b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
105 lines
4.4 KiB
Markdown
105 lines
4.4 KiB
Markdown
# Hybrid Networking — SNS Digital
|
|
|
|
**Entity:** SNS Digital · **Status:** Partially built (WireGuard/Tailscale active)
|
|
|
|
## What it is
|
|
|
|
The overlay network that connects on-prem Proxmox VMs to cloud providers securely.
|
|
Makes location transparent — a VM on Proxmox and a VPS on Linode appear on the same
|
|
private network.
|
|
|
|
## Stack
|
|
|
|
| Component | Software | FOSS | Role |
|
|
|-----------|----------|------|------|
|
|
| Mesh VPN | Tailscale | Partial (client FOSS, control plane proprietary) | Zero-config mesh for management access |
|
|
| Site-to-site | WireGuard | Yes | Persistent tunnels between sites (Proxmox ↔ Linode) |
|
|
| DNS | AdGuard Home (on-prem) + split horizon | Yes | Internal names resolve to private IPs |
|
|
| Bastion | Linode Nanode | N/A | Public SSH/WireGuard endpoint, ProxyJump target |
|
|
|
|
## Current Topology
|
|
|
|
```
|
|
┌──────────────┐ WireGuard ┌──────────────────┐
|
|
│ Proxmox │◄──────────────────────────►│ Linode Bastion │
|
|
│ 192.168.122.x│ (always-on) │ 172.238.163.85 │
|
|
└──────┬───────┘ └────────┬─────────┘
|
|
│ │
|
|
│ Tailscale mesh (management) │ Public IP
|
|
│ │
|
|
┌──────┴───────┐ ┌────────┴─────────┐
|
|
│ Workstation │ │ Internet/SSH │
|
|
│ (Sam's PC) │ │ clients │
|
|
└──────────────┘ └──────────────────┘
|
|
|
|
Racknerd boxes: WireGuard peer to Linode (hub-and-spoke)
|
|
AWS VPC: future — VPN Gateway or WireGuard on EC2 when needed
|
|
```
|
|
|
|
## Design Decisions
|
|
|
|
1. **WireGuard for infrastructure, Tailscale for people.** WireGuard tunnels are
|
|
persistent, config-file driven, Ansible-managed. Tailscale is for ad-hoc
|
|
management access from laptops/phones.
|
|
2. **Linode is the hub.** All WireGuard peers connect to Linode. On-prem and Racknerd
|
|
boxes don't need public IPs — they reach each other through the hub.
|
|
3. **No split tunneling for services.** Only management traffic goes over the mesh.
|
|
Service traffic (web, API) goes through the public reverse proxy path.
|
|
4. **ProxyJump, not port forwarding.** SSH to internal VMs uses `ProxyJump linode`
|
|
(already in your SSH config). No ports exposed on the bastion beyond SSH + WireGuard.
|
|
|
|
## Build Steps (WireGuard hub-and-spoke)
|
|
|
|
1. **Linode (hub):**
|
|
```ini
|
|
# /etc/wireguard/wg0.conf
|
|
[Interface]
|
|
Address = 10.10.0.1/24
|
|
ListenPort = 51820
|
|
PrivateKey = <hub-private-key>
|
|
|
|
[Peer] # Proxmox
|
|
PublicKey = <proxmox-public-key>
|
|
AllowedIPs = 10.10.0.2/32, 192.168.122.0/24
|
|
|
|
[Peer] # Racknerd1
|
|
PublicKey = <rn1-public-key>
|
|
AllowedIPs = 10.10.0.3/32
|
|
```
|
|
|
|
2. **Proxmox (spoke):**
|
|
```ini
|
|
[Interface]
|
|
Address = 10.10.0.2/24
|
|
PrivateKey = <proxmox-private-key>
|
|
|
|
[Peer] # Linode hub
|
|
PublicKey = <hub-public-key>
|
|
Endpoint = 172.238.163.85:51820
|
|
AllowedIPs = 10.10.0.0/24
|
|
PersistentKeepalive = 25
|
|
```
|
|
|
|
3. **Enable IP forwarding** on Linode: `net.ipv4.ip_forward = 1`
|
|
4. **Firewall:** UFW on Linode allows UDP 51820 inbound. Forward rules for inter-spoke.
|
|
5. **DNS:** AdGuard on-prem resolves `*.wg.internal` to 10.10.0.x addresses.
|
|
|
|
## Security Posture
|
|
|
|
- **WireGuard:** Authenticated encryption (ChaCha20 + Poly1305). No pre-shared keys
|
|
needed for this threat model, but can add for post-quantum hedge.
|
|
- **Bastion exposure:** Only SSH (22/tcp) + WireGuard (51820/udp) on public IP.
|
|
Everything else is default-deny.
|
|
- **Key rotation:** WireGuard keys rotated annually (low urgency — Noise protocol
|
|
provides forward secrecy per session).
|
|
- **No cloud provider VPN dependencies.** Pure WireGuard means portable across providers.
|
|
|
|
## Upgrade Path
|
|
|
|
- **Headscale:** Self-hosted Tailscale control plane if the proprietary coordination
|
|
server becomes a concern.
|
|
- **AWS Site-to-Site VPN:** When a client VPC needs persistent connectivity and
|
|
WireGuard-on-EC2 isn't enterprise-palatable.
|
|
- **Multi-hub:** Add a second WireGuard hub (Racknerd or second Linode) for redundancy
|
|
if the single Linode becomes a SPOF.
|