infrastructure/docs/archive/07-CHANGELOG.md

2026-01-19 - NetDisco Web UI Fixed

2026-01-19 - Phase 8 NetDisco Integration COMPLETED

All Tasks Completed

• [8.1] SNMP enabled on hAP ax³, cAP ac, CSS326
• [8.2] NetDisco deployed (backend + web containers)
• [8.3] Discovery configured (3 devices discovered)
• [8.4] Traefik ingress with Authentik SSO
• [8.5] NetBox sync script created and tested
• [8.6] All functionality verified

Key Fix

• [FIX] session_cookie_key missing from database - manually inserted

Metrics

• Devices discovered: 3
• Ports collected: 52
• MAC addresses tracked: 19

Access

• External: https://netdisco.xtrm-lab.org (SSO)
• Internal: http://192.168.31.2:5000

---

Task 8.4: Traefik Ingress - VERIFIED WORKING

Root Cause:

• [BUG] session_cookie_key was missing from database
• NetDisco generates this key via netdisco-deploy, but our external PostgreSQL setup skipped this step
• Error: "The setting session_cookie_key must be defined"

Fix Applied:

• [DB] Manually inserted dancer_session_cookie_key into sessions table:

  INSERT INTO sessions (id, a_session) VALUES ('dancer_session_cookie_key', md5(random()::text));
  

Verification:

• [TEST] http://netdisco-web:5000 - WORKING (returns HTML)
• [TEST] https://netdisco.xtrm-lab.org - WORKING (302 redirect to Authentik)

Access:

• External URL: https://netdisco.xtrm-lab.org (SSO via Authentik)
• Internal URL: http://192.168.31.2:5000 (direct)
• Database: session_cookie_key stored in PostgreSQL sessions table

---

Infrastructure Changelog

2026-01-19 - NetDisco Traefik Integration

Task 8.4: Traefik Ingress - COMPLETED

• [TRAEFIK] Added netdisco-secure router to dynamic.yml
• [TRAEFIK] Service: http://netdisco-web:5000
• [AUTH] Protected with authentik-forward-auth middleware
• [DNS] netdisco.xtrm-lab.org (configured by user)
• [URL] https://netdisco.xtrm-lab.org

---

2026-01-19 - NetDisco Deployment

Task 8.2: Deploy NetDisco - COMPLETED

Database Setup:

• [DB] Created netdisco_db database in postgresql17
• [DB] Created netdisco_user with password
• [DB] Database schema initialized (96 migrations applied)

Container Deployment:

• [SERVICE] netdisco-web: Web UI on port 5000
• [SERVICE] netdisco-backend: SNMP polling daemon
• [CONFIG] deployment.yml configured with SNMP communities
• [CONFIG] Discover schedule: Every 2 hours
• [CONFIG] MAC/ARP polling: Hourly

Device Discovery:

• [DISCOVER] 192.168.31.1 (hAP ax³) - Successful
• [DISCOVER] 192.168.31.6 (cAP ac) - Successful
• [DISCOVER] 192.168.31.9 (CSS326) - Successful
• [DATA] MAC address tables collected
• [DATA] ARP tables collected

Access:

• Web UI: http://192.168.31.2:5000
• Initial auth: no_auth=true (unauthenticated admin)

---

2026-01-19 - SNMP Configuration for NetDisco

Task 8.1: Enable SNMP on MikroTik Devices - COMPLETED

hAP ax³ (192.168.31.1):

• [SNMP] Enabled SNMPv2c
• [SNMP] Added netdisco community (192.168.31.2 only)
• [SNMP] Restricted public community to 192.168.31.2
• [SNMP] Contact: admin@xtrm-lab.org, Location: XTRM Home Lab

cAP ac (192.168.31.6):

• [SNMP] Enabled SNMPv2c via REST API
• [SNMP] Added netdisco community (192.168.31.2 only)
• [SNMP] Restricted public community to 192.168.31.2

CSS326 (192.168.31.9):

• [SNMP] Verified SNMP enabled (SwOS default)
• [SNMP] Using public community (SwOS single-community limitation)
• [NOTE] SwOS does not support address restrictions via API

Testing:

• [TEST] All three devices responding to SNMP queries from Unraid
• [TEST] sysName.0 verified: HAPax3, CAP XL ac, CSS326-24G-2S+

---

2026-01-19 - NetDisco Integration Planning

Phase 8: NetDisco + NetBox Integration

• [DOCS] Created 12-PHASE8-NETDISCO-INTEGRATION.md
• [PLANNING] NetDisco deployment for SNMP-based network discovery
• [PLANNING] MikroTik SNMP configuration (hAP ax³, CSS326, cAP ac)
• [PLANNING] NetBox integration via plugin or custom API sync
• [DECISION] Keep NetAlertX running in parallel during transition

MikroTik SNMP Support Confirmed

• hAP ax³ (RouterOS 7.x): Full SNMPv1/v2c/v3 support
• CSS326 (SwOS): SNMPv1/v2c read-only support
• cAP ac (RouterOS 7.x): Full SNMPv1/v2c/v3 support

Resources

• NetDisco
• NetBox Plugin for NetDisco

---

2026-01-19 - NetBox IPAM/DCIM Deployment

NetBox Installation

• [SERVICE] netbox: Deployed NetBox IPAM/DCIM on port 8090
• [SERVICE] netbox-worker: Background task worker
• [SERVICE] netbox-housekeeping: Database maintenance
• [SERVICE] netbox-postgres: Dedicated PostgreSQL 16 database
• [SERVICE] netbox-redis: Persistent Redis for queues
• [SERVICE] netbox-redis-cache: Redis cache instance

Configuration

• URL: https://netbox.xtrm-lab.org
• Local: http://192.168.31.2:8090
• Network: dockerproxy (for Traefik) + netbox (internal)
• Data: /mnt/user/appdata/netbox/

DNS

• [DNS] Added netbox.xtrm-lab.org to Cloudflare

Purpose

• IP Address Management (IPAM)
• Data Center Infrastructure Management (DCIM)
• VLAN documentation and planning
• Network device inventory
• Cable/connection tracking

---

2026-01-18 - MikroTik WiFi & CAPsMAN Configuration

CAPsMAN Setup

• [MIKROTIK] Configured CAPsMAN on hAP ax³ (192.168.31.1) as WiFi controller
• [MIKROTIK] Added cAP ac (192.168.31.6) as managed access point
• [MIKROTIK] Created provisioning rules for 2.4GHz and 5GHz bands
• [MIKROTIK] cAP ac radios now managed by CAPsMAN (configuration.manager=capsman)

WiFi Security Updates

• [WIFI] XTRM (2.4GHz): Changed from WPA2/WPA3 to WPA/WPA2 for legacy device support
• [WIFI] XTRM2 (IoT): Changed from WPA2/WPA3 to WPA/WPA2 for legacy device support
• [WIFI] XTRM (5GHz): Remains WPA2/WPA3
• [WIFI] Fixed configuration band mismatch (cfg-XTRM5g had 2ghz-n, cfg-XTRM2g had 5ghz-ac)

SSH Key Configuration

• [SSH] Added SSH key to cAP ac for xtrm user (key-based auth from Desktop)
• [SSH] Documented SSH access for both MikroTik devices

Documentation

• [DOCS] Created 09-MIKROTIK-WIFI-CAPSMAN.md with full WiFi/CAPsMAN configuration
• [DOCS] Updated 00-CURRENT-STATE.md with cAP ac device info and WiFi networks
• [DOCS] Added WiFi passwords and connection details to documentation

Issue Resolved

• [FIX] iPad 2 connectivity issue - resolved by enabling WPA-PSK on 2.4GHz networks

---

2026-01-18 - Docker Organization & Container Fixes

FolderView2 Categories Reorganized

• [UNRAID] Reorganized Docker containers into 10 categories
• Categories: Infrastructure, Security, Monitoring, DevOps, Media, Storage/Backup, Productivity, Smart Home, Remote Access, Management
• Icon collection: Dazzle Line Icons (https://www.svgrepo.com/collection/dazzle-line-icons/)
• Deleted old categories: Cloud, Dashboards and Stats, Finance, Databases, Network, Network Monitoring, Automation, Backup

Container Icon Fixes

• [SERVICE] rustfs: Fixed missing icon (was 404), now uses GitHub org avatar
• [SERVICE] gitea: Fixed webui label (was template syntax, now https://git.xtrm-lab.org)
• [SERVICE] woodpecker-server: Fixed icon URL (woodpecker.png → woodpecker-ci.png)
• [SERVICE] woodpecker-agent: Fixed icon URL (woodpecker.png → woodpecker-ci.png)

Documentation

• [DOCS] Added Unraid Docker Organization section to 00-CURRENT-STATE.md

2026-01-18

• [INFRA] Added pending task: Static IP assignment for critical services on dockerproxy and bridge networks
• [SERVICE] postgresql17: Recreated container (was stopped due to port conflict)
• [SERVICE] authentik + authentik-worker: Restarted after PostgreSQL fix
• [TEMPLATE] Added RustDesk container templates with icons
• [TEMPLATE] Updated Pi-hole template with proper Unraid CA metadata

Track all changes to services, configurations, and phase progress.

---

2026-01-17 - Homarr + Portainer Integration

Portainer App Added to Homarr

• [SERVICE] homarr: Added Portainer app to dashboard
• Section: Monitoring
• URL: http://100.100.208.70:9002 (Tailscale)
• Ping URL: http://192.168.31.2:9002 (LAN)

Docker Integration Added

• [SERVICE] homarr: Added Docker integration via socket
• Integration name: Docker (Unraid)
• Socket: unix:///var/run/docker.sock
• Linked to Portainer app for container status display

Database Changes

• Added app record for Portainer
• Added item and item_layout for Monitoring section
• Added integration record for Docker
• Linked integration to Portainer item

Access

• Homarr: https://xtrm-lab.org
• Portainer visible in Monitoring section

---

2026-01-17 - Phase 6.2/6.3 Cancelled: MikroTik Incompatible

Discovery

• MikroTik RouterOS containers are NOT Docker-based
• No /var/run/docker.sock exists on MikroTik
• Portainer cannot connect to MikroTik's container runtime

What Was Attempted

• Created veth-socat interface (172.17.0.5)
• Deployed alpine/socat container
• Added firewall and NAT rules for port 2375
• Socat failed: No such file or directory for docker.sock

Cleanup Performed

• Removed socat container
• Removed veth-socat interface and bridge port
• Removed docker_sock mount
• Removed firewall/NAT rules for port 2375

Conclusion

• Phase 6.2 and 6.3 are NOT FEASIBLE
• MikroTik containers must be managed via RouterOS CLI/WebFig
• Portainer remains useful for Unraid-only container management

Status Update

• [PHASE 6.1] COMPLETED - Portainer managing Unraid
• [PHASE 6.2] CANCELLED - MikroTik incompatible
• [PHASE 6.3] CANCELLED - MikroTik incompatible

---

2026-01-17 - Unraid Container Labels Fixed

Containers Updated

• [SERVICE] unbound: Added Unraid labels (net.unraid.docker.managed, net.unraid.docker.icon)
• [SERVICE] portainer: Added Unraid labels + Tailscale labels

Portainer Labels

• net.unraid.docker.managed=dockerman
• net.unraid.docker.icon - Portainer icon
• net.unraid.docker.webui=http://100.100.208.70:9002
• tailscale.expose=true
• tailscale.host=100.100.208.70
• tailscale.port=9002

Unbound Labels

• net.unraid.docker.managed=dockerman
• net.unraid.docker.icon - Unbound icon

Note

Both containers recreated to apply labels. Services verified working after recreation.

---

2026-01-17 - Phase 6.1 Completed: Portainer CE Deployed

Portainer CE Installation

• [PHASE 6.1] Portainer CE deployed on Unraid - COMPLETED
• Container: portainer/portainer-ce:latest
• HTTP Port: 9002 (changed from 9000 due to Authentik conflict)
• HTTPS Port: 9444
• Data: /mnt/user/appdata/portainer
• LAN URL: http://192.168.31.2:9002
• Tailscale URL: http://100.100.208.70:9002

Port Conflict Resolution

• Original plan: port 9000
• Conflict: Authentik already using port 9000
• Resolution: Mapped to port 9002 (HTTP) and 9444 (HTTPS)

Next Steps

• Phase 6.2: Deploy Socat proxy on MikroTik (port 2375)
• Phase 6.3: Connect MikroTik environment to Portainer

Status

• [PHASE 6.1] COMPLETED - Portainer running, needs initial setup via web UI
• [PHASE 6.2] NOT STARTED
• [PHASE 6.3] NOT STARTED

---

2026-01-17 - Phase 6 Added: Multi-Host Docker Management

New Documentation

• [PHASE 6] Created 06-PHASE6-PORTAINER-MANAGEMENT.md
• Portainer CE deployment plan for unified Docker management
• Covers Unraid local setup and MikroTik remote API via Socat

Phase 6 Components

• Phase 6.1: Portainer CE installation on Unraid (port 9002)
• Phase 6.2: MikroTik Socat proxy for Docker API exposure (port 2375)
• Phase 6.3: Unified dashboard connection

Security Considerations