# T00-DRIP Network Configuration

## Architecture

```
                    INTERNET (T-Mobile 5G)
                         │
                    ┌────┴────────────────────┐
                    │  GL-X3000 Spitz AX       │
                    │  • 5G/4G cellular uplink  │
                    │  • WiFi 6 AP (2 SSIDs)   │
                    │  • OpenWrt                │
                    │  • WAN: cellular          │
                    │  • LAN: 2.5G → G11 NIC1  │
                    └────┬────────────────────┘
                         │ Ethernet (2.5G)
                         │
                    ┌────┴────────────────────┐
                    │  GMKtec G11 (Fedora)     │
                    │  NIC1 (WAN): from Spitz  │
                    │  NIC2 (LAN): to switch   │
                    │                          │
                    │  ┌─────────────────┐     │
                    │  │ VyOS VM          │     │
                    │  │ • NAT/Firewall   │     │
                    │  │ • DHCP server    │     │
                    │  │ • WireGuard      │     │
                    │  │ • VLAN routing   │     │
                    │  │ • QoS/traffic    │     │
                    │  └─────────────────┘     │
                    │                          │
                    │  Podman Containers:       │
                    │  • Frigate (NVR)          │
                    │  • Home Assistant         │
                    │  • nginx (captive portal) │
                    └────┬────────────────────┘
                         │ Ethernet (2.5G) - NIC2
                         │
                    ┌────┴────────────────────┐
                    │  TP-Link TL-SG208PE      │
                    │  8-port PoE (65W)        │
                    │                          │
                    │  Port 1: Uplink (G11)    │
                    │  Port 2: Camera 1 (PoE)  │
                    │  Port 3: Camera 2 (PoE)  │
                    │  Port 4: Camera 3 (PoE)  │
                    │  Port 5-8: spare         │
                    └──────────────────────────┘
```

## IP Addressing (per trailer)

| Subnet | Purpose | DHCP Range |
|--------|---------|------------|
| 10.T.0.0/24 | Management/Infrastructure | .1-.10 static |
| 10.T.10.0/24 | VLAN 10 — Security (cameras, lock, NVR) | .100-.150 |
| 10.T.20.0/24 | VLAN 20 — Operations (POS, staff devices) | .100-.150 |
| 10.T.30.0/24 | VLAN 30 — Guest WiFi (isolated, internet only) | .100-.200 |

Where T = trailer number (0 for T00-DRIP, 1 for T01-ROAST, etc.)

## Static IPs

| Device | IP | VLAN | MAC |
|--------|-----|------|-----|
| G11 (gateway) | 10.0.0.1 | Mgmt | — |
| GL-X3000 (WAN gateway) | DHCP from carrier | — | — |
| Camera 1 (interior) | 10.0.10.1 | 10 | TBD |
| Camera 2 (exterior) | 10.0.10.2 | 10 | TBD |
| Camera 3 (drive-through) | 10.0.10.3 | 10 | TBD |
| ULTRALOQ (lock) | 10.0.10.10 | 10 | TBD |
| Square POS | 10.0.20.100 | 20 | DHCP |
| Staff devices | 10.0.20.101+ | 20 | DHCP |

## VLANs

| VLAN ID | Name | Purpose | Firewall Rules |
|---------|------|---------|----------------|
| 10 | Security | Cameras, lock, NVR | No internet access. Talk to G11 (NVR) only. |
| 20 | Operations | POS, staff WiFi, management | Internet access. Can reach Home Assistant. |
| 30 | Guest | Customer WiFi (captive portal) | Internet only. Isolated from all other VLANs. Rate-limited. |

## WiFi SSIDs (GL-X3000)

| SSID | VLAN | Security | Purpose |
|------|------|----------|---------|
| `DailyPour-Staff` | 20 | WPA3-Personal | POS, staff devices, management |
| `The Daily Pour` | 30 | Open (captive portal) | Customer WiFi — branded splash page → internet |

## WireGuard Tunnel

| Setting | Value |
|---------|-------|
| Server | Home (ws, 100.96.11.9 via NetBird) or cloud endpoint |
| Client | VyOS on G11 |
| Tunnel IP | 10.200.T.1/32 (per trailer) |
| Keepalive | 25s |
| Purpose | Remote management, NVR remote view, fleet config push |

## Firewall Rules (VyOS)

```
# WAN → LAN: deny all (default)
# LAN → WAN: allow (NAT masquerade)
# VLAN 10 (Security) → WAN: DENY (cameras never reach internet)
# VLAN 10 → G11 (NVR): ALLOW (cameras stream to local Frigate)
# VLAN 20 (Ops) → WAN: ALLOW
# VLAN 20 → VLAN 10: DENY (POS can't see cameras)
# VLAN 30 (Guest) → WAN: ALLOW (rate limited 5Mbps)
# VLAN 30 → VLAN 10: DENY
# VLAN 30 → VLAN 20: DENY
# WireGuard → ALL: ALLOW (remote management)
```

## Services on G11 (Fedora Workstation + Podman)

G11 runs **Fedora Workstation** (GNOME desktop) — provides GUI for video calls
and dashboard display. Server workloads run in VyOS VM + Podman containers.
Managed remotely via **Cockpit** (web UI).

| Container/VM | Image | Port | Purpose |
|-----------|-------|------|---------|
| vyos (VM) | VyOS qcow2 | — | Router/firewall/WireGuard/DHCP/VLAN/QoS |
| frigate | ghcr.io/blakeblackshear/frigate | 5000, 8554 | NVR — records cameras, AI detection |
| homeassistant | ghcr.io/home-assistant/home-assistant | 8123 | Lock control, automations, dashboard |
| nginx-portal | nginx:alpine | 80 | Captive portal splash page |

**Desktop apps (browser):**
- Jitsi Meet (video calls — `meet.jit.si/dailypour-drip`)
- Dashboard view (Frigate live feeds, HA status, sales)
- Cockpit (`localhost:9090`) for local management

## Automation (Home Assistant)

| Automation | Trigger | Action |
|------------|---------|--------|
| Auto-lock | 2:30 PM (closing) | Lock ULTRALOQ |
| Auto-unlock | 4:45 AM (pre-open) | Unlock ULTRALOQ |
| Motion alert | Frigate detects person after hours | Push notification to Sam |
| Power alert | UPS switches to battery | Push notification to Sam |

## Fleet Scaling

Each trailer is a clone of this config with:
- Trailer number (T) incremented in all IPs
- Unique WireGuard keys
- Same VyOS config template (Ansible playbook)
- Same Podman containers (compose file)
- Same GL-X3000 OpenWrt config (backup/restore)

Deploy a new trailer's network: flash configs → plug in → WireGuard auto-connects → fleet dashboard sees it.

## Video Conferencing (Jitsi)

| Setting | Value |
|---------|-------|
| Platform | Jitsi Meet (meet.jit.si — public, free) |
| Room naming | `dailypour-T00` (per trailer) |
| Hardware | G11 (Fedora WS) + 27" monitor + USB webcam |
| Use cases | Management check-ins, inter-trailer comms, staff meetings |
| Future | Self-host at `video.snsnetlabs.com` when 5+ trailers |

No accounts needed. Staff opens browser → `meet.jit.si/dailypour-drip` → instant video call.

## Files in this directory

```
T-00/network/
├── README.md              (this file)
├── vyos/
│   └── config.boot        (VyOS configuration — TODO)
├── openwrt/
│   └── backup.tar.gz      (GL-X3000 config backup — TODO)
├── ansible/
│   └── deploy-trailer.yml (fleet deployment playbook — TODO)
└── captive-portal/
    └── index.html          (branded splash page — TODO)
```