MakerFLOSS_Troubleshooting/network-map.md

# Network map (thin)

Pointers, not the source of truth. Authoritative data is in the source repos —
links below. Confirm live values before acting. Refreshed 2026-07-17 from
live probing (mamba wired on the rack LAN + the wg1 hub + mf01).

## Subnets seen live on 2026-07-17

| Subnet | Role | Notes / source of truth |
|--------|------|-------------------------|
| `10.0.0.0/24` | **Makerspace rack LAN** (the subnet you get wired into the rack switching). Gw `.1` (FreeBSD — likely flossfw). srv07 `.183`, mf01 `.223` (both DHCP, ssh `:7576`). Unidentified: Debian 13 trio `.10/.11/.12` (ssh `:22`, likely TaPPaaS nodes), ssh hosts `.158/.165/.209`. | live scan 2026-07-17; `AnsibleBaobabV4/host_vars/srv07.yml`, `mf01.yml` |
| `172.17.3.0/24` | **OrangeMakers house LAN / wifi** (mamba's wifi lands here). Does **not** route to `10.0.0.0/24`. `makerfloss1` recorded at `.51` — did not answer. Seen: a Raspberry Pi `.66`, a Debian 12 box `.215` (neither is ours). | live scan 2026-07-17 |
| `10.13.0.0/24` | **makerfloss WireGuard plane (`wg1`)**, hub `10.13.0.1` on the VPS, UDP `:51820`. Peers: `.2` makerfloss1 (down), **`.3` srv07 (up)**, `.5` sjat-roaming/mamba (dormant), `.6` sjat-work (down), **`.8` mf01 (up)**, `.9` flossfw (down). | `AnsibleBaobabV4/host_vars/makerfloss.yml` |
| `100.99.0.0/16` | **Netbird overlay** (legacy, kept for now — see `access.md` §D). Control plane `nb.makerfloss.eu` up; srv07 agent still enrolled (`100.99.133.190`); fisi peer gone (host decommissioned); ubongo deliberately not enrolled. | `specs/2026-05-27-makerspace-vpn-design.md` |
| `10.99.0.0/24` | **boma WireGuard hub** (homelab plane — hub on askari `.1`; ubongo `.2`, mamba `.10`). Only relevance here: it's how Claude reaches mamba from ubongo. Never bridged to makerspace nets. | `boma` repo, ADR-036 |
| `192.168.88.0/24` | CRS310 (sw01) mgmt VLAN — switch at `.1`, reachable only from the mgmt port. Post-recabling state **unverified**; sw01 p8 (mgmt) is patched out via pp01:3 and currently non-active. | `MakerFLOSS_Mikrotik`, switch runbook |
| `10.2.30.0/24` | Former CRS310 data VLAN 30. **Probably gone** — mf01 moved off it onto `10.0.0.x`, and nothing answered on it 2026-07-17. Treat references to it (older specs, host comments) as historical. | historical: `specs/2026-06-09-crs310-flat-mgmtvlan-design.md` |

## Open questions (check when on-site)

- **makerfloss1:** where is it, and is it still alive? Neither its LAN IP nor
  its wg1 peer answered.
- **The `.10/.11/.12` trio and `.158/.165/.209`:** identify and label
  (TAPPaaS nodes? APs?). Add to the hardware docs once known.
- **Switch mgmt path** after the rack re-cabling (sw01/sw06/sw07): confirm
  how to reach `192.168.88.1` and update the switch runbook.

## Public services (makerfloss VPS, `88.99.32.236`)

All TLS-terminated at the VPS via Traefik, certs via Gandi DNS-01:
`docs.makerfloss.eu`, `slides.makerfloss.eu`, `forgejo.makerfloss.eu` (git SSH
`:7577`), `mail.makerfloss.eu` (Poste.io), `discourse.makerfloss.eu`,
`snipeit.makerfloss.eu`, `nb.makerfloss.eu` (Netbird, legacy).
Source: `AnsibleBaobabV4/host_vars/makerfloss.yml`.
Initial troubleshooting workspace: access, network map, runbooks Scaffold for troubleshooting MakerFLOSS hosts at the makerspace. Reference + thin runbooks model — authoritative data stays in the source repos (AnsibleBaobabV4, MakerFLOSS_Mikrotik, MakerFLOSS). - access.md: reach paths for mamba-on-LAN and fisi-tunneling-in (netbird on-demand, VPS bastion, ProxyJump via kuku->mamba), with the isolation rule. - network-map.md: subnet pointers + open question on makerspace addressing (10.2.30/172.17.3/10.0.0). - runbooks/switch-crs310.md: CRS310 connectivity + lockout recovery. - incidents/: dated log scaffold. - CLAUDE.md: operating rules for this repo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-09 13:24:26 +02:00			`# Network map (thin)`

			`Pointers, not the source of truth. Authoritative data is in the source repos —`
access: rewrite for the ubongo era; srv07 incident; refresh network map fisi is decommissioned and boma retired Netbird (ADR-036), so the old Claude-on-fisi/Netbird access doctrine is gone. New order: VPS bastion ProxyJump onto wg1 (primary, isolation-clean), via mamba over the boma hub when on-site. Netbird control plane kept but demoted to legacy (operator decision, not an access path). Network map refreshed from live probing 2026-07-17: rack LAN is 10.0.0.0/24, wifi 172.17.3.0/24 does not route to it, 10.2.30.0/24 likely gone. Incident log covers the srv07/mf04 identity fix and re-established access. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> 2026-07-17 17:23:18 +02:00			`links below. Confirm live values before acting. Refreshed 2026-07-17 from`
			`live probing (mamba wired on the rack LAN + the wg1 hub + mf01).`

			`## Subnets seen live on 2026-07-17`

			`\| Subnet \| Role \| Notes / source of truth \|`
			`\|--------\|------\|-------------------------\|`
			\| `10.0.0.0/24` \| Makerspace rack LAN (the subnet you get wired into the rack switching). Gw `.1` (FreeBSD — likely flossfw). srv07 `.183`, mf01 `.223` (both DHCP, ssh `:7576`). Unidentified: Debian 13 trio `.10/.11/.12` (ssh `:22`, likely TaPPaaS nodes), ssh hosts `.158/.165/.209`. \| live scan 2026-07-17; `AnsibleBaobabV4/host_vars/srv07.yml`, `mf01.yml` \|
			\| `172.17.3.0/24` \| OrangeMakers house LAN / wifi (mamba's wifi lands here). Does not route to `10.0.0.0/24`. `makerfloss1` recorded at `.51` — did not answer. Seen: a Raspberry Pi `.66`, a Debian 12 box `.215` (neither is ours). \| live scan 2026-07-17 \|
			\| `10.13.0.0/24` \| makerfloss WireGuard plane (`wg1`), hub `10.13.0.1` on the VPS, UDP `:51820`. Peers: `.2` makerfloss1 (down), `.3` srv07 (up), `.5` sjat-roaming/mamba (dormant), `.6` sjat-work (down), `.8` mf01 (up), `.9` flossfw (down). \| `AnsibleBaobabV4/host_vars/makerfloss.yml` \|
			\| `100.99.0.0/16` \| Netbird overlay (legacy, kept for now — see `access.md` §D). Control plane `nb.makerfloss.eu` up; srv07 agent still enrolled (`100.99.133.190`); fisi peer gone (host decommissioned); ubongo deliberately not enrolled. \| `specs/2026-05-27-makerspace-vpn-design.md` \|
			\| `10.99.0.0/24` \| boma WireGuard hub (homelab plane — hub on askari `.1`; ubongo `.2`, mamba `.10`). Only relevance here: it's how Claude reaches mamba from ubongo. Never bridged to makerspace nets. \| `boma` repo, ADR-036 \|
			\| `192.168.88.0/24` \| CRS310 (sw01) mgmt VLAN — switch at `.1`, reachable only from the mgmt port. Post-recabling state unverified; sw01 p8 (mgmt) is patched out via pp01:3 and currently non-active. \| `MakerFLOSS_Mikrotik`, switch runbook \|
			\| `10.2.30.0/24` \| Former CRS310 data VLAN 30. Probably gone — mf01 moved off it onto `10.0.0.x`, and nothing answered on it 2026-07-17. Treat references to it (older specs, host comments) as historical. \| historical: `specs/2026-06-09-crs310-flat-mgmtvlan-design.md` \|

			`## Open questions (check when on-site)`

			`- makerfloss1: where is it, and is it still alive? Neither its LAN IP nor`
			`its wg1 peer answered.`
			- The `.10/.11/.12` trio and `.158/.165/.209`: identify and label
			`(TAPPaaS nodes? APs?). Add to the hardware docs once known.`
			`- Switch mgmt path after the rack re-cabling (sw01/sw06/sw07): confirm`
			how to reach `192.168.88.1` and update the switch runbook.
Initial troubleshooting workspace: access, network map, runbooks Scaffold for troubleshooting MakerFLOSS hosts at the makerspace. Reference + thin runbooks model — authoritative data stays in the source repos (AnsibleBaobabV4, MakerFLOSS_Mikrotik, MakerFLOSS). - access.md: reach paths for mamba-on-LAN and fisi-tunneling-in (netbird on-demand, VPS bastion, ProxyJump via kuku->mamba), with the isolation rule. - network-map.md: subnet pointers + open question on makerspace addressing (10.2.30/172.17.3/10.0.0). - runbooks/switch-crs310.md: CRS310 connectivity + lockout recovery. - incidents/: dated log scaffold. - CLAUDE.md: operating rules for this repo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-09 13:24:26 +02:00
			## Public services (makerfloss VPS, `88.99.32.236`)

			`All TLS-terminated at the VPS via Traefik, certs via Gandi DNS-01:`
			`docs.makerfloss.eu`, `slides.makerfloss.eu`, `forgejo.makerfloss.eu` (git SSH
			`:7577`), `mail.makerfloss.eu` (Poste.io), `discourse.makerfloss.eu`,
access: rewrite for the ubongo era; srv07 incident; refresh network map fisi is decommissioned and boma retired Netbird (ADR-036), so the old Claude-on-fisi/Netbird access doctrine is gone. New order: VPS bastion ProxyJump onto wg1 (primary, isolation-clean), via mamba over the boma hub when on-site. Netbird control plane kept but demoted to legacy (operator decision, not an access path). Network map refreshed from live probing 2026-07-17: rack LAN is 10.0.0.0/24, wifi 172.17.3.0/24 does not route to it, 10.2.30.0/24 likely gone. Incident log covers the srv07/mf04 identity fix and re-established access. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> 2026-07-17 17:23:18 +02:00			`snipeit.makerfloss.eu`, `nb.makerfloss.eu` (Netbird, legacy).
Initial troubleshooting workspace: access, network map, runbooks Scaffold for troubleshooting MakerFLOSS hosts at the makerspace. Reference + thin runbooks model — authoritative data stays in the source repos (AnsibleBaobabV4, MakerFLOSS_Mikrotik, MakerFLOSS). - access.md: reach paths for mamba-on-LAN and fisi-tunneling-in (netbird on-demand, VPS bastion, ProxyJump via kuku->mamba), with the isolation rule. - network-map.md: subnet pointers + open question on makerspace addressing (10.2.30/172.17.3/10.0.0). - runbooks/switch-crs310.md: CRS310 connectivity + lockout recovery. - incidents/: dated log scaffold. - CLAUDE.md: operating rules for this repo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-09 13:24:26 +02:00			Source: `AnsibleBaobabV4/host_vars/makerfloss.yml`.