fisi is decommissioned and boma retired Netbird (ADR-036), so the old
Claude-on-fisi/Netbird access doctrine is gone. New order: VPS bastion
ProxyJump onto wg1 (primary, isolation-clean), via mamba over the boma hub
when on-site. Netbird control plane kept but demoted to legacy (operator
decision, not an access path). Network map refreshed from live probing
2026-07-17: rack LAN is 10.0.0.0/24, wifi 172.17.3.0/24 does not route to
it, 10.2.30.0/24 likely gone. Incident log covers the srv07/mf04 identity
fix and re-established access.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Switch mgmt-VLAN DHCP advertised a default gateway (192.168.88.1) that
stole mamba's default route from WiFi, cutting the netbird underlay to
askari. Fixed client-side with never-default/high-metric/ignore-auto-dns
on the wired NetworkManager profile; WiFi stays default, tunnel holds.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Scaffold for troubleshooting MakerFLOSS hosts at the makerspace.
Reference + thin runbooks model — authoritative data stays in the
source repos (AnsibleBaobabV4, MakerFLOSS_Mikrotik, MakerFLOSS).
- access.md: reach paths for mamba-on-LAN and fisi-tunneling-in
(netbird on-demand, VPS bastion, ProxyJump via kuku->mamba),
with the isolation rule.
- network-map.md: subnet pointers + open question on makerspace
addressing (10.2.30/172.17.3/10.0.0).
- runbooks/switch-crs310.md: CRS310 connectivity + lockout recovery.
- incidents/: dated log scaffold.
- CLAUDE.md: operating rules for this repo.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
