julien/doc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

doc: make every LAN instance static, record the FTTH fallout

Browse Source 
Follow-up to a7f1ac6. The Archer C7's DHCP reservations did not carry
over to the FTTH box, so anything still on DHCP was one lease renew away
from moving — as blocky already demonstrated by taking LAN DNS with it.
jellyfin-server and jellyfin-client are now static too; homeassistant
stays dynamic on purpose (it never had a reservation).

Records three things that cost time to find:

- jellyfin-client can never use netplan: the kiosk raw.lxc bind-mounts
  the host /run/udev read-only, so netplan generate fails and config
  silently does not regenerate at boot. It uses systemd-networkd now.
- LAPTOP719974 and patate also lost their reserved addresses.
- ks4 cannot serve as an IPv6 exit: it has a global v6 address and a
  default v6 route but no working v6 egress, so extending the torrent
  tunnel to ::/0 is not an option. IPv6 stays disabled in the container.

Also notes the C7 + LTE box kept as fallback: only the gateway differs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Julien Lutran
2026-09-16 10:33:17 +02:00
co-authored by Claude Opus 5
parent a7f1ac691e
commit 7e6b8f2848
2 changed files with 46 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nuc/nuc-install.md
+45 -21
View File
@@ -167,30 +167,54 @@ the nuc or a sibling container; that always fails by design.)
LAN gateway note: the router/gateway is **`192.168.0.1`** — the FTTH box,
since 2026-09 (it was `.2`, the Archer C7, from 2026-08; and `.1` before
that). **Every statically-configured host and instance must be updated by
hand**, and DHCP ones need a lease renew before they stop using the cached
old gateway. Symptom of a missed one: the service is up and its port
answers, but nothing it fetches works.
that). **Every host and instance is statically configured, so each one
must be updated by hand.** Symptom of a missed one: the service is up and
its port answers, but nothing it fetches works.
Static holdouts to update on any gateway change — the full list, verified
2026-09-16:
Every LAN host and instance is now **statically configured** (verified
2026-09-16) — nothing on this LAN depends on a DHCP reservation any more.
On a gateway change, update all of these by hand:
| Where | What to change |
|---|---|
| nas host | `/etc/network/interfaces`, `gateway` |
| nuc host | `/etc/network/interfaces`, `gateway` |
| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` (static since 2026-09, see below) |
| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` |
| transmission-bt | netplan `routes: via:` (the WG kill-switch `/32`) |
| jellyfin-server/-client | DHCP — renew the lease, or they keep the old gateway |
| Where | File | Address |
|---|---|---|
| nas host | `/etc/network/interfaces`, `gateway` | `.4` |
| nuc host | `/etc/network/interfaces`, `gateway` | `.3` |
| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` | `.254` |
| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` | `.11` |
| transmission-bt | netplan `routes: via:` (WG kill-switch `/32`) | `.7` |
| jellyfin-server | netplan `routes: - to: default / via:` | `.5` |
| jellyfin-client | `/etc/systemd/network/10-eth0.network`, `Gateway=` | `.6` |
⚠️ **DHCP reservations did not survive the FTTH migration.** blocky held
`192.168.0.254` via a reservation on the Archer C7; renewing its lease on
the FTTH box handed it a random address and took LAN DNS down with it. It
is now **statically configured** so it cannot move. `jellyfin-server`
(`.5`) and `jellyfin-client` (`.6`) are still DHCP with stale leases — set
reservations on the FTTH box or make them static before those leases
expire.
`homeassistant` (a HAOS **VM**, NetworkManager, normally stopped) is
deliberately left on DHCP — it never had a reservation and nothing
addresses it by IP.
⚠️ **Why everything is static now: DHCP reservations did not survive the
FTTH migration.** They lived in the Archer C7's `dhcp.@host[-1]` list
(the `add_host` block in
[../archer-c7/upgrade-openwrt-25.12.md](../archer-c7/upgrade-openwrt-25.12.md)),
and the FTTH box did not inherit them. blocky held `192.168.0.254` that
way; renewing its lease handed it a pool address and took LAN DNS down
with it. Static config removes the dependency entirely.
Two **non-container** hosts also lost their reservations and are still
dynamic — harmless, nothing addresses them by IP, but the old fixed
addresses are gone: `LAPTOP719974` (was `.20`) and `patate` (was `.21`).
⚠️ **`jellyfin-client` cannot use netplan at all.** It is a privileged
kiosk whose `raw.lxc` bind-mounts the host's `/run/udev` read-only, so
`netplan generate` dies with `cannot create directory /run/udev/rules.d`
— which means netplan changes there **silently fail to regenerate at
boot**. It is configured with plain systemd-networkd
(`/etc/systemd/network/10-eth0.network`); its old netplan yaml is parked
at `/root/10-lxc.yaml.netplan-disabled-ftth`. Always verify a network
change in that container with `incus restart jellyfin-client`, not just
`netplan apply`.
**Fallback hardware:** the Archer C7 and the LTE box are kept on the
shelf. Their addressing does not clash with the current LAN — **the
gateway is the only thing that differs**, so failing back means walking
the table above and setting `.2` (C7) instead of `.1`.
Let `julien` run harmless incus commands (list/info/config/show…)
without a password — mutating ones (`exec`, `start/stop`, `delete`)