Reference
Current Decisions
Active architectural decisions that define the current AORXI homelab target, with canonical design references and deployment status.
Current decisions describe the active architecture without forcing readers to reconstruct it from dated reversals. The Decision History retains every prior entry, correction, and superseded assumption.
Target and Live State Differ
The Site A UniFi Layer 2 fabric and OPNsense-only routing target are approved, but the UCG Max bootstrap network remains live. It will feed OPNsense WAN while the final-addressed LAN is commissioned, then leave the path at the WAN-only handoff. Site B has not started.
Architecture
| Area | Current decision | Canonical detail |
|---|---|---|
| Site boundary | One Proxmox cluster per site; no stretched Ceph or Layer 2; WireGuard carries routed inter-site traffic. | Design Principles |
| Stateful edge | OPNsense owns WAN, NAT, WireGuard, DMZ, and stateful cross-zone policy; each firewall VM stays pinned to its local E200. | Two-Site Model |
| Site A switching | Three UniFi Switch Pro XG 10 PoE devices form an L2-only RSTP triangle under sa-uos-01; VLAN admission uses explicit lists and native sink VLAN 999. | Site A L2 Fabric |
| Site A handoff | sa-fw-01 owns every routed VLAN gateway/DHCP/policy surface over an explicit 802.1Q trunk; Site A VLANs 253/4040 are absent. | OPNsense / UniFi Handoff |
| Site A bootstrap cutover | UCG feeds OPNsense WAN through A7 while all systems use final 10.10.x; A8 changes only the ONT feed, and rollback restores UCG upstream without reverting the LAN. | Site A Migration Phases |
| Site B switching | sb-sw-01 remains a Netgear Layer 2 core; the USG Pro stays behind OPNsense on VLAN 253 for the Site B migration plan. | Site B Port Map |
| Storage networks | VLAN 60 is Layer 2-only with no SVI or default gateway; VLAN 65 is isolated Ceph cluster traffic; VLAN 90 remains routed for PBS. | VLAN Reference |
Services and Operations
| Area | Current decision | Canonical detail |
|---|---|---|
| Backups | PBS runs locally at both sites and replicates cross-site for DR; the detailed retention and recovery contract remains open. | PBS Backups |
| DNS | Four Technitium VMs serve core.aorxi.io; sa-dns-01 is primary and secondaries receive AXFR. | DNS VMs |
| Certificates | Let's Encrypt DNS-01 is primary; step-ca is limited to IPMI/BMC and optional internal mTLS. | CA & Certificates |
| UniFi controller | sa-uos-01 manages Site A switches/APs and later sb-sw-02 over WireGuard; Cloud Gateways remain outside UOS. | UOS Controller |
| Secrets | Independent per-site OpenBao instances use bao-first consumption with documented break-glass fallback; no stretched Raft. | Secrets: OpenBao |
| Automation boundary | Pulumi owns VM/CT/API resources; Ansible owns host OS and application configuration surfaces defined by each subproject. | Current Build State |
| Kubernetes | Clusters remain site-local; network allocations are reserved while the final platform stack and sizing remain tentative. | Kubernetes / OpenShift |