---
title: "07 — Authentication"
description: "## Purpose"
section: nanda
raw: "07-authentication.md"
source: ai-generated
tags: network, aruba, siemens, vlan
last-updated: 2026-09-15
---

# 07 — Authentication

> **Last updated:** 2026-09-05 · **Status:** 🚧 Draft · **Owner:** TBD

## Purpose

How identity works in the home network: which system is authoritative for users, how devices get in (Wi-Fi, RADIUS, VPN), and where secrets live. **Never store actual passwords here** — use `SEE:PM:` references.

## Identity stack

| Component | Role | Access | Notes |
|-----------|------|--------|-------|
| Tailscale | Device mesh / zero-config VPN | tailscale login | primary remote access |
| WireGuard (on firewall) | VPN to home subnet | SEE:PM:wg-keys | fallback |
| Samba / NAS shares | File auth | user:password (SEE:PM:nas) | |
| RADIUS (for Wi-Fi) | 802.1X on SSID: TBD | SEE:PM:radius-secret | enabled? yes/no |
| Authelia / Authelia-like | Web auth proxy | <http://10.0.x.x> | for self-hosted UIs |
| Home Assistant auth | local users + MFA | SEE:PM:ha-admin | see 08 |

## Access paths & rules of thumb

| Who / what | How they get in | What they can reach |
|-----------|-----------------|---------------------|
| Family members | Wi-Fi personal + Tailscale | LAN, media, own files |
| Guests | Guest SSID only | Internet only (isolated) |
| IoT devices | IoT SSID (pre-shared key) | Internet + HA (allowed by firewall) |
| Admin (me) | Tailscale / WG + MFA | Everything incl. MGMT |
| Cameras | none (no creds) | Push to NVR only |

## Users & groups

| User | Accounts | Groups / roles | MFA | Notes |
|------|----------|----------------|-----|-------|
| me | tailscale, nas, ha, authelia | admin | yes (TOTP) | |
| family-1 | nas, media | user | no | |
| family-2 | nas, media | user | no | |
| (service acct) | ha-camera, restic | service | n/a | least privilege |

## MFA & secrets

- Primary MFA: TBD (TOTP / WebAuthn / both) — recovery codes: SEE:PM:mfa-recovery
- Password manager: TBD app, master: SEE:PM:master-ref
- Wi-Fi keys: SEE:PM:wi-fi-main, SEE:PM:wi-fi-iot, SEE:PM:wi-fi-guest
- Device admin passwords (switch, firewall, NAS): SEE:PM:`<device>`-admin
- Certificate / key material (if 802.1X or DoT): SEE:PM:`<name>`, expiry TBD

## Password policy (house rules)

1. One password per device, no reuse across roles.
2. Admin accounts always have MFA.
3. Rotate Wi-Fi PWK on: leaving the house, anyone knowing it + leaving.
4. Service accounts have the minimum permissions that work.

## Change log

| Date | Change | Why |
|------|--------|-----|
| 2026-09-05 | Boilerplate created | — |

## Related

- [03 — Firewall Rules](/nanda/03-firewall-rules/)
- [06 — Wireless Network](/nanda/06-wireless/)
- [05 — Servers & Docker](/nanda/05-servers-and-docker/)

---

## Source Disclaimer

- [x] AI Generated
- [ ] Human Generated
- [ ] AI Edited
- [ ] Human Edited