Devices
Full inventory of all devices in the homelab ecosystem.
Infrastructure (Rack)
Superseded the original PhD-lab RPi-based plan — actual hardware post-move is Proxmox host + LXC/VM services + multiple physical Debian hosts, including the dedicated Lenovo CI laptop.
| Hostname | Device | OS/Firmware | VLAN | IP | Notes |
|---|---|---|---|---|---|
flint2 |
GL.iNet GL-MT6000 Flint 2 | stock OpenWrt 23.05.5 (not GL.iNet fw) | mgmt (all, trunk) | 192.168.1.1 | Edge router, DHCP filtering + br-lan.X per VLAN |
switch |
TP-Link TL-SG108E | — | mgmt | 192.168.1.160 | L2 only, DHCP (not static) |
proxmox (pve) |
Dell Precision 3620 | Proxmox VE | 10 | 192.168.10.10 | Static, host for VMs/LXCs below |
nas (LXC 105) |
— | — | 10 | 192.168.10.170 | DHCP (not pinned) |
certs-01 (LXC 106) |
— | Debian 13 | 10 | 192.168.10.50 | Static; Caddy 2.6.2, internal CA, HTTPS proxy for Grafana, Uptime Kuma and CS leaderboard (cs-leaderboard.home.arpa), metrics :9180; see caddy.md |
gha-general-01 (VM 101) |
— | Debian Trixie | 10 | 192.168.10.189 | DHCP host reservation (pinned to MAC). Runs 2x GHA runner containers (dfair/kc; PL retired 2026-10-22), BuildKit, GitHub job exporter :9119, Grafana Alloy, cAdvisor :8080, node-exporter. SSH open from lan/trusted |
llm-01 (VM 108) |
— | Debian 13 (Trixie), NVIDIA 550/CUDA 12.4 | 10 | 192.168.10.162 | DHCP reservation BC:24:11:34:49:AC; Quadro P4000 8 GiB passthrough; Qwen3 8B (4K, :8080) and Qwen3.5 2B (64K, :8081) llama.cpp systemd services, Caddy-only backends. HTTPS names llm.home.arpa and llm-long.home.arpa → Caddy .50; see LLM runbook |
monitor-01 (VM 102) |
— | — | 10 | 192.168.10.158 | Grafana :3000 (dashboards lost, rebuild tracked in issues #3-8), Prometheus :9090 (not :3001 — that's Uptime Kuma), Loki :3100, Alloy :12345, cAdvisor :8080, node-exporter. DHCP (not pinned). SSH open from lan/trusted |
iot-ap (old TP-Link) |
TP-Link (unknown model) | OpenWrt 15.05.1 "Chaos Calmer" | 30 | 192.168.30.2 | Dumb AP, SSID OpenWrt, own DHCP/WAN disabled |
dell-mini |
Dell OptiPlex 3050 Micro | Debian 13 (Trixie) | 10 | 192.168.10.117 | DHCP host reservation (pinned to MAC, enp2s0). Networked via systemd-networkd (chosen over ifupdown/NetworkManager for a consistent config method across all 3 debian boxes). Runs research-output-scraper (nginx + systemd, see that repo's docs/deploy.md); served internally through Caddy at https://cs-leaderboard.home.arpa. nginx trusts Caddy .50 for forwarded client IP. SSH (22) and direct HTTP (80) still documented open from lan/trusted |
acer-lap |
Acer Aspire 5 A515-54 (laptop) — i5-10210U, 8 GB, 512 GB NVMe, see specs | Debian 13.7 (Trixie), headless (multi-user.target) |
10 | 192.168.10.199 | DHCP host reservation (pinned to MAC b4:a9:fc:2b:d2:6d, enp1s0). Networked via systemd-networkd. Run closed-lid with the built-in panel disconnected; suspend-on-close prevented via drop-in /etc/systemd/logind.conf.d/10-headless.conf (HandleLidSwitch*/HandleSuspendKey/HandleHibernateKey/IdleAction = ignore) plus masked sleep/suspend/hibernate/hybrid-sleep/suspend-then-hibernate targets — applies to any laptop run this way, see HP below. Planned role: edge-device test host for custom IDS (dissertation direction four). SSH open from lan/trusted |
hp-lap |
HP EliteBook 840 G2 (laptop) — i5-5300U, 16 GB, 240 GB SATA SSD, see specs | Debian 13.7 (Trixie), headless (multi-user.target) |
10 (switch port 5) | 192.168.10.147 | DHCP host reservation (pinned to MAC 70:5a:0f:ce:1a:ae, enp0s25). Networked via systemd-networkd (/etc/systemd/network/10-wired.network, matched on MAC); was previously on the IoT AP's WiFi (VLAN 30) — NetworkManager disabled and WiFi (wlo1) rfkill-blocked. Hostname renamed from poolTab; login user is pooltab. Same closed-lid setup as acer-lap (/etc/systemd/logind.conf.d/10-headless.conf + masked sleep targets). Docker installed (docker0 present). Full-disk encryption — requires an interactive passphrase, but remote unlock via dropbear-initramfs on port 2222 from XPS is now verified after Debian 13 kernel reboot (LUKS2 sda5 → LVM). Docker Trixie packages active; Hermes v0.22.5+2971.ga938f00 gateway active with Codex OAuth primary, owner Telegram bot confirmed, Qwen3.5 2B local alias tested; automatic failover and Harness deployment still unverified; see gateway runbook. SSH open from lan/trusted |
| lenovo-lap | Lenovo ThinkBook 15 G4 IAP (21DJ), i7-1255U, 40 GB RAM, 1 TB NVMe; details | Debian 13.7, headless (multi-user.target) | 10 (switch port 7) | 192.168.10.193 (DHCP; reservation not independently confirmed) | Wired enp0s31f6 via ifupdown/dhcpcd, MAC e4:a8:df:dd:bd:29; SSH from XPS 192.168.20.173 allowed TCP 22 through firewall.allow_xps_to_lenovo_ssh; runs dedicated Docker runners for kc-backend-core and kartchaser-infrastructure (see runner runbook). |
acer-lap hardware
Collected 2026-10-08 via dmidecode, lscpu, lsblk, lspci and sysfs.
| Component | Detail |
|---|---|
| Model | Acer Aspire 5 A515-54, version V1.11 |
| BIOS | V1.11 (2019-08-01) |
| CPU | Intel Core i5-10210U (Comet Lake) — 4C/8T, 1.6–4.2 GHz, 6 MiB L3, VT-x |
| RAM | 8 GB DDR4-2400 SO-DIMM in ChannelA-DIMM0; ChannelB-DIMM0 empty (single-channel, upgradeable). 7.7 GiB swap |
| Storage | Kingston 512 GB NVMe (RBUSNS8154P3512GJ1) |
| Wired NIC | enp1s0 — Realtek RTL8111/8168 [10ec:8168] rev 15, r8169 driver, 1 GbE, MAC b4:a9:fc:2b:d2:6d |
| Wireless | wlp2s0 — Qualcomm Atheros QCA6174 802.11ac [168c:003e], ath10k_pci driver, MAC e8:d0:fc:a7:c1:25 (unused) |
| Battery | AP18C4K, ~71% of design capacity (2,976,000 / 4,200,000 µAh); kernel reports cycle_count 0 (not tracked) |
| Display | Built-in panel physically disconnected; runs headless |
| Kernel | 6.12.111+deb13-amd64 |
hp-lap hardware
Collected 2026-10-08 via dmidecode, lscpu, lsblk, lspci and sysfs.
| Component | Detail |
|---|---|
| Model | HP EliteBook 840 G2 (Hewlett-Packard) |
| BIOS | M71 Ver. 01.13 (2016-01-18) |
| CPU | Intel Core i5-5300U (Broadwell) — 2C/4T, 2.3–2.9 GHz, 3 MiB L3, VT-x |
| RAM | 16 GB DDR3-1600 — 2× 8 GB SO-DIMM (both slots full, dual-channel). 975 MiB swap |
| Storage | SanDisk SDSSDA240G 240 GB SATA SSD |
| Wired NIC | enp0s25 — Intel I218-LM [8086:15a2] rev 03, e1000e driver, 1 GbE, MAC 70:5a:0f:ce:1a:ae |
| Wireless | wlo1 — Intel Wireless 7265 [8086:095a], iwlwifi driver, MAC 64:80:99:e3:e5:54 (rfkill-blocked, unused) |
| Battery | "Primary", reports 100% of design (4,290,000 / 4,290,000 µAh) — likely a replacement pack or unreliable firmware reporting |
| Kernel | 6.12.113+deb13-amd64 (6.1.0-54-amd64 retained as fallback) |
lenovo-lap hardware
Collected 2026-11-02–03 from Debian system diagnostics and validated by reboot/SSH testing.
| Component | Detail |
|---|---|
| Model | Lenovo ThinkBook 15 G4 IAP, product 21DJ |
| CPU | Intel Core i7-1255U — 2 performance + 8 efficiency cores, 12 threads |
| RAM | 40 GB (8 GB onboard + 32 GB DDR4-3200 SO-DIMM) |
| Storage | WD Blue SN570 1 TB NVMe; SMART PASSED, 0% used, 0 media/data-integrity errors (2026-11-03) |
| Wired NIC | enp0s31f6 — Intel I219-V, e1000e, MAC e4:a8:df:dd:bd:29 |
| Wireless | wlp0s20f3 — prior temporary-home Wi-Fi configuration retained |
| Ethernet management | ifupdown with /etc/network/interfaces.d/enp0s31f6 (auto, DHCP using dhcpcd), reboot-tested |
| Power | Headless multi-user.target, lid/suspend overrides in /etc/systemd/logind.conf.d/10-ci-headless.conf, sleep targets masked |
| Battery | 36.85 Wh full versus 45 Wh design (~82%); 355 cycles at inspection |
| Kernel | 6.12.115+deb13.1-amd64 at deployment |
Personal Devices (Mobile / Off-rack)
WiFi: SSID dfair_lab (both 2.4GHz/radio0 and 5GHz/radio1), bound to
VLAN 20 (Trusted), on the Flint 2 itself.
Phones and Macs use per-network or per-connection randomized MACs
(GrapheneOS re-randomizes on every connection by default), so these devices
are tracked by name rather than MAC and get no DHCP reservations — expect
many stale randomized-MAC neighbor entries on br-lan.20.
| Device | VLAN | Notes |
|---|---|---|
| MacBook Pro M1 | 20 | Reconnected from the old IoT OpenWrt SSID to dfair_lab |
| Dell XPS 16 | 20 | Likely the Intel 80:c0:1e:35:9d:be client — the only non-randomized MAC on VLAN 20 |
| Pixel 6 (GrapheneOS) | 20 | Randomized MAC |
| Pixel 3 (GrapheneOS) | 20 | Randomized MAC |
| iPhone 7 | 20 | Private Wi-Fi address |
The Samsung (Galaxy A71 5G) is the dedicated IoT setup/test phone and lives on VLAN 30 — see below.
IoT Devices (VLAN 30)
All static DHCP host reservations on the Flint 2 (/etc/config/dhcp), pinned
to current MAC/IP so they don't drift. Bridged in via the old TP-Link AP
(iot-ap, SSID OpenWrt) on switch port 6. Identified via a mix of MAC
vendor lookup (api.macvendors.com) and ground-truth checks in each device's
companion app — vendor lookup alone caused one mislabel (see note below), so
app-based confirmation is the more reliable method going forward. For new
devices, logread -f -e dnsmasq-dhcp on the router shows each DHCPACK
(MAC + hostname) live as a device joins.
| Name | MAC | IP | Notes |
|---|---|---|---|
| Galaxy-A71-5G | BA:AD:F9:BE:0C:BB | 192.168.30.117 | Test phone |
| RingDoorbell-b1 | 90:48:6C:04:72:B1 | 192.168.30.151 | Ring Video Doorbell — reconfirmed by owner |
| HS105 | 00:5F:67:FB:83:A4 | 192.168.30.216 | Kasa Smart Plug |
| Nest-Cam-indoor | 20:1F:3B:21:93:74 | 192.168.30.110 | Google Home Cam |
| Amazon-Echo-Dot | A8:E6:21:3E:26:01 | 192.168.30.142 | Amazon Echo Dot (5th Gen) — confirmed via Alexa app, doesn't respond to ICMP even when online (expected Echo behavior) |
| Roborock-K2-Vacuum | B0:4A:39:55:B1:76 | 192.168.30.181 | Self-identified via DHCP hostname roborock-vacuum-a34 |
| OKP-K2-Vacuum | 10:D5:61:A4:B8:92 | 192.168.30.188 | Inferred by elimination (plugged in alongside the Roborock, only 2 new leases appeared) |
| LongPlus-Baby-Monitor | 30:4A:26:2B:BA:87 | 192.168.30.220 | Confirmed via unplug test (vendor lookup had only narrowed it to "Shenzhen Trolink Technology Co.", a generic OEM — unplug test gave the real answer) |
| Google-Nest-Mini | 00:F6:20:4E:22:FB | 192.168.30.203 | Previously amazon-unknown-1 (and before that mislabeled Google-Home-Mini). Re-checked 2026-10-08: OUI 00:f6:20 is Google, Inc., not Amazon — the earlier "vendor lookup said Amazon" note was wrong. Owner believes this is the Nest Mini; the MAC the Google Home app shows (20:1F:3B:78:FA:4A) differs from this Wi-Fi MAC, so not 100% confirmed by an unplug test |
| Philips-Hue-Hub | EC:B5:FA:A2:E4:5A | 192.168.30.153 | Wired into the old TP-Link AP's LAN port (bridged to VLAN 30); DHCP hostname Philips-hue |
| NiteBird-Bulb-1 | 70:03:9F:51:2E:A9 | 192.168.30.214 | Previously ESP_512EA9, firewall-blocked as an "unknown ESP device" — identified 2026-10-08 as a NiteBird smart bulb (Espressif module; MAC is near-sequential with Bulb-2, same batch). Block removed |
| NiteBird-Bulb-2 | 70:03:9F:51:4A:84 | 192.168.30.199 | DHCP hostname ESP_514A84, first seen 2026-10-08 |
Retired entries (2026-10-08): iot-unknown-2 (72:28:BA:5F:4E:6C, .229),
iot-unknown-4 (CA:70:A3:B6:C7:FB, .237) and unknown-100
(82:A4:F5:01:66:AA, .100) — all locally-administered/randomized MACs, most
likely GrapheneOS phones that joined the OpenWrt SSID at some point rather
than IoT devices. Reservations deleted. An Intel client
(c0:b6:f9:5c:81:90, seen at .116 with no lease) was likely hp-lap or
acer-lap on Wi-Fi before they moved to wired VLAN 10.
Cross-VLAN Firewall Rules (Lab access from mgmt/Trusted)
Scoped, least-privilege — only these host:port combos are reachable from
lan/trusted into VLAN 10, everything else in Lab stays unreachable from
outside it:
| Dest host | Port(s) | From |
|---|---|---|
| proxmox (192.168.10.10) | 8006, 22 | lan, trusted |
| monitor-01 (192.168.10.158) | 3000, 3001, 22 | lan, trusted |
| certs-01 (192.168.10.50) | 22, 80, 443 | trusted (documented access rules; HTTPS 443 reachability verified 2026-10-21, exact UCI rules not audited) |
| gha-general-01 (192.168.10.189) | 22 | lan, trusted |
| dell-mini (192.168.10.117) | 22, 80 | lan, trusted |
| acer-lap (192.168.10.199) | 22 | lan, trusted |
| hp-lap (192.168.10.147) | 22 | lan, trusted |
| lenovo-lap (192.168.10.193) | 22 | XPS 192.168.20.173 (trusted), verified 2026-11-03; router UCI section allow_xps_to_lenovo_ssh |
Device Naming Convention
<type>-<descriptor>
e.g. rpi1, rpi2, proxmox, xps16, mbp
Hostnames should be set in /etc/hostname and registered in the router's DHCP static leases for consistent DNS resolution.
Adding a New Device
- Note MAC address
- Assign to appropriate VLAN (Lab / Trusted / IoT)
- Create DHCP reservation on router if static IP needed
- Add to this table
- Install node_exporter if it's a Linux device and should be monitored