sam/sns-network-solutions
1
0
Fork 0
Code Issues 31 Pull Requests 5 Actions Packages Projects Releases Wiki Activity
c4bd17ed37
sns-network-solutions/infra/future-stack-decisions.md
Samuel James 4831152b25 restructure: new corporate structure (Technology Group, Hospitality Group, Properties) 
- Add SnS Technology Group LLC (planned)
- Add SnS Hospitality Group LLC (Kiowa Scott 15%, coffee trailers 2-year plan)
- Add SnS Properties LLC (planned)
- Move 04-foodtruck1 to sns-hospitality-group/indian-food-truck-legacy
- Add Kiowa partnership agreement HTML (Option C split-grant, group-level)
- Add NDA, equity framework, legal services docs
- Add coffee trailers business plan (10 locations, NW IN + S. Michigan)
- Add corporate structure HTML (visual org chart)
- Add Holdings legal docs (certificate, EIN, operating agreement HTML)
2026-08-12 07:33:30 -05:00

9.4 KiB
Raw Blame History

Future Stack Decisions — SNS Network Solutions

Decisions made 2026-07-25 during brainstorming session. Apply these when building out the 3-rack environment.

Decisions Locked

Decision Choice Replaces Reason
Perimeter firewall OPNsense OpenWRT (for racks/client sites) Enterprise GUI, built-in Suricata IDS/IPS, CARP HA, traffic shaping. OpenWRT stays only for embedded APs.
Client/remote connectivity OpenZiti OpenVPN OpenVPN is too slow. OpenZiti = zero-trust, no open ports, per-service access, faster (peer-to-peer).
Network Access Control PacketFence Nothing (new layer) 802.1X, captive portal, device profiling, BYOD enforcement, rogue device isolation.
Mesh (personal/homelab) NetBird (keep) — Already working. Not for client delivery — that's OpenZiti.
LLM API routing OpenRouter — API key: sk-or-v1-607da... (free tier, 4000 token cap per request unless credits added)

The Stack (consolidated)

Networking & Access (the perimeter + admission + connectivity triad)

Internet
    │
    ▼
┌──────────────┐
│  OPNsense    │  ← What traffic is allowed in/out (firewall + IDS/IPS)
└──────┬───────┘
       │
┌──────▼───────┐
│ PacketFence  │  ← Who/what is allowed ON the network (NAC, 802.1X)
└──────┬───────┘
       │
┌──────▼───────┐
│  OpenZiti    │  ← How services are accessed (zero-trust overlay, per-app)
└──────────────┘

Full Stack (3-Rack)

Layer Tool Role
Perimeter firewall OPNsense Stateful firewall, IDS/IPS (Suricata), VLANs, traffic shaping
NAC PacketFence Network admission, 802.1X, captive portal, device profiling
Zero-trust connectivity OpenZiti Service-level access, no open ports, replaces VPN
Secrets OpenBao All credentials, transit encryption, audit log
Identity OpenLDAP Employee/contractor directory, SSO source
IaC OpenTofu Provision client environments reproducibly
Observability Graylog + OpenTelemetry Log management, SIEM, search, dashboards, alerting (replaces standalone OpenSearch)
Vulnerability scanning OpenVAS Scheduled client network scans
Threat intel OpenCTI IOC aggregation, threat actor tracking
Honeypots OpenCanary Intrusion detection decoys
Compliance OpenSCAP CIS/NIST benchmark audits
Network fleet management OpenWISP Manage OPNsense/AP fleets across client sites
Storage OpenZFS Backup targets, snapshots, data integrity (runs on Proxmox natively)
AI agents OpenClaw + OpenRouter Chief/Scout/Scribe + LLM API routing
Serverless automation OpenFaaS Webhook handlers, client onboarding, alert processors

Removed / Not Using

Tool Reason
OpenVPN Too slow. Replaced by OpenZiti.
ZeroTier (for clients) Network-level access (full LAN) instead of service-level. Keep NetBird for personal homelab only.
OpenWRT Not using at all. OPNsense covers firewall/routing; no embedded router flashing.
OpenProject Tested on pve2 (LXC 215) — didn't like it. Destroyed.
OpenSearch (standalone) Tested on pve2 (LXC 216) — using Graylog instead (includes OpenSearch under the hood + better UI/SIEM).

Revenue Services Enabled

Service Tools Billing
Managed firewall + IDS OPNsense Monthly per-site
Zero-trust remote access OpenZiti Monthly per-endpoint
NAC / BYOD enforcement PacketFence Setup + monthly
Vulnerability scanning OpenVAS Monthly/quarterly report
Compliance audits OpenSCAP Per-engagement
Managed backup OpenZFS + PBS + OMV Monthly per-TB
Threat monitoring OpenCTI + OpenCanary + Suricata Monthly retainer
Infrastructure builds OpenTofu + Proxmox + Ansible Project-based
Secrets management OpenBao (at client) Setup + monthly

OpenRouter API

  • Key: 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
  • Status: Free tier (4000 token max per request)
  • Usage: Add "max_tokens": 500 (or less) to stay within limits
  • Wire into: LiteLLM or AI Core .env when ready
  • Add credits: https://openrouter.ai/settings/credits

Repository Links (all tools)

Tool Repo / Site License
OPNsense https://github.com/opnsense/core BSD-2
OPNcentral Built-in OPNsense plugin (os-central) BSD-2
PacketFence https://github.com/inverse-inc/packetfence GPL-2.0
OpenZiti https://github.com/openziti/ziti Apache-2.0
OpenBao https://github.com/openbao/openbao MPL-2.0
OpenTofu https://github.com/opentofu/opentofu MPL-2.0
OpenLDAP https://github.com/openldap/openldap OpenLDAP Public License
OpenTelemetry https://github.com/open-telemetry/opentelemetry-collector Apache-2.0
OpenTelemetry Contrib https://github.com/open-telemetry/opentelemetry-collector-contrib Apache-2.0
OpenSearch https://github.com/opensearch-project/OpenSearch Apache-2.0
OpenVAS https://github.com/greenbone/openvas-scanner GPL-2.0
OpenCTI https://github.com/OpenCTI-Platform/opencti Apache-2.0
OpenCanary https://github.com/thinkst/opencanary BSD-3
OpenSCAP https://github.com/ComplianceAsCode/content BSD-2
OpenFaaS https://github.com/openfaas/faas MIT
OpenProject https://github.com/opf/openproject GPL-3.0
OpenZFS https://github.com/openzfs/zfs CDDL / BSD
OpenClaw https://github.com/openclaw/openclaw MIT
OpenRouter https://openrouter.ai (API service, not self-hosted) Commercial (API)
OpenWISP https://github.com/openwisp GPL-3.0
Proxmox VE https://git.proxmox.com AGPL-3.0
Grafana https://github.com/grafana/grafana AGPL-3.0
Prometheus https://github.com/prometheus/prometheus Apache-2.0

Official Docs / Sites

Tool Documentation
OPNsense https://docs.opnsense.org
PacketFence https://www.packetfence.org/doc/
OpenZiti https://openziti.io / https://docs.openziti.io
OpenBao https://openbao.org/docs/
OpenTofu https://opentofu.org/docs/
OpenTelemetry https://opentelemetry.io/docs/
OpenSearch https://opensearch.org/docs/
OpenVAS (Greenbone) https://greenbone.github.io/docs/
OpenCTI https://docs.opencti.io
OpenFaaS https://docs.openfaas.com
OpenProject https://www.openproject.org/docs/

Network Switching — MikroTik (No Licensing)

Decision: MikroTik CRS series. Zero license fees forever. RouterOS included with hardware.

Why MikroTik

  • $0 licensing — ever. RouterOS included, free upgrades.
  • Full L2/L3 switching + routing in one device
  • REST API (RouterOS 7+) + native API (port 8728)
  • Full Ansible support (community.routeros collection)
  • Full Python support (librouteros, routeros-api, or plain REST)
  • PacketFence compatible (SNMP + RADIUS/802.1X)
  • Cheapest enterprise-grade option (~$130-500 vs Cisco $1000+)

Suggested Rack Layout

Rack Switch Model Role
Rack 1 CRS354-48G-4S+2Q+ 48× 1G + 4× SFP+ 10G + 2× QSFP+ 40G Core/distribution
Rack 2 CRS326-24G-2S+ 24× 1G + 2× SFP+ 10G Client services
Rack 3 CRS326-24G-2S+ 24× 1G + 2× SFP+ 10G Lab/security
Inter-rack 10G SFP+ DAC cables Between switches Backbone

Total hardware cost: ~$500-700 (Cisco equivalent: $5,000+)

Automation

Ansible:

ansible-galaxy collection install community.routeros

# Modules: api, api_modify, api_info, api_facts, command
- community.routeros.api:
    hostname: 192.168.122.10
    path: interface bridge vlan
    add:
      bridge: bridge1
      vlan-ids: 100

Python (REST API — RouterOS 7+):

import requests
r = requests.get('https://switch-ip/rest/interface',
                 auth=('admin', 'password'), verify=False)
print(r.json())

Python (native API):

import routeros_api
connection = routeros_api.RouterOsApiPool('switch-ip',
    username='admin', password='password', plaintext_login=True)
api = connection.get_api()
interfaces = api.get_resource('/interface')
for iface in interfaces.get():
    print(iface['name'])

Integration With Stack

Tool Integration
Ansible community.routeros — provision, configure, update from code
OpenTofu Triggers Ansible post-provision (switch auto-configures on boot)
PacketFence RADIUS + SNMP for 802.1X NAC (officially supported)
Graylog Syslog receiver (point switch logging at Graylog)
OpenTelemetry SNMP receiver collects switch metrics
Python REST API or native API for custom scripts/monitoring

Avoid (licensing traps)

Brand Why Not
Cisco (Catalyst/Nexus) SmartNet + DNA licenses + per-feature licensing
Aruba/HPE Pushing cloud subscriptions (Aruba Central)
Meraki Hardware bricks if license expires
Juniper (Mist) Cloud-AI management is subscription-based

Document created: 2026-07-25 | Status: Planning | Next: Deploy OpenZiti controller on Rack 1 when hardware is ready