diff --git a/nas/README.md b/nas/README.md index 8033d0d..acc7dce 100644 --- a/nas/README.md +++ b/nas/README.md @@ -33,8 +33,8 @@ Storage + backup host on the LAN, added 2026-08. | Name | IP | Doc | Features | |---|---|---|---| | blocky | 192.168.0.254 | — | unprivileged, autostart; DNS ad-blocker for the LAN. Moved from nuc 2026-08-30 so it survives nuc being powered off | -| privoxy | 192.168.0.11 | — | unprivileged, autostart; filtering HTTP proxy, listens on **:3128** (not privoxy's default 8118); static config in `/etc/systemd/network/eth0.network`, `DNS=192.168.0.254`. Moved from nuc 2026-08-30 | -| [transmission-bt](transmission-bt.md) | 192.168.0.7 | ✅ | unprivileged, autostart; always-on WireGuard full tunnel → ks4 (egress = 193.70.35.17, kill switch: no default route); `/export/media` disk device (`shift=true`), downloads to `/media/downloads`; web UI :9091 (LAN only). Moved from nuc 2026-08-30 | +| privoxy | 192.168.0.11 | — | unprivileged, autostart; filtering HTTP proxy, listens on **:3128** (not privoxy's default 8118); static config in `/etc/systemd/network/eth0.network` (`Gateway=192.168.0.1`), `DNS=192.168.0.254`. Moved from nuc 2026-08-30 | +| [transmission-bt](transmission-bt.md) | 192.168.0.7 | ✅ | unprivileged, autostart; always-on WireGuard full tunnel → ks4 (egress = 193.70.35.17, kill switch: no default route in `main`, wg-quick's `fwmark`/`suppress_prefixlength` rules send traffic to table 51820 — **`netplan apply` wipes those rules, so always `systemctl restart wg-quick@wg0` after it**); **IPv6 disabled** (`/etc/sysctl.d/99-no-ipv6.conf`) since the tunnel is `AllowedIPs = 0.0.0.0/0` only and the FTTH box's native IPv6 RA bypassed the kill switch entirely; `/export/media` disk device (`shift=true`), downloads to `/media/downloads`; web UI :9091 (LAN only). Moved from nuc 2026-08-30 | ## Backup pools hosted here diff --git a/nas/nas-install.md b/nas/nas-install.md index 4fc6a03..c81f319 100644 --- a/nas/nas-install.md +++ b/nas/nas-install.md @@ -324,11 +324,11 @@ allow-hotplug enp0s20f0 iface enp0s20f0 inet static address 192.168.0.4 netmask 255.255.255.0 - gateway 192.168.0.2 + gateway 192.168.0.1 dns-nameservers 1.1.1.1 9.9.9.9 ``` -(Gateway is **`192.168.0.2`** — `.1` is gone since 2026-08. The host +(Gateway is **`192.168.0.1`** — the FTTH box, since 2026-09. The host uses public resolvers, never blocky, to avoid a bootstrap loop. Interface name is a guess until the board is up — check `ip -br link`.) @@ -527,7 +527,7 @@ Its WireGuard tunnel is **entirely inside the container** (`wg0`, `10.8.0.21`, `wg-quick@wg0`, `BindsTo=` on the daemon), so the container carries its own keys and **ks4 needs no change at all** — the peer stays `10.8.0.21/32`. The kill-switch `/32` route points at the gateway -`192.168.0.2`, which is the same from here. +`192.168.0.1`, which is the same from here. ```sh # on nuc — remote already added in §9a diff --git a/nas/transmission-bt.md b/nas/transmission-bt.md index 33e4b4f..762e80e 100644 --- a/nas/transmission-bt.md +++ b/nas/transmission-bt.md @@ -66,17 +66,17 @@ network: addresses: [192.168.0.254] routes: - to: 193.70.35.17/32 - via: 192.168.0.2 + via: 192.168.0.1 EOF chmod 600 /etc/netplan/10-lxc.yaml netplan apply' # packages need a temporary default route (removed right after) -incus exec "$CNAME" -- ip route add default via 192.168.0.2 +incus exec "$CNAME" -- ip route add default via 192.168.0.1 incus exec "$CNAME" -- apt-get update incus exec "$CNAME" -- apt-get install -y --no-install-recommends \ transmission-daemon wireguard-tools iptables curl -incus exec "$CNAME" -- ip route del default via 192.168.0.2 +incus exec "$CNAME" -- ip route del default via 192.168.0.1 # WireGuard full tunnel (generate key, print pubkey for the ks4 side) incus exec "$CNAME" -- bash -c 'umask 077 diff --git a/nuc/nuc-install.md b/nuc/nuc-install.md index 9db0838..3367203 100644 --- a/nuc/nuc-install.md +++ b/nuc/nuc-install.md @@ -12,7 +12,7 @@ How to rebuild the Incus host from scratch if `/dev/sda` (512 GB SSD, `usb4t/media` → `/srv/media` (media library) - USB: Pioneer USB audio (`08e4:0176`), Logitech Unifying receiver (K400), CSCTEK USB Audio and HID -- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.2`) +- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.1`) ## ⚠️ What dies with sda @@ -87,7 +87,7 @@ allow-hotplug enp1s0 iface enp1s0 inet static address 192.168.0.3 netmask 255.255.255.0 - gateway 192.168.0.2 + gateway 192.168.0.1 dns-nameservers 1.1.1.1 9.9.9.9 ``` @@ -165,13 +165,32 @@ hosts reach them normally. (So test a container's LAN service from inside the container or from an external LAN host — never by pinging its IP from the nuc or a sibling container; that always fails by design.) -LAN gateway note: the router/gateway is **`192.168.0.2`** (migrated from -`192.168.0.1`, 2026-08 — `.1` is gone). DHCP-configured instances pick the -new gateway up automatically; **statically-configured ones must be updated -by hand.** Current static holdouts: privoxy -(`/etc/systemd/network/eth0.network`, `Gateway=`) and transmission-bt -(netplan `routes: via:` + the WG kill-switch `/32`). Symptom of a missed -one: the service is up and its port answers, but nothing it fetches works. +LAN gateway note: the router/gateway is **`192.168.0.1`** — the FTTH box, +since 2026-09 (it was `.2`, the Archer C7, from 2026-08; and `.1` before +that). **Every statically-configured host and instance must be updated by +hand**, and DHCP ones need a lease renew before they stop using the cached +old gateway. Symptom of a missed one: the service is up and its port +answers, but nothing it fetches works. + +Static holdouts to update on any gateway change — the full list, verified +2026-09-16: + +| Where | What to change | +|---|---| +| nas host | `/etc/network/interfaces`, `gateway` | +| nuc host | `/etc/network/interfaces`, `gateway` | +| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` (static since 2026-09, see below) | +| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` | +| transmission-bt | netplan `routes: via:` (the WG kill-switch `/32`) | +| jellyfin-server/-client | DHCP — renew the lease, or they keep the old gateway | + +⚠️ **DHCP reservations did not survive the FTTH migration.** blocky held +`192.168.0.254` via a reservation on the Archer C7; renewing its lease on +the FTTH box handed it a random address and took LAN DNS down with it. It +is now **statically configured** so it cannot move. `jellyfin-server` +(`.5`) and `jellyfin-client` (`.6`) are still DHCP with stale leases — set +reservations on the FTTH box or make them static before those leases +expire. Let `julien` run harmless incus commands (list/info/config/show…) without a password — mutating ones (`exec`, `start/stop`, `delete`)