README.md, netbird-zero-trust.md: bigger zero-trust section, expanded doc, drop over-specific personal-device detail

README: real dedicated 'Zero Trust, Actually Implemented' section (general
concept -> NetBird as the concrete implementation -> link out), host/doc
count bumped to 12/16, NetBird tool bullet.

netbird-zero-trust.md: dropped the LXC-provisioning tangent (not relevant
to a doc about NetBird itself), added self-hosted-vs-SaaS rationale, a
real Addressing table, and expanded split-DNS mechanism detail. Also
genericized personal-device specifics (device types/exact split of
access) that were too specific for the public repo.

README.md

@@ -12,15 +12,15 @@
 
 <table style="margin: 0 auto;">
 <tr>
-<td align="center">🖥️<br/><strong style="font-size:1.6em;">11</strong><br/>fleet hosts</td>
+<td align="center">🖥️<br/><strong style="font-size:1.6em;">12</strong><br/>fleet hosts</td>
 <td align="center">🐳<br/><strong style="font-size:1.6em;">44</strong><br/>compose stacks</td>
-<td align="center">📚<br/><strong style="font-size:1.6em;">15</strong><br/>documented systems</td>
+<td align="center">📚<br/><strong style="font-size:1.6em;">16</strong><br/>documented systems</td>
 <td align="center">🧱<br/><strong style="font-size:1.6em;">4</strong><br/>trust boundaries</td>
 <td align="center">🔁<br/><strong style="font-size:1.6em;">13</strong><br/>automated maintenance flows</td>
 </tr>
 </table>
 
-I'm a curious, self-taught technologist who runs a real, multi-host homelab as a production-grade playground. Most homelabs are a media server with some extra apps bolted on. This one is a platform: The same categories of systems a company's platform/security team owns, run at homelab scale, for real, 24/7, by one person.
+I'm a curious, self-taught technologist who runs a real, multi-host homelab as a production-grade playground. Most homelabs are a media server with some extra apps bolted on. This one is a platform: the same categories of systems a company's platform/security team owns, run at homelab scale, for real, 24/7, by one person.
 
 My long-term goal is to build a career in IT — specifically in environments where learning never stops and innovation is part of the culture.
 What started as a hobby project has grown into a full-on journey into DevOps, automation, infrastructure, and security;
@@ -30,6 +30,7 @@ What started as a hobby project has grown into a full-on journey into DevOps, au
 - <strong style="font-size:1.4em;">HashiCorp Vault</strong> — issuing PKI certs and managing every application secret
 - <strong style="font-size:1.4em;">Caddy + Authentik</strong> — a two-zone reverse-proxy design fronted by SSO, behind pfSense and firewalld for real network segmentation
 - <strong style="font-size:1.4em;">Kestra</strong> — fleet orchestration with scheduled flows backed by Ansible roles and playbooks
+- <strong style="font-size:1.4em;">NetBird</strong> — a self-hosted zero-trust WireGuard mesh, every host and device with its own identity, deny-by-default policy instead of trusting LAN position
 - <strong style="font-size:1.4em;">Gitea</strong> — a self-hosted registry building and shipping container images for every stack that's opted in
 - <strong style="font-size:1.4em;">Wazuh + Dashy</strong> — a self-built SOC watching all of it
 
@@ -47,6 +48,16 @@ The three routing authorities are also split across two separate physical nodes,
 
 Full breakdown — the boundary-by-boundary reasoning, the routing-authority failure table, all 8 traffic laws: [docs/architecture-overview.md](docs/architecture-overview.md).
 
+## Zero Trust, Actually Implemented
+
+Zero trust is where enterprise security has been heading for years now — NIST formalized it as a reference architecture, and "trusted because it's on the LAN" has been steadily losing ground everywhere as the default posture. The core idea is simple to state and hard to actually build: nothing gets access because of *where* it's connecting from, only because of *what it's proven itself to be*. Network position stops being a substitute for identity, and every single request gets checked against explicit policy instead of inheriting trust from whatever segment it happened to arrive on.
+
+This fleet doesn't just talk about that model — the four trust boundaries above are one expression of it, and remote/roaming access is a second, separate one, since "how do you reach the fleet from outside it" is a genuinely different problem from "how do services inside it talk to each other." That second problem is solved with a self-hosted zero-trust mesh (**NetBird**, WireGuard-based): every host and every device gets its own cryptographic identity, access is granted per-identity through explicit policy, and the mesh's own built-in allow-everything default is disabled — nothing crosses it unless a rule says so.
+
+![The NetBird control plane sends thin coordination-only signals to every peer, while real data flows over direct peer-to-peer WireGuard tunnels that bypass the control plane entirely, with relay fallback only when a direct path isn't possible](assets/netbird-zero-trust-mesh-topology.svg)
+
+Full breakdown — the mesh-vs-VPN reasoning, the complete policy model (groups, scoped keys, peer approval, posture checks), the real bring-up story, and live evidence straight from the running system: [docs/netbird-zero-trust.md](docs/netbird-zero-trust.md).
+
 ## Architecture at a Glance
 
 ![Architecture Overview](assets/architecture-overview.svg)
@@ -110,6 +121,10 @@ Docker images get built and hosted entirely in-fleet on the Git server's own bui
 Authentik, self-hosted, fronts single sign-on fleet-wide — native OIDC where an app supports it, proxy-based forward-auth covering everything else, so apps that were never built with SSO in mind still get it. Every OIDC login crosses reverse-proxy zones mid-handshake, and Git automation runs on a scoped bot account rather than an admin identity.
 → [docs/sso-and-identity.md](docs/sso-and-identity.md)
 
+### 🕸️ Zero-Trust Mesh Overlay
+A self-hosted WireGuard mesh gives every fleet host and personal device its own stable identity, independent of where it physically sits — access is granted per-identity through mesh policy, deny-by-default, not inferred from LAN position. Rejected a classic VPN concentrator on purpose: the mesh's control plane only ever coordinates, real traffic flows peer-to-peer and never routes through it.
+→ [docs/netbird-zero-trust.md](docs/netbird-zero-trust.md)
+
 ## What's Running
 
 44 Docker Compose stacks, grouped by purpose rather than by which host happens to run them — see [`stacks/`](stacks/): identity & security, platform/infra, media, productivity, and dev tools.