[Gerrrt]

Refs #523. This PR decides the issue but does not close it. The issue closes once the steps below have been done at smaug and morpheus.

Decision (ADR-0051)

• A Hicks pass, vlan50 net → 10.0.40.30:445/tcp, described Allow SMB to smaug, above Block access to CasaBonita on igc0.50. It is the same kind of rule as the other Hicks passes: one rule per port, and host-scoped. Only 445 is opened, not NetBIOS on 137–139, and the share is reached by address.
• A second SMB user, samwise, for workstations. bilbo stays the televisions' credential, unchanged, so the password stored on a TV and the one typed on a laptop can be revoked separately. Making bilbo read-only is deferred, because it means changing the share's ACL.
• Rejected: a pull from the NAS side, because it would make CasaBonita initiate, and loading over the console, because it does not scale.
• Residuals the ADR accepts:
  • A workstation holding samwise's password can delete or encrypt the library, and erebor/media is not snapshotted. ADR-0008 treats the library as replaceable.
  • Everything on Hicks, the corporate laptop included, can now reach an SMB login prompt, as it already reaches the TrueNAS one on 443.
  • The monitoring host cannot probe 445.

Documents

• build-the-nas.md:
  • §0.5: a row for the rule in the table.
  • §0.6: a check that the monitoring host is refused on 445.
  • §5: a new Workstations procedure. Create the user, confirm SMB1 is off, create the rule, read its position from morpheus, mount from a Hicks workstation and write a test file, confirm the monitoring host is refused, then record the result here.
• network.md, security.md, architecture.md, stacks/media/README.md, ADR-0016 (a pointer, as for ADR-0050), roadmap.md and changelog.md are updated. All of them call the pass specified, not created.
• The ADR count in README.md is now 51.

Verification

scripts/check_docs.py and scripts/lint.sh pass. No configuration changed, only documents.

After merge

Follow build-the-nas.md §5 Workstations at smaug and morpheus. Then change the four documents from specified to created in one commit, as was done for 4533, and close #523.

🤖 Generated with Claude Code