dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

network: migration complete — Proxmox as subnet router, Technitium DHCP live

Browse Source 
- plans/: mark Slate AX → SODOLA migration as Done (2026-06-02)
- infrastructure/network.md: rewrite to reflect actual topology —
  Fritz!OS 8.x lacks second-IP-network support, so Proxmox routes between
  vmbr1 (192.168.178.10, uplink) and vmbr0 (192.168.8.x, internal portless
  bridge with 192.168.8.1 alias). Static route on Fritz!Box, no NAT on Proxmox.
  Technitium DHCP enabled for 192.168.8.100–240 (gateway .1, DNS .2).
  Caddy service unit was missing on CT 121 — recreated and enabled.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-02 21:34:56 +02:00
parent 1e7c5a7153
commit 99d412370b
3 changed files with 45 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
infrastructure/network.md
View File

@@ -4,53 +4,63 @@ Physical and logical network topology for the homelab.
## Why ## Why
The homelab runs on a dedicated subnet (`192.168.8.0/24`) isolated from the main household LAN (`192.168.178.0/24`). Isolation is enforced at the Fritz!Box level: homelab devices can reach the internet and main LAN can reach homelab services via explicit port forwards, but main LAN cannot initiate arbitrary connections into the homelab subnet. The homelab runs on a dedicated internal subnet (`192.168.8.0/24`) isolated from the main household LAN (`192.168.178.0/24`). Isolation is enforced at Proxmox: LXC/VM traffic is bridged only on the internal `vmbr0` bridge; Proxmox routes packets out to Fritz!Box via `vmbr1`. The main LAN cannot reach homelab services directly without a Fritz!Box static route (which is configured to allow inbound).
Fritz!OS 8.x does not support second IP networks on LAN ports, so Proxmox (`hubris`) acts as the subnet router rather than the Fritz!Box.
## Hardware ## Hardware
| Device | Role | | Device | Role |
|---|---| |---|---|
| Fritz!Box 7590 | Main router / ISP gateway, VLAN router between subnets | | Fritz!Box 7590 | Main router / ISP gateway (`192.168.178.1`) |
| SODOLA 5-Port 2.5Gbit Managed | Homelab switch, all ports in VLAN 10 | | SODOLA 5-Port 2.5Gbit Managed | Homelab switch — flat L2, all ports native |
| hubris (Proxmox) | Subnet router — routes between `192.168.8.0/24` and `192.168.178.0/24` |
## VLANs
| VLAN | Subnet | Gateway | Devices |
|---|---|---|---|
| 1 (native) | 192.168.178.0/24 | 192.168.178.1 | Household LAN — laptops, phones, APs |
| 10 | 192.168.8.0/24 | 192.168.8.1 | Homelab — Proxmox, all LXCs/VMs |
## Topology ## Topology
``` ```
ISP ISP
└── Fritz!Box 7590 └── Fritz!Box 7590 (192.168.178.1)
├── VLAN 1 192.168.178.0/24 (main LAN) │ static route: 192.168.8.0/24 → 192.168.178.10
└── VLAN 10 192.168.8.0/24 (homelab) │
│ └── SODOLA 5-Port 2.5Gbit
└── SODOLA 5-Port 2.5Gbit ├── Port 1 uplink → Fritz!Box LAN
├── Port 1 uplink → Fritz!Box ├── Port 2 hubris eno1 → vmbr1 (192.168.178.10)
├── Port 2 hubris (Proxmox, 192.168.8.77) ├── Port 3 [device]
├── Port 3 [device] ├── Port 4 [device]
├── Port 4 [device] └── Port 5 spare
└── Port 5 spare
hubris internal bridges:
vmbr1 192.168.178.10/24 eno1 (uplink, DHCP-reserved) gateway 192.168.178.1
vmbr0 192.168.8.77/24 no physical port (internal)
192.168.8.1/24 alias — LXC default gateway
├── all 16 LXCs
└── HAOS VM
``` ```
## Subnets
| Subnet | Gateway | Purpose |
|---|---|---|
| `192.168.178.0/24` | `192.168.178.1` | Household LAN — laptops, phones, Fritz!Box DHCP |
| `192.168.8.0/24` | `192.168.8.1` (Proxmox `vmbr0` alias) | Homelab — all LXCs and VMs |
## DHCP ## DHCP
Fritz!Box serves DHCP for both VLANs. For VLAN 10 homelab: - **Household (`192.168.178.x`)**: Fritz!Box built-in DHCP. Proxmox `vmbr1` has a reservation: MAC `84:47:09:6b:e7:58` → `192.168.178.10`.
- Range: `192.168.8.100 – 192.168.8.240` - **Homelab (`192.168.8.x`)**: Technitium on [CT 107](../containers/107-dns.md) at `192.168.8.2`. Range `192.168.8.100–192.168.8.240`, gateway `192.168.8.1`, DNS `192.168.8.2`.
- DNS: `192.168.8.2` (Technitium on [CT 107](../containers/107-dns.md))
Most homelab hosts use static IPs below `.100` — DHCP only assigns to new/transient devices. Most homelab LXCs use static IPs below `.100`. DHCP only covers new/transient containers.
## DNS ## DNS
Split-horizon DNS for `*.hubris.network` served by Technitium on [CT 107](../containers/107-dns.md) at `192.168.8.2:53`. See [dns.md](dns.md) for full detail. Split-horizon DNS for `*.hubris.network` served by Technitium on [CT 107](../containers/107-dns.md) at `192.168.8.2:53`. See [dns.md](dns.md) for full detail.
## Port forwarding ## Routing
All inbound port forwards are on the Fritz!Box directly. The old double-hop (Fritz!Box → Slate AX → homelab) was eliminated when the Slate AX was retired. Target IPs are homelab addresses (`192.168.8.x`). Proxmox has `net.ipv4.ip_forward=1` (already enabled by PVE). Packets from LXCs on `vmbr0` destined for the internet exit via `vmbr1` → Fritz!Box. Fritz!Box masquerades all outbound WAN traffic. Fritz!Box has a static route (`192.168.8.0/24 → 192.168.178.10`) so return traffic reaches the LXCs.
No NAT on Proxmox — traffic flows without double-NAT.
## Remote access ## Remote access
@@ -62,10 +72,13 @@ All inbound port forwards are on the Fritz!Box directly. The old double-hop (Fri
- [DNS](dns.md) — split-horizon config and entry list - [DNS](dns.md) — split-horizon config and entry list
- [Ingress](ingress.md) — public entry points via VPS traefik - [Ingress](ingress.md) — public entry points via VPS traefik
- [Mesh](mesh.md) — NetBird / Tailscale VPN overlay - [Mesh](mesh.md) — NetBird / Tailscale VPN overlay
- [hosts/hubris.md](../hosts/hubris.md) — Proxmox host - [hosts/hubris.md](../hosts/hubris.md) — Proxmox host (vmbr0/vmbr1 config)
- [CT 107 — dns](../containers/107-dns.md) — Technitium DNS server - [CT 107 — dns](../containers/107-dns.md) — Technitium DNS + DHCP server
## Changelog ## Changelog
### 2026-06-01 — Slate AX retired; SODOLA switch added; Fritz!Box becomes homelab gateway ### 2026-06-02 — Executed migration; Proxmox as subnet router
Replaced the GL.iNet Slate AX sub-router with the SODOLA 5-Port 2.5Gbit managed switch. Fritz!Box 7590 now routes VLAN 10 (`192.168.8.0/24`) directly — no more double-NAT. Gateway `192.168.8.1` is unchanged so no LXC or VM needed reconfiguration. Fritz!Box DHCP for VLAN 10 now hands out `192.168.8.2` (Technitium) as DNS, resolving the outstanding "update router DHCP DNS" item. See [migration plan](../plans/2026-06-01-slate-ax-to-sodola-migration.md). Fritz!OS 8.x does not support second IP networks on LAN ports, so the final design uses Proxmox as the router: `vmbr1` (eno1 → SODOLA → Fritz!Box) is the uplink at `192.168.178.10`; `vmbr0` is a portless internal bridge with `192.168.8.1` alias as the LXC gateway. Technitium DHCP enabled for `192.168.8.100–240`. Caddy service unit was missing and recreated. See [migration plan](../plans/2026-06-01-slate-ax-to-sodola-migration.md).
### 2026-06-01 — Initial network doc; Slate AX retired; SODOLA switch added
Replaced the GL.iNet Slate AX sub-router with the SODOLA 5-Port 2.5Gbit managed switch. Eliminated double-NAT. See [migration plan](../plans/2026-06-01-slate-ax-to-sodola-migration.md).

2
plans/2026-06-01-slate-ax-to-sodola-migration.md
View File

@@ -1,6 +1,6 @@
# 2026-06-01 — Slate AX → SODOLA Migration # 2026-06-01 — Slate AX → SODOLA Migration
**Status:** Planned **Status:** Done — 2026-06-02
**Hardware:** SODOLA 5-Port 2.5Gbit Managed Switch replacing GL.iNet Slate AX **Hardware:** SODOLA 5-Port 2.5Gbit Managed Switch replacing GL.iNet Slate AX
**Router:** Fritz!Box 7590 **Router:** Fritz!Box 7590

2
plans/index.md
View File

@@ -6,7 +6,7 @@ Pre-flight runbooks for planned changes that haven't happened yet. Once executed
| Date | Title | Status | | Date | Title | Status |
| ---- | ----- | ------ | | ---- | ----- | ------ |
| 2026-06-01 | [Slate AX → SODOLA managed switch migration](2026-06-01-slate-ax-to-sodola-migration.md) | Planned | | 2026-06-01 | [Slate AX → SODOLA managed switch migration](2026-06-01-slate-ax-to-sodola-migration.md) | Done |
## Conventions ## Conventions