oikos/plans/done/2026-06-01-slate-ax-to-sodola-migration.md

2026-06-01 — Slate AX → SODOLA Migration

Status: Done — 2026-06-02
Hardware: SODOLA 5-Port 2.5Gbit Managed Switch replacing GL.iNet Slate AX
Router: Fritz!Box 7590

Goal

Remove the Slate AX sub-router. It adds double-NAT, double port-forward complexity, and a second DHCP/gateway hop. Replace with the SODOLA switch so Proxmox and homelab devices attach directly to the Fritz!Box—without changing any of their IPs.

Current topology

ISP
 └── Fritz!Box 7590 (192.168.178.1)
      └── GL.iNet Slate AX  WAN: 192.168.178.x  LAN: 192.168.8.1  [NAT]
           ├── hubris (Proxmox)   192.168.8.77
           ├── + all 16 LXCs on vmbr0 bridged to the same subnet
           └── other homelab devices

Target topology

ISP
 └── Fritz!Box 7590
      ├── VLAN 1  192.168.178.0/24  (main LAN — laptops, phones)
      └── VLAN 10 192.168.8.0/24   gateway 192.168.8.1  (homelab, no NAT)
           │
           └── SODOLA 5-Port 2.5Gbit
                ├── Port 1  uplink → Fritz!Box LAN port
                ├── Port 2  hubris (Proxmox)     192.168.8.77
                ├── Port 3  [homelab device]
                ├── Port 4  [homelab device]
                └── Port 5  spare

Fritz!Box takes over 192.168.8.1 — the same gateway IP the Slate AX used. No static IPs or gateway entries change on any LXC or VM.

See network architecture for the permanent topology reference.

Pre-flight checklist

• Note Slate AX gateway IP on the homelab subnet (expected 192.168.8.1)
• Note Slate AX upstream DNS setting (what it forwards to)
• List all port forwards currently on the Slate AX → move these to Fritz!Box
• List all port forwards on Fritz!Box that point at the Slate AX WAN IP → collapse these into direct homelab-IP rules
• Confirm Fritz!OS version supports "second IP network" (Fritz!OS 7.x required)
• SSH into hubris: verify grep gateway /etc/network/interfaces → 192.168.8.1
• SODOLA web UI accessible and ports configurable before physical move

Fritz!Box configuration

Path: Home Network → Network → Network Settings → IPv4 Addresses → Add IP network

Field	Value
IP address	192.168.8.1
Subnet mask	255.255.255.0
DHCP range	192.168.8.100 – 192.168.8.240
Assign to	LAN port that connects to SODOLA
Network isolation	Enabled (blocks main LAN from initiating into homelab)
DNS for DHCP clients	192.168.8.2 (Technitium on CT 107)

After creating the network, move any port forwards from the Slate AX into Fritz!Box → Internet → Permits (target IPs are now directly reachable on 192.168.8.x).

SODOLA configuration

All ports in VLAN 10, untagged (simple access-port setup):

Port	PVID	Role
1	10	Uplink → Fritz!Box
2	10	hubris (Proxmox)
3	10	homelab device
4	10	homelab device
5	10	spare

Proxmox / LXC changes

If the Slate AX gateway was 192.168.8.1: no changes needed. Fritz!Box takes the same IP.

If Slate AX used a different gateway (e.g. .254), update:

# on hubris
nano /etc/network/interfaces   # change gateway line
ifreload -a
# for each LXC with a static gateway
pct config <id>                # check net0: line for gw=
pct set <id> --net0 name=eth0,bridge=vmbr0,ip=<ip>/24,gw=192.168.8.1

DNS after migration

Technitium (CT 107) at 192.168.8.2 continues to serve split-horizon DNS for hubris.network. The Fritz!Box DHCP server for VLAN 10 hands out 192.168.8.2 as the DNS server. This fixes the "update router DHCP DNS from dead .180 → .2" outstanding item in dns.md.

Cutover procedure

1. Configure Fritz!Box second IP network (VLAN 10 / 192.168.8.1) — verify DHCP works via a test laptop on the target port.
2. Configure SODOLA port VLAN assignments.
3. Connect SODOLA port 1 → Fritz!Box target LAN port.
4. Move hubris ethernet → SODOLA port 2. Proxmox should stay reachable immediately (same gateway IP).
5. Move remaining homelab devices to SODOLA ports 3–5.
6. Decommission Slate AX.

Verification

# internet from Proxmox
ssh proxmox "ping -c3 1.1.1.1"

# Fritz!Box main LAN reachable (routing between VLANs works)
ssh proxmox "ping -c3 192.168.178.1"

# split-horizon DNS via Technitium still resolves
ssh proxmox "dig @192.168.8.2 +short git.hubris.network"
# expected: 192.168.8.175

# Caddy reverse proxy responds
curl -sk https://git.hubris.network | head -5

# Authentik on VPS still reachable
curl -sk https://auth.hubris.network/if/flow/default-authentication-flow/ | head -5

Post-migration

• Update network.md topology to reflect new state.
• Add changelog entries to hosts/hubris.md and any affected container pages.
• Update status in plans/index.md to Done.
• If anything went sideways, open an investigation in investigations/.