Actually fixed the 4 problems named earlier instead of just naming
them: a numbers-at-a-glance strip up top, the trust-boundary diagram
is now color-coded by boundary type, added a concrete blast-radius
table showing exactly what stays up vs goes down per failure, and
replaced vague figures ('~40 stacks', 'every managed host') with
real ones (41 stacks, 11 fleet hosts).
Leads with the hardest actual decision (4 trust boundaries, each
calibrated to a different risk level, enforced by 3 separate routing
authorities) given full narrative depth instead of flat template
treatment. The other 6 traffic laws move to a compact reference
table linking to their own dedicated docs, avoiding redundancy with
content that already lives elsewhere in more depth.
Previously only delivered 2-3 of the 8 traffic categories it claimed
to cover. Now states every law (ingress, east-west, secrets, DNS,
observability, notifications, CI/CD, management) with its own
Law/Flow/Failure-behavior, plus the 4 global architectural laws that
apply across all of them.
Switch to LR layout, restore all 12 observability-reporting edges
(cut them by mistake, they belong in a dependency graph), drop the
repeated 'reports to' label text that was breaking legibility and
let line style (solid=dependency, dotted=async reporting) carry that
distinction instead. Also shortened edge labels on the trust-boundary
diagram to avoid the same clipping issue.
Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.
Completes the docs/ set - all 16 systems now have a full deep-dive
page in the diagram+callout+table style. Architecture overview covers
the 4 trust boundaries and 2 traffic planes; IaC pipeline is a fresh
Packer->Terraform->Ansible writeup replacing the stale old-content/
snapshot; disaster recovery covers the 3 independent backup layers
and the deliberately decoupled OS/app upgrade systems.
thesabear