# vault

# Physical Hardware

![](https://bookstack.swigg.net/uploads/images/gallery/2021-10/protectli-fw2.jpg)## Basic Components

[Proectli Vault](https://protectli.com/product/fw1/)

### Compute

#### Processor

[Intel Celeron Bay Trail-D J1800](https://ark.intel.com/content/www/us/en/ark/products/78866/intel-celeron-processor-j1800-1m-cache-up-to-2-58-ghz.html) - Provides excellent mix between performance and efficiency using only 10W.

<span class="vertical-table" id="bkmrk-cores-%2F-threads-2-%2F-"><table><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Cores / Threads</td><td>2 / 2</td></tr><tr><td>Base Frequency</td><td>2.41 GHz</td></tr><tr><td>Burst Frequency</td><td>2.58 GHz</td></tr><tr><td>Cache</td><td>1MB L2 Cache</td></tr><tr><td>TDP</td><td>10W</td></tr></tbody></table>

</span>#### GPU

<span class="vertical-table" id="bkmrk-intel-hd-graphics-fo">Intel HD Graphics for Intel Atom Processor Z3700 Series

<table><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Base Frequency</td><td>688 MHz</td></tr><tr><td>Burst Frequency</td><td>792 MHz</td></tr><tr><td>QuickSync Video</td><td>Yes</td></tr></tbody></table>

</span>### Motherboard

<span class="vertical-table" id="bkmrk-form-factor-propriet"><table><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Form Factor</td><td>Proprietary</td></tr><tr><td>CPU</td><td>Soldered Intel Celeron J1800</td></tr><tr><td>Chipset</td><td>unknown</td></tr><tr><td>Memory</td><td>1x DDR3L 1333MHz SODIMM, 1.35v, Max 8GB</td></tr><tr><td>Video</td><td>1x VGA</td></tr><tr><td>Networking</td><td>2x Intel Gigabit 82583V 1GbE</td></tr><tr><td>PCI</td><td>none</td></tr><tr><td>Storage</td><td>- 1x mSATA

</td></tr><tr><td>USB</td><td>- 1x External USB 2.0 (Type-A)
- 1x External USB 3.0 (Type-A)
- 1x Internal USB 2.0 (mPCIe)

</td></tr><tr><td>COM</td><td>1\*RS232</td></tr></tbody></table>

</span>### Memory

<span class="vertical-table" id="bkmrk-slot-1-timetec-hynix"><table><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Slot 1 ![](https://bookstack.swigg.net/uploads/images/gallery/2021-03/scaled-1680-/timetec-ddr3-1866.png)</td><td>Timetec Hynix IC 8GB DDR3L 1333MHz (1x8GB)   
- 2Rx8 Dual Rank
- CAS Latency 13
- 1.35V

</td></tr></tbody></table>

</span>### Case

n/a

### Storage

<span class="vertical-table" id="bkmrk-sata1-dogfish-64gb-m"><table><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>SATA1 ![](https://bookstack.swigg.net/uploads/images/gallery/2021-03/scaled-1680-/dogfish-ssd.png)</td><td>Dogfish 64GB mSATA MLC SSD</td></tr></tbody></table>

</span>### Cooling

n/a

### Power Supply

n/a

### UPS

n/a

## Add-On Cards

<span class="vertical-table" id="bkmrk-mpcie-%28usb%29-protectl"><table><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>mPCIe (USB) ![](https://bookstack.swigg.net/uploads/images/gallery/2021-03/intel-ax200.png)</td><td>Protectli Wifi Adapter   
- Wireless B/G/N at 2.4Ghz
- USB Channel communication

</td></tr></tbody></table>

</span>

# Base Install

## Operating System

---

[Proxmox Virtual Environment](https://www.proxmox.com/en/) 6.x

## Configuration

<p class="callout info">Proxmox configuration has been transitioned to being automated by an [Ansible Role](https://gitlab.swigg.net/dustins/ansible/-/blob/master/proxmox.yml)</p>

# Configuration (deprecated)

## DHCP Server

<table id="bkmrk-domain-subnet-gatewa"><thead><tr><th>Domain</th><th>Subnet</th><th>Gateway</th></tr></thead><tbody><tr><td>hermz</td><td>10.0.0.0/21</td><td>10.0.1.1</td></tr></tbody></table>

### IP Reservations

A few reservations were setup to ensure certain interfaces get a static IP address assigned to make managing these machines/devices easier.

<table id="bkmrk-mac-address-client-i"><thead><tr><th>MAC Address</th><th style="text-align:left">Client Id</th><th style="text-align:right">IP Address</th><th style="text-align:left">Description</th></tr></thead><tbody><tr><td>`02:1c:83:7d:15:8e`</td><td style="text-align:left">firewall</td><td style="text-align:right">10.0.1.1</td><td style="text-align:left">PfSense firewall</td></tr><tr><td>`02:1c:83:7d:15:8e`</td><td style="text-align:left">pihole</td><td style="text-align:right">10.0.2.2</td><td style="text-align:left">Pi-hole DNS</td></tr><tr><td>`02:1c:83:7d:15:8e`</td><td style="text-align:left">wireguarded</td><td style="text-align:right">10.0.2.2</td><td style="text-align:left">wireguarded</td></tr><tr><td>`b4:fb:e4:8f:f9:74`</td><td style="text-align:left"></td><td style="text-align:right">10.0.2.99</td><td style="text-align:left">Ubiquiti UniFi Switch 8</td></tr><tr><td>`e0:d5:5e:63:fe:30`</td><td style="text-align:left">blackbox</td><td style="text-align:right">10.0.3.2</td><td style="text-align:left">[blackbox](https://bookstack.swigg.net/books/blackboxhermz) proxmox management</td></tr><tr><td>`e0:d5:5e:63:fe:30`</td><td style="text-align:left">mini</td><td style="text-align:right">10.0.3.3</td><td style="text-align:left">[mini](https://bookstack.swigg.net/books/minihermz) proxmox management</td></tr><tr><td>`d0:a6:37:ed:8c:7f`</td><td style="text-align:left">silverbook</td><td style="text-align:right">10.0.4.4</td><td style="text-align:left">Dustin's MacBook Pro (wifi)</td></tr><tr><td>`82:13:00:9c:c7:00`</td><td style="text-align:left"></td><td style="text-align:right">10.0.4.5</td><td style="text-align:left">thunderbolt ethernet adapter</td></tr><tr><td>`32:cc:fb:a3:1a:57`</td><td style="text-align:left">docked</td><td style="text-align:right">10.0.44.4</td><td style="text-align:left">docker services</td></tr></tbody></table>

## DNS Resolver

DNS overrides were setup to allow accessing some services directly across the LAN instead of going through the router.

<table id="bkmrk-home-domain-address%2F"> <thead> <th>Home</th> <th>Domain</th> <th>Address/Alias</th> <th>Description</th> </thead> <tr> <td colspan="4">No overrides are currently being used</td> </tr></table>

## Firewall/NAT

<table id="bkmrk-interface-protocol-d"><thead><tr><th>Interface</th><th>Protocol</th><th>Destination</th><th>Port(s)</th></tr></thead><tbody><tr><td>WAN</td><td>IPv4 TCP</td><td>docked.hermz</td><td>80 *(HTTP)*  
8080 *(HTTP alternative)*  
443 *(HTTPS)*  
8443 *(HTTPS alternative)*</td></tr><tr><td>WAN</td><td>IPv4 TCP</td><td>docked.hermz</td><td>2222 *(SSH alternative)*</td></tr><tr><td>WAN</td><td>IPv4 TCP/UDP</td><td>wireguarded.hermz</td><td>51820 *(Wireguard)*</td></tr></tbody></table>

## Dynamic DNS

<table id="bkmrk-interface-service-ho"><thead><tr><th>Interface</th><th>Service</th><th style="text-align:right">Hostname</th></tr></thead><tbody><tr><td>WAN</td><td>Namecheap</td><td style="text-align:right">@.swigg.net</td></tr><tr><td>WAN</td><td>Namecheap</td><td style="text-align:right">\*.swigg.net</td></tr><tr><td>WAN</td><td>Namecheap</td><td style="text-align:right">@.dustins.site</td></tr><tr><td>WAN</td><td>Namecheap</td><td style="text-align:right">\*.dustins.site</td></tr><tr><td>WAN</td><td>Namecheap</td><td style="text-align:right">@.notgandhi.com</td></tr><tr><td>WAN</td><td>Namecheap</td><td style="text-align:right">\*.notgandhi.com</td></tr></tbody></table>

# VM / firewall (needs verification)

## Description

This VM is for running [VyOS](https://en.wikipedia.org/wiki/VyOS) to act as a [firewall](https://en.wikipedia.org/wiki/Firewall_(computing))/[router](https://en.wikipedia.org/wiki/Router_(computing)) for the network. Originally this machine was running [pfSense](https://en.wikipedia.org/wiki/PfSense) (which is excellent) but that is based on [FreeBSD](https://en.wikipedia.org/wiki/FreeBSD) and I wanted a firewall/router based on [Linux](https://en.wikipedia.org/wiki/Linux).

## Configuration

### Resources

<table id="bkmrk-hostname-cpu-memory-"><thead><tr><th>Hostname</th><th>CPU</th><th>Memory</th></tr></thead><tbody><tr><td>firewall</td><td>2 vCPU</td><td>512MB</td></tr></tbody></table>

### Storage

<table id="bkmrk-disk-controller-size"><thead><tr><th>Disk</th><th>Controller</th><th>Size</th><th>Purpose</th></tr></thead><tbody><tr><td>vpool-zfs:vm-104-disk-0</td><td>ide0</td><td>1M</td><td>EFI</td></tr></tbody></table>

### Networking

#### Interfaces

<table id="bkmrk-id-name-bridge-ip-ad"><thead><tr><th>ID</th><th>Name</th><th>Bridge</th><th>IP Address</th></tr></thead><tbody><tr><td>net0</td><td>n/a</td><td>vmbr0</td><td>(DHCP)</td></tr><tr><td>net1</td><td>n/a</td><td>vmbr1</td><td>10.0.1.1/21</td></tr></tbody></table>

# VM / homeassistant

![](https://upload.wikimedia.org/wikipedia/commons/thumb/6/6e/Home_Assistant_Logo.svg/220px-Home_Assistant_Logo.svg.png)## Description

This VM is for running [HomeAssistant](https://www.home-assistant.io/) which acts as the control system for smart home devices with focus on local control and privacy.

## Configuration

### Resources

<table id="bkmrk-hostname-cpu-memory-"><thead><tr><th>Hostname</th><th>CPU</th><th>Memory</th></tr></thead><tbody><tr><td>homeassistant</td><td>2 vCPU</td><td>4096MB</td></tr></tbody></table>

### Storage

<table id="bkmrk-disk-controller-size"><thead><tr><th>Disk</th><th>Controller</th><th>Size</th><th>Purpose</th></tr></thead><tbody><tr><td>vpool-zfs:vm-104-disk-0</td><td>ide0</td><td>1M</td><td>EFI</td></tr></tbody></table>

### Networking

#### Interfaces

<table id="bkmrk-id-name-bridge-ip-ad"><thead><tr><th>ID</th><th>Name</th><th>Bridge</th><th>IP Address</th></tr></thead><tbody><tr><td>net0</td><td>n/a</td><td>vmbr0</td><td>(DHCP)</td></tr></tbody></table>