Home Network

A single serene control pane floating in a quiet haus: one clean gauge showing the network online and protected, a shielded router glowing softly, mesh nodes as small steady stars. Tommy the Abyssinian sits beside it watching the green light, entirely unbothered.

Green. That is the whole promise.

Tommy the Abyssinian used to sit by the router and watch the little light without blinking — fifteen years of the same unbothered vigil. sanctum net home is that vigil rendered as a command: one pane, one question, no drama. Is the haus online and protected right now?

Not a cutover wizard. Not a speed-test sermon. One glance at the everyday surface, and one action that only applies fixes which cannot strand you.

sanctum net home

What you see

The pane is a rollup, not a firehose. Five rows, each answering a question you would otherwise SSH into the Firewalla to ask.

Row	Meaning
Internet	TLS samples — Fastly/PyPI (CDN path) and Google (control). If CDN fails while Google works, the path MTU/MSS guard is the usual suspect
WAN path	How the Firewalla reaches the internet (`pppoe`, public Ethernet / ADMZ-class, or private double-NAT)
CDN guard	Firewalla TCP MSS 1400 + `tcp_mtu_probing` — keeps Fastly/PyPI (and similar CDNs) healthy on Bell PPPoE
Armor	Single-NAT armor rollup (`HEALTHY`, poison routes, etc.)
Hub (optional)	Whether the ISP hub (`192.168.2.1` by default) is reachable. Unreachable under PPPoE bridge is normal, not a failure

The five rows resolve to one word at the top:

GREEN — online and protected
ATTENTION — works now; optional improvements
DEGRADED — something is broken right now (e.g. CDN TLS down)

sanctum net home status
sanctum net home status --json

Safe improve

When the pane nudges toward ATTENTION, improve is the one lever you can pull without a second thought.

sanctum net home improve
sanctum net home improve --force    # re-assert even when green
sanctum net home improve --dry-run  # print intent only

Does: re-assert Firewalla MSS 1400 + tcp_mtu_probing (and the persist script when present).

Does not: Advanced DMZ, PPPoE ↔ DHCP, hub reboot, or any WAN mode change.

That split is deliberate — the beta/dogfood surface never drops the haus for a speed experiment. The dangerous knobs live behind their own gated doors, on purpose.

sanctum net home doctor
sanctum net home doctor --apply   # status + safe improve if needed

How this fits the other `net` commands

home is the front porch. The rest of the net family goes deeper the further you walk in — reach for them only when the pane sends you.

Command	Role
`sanctum net home`	Daily “is the haus OK?” + safe CDN guard
`sanctum net status`	Deeper node roll-up (posture, heal daemon, identity, guardian)
`sanctum net check` / `optimize`	NAT topology and guided single-NAT playbooks
`sanctum net speedtest`	Honest multi-stream ceiling
`sanctum net single-nat`	Attended Advanced DMZ cutover (separate, gated)

Start with home. The Firewalla architecture explains what sits behind these rows; Diagnosing Your Network is where you go when a row turns red.

Why CDN TLS used to hang on Bell

This row exists because of a real bad week. Bell PPPoE leaves a 1492 path MTU. A TCP MSS of 1452 is the textbook clamp and is often enough — but some CDNs (Fastly hosts PyPI, Reddit, and friends) still failed TLS until MSS was tightened to 1400. The fix is applied on the Firewalla and re-asserted by home improve; it is not a PyPI outage and not a Firewalla blocklist.

For the /1 netmask story (Advanced DMZ + 10.x LAN), see The Slash-One That Ate the LAN. For speed-test honesty, see The Speed Test That Cried Slow.

Advanced DMZ (not in `home improve`)

Optional speed / topology upgrade stays a separate attended flow:

sanctum net single-nat --check
# only when preflight is green and net.single_nat_live is armed
sanctum net single-nat --apply

Hub management is often unreachable from the haus LAN while the hub is bridged and Firewalla owns PPPoE. That requires a dual-homed operator machine (Ethernet to hub + Wi‑Fi to the haus) — not something home improve will ever start for you.

Instance knobs

In ~/.sanctum/instance.yaml:

devices:
  hub:
    brand: sagemcom
    host: 192.168.2.1          # pin hub for SAH when dual-homed
  firewalla:
    host: 10.0.0.1
    ssh_user: pi
    ts_addr: 100.0.0.X         # Tailscale OOB recovery (your firewalla's tailnet IP)
paths:
  armor_kit_dir: ~/Projects/Claude_Code/sanctum-singlenat-armor
net:
  isp: bell
  single_nat_live: false         # keep false until an attended ADMZ night

The whole design earns its keep on the day you glance, see green, and go make coffee. That was always the point — the vigil runs so you do not have to. Tommy would approve, from wherever the warm rectangle of light is now.