From 19bad641050fb8ec1f2392391525f781f6664985 Mon Sep 17 00:00:00 2001 From: Julien Lutran Date: Mon, 17 Aug 2026 11:07:16 +0200 Subject: [PATCH] nuc: document LAN gateway migration 192.168.0.1 -> 192.168.0.2 Update host NIC/interfaces (gw + DNS to public 1.1.1.1/9.9.9.9, no container dependency), fix transmission-bt kill-switch routes, and add a note that DHCP instances self-heal while static ones (privoxy, transmission-bt) must be updated by hand. Also spell out the macvlan test-from-inside/external-host rule. Co-Authored-By: Claude Opus 4.8 --- nuc/nuc-install.md | 20 +++++++++++++++----- nuc/transmission-bt.md | 6 +++--- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/nuc/nuc-install.md b/nuc/nuc-install.md index 0e01d68..8a5d57a 100644 --- a/nuc/nuc-install.md +++ b/nuc/nuc-install.md @@ -12,7 +12,7 @@ How to rebuild the Incus host from scratch if `/dev/sda` (512 GB SSD, `usb4t/media` → `/srv/media` (media library) - USB: Pioneer USB audio (`08e4:0176`), Logitech Unifying receiver (K400), CSCTEK USB Audio and HID -- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.1`) +- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.2`) ## ⚠️ What dies with sda @@ -87,8 +87,8 @@ allow-hotplug enp1s0 iface enp1s0 inet static address 192.168.0.3 netmask 255.255.255.0 - gateway 192.168.0.1 - dns-nameservers 192.168.0.1 1.1.1.1 + gateway 192.168.0.2 + dns-nameservers 1.1.1.1 9.9.9.9 ``` Restore `/root/.ssh/authorized_keys` (3 keys; one is `id_rsa_claude.pub` @@ -161,7 +161,17 @@ EOF Known macvlan quirk: the **host cannot talk to its own instances** (and vice versa) over macvlan — management is via `incus exec`, and other LAN -hosts reach them normally. +hosts reach them normally. (So test a container's LAN service from inside +the container or from an external LAN host — never by pinging its IP from +the nuc or a sibling container; that always fails by design.) + +LAN gateway note: the router/gateway is **`192.168.0.2`** (migrated from +`192.168.0.1`, 2026-08 — `.1` is gone). DHCP-configured instances pick the +new gateway up automatically; **statically-configured ones must be updated +by hand.** Current static holdouts: privoxy +(`/etc/systemd/network/eth0.network`, `Gateway=`) and transmission-bt +(netplan `routes: via:` + the WG kill-switch `/32`). Symptom of a missed +one: the service is up and its port answers, but nothing it fetches works. Let `julien` run harmless incus commands (list/info/config/show…) without a password — mutating ones (`exec`, `start/stop`, `delete`) @@ -258,7 +268,7 @@ Both logs rotate monthly (`/etc/logrotate.d/incus-*`). - [ ] Jellyfin web at `http://192.168.0.5:8096`, kiosk UI on HDMI, sound on the Pioneer, "Pioneer A-70" visible in Spotify Connect - [ ] LAN DNS: clients use blocky at `192.168.0.254` (host itself uses - `192.168.0.1` + `1.1.1.1` to avoid a bootstrap loop) + public `1.1.1.1` + `9.9.9.9`, never blocky, to avoid a bootstrap loop) - [ ] Optional (only if QSV low-power encoders are wanted): `echo 'options i915 enable_guc=3' > /etc/modprobe.d/i915.conf && update-initramfs -u` diff --git a/nuc/transmission-bt.md b/nuc/transmission-bt.md index 0747850..a6d9b3c 100644 --- a/nuc/transmission-bt.md +++ b/nuc/transmission-bt.md @@ -57,17 +57,17 @@ network: addresses: [192.168.0.254] routes: - to: 193.70.35.17/32 - via: 192.168.0.1 + via: 192.168.0.2 EOF chmod 600 /etc/netplan/10-lxc.yaml netplan apply' # packages need a temporary default route (removed right after) -incus exec "$CNAME" -- ip route add default via 192.168.0.1 +incus exec "$CNAME" -- ip route add default via 192.168.0.2 incus exec "$CNAME" -- apt-get update incus exec "$CNAME" -- apt-get install -y --no-install-recommends \ transmission-daemon wireguard-tools iptables curl -incus exec "$CNAME" -- ip route del default via 192.168.0.1 +incus exec "$CNAME" -- ip route del default via 192.168.0.2 # WireGuard full tunnel (generate key, print pubkey for the ks4 side) incus exec "$CNAME" -- bash -c 'umask 077