jackos1998
0aade09d7e
New bare-metal box headed for Nikhef, intended to take over most of estuary's colony edge routing. This is the bootstrap config only: the hardware, the single-NVMe ESP + LVM layout, and enough networking to boot and be reachable. It is being staged at home before it is racked, so it has no colony assignments yet. Every 2.5G port takes DHCP and whichever one is patched in brings the box up; kea registers the DHCP hostname, so the deploy node points at portcullis.dyn.h.nul.ie until there is a real colony FQDN for it. The host key was adopted from the installer session and seeded onto the persist volume before first boot, so my.secrets.key could be set up front -- which makes portcullis a recipient of the user-passwd secret that my.user declares for every box. Documented with a box page, a row in the colony site index, and a note in the colony section of networking.md that the topology is expected to change once portcullis takes over from estuary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.8 KiB
Markdown
37 lines
1.8 KiB
Markdown
# colony
|
|
|
|
The hosted dedicated server in Amsterdam (`ams1`) and the public-facing half of
|
|
the boxes: almost everything reachable from the internet lives here.
|
|
|
|
- **Internal domain:** `ams1.int.nul.ie` (`lib.my.c.colony.domain`)
|
|
- **Public domain:** `nul.ie` — public services are published as `*.nul.ie`
|
|
- **Source:** [`nixos/boxes/colony/`](../../../nixos/boxes/colony)
|
|
|
|
## Networking
|
|
|
|
`colony` separates the host, VMs, `shill` containers and `whale2` OCI workloads onto dedicated
|
|
networks behind [`estuary`](estuary.md), which terminates the public addressing. The canonical
|
|
prefixes and routing overview are in the [`colony` section of networking.md](../../networking.md#colony).
|
|
|
|
## Boxes
|
|
|
|
| Box | Role |
|
|
|---|---|
|
|
| [`colony`](colony.md) | Physical VM host (AMD, KVM, LVM-thin, `borgthin` backups → rsync.net) |
|
|
| [`estuary`](estuary.md) | Edge router: WAN, firewall/NAT, DNS, BGP (AS211024), WireGuard |
|
|
| [`shill`](shill/README.md) | NixOS container host (most applications; per-container pages under `shill/`) |
|
|
| [`whale2`](whale2.md) | podman/OCI game-server host |
|
|
| [`git`](git.md) | Gitea + Gitea Actions runner |
|
|
| [`mail`](mail.md) | Debian VM running mailcow (not NixOS) |
|
|
| [`darts`](darts.md) | Third-party/customer VM (not NixOS) |
|
|
| [`portcullis`](portcullis.md) | Bare-metal edge box for Nikhef; being staged, not yet in service |
|
|
|
|
The applications running on `shill` are listed on its own page — see
|
|
[shill/README.md](shill/README.md#containers).
|
|
|
|
`mail` and `darts` are host-defined VMs whose guest operating systems are managed out of band; their
|
|
pages document only what this repository controls.
|
|
|
|
`portcullis` is new hardware headed for Nikhef that will take over most of `estuary`'s edge routing.
|
|
It is not deployed yet and the resulting topology is still being worked out.
|