From c2833e72d2caea6afdd6df1888a0a78ad9605f92 Mon Sep 17 00:00:00 2001 From: jarvis Date: Sat, 30 May 2026 00:58:03 -0400 Subject: [PATCH] =?UTF-8?q?v2=20topology:=20Neo=20dual-homed=20=E2=80=94?= =?UTF-8?q?=20Tailscale=20for=20SSH=20mgmt,=20NetBird=20for=20services;=20?= =?UTF-8?q?clarify=20service=20isolation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- iron-legion-topology.mmd | 36 +++++++++++++++++++++++------------- iron-legion-topology.svg | 2 +- 3 files changed, 25 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 3e2c09e..dce8f12 100644 --- a/README.md +++ b/README.md @@ -125,7 +125,7 @@ The Iron Legion fleet runs **two completely separate mesh VPN overlays** managed 2. **Same CGNAT range does not mean same network.** Both Tailscale and NetBird default to `100.64.0.0/10` for overlay addressing, but devices on one cannot reach devices on the other. The coordination servers (Tailscale Inc. cloud vs. NetBird cloud/self-hosted) are completely isolated. -3. **Neo is the boundary.** Neo runs the NetBird client for user-facing services. Neo does **not** participate in the Tailscale tailnet. User-facing services are isolated from the admin/management plane by design. +3. **Neo is dual-homed but services are intentionally isolated.** Neo runs the Tailscale client so Artemis can SSH-manage the node. Neo also runs the NetBird client โ€” but the services (Nextcloud, Vaultwarden, Dockhand, Trilium) are exposed **only** through NetBird. They are intentionally unreachable via Tailscale or LAN. This is the boundary between admin and user planes. 4. **The Swarm stack (Path A) is LAN-contained.** Traefik on MK7 routes HTTP internally. Technitium handles LAN DNS. Neither Tailscale nor NetBird is required for the blueprint buyer's stack to function. diff --git a/iron-legion-topology.mmd b/iron-legion-topology.mmd index 6a49d58..da5b492 100644 --- a/iron-legion-topology.mmd +++ b/iron-legion-topology.mmd @@ -1,37 +1,39 @@ flowchart TB - subgraph TAILSCALE["๐Ÿ›ก๏ธ Tailscale Overlay โ€” Tailscale Inc. (Admin/Management)"] + subgraph TAILSCALE["๐Ÿ›ก๏ธ TAILSCALE OVERLAY โ€” Tailscale Inc. (Admin/Management)"] direction TB TSCOORD["Tailscale Coordination Server
(proprietary SaaS)"] TSART["๐Ÿค– Artemis (AI Foreman)
100.100.97.18"] TSM44["๐Ÿ”ง Mark44 (Ollama)
100.75.26.83"] TSM5["๐Ÿ“š Mark5 (Research)
100.118.67.105"] TSM7["โšก MK7 Swarm Manager
100.66.70.51"] + TSNEO["๐Ÿ–ฅ๏ธ Neo (SSH mgmt only)
Tailscale IP โ€” admin access"] end - subgraph NETBIRD["๐Ÿ•Š๏ธ NetBird Overlay โ€” WireTrustee SA (User-facing)"] + subgraph NETBIRD["๐Ÿ•Š๏ธ NETBIRD OVERLAY โ€” WireTrustee SA (User-facing)"] direction TB NBCOORD["NetBird Coordination Server
(cloud or self-hosted)"] - NBNEO["๐Ÿ–ฅ๏ธ Neo (Nebuchadnezzar)
100.92.224.74"] + NBNEO["๐Ÿ–ฅ๏ธ Neo (Service host)
NetBird IP โ€” user access"] NBNC["โ˜๏ธ Nextcloud AIO"] NBVW["๐Ÿ” Vaultwarden"] NBDOCK["๐Ÿณ Dockhand"] NBTRIL["๐Ÿ“ Trilium Notes"] end - subgraph LAN["๐Ÿ  LAN Backbone โ€” Beryl Router (OpenWrt)"] + subgraph LAN["๐Ÿ  LAN BACKBONE โ€” Beryl Router (OpenWrt)"] direction TB BERYL["๐ŸŒ Beryl 7
Gateway + DHCP
192.168.0.0/18"] - MK7LAN["โšก MK7
Traefik | Technitium | Prometheus
Beszel Hub | Portainer CE | Dozzle | Homepage
192.168.7.7"] - WORKERS["๐Ÿ”ฉ MK33 / MK34 / MK39 / MK42
Swarm Workers (G9 nodes)
192.168.0.x"] + MK7LAN["โšก MK7
Traefik ยท Technitium ยท Prometheus
Beszel Hub ยท Portainer CE ยท Dozzle ยท Homepage
Node Exporter (global)
192.168.7.7"] + WORKERS["๐Ÿ”ฉ MK33 ยท MK34 ยท MK39 ยท MK42
Swarm Workers (G9 nodes)
192.168.0.x"] end - %% Tailscale connections + %% Tailscale mesh TSCOORD ---|"admin mesh
WireGuard tunnel"| TSART TSCOORD ---|"admin mesh"| TSM44 TSCOORD ---|"admin mesh"| TSM5 TSCOORD ---|"admin mesh"| TSM7 + TSCOORD ---|"admin mesh"| TSNEO - %% NetBird connections + %% NetBird mesh NBCOORD ---|"user mesh
WireGuard tunnel"| NBNEO NBNEO ---|"Docker Compose"| NBNC NBNEO ---|"Docker Compose"| NBVW @@ -43,11 +45,19 @@ flowchart TB BERYL -.->|"DHCP lease"| WORKERS MK7LAN ---|"swarm overlay"| WORKERS - %% Cross-plane: management SSH from Tailscale to LAN - TSM7 --"SSH mgmt"--> MK7LAN + %% Cross-plane: management SSH from Tailscale to LAN nodes TSART --"SSH mgmt"--> MK7LAN + TSART --"SSH mgmt"--> TSNEO + TSM7 --"SSH mgmt"--> MK7LAN + + %% Neo dual-homed indicator + TSNEO -.->|"same physical host"| NBNEO %% Isolation boundaries - NBNEO -.-x|"๐Ÿ”’ ISOLATED
no route"| LAN - TSART -.-x|"๐Ÿ”’ ISOLATED
no route"| NBNEO - TSM7 -.-x|"๐Ÿ”’ ISOLATED
no route"| NBNEO + NBNEO -.-x|"๐Ÿ”’ INTENTIONAL ISOLATION
services NOT on Tailscale"| LAN + NBNEO -.-x|"๐Ÿ”’ INTENTIONAL ISOLATION
services NOT on Tailscale"| TAILSCALE + TSART -.-x|"๐Ÿ”’ no route"| NBNEO + TSM7 -.-x|"๐Ÿ”’ no route"| NBNEO + + style TSNEO fill:#2d3748,stroke:#63b3ed,stroke-width:2px,stroke-dasharray: 5 5 + style NBNEO fill:#2d3748,stroke:#f6ad55,stroke-width:2px,stroke-dasharray: 5 5 diff --git a/iron-legion-topology.svg b/iron-legion-topology.svg index dce6a6b..5097de2 100644 --- a/iron-legion-topology.svg +++ b/iron-legion-topology.svg @@ -1 +1 @@ -

๐Ÿ  LAN Backbone โ€” Beryl Router (OpenWrt)

๐Ÿ•Š๏ธ NetBird Overlay โ€” WireTrustee SA (User-facing)

๐Ÿ›ก๏ธ Tailscale Overlay โ€” Tailscale Inc. (Admin/Management)

admin mesh
WireGuard tunnel

admin mesh

admin mesh

admin mesh

user mesh
WireGuard tunnel

Docker Compose

Docker Compose

Docker Compose

Docker Compose

DHCP lease

DHCP lease

swarm overlay

SSH mgmt

SSH mgmt

๐Ÿ”’ ISOLATED
no route

๐Ÿ”’ ISOLATED
no route

๐Ÿ”’ ISOLATED
no route

Tailscale Coordination Server
(proprietary SaaS)

๐Ÿค– Artemis (AI Foreman)
100.100.97.18

๐Ÿ”ง Mark44 (Ollama)
100.75.26.83

๐Ÿ“š Mark5 (Research)
100.118.67.105

โšก MK7 Swarm Manager
100.66.70.51

NetBird Coordination Server
(cloud or self-hosted)

๐Ÿ–ฅ๏ธ Neo (Nebuchadnezzar)
100.92.224.74

โ˜๏ธ Nextcloud AIO

๐Ÿ” Vaultwarden

๐Ÿณ Dockhand

๐Ÿ“ Trilium Notes

๐ŸŒ Beryl 7
Gateway + DHCP
192.168.0.0/18

โšก MK7
Traefik | Technitium | Prometheus
Beszel Hub | Portainer CE | Dozzle | Homepage
192.168.7.7

๐Ÿ”ฉ MK33 / MK34 / MK39 / MK42
Swarm Workers (G9 nodes)
192.168.0.x

\ No newline at end of file +

๐Ÿ  LAN BACKBONE โ€” Beryl Router (OpenWrt)

๐Ÿ•Š๏ธ NETBIRD OVERLAY โ€” WireTrustee SA (User-facing)

๐Ÿ›ก๏ธ TAILSCALE OVERLAY โ€” Tailscale Inc. (Admin/Management)

admin mesh
WireGuard tunnel

admin mesh

admin mesh

admin mesh

admin mesh

user mesh
WireGuard tunnel

Docker Compose

Docker Compose

Docker Compose

Docker Compose

DHCP lease

DHCP lease

swarm overlay

SSH mgmt

SSH mgmt

SSH mgmt

same physical host

๐Ÿ”’ no route

๐Ÿ”’ no route

๐Ÿ”’ INTENTIONAL ISOLATION
services NOT on Tailscale

๐Ÿ”’ INTENTIONAL ISOLATION
services NOT on Tailscale

Tailscale Coordination Server
(proprietary SaaS)

๐Ÿค– Artemis (AI Foreman)
100.100.97.18

๐Ÿ”ง Mark44 (Ollama)
100.75.26.83

๐Ÿ“š Mark5 (Research)
100.118.67.105

โšก MK7 Swarm Manager
100.66.70.51

๐Ÿ–ฅ๏ธ Neo (SSH mgmt only)
Tailscale IP โ€” admin access

NetBird Coordination Server
(cloud or self-hosted)

๐Ÿ–ฅ๏ธ Neo (Service host)
NetBird IP โ€” user access

โ˜๏ธ Nextcloud AIO

๐Ÿ” Vaultwarden

๐Ÿณ Dockhand

๐Ÿ“ Trilium Notes

๐ŸŒ Beryl 7
Gateway + DHCP
192.168.0.0/18

โšก MK7
Traefik ยท Technitium ยท Prometheus
Beszel Hub ยท Portainer CE ยท Dozzle ยท Homepage
Node Exporter (global)
192.168.7.7

๐Ÿ”ฉ MK33 ยท MK34 ยท MK39 ยท MK42
Swarm Workers (G9 nodes)
192.168.0.x

\ No newline at end of file