Procure ifrit and build the playground — after the main network is finished

[Gerrrt]

Two entries that are one decision:

• Procure ifrit, a second server for the isolated playground network.
• Build the playground — the deliberately-vulnerable range for practising
  offensive work.

ADR-0007 splits the estate into a defensive side (the network the house depends
on) and an offensive range, and is explicit that the range "requires a second
machine that does not yet exist". ADR-0007:73-76 also defers ifrit's
isolation mechanism: physically separate, a dedicated VLAN with no route, or
virtualised — "not settled here … deferred deliberately".

That deferral is the real content of this issue. Everything else is a purchase.

The ordering constraint, from the roadmap

Build the playground — only after the main network is finished.

Which is the right call, and worth keeping visible: this repository started as a
place to practise security work and became the network the house depends on. A
broken experiment is a learning opportunity; a broken DHCP server is a domestic
incident. The range is the thing that reintroduces that risk, so it goes last
and it goes behind an isolation mechanism that has been decided in advance.

Related: whether VLAN 30 needs egress filtering is the same question asked from
the other side.

Tracked in docs/roadmap.md; filed as an issue so it has a place to be discussed and closed.

[Gerrrt]

A small practical note for when this gets built, from the selfh.st directory.

ADR-0007 specifies that ifrit is "sized for on-demand use and powered off between sessions". That is the right call — it is the property that keeps the offensive range from being a permanently-running attack platform on the house network — but it leaves an obvious question: how does it get turned on, given it is not going to be reachable by any of the usual means when it is off.

UpSnap MIT (~6.2k stars) — a Wake-on-LAN web app with scheduling and a device list. Small, single container.

Two things that make this less trivial than it sounds here:

1. WoL is a broadcast on the local segment. A magic packet from Hicks (50) will not reach a machine on ifrit's segment unless something forwards it — either a directed broadcast through pfSense, or the sender sits on the same segment. That is a firewall decision, and it is one that has to be made for the segment whose isolation ADR-0007 deliberately left unsettled. Worth folding into that deferred decision rather than discovering it afterwards.
2. It is an unauthenticated power-on primitive. Anything that can send the packet can start the attack range. On a segment that is meant to be the most isolated thing in the estate, that deserves a moment's thought — the alternative being IPMI/iLO-style out-of-band power control, or simply walking over and pressing the button, which for a machine used a few times a month is a perfectly respectable answer.

Filing this as a note rather than an issue because it is a detail of this one, and because "press the button" may well win.

---

Generated by Claude Code