beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(ha): update docs to reflect implemented network segmentation
Check NixOS configurations / eval-hosts (push) Successful in 10m21s
Details

Browse Source 
ip-addressing.md:
  - Storage-client network purpose updated: NFS primary, iSCSI available
  - Protocol separation box updated: NFS on both VIPs (each CIDR-restricted);
    iSCSI on VLAN 20 only but not in active use
  - docker role updated to NFS client (not iSCSI initiator)
  - vip-storage description updated to NFS + iSCSI endpoint

ha-network-audit.md:
  - Implementation status header added noting all audit items resolved
  - Records decisions that diverged from original recommendations
    (VLAN renumbering, dual VIP, NFS-over-iSCSI for docker/swarm)
  - Notes deferred items (STONITH, iSCSI ACLs)

network-cutover.md:
  - New Stage 6: HA storage cutover — docker NFS remount from
    server.sweet.home to vip-storage (192.168.20.229), final rsync
    steps, and server.sweet.home decommission procedure
  - Former Stage 6 (final cleanup) renumbered to Stage 7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2
This commit is contained in:
beatzaplenty
2026-07-29 19:04:42 +10:00
co-authored by Claude Sonnet 4.6
parent 3c28d48bc7
commit 8c86144694
3 changed files with 105 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ha-network-audit.md
+12
View File
@@ -3,6 +3,18 @@
**Date:** 2026-07-29
**Scope:** Read-only discovery of pve1.sweet.home host networking, HA cluster VMs (200/201), and Docker CT (105). No changes made.
> **Implementation status — 2026-07-29:** All recommendations from this audit have been
> implemented in the same session. See `docs/ip-addressing.md` for the current state.
> Key decisions that diverged from the original recommendations:
> - VLAN IDs renumbered: cluster → VLAN 10 (192.168.10.x), storage-client → VLAN 20 (192.168.20.x)
> - Two Pacemaker VIPs: `vip-lan` (192.168.2.229, NFS for LAN) and `vip-storage` (192.168.20.229, NFS + iSCSI for VLAN 20)
> - NFS served on **both** VIPs (each firewalled to its own subnet); iSCSI available on VLAN 20 but NFS is preferred for docker to support future Docker Swarm multi-host access
> - `corosync.conf` ring1 added using LAN IPs (RF-1 resolved)
> - `vmbr2` created and NICs added to HA VMs and docker CT (RF-6/RF-7 resolved)
> - iSCSI portal remains on `[::0]`; firewall enforces VLAN 20 restriction (RF-4 mitigated)
> - STONITH still disabled (RF-3 deferred — accepted risk during development phase)
> - iSCSI ACLs not configured (RF-5 deferred — iSCSI not in active use)
---
## 1. Current State Summary