From 5fddb5b8f7ac2ecfa0bb2a286d1b496373c1fa81 Mon Sep 17 00:00:00 2001 From: thesabear Date: Tue, 25 Aug 2026 22:04:44 +0300 Subject: [PATCH] architecture-overview: tighten two image captions that undersold their own screenshots Both captions described only one rule visible in a multi-rule screenshot, technically accurate but misleading about what the image actually shows. --- docs/architecture-overview.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/architecture-overview.md b/docs/architecture-overview.md index 974da8c..1a2cdce 100644 --- a/docs/architecture-overview.md +++ b/docs/architecture-overview.md @@ -58,7 +58,7 @@ That third fix isn't just a claim — it's the actual live ruleset: ![pfSense LAN catch-all deny rule: block+log east-west traffic not explicitly allowed](../assets/pfsense-rules-lan-catchall-deny.png) -![pfSense rule explicitly allowing LAN to WAN/internet only, not LAN-to-LAN](../assets/pfsense-rules-lan-core-services.png) +![pfSense's core LAN service rules, including the explicit rule allowing LAN to WAN/internet only, never LAN-to-LAN](../assets/pfsense-rules-lan-core-services.png)
See the rest of the actual pfSense configuration @@ -71,9 +71,9 @@ That third fix isn't just a claim — it's the actual live ruleset: ![pfSense LAN rules for Alloy metrics, MQTT, Wazuh agent reporting, NTP](../assets/pfsense-rules-lan-observability.png) -**LAN — the Ansible SSH fan-out, one explicit rule per host, sourced from the automation host only:** +**LAN — the Ansible SSH fan-out (one explicit rule per host, sourced from the automation host only), plus the application-integration rules sitting right below it:** -![pfSense LAN rules showing per-host Ansible SSH fan-out rules](../assets/pfsense-rules-lan-ssh-fanout.png) +![pfSense LAN rules showing per-host Ansible SSH fan-out rules and application integration rules](../assets/pfsense-rules-lan-ssh-fanout.png) **LAN — the built-in anti-lockout rule, at the top of the list by necessity:**