Pulled every pfSense child note (Default Policy, Proxmox Firewall Usage,
VM-Level Firewalld Strategy, WAN Rules, Security Tooling, Failure Impact,
HAProxy, Aliases, DNS & Resolver Config, LAN Rules, NAT, VPN), not just
the originally-scoped subset. Live-verified firewalld defaults, SSH
rich-rule restrictions, and Vault's per-client rules directly against
the running hosts - all matched exactly.
Caught and fixed a real staleness bug in the KB itself: WAN Rules and
Security Tooling (both dated a week old) still described CrowdSec as
active, but the more recent Aliases note (updated yesterday, checked
against pfSense's actual config.xml) confirmed the package has been
fully purged. Fixed both stale notes and the public doc, which had
already inherited the wrong claim.
Folded in the staged PAM defense-in-depth note properly - found the
fuller, better story directly in the Ansible role's source comments
(the bug hit twice, on two different hosts, before the permanent fix).
Added the LAN lockdown narrative this doc was missing, the DNS
bypass-block defense-in-depth story, and the this-week port-alias
conversion. Cut two redundant Mermaid diagrams. Added real evidence:
four pfSense screenshots already validated for architecture-overview.md
reused here since they directly prove this doc's own claims, plus two
real firewall-cmd command outputs from live verification this session.
thesabear
033140f65d