the planned attack VM, as part of #421’s range build.

Changes:

• Expands the migration runbook with dependency updates, cutover checks and cleanup steps.
• Updates current addresses in documentation, the Glance link, diagram, comments and test fixtures.
• Adds a changelog entry and dated ADR notes while preserving the original decisions.

File	Description
stacks/​sensitive/​glance/​pages/​homelab.yml	Points the Proxmox link to .20.
stacks/​media/​README.md	Updates Saruman’s NFS access address.
scripts/​zeek-mirror.sh	Makes the explanatory comment address-independent.
scripts/​collect-pve-firewall-state.sh	Updates the probe comment and alias fixtures.
scripts/​collect-iso-store-state.sh	Updates export and installation comments.
packer/​variables.pkr.hcl	Updates the TLS security comment.
docs/​security.md	Updates documented firewall source addresses.
docs/​runbooks/​shut-down-on-the-ups.md	Updates NUT rules and shutdown probes.
docs/​runbooks/​schedule-maintenance.md	Updates the collector installation target.
docs/​runbooks/​replace-the-smart-storage-battery.md	Updates the hypervisor address.
docs/​runbooks/​provision-lab-guests.md	Updates the provider endpoint example.
docs/​runbooks/​move-into-the-32u-rack.md	Updates the shutdown UI link.
docs/​runbooks/​fit-the-saruman-ssds.md	Updates host and installation addresses.
docs/​runbooks/​build-the-sensor-guest.md	Updates bridge checks and SSH targets.
docs/​runbooks/​build-the-playground.md	Records the cutover procedure and verification.
docs/​runbooks/​build-the-nas.md	Updates NFS export and firewall addresses.
docs/​runbooks/​build-the-lab-templates.md	Updates certificate checks and installation targets.
docs/​runbooks/​build-the-lab-domain.md	Notes completion of the address move.
docs/​runbooks/​build-the-jumpbox.md	Updates the API endpoint example.
docs/​runbooks/​add-monitored-device.md	Updates the Alloy firewall source.
docs/​roadmap.md	Advances the range build to management hardening.
docs/​network.md	Updates authoritative addressing and migration context.
docs/​hardware.md	Updates Saruman’s management address.
docs/​diagrams/​current/​network.svg	Shows .20 and removes the pending-move label.
docs/​changelog.md	Records the migration and operational observations.
docs/​architecture.md	Updates the hypervisor inventory address.
docs/​adr/​0106-name-the-range-host-gandalf-and-leave-ifrit-to-its-disabled-amt.md	Adds a dated address-migration note.
docs/​adr/​0084-read-management-certificate-expiry-from-inside-each-segment.md	Adds a dated address-migration note.
docs/​adr/​0079-tag-on-demand-guests-and-leave-them-out-of-the-stopped-guest-alert.md	Adds a dated address-migration note.
docs/​adr/​0072-put-the-iso-store-on-smaug-over-nfs-to-saruman-alone.md	Adds a dated address-migration note.
docs/​adr/​0068-mirror-the-lab-bridge-to-zeek-with-tc-not-open-vswitch.md	Adds a dated address-migration note.
docs/​adr/​0049-shut-down-on-the-ups-from-a-nut-server-on-the-firewall.md	Adds a dated address-migration note.
docs/​adr/​0039-decline-proxmox-clustering-while-ifrit-is-the-range.md	Adds a dated address-migration note.
docs/​adr/​0028-let-guest-liveness-cross-but-not-guest-telemetry.md	Adds a dated address-migration note.
docs/​adr/​0020-run-the-lab-stack-in-a-guest-with-its-own-prometheus.md	Adds a dated address-migration note.
docs/​adr/​0017-buy-ifrit-for-iops-and-keep-the-range-disposable.md	Adds a dated address-migration note.
docs/​adr/​0016-open-casabonita-inward-and-keep-it-terminal-outward.md	Adds a dated address-migration note.
docs/​adr/​0007-defensive-estate-and-offensive-range.md	Adds a dated address-migration note.

_{Review effort: Balanced}