[Gerrrt]

What changed

build-the-playground.md §4 gains an On gandalf table listing every value and step that differs from the recorded Saruman run. §7's power-on sequence now begins by reading the firewall back. Nothing on the lab changes. This prepares the next step of the range build.

Why

#421's next step is §4 on gandalf. §4 records the 2026-09-20 Saruman run (#566) and said gandalf "gets the same treatment". Followed as written, three things would have gone wrong:

• The collector, its three alerts and the up{} check are useless on gandalf. ADR-0017 gives it no agent, so nothing would read the collector's file. The table also expected 3 host rules on gandalf, which assumed something would count them. Since nothing watches it, the check that the firewall stays on becomes a §7 step at every power-on: pve-firewall status plus the probe from morpheus.
• host.fw on gandalf needs phoenix's 8006 rule. ADR-0074 builds tpl-kali (Build tpl-kali (VMID 902) on ifrit once it exists #790) on gandalf from phoenix. build-the-lab-templates.md §5 step 2 already says to admit it, but §4 said gandalf takes three rules. It takes four.
• The guest-NIC loop names Saruman's 140 and 170. gandalf has no guests yet (ADR-0106). The flag is cleared as §5 and §6 create each NIC. Clones of tpl-kali already carry firewall=0 from Packer, but a NIC added in the GUI, like the attack VM's net1, does not.

The table also gives the console path, KVM port 4. AMT is disabled, so there is no second way in. It also gives the alias (10.0.30.30), the lower-case node path and the probe target.

Refs #421.

Blast radius

Docs only. The one runbook will be followed on gandalf (VLAN 30). docs/security.md, network.md and architecture.md still describe Saruman's firewall alone, and that is still true until §4 runs on gandalf. They change in that PR.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python3 scripts/check_docs.py (in a venv from scripts/requirements.txt): docs OK — 159 Prometheus + 20 Loki rules, 8 dashboards, 156 panels, 12 assertions

• markdownlint-cli2 on the file: 0 issues

• ./scripts/lint.sh: passed, but 14 checks were skipped (no docker daemon or pipx here), so CI's --require-all run is the real lint

• make validate was not run in full

• make validate passes

• Deployed to the lab and confirmed working

• Docs updated (docs/, service README, or docs/roadmap.md)

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues are reported for the runbook documentation update.

No open issues 🎉

What changed in this PR

Clarifies how to apply the playground runbook’s recorded Saruman firewall procedure to gandalf, preparing the next range-build step for #421 without changing the lab.

Changes:

• Adds gandalf-specific console, node path, address, guest-NIC, and firewall-rule guidance.
• Limits collector and alert instructions to Saruman, since gandalf has no monitoring agent.
• Requires firewall status and connectivity checks before each range session.

File	Description
docs/​runbooks/​build-the-playground.md	Documents gandalf substitutions and adds per-session firewall verification.

_{Review effort: Balanced}