HOMEHOMELABNETMAPTASK LOGDOSSIERDEEP THOUGHTCONTINUUMRADARTRACEROUTEOLLAMAGARMINNET HUD
N9LYA
PAGE LOAD: --
RETIRE IN: -- days
LAN: 192.168.1.0/24 · Gateway: 192.168.1.xxx
🕐 ET: --:--:-- SUBNET: 192.168.1.0/24 44NET: 44.48.0.40/24 (N9LYA-8) IPv6: 2001:470:1f11:372::/64 (HE Tunnel #430369) RETIRE: AUG 13, 2026 ⭐
WAN / ISP
⚡ Sparklight (Cable)
Primary · DOCSIS 3.1 Coax
~300↓ / 30↑ Mbps · ~5 TB/mo soft cap
High usage warning — Plex drives bulk of traffic
Modem → MikroTik ether1 (WAN port)
Static estimate — live speed test not yet configured
✗ Frontier Fiber (cancelled)
Ticket #9331641 · Damaged drop cable
Upload near zero — cancelled, no ETF
Account zeroed / billing resolved
CORE ROUTER
🌐
MikroTik RB5009UG+S+
RouterOS 7.22.1 Stable · hostname: wireguard-pop
10G SFP+ uplink to Proxmox (Intel X520-DA2, ~2.61 Gbps iperf3)
The Dude disabled (was causing Winbox login storm)
DHCP: 192.168.1.xxx–200 · DNS: 192.168.1.xxx (AdGuard)
API brute-force blocked · Ollama NAT rule disabled
⚠ Firewall rule *46 misconfigured — auto-blacklists any IP on its 2nd SSH connection to port 22 (found in audit 7/25/26, fix pending)
DHCP Server WireGuard Hub IPv6 HE Tunnel BGP/OSPF Rule *46 Bug
192.168.1.xxxGateway
CORE SWITCH — CRS .3 · RADIO ROOM
🔀
MikroTik CRS326-24G-2S+ (Mikrotik_CRS1)
SwOS · Rev r2 · S/N: HGH09M0FSMF · MAC: d4:01:c3:bd:a3:9a
24× GbE + 2× SFP+ 10G · Static 192.168.1.xxx
SFP1 → RB5009 (10G uplink to router)
SFP2 → CRS-Bedroom (10G inter-switch)
Active: AC5300 WiFi AP · Ilo-4 Plexnas · HDHR_EXTEND · HDHR_Flex_4K_Dev · RPC-3 · SolarEdge Inverter
Temp: 67°C · Uptime: 71d+ at last check
SwOS confirmed by design — no SSH/Telnet/Winbox/API on this switch (audit 7/25/26)
CRS326-24G-2S+ SwOS 10G Spine
192.168.1.xxxStatic · SwOS
CORE SWITCH — CRS .2 · BEDROOM
🔀
MikroTik CRS326-24G-2S+ (Mikrotik_CRS2)
SwOS · Rev r2 · S/N: HGQ09X0H3DX · MAC: d4:01:c3:f9:b2:f4
24× GbE + 2× SFP+ 10G · Static 192.168.1.xxx
SFP1 → CRS-RadioRoom (10G inter-switch)
SFP2 → Proxmox DL380 Gen9 (10G to hypervisor)
Active: Buffalo AP · Buffalo Switch · Dell Laptop · N9LYA URONode · BPQ32 N9LYA · RPi-K9UY URONode · MMDVM RPi
Temp: 76°C ⚠️ · Uptime: 5h57m at last check (recent reboot)
SwOS confirmed by design — no SSH/Telnet/Winbox/API on this switch (audit 7/25/26) · worth continued monitoring at 76°C
CRS326-24G-2S+ SwOS 10G Spine 76°C ⚠
192.168.1.xxxStatic · SwOS
PROXMOX HYPERVISOR — HP DL380 Gen9
192.168.1.xxx · 2× Intel Xeon E5-2690v4 · 256 GB DDR4 · 36 TB Storage · 2× Tesla P4 GPU (60W limit, persistence on) · CPU governor: powersave
HOW THIS GETS BUILT AND STAYS RUNNING — N9LYA makes every call: what goes on the box, how it's wired, what gets fixed first. Claude (Anthropic's AI) is who the problem gets worked with when something breaks at midnight or a config needs a second set of eyes before it goes live. Together they've hunted down a Home Assistant memory leak, rebuilt n8n from scratch after a bad upgrade, migrated remote access from ZeroTier to native WireGuard, and fixed an OAuth callback that was quietly pointing at localhost instead of the real domain. 30+ years of industrial troubleshooting instinct, paired with a second set of hands that keeps pace on the typing and catches the dumb mistakes at 1am — that combination is most of why this stack runs as clean as it does.
ID Type Name IP Address RAM Role / Notes
100CTSamba192.168.1.xxx512 MBSamba file sharing · LAN NAS shares
101CTAdGuard Home192.168.1.xxx512 MBDNS ad-blocking · LAN DNS resolver · 12 blocklists · ~32% block rate
102CTNextcloud192.168.1.xxx4 GBSelf-hosted cloud storage / file sync
103CTWyoming192.168.1.xxx4 GBWyoming STT/TTS · faster-whisper :10300 · piper-lessac :10200 · HA voice assistant
104CTMariaDB192.168.1.xxx1 GBDatabase backend for n8n and WordPress sites
105CTRedis192.168.1.xxx512 MBCache layer · ⚠ ORPHANED — fully disconnected from n8n (audit 7/25/26)
106CTHAProxy192.168.1.xxx512 MBReverse proxy · SSL termination · n8n.kutche.net and other subdomains
107VMOllama192.168.1.xxx8 GBLocal LLM · gemma4 + llama3.2-vision · dual Tesla P4 GPU · KEEP_ALIVE=-1
109CTPlex192.168.1.xxx4 GBPlex Media Server · X520-DA2 10G fiber · port 32400 · media loading July 4 weekend
112VMHome Assistant OS192.168.1.xxx20 GBHAOS 17.x · Wyoming voice via CT103 · NWS tornado automation · SolarEdge integration
113CTn8n (legacy)192.168.1.xxx2 GBDisabled — kept as rollback only, n8n moved to VM 118
118VMn8n Automation192.168.1.xxx4 GBn8n 2.35.7 · dedicated VM, migrated off CT 113 · Crypto Intel pipeline · YouTube API · Claude · auto-push workflow
115CTUptime Kuma192.168.1.xxx1 GBUptime Kuma 2.4.0 · 18 monitors · SQLite · LAN access only · port 3001
200CTClaude Code192.168.1.xxx4 GBClaude Code CLI · Ubuntu 22.04 · agentic coding environment
COMPREHENSIVE AUDIT FINDINGS — JULY 25, 2026 (Phases 2 & 9), updated 8/25/26
⚠️
Single-Path Resiliency Gap
No redundant path identified for a key link in the network — tabled pending hardware. Revisit once parts are in hand.
Tabled
🔥
RB5009 Firewall Rule *46 — Confirmed Intentional
Auto-blacklists any IP for 24h the moment it opens a second SSH connection to port 22 — an aggressive anti-bruteforce design choice, not a bug. Full rule-chain review confirmed no unintended side effects on LAN traffic; access to the router now goes through its REST API instead of a second SSH hop.
By Design
🔀
SwOS Confirmed on Both CRS Switches
No SSH, Telnet, Winbox, or API on either CRS326 — this is by design for SwOS, not a misconfiguration.
By Design
🗄️
CT 105 Redis — Fully Orphaned
No active connection to n8n found. Either wire it back in or decommission the container.
Needs Decision
📧
LinBPQ Forwarding Monitor — Root Cause Fixed
Reported failure rate traced to an expired Gmail OAuth2 token, not a real forwarding/connectivity failure. Re-auth done, a distinct "auth expired" alert branch and a daily credential health-check workflow now run on the automation host, so a token expiry can't be mistaken for a real outage again.
Resolved
🔑
Credential Exposure — Terminal Screenshots
Credentials were visible in terminal screenshots taken during the audit session. Full password rotation initiated across the stack — CT 200 done, remaining hosts pending.
Rotation In Progress
🔐
WordPress Admin Credentials Rotated (All 8 Self-Hosted Sites)
Every site's admin login now runs on a dedicated account with its own unique password, replacing a shared default password left over from the prior host. Old generic accounts removed where they existed; a legacy account tied to the prior site manager was locked out and demoted rather than deleted, preserving its historical authorship.
Resolved
WORKSTATIONS & PCs
🖥️
Dell XPS 8930 (Primary WS)
i7-8700K · 64GB DDR4 · RTX 2060 Super 8GB · Samsung 970 EVO+ 2TB
Rebuilt w/ replacement IPCFL-VM Z370 board (eBay)
Killer E2400 NIC defective → Plugable USB3-E1000 adapter
X520-DA2 10G SFP+ fiber to Proxmox (~2.61 Gbps)
Win10 Pro · Static DHCP lease
10G Fiber Static Lease
Static192.168.1.x
🖥️
Dell XPS 8900 (Secondary WS)
Secondary desktop · Intel SFP+ 10G card installed (KB8PMY + N9LYA)
10G SFP+ fiber direct to Proxmox DL380 Gen9 (~2.5 Gb/s sustained)
192.168.1.xxx · Windows · second 10G node on spine
10G Fiber Static Lease
192.168.1.xxxSecondary WS
🖥️
Dell 1600SC (Radio Room)
Legacy server · high power draw
~2,154 kWh/yr power draw — high-ROI replacement target
N100 mini PC planned as replacement
Replace Soon High Power
Radio Room
PACKET RADIO SERVERS
📡
Dell Server (.41) — URONode
Debian · URONode / JNOS · kernel 3.2
SSH absent from ARP table — access issue unresolved
NET44 / AMPRNet routing · wg-44net interface
ampr0 tunnel up · WAN IP correct · routing OK
SSH Issue Net44 IPIP
192.168.1.xxxURONode
📻
Dell Server (.42) — LinBPQ
Debian · BPQ32 · LYANOD / N9LYA-8
SSH running on port 41022 · webroot /var/www/n9lya/
mitchellbpq.com · 44Net IPIP mesh · ampr-ripd
14-port node · DLLNAME bug fixed (no .dll on Linux)
update-44.routes.sh cron restored · 936 routes loading
Forwarding Monitor failure rate traced to expired Gmail OAuth2 token, not real connectivity loss (audit 7/25/26) — re-auth + distinct alert branch in progress
SSH :41022 BPQ Web OK Net44 OAuth Fix Pending
192.168.1.xxxN9LYA-8
WIREGUARD TUNNELS
wg-44net
44.48.0.40/24 — Net44/AMPRNet · wg link 44.27.130.176
Status: HEALTHY · 936 routes in table 1
ampr-ripd running · boot startup script in place
sit1 — HE.net IPv6 Tunnel
2001:470:1f10:372::2/64
Tunnel ID: 430369 · Remote: 184.105.253.xxx
Local: 192.182.6.xxx · 10/10 test-ipv6.com
Routed /64: 2001:470:1f11:372::/64 → LAN SLAAC
✗ wireguardPOP (duplicate)
Removed — was duplicate interface
Cleaned up during May 2026 security audit
HP iLO WAN
DISABLED — was exposed to WAN
Disabled during May 2026 security hardening
SOLAR — SOLAREDGE (50 panels, 2019)
☀️ House Array
192.168.1.xxx
18 panels
SolarEdge inverter
Integrated in Home Assistant
SE Local API
☀️ Garage Array
192.168.1.xxx
32 panels
SolarEdge inverter
Integrated in Home Assistant
SE Local API
⚠ Indiana solar property tax deduction eliminated by legislature —
tax bill nearly tripled. Letters sent to Sen. Koch & Rep. May.
OTHER LAN DEVICES
🔒
AdGuard Home
LXC CT 101 · Proxmox
LAN DNS · ad/tracker blocking
DHCP reservation: static
192.168.1.xxxDNS :80
🌤️
Mitchell WX Station
mitchellwx.com
Personal weather station · public site
WX
📊
Sense Energy Monitor
Whole-home power monitoring
Integrated with HA · power savings analysis
Cloud API
📱
Eero Pro 7
Previously mesh WAP
Fully removed from network (May 2026)
REMOVED
HOME ASSISTANT — QUICK ACCESS CHECKING…
🏠
Home Assistant OS · VM 112 · 192.168.1.xxx:8123
LAN ONLY
:8123
Solar production · grid import/export · consumption
LAN ONLY
:8123/energy
🌪️
Tornado warning automation · NWS API · alarm_stream
LAN ONLY
:8123/lovelace
📊
Entity history · Xiaomi BLE sensors · ESP32 proxies
LAN ONLY
:8123/history
SOLAR — LIVE STATUS (LAN)
☀️ House Array
18 panels · SolarEdge
☀️ Garage Array
32 panels · SolarEdge
Live data available on LAN via Home Assistant · SE Local API
n8n → HA → JSON feed planned (Task pipeline)
AMATEUR RADIO — N9LYA / K9BBS / W9OTR
CallsignMode/NodeFreq / NotesStatus
N9LYA-8 LinBPQ / BPQ32 145.050 MHz · LYANOD ACTIVE
N9LYA Indiana 44Net / AMPRNet 44.48.0.40/24 Coordinator ACTIVE
N9LYA-8 mitchellbpq.com BPQ32 Web Terminal WEB OK
K9BBS HARDS — Hoosier Amateur Radio Digital Society Digital / Packet / 44Net · Trustee: N9LYA ACTIVE
W9OTR Hoosier Radio Society General amateur radio club · Trustee: N9LYA ACTIVE
44NET / AMPRNET MESH — RESTORED
ampr0 → tunnel up with correct local WAN IP — packets routing
ampr-ripd → running with boot startup script in place
update-44.routes.sh → cron job restored
936 routes loading in table 1 · confirmed by overseas operators
Mesh fully restored after 3+ years down
WEBSITE PORTFOLIO (18 SITES)
n9lya.com
Amateur radio / personal hub
WordPress · n8n SEO automation
mitchellwx.com
Mitchell weather station
Weather data · public
ainews.us.com
AI news aggregator
WordPress · Self-hosted · Cloudflare
cryptonews.us.com
Crypto news aggregator
WordPress · Self-hosted · Cloudflare
indianapacketcouncil.com
Indiana Packet Radio Council
Ham radio / 44Net
mitchellbpq.com
LinBPQ node web terminal
BPQ32 · N9LYA-8
petworld.us.com
Pet content site
WordPress · Self-hosted · Cloudflare
adsubmission.net
Ad submission directory
WordPress · Self-hosted · Cloudflare
affiliatepathways.us.com
Affiliate marketing site
WordPress · Self-hosted · Cloudflare
booksrus.us.com
N9LYA ebook store
WordPress · Kari's server
takemethere.us.com
Travel content site
WordPress · Self-hosted · Cloudflare
tripza.us.com
Travel content site
WordPress · Self-hosted · Cloudflare
hfskipnet.net
HF propagation / skip reports
Ham radio / 44Net
home.kutche.net
Home Assistant OS terminal
HAOS · 192.168.1.xxx
cloud.kutche.net
Nextcloud file storage
Nextcloud
ai.kutche.net
Ollama AI access
Ollama · CT 107
n8n.kutche.net
Automation platform
n8n · VM 118
vault.kutche.net
Secrets / credential vault
Vault
VEHICLES (QUICK REF)
🚗
2004 Oldsmobile Alero 3.4L V6
Intake manifold gasket repair pending · FLS-16 coolant sensor ordered (~$10)
Alero
🛻
2006 Toyota Tundra SR5 Double Cab
P0020 — Bank 2 VVT-i oil control valve
Tundra
NETWORK TOPOLOGY — TEXT MAP
INTERNET
  │
  └─ Sparklight Coax (DOCSIS 3.1 ~300↓/30↑ Mbps)
     │
     └─ MikroTik RB5009 — 192.168.1.xxx (Gateway)
         ├─ ether1 → WAN (Sparklight modem)
         ├─ ether2 → LAN devices
         ├─ SFP+ 10G → CRS .3 Radio Room (.3 · CRS326-24G-2S+)
         │           └─ 10G → CRS .2 Bedroom (.2 · CRS326-24G-2S+)
         │                        └─ 10G → Proxmox DL380 Gen9 (.222)
         ├─ wg-44net → 44.48.0.40/24 (AMPRNet)
         └─ sit1 → HE.net IPv6 (Tunnel #430369)

PROXMOX — 192.168.1.xxx (HP DL380 Gen9)
  ├─ CT101 AdGuard — 192.168.1.xxx (DNS)
  ├─ CT102 Nextcloud — 192.168.1.xxx
  ├─ CT Ollama LLM — 192.168.1.xxx (Tesla P4)
  ├─ CT n8n — RSS→WP automation
  ├─ CT106 HAProxy — SSL reverse proxy
  └─ VM112 Home Assistant OS — HAOS (20GB RAM)

PACKET RADIO
  ├─ .41 URONode — SSH absent (ARP issue)
  └─ .42 LinBPQ — N9LYA-8/LYANOD (BPQ web OK)

SOLAR
  ├─ House: 192.168.1.xxx — 18 panels
  └─ Garage: 192.168.1.xxx — 32 panels

WORKSTATIONS
  ├─ XPS 8930 — i7-8700K, 64GB, X520-DA2 10G → Proxmox direct fiber
  ├─ XPS 8900 — SFP+ 10G → Proxmox (~2.5 Gb) · installed KB8PMY & N9LYA
  └─ Dell 1600SC — Radio room (N100 replacement planned)
HOMELAB CONTRIBUTOR CREDIT — KB8PMY
RYAN  ·  KB8PMY
HAMILTON, OHIO ELMER CLOSE FRIEND
Ryan is the reason this homelab exists in its current form. What started as help standing up a single Proxmox box grew into the full backbone this site runs on today — the 10G switch fabric, the gateway config, the container stack philosophy. Good friend, patient mentor, and the guy N9LYA calls when the iron needs to run.
FOUNDATION WORK
  ├─ Introduced N9LYA to Proxmox and walked through the initial server build
  ├─ Assisted with physical setup of the HP DL380 Gen9 hypervisor
  ├─ Helped stand up the MikroTik RB5009 gateway configuration
  └─ Assisted with MikroTik CRS switches — initial deployment and VLAN groundwork

STACK RECOMMENDATIONS
  ├─ The Dude — network monitoring (MikroTik)
  ├─ ZeroTier — remote access VPN (since superseded by WireGuard road warrior)
  ├─ AdGuard Home — DNS-level ad/tracker blocking
  ├─ HAProxy — SSL reverse proxy for internal services
  ├─ Ollama — local LLM inference (now on dual Tesla P4s)
  ├─ Home Assistant — home automation platform
  └─ Other containers in the current stack — all Ryan recommendations

ONGOING
  ├─ Helped install the SFP+ 10G card on the XPS 8900, bringing it to near-2.5Gb into Proxmox
  └─ Still the first call for network and hypervisor troubleshooting when something goes sideways

The packet radio work, AMPRNet coordination, solar monitoring, and all the layers built on top came later — but none of it would exist without Ryan pointing N9LYA at the right tools and helping get the iron running. 73 de N9LYA — KB8PMY, much appreciated.