# 2026-06-01 — Slate AX → SODOLA Migration

**Status:** Done — 2026-06-02  
**Hardware:** SODOLA 5-Port 2.5Gbit Managed Switch replacing GL.iNet Slate AX  
**Router:** Fritz!Box 7590

## Goal

Remove the Slate AX sub-router. It adds double-NAT, double port-forward complexity, and a second DHCP/gateway hop. Replace with the SODOLA switch so Proxmox and homelab devices attach directly to the Fritz!Box—without changing any of their IPs.

## Current topology

```
ISP
 └── Fritz!Box 7590 (192.168.178.1)
      └── GL.iNet Slate AX  WAN: 192.168.178.x  LAN: 192.168.8.1  [NAT]
           ├── hubris (Proxmox)   192.168.8.77
           ├── + all 16 LXCs on vmbr0 bridged to the same subnet
           └── other homelab devices
```

## Target topology

```
ISP
 └── Fritz!Box 7590
      ├── VLAN 1  192.168.178.0/24  (main LAN — laptops, phones)
      └── VLAN 10 192.168.8.0/24   gateway 192.168.8.1  (homelab, no NAT)
           │
           └── SODOLA 5-Port 2.5Gbit
                ├── Port 1  uplink → Fritz!Box LAN port
                ├── Port 2  hubris (Proxmox)     192.168.8.77
                ├── Port 3  [homelab device]
                ├── Port 4  [homelab device]
                └── Port 5  spare
```

Fritz!Box takes over `192.168.8.1` — the same gateway IP the Slate AX used. No static IPs or gateway entries change on any LXC or VM.

See [network architecture](../infrastructure/network.md) for the permanent topology reference.

## Pre-flight checklist

- [ ] Note Slate AX gateway IP on the homelab subnet (expected `192.168.8.1`)
- [ ] Note Slate AX upstream DNS setting (what it forwards to)
- [ ] List all port forwards currently on the Slate AX → move these to Fritz!Box
- [ ] List all port forwards on Fritz!Box that point at the Slate AX WAN IP → collapse these into direct homelab-IP rules
- [ ] Confirm Fritz!OS version supports "second IP network" (Fritz!OS 7.x required)
- [ ] SSH into hubris: verify `grep gateway /etc/network/interfaces` → `192.168.8.1`
- [ ] SODOLA web UI accessible and ports configurable before physical move

## Fritz!Box configuration

**Path:** Home Network → Network → Network Settings → IPv4 Addresses → Add IP network

| Field | Value |
|---|---|
| IP address | `192.168.8.1` |
| Subnet mask | `255.255.255.0` |
| DHCP range | `192.168.8.100 – 192.168.8.240` |
| Assign to | LAN port that connects to SODOLA |
| Network isolation | Enabled (blocks main LAN from initiating into homelab) |
| DNS for DHCP clients | `192.168.8.2` (Technitium on [CT 107](../containers/107-dns.md)) |

After creating the network, move any port forwards from the Slate AX into Fritz!Box → Internet → Permits (target IPs are now directly reachable on `192.168.8.x`).

## SODOLA configuration

All ports in VLAN 10, untagged (simple access-port setup):

| Port | PVID | Role |
|---|---|---|
| 1 | 10 | Uplink → Fritz!Box |
| 2 | 10 | hubris (Proxmox) |
| 3 | 10 | homelab device |
| 4 | 10 | homelab device |
| 5 | 10 | spare |

## Proxmox / LXC changes

If the Slate AX gateway was `192.168.8.1`: **no changes needed**. Fritz!Box takes the same IP.

If Slate AX used a different gateway (e.g. `.254`), update:
```bash
# on hubris
nano /etc/network/interfaces   # change gateway line
ifreload -a
# for each LXC with a static gateway
pct config <id>                # check net0: line for gw=
pct set <id> --net0 name=eth0,bridge=vmbr0,ip=<ip>/24,gw=192.168.8.1
```

## DNS after migration

Technitium ([CT 107](../containers/107-dns.md)) at `192.168.8.2` continues to serve split-horizon DNS for `hubris.network`. The Fritz!Box DHCP server for VLAN 10 hands out `192.168.8.2` as the DNS server. This fixes the "update router DHCP DNS from dead .180 → .2" outstanding item in [dns.md](../infrastructure/dns.md).

## Cutover procedure

1. Configure Fritz!Box second IP network (VLAN 10 / `192.168.8.1`) — verify DHCP works via a test laptop on the target port.
2. Configure SODOLA port VLAN assignments.
3. Connect SODOLA port 1 → Fritz!Box target LAN port.
4. Move hubris ethernet → SODOLA port 2. Proxmox should stay reachable immediately (same gateway IP).
5. Move remaining homelab devices to SODOLA ports 3–5.
6. Decommission Slate AX.

## Verification

```bash
# internet from Proxmox
ssh proxmox "ping -c3 1.1.1.1"

# Fritz!Box main LAN reachable (routing between VLANs works)
ssh proxmox "ping -c3 192.168.178.1"

# split-horizon DNS via Technitium still resolves
ssh proxmox "dig @192.168.8.2 +short git.hubris.network"
# expected: 192.168.8.175

# Caddy reverse proxy responds
curl -sk https://git.hubris.network | head -5

# Authentik on VPS still reachable
curl -sk https://auth.hubris.network/if/flow/default-authentication-flow/ | head -5
```

## Post-migration

- Update [network.md](../infrastructure/network.md) topology to reflect new state.
- Add changelog entries to [hosts/hubris.md](../hosts/hubris.md) and any affected container pages.
- Update status in [plans/index.md](index.md) to `Done`.
- If anything went sideways, open an investigation in `investigations/`.