rufusking/infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infrastructure/network_index.md
Rufus King d04e5bcc10 describe what changed
2026-07-26 22:12:38 -04:00

198 lines
12 KiB
Markdown
Raw Blame History

# KingDezigns Network Documentation Index
Last Updated: 2026-07-25
This index provides a structured overview of all VLANs, servers, and firewall policies in the KingDezigns network.
Each section links to its own dedicated Markdown file for clarity and modularity.
---
# 📁 VLAN Documentation
## 🔧 Core VLANs
- [VLAN 1 — Infrastructure](vlan1_infrastructure.md)
- [VLAN 10 — Management](vlan10_management.md)
## 🧑‍💻 Trusted User VLANs
- [VLAN 20 — Trusted Devices](vlan20_trusted.md)
## 🏠 Smart Home & Guest VLANs
- [VLAN 30 — IoT](vlan30_iot.md)
- [VLAN 40 — Guest](vlan40_guest.md)
## 🧪 Server & Lab VLAN
- [VLAN 50 — Lab / Servers](vlan50_lab.md)
---
# 🖥️ Server Documentation
## Core Services
- [Home Assistant Server](server_homeassistant.md)
- [NAS08 — Pi-hole, Nextcloud (+ ONLYOFFICE/Collabora), Vaultwarden, STOCKPROXY](server_nas08.md)
- [NAS16 — LAMP Stack, MariaDB, Webmin](server_nas16.md)
- [PLEX32 — Plex Media Server + Tautulli](server_plex32.md)
## Network Hardware
- [UCG Gateway Max](server_ucg.md)
---
# 🔥 Firewall Policies
- [Firewall Policies Overview](firewall_policies.md)
---
# 🛡️ Security Stack
## Intrusion Prevention
- **CrowdSec** — installed on HAS as a native HA add-on
- Agent reads NPM, HA, and SSH logs via journald
- 60 active detection scenarios
- Community blocklist updates every 2 hours
- Firewall Bouncer enforces bans at nftables level
- Email alerts on every ban decision
- All LAN VLANs whitelisted — internal IPs can never be banned
- See [Home Assistant Server](server_homeassistant.md) for full configuration details
## Perimeter Defense (per server)
- **Fail2Ban** — NAS16 (active), PLEX32 (active), NAS08 (recommended)
- `ignoreip` includes `192.168.150.0/24` to prevent HAS proxy IP from being banned
- Real IP forwarding configured on NAS16 (nginx + Apache) and NAS08
## DNS-level Protection
- **Pi-hole** — NAS08 (192.168.150.35)
- Blocks ads, trackers, and malicious domains for all VLANs
- All VLANs forced to use Pi-hole via global firewall rule 20001
- **Local DNS overrides required** for any internally-hosted service accessed by its public hostname from within the LAN (e.g. `cloud.kingdezigns.com` → `192.168.150.30`), to avoid NAT hairpin failures. See `server_nas08.md` ONLYOFFICE section for a documented example and fix.
---
# 🌐 Network Architecture Overview
This documentation set is designed around:
- Clear segmentation
- Explicit inter-VLAN access
- Isolation of untrusted devices
- Preservation of Home Assistant functionality
- AI-friendly structure and formatting
- Layered security — DNS filtering, intrusion prevention, firewall enforcement
## Security Layer Model
```
Internet
↓
UCG Max — firewall, VLAN segmentation, geo-blocking (future)
↓
CrowdSec Firewall Bouncer — nftables ban enforcement
↓
NPM on HAS — single ingress, SSL termination
↓
CrowdSec Agent — log analysis, attack detection
↓
Backend Services (NAS08, NAS16, PLEX32)
↓
Fail2Ban — last-line brute force protection
↑
Pi-hole — DNS-level ad/tracker/malware blocking (all VLANs)
```
---
# 🔑 SSH Key Authentication Map
SSH key authentication is configured between the following machines — no passwords required:
| From | To | Purpose |
|------|----|---------|
| KingDezigns001 | PLEX32 (192.168.150.45) | Remote launcher script |
| KingDezigns001 | NAS08 (192.168.150.35) | Direct SSH access |
| KingDezigns001 | NAS16 (192.168.150.40) | Direct SSH access |
| PLEX32 | NAS08 (192.168.150.35) | Backup script disk stats via SSH |
Key type: ED25519. Keys generated per machine — not shared.
---
# 🖥️ KingDezigns001 — Admin Workstation Tools
KingDezigns001 is the primary Linux administrative workstation on VLAN 20 (Trusted).
## Remote Launcher
A menu-driven launcher script provides one-click access to run scripts on PLEX32:
- **Script:** `~/scripts/plex32_launcher.sh`
- **Desktop shortcut:** `~/Desktop/PLEX32-Launcher.desktop`
- **Terminal:** gnome-terminal
### Menu Options
| Option | Runs on | Script |
|--------|---------|--------|
| 1) Update Check | PLEX32 | `/usr/scripts/plex32/plex32_update_check.sh` |
| 2) Health Report | PLEX32 | `/usr/scripts/plex32/plex32_health_report.sh` |
| 3) Plex32 Backup | PLEX32 | `/usr/scripts/plex32/plex32_backup.sh` |
---
# 🧠 Notes for AI Systems
- Each file is self-contained and structured consistently.
- Section headers follow a predictable pattern for easy parsing.
- No duplicated firewall rules — all rules live in `firewall_policies.md`.
- CrowdSec configuration lives entirely on HAS — see `server_homeassistant.md`.
- VLAN files contain:
- Purpose
- Access types
- Subnet
- Expected devices
- Security rules
- AI summary
- Plex Media Server migrated from NAS08 to PLEX32 (dedicated Dell Wyse 5070) on 2026-06-18 — see `server_plex32.md`.
- PLEX32 now runs Plex + Tautulli with Intel Quick Sync hardware transcoding — optimized 2026-06-20.
- KingDezigns001 has SSH keys to all VLAN 50 servers — passwordless access for all admin tasks.
- PLEX32 has SSH key to NAS08 — required for backup script to fetch disk stats.
- **NAS08 Nextcloud update check** runs daily at 7AM — `/usr/scripts/omv/nextcloud_update_check.sh` — emails HTML report with copy-paste `occ` commands. Never use the browser UI for Nextcloud app updates (causes Apache segfault → maintenance mode deadlock).
- **NAS08 Nextcloud update check — core-update false negative fixed (2026-07-25):** the script previously checked app updates only (`occ app:update`) and had no code path for Nextcloud core/server releases, so it silently missed a core update (34.0.1 → 34.0.2) and emailed a false "up to date" report. Fixed by adding a core check via `occ update:check`, correcting the emailed Compose commands to the real path (`/kingdezignsnas/Docker/Compose/nextcloud/`, root-only, non-default filenames requiring `-f nextcloud.yml -f compose.override.yml`), and fixing a bash quoting bug that made emailed multi-line commands unreadable. Also documented: the official Nextcloud Docker image auto-upgrades on container restart via its own entrypoint — checking version status immediately after `up -d` can race that process and show a stale version for ~30 seconds. Full detail in `server_nas08.md`.
- **NAS08 Nextcloud Office editing** uses ONLYOFFICE Document Server (free Community Edition) as of 2026-07-18. Only one Office integration app should ever be enabled at a time (exception: the Collabora trial below, run as a time-boxed disable/enable swap, never simultaneous). Requires a Pi-hole local DNS override for `cloud.kingdezigns.com`, `ALLOW_PRIVATE_IP_ADDRESS=true` on the container, and matching JWT secrets between Nextcloud and the container. Full details and troubleshooting history in `server_nas08.md`.
- **NAS08 Collabora Online trial (2026-07-21, ongoing):** A second Office editor, Collabora Online (CODE), was deployed as a standalone Docker container (`collabora`, its own OMV Compose project "Collabora Office") for a head-to-head reliability trial against ONLYOFFICE — triggered by confirmed ONLYOFFICE bugs (conditional formatting crashing on formula cells; silent reverts to hours-old document versions). Only one Office app is ever enabled in Nextcloud at a time — currently `richdocuments`/Collabora is enabled, `onlyoffice` is disabled but still installed for easy rollback. Public URL `https://collabora.kingdezigns.com/`, requires its own Pi-hole local DNS override and a WOPI allow-list (`192.168.150.35`). First real-document test succeeded with a notably fast load time. Full config, setup troubleshooting, and rollback steps in `server_nas08.md`.
- **NAS08 Collabora stock/fund price macro integration (2026-07-22, working):** The ONLYOFFICE `FUNDPRICE`/`FUNDPRICE_HIST`/`STOCKPRICE`/`STOCKTIME` custom functions were ported to Collabora as a LibreOffice Basic module (`StockFunctions.bas`), calling the same STOCKPROXY backend with no backend changes required. Two `coolwsd.xml` server-config changes were required — macro execution enabling and a `net.lok_allow` hostname allowlist entry for `stocks.kingdezigns.com` — plus a fix to the previously non-functional `stocks.kingdezigns.com` Pi-hole DNS override. Confirmed working with a live price pull as of 2026-07-22. Full troubleshooting detail, exact config edits, and remaining follow-up items (recreating the full ~50-fund table, conditional-formatting re-test, recalc performance) in `server_nas08.md`.
- **NAS08 systemd-resolved DNS bug** (fixed 2026-07-18): a stray global `DNS=` override in `/etc/systemd/resolved.conf` caused duplicate/incorrect DNS answers for internal hostnames network-wide on that host. Any future "works from browser but fails from a container/script on NAS08" symptom should check `resolvectl status` for stray global DNS servers first.
- **NAS08 STOCKPROXY service (2026-07-21):** Self-hosted Flask API, Docker container `stockproxy` (`~/docker/stockproxy/`), port 5005, public URL `https://stocks.kingdezigns.com/` proxied via NPM on HAS (see Proxy Hosts table in `server_homeassistant.md`). Supplies current + historical mutual fund prices to ONLYOFFICE custom functions (`FUNDPRICE`, `FUNDPRICE_HIST`) via Yahoo Finance, scraped server-side to dodge the browser CORS block that rules out calling Yahoo directly from a spreadsheet macro. Finnhub was evaluated first but dropped from this service — confirmed no mutual fund NAV coverage on the free tier. Current-price cache: 15 min in-memory. Historical-price cache: permanent, SQLite. All endpoints require a shared-secret `key` param (Vaultwarden). Built to support the "HSA Investiments Choices" tab in `Rufus Retirement Account Tracking 2026.xlsx`. `stocks.kingdezigns.com` A record added to the daily Dreamhost DDNS refresh script. Full config and known limitations in `server_nas08.md`.
- **NAS08 RANK.EQ Err:522 circular reference fix (2026-07-23, working):** The
"HSA Investiments Choices" fund-ranking formula broke with a circular-reference error on
any sheet edit (worked fine on load) because it depended on ~50 cells fed by live
`FUNDPRICE`/`FUNDPRICE_HIST` network calls. Fixed with a button-triggered LibreOffice
Basic macro that snapshots the live price columns into static value-only columns via
`setDataArray()`, with percent-change and rank formulas rebuilt to read from the static
snapshot instead of the live columns. Full root-cause analysis and macro in
`server_nas08.md`.
- **NAS08 Collabora Finnhub removal (2026-07-23, working):** `STOCKPRICE`/`STOCKTIME`
(Finnhub-backed equity functions) errored due to a missing `net.lok_allow` entry for
Finnhub. Instead of allowlisting Finnhub, it was removed entirely — `FUNDPRICE` (STOCKPROXY)
now covers equity tickers too, and a new `FUNDTIME` function replaces `STOCKTIME`, returning
STOCKPROXY's `resolved_date` (date only, not a time-of-day timestamp — accepted tradeoff).
No `coolwsd.xml` changes required. Full detail in `server_nas08.md`.
- **Synaplan AI integration** (added 2026-07-18, not yet functional): Nextcloud connector app installed, but the required self-hosted Synaplan backend stack (PHP/MariaDB/Qdrant/optional Ollama) has not been deployed. Treat as a future project, not a bug — see `server_nas08.md` for details before troubleshooting.
---
# 📌 Future Expansion
Additional files may be added for:
- Device inventories
- Application-specific firewall rules
- Backup and recovery procedures
- Monitoring and alerting configuration
- CrowdSec Console dashboard enrollment
- Geo-blocking configuration on UCG Max
- Authelia / forward authentication layer
- Expand remote launcher to cover NAS08 and NAS16 scripts
- **Synaplan self-hosted AI stack deployment** (PHP backend, MariaDB, Qdrant, optional Ollama) — scope resource requirements and deployment plan when ready
- **Collabora vs. ONLYOFFICE trial decision** (started 2026-07-21) — once a winner is chosen, update `server_nas08.md` and this index to reflect the final state (remove trial framing, decommission or keep the losing container, update firewall/NPM docs if the losing editor's proxy host is removed)
- **STOCKPROXY hardening** — not yet stress-tested at full ~50-ticker scale for Yahoo-side rate limiting; revisit if widespread simultaneous lookup failures are observed
---
# ✔️ End of Index
Reference in a new issue View git blame Copy permalink