Gateway IP move: 192.168.2.42 → .45 (DHCP collision fix) - #44
Draft
baron-3dl wants to merge 2 commits into
Draft
Conversation
The gateway VM shared 192.168.2.42 with rd-node via DHCP; rd-node won ARP and swallowed all ingress traffic, taking the public site down. Reserve the gateway at a dedicated IP instead. Updates the five hard-coded .42 refs: the Caddyfile LAN-TLS bind, the OIDC-issuer hostAliases on control-plane/chat/ workspace, and the workspace egress NetworkPolicy /32. Router-side (DHCP reservation, :443 NAT, internal DNS) is done out-of-band; deploy this only after the VM actually holds .45. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The VM's /etc/caddy/Caddyfile had drifted ahead of the repo: it carries a dedicated `https://ai.3dl.one:443` origin block with its own LE cert (/etc/caddy/certs/ai.3dl.one.*) that the repo copy never had, and the OIDC issuer has migrated from the tailscale-funnel name to `https://ai.3dl.one`. This records the live config as-is (now bound to .45). Design docs (design.md Funnel narrative, deploy/README) and the k8s ts.net hostAliases still describe the old issuer and need a separate reconciliation pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Incident
ai.3dl.onewent down: the gateway VM andrd-nodewere both unreserved DHCP clients, andrd-nodegrabbed the gateway's192.168.2.42, won ARP, and swallowed all ingress. The gateway VM, caddy, and k3s were healthy the whole time.Fix applied (live, this branch records it)
rd-node → 192.168.2.42andgateway → 192.168.2.45as fixed-IP reservations (root cause: neither was reserved). rd-node keeps.42because it's referenced in many downstream configs.3dl.one):aianddev-aiA records.42 → .45..45; repointed caddy binds.42 → .45; restarted caddy.enterprise-ai): hostAliases +workspace-isolationNetworkPolicy.42 → .45onchat,control-plane,ws-baron/claire/student; rolled the pods.gateway.stealth.baron.localfollowed automatically (USG MAC-keyed hosts hook).Verified
ai.3dl.one→.45, serves HTTP 302 (portal), valid cert.https://ai.3dl.one/realms/enterprise-ai→ 200 over.45, byte-identical issuer string.ai.3dl.one→.45.Follow-up (NOT in this PR — needs a design-aware pass)
ai.3dl.onecert block); this PR syncs the repo to the live file.https://ai.3dl.one.design.md(Funnel-on-443 narrative),deploy/README.md, and the k8sgateway.tailcb6ef9.ts.nethostAliases still describe the old path and should be reconciled.🤖 Generated with Claude Code