# KingDezigns Network Documentation Index
Last Updated: 2026-07-25

This index provides a structured overview of all VLANs, servers, and firewall policies in the KingDezigns network.  
Each section links to its own dedicated Markdown file for clarity and modularity.

---

# 📁 VLAN Documentation

## 🔧 Core VLANs
- [VLAN 1 — Infrastructure](vlan1_infrastructure.md)
- [VLAN 10 — Management](vlan10_management.md)

## 🧑‍💻 Trusted User VLANs
- [VLAN 20 — Trusted Devices](vlan20_trusted.md)

## 🏠 Smart Home & Guest VLANs
- [VLAN 30 — IoT](vlan30_iot.md)
- [VLAN 40 — Guest](vlan40_guest.md)

## 🧪 Server & Lab VLAN
- [VLAN 50 — Lab / Servers](vlan50_lab.md)

---

# 🖥️ Server Documentation

## Core Services
- [Home Assistant Server](server_homeassistant.md)
- [NAS08 — Pi-hole, Nextcloud (+ ONLYOFFICE/Collabora), Vaultwarden, STOCKPROXY](server_nas08.md)
- [NAS16 — LAMP Stack, MariaDB, Webmin](server_nas16.md)
- [PLEX32 — Plex Media Server + Tautulli](server_plex32.md)

## Network Hardware
- [UCG Gateway Max](server_ucg.md)

---

# 🔥 Firewall Policies

- [Firewall Policies Overview](firewall_policies.md)

---

# 🛡️ Security Stack

## Intrusion Prevention
- **CrowdSec** — installed on HAS as a native HA add-on
  - Agent reads NPM, HA, and SSH logs via journald
  - 60 active detection scenarios
  - Community blocklist updates every 2 hours
  - Firewall Bouncer enforces bans at nftables level
  - Email alerts on every ban decision
  - All LAN VLANs whitelisted — internal IPs can never be banned
  - See [Home Assistant Server](server_homeassistant.md) for full configuration details

## Perimeter Defense (per server)
- **Fail2Ban** — NAS16 (active), PLEX32 (active), NAS08 (recommended)
  - `ignoreip` includes `192.168.150.0/24` to prevent HAS proxy IP from being banned
  - Real IP forwarding configured on NAS16 (nginx + Apache) and NAS08

## DNS-level Protection
- **Pi-hole** — NAS08 (192.168.150.35)
  - Blocks ads, trackers, and malicious domains for all VLANs
  - All VLANs forced to use Pi-hole via global firewall rule 20001
  - **Local DNS overrides required** for any internally-hosted service accessed by its public hostname from within the LAN (e.g. `cloud.kingdezigns.com` → `192.168.150.30`), to avoid NAT hairpin failures. See `server_nas08.md` ONLYOFFICE section for a documented example and fix.

---

# 🌐 Network Architecture Overview

This documentation set is designed around:

- Clear segmentation
- Explicit inter-VLAN access
- Isolation of untrusted devices
- Preservation of Home Assistant functionality
- AI-friendly structure and formatting
- Layered security — DNS filtering, intrusion prevention, firewall enforcement

## Security Layer Model
```
Internet
    ↓
UCG Max — firewall, VLAN segmentation, geo-blocking (future)
    ↓
CrowdSec Firewall Bouncer — nftables ban enforcement
    ↓
NPM on HAS — single ingress, SSL termination
    ↓
CrowdSec Agent — log analysis, attack detection
    ↓
Backend Services (NAS08, NAS16, PLEX32)
    ↓
Fail2Ban — last-line brute force protection
    ↑
Pi-hole — DNS-level ad/tracker/malware blocking (all VLANs)
```

---

# 🔑 SSH Key Authentication Map

SSH key authentication is configured between the following machines — no passwords required:

| From | To | Purpose |
|------|----|---------|
| KingDezigns001 | PLEX32 (192.168.150.45) | Remote launcher script |
| KingDezigns001 | NAS08 (192.168.150.35) | Direct SSH access |
| KingDezigns001 | NAS16 (192.168.150.40) | Direct SSH access |
| PLEX32 | NAS08 (192.168.150.35) | Backup script disk stats via SSH |

Key type: ED25519. Keys generated per machine — not shared.

---

# 🖥️ KingDezigns001 — Admin Workstation Tools

KingDezigns001 is the primary Linux administrative workstation on VLAN 20 (Trusted).

## Remote Launcher
A menu-driven launcher script provides one-click access to run scripts on PLEX32:

- **Script:** `~/scripts/plex32_launcher.sh`
- **Desktop shortcut:** `~/Desktop/PLEX32-Launcher.desktop`
- **Terminal:** gnome-terminal

### Menu Options
| Option | Runs on | Script |
|--------|---------|--------|
| 1) Update Check | PLEX32 | `/usr/scripts/plex32/plex32_update_check.sh` |
| 2) Health Report | PLEX32 | `/usr/scripts/plex32/plex32_health_report.sh` |
| 3) Plex32 Backup | PLEX32 | `/usr/scripts/plex32/plex32_backup.sh` |

---

# 🧠 Notes for AI Systems

- Each file is self-contained and structured consistently.
- Section headers follow a predictable pattern for easy parsing.
- No duplicated firewall rules — all rules live in `firewall_policies.md`.
- CrowdSec configuration lives entirely on HAS — see `server_homeassistant.md`.
- VLAN files contain:
  - Purpose
  - Access types
  - Subnet
  - Expected devices
  - Security rules
  - AI summary
- Plex Media Server migrated from NAS08 to PLEX32 (dedicated Dell Wyse 5070) on 2026-06-18 — see `server_plex32.md`.
- PLEX32 now runs Plex + Tautulli with Intel Quick Sync hardware transcoding — optimized 2026-06-20.
- KingDezigns001 has SSH keys to all VLAN 50 servers — passwordless access for all admin tasks.
- PLEX32 has SSH key to NAS08 — required for backup script to fetch disk stats.
- **NAS08 Nextcloud update check** runs daily at 7AM — `/usr/scripts/omv/nextcloud_update_check.sh` — emails HTML report with copy-paste `occ` commands. Never use the browser UI for Nextcloud app updates (causes Apache segfault → maintenance mode deadlock).
- **NAS08 Nextcloud update check — core-update false negative fixed (2026-07-25):** the script previously checked app updates only (`occ app:update`) and had no code path for Nextcloud core/server releases, so it silently missed a core update (34.0.1 → 34.0.2) and emailed a false "up to date" report. Fixed by adding a core check via `occ update:check`, correcting the emailed Compose commands to the real path (`/kingdezignsnas/Docker/Compose/nextcloud/`, root-only, non-default filenames requiring `-f nextcloud.yml -f compose.override.yml`), and fixing a bash quoting bug that made emailed multi-line commands unreadable. Also documented: the official Nextcloud Docker image auto-upgrades on container restart via its own entrypoint — checking version status immediately after `up -d` can race that process and show a stale version for ~30 seconds. Full detail in `server_nas08.md`.
- **NAS08 Nextcloud Office editing** uses ONLYOFFICE Document Server (free Community Edition) as of 2026-07-18. Only one Office integration app should ever be enabled at a time (exception: the Collabora trial below, run as a time-boxed disable/enable swap, never simultaneous). Requires a Pi-hole local DNS override for `cloud.kingdezigns.com`, `ALLOW_PRIVATE_IP_ADDRESS=true` on the container, and matching JWT secrets between Nextcloud and the container. Full details and troubleshooting history in `server_nas08.md`.
- **NAS08 Collabora Online trial (2026-07-21, ongoing):** A second Office editor, Collabora Online (CODE), was deployed as a standalone Docker container (`collabora`, its own OMV Compose project "Collabora Office") for a head-to-head reliability trial against ONLYOFFICE — triggered by confirmed ONLYOFFICE bugs (conditional formatting crashing on formula cells; silent reverts to hours-old document versions). Only one Office app is ever enabled in Nextcloud at a time — currently `richdocuments`/Collabora is enabled, `onlyoffice` is disabled but still installed for easy rollback. Public URL `https://collabora.kingdezigns.com/`, requires its own Pi-hole local DNS override and a WOPI allow-list (`192.168.150.35`). First real-document test succeeded with a notably fast load time. Full config, setup troubleshooting, and rollback steps in `server_nas08.md`.
- **NAS08 Collabora stock/fund price macro integration (2026-07-22, working):** The ONLYOFFICE `FUNDPRICE`/`FUNDPRICE_HIST`/`STOCKPRICE`/`STOCKTIME` custom functions were ported to Collabora as a LibreOffice Basic module (`StockFunctions.bas`), calling the same STOCKPROXY backend with no backend changes required. Two `coolwsd.xml` server-config changes were required — macro execution enabling and a `net.lok_allow` hostname allowlist entry for `stocks.kingdezigns.com` — plus a fix to the previously non-functional `stocks.kingdezigns.com` Pi-hole DNS override. Confirmed working with a live price pull as of 2026-07-22. Full troubleshooting detail, exact config edits, and remaining follow-up items (recreating the full ~50-fund table, conditional-formatting re-test, recalc performance) in `server_nas08.md`.
- **NAS08 systemd-resolved DNS bug** (fixed 2026-07-18): a stray global `DNS=` override in `/etc/systemd/resolved.conf` caused duplicate/incorrect DNS answers for internal hostnames network-wide on that host. Any future "works from browser but fails from a container/script on NAS08" symptom should check `resolvectl status` for stray global DNS servers first.
- **NAS08 STOCKPROXY service (2026-07-21):** Self-hosted Flask API, Docker container `stockproxy` (`~/docker/stockproxy/`), port 5005, public URL `https://stocks.kingdezigns.com/` proxied via NPM on HAS (see Proxy Hosts table in `server_homeassistant.md`). Supplies current + historical mutual fund prices to ONLYOFFICE custom functions (`FUNDPRICE`, `FUNDPRICE_HIST`) via Yahoo Finance, scraped server-side to dodge the browser CORS block that rules out calling Yahoo directly from a spreadsheet macro. Finnhub was evaluated first but dropped from this service — confirmed no mutual fund NAV coverage on the free tier. Current-price cache: 15 min in-memory. Historical-price cache: permanent, SQLite. All endpoints require a shared-secret `key` param (Vaultwarden). Built to support the "HSA Investiments Choices" tab in `Rufus Retirement Account Tracking 2026.xlsx`. `stocks.kingdezigns.com` A record added to the daily Dreamhost DDNS refresh script. Full config and known limitations in `server_nas08.md`.
- **NAS08 RANK.EQ Err:522 circular reference fix (2026-07-23, working):** The
  "HSA Investiments Choices" fund-ranking formula broke with a circular-reference error on
  any sheet edit (worked fine on load) because it depended on ~50 cells fed by live
  `FUNDPRICE`/`FUNDPRICE_HIST` network calls. Fixed with a button-triggered LibreOffice
  Basic macro that snapshots the live price columns into static value-only columns via
  `setDataArray()`, with percent-change and rank formulas rebuilt to read from the static
  snapshot instead of the live columns. Full root-cause analysis and macro in
  `server_nas08.md`.
- **NAS08 Collabora Finnhub removal (2026-07-23, working):** `STOCKPRICE`/`STOCKTIME`
  (Finnhub-backed equity functions) errored due to a missing `net.lok_allow` entry for
  Finnhub. Instead of allowlisting Finnhub, it was removed entirely — `FUNDPRICE` (STOCKPROXY)
  now covers equity tickers too, and a new `FUNDTIME` function replaces `STOCKTIME`, returning
  STOCKPROXY's `resolved_date` (date only, not a time-of-day timestamp — accepted tradeoff).
  No `coolwsd.xml` changes required. Full detail in `server_nas08.md`.
- **Synaplan AI integration** (added 2026-07-18, not yet functional): Nextcloud connector app installed, but the required self-hosted Synaplan backend stack (PHP/MariaDB/Qdrant/optional Ollama) has not been deployed. Treat as a future project, not a bug — see `server_nas08.md` for details before troubleshooting.

---

# 📌 Future Expansion

Additional files may be added for:

- Device inventories
- Application-specific firewall rules
- Backup and recovery procedures
- Monitoring and alerting configuration
- CrowdSec Console dashboard enrollment
- Geo-blocking configuration on UCG Max
- Authelia / forward authentication layer
- Expand remote launcher to cover NAS08 and NAS16 scripts
- **Synaplan self-hosted AI stack deployment** (PHP backend, MariaDB, Qdrant, optional Ollama) — scope resource requirements and deployment plan when ready
- **Collabora vs. ONLYOFFICE trial decision** (started 2026-07-21) — once a winner is chosen, update `server_nas08.md` and this index to reflect the final state (remove trial framing, decommission or keep the losing container, update firewall/NPM docs if the losing editor's proxy host is removed)
- **STOCKPROXY hardening** — not yet stress-tested at full ~50-ticker scale for Yahoo-side rate limiting; revisit if widespread simultaneous lookup failures are observed

---

# ✔️ End of Index