Files

dtoro 4efddb8bed docs: fix pre-existing broken links surfaced by docs-lint

Problem: docs-lint (added in the wiki-hq reorg) surfaced 126 broken relative
links that predated this session — a container rename, incident/plan docs
that moved into archive/done subfolders without their inbound links being
updated, and a handful of relative-depth bugs in files nested under
containers/archive/ and plans/done/.

Fixes applied, by category:
- 124-authentik.md -> 106-auth-outpost.md (container was renamed; ~40 refs).
- investigations/{2026-04-21-hubris-crash-loop,2026-05-31-authentik-vps-migration}.md
  -> archive/ prefix (both moved to investigations/archive/ previously).
- plans/{2026-06-01-slate-ax-to-sodola-migration,2026-06-04_130000-deprecate-claudio-bot,
  2026-06-25-yuvomi-deployment}.md -> plans/done/ prefix.
- Depth bugs in files nested one level deeper than their siblings assumed
  (investigations/archive/*, knowledge/wiki/containers/archive/*,
  plans/done/*) — corrected relative-path depth.
- Destroyed containers with no surviving page (126-plato) delinked to the
  containers/index.md archaeology row instead of a 404.
- ludo-mini.yaml -> strong.yaml (host was renamed, same physical machine).
- netbird-vps.md (no narrative page exists) -> netbird-vps.yaml (substrate
  record, matching the existing convention for hosts without a wiki page).
- runbook-dpkg-interrupted.md refs -> .agents/skills/runbook-dpkg-interrupted/SKILL.md
  (missed in the phase-4 runbook move because the referencing files used a
  bare filename, not a runbooks/ prefix).
- One dangling forward-reference to a never-written investigation delinked
  to the actual incident record it was describing.

Left alone: two links in knowledge/wiki/containers/101-jellyfin.md into
devops/homelab-authentik-admin/ — an intentional reference to a sibling repo,
not present in this checkout.

Verification: broken-link count 126 -> 2 (real remainder is the cross-repo
reference above); gen-topology.py --check still exit 0; build_host_files.py
still idempotent; all inventory.yaml doc_page targets still resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-06 17:53:35 +02:00

4.9 KiB

Raw Blame History

Network

Physical and logical network topology for the homelab.

Why

The homelab runs on a dedicated internal subnet (192.168.8.0/24) isolated from the main household LAN (192.168.178.0/24). Isolation is enforced at Proxmox: LXC/VM traffic is bridged only on the internal vmbr0 bridge; Proxmox routes packets out to Fritz!Box via vmbr1. The main LAN cannot reach homelab services directly without a Fritz!Box static route (which is configured to allow inbound).

Fritz!OS 8.x does not support second IP networks on LAN ports, so Proxmox (hubris) acts as the subnet router rather than the Fritz!Box.

Hardware

Device	Role
Fritz!Box 7590	Main router / ISP gateway (`192.168.178.1`)
SODOLA 5-Port 2.5Gbit Managed	Homelab switch — flat L2, all ports native
hubris (Proxmox)	Subnet router — routes between `192.168.8.0/24` and `192.168.178.0/24`

Topology

ISP
 └── Fritz!Box 7590 (192.168.178.1)
      │   static route: 192.168.8.0/24 → 192.168.178.10
      │
      └── SODOLA 5-Port 2.5Gbit
           ├── Port 1  uplink → Fritz!Box LAN
           ├── Port 2  hubris eno1 → vmbr1 (192.168.178.10)
           ├── Port 3  [device]
           ├── Port 4  [device]
           └── Port 5  spare

hubris internal bridges:
  vmbr1  192.168.178.10/24  eno1 (uplink, DHCP-reserved)  gateway 192.168.178.1
  vmbr0  192.168.8.77/24    no physical port (internal)
         192.168.8.1/24     alias — LXC default gateway
            ├── all 16 LXCs
            └── HAOS VM

Subnets

Subnet	Gateway	Purpose
`192.168.178.0/24`	`192.168.178.1`	Household LAN — laptops, phones, Fritz!Box DHCP
`192.168.8.0/24`	`192.168.8.1` (Proxmox `vmbr0` alias)	Homelab — all LXCs and VMs

DHCP

Household (192.168.178.x): Fritz!Box built-in DHCP. Proxmox vmbr1 has a reservation: MAC 84:47:09:6b:e7:58 → 192.168.178.10.
Homelab (192.168.8.x): Technitium on CT 107 at 192.168.8.2. Range 192.168.8.241–192.168.8.254, gateway 192.168.8.1, DNS 192.168.8.2.

Static IPs span .101–.239 (all LXCs, VMs, and workstations). DHCP pool narrowed to .241–.254 (2026-06-03) to avoid overlap and IP conflicts.

DNS

Split-horizon DNS for *.hubris.network served by Technitium on CT 107 at 192.168.8.2:53. See dns.md for full detail.

Routing

Proxmox has net.ipv4.ip_forward=1 (already enabled by PVE). Packets from LXCs on vmbr0 destined for the internet exit via vmbr1 → Fritz!Box. Fritz!Box masquerades all outbound WAN traffic. Fritz!Box has a static route (192.168.8.0/24 → 192.168.178.10) so return traffic reaches the LXCs.

No NAT on Proxmox — traffic flows without double-NAT.

Remote access

NetBird mesh — primary path for remote administration. Authenticated via Authentik on the VPS.
Tailscale — legacy, being phased out. See mesh.md.

DNS — split-horizon config and entry list
Ingress — public entry points via VPS traefik
Mesh — NetBird / Tailscale VPN overlay
hosts/hubris.md — Proxmox host (vmbr0/vmbr1 config)
CT 107 — dns — Technitium DNS + DHCP server

Changelog

2026-06-17 — Fritz!Box DNSv4 server set to Technitium (192.168.8.2)

Household LAN clients (192.168.178.x) now resolve *.hubris.network to LAN IPs. Configured in Fritz!Box at Internet → Filter → DNS Server → DNSv4 Server → "Use other DNSv4 servers" → Preferred = 192.168.8.2. No per-device or Netbird setup needed. Previous pool .100–.240 overlapped with all static LXCs/VMs ( .101–.239), creating IP conflict risk (DHCP could hand out an IP that a static service expects). Shrunk pool to .241–.254 via Technitium API. No services re-IP'd. 11 stale DHCP leases in .101–.110 will expire naturally. Open: ZimaOS (VM 100) holds DHCP lease .103 but inventory expects .195 — needs static IP set inside VM. See plan.

2026-06-02 — Executed migration; Proxmox as subnet router

Fritz!OS 8.x does not support second IP networks on LAN ports, so the final design uses Proxmox as the router: vmbr1 (eno1 → SODOLA → Fritz!Box) is the uplink at 192.168.178.10; vmbr0 is a portless internal bridge with 192.168.8.1 alias as the LXC gateway. Technitium DHCP enabled for 192.168.8.100–240. Caddy service unit was missing and recreated. See migration plan.

2026-06-01 — Initial network doc; Slate AX retired; SODOLA switch added

Replaced the GL.iNet Slate AX sub-router with the SODOLA 5-Port 2.5Gbit managed switch. Eliminated double-NAT. See migration plan.

4.9 KiB Raw Blame History Unescape Escape