Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 78fdf3d94c Update network topology: Tailscale routing and DNS proxy, remove Pi-hole

- Document bidirectional LAN ↔ Tailscale routing via tailscale-router
  (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet)
- Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net
  → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients
- Remove stale pihole.sweet.home from IP table (decommissioned)
- Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document
  ts.net conditional forwarder as a post-install step
- Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

2026-07-30 07:10:03 +10:00

3.7 KiB

Raw Blame History

Network Topology

LAN segments

Subnet	VLAN	Purpose
`192.168.2.0/24`	(untagged/management)	Primary LAN — all host management interfaces
`192.168.10.0/29`	VLAN 10	HA cluster replication (Corosync ring, DRBD) — internal to pve1
`192.168.20.0/24`	VLAN 20	HA storage-client (iSCSI/NFS) — internal to pve1

Host IP assignments

Host	IP	Role
`pve1.sweet.home`	(router DHCP / static lease)	Proxmox hypervisor
`domain-controller.sweet.home`	`192.168.2.253`	FreeIPA (DNS + auth)
`docker.sweet.home`	`192.168.2.225`	Docker app stack host
`nix-cache.sweet.home`	`192.168.2.224`	Nix binary cache
`pxe-boot.sweet.home`	`192.168.2.223`	PXE/TFTP/HTTP boot server
`tailscale-router.sweet.home`	`192.168.2.222`	Tailscale subnet router + DNS proxy
`tor-relay.sweet.home`	`192.168.2.221`	Tor middle relay
`ha-server-1.sweet.home`	`192.168.2.228`	HA cluster node 1
`ha-server-2.sweet.home`	`192.168.2.227`	HA cluster node 2
HA LAN VIP (Pacemaker)	`192.168.2.229`	Floating NFS/service VIP
HA storage VIP (Pacemaker)	`192.168.20.229`	Docker iSCSI/NFS floating VIP
`raspberrypi.tail13f623.ts.net`	Tailscale	Raspberry Pi edge node

DNS architecture

FreeIPA is the sole DNS server for all LAN clients (Pi-hole decommissioned). Tailscale name resolution is handled by a conditional forwarder in FreeIPA pointing at the tailscale-router LXC, which proxies those queries into Tailscale MagicDNS.

LAN client → FreeIPA (192.168.2.253)
    │
    ├── *.sweet.home  → IPA integrated DNS (authoritative)
    ├── *.ts.net      → conditional forwarder → tailscale-router (192.168.2.222)
    │                                                │
    │                                                └── Tailscale MagicDNS (100.100.100.100)
    └── everything else → upstream resolvers (via FreeIPA forwarders)

Tailscale client → tailscale-router (MagicDNS split-horizon)
    │
    ├── *.sweet.home  → forwarded to FreeIPA (192.168.2.253)
    └── *.ts.net      → Tailscale MagicDNS (local)

PXE DHCP options are served by the pxe-boot LXC (dnsmasq proxy mode for PXE chainloading only). General DHCP is handled by the router.

Tailscale + LAN routing

The tailscale-router LXC at 192.168.2.222 bridges the Tailscale network and the LAN in both directions:

LAN → Tailscale:

Router has a static route: Tailscale CGNAT range (100.64.0.0/10) → 192.168.2.222
LAN hosts reach Tailscale peers (e.g. raspberrypi.tail13f623.ts.net) via this route
DNS resolution for *.ts.net goes through FreeIPA → tailscale-router → MagicDNS (see above)

Tailscale → LAN:

tailscale-router advertises 192.168.2.0/24 as a subnet route into the Tailnet
Tailscale peers can reach any 192.168.2.x host by routing through tailscale-router
DNS: Tailscale peers use tailscale-router as a split-horizon forwarder for sweet.home

Result: From any Tailscale-connected device, docker.sweet.home resolves and routes correctly without being physically on the LAN. From any LAN host, raspberrypi.tail13f623.ts.net resolves and routes without a Tailscale client.

External access

Domain: *.lan.ddnsgeek.com → Dynamic DNS via Dynu → home WAN IP
TLS: LetsEncrypt via Traefik ACME (HTTP challenge on port 80)
Tailscale: subnet router at 192.168.2.222 (see above)

Proxmox firewall

Default-deny inbound on all Proxmox nodes. Management access (SSH port 22, web UI port 8006) from 192.168.2.0/24 only. See ansible/roles/proxmox-hardening/templates/cluster-fw.j2 for the ruleset.

3.7 KiB Raw Blame History