ADR-0017 rev 2: two switches — the PE is a dedicated CCTV island, no VLAN table anywhere
Viktor asked to verify free ports on the garage switch (192.168.1.6) before finalizing. Logging into it showed it is NOT the TL-SG105PE from the plan but a pre-existing non-PoE TL-SG105E with 4 of 5 ports in use (apartment uplink, R730 LAN1, 4G router, UPS) - the single-shared-switch port-VLAN design written earlier today was based on conflating the two devices. Corrected: the new TL-SG105PE carries ONLY camera + eno2 uplink (mgmt 10.0.30.6 inside the segment), the old switch is untouched, and no VLAN config exists anywhere. ADR, topology SVG and networking.md updated to match. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin
parent
b761701994
commit
e11bd6e893
3 changed files with 86 additions and 78 deletions
|
|
@ -15,10 +15,13 @@ untagged pfSense interface per segment.
|
|||
|
||||
**Decision:** the CCTV segment (`dCCTV`, 10.0.30.1/24) rides a dedicated
|
||||
physical leg — R730 `eno2` (spare) → new bridge `vmbr2` → pfSense `net3`
|
||||
(vtnet3), untagged end-to-end. The shared TL-SG105PE PoE switch in the rack
|
||||
splits via port-based VLANs: {camera port, eno2 uplink} in an internal VLAN,
|
||||
{home-LAN uplink, 4G router 192.168.1.7, UPS mgmt, switch mgmt 192.168.1.6}
|
||||
stay in VLAN 1. Cameras are untrusted: default-deny on dCCTV with a single
|
||||
(vtnet3), untagged end-to-end. The new TL-SG105PE PoE switch is a **dedicated
|
||||
CCTV island**: camera in a PoE port, one port patched to eno2, no VLAN table
|
||||
at all, mgmt IP inside the segment (10.0.30.6 via Kea). The existing garage
|
||||
TL-SG105E (192.168.1.6 — apartment uplink, R730 LAN1, 4G router 192.168.1.7,
|
||||
UPS mgmt; exactly one free port) is untouched — it has no PoE and no spare
|
||||
port pair, which is also why the two roles cannot share one switch.
|
||||
Cameras are untrusted: default-deny on dCCTV with a single
|
||||
NTP-to-gateway exception; Frigate (k8s) pulls RTSP in; ha-sofia (192.168.1.8)
|
||||
may reach ISAPI/RTSP directly; home-LAN clients route in via an AX6000 static
|
||||
route (10.0.30.0/24 via 192.168.1.2). 10.0.30.0/24 is deliberately NOT in the
|
||||
|
|
@ -38,11 +41,17 @@ route (10.0.30.0/24 via 192.168.1.2). 10.0.30.0/24 is deliberately NOT in the
|
|||
## Consequences
|
||||
|
||||
- eno2 is consumed; eno3/eno4 remain the last spare NICs on the R730.
|
||||
- The TL-SG105PE is now load-bearing shared infra: it carries pfSense's
|
||||
backup-WAN path (4G router), UPS mgmt, AND the CCTV segment. Its Easy
|
||||
Smart mgmt UI answers on every port regardless of VLAN — mitigated by a
|
||||
strong password; residual L2 risk accepted.
|
||||
- Adding a future camera = one PoE port in the CCTV VLAN + a Kea
|
||||
reservation; no pfSense/PVE work.
|
||||
- Two Easy Smart switches live in the rack: the OLD TL-SG105E at 192.168.1.6
|
||||
remains the load-bearing shared one (apartment uplink, R730 LAN1, pfSense's
|
||||
backup-WAN path via the 4G router, UPS mgmt — one port free); the NEW
|
||||
TL-SG105PE carries only CCTV. The Easy Smart mgmt-answers-on-every-port
|
||||
quirk is therefore contained: the PE's mgmt UI is only L2-adjacent to
|
||||
cameras, and pfSense still gates all L3.
|
||||
- Adding a future camera = one free PoE port on the PE + a Kea
|
||||
reservation; no pfSense/PVE/VLAN work.
|
||||
- 2026-07-02 correction: an earlier revision of this ADR described ONE shared
|
||||
PE switch with a port-based VLAN split — written before discovering the
|
||||
live 192.168.1.6 device is a separate, older non-PoE TL-SG105E. No VLAN
|
||||
table exists anywhere in the final design.
|
||||
- Frigate's ADR-0016 VRAM budget was bumped 2000 → 2300 MiB for the extra
|
||||
NVDEC stream.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
<svg xmlns="http://www.w3.org/2000/svg" width="1600" height="880" viewBox="0 0 1600 880" font-family="system-ui, -apple-system, 'Segoe UI', Roboto, sans-serif">
|
||||
<!-- ADR-0017 dCCTV topology. Colors: reference dataviz palette (light mode).
|
||||
blue #2a78d6 = home LAN / VLAN1 · violet #4a3aa7 = dCCTV / VLAN30 ·
|
||||
<!-- ADR-0017 dCCTV topology (two-switch revision). Colors: reference dataviz
|
||||
palette (light mode). blue #2a78d6 = home LAN · violet #4a3aa7 = dCCTV ·
|
||||
aqua #1baf7a = dKubernetes · yellow #eda100 = dManagementsVms ·
|
||||
green #008300 = allowed flow · red #e34948 = denied flow -->
|
||||
<defs>
|
||||
|
|
@ -19,7 +19,7 @@
|
|||
|
||||
<!-- title -->
|
||||
<text x="40" y="42" font-size="26" font-weight="700" fill="#0b0b0b">ADR-0017 — CCTV segment on a dedicated pfSense leg</text>
|
||||
<text x="40" y="66" font-size="15" fill="#52514e">Sofia/Vermont · as-built 2026-07-02 · dashed = camera-day · untagged on every wire</text>
|
||||
<text x="40" y="66" font-size="15" fill="#52514e">Sofia/Vermont · as-built 2026-07-02 · dashed = camera-day · no VLANs anywhere — isolation is physical</text>
|
||||
|
||||
<!-- camera -> everything else (denied): kept above the zones, below the subtitle -->
|
||||
<path d="M240,168 C520,104 900,104 1148,140" fill="none" stroke="#e34948" stroke-width="3" marker-end="url(#arrRed)"/>
|
||||
|
|
@ -39,55 +39,53 @@
|
|||
<text x="80" y="252" font-size="12.5" fill="#52514e">DNS: garage-cam.viktorbarzin.lan</text>
|
||||
<text x="80" y="270" font-size="12.5" fill="#52514e">PoE from switch · cloud/P2P off</text>
|
||||
|
||||
<!-- camera cable to switch P4 (camera day, dashed) -->
|
||||
<path d="M160,308 L160,352" fill="none" stroke="#52514e" stroke-width="2" stroke-dasharray="6,5" marker-end="url(#arrGray)"/>
|
||||
<text x="172" y="334" font-size="12" fill="#52514e">cat6 in conduit · PoE</text>
|
||||
<!-- camera cable to PE switch (camera day, dashed) -->
|
||||
<path d="M160,308 L160,390" fill="none" stroke="#52514e" stroke-width="2" stroke-dasharray="6,5" marker-end="url(#arrGray)"/>
|
||||
<text x="172" y="344" font-size="12" fill="#52514e">cat6 in conduit · PoE</text>
|
||||
|
||||
<!-- ═════════ RACK zone ═════════ -->
|
||||
<rect x="40" y="360" width="560" height="240" rx="10" fill="#0b0b0b" fill-opacity="0.03" stroke="#b9b8b2"/>
|
||||
<text x="56" y="386" font-size="13" font-weight="700" fill="#52514e" letter-spacing="1">RACK — GARAGE</text>
|
||||
<rect x="40" y="360" width="560" height="265" rx="10" fill="#0b0b0b" fill-opacity="0.03" stroke="#b9b8b2"/>
|
||||
<text x="56" y="384" font-size="13" font-weight="700" fill="#52514e" letter-spacing="1">RACK — GARAGE · TWO SWITCHES</text>
|
||||
|
||||
<!-- TL-SG105PE -->
|
||||
<rect x="64" y="400" width="512" height="176" rx="8" fill="#ffffff" stroke="#8a8984"/>
|
||||
<text x="80" y="426" font-size="15" font-weight="700" fill="#0b0b0b">TL-SG105PE</text>
|
||||
<text x="185" y="426" font-size="12.5" fill="#52514e">shared PoE switch · mgmt 192.168.1.6 (VLAN 1, Kea)</text>
|
||||
<text x="80" y="446" font-size="12.5" fill="#52514e">port-based VLANs, everything untagged</text>
|
||||
|
||||
<!-- ports row -->
|
||||
<!-- TL-SG105PE: NEW, dedicated CCTV island -->
|
||||
<rect x="64" y="396" width="512" height="88" rx="8" fill="#4a3aa7" fill-opacity="0.05" stroke="#4a3aa7" stroke-width="2"/>
|
||||
<text x="80" y="420" font-size="15" font-weight="700" fill="#0b0b0b">TL-SG105PE <tspan font-size="12.5" font-weight="400" fill="#52514e">NEW · dedicated CCTV island · mgmt 10.0.30.6 (Kea) · no VLAN table</tspan></text>
|
||||
<g font-size="11.5" text-anchor="middle">
|
||||
<rect x="80" y="462" width="88" height="64" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="124" y="482" font-weight="700" fill="#0b0b0b">P1 · VLAN 1</text>
|
||||
<text x="124" y="500" fill="#52514e">home-LAN</text>
|
||||
<text x="124" y="516" fill="#52514e">uplink</text>
|
||||
|
||||
<rect x="178" y="462" width="88" height="64" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="222" y="482" font-weight="700" fill="#0b0b0b">P2 · VLAN 1</text>
|
||||
<text x="222" y="500" fill="#52514e">4G router</text>
|
||||
<text x="222" y="516" fill="#52514e">192.168.1.7</text>
|
||||
|
||||
<rect x="276" y="462" width="88" height="64" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="320" y="482" font-weight="700" fill="#0b0b0b">P3 · VLAN 1</text>
|
||||
<text x="320" y="500" fill="#52514e">UPS mgmt</text>
|
||||
|
||||
<rect x="374" y="462" width="88" height="64" rx="6" fill="#4a3aa7" fill-opacity="0.12" stroke="#4a3aa7" stroke-width="2"/>
|
||||
<text x="418" y="482" font-weight="700" fill="#0b0b0b">P4 · VLAN 30</text>
|
||||
<text x="418" y="500" fill="#52514e">camera</text>
|
||||
<text x="418" y="516" fill="#52514e">PoE ON</text>
|
||||
|
||||
<rect x="472" y="462" width="88" height="64" rx="6" fill="#4a3aa7" fill-opacity="0.12" stroke="#4a3aa7" stroke-width="2"/>
|
||||
<text x="516" y="482" font-weight="700" fill="#0b0b0b">P5 · VLAN 30</text>
|
||||
<text x="516" y="500" fill="#52514e">uplink to</text>
|
||||
<text x="516" y="516" fill="#52514e">R730 eno2</text>
|
||||
<rect x="80" y="432" width="120" height="40" rx="6" fill="#4a3aa7" fill-opacity="0.12" stroke="#4a3aa7"/>
|
||||
<text x="140" y="449" font-weight="700" fill="#0b0b0b">camera · PoE</text>
|
||||
<text x="140" y="465" fill="#52514e">any of P1–P4</text>
|
||||
<rect x="212" y="432" width="120" height="40" rx="6" fill="#4a3aa7" fill-opacity="0.12" stroke="#4a3aa7"/>
|
||||
<text x="272" y="449" font-weight="700" fill="#0b0b0b">→ R730 eno2</text>
|
||||
<text x="272" y="465" fill="#52514e">uplink (P5)</text>
|
||||
<rect x="344" y="432" width="120" height="40" rx="6" fill="#ffffff" stroke="#8a8984" stroke-dasharray="4,3"/>
|
||||
<text x="404" y="449" fill="#52514e">3 × spare PoE</text>
|
||||
<text x="404" y="465" fill="#52514e">future cameras</text>
|
||||
</g>
|
||||
<text x="80" y="556" font-size="12" fill="#52514e">backup-WAN path (pfSense 4g_router gateway) and UPS ride VLAN 1 — untouched</text>
|
||||
|
||||
<!-- P5 -> eno2 cable (camera day, dashed) -->
|
||||
<path d="M560,494 C620,494 620,494 676,494" fill="none" stroke="#52514e" stroke-width="2" stroke-dasharray="6,5" marker-end="url(#arrGray)"/>
|
||||
<text x="575" y="482" font-size="12" fill="#52514e">patch</text>
|
||||
<!-- TL-SG105E: existing garage switch, untouched -->
|
||||
<rect x="64" y="496" width="512" height="116" rx="8" fill="#ffffff" stroke="#8a8984"/>
|
||||
<text x="80" y="520" font-size="15" font-weight="700" fill="#0b0b0b">TL-SG105E · 192.168.1.6 <tspan font-size="12.5" font-weight="400" fill="#52514e">existing · no PoE · UNTOUCHED by this design</tspan></text>
|
||||
<g font-size="11.5" text-anchor="middle">
|
||||
<rect x="80" y="532" width="88" height="34" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="124" y="553" fill="#0b0b0b">P1 · 1G</text>
|
||||
<rect x="178" y="532" width="88" height="34" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="222" y="553" fill="#0b0b0b">P2 · 100M</text>
|
||||
<rect x="276" y="532" width="88" height="34" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="320" y="553" fill="#0b0b0b">P3 · 100M</text>
|
||||
<rect x="374" y="532" width="88" height="34" rx="6" fill="#ffffff" stroke="#8a8984" stroke-dasharray="4,3"/>
|
||||
<text x="418" y="553" fill="#52514e">P4 · free</text>
|
||||
<rect x="472" y="532" width="88" height="34" rx="6" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="516" y="553" fill="#0b0b0b">P5 · 1G</text>
|
||||
</g>
|
||||
<text x="80" y="590" font-size="12" fill="#52514e">1G ports: apartment uplink + R730 LAN1 · 100M ports: 4G router .7 (pfSense backup-WAN) + UPS mgmt</text>
|
||||
|
||||
<!-- P1 -> home LAN (existing uplink) -->
|
||||
<path d="M124,462 C124,336 940,300 1150,296" fill="none" stroke="#2a78d6" stroke-width="2" opacity="0.6"/>
|
||||
<text x="560" y="292" font-size="12" fill="#2a78d6">existing home-LAN uplink (VLAN 1)</text>
|
||||
<!-- PE -> eno2 patch (camera day, dashed) -->
|
||||
<path d="M576,452 C630,452 640,478 676,490" fill="none" stroke="#52514e" stroke-width="2" stroke-dasharray="6,5" marker-end="url(#arrGray)"/>
|
||||
<text x="592" y="440" font-size="12" fill="#52514e">patch</text>
|
||||
|
||||
<!-- E -> eno1 (existing R730 LAN1) -->
|
||||
<path d="M576,522 C630,522 650,470 696,432" fill="none" stroke="#2a78d6" stroke-width="2" opacity="0.6"/>
|
||||
<text x="604" y="516" font-size="12" fill="#2a78d6">R730 LAN1</text>
|
||||
|
||||
<!-- ═════════ R730 / PVE zone ═════════ -->
|
||||
<rect x="680" y="330" width="880" height="440" rx="10" fill="#0b0b0b" fill-opacity="0.03" stroke="#b9b8b2"/>
|
||||
|
|
@ -143,7 +141,7 @@
|
|||
|
||||
<!-- ═════════ HOME LAN zone ═════════ -->
|
||||
<rect x="1148" y="128" width="412" height="180" rx="10" fill="#2a78d6" fill-opacity="0.06" stroke="#2a78d6" stroke-opacity="0.4"/>
|
||||
<text x="1164" y="154" font-size="13" font-weight="700" fill="#52514e" letter-spacing="1">HOME LAN 192.168.1.0/24 (VLAN 1)</text>
|
||||
<text x="1164" y="154" font-size="13" font-weight="700" fill="#52514e" letter-spacing="1">HOME LAN 192.168.1.0/24</text>
|
||||
<rect x="1164" y="168" width="180" height="56" rx="6" fill="#ffffff" stroke="#2a78d6"/>
|
||||
<text x="1176" y="190" font-size="13.5" font-weight="700" fill="#0b0b0b">AX6000 · .1</text>
|
||||
<text x="1176" y="208" font-size="11.5" fill="#52514e">+ route 10.0.30.0/24 → .2</text>
|
||||
|
|
@ -151,20 +149,21 @@
|
|||
<text x="1176" y="258" font-size="13.5" font-weight="700" fill="#0b0b0b">ha-sofia · .8</text>
|
||||
<text x="1176" y="275" font-size="11.5" fill="#52514e">Frigate card + hikvision_next</text>
|
||||
<rect x="1360" y="168" width="184" height="56" rx="6" fill="#ffffff" stroke="#2a78d6"/>
|
||||
<text x="1372" y="190" font-size="13.5" font-weight="700" fill="#0b0b0b">SW1 + clients</text>
|
||||
<text x="1372" y="208" font-size="11.5" fill="#52514e">laptops, R730 eno1 uplink</text>
|
||||
<text x="1372" y="190" font-size="13.5" font-weight="700" fill="#0b0b0b">apartment clients</text>
|
||||
<text x="1372" y="208" font-size="11.5" fill="#52514e">laptops, phones</text>
|
||||
<!-- AX6000 route badge (camera day) -->
|
||||
<rect x="1360" y="236" width="184" height="52" rx="6" fill="#ffffff" stroke="#52514e" stroke-dasharray="5,4"/>
|
||||
<text x="1372" y="256" font-size="11.5" font-weight="700" fill="#52514e">CAMERA DAY: static route</text>
|
||||
<text x="1372" y="272" font-size="11.5" fill="#52514e">10.0.30.0/24 via 192.168.1.2</text>
|
||||
|
||||
<!-- home LAN -> eno1 -->
|
||||
<!-- home LAN -> pfSense WAN (via apartment uplink path) -->
|
||||
<path d="M1254,308 C1150,352 950,372 790,400" fill="none" stroke="#2a78d6" stroke-width="2" opacity="0.6"/>
|
||||
<text x="1010" y="374" font-size="12" fill="#2a78d6">apartment uplink · SG105E · eno1</text>
|
||||
|
||||
<!-- ═════════ FLOWS ═════════ -->
|
||||
<!-- Frigate -> camera RTSP (allowed): sweeps under the rack, terminates at the camera box -->
|
||||
<path d="M1256,497 C1010,680 330,720 120,640 C40,608 40,380 96,286" fill="none" stroke="#008300" stroke-width="3" marker-end="url(#arrGreen)"/>
|
||||
<text x="560" y="688" font-size="13.5" font-weight="700" fill="#008300">ALLOW · Frigate → camera RTSP :554 (routed k8s → dCCTV; opt1 allow-all)</text>
|
||||
<path d="M1256,497 C1010,690 330,730 120,650 C40,618 40,380 96,286" fill="none" stroke="#008300" stroke-width="3" marker-end="url(#arrGreen)"/>
|
||||
<text x="620" y="700" font-size="13.5" font-weight="700" fill="#008300">ALLOW · Frigate → camera RTSP :554 (routed k8s → dCCTV; opt1 allow-all)</text>
|
||||
|
||||
<!-- HA -> camera (allowed, via AX6000 route + WAN rules): labels above, arc dips below them -->
|
||||
<path d="M1164,262 C820,282 470,268 302,176 C286,167 278,166 270,172" fill="none" stroke="#008300" stroke-width="3" marker-end="url(#arrGreen)"/>
|
||||
|
|
@ -178,19 +177,19 @@
|
|||
<!-- ═════════ LEGEND ═════════ -->
|
||||
<g transform="translate(40,800)" font-size="12.5">
|
||||
<rect x="0" y="0" width="18" height="18" rx="4" fill="#2a78d6" fill-opacity="0.12" stroke="#2a78d6"/>
|
||||
<text x="26" y="14" fill="#0b0b0b">home LAN / VLAN 1</text>
|
||||
<rect x="190" y="0" width="18" height="18" rx="4" fill="#4a3aa7" fill-opacity="0.12" stroke="#4a3aa7" stroke-width="2"/>
|
||||
<text x="216" y="14" fill="#0b0b0b">CCTV · VLAN 30 / dCCTV 10.0.30.0/24</text>
|
||||
<rect x="490" y="0" width="18" height="18" rx="4" fill="#1baf7a" fill-opacity="0.12" stroke="#1baf7a"/>
|
||||
<text x="516" y="14" fill="#0b0b0b">dKubernetes</text>
|
||||
<rect x="630" y="0" width="18" height="18" rx="4" fill="#eda100" fill-opacity="0.14" stroke="#eda100"/>
|
||||
<text x="656" y="14" fill="#0b0b0b">dManagementsVms</text>
|
||||
<line x1="810" y1="9" x2="850" y2="9" stroke="#008300" stroke-width="3" marker-end="url(#arrGreen)"/>
|
||||
<text x="860" y="14" fill="#0b0b0b">allowed flow</text>
|
||||
<line x1="970" y1="9" x2="1010" y2="9" stroke="#e34948" stroke-width="3" marker-end="url(#arrRed)"/>
|
||||
<text x="1020" y="14" fill="#0b0b0b">denied</text>
|
||||
<line x1="1090" y1="9" x2="1130" y2="9" stroke="#52514e" stroke-width="2" stroke-dasharray="6,5"/>
|
||||
<text x="1140" y="14" fill="#0b0b0b">camera-day step</text>
|
||||
<text x="1310" y="14" fill="#52514e">ADR-0017 · 2026-07-02</text>
|
||||
<text x="26" y="14" fill="#0b0b0b">home LAN 192.168.1.0/24</text>
|
||||
<rect x="230" y="0" width="18" height="18" rx="4" fill="#4a3aa7" fill-opacity="0.12" stroke="#4a3aa7" stroke-width="2"/>
|
||||
<text x="256" y="14" fill="#0b0b0b">CCTV island / dCCTV 10.0.30.0/24</text>
|
||||
<rect x="510" y="0" width="18" height="18" rx="4" fill="#1baf7a" fill-opacity="0.12" stroke="#1baf7a"/>
|
||||
<text x="536" y="14" fill="#0b0b0b">dKubernetes</text>
|
||||
<rect x="650" y="0" width="18" height="18" rx="4" fill="#eda100" fill-opacity="0.14" stroke="#eda100"/>
|
||||
<text x="676" y="14" fill="#0b0b0b">dManagementsVms</text>
|
||||
<line x1="830" y1="9" x2="870" y2="9" stroke="#008300" stroke-width="3" marker-end="url(#arrGreen)"/>
|
||||
<text x="880" y="14" fill="#0b0b0b">allowed flow</text>
|
||||
<line x1="990" y1="9" x2="1030" y2="9" stroke="#e34948" stroke-width="3" marker-end="url(#arrRed)"/>
|
||||
<text x="1040" y="14" fill="#0b0b0b">denied</text>
|
||||
<line x1="1110" y1="9" x2="1150" y2="9" stroke="#52514e" stroke-width="2" stroke-dasharray="6,5"/>
|
||||
<text x="1160" y="14" fill="#0b0b0b">camera-day step</text>
|
||||
<text x="1330" y="14" fill="#52514e">ADR-0017 · rev 2</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
|
|
|||
|
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 15 KiB |
Loading…
Add table
Add a link
Reference in a new issue