Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 cd4997f429 docs(network): establish IP addressing scheme and update infra IPs

Defines the new structured 192.168.2.0/24 layout:
- .10–.59   client DHCP (router-assigned, DNS → .253)
- .220–.229 virtual nodes (VMs / LXC containers)
- .230–.239 expansion buffer
- .240–.249 physical nodes (pve1 at .245, PBS at .244)
- .250–.253 network services (router .254, FreeIPA/DC .253)

Storage network 192.168.4.0/29 defined for HA DRBD replication
(internal vmbr1 bridge, no uplink). Host octet matches LAN throughout.

Updates variables.nix: pxeServerIp .247→.223, pbsIp .108→.244,
adds domainControllerIp .253. Updates pxe-boot.md IP references.
Full migration before/after table in docs/ip-addressing.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-27 12:19:45 +10:00

5.6 KiB

Raw Permalink Blame History

IP Addressing Scheme

Subnets

Subnet	CIDR	Purpose	Routed?
LAN	`192.168.2.0/24`	General LAN — clients and infrastructure	Yes (gateway .254)
Storage	`192.168.4.0/29`	HA file server DRBD replication	No — internal `vmbr1` only, no uplink

The storage subnet never leaves pve1. vmbr1 is a Proxmox Linux bridge with no physical port attached; traffic between the two HA file server VMs stays in-kernel.

The host octet is consistent across subnets for any host that has multiple interfaces — e.g. ha-node1 is always .228 (LAN: 192.168.2.228, storage: 192.168.4.228).

LAN — 192.168.2.0/24

Address map

Range	Purpose
.1–.9	Reserved, never assign
.10–.59	Client DHCP pool (router-assigned)
.60–.219	Unallocated buffer
.220–.229	Virtual nodes (VMs / LXC containers)
.230–.239	Expansion buffer (reserved, unallocated)
.240–.249	Physical nodes (bare-metal hosts)
.250–.253	Network services
.254	Router / gateway

Network services (.250–.253)

IP	Hostname	Role
`192.168.2.254`	router	Gateway (TP-Link)
`192.168.2.253`	domain-controller	FreeIPA — authoritative DNS for `sweet.home`, Kerberos, LDAP
`192.168.2.250`–`.252`	—	Reserved for future network services

Physical nodes (.240–.249)

IP	Hostname	Role
`192.168.2.245`	pve1	Proxmox VE hypervisor
`192.168.2.244`	pbs	Proxmox Backup Server
`192.168.2.243`	nixos	Bare-metal workstation (`baremetal-gui`)
`192.168.2.246`–`.249`	—	Reserved — second Proxmox node and associated services
`192.168.2.240`–`.242`	—	Reserved

pve1 sits mid-range deliberately so a second Proxmox node can slot in on either side.

Virtual nodes (.220–.229)

All VMs and LXC containers run on pve1.

IP	Hostname	Role	Status
`192.168.2.229`	ha-vip	HA file server iSCSI floating VIP (Pacemaker)	Future
`192.168.2.228`	ha-node1	HA file server node 1 (DRBD + XFS + iSCSI)	Future
`192.168.2.227`	ha-node2	HA file server node 2 (DRBD + XFS + iSCSI)	Future
`192.168.2.226`	server	Current NFS/ZFS file server — retires when HA is live	Retiring
`192.168.2.225`	docker	Docker / Traefik stack	Active
`192.168.2.224`	nix-cache	Nix binary cache + remote builder	Active
`192.168.2.223`	pxe-boot	PXE / TFTP / HTTP netboot server	Active
`192.168.2.222`	tailscale-router	Tailscale exit node / router	Active
`192.168.2.221`	tor-relay	Tor relay	Active
`192.168.2.220`	pdm	Proxmox Deploy Manager	Active

Client DHCP pool (.10–.59)

Assigned by the router. DNS option points to 192.168.2.253 (domain-controller).

Devices in this range: phones, laptops, IoT, Canon printer, any non-infrastructure host. No static reservations for infrastructure hosts — all infra uses static IP configuration on the guest itself (not DHCP reservations), so IPs survive VM recreation regardless of MAC address churn.

Storage network — 192.168.4.0/29

Internal to pve1 only. Proxmox bridge vmbr1, no physical NIC attached.

IP	Hostname	Interface role
`192.168.4.228`	ha-node1	DRBD replication NIC
`192.168.4.227`	ha-node2	DRBD replication NIC
—	no gateway	Isolated — not routed to LAN or internet

Migration reference

Current → target IP for every host being renumbered.

Host	Current IP	New IP	Config location
router	`192.168.2.254`	`192.168.2.254`	unchanged
domain-controller	`192.168.2.138`	`192.168.2.253`	`/etc/sysconfig/network-scripts/ifcfg-eth0` on guest
pve1	`192.168.2.250`	`192.168.2.245`	`/etc/network/interfaces` on Proxmox host
pbs	`192.168.2.108`	`192.168.2.244`	static config on PBS host
nixos workstation	`192.168.2.119`	`192.168.2.243`	`networking.interfaces` / NetworkManager on guest
ha-node1	—	`192.168.2.228`	future
ha-node2	—	`192.168.2.227`	future
ha-vip	—	`192.168.2.229`	future (Pacemaker resource)
server	`192.168.2.252`	`192.168.2.226`	static config on guest
docker	`192.168.2.249`	`192.168.2.225`	static config on guest
nix-cache	`192.168.2.120`	`192.168.2.224`	static config on guest
pxe-boot	`192.168.2.247`	`192.168.2.223`	static config on guest; update `vars.pxeServerIp` in `variables.nix` ✓
tailscale-router	`192.168.2.121`	`192.168.2.222`	static config on guest
tor-relay	`192.168.2.107`	`192.168.2.221`	static config on guest
pdm	`192.168.2.248`	`192.168.2.220`	static config on guest

Cutover notes

Do domain-controller first — it becomes the DNS server; everything else depends on it having its new IP and FreeIPA DNS configured before Pi-hole is retired.
pve1 last among physical hosts — changing the Proxmox management IP drops the web UI briefly; all guests keep running.
Update Pi-hole custom.list / FreeIPA DNS A records to new IPs before flipping any host, so name resolution stays valid throughout the migration.
variables.nix already updated for pxeServerIp (.247→.223), pbsIp (.108→.244), and new domainControllerIp (.253). Rebuild affected hosts after renumbering.
Router DHCP: once domain-controller is at .253 and FreeIPA DNS is serving sweet.home, switch router DHCP on with pool .10–.59 and DNS option pointing to .253; retire Pi-hole CT.
Pi-hole's iPXE dnsmasq config (99-ipxe-chainload.conf) moves to the pxe-boot CT as a dnsmasq proxy-mode config before Pi-hole is decommissioned.

5.6 KiB Raw Permalink Blame History Unescape Escape