# Warden Network Model

Use this file when planning or validating the host-side network used by Bastille
and Warden.

## Canonical addresses

- bridge: `warden0`
- subnet: `192.168.100.0/24`
- host gateway: `192.168.100.1`
- control-plane: `192.168.100.100`
- workers: `192.168.100.101+`

## Design intent

- `controlplane` is the thick persistent control-plane jail ID
- workers are thin and start after the control-plane is stable
- `networkedWorker` uses the same subnet with VNET
- browser automation later belongs to a separate `bhyve` Linux VM

## Host assumptions

- public uplink: `vtnet0`
- host Tailscale interface: `tailscale0`
- bridge for Warden: `warden0`

## Ordering

1. create `warden0`
2. assign `192.168.100.1/24`
3. enable forwarding
4. add minimal `pf` NAT
5. create or start `controlplane`
6. validate egress from inside the jail

## Why this is the canonical model

This keeps bootstrap and future deployment aligned:

- same bridge in docs, code, and Bastille steps
- same control-plane address every time
- workers can scale later without redesign
