# Network Topology

## LAN segments

| Subnet | VLAN | Purpose |
|--------|------|---------|
| `192.168.2.0/24` | (untagged/management) | Primary LAN — all host management interfaces |
| `192.168.10.0/29` | VLAN 10 | HA cluster replication (Corosync ring, DRBD) — internal to pve1 |
| `192.168.20.0/24` | VLAN 20 | HA storage-client (iSCSI/NFS) — internal to pve1 |

## Host IP assignments

| Host | IP | Role |
|------|----|------|
| `pve1.sweet.home` | (assigned by router) | Proxmox hypervisor |
| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA server |
| `pihole.sweet.home` | see Pi-hole admin | DNS/DHCP server |
| `docker.sweet.home` | `192.168.2.225` | Docker app stack host |
| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache |
| `pxe-boot.sweet.home` | `192.168.2.223` | PXE/TFTP/HTTP boot server |
| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale subnet router |
| `tor-relay.sweet.home` | `192.168.2.221` | Tor middle relay |
| `ha-server-1.sweet.home` | `192.168.2.228` | HA cluster node 1 |
| `ha-server-2.sweet.home` | `192.168.2.227` | HA cluster node 2 |
| HA LAN VIP (Pacemaker) | `192.168.2.229` | Floating NFS/service VIP |
| HA storage VIP (Pacemaker) | `192.168.20.229` | Docker iSCSI/NFS floating VIP |
| `raspberrypi.tail13f623.ts.net` | Tailscale | Raspberry Pi (reachable via Tailnet) |

## DNS architecture

Pi-hole has been decommissioned. FreeIPA is now the sole DNS server for the LAN.

```
All LAN clients → FreeIPA (domain-controller.sweet.home — 192.168.2.253)
    │
    ├── *.sweet.home → IPA integrated DNS (authoritative)
    └── Everything else → upstream resolvers (forwarded by FreeIPA)
```

PXE DHCP is handled by the `pxe-boot` LXC (dnsmasq in proxy mode for PXE chainloading only).
General DHCP is handled by the router.

## External access

- Domain: `*.lan.ddnsgeek.com` → Dynamic DNS via Dynu → home WAN IP
- TLS: LetsEncrypt via Traefik ACME (HTTP challenge)
- Tailscale VPN: subnet router at `192.168.2.222` bridges Tailnet to LAN

## Proxmox firewall

Default-deny inbound on all Proxmox nodes.
Management access (SSH port 22, web UI port 8006) from `192.168.2.0/24` only.
See `ansible/roles/proxmox-hardening/templates/cluster-fw.j2` for the ruleset.