[Gerrrt]

Follow-up to #82 and #223.

#223 records that TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only, and the rule matches action="pass". The finding was already written down in docs/observability.md and stated on the homelab-security dashboard, but neither pointed at an issue, and docs/roadmap.md did not list it at all.

That is this repository's recurring failure seen from the other direction: a known problem described in prose with nothing tracking it reads, six months later, as a thing somebody decided was fine.

Three small changes:

• docs/roadmap.md — the Security section now lists TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only #223, which is where the index of open work lives.
• docs/observability.md — the paragraph that records the measurement now names the issue that would arm the alert.
• security-overview.json — the caveat panel cites TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only #223 the way it already cites Extend Suricata to Degens (VLAN 10) #89 for the unwatched VLANs and Detect Suricata being dead — a quiet IDS and a stopped one look identical #90 for detecting Suricata dying. One-line diff; no panel, query or layout change.

make validate passes: 7 dashboards, 140 panels, 132 PromQL and 28 LogQL expressions, docs OK.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Changes are limited to documentation/caveat text updates that align with the PR description and do not introduce behavioral risk.

Pull request overview

This PR adds explicit issue tracking for the known “dead” Loki alert TerminalSegmentReachedInternalNetwork by referencing issue #223 in the roadmap, observability documentation, and the security overview dashboard’s caveats.

Changes:

• Add #223 to the Security section of docs/roadmap.md so it appears in the canonical index of open work.
• Update docs/observability.md to link the documented finding to #223.
• Update the security-overview.json caveat text to cite #223 alongside the existing issue references.

File summaries

File	Description
stacks/observability/grafana/dashboards/security-overview.json	Adds a #223 citation in the dashboard caveat explaining why the pass-based alert cannot fire.
docs/roadmap.md	Lists #223 in the Security roadmap section as tracked open work.
docs/observability.md	Links the documented “cannot fire” finding to issue #223.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.