7.3 KiB
Access — reaching MakerFLOSS / makerspace hosts
How to get a shell on the hosts we troubleshoot, from each place you might be working. Read the section that matches your situation.
Rewritten 2026-07-17 for the ubongo era (fisi decommissioned, boma ADR-036). Live-verified facts are dated; everything else is best-known and can drift.
There are two actors:
- You (sjat) — at the makerspace with mamba (laptop), or elsewhere.
- Claude — lives on ubongo (homelab control node,
10.20.10.151) and must tunnel in to help at the makerspace. fisi is gone; anything that says fisi is stale.
The hosts and where they live
| Host | Address | SSH | Where it sits | Notes |
|---|---|---|---|---|
| makerfloss VPS | 88.99.32.236 / makerfloss.eu |
:7576 |
Public (Hetzner) | Public entrypoint + bastion. Forgejo on :7577. wg1 hub 10.13.0.1 (UDP 51820). Netbird control plane nb.makerfloss.eu (legacy — kept for now, see §D). |
| srv07 (ex-mf04) | wg1 10.13.0.3 (canonical); rack LAN 10.0.0.183 (DHCP) |
:7576 |
Makerspace rack (rack01, shf02/1) | Testmachine, Debian 13. Renamed mf04 → srv07 on 2026-07-17 (matches sticker). wg unit wg-quick@mf-srv07 auto-dials the VPS on boot. |
| mf01 (docs: srv02) | wg1 10.13.0.8; rack LAN 10.0.0.223 (DHCP) |
:7576 |
Makerspace rack | Docker/dev host, publishes *.mf01.makerfloss.eu via the VPS. OS hostname still mf01. |
| makerfloss1 | recorded 172.17.3.51 |
:7576 |
OrangeMakers LAN? | Did not answer 2026-07-17 (LAN or wg1 .2). Status unknown — verify on-site before relying on it. |
| flossfw | wg1 10.13.0.9; likely the rack gateway 10.0.0.1 |
:22 |
Makerspace rack | TaPPaaS FLOSSFirewall (FreeBSD). wg1 peer down 2026-07-17. See runbooks/ for peer-key swap on operator onboarding. |
| crs310-maker (switch) | mgmt 192.168.88.1 |
:22 |
Makerspace rack (sw01) | Mgmt VLAN reachable only from the mgmt port (sw01 p8, patched out via pp01:3, currently non-active). Rack re-cabling means the switch runbook may be stale — verify on-site. |
| mamba (laptop) | LAN-dependent | :7576 |
Roams | boma wg spoke 10.99.0.10 (how Claude reaches it anywhere); makerfloss wg1 roaming peer 10.13.0.5 (profile dormant, hub still has the peer); Netbird peer (legacy). |
The rack LAN is 10.0.0.0/24 (gw .1). Also seen there 2026-07-17: a trio of
fresh Debian 13 boxes at .10/.11/.12 (ssh :22, unidentified — likely
TaPPaaS cluster nodes) and unidentified ssh hosts at .158/.165/.209.
A. You're at the makerspace with mamba
Plug in the cable. Wired, mamba lands on the rack LAN (10.0.0.0/24).
The wifi (172.17.3.0/24, OrangeMakers house LAN) does not route to the
rack LAN (verified 2026-07-17) — wifi-only is not enough.
ssh -p 7576 sjat@10.0.0.183 # srv07 by its current DHCP lease
ssh -p 7576 sjat@10.0.0.223 # mf01
The leases are DHCP and can drift; the wg1 addresses (§B) are the stable
names. If a box doesn't answer, check the physical layer first — srv07 was
dark for weeks because its patch-panel run lost its rear patch (see
incidents/2026-07-17-srv07-access.md).
B. You're roaming (anywhere with internet)
Single hop via the VPS bastion — works with your normal key, nothing to bring up first:
ssh -J sjat@makerfloss.eu:7576 -p 7576 sjat@10.13.0.3 # srv07
ssh -J sjat@makerfloss.eu:7576 -p 7576 sjat@10.13.0.8 # mf01
This rides each box's own always-on wg1 tunnel to the VPS, so it survives
makerspace LAN renumbering. Verified end-to-end 2026-07-17.
Alternative: bring up mamba's own wg1 roaming profile (10.13.0.5, config
hand-deployed on mamba) and reach 10.13.0.x directly without the jump. The
hub still carries the peer; the profile has simply not been up lately.
C. Claude tunneling in from ubongo
Ordered by preference under the isolation rule (§E). ubongo has no Netbird agent (removed estate-wide, boma ADR-036) — the old fisi/Netbird path is gone.
C1. VPS bastion (primary)
Same as §B: ubongo only ever talks to the public VPS, which hops onward over
wg1. No makerspace network ever exists on ubongo.
ssh -J sjat@makerfloss.eu:7576 -p 7576 sjat@10.13.0.3 # srv07
First use on a fresh control node: accept/pin makerfloss.eu's host key.
Key state (2026-08-16): ubongo's claude key (~/.ssh/id_ed25519.pub,
claude@ubongo) is appended to ~sjat/.ssh/authorized_keys on both the VPS
and mf01 — done by hand via mamba, not via the users catalog in
AnsibleBaobabV4/group_vars/all/50-users_catalog.yml, which still lists only
the mamba + phone keys. A users-play run against those hosts will drop it again
unless the catalog is updated first (TODO). Verified working end-to-end from
ubongo the same day.
C2. Via mamba (when mamba is at the makerspace)
ubongo reaches mamba anywhere over the boma wg hub (ssh mamba =
10.99.0.10:7576, pinned in the boma-managed ssh config). If mamba is wired
at the makerspace, hop onward to the rack LAN:
ssh -o ProxyJump=mamba -p 7576 sjat@10.0.0.183 # srv07 via mamba
Useful when the VPS or a box's wg1 tunnel is down but the LAN is up (this is how srv07 was found and fixed on 2026-07-17). Breaks when mamba leaves.
Choosing
| Need | Use |
|---|---|
| Reach srv07/mf01/VPS services, any time | C1 (bastion) |
| Box's wg1 is down / raw LAN work, mamba on-site | C2 (via mamba) |
| The switch mgmt plane | Neither directly — needs a host on the mgmt port; see the switch runbook and verify the post-recabling mgmt path on-site. |
D. Netbird (legacy — kept, not used for access)
The self-hosted control plane nb.makerfloss.eu still runs on the VPS, and
srv07's agent is still enrolled (100.99.133.190). It is no longer an
access path: fisi (the only Claude-side peer) is decommissioned, ubongo is
deliberately not enrolled (isolation + boma ADR-036 doctrine: static
WireGuard, config-as-code, no coordinator). Operator decision 2026-07-17:
keep it running for now; do not enroll new peers for management access.
Retirement is the eventual direction — that decision is logged, not taken.
E. Isolation rule (unchanged, important)
Keep the makerspace and the homelab apart. ubongo must not hold a standing tunnel into the makerspace and must not join makerspace overlays (wg1, Netbird). The bastion path (C1) puts no makerspace network on ubongo at all; the mamba path (C2) rides boma's own hub and ends at mamba. The concern is preventing any compromise at the makerspace from reaching the homelab.
F. Secrets & credentials (where they live — not stored here)
- Ansible vault (baobab/prod):
~/.ansible/vault-keys/prod.txt(present on ubongo); secrets inAnsibleBaobabV4/group_vars/all/90-secrets.vault.yml. WG/Netbird/service secrets arevault_*keys there (vault_wireguard_makerfloss_peers.*— srv07's keypair is still under the historical namemf04). - Ansible vault (switch): identity
makerfloss,~/.ansible/vault-keys/makerfloss.txt; switch admin password inMakerFLOSS_Mikrotik/group_vars/mikrotik.vault.yml. - SSH: operator key
~/.ssh/id_ed25519; project-wide SSH port is 7576 (switch SSH:22, flossfw:22, Forgejo git:7577).
Never commit secrets to this repo.