Document pve-test's wifi network, add Claude guardrails, fix ping firewall #2

2026-07-21T21:21:51Z

beatzaplenty commented

2026-07-21 21:21:51 +00:00

Summary

Documents pve-test's wifi-primary network (4addr bridge mode, active-backup bonded with a wired LAN fallback) and the cluster-separation procedure used to get there - see docs/05-node-roles.md and docs/06-pve-test-wifi-network.md, including what went wrong on the first live-cutover attempt and what worked on retry.
Adds scripts/setup-wifi-bond-network.sh to reproduce pve-test's network config if the server is ever rebuilt.
Adds CLAUDE.md with pve1 (production)/pve-test (sandbox) guardrails - this repo had none before, despite scripts here being able to make real changes to both nodes.
Fixes both nodes' mgmt firewall silently dropping ICMP (only TCP 22/8006 were allowed) - added an explicit ping-allow rule to the firewall template, applied live on both pve1 and pve-test, and added an audit.sh check so it stays enforced.
Cross-references from docs/00-overview.md/docs/03-networking.md clarifying pve-test existing doesn't mean Stage 2 (HA/Ceph) node 2 exists - it's sandbox-purpose and wifi-networked, incompatible with corosync.

Test plan

bash -n on both changed/added scripts
Firewall change validated live via pve-firewall compile/restart on both nodes, ping confirmed working on both afterward
All 7 guests on pve1 confirmed still running throughout
Operator review of the new CLAUDE.md guardrails and node-roles history for accuracy

Generated with Claude Code

## Summary - Documents pve-test's wifi-primary network (4addr bridge mode, active-backup bonded with a wired LAN fallback) and the cluster-separation procedure used to get there - see docs/05-node-roles.md and docs/06-pve-test-wifi-network.md, including what went wrong on the first live-cutover attempt and what worked on retry. - Adds scripts/setup-wifi-bond-network.sh to reproduce pve-test's network config if the server is ever rebuilt. - Adds CLAUDE.md with pve1 (production)/pve-test (sandbox) guardrails - this repo had none before, despite scripts here being able to make real changes to both nodes. - Fixes both nodes' mgmt firewall silently dropping ICMP (only TCP 22/8006 were allowed) - added an explicit ping-allow rule to the firewall template, applied live on both pve1 and pve-test, and added an audit.sh check so it stays enforced. - Cross-references from docs/00-overview.md/docs/03-networking.md clarifying pve-test existing doesn't mean Stage 2 (HA/Ceph) node 2 exists - it's sandbox-purpose and wifi-networked, incompatible with corosync. ## Test plan - [x] bash -n on both changed/added scripts - [x] Firewall change validated live via pve-firewall compile/restart on both nodes, ping confirmed working on both afterward - [x] All 7 guests on pve1 confirmed still running throughout - [ ] Operator review of the new CLAUDE.md guardrails and node-roles history for accuracy Generated with Claude Code

beatzaplenty added 1 commit 2026-07-21 21:21:51 +00:00

Document pve-test's wifi-primary network and add Claude node guardrails ba73420350

pve-test was briefly clustered with pve1 then deliberately de-clustered
so it could move to wifi-primary networking (4addr bridge mode, bonded
with a wired LAN backup) - a change not achievable while clustered given
corosync's latency requirements. Captures that as a reproducible script
plus docs: cluster separation procedure, the wifi network design and the
live-cutover pitfalls hit along the way, and node-role/history context.

Also adds CLAUDE.md guardrails for pve1 (production) vs pve-test
(sandbox) - this repo had none before, despite scripts here being able
to make real changes to both.

Separately: both nodes' mgmt firewalls were dropping ICMP by default
(TCP 22/8006 only), which looked like an outage mid-troubleshooting even
though SSH/web UI were fine. Added an explicit ping-allow rule to the
firewall template, applied it live on both nodes, and added an audit.sh
check so it stays enforced.

beatzaplenty added 1 commit 2026-07-21 21:26:27 +00:00

Document AP/client-isolation gotcha for wifi clients reaching pve-test dc4eff97fa

Found live: a laptop on the same wifi network as pve-test couldn't reach
it at all (no ARP entry, not stale) despite every wired device working
fine and the mgmt firewall already allowing ICMP - the router's AP/client
isolation was blocking wireless-to-wireless traffic. Router-side fix
only; nothing on pve-test to change for this symptom.

beatzaplenty added 1 commit 2026-07-21 21:35:11 +00:00

Correct AP-isolation guess: confirmed as a 4addr forwarding gap instead 143eebcbf3

Tested live: AP isolation was already off on the TP-Link BE9300, and a
second wireless device (phone) failed identically to the laptop - rules
out isolation entirely. Real cause is the router's 4addr/WDS handling
not forwarding wireless-client broadcast/ARP traffic to pve-test's WDS
association, even though wired forwarding to it works fine. Since ARP
never resolves for wireless peers, this affects every protocol (web UI
included), not just ICMP - corrects an earlier draft of this doc that
speculated TCP might still work.

beatzaplenty commented

2026-07-21 21:45:31 +00:00

Closing without merging - the wifi-primary design this documents turned out to have a fundamental limitation: no wireless client on the same AP (tested: laptop and phone both) can reach pve-test at all, even with AP isolation off, due to how the router handles 4addr/WDS forwarding for wireless peers. pve-test has been rolled back to nic0-only wired networking, wifi disabled. Considering a bare-metal NixOS rebuild of pve-test instead (running libvirt/nixos-containers directly) as the next direction - separate work if it happens.

beatzaplenty closed this pull request

2026-07-21 21:45:32 +00:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/debian-configuration#2