dtoro
4efddb8bed
Problem: docs-lint (added in the wiki-hq reorg) surfaced 126 broken relative
links that predated this session — a container rename, incident/plan docs
that moved into archive/done subfolders without their inbound links being
updated, and a handful of relative-depth bugs in files nested under
containers/archive/ and plans/done/.
Fixes applied, by category:
- 124-authentik.md -> 106-auth-outpost.md (container was renamed; ~40 refs).
- investigations/{2026-04-21-hubris-crash-loop,2026-05-31-authentik-vps-migration}.md
-> archive/ prefix (both moved to investigations/archive/ previously).
- plans/{2026-06-01-slate-ax-to-sodola-migration,2026-06-04_130000-deprecate-claudio-bot,
2026-06-25-yuvomi-deployment}.md -> plans/done/ prefix.
- Depth bugs in files nested one level deeper than their siblings assumed
(investigations/archive/*, knowledge/wiki/containers/archive/*,
plans/done/*) — corrected relative-path depth.
- Destroyed containers with no surviving page (126-plato) delinked to the
containers/index.md archaeology row instead of a 404.
- ludo-mini.yaml -> strong.yaml (host was renamed, same physical machine).
- netbird-vps.md (no narrative page exists) -> netbird-vps.yaml (substrate
record, matching the existing convention for hosts without a wiki page).
- runbook-dpkg-interrupted.md refs -> .agents/skills/runbook-dpkg-interrupted/SKILL.md
(missed in the phase-4 runbook move because the referencing files used a
bare filename, not a runbooks/ prefix).
- One dangling forward-reference to a never-written investigation delinked
to the actual incident record it was describing.
Left alone: two links in knowledge/wiki/containers/101-jellyfin.md into
devops/homelab-authentik-admin/ — an intentional reference to a sibling repo,
not present in this checkout.
Verification: broken-link count 126 -> 2 (real remainder is the cross-repo
reference above); gen-topology.py --check still exit 0; build_host_files.py
still idempotent; all inventory.yaml doc_page targets still resolve.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
132 lines
5.1 KiB
Markdown
132 lines
5.1 KiB
Markdown
# 2026-06-01 — Slate AX → SODOLA Migration
|
||
|
||
**Status:** Done — 2026-06-02
|
||
**Hardware:** SODOLA 5-Port 2.5Gbit Managed Switch replacing GL.iNet Slate AX
|
||
**Router:** Fritz!Box 7590
|
||
|
||
## Goal
|
||
|
||
Remove the Slate AX sub-router. It adds double-NAT, double port-forward complexity, and a second DHCP/gateway hop. Replace with the SODOLA switch so Proxmox and homelab devices attach directly to the Fritz!Box—without changing any of their IPs.
|
||
|
||
## Current topology
|
||
|
||
```
|
||
ISP
|
||
└── Fritz!Box 7590 (192.168.178.1)
|
||
└── GL.iNet Slate AX WAN: 192.168.178.x LAN: 192.168.8.1 [NAT]
|
||
├── hubris (Proxmox) 192.168.8.77
|
||
├── + all 16 LXCs on vmbr0 bridged to the same subnet
|
||
└── other homelab devices
|
||
```
|
||
|
||
## Target topology
|
||
|
||
```
|
||
ISP
|
||
└── Fritz!Box 7590
|
||
├── VLAN 1 192.168.178.0/24 (main LAN — laptops, phones)
|
||
└── VLAN 10 192.168.8.0/24 gateway 192.168.8.1 (homelab, no NAT)
|
||
│
|
||
└── SODOLA 5-Port 2.5Gbit
|
||
├── Port 1 uplink → Fritz!Box LAN port
|
||
├── Port 2 hubris (Proxmox) 192.168.8.77
|
||
├── Port 3 [homelab device]
|
||
├── Port 4 [homelab device]
|
||
└── Port 5 spare
|
||
```
|
||
|
||
Fritz!Box takes over `192.168.8.1` — the same gateway IP the Slate AX used. No static IPs or gateway entries change on any LXC or VM.
|
||
|
||
See [network architecture](../../knowledge/wiki/infrastructure/network.md) for the permanent topology reference.
|
||
|
||
## Pre-flight checklist
|
||
|
||
- [ ] Note Slate AX gateway IP on the homelab subnet (expected `192.168.8.1`)
|
||
- [ ] Note Slate AX upstream DNS setting (what it forwards to)
|
||
- [ ] List all port forwards currently on the Slate AX → move these to Fritz!Box
|
||
- [ ] List all port forwards on Fritz!Box that point at the Slate AX WAN IP → collapse these into direct homelab-IP rules
|
||
- [ ] Confirm Fritz!OS version supports "second IP network" (Fritz!OS 7.x required)
|
||
- [ ] SSH into hubris: verify `grep gateway /etc/network/interfaces` → `192.168.8.1`
|
||
- [ ] SODOLA web UI accessible and ports configurable before physical move
|
||
|
||
## Fritz!Box configuration
|
||
|
||
**Path:** Home Network → Network → Network Settings → IPv4 Addresses → Add IP network
|
||
|
||
| Field | Value |
|
||
|---|---|
|
||
| IP address | `192.168.8.1` |
|
||
| Subnet mask | `255.255.255.0` |
|
||
| DHCP range | `192.168.8.100 – 192.168.8.240` |
|
||
| Assign to | LAN port that connects to SODOLA |
|
||
| Network isolation | Enabled (blocks main LAN from initiating into homelab) |
|
||
| DNS for DHCP clients | `192.168.8.2` (Technitium on [CT 107](../../knowledge/wiki/containers/107-dns.md)) |
|
||
|
||
After creating the network, move any port forwards from the Slate AX into Fritz!Box → Internet → Permits (target IPs are now directly reachable on `192.168.8.x`).
|
||
|
||
## SODOLA configuration
|
||
|
||
All ports in VLAN 10, untagged (simple access-port setup):
|
||
|
||
| Port | PVID | Role |
|
||
|---|---|---|
|
||
| 1 | 10 | Uplink → Fritz!Box |
|
||
| 2 | 10 | hubris (Proxmox) |
|
||
| 3 | 10 | homelab device |
|
||
| 4 | 10 | homelab device |
|
||
| 5 | 10 | spare |
|
||
|
||
## Proxmox / LXC changes
|
||
|
||
If the Slate AX gateway was `192.168.8.1`: **no changes needed**. Fritz!Box takes the same IP.
|
||
|
||
If Slate AX used a different gateway (e.g. `.254`), update:
|
||
```bash
|
||
# on hubris
|
||
nano /etc/network/interfaces # change gateway line
|
||
ifreload -a
|
||
# for each LXC with a static gateway
|
||
pct config <id> # check net0: line for gw=
|
||
pct set <id> --net0 name=eth0,bridge=vmbr0,ip=<ip>/24,gw=192.168.8.1
|
||
```
|
||
|
||
## DNS after migration
|
||
|
||
Technitium ([CT 107](../../knowledge/wiki/containers/107-dns.md)) at `192.168.8.2` continues to serve split-horizon DNS for `hubris.network`. The Fritz!Box DHCP server for VLAN 10 hands out `192.168.8.2` as the DNS server. This fixes the "update router DHCP DNS from dead .180 → .2" outstanding item in [dns.md](../../knowledge/wiki/infrastructure/dns.md).
|
||
|
||
## Cutover procedure
|
||
|
||
1. Configure Fritz!Box second IP network (VLAN 10 / `192.168.8.1`) — verify DHCP works via a test laptop on the target port.
|
||
2. Configure SODOLA port VLAN assignments.
|
||
3. Connect SODOLA port 1 → Fritz!Box target LAN port.
|
||
4. Move hubris ethernet → SODOLA port 2. Proxmox should stay reachable immediately (same gateway IP).
|
||
5. Move remaining homelab devices to SODOLA ports 3–5.
|
||
6. Decommission Slate AX.
|
||
|
||
## Verification
|
||
|
||
```bash
|
||
# internet from Proxmox
|
||
ssh proxmox "ping -c3 1.1.1.1"
|
||
|
||
# Fritz!Box main LAN reachable (routing between VLANs works)
|
||
ssh proxmox "ping -c3 192.168.178.1"
|
||
|
||
# split-horizon DNS via Technitium still resolves
|
||
ssh proxmox "dig @192.168.8.2 +short git.hubris.network"
|
||
# expected: 192.168.8.175
|
||
|
||
# Caddy reverse proxy responds
|
||
curl -sk https://git.hubris.network | head -5
|
||
|
||
# Authentik on VPS still reachable
|
||
curl -sk https://auth.hubris.network/if/flow/default-authentication-flow/ | head -5
|
||
```
|
||
|
||
## Post-migration
|
||
|
||
- Update [network.md](../../knowledge/wiki/infrastructure/network.md) topology to reflect new state.
|
||
- Add changelog entries to [hosts/hubris.md](../../knowledge/wiki/hosts/hubris.md) and any affected container pages.
|
||
- Update status in [plans/index.md](../index.md) to `Done`.
|
||
- If anything went sideways, open an investigation in `investigations/`.
|