Skip to content

Commit caae47c

Browse files
tamarindmonkeytamarindmonkey
authored
Create index.md
1 parent c682c7e commit caae47c

1 file changed

Lines changed: 152 additions & 0 deletions

File tree

‎src/content/docs/index.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
title: LAN/Services
3+
template: splash
4+
---
5+
6+
# lan
7+
Home network and self-hosted service documentation
8+
9+
## High-Level Architecture
10+
11+
The network utilizes a **Split-Horizon DNS** strategy hosted on a virtualized microserver. This architecture ensures high-speed, direct local access for LAN clients while securely routing external traffic via a Cloudflare Application Tunnel, effectively bypassing ISP inbound port blocks (80/443) and throttling on specific ports (32400).
12+
13+
- **WAN Ingress:** Cloudflare Tunnel (No inbound ports open).
14+
- **LAN Routing:** Direct IP resolution via local authoritative DNS.
15+
- **Virtualization:** Proxmox VE
16+
- Privileged LXC for OpenWRT.
17+
- VM (using all 4 A76 cores) for a docker host to run a monolithic compose with all services.
18+
19+
## Hardware Inventory
20+
21+
### Core Compute & Routing
22+
23+
- **Host Device:** FriendlyARM NanoPC T6
24+
- **SoC:** Rockchip RK3588
25+
- **Interfaces:** 2x 2.5Gbps RJ45, NVMe, m.2 WiFi/BT slots
26+
- Internal Storage
27+
- 256GB eMMC (/dev/mmcblk0)
28+
- 256GB Samsung PM961 - PCIe 3.0 x4 m.2 NVME (/dev/nvme0)
29+
- Exernal/Attached Storage
30+
- USB 3.0 12TB WD MyBook (/dev/sda1)
31+
- **OS:** Debian 12 with Pxvirt (Proxmox) 8.4.10
32+
- **Modem:** Motorola MB8611 (DOCSIS 3.1)
33+
34+
### Network Switching Fabric
35+
36+
- **Switch 1 (Living Room):** Mokerlink 8-Port 2.5Gbps Unmanaged (Model: 2G080210GS) with 2x 10Gbps SFP+ Uplinks.
37+
- **Switch 2 (Entertainment Center):** Mokerlink 16-Port 2.5Gbps Unmanaged (Model: 2G16210GS) with 2x 10Gbps SFP+ Uplinks.
38+
- **Switch 3 (Office):** Mokerlink 8-Port 2.5Gbps Unmanaged (Model: 2G080210GS) with 2x 10Gbps SFP+ Uplinks.
39+
- **Switch 4 (Attic):** Mokerlink 5-Port 2.5Gbps Unmanaged (Model: 2G050210GS) with 2x 10Gbps SFP+ Uplinks.
40+
- **Wireless APs:** 2x Ubiquiti Unifi 7 Pro
41+
- Living Room
42+
- Office
43+
44+
### Smart Home
45+
46+
- **Controller:** Home Assistant Blue (Odroid N2+)
47+
- **Zigbee Radio:** Sonoff ZBDongle-E (Plus V2)
48+
- **Z-Wave Radio:** Zooz S2 Stick 700 (ZST10 700)
49+
50+
## Virtualization Topology
51+
52+
The NanoPC-T6 (`pmx-t6`) serves as the hypervisor host using two physical interfaces bridged to virtual networks.
53+
54+
| ID | Hostname | OS | Role | Network Configuration |
55+
| --- | --- | --- | --- | --- |
56+
| **Metal** | `pmx-t6` | Debian 12 | **Hypervisor** | `eth0` -> `vmbr0` (WAN Bridge)`eth1` -> `vmbr1` (LAN Bridge) |
57+
| **100** | `openwrt` | OpenWRT 24.10 | **Router / Gateway** | **Privileged LXC** `eth0` (WAN) mapped to `vmbr0` `eth1` (LAN) mapped to `vmbr1` **IP:** `192.168.1.1` |
58+
| **101** | `ubuntu-docker` | Ubuntu 24.04.3 | **Application Host** | **VM** `eth0` mapped to `vmbr1`**IP:** `192.168.1.3` |
59+
60+
## Network Topology & Interconnects
61+
62+
### WAN/ISP Constraints
63+
64+
- **Restrictions:** Inbound ports 21, 80, 143, 443 blocked; Port 32400 throttled.
65+
- **Connection:** Cable Modem -> NanoPC-T6 `eth0` (Passthrough to OpenWRT via `vmbr0`).
66+
67+
### LAN Backbone (2.5G / 10G)
68+
69+
1. **Router Downlink:** NanoPC-T6 `eth1` -> Primary Switch `Port 1` (2.5Gbps).
70+
2. **Switch Interconnects:**
71+
- **Switch 1 (Living Room)** `Port 2` **↔ Switch 2 (Entertainment Center)** `Port 1` (CAT6)
72+
- **Switch 1 (Living Room)** `SFP 1` **↔** **Switch 3 (Office)** `SFP 1` (LC/LC OM4).
73+
- **Switch 1 (Living Room)** `SFP 2` **↔** **Switch 4 (Attic)** `SFP 1` (LC/LC OM4).
74+
75+
### Port Allocations
76+
77+
- **Switch 1:** Uplink, HA Blue, Interconnects.
78+
- **Switch 2:** Entertainment Consoles (Xbox Series X, PS5 Pro, Nintendo Switch, etc.).
79+
- **Switch 3:** Workstations (Mac Mini, Desktops), Lab Equipment (Siglent PSU/Scope).
80+
- **Switch 4:** Cameras (2x Reolink Duo 3v), APs.
81+
82+
## DNS & Routing Architecture
83+
84+
### Split-Horizon Strategy
85+
86+
To prevent hairpin NAT issues and ensure valid SSL termination locally, specific DNS records allow local clients to resolve services directly while external clients use the Cloudflare Tunnel.
87+
88+
### Internal DNS (LAN)
89+
90+
- **Primary:** Pi-hole (Docker on `192.168.1.3`)
91+
- **Configuration:** Both resolvers enforce the local IP for the domain and strip HTTPS/ECH records to prevent SSL handshake failures with Cloudflare keys.
92+
- **Pi-hole Env:** `FTLCONF_misc_dnsmasq_lines="address=/[FQDN]/192.168.1.3;server=/[FQDN]/"`
93+
- **OpenWRT Config:** `list address '/[FQDN]/192.168.1.3'`, `list server '/[FQDN]/'`
94+
95+
### External DNS (Cloudflare)
96+
97+
- **Record:** `[FQDN]` (CNAME) → `[Tunnel UUID].cfargotunnel.com`.
98+
- *Note: Cannot use A record for a tunnel, must be IPv4.*
99+
- **Record:** `*.[FQDN]` (CNAME) → `[Tunnel UUID].cfargotunnel.com`.
100+
- **Record:** `plex.[FQDN]` (A) → `Public IPv4 address of Oracle Cloud Infra VM` (Tailscale tunnel endpoint and Traefik reverse proxy).
101+
- **Proxy Status:** Proxied (Orange Cloud).
102+
103+
## Service Implementation (Docker on `ubuntu-docker`)
104+
105+
### Network Stack
106+
107+
- **Traefik:** Reverse Proxy & Ingress Controller.
108+
- **Network:** `proxy` bridge (`172.20.0.0/16`).
109+
- **SSL:** Wildcard `.[FQDN]` via Let’s Encrypt DNS Challenge.
110+
- **Cloudflared:** Tunnel Connector.
111+
- **Route:** `.[FQDN]` -> `https://traefik:443` (No TLS Verify).
112+
- **Pi-hole:** Network-wide Ad-blocking & DNS.
113+
- **Network:** Fixed IP `172.20.0.10` on `proxy` net; Host ports `53:53` mapped.
114+
115+
### Media Stack (Plex)
116+
117+
- **Container Network:** `macvlan` (Essential for DLNA/L2 Discovery) and `proxy` (for other services to be able to access by docker internal DNS).
118+
- **ISP Bypass:**
119+
- **Remote Access:** Disabled in GUI to prevent UPnP/Port 32400 mapping.
120+
- **Custom Server URL:** Set to `https://plex.[FQDN]:443`.
121+
- **Routing:** Traefik labels on `ubuntu-docker` configured to proxy traffic to `http://192.168.1.5:32400`.
122+
- **Tunnel:** Tailscale VPN connection between 192.168.1.5 and public IPv4 of OCI VM (endpoint).
123+
- Restrictive to exposing **only** one IP using `TS_EXTRA_ARGS=--advertise-routes=192.168.1.5/32 --accept-routes`
124+
- External Traefik reverse proxy on OCI VM translates `http://192.168.1.5:32400` to `https://[OCI VM Public IPv4]:443/`
125+
- **DNS A Record:** `plex.[FQDN]` handles resolution to `[OCI VM Public IPv4]`
126+
- **Result:** External traffic routes via `https://plex.[FQDN]` (Tunnel), bypassing ISP throttling. Internal traffic routes to 192.168.1.5. Avoids breaking ToS of Cloudflare Application Tunnel (free tier).
127+
128+
### Authentication
129+
130+
**Authentik:** Identity Provider (IdP) and SSO.
131+
132+
- Rule in place to check for Cloudflare headers in request. If present, client is external and must authenticate.
133+
- No authentication required from LAN clients.
134+
135+
### Docker compose
136+
137+
Monolithic docker compose for all services.
138+
- See [docker-compose.yaml](docker-compose.yaml)
139+
140+
## Client-Side Specifics
141+
142+
### Browser VPN Extensions
143+
144+
- **Configuration:** “Split Tunneling” or “Bypass List” must be configured in the extension to avoid external resolution via Cloudflare Application Tunnel.
145+
- **Bypass Rule 1:** `192.168.1.0/24` (Local Subnet)
146+
- **Bypass Rule 2:** `.[FQDN]` (Local Domain)
147+
148+
### Home Assistant
149+
150+
- **Connectivity:** Hardwired via Primary Switch `Port 3`.
151+
- **Zigbee:** Sonoff ZBDongle-E (Plus V2) connected via USB extension.
152+
- **Z-Wave:** Zooz S2 Stick 700 (ZST10 700) connected via USB extension.

0 commit comments

Comments
 (0)