Initial planning docs and hardening scripts for HA rebuild

Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path,
Ceph as the future HA storage upgrade, and baseline SSH/firewall
hardening.

docs/03-networking.md

@@ -0,0 +1,42 @@
+# Networking
+
+## Required separation
+
+Keep these on logically separate networks/VLANs, ideally separate NICs:
+
+- **Management** — web UI (8006), SSH
+- **Corosync** — cluster quorum. Low, *consistent* latency (well under
+  5ms) matters more than bandwidth. Never share with VM/storage traffic.
+- **Ceph public** — VM-to-OSD traffic (once Ceph is live)
+- **Ceph cluster/backend** — OSD-to-OSD replication, heaviest load
+
+## Practical layout
+
+2x 10/25GbE bonded or split:
+
+- Link pair A → Ceph (public + backend, or split further if 4 NICs
+  available)
+- Link pair B → management + corosync + VM traffic, with corosync on its
+  own VLAN even when sharing a physical NIC with the rest
+
+## Cluster join requirements
+
+- All nodes reachable to each other on SSH (22) and the corosync network
+- Same PVE version across nodes
+- NTP-synced clocks
+
+## Firewall
+
+Proxmox's built-in firewall operates at datacenter and node level.
+Default-deny, then whitelist:
+
+- SSH from the management network/VLAN only
+- Web UI (8006) from the management network/VLAN only
+- Corosync ports between cluster nodes
+- Ceph ports between cluster nodes (once Ceph is live)
+
+Enforce the network separation above at the firewall — corosync and Ceph
+traffic shouldn't be reachable from the VM network even if they end up
+sharing a physical link.
+
+See `config/pve-firewall/` for a starting rule set.