Site A Build Phases
Clean-slate A0-A11 Site A sequence from the working UCG Max bootstrap island through OPNsense, the L2 fabric, Proxmox, storage, and Kubernetes.
Site A is built as a sequence of evidence gates. A phase changes target intent into current state only after its completion tests are observed and recorded. Site B is parked and unchanged.
| Phase | Name | Completion signal |
|---|---|---|
| A0 | Preserve bootstrap | UCG/XG6 exports, WAN/SSID/reservation record, labels, rollback cable map |
| A1 | Sequential host bootstrap | all four hosts and both BMCs proven through XG6 p4; physical NIC identities confirmed |
| A2 | Edge services staging | OPNsense, UOS, and Bao healthy behind UCG |
| A3 | Target-only switch adoption | UOS target VLAN-10 path is live; all three XG10s are adopted at final addresses through the loop-free target tree; none connects to UCG/XG6 |
| A4 | Target LAN commissioning | remaining OPNsense VLANs, DHCP/DNS/NAT, and allowed/denied policy tests pass on the A3 tree |
| A5 | Control-plane migration | UOS bootstrap vNIC retired; Bao, management, and IPMI migrated without losing control |
| A6 | RSTP closure / validation | third DAC closes the triangle; each single-DAC loss passes |
| A7 | Wi-Fi / client migration | AP, SSIDs, and clients pass on final VLANs while UCG feeds OPNsense WAN |
| A8 | WAN-only handoff | ONT on OPNsense; two full validation passes; UCG/XG6 retired |
| A9 | sa-pve cluster | final VLAN 20/25 addressing and stable local quorum |
| A10 | storage/services | ZFS, PBS-A, DNS, and monitoring pass service gates |
| A11 | Kubernetes/OpenShift | nodes/VIPs deploy without address overlap or policy bypass |
No Phase Skipping
Do not close the switch triangle before RSTP is staged, move the ONT before the
complete wired and wireless target passes, or form sa-pve before final management and Corosync
addresses are correct.
Fixed Target Invariants
- OPNsense owns every routed Site A gateway, DHCP scope, and stateful rule.
- The three switches remain L2-only.
- VLANs 25 and 60 have no gateway; 65 is reserved and not carried.
- VLANs 253 and 4040 are absent; VLAN 999 is an unrouted native sink.
- UCG feeds OPNsense WAN through A7; every target endpoint already uses final
10.10.xnetworks before the A8 WAN-only handoff. - XG6 stays separate from the target fabric: p4 is a one-endpoint service lead and p5/p6 stay disconnected. No XG10 ever connects to UCG Max or XG6.
- All applies that can break connectivity require local console access.
See Migration Phases, Site A Port Map, and Current Build State.
sa-edge-01 Bootstrap Runbook
Step-by-step Site A edge-node runbook covering IPMI, Proxmox, bridges, hardening, OPNsense, UOS, OpenBao, and verification gates.
Current Build State
Dated Site A snapshot: working UCG Max bootstrap island, live edge VMs, and approved-but-not-yet-production OPNsense/L2 target as of 2026-07-26.