diff --git a/README.md b/README.md index 3e2c09e..dce8f12 100644 --- a/README.md +++ b/README.md @@ -125,7 +125,7 @@ The Iron Legion fleet runs **two completely separate mesh VPN overlays** managed 2. **Same CGNAT range does not mean same network.** Both Tailscale and NetBird default to `100.64.0.0/10` for overlay addressing, but devices on one cannot reach devices on the other. The coordination servers (Tailscale Inc. cloud vs. NetBird cloud/self-hosted) are completely isolated. -3. **Neo is the boundary.** Neo runs the NetBird client for user-facing services. Neo does **not** participate in the Tailscale tailnet. User-facing services are isolated from the admin/management plane by design. +3. **Neo is dual-homed but services are intentionally isolated.** Neo runs the Tailscale client so Artemis can SSH-manage the node. Neo also runs the NetBird client โ but the services (Nextcloud, Vaultwarden, Dockhand, Trilium) are exposed **only** through NetBird. They are intentionally unreachable via Tailscale or LAN. This is the boundary between admin and user planes. 4. **The Swarm stack (Path A) is LAN-contained.** Traefik on MK7 routes HTTP internally. Technitium handles LAN DNS. Neither Tailscale nor NetBird is required for the blueprint buyer's stack to function. diff --git a/iron-legion-topology.mmd b/iron-legion-topology.mmd index 6a49d58..da5b492 100644 --- a/iron-legion-topology.mmd +++ b/iron-legion-topology.mmd @@ -1,37 +1,39 @@ flowchart TB - subgraph TAILSCALE["๐ก๏ธ Tailscale Overlay โ Tailscale Inc. (Admin/Management)"] + subgraph TAILSCALE["๐ก๏ธ TAILSCALE OVERLAY โ Tailscale Inc. (Admin/Management)"] direction TB TSCOORD["Tailscale Coordination Server(proprietary SaaS)"] TSART["๐ค Artemis (AI Foreman)100.100.97.18"] TSM44["๐ง Mark44 (Ollama)100.75.26.83"] TSM5["๐ Mark5 (Research)100.118.67.105"] TSM7["โก MK7 Swarm Manager100.66.70.51"] + TSNEO["๐ฅ๏ธ Neo (SSH mgmt only)Tailscale IP โ admin access"] end - subgraph NETBIRD["๐๏ธ NetBird Overlay โ WireTrustee SA (User-facing)"] + subgraph NETBIRD["๐๏ธ NETBIRD OVERLAY โ WireTrustee SA (User-facing)"] direction TB NBCOORD["NetBird Coordination Server(cloud or self-hosted)"] - NBNEO["๐ฅ๏ธ Neo (Nebuchadnezzar)100.92.224.74"] + NBNEO["๐ฅ๏ธ Neo (Service host)NetBird IP โ user access"] NBNC["โ๏ธ Nextcloud AIO"] NBVW["๐ Vaultwarden"] NBDOCK["๐ณ Dockhand"] NBTRIL["๐ Trilium Notes"] end - subgraph LAN["๐ LAN Backbone โ Beryl Router (OpenWrt)"] + subgraph LAN["๐ LAN BACKBONE โ Beryl Router (OpenWrt)"] direction TB BERYL["๐ Beryl 7Gateway + DHCP192.168.0.0/18"] - MK7LAN["โก MK7Traefik | Technitium | PrometheusBeszel Hub | Portainer CE | Dozzle | Homepage192.168.7.7"] - WORKERS["๐ฉ MK33 / MK34 / MK39 / MK42Swarm Workers (G9 nodes)192.168.0.x"] + MK7LAN["โก MK7Traefik ยท Technitium ยท PrometheusBeszel Hub ยท Portainer CE ยท Dozzle ยท HomepageNode Exporter (global)192.168.7.7"] + WORKERS["๐ฉ MK33 ยท MK34 ยท MK39 ยท MK42Swarm Workers (G9 nodes)192.168.0.x"] end - %% Tailscale connections + %% Tailscale mesh TSCOORD ---|"admin meshWireGuard tunnel"| TSART TSCOORD ---|"admin mesh"| TSM44 TSCOORD ---|"admin mesh"| TSM5 TSCOORD ---|"admin mesh"| TSM7 + TSCOORD ---|"admin mesh"| TSNEO - %% NetBird connections + %% NetBird mesh NBCOORD ---|"user meshWireGuard tunnel"| NBNEO NBNEO ---|"Docker Compose"| NBNC NBNEO ---|"Docker Compose"| NBVW @@ -43,11 +45,19 @@ flowchart TB BERYL -.->|"DHCP lease"| WORKERS MK7LAN ---|"swarm overlay"| WORKERS - %% Cross-plane: management SSH from Tailscale to LAN - TSM7 --"SSH mgmt"--> MK7LAN + %% Cross-plane: management SSH from Tailscale to LAN nodes TSART --"SSH mgmt"--> MK7LAN + TSART --"SSH mgmt"--> TSNEO + TSM7 --"SSH mgmt"--> MK7LAN + + %% Neo dual-homed indicator + TSNEO -.->|"same physical host"| NBNEO %% Isolation boundaries - NBNEO -.-x|"๐ ISOLATEDno route"| LAN - TSART -.-x|"๐ ISOLATEDno route"| NBNEO - TSM7 -.-x|"๐ ISOLATEDno route"| NBNEO + NBNEO -.-x|"๐ INTENTIONAL ISOLATIONservices NOT on Tailscale"| LAN + NBNEO -.-x|"๐ INTENTIONAL ISOLATIONservices NOT on Tailscale"| TAILSCALE + TSART -.-x|"๐ no route"| NBNEO + TSM7 -.-x|"๐ no route"| NBNEO + + style TSNEO fill:#2d3748,stroke:#63b3ed,stroke-width:2px,stroke-dasharray: 5 5 + style NBNEO fill:#2d3748,stroke:#f6ad55,stroke-width:2px,stroke-dasharray: 5 5 diff --git a/iron-legion-topology.svg b/iron-legion-topology.svg index dce6a6b..5097de2 100644 --- a/iron-legion-topology.svg +++ b/iron-legion-topology.svg @@ -1 +1 @@ -๐ LAN Backbone โ Beryl Router (OpenWrt)๐๏ธ NetBird Overlay โ WireTrustee SA (User-facing)๐ก๏ธ Tailscale Overlay โ Tailscale Inc. (Admin/Management)admin meshWireGuard tunneladmin meshadmin meshadmin meshuser meshWireGuard tunnelDocker ComposeDocker ComposeDocker ComposeDocker ComposeDHCP leaseDHCP leaseswarm overlaySSH mgmtSSH mgmt๐ ISOLATEDno route๐ ISOLATEDno route๐ ISOLATEDno routeTailscale Coordination Server(proprietary SaaS)๐ค Artemis (AI Foreman)100.100.97.18๐ง Mark44 (Ollama)100.75.26.83๐ Mark5 (Research)100.118.67.105โก MK7 Swarm Manager100.66.70.51NetBird Coordination Server(cloud or self-hosted)๐ฅ๏ธ Neo (Nebuchadnezzar)100.92.224.74โ๏ธ Nextcloud AIO๐ Vaultwarden๐ณ Dockhand๐ Trilium Notes๐ Beryl 7Gateway + DHCP192.168.0.0/18โก MK7Traefik | Technitium | PrometheusBeszel Hub | Portainer CE | Dozzle | Homepage192.168.7.7๐ฉ MK33 / MK34 / MK39 / MK42Swarm Workers (G9 nodes)192.168.0.x \ No newline at end of file +๐ LAN BACKBONE โ Beryl Router (OpenWrt)๐๏ธ NETBIRD OVERLAY โ WireTrustee SA (User-facing)๐ก๏ธ TAILSCALE OVERLAY โ Tailscale Inc. (Admin/Management)admin meshWireGuard tunneladmin meshadmin meshadmin meshadmin meshuser meshWireGuard tunnelDocker ComposeDocker ComposeDocker ComposeDocker ComposeDHCP leaseDHCP leaseswarm overlaySSH mgmtSSH mgmtSSH mgmtsame physical host๐ no route๐ no route๐ INTENTIONAL ISOLATIONservices NOT on Tailscale๐ INTENTIONAL ISOLATIONservices NOT on TailscaleTailscale Coordination Server(proprietary SaaS)๐ค Artemis (AI Foreman)100.100.97.18๐ง Mark44 (Ollama)100.75.26.83๐ Mark5 (Research)100.118.67.105โก MK7 Swarm Manager100.66.70.51๐ฅ๏ธ Neo (SSH mgmt only)Tailscale IP โ admin accessNetBird Coordination Server(cloud or self-hosted)๐ฅ๏ธ Neo (Service host)NetBird IP โ user accessโ๏ธ Nextcloud AIO๐ Vaultwarden๐ณ Dockhand๐ Trilium Notes๐ Beryl 7Gateway + DHCP192.168.0.0/18โก MK7Traefik ยท Technitium ยท PrometheusBeszel Hub ยท Portainer CE ยท Dozzle ยท HomepageNode Exporter (global)192.168.7.7๐ฉ MK33 ยท MK34 ยท MK39 ยท MK42Swarm Workers (G9 nodes)192.168.0.x \ No newline at end of file
๐ LAN Backbone โ Beryl Router (OpenWrt)
๐๏ธ NetBird Overlay โ WireTrustee SA (User-facing)
๐ก๏ธ Tailscale Overlay โ Tailscale Inc. (Admin/Management)
admin meshWireGuard tunnel
admin mesh
user meshWireGuard tunnel
Docker Compose
DHCP lease
swarm overlay
SSH mgmt
๐ ISOLATEDno route
Tailscale Coordination Server(proprietary SaaS)
๐ค Artemis (AI Foreman)100.100.97.18
๐ง Mark44 (Ollama)100.75.26.83
๐ Mark5 (Research)100.118.67.105
โก MK7 Swarm Manager100.66.70.51
NetBird Coordination Server(cloud or self-hosted)
๐ฅ๏ธ Neo (Nebuchadnezzar)100.92.224.74
โ๏ธ Nextcloud AIO
๐ Vaultwarden
๐ณ Dockhand
๐ Trilium Notes
๐ Beryl 7Gateway + DHCP192.168.0.0/18
โก MK7Traefik | Technitium | PrometheusBeszel Hub | Portainer CE | Dozzle | Homepage192.168.7.7
๐ฉ MK33 / MK34 / MK39 / MK42Swarm Workers (G9 nodes)192.168.0.x
๐ LAN BACKBONE โ Beryl Router (OpenWrt)
๐๏ธ NETBIRD OVERLAY โ WireTrustee SA (User-facing)
๐ก๏ธ TAILSCALE OVERLAY โ Tailscale Inc. (Admin/Management)
same physical host
๐ no route
๐ INTENTIONAL ISOLATIONservices NOT on Tailscale
๐ฅ๏ธ Neo (SSH mgmt only)Tailscale IP โ admin access
๐ฅ๏ธ Neo (Service host)NetBird IP โ user access
โก MK7Traefik ยท Technitium ยท PrometheusBeszel Hub ยท Portainer CE ยท Dozzle ยท HomepageNode Exporter (global)192.168.7.7
๐ฉ MK33 ยท MK34 ยท MK39 ยท MK42Swarm Workers (G9 nodes)192.168.0.x