Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
54 lines
2.2 KiB
Markdown
54 lines
2.2 KiB
Markdown
# Network Topology
|
|
|
|
## LAN segments
|
|
|
|
| Subnet | VLAN | Purpose |
|
|
|--------|------|---------|
|
|
| `192.168.2.0/24` | (untagged/management) | Primary LAN — all host management interfaces |
|
|
| `192.168.10.0/29` | VLAN 10 | HA cluster replication (Corosync ring, DRBD) — internal to pve1 |
|
|
| `192.168.20.0/24` | VLAN 20 | HA storage-client (iSCSI/NFS) — internal to pve1 |
|
|
|
|
## Host IP assignments
|
|
|
|
| Host | IP | Role |
|
|
|------|----|------|
|
|
| `pve1.sweet.home` | (assigned by router) | Proxmox hypervisor |
|
|
| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA server |
|
|
| `pihole.sweet.home` | see Pi-hole admin | DNS/DHCP server |
|
|
| `docker.sweet.home` | `192.168.2.225` | Docker app stack host |
|
|
| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache |
|
|
| `pxe-boot.sweet.home` | `192.168.2.223` | PXE/TFTP/HTTP boot server |
|
|
| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale subnet router |
|
|
| `tor-relay.sweet.home` | `192.168.2.221` | Tor middle relay |
|
|
| `ha-server-1.sweet.home` | `192.168.2.228` | HA cluster node 1 |
|
|
| `ha-server-2.sweet.home` | `192.168.2.227` | HA cluster node 2 |
|
|
| HA LAN VIP (Pacemaker) | `192.168.2.229` | Floating NFS/service VIP |
|
|
| HA storage VIP (Pacemaker) | `192.168.20.229` | Docker iSCSI/NFS floating VIP |
|
|
| `raspberrypi.tail13f623.ts.net` | Tailscale | Raspberry Pi (reachable via Tailnet) |
|
|
|
|
## DNS architecture
|
|
|
|
Pi-hole has been decommissioned. FreeIPA is now the sole DNS server for the LAN.
|
|
|
|
```
|
|
All LAN clients → FreeIPA (domain-controller.sweet.home — 192.168.2.253)
|
|
│
|
|
├── *.sweet.home → IPA integrated DNS (authoritative)
|
|
└── Everything else → upstream resolvers (forwarded by FreeIPA)
|
|
```
|
|
|
|
PXE DHCP is handled by the `pxe-boot` LXC (dnsmasq in proxy mode for PXE chainloading only).
|
|
General DHCP is handled by the router.
|
|
|
|
## External access
|
|
|
|
- Domain: `*.lan.ddnsgeek.com` → Dynamic DNS via Dynu → home WAN IP
|
|
- TLS: LetsEncrypt via Traefik ACME (HTTP challenge)
|
|
- Tailscale VPN: subnet router at `192.168.2.222` bridges Tailnet to LAN
|
|
|
|
## Proxmox firewall
|
|
|
|
Default-deny inbound on all Proxmox nodes.
|
|
Management access (SSH port 22, web UI port 8006) from `192.168.2.0/24` only.
|
|
See `ansible/roles/proxmox-hardening/templates/cluster-fw.j2` for the ruleset.
|