This is how Albgott decides who's allowed in.

Everything else on this page is a variation of one rule: traffic between managed networks is denied by default, and every exception is an explicit, named rule — a source, a destination, a port. Nothing is reachable because two things happen to share a network; it's reachable because a rule for exactly that flow exists on the router.

That applies to the router itself, not just what passes through it. Direct access is limited to established connections, the two VPN tunnels, admin access from an explicit allow-list, and ICMP — everything else is dropped before it's even considered.

Remote access runs over two separate WireGuard tunnels rather than one VPN with permission tiers: wg-corp for normal use, wg-admin for infrastructure administration. Neither joins a VLAN directly — a connecting device gets an address on a routed overlay, and the router filters on that address exactly like it would any other network.

The split is about who's on the other end as much as what they can reach. I collaborate with people who aren't me, and wg-corp is what they connect through — it reaches internal tools and nothing past that. wg-admin is the only path to the infrastructure control plane, and no collaborator ever gets it. A compromised device on wg-corp cannot reach a hypervisor console; that's the entire point of the split.

Two identity providers exist and both work today, for different reasons. Authentik is the long-term target — everything on this platform is meant to eventually authenticate through it. Zitadel exists for a narrower, forward-looking reason: it's ready for whenever a public-facing app needs its own identity layer, with real multi-tenant support (isolated users, projects, and settings per organization) built in from the start.

Infisical runs as a real, reachable secrets-management service, internal only — the goal is simple: stop keeping credentials in plaintext inside config and compose files scattered across hosts, and give them one managed home instead.

Migration is deliberate and ongoing, not finished: deciding which secrets move, then updating what consumes them to treat Infisical as the source of truth only once it actually is one. This matters most exactly where it's riskiest to get wrong — CI. Build agents sit in their own isolated network segment with narrow, explicit outbound rules, and nothing lets a compromised build reach anything management-plane.

Security and observability aren't separate stacks here — the same monitoring covered on /operations is also what would notice most access-related problems first. Active checks run from outside the network as well as inside it, so a misconfiguration shows up independently of whatever the metrics pipeline reports. Alerts route to a single phone, with criticals firing faster and duplicate warnings for the same host suppressed — a real problem gets heard once, loudly, not scattered across systems.

The honest gap: none of this is purpose-built security monitoring. There's no dedicated alerting today for repeated failed logins, unusual VPN peer activity, or firewall rule drift — general observability would likely catch a lot of that incidentally, but "would probably notice" and "is explicitly watching for it" are different claims, and this page means to keep being honest about which one is actually true.

Consolidating the honesty from every section above into one place, because burying gaps across five subsections would defeat the point of having this page at all.