vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(mesh): retire nh3-dev from the mesh and revert the masquerade it required

Browse Source 
nh3-dev sits on the NH3 LAN and reaches every site through its own default
gateway; RouteAll was already false, so it never used the tunnel for routing.
Membership bought a 100.64.0.4 address nothing referenced -- grep across the
repo and ~/development found only docs and memory hits.

It also cost something concrete. A host running Tailscale installs
-A ts-input -s 100.64.0.0/10 ! -i tailscale0 -j DROP, and because the fleet's
subnet routers preserve source rather than masquerading RFC1918, a mesh client's
packet reached nh3-dev's ens18 still sourced 100.64.x and was dropped silently.
That is why nh3-dev.nh3.internal failed from the mesh while every NH3 host that
does not run Tailscale worked, and it needed a -d 10.100.10.50/32 -j MASQUERADE
exception on nh3-scale to paper over. Retiring the membership removed the
anti-spoof rule, so the exception went with it -- mesh-exit-masq.sh is back to
the two rules it had before yesterday.

Verified after: nh3-dev reachable at 10.100.10.50 from ESH, Anaheim, FV, Irvine
and NH3, and reaching all four sites plus the internet itself. fv-ml1
unaffected.

The mesh is now six nodes and every one has a job: three site routers,
vb-gateway, irv-ml1 (Irvine's own router, no separate scale node), and the
operator's MacBook Air. Nothing is enrolled just in case.
This commit is contained in:
vh
2026-09-15 01:05:23 -07:00
parent 959a743256
commit a65cdf65d9
3 changed files with 17 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
persistent-memory.md
+5 -5
View File
@@ -137,14 +137,14 @@ Anaheim only. Commits `fa04f45`, `0ab9da5`.
### Fleet hygiene landed
`root:docker 2775` setgid deploy trees on all 5 hosts + `0777` cleared (`826a63b`);
conventions pinned in `docs/pfi/fleet-conventions.md` with a read-only audit playbook
(`abef67a`); `linus` deleted and `llmuser` de-privileged (`ce7b07f`); nh3-dev reachable
from the mesh at its LAN address (`9dbd829`); ESPHome pinned/relocated/rotated
(`abef67a`); `linus` deleted and `llmuser` de-privileged (`ce7b07f`); nh3-dev retired from the mesh and its masquerade
exception reverted with it (`9dbd829` superseded); ESPHome pinned/relocated/rotated
(`d1769ed` ff); `kb` KB-search tool shipped (`68fa80f`).
### Open loose ends (none blocking)
- **nh3-dev is still a bare mesh member** — retirement authorized, never executed.
**Operator's call.** (fv-ml1 IS now retired: off-mesh, node record deleted, reaching the
fleet on the gateway's SNAT alone, with break-glass rejoin as its safety net.)
- ✅ **Mesh membership retired for both nh3-dev and fv-ml1** (2026-09-15). Six nodes remain:
the three site routers, vb-gateway, irv-ml1 (Irvine's own router) and the MacBook Air.
Every one of those has a job; nothing is enrolled "just in case" any more.
- ✅ **Stale reusable pre-auth keys retired** (IDs 5, 6 expired). The mesh now has exactly
one live reusable key: the dedicated fv-ml1 break-glass key, ID 8, expires 2027-09-15,
vaulted `fv-ml1/headscale-breakglass-key`.