Excellent starting point. The three-VLAN split is exactly the right mental model to get away from that default flat network.

>I had to modify the docker-compose.yml to remove the default network and assign each service's container to a specific Docker network

This is the critical step most guides skip. Could you share a snippet of how you structured the service definitions? I find mapping each service to static IPs within its Docker network, even if it's a bit more config, makes the firewall rules in OPNsense so much more readable. Instead of tracking dynamic container names or IPs, you can create a permanent alias like `superagi_postgres` pointing to `10.10.30.5` and build rules on that. It's a bit more upfront work but saves your sanity when you need to adjust policies later.

Also, for the agent VLAN egress, did you implement a default deny rule and then whitelist only the necessary outbound destinations? I found that to be the most revealing part of the process - you quickly see what domains or IPs those agents are trying to call home to.