How it works — NETSetup

1. How it works

Architecture internals are documented in docs/NETSetup-Specification.adoc → How it works:

Specification Chapter Summary

Specification Chapter	Summary
Company → Config translation	6-stage pipeline (`Customers/<Name>.cs` → `Company` → `LiberatorWithWinDCTranslator` → `/24` IP plan + implicit 5-VM Liberator stack → overrides → `#<ticket>.json` + `.map` files).
Netconfig as a database	V5 `IVirtualizationUnitOfWork` synchronisation between `NETSetup.DataStore.NETConfig` (JSON desired state) and `HyperVVmDataStoreReference5` / `ProxmoxVmDataStoreReference5`, two-step soft delete (`IPermanentDeletions<T>`), host slicing, and `[#hyperv-firmware]` OS-driven Hyper-V firmware.
Windows node capabilities & lab nodes	`NETSetupConfig.WindowsCapabilities` (`EnableWinRm`, `InstallWsl`, `DockerAutoStart`, `DomainOuPath`, `LocalGroupMembers`), shared reusable ISO rebuild, `NETSetup.kdbx` secrets, lab nodes `#9153`-`#9159`, and CI build node checklist.
Proxmox VM provisioning during update	`EnsureCustomerVms` + `EnsureCustomerLxcs` during `netsetup update`: NixOS flow (booting `nixos.iso`, `NixTemplateFactory`, sops + LUKS TPM unlock), Windows flow (offline/reusable ISO), OPNsense flow + VLAN cutover, and sequence diagram `src/NETSetup/docs/NETSetupProvisionVms.puml` (`NETSetupProvisionVms.pages.adoc`).
NixOS + Proxmox stacking & NixOS entity model	Why Proxmox host + NixOS VMs is standard; `NixHostModel` / `NixModelTemplate` data-driven host definition.
Wake-on-LAN, Linux PE & Diagrams	WoL integration (`WOL.adoc`), Void Linux musl UnixPE boot chain (`void-linux-pe.adoc`), and PlantUML sequence/network diagrams.
How the domain join actually run	Stage 3 gates, DC DNS pinning, Path A (`Add-Computer -OUPath`) vs Path B (WMI `JoinDomainOrWorkgroup`), and `djoin` fallback.
Company model & organisation standards	Customer template vs `Customers/*.cs` graph and comparison with W3C ORG, OASIS CIQ, eCH-0097, GLEIF LEI, SCIM 2.0.

6-stage pipeline (Customers/<Name>.cs → Company → LiberatorWithWinDCTranslator → /24 IP plan + implicit 5-VM Liberator stack → overrides → #<ticket>.json + .map files).

Netconfig as a database

V5 IVirtualizationUnitOfWork synchronisation between NETSetup.DataStore.NETConfig (JSON desired state) and HyperVVmDataStoreReference5 / ProxmoxVmDataStoreReference5, two-step soft delete (IPermanentDeletions<T>), host slicing, and [#hyperv-firmware] OS-driven Hyper-V firmware.

Windows node capabilities & lab nodes

NETSetupConfig.WindowsCapabilities (EnableWinRm, InstallWsl, DockerAutoStart, DomainOuPath, LocalGroupMembers), shared reusable ISO rebuild, NETSetup.kdbx secrets, lab nodes #9153-#9159, and CI build node checklist.

Proxmox VM provisioning during update

EnsureCustomerVms + EnsureCustomerLxcs during netsetup update: NixOS flow (booting nixos.iso, NixTemplateFactory, sops + LUKS TPM unlock), Windows flow (offline/reusable ISO), OPNsense flow + VLAN cutover, and sequence diagram src/NETSetup/docs/NETSetupProvisionVms.puml (NETSetupProvisionVms.pages.adoc).

NixOS + Proxmox stacking & NixOS entity model

Why Proxmox host + NixOS VMs is standard; NixHostModel / NixModelTemplate data-driven host definition.

Wake-on-LAN, Linux PE & Diagrams

WoL integration (WOL.adoc), Void Linux musl UnixPE boot chain (void-linux-pe.adoc), and PlantUML sequence/network diagrams.

How the domain join actually run

Stage 3 gates, DC DNS pinning, Path A (Add-Computer -OUPath) vs Path B (WMI JoinDomainOrWorkgroup), and djoin fallback.

Company model & organisation standards

Customer template vs Customers/*.cs graph and comparison with W3C ORG, OASIS CIQ, eCH-0097, GLEIF LEI, SCIM 2.0.