This repository documents and configures a private home network. It is not a product and has no users other than its owner, so "supported versions" does not really apply — main is the only branch that means anything, and it is what the lab runs.

What is useful here is a clear answer to two questions: what to do if you spot a problem, and what is already known.

If you find a misconfiguration, a leaked credential, or a weakness in what is published here, please report it privately rather than opening a public issue:

• GitHub Security Advisories — open a draft advisory (preferred; it stays private until fixed)
• Failing that, a GitHub issue without details, asking for a contact.

Please do not open a public issue containing a working credential, a capture, or anything that would let someone else reach the network before it can be fixed.

This is a personal project, so there is no SLA. Realistically: acknowledgement within a few days, and credential exposure treated as urgent.

The lab is a home network, not a bug bounty target. Scanning, probing or attempting to reach any host described in docs/network.md is unwelcome and not authorised. Everything worth reviewing is in this repository — review the configuration, not the running system.

Documented rather than quietly fixed, because a known and written-down exposure is a very different thing from an overlooked one. Full detail in docs/security.md.

The switch is the honest gap. 10.7.7.2 has returned up == 0 for every scrape the monitoring stack has ever taken — all four SNMP series begin together when the stack was rebuilt, so the failure predates the rotation and is not evidence that the rotation broke anything. Nor is its silence evidence that the old community was removed. It is reachable at layer 3 on ICMP and TCP/80; only UDP/161 fails, which is the signature of a wedged SNMP agent rather than a dead device. Tracked separately in #22.

Remediation is tracked in docs/roadmap.md, with procedures in docs/runbooks/rotate-snmp-community.md and docs/runbooks/purge-git-history.md.

.gitleaksignore enumerates all nine historical findings individually, with a note on each. It exists so the full-history scan stays meaningful — a job that is permanently red for a known reason gets ignored, and then a genuinely new leak goes unnoticed alongside it. It is an acknowledgement, not a fix, and it gets deleted once the purge has run.

Deliberate omissions, so their absence is not mistaken for an oversight:

• Full MAC addresses. Truncated to the vendor OUI, which keeps the useful half and drops the unique identifier.
• Owner-linked device names, and no room labelled as a child's.
• Camera-to-room mapping. That there are cameras is fine; which one covers which door is not.
• The WAN address, firewall rule bodies, and Wi-Fi configuration.
• Any plaintext credential. Secrets are SOPS + age encrypted; the private key never enters the repository. See secrets/README.md.

Every push and pull request runs:

• gitleaks over the working tree and full history, with rules for SNMP communities, inline Grafana passwords, PEM private keys and age secret keys.
• An assertion that every secrets/*.sops.yaml is genuinely encrypted, which needs no ability to decrypt.
• An assertion that no rendered or decrypted artefact — .env, .rendered/, .purge-secrets.txt — is ever a tracked file.
• Verification that every container image is pinned by tag and digest, so a moved tag cannot silently change what is deployed.

See docs/security.md for the threat model and segmentation rationale.