Repository navigation
feat: add services VLAN 50 for long-lived service VMs - #23
Conversation
Routed 10.10.50.0/24 for long-lived service VMs (first: media01 on nas01), off both management VLAN 10 and the OVN-owned VLAN 40 uplink. - gw01: eth1 vif 50 10.10.50.1/24, SERVICES_FORWARD/SERVICES_LOCAL, management-to-services accept, DHCP LAB_SERVICES, CoreDNS binds. - sw-core01: VLAN 50 tagged on sfp-sfpplus8 (gw01) and sfp-sfpplus7 (nas01). Apply sw-core01 first, then gw01.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8176a6799f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1,5 +1,5 @@ | |||
| glab.lol:53 { | |||
| bind 10.10.10.54 10.10.10.1 10.10.40.1 10.10.70.1 | |||
| bind 10.10.10.54 10.10.10.1 10.10.40.1 10.10.50.1 10.10.70.1 | |||
There was a problem hiding this comment.
On an in-place gw01 rollout, the assets stage only overwrites the mounted Corefile, and the subsequent configuration load does not change the container definition or explicitly restart it. CoreDNS rereads a changed Corefile only when its reload plugin is configured, which this Corefile does not enable; VyOS's restart always setting merely controls behavior after the container exits. Consequently, the running process retains its old listeners and does not answer on 10.10.50.1, while the existing verification probes only VLAN 10 and still passes. Restart CoreDNS after the new interface is committed, or otherwise add a reliable post-commit reload mechanism.
Useful? React with 👍 / 👎.
The VLAN 50 sync staged a Corefile binding 10.10.50.1, but the running container kept its old listeners until a manual restart.
1 participant
Summary
Adds a routed services VLAN 50 (
10.10.50.0/24, gateway10.10.50.1on gw01) for long-lived service VMs. First consumer:media01(static10.10.50.20) on Incus member nas01. It sits off both management VLAN 10 and the OVN-owned VLAN 40 uplink.Path:
gw01 eth1 (SFP+ 2) ⇄ sw-core01 sfp-sfpplus8(trunk) andsw-core01 sfp-sfpplus7 ⇄ nas01. The lab LAGs do not carry VLAN 50.gw01 (
vyos/gw01/config.boot.tmpl)eth1 vif 50holds10.10.50.1/24directly. There is no bridge because no untagged access port shares the VLAN. The header interface map is updated.LAB_SERVICES 10.10.50.0/24.eth1.50→SERVICES_FORWARD/SERVICES_LOCAL.shared-network-name LAB_SERVICES(subnet-id 4, router and DNS10.10.50.1, range.200–.250), listening oneth1.50.assets/coredns/Corefile) binds10.10.50.1for bothglab.loland the recursive zone. Its listeners are per-address.Firewall policy
!RFC1918)MGMT_FORWARDrule 35)WAN_FORWARDaccepts any HOME_NETWORKS source)TAILSCALE_FORWARD→LAB_NETWORKS 10.10.0.0/16,TS_ROUTESalready includes 10.10.0.0/16)10.10.0.0/16)sw-core01 (
routeros/sw-core01/bridge.tf)routeros_interface_bridge_vlan.vlan50, tagged onsfp-sfpplus8(gw01 trunk) andsfp-sfpplus7(nas01). Both ports are alreadyadmit-only-vlan-taggedbridge ports. README note added.Tooling
verify.pypost-sync assertions now requireeth1 vif 50 address 10.10.50.1/24, the DHCP listener oneth1.50, and the rule 150 jumps. The operational check requireseth1.50up with its address.policy.pyrequires the services gateway in the template. Tests are updated, and one new test asserts that services → management is blocked.Apply order
just snapshot && just plan && just apply. The expected plan is 1 to add (vlan50) with nothing else changed.CI= moon run network:vyos-sync.Validation
moon run network:checkpasses: lock, format, lint, typecheck, pytest (43 passed), vyos-validate, routeros-check (tofu fmt -check,validate).tofu planand VyOS commit-time syntax checks were not run because they need device credentials or the live box.