πŸ”€ Change Records

Change Records #

One record per significant change to a site: what was changed and why, the end state it aimed for, the procedure, how to undo it, and what actually happened.

The runbook and these records hold different kinds of information. The runbook is maintained: procedures and templates, kept current, and edited whenever reality changes. A change record is retained: evidence of a change made on a given day. It is written once and then left alone, apart from follow-ups closing. Incidents are kept the same way, under Incident Records.

New records start from the change record template. Change Management says when a change needs one.


Records #

IDDateChangeTypeSiteStatus
CHG-0066UnscheduledThe Management Hypervisor Moves to Proxmox VE 9UpgrademobilePlanned
CHG-00652026-11-12Removing a Tenant Leaves Nothing BehindDeploymentmobileComplete
CHG-00642026-11-12The Inventory Vault Under a New PasswordConfigurationmobileIn progress
CHG-00632026-11-12The Core Router’s Untagged LAN Loses Its Flat-Network AddressDecommissionmobileComplete
CHG-00622026-11-11Router and Wi-Fi Controller Backed Up After Every ChangeDeployment Β· ConfigurationmobileComplete
CHG-00612026-11-11The Core Router Restored From Its Vaulted BackupConfigurationmobileComplete
CHG-00602026-11-09An Operator Reissue of a Tenant’s State SecretDeploymentmobileComplete
CHG-00592026-11-07The Secret Store Refuses Reserved NamesConfiguration Β· DeploymentmobileComplete
CHG-00582026-11-04Windows Tenant LaptopsDeployment Β· ConfigurationmobileComplete
CHG-0057UnscheduledBuild the Home SiteDeployment Β· ConfigurationhomePlanned
CHG-00562026-10-25A Deevnet Pi by Default, With a Starter PKI KitDeploymentmobileComplete
CHG-00552026-11-01Existing Tenants Reissued Under Site-Less NamesConfiguration Β· MigrationmobileComplete
CHG-00542026-10-25Tenant Names Without a SiteDeployment Β· ConfigurationmobileComplete
CHG-00532026-11-08OpenBao Sealed by Shamir SharesConfigurationmobileComplete
CHG-00522026-10-25A Sealed OpenBao Is Unavailable, Not a Lost SecretDeploymentmobileComplete
CHG-00512026-10-18The Take-Home Image on deevnet-kit 0.12.0DeploymentmobileComplete
CHG-00502026-10-18Extra Names on a Pi’s Certificate (deevnet-kit 0.12.0)DeploymentmobileComplete
CHG-00492026-10-18The Take-Home Image on deevnet-kit v0.11.0DeploymentmobileComplete
CHG-00482026-10-18A Switch Port for dv02rpi003p01ConfigurationmobileComplete
CHG-00472026-10-11Server Certificates for Tenants’ ServicesDeployment Β· ConfigurationmobileComplete
CHG-00462026-10-10Tenant-Facing Services on 443Deployment Β· ConfigurationmobileComplete
CHG-00452026-10-10A Service Name for GrafanaConfigurationmobileComplete
CHG-00442026-10-06Fixed Addresses for Tenants’ DevicesDeployment Β· Configuration Β· MigrationmobileComplete
CHG-0043UnscheduledA Local Package MirrorDeployment Β· ConfigurationmobilePlanned
CHG-0042UnscheduledTwo Undeclared VMs Moved Off the Management HypervisorMigrationmobilePlanned
CHG-0041UnscheduledThe Artifact Server Over HTTPSConfigurationmobilePlanned
CHG-0040UnscheduledDevice Secrets in Tenant CodeDeployment Β· MigrationmobilePlanned
CHG-00392026-10-07Backup to an Attached USB DriveDeploymentmobileIn Progress
CHG-0038UnscheduledThe Reconcile Restores EverythingDeployment Β· ConfigurationmobilePlanned
CHG-00372026-11-08Substrate Builds Off OpenBaoConfigurationmobileIn Progress
CHG-00362026-10-25OpenBao’s Keys From the VaultConfigurationmobileComplete
CHG-00352026-10-06Previously Exposed Credentials Checked and RotatedConfigurationmobileComplete
CHG-0034UnscheduledDevice Certificates Through the Deevnet APIDeployment Β· ConfigurationmobilePlanned
CHG-00332026-10-03The Deevnet PKIConfigurationmobileComplete
CHG-00322026-10-02The Appliances on Site CertificatesConfigurationmobileComplete
CHG-00312026-10-02The Site Root and Its IntermediateConfigurationmobileSuperseded
CHG-00302026-09-27The State Store Over TLSConfigurationmobileComplete
CHG-00292026-09-27One Key per Tenant on DVNTM-TDConfigurationmobileComplete
CHG-00282026-09-27Tenants Log In to Their Own WorkloadsDeploymentmobileComplete
CHG-00272026-09-25A Switch Port for dv02rpi004p01ConfigurationmobileComplete
CHG-00262026-09-25Build Secrets Off the DiskConfigurationmobileComplete
CHG-00252026-09-24Tenant DownloadsDeployment Β· ConfigurationmobileComplete
CHG-00242026-09-24Tenant DashboardsDeployment Β· ConfigurationmobileComplete
CHG-00232026-09-23Internet Means InternetConfigurationmobileComplete
CHG-00222026-09-23The Tenant Dev NetworkConfigurationmobileComplete
CHG-00212026-09-22The MQTT Log BridgeDeploymentmobileComplete
CHG-00202026-09-22The API Issues Tenant Log TokensDeployment Β· ConfigurationmobileComplete
CHG-00192026-09-22Strip the Log Store to Tenant ScopeConfiguration Β· DecommissionmobileComplete
CHG-00182026-09-21The Central Log StoreDeployment Β· ConfigurationmobileComplete
CHG-00172026-09-20Retire MosquittoConfiguration Β· CleanupmobileComplete
CHG-00162026-09-20The API Writes Broker AccountsDeployment Β· ConfigurationmobileComplete
CHG-00152026-09-20The VerneMQ BrokerDeploymentmobileComplete
CHG-00142026-09-20The Tenant Device RegistryDeploymentmobileComplete
CHG-00132026-09-18Tenant Wi-Fi PPSK KeysDeploymentmobileComplete
CHG-00122026-09-18Operator Access to Tenant WorkloadsConfigurationmobileComplete
CHG-00112026-09-17Tenant Workloads Get a ResolverConfiguration Β· DeploymentmobileComplete
CHG-00102026-09-17Deploy the Deevnet API and Cut Tenants OverBuild-out and migrationmobileComplete
CHG-0009UnscheduledAccess Switch Omada AdoptionMigrationmobilePlanned (on hold)
CHG-00082026-09-15Management Domain VMs, First BuildDeployment Β· DecommissionmobileComplete
CHG-00072026-09-19Core Router Zone Policy, First ApplicationConfigurationmobileComplete
CHG-00062026-09-16Access Switch Firmware UpgradeUpgrademobileComplete
CHG-00052026-09-15Wireless AP Firmware and Omada AdoptionMigrationmobileComplete
CHG-00042026-09-10Omada Controller UpgradeUpgrademobileComplete
CHG-00032026-09-05Host Rename (ADR-0008)MigrationmobileComplete
CHG-00022026-03-26Authority Transition ReworkConfigurationmobileComplete
CHG-00012026-03-21Flat Network β†’ VLANsMigrationmobileComplete

Records are numbered CHG-NNNN in the order they are opened, like ADRs: the number is global, never reused, and is how a record is cited. They are grouped by year, and each carries the date execution started.

Retrospective records #

Changes made before this section existed are written up retrospectively. Each one is rebuilt from the plan that drove the change, the automation logs, and git history, and says so at the top. A retrospective record reshapes what was captured at the time. Where the original material is silent, the record says so rather than filling the gap.

Page last modified: November 12, 2026