# Network Topology

## LAN segments

| Subnet | VLAN | Purpose |
|--------|------|---------|
| `192.168.2.0/24` | (untagged/management) | Primary LAN — all host management interfaces |
| `192.168.10.0/29` | VLAN 10 | HA cluster replication (Corosync ring, DRBD) — internal to pve1 |
| `192.168.20.0/24` | VLAN 20 | HA storage-client (iSCSI/NFS) — internal to pve1 |

## Host IP assignments

| Host | IP | Role |
|------|----|------|
| `pve1.sweet.home` | (router DHCP / static lease) | Proxmox hypervisor |
| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA (DNS + auth) |
| `docker.sweet.home` | `192.168.2.225` | Docker app stack host |
| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache |
| `pxe-boot.sweet.home` | `192.168.2.223` | PXE/TFTP/HTTP boot server |
| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale subnet router + DNS proxy |
| `tor-relay.sweet.home` | `192.168.2.221` | Tor middle relay |
| `ha-server-1.sweet.home` | `192.168.2.228` | HA cluster node 1 |
| `ha-server-2.sweet.home` | `192.168.2.227` | HA cluster node 2 |
| HA LAN VIP (Pacemaker) | `192.168.2.229` | Floating NFS/service VIP |
| HA storage VIP (Pacemaker) | `192.168.20.229` | Docker iSCSI/NFS floating VIP |
| `raspberrypi.tail13f623.ts.net` | Tailscale | Raspberry Pi edge node |

## DNS architecture

FreeIPA is the sole DNS server for all LAN clients (Pi-hole decommissioned).
Tailscale name resolution is handled by a conditional forwarder in FreeIPA pointing at
the `tailscale-router` LXC, which proxies those queries into Tailscale MagicDNS.

```
LAN client → FreeIPA (192.168.2.253)
    │
    ├── *.sweet.home  → IPA integrated DNS (authoritative)
    ├── *.ts.net      → conditional forwarder → tailscale-router (192.168.2.222)
    │                                                │
    │                                                └── Tailscale MagicDNS (100.100.100.100)
    └── everything else → upstream resolvers (via FreeIPA forwarders)

Tailscale client → tailscale-router (MagicDNS split-horizon)
    │
    ├── *.sweet.home  → forwarded to FreeIPA (192.168.2.253)
    └── *.ts.net      → Tailscale MagicDNS (local)
```

PXE DHCP options are served by the `pxe-boot` LXC (dnsmasq proxy mode for PXE chainloading only).
General DHCP is handled by the router.

## Tailscale + LAN routing

The `tailscale-router` LXC at `192.168.2.222` bridges the Tailscale network and the LAN
in both directions:

**LAN → Tailscale:**
- Router has a static route: Tailscale CGNAT range (`100.64.0.0/10`) → `192.168.2.222`
- LAN hosts reach Tailscale peers (e.g. `raspberrypi.tail13f623.ts.net`) via this route
- DNS resolution for `*.ts.net` goes through FreeIPA → tailscale-router → MagicDNS (see above)

**Tailscale → LAN:**
- `tailscale-router` advertises `192.168.2.0/24` as a subnet route into the Tailnet
- Tailscale peers can reach any `192.168.2.x` host by routing through `tailscale-router`
- DNS: Tailscale peers use `tailscale-router` as a split-horizon forwarder for `sweet.home`

**Result:** From any Tailscale-connected device, `docker.sweet.home` resolves and routes
correctly without being physically on the LAN. From any LAN host,
`raspberrypi.tail13f623.ts.net` resolves and routes without a Tailscale client.

## External access

- Domain: `*.lan.ddnsgeek.com` → Dynamic DNS via Dynu → home WAN IP
- TLS: LetsEncrypt via Traefik ACME (HTTP challenge on port 80)
- Tailscale: subnet router at `192.168.2.222` (see above)

## Proxmox firewall

Default-deny inbound on all Proxmox nodes.
Management access (SSH port 22, web UI port 8006) from `192.168.2.0/24` only.
See `ansible/roles/proxmox-hardening/templates/cluster-fw.j2` for the ruleset.