Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
56 lines
1.9 KiB
Markdown
56 lines
1.9 KiB
Markdown
# Networking
|
|
|
|
## pve1 as built (Stage 1, current)
|
|
|
|
Single NIC (2.5GbE), single bridge `vmbr0` on the flat LAN
|
|
(`192.168.2.0/24`), no VLANs. There is no corosync or Ceph traffic to
|
|
separate yet — this node isn't clustered. Segmentation for Stage 1 is
|
|
done at the firewall, not the network: `scripts/deploy-firewall.sh`
|
|
restricts SSH (22) and the web UI (8006) to the management CIDR via the
|
|
PVE datacenter firewall (default-deny inbound otherwise). That's
|
|
sufficient until Stage 2 needs actual separate physical/VLAN paths for
|
|
corosync and Ceph traffic — see below.
|
|
|
|
## Target design (Stage 2, future cluster)
|
|
|
|
## Required separation
|
|
|
|
Keep these on logically separate networks/VLANs, ideally separate NICs:
|
|
|
|
- **Management** — web UI (8006), SSH
|
|
- **Corosync** — cluster quorum. Low, *consistent* latency (well under
|
|
5ms) matters more than bandwidth. Never share with VM/storage traffic.
|
|
- **Ceph public** — VM-to-OSD traffic (once Ceph is live)
|
|
- **Ceph cluster/backend** — OSD-to-OSD replication, heaviest load
|
|
|
|
## Practical layout
|
|
|
|
2x 10/25GbE bonded or split:
|
|
|
|
- Link pair A → Ceph (public + backend, or split further if 4 NICs
|
|
available)
|
|
- Link pair B → management + corosync + VM traffic, with corosync on its
|
|
own VLAN even when sharing a physical NIC with the rest
|
|
|
|
## Cluster join requirements
|
|
|
|
- All nodes reachable to each other on SSH (22) and the corosync network
|
|
- Same PVE version across nodes
|
|
- NTP-synced clocks
|
|
|
|
## Firewall
|
|
|
|
Proxmox's built-in firewall operates at datacenter and node level.
|
|
Default-deny, then whitelist:
|
|
|
|
- SSH from the management network/VLAN only
|
|
- Web UI (8006) from the management network/VLAN only
|
|
- Corosync ports between cluster nodes
|
|
- Ceph ports between cluster nodes (once Ceph is live)
|
|
|
|
Enforce the network separation above at the firewall — corosync and Ceph
|
|
traffic shouldn't be reachable from the VM network even if they end up
|
|
sharing a physical link.
|
|
|
|
See `config/pve-firewall/` for a starting rule set.
|