jackos1998
08605ab422
Place physical hardware inventories and VPS resource allocations near the top of each box page, while leaving broader platform details in their topical sections.
55 lines
2.8 KiB
Markdown
55 lines
2.8 KiB
Markdown
# britway
|
|
|
|
A Vultr VPS in London (`lon1`) acting as the network edge node: the self-hosted Tailscale
|
|
control plane, a tailnet exit node, and the BGP speaker for AS211024.
|
|
|
|
- **Source:** [`nixos/boxes/britway/`](../../nixos/boxes/britway)
|
|
- **Host:** VPS at Vultr (London, `lon1`)
|
|
- **nixpkgs:** `mine`
|
|
|
|
## Platform
|
|
|
|
| Component | Allocation |
|
|
|---|---|
|
|
| Virtualisation | Vultr VC2 virtual guest on a QEMU-compatible platform |
|
|
| Compute | 2 vCPUs and 2 GiB RAM |
|
|
| Storage | 65 GiB virtio disk with separate ext4 filesystems for `/boot`, `/nix` and `/persist`; root is tmpfs |
|
|
|
|
## Role
|
|
|
|
- **Headscale** — the self-hosted Tailscale control plane at `hs.nul.ie`; every other box's
|
|
`tailscaled` logs in here (`--login-server=https://hs.nul.ie`). Google OIDC for auth,
|
|
SQLite state, MagicDNS under `ts.nul.ie`, and split DNS pointing the colony/home domains
|
|
at their internal resolvers.
|
|
- **Tailscale exit node** — advertises `--advertise-exit-node` plus routes to the home v4/v6
|
|
prefixes; tailnet traffic is SNATed out `veth0` (v4 to the Vultr public IP, v6 to the
|
|
`as211024` mesh address).
|
|
- **BGP edge** — `bird2` speaks BGP as AS211024 to Vultr transit (AS64515, separate v4/v6
|
|
sessions authenticated with a password from `britway/bgp-password-vultr.conf`) and exports
|
|
everything to a `bgp.tools` monitoring session. It originates the internal, colony and home
|
|
IPv6 prefixes documented in [networking](../networking.md#domains).
|
|
- **nginx** — reverse proxy fronting headscale (`hs.nul.ie` → `localhost` headscale port),
|
|
with a wildcard ACME cert for `nul.ie` issued via Cloudflare DNS.
|
|
|
|
## Network assignments
|
|
|
|
See the consolidated [network assignments](../networking.md#box-assignments) table (this box: `britway`).
|
|
|
|
## Networking
|
|
|
|
- Two assignments: `vultr` on the provider interface `veth0` (renamed by MAC), and `as211024`
|
|
on the `l2mesh` VXLAN interface (`my.vpns.l2`) — member of the shared mesh (see
|
|
[The AS211024 L2 mesh](../networking.md#the-as211024-l2-mesh)).
|
|
- Static routes steer colony/home v4 traffic over the `as211024` mesh. A separate `ts-extra`
|
|
routing table with a policy rule on `tailscale0` ingress sends Tailscale-sourced v6
|
|
traffic for colony via `estuary`, while the box's own v6 uses WAN.
|
|
- The firewall trusts the `as211024` prefixes (`lib.my.c.as211024.nftTrust`) and
|
|
`tailscale0`; `iperf3` runs with an open port for bandwidth testing.
|
|
|
|
## Notable config files
|
|
|
|
- [`nixos/boxes/britway/default.nix`](../../nixos/boxes/britway/default.nix) — system, assignments, networkd, firewall/SNAT.
|
|
- [`nixos/boxes/britway/bgp.nix`](../../nixos/boxes/britway/bgp.nix) — `bird2` config (Vultr transit, `bgp.tools`).
|
|
- [`nixos/boxes/britway/nginx.nix`](../../nixos/boxes/britway/nginx.nix) — nginx vhosts + ACME.
|
|
- [`nixos/boxes/britway/tailscale.nix`](../../nixos/boxes/britway/tailscale.nix) — headscale + the tailnet node itself.
|