Archived
beatzaplentyandClaude Sonnet 4.6
78fdf3d94c
- Document bidirectional LAN ↔ Tailscale routing via tailscale-router (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet) - Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients - Remove stale pihole.sweet.home from IP table (decommissioned) - Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document ts.net conditional forwarder as a post-install step - Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
82 lines
3.7 KiB
Markdown
82 lines
3.7 KiB
Markdown
# Network Topology
|
|
|
|
## LAN segments
|
|
|
|
| Subnet | VLAN | Purpose |
|
|
|--------|------|---------|
|
|
| `192.168.2.0/24` | (untagged/management) | Primary LAN — all host management interfaces |
|
|
| `192.168.10.0/29` | VLAN 10 | HA cluster replication (Corosync ring, DRBD) — internal to pve1 |
|
|
| `192.168.20.0/24` | VLAN 20 | HA storage-client (iSCSI/NFS) — internal to pve1 |
|
|
|
|
## Host IP assignments
|
|
|
|
| Host | IP | Role |
|
|
|------|----|------|
|
|
| `pve1.sweet.home` | (router DHCP / static lease) | Proxmox hypervisor |
|
|
| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA (DNS + auth) |
|
|
| `docker.sweet.home` | `192.168.2.225` | Docker app stack host |
|
|
| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache |
|
|
| `pxe-boot.sweet.home` | `192.168.2.223` | PXE/TFTP/HTTP boot server |
|
|
| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale subnet router + DNS proxy |
|
|
| `tor-relay.sweet.home` | `192.168.2.221` | Tor middle relay |
|
|
| `ha-server-1.sweet.home` | `192.168.2.228` | HA cluster node 1 |
|
|
| `ha-server-2.sweet.home` | `192.168.2.227` | HA cluster node 2 |
|
|
| HA LAN VIP (Pacemaker) | `192.168.2.229` | Floating NFS/service VIP |
|
|
| HA storage VIP (Pacemaker) | `192.168.20.229` | Docker iSCSI/NFS floating VIP |
|
|
| `raspberrypi.tail13f623.ts.net` | Tailscale | Raspberry Pi edge node |
|
|
|
|
## DNS architecture
|
|
|
|
FreeIPA is the sole DNS server for all LAN clients (Pi-hole decommissioned).
|
|
Tailscale name resolution is handled by a conditional forwarder in FreeIPA pointing at
|
|
the `tailscale-router` LXC, which proxies those queries into Tailscale MagicDNS.
|
|
|
|
```
|
|
LAN client → FreeIPA (192.168.2.253)
|
|
│
|
|
├── *.sweet.home → IPA integrated DNS (authoritative)
|
|
├── *.ts.net → conditional forwarder → tailscale-router (192.168.2.222)
|
|
│ │
|
|
│ └── Tailscale MagicDNS (100.100.100.100)
|
|
└── everything else → upstream resolvers (via FreeIPA forwarders)
|
|
|
|
Tailscale client → tailscale-router (MagicDNS split-horizon)
|
|
│
|
|
├── *.sweet.home → forwarded to FreeIPA (192.168.2.253)
|
|
└── *.ts.net → Tailscale MagicDNS (local)
|
|
```
|
|
|
|
PXE DHCP options are served by the `pxe-boot` LXC (dnsmasq proxy mode for PXE chainloading only).
|
|
General DHCP is handled by the router.
|
|
|
|
## Tailscale + LAN routing
|
|
|
|
The `tailscale-router` LXC at `192.168.2.222` bridges the Tailscale network and the LAN
|
|
in both directions:
|
|
|
|
**LAN → Tailscale:**
|
|
- Router has a static route: Tailscale CGNAT range (`100.64.0.0/10`) → `192.168.2.222`
|
|
- LAN hosts reach Tailscale peers (e.g. `raspberrypi.tail13f623.ts.net`) via this route
|
|
- DNS resolution for `*.ts.net` goes through FreeIPA → tailscale-router → MagicDNS (see above)
|
|
|
|
**Tailscale → LAN:**
|
|
- `tailscale-router` advertises `192.168.2.0/24` as a subnet route into the Tailnet
|
|
- Tailscale peers can reach any `192.168.2.x` host by routing through `tailscale-router`
|
|
- DNS: Tailscale peers use `tailscale-router` as a split-horizon forwarder for `sweet.home`
|
|
|
|
**Result:** From any Tailscale-connected device, `docker.sweet.home` resolves and routes
|
|
correctly without being physically on the LAN. From any LAN host,
|
|
`raspberrypi.tail13f623.ts.net` resolves and routes without a Tailscale client.
|
|
|
|
## External access
|
|
|
|
- Domain: `*.lan.ddnsgeek.com` → Dynamic DNS via Dynu → home WAN IP
|
|
- TLS: LetsEncrypt via Traefik ACME (HTTP challenge on port 80)
|
|
- Tailscale: subnet router at `192.168.2.222` (see above)
|
|
|
|
## Proxmox firewall
|
|
|
|
Default-deny inbound on all Proxmox nodes.
|
|
Management access (SSH port 22, web UI port 8006) from `192.168.2.0/24` only.
|
|
See `ansible/roles/proxmox-hardening/templates/cluster-fw.j2` for the ruleset.
|