¶ Architecture
The Lab infrastructure is built on a modified Router-on-a-stick design.
The central router (RLab) acts as the single L3 network equipment. It supported by 3 switches on trunk ports, whose role is to provide access ports to end devices. Internet uplink L2 connectivity is tunneled to the router by SVlad trough a isolated vlan.
Switches are:
- SCore (10.12.1.2) - Uplink from RLab on Ether1, provides access port to core rack servers.
- SHenri (10.12.1.4) - Uplink from RLab on Ether1, Ether10 trunk downlink to APHenri.
- SVlad (10.12.1.3) - Uplink from RLab on Ether1, Ether10 trunk downlink to APVlad. Contains the access port for the Digi WAN vlan.
Two access points (Mikrotik cAP AX) are placed in each of the rooms. RLab router runs CAPsMAN and controls the radios of these AP's. All vlan's use local forwarding (traffic gets processed on CAP) except the VJail network, which uses CAPsMAN traffic processing to be able to apply filtering rules centrally.
¶ Core Rack
The core rack is located in the entrace hallway and contains the heart of the network: RLab, SCore and a few servers.
Already existing wiring in the building is used to distribute trunk ports to other sections of the house, including Henri and Vlad. The reception room and classroom are connected using only access pors on the RLab router itself.
The SCore switch has a display where charts of the traffic on Ether1 ports can be observed. The last 5 ports are reserved for future use with IP cameras and NVR.
| Core Rack | Henri AP temporary mouting |
|---|---|
 |
 |
¶ Servers
Servers should normally live in the core rack and the VServers vlan, except cases where they are needed in other physical locations and/or network configurations.
- Pallas (pallas.lr) handles low-level data services like logs and telemetry collection. Here we will also deploy services manipulating infrastructure.
- Eros (eros.lr) is the main server running https termination (caddy), Wiki and Authentik stacks, URL shortener and other production setups.
- Ceres (ceres.lr) runs automation software in the form of Home Assitant OS and handles connectivity to the Zigbee network.
¶ Vlans
All bridges will be called bridge. They will have VLAN filtering turned on.
| VID | Interface Name | Network | Devices | Notes | WiFi |
|---|---|---|---|---|---|
| 100 | VMgmt | 10.12.1.1 | Switches, Routers | No! | |
| 200 | VClock | 10.12.2.1 | Clockworks printers and regular stuff | ClockWorks | |
| 300 | VAlacrity | 10.12.3.1 | Alacriy regular devices | Alacrity | |
| 400 | VIoT | 10.12.4.1 | HassOS, cameras, Boron. | LabIoT (hidden) | |
| 500 | VGuest | 10.12.5.1 | NO access to othe vlans | LabGuest | |
| 501 | VJail | 10.12.51.1 | Bambu's and other chatty shit | NO access between devices, NO access to other vlans | LabIso |
| 101 | VWanConsumer | Whatever digi gives | Primary Uplink | Internet Uplink PPPoE (Digi) | No?! |
| 102 | Reserved | Provider-allocated | Future Uplink | Reserved | No?! |
| 103 | Reserved | Provider-allocated | Future Uplink | Reserved | No?! |
| 104 | Reserved | - | Reserved | Reserved | TBD |
| 105 | Reserved | - | Reserved | Reserved | TBD |
| 106 | Servers | 10.12.16.1 | Eros, Pallas, Ceres | Servers and stuff | No! |
¶ Lab network layout
¶ Service-level infrastructure
Very outdated and pending removal