home-network-controllers

Files (1)

• SKILL.md

SKILL.md (first lines)

# Home network controllers

Full guide: `docs/network/home-network-controllers.md`.

## Any vendor

1. VLANs: clients vs servers (optional IoT)  
2. DHCP DNS → Technitium  
3. Exclude Cilium LB range from DHCP  
4. DNS redirect only where it cannot blackhole DNS upstream  

## Hard rule

Never redirect **servers VLAN** :53 in a way that catches the DNS host’s own queries to 1.1.1.1.

## Related

`skills/technitium-split-dns` · `docs/platform/hardware-topologies.md`


## Layer-0 rules (added)
- Resolvers on a **dedicated DNS network**; per-network DNAT `dst 53 AND dst NOT the DNS network → primary` (covers servers too, no upstream blackhole).
- Zones: default-deny between internal zones; named allows with a one-line description; block IoT-local and cameras → internet; admin paths (management + admin MACs) before moving your own devices; a break-glass port.
- Device names: per-network domain `<network>.local.<domain>` + resolver forwarder zone → gateway; guests on DHCP reservations.
- Before blaming Wi-Fi: uplink error counters and negotiated link speeds.
- UniFi API: `setting_preference: manual` for WLAN advanced fields; unique NAT `rule_index`; one login per run (rate limit); read back every write.
Full doc: `docs/network/network-foundation.md`.

## Moving and adopting switches (added)
- **Adoption replaces a switch's port configuration.** Save the old port overrides as data first and re-apply them right after adopting, or trunks become "all networks" and native VLANs reset.
- **After any cable move, read the port's LLDP neighbour before enabling it.** The wrong end of an uplink joins two routers on one subnet.
- **Never adopt a switch that carries live traffic before its VLANs exist on the new gateway.**
- **Network boot:** the gateway's DHCP option is one filename per network (UEFI or BIOS). A proxyDHCP serves both without touching the gateway's DHCP (`docs/platform/omni-and-netboot.md`).
- **Recovery notes rot:** after each migration step, re-read the "how do I get back in" document. A fallback that names a network which no longer exists is worse than none.

From giovannirco/agentic-homelab, MIT.

More from giovannirco/agentic-homelab