sns-network-solutions/infra/future-stack-decisions.md

Future Stack Decisions — SNS Network Solutions

Decisions made 2026-07-25 during brainstorming session. Apply these when building out the 3-rack environment.

---

Decisions Locked

Decision	Choice	Replaces	Reason
Perimeter firewall	OPNsense	OpenWRT (for racks/client sites)	Enterprise GUI, built-in Suricata IDS/IPS, CARP HA, traffic shaping. OpenWRT stays only for embedded APs.
Client/remote connectivity	OpenZiti	OpenVPN	OpenVPN is too slow. OpenZiti = zero-trust, no open ports, per-service access, faster (peer-to-peer).
Network Access Control	PacketFence	Nothing (new layer)	802.1X, captive portal, device profiling, BYOD enforcement, rogue device isolation.
Mesh (personal/homelab)	NetBird (keep)	—	Already working. Not for client delivery — that's OpenZiti.
LLM API routing	OpenRouter	—	API key: sk-or-v1-607da... (free tier, 4000 token cap per request unless credits added)

---

The Stack (consolidated)

Networking & Access (the perimeter + admission + connectivity triad)

Internet
    │
    ▼
┌──────────────┐
│  OPNsense    │  ← What traffic is allowed in/out (firewall + IDS/IPS)
└──────┬───────┘
       │
┌──────▼───────┐
│ PacketFence  │  ← Who/what is allowed ON the network (NAC, 802.1X)
└──────┬───────┘
       │
┌──────▼───────┐
│  OpenZiti    │  ← How services are accessed (zero-trust overlay, per-app)
└──────────────┘

Full Stack (3-Rack)

Layer	Tool	Role
Perimeter firewall	OPNsense	Stateful firewall, IDS/IPS (Suricata), VLANs, traffic shaping
NAC	PacketFence	Network admission, 802.1X, captive portal, device profiling
Zero-trust connectivity	OpenZiti	Service-level access, no open ports, replaces VPN
Secrets	OpenBao	All credentials, transit encryption, audit log
Identity	OpenLDAP	Employee/contractor directory, SSO source
IaC	OpenTofu	Provision client environments reproducibly
Observability	Graylog + OpenTelemetry	Log management, SIEM, search, dashboards, alerting (replaces standalone OpenSearch)
Vulnerability scanning	OpenVAS	Scheduled client network scans
Threat intel	OpenCTI	IOC aggregation, threat actor tracking
Honeypots	OpenCanary	Intrusion detection decoys
Compliance	OpenSCAP	CIS/NIST benchmark audits
Network fleet management	OpenWISP	Manage OPNsense/AP fleets across client sites
Storage	OpenZFS	Backup targets, snapshots, data integrity (runs on Proxmox natively)
AI agents	OpenClaw + OpenRouter	Chief/Scout/Scribe + LLM API routing
Serverless automation	OpenFaaS	Webhook handlers, client onboarding, alert processors

Removed / Not Using

Tool	Reason
OpenVPN	Too slow. Replaced by OpenZiti.
ZeroTier (for clients)	Network-level access (full LAN) instead of service-level. Keep NetBird for personal homelab only.
OpenWRT	Not using at all. OPNsense covers firewall/routing; no embedded router flashing.
OpenProject	Tested on pve2 (LXC 215) — didn't like it. Destroyed.
OpenSearch (standalone)	Tested on pve2 (LXC 216) — using Graylog instead (includes OpenSearch under the hood + better UI/SIEM).

---

Revenue Services Enabled

Service	Tools	Billing
Managed firewall + IDS	OPNsense	Monthly per-site
Zero-trust remote access	OpenZiti	Monthly per-endpoint
NAC / BYOD enforcement	PacketFence	Setup + monthly
Vulnerability scanning	OpenVAS	Monthly/quarterly report
Compliance audits	OpenSCAP	Per-engagement
Managed backup	OpenZFS + PBS + OMV	Monthly per-TB
Threat monitoring	OpenCTI + OpenCanary + Suricata	Monthly retainer
Infrastructure builds	OpenTofu + Proxmox + Ansible	Project-based
Secrets management	OpenBao (at client)	Setup + monthly

---

OpenRouter API

• Key: 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
• Status: Free tier (4000 token max per request)
• Usage: Add "max_tokens": 500 (or less) to stay within limits
• Wire into: LiteLLM or AI Core .env when ready
• Add credits: https://openrouter.ai/settings/credits

---

---

Repository Links (all tools)

Tool	Repo / Site	License
OPNsense	https://github.com/opnsense/core	BSD-2
OPNcentral	Built-in OPNsense plugin (os-central)	BSD-2
PacketFence	https://github.com/inverse-inc/packetfence	GPL-2.0
OpenZiti	https://github.com/openziti/ziti	Apache-2.0
OpenBao	https://github.com/openbao/openbao	MPL-2.0
OpenTofu	https://github.com/opentofu/opentofu	MPL-2.0
OpenLDAP	https://github.com/openldap/openldap	OpenLDAP Public License
OpenTelemetry	https://github.com/open-telemetry/opentelemetry-collector	Apache-2.0
OpenTelemetry Contrib	https://github.com/open-telemetry/opentelemetry-collector-contrib	Apache-2.0
OpenSearch	https://github.com/opensearch-project/OpenSearch	Apache-2.0
OpenVAS	https://github.com/greenbone/openvas-scanner	GPL-2.0
OpenCTI	https://github.com/OpenCTI-Platform/opencti	Apache-2.0
OpenCanary	https://github.com/thinkst/opencanary	BSD-3
OpenSCAP	https://github.com/ComplianceAsCode/content	BSD-2
OpenFaaS	https://github.com/openfaas/faas	MIT
OpenProject	https://github.com/opf/openproject	GPL-3.0
OpenZFS	https://github.com/openzfs/zfs	CDDL / BSD
OpenClaw	https://github.com/openclaw/openclaw	MIT
OpenRouter	https://openrouter.ai (API service, not self-hosted)	Commercial (API)
OpenWISP	https://github.com/openwisp	GPL-3.0
Proxmox VE	https://git.proxmox.com	AGPL-3.0
Grafana	https://github.com/grafana/grafana	AGPL-3.0
Prometheus	https://github.com/prometheus/prometheus	Apache-2.0

Official Docs / Sites

Tool	Documentation
OPNsense	https://docs.opnsense.org
PacketFence	https://www.packetfence.org/doc/
OpenZiti	https://openziti.io / https://docs.openziti.io
OpenBao	https://openbao.org/docs/
OpenTofu	https://opentofu.org/docs/
OpenTelemetry	https://opentelemetry.io/docs/
OpenSearch	https://opensearch.org/docs/
OpenVAS (Greenbone)	https://greenbone.github.io/docs/
OpenCTI	https://docs.opencti.io
OpenFaaS	https://docs.openfaas.com
OpenProject	https://www.openproject.org/docs/

---

Network Switching — MikroTik (No Licensing)

Decision: MikroTik CRS series. Zero license fees forever. RouterOS included with hardware.

Why MikroTik

• $0 licensing — ever. RouterOS included, free upgrades.
• Full L2/L3 switching + routing in one device
• REST API (RouterOS 7+) + native API (port 8728)
• Full Ansible support (community.routeros collection)
• Full Python support (librouteros, routeros-api, or plain REST)
• PacketFence compatible (SNMP + RADIUS/802.1X)
• Cheapest enterprise-grade option (~$130-500 vs Cisco $1000+)

Suggested Rack Layout

Rack	Switch	Model	Role
Rack 1	CRS354-48G-4S+2Q+	48× 1G + 4× SFP+ 10G + 2× QSFP+ 40G	Core/distribution
Rack 2	CRS326-24G-2S+	24× 1G + 2× SFP+ 10G	Client services
Rack 3	CRS326-24G-2S+	24× 1G + 2× SFP+ 10G	Lab/security
Inter-rack	10G SFP+ DAC cables	Between switches	Backbone

Total hardware cost: ~$500-700 (Cisco equivalent: $5,000+)

Automation

Ansible:

ansible-galaxy collection install community.routeros

# Modules: api, api_modify, api_info, api_facts, command
- community.routeros.api:
    hostname: 192.168.122.10
    path: interface bridge vlan
    add:
      bridge: bridge1
      vlan-ids: 100

Python (REST API — RouterOS 7+):

import requests
r = requests.get('https://switch-ip/rest/interface',
                 auth=('admin', 'password'), verify=False)
print(r.json())

Python (native API):

import routeros_api
connection = routeros_api.RouterOsApiPool('switch-ip',
    username='admin', password='password', plaintext_login=True)
api = connection.get_api()
interfaces = api.get_resource('/interface')
for iface in interfaces.get():
    print(iface['name'])

Integration With Stack

Tool	Integration
Ansible	community.routeros — provision, configure, update from code
OpenTofu	Triggers Ansible post-provision (switch auto-configures on boot)
PacketFence	RADIUS + SNMP for 802.1X NAC (officially supported)
Graylog	Syslog receiver (point switch logging at Graylog)
OpenTelemetry	SNMP receiver collects switch metrics
Python	REST API or native API for custom scripts/monitoring

Avoid (licensing traps)

Brand	Why Not
Cisco (Catalyst/Nexus)	SmartNet + DNA licenses + per-feature licensing
Aruba/HPE	Pushing cloud subscriptions (Aruba Central)
Meraki	Hardware bricks if license expires
Juniper (Mist)	Cloud-AI management is subscription-based

---

Document created: 2026-07-25 | Status: Planning | Next: Deploy OpenZiti controller on Rack 1 when hardware is ready