T00-DRIP Network Configuration
Architecture
INTERNET (T-Mobile 5G)
│
┌────┴────────────────────┐
│ GL-X3000 Spitz AX │
│ • 5G/4G cellular uplink │
│ • WiFi 6 AP (2 SSIDs) │
│ • OpenWrt │
│ • WAN: cellular │
│ • LAN: 2.5G → G11 NIC1 │
└────┬────────────────────┘
│ Ethernet (2.5G)
│
┌────┴────────────────────┐
│ GMKtec G11 (Fedora) │
│ NIC1 (WAN): from Spitz │
│ NIC2 (LAN): to switch │
│ │
│ ┌─────────────────┐ │
│ │ VyOS VM │ │
│ │ • NAT/Firewall │ │
│ │ • DHCP server │ │
│ │ • WireGuard │ │
│ │ • VLAN routing │ │
│ │ • QoS/traffic │ │
│ └─────────────────┘ │
│ │
│ Podman Containers: │
│ • Frigate (NVR) │
│ • Home Assistant │
│ • nginx (captive portal) │
└────┬────────────────────┘
│ Ethernet (2.5G) - NIC2
│
┌────┴────────────────────┐
│ TP-Link TL-SG208PE │
│ 8-port PoE (65W) │
│ │
│ Port 1: Uplink (G11) │
│ Port 2: Camera 1 (PoE) │
│ Port 3: Camera 2 (PoE) │
│ Port 4: Camera 3 (PoE) │
│ Port 5-8: spare │
└──────────────────────────┘
IP Addressing (per trailer)
| Subnet |
Purpose |
DHCP Range |
| 10.T.0.0/24 |
Management/Infrastructure |
.1-.10 static |
| 10.T.10.0/24 |
VLAN 10 — Security (cameras, lock, NVR) |
.100-.150 |
| 10.T.20.0/24 |
VLAN 20 — Operations (POS, staff devices) |
.100-.150 |
| 10.T.30.0/24 |
VLAN 30 — Guest WiFi (isolated, internet only) |
.100-.200 |
Where T = trailer number (0 for T00-DRIP, 1 for T01-ROAST, etc.)
Static IPs
| Device |
IP |
VLAN |
MAC |
| G11 (gateway) |
10.0.0.1 |
Mgmt |
— |
| GL-X3000 (WAN gateway) |
DHCP from carrier |
— |
— |
| Camera 1 (interior) |
10.0.10.1 |
10 |
TBD |
| Camera 2 (exterior) |
10.0.10.2 |
10 |
TBD |
| Camera 3 (drive-through) |
10.0.10.3 |
10 |
TBD |
| ULTRALOQ (lock) |
10.0.10.10 |
10 |
TBD |
| Square POS |
10.0.20.100 |
20 |
DHCP |
| Staff devices |
10.0.20.101+ |
20 |
DHCP |
VLANs
| VLAN ID |
Name |
Purpose |
Firewall Rules |
| 10 |
Security |
Cameras, lock, NVR |
No internet access. Talk to G11 (NVR) only. |
| 20 |
Operations |
POS, staff WiFi, management |
Internet access. Can reach Home Assistant. |
| 30 |
Guest |
Customer WiFi (captive portal) |
Internet only. Isolated from all other VLANs. Rate-limited. |
WiFi SSIDs (GL-X3000)
| SSID |
VLAN |
Security |
Purpose |
DailyPour-Staff |
20 |
WPA3-Personal |
POS, staff devices, management |
The Daily Pour |
30 |
Open (captive portal) |
Customer WiFi — branded splash page → internet |
WireGuard Tunnel
| Setting |
Value |
| Server |
Home (ws, 100.96.11.9 via NetBird) or cloud endpoint |
| Client |
VyOS on G11 |
| Tunnel IP |
10.200.T.1/32 (per trailer) |
| Keepalive |
25s |
| Purpose |
Remote management, NVR remote view, fleet config push |
Firewall Rules (VyOS)
# WAN → LAN: deny all (default)
# LAN → WAN: allow (NAT masquerade)
# VLAN 10 (Security) → WAN: DENY (cameras never reach internet)
# VLAN 10 → G11 (NVR): ALLOW (cameras stream to local Frigate)
# VLAN 20 (Ops) → WAN: ALLOW
# VLAN 20 → VLAN 10: DENY (POS can't see cameras)
# VLAN 30 (Guest) → WAN: ALLOW (rate limited 5Mbps)
# VLAN 30 → VLAN 10: DENY
# VLAN 30 → VLAN 20: DENY
# WireGuard → ALL: ALLOW (remote management)
Services on G11 (Fedora Workstation + Podman)
G11 runs Fedora Workstation (GNOME desktop) — provides GUI for video calls
and dashboard display. Server workloads run in VyOS VM + Podman containers.
Managed remotely via Cockpit (web UI).
| Container/VM |
Image |
Port |
Purpose |
| vyos (VM) |
VyOS qcow2 |
— |
Router/firewall/WireGuard/DHCP/VLAN/QoS |
| frigate |
ghcr.io/blakeblackshear/frigate |
5000, 8554 |
NVR — records cameras, AI detection |
| homeassistant |
ghcr.io/home-assistant/home-assistant |
8123 |
Lock control, automations, dashboard |
| nginx-portal |
nginx:alpine |
80 |
Captive portal splash page |
Desktop apps (browser):
- Jitsi Meet (video calls —
meet.jit.si/dailypour-drip)
- Dashboard view (Frigate live feeds, HA status, sales)
- Cockpit (
localhost:9090) for local management
Automation (Home Assistant)
| Automation |
Trigger |
Action |
| Auto-lock |
2:30 PM (closing) |
Lock ULTRALOQ |
| Auto-unlock |
4:45 AM (pre-open) |
Unlock ULTRALOQ |
| Motion alert |
Frigate detects person after hours |
Push notification to Sam |
| Power alert |
UPS switches to battery |
Push notification to Sam |
Fleet Scaling
Each trailer is a clone of this config with:
- Trailer number (T) incremented in all IPs
- Unique WireGuard keys
- Same VyOS config template (Ansible playbook)
- Same Podman containers (compose file)
- Same GL-X3000 OpenWrt config (backup/restore)
Deploy a new trailer's network: flash configs → plug in → WireGuard auto-connects → fleet dashboard sees it.
Video Conferencing (Jitsi)
| Setting |
Value |
| Platform |
Jitsi Meet (meet.jit.si — public, free) |
| Room naming |
dailypour-T00 (per trailer) |
| Hardware |
G11 (Fedora WS) + 27" monitor + USB webcam |
| Use cases |
Management check-ins, inter-trailer comms, staff meetings |
| Future |
Self-host at video.snsnetlabs.com when 5+ trailers |
No accounts needed. Staff opens browser → meet.jit.si/dailypour-drip → instant video call.
Files in this directory
T-00/network/
├── README.md (this file)
├── vyos/
│ └── config.boot (VyOS configuration — TODO)
├── openwrt/
│ └── backup.tar.gz (GL-X3000 config backup — TODO)
├── ansible/
│ └── deploy-trailer.yml (fleet deployment playbook — TODO)
└── captive-portal/
└── index.html (branded splash page — TODO)
2bbea20b22