Network Reference #
Quick reference for VLAN assignments and network configuration across Deevnet sites.
mobile VLAN Assignments #
| Segment | VLAN ID | Subnet | Gateway | DHCP |
|---|---|---|---|---|
| Trusted | 10 | 10.20.10.0/24 | 10.20.10.1 | .100-.200 |
| Storage | 20 | 10.20.20.0/24 | 10.20.20.1 | Static only |
| Platform | 25 | 10.20.25.0/24 | 10.20.25.1 | Static only |
| IoT | 30 | 10.20.30.0/24 | 10.20.30.1 | .201-.254; tenants’ device addresses .25-.200 |
| IoT Vendor | 31 | 10.20.31.0/24 | 10.20.31.1 | .100-.200 |
| IoT Backend | 35 | 10.20.35.0/24 | 10.20.35.1 | Static only |
| Guest | 40 | 10.20.40.0/24 | 10.20.40.1 | .50-.250 |
| Tenant Dev | 45 | 10.20.45.0/24 | 10.20.45.1 | .50-.250 |
| Tenant Transit | 50 | 10.20.50.0/24 | 10.20.50.1 | Static only |
| Tenant Underlay | 51 | — | — | None (unrouted) |
| Management | 99 | 10.20.99.0/24 | 10.20.99.1 | .200-.230 (temporary; infrastructure is static or reserved) |
| Blackhole | 999 | — | — | None (unrouted) |
Tenants are not VLANs. Under ADR-0001 a tenant is an EVPN/VXLAN overlay owned by the tenant hypervisor’s fabric, addressed from
10.20.128.0/18by fabric IPAM. The Tenant Transit and Tenant Underlay VLANs are the fabric’s transport: transit to the perimeter, and the VTEP underlay. Creating a tenant changes neither. Tenant Dev is not part of the fabric: it is where a tenant’s developer sits ( CHG-0022).
mobile Hosts by Segment #
From inventory (env.interfaces in host_vars). Trusted, Tenant Dev and Guest hold only DHCP clients.
| Segment | Host | Address | What it is |
|---|---|---|---|
| Management | dv02cor002p01 | 10.20.99.1 | Core router |
dv02wap001p01 | 10.20.99.9 | Wireless AP | |
dv02acc001p01 | 10.20.99.10 | Access switch | |
dv02hyp001p01 | 10.20.99.21 | Management hypervisor | |
dv02hyp002p02 | 10.20.99.22 | Tenant hypervisor | |
dv02nms001v01 | 10.20.99.40 | Network management (Omada controller) | |
dv02col001v01 | 10.20.99.41 | Substrate observability collection | |
dv00bld001p01 | 10.20.99.95 | Builder | |
| Platform | dv02prv001v01 | 10.20.25.20 | Provisioning: the Deevnet API, the tenant state store |
dv02idn001v01 | 10.20.25.21 | Identity: OpenBao, tenant DNS | |
dv02obs001v01 | 10.20.25.22 | Tenant observability: log store, Grafana | |
| IoT Backend | dv02msg001v01 | 10.20.35.20 | Device messaging: the MQTT broker |
| IoT | dv02rpi001p01–dv02rpi004p01 | 10.20.30.11–.14 | The Pi lab |
| Outside the site | dv02edg001p01 | 192.168.8.1 | Edge (travel) router |
Segment Purpose Summary #
| Segment | Trust Level | Purpose |
|---|---|---|
| Management | High | Infrastructure management plane (provisioners, hypervisor mgmt, switches, IPMI) |
| Trusted | High | User devices (workstations, laptops, personal devices) |
| Storage | High | Dedicated storage traffic (NAS, backup targets) |
| Platform | High | Shared infrastructure services (DNS, NTP, artifact mirrors, reverse proxy) |
| Tenant | Medium | Per-tenant workload isolation |
| IoT Backend | Medium | IoT application backends (MQTT, Home Assistant, data pipelines) |
| IoT Vendor | Very Low | Vendor-managed IoT containment zone (cloud-dependent, unauditable) |
| IoT | Medium | Custom-developed embedded devices with controlled firmware (Pis, sensors) |
| Tenant Dev | Low | Tenant developers’ laptops: the tenant-facing services (the API, state store, log store, dashboards, downloads and broker) only, plus internet |
| Guest | Untrusted | Transient visitor access (internet only) |
Canonical Source #
VLAN definitions are maintained in Ansible inventory:
ansible-inventory-deevnet/mobile/group_vars/all/vlans.yml
ansible-inventory-deevnet/home/group_vars/all/vlans.yml
For segment design rationale and trust hierarchy, see the architecture documentation.