jackos1998
87cdfdbd97
portcullis is wired over 10G to fergal, which uplinks to jim's spare SFP+ port. That uplink is untagged VLAN 1, so hi is carried tagged on a lan-hi VLAN interface: a static assignment at 192.168.68.41 / ::6:1, resolving through the router VIPs like any other hi client. Its gateway route outranks the DHCP default, making 10G the preferred path while the 2.5G bootstrap stays as a fallback. Deploy now targets that address. The hi MTU goes on the .network rather than the .link, since a .link is only applied at udev device-add -- with it there, et10g-0 stays at 1500 across a switch and lan-hi cannot take 9000. jim's sfp-spare was tagged into hi and lo out of band to match. fergal turns out to belong with portcullis rather than to the home fabric -- it goes to Nikhef when the box does -- so its documentation moves to the colony site, leaving home/switches.md a short section on what it borrows from that fabric. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Home site
The home network (domain h.nul.ie): a redundant pair of routers in front of a VM host, an
NVMe-oF storage target, an IoT container host, and a workstation. The two routers — river (a VM)
and stream (a physical box) — are built from one shared
routing-common definition as an active/backup VRRP
pair, and everything clients touch (gateway, DNS) is a floating VIP that follows the master.
- Source:
nixos/boxes/home/
Boxes
| Box | Role | Host |
|---|---|---|
palace |
VM host | physical |
river |
Primary router (VRRP pair with stream) |
VM on palace |
stream |
Secondary router (VRRP pair with river) |
physical |
cellar |
NVMe-oF / SPDK storage target | VM on palace |
sfh |
NixOS container host (containers on its page) | VM on palace |
castle |
Workstation / gaming desktop | physical |
Router VIPs
Clients use per-VLAN floating VIPs as their gateway and DNS server; keepalived moves them between
river and stream. The addresses, DHCP/RA behavior and failover mechanics are documented once in
Router VIPs and Router HA.
Networks
The site separates core management, high-MTU trusted traffic, general trusted traffic, untrusted
clients and the two WAN paths. VLAN IDs, prefixes, MTUs and router addressing live in the canonical
home section of networking.md.
Switch fabric
The boxes hang off three hand-configured switches — jim and dave (MikroTik, RouterOS) and
brian (Ubiquiti, UniFi) — which are not managed by this flake. The physical topology, VLAN
map, the Digiweb WAN path (trunked VLAN 10 + PVID 140 at the ONT edge), and the multi-ONT plan are
documented in switches.md.
Wireless APs
The Wi-Fi APs — vibe (MikroTik cAP ax) and wave (Cudy AX3000 on OpenWrt) — are dumb APs, also
not managed by this flake. The shared VLAN-trunk design, SSIDs, per-AP management addressing,
and the OpenWrt flash/config for wave are in aps.md.
5G WWAN
A Quectel RM500U-EA USB modem with a GoMo SIM is being evaluated as a replacement for stream's
Virgin Media WAN. It is bench-tested only and not yet referenced by the flake; the module settings
it needs, the APN gotcha and the CGNAT consequences are in wwan.md.