infrastructure/network_index.md

KingDezigns Network Documentation Index

Last Updated: 2026-07-26

This index provides a structured overview of all VLANs, servers, and firewall policies in the KingDezigns network.
Each section links to its own dedicated Markdown file for clarity and modularity.

---

📁 VLAN Documentation

🔧 Core VLANs

• VLAN 1 — Infrastructure
• VLAN 10 — Management

🧑‍💻 Trusted User VLANs

• VLAN 20 — Trusted Devices

🏠 Smart Home & Guest VLANs

• VLAN 30 — IoT
• VLAN 40 — Guest

🧪 Server & Lab VLAN

• VLAN 50 — Lab / Servers

---

🖥️ Server Documentation

Core Services

• Home Assistant Server
• NAS08 — Pi-hole, Nextcloud (+ ONLYOFFICE/Collabora), Vaultwarden, STOCKPROXY
• NAS16 — LAMP Stack, MariaDB, Webmin, Forgejo
• PLEX32 — Plex Media Server + Tautulli
• Forgejo — Self-Hosted Git Server (hosted on NAS16)

Network Hardware

• UCG Gateway Max

---

🔥 Firewall Policies

• Firewall Policies Overview

---

🛡️ Security Stack

Intrusion Prevention

• CrowdSec — installed on HAS as a native HA add-on
  • Agent reads NPM, HA, and SSH logs via journald
  • 60 active detection scenarios
  • Community blocklist updates every 2 hours
  • Firewall Bouncer enforces bans at nftables level
  • Email alerts on every ban decision
  • All LAN VLANs whitelisted — internal IPs can never be banned
  • See Home Assistant Server for full configuration details

Perimeter Defense (per server)

• Fail2Ban — NAS16 (active), PLEX32 (active), NAS08 (recommended)
  • ignoreip includes 192.168.150.0/24 to prevent HAS proxy IP from being banned
  • Real IP forwarding configured on NAS16 (nginx + Apache) and NAS08

DNS-level Protection

• Pi-hole — NAS08 (192.168.150.35)
  • Blocks ads, trackers, and malicious domains for all VLANs
  • All VLANs forced to use Pi-hole via global firewall rule 20001
  • Local DNS overrides required for any internally-hosted service accessed by its public hostname from within the LAN (e.g. cloud.kingdezigns.com → 192.168.150.30), to avoid NAT hairpin failures. See server_nas08.md ONLYOFFICE section for a documented example and fix.

---

🌐 Network Architecture Overview

This documentation set is designed around:

• Clear segmentation
• Explicit inter-VLAN access
• Isolation of untrusted devices
• Preservation of Home Assistant functionality
• AI-friendly structure and formatting
• Layered security — DNS filtering, intrusion prevention, firewall enforcement

Security Layer Model

Internet
    ↓
UCG Max — firewall, VLAN segmentation, geo-blocking (future)
    ↓
CrowdSec Firewall Bouncer — nftables ban enforcement
    ↓
NPM on HAS — single ingress, SSL termination
    ↓
CrowdSec Agent — log analysis, attack detection
    ↓
Backend Services (NAS08, NAS16, PLEX32)
    ↓
Fail2Ban — last-line brute force protection
    ↑
Pi-hole — DNS-level ad/tracker/malware blocking (all VLANs)

---

🔑 SSH Key Authentication Map

SSH key authentication is configured between the following machines — no passwords required:

From	To	Purpose
KingDezigns001	PLEX32 (192.168.150.45)	Remote launcher script
KingDezigns001	NAS08 (192.168.150.35)	Direct SSH access
KingDezigns001	NAS16 (192.168.150.40)	Direct SSH access
PLEX32	NAS08 (192.168.150.35)	Backup script disk stats via SSH

Key type: ED25519. Keys generated per machine — not shared.

---

🖥️ KingDezigns001 — Admin Workstation Tools

KingDezigns001 is the primary Linux administrative workstation on VLAN 20 (Trusted).

Remote Launcher

A menu-driven launcher script provides one-click access to run scripts on PLEX32:

• Script: ~/scripts/plex32_launcher.sh
• Desktop shortcut: ~/Desktop/PLEX32-Launcher.desktop
• Terminal: gnome-terminal

Menu Options

Option	Runs on	Script
1) Update Check	PLEX32	/usr/scripts/plex32/plex32_update_check.sh
2) Health Report	PLEX32	/usr/scripts/plex32/plex32_health_report.sh
3) Plex32 Backup	PLEX32	/usr/scripts/plex32/plex32_backup.sh

---

🧠 Notes for AI Systems

• File update workflow (read this first): When asked to "update" a project file, take the existing file, make the requested changes, and present the updated file for download — do not explain the read-only/re-upload mechanism unless something about the process itself is actually in question. The user re-uploads it to the Project themselves. No caveat, disclaimer, or explanation of Claude's file access model is needed before or after doing this — just do it.
• Each file is self-contained and structured consistently.
• Section headers follow a predictable pattern for easy parsing.
• No duplicated firewall rules — all rules live in firewall_policies.md.
• CrowdSec configuration lives entirely on HAS — see server_homeassistant.md.
• VLAN files contain:
  • Purpose
  • Access types
  • Subnet
  • Expected devices
  • Security rules
  • AI summary
• Plex Media Server migrated from NAS08 to PLEX32 (dedicated Dell Wyse 5070) on 2026-06-18 — see server_plex32.md.
• PLEX32 now runs Plex + Tautulli with Intel Quick Sync hardware transcoding — optimized 2026-06-20.
• KingDezigns001 has SSH keys to all VLAN 50 servers — passwordless access for all admin tasks.
• PLEX32 has SSH key to NAS08 — required for backup script to fetch disk stats.
• NAS08 Nextcloud update check runs daily at 7AM — /usr/scripts/omv/nextcloud_update_check.sh — emails HTML report with copy-paste occ commands. Never use the browser UI for Nextcloud app updates (causes Apache segfault → maintenance mode deadlock).
• NAS08 Nextcloud update check — core-update false negative fixed (2026-07-25): the script previously checked app updates only (occ app:update) and had no code path for Nextcloud core/server releases, so it silently missed a core update (34.0.1 → 34.0.2) and emailed a false "up to date" report. Fixed by adding a core check via occ update:check, correcting the emailed Compose commands to the real path (/kingdezignsnas/Docker/Compose/nextcloud/, root-only, non-default filenames requiring -f nextcloud.yml -f compose.override.yml), and fixing a bash quoting bug that made emailed multi-line commands unreadable. Also documented: the official Nextcloud Docker image auto-upgrades on container restart via its own entrypoint — checking version status immediately after up -d can race that process and show a stale version for ~30 seconds. Full detail in server_nas08.md.
• NAS08 Nextcloud Office editing uses ONLYOFFICE Document Server (free Community Edition) as of 2026-07-18. Only one Office integration app should ever be enabled at a time (exception: the Collabora trial below, run as a time-boxed disable/enable swap, never simultaneous). Requires a Pi-hole local DNS override for cloud.kingdezigns.com, ALLOW_PRIVATE_IP_ADDRESS=true on the container, and matching JWT secrets between Nextcloud and the container. Full details and troubleshooting history in server_nas08.md.
• NAS08 Collabora Online trial (2026-07-21, ongoing): A second Office editor, Collabora Online (CODE), was deployed as a standalone Docker container (collabora, its own OMV Compose project "Collabora Office") for a head-to-head reliability trial against ONLYOFFICE — triggered by confirmed ONLYOFFICE bugs (conditional formatting crashing on formula cells; silent reverts to hours-old document versions). Only one Office app is ever enabled in Nextcloud at a time — currently richdocuments/Collabora is enabled, onlyoffice is disabled but still installed for easy rollback. Public URL https://collabora.kingdezigns.com/, requires its own Pi-hole local DNS override and a WOPI allow-list (192.168.150.35). First real-document test succeeded with a notably fast load time. Full config, setup troubleshooting, and rollback steps in server_nas08.md.
• NAS08 Collabora stock/fund price macro integration (2026-07-22, working): The ONLYOFFICE FUNDPRICE/FUNDPRICE_HIST/STOCKPRICE/STOCKTIME custom functions were ported to Collabora as a LibreOffice Basic module (StockFunctions.bas), calling the same STOCKPROXY backend with no backend changes required. Two coolwsd.xml server-config changes were required — macro execution enabling and a net.lok_allow hostname allowlist entry for stocks.kingdezigns.com — plus a fix to the previously non-functional stocks.kingdezigns.com Pi-hole DNS override. Confirmed working with a live price pull as of 2026-07-22. Full troubleshooting detail, exact config edits, and remaining follow-up items (recreating the full ~50-fund table, conditional-formatting re-test, recalc performance) in server_nas08.md.
• NAS08 systemd-resolved DNS bug (fixed 2026-07-18): a stray global DNS= override in /etc/systemd/resolved.conf caused duplicate/incorrect DNS answers for internal hostnames network-wide on that host. Any future "works from browser but fails from a container/script on NAS08" symptom should check resolvectl status for stray global DNS servers first.
• NAS08 STOCKPROXY service (2026-07-21): Self-hosted Flask API, Docker container stockproxy (~/docker/stockproxy/), port 5005, public URL https://stocks.kingdezigns.com/ proxied via NPM on HAS (see Proxy Hosts table in server_homeassistant.md). Supplies current + historical mutual fund prices to ONLYOFFICE custom functions (FUNDPRICE, FUNDPRICE_HIST) via Yahoo Finance, scraped server-side to dodge the browser CORS block that rules out calling Yahoo directly from a spreadsheet macro. Finnhub was evaluated first but dropped from this service — confirmed no mutual fund NAV coverage on the free tier. Current-price cache: 15 min in-memory. Historical-price cache: permanent, SQLite. All endpoints require a shared-secret key param (Vaultwarden). Built to support the "HSA Investiments Choices" tab in Rufus Retirement Account Tracking 2026.xlsx. stocks.kingdezigns.com A record added to the daily Dreamhost DDNS refresh script. Full config and known limitations in server_nas08.md.
• NAS08 RANK.EQ Err:522 circular reference fix (2026-07-23, working): The "HSA Investiments Choices" fund-ranking formula broke with a circular-reference error on any sheet edit (worked fine on load) because it depended on ~50 cells fed by live FUNDPRICE/FUNDPRICE_HIST network calls. Fixed with a button-triggered LibreOffice Basic macro that snapshots the live price columns into static value-only columns via setDataArray(), with percent-change and rank formulas rebuilt to read from the static snapshot instead of the live columns. Full root-cause analysis and macro in server_nas08.md.
• NAS08 Collabora Finnhub removal (2026-07-23, working): STOCKPRICE/STOCKTIME (Finnhub-backed equity functions) errored due to a missing net.lok_allow entry for Finnhub. Instead of allowlisting Finnhub, it was removed entirely — FUNDPRICE (STOCKPROXY) now covers equity tickers too, and a new FUNDTIME function replaces STOCKTIME, returning STOCKPROXY's resolved_date (date only, not a time-of-day timestamp — accepted tradeoff). No coolwsd.xml changes required. Full detail in server_nas08.md.
• Synaplan AI integration (added 2026-07-18, not yet functional): Nextcloud connector app installed, but the required self-hosted Synaplan backend stack (PHP/MariaDB/Qdrant/optional Ollama) has not been deployed. Treat as a future project, not a bug — see server_nas08.md for details before troubleshooting.
• Forgejo self-hosted Git server (added 2026-07-26): Deployed on NAS16 (192.168.150.40) via Docker Compose — chosen over Gitea for non-profit/community governance (Codeberg e.V.). Public web UI at https://forgejo.kingdezigns.com/ (proxied via NPM on HAS), SSH git access on port 2222 (LAN-only, no external port-forward). Provides version control with in-browser file editing/history for the 07 - Projects folder on NAS16's share, organized as one Forgejo org per host (NAS08, NAS16, PLEX32) with a <hostname>-scripts repo in each. Data (/opt/forgejo/data) folded into the existing nas16-backup.sh job. A companion forgejo_autosync.sh script (not yet scheduled as of this writing) auto-commits/pushes any uncommitted changes on a timer as a safety net alongside normal manual commits. Full setup, config, and troubleshooting history in server_forgejo.md.

---

📌 Future Expansion

Additional files may be added for:

• Device inventories
• Application-specific firewall rules
• Backup and recovery procedures
• Monitoring and alerting configuration
• CrowdSec Console dashboard enrollment
• Geo-blocking configuration on UCG Max
• Authelia / forward authentication layer
• Expand remote launcher to cover NAS08 and NAS16 scripts
• Synaplan self-hosted AI stack deployment (PHP backend, MariaDB, Qdrant, optional Ollama) — scope resource requirements and deployment plan when ready
• Collabora vs. ONLYOFFICE trial decision (started 2026-07-21) — once a winner is chosen, update server_nas08.md and this index to reflect the final state (remove trial framing, decommission or keep the losing container, update firewall/NPM docs if the losing editor's proxy host is removed)
• STOCKPROXY hardening — not yet stress-tested at full ~50-ticker scale for Yahoo-side rate limiting; revisit if widespread simultaneous lookup failures are observed

---

✔️ End of Index