19/09/26 Reworking My Homelab Network

Today was mostly networking, firewall cleanup, and fixing everything that broke after moving the homelab onto its own router.

• Installed a TP-Link ER605 between the family router and my homelab.
• Moved the homelab onto its own private subnet instead of sharing the main household LAN.
• Connected the existing managed switch behind the ER605.
• Set DHCP reservations for the router, switch, Raspberry Pi, NAS, Ubuntu AI server and my Fedora laptop.
• Verified the routing path through the new router and confirmed internet access was working properly.
• Worked through a brief DNS outage caused by the Pi firewall blocking DNS traffic.
• Set the Raspberry Pi/Pi-hole as the DNS server handed out to homelab clients.
• Rebuilt the Pi's UFW rules around the new subnet.
• Restricted things like SSH, Cockpit, Caddy and rsync to the devices/networks that actually need them.
• Confirmed Caddy was still listening correctly on HTTP/HTTPS.
• Rebuilt my local *.home.arpa DNS records in Pi-hole.
• Kept Caddy as the front door for local services, so the DNS records point at the Pi and Caddy handles the actual backend routing.
• Updated Caddy's Ubuntu server backends to use the server's new address.
• Removed the old OliveTin config since I don't use it anymore.
• Fixed SillyTavern after discovering its IP whitelist was still using the old subnet.
• Audited the Ubuntu server for old network references instead of waiting for services to randomly break later.
• Cleaned the Ubuntu UFW rules and removed the old LAN entries.
• Tightened some service rules so things like Open WebUI and Chatterbox only accept traffic from Caddy where appropriate.
• Confirmed Ollama is still only listening locally rather than exposing its API directly to the LAN.
• Left the Chatterbox CPU/GPU services disabled at boot as intended; I start whichever backend I want manually through Cockpit.
• Updated my remote LUKS unlock setup for the Ubuntu server.
• Confirmed I can SSH into the initramfs on a separate port and remotely unlock the encrypted system disk.
• Added support for unlocking the server from either my Fedora machine or the Raspberry Pi using separate SSH keys.
• Fixed normal SSH access to Ubuntu after noticing its firewall was still only allowing the old subnet.
• Did a full listening-port/service audit to make sure the firewall rules actually match what is running.

The main result is that the homelab now has a much cleaner boundary from the rest of the house network, predictable addressing, local DNS working again, and host firewalls that actually match the new layout.

Next job is VLANs.