jazzymc/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
fa15bec2d6c7e480d051c94bf4b437fc6d06fea4
infrastructure/docs/00-CURRENT-STATE.md
XTRM-Unraid 01e8519639
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details
Add switch web UI via Traefik at sw.xtrm-lab.org
2026-01-22 21:43:24 +02:00

358 lines
9.7 KiB
Markdown
Raw Blame History

# Infrastructure Current State: xtrm-lab.org
## Document Updated: 2026-01-22
## Target Domain: xtrm-lab.org
---
## Network Topology Diagram
```mermaid
graph TB
subgraph Internet
WAN["WAN: 62.73.120.142"]
DNS_EXT["dns.xtrm-lab.org<br/>DoH/DoT/DoQ"]
end
subgraph MikroTik["MikroTik hAP ax³ (192.168.31.1)"]
ROUTER["RouterOS 7.20.6"]
subgraph MK_Containers["Docker Containers"]
AGH_MK["AdGuard Home<br/>172.17.0.5:5355<br/>PRIMARY DNS"]
TS["Tailscale<br/>172.17.0.4"]
end
end
subgraph Switch["CSS326-24G-2S+ (192.168.31.9)"]
SW["24-Port Managed Switch"]
end
subgraph AP["cAP ac (192.168.31.6)"]
WIFI["CAPsMAN AP"]
end
subgraph Unraid["Unraid Server (192.168.31.2)"]
subgraph Core["Core Services"]
TRAEFIK["Traefik<br/>172.18.0.3"]
HOMARR["Homarr<br/>172.18.0.4"]
end
subgraph Security["Security"]
AUTH["Authentik<br/>172.18.0.11"]
VAULT["Vaultwarden<br/>172.18.0.15"]
end
subgraph DNS_Unraid["DNS Services"]
AGH_UR["AdGuard Home<br/>192.168.31.4:53<br/>SECONDARY DNS"]
UNBOUND["Unbound<br/>192.168.31.5"]
end
subgraph DevOps["DevOps"]
GITEA["Gitea<br/>172.18.0.31"]
WOODPECKER["Woodpecker CI<br/>172.18.0.32"]
end
subgraph Monitoring["Monitoring"]
UPTIME["Uptime Kuma<br/>172.18.0.20"]
NETBOX["NetBox<br/>172.24.0.5"]
end
subgraph Media["Media"]
PLEX["Plex"]
NEXTCLOUD["Nextcloud<br/>172.18.0.24"]
end
end
subgraph LAN["LAN Devices (192.168.31.x)"]
CLIENTS["Clients"]
end
WAN --> ROUTER
DNS_EXT --> ROUTER
ROUTER --> AGH_MK
ROUTER --> TS
ROUTER --> SW
SW --> Unraid
SW --> AP
AP --> CLIENTS
SW --> CLIENTS
AGH_MK -.->|"Upstream DoH"| QUAD9["Quad9 DNS"]
AGH_UR -.->|"Upstream DoH"| QUAD9
CLIENTS -->|"DNS Queries"| AGH_MK
CLIENTS -.->|"Failover"| AGH_UR
```
---
## MikroTik hAP ax³ Router (192.168.31.1)
| Parameter | Value |
|-----------|-------|
| RouterOS Version | 7.20.6 (stable) |
| WAN IP (Static) | 62.73.120.142 |
| LAN Subnet | 192.168.31.0/24 |
| Docker Bridge | 172.17.0.0/24 |
| SSH Access | Port 2222, user: jazzymc |
**Interfaces:**
- `ether1` - WAN (62.73.120.142/23)
- `bridge` - LAN (192.168.31.1/24)
- `docker-bridge` - Container network (172.17.0.1/24)
- `back-to-home-vpn` - WireGuard VPN (192.168.216.1/24)
### Running Containers on MikroTik
| Container | IP | Storage | Purpose |
|-----------|-----|---------|---------|
| tailscale | 172.17.0.4 | usb1/tailscale/root | Tailscale VPN client |
| adguardhome | 172.17.0.5 | disk1/agh-root + usb1 mount | DNS with DoH/DoT/DoQ |
### AdGuard Home (MikroTik) - PRIMARY DNS
| Service | Port | Protocol | Status |
|---------|------|----------|--------|
| DNS | 5355 (NAT from 53) | UDP/TCP | Active |
| Web UI | 80 | HTTP | Active |
| DoH | 443 | HTTPS | Active |
| DoT | 853 | TCP | Active |
| DoQ | 8853 | UDP | Active |
**Configuration:**
- Upstream: Quad9 DoH (https://dns10.quad9.net/dns-query)
- TLS Certificate: Let's Encrypt wildcard (\*.xtrm-lab.org)
- Server Name: dns.xtrm-lab.org
- Certificate Expiry: 2026-04-02
- Credentials: jazzymc / 7RqWElENNbZnPW
**Persistence:** root-dir on disk1 + data mount on usb1 (survives container restart)
---
## MikroTik CSS326-24G-2S+ Switch (192.168.31.9)
| Parameter | Value |
|-----------|-------|
| Role | Managed Layer 2 Switch |
| Ports | 24x Gigabit + 2x SFP |
| OS | SwOS |
| Web UI | https://sw.xtrm-lab.org |
---
## MikroTik cAP ac (192.168.31.6)
| Parameter | Value |
|-----------|-------|
| Role | CAPsMAN Managed Access Point |
| RouterOS Version | 7.20.1 (stable) |
| Identity | CAP XL ac |
---
## Unraid Server (192.168.31.2)
**Tailscale IP:** 100.100.208.70
**SSH Access:** `ssh -i ~/.ssh/id_ed25519_unraid root@192.168.31.2 -p 422`
### Docker Networks
| Network | Subnet | Purpose |
|---------|--------|---------|
| br0 | 192.168.31.0/24 | LAN macvlan (AdGuard Home) |
| dockerproxy | 172.18.0.0/16 | Traefik-accessible services |
| netbox | 172.24.0.0/16 | NetBox stack |
| bridge | 172.17.0.0/16 | Default Docker bridge |
### Key Services
| Service | Container | IP | External URL |
|---------|-----------|---|--------------|
| **Core** ||||
| Reverse Proxy | traefik | 172.18.0.3 | traefik.xtrm-lab.org |
| Dashboard | homarr | 172.18.0.4 | xtrm-lab.org |
| **Security** ||||
| Identity Provider | authentik | 172.18.0.11 | auth.xtrm-lab.org |
| Password Manager | vaultwarden | 172.18.0.15 | vault.xtrm-lab.org |
| **DNS** ||||
| AdGuard Home | adguardhome | 192.168.31.4 | - |
| Unbound | unbound | 192.168.31.5 | - |
| **DevOps** ||||
| Git Server | gitea | 172.18.0.31 | git.xtrm-lab.org |
| CI/CD Server | woodpecker-server | 172.18.0.32 | ci.xtrm-lab.org |
| **Monitoring** ||||
| Uptime Kuma | UptimeKuma | 172.18.0.20 | uptime.xtrm-lab.org |
| NetBox | netbox | 172.24.0.5 | netbox.xtrm-lab.org |
| **Media** ||||
| Plex | plex | host | plex.xtrm-lab.org |
| Nextcloud | Nextcloud | 172.18.0.24 | nextcloud.xtrm-lab.org |
| **Remote Access** ||||
| RustDesk | rustdesk-hbbs/hbbr | bridge | rustdesk.xtrm-lab.org |
### AdGuard Home (Unraid) - SECONDARY DNS
| Setting | Value |
|---------|-------|
| IP Address | 192.168.31.4 |
| Network | br0 (macvlan) |
| Web UI | http://192.168.31.4:3000 |
| DNS | 192.168.31.4:53 |
| DoT | 192.168.31.4:853 |
| Credentials | jazzymc / 7RqWElENNbZnPW |
**Configuration (synced with MikroTik):**
- Upstream: Quad9 DoH
- TLS Certificate: Let's Encrypt wildcard
- 6 Clients configured
- Custom filtering rules (SentinelOne, Jamf)
**Data Location:** /mnt/user/appdata/adguardhome/
**Stopped Services:**
- binhex-official-pihole (replaced by AdGuard Home)
- nebula-sync (incompatible with AdGuard Home)
---
## DNS Architecture
```mermaid
flowchart TB
subgraph External["External Access"]
DOH["DoH: https://dns.xtrm-lab.org/dns-query"]
DOT["DoT: tls://dns.xtrm-lab.org:853"]
DOQ["DoQ: quic://dns.xtrm-lab.org:8853"]
end
subgraph MikroTik["MikroTik Router"]
NAT["NAT: 53 → 5355"]
AGH1["AdGuard Home<br/>172.17.0.5:5355<br/>PRIMARY"]
end
subgraph Unraid["Unraid Server"]
AGH2["AdGuard Home<br/>192.168.31.4:53<br/>SECONDARY"]
end
subgraph Upstream["Upstream DNS"]
Q9["Quad9 DoH<br/>dns10.quad9.net"]
end
subgraph Clients["LAN Clients"]
C1["IPhone Dancho"]
C2["IPhone Kimi"]
C3["Laptop Dari"]
C4["Laptop Kimi"]
C5["PC Dancho"]
C6["ROG Ally Teodor"]
end
External --> MikroTik
Clients -->|"Primary"| NAT
NAT --> AGH1
Clients -.->|"Failover"| AGH2
AGH1 --> Q9
AGH2 --> Q9
```
---
## Configured Clients (Both AdGuard Instances)
| Client | MAC Address | Tags |
|--------|-------------|------|
| IPhone (Dancho) | f2:b8:14:61:c8:27 | - |
| IPhone (Kimi) | 2a:2b:ba:86:d4:af | user_child |
| Laptop (Dari) | 34:f6:4b:b3:14:83 | user_child |
| Laptop (Kimi) | 90:91:64:70:0d:86 | user_child |
| PC (Dancho) | 70:85:c2:75:64:e5 | - |
| ROG Ally (Teodor) | cc:5e:f8:d3:37:d3 | user_child |
---
## Custom Filtering Rules
```
||dv-eu-prod.sentinelone.net^
||euce1-soc360.sentinelone.net^
||ampeco.jamfcloud.com^
||*.jamfcloud.com^
```
---
## NAT/Port Forwarding (MikroTik)
| Rule | Protocol | Port | Destination | Purpose |
|------|----------|------|-------------|---------|
| HTTP | TCP | 80 | 192.168.31.2:8001 | Traefik |
| HTTPS | TCP | 443 | 192.168.31.2:44301 | Traefik |
| DNS UDP | UDP | 53→5355 | 172.17.0.5 | AdGuard Home |
| DNS TCP | TCP | 53→5355 | 172.17.0.5 | AdGuard Home |
| DoT | TCP | 853 | 172.17.0.5 | DNS over TLS |
| DoQ | UDP | 8853 | 172.17.0.5 | DNS over QUIC |
| Plex | TCP | 32400 | 192.168.31.2 | Plex Media |
| RustDesk | TCP/UDP | 21115-21119 | 192.168.31.2 | RustDesk |
---
## Reference Documents
- [Phase 1: DNS Portability](./01-PHASE1-DNS-PORTABILITY.md)
- [Phase 7: Gitea GitOps](./08-PHASE7-GITEA-GITOPS.md)
- [Changelog](./06-CHANGELOG.md)
---
## Network Discovery & Management
### Slurp'it Stack
| Container | IP | Purpose |
|-----------|-----|---------|
| slurpit-portal | 172.18.0.129 | Web UI (slurpit.xtrm-lab.org) |
| slurpit-scanner | 172.25.0.5 | SNMP network scanner |
| slurpit-scraper | 172.25.0.3 | Device data collector |
| slurpit-warehouse | 172.25.0.4 | Data storage API |
| slurpit-mariadb | 172.25.0.2 | Portal database |
| slurpit-mongodb | 172.25.0.6 | Discovery database |
**Status:** Operational
**Discovered Devices:** 1 (MikroTik Router)
**SNMP Communities:** public, netdisco
**Configuration:**
- SNMP v2c credentials configured
- Scan target: 192.168.31.0/24
- NetBox integration: Enabled (plugin_online: 1)
**Pending Tasks:**
- Add SSH credentials to Vault for device scraping
- Troubleshoot SNMP discovery of switch and AP
### NetDisco
| Container | IP | Purpose |
|-----------|-----|---------|
| netdisco-web | 172.18.0.41 | Web UI (netdisco.xtrm-lab.org) |
| netdisco-backend | 172.18.0.42 | SNMP poller |
### NetBox (IPAM/DCIM)
| Container | IP | Purpose |
|-----------|-----|---------|
| netbox | 172.24.0.5 | Web UI (netbox.xtrm-lab.org) |
| netbox-postgres | 172.24.0.4 | Database |
| netbox-redis | 172.24.0.2 | Cache |
| netbox-worker | 172.24.0.6 | Background tasks |
**NetBox Slurp'it Plugin:** Installed and configured
---
## Agent Service Account
A dedicated service account `agent` was created for automated tools:
| Device | Username | Auth Method | Port |
|--------|----------|-------------|------|
| Unraid | agent | SSH Key + Password | 422 |
| MikroTik Router | agent | SSH Key | 2222 |
| MikroTik AP | agent | Password | 2222 |
| MikroTik Switch | N/A | No SSH (SwOS) | - |
**Credentials:** See docs/AGENT-CREDENTIALS.md (gitignored, local only)
Reference in New Issue View Git Blame Copy Permalink