Skip to content

Network

Addressing

Host IP MAC (net0) Notes
pve (Proxmox) 192.168.0.76 (test host, pve.lan.mw.jasonrivers.co.uk) Physical NIC, not managed by this inventory On the main LAN, 192.168.0.0/24. Retire this address and its API token once a permanent Proxmox host is in place.
swarm-core 10.36.0.10/24, gateway 10.36.0.1 bc:24:11:dc:5e:a7 Swarm manager VM
pihole 10.36.0.11/24, gateway 10.36.0.1 bc:24:11:f2:0d:90 Appliance VM
nextcloud 10.36.0.12/24, gateway 10.36.0.1 bc:24:11:60:83:3b Appliance VM
unifi 10.36.0.13/24, gateway 10.36.0.1 bc:24:11:f8:aa:27 Appliance VM
homeassistant 10.36.0.14/24, gateway 10.36.0.1 bc:24:11:f6:7f:30 Appliance VM. HAOS has no cloud-init, so this address is only reachable via a DHCP reservation keyed to the MAC — Ansible pins the MAC (home_assistant_mac_address) and declares the IP for the Traefik route, but does not apply the IP itself, see Home Assistant
swarm-media Physical host, address not managed by this inventory Physical NIC, not managed by this inventory Swarm worker

VMs and appliances sit on 10.36.0.0/24; the Proxmox host itself is on the separate 192.168.0.0/24 LAN. No VLAN tagging appears anywhere in the Ansible layer (proxmox_vm_ipconfig has no ,tag= segment on any host) — if VLANs exist on this network, they are configured outside this repository, at the switch/Proxmox-network layer. Don't infer a VLAN number that isn't set here.

Every provisioned VM's net0 MAC is pinned (proxmox_vm_mac_address for the cloned VMs, home_assistant_mac_address for HAOS) to its real hardware address, rather than left to Proxmox's clone-time assignment, so a router DHCP reservation can give it the same address as a fallback, independent of cloud-init. A router DHCP reservation for each MAC still needs to be set to match its IP above.

Domain and ingress

Base domain: lab.riversfamily.uk. Every service, including the appliance VMs, is reached through Traefik on its own subdomain, <service>.lab.riversfamily.uk — including internal-only services, which are still fronted by Traefik, just not exposed to the public internet.

  • Traefik is the only service publishing host ports (80/443), pinned to swarm-core, mode: host so it sees the real client IP.
  • Every other Swarm service attaches to the shared traefik overlay network (external, attachable) and is routed purely by Traefik label, never a ports: mapping.
  • The appliance VMs are routed through Traefik's file provider (traefik_appliances in group_vars/all/vars.yml), pointing directly at each VM's IP and port.
  • Two exceptions serve non-HTTP traffic directly on the LAN rather than through Traefik: Pi-hole's DNS listener (port 53) and UniFi's device-communication ports (inform 8080, STUN 3478 UDP, L2 discovery 10001).

DNS and TLS

  • lab.riversfamily.uk is hosted at Cloudflare. Pi-hole additionally holds a split-horizon wildcard record for *.lab.riversfamily.uk pointing at the swarm-core IP, so internal clients resolve every service name straight to Traefik without a public round-trip.
  • Traefik terminates TLS via Let's Encrypt with two resolvers: dns-cloudflare (DNS-01, the only way to issue the *.lab.riversfamily.uk wildcard, used for every internal service) and http (HTTP-01, for any future zone not hosted on Cloudflare, e.g. a client site).

Trusted proxies

traefik_trusted_proxies (group_vars/swarm_managers.yml) is 10.0.0.0/8, consumed by every service that needs to trust Traefik's forwarded headers (X-Forwarded-For, X-Forwarded-Proto).