sns-network-solutions/infra/future-stack-decisions.md

# Future Stack Decisions — SNS Network Solutions

> Decisions made 2026-07-25 during brainstorming session. Apply these when building out the 3-rack environment.

---

## Decisions Locked

| Decision | Choice | Replaces | Reason |
|----------|--------|----------|--------|
| Perimeter firewall | **OPNsense** | OpenWRT (for racks/client sites) | Enterprise GUI, built-in Suricata IDS/IPS, CARP HA, traffic shaping. OpenWRT stays only for embedded APs. |
| Client/remote connectivity | **OpenZiti** | OpenVPN | OpenVPN is too slow. OpenZiti = zero-trust, no open ports, per-service access, faster (peer-to-peer). |
| Network Access Control | **PacketFence** | Nothing (new layer) | 802.1X, captive portal, device profiling, BYOD enforcement, rogue device isolation. |
| Mesh (personal/homelab) | **NetBird** (keep) | — | Already working. Not for client delivery — that's OpenZiti. |
| LLM API routing | **OpenRouter** | — | API key: sk-or-v1-607da... (free tier, 4000 token cap per request unless credits added) |

---

## The Stack (consolidated)

### Networking & Access (the perimeter + admission + connectivity triad)

```
Internet
    │
    ▼
┌──────────────┐
│  OPNsense    │  ← What traffic is allowed in/out (firewall + IDS/IPS)
└──────┬───────┘
       │
┌──────▼───────┐
│ PacketFence  │  ← Who/what is allowed ON the network (NAC, 802.1X)
└──────┬───────┘
       │
┌──────▼───────┐
│  OpenZiti    │  ← How services are accessed (zero-trust overlay, per-app)
└──────────────┘
```

### Full Stack (3-Rack)

| Layer | Tool | Role |
|-------|------|------|
| Perimeter firewall | OPNsense | Stateful firewall, IDS/IPS (Suricata), VLANs, traffic shaping |
| NAC | PacketFence | Network admission, 802.1X, captive portal, device profiling |
| Zero-trust connectivity | OpenZiti | Service-level access, no open ports, replaces VPN |
| Secrets | OpenBao | All credentials, transit encryption, audit log |
| Identity | OpenLDAP | Employee/contractor directory, SSO source |
| IaC | OpenTofu | Provision client environments reproducibly |
| Observability | Graylog + OpenTelemetry | Log management, SIEM, search, dashboards, alerting (replaces standalone OpenSearch) |
| Vulnerability scanning | OpenVAS | Scheduled client network scans |
| Threat intel | OpenCTI | IOC aggregation, threat actor tracking |
| Honeypots | OpenCanary | Intrusion detection decoys |
| Compliance | OpenSCAP | CIS/NIST benchmark audits |
| Network fleet management | OpenWISP | Manage OPNsense/AP fleets across client sites |
| Storage | OpenZFS | Backup targets, snapshots, data integrity (runs on Proxmox natively) |
| AI agents | OpenClaw + OpenRouter | Chief/Scout/Scribe + LLM API routing |
| Serverless automation | OpenFaaS | Webhook handlers, client onboarding, alert processors |

### Removed / Not Using

| Tool | Reason |
|------|--------|
| ~~OpenVPN~~ | Too slow. Replaced by OpenZiti. |
| ~~ZeroTier~~ (for clients) | Network-level access (full LAN) instead of service-level. Keep NetBird for personal homelab only. |
| ~~OpenWRT~~ | Not using at all. OPNsense covers firewall/routing; no embedded router flashing. |
| ~~OpenProject~~ | Tested on pve2 (LXC 215) — didn't like it. Destroyed. |
| ~~OpenSearch~~ (standalone) | Tested on pve2 (LXC 216) — using Graylog instead (includes OpenSearch under the hood + better UI/SIEM). |

---

## Revenue Services Enabled

| Service | Tools | Billing |
|---------|-------|---------|
| Managed firewall + IDS | OPNsense | Monthly per-site |
| Zero-trust remote access | OpenZiti | Monthly per-endpoint |
| NAC / BYOD enforcement | PacketFence | Setup + monthly |
| Vulnerability scanning | OpenVAS | Monthly/quarterly report |
| Compliance audits | OpenSCAP | Per-engagement |
| Managed backup | OpenZFS + PBS + OMV | Monthly per-TB |
| Threat monitoring | OpenCTI + OpenCanary + Suricata | Monthly retainer |
| Infrastructure builds | OpenTofu + Proxmox + Ansible | Project-based |
| Secrets management | OpenBao (at client) | Setup + monthly |

---

## OpenRouter API

- **Key:** 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
- **Status:** Free tier (4000 token max per request)
- **Usage:** Add `"max_tokens": 500` (or less) to stay within limits
- **Wire into:** LiteLLM or AI Core `.env` when ready
- **Add credits:** https://openrouter.ai/settings/credits

---

---

## Repository Links (all tools)

| Tool | Repo / Site | License |
|------|-------------|---------|
| **OPNsense** | https://github.com/opnsense/core | BSD-2 |
| **OPNcentral** | Built-in OPNsense plugin (os-central) | BSD-2 |
| **PacketFence** | https://github.com/inverse-inc/packetfence | GPL-2.0 |
| **OpenZiti** | https://github.com/openziti/ziti | Apache-2.0 |
| **OpenBao** | https://github.com/openbao/openbao | MPL-2.0 |
| **OpenTofu** | https://github.com/opentofu/opentofu | MPL-2.0 |
| **OpenLDAP** | https://github.com/openldap/openldap | OpenLDAP Public License |
| **OpenTelemetry** | https://github.com/open-telemetry/opentelemetry-collector | Apache-2.0 |
| **OpenTelemetry Contrib** | https://github.com/open-telemetry/opentelemetry-collector-contrib | Apache-2.0 |
| **OpenSearch** | https://github.com/opensearch-project/OpenSearch | Apache-2.0 |
| **OpenVAS** | https://github.com/greenbone/openvas-scanner | GPL-2.0 |
| **OpenCTI** | https://github.com/OpenCTI-Platform/opencti | Apache-2.0 |
| **OpenCanary** | https://github.com/thinkst/opencanary | BSD-3 |
| **OpenSCAP** | https://github.com/ComplianceAsCode/content | BSD-2 |
| **OpenFaaS** | https://github.com/openfaas/faas | MIT |
| **OpenProject** | https://github.com/opf/openproject | GPL-3.0 |
| **OpenZFS** | https://github.com/openzfs/zfs | CDDL / BSD |
| **OpenClaw** | https://github.com/openclaw/openclaw | MIT |
| **OpenRouter** | https://openrouter.ai (API service, not self-hosted) | Commercial (API) |
| **OpenWISP** | https://github.com/openwisp | GPL-3.0 |
| **Proxmox VE** | https://git.proxmox.com | AGPL-3.0 |
| **Grafana** | https://github.com/grafana/grafana | AGPL-3.0 |
| **Prometheus** | https://github.com/prometheus/prometheus | Apache-2.0 |

### Official Docs / Sites

| Tool | Documentation |
|------|--------------|
| OPNsense | https://docs.opnsense.org |
| PacketFence | https://www.packetfence.org/doc/ |
| OpenZiti | https://openziti.io / https://docs.openziti.io |
| OpenBao | https://openbao.org/docs/ |
| OpenTofu | https://opentofu.org/docs/ |
| OpenTelemetry | https://opentelemetry.io/docs/ |
| OpenSearch | https://opensearch.org/docs/ |
| OpenVAS (Greenbone) | https://greenbone.github.io/docs/ |
| OpenCTI | https://docs.opencti.io |
| OpenFaaS | https://docs.openfaas.com |
| OpenProject | https://www.openproject.org/docs/ |

---

## Network Switching — MikroTik (No Licensing)

**Decision:** MikroTik CRS series. Zero license fees forever. RouterOS included with hardware.

### Why MikroTik

- $0 licensing — ever. RouterOS included, free upgrades.
- Full L2/L3 switching + routing in one device
- REST API (RouterOS 7+) + native API (port 8728)
- Full Ansible support (`community.routeros` collection)
- Full Python support (`librouteros`, `routeros-api`, or plain REST)
- PacketFence compatible (SNMP + RADIUS/802.1X)
- Cheapest enterprise-grade option (~$130-500 vs Cisco $1000+)

### Suggested Rack Layout

| Rack | Switch | Model | Role |
|------|--------|-------|------|
| Rack 1 | **CRS354-48G-4S+2Q+** | 48× 1G + 4× SFP+ 10G + 2× QSFP+ 40G | Core/distribution |
| Rack 2 | **CRS326-24G-2S+** | 24× 1G + 2× SFP+ 10G | Client services |
| Rack 3 | **CRS326-24G-2S+** | 24× 1G + 2× SFP+ 10G | Lab/security |
| Inter-rack | 10G SFP+ DAC cables | Between switches | Backbone |

**Total hardware cost: ~$500-700** (Cisco equivalent: $5,000+)

### Automation

**Ansible:**
```yaml
ansible-galaxy collection install community.routeros

# Modules: api, api_modify, api_info, api_facts, command
- community.routeros.api:
    hostname: 192.168.122.10
    path: interface bridge vlan
    add:
      bridge: bridge1
      vlan-ids: 100
```

**Python (REST API — RouterOS 7+):**
```python
import requests
r = requests.get('https://switch-ip/rest/interface',
                 auth=('admin', 'password'), verify=False)
print(r.json())
```

**Python (native API):**
```python
import routeros_api
connection = routeros_api.RouterOsApiPool('switch-ip',
    username='admin', password='password', plaintext_login=True)
api = connection.get_api()
interfaces = api.get_resource('/interface')
for iface in interfaces.get():
    print(iface['name'])
```

### Integration With Stack

| Tool | Integration |
|------|-------------|
| Ansible | `community.routeros` — provision, configure, update from code |
| OpenTofu | Triggers Ansible post-provision (switch auto-configures on boot) |
| PacketFence | RADIUS + SNMP for 802.1X NAC (officially supported) |
| Graylog | Syslog receiver (point switch logging at Graylog) |
| OpenTelemetry | SNMP receiver collects switch metrics |
| Python | REST API or native API for custom scripts/monitoring |

### Avoid (licensing traps)

| Brand | Why Not |
|-------|---------|
| Cisco (Catalyst/Nexus) | SmartNet + DNA licenses + per-feature licensing |
| Aruba/HPE | Pushing cloud subscriptions (Aruba Central) |
| Meraki | Hardware bricks if license expires |
| Juniper (Mist) | Cloud-AI management is subscription-based |

---

*Document created: 2026-07-25 | Status: Planning | Next: Deploy OpenZiti controller on Rack 1 when hardware is ready*