diff --git a/nas/README.md b/nas/README.md index acc7dce..82f0ad0 100644 --- a/nas/README.md +++ b/nas/README.md @@ -34,7 +34,7 @@ Storage + backup host on the LAN, added 2026-08. |---|---|---|---| | blocky | 192.168.0.254 | — | unprivileged, autostart; DNS ad-blocker for the LAN. Moved from nuc 2026-08-30 so it survives nuc being powered off | | privoxy | 192.168.0.11 | — | unprivileged, autostart; filtering HTTP proxy, listens on **:3128** (not privoxy's default 8118); static config in `/etc/systemd/network/eth0.network` (`Gateway=192.168.0.1`), `DNS=192.168.0.254`. Moved from nuc 2026-08-30 | -| [transmission-bt](transmission-bt.md) | 192.168.0.7 | ✅ | unprivileged, autostart; always-on WireGuard full tunnel → ks4 (egress = 193.70.35.17, kill switch: no default route in `main`, wg-quick's `fwmark`/`suppress_prefixlength` rules send traffic to table 51820 — **`netplan apply` wipes those rules, so always `systemctl restart wg-quick@wg0` after it**); **IPv6 disabled** (`/etc/sysctl.d/99-no-ipv6.conf`) since the tunnel is `AllowedIPs = 0.0.0.0/0` only and the FTTH box's native IPv6 RA bypassed the kill switch entirely; `/export/media` disk device (`shift=true`), downloads to `/media/downloads`; web UI :9091 (LAN only). Moved from nuc 2026-08-30 | +| [transmission-bt](transmission-bt.md) | 192.168.0.7 | ✅ | unprivileged, autostart; always-on WireGuard full tunnel → ks4 (egress = 193.70.35.17, kill switch: no default route in `main`, wg-quick's `fwmark`/`suppress_prefixlength` rules send traffic to table 51820 — **`netplan apply` wipes those rules, so always `systemctl restart wg-quick@wg0` after it**); **IPv6 disabled** (`/etc/sysctl.d/99-no-ipv6.conf`) since the tunnel is `AllowedIPs = 0.0.0.0/0` only and the FTTH box's native IPv6 RA bypassed the kill switch entirely. Extending the tunnel to `::/0` is **not currently possible**: ks4 has a global v6 address and a default v6 route but **no working v6 egress** (verified 2026-09-16 — both ICMP and TCP to the v6 internet fail while v4 is fine), so it cannot act as a v6 exit. Fix OVH v6 on ks4 first if v6 peers are ever wanted; `/export/media` disk device (`shift=true`), downloads to `/media/downloads`; web UI :9091 (LAN only). Moved from nuc 2026-08-30 | ## Backup pools hosted here diff --git a/nuc/nuc-install.md b/nuc/nuc-install.md index 3367203..f68ed38 100644 --- a/nuc/nuc-install.md +++ b/nuc/nuc-install.md @@ -167,30 +167,54 @@ the nuc or a sibling container; that always fails by design.) LAN gateway note: the router/gateway is **`192.168.0.1`** — the FTTH box, since 2026-09 (it was `.2`, the Archer C7, from 2026-08; and `.1` before -that). **Every statically-configured host and instance must be updated by -hand**, and DHCP ones need a lease renew before they stop using the cached -old gateway. Symptom of a missed one: the service is up and its port -answers, but nothing it fetches works. +that). **Every host and instance is statically configured, so each one +must be updated by hand.** Symptom of a missed one: the service is up and +its port answers, but nothing it fetches works. -Static holdouts to update on any gateway change — the full list, verified -2026-09-16: +Every LAN host and instance is now **statically configured** (verified +2026-09-16) — nothing on this LAN depends on a DHCP reservation any more. +On a gateway change, update all of these by hand: -| Where | What to change | -|---|---| -| nas host | `/etc/network/interfaces`, `gateway` | -| nuc host | `/etc/network/interfaces`, `gateway` | -| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` (static since 2026-09, see below) | -| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` | -| transmission-bt | netplan `routes: via:` (the WG kill-switch `/32`) | -| jellyfin-server/-client | DHCP — renew the lease, or they keep the old gateway | +| Where | File | Address | +|---|---|---| +| nas host | `/etc/network/interfaces`, `gateway` | `.4` | +| nuc host | `/etc/network/interfaces`, `gateway` | `.3` | +| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` | `.254` | +| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` | `.11` | +| transmission-bt | netplan `routes: via:` (WG kill-switch `/32`) | `.7` | +| jellyfin-server | netplan `routes: - to: default / via:` | `.5` | +| jellyfin-client | `/etc/systemd/network/10-eth0.network`, `Gateway=` | `.6` | -⚠️ **DHCP reservations did not survive the FTTH migration.** blocky held -`192.168.0.254` via a reservation on the Archer C7; renewing its lease on -the FTTH box handed it a random address and took LAN DNS down with it. It -is now **statically configured** so it cannot move. `jellyfin-server` -(`.5`) and `jellyfin-client` (`.6`) are still DHCP with stale leases — set -reservations on the FTTH box or make them static before those leases -expire. +`homeassistant` (a HAOS **VM**, NetworkManager, normally stopped) is +deliberately left on DHCP — it never had a reservation and nothing +addresses it by IP. + +⚠️ **Why everything is static now: DHCP reservations did not survive the +FTTH migration.** They lived in the Archer C7's `dhcp.@host[-1]` list +(the `add_host` block in +[../archer-c7/upgrade-openwrt-25.12.md](../archer-c7/upgrade-openwrt-25.12.md)), +and the FTTH box did not inherit them. blocky held `192.168.0.254` that +way; renewing its lease handed it a pool address and took LAN DNS down +with it. Static config removes the dependency entirely. + +Two **non-container** hosts also lost their reservations and are still +dynamic — harmless, nothing addresses them by IP, but the old fixed +addresses are gone: `LAPTOP719974` (was `.20`) and `patate` (was `.21`). + +⚠️ **`jellyfin-client` cannot use netplan at all.** It is a privileged +kiosk whose `raw.lxc` bind-mounts the host's `/run/udev` read-only, so +`netplan generate` dies with `cannot create directory /run/udev/rules.d` +— which means netplan changes there **silently fail to regenerate at +boot**. It is configured with plain systemd-networkd +(`/etc/systemd/network/10-eth0.network`); its old netplan yaml is parked +at `/root/10-lxc.yaml.netplan-disabled-ftth`. Always verify a network +change in that container with `incus restart jellyfin-client`, not just +`netplan apply`. + +**Fallback hardware:** the Archer C7 and the LTE box are kept on the +shelf. Their addressing does not clash with the current LAN — **the +gateway is the only thing that differs**, so failing back means walking +the table above and setting `.2` (C7) instead of `.1`. Let `julien` run harmless incus commands (list/info/config/show…) without a password — mutating ones (`exec`, `start/stop`, `delete`)