padriano/composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: document static host IP and DHCP pool for external access

Browse source 
Record the final networking setup: host static 192.168.1.2 (netplan),
HA/Samba macvlan .246/.247, DHCP pool narrowed to .11-.245 so the
statics stay protected, and why static-at-host beats DHCP reservation
on the NOS router. Hard-code 192.168.1.2 in the port-forward table.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
padriano 2026-06-22 21:46:45 +01:00
parent 7e898d7b22
commit b896bfcb79
1 changed files with 64 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

68
README.md
View file

@ -189,10 +189,7 @@ Visit `http://server:3000` on first start (LAN only) and complete the install wi
| Web UI | `http://server:3000` | `https://git-padriano.duckdns.org` |
| Git SSH | `ssh://git@server:2222` | `ssh://git@git-padriano.duckdns.org:2222` |
For external access, forward these ports on your router to the server IP:
- TCP `443` → Caddy (HTTPS — serves both HA and Forgejo)
- TCP `2222` → Forgejo SSH
For external access, forward these ports on your router to the server IP — see [Networking & External Access](#networking--external-access) below for the full setup.
#### Git remote URL examples
@ -209,6 +206,69 @@ git clone ssh://git@server:2222/padriano/my-repo.git
---
## Networking & External Access
### Address layout
The stack uses fixed addresses on the `192.168.1.0/23` LAN:
| Address | Belongs to | Assigned by |
|---------|------------|-------------|
| `192.168.1.2` | The server host itself (Docker publishes Caddy `:443`/`:80` and Forgejo `:2222` here) | Static at the OS level — netplan `/etc/netplan/99-server-static.yaml` on interface `enp0s31f6` |
| `192.168.1.246` | `homeassistant` macvlan interface | Static (`docker-compose.yml`) |
| `192.168.1.247` | `samba` macvlan interface | Static (`docker-compose.yml`) |
Caddy and Forgejo publish their ports on the **host IP** (`192.168.1.2`, via Docker port mapping) — *not* on `192.168.1.246`. The macvlan IP belongs only to the Home Assistant container; Caddy reaches HA over the internal bridge network by container name.
#### Keeping these IPs stable (router DHCP)
All three static IPs must sit **outside the router's DHCP pool** so the router can never lease them to another device. On the NOS F@st 5670 the DHCP pool is set to:
- **Pool start `192.168.1.11`, end `192.168.1.245`** — this leaves `.2`–`.10` and `.246`–`.254` free for static use.
> **Why static-at-the-host instead of a DHCP reservation:** the NOS router only reserves a device's *current* lease, and refuses to reserve any IP already present in the DHCP leases table. Combined with the macvlan containers (which don't use DHCP at all and never appear in the leases table), reservations proved unworkable. Pinning the host IP in netplan and carving the static range out of the DHCP pool is the reliable approach.
>
> **History:** the host originally took `192.168.1.246` from DHCP — the *same* IP statically assigned to the Home Assistant container — causing an address collision (two MACs answering for `.246`). Moving the host to a static `.2` outside the pool resolved it.
To re-apply the host static IP after a fresh OS install, recreate `/etc/netplan/99-server-static.yaml`:
```yaml
network:
version: 2
renderer: NetworkManager
ethernets:
enp0s31f6:
dhcp4: false
addresses:
- 192.168.1.2/23
routes:
- to: default
via: 192.168.1.1
nameservers:
addresses: [192.168.1.1, 1.1.1.1]
```
Then `sudo netplan apply`. Cloud-init network management is disabled via `/etc/cloud/cloud.cfg.d/99-disable-network-config.cfg` (`network: {config: disabled}`) so it doesn't override this on reboot.
### Router port forwarding
Forward exactly two ports to the host IP `192.168.1.2`. The single `443` rule serves **both** sites — Caddy routes by hostname.
| Service | Protocol | External port | Internal host | Internal port |
|---------|----------|---------------|---------------|---------------|
| HTTPS (Caddy → Home Assistant **and** Forgejo) | TCP | 443 | `192.168.1.2` | 443 |
| Forgejo SSH | TCP | 2222 | `192.168.1.2` | 2222 |
Do **not** forward:
- `8123` (Home Assistant) — bypasses Caddy and exposes the UI over plaintext HTTP. Use `https://ha-padriano.duckdns.org` instead.
- `3000` (Forgejo) — not exposed on the host; access is via Caddy only.
- `22` — not used by this stack; Forgejo SSH is on `2222`.
Port `80` is optional — forward it only if you want bare `http://` requests auto-redirected to HTTPS. It is **not** required for certificates, which use the DuckDNS DNS-01 challenge.
---
## Disk Space
```bash