Home Site: Project Plan #

The Mobile Factory builds sites as well as tenants. The home site (home.deevnet.net, site code 01) is the next one: a site that hosts several tenants’ Deevnet Pis. It is not built. Its site code, zone and address space are reserved in the Naming standard.

Roadmap item: Home Site

✓ 0 | ↻ 0 | ⏳ 7 (7 total)

Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned

Project Vision & Scope #

Home is built at the factory and deployed at home. The Builder comes home and runs Ansible against the home inventory; nothing at home is changed any other way. Tenants at home have no self-service: a change starts at the factory and arrives as a new image or a configuration change.

In Scope

Home’s own PKI, network, DNS and DHCP
Hosting tenants’ Deevnet Pis, which carry their own services ( ADR-0041)

Out of Scope

A hypervisor at home, and tenant workloads on it, until a tenant needs them
A broker, a device registry or a Deevnet API at home: a Pi is its devices’ broker and registry
A VPN between the sites, with home hosting it and the mobile site’s router as a client. If one is built, revisit how router backups are kept first. Each router’s config.xml is backed up vault-encrypted into the public inventory ( Rebuild the Core Router), which is acceptable today because nothing in it works from outside the network. VPN keys would. The options then: a separate vault password for router backups, a private repository for them, or rotating the VPN keys whenever the vault password changes

PKI ⏳ #

⏳ Home Site CA. Signed by the root in a ceremony (path 2), held offline ( ADR-0039 §1).
⏳ Home Substrate CA. Its key in home’s vault, signed by the Home Site CA (path 3); home’s infrastructure certificates issued from it by Ansible.

Network ⏳ #

⏳ Home inventory. Hosts, VLANs and firewall policy, in the home inventory beside the mobile site’s.
⏳ DNS and DHCP on the core router, OPNsense with Unbound, as on the mobile site.
⏳ DNS for hosted Pis. Each Pi’s site-less names (<service>.<tenant>.deevnet.net) and the site names it carries, from the home inventory ( ADR-0040).

Later ⏳ #

⏳ Kea for DHCP, for the API support found wanting on the mobile site.
⏳ A hypervisor at home, when a tenant needs workloads there.