ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102

ADR-0008
decides to place services by the trust level of the data they hold, and lists a
substantial build-out. None of it is in docs/roadmap.md — the roadmap has
only "Plan and build the NAS on VLAN 40" — and none of it exists.

Sensitive tier — a new mini PC on VLAN 99

Vaultwarden, Immich, Paperless-ngx, Home Assistant, Caddy, step-ca, AdGuard
Home, ntfy, Homepage.

Low-trust tier — the N100 NAS on VLAN 40

Jellyfin, and Plex only if a client on 40 turns out to need it — deferred
against that test by
ADR-0016,
which planned the box under #95. Nothing is bought.

The firewall rules — four, not two, and two of them are insertions

This section is corrected. It said "50→40 and 99→20 … three inter-VLAN
rules, ADR-0008 takes it to five". Every part of that is now wrong, and the two
reasons are worth keeping rather than overwriting.

The count was retired.
ADR-0013
replaced it with a list, because a count cannot express "reachable because a
catch-all was reached" and four documents holding four numbers is what that
cost. When these rules land they belong in ADR-0013's table, not in a new total.

50→40 is not one rule, and it is not an addition. ADR-0016 read the enforced
ruleset on morpheus and found that Hicks and Winterfell each carry an
explicit Block access to CasaBonita above their catch-all, so a pass has to be
ordered in front of a deny. One appended where new rules naturally land —
next to Allow internet — would match nothing, which is the fault ADR-0013
found in Allow Hicks access to ImaginationLAN. It also takes three rules, not
one, because the NAS is a host and not just a destination: built like every
other host in the estate its Alloy agent would initiate 40→99, the first upward
path here and the end of the property ADR-0008 claims to keep. ADR-0016 reverses
the direction instead — scraped, not pushed; pulled, not sent.

So what this issue owes the firewall is:

The fourth row is deliberately vaguer than the others. ADR-0008 asserts it and
nobody has yet checked it against what is deployed — and the first three are
what happens when someone does. It should be read before it is written down,
not after.

#228 should be decided first. Its own note already says "decide before #102
adds rules to the same segment", and that is now concrete: the Hicks row above
is the first rule granting that segment a destination narrowly and on purpose,
while #228 is about the catch-all that grants it two segments wholesale. The
narrow one is a worked example of what the answer to the wide one looks like.

The parts the ADR flags itself

New hardware is required. … Two purchases where the plan originally
assumed zero.

And, separately tracked, the SSO deferral.

Why this is one issue rather than nine

The placement decision is the thing to agree on; the individual services are
straightforward once it is. But several of them are load-bearing for other open
work — ntfy is the natural home for the dead-man's-switch, AdGuard for the switch
DNS item, Home Assistant for the eero integration — so the ordering matters more
than the count.