jackos1998
d51f2d62b6
Add a top-level README mapping the boxes and a full docs/ tree: topic pages (architecture, networking, deployment), per-site box pages for colony and home with containers nested under their hosts, remote and mobile boxes, the installer, and the home switch fabric reference (folded in from home-switches.md, with AGENTS.md and code comments retargeted to its new home). Box pages carry marked assignment tables that CI regenerates from nixos.allAssignments. AGENTS.md points at the new docs and keeps its terse agent version of the mechanics, referring to the topic pages for depth.
2.8 KiB
2.8 KiB
britway
A Vultr VPS in London (lon1) acting as the network edge node: the self-hosted Tailscale
control plane, a tailnet exit node, and the BGP speaker for AS211024.
- Source:
nixos/boxes/britway/ - Host: VPS at Vultr (London,
lon1)
Role
- Headscale — the self-hosted Tailscale control plane at
hs.nul.ie; every other box'stailscaledlogs in here (--login-server=https://hs.nul.ie). Google OIDC for auth, SQLite state, MagicDNS underts.nul.ie, and split DNS pointing the colony/home domains at their internal resolvers. - Tailscale exit node — advertises
--advertise-exit-nodeplus routes to the home v4/v6 prefixes; tailnet traffic is SNATed outveth0(v4 to the Vultr public IP, v6 to theas211024mesh address). - BGP edge —
bird2speaks BGP as AS211024 to Vultr transit (AS64515, separate v4/v6 sessions authenticated with a password frombritway/bgp-password-vultr.conf) and exports everything to abgp.toolsmonitoring session. It originates the internal, colony and home v6 prefixes (2a0e:97c0:4df::/48,2a0e:97c0:4d2::/48,2a0e:97c0:4d0::/48). - nginx — reverse proxy fronting headscale (
hs.nul.ie→localhostheadscale port), with a wildcard ACME cert fornul.ieissued via Cloudflare DNS.
Network assignments
| Name | Assignment | IPv4 | IPv6 | Domain | Notes |
|---|---|---|---|---|---|
| britway | as211024 | 10.100.50.5/24 |
2a0e:97c0:4df:0:2::1/64 |
— | |
| britway | vultr | 45.76.141.188/23 gw 45.76.140.1 |
2001:19f0:7402:128b::1/64 |
lon1.int.nul.ie |
Networking
- Two assignments:
vultron the provider interfaceveth0(renamed by MAC), andas211024on the l2mesh VXLAN interface (my.vpns.l2, a mesh shared withestuaryand the home routersriver/stream). - Static routes steer colony/home v4 traffic over the
as211024mesh. A separatets-extrarouting table (1337) with a policy rule ontailscale0ingress sends Tailscale-sourced v6 traffic for colony viaestuary, while the box's own v6 uses WAN. - The firewall trusts the
as211024prefixes (lib.my.c.as211024.nftTrust) andtailscale0;iperf3runs with an open port for bandwidth testing.
Notable config files
nixos/boxes/britway/default.nix— system, assignments, networkd, firewall/SNAT.nixos/boxes/britway/bgp.nix—bird2config (Vultr transit,bgp.tools).nixos/boxes/britway/nginx.nix— nginx vhosts + ACME.nixos/boxes/britway/tailscale.nix— headscale + the tailnet node itself.