From ec9659d0cb5692f5e03c31b792978a28f70bd8fb Mon Sep 17 00:00:00 2001 From: Kaloyan Danchev Date: Fri, 6 Feb 2026 12:45:16 +0200 Subject: [PATCH] Restructure docs: archive VLAN migration, update IPs to VLAN 10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Major documentation cleanup after VLAN migration completion: - Archive 12 VLAN project docs to archive/vlan-migration/ - Archive 5 done WIP docs (VLAN proposals, AI stack, Fossorial, DNS backup) - Create standing reference docs 08-DNS-ARCHITECTURE and 09-TAILSCALE-VPN - Renumber docs to clean 01-09 sequence with merged CHANGELOG - Update all active docs from stale 192.168.31.x to current VLAN 10 IPs - Fix CSS1 (.10.9→.10.3) and ZX1 (.10.7→.10.4) IPs in hardware inventory - Clean 06-VLAN-DEVICE-ASSIGNMENT: remove migration columns/sections, fix VLAN 25 subnet Co-Authored-By: Claude Opus 4.6 --- CLAUDE.md | 14 +- README.md | 47 ++- docs/00-CHANGELOG.md | 118 ------ docs/01-NETWORK-MAP.md | 76 ++-- docs/03-SERVICES-OTHER.md | 6 +- docs/03-VLAN-DEVICE-ASSIGNMENT.md | 248 ----------- docs/04-HARDWARE-INVENTORY.md | 6 +- ...-UTILIZATION.md => 05-PORT-UTILIZATION.md} | 8 +- docs/06-CHANGELOG.md | 175 -------- docs/06-VLAN-DEVICE-ASSIGNMENT.md | 206 ++++++++++ ...AN-CONFIG.md => 07-WIFI-CAPSMAN-CONFIG.md} | 0 docs/08-DNS-ARCHITECTURE.md | 387 ++++++++++++++++++ docs/09-TAILSCALE-VPN.md | 208 ++++++++++ docs/CHANGELOG.md | 228 +++++++++++ docs/{wip => archive}/FOSSORIAL-TUNNELS.md | 0 docs/{wip => archive}/LOCAL-AI-STACK.md | 0 docs/archive/README.md | 29 +- docs/{wip => archive}/VLAN-PROPOSAL.md | 0 docs/{wip => archive}/VLAN-SEGMENTATION.md | 0 .../vlan-migration}/04-VLAN-MIGRATION-PLAN.md | 0 .../09-MIKROTIK-ADGUARD-DOT-DOH.md | 0 .../vlan-migration}/10-MIKROTIK-TAILSCALE.md | 0 .../vlan-migration}/11-VLAN-IMPLEMENTATION.md | 0 .../vlan-migration}/12-VLAN-SETUP-PROGRESS.md | 0 .../vlan-migration}/13-VLAN-SETUP-PLAN-V2.md | 0 .../14-VLAN-SETUP-PLAN-V3-SAFE-MODE.md | 0 .../15-VLAN-SETUP-COMPLETE-2026-01-31.md | 0 .../vlan-migration}/16-ADGUARD-VLAN-PLAN.md | 0 .../17-DNS-ADGUARD-FAILOVER.md | 0 .../vlan-migration}/18-MIKROTIK-TAILSCALE.md | 0 .../20-DEVICE-MIGRATION-WORKSHEET.md | 0 .../DNS-REDIRECT-RULES-BACKUP.md | 0 docs/wip/GITOPS-CONTAINERS.md | 2 +- docs/wip/README.md | 18 +- 34 files changed, 1145 insertions(+), 631 deletions(-) delete mode 100644 docs/00-CHANGELOG.md delete mode 100644 docs/03-VLAN-DEVICE-ASSIGNMENT.md rename docs/{02-PORT-UTILIZATION.md => 05-PORT-UTILIZATION.md} (98%) delete mode 100644 docs/06-CHANGELOG.md create mode 100644 docs/06-VLAN-DEVICE-ASSIGNMENT.md rename docs/{19-WIFI-CAPSMAN-CONFIG.md => 07-WIFI-CAPSMAN-CONFIG.md} (100%) create mode 100644 docs/08-DNS-ARCHITECTURE.md create mode 100644 docs/09-TAILSCALE-VPN.md create mode 100644 docs/CHANGELOG.md rename docs/{wip => archive}/FOSSORIAL-TUNNELS.md (100%) rename docs/{wip => archive}/LOCAL-AI-STACK.md (100%) rename docs/{wip => archive}/VLAN-PROPOSAL.md (100%) rename docs/{wip => archive}/VLAN-SEGMENTATION.md (100%) rename docs/{ => archive/vlan-migration}/04-VLAN-MIGRATION-PLAN.md (100%) rename docs/{ => archive/vlan-migration}/09-MIKROTIK-ADGUARD-DOT-DOH.md (100%) rename docs/{ => archive/vlan-migration}/10-MIKROTIK-TAILSCALE.md (100%) rename docs/{ => archive/vlan-migration}/11-VLAN-IMPLEMENTATION.md (100%) rename docs/{ => archive/vlan-migration}/12-VLAN-SETUP-PROGRESS.md (100%) rename docs/{ => archive/vlan-migration}/13-VLAN-SETUP-PLAN-V2.md (100%) rename docs/{ => archive/vlan-migration}/14-VLAN-SETUP-PLAN-V3-SAFE-MODE.md (100%) rename docs/{ => archive/vlan-migration}/15-VLAN-SETUP-COMPLETE-2026-01-31.md (100%) rename docs/{ => archive/vlan-migration}/16-ADGUARD-VLAN-PLAN.md (100%) rename docs/{ => archive/vlan-migration}/17-DNS-ADGUARD-FAILOVER.md (100%) rename docs/{ => archive/vlan-migration}/18-MIKROTIK-TAILSCALE.md (100%) rename docs/{ => archive/vlan-migration}/20-DEVICE-MIGRATION-WORKSHEET.md (100%) rename docs/{wip => archive/vlan-migration}/DNS-REDIRECT-RULES-BACKUP.md (100%) diff --git a/CLAUDE.md b/CLAUDE.md index 40c6961..a942e99 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -49,12 +49,16 @@ infrastructure/ └── docs/ ├── 01-NETWORK-MAP.md # Network topology ├── 02-SERVICES-CRITICAL.md # P0/P1 services (DNS, Auth, Proxy) - ├── 02-PORT-UTILIZATION.md # Device port assignments ├── 03-SERVICES-OTHER.md # Non-critical services - ├── 03-VLAN-DEVICE-ASSIGNMENT.md # VLAN device mapping ├── 04-HARDWARE-INVENTORY.md # Hardware list - ├── 06-CHANGELOG.md # Change history - ├── archive/ # Completed phase docs + ├── 05-PORT-UTILIZATION.md # Device port assignments + ├── 06-VLAN-DEVICE-ASSIGNMENT.md # VLAN device mapping + ├── 07-WIFI-CAPSMAN-CONFIG.md # WiFi and CAPsMAN settings + ├── 08-DNS-ARCHITECTURE.md # DNS failover architecture + ├── 09-TAILSCALE-VPN.md # Tailscale VPN setup + ├── CHANGELOG.md # Change history + ├── archive/ # Completed/legacy docs + │ └── vlan-migration/ # VLAN migration project artifacts ├── incidents/ # Incident reports └── wip/ # Work in progress ``` @@ -93,7 +97,7 @@ cd /tmp && \ git push ``` -### Changelog Format (docs/06-CHANGELOG.md) +### Changelog Format (docs/CHANGELOG.md) ```markdown ## YYYY-MM-DD - [PHASE X] Task description - COMPLETED/FIXED/ISSUE diff --git a/README.md b/README.md index 0c0ab29..bd79984 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # XTRM Home Lab Infrastructure -**Domain:** xtrm-lab.org +**Domain:** xtrm-lab.org **Repository:** https://git.xtrm-lab.org/jazzymc/infrastructure --- @@ -22,15 +22,20 @@ ``` docs/ -├── 01-NETWORK-MAP.md # Network topology, IPs, Docker networks -├── 02-SERVICES-CRITICAL.md # DNS, Auth, Routing - must stay up -├── 03-SERVICES-OTHER.md # All other services -├── 04-HARDWARE-INVENTORY.md # Physical devices, specs, serials -├── 00-CHANGELOG.md # Major events only -├── wip/ # Planned changes & ideas -│ ├── UPGRADE-2026-HARDWARE.md -│ └── GITOPS-CONTAINERS.md -└── archive/ # Legacy docs (read-only) +├── 01-NETWORK-MAP.md # Network topology, IPs, Docker networks +├── 02-SERVICES-CRITICAL.md # DNS, Auth, Routing - must stay up +├── 03-SERVICES-OTHER.md # All other services +├── 04-HARDWARE-INVENTORY.md # Physical devices, specs, serials +├── 05-PORT-UTILIZATION.md # Device port assignments +├── 06-VLAN-DEVICE-ASSIGNMENT.md # VLAN device mapping +├── 07-WIFI-CAPSMAN-CONFIG.md # WiFi and CAPsMAN settings +├── 08-DNS-ARCHITECTURE.md # DNS failover architecture +├── 09-TAILSCALE-VPN.md # Tailscale VPN setup +├── CHANGELOG.md # Change history +├── archive/ # Completed/legacy docs +│ └── vlan-migration/ # VLAN migration project artifacts +├── incidents/ # Incident reports +└── wip/ # Work in progress ``` --- @@ -39,11 +44,11 @@ docs/ | Device | IP | Role | |--------|-----|------| -| HAP1 | 192.168.31.1 | Router, DNS, WiFi Controller | -| XTRM-U | 192.168.31.2 | Production Server (Unraid) | -| CSS1 | 192.168.31.9 | Distribution Switch | -| ZX1 | 192.168.31.7 | Core Switch (2.5G) | -| CAP | 192.168.31.6 | Wireless Access Point | +| HAP1 | 192.168.10.1 | Router, DNS, WiFi Controller | +| XTRM-U | 192.168.10.20 | Production Server (Unraid) | +| CSS1 | 192.168.10.3 | Distribution Switch | +| ZX1 | 192.168.10.4 | Core Switch (2.5G) | +| CAP | 192.168.10.6 | Wireless Access Point | --- @@ -51,26 +56,26 @@ docs/ ```bash # Unraid -ssh -i ~/.ssh/id_ed25519_unraid root@192.168.31.2 -p 422 +ssh -i ~/.ssh/id_ed25519_unraid root@192.168.10.20 -p 422 # MikroTik Router -ssh -i ~/.ssh/mikrotik_key -p 2222 unraid@192.168.31.1 +ssh -i ~/.ssh/mikrotik_key -p 2222 xtrm@192.168.10.1 ``` --- ## Emergency Recovery -1. **DNS down?** → Clients fallback to 192.168.31.4 (secondary) -2. **Internet down?** → Check HAP1 at 192.168.31.1 -3. **Services down?** → Check Unraid at 192.168.31.2 +1. **DNS down?** → Automatic failover to 192.168.10.10 (secondary), see `08-DNS-ARCHITECTURE.md` +2. **Internet down?** → Check HAP1 at 192.168.10.1 +3. **Services down?** → Check Unraid at 192.168.10.20 4. **Full outage?** → See `02-SERVICES-CRITICAL.md` startup order --- ## Change Management -- **Major changes:** Document in `00-CHANGELOG.md` +- **Major changes:** Document in `CHANGELOG.md` - **Minor changes:** Git commit messages only - **Planned work:** Create doc in `wip/` folder diff --git a/docs/00-CHANGELOG.md b/docs/00-CHANGELOG.md deleted file mode 100644 index 9e48ed5..0000000 --- a/docs/00-CHANGELOG.md +++ /dev/null @@ -1,118 +0,0 @@ -# Infrastructure Changelog - -**Purpose:** Major infrastructure events only. Minor changes are in git commit messages. - ---- - -## 2026-01 - -### 2026-01-25 -- **[INCIDENT]** DNS outage after MikroTik restart - multiple root causes fixed: - - NAT rules blocking AdGuard outbound DNS (added exception rules) - - DHCP pushing wrong DNS (8.8.8.8 → 192.168.31.1) - - NAT redirect pointing to wrong IP/port (172.17.0.5:5355 → 192.168.31.4:53) - - Asymmetric routing (added srcnat masquerade for DNS redirect) -- **[SERVICE]** Removed MikroTik AdGuard Home container (storage/overlay errors) -- **[SERVICE]** Removed MikroTik Tailscale container (root directory missing) -- **[SERVICE]** Removed Pi-hole/Unbound leftovers from MikroTik (veth, mounts, envs) -- **[NETWORK]** Consolidated DNS architecture: MikroTik → Unraid AdGuard (192.168.31.4) only -- **[DOCS]** Created incident reports in docs/incidents/ -- **[DOCS]** Restructured documentation - consolidated into 5 core docs + archive -- **[NETBOX]** Added shelf devices for rack organization (U9, U7, U3) - -### 2026-01-24 -- **[NETBOX]** Standardized device names to NetBox convention (HAP1, CSS1, ZX1) -- **[DOCS]** Created NETWORK-PHYSICAL-MAP.md with complete port maps - -### 2026-01-23 -- **[SERVICE]** Deployed Diode network discovery stack -- **[SERVICE]** Removed Slurp'it (replaced by Diode + NetDisco) -- **[SERVICE]** Consolidated NetBox Redis to shared instance -- **[SERVICE]** Removed redundant DNS services (Unbound, DoH-Server, stunnel-dot) - -### 2026-01-22 -- **[SERVICE]** Migrated NetBox to shared PostgreSQL 17 -- **[SERVICE]** Deployed AdGuard Home on MikroTik (primary DNS) -- **[SERVICE]** Deployed AdGuard Home on Unraid (secondary DNS) -- **[SERVICE]** Removed Pi-hole (replaced by AdGuard Home) -- **[DOCS]** Created INFRASTRUCTURE-DIAGRAM.md - -### 2026-01-21 -- **[BACKUP]** Configured Rclone sync to Google Drive - -### 2026-01-19 -- **[SERVICE]** Deployed NetBox IPAM/DCIM -- **[SERVICE]** Deployed NetDisco network discovery -- **[NETWORK]** Enabled SNMP on all MikroTik devices - -### 2026-01-18 -- **[SERVICE]** Deployed Gitea git server -- **[SERVICE]** Deployed Woodpecker CI -- **[NETWORK]** Configured CAPsMAN on HAP1 -- **[WIRELESS]** CAP added to CAPsMAN management - -### 2026-01-17 -- **[SERVICE]** Deployed Portainer CE - ---- - -## Format Guide - -```markdown -### YYYY-MM-DD -- **[CATEGORY]** Brief description - -Categories: -- [DEVICE] - Hardware added/removed/changed -- [SERVICE] - Container/service deployed/removed -- [NETWORK] - Network topology/config changes -- [WIRELESS] - WiFi/CAPsMAN changes -- [BACKUP] - Backup configuration -- [DOCS] - Major documentation changes -- [INCIDENT] - Outages and fixes -``` - ---- - -## Previous History - -For detailed history before 2026-01-17, see archived changelogs: -- `archive/06-CHANGELOG.md` -- `archive/07-CHANGELOG.md` -- `archive/00-CHANGELOG.md` - -## 2026-01-25 -- [PHASE DNS] MikroTik AdGuard Home container installed - COMPLETED - - Container: adguardhome v0.107.71 on veth-adguard (172.17.0.2/24) - - Upstreams: 192.168.31.4 (Unraid AdGuard), 8.8.8.8, 1.1.1.1 - - TLS enabled with Let's Encrypt cert for dns.xtrm-lab.org - - DoT on port 853, DoH on port 8443 (external) - - LAN DNS redirect updated to use MikroTik AdGuard - - Old docker-bridge removed (routing conflict) - - Web UI at http://192.168.31.1:3000 -- [ISSUE] Container failed after restart with 'could not load config json' - - Fix: Removed and recreated container, added mountlists, restarted - - AdGuard config preserved (on separate mount) - - Documented fix in 09-MIKROTIK-ADGUARD-DOT-DOH.md -- [CONTAINERS] Created container bridge (containers-br) for shared networking - - Both AdGuard and Tailscale containers now use the same bridge - - Added NAT masquerade for container outbound traffic -- [SERVICE] Tailscale container installed and running - - Image: tailscale/tailscale:latest - - IP: 172.17.0.3/24 on veth-tailscale - - State persisted to usb1/tailscale/state - - Userspace mode enabled - -## 2026-01-25 (VLAN Implementation) -- [VLAN] Created VLAN interfaces on bridge: - - VLAN 10: Management (192.168.10.0/24) - - VLAN 20: Trusted (192.168.20.0/24) - - VLAN 30: IoT (192.168.30.0/24) - - VLAN 35: Cameras (192.168.35.0/24) - - VLAN 40: Servers (192.168.40.0/24) - - VLAN 50: Guest (192.168.50.0/24) -- [VLAN] DHCP servers configured for all VLANs -- [VLAN] Inter-VLAN firewall rules created -- [VLAN] WiFi SSIDs created: Home-Trusted, Home-IoT, Home-Guest -- [STATUS] VLAN filtering NOT yet enabled (Phase 1 complete) -- [NOTE] Legacy 192.168.31.0/24 still active for transition diff --git a/docs/01-NETWORK-MAP.md b/docs/01-NETWORK-MAP.md index 59bf465..4f94bbc 100644 --- a/docs/01-NETWORK-MAP.md +++ b/docs/01-NETWORK-MAP.md @@ -1,6 +1,6 @@ # Network Map - xtrm-lab.org -**Last Updated:** 2026-02-02 +**Last Updated:** 2026-02-06 **Domain:** xtrm-lab.org **WAN IP:** 62.73.120.142 @@ -27,19 +27,19 @@ flowchart TB end subgraph Rack19["19" Rack (3U)"] - HAP1["HAP1 | hAP ax³
192.168.31.1"] + HAP1["HAP1 | hAP ax³
192.168.10.1"] PP1["PP1 | 24-port"] - CSS1["CSS1 | CSS326-24G-2S+
192.168.31.9"] + CSS1["CSS1 | CSS326-24G-2S+
192.168.10.3"] end subgraph Rack10["10" Rack (9U)"] - ZX1["ZX1 | ZX-SWTGW218AS
192.168.31.22"] + ZX1["ZX1 | ZX-SWTGW218AS
192.168.10.4"] PP2["PP2 | 12-port"] - XTRMU["XTRM-U
192.168.31.2"] + XTRMU["XTRM-U
192.168.10.20"] end subgraph Wireless["WiFi"] - CAP["CAP | cAP XL ac
192.168.31.6"] + CAP["CAP | cAP XL ac
192.168.10.6"] end ISP -->|"ether1 WAN"| HAP1 @@ -63,17 +63,17 @@ flowchart TB |---|--------|-------|-----|-------| | U9 | Shelf + ISP Gateway | Vivacom ONT | 62.73.120.2 | WAN | | U8 | PP2 | 10" 12-port Cat6a | - | Patch panel | -| U7 | Shelf + ZX1 | ZX-SWTGW218AS | 192.168.31.22 | 8x2.5G + 2x10G SFP+ | +| U7 | Shelf + ZX1 | ZX-SWTGW218AS | 192.168.10.4 | 8x2.5G + 2x10G SFP+ | | U6 | (empty) | - | - | Reserved for XTRM-N1 | -| U1-U4 | XTRM-U | NAS Server | 192.168.31.2 | 4x 2.5GbE bond | +| U1-U4 | XTRM-U | NAS Server | 192.168.10.20 | 4x 2.5GbE bond | #### 19" Rack (3U) | U | Device | Model | IP | Notes | |---|--------|-------|-----|-------| -| U3 | Shelf + HAP1 | hAP ax³ | 192.168.31.1 | Router + WiFi controller | +| U3 | Shelf + HAP1 | hAP ax³ | 192.168.10.1 | Router + WiFi controller | | U2.5 | PP1 | 19" 24-port Cat6a | - | Room connections | -| U1 | CSS1 | CSS326-24G-2S+ | 192.168.31.9 | 24x1G + 2x10G SFP+ | +| U1 | CSS1 | CSS326-24G-2S+ | 192.168.10.3 | 24x1G + 2x10G SFP+ | ### HAP ax³ Port Assignments @@ -99,33 +99,29 @@ flowchart TB ## IP Address Allocation -### Network: 192.168.31.0/24 +### VLAN Summary -#### Infrastructure Devices +| VLAN | Subnet | Gateway | Purpose | +|------|--------|---------|---------| +| 10 | 192.168.10.0/24 | 192.168.10.1 | Management | +| 20 | 192.168.20.0/24 | 192.168.20.1 | Trusted | +| 25 | 192.168.25.0/24 | 192.168.25.1 | Kids | +| 30 | 192.168.30.0/24 | 192.168.30.1 | IoT | +| 40 | 192.168.1.0/24 | 192.168.1.1 | CatchAll | -| IP | Device | Type | MAC | -|----|--------|------|-----| -| 192.168.31.1 | HAP1 \| hAP ax³ | Router | 78:9A:18:2C:A5:48 | -| 192.168.31.2 | XTRM-U | Server | A8:B8:E0:02:B6:15 | -| 192.168.31.6 | CAP \| cAP XL ac | Access Point | 18:FD:74:54:3D:BC | -| 192.168.31.22 | ZX1 \| ZX-SWTGW218AS | Switch | 1C:2A:A3:1E:78:67 | -| 192.168.31.9 | CSS1 \| CSS326-24G-2S+ | Switch | F4:1E:57:C9:BD:09 | +### VLAN 10 - Infrastructure Devices -#### Containers (br0 Macvlan) +| IP | Device | Type | +|----|--------|------| +| 192.168.10.1 | HAP1 \| hAP ax³ | Router | +| 192.168.10.3 | CSS1 \| CSS326-24G-2S+ | Switch | +| 192.168.10.4 | ZX1 \| ZX-SWTGW218AS | Switch | +| 192.168.10.6 | CAP \| cAP XL ac | Access Point | +| 192.168.10.10 | AdGuard Home (Unraid macvlan) | DNS Secondary | +| 192.168.10.20 | XTRM-U | Server | +| 192.168.10.200 | NanoKVM | Remote KVM | -| IP | Container | Purpose | -|----|-----------|---------| -| 192.168.31.4 | AdGuard Home | DNS Secondary | -| 192.168.31.5 | Unbound | Recursive DNS (stopped) | -| 192.168.31.12 | TimeMachine | macOS backups | - -#### DHCP Ranges - -| Range | Purpose | -|-------|---------| -| 192.168.31.10-99 | Reserved (static) | -| 192.168.31.100-200 | DHCP Pool | -| 192.168.31.201-254 | Reserved | +For complete device-to-VLAN mapping, see `06-VLAN-DEVICE-ASSIGNMENT.md`. --- @@ -133,12 +129,12 @@ flowchart TB ### HAP1 (MikroTik Router) -**Network:** 172.17.0.0/16 (bridge) +**Network:** 172.17.0.0/24 (veth) | Container | IP | Purpose | |-----------|-----|---------| -| AdGuard Home | 172.17.0.5 | DNS Primary (DoH/DoT/DoQ) | -| Tailscale | 172.17.0.4 | VPN mesh | +| AdGuard Home | 172.17.0.2 | DNS Primary (DoH/DoT/DoQ) | +| Tailscale | 172.17.0.3 | VPN mesh | ### XTRM-U (Unraid Server) @@ -264,8 +260,8 @@ flowchart TB | External Port | Destination | Service | |---------------|-------------|---------| -| 853 | 172.17.0.5:853 | AdGuard DoT | -| 8853 | 172.17.0.5:8853 | AdGuard DoQ | +| 853 | 172.17.0.2:853 | AdGuard DoT | +| 8853 | 172.17.0.2:8853 | AdGuard DoQ | --- @@ -279,11 +275,11 @@ flowchart TB end subgraph HAP1["HAP1 (Primary)"] - AGH1["AdGuard Home
172.17.0.5"] + AGH1["AdGuard Home
172.17.0.2"] end subgraph XTRMU["XTRM-U (Secondary)"] - AGH2["AdGuard Home
192.168.31.4"] + AGH2["AdGuard Home
192.168.10.10"] end subgraph Sync["Sync"] diff --git a/docs/03-SERVICES-OTHER.md b/docs/03-SERVICES-OTHER.md index 7345917..e1ca755 100644 --- a/docs/03-SERVICES-OTHER.md +++ b/docs/03-SERVICES-OTHER.md @@ -64,7 +64,7 @@ Non-critical services that enhance functionality but don't affect core network o | diode-auth | 172.18.0.74 | Token service | | diode-agent | host | Network scanner | -**Discovery:** 192.168.31.0/24 every 30 minutes +**Discovery:** 192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24 every 30 minutes ### Unimus @@ -182,7 +182,7 @@ Non-critical services that enhance functionality but don't affect core network o | Network | IP | |---------|-----| -| br0 macvlan | 192.168.31.12 | +| br0 macvlan | 192.168.10.12 | **Purpose:** macOS Time Machine backup target @@ -219,7 +219,7 @@ Non-critical services that enhance functionality but don't affect core network o | Host | IP | |------|-----| -| HAP1 | 172.17.0.4 | +| HAP1 | 172.17.0.3 | **Purpose:** Mesh VPN for remote access diff --git a/docs/03-VLAN-DEVICE-ASSIGNMENT.md b/docs/03-VLAN-DEVICE-ASSIGNMENT.md deleted file mode 100644 index 7909713..0000000 --- a/docs/03-VLAN-DEVICE-ASSIGNMENT.md +++ /dev/null @@ -1,248 +0,0 @@ -# VLAN Device Assignment Map - -**Last Updated:** 2026-02-01 -**Purpose:** Complete inventory of all network devices with VLAN assignments - ---- - -## VLAN Summary - -| VLAN | Name | Subnet | Gateway | Purpose | Comment | -|------|------|--------|---------|---------|---------| -| 1 | Legacy | 192.168.31.0/24 | 192.168.31.1 | Current flat network | To be deprecated | -| 10 | Mgmt | 192.168.10.0/24 | 192.168.10.1 | Infrastructure devices | Admin access only | -| 20 | Trusted | 192.168.20.0/24 | 192.168.20.1 | Family personal devices | Full network access | -| 25 | Trusted | 192.168.20.0/24 | 192.168.20.1 | Kids Devices| Full network access | -| 30 | IoT | 192.168.30.0/24 | 192.168.30.1 | Smart home devices | Internet + limited local | -| 35 | Cameras | 192.168.35.0/24 | 192.168.35.1 | Security cameras | Isolated, NVR access only | -| 40 | Servers | 192.168.40.0/24 | 192.168.40.1 | Servers & printers | Service hosts | -| 50 | Guest | 192.168.50.0/24 | 192.168.50.1 | Guest WiFi | Internet only | - ---- - -## VLAN 10 - Management (Infrastructure) - -| Current IP | Target IP | MAC Address | Device | Notes | Comment | -|------------|-----------|-------------|--------|-------|---------| -| 192.168.31.1 | 192.168.10.1 | 78:9A:18:2C:A5:48 | HAP1 (hAP ax³) | Router | Gateway for all VLANs | -| 192.168.31.4 | 192.168.10.10| 02:42:C0:A8:1F:04 | AdGuard Home | DNS (Unraid) | Secondary DNS | -| 192.168.31.6 | 192.168.10.2| 18:FD:74:54:3D:BC | CAP XL ac | Access point | CAPsMAN managed | -| 192.168.31.9 | 192.168.10.3 | F4:1E:57:C9:BD:09 | CSS326-24G-2S+ | 24-port switch | Room distribution | -| 192.168.31.22 | 192.168.10.4 | 1C:2A:A3:1E:78:67 | ZX1 (ZX-SWTGW218AS) | 8-port 2.5G switch | Server rack | -| 192.168.31.2 | 192.168.10.20 | A8:B8:E0:02:B6:15 | XTRM-U (Unraid) | Main server | Docker host, NAS | -| 192.168.31.20 | 192.168.10.200 | 48:DA:35:6F:BE:50 | NanoKVM | Remote KVM | IPMI alternative | -| 172.17.0.2 | - | 46:D0:27:F7:1F:CA | AdGuard (MikroTik) | DNS (Router) | Primary DNS, DoH/DoT | -| 172.17.0.3 | - | 0C:AB:39:8D:8C:FC | Tailscale (MikroTik) | VPN container | Remote access | - ---- - -## VLAN 20 - Trusted (Family Devices) - -| Current IP | Target IP | MAC Address | Device | Owner | Comment | -|------------|-----------|-------------|--------|-------|---------| -| 192.168.31.79 | 192.168.20.10 | 82:6D:FB:D9:E0:47 | MacBook Air | Nora | Primary laptop | -| 192.168.31.98 | 192.168.20.11 | AA:ED:8B:2A:40:F1 | Samsung S25 Ultra | Kaloyan | Primary phone | -| 192.168.31.114 | 192.168.20.12 | F2:B8:14:61:C8:27 | iPhone | Dancho | | -| 192.168.31.99 | 192.168.20.13 | 82:EC:EF:B5:F2:AF | MacBook Pro (WiFi) | Kaloyan | Work laptop wireless | -| 192.168.31.108 | 192.168.20.14 | 90:91:64:70:0D:86 | Notebook | Kimi | | -| 192.168.31.121 | 192.168.20.15 | 2A:2B:BA:86:D4:AF | iPhone | Kimi | | -| 192.168.31.95 | 192.168.20.16 | 08:92:04:C6:07:C5 | MacBook Pro (LAN) | Kaloyan | Via Dell KVM dock | -| 192.168.31.97 | 192.168.20.17 | 1C:83:41:32:F3:AF | Gaming PC | Kaloyan | Main bedroom | -| 192.168.31.107 | 192.168.20.18 | A4:D1:D2:7B:52:BE | iPad | Compusbg | Work tablet | - ---- - -## VLAN 25 - Trusted (Kids Devices) - -| Current IP | Target IP | MAC Address | Device | Owner | Comment | -|------------|-----------|-------------|--------|-------|---------| -| 192.168.31.114 | 192.168.20.12 | F2:B8:14:61:C8:27 | iPhone | Dancho | | -| 192.168.31.108 | 192.168.20.14 | 90:91:64:70:0D:86 | Notebook | Kimi | | -| 192.168.31.121 | 192.168.20.15 | 2A:2B:BA:86:D4:AF | iPhone | Kimi | | -| 192.168.31.107 | 192.168.20.18 | A4:D1:D2:7B:52:BE | iPad | Compusbg | Work tablet | - ---- - -## VLAN 30 - IoT (Smart Home) - -| Current IP | Target IP | MAC Address | Device | Location | Comment | -|------------|-----------|-------------|--------|----------|---------| -| 192.168.31.139 | 192.168.30.10 | 50:2C:C6:7A:55:39 | Air Conditioner | Living Room| GREE Electric| -| 192.168.31.100 | 192.168.30.11 | B0:37:95:79:AF:9B | LG TV | Living Room | LAN (not connected) | -| 192.168.31.118 | 192.168.30.12 | DC:03:98:6B:5A:3A | LG TV | Living Room | WiFi (active) | -| 192.168.31.134 | 192.168.30.13 | D0:E7:82:F7:65:DD | Chromecast | Living Room | Streaming | -| 192.168.31.104 | 192.168.30.14 | B0:4A:39:3F:9A:14 | Roborock S7 Vacuum | Living Room | Needs cloud access | -| 192.168.31.105 | 192.168.30.20 | 94:27:70:1E:0C:EE | Bosch Smart Oven | Kitchen | Home Connect app | -| 192.168.31.116 | 192.168.30.21 | C8:D7:78:40:65:40 | Bosch Dishwasher | Kitchen | Home Connect app | -| 192.168.31.117 | 192.168.30.22 | C8:D7:78:D6:DC:FC | Bosch Washer | Kids Bathroom| Home Connect app | -| 192.168.31.106 | 192.168.30.31 | 18:DE:50:5B:C8:A6 | Tuya Smart Device | - | OUI: Tuya Smart Inc. | -| 192.168.31.113 | 192.168.30.5 | 38:1F:8D:04:6F:E4 | Tuya Smart Gateway (JMWZG1) | - | Requires WPA+TKIP | -| 192.168.31.149 | 192.168.30.33 | D4:AD:FC:BE:13:B0 | Tuya Smart Device | - | OUI: Tuya Smart Inc. | -| 192.168.31.106 | 192.168.30.34 | 18:DE:50:5B:C8:A6 | Tuya Smart Device | - | OUI: Tuya Smart Inc. | -| 192.168.31.113 | 192.168.30.5 | 38:1F:8D:04:6F:E4 | Tuya Smart Gateway (JMWZG1) | - | Requires WPA+TKIP | -| 192.168.31.149 | 192.168.30.38| D4:AD:FC:BE:13:B0 | Shenzhen Intellirocks | - | Smart Device | -| 192.168.31.101 | 192.168.30.39 | C8:5C:CC:52:EA:53 | Xiaomi Air Purifier | - | Mi Home app | -| - | 192.168.30.50 | FC:D5:D9:EB:6A:82 | Settop Box (LAN) | Living Room | CSS326 Port 23 | -| - | 192.168.30.51 | 08:FB:EA:61:9D:3A | Settop Box (WiFi) | Living Room | XTRM2 2.4GHz | - ---- - -## VLAN 35 - Cameras (Security) - -| Current IP | Target IP | MAC Address | Device | Location | Comment | -|------------|-----------|-------------|--------|----------|---------| -| 192.168.31.68 | 192.168.35.10 | 48:9E:9D:0E:16:F7 | Reolink Doorbell | Front door | PoE powered | - ---- - -## VLAN 40 - Servers (Services) - -| Current IP | Target IP | MAC Address | Device | Purpose | Comment | -|------------|-----------|-------------|--------|---------|---------| -| 192.168.31.19 | 192.168.40.19 | 64:4E:D7:D8:43:3E | HP LaserJet | Network printer | Wired connection | - ---- - -## VLAN 50 - Guest (Isolated) - -| Current IP | Target IP | MAC Address | Device | Notes | Comment | -|------------|-----------|-------------|--------|-------|---------| -| 192.168.31.15 | 192.168.50.10 | AC:87:A3:77:8F:BD | Apple Device | Unknown owner | OUI: Apple Inc. | -| 192.168.31.142 | 192.168.50.11 | 22:4C:7F:1D:85:8E | Unknown Device | Random MAC | Privacy MAC | -| 192.168.31.109 | 192.168.50.12 | D0:C9:07:92:1A:8E | Unknown Device | Private vendor | Hidden OUI | -| 192.168.31.110 | 192.168.50.13 | D0:C9:07:8C:C9:46 | Unknown Device | Private vendor | Same as .109 | -| DHCP Pool | 192.168.50.100-200 | - | Guest devices | Dynamic | Internet only | - ---- - -## Identified Unknown Devices (Moved to Guest) - -| Current IP | MAC Address | Vendor (OUI) | Likely Device | Assigned VLAN | Comment | -|------------|-------------|--------------|---------------|---------------|---------| -| 192.168.31.15 | AC:87:A3:77:8F:BD | Apple Inc. | iPhone/iPad/Mac | 50 (Guest) | Unknown owner | -| 192.168.31.142 | 22:4C:7F:1D:85:8E | Locally Administered | Phone/Laptop | 50 (Guest) | Random MAC (privacy) | -| 192.168.31.109 | D0:C9:07:92:1A:8E | Private (IEEE) | Unknown | 50 (Guest) | Hidden vendor | -| 192.168.31.110 | D0:C9:07:8C:C9:46 | Private (IEEE) | Unknown | 50 (Guest) | Same vendor as .109 | - ---- - -## MAC Address Quick Reference - -### By VLAN (for switch port assignment) - -**VLAN 10 - Mgmt:** -``` -78:9A:18:2C:A5:48 HAP1 -A8:B8:E0:02:B6:15 XTRM-U -18:FD:74:54:3D:BC CAP XL ac -F4:1E:57:C9:BD:09 CSS326 -1C:2A:A3:1E:78:67 ZX1 -48:DA:35:6F:BE:50 NanoKVM -``` - -**VLAN 20 - Trusted:** -``` -82:6D:FB:D9:E0:47 Nora MacBook -AA:ED:8B:2A:40:F1 Kaloyan S25 -F2:B8:14:61:C8:27 Dancho iPhone -82:EC:EF:B5:F2:AF Kaloyan MacBook WiFi -90:91:64:70:0D:86 Kimi Notebook -2A:2B:BA:86:D4:AF Kimi iPhone -08:92:04:C6:07:C5 Kaloyan MacBook LAN -1C:83:41:32:F3:AF Kaloyan Game PC -A4:D1:D2:7B:52:BE Compusbg iPad -``` - -**VLAN 30 - IoT:** -``` -B0:37:95:79:AF:9B LG TV (LAN) -DC:03:98:6B:5A:3A LG TV (WiFi) -D0:E7:82:F7:65:DD Chromecast -B0:4A:39:3F:9A:14 Roborock Vacuum -94:27:70:1E:0C:EE Bosch Oven -C8:5C:CC:52:EA:53 Xiaomi Air Purifier -C8:D7:78:D6:DC:FC Bosch Washer -C8:D7:78:40:65:40 Bosch Dishwasher -50:2C:C6:7A:55:39 GREE Appliance -18:DE:50:5B:C8:A6 Tuya Device 1 -38:1F:8D:04:6F:E4 Tuya Smart Gateway (JMWZG1) -D4:AD:FC:BE:13:B0 Intellirocks Device -FC:D5:D9:EB:6A:82 Settop Box (LAN) -08:FB:EA:61:9D:3A Settop Box (WiFi) -``` - -**VLAN 35 - Cameras:** -``` -48:9E:9D:0E:16:F7 Reolink Doorbell -``` - -**VLAN 40 - Servers:** -``` -64:4E:D7:D8:43:3E HP LaserJet -``` - -**VLAN 50 - Guest:** -``` -AC:87:A3:77:8F:BD Apple Device (unknown) -22:4C:7F:1D:85:8E Random MAC device -D0:C9:07:92:1A:8E Private Vendor 1 -D0:C9:07:8C:C9:46 Private Vendor 2 -``` - ---- - -## Device Count Summary - -| VLAN | Device Count | Comment | -|------|--------------|---------| -| 10 - Mgmt | 9 | Infrastructure only | -| 20 - Trusted | 9 | Family devices | -| 25 - Kids | 4 | Kids devices (subset of 20) | -| 30 - IoT | 11 | Smart home devices | -| 35 - Cameras | 1 | Security | -| 40 - Servers | 1 | Services | -| 50 - Guest | 4 | Unknown/unidentified devices | -| **Total** | **35** | All devices categorized | - ---- - -## OUI Lookup Reference - -| OUI Prefix | Vendor | Type | -|------------|--------|------| -| B0:37:95 | LG Electronics | TV/Displays (LAN) | -| DC:03:98 | LG Innotek | TV/Displays (WiFi) | -| 50:2C:C6 | GREE Electric Appliances (Zhuhai) | AC/Appliances | -| 18:DE:50 | Tuya Smart Inc. | IoT Platform | -| 38:1F:8D | Xiaomi | Smart Home Devices | -| D4:AD:FC | Shenzhen Intellirocks Tech | Smart Devices | -| AC:87:A3 | Apple Inc. | Consumer Electronics | -| D0:C9:07 | Private (IEEE hidden) | Unknown | -| 22:xx:xx | Locally Administered | Random/Private MAC | - ---- - -## Next Steps - -| Step | Action | Comment | -|------|--------|---------| -| 1 | ✅ Identify unknown devices | Completed via OUI lookup | -| 2 | Decide WiFi strategy | Single SSID vs Multiple SSIDs | -| 3 | Configure switch ports | VLAN tagging on CSS326 | -| 4 | Test VLAN routing | Before full activation | -| 5 | Update firewall rules | Inter-VLAN traffic control | - ---- - -## Quick Assignment Table (Identified Devices) - -| VLAN | IP | Comment | -|------|----|---------| -| 30 (IoT) | 192.168.31.139 | GREE Air Conditioner | -| 30 (IoT) | 192.168.31.106 | Tuya Smart Device #1 | -| 30 (IoT) | 192.168.31.113 | Tuya Smart Gateway (JMWZG1) | -| 30 (IoT) | 192.168.31.149 | Shenzhen Intellirocks Smart Device | -| 50 (Guest) | 192.168.31.15 | Apple device (unknown owner) | -| 50 (Guest) | 192.168.31.142 | Privacy MAC device | -| 50 (Guest) | 192.168.31.109 | Private vendor device | -| 50 (Guest) | 192.168.31.110 | Private vendor device | diff --git a/docs/04-HARDWARE-INVENTORY.md b/docs/04-HARDWARE-INVENTORY.md index 257baaf..22cb18a 100644 --- a/docs/04-HARDWARE-INVENTORY.md +++ b/docs/04-HARDWARE-INVENTORY.md @@ -36,12 +36,12 @@ |----------|-------| | **Role** | Distribution Switch | | **Location** | 19" Rack U1 | -| **IP** | 192.168.10.9 | +| **IP** | 192.168.10.3 | | **MAC** | F4:1E:57:C9:BD:09 | | **OS** | SwOS 2.16 | | **Serial** | - | | **Docs** | https://help.mikrotik.com/docs/spaces/UM/pages/17498168/CSS326-24G-2S+RM | -| **Web UI** | http://192.168.10.9 | +| **Web UI** | http://192.168.10.3 | **Ports:** 24x 1G RJ45, 2x 10G SFP+ - SFP1: 10G DAC to ZX1 @@ -55,7 +55,7 @@ |----------|-------| | **Role** | Core Switch (2.5GbE) | | **Location** | 10" Rack U7 (on shelf) | -| **IP** | 192.168.10.7 | +| **IP** | 192.168.10.4 | | **MAC** | 1C:2A:A3:1E:78:67 | | **Serial** | - | diff --git a/docs/02-PORT-UTILIZATION.md b/docs/05-PORT-UTILIZATION.md similarity index 98% rename from docs/02-PORT-UTILIZATION.md rename to docs/05-PORT-UTILIZATION.md index f41029d..14f55f4 100644 --- a/docs/02-PORT-UTILIZATION.md +++ b/docs/05-PORT-UTILIZATION.md @@ -1,11 +1,11 @@ # Device Port Utilization -**Last Updated:** 2026-01-25 +**Last Updated:** 2026-02-06 **Legend:** 🟢 Connected | ⚪ Enabled/No Link | 🔘 Disabled | 🩷 High Speed (≥2.5G) --- -## HAP1 | MikroTik hAP ax³ (192.168.31.1) +## HAP1 | MikroTik hAP ax³ (192.168.10.1) ``` ┌─────────────────────────────────────────────────────────┐ @@ -29,7 +29,7 @@ Connections: --- -## CSS1 | MikroTik CSS326-24G-2S+ (192.168.31.9) +## CSS1 | MikroTik CSS326-24G-2S+ (192.168.10.3) ``` ┌───────────────────────────────────────────────────────────────────────────┐ @@ -68,7 +68,7 @@ Port Details: --- -## ZX1 | ZX-SWTGW218AS (192.168.31.22) +## ZX1 | ZX-SWTGW218AS (192.168.10.4) ``` ┌─────────────────────────────────────────────────────────┐ diff --git a/docs/06-CHANGELOG.md b/docs/06-CHANGELOG.md deleted file mode 100644 index 4cff1df..0000000 --- a/docs/06-CHANGELOG.md +++ /dev/null @@ -1,175 +0,0 @@ -# Infrastructure Changelog - -## 2026-02-01 - -### WIP Documentation -- [WIP] Added KVM-SWITCH-MAC-NOBARA.md - Software KVM for Mac/Nobara switching -- DDC/CI monitor control (Dell U3821DW) + HID++ Logitech peripheral switching -- Scripts created on Mac at ~/scripts/ - - -## 2026-01-31 - -### Docker Cleanup -- [DOCKER] Removed 18 unused images (~4.9 GB reclaimed) -- [DOCKER] Removed 12 dangling images (old builds, untagged) -- [DOCKER] Removed Slurpit stack images (warehouse, portal, scanner, scraper) -- [DOCKER] Removed unused MongoDB 8 and MariaDB 11 images -- [DOCKER] Removed 35 orphaned volumes (~1.15 GB reclaimed) -- [DOCKER] Removed 28 anonymous dangling volumes -- [DOCKER] Removed 6 nextcloud_aio_* volumes (from old AIO install) -- [DOCKER] Removed orphaned redis-data volume -- [DOCKER] **Total reclaimed: ~6 GB** - -### Kept (Stopped Containers) -- open-webui, ollama (AI stack - for future use) -- pgAdmin4 (database management) -- diode-hydra-migrate, diode-auth-bootstrap (one-time migration jobs) - -## 2026-01-27 - -### VLAN Filtering Rolled Back -- [VLAN] Enabled VLAN filtering - caused connectivity issues -- [VLAN] ZX1 switch unreachable after activation (no management IP responding) -- [VLAN] CSS326 traffic routing through ZX1 (not direct eth3 link) -- [VLAN] **Rolled back** - VLAN filtering disabled -- [CONFIG] Added eth4 (ZX1) to all VLAN tagged lists for future use -- [STATUS] Network back to Legacy mode (192.168.31.0/24) -- [TODO] Need physical access to ZX1 to configure VLAN trunking - -### Issues Identified -- ZX1 switch not responding on documented IP 192.168.31.22 -- ZX1 may need VLAN trunk configuration before re-enabling filtering -- All CSS326 traffic goes via ZX1→HAP1, not direct CSS326→HAP1 link (STP?) - -# Infrastructure Changelog - -## 2026-02-01 - -### WIP Documentation -- [WIP] Added KVM-SWITCH-MAC-NOBARA.md - Software KVM for Mac/Nobara switching -- DDC/CI monitor control (Dell U3821DW) + HID++ Logitech peripheral switching -- Scripts created on Mac at ~/scripts/ - - -## 2026-01-26 - -### VLAN Filtering Activated ✅ -- [VLAN] **VLAN filtering enabled on MikroTik bridge - SUCCESSFUL** -- [VLAN] Internet connectivity verified (ping 1.1.1.1, google.com) -- [VLAN] DNS resolution working through AdGuard -- [VLAN] All previous fixes (DHCP DNS, firewall, NAT masquerade) working correctly -- [STATUS] Network segmentation now ACTIVE - -### Local AI Stack Deployed -- [AI] Deployed Ollama container with Intel GPU passthrough -- [AI] Deployed Open WebUI at http://192.168.31.2:3080 -- [AI] Installed qwen2.5-coder:7b base model -- [AI] Created custom `unraid-assistant` model with infrastructure knowledge: - - Network topology (all VLANs, IPs, gateways) - - 45+ Docker containers (names, ports, purposes) - - RouterOS 7 commands and patterns - - Traefik labels and Authentik middleware - - All external URLs (xtrm-lab.org) -- [AI] Created `/usr/local/bin/ai` terminal helper command -- [AI] Stopped non-critical containers for RAM: karakeep, unimus, homarr, netdisco-* - - -### VLAN Activation Attempt & Fixes -- [VLAN] Configured CSS326 switch VLANs via SwOS web interface -- [VLAN] Enabled VLAN filtering on MikroTik - caused internet outage -- [VLAN] Rolled back VLAN filtering to restore connectivity -- [VLAN] **ROOT CAUSE IDENTIFIED:** Multiple configuration issues - -### Issues Fixed -- [FIX] DHCP DNS now points to each VLAN gateway instead of legacy 192.168.31.1 - - VLAN 20: 192.168.20.1, VLAN 25: 192.168.25.1, etc. -- [FIX] Added DNS redirect rules for all VLANs (src-address-list=all-vlans) -- [FIX] Added all VLAN interfaces to LAN firewall interface list -- [FIX] Added NAT masquerade rules for VLAN traffic to AdGuard container -- [BACKUP] MikroTik config saved before activation attempt - -### Current Status -- MikroTik: Fully configured, fixes applied, ready for activation -- CSS326: VLANs configured, port assignments done -- VLAN Filtering: OFF (ready to enable when convenient) -- Next: Enable VLAN filtering + force DHCP renewal on devices - -## 2026-01-25 (Update 3) - -### VLAN Phase 1 Complete -- [VLAN] Added VLAN 25 (Kids) - interface, IP, DHCP server, pool, bridge entry -- [VLAN] Fixed VLAN 10 (Management) leases - correct IPs per device assignment doc -- [VLAN] Fixed VLAN 30 (IoT) leases - all 14 devices with correct IPs -- [VLAN] Added VLAN 25 (Kids) leases - 6 devices including XTRM-Ally -- [VLAN] Added VLAN 50 (Guest) leases - 7 unknown devices -- [VLAN] Added firewall rules for VLAN 25 (Kids → IoT, Legacy, DNS) -- [VLAN] Total devices configured: 44 - -### Device Discovery -- [NETWORK] Discovered XTRM-Ally gaming device → assigned to Kids VLAN -- [NETWORK] Discovered Dancho Windows device → assigned to Kids VLAN -- [NETWORK] Discovered 2x lwip0 IoT devices → assigned to IoT VLAN -- [NETWORK] Discovered 3x unknown devices → assigned to Guest VLAN - -### Documentation Updates -- [DOCS] Updated 03-VLAN-DEVICE-ASSIGNMENT.md - complete device inventory (44 devices) -- [DOCS] Updated 11-VLAN-IMPLEMENTATION.md - Phase 1 complete status -- [DOCS] All VLANs now documented: 10, 20, 25, 30, 35, 40, 50 - -### Next Steps -- CSS326 switch VLAN configuration via SwOS -- Enable VLAN filtering on MikroTik bridge -- Test connectivity - -## 2026-01-25 - -### VLAN Implementation (Prepared) -- [VLAN] Created 6 VLANs on MikroTik bridge (10, 20, 30, 35, 40, 50) -- [VLAN] Configured IP addresses for all VLAN interfaces -- [VLAN] Created DHCP servers and pools for each VLAN -- [VLAN] Added static DHCP leases mapping MACs to VLAN IPs -- [VLAN] Configured bridge VLAN table with tagged/untagged ports -- [VLAN] Set WiFi ports PVID=20 (Trusted VLAN default) -- [VLAN] Added inter-VLAN firewall rules (active) -- [VLAN] VLAN filtering NOT YET ENABLED (pending CSS326 switch config) -- [DOCS] Added docs/11-VLAN-IMPLEMENTATION.md -- [SCRIPTS] Added scripts/mikrotik-vlan-setup.rsc -- [SCRIPTS] Added scripts/mikrotik-vlan-enable.rsc - -### MikroTik Containers -- [CONTAINER] AdGuard Home container running on MikroTik -- [CONTAINER] Tailscale container configured (inactive) -- [CONTAINER] Container bridge (containers-br) with NAT - -### DNS Configuration -- [DNS] AdGuard Home as primary DNS (172.17.0.2) -- [DNS] DNS redirect rules for all clients -- [DNS] DoT/DoH upstream configured in AdGuard - -## Previous Changes - -See git history for earlier changes. - -## 2026-01-25 (Update 2) - -### DNS Configuration -- [DNS] Updated both AdGuard instances to use Quad9 DoH -- [DNS] MikroTik AdGuard: upstream=https://dns.quad9.net/dns-query -- [DNS] Unraid AdGuard: upstream=https://dns.quad9.net/dns-query -- [DNS] Bootstrap DNS: 9.9.9.9, 149.112.112.112 - -### Containers -- [CONTAINER] Fixed Tailscale container authentication -- [CONTAINER] Tailscale DNS changed from 8.8.8.8 to 172.17.0.1,1.1.1.1 (fallback) -- [CONTAINER] Tailscale route fixed: 100.64.0.0/10 → 172.17.0.3 - -### Documentation -- [DOCS] Created 02-PORT-UTILIZATION.md with ASCII port diagrams -- [DOCS] Updated 09-MIKROTIK-ADGUARD-DOT-DOH.md with Quad9 DoH config - -### Network -- [NETWORK] Enabled CSS326 SFP1 port - 10G backbone link to ZX1 now active - -### Documentation Fix -- [DOCS] Fixed ZX1 switch IP: 192.168.31.22 (was incorrectly documented as .7) diff --git a/docs/06-VLAN-DEVICE-ASSIGNMENT.md b/docs/06-VLAN-DEVICE-ASSIGNMENT.md new file mode 100644 index 0000000..f16589f --- /dev/null +++ b/docs/06-VLAN-DEVICE-ASSIGNMENT.md @@ -0,0 +1,206 @@ +# VLAN Device Assignment Map + +**Last Updated:** 2026-02-06 +**Purpose:** Complete inventory of all network devices with VLAN assignments + +--- + +## VLAN Summary + +| VLAN | Name | Subnet | Gateway | Purpose | +|------|------|--------|---------|---------| +| 10 | Mgmt | 192.168.10.0/24 | 192.168.10.1 | Infrastructure devices | +| 20 | Trusted | 192.168.20.0/24 | 192.168.20.1 | Family personal devices | +| 25 | Kids | 192.168.25.0/24 | 192.168.25.1 | Kids devices | +| 30 | IoT | 192.168.30.0/24 | 192.168.30.1 | Smart home devices | +| 35 | Cameras | 192.168.35.0/24 | 192.168.35.1 | Security cameras | +| 40 | Servers | 192.168.40.0/24 | 192.168.40.1 | Servers & printers | +| 50 | Guest | 192.168.50.0/24 | 192.168.50.1 | Guest WiFi | + +--- + +## VLAN 10 - Management (Infrastructure) + +| IP | MAC Address | Device | Notes | Comment | +|----|-------------|--------|-------|---------| +| 192.168.10.1 | 78:9A:18:2C:A5:48 | HAP1 (hAP ax³) | Router | Gateway for all VLANs | +| 192.168.10.10 | 02:42:C0:A8:1F:04 | AdGuard Home | DNS (Unraid) | Secondary DNS | +| 192.168.10.2 | 18:FD:74:54:3D:BC | CAP XL ac | Access point | CAPsMAN managed | +| 192.168.10.3 | F4:1E:57:C9:BD:09 | CSS326-24G-2S+ | 24-port switch | Room distribution | +| 192.168.10.4 | 1C:2A:A3:1E:78:67 | ZX1 (ZX-SWTGW218AS) | 8-port 2.5G switch | Server rack | +| 192.168.10.20 | A8:B8:E0:02:B6:15 | XTRM-U (Unraid) | Main server | Docker host, NAS | +| 192.168.10.200 | 48:DA:35:6F:BE:50 | NanoKVM | Remote KVM | IPMI alternative | +| 172.17.0.2 | 46:D0:27:F7:1F:CA | AdGuard (MikroTik) | DNS (Router) | Primary DNS, DoH/DoT | +| 172.17.0.3 | 0C:AB:39:8D:8C:FC | Tailscale (MikroTik) | VPN container | Remote access | + +--- + +## VLAN 20 - Trusted (Family Devices) + +| IP | MAC Address | Device | Owner | Comment | +|----|-------------|--------|-------|---------| +| 192.168.20.10 | 82:6D:FB:D9:E0:47 | MacBook Air | Nora | Primary laptop | +| 192.168.20.11 | AA:ED:8B:2A:40:F1 | Samsung S25 Ultra | Kaloyan | Primary phone | +| 192.168.20.12 | F2:B8:14:61:C8:27 | iPhone | Dancho | | +| 192.168.20.13 | 82:EC:EF:B5:F2:AF | MacBook Pro (WiFi) | Kaloyan | Work laptop wireless | +| 192.168.20.14 | 90:91:64:70:0D:86 | Notebook | Kimi | | +| 192.168.20.15 | 2A:2B:BA:86:D4:AF | iPhone | Kimi | | +| 192.168.20.16 | 08:92:04:C6:07:C5 | MacBook Pro (LAN) | Kaloyan | Via Dell KVM dock | +| 192.168.20.17 | 1C:83:41:32:F3:AF | Gaming PC | Kaloyan | Main bedroom | +| 192.168.20.18 | A4:D1:D2:7B:52:BE | iPad | Compusbg | Work tablet | + +--- + +## VLAN 25 - Kids (Kids Devices) + +| IP | MAC Address | Device | Owner | Comment | +|----|-------------|--------|-------|---------| +| 192.168.25.12 | F2:B8:14:61:C8:27 | iPhone | Dancho | | +| 192.168.25.14 | 90:91:64:70:0D:86 | Notebook | Kimi | | +| 192.168.25.15 | 2A:2B:BA:86:D4:AF | iPhone | Kimi | | +| 192.168.25.18 | A4:D1:D2:7B:52:BE | iPad | Compusbg | Work tablet | + +--- + +## VLAN 30 - IoT (Smart Home) + +| IP | MAC Address | Device | Location | Comment | +|----|-------------|--------|----------|---------| +| 192.168.30.10 | 50:2C:C6:7A:55:39 | Air Conditioner | Living Room | GREE Electric | +| 192.168.30.11 | B0:37:95:79:AF:9B | LG TV | Living Room | LAN (not connected) | +| 192.168.30.12 | DC:03:98:6B:5A:3A | LG TV | Living Room | WiFi (active) | +| 192.168.30.13 | D0:E7:82:F7:65:DD | Chromecast | Living Room | Streaming | +| 192.168.30.14 | B0:4A:39:3F:9A:14 | Roborock S7 Vacuum | Living Room | Needs cloud access | +| 192.168.30.20 | 94:27:70:1E:0C:EE | Bosch Smart Oven | Kitchen | Home Connect app | +| 192.168.30.21 | C8:D7:78:40:65:40 | Bosch Dishwasher | Kitchen | Home Connect app | +| 192.168.30.22 | C8:D7:78:D6:DC:FC | Bosch Washer | Kids Bathroom | Home Connect app | +| 192.168.30.31 | 18:DE:50:5B:C8:A6 | Tuya Smart Device | - | OUI: Tuya Smart Inc. | +| 192.168.30.5 | 38:1F:8D:04:6F:E4 | Tuya Smart Gateway (JMWZG1) | - | Requires WPA+TKIP | +| 192.168.30.33 | D4:AD:FC:BE:13:B0 | Tuya Smart Device | - | OUI: Tuya Smart Inc. | +| 192.168.30.39 | C8:5C:CC:52:EA:53 | Xiaomi Air Purifier | - | Mi Home app | +| 192.168.30.50 | FC:D5:D9:EB:6A:82 | Settop Box (LAN) | Living Room | CSS326 Port 23 | +| 192.168.30.51 | 08:FB:EA:61:9D:3A | Settop Box (WiFi) | Living Room | XTRM2 2.4GHz | + +--- + +## VLAN 35 - Cameras (Security) + +| IP | MAC Address | Device | Location | Comment | +|----|-------------|--------|----------|---------| +| 192.168.35.10 | 48:9E:9D:0E:16:F7 | Reolink Doorbell | Front door | PoE powered | + +--- + +## VLAN 40 - Servers (Services) + +| IP | MAC Address | Device | Purpose | Comment | +|----|-------------|--------|---------|---------| +| 192.168.40.19 | 64:4E:D7:D8:43:3E | HP LaserJet | Network printer | Wired connection | + +--- + +## VLAN 50 - Guest (Isolated) + +| IP | MAC Address | Device | Notes | Comment | +|----|-------------|--------|-------|---------| +| 192.168.50.10 | AC:87:A3:77:8F:BD | Apple Device | Unknown owner | OUI: Apple Inc. | +| 192.168.50.11 | 22:4C:7F:1D:85:8E | Unknown Device | Random MAC | Privacy MAC | +| 192.168.50.12 | D0:C9:07:92:1A:8E | Unknown Device | Private vendor | Hidden OUI | +| 192.168.50.13 | D0:C9:07:8C:C9:46 | Unknown Device | Private vendor | Same as .12 | +| 192.168.50.100-200 | - | Guest devices | Dynamic | Internet only | + +--- + +## MAC Address Quick Reference + +### By VLAN (for switch port assignment) + +**VLAN 10 - Mgmt:** +``` +78:9A:18:2C:A5:48 HAP1 +A8:B8:E0:02:B6:15 XTRM-U +18:FD:74:54:3D:BC CAP XL ac +F4:1E:57:C9:BD:09 CSS326 +1C:2A:A3:1E:78:67 ZX1 +48:DA:35:6F:BE:50 NanoKVM +``` + +**VLAN 20 - Trusted:** +``` +82:6D:FB:D9:E0:47 Nora MacBook +AA:ED:8B:2A:40:F1 Kaloyan S25 +F2:B8:14:61:C8:27 Dancho iPhone +82:EC:EF:B5:F2:AF Kaloyan MacBook WiFi +90:91:64:70:0D:86 Kimi Notebook +2A:2B:BA:86:D4:AF Kimi iPhone +08:92:04:C6:07:C5 Kaloyan MacBook LAN +1C:83:41:32:F3:AF Kaloyan Game PC +A4:D1:D2:7B:52:BE Compusbg iPad +``` + +**VLAN 30 - IoT:** +``` +B0:37:95:79:AF:9B LG TV (LAN) +DC:03:98:6B:5A:3A LG TV (WiFi) +D0:E7:82:F7:65:DD Chromecast +B0:4A:39:3F:9A:14 Roborock Vacuum +94:27:70:1E:0C:EE Bosch Oven +C8:5C:CC:52:EA:53 Xiaomi Air Purifier +C8:D7:78:D6:DC:FC Bosch Washer +C8:D7:78:40:65:40 Bosch Dishwasher +50:2C:C6:7A:55:39 GREE Appliance +18:DE:50:5B:C8:A6 Tuya Device 1 +38:1F:8D:04:6F:E4 Tuya Smart Gateway (JMWZG1) +D4:AD:FC:BE:13:B0 Intellirocks Device +FC:D5:D9:EB:6A:82 Settop Box (LAN) +08:FB:EA:61:9D:3A Settop Box (WiFi) +``` + +**VLAN 35 - Cameras:** +``` +48:9E:9D:0E:16:F7 Reolink Doorbell +``` + +**VLAN 40 - Servers:** +``` +64:4E:D7:D8:43:3E HP LaserJet +``` + +**VLAN 50 - Guest:** +``` +AC:87:A3:77:8F:BD Apple Device (unknown) +22:4C:7F:1D:85:8E Random MAC device +D0:C9:07:92:1A:8E Private Vendor 1 +D0:C9:07:8C:C9:46 Private Vendor 2 +``` + +--- + +## Device Count Summary + +| VLAN | Device Count | Comment | +|------|--------------|---------| +| 10 - Mgmt | 9 | Infrastructure only | +| 20 - Trusted | 9 | Family devices | +| 25 - Kids | 4 | Kids devices (subset of 20) | +| 30 - IoT | 14 | Smart home devices | +| 35 - Cameras | 1 | Security | +| 40 - Servers | 1 | Services | +| 50 - Guest | 4 | Unknown/unidentified devices | +| **Total** | **38** | All devices categorized | + +--- + +## OUI Lookup Reference + +| OUI Prefix | Vendor | Type | +|------------|--------|------| +| B0:37:95 | LG Electronics | TV/Displays (LAN) | +| DC:03:98 | LG Innotek | TV/Displays (WiFi) | +| 50:2C:C6 | GREE Electric Appliances (Zhuhai) | AC/Appliances | +| 18:DE:50 | Tuya Smart Inc. | IoT Platform | +| 38:1F:8D | Xiaomi | Smart Home Devices | +| D4:AD:FC | Shenzhen Intellirocks Tech | Smart Devices | +| AC:87:A3 | Apple Inc. | Consumer Electronics | +| D0:C9:07 | Private (IEEE hidden) | Unknown | +| 22:xx:xx | Locally Administered | Random/Private MAC | diff --git a/docs/19-WIFI-CAPSMAN-CONFIG.md b/docs/07-WIFI-CAPSMAN-CONFIG.md similarity index 100% rename from docs/19-WIFI-CAPSMAN-CONFIG.md rename to docs/07-WIFI-CAPSMAN-CONFIG.md diff --git a/docs/08-DNS-ARCHITECTURE.md b/docs/08-DNS-ARCHITECTURE.md new file mode 100644 index 0000000..eefd219 --- /dev/null +++ b/docs/08-DNS-ARCHITECTURE.md @@ -0,0 +1,387 @@ +# DNS Architecture with AdGuard Failover + +**Last Updated:** 2026-02-06 + +--- + +## Overview + +Dual AdGuard DNS setup with automatic failover. All DNS queries are filtered through AdGuard for ad-blocking, and if the primary (MikroTik) fails, traffic automatically switches to secondary (Unraid). + +--- + +## Architecture + +``` + ┌─────────────────────────────────────┐ + │ INTERNET │ + │ │ + │ External clients (DoT/DoH) │ + │ dns.xtrm-lab.org:853 (DoT) │ + │ dns.xtrm-lab.org:8443 (DoH) │ + └──────────────┬──────────────────────┘ + │ + ▼ +┌──────────────────────────────────────────────────────────────────────────────┐ +│ MikroTik hAP ax³ (192.168.10.1) │ +│ │ +│ ┌────────────────────────────────────────────────────────────────────────┐ │ +│ │ AdGuard Home (PRIMARY) │ │ +│ │ Container: 172.17.0.2 │ │ +│ │ Web UI: http://192.168.10.1:3000 │ │ +│ │ │ │ +│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ +│ │ │ Filters │ │ Blocklists │ │ Clients │ │ │ +│ │ │ (synced) │ │ 143K rules │ │ (synced) │ │ │ +│ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ +│ └────────────────────────────────────────────────────────────────────────┘ │ +│ │ │ +│ Netwatch monitors every 10s │ +│ │ │ +│ ┌─────────┴─────────┐ │ +│ │ │ │ +│ Container UP Container DOWN │ +│ │ │ │ +│ ▼ ▼ │ +│ NAT → 172.17.0.2 NAT → 192.168.10.10 │ +│ (MikroTik) (Unraid Failover) │ +└──────────────────────────────────────────────────────────────────────────────┘ + ▲ ▲ ▲ + │ │ │ + NAT Redirect NAT Redirect NAT Redirect + │ │ │ +┌───────┴───────┐ ┌────────┴────────┐ ┌────────┴────────┐ +│ VLAN 10 │ │ VLAN 20/25 │ │ VLAN 30/40 │ +│ Management │ │ Trusted/Kids │ │ IoT/CatchAll │ +│ 192.168.10.x │ │ 192.168.20.x │ │ 192.168.30.x │ +│ │ │ 192.168.25.x │ │ 192.168.1.x │ +└───────────────┘ └─────────────────┘ └─────────────────┘ +``` + +--- + +## AdGuard Instances + +| Instance | Role | IP | Port | Web UI | +|----------|------|-----|------|--------| +| MikroTik | Primary | 172.17.0.2 | 53 | http://192.168.10.1:3000 | +| Unraid | Secondary/Failover | 192.168.10.10 | 3000 | http://192.168.10.10:3000 | + +### Credentials (Same for Both) + +| Username | Password | +|----------|----------| +| jazzymc | 7RqWElENNbZnPW | + +--- + +## DNS Redirect Rules + +All DNS queries (port 53) from any VLAN are intercepted and redirected: + +| VLAN | Subnet | Redirected To | +|------|--------|---------------| +| 10 | 192.168.10.0/24 | 172.17.0.2:53 | +| 20 | 192.168.20.0/24 | 172.17.0.2:53 | +| 25 | 192.168.25.0/24 | 172.17.0.2:53 | +| 30 | 192.168.30.0/24 | 172.17.0.2:53 | +| 40 | 192.168.1.0/24 | 172.17.0.2:53 | + +**Note:** Clients don't need any DNS configuration - even if they use 8.8.8.8, traffic is intercepted by NAT. + +### NAT Rules on MikroTik + +```routeros +# Exception rules (prevent loops) - MUST BE FIRST +/ip firewall nat +add chain=dstnat action=accept protocol=udp src-address=172.17.0.0/24 dst-port=53 comment="[DNS] Allow MikroTik AdGuard outbound" +add chain=dstnat action=accept protocol=udp src-address=192.168.10.10 dst-port=53 comment="[DNS] Allow Unraid AdGuard outbound" + +# VLAN redirect rules +add chain=dstnat action=dst-nat to-addresses=172.17.0.2 to-ports=53 protocol=udp src-address=192.168.10.0/24 dst-port=53 comment="[DNS] VLAN10 Mgmt redirect" +add chain=dstnat action=dst-nat to-addresses=172.17.0.2 to-ports=53 protocol=udp src-address=192.168.20.0/24 dst-port=53 comment="[DNS] VLAN20 Trusted redirect" +add chain=dstnat action=dst-nat to-addresses=172.17.0.2 to-ports=53 protocol=udp src-address=192.168.25.0/24 dst-port=53 comment="[DNS] VLAN25 Kids redirect" +add chain=dstnat action=dst-nat to-addresses=172.17.0.2 to-ports=53 protocol=udp src-address=192.168.30.0/24 dst-port=53 comment="[DNS] VLAN30 IoT redirect" +add chain=dstnat action=dst-nat to-addresses=172.17.0.2 to-ports=53 protocol=udp src-address=192.168.1.0/24 dst-port=53 comment="[DNS] VLAN40 CatchAll redirect" + +# Masquerade for return traffic +add chain=srcnat action=masquerade protocol=udp src-address=192.168.10.0/24 dst-address=172.17.0.2 dst-port=53 comment="[DNS] VLAN10 masquerade" +# ... (similar for other VLANs) +``` + +--- + +## Automatic Failover + +### How It Works (Dual Health Check) + +Two independent Netwatch monitors trigger failover: + +| Monitor | Type | What It Checks | Interval | Timeout | +|---------|------|----------------|----------|---------| +| Ping | simple | Container reachable | 10s | 3s | +| DNS | dns | DNS queries work | 30s | 10s | + +**Either monitor failing triggers failover to Unraid.** + +### Failure Scenarios Covered + +| Scenario | Ping Check | DNS Check | Failover? | +|----------|------------|-----------|-----------| +| Container crashed | Fail | Fail | Yes | +| Container stopped | Fail | Fail | Yes | +| Network/routing issue | Fail | Fail | Yes | +| Upstream DNS unreachable | Pass | Fail | Yes | +| AdGuard overloaded | Pass | Fail | Yes | +| Everything working | Pass | Pass | No | + +### Failover Timeline + +| Event | Detection Time | Total Switchover | +|-------|----------------|------------------| +| Container crash (ping) | ~10-13 seconds | ~13-16 seconds | +| DNS failure (resolution) | ~30-40 seconds | ~33-43 seconds | +| Recovery | ~10-30 seconds | Automatic | + +### Failover Scripts + +```routeros +# dns-failover-down (runs when either check fails) +/system script add name=dns-failover-down dont-require-permissions=yes source={ + :log warning "DNS Failover: Switching to Unraid" + /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=3000 +} + +# dns-failover-up (runs when check recovers) +/system script add name=dns-failover-up dont-require-permissions=yes source={ + :log info "DNS Failover: Switching back to MikroTik" + /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=172.17.0.2 to-ports=53 +} +``` + +### Netwatch Configuration + +```routeros +# Monitor 1: Ping check (fast crash detection) +/tool netwatch add type=simple host=172.17.0.2 interval=10s timeout=3s \ + up-script=dns-failover-up down-script=dns-failover-down \ + comment="AdGuard failover monitor" + +# Monitor 2: DNS resolution check (functional verification) +/tool netwatch add type=dns host=google.com interval=30s timeout=10s \ + up-script=dns-failover-up down-script=dns-failover-down \ + comment="AdGuard DNS resolution check" +``` + +--- + +## Sync Configuration + +Settings are synced from Unraid (source of truth) to MikroTik every 30 minutes. + +### What Syncs + +| Feature | Synced | +|---------|--------| +| Filter lists (blocklists) | Yes | +| User rules (custom blocks/allows) | Yes | +| Client settings (per-device rules) | Yes | +| Services (blocked services) | Yes | +| Rewrites (custom DNS entries) | Yes | +| DNS server config | No | +| DHCP settings | No | +| Query logs/stats | No | + +### Sync Container + +```yaml +# /mnt/user/appdata/adguard-sync/adguardhome-sync.yaml +cron: "*/30 * * * *" +runOnStart: true + +origin: + url: http://192.168.10.10:3000 + username: jazzymc + password: 7RqWElENNbZnPW + +replicas: + - url: http://192.168.10.1:3000 + username: jazzymc + password: 7RqWElENNbZnPW + +features: + dns: + serverConfig: false + accessLists: true + rewrites: true + filters: true + clientSettings: true + services: true +``` + +**Note:** The sync container must be connected to both `dockerproxy` and `br0` networks to reach both AdGuard instances. + +--- + +## Container Configuration (MikroTik) + +### Container Details + +| Setting | Value | +|---------|-------| +| Image | adguard/adguardhome:latest | +| Interface | veth-adguard | +| IP | 172.17.0.2/24 | +| Gateway | 172.17.0.1 | +| Root dir | usb1/adguard/root | +| Config mount | usb1/adguard/conf → /opt/adguardhome/conf | +| Work mount | usb1/adguard/work → /opt/adguardhome/work | +| Start on boot | Yes | + +### Container Commands + +```routeros +# Check status +/container print + +# Start container +/container start 0 + +# Stop container +/container stop 0 + +# View logs +/log print where topics~"container" +``` + +--- + +## Upstream DNS + +Both AdGuard instances use the same upstream: + +| Upstream | Type | +|----------|------| +| https://dns.quad9.net/dns-query | Primary (DoH) | +| 9.9.9.9 | Bootstrap | +| 149.112.112.112 | Bootstrap secondary | + +--- + +## Management + +| Task | Where to Do It | +|------|----------------| +| Change blocklists | Unraid AdGuard (syncs to MikroTik) | +| Add custom rules | Unraid AdGuard | +| Add client settings | Unraid AdGuard | +| View query logs | MikroTik AdGuard (real-time) | +| Check failover status | MikroTik `/tool netwatch print` | + +--- + +## Troubleshooting + +### Check Failover Status + +```routeros +/tool netwatch print +# Both monitors should show STATUS=up normally +# Monitor 0: Ping check +# Monitor 1: DNS resolution check +``` + +### Check Current DNS Target + +```routeros +/ip firewall nat print where comment~"VLAN10 Mgmt redirect" +# to-addresses should be 172.17.0.2 (normal) or 192.168.10.10 (failover) +``` + +### View Failover Logs + +```routeros +/log print where message~"Failover" +``` + +### Manual Failover Test + +```routeros +# Stop container (triggers failover) +/container stop 0 + +# Wait 15 seconds, check NAT rules switched to 192.168.10.10 + +# Start container (triggers recovery) +/container start 0 + +# Wait 15 seconds, check NAT rules switched back to 172.17.0.2 +``` + +### DNS Not Working + +1. Check container is running: `/container print` +2. Check netwatch status: `/tool netwatch print` +3. Test DNS directly: `:resolve google.com server=172.17.0.2` +4. Check NAT rules: `/ip firewall nat print where comment~"DNS"` +5. **Check /32 routes exist:** `/ip route print where dst-address~"172.17.0.[23]"` +6. **Ping container:** `/ping 172.17.0.2 count=3` + +### Container Reachable but DNS Fails + +If ping works but DNS queries timeout: + +1. Check container can reach upstream: Look for timeout errors in logs +2. Verify /32 routes: Missing routes cause ECMP issues +3. Check NAT masquerade: `/ip firewall nat print where comment~"Container"` +4. Verify routes: +```routeros +/ip route print where dst-address~"172.17" +# Should show /32 routes for each container IP +``` + +### Sync Not Working + +```bash +# On Unraid +docker logs adguardhome-sync --tail 20 + +# Check connectivity +docker exec adguardhome-sync ping -c 2 192.168.10.10 +docker exec adguardhome-sync ping -c 2 192.168.10.1 +``` + +--- + +## Container Network Routing + +### Important: /32 Host Routes Required + +When running multiple containers on the same subnet (172.17.0.0/24), specific host routes are required to prevent ECMP routing issues: + +```routeros +# Without these routes, return traffic may go to wrong container +/ip route add dst-address=172.17.0.2/32 gateway=veth-adguard comment="AdGuard container - specific route" +/ip route add dst-address=172.17.0.3/32 gateway=veth-tailscale comment="Tailscale container - specific route" +``` + +**Why this matters:** Each veth interface creates a /24 route. With multiple veth interfaces on the same subnet, RouterOS enables ECMP load balancing, sending return traffic to random interfaces. + +--- + +## Quick Reference + +### Normal Operation +- DNS queries → MikroTik AdGuard (172.17.0.2) +- Ad blocking active +- ~143,000 filter rules + +### During Failover +- DNS queries → Unraid AdGuard (192.168.10.10) +- Ad blocking still active (same rules synced) +- Automatic, no manual intervention needed + +### Recovery +- Automatic when container comes back up +- NAT rules switch back to MikroTik +- No DNS interruption for clients diff --git a/docs/09-TAILSCALE-VPN.md b/docs/09-TAILSCALE-VPN.md new file mode 100644 index 0000000..9d78fae --- /dev/null +++ b/docs/09-TAILSCALE-VPN.md @@ -0,0 +1,208 @@ +# MikroTik Tailscale Container Setup + +**Last Updated:** 2026-02-06 + +--- + +## Overview + +Tailscale VPN running as a container on MikroTik hAP ax³, providing remote access to the home network via the Tailscale mesh network. + +--- + +## Architecture + +``` +┌─────────────────────────────────────────────────────────────────────┐ +│ MikroTik hAP ax³ (192.168.10.1) │ +│ │ +│ ┌─────────────────────────────────────────────────────────────┐ │ +│ │ Container Network (172.17.0.0/24) │ │ +│ │ │ │ +│ │ ┌─────────────────────┐ ┌─────────────────────────┐ │ │ +│ │ │ AdGuard Home │ │ Tailscale │ │ │ +│ │ │ 172.17.0.2 │ │ 172.17.0.3 │ │ │ +│ │ │ veth-adguard │ │ veth-tailscale │ │ │ +│ │ └─────────────────────┘ └─────────────────────────┘ │ │ +│ │ │ │ │ │ +│ │ └───────────┬───────────────┘ │ │ +│ │ │ │ │ +│ │ Gateway: 172.17.0.1 │ │ +│ └─────────────────────────────────────────────────────────────┘ │ +│ │ │ +│ NAT Masquerade │ +│ │ │ +│ WAN (ether1) │ +└──────────────────────────────┬──────────────────────────────────────┘ + │ + ▼ + ┌─────────────────────┐ + │ Tailscale Network │ + │ 100.x.x.x mesh │ + │ │ + │ Home Router IP: │ + │ 100.74.219.35 │ + └─────────────────────┘ +``` + +--- + +## Container Details + +| Setting | Value | +|---------|-------| +| Image | tailscale/tailscale:latest | +| Interface | veth-tailscale | +| Container IP | 172.17.0.3/24 | +| Gateway | 172.17.0.1 | +| Tailscale IP | 100.74.219.35 | +| Root dir | usb1/tailscale/root | +| State mount | usb1/tailscale → /var/lib/tailscale | +| DNS | 8.8.8.8 | +| Start on boot | Yes | +| Networking mode | Userspace (TS_USERSPACE=true) | + +--- + +## Environment Variables + +| Variable | Value | Purpose | +|----------|-------|---------| +| TS_AUTHKEY | tskey-auth-... | One-time auth key (used during setup) | +| TS_STATE_DIR | /var/lib/tailscale | Persistent state directory | +| TS_USERSPACE | true | Required for MikroTik containers (no /dev/net/tun) | + +--- + +## Network Configuration + +### veth Interface + +```routeros +/interface veth add address=172.17.0.3/24 gateway=172.17.0.1 name=veth-tailscale +``` + +### Gateway IP on Interface + +```routeros +/ip address add address=172.17.0.1/24 interface=veth-tailscale comment="Tailscale container gateway" +``` + +### NAT Masquerade for Internet Access + +```routeros +/ip firewall nat add chain=srcnat action=masquerade src-address=172.17.0.0/24 out-interface-list=WAN comment="Container network NAT" +``` + +### Firewall Forward Rules + +```routeros +/ip firewall filter add chain=forward action=accept dst-address=172.17.0.0/24 comment="[Container] Forward to container network" +/ip firewall filter add chain=forward action=accept src-address=172.17.0.0/24 comment="[Container] Forward from container network" +``` + +--- + +## Container Setup Commands + +### Create Mounts + +```routeros +/container mounts add list=ts-state src=usb1/tailscale dst=/var/lib/tailscale +``` + +### Create Environment Variables + +```routeros +/container envs add list=ts-env key=TS_STATE_DIR value=/var/lib/tailscale +/container envs add list=ts-env key=TS_USERSPACE value=true +/container envs add list=ts-env key=TS_AUTHKEY value= +``` + +### Create Container + +```routeros +/container add remote-image=tailscale/tailscale:latest interface=veth-tailscale \ + root-dir=usb1/tailscale/root mountlists=ts-state envlists=ts-env \ + dns=8.8.8.8 start-on-boot=yes logging=yes +``` + +--- + +## Management + +### Check Container Status + +```routeros +/container print +``` + +### View Logs + +```routeros +/log print where topics~"container" and message~"tailscale" +``` + +### Start/Stop Container + +```routeros +/container start [find name~"tailscale"] +/container stop [find name~"tailscale"] +``` + +--- + +## Troubleshooting + +### Container Won't Start (Exit Status 1) + +**Cause:** Missing /dev/net/tun device (default for Tailscale) + +**Solution:** Enable userspace networking mode: +```routeros +/container envs add list=ts-env key=TS_USERSPACE value=true +``` + +### Can't Reach Internet from Container + +**Cause:** Missing NAT masquerade or gateway IP + +**Solution:** +1. Verify gateway IP on veth interface: +```routeros +/ip address print where interface=veth-tailscale +``` + +2. Verify NAT masquerade rule: +```routeros +/ip firewall nat print where src-address=172.17.0.0/24 +``` + +### Container Not Connecting to Tailscale + +1. Check DNS resolution works (logs should show no timeout) +2. Verify auth key is valid and not expired +3. Check firewall isn't blocking outbound HTTPS + +--- + +## Tailscale Network Devices + +| Tailscale IP | Device | Status | +|--------------|--------|--------| +| 100.74.219.35 | MikroTik hAP ax³ (container) | Online | +| 100.100.208.70 | xtrm-unraid | Online | +| 100.112.103.7 | hapax3 (old native install) | Offline | +| 100.75.93.123 | mikrotik-tailscale (previous container) | Offline | + +--- + +## Important Notes + +1. **Userspace Networking Required:** MikroTik containers don't have /dev/net/tun access, so TS_USERSPACE=true is mandatory + +2. **Auth Key:** After initial authentication, the key is no longer needed - state is persisted in the mount + +3. **Container Network:** Both AdGuard and Tailscale share the 172.17.0.0/24 network but have separate veth interfaces + +4. **Accept Routes:** If subnet routing is needed, add TS_EXTRA_ARGS="--accept-routes" to environment diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md new file mode 100644 index 0000000..18f9479 --- /dev/null +++ b/docs/CHANGELOG.md @@ -0,0 +1,228 @@ +# Infrastructure Changelog + +**Purpose:** Major infrastructure events only. Minor changes are in git commit messages. + +--- + +## 2026-02-06 + +### Documentation Restructure +- **[DOCS]** Restructured docs/ from 23 files to clean 9-doc structure +- **[DOCS]** Archived 12 completed VLAN migration project docs to archive/vlan-migration/ +- **[DOCS]** Archived 5 done/superseded WIP docs (VLAN proposals, AI stack, Fossorial, DNS backup) +- **[DOCS]** Created standing reference docs: 08-DNS-ARCHITECTURE.md, 09-TAILSCALE-VPN.md +- **[DOCS]** Renamed docs to clean numbering (05-PORT-UTILIZATION, 06-VLAN-DEVICE-ASSIGNMENT, 07-WIFI-CAPSMAN-CONFIG) +- **[DOCS]** Merged 00-CHANGELOG.md + 06-CHANGELOG.md → CHANGELOG.md +- **[DOCS]** Updated all core docs with current VLAN IPs (192.168.31.x → 192.168.10.x) +- **[DOCS]** Fixed CSS1 IP: 192.168.10.9 → 192.168.10.3, ZX1 IP: 192.168.10.7 → 192.168.10.4 +- **[DOCS]** Cleaned 06-VLAN-DEVICE-ASSIGNMENT.md: removed migration-era columns and sections, fixed VLAN 25 subnet +- **[DOCS]** Updated README.md, CLAUDE.md, archive/README.md, wip/README.md + +--- + +## 2026-02-01 + +### WIP Documentation +- **[DOCS]** Added KVM-SWITCH-MAC-NOBARA.md - Software KVM for Mac/Nobara switching +- DDC/CI monitor control (Dell U3821DW) + HID++ Logitech peripheral switching +- Scripts created on Mac at ~/scripts/ + +--- + +## 2026-01-31 + +### Docker Cleanup +- **[DOCKER]** Removed 18 unused images (~4.9 GB reclaimed) +- **[DOCKER]** Removed 12 dangling images (old builds, untagged) +- **[DOCKER]** Removed Slurpit stack images (warehouse, portal, scanner, scraper) +- **[DOCKER]** Removed unused MongoDB 8 and MariaDB 11 images +- **[DOCKER]** Removed 35 orphaned volumes (~1.15 GB reclaimed) +- **[DOCKER]** Removed 28 anonymous dangling volumes +- **[DOCKER]** Removed 6 nextcloud_aio_* volumes (from old AIO install) +- **[DOCKER]** Removed orphaned redis-data volume +- **[DOCKER]** **Total reclaimed: ~6 GB** + +### Kept (Stopped Containers) +- open-webui, ollama (AI stack - for future use) +- pgAdmin4 (database management) +- diode-hydra-migrate, diode-auth-bootstrap (one-time migration jobs) + +--- + +## 2026-01-27 + +### VLAN Filtering Rolled Back +- **[VLAN]** Enabled VLAN filtering - caused connectivity issues +- **[VLAN]** ZX1 switch unreachable after activation (no management IP responding) +- **[VLAN]** CSS326 traffic routing through ZX1 (not direct eth3 link) +- **[VLAN]** **Rolled back** - VLAN filtering disabled +- **[CONFIG]** Added eth4 (ZX1) to all VLAN tagged lists for future use +- **[STATUS]** Network back to Legacy mode (192.168.31.0/24) +- **[TODO]** Need physical access to ZX1 to configure VLAN trunking + +### Issues Identified +- ZX1 switch not responding on documented IP 192.168.31.22 +- ZX1 may need VLAN trunk configuration before re-enabling filtering +- All CSS326 traffic goes via ZX1→HAP1, not direct CSS326→HAP1 link (STP?) + +--- + +## 2026-01-26 + +### VLAN Filtering Activated +- **[VLAN]** VLAN filtering enabled on MikroTik bridge - SUCCESSFUL +- **[VLAN]** Internet connectivity verified (ping 1.1.1.1, google.com) +- **[VLAN]** DNS resolution working through AdGuard +- **[VLAN]** All previous fixes (DHCP DNS, firewall, NAT masquerade) working correctly +- **[STATUS]** Network segmentation now ACTIVE + +### Local AI Stack Deployed +- **[AI]** Deployed Ollama container with Intel GPU passthrough +- **[AI]** Deployed Open WebUI at http://192.168.31.2:3080 +- **[AI]** Installed qwen2.5-coder:7b base model +- **[AI]** Created custom `unraid-assistant` model with infrastructure knowledge +- **[AI]** Created `/usr/local/bin/ai` terminal helper command +- **[AI]** Stopped non-critical containers for RAM: karakeep, unimus, homarr, netdisco-* + +### VLAN Activation Attempt & Fixes +- **[VLAN]** Configured CSS326 switch VLANs via SwOS web interface +- **[VLAN]** Enabled VLAN filtering on MikroTik - caused internet outage +- **[VLAN]** Rolled back VLAN filtering to restore connectivity +- **[VLAN]** **ROOT CAUSE IDENTIFIED:** Multiple configuration issues + +### Issues Fixed +- **[FIX]** DHCP DNS now points to each VLAN gateway instead of legacy 192.168.31.1 +- **[FIX]** Added DNS redirect rules for all VLANs (src-address-list=all-vlans) +- **[FIX]** Added all VLAN interfaces to LAN firewall interface list +- **[FIX]** Added NAT masquerade rules for VLAN traffic to AdGuard container +- **[BACKUP]** MikroTik config saved before activation attempt + +--- + +## 2026-01-25 + +### VLAN Phase 1 Complete +- **[VLAN]** Added VLAN 25 (Kids) - interface, IP, DHCP server, pool, bridge entry +- **[VLAN]** Fixed VLAN 10 (Management) leases - correct IPs per device assignment doc +- **[VLAN]** Fixed VLAN 30 (IoT) leases - all 14 devices with correct IPs +- **[VLAN]** Added VLAN 25 (Kids) leases - 6 devices including XTRM-Ally +- **[VLAN]** Added VLAN 50 (Guest) leases - 7 unknown devices +- **[VLAN]** Added firewall rules for VLAN 25 (Kids → IoT, Legacy, DNS) +- **[VLAN]** Total devices configured: 44 + +### VLAN Implementation (Prepared) +- **[VLAN]** Created 6 VLANs on MikroTik bridge (10, 20, 30, 35, 40, 50) +- **[VLAN]** Configured IP addresses for all VLAN interfaces +- **[VLAN]** Created DHCP servers and pools for each VLAN +- **[VLAN]** Added static DHCP leases mapping MACs to VLAN IPs +- **[VLAN]** Configured bridge VLAN table with tagged/untagged ports +- **[VLAN]** Set WiFi ports PVID=20 (Trusted VLAN default) +- **[VLAN]** Added inter-VLAN firewall rules (active) +- **[VLAN]** VLAN filtering NOT YET ENABLED (pending CSS326 switch config) +- **[DOCS]** Added docs/11-VLAN-IMPLEMENTATION.md +- **[SCRIPTS]** Added scripts/mikrotik-vlan-setup.rsc and mikrotik-vlan-enable.rsc + +### DNS Configuration +- **[DNS]** Updated both AdGuard instances to use Quad9 DoH +- **[DNS]** Bootstrap DNS: 9.9.9.9, 149.112.112.112 + +### MikroTik Containers +- **[CONTAINER]** AdGuard Home container running on MikroTik (172.17.0.2) +- **[CONTAINER]** Tailscale container configured (172.17.0.3) +- **[CONTAINER]** Fixed Tailscale container authentication +- **[CONTAINER]** Container bridge (containers-br) with NAT + +### Network +- **[NETWORK]** Enabled CSS326 SFP1 port - 10G backbone link to ZX1 now active + +### Documentation +- **[DOCS]** Created 02-PORT-UTILIZATION.md with ASCII port diagrams +- **[DOCS]** Fixed ZX1 switch IP: 192.168.31.22 (was incorrectly documented as .7) + +### Incident +- **[INCIDENT]** DNS outage after MikroTik restart - multiple root causes fixed: + - NAT rules blocking AdGuard outbound DNS (added exception rules) + - DHCP pushing wrong DNS (8.8.8.8 → 192.168.31.1) + - NAT redirect pointing to wrong IP/port (172.17.0.5:5355 → 192.168.31.4:53) + - Asymmetric routing (added srcnat masquerade for DNS redirect) +- **[SERVICE]** Removed MikroTik AdGuard Home container (storage/overlay errors) +- **[SERVICE]** Removed MikroTik Tailscale container (root directory missing) +- **[SERVICE]** Removed Pi-hole/Unbound leftovers from MikroTik (veth, mounts, envs) +- **[NETWORK]** Consolidated DNS architecture: MikroTik → Unraid AdGuard (192.168.31.4) only +- **[DOCS]** Created incident reports in docs/incidents/ +- **[DOCS]** Restructured documentation - consolidated into 5 core docs + archive +- **[NETBOX]** Added shelf devices for rack organization (U9, U7, U3) + +--- + +## 2026-01-24 +- **[NETBOX]** Standardized device names to NetBox convention (HAP1, CSS1, ZX1) +- **[DOCS]** Created NETWORK-PHYSICAL-MAP.md with complete port maps + +--- + +## 2026-01-23 +- **[SERVICE]** Deployed Diode network discovery stack +- **[SERVICE]** Removed Slurp'it (replaced by Diode + NetDisco) +- **[SERVICE]** Consolidated NetBox Redis to shared instance +- **[SERVICE]** Removed redundant DNS services (Unbound, DoH-Server, stunnel-dot) + +--- + +## 2026-01-22 +- **[SERVICE]** Migrated NetBox to shared PostgreSQL 17 +- **[SERVICE]** Deployed AdGuard Home on MikroTik (primary DNS) +- **[SERVICE]** Deployed AdGuard Home on Unraid (secondary DNS) +- **[SERVICE]** Removed Pi-hole (replaced by AdGuard Home) +- **[DOCS]** Created INFRASTRUCTURE-DIAGRAM.md + +--- + +## 2026-01-21 +- **[BACKUP]** Configured Rclone sync to Google Drive + +--- + +## 2026-01-19 +- **[SERVICE]** Deployed NetBox IPAM/DCIM +- **[SERVICE]** Deployed NetDisco network discovery +- **[NETWORK]** Enabled SNMP on all MikroTik devices + +--- + +## 2026-01-18 +- **[SERVICE]** Deployed Gitea git server +- **[SERVICE]** Deployed Woodpecker CI +- **[NETWORK]** Configured CAPsMAN on HAP1 +- **[WIRELESS]** CAP added to CAPsMAN management + +--- + +## 2026-01-17 +- **[SERVICE]** Deployed Portainer CE + +--- + +## Previous History + +For detailed history before 2026-01-17, see archived changelogs in `archive/`. + +--- + +## Format Guide + +```markdown +### YYYY-MM-DD +- **[CATEGORY]** Brief description + +Categories: +- [DEVICE] - Hardware added/removed/changed +- [SERVICE] - Container/service deployed/removed +- [NETWORK] - Network topology/config changes +- [WIRELESS] - WiFi/CAPsMAN changes +- [BACKUP] - Backup configuration +- [DOCS] - Major documentation changes +- [INCIDENT] - Outages and fixes +- [VLAN] - VLAN configuration changes +- [DOCKER] - Docker maintenance +``` diff --git a/docs/wip/FOSSORIAL-TUNNELS.md b/docs/archive/FOSSORIAL-TUNNELS.md similarity index 100% rename from docs/wip/FOSSORIAL-TUNNELS.md rename to docs/archive/FOSSORIAL-TUNNELS.md diff --git a/docs/wip/LOCAL-AI-STACK.md b/docs/archive/LOCAL-AI-STACK.md similarity index 100% rename from docs/wip/LOCAL-AI-STACK.md rename to docs/archive/LOCAL-AI-STACK.md diff --git a/docs/archive/README.md b/docs/archive/README.md index 0130faf..8223374 100644 --- a/docs/archive/README.md +++ b/docs/archive/README.md @@ -1,8 +1,8 @@ # Archived Documentation -> ⚠️ **OBSOLETE - DO NOT UPDATE** +> **OBSOLETE - DO NOT UPDATE** -These documents are from the legacy documentation structure (pre-2026-01-25). +These documents are from completed projects and legacy documentation. They are kept for historical reference only. **For current documentation, see the parent `docs/` folder:** @@ -10,7 +10,28 @@ They are kept for historical reference only. - `02-SERVICES-CRITICAL.md` - Essential services - `03-SERVICES-OTHER.md` - Non-critical services - `04-HARDWARE-INVENTORY.md` - Hardware details -- `05-CHANGELOG.md` - Major events +- `05-PORT-UTILIZATION.md` - Device port assignments +- `06-VLAN-DEVICE-ASSIGNMENT.md` - VLAN device mapping +- `07-WIFI-CAPSMAN-CONFIG.md` - WiFi and CAPsMAN settings +- `08-DNS-ARCHITECTURE.md` - DNS failover architecture +- `09-TAILSCALE-VPN.md` - Tailscale VPN setup +- `CHANGELOG.md` - Change history + +## Subfolders + +### vlan-migration/ + +12 documents from the VLAN migration project (completed 2026-01-31): +- Migration plans (v1, v2, v3) +- Implementation status trackers +- Setup progress logs +- DNS/AdGuard/Tailscale project docs (superseded by standing docs 08- and 09-) +- Device migration worksheet + +### Legacy Docs (root archive/) + +- Pre-2026-01-25 documentation structure +- Completed WIP items (VLAN proposals, AI stack, Fossorial tunnels) +- Historical changelogs **Do not reference these archived documents for current state.** -All relevant information has been migrated to the new structure. diff --git a/docs/wip/VLAN-PROPOSAL.md b/docs/archive/VLAN-PROPOSAL.md similarity index 100% rename from docs/wip/VLAN-PROPOSAL.md rename to docs/archive/VLAN-PROPOSAL.md diff --git a/docs/wip/VLAN-SEGMENTATION.md b/docs/archive/VLAN-SEGMENTATION.md similarity index 100% rename from docs/wip/VLAN-SEGMENTATION.md rename to docs/archive/VLAN-SEGMENTATION.md diff --git a/docs/04-VLAN-MIGRATION-PLAN.md b/docs/archive/vlan-migration/04-VLAN-MIGRATION-PLAN.md similarity index 100% rename from docs/04-VLAN-MIGRATION-PLAN.md rename to docs/archive/vlan-migration/04-VLAN-MIGRATION-PLAN.md diff --git a/docs/09-MIKROTIK-ADGUARD-DOT-DOH.md b/docs/archive/vlan-migration/09-MIKROTIK-ADGUARD-DOT-DOH.md similarity index 100% rename from docs/09-MIKROTIK-ADGUARD-DOT-DOH.md rename to docs/archive/vlan-migration/09-MIKROTIK-ADGUARD-DOT-DOH.md diff --git a/docs/10-MIKROTIK-TAILSCALE.md b/docs/archive/vlan-migration/10-MIKROTIK-TAILSCALE.md similarity index 100% rename from docs/10-MIKROTIK-TAILSCALE.md rename to docs/archive/vlan-migration/10-MIKROTIK-TAILSCALE.md diff --git a/docs/11-VLAN-IMPLEMENTATION.md b/docs/archive/vlan-migration/11-VLAN-IMPLEMENTATION.md similarity index 100% rename from docs/11-VLAN-IMPLEMENTATION.md rename to docs/archive/vlan-migration/11-VLAN-IMPLEMENTATION.md diff --git a/docs/12-VLAN-SETUP-PROGRESS.md b/docs/archive/vlan-migration/12-VLAN-SETUP-PROGRESS.md similarity index 100% rename from docs/12-VLAN-SETUP-PROGRESS.md rename to docs/archive/vlan-migration/12-VLAN-SETUP-PROGRESS.md diff --git a/docs/13-VLAN-SETUP-PLAN-V2.md b/docs/archive/vlan-migration/13-VLAN-SETUP-PLAN-V2.md similarity index 100% rename from docs/13-VLAN-SETUP-PLAN-V2.md rename to docs/archive/vlan-migration/13-VLAN-SETUP-PLAN-V2.md diff --git a/docs/14-VLAN-SETUP-PLAN-V3-SAFE-MODE.md b/docs/archive/vlan-migration/14-VLAN-SETUP-PLAN-V3-SAFE-MODE.md similarity index 100% rename from docs/14-VLAN-SETUP-PLAN-V3-SAFE-MODE.md rename to docs/archive/vlan-migration/14-VLAN-SETUP-PLAN-V3-SAFE-MODE.md diff --git a/docs/15-VLAN-SETUP-COMPLETE-2026-01-31.md b/docs/archive/vlan-migration/15-VLAN-SETUP-COMPLETE-2026-01-31.md similarity index 100% rename from docs/15-VLAN-SETUP-COMPLETE-2026-01-31.md rename to docs/archive/vlan-migration/15-VLAN-SETUP-COMPLETE-2026-01-31.md diff --git a/docs/16-ADGUARD-VLAN-PLAN.md b/docs/archive/vlan-migration/16-ADGUARD-VLAN-PLAN.md similarity index 100% rename from docs/16-ADGUARD-VLAN-PLAN.md rename to docs/archive/vlan-migration/16-ADGUARD-VLAN-PLAN.md diff --git a/docs/17-DNS-ADGUARD-FAILOVER.md b/docs/archive/vlan-migration/17-DNS-ADGUARD-FAILOVER.md similarity index 100% rename from docs/17-DNS-ADGUARD-FAILOVER.md rename to docs/archive/vlan-migration/17-DNS-ADGUARD-FAILOVER.md diff --git a/docs/18-MIKROTIK-TAILSCALE.md b/docs/archive/vlan-migration/18-MIKROTIK-TAILSCALE.md similarity index 100% rename from docs/18-MIKROTIK-TAILSCALE.md rename to docs/archive/vlan-migration/18-MIKROTIK-TAILSCALE.md diff --git a/docs/20-DEVICE-MIGRATION-WORKSHEET.md b/docs/archive/vlan-migration/20-DEVICE-MIGRATION-WORKSHEET.md similarity index 100% rename from docs/20-DEVICE-MIGRATION-WORKSHEET.md rename to docs/archive/vlan-migration/20-DEVICE-MIGRATION-WORKSHEET.md diff --git a/docs/wip/DNS-REDIRECT-RULES-BACKUP.md b/docs/archive/vlan-migration/DNS-REDIRECT-RULES-BACKUP.md similarity index 100% rename from docs/wip/DNS-REDIRECT-RULES-BACKUP.md rename to docs/archive/vlan-migration/DNS-REDIRECT-RULES-BACKUP.md diff --git a/docs/wip/GITOPS-CONTAINERS.md b/docs/wip/GITOPS-CONTAINERS.md index 768bfde..b7e8c0e 100644 --- a/docs/wip/GITOPS-CONTAINERS.md +++ b/docs/wip/GITOPS-CONTAINERS.md @@ -104,7 +104,7 @@ pipeline: when: path: configs/xtrm-n5/** commands: - - ssh root@192.168.31.2 "cd /path && docker compose up -d" + - ssh root@192.168.10.20 "cd /path && docker compose up -d" secrets: [ssh_key] deploy-n1: diff --git a/docs/wip/README.md b/docs/wip/README.md index 75a63f8..7641d38 100644 --- a/docs/wip/README.md +++ b/docs/wip/README.md @@ -8,9 +8,9 @@ Planned changes, evaluations, and ideas not yet implemented. | Status | Meaning | |--------|---------| -| 📋 PLANNED | Approved, waiting for resources/time | -| 🔬 EVALUATING | Under investigation/research | -| 💡 IDEA | Concept, needs further definition | +| PLANNED | Approved, waiting for resources/time | +| EVALUATING | Under investigation/research | +| IDEA | Concept, needs further definition | --- @@ -20,24 +20,24 @@ Planned changes, evaluations, and ideas not yet implemented. | Document | Status | Priority | Description | |----------|--------|----------|-------------| -| [UPGRADE-2026-HARDWARE.md](UPGRADE-2026-HARDWARE.md) | 📋 PLANNED | High | N5 Air + N100 server migration | -| [GITOPS-CONTAINERS.md](GITOPS-CONTAINERS.md) | 💡 IDEA | Medium | Container config in Git with CI/CD | +| [UPGRADE-2026-HARDWARE.md](UPGRADE-2026-HARDWARE.md) | PLANNED | High | N5 Air + N100 server migration | +| [GITOPS-CONTAINERS.md](GITOPS-CONTAINERS.md) | IDEA | Medium | Container config in Git with CI/CD | ### Network | Document | Status | Priority | Description | |----------|--------|----------|-------------| -| [VLAN-SEGMENTATION.md](VLAN-SEGMENTATION.md) | 📋 PLANNED | Medium | Network segmentation (Secure/IoT/Kids/Guest) | -| [FOSSORIAL-TUNNELS.md](FOSSORIAL-TUNNELS.md) | 💡 IDEA | Low | Self-hosted Pangolin/Gerbil tunnels | +| [CONSOLE-PORT-ETHER5.md](CONSOLE-PORT-ETHER5.md) | EVALUATING | Low | Console/serial port on HAP1 ether5 | +| [KVM-SWITCH-MAC-NOBARA.md](KVM-SWITCH-MAC-NOBARA.md) | EVALUATING | Medium | Software KVM for Mac/Nobara switching | ### Applications | Document | Status | Priority | Description | |----------|--------|----------|-------------| -| [REMOTE-GAMING.md](REMOTE-GAMING.md) | 🔬 EVALUATING | Low | Sunshine + Moonlight game streaming | +| [REMOTE-GAMING.md](REMOTE-GAMING.md) | EVALUATING | Low | Sunshine + Moonlight game streaming | --- ## Completed Items -Move to main docs or archive when done. Update `05-CHANGELOG.md` with major completions. +Move to main docs or archive when done. Update `CHANGELOG.md` with major completions.