[Gerrrt]

What changed

build-the-playground.md §4 ran on gandalf on 2026-11-09. The Proxmox firewall is now on, with policy_in: DROP. host.fw admits 8006, 8007 and 22 from Hicks (10.0.50.0/24) and 8006 from phoenix. cluster.fw narrows the local_network alias from the detected 10.0.30.0/24 to 10.0.30.30. This PR records that in the runbook, the roadmap's #421 entry and the changelog.

Why

Refs #421. §4 was the next step in the roadmap. Until now gandalf's firewall was off, so every address on VLAN 30 reached its GUI and SSH. ADR-0014 grants three ports to Hicks only.

Blast radius

gandalf only. It has no guests yet. If the rules are wrong, the result is a lockout of gandalf's UI or SSH. KVM port 4 and pve-firewall stop are the way back. No pfSense rule changed.

• No change to network segmentation or firewall rules. Not ticked: the host firewall on gandalf was enabled. pfSense is untouched.
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

Ran on gandalf:

• pve-firewall localnet read using detected local_network: 10.0.30.0/24 before and using user defined local_network: 10.0.30.30 after. ipset list PVEFW-0-management-v4 lists 10.0.30.30 alone, and the v6 set is empty.

• At ACCEPT, pve-firewall compile showed the four explicit RETURNs. After the flip, pve-firewall status read enabled/running, and iptables/ip6tables -S PVEFW-HOST-IN end in -j PVEFW-Drop, with the v6 neighbour-discovery RETURNs above it.

• The SSH session from 10.0.50.100 stayed up across the flip. It rides conntrack, though, so the probes below are what prove the rules.

• §4's probe from morpheus (not Hicks) aimed at 10.0.30.30, run by the operator: 8006 exit=1, control exit=0. The UI is refused to the rest of VLAN 30, and the probe itself works.

• A new SSH connection from the Mac on Hicks, opened after the flip, logged in to gandalf, so the 10.0.50.0/24 rule admits new connections and not just established ones.

• scripts/check_docs.py passes, and make validate exits 0 with 43 checks skipped because this host has no docker daemon or pipx. markdownlint, shellcheck and yamllint did not run locally.

• make validate passes (passes with 43 skipped, see above)

• Deployed to the lab and confirmed working (on-host read-backs and the morpheus probe)

• Docs updated (docs/, service README, or docs/roadmap.md)

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The documentation marks required off-host checks complete while they remain pending and adds dated completion history contrary to the roadmap’s explicit scope.

2 open issues

• Remove dated completion record from roadmap · New
• Mark section 4 pending off-host verification · New

What changed in this PR

This documentation-only PR records enabling gandalf’s Proxmox host firewall as part of the range build tracked by #421.

Changes:

• Records the firewall rollout, management-address restriction, and default inbound DROP policy.
• Adds runbook guidance to avoid root’s interactive cp alias.
• Updates the roadmap and changelog to reflect the rollout; off-host verification remains pending.

File	Description
docs/​runbooks/​build-the-playground.md	Records §4 execution, firewall read-backs, and the copy-command workaround.
docs/​roadmap.md	Updates range-build progress and identifies the attack VM as the next step.
docs/​changelog.md	Adds a dated record of the firewall rollout and operational observations.

_{Review effort: Balanced}