first commit and build

docs/network/firewall.md

@@ -0,0 +1,21 @@
+# Firewall
+
+Zone-based policy on the UDR7. Document the **intent** first, then the rules
+that implement it — future-you (mid-outage) needs the reasoning, not just a
+rule dump.
+
+## Policy matrix
+
+| From \ To | Management | Trusted | IoT | Guest | WAN |
+|---|---|---|---|---|---|
+| Management | — | allow | allow | allow | allow |
+| Trusted | deny | — | allow | deny | allow |
+| IoT | deny | deny | — | deny | allow* |
+| Guest | deny | deny | deny | — | allow |
+
+\* IoT to WAN often restricted to specific destinations. Document exceptions.
+
+## Rationale
+
+Explain each non-obvious allow/deny: why IoT can't reach Trusted, which
+management exceptions exist, and any per-device carve-outs.

docs/network/index.md

@@ -0,0 +1,8 @@
+# Network
+
+The homelab runs on a UniFi UDR7 with a segmented VLAN design and a
+zone-based firewall policy. This section is the reference for that design.
+
+- [Topology](topology.md) — physical + logical layout
+- [VLANs & Subnets](vlans.md) — the segmentation plan
+- [Firewall](firewall.md) — inter-zone policy and rationale

docs/network/topology.md

@@ -0,0 +1,27 @@
+# Topology
+
+!!! note "Template"
+    The diagram below is a scaffold. Replace the nodes/edges with your actual
+    layout. It renders automatically — Material draws ` ```mermaid ` blocks.
+
+```mermaid
+graph TD
+    WAN[Internet] --> UDR7[UniFi UDR7]
+    UDR7 --> SW[Aggregation Switch]
+    SW --> AP[Access Points]
+    SW --> VLAN_MGMT[VLAN 10 · Management]
+    SW --> VLAN_TRUST[VLAN 20 · Trusted]
+    SW --> VLAN_IOT[VLAN 30 · IoT]
+    SW --> VLAN_GUEST[VLAN 40 · Guest]
+```
+
+## Physical
+
+| Device | Model | Location | Notes |
+|---|---|---|---|
+| Gateway | UniFi UDR7 | _rack_ | _replace with real detail_ |
+| Switch | _model_ | _location_ | _uplinks / PoE_ |
+
+## Logical
+
+Describe uplinks, tagged/untagged ports, and where each VLAN is trunked.

docs/network/vlans.md

@@ -0,0 +1,18 @@
+# VLANs & Subnets
+
+!!! warning "Fill in real values"
+    The rows below are an **example format**, not your live plan. Replace them
+    with your actual VLAN IDs, subnets, and gateways. On the private site this
+    is fine; keep the [public portfolio version](../index.md) sanitized.
+
+| VLAN | Name | Subnet | Gateway | DHCP | Purpose |
+|---|---|---|---|---|---|
+| 10 | Management | 10.0.10.0/24 | 10.0.10.1 | reserved | Switches, APs, UDR7 UI |
+| 20 | Trusted | 10.0.20.0/24 | 10.0.20.1 | yes | Workstations, phones |
+| 30 | IoT | 10.0.30.0/24 | 10.0.30.1 | yes | Smart-home, Matter/Thread |
+| 40 | Guest | 10.0.40.0/24 | 10.0.40.1 | yes | Isolated guest access |
+
+## Notes
+
+- Reserved (static) leases: document them per device.
+- mDNS / service discovery across VLANs: note where it's allowed and how.