Files

dtoro 85457095e4 DNS single-source Phase 1 + decommission Tailscale fleet-wide

Phase 1 of the DNS-redundancy cleanup (keep NetBird, collapse toward one
zone) — the safe, mesh-independent half:

- Every homelab LXC now resolves via Technitium (192.168.8.2). Fixed 8
  boxes on a dead resolver (.180), the router (.1), or Tailscale MagicDNS
  (100.100.100.100): 101,102,104,105,106,114,119,126.
- Removed the redundant /etc/hosts auth/mcp/secrets overrides (Technitium
  returns identical-or-better answers); disabled hubris-hosts-override.
- Net effect: on-prem DNS (LXCs + household via Fritz!Box->Technitium) is
  now NetBird-independent, so dropping the managed zone later can't break
  on-LAN resolution. Phases 2-4 still pending.

Tailscale decommissioned (was legacy/being-phased-out):
- Removed from the 6 LXCs still running it (101,103,104,105,114,119):
  logout, disable tailscaled, apt purge, state cleared.
- inventory.yaml: dropped tailscale from accepted + all mesh blocks;
  regenerated hosts/*.yaml (also pruned orphan authentik/claudio-bot).
- Tightened secrets-issuance MESH_SUBNETS: removed the now-vestigial
  Tailscale CGNAT range 100.64.0.0/10.
- Updated narrative docs (mesh, dns, network, README, AGENTS,
  agent-enrollment, homelab-context, 105-apps, 107-dns).

Live infra changed on the fleet + Mac; this commit records the docs/inventory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-21 15:14:07 +02:00

4.9 KiB

Raw Blame History

Network

Physical and logical network topology for the homelab.

Why

The homelab runs on a dedicated internal subnet (192.168.8.0/24) isolated from the main household LAN (192.168.178.0/24). Isolation is enforced at Proxmox: LXC/VM traffic is bridged only on the internal vmbr0 bridge; Proxmox routes packets out to Fritz!Box via vmbr1. The main LAN cannot reach homelab services directly without a Fritz!Box static route (which is configured to allow inbound).

Fritz!OS 8.x does not support second IP networks on LAN ports, so Proxmox (hubris) acts as the subnet router rather than the Fritz!Box.

Hardware

Device	Role
Fritz!Box 7590	Main router / ISP gateway (`192.168.178.1`)
SODOLA 5-Port 2.5Gbit Managed	Homelab switch — flat L2, all ports native
hubris (Proxmox)	Subnet router — routes between `192.168.8.0/24` and `192.168.178.0/24`

Topology

ISP
 └── Fritz!Box 7590 (192.168.178.1)
      │   static route: 192.168.8.0/24 → 192.168.178.10
      │
      └── SODOLA 5-Port 2.5Gbit
           ├── Port 1  uplink → Fritz!Box LAN
           ├── Port 2  hubris eno1 → vmbr1 (192.168.178.10)
           ├── Port 3  [device]
           ├── Port 4  [device]
           └── Port 5  spare

hubris internal bridges:
  vmbr1  192.168.178.10/24  eno1 (uplink, DHCP-reserved)  gateway 192.168.178.1
  vmbr0  192.168.8.77/24    no physical port (internal)
         192.168.8.1/24     alias — LXC default gateway
            ├── all 16 LXCs
            └── HAOS VM

Subnets

Subnet	Gateway	Purpose
`192.168.178.0/24`	`192.168.178.1`	Household LAN — laptops, phones, Fritz!Box DHCP
`192.168.8.0/24`	`192.168.8.1` (Proxmox `vmbr0` alias)	Homelab — all LXCs and VMs

DHCP

Household (192.168.178.x): Fritz!Box built-in DHCP. Proxmox vmbr1 has a reservation: MAC 84:47:09:6b:e7:58 → 192.168.178.10.
Homelab (192.168.8.x): Technitium on CT 107 at 192.168.8.2. Range 192.168.8.241–192.168.8.254, gateway 192.168.8.1, DNS 192.168.8.2.

Static IPs span .101–.239 (all LXCs, VMs, and workstations). DHCP pool narrowed to .241–.254 (2026-06-03) to avoid overlap and IP conflicts.

DNS

Split-horizon DNS for *.hubris.network served by Technitium on CT 107 at 192.168.8.2:53. See dns.md for full detail.

Routing

Proxmox has net.ipv4.ip_forward=1 (already enabled by PVE). Packets from LXCs on vmbr0 destined for the internet exit via vmbr1 → Fritz!Box. Fritz!Box masquerades all outbound WAN traffic. Fritz!Box has a static route (192.168.8.0/24 → 192.168.178.10) so return traffic reaches the LXCs.

No NAT on Proxmox — traffic flows without double-NAT.

Remote access

NetBird mesh — the remote-administration path. Authenticated via Authentik on the VPS.
Tailscale (the previous overlay) was decommissioned 2026-06-21. See mesh.md.

DNS — split-horizon config and entry list
Ingress — public entry points via VPS traefik
Mesh — NetBird VPN overlay
hosts/hubris.md — Proxmox host (vmbr0/vmbr1 config)
CT 107 — dns — Technitium DNS + DHCP server

Changelog

2026-06-17 — Fritz!Box DNSv4 server set to Technitium (192.168.8.2)

Household LAN clients (192.168.178.x) now resolve *.hubris.network to LAN IPs. Configured in Fritz!Box at Internet → Filter → DNS Server → DNSv4 Server → "Use other DNSv4 servers" → Preferred = 192.168.8.2. No per-device or Netbird setup needed. Previous pool .100–.240 overlapped with all static LXCs/VMs ( .101–.239), creating IP conflict risk (DHCP could hand out an IP that a static service expects). Shrunk pool to .241–.254 via Technitium API. No services re-IP'd. 11 stale DHCP leases in .101–.110 will expire naturally. Open: ZimaOS (VM 100) holds DHCP lease .103 but inventory expects .195 — needs static IP set inside VM. See plan.

2026-06-02 — Executed migration; Proxmox as subnet router

Fritz!OS 8.x does not support second IP networks on LAN ports, so the final design uses Proxmox as the router: vmbr1 (eno1 → SODOLA → Fritz!Box) is the uplink at 192.168.178.10; vmbr0 is a portless internal bridge with 192.168.8.1 alias as the LXC gateway. Technitium DHCP enabled for 192.168.8.100–240. Caddy service unit was missing and recreated. See migration plan.

2026-06-01 — Initial network doc; Slate AX retired; SODOLA switch added

Replaced the GL.iNet Slate AX sub-router with the SODOLA 5-Port 2.5Gbit managed switch. Eliminated double-NAT. See migration plan.

4.9 KiB Raw Blame History Unescape Escape