B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
203 Commits 3 Branches 0 Tags
655c6331e9a7dcb246740a1e9b416b080b5ff6ce
Commit Graph
203 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kurogeek 655c6331e9 mob next [ci-skip] [ci skip] [skip ci] 
lastFile:clan.nix
 2026-08-06 14:42:11 +07:00
kurogeek 0b8f1860fa mob next [ci-skip] [ci skip] [skip ci] 
lastFile:clan.nix
 2026-08-06 14:02:21 +07:00
kurogeek 17f3860f9b mob next [ci-skip] [ci skip] [skip ci] 
lastFile:modules/clan/gw-router/default.nix
 2026-08-06 14:01:25 +07:00
kurogeek a97f3f82e5 mob next [ci-skip] [ci skip] [skip ci] 
lastFile:modules/clan/gw-router/default.nix
 2026-08-06 11:56:42 +07:00
kurogeek a46b83cbc7 mob next [ci-skip] [ci skip] [skip ci] 
lastFile:flake.nix
 2026-08-06 11:49:57 +07:00
kurogeek 5642a0f6fc mob next [ci-skip] [ci skip] [skip ci] 
lastFile:machines/gw-cnx-1/configuration.nix
 2026-08-06 11:23:46 +07:00
kurogeek df389266f6 mob next [ci-skip] [ci skip] [skip ci] 
lastFile:machines/gw-cnx-1/configuration.nix
 2026-08-06 11:23:37 +07:00
kurogeek 81626a75db mob next [ci-skip] [ci skip] [skip ci] 
lastFile:modules/clan/gw-router/flake-module.nix
 2026-08-06 11:23:14 +07:00
kurogeek 8171207e9c mob next [ci-skip] [ci skip] [skip ci] 
lastFile:flake.nix
 2026-08-05 11:31:09 +07:00
kurogeek 53c03af2a0 mob next [ci-skip] [ci skip] [skip ci] 
lastFile:flake.nix
 2026-08-05 10:57:28 +07:00
kurogeek 1a56a2d24b mob next [ci-skip] [ci skip] [skip ci] 
lastFile:modules/clan/gw-router/flake-module.nix
 2026-08-05 10:21:39 +07:00
kurogeek e316ec56ce flake: use flake-parts 2026-08-05 10:19:32 +07:00
kurogeek 559115e52b inventory.json: update install time of gw-cnx-1 2026-07-31 17:37:47 +07:00
kurogeek 9cfcf91b51 inventory.json: update install time of gw-cnx-1 2026-07-31 16:08:14 +07:00
kurogeek 570fe64497 inventory.json: update install time of gw-cnx-1 2026-07-31 15:09:07 +07:00
kurogeek 2ac4215237 inventory.json: update install time of gw-cnx-1 2026-07-31 13:03:43 +07:00
kurogeek d51a334ec6 inventory.json: update install time of gw-cnx-1 2026-07-31 13:00:57 +07:00
kurogeek b81c0aaa89 machines/gw-cnx-1/facter.json: update hardware configuration 2026-07-31 13:00:57 +07:00
Berwn fcd8e55024 Add untagged access ports and a staging uplink for gw-cnx-1 
New cnx.router.accessPorts option pins a port untagged to one VLAN via
bridge PVID/EgressUntagged; convention is the last copper port as an
always-available mgmt recovery port. gw-cnx-1 port roles: enp1s0 WAN,
enp2s0 trunk, enp3s0 temporary DHCP uplink into the old OPNsense LAN
(back to trunk at cutover), enp4s0 untagged mgmt.
 2026-07-31 12:57:34 +07:00
Berwn 19e1acda51 Renumber gw-cnx-1 to the fleet addressing scheme (OPNsense replacement) 
The newedge.house site adopts the 10.1.<vlanId>.0/24 convention: mgmt 10
(the old untagged LAN), lan 20, iot 40, voip 50, dmz 60, unit1-5 110-150.
PPPoE is untagged at this site. Static leases move to a new per-VLAN
dhcp.reservations option rendered into Kea host reservations.
 2026-07-31 11:39:54 +07:00
Berwn f5b6b4b55e Serve newedge.house from the fleet nameservers 2026-07-31 11:39:54 +07:00
Berwn 3646d43ac5 Add CNX WAN Speed dashboard for the gateway speed tests 
Per-gateway download/upload/ping from the hourly librespeed runs, with
each link's 7-day median overlaid so the WANSpeedDegraded alert
condition is visible at a glance. Label-driven — new sites appear
automatically once scraped.
 2026-07-31 11:03:31 +07:00
Berwn d8d4a686eb Add gateway diagnostics: iperf3, CLI toolkit, periodic WAN speed test 
iperf3 serves throughput tests from every VLAN and the mesh; an hourly
librespeed run feeds speedtest_* metrics through node_exporter's textfile
collector, and vmalert flags download rates below half the link's own
7-day median so ISP degradation surfaces without per-site thresholds.
 2026-07-31 10:44:52 +07:00
Berwn b11ff75ca6 Add internal reverse proxy for gateways (Caddy, wildcard via DNS-01) 
cnx.router.proxy serves <service>.<site><n>.cnx.network with a real Let's
Encrypt wildcard obtained via a gateway-scoped TSIG key against ns1; Blocky
resolves the names to the router's LAN address, so they exist only
internally. First user: Omada UI on gw-cnx-1 (omada.cnx1.cnx.network).
 2026-07-31 10:09:08 +07:00
Berwn 4735968433 vars: update via generator dns-acme-gw-cnx-1-knot (machine: ns1) 2026-07-31 10:09:08 +07:00
Berwn 02efeb454b vars: update via generator dns-acme-gw-cnx-1-rfc2136 (machine: gw-cnx-1) 2026-07-31 10:09:08 +07:00
Berwn 868cd9eebd vars: update via generator dns-acme-gw-cnx-1-secret (shared) 2026-07-31 10:09:08 +07:00
Berwn 99fdde666c secrets: add group admins to secret gw-cnx-1-age.key 2026-07-31 10:09:08 +07:00
Berwn 7b706eb3e7 secrets: add group admins to secret ns2-age.key 2026-07-31 10:09:08 +07:00
Berwn 6c89a7031a secrets: add group admins to secret ns1-age.key 2026-07-31 10:09:08 +07:00
Berwn 4ca5fd3afd secrets: add group admins to secret control-age.key 2026-07-31 10:09:08 +07:00
kurogeek 7958ddd771 .gitignore 2026-07-31 09:38:57 +07:00
kurogeek 0c11aca91f machines/gw-cnx-1: disko update 2026-07-31 09:38:07 +07:00
kurogeek 292a699a2b clan.core.sops.defaultGroups to all machines 2026-07-31 09:18:18 +07:00
Berwn 7d549a9c17 Migrate deprecated admin service to sshd + users 
sshd carries the admin SSH keys and now also CA-signed host certificates
(TOFU-less verification via the shared openssh-ca); the users service
generates per-machine root passwords (share = false, no prompts).
 2026-07-28 17:17:56 +07:00
Berwn ac60d527ae vars: update via generator openssh-cert (machine: web01) 2026-07-28 17:15:55 +07:00
Berwn 3471faa466 vars: update via generator openssh-cert (machine: ns2) 2026-07-28 17:15:54 +07:00
Berwn db22afc6e3 vars: update via generator openssh-cert (machine: ns1) 2026-07-28 17:15:54 +07:00
Berwn 04d3518c03 vars: update via generator openssh-cert (machine: mx1) 2026-07-28 17:15:53 +07:00
Berwn 94daf06814 vars: update via generator openssh-cert (machine: gw-cnx-1) 2026-07-28 17:15:53 +07:00
Berwn 3093ed7044 vars: update via generator openssh-cert (machine: control) 2026-07-28 17:15:52 +07:00
Berwn c1fad33ad7 vars: update via generator user-password-root (machine: web01) 2026-07-28 17:15:47 +07:00
Berwn 60f6884f35 vars: update via generator user-password-root (machine: ns2) 2026-07-28 17:15:47 +07:00
Berwn d2b352543b vars: update via generator user-password-root (machine: ns1) 2026-07-28 17:15:46 +07:00
Berwn 7639d477c8 vars: update via generator user-password-root (machine: mx1) 2026-07-28 17:15:45 +07:00
Berwn 8327e4997a vars: update via generator user-password-root (machine: gw-cnx-1) 2026-07-28 17:15:44 +07:00
Berwn 060091247a vars: update via generator user-password-root (machine: control) 2026-07-28 17:15:43 +07:00
Berwn 9ccfbc3959 vars: update via generator openssh-ca (shared) 2026-07-28 17:15:43 +07:00
Berwn 4585fe7b7f Update flake inputs (clan-core 2026-07-08, nixos-mailserver, treefmt-nix) 2026-07-28 17:11:00 +07:00
Berwn 89eb50fcd7 vars: re-encrypt gw-cnx-1 emergency-access and openssh for admins group 2026-07-28 17:06:11 +07:00