From 41de39524079ea4dbb6656d757143f205c667ff2 Mon Sep 17 00:00:00 2001 From: dtoro Date: Tue, 2 Jun 2026 22:02:34 +0200 Subject: [PATCH] docs: post-migration changelog entries on hubris, caddy, dns hosts/hubris.md: - Update At a glance network section: vmbr1 uplink (192.168.178.10), vmbr0 portless internal bridge with 192.168.8.1 alias - Remove Phase 1 WiFi failover section (wlp3s0 disabled 2026-06-02) - Changelog: Slate AX retired, SODOLA added, Proxmox as subnet router containers/121-caddy.md: - Changelog: caddy.service unit was missing from hubris1 package, recreated manually; risk of loss on package reinstall noted containers/107-dns.md: - Update Who points here: Technitium DHCP hands out .2 as DNS for homelab clients; Fritz!Box LAN clients still get Fritz!Box DNS - Add DHCP section documenting the homelab scope (100-240, gw .1) - Changelog: DHCP enabled 2026-06-02, replaces Slate AX DHCP Co-Authored-By: Claude Sonnet 4.6 --- containers/107-dns.md | 16 +++++++++++++++- containers/121-caddy.md | 3 +++ hosts/hubris.md | 19 ++++++------------- 3 files changed, 24 insertions(+), 14 deletions(-) diff --git a/containers/107-dns.md b/containers/107-dns.md index 2dbee90..1603feb 100644 --- a/containers/107-dns.md +++ b/containers/107-dns.md @@ -25,9 +25,20 @@ Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recur ## Who points here - **NetBird mesh peers:** nameserver group `home-lab-dns` (`hubris.network` → this server). *Note: the [NetBird managed DNS zone](124-authentik.md) still answers most app names directly, bypassing this — see the single-source-of-truth decision.* -- **Plain LAN clients:** router DHCP should hand out `192.168.8.2` (update the router — the old `.180`/dnsmasq is gone). +- **Homelab DHCP clients:** Technitium's own DHCP scope hands out `192.168.8.2` as the DNS server for `192.168.8.x` leases (see DHCP section below). +- **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS — no split-horizon for non-mesh clients. Changing this requires a secondary DNS fallback, which Fritz!OS 8.x doesn't expose in a single DHCP field. - **Secondary:** Mac Mini (planned, Phase 3) via AXFR zone transfer. +## DHCP + +Technitium also runs a DHCP server for the homelab subnet (enabled 2026-06-02): +- **Scope:** `homelab` — `192.168.8.100 – 192.168.8.240` +- **Gateway:** `192.168.8.1` (Proxmox `vmbr0` alias) +- **DNS:** `192.168.8.2` (self) +- **Lease time:** 24 h + +Replaces the DHCP that was previously served by the Slate AX router. Static-IP LXCs (below `.100`) are unaffected. + ## Related - [124 — authentik](124-authentik.md) — retired host of the old dnsmasq - [DNS split-horizon](../infrastructure/dns.md) @@ -35,5 +46,8 @@ Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recur ## Changelog +### 2026-06-02 — DHCP server enabled; replaces Slate AX DHCP +Enabled Technitium's built-in DHCP server for `192.168.8.0/24` (scope `homelab`, range `.100–.240`, gateway `192.168.8.1`, DNS self). Previously the Slate AX sub-router served DHCP for the homelab subnet. With the Slate AX retired and Proxmox now the subnet router, Technitium takes over DHCP. Configured via the Technitium API (`/api/dhcp/scopes/set`). DHCP LXCs kept their Slate AX leases until expiry, then renewed from Technitium. + ### 2026-06-01 — created; replaced dnsmasq on 124 Stood up Technitium at `192.168.8.2`, imported the split-horizon zone (specific A + wildcard + MX/SPF/CAA), made it the primary nameserver in the NetBird `home-lab-dns` group. Verified all names resolve with dnsmasq/124 stopped; [LXC 124 retired](124-authentik.md). diff --git a/containers/121-caddy.md b/containers/121-caddy.md index bda0433..ceda2eb 100644 --- a/containers/121-caddy.md +++ b/containers/121-caddy.md @@ -65,6 +65,9 @@ Gitea webhook id 2 on `dtoro/caddy-conf`. Receiver, deploy script, install scrip ## Changelog +### 2026-06-02 — caddy.service unit missing; recreated +After the Slate AX → SODOLA network migration, Caddy was not listening (ports 80/443 dead). Root cause: the custom hubris1 Debian package (`caddy_1:2.11.3-hubris1_amd64`) does not ship a systemd service unit file. The unit had previously existed but was lost (likely on a package reinstall). Recreated at `/lib/systemd/system/caddy.service` with standard Caddy service config + `EnvironmentFile=/etc/caddy/caddy.env` (already present in `caddy.service.d/override.conf`). **Risk:** the unit will be lost again if the package is reinstalled without the file being tracked. Fix: add the service unit to the `caddy-conf` repo or rebuild the hubris1 package to include it. + ### 2026-04-28 — wiki entry created Initial documentation. 16 active sites at this date. diff --git a/hosts/hubris.md b/hosts/hubris.md index ec259e8..4bde448 100644 --- a/hosts/hubris.md +++ b/hosts/hubris.md @@ -6,8 +6,9 @@ Single-node Proxmox VE running 1 VM and 13 LXC containers. The whole homelab. - **Role:** Proxmox VE 9.1.2 hypervisor (kernel `6.14.11-4-pve`) - **Hardware:** GMKtec NucBox M6 Ultra — AMD Ryzen 5 7640HS (Phoenix APU), 12 vCPU / ~28 GiB RAM, 2× Samsung 990 EVO Plus NVMe (one SSD primary, one for `library` LVM). 2× Realtek RTL8125 NICs (`r8169`). - **BIOS:** 1.02 (2025-08-06) — vendor not on LVFS, no automated update path. See [investigations](../investigations/2026-04-21-hubris-crash-loop.md). -- **LAN (primary):** `192.168.8.77/24` on bridge `vmbr0` (slave: `eno1`), gateway `192.168.8.1`. Default route metric 0. -- **WiFi (failover):** `192.168.8.141/24` on `wlp3s0` (MediaTek MT7922, AX), DHCP from the same router. Default route metric 200. See [Phase 1 WiFi failover](#phase-1-wifi-failover) below. +- **Uplink:** `vmbr1` (slave: `eno1`) → SODOLA switch → Fritz!Box 7590. DHCP-reserved `192.168.178.10/24`, gateway `192.168.178.1`. +- **Homelab bridge:** `vmbr0` — portless internal bridge, `192.168.8.77/24` + `192.168.8.1/24` alias (LXC default gateway). All 16 LXCs and the HAOS VM are on `vmbr0`. Proxmox routes between `vmbr0` and `vmbr1`; Fritz!Box has a static route `192.168.8.0/24 → 192.168.178.10`. +- **WiFi:** disabled 2026-06-02 — `wlp3s0` removed from `/etc/network/interfaces`, wpa config deleted. Was used as a failover to the now-retired Slate AX AP. - **Mesh:** Netbird `wt0` `100.122.38.109/16`. Resolver: `100.122.38.109` (the local netbird daemon, which forwards to LAN/upstream and learns `*.hubris.network` answers via that path). See [mesh](../infrastructure/mesh.md). - **UI:** `https://proxmox.hubris.network` (via [caddy](../containers/121-caddy.md)) or `https://192.168.8.77:8006`. @@ -36,17 +37,6 @@ See [containers/index](../containers/index.md). 13 active (109 syncthing destroy - **Crash capture:** `/etc/sysctl.d/60-crash-capture.conf` (panic on oops/hardlockup/softlockup/rcu, auto-reboot 10 s), `/etc/modprobe.d/softdog.conf` (`soft_panic=1 soft_margin=60`), `/etc/systemd/system.conf.d/watchdog.conf` (`RuntimeWatchdogSec=15s`). Pstore traces collected to `/var/lib/systemd/pstore/` by `systemd-pstore.service`. **Caveat:** silent CPU lockups leave pstore empty. - **`rasdaemon`** (Debian pkg) collects MCE / memory / PCIe AER / thermal events to `/var/lib/rasdaemon/ras-mc_event.db`. Query with `ras-mc-ctl --summary` / `--errors`. (mcelog is retired in Debian 13 — don't go looking for it.) -## Phase 1 WiFi failover - -Host is dual-homed on LAN (`eno1`/`vmbr0`) and WiFi (`wlp3s0`) so management/SSH stay reachable when LAN drops. **Guests are not yet failed over** — the LXC fleet remains on `vmbr0`/`eno1`. Phase 2 will migrate guest networking off the bridge so the homelab survives full LAN loss. - -- WiFi creds in `/etc/wpa_supplicant/wpa_supplicant-wlp3s0.conf` (hashed PSK, mode 600). SSID lives in `/etc/network/interfaces` as `wpa-conf`. -- Both interfaces sit on the same `192.168.8.0/24`; cross-talk avoided with `arp_ignore=1` + `arp_announce=2` on `eno1`/`vmbr0`/`wlp3s0` (set via `post-up` in `/etc/network/interfaces`). -- A second default route at metric 200 is added on `wlp3s0` (post-up). LAN wins while up. -- **Carrier-based failover:** `vmbr0`'s carrier follows the LXC veth members, so it stays `1` even when `eno1` loses link. `ignore_routes_with_linkdown` is therefore not enough on its own. `wan-failover.service` (`/usr/local/sbin/wan-failover.sh`) watches `/sys/class/net/eno1/carrier` via `ip monitor link` and removes/restores the `vmbr0` default route on transitions. Logs to `journalctl -t wan-failover`. -- Failover verified 2026-04-28: `ip link set eno1 down` → outbound HTTP keeps working via WiFi; `ip link set eno1 up` → vmbr0 default restored. -- Reachable on `192.168.8.77` (LAN) and `192.168.8.141` (WiFi); SSH works on either. - ## Network performance baseline (2026-05-14) | Path | Throughput | Notes | @@ -99,6 +89,9 @@ OpenSSH on `0.0.0.0:22`. Netbird's built-in SSH server is on `100.122.38.109:220 ## Changelog +### 2026-06-02 — Slate AX retired; SODOLA switch added; network restructured +Replaced GL.iNet Slate AX sub-router with SODOLA 5-Port 2.5Gbit managed switch. Fritz!OS 8.x lacks second-IP-network support on LAN ports, so Proxmox now acts as the subnet router: `vmbr1` (eno1 → SODOLA → Fritz!Box) is the uplink at `192.168.178.10/24`; `vmbr0` is a portless internal bridge holding all LXCs/VMs with `192.168.8.1` as an alias (unchanged LXC gateway). Fritz!Box static route `192.168.8.0/24 → 192.168.178.10` enables inbound routing. No LXC configs changed. Eliminated double-NAT. WiFi (`wlp3s0`) also removed — was pointing at the Slate AX SSID, no longer useful. See [network](../infrastructure/network.md) and [migration plan](../plans/2026-06-01-slate-ax-to-sodola-migration.md). + ### 2026-05-14 — LXC 109 (syncthing) decommissioned User destroyed the syncthing LXC (had been stopped since 2026-04-21, never re-enabled). `pct destroy 109 --purge` cleaned `vm-109-disk-0` on `local-lvm` and the `/etc/pve/lxc/109.conf` entry. Data subtree `/mnt/library/syncthing` was already empty and retained as an empty dir. No DNS, Caddy, NFS-export, or claudio-monitor references to clean up. Entry moved to the "recently destroyed" table in [containers/index](../containers/index.md#recently-destroyed-kept-for-archaeology); references stripped from [README](../README.md), [media-permissions](../infrastructure/media-permissions.md), [vms/100-zimaos](../vms/100-zimaos.md), and [containers/102-nfs-export](../containers/102-nfs-export.md).