Purpose
07 — Authentication
Last updated: 2026-09-05 · Status: 🚧 Draft · Owner: TBD
Purpose
How identity works in the home network: which system is authoritative for users, how devices get in (Wi-Fi, RADIUS, VPN), and where secrets live. Never store actual passwords here — use SEE:PM: references.
Identity stack
| Component | Role | Access | Notes |
|---|
| Tailscale | Device mesh / zero-config VPN | tailscale login | primary remote access |
| WireGuard (on firewall) | VPN to home subnet | SEE:PM:wg-keys | fallback |
| Samba / NAS shares | File auth | user:password (SEE:PM:nas) | |
| RADIUS (for Wi-Fi) | 802.1X on SSID: TBD | SEE:PM:radius-secret | enabled? yes/no |
| Authelia / Authelia-like | Web auth proxy | http://10.0.x.x | for self-hosted UIs |
| Home Assistant auth | local users + MFA | SEE:PM:ha-admin | see 08 |
Access paths & rules of thumb
| Who / what | How they get in | What they can reach |
|---|
| Family members | Wi-Fi personal + Tailscale | LAN, media, own files |
| Guests | Guest SSID only | Internet only (isolated) |
| IoT devices | IoT SSID (pre-shared key) | Internet + HA (allowed by firewall) |
| Admin (me) | Tailscale / WG + MFA | Everything incl. MGMT |
| Cameras | none (no creds) | Push to NVR only |
Users & groups
| User | Accounts | Groups / roles | MFA | Notes |
|---|
| me | tailscale, nas, ha, authelia | admin | yes (TOTP) | |
| family-1 | nas, media | user | no | |
| family-2 | nas, media | user | no | |
| (service acct) | ha-camera, restic | service | n/a | least privilege |
MFA & secrets
- Primary MFA: TBD (TOTP / WebAuthn / both) — recovery codes: SEE:PM:mfa-recovery
- Password manager: TBD app, master: SEE:PM:master-ref
- Wi-Fi keys: SEE:PM:wi-fi-main, SEE:PM:wi-fi-iot, SEE:PM:wi-fi-guest
- Device admin passwords (switch, firewall, NAS): SEE:PM:
<device>-admin - Certificate / key material (if 802.1X or DoT): SEE:PM:
<name>, expiry TBD
Password policy (house rules)
- One password per device, no reuse across roles.
- Admin accounts always have MFA.
- Rotate Wi-Fi PWK on: leaving the house, anyone knowing it + leaving.
- Service accounts have the minimum permissions that work.
Change log
| Date | Change | Why |
|---|
| 2026-09-05 | Boilerplate created | — |
Source Disclaimer