Validated Designs & Configurations
Overview
Validated Designs (VDs) are production-ready configurations that have been:
-
Designed with security and scalability in mind
-
Implemented in the Domus Digitalis home enterprise
-
Tested under real-world conditions
-
Documented with exact commands and expected outputs
-
Maintained with version control and change tracking
|
Every configuration in this section has been deployed and validated. No theoretical designs. No untested configs. If it’s here, it works. |
Validation Status Legend
| Status | Meaning |
|---|---|
Deployed, tested, production-ready |
|
Deployed, validation in progress |
|
Design complete, pending deployment |
|
Superseded by newer design |
Disciplines
Network Infrastructure
| Design | Status | Description |
|---|---|---|
Draft |
CARP failover, VLANs, NAT, VPN |
|
Draft |
C9300/3560CX trunk, access, 802.1X |
|
Draft |
FlexConnect, WPA3-Enterprise, policy tags |
|
Draft |
Segmentation strategy, inter-VLAN routing |
|
Draft |
Split-horizon, DNSSEC, zone transfers |
Identity & Access Management
| Design | Status | Description |
|---|---|---|
Draft |
Windows Server 2025 Core, GPO, DNS integration |
|
Draft |
RHEL identity, Kerberos, sudo rules |
|
Draft |
OIDC/SAML, realm config, client federation |
|
Draft |
PAN/PSN/MnT, HA, profiling, posture |
|
Draft |
Switch config, ISE policy, certificates |
|
Draft |
WLC config, ISE policy, roaming |
|
Draft |
MAC bypass, profiling, dACL assignment |
|
Draft |
Device onboarding, RADIUS lookup, VLAN assignment |
PKI & Certificates
| Design | Status | Description |
|---|---|---|
Draft |
Root CA, Issuing CA, cert roles |
|
Draft |
Short-lived certs, principals, host verification |
|
Draft |
Client certs, SAN, key usage, renewal |
|
Draft |
Web services, API endpoints, auto-renewal |
|
Draft |
Git commits, container images, scripts |
Secrets Management
| Design | Status | Description |
|---|---|---|
Draft |
v3 hierarchy, team sharing, git sync |
|
Draft |
Path structure, policies, AppRole |
|
Draft |
Environment sourcing, age encryption |
|
Draft |
Automated rotation, notification, validation |
Virtualization & Compute
| Design | Status | Description |
|---|---|---|
Draft |
VM provisioning, CPU pinning, storage pools |
|
Draft |
User-data, network config, first-boot |
|
Draft |
Hardened base, SELinux, minimal install |
|
Draft |
Development environment, dotfiles, tooling |
Kubernetes & Containers
| Design | Status | Description |
|---|---|---|
Draft |
3-node control plane, embedded etcd |
|
Draft |
eBPF, network policies, Hubble |
|
Draft |
L2 mode, IP pools, service announcements |
|
Draft |
TLS termination, middleware, routing |
|
Draft |
Sidecar secrets, annotations, templates |
|
Draft |
App-of-apps, sync policies, RBAC |
|
Draft |
Dynamic provisioning, access modes |
Observability & SIEM
| Design | Status | Description |
|---|---|---|
Draft |
Manager, indexer, dashboard, agents |
|
Draft |
kube-prometheus, ServiceMonitors, alerts |
|
Draft |
Infrastructure, k8s, application metrics |
|
Draft |
Routing, receivers, silences |
|
Draft |
Syslog, Filebeat, index lifecycle |
Storage & Backup
| Design | Status | Description |
|---|---|---|
Draft |
Shares, NFS exports, permissions |
|
Draft |
Deduplication, encryption, pruning |
|
Draft |
Snapshots, restore procedures |
|
Draft |
Local, NAS, offsite/cloud |
|
Draft |
RTO/RPO, runbooks, testing |
Automation & IaC
| Design | Status | Description |
|---|---|---|
Draft |
Roles, inventory, vault integration |
|
Draft |
KVM, Vault, Cloudflare providers |
|
Draft |
GitHub Actions, GitLab CI, deployment |
|
Draft |
Linting, secrets detection, formatting |
Documentation Platform
| Design | Status | Description |
|---|---|---|
Draft |
Aggregator, spoke repos, playbooks |
|
Draft |
Attributes, includes, partials |
|
Draft |
Styling, themes, CI rendering |
|
Draft |
Deployment, Access policies, DNS |
CLI Tooling
| Design | Status | Description |
|---|---|---|
Draft |
ISE, pfSense, WLC, Synology automation |
|
Draft |
Age encryption, environment sourcing |
|
Draft |
zsh, aliases, functions, completions |
|
Draft |
GNU Stow, git sync, machine-specific |
Design Document Template
Each validated design follows a standard structure:
-
Overview - What problem does this solve?
-
Architecture - Diagrams, components, data flow
-
Prerequisites - Dependencies, credentials, access
-
Configuration - Exact commands with expected output
-
Validation - How to verify it works
-
Troubleshooting - Common issues and fixes
-
Maintenance - Upgrades, backups, rotation
-
References - Vendor docs, RFCs, related designs
See Validated Design Template for the full structure.