Start Here
Glossary
Hostnames, acronyms, product names, VLANs, and networking terms used throughout the AORXI homelab documentation.
A decoder ring for every term, hostname pattern, product, and acronym on this site. Entries are grouped by category; within each table rows are alphabetical.
Hostname Conventions
Every managed host follows the pattern <site>-<type>-<seq>, where sa = Site A and sb = Site B.
| Suffix | Type | Examples |
|---|---|---|
ap | Access point (UniFi Wi-Fi) | sa-ap-01 |
cmp | Compute node (Proxmox worker) | sa-cmp-01, sb-cmp-03 |
dns | DNS service VM (Technitium) | sa-dns-01, sb-dns-02 |
edge | Edge appliance: hosts Proxmox + OPNsense VM | sa-edge-01, sb-edge-01 |
fw | Firewall VM (OPNsense guest) | sa-fw-01, sb-fw-01 |
gw | UniFi routing gateway; retired/reserved at Site A, retained for users at Site B | sa-gw, sb-gw |
stor | Storage server (ZFS / PBS) | sa-stor-01 |
sw | Managed switch | sa-sw-01, sb-sw-02 |
Proxmox cluster names follow the same site prefix: sa-pve (Site A cluster) and sb-pve (Site B cluster).
Products & Software
| Term | What it is |
|---|---|
| Ansible | Configuration management; drives OS hardening (STIG-mapped) and baseline across all Proxmox hosts (baseline/), plus app-level config for UniFi, OPNsense, and OpenBao (unifi/config/, opnsense/config/, openbao/config/). |
| Ceph | Distributed storage cluster at Site B (20-30 OSDs across sb-cmp-01-sb-cmp-05). Not present at Site A. |
| Cilium | Preferred CNI for Kubernetes; runs in overlay mode with eBPF-based networking and policy enforcement. |
| Cloudflare | DNS registrar and CDN for the public aorxi.io zone; provides the DNS-01 challenge endpoint for Let's Encrypt. |
| Corosync | Cluster heartbeat and quorum daemon underpinning Proxmox HA. Runs on VLAN 25 (no gateway; never routed). |
| MetalLB | Bare-metal load balancer for Kubernetes; allocates VIPs from the VLAN 50 (K8s LB / VIPs) pool. |
| Netgear | Brand of Site B's sb-sw-01 XS748T L2 core. The former Site A XS716T plan is superseded. |
| Switch Pro XG 10 PoE | UniFi USW-Pro-XG-10-PoE: 10× 10GbE RJ45 PoE+++ plus 2× 10G SFP+; three form Site A's approved L2 RSTP fabric. |
| OpenBao | Open-source secrets manager (Vault fork); one instance per site (sa-bao-01 at 10.10.30.40, sb-bao-01 at 10.20.30.40) on the edge E200s. Runtime secrets live here; consumers fall back to encrypted files if it is unreachable. |
| OPNsense | Open-source firewall and router; runs as a VM (sa-fw-01 / sb-fw-01) on each site's edge host. Acts as the infrastructure router upstream of all UniFi devices. |
| PBS | Proxmox Backup Server: backup appliance for incremental, deduplicated backups of Proxmox VMs and containers. Abbreviated PBS after first use per page. |
| Proxmox | Proxmox Virtual Environment: the KVM/LXC hypervisor platform running on all bare-metal servers in this homelab. |
| Pulumi | Infrastructure-as-code tool used to provision Proxmox API objects (VMs, storage, networks). Projects: platform/ (host firewall + shared infra), unifi/provision/, opnsense/provision/, openbao/provision/; shared building blocks in core/. |
| Technitium | DNS server software powering the four internal DNS VMs (sa-dns-01, sa-dns-02, sb-dns-01, sb-dns-02). |
| UniFi | Ubiquiti network line used for Site A's Layer 2 switches and AP, plus Site B's access and user-side equipment. |
| UOS | UniFi OS Server: the self-hosted controller (sa-uos-01, 10.10.10.40 on VLAN 10). It adopts all Site A switches/APs and later standalone Site B gear over WireGuard. |
| WireGuard | Site-to-site VPN tunnel between sa-fw-01 and sb-fw-01 over the 10.255.0.0/24 transit network. |
| ZFS | Copy-on-write filesystem used on sa-stor-01 for VM storage, PBS data, and databases at Site A. |
VLANs at a Glance
Full subnet tables are on the VLAN Reference page. This table covers purpose only.
| VLAN | Name | Notes |
|---|---|---|
| 10 | Network Mgmt / IPMI | Switch management, IPMI BMC access; out-of-band |
| 20 | Proxmox Management | Proxmox web UI, SSH, cluster sync address |
| 25 | Corosync heartbeat | Dedicated cluster heartbeat; no GW: never routed |
| 30 | VM Services | Pinned service VMs: PBS, DNS appliances |
| 40 | Kubernetes Nodes | K8s machine network (/22 blocks per cluster) |
| 50 | K8s LB / VIPs | MetalLB address pool; API and ingress VIPs |
| 60 | Storage / Ceph public | Direct-attached storage clients; no SVI/default gateway; never routed to VLAN 65 |
| 65 | Ceph cluster | Internal Ceph OSD replication; no GW: Site A reserved |
| 70 | DMZ | Internet-exposed services |
| 80 | Monitoring | Metrics collection and dashboards |
| 90 | Backup / Replication | Routed PBS backup traffic and cross-site synchronization |
| 100 | Lab / Trusted Client | Lab endpoints and OpenShift machine networks |
| 110 | IoT | IoT devices; isolated from management networks |
| 120 | Guest WiFi | Guest wireless clients; no access to infrastructure |
| 253 | Site B UniFi WAN transit | OPNsense-to-USG WAN link; retired at Site A |
| 999 | Site A Native Sink | No subnet, gateway, DHCP, or clients; native on infrastructure trunks and disabled ports |
Terms & Acronyms
| Term | Definition |
|---|---|
/22 machine network | A /22 IP block (1022 usable addresses) allocated to a single Kubernetes or OpenShift cluster's node IPs. Multiple clusters each receive their own /22 carved from the VLAN 100 / Lab range. |
aorxi.io | Public-facing domain registered on Cloudflare. Used for external DNS records and as the DNS-01 domain for Let's Encrypt certificates. |
core.aorxi.io | Internal DNS zone served by Technitium DNS VMs; resolves all internal hostnames to private IPs without touching public DNS. |
| AXFR | DNS zone-transfer protocol. sa-dns-01 is the primary authoritative server; sa-dns-02, sb-dns-01, and sb-dns-02 receive zone updates via AXFR. |
| DNS-01 | ACME challenge type that proves domain ownership via a DNS TXT record rather than an HTTP endpoint. Used with the Cloudflare API for Let's Encrypt wildcard certificates: no public port 80/443 exposure required. |
| Double-NAT | Site B user traffic is NATed by the USG Pro and again by OPNsense. Site A's approved target removes this path. |
| IPMI | Intelligent Platform Management Interface: out-of-band management built into Supermicro BMCs. Provides console, power, and virtual media access independent of the host OS. |
| iKVM | IP-based KVM-over-IP console delivered through IPMI. Available as an HTML5 web client or a legacy Java applet; HTML5 does not support virtual ISO mount on older Supermicro boards. |
| Jumbo frames | Ethernet frames with MTU larger than 1500 bytes. Policy: default MTU of 1500 everywhere; 9000-byte jumbo frames only on storage VLANs 60, 65, and 90. Corosync (VLAN 25) is never jumbo. |
| LACP | Link Aggregation Control Protocol. Not used in this design: all inter-switch and host uplinks are single copper or SFP+ links (no bonding). |
| MTU | Maximum Transmission Unit: maximum Ethernet frame payload in bytes. See "Jumbo frames" above for the per-VLAN policy. |
| Stretched cluster | A single Proxmox or Ceph cluster whose nodes span two physical sites over WAN or VPN. Prohibited: one cluster per site only; PBS replication handles cross-site DR instead. |
| WireGuard transit | The 10.255.0.0/24 subnet used for the inter-site VPN tunnel. sa-fw-01 holds .1; sb-fw-01 holds .2. Neither site's L2 is extended across this link. |
Related Pages
- How It Fits Together: topology overview that puts these terms in context
- VLAN Reference: full VLAN table with subnets, gateways, and which switches carry each VLAN
- IP Tables: per-host and per-service address reference for both sites
How It All Fits Together
Current state, target topology, ownership boundaries, control services, storage, and build sequence for the two-site AORXI private cloud.
Design Principles & Hard Rules
Non-negotiable architecture rules and guiding principles every operator must understand before making any change to this homelab.