Skip to content

ARCH-INFRA-OVH: OVH hosting, vRack and network blocks

Wetopi runs on 8 OVH dedicated servers in a single vRack (OVH's private L2 fabric that interconnects the servers' vRack ports). Proxmox VE runs on all 8; the VMs and the RKE2 cluster live on top of it. The whole stack is provisioned from the GitOps repo https://github.com/wetopi-platform/infrastructure (tofu/proxmox/environments/prod/ — authoritative source; the committed terraform.tfvars.example documents the shape, the real terraform.tfvars is gitignored/0600).

The 8 servers

Node names are the OVH server identifiers used throughout tfvars (proxmox_nodes) and live Proxmox (cluster wetopi7):

Proxmox node Trunk NIC (live-verified)
ns31826925 enp10s0f1np1
ns31826929 enp10s0f1np1
ns3214108 enp2s0f1np1
ns3226931 enp2s0f1np1
ns3226939 enp2s0f1np1
ns3235424 enp10s0f1np1
ns3243421 enp10s0f1np1
ns3249468 enp10s0f1np1

Each node carries a single 802.1Q trunk NIC (the vlan-raw-device verified live per node via the Proxmox API) through which the vRack VLANs below flow. VM placement across the 8 nodes spreads the control planes and workers over distinct failure domains (see proxmox-cluster.md).

Public (WAN) IP blocks

Two OVH-allocated public blocks are attached to the servers and reachable on the WAN bridge vmbr3:

Block Addresses in use (verified)
92.222.245.64/27 92.222.245.91 = wetopi-ops01 (bastion, direct WAN); 92.222.245.83 = wetopi-natgw01 (WAN egress); gateway 92.222.245.94
79.137.114.192/27 79.137.114.193 = rke-wan01; 79.137.114.194 = rke-wan02 (edge v1, ADR-0006); gateway 79.137.114.222

vmbr3 carries untagged public IPs on the VM NICs (no VLAN tag, no IP on the hypervisor). The ops01 .91 address is the SSH bastion for the whole internal network (every other VM is reached through it); natgw .83 is the LAN's NAT egress.

Internal networks and bridges

Three L2 domains exist on the vRack, each a bridge on every Proxmox node:

Bridge VLAN Subnet Purpose
vmbr4 4 10.72.0.0/23 (MTU 1500, from reserved 10.72.0.0/20 — ADR-0001) RKE2 node LAN: all 8 cluster VMs. No IP on the hypervisors.
vmbr2 2 192.168.96.0/20 Pre-existing Ceph storage LAN (see ceph.md).
vmbr3 (untagged) public blocks above WAN attachment.

Address plan on 10.72.0.0/23 (from tfvars ansible_host + NIC configs): .1 LAN gateway (non-managed default gateway hop), .2 natgw, .10 ops01, .20 RKE2 API VIP (keepalived, ADR-0004), .21-23 control planes, .41-43 platform workers, .51-52 edge nodes. VMs resolve names via public resolvers (1.1.1.1, 1.0.0.1, domain wetopi.priv) — there is no internal DNS in the platform; stable endpoints are IP-based.

flowchart TB
  subgraph OVH["OVH (8 dedicated servers, one vRack)"]
    direction TB
    subgraph WAN["vmbr3 — WAN (untagged)"]
      O91[ops01 92.222.245.91<br/>bastion]
      N83[natgw 92.222.245.83<br/>LAN egress]
      W1[rke-wan01 79.137.114.193]
      W2[rke-wan02 79.137.114.194]
    end
    subgraph LAN["vmbr4 — VLAN 4, 10.72.0.0/23"]
      CP[rke-cp01/02/03<br/>.21/.22/.23 + VIP .20]
      PL[rke-platform01/02/03<br/>.41/.42/.43]
    end
    subgraph CEPH["vmbr2 — VLAN 2, 192.168.96.0/20"]
      C1["ceph mons/OSDs (pre-existing)"]
      PL2["workers eth1 192.168.98.10-12/20"]
    end
  end
  Internet((Internet)) --- WAN
  WAN ---|LAN-to-WAN NAT| LAN
  LAN --- CP & PL
  C1 --- CEPH
  CEPH --- PL2
  O91 -.-|"SSH bastion to all VMs"| LAN

Cloudflare DNS (zone wetopi.net)

The zone is managed on Cloudflare (zone id 6728a5c341cfadd578c1539ccb28c9ad — non-secret, read via the CF API) and Wetopi-new service records are declared in OpenTofu (tofu/proxmox/environments/prod/cloudflare-dns.tf + var.cloudflare_dns_records), one module instance per record with prevent_destroy. Verified live via the Cloudflare API on 2026-08-31:

Name Records Shape
edge-test.wetopi.net A × 79.137.114.193 / .194 TTL 300, proxied=false (grey-cloud)
docs-new.wetopi.net A × 79.137.114.193 / .194 TTL 300, grey-cloud
docs.wetopi.net A × 79.137.114.193 / .194 TTL 300, grey-cloud (F4 cutover)
argo.wetopi.net A × 79.137.114.193 / .194 TTL 300, grey-cloud

Scope rule (WAN Edge v1 plan §4): only Wetopi-new service records are in tofu scope. Legacy records (wildcards, agg, carlos-*, devops-wan-*, …) and _acme-challenge TXT records (cert-manager) are deliberately out of scope — never imported, declared or touched. edge-test was the Let's Encrypt staging gate (F3); docs-new the pre-cutover staging name; docs and argo are the live v1-window edge services (ADR-0006: DNS round-robin, reduced availability, operator-driven remediation).

Takeover notes

  • To re-verify this pill: tofu plan on tofu/proxmox/environments/prod (no-changes expected), CF API GET /zones/<id>/dns_records, and kubectl get nodes via ops01.
  • Never commit terraform.tfstate, terraform.tfvars or provider tokens (.env.proxmox, .cloudflare-wetopi-net.env) — see providers.md for where each secret lives.

Live inventory (verified 2026-09-06, BookStack mirror — T1.6)

  • Edge WAN 79.137.114.193/.194 (rke-wan01/02, hostNetwork, Traefik 8000/8443); edge LB nftables: redirect 80→8000 y 443→8443.
  • Allowlists por hostname: .87 (operador VPN) + .89 (agents01/harness) — twins por ns.
  • NATGW (wetopi-natgw01): pools egress gw100/101/102 — crawlers nunca comparten IP con clientes.
  • Wildcard *.wetopi.net → 92.222.245.76 (bastion, NO el edge): hosts nuevos SIEMPRE con A records explícitos.