diff --git a/docs/runbooks/build-the-nas.md b/docs/runbooks/build-the-nas.md index 6f550193..86a8887f 100644 --- a/docs/runbooks/build-the-nas.md +++ b/docs/runbooks/build-the-nas.md @@ -5,7 +5,8 @@ `10.0.40.30` **Time:** §0 is about half an hour and needs no drives. §1–§7 is about twenty minutes once the drives are in hand. -**You will need:** a console on `smaug` (or its web UI), the pfSense UI on +**You will need:** a console on `smaug` (or its web UI), `neo`'s web UI at +`http://10.7.7.2` and a yellow Cat6 lead for §0.2b, the pfSense UI on `morpheus`, a shell on the monitoring host for §0.6, and the two Exos X20 drives for §1 onward. @@ -18,10 +19,15 @@ drives for §1 onward. > listing and recorded in [`hardware.md`](../hardware.md). > > **§0 is complete as of 2026-09-16.** BIOS flashed (§0.1), AMT found on its -> factory-default credential and disabled (§0.2), the static set (§0.3), the -> reservation added (§0.4), and the rules created as four host- and port-scoped -> passes rather than three (§0.5) — `443,8096` from Hicks split into two rules, -> `9100` and `22` from `10.0.99.20`. +> factory-default credential and disabled (§0.2), the switch port moved into +> CasaBonita untagged (§0.2b), the static set (§0.3), the reservation added +> (§0.4), and the rules created as four host- and port-scoped passes rather +> than three (§0.5) — `443,8096` from Hicks split into two rules, `9100` and +> `22` from `10.0.99.20`. +> +> **§0.2b is the one step here with no date of its own.** It was added after the +> fact by [#481](https://github.com/Gerrrt/HomeLab/issues/481), which is why it +> records a reading rather than a day's work. > > §0.6 verified from `morpheus` rather than from the UI: every pass sits above > *Block access to CasaBonita* on its interface (167–168 before 169 on @@ -85,6 +91,65 @@ its own issue — the precedent is There is also an `ME_DIS` header on the board if the answer turns out to be "remove it entirely". +### §0.2b — Move its switch port to CasaBonita + +> **Done, and the only step in §0 without a date.** Read off the switch on +> 2026-09-17: `smaug` is on **port 15 of `neo`**, whose PVID is **40**, untagged +> only, with `smaug`'s MAC learned on it in VLAN 40 and the link up at **1000M +> full** — the fastest thing answering on CasaBonita when it was read, which is +> what identifies the port. The move itself was never recorded. The map was last +> read on 2026-09-04 with port 15 still ImaginationLAN's and matching the +> documented map exactly, so it happened between that day and this one, and the +> install on 2026-09-16 is the obvious occasion — an inference, not a reading. +> The section below is kept for the next machine, and for the next time this one +> is re-cabled. +> +> **Port 15 is a fact about `neo`.** The MikroTik bought to replace it +> ([#444](https://github.com/Gerrrt/HomeLab/issues/444)) will need its own +> reading, and this step run again. + +In `neo`'s web UI at `http://10.7.7.2`, add the port to CasaBonita's untagged +members in the static VLAN table, take it out of ImaginationLAN's, and set its +**PVID to 40**. What you are making is a **Yellow access port, untagged VLAN 40 +— no trunk, no tagged port**, the same shape +[`build-the-playground.md`](build-the-playground.md) asks for in Green on the +lab segment. The UI is plain HTTP, and that is decided rather than outstanding +([ADR-0018](../adr/0018-name-the-switch-and-leave-its-ui-on-plain-http.md)). + +**Read both tables back after saving.** Membership and PVID are set in separate +places on this firmware, and a port with the right membership and a stale PVID +is the failure below wearing a working port's clothes. + +Not **port 1**, which is the trunk to `morpheus`, and not **port 3**, which +feeds the unmanaged shelf switch that `prometheus` and `oracle` hang off. + +**Then re-patch it yellow.** CasaBonita is the yellow cable and ImaginationLAN +the green one +([ADR-0009](../adr/0009-colour-vlans-by-cable-not-by-trust.md)), so a port taken +from the lab segment still has a green cable in it. That ADR makes colour +evidence rather than decoration, and a green cable in a CasaBonita port is +exactly what destroys it. + +**This comes before §0.3, and the order is not cosmetic.** §0.3 sets a static on +`10.0.40.0/24`, and TrueNAS applies it on a test-and-confirm timer: on a port +still carrying VLAN 30 that static loses contact the moment it is applied and +rolls itself back. If it somehow sticks, the result is worse — a machine on the +lab segment holding a media-segment address, which no inbound rule reaches, so +*"can I reach the NAS"* fails in a way **indistinguishable from a firewall +fault**. §0.5 warns about the mirror image of that, a rule appended where it +matches nothing and leaves the question passing for the wrong reason; this one +leaves it failing for the wrong reason, and sends you to the pfSense UI, where +the answer is not. + +**Write the port number down**, which is what this section is for. §0.3 and +§0.4 hold the address twice because either alone is a single point of drift; a +port that nothing records is worse than either, because a successor re-cabling +this machine has nothing to re-cable it to. Only this machine's own port belongs +here — the full map is the wiki's `infrastructure/switching` page and stays +there, because +[ADR-0026](../adr/0026-check-the-documents-where-the-truth-is.md) keeps facts +where they are checked rather than copying them somewhere nothing checks them. + ### §0.3 — Give it the static address In the TrueNAS UI, **Network → Interfaces**, edit the onboard NIC: remove DHCP @@ -291,6 +356,9 @@ Jellyfin binds `8096`, reads `erebor/media`, and writes its state to - A Hicks workstation reaches `https://10.0.40.30` and `http://10.0.40.30:8096` - The monitoring host reaches `9100` and **nothing else** - The `igc0.40` tripwire counter is **still zero** +- Port 15 on `neo` reads PVID **40**, untagged, with `smaug`'s MAC learned on it + in VLAN 40 — read in the switch UI, and **not** inferred from the host having + an address - `zpool status erebor` is `ONLINE` with no errors - Both Exos self-tests from §2 completed without error