Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
78 lines
4.6 KiB
Markdown
78 lines
4.6 KiB
Markdown
# Architecture
|
|
|
|
## Infrastructure layers
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────┐
|
|
│ pve1.sweet.home (Proxmox VE — production hypervisor) │
|
|
│ │
|
|
│ ┌────────────┐ ┌──────────┐ ┌──────────────────────┐ │
|
|
│ │ server- │ │ docker │ │ nix-cache pxe-boot │ │
|
|
│ │ nixos VM │ │ LXC │ │ LXC LXC │ │
|
|
│ │ (baremetal │ │ 192.168 │ │ .224 .223 │ │
|
|
│ │ GUI host) │ │ .2.225 │ └──────────────────────┘ │
|
|
│ └────────────┘ └──────────┘ │
|
|
│ ┌────────────┐ ┌──────────┐ ┌──────────────────────┐ │
|
|
│ │ domain- │ │ pxe-boot │ │ ha-server-1 ha- │ │
|
|
│ │ controller │ │ LXC │ │ VM .2.228 server-2│ │
|
|
│ │ FreeIPA VM │ │ PXE DHCP │ │ VM .2.227│ │
|
|
│ │ .2.253 │ │ .2.223 │ └──────────────────────┘ │
|
|
│ └────────────┘ └──────────┘ │
|
|
└─────────────────────────────────────────────────────────┘
|
|
|
|
┌─────────────────────────────────────────────────────────┐
|
|
│ pve-test.sweet.home (Proxmox VE — sandbox) │
|
|
│ WiFi-connected. Safe for scratch VMs/LXCs. │
|
|
└─────────────────────────────────────────────────────────┘
|
|
|
|
┌─────────────────────────────────────────────────────────┐
|
|
│ raspberrypi.tail13f623.ts.net (Raspberry Pi 4) │
|
|
│ Edge monitoring via Tailscale. │
|
|
│ Traefik · Uptime Kuma · CrowdSec · Beszel agent │
|
|
└─────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Configuration management matrix
|
|
|
|
| Host | Managed by | How |
|
|
|------|-----------|-----|
|
|
| pve1, pve-test | Ansible (`proxmox-hardening` role) | `ansible/playbooks/proxmox.yml` |
|
|
| domain-controller | Ansible (`freeipa` role) | `ansible/playbooks/freeipa.yml` |
|
|
| pihole | Ansible (`pihole` role) | `ansible/playbooks/pihole.yml` |
|
|
| raspberrypi | Ansible (`raspberrypi` role) | `ansible/playbooks/raspi.yml` |
|
|
| docker LXC | NixOS flake | `nixos/` — `proxmox-docker` target |
|
|
| nix-cache LXC | NixOS flake | `nixos/` — `proxmox-nix-cache` target |
|
|
| pxe-boot LXC | NixOS flake | `nixos/` — `proxmox-pxe-boot` target |
|
|
| ha-server-1/2 | NixOS flake | `nixos/` — `proxmox-ha-server-1/2` targets |
|
|
| baremetal workstation | NixOS flake | `nixos/` — `baremetal-gui` target |
|
|
|
|
## Authentication and DNS backbone
|
|
|
|
FreeIPA (`SWEET.HOME` realm) provides:
|
|
- Kerberos SSO for all IPA-enrolled hosts
|
|
- LDAP user/group directory (`admins`, `docker-access` groups)
|
|
- Authoritative DNS for the entire LAN (Pi-hole decommissioned; FreeIPA is the sole resolver)
|
|
- Certificate authority for internal TLS
|
|
|
|
All hosts (Proxmox nodes, Raspberry Pi, Docker host) are IPA-enrolled via SSSD.
|
|
The `admins` group has passwordless sudo on all enrolled hosts.
|
|
The `docker-access` group (GID 50010) grants Docker socket access on Docker hosts.
|
|
|
|
DHCP is handled by the router. PXE-specific DHCP options are served by the `pxe-boot` LXC.
|
|
|
|
## Monitoring stack
|
|
|
|
```
|
|
Beszel agents (every host)
|
|
└─→ Beszel hub (stacks/docker — beszel.lan.ddnsgeek.com)
|
|
|
|
Uptime Kuma (stacks/docker — monitor-kuma.lan.ddnsgeek.com)
|
|
└─→ monitors all public endpoints
|
|
|
|
Gotify (stacks/docker)
|
|
└─→ receives: WUD alerts, Docker health checks, drift detection notifications
|
|
|
|
WUD (stacks/docker)
|
|
└─→ watches: local docker host + Raspberry Pi (via Tailscale)
|
|
```
|