dtoro
99d412370b
- plans/: mark Slate AX → SODOLA migration as Done (2026-06-02) - infrastructure/network.md: rewrite to reflect actual topology — Fritz!OS 8.x lacks second-IP-network support, so Proxmox routes between vmbr1 (192.168.178.10, uplink) and vmbr0 (192.168.8.x, internal portless bridge with 192.168.8.1 alias). Static route on Fritz!Box, no NAT on Proxmox. Technitium DHCP enabled for 192.168.8.100–240 (gateway .1, DNS .2). Caddy service unit was missing on CT 121 — recreated and enabled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
132 lines
5.0 KiB
Markdown
132 lines
5.0 KiB
Markdown
# 2026-06-01 — Slate AX → SODOLA Migration
|
||
|
||
**Status:** Done — 2026-06-02
|
||
**Hardware:** SODOLA 5-Port 2.5Gbit Managed Switch replacing GL.iNet Slate AX
|
||
**Router:** Fritz!Box 7590
|
||
|
||
## Goal
|
||
|
||
Remove the Slate AX sub-router. It adds double-NAT, double port-forward complexity, and a second DHCP/gateway hop. Replace with the SODOLA switch so Proxmox and homelab devices attach directly to the Fritz!Box—without changing any of their IPs.
|
||
|
||
## Current topology
|
||
|
||
```
|
||
ISP
|
||
└── Fritz!Box 7590 (192.168.178.1)
|
||
└── GL.iNet Slate AX WAN: 192.168.178.x LAN: 192.168.8.1 [NAT]
|
||
├── hubris (Proxmox) 192.168.8.77
|
||
├── + all 16 LXCs on vmbr0 bridged to the same subnet
|
||
└── other homelab devices
|
||
```
|
||
|
||
## Target topology
|
||
|
||
```
|
||
ISP
|
||
└── Fritz!Box 7590
|
||
├── VLAN 1 192.168.178.0/24 (main LAN — laptops, phones)
|
||
└── VLAN 10 192.168.8.0/24 gateway 192.168.8.1 (homelab, no NAT)
|
||
│
|
||
└── SODOLA 5-Port 2.5Gbit
|
||
├── Port 1 uplink → Fritz!Box LAN port
|
||
├── Port 2 hubris (Proxmox) 192.168.8.77
|
||
├── Port 3 [homelab device]
|
||
├── Port 4 [homelab device]
|
||
└── Port 5 spare
|
||
```
|
||
|
||
Fritz!Box takes over `192.168.8.1` — the same gateway IP the Slate AX used. No static IPs or gateway entries change on any LXC or VM.
|
||
|
||
See [network architecture](../infrastructure/network.md) for the permanent topology reference.
|
||
|
||
## Pre-flight checklist
|
||
|
||
- [ ] Note Slate AX gateway IP on the homelab subnet (expected `192.168.8.1`)
|
||
- [ ] Note Slate AX upstream DNS setting (what it forwards to)
|
||
- [ ] List all port forwards currently on the Slate AX → move these to Fritz!Box
|
||
- [ ] List all port forwards on Fritz!Box that point at the Slate AX WAN IP → collapse these into direct homelab-IP rules
|
||
- [ ] Confirm Fritz!OS version supports "second IP network" (Fritz!OS 7.x required)
|
||
- [ ] SSH into hubris: verify `grep gateway /etc/network/interfaces` → `192.168.8.1`
|
||
- [ ] SODOLA web UI accessible and ports configurable before physical move
|
||
|
||
## Fritz!Box configuration
|
||
|
||
**Path:** Home Network → Network → Network Settings → IPv4 Addresses → Add IP network
|
||
|
||
| Field | Value |
|
||
|---|---|
|
||
| IP address | `192.168.8.1` |
|
||
| Subnet mask | `255.255.255.0` |
|
||
| DHCP range | `192.168.8.100 – 192.168.8.240` |
|
||
| Assign to | LAN port that connects to SODOLA |
|
||
| Network isolation | Enabled (blocks main LAN from initiating into homelab) |
|
||
| DNS for DHCP clients | `192.168.8.2` (Technitium on [CT 107](../containers/107-dns.md)) |
|
||
|
||
After creating the network, move any port forwards from the Slate AX into Fritz!Box → Internet → Permits (target IPs are now directly reachable on `192.168.8.x`).
|
||
|
||
## SODOLA configuration
|
||
|
||
All ports in VLAN 10, untagged (simple access-port setup):
|
||
|
||
| Port | PVID | Role |
|
||
|---|---|---|
|
||
| 1 | 10 | Uplink → Fritz!Box |
|
||
| 2 | 10 | hubris (Proxmox) |
|
||
| 3 | 10 | homelab device |
|
||
| 4 | 10 | homelab device |
|
||
| 5 | 10 | spare |
|
||
|
||
## Proxmox / LXC changes
|
||
|
||
If the Slate AX gateway was `192.168.8.1`: **no changes needed**. Fritz!Box takes the same IP.
|
||
|
||
If Slate AX used a different gateway (e.g. `.254`), update:
|
||
```bash
|
||
# on hubris
|
||
nano /etc/network/interfaces # change gateway line
|
||
ifreload -a
|
||
# for each LXC with a static gateway
|
||
pct config <id> # check net0: line for gw=
|
||
pct set <id> --net0 name=eth0,bridge=vmbr0,ip=<ip>/24,gw=192.168.8.1
|
||
```
|
||
|
||
## DNS after migration
|
||
|
||
Technitium ([CT 107](../containers/107-dns.md)) at `192.168.8.2` continues to serve split-horizon DNS for `hubris.network`. The Fritz!Box DHCP server for VLAN 10 hands out `192.168.8.2` as the DNS server. This fixes the "update router DHCP DNS from dead .180 → .2" outstanding item in [dns.md](../infrastructure/dns.md).
|
||
|
||
## Cutover procedure
|
||
|
||
1. Configure Fritz!Box second IP network (VLAN 10 / `192.168.8.1`) — verify DHCP works via a test laptop on the target port.
|
||
2. Configure SODOLA port VLAN assignments.
|
||
3. Connect SODOLA port 1 → Fritz!Box target LAN port.
|
||
4. Move hubris ethernet → SODOLA port 2. Proxmox should stay reachable immediately (same gateway IP).
|
||
5. Move remaining homelab devices to SODOLA ports 3–5.
|
||
6. Decommission Slate AX.
|
||
|
||
## Verification
|
||
|
||
```bash
|
||
# internet from Proxmox
|
||
ssh proxmox "ping -c3 1.1.1.1"
|
||
|
||
# Fritz!Box main LAN reachable (routing between VLANs works)
|
||
ssh proxmox "ping -c3 192.168.178.1"
|
||
|
||
# split-horizon DNS via Technitium still resolves
|
||
ssh proxmox "dig @192.168.8.2 +short git.hubris.network"
|
||
# expected: 192.168.8.175
|
||
|
||
# Caddy reverse proxy responds
|
||
curl -sk https://git.hubris.network | head -5
|
||
|
||
# Authentik on VPS still reachable
|
||
curl -sk https://auth.hubris.network/if/flow/default-authentication-flow/ | head -5
|
||
```
|
||
|
||
## Post-migration
|
||
|
||
- Update [network.md](../infrastructure/network.md) topology to reflect new state.
|
||
- Add changelog entries to [hosts/hubris.md](../hosts/hubris.md) and any affected container pages.
|
||
- Update status in [plans/index.md](index.md) to `Done`.
|
||
- If anything went sideways, open an investigation in `investigations/`.
|