From cd4997f429c10528a0f37b2e625ff5cd4db335d8 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 12:19:45 +1000 Subject: [PATCH] docs(network): establish IP addressing scheme and update infra IPs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Defines the new structured 192.168.2.0/24 layout: - .10–.59 client DHCP (router-assigned, DNS → .253) - .220–.229 virtual nodes (VMs / LXC containers) - .230–.239 expansion buffer - .240–.249 physical nodes (pve1 at .245, PBS at .244) - .250–.253 network services (router .254, FreeIPA/DC .253) Storage network 192.168.4.0/29 defined for HA DRBD replication (internal vmbr1 bridge, no uplink). Host octet matches LAN throughout. Updates variables.nix: pxeServerIp .247→.223, pbsIp .108→.244, adds domainControllerIp .253. Updates pxe-boot.md IP references. Full migration before/after table in docs/ip-addressing.md. Co-Authored-By: Claude Sonnet 4.6 --- docs/ip-addressing.md | 128 ++++++++++++++++++++++++++++++++++++++++++ docs/pxe-boot.md | 6 +- variables.nix | 5 +- 3 files changed, 134 insertions(+), 5 deletions(-) create mode 100644 docs/ip-addressing.md diff --git a/docs/ip-addressing.md b/docs/ip-addressing.md new file mode 100644 index 0000000..767bfd6 --- /dev/null +++ b/docs/ip-addressing.md @@ -0,0 +1,128 @@ +# IP Addressing Scheme + +## Subnets + +| Subnet | CIDR | Purpose | Routed? | +|---|---|---|---| +| LAN | `192.168.2.0/24` | General LAN — clients and infrastructure | Yes (gateway .254) | +| Storage | `192.168.4.0/29` | HA file server DRBD replication | No — internal `vmbr1` only, no uplink | + +The storage subnet never leaves pve1. `vmbr1` is a Proxmox Linux bridge with no physical port +attached; traffic between the two HA file server VMs stays in-kernel. + +The host octet is consistent across subnets for any host that has multiple interfaces — e.g. +ha-node1 is always `.228` (LAN: `192.168.2.228`, storage: `192.168.4.228`). + +--- + +## LAN — 192.168.2.0/24 + +### Address map + +| Range | Purpose | +|---|---| +| .1–.9 | Reserved, never assign | +| .10–.59 | Client DHCP pool (router-assigned) | +| .60–.219 | Unallocated buffer | +| .220–.229 | Virtual nodes (VMs / LXC containers) | +| .230–.239 | Expansion buffer (reserved, unallocated) | +| .240–.249 | Physical nodes (bare-metal hosts) | +| .250–.253 | Network services | +| .254 | Router / gateway | + +### Network services (.250–.253) + +| IP | Hostname | Role | +|---|---|---| +| `192.168.2.254` | router | Gateway (TP-Link) | +| `192.168.2.253` | domain-controller | FreeIPA — authoritative DNS for `sweet.home`, Kerberos, LDAP | +| `192.168.2.250`–`.252` | — | Reserved for future network services | + +### Physical nodes (.240–.249) + +| IP | Hostname | Role | +|---|---|---| +| `192.168.2.245` | pve1 | Proxmox VE hypervisor | +| `192.168.2.244` | pbs | Proxmox Backup Server | +| `192.168.2.243` | nixos | Bare-metal workstation (`baremetal-gui`) | +| `192.168.2.246`–`.249` | — | Reserved — second Proxmox node and associated services | +| `192.168.2.240`–`.242` | — | Reserved | + +pve1 sits mid-range deliberately so a second Proxmox node can slot in on either side. + +### Virtual nodes (.220–.229) + +All VMs and LXC containers run on pve1. + +| IP | Hostname | Role | Status | +|---|---|---|---| +| `192.168.2.229` | ha-vip | HA file server iSCSI floating VIP (Pacemaker) | Future | +| `192.168.2.228` | ha-node1 | HA file server node 1 (DRBD + XFS + iSCSI) | Future | +| `192.168.2.227` | ha-node2 | HA file server node 2 (DRBD + XFS + iSCSI) | Future | +| `192.168.2.226` | server | Current NFS/ZFS file server — retires when HA is live | Retiring | +| `192.168.2.225` | docker | Docker / Traefik stack | Active | +| `192.168.2.224` | nix-cache | Nix binary cache + remote builder | Active | +| `192.168.2.223` | pxe-boot | PXE / TFTP / HTTP netboot server | Active | +| `192.168.2.222` | tailscale-router | Tailscale exit node / router | Active | +| `192.168.2.221` | tor-relay | Tor relay | Active | +| `192.168.2.220` | pdm | Proxmox Deploy Manager | Active | + +### Client DHCP pool (.10–.59) + +Assigned by the router. DNS option points to `192.168.2.253` (domain-controller). + +Devices in this range: phones, laptops, IoT, Canon printer, any non-infrastructure host. +No static reservations for infrastructure hosts — all infra uses static IP configuration +on the guest itself (not DHCP reservations), so IPs survive VM recreation regardless of +MAC address churn. + +--- + +## Storage network — 192.168.4.0/29 + +Internal to pve1 only. Proxmox bridge `vmbr1`, no physical NIC attached. + +| IP | Hostname | Interface role | +|---|---|---| +| `192.168.4.228` | ha-node1 | DRBD replication NIC | +| `192.168.4.227` | ha-node2 | DRBD replication NIC | +| — | no gateway | Isolated — not routed to LAN or internet | + +--- + +## Migration reference + +Current → target IP for every host being renumbered. + +| Host | Current IP | New IP | Config location | +|---|---|---|---| +| router | `192.168.2.254` | `192.168.2.254` | unchanged | +| domain-controller | `192.168.2.138` | `192.168.2.253` | `/etc/sysconfig/network-scripts/ifcfg-eth0` on guest | +| pve1 | `192.168.2.250` | `192.168.2.245` | `/etc/network/interfaces` on Proxmox host | +| pbs | `192.168.2.108` | `192.168.2.244` | static config on PBS host | +| nixos workstation | `192.168.2.119` | `192.168.2.243` | `networking.interfaces` / NetworkManager on guest | +| ha-node1 | — | `192.168.2.228` | future | +| ha-node2 | — | `192.168.2.227` | future | +| ha-vip | — | `192.168.2.229` | future (Pacemaker resource) | +| server | `192.168.2.252` | `192.168.2.226` | static config on guest | +| docker | `192.168.2.249` | `192.168.2.225` | static config on guest | +| nix-cache | `192.168.2.120` | `192.168.2.224` | static config on guest | +| pxe-boot | `192.168.2.247` | `192.168.2.223` | static config on guest; update `vars.pxeServerIp` in `variables.nix` ✓ | +| tailscale-router | `192.168.2.121` | `192.168.2.222` | static config on guest | +| tor-relay | `192.168.2.107` | `192.168.2.221` | static config on guest | +| pdm | `192.168.2.248` | `192.168.2.220` | static config on guest | + +### Cutover notes + +- **Do domain-controller first** — it becomes the DNS server; everything else depends on it + having its new IP and FreeIPA DNS configured before Pi-hole is retired. +- **pve1 last among physical hosts** — changing the Proxmox management IP drops the web UI + briefly; all guests keep running. +- **Update Pi-hole custom.list / FreeIPA DNS A records** to new IPs before flipping any host, + so name resolution stays valid throughout the migration. +- **variables.nix already updated** for `pxeServerIp` (.247→.223), `pbsIp` (.108→.244), and + new `domainControllerIp` (.253). Rebuild affected hosts after renumbering. +- **Router DHCP**: once domain-controller is at .253 and FreeIPA DNS is serving `sweet.home`, + switch router DHCP on with pool .10–.59 and DNS option pointing to .253; retire Pi-hole CT. +- **Pi-hole's iPXE dnsmasq config** (`99-ipxe-chainload.conf`) moves to the pxe-boot CT as a + dnsmasq proxy-mode config before Pi-hole is decommissioned. diff --git a/docs/pxe-boot.md b/docs/pxe-boot.md index 4bb3347..46e14f8 100644 --- a/docs/pxe-boot.md +++ b/docs/pxe-boot.md @@ -64,8 +64,8 @@ The HTTP iPXE chain is: ```text undionly.kpxe or ipxe.efi -> autoexec.ipxe from the TFTP root, when iPXE requests it - -> http://192.168.2.247/boot.ipxe - -> http://192.168.2.247/menu.ipxe + -> http://192.168.2.223/boot.ipxe + -> http://192.168.2.223/menu.ipxe ``` The generated menu currently exposes entries for: @@ -141,7 +141,7 @@ The `stage-systemrescue.service` oneshot extracts that ISO into: /srv/pxe/http/systemrescue ``` -The rescue menu entry then chains `http://192.168.2.247/systemrescue.ipxe`, +The rescue menu entry then chains `http://192.168.2.223/systemrescue.ipxe`, which loads the SystemRescue kernel and initramfs from the extracted tree and uses `archiso_http_srv` to fetch the squashfs payload over HTTP. diff --git a/variables.nix b/variables.nix index e1e15b1..8d9097b 100644 --- a/variables.nix +++ b/variables.nix @@ -4,8 +4,9 @@ homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.) tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix lanCidr = "192.168.2.0/24"; # LAN subnet - pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP - pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP + pxeServerIp = "192.168.2.223"; # pxe-boot host's LAN IP + pbsIp = "192.168.2.244"; # Proxmox Backup Server LAN IP + domainControllerIp = "192.168.2.253"; # FreeIPA domain controller / primary DNS # Cross-host references (LAN hostnames/users other hosts reach over the network) nixCacheHost = "nix-cache"; # substituter/remote-builder hostname