Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Subnet routes advertised by the laptop (192.168.10.127).
+#
+# The laptop is the tailnet's ONLY subnet router. Everything else in the tailnet
+# is either an operator-managed pod (the ts-* StatefulSets in the `tailscale`
+# namespace, one per exposed Service) or a client device — none of them route.
+#
+# WHY the laptop rather than VyOS or a PVE node: it already sits on every path
+# worth reaching. It is on the LAN, it is the NFS/k3s/netboot host, and it
+# speaks OSPF with the VyOS router (vm:100), so the PVE SDN VNets show up as
+# ordinary kernel routes without adding another tailnet node.
+#
+# WHY these three:
+#   192.168.10.0/24   the LAN — PVE nodes, the AD DC, OpenBao, k3s ingress
+#   10.60.0.0/24      SDN labnet   (VLAN 100) — retrolab, future lab VMs
+#   10.61.0.0/24      SDN retronet (VLAN 110) — 86Box guests. Included on
+#                     purpose: the alternative is a second VPN or a jump box
+#                     just to reach an emulated Win98. retronet is a quarantine
+#                     network as seen from the LAN, not from the tailnet.
+#
+# The two 10.x routes are LEARNED BY OSPF, not configured here — check with
+# `ip route show proto ospf`. If VyOS stops advertising them this script still
+# reports success while the routes blackhole, so verify the kernel table too.
+#
+# ⚠️ Advertising is only half the job. A newly advertised route arrives
+# UNAPPROVED and carries no traffic until it is enabled in the admin console
+# (Machines -> laptop -> Edit route settings) or matched by an `autoApprovers`
+# entry in the tailnet policy file. Approval state is not visible in
+# `tailscale debug prefs` — that only shows what was offered. Check what was
+# accepted:
+#     sudo tailscale debug netmap | jq '.SelfNode.AllowedIPs'
+# An advertised-but-unapproved route is simply absent from that list.
+#
+# Re-running is safe: --advertise-routes replaces the whole list, so this file
+# is the complete set, not an increment.
+set -euo pipefail
+
+sudo tailscale set --advertise-routes=192.168.10.0/24,10.60.0.0/24,10.61.0.0/24
+
+sudo tailscale debug netmap | jq -r '"approved: " + (.SelfNode.AllowedIPs | join(", "))'