dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
Files
314be7620fa4c09411ac0f620d368efc8a398e65
nixfiles/docs/sites/home/sfh/README.md
T
jackos1998 a04d11423a nixos/home: Separate router storage and uplinks 
Give `river` a dedicated RDMA VF and two RSTP trunk attachments.
Keep client services on the router VIPs and carry Digiweb VLANs
over both switch paths.

Set VF trust, multicast reception, bridge MAC and ARP behavior for
local switching. Wait for Kea interface readiness and apply RSTP
costs through `mstpd` despite port-registration and rename races.

Load `palace`'s RAID module in the initrd. Record RouterOS and
RouterBOOT upgrades and validate port, carrier and switch outages.

Document the deployed architecture, interface handoffs and recovery
procedures. Add physical socket maps, NIC capacities and cable
connections alongside the logical topology and failover checks.
2026-11-15 16:23:06 +00:00

3.4 KiB
Raw Blame History

sfh

"Shill from home" — the NixOS container host for the home site. A VM on palace that netboots from river and runs its root off NVMe-oF from cellar.

Role

  • Runs the home NixOS containers via my.containers.instances (systemd-nspawn); each container is its own nixos.systems.* entry rendered through my.asContainer.
  • Netboot client (my.netboot.client.enable): the VM has no boot disk — its netboot NIC on palace's lan-lo bridge is matched by a kea client-class on river and iPXE-boots from boot.h.nul.ie.
  • Root on NVMe-oF: my.nvme.boot connects to nqn.2016-06.io.spdk:sfh (cellar, RDMA) from the initrd (lan-hi up + roceBootModules); /nix and /persist are LVs on that volume. KeepConfiguration=static on lan-hi protects the NVMe-oF address from networkd reconfigures.
  • Frigate footage disk: palace passes the hdds/frigate LVM LV through as a virtio disk; sfh mounts it at /mnt/frigate (by label) and bind-mounts it into the hass container at /var/lib/frigate.
  • USB: two host ports are passed to the VM (qemu flags) for the Zigbee coordinator and webcam used by hass; the nspawn unit gets DeviceAllow for char-ttyUSB and char-video4linux.

Network assignments

See the consolidated network assignments table (this box: sfh).

Networking

Interface palace attachment Purpose
lan-hi sfh-hi SR-IOV VF 2 Box's hi assignment and NVMe/RDMA root path; MTU 9000
ctrs-hi sfh-ctrs SR-IOV VF 3 L3-less MACVLAN parent for each container's host0; MTU 9000
ctrs-core Virtio via sfh-core-tap, lan-core and host-jim L3-less MACVLAN parent for UniFi's lan-core management attachment
ctrs-lo Virtio via sfh-lo-tap, lan-lo and host-jim L3-less MACVLAN parent for hass's lan-lo and the VM's PXE path

The two VFs separate the box's RDMA root traffic from container hi traffic; they do not provide redundant switch paths. The Virtio attachments reach the jim-facing palace host bridges. Container host0 names are intentionally unchanged.

The per-container MACVLAN wiring lives in systemd.nspawn.*.networkConfig in sfh/default.nix. The palace interface topology traces these interfaces back through the VM handoffs to the physical switch connections.

Containers

Container Role
hass Home Assistant + Frigate + MQTT
unifi UniFi controller

Notable config files

Reference in New Issue View Git Blame Copy Permalink