Site-to-site network role boundaries standard¶
Purpose¶
Norms for trust zones, SITE_HOME vs SITE_FARM roles, and what crosses the WAN vs stays local—aligned with Network segmentation, site-to-site, and internet exposure — two-site smart farm (exposure table) and Execution topology package — two-site smart farm (Mermaid).
Standard¶
| # | Rule |
|---|---|
| 1 | Document Z1/Z2/Z3 (or equivalent) per site—admin, telemetry, guest/user traffic do not share implicit trust. |
| 2 | SITE_HOME may host control plane / central backup landing; SITE_FARM edge assumes constrained power and WAN (Central vs local backup scope). |
| 3 | Field telemetry must operate local-first for welfare-critical signals per off-grid doctrine where applicable—WAN is not the sole proof path. |
| 4 | Site-to-site link (VPN / tailnet / SSH bastion ) terminates in a known segment—no flat LAN across counties without documented exception. |
| 5 | Internet exposure table (cameras , broker , farmOS ) stays current when services move—see segmentation analysis for fill-in template. |