Tested live: AP isolation was already off on the TP-Link BE9300, and a
second wireless device (phone) failed identically to the laptop - rules
out isolation entirely. Real cause is the router's 4addr/WDS handling
not forwarding wireless-client broadcast/ARP traffic to pve-test's WDS
association, even though wired forwarding to it works fine. Since ARP
never resolves for wireless peers, this affects every protocol (web UI
included), not just ICMP - corrects an earlier draft of this doc that
speculated TCP might still work.
Found live: a laptop on the same wifi network as pve-test couldn't reach
it at all (no ARP entry, not stale) despite every wired device working
fine and the mgmt firewall already allowing ICMP - the router's AP/client
isolation was blocking wireless-to-wireless traffic. Router-side fix
only; nothing on pve-test to change for this symptom.
pve-test was briefly clustered with pve1 then deliberately de-clustered
so it could move to wifi-primary networking (4addr bridge mode, bonded
with a wired LAN backup) - a change not achievable while clustered given
corosync's latency requirements. Captures that as a reproducible script
plus docs: cluster separation procedure, the wifi network design and the
live-cutover pitfalls hit along the way, and node-role/history context.
Also adds CLAUDE.md guardrails for pve1 (production) vs pve-test
(sandbox) - this repo had none before, despite scripts here being able
to make real changes to both.
Separately: both nodes' mgmt firewalls were dropping ICMP by default
(TCP 22/8006 only), which looked like an outage mid-troubleshooting even
though SSH/web UI were fine. Added an explicit ping-allow rule to the
firewall template, applied it live on both nodes, and added an audit.sh
check so it stays enforced.
Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).
Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.
Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.
Simplifies the storage model to one long-term tier (Ceph) instead of
two. Node 1 runs local ZFS only until nodes 2/3 join, at which point
Ceph goes live and VMs migrate onto it directly.
beatzaplenty