Network Topology¶

Network layout across Toronto and Kingston locations with Tailscale VPN.

Current Field Network¶

At TMU / school, the portable GL.iNet router is the preferred network anchor. It joins TMU Wi-Fi with WPA2-Enterprise and gives the Mac plus lab devices a private LAN. The lab Ubuntu host runs Home Assistant and controls the iDevices switch that acts as the robot's main power switch.

flowchart TD
    TMU["TMU Wi-Fi<br/>DHCP 10.16.x.x"] --> GL["eph107<br/>GL-MT3000<br/>192.168.8.1"]
    GL --> ZMACS["zmac<br/>192.168.8.109<br/>TS: 100.117.222.41"]
    GL --> UBUNTU["jeffxi-ubuntu<br/>HA 192.168.8.241<br/>TS: 100.108.86.74"]
    GL --> POWER["iDevices Switch 00101614<br/>main robot power switch<br/>192.168.8.115"]
    GL --> LAB["robot tools / tablets / lab devices<br/>192.168.8.x"]
    GL --> TSNET["Tailnet<br/>eph107: 100.84.198.19"]

See Field Router for setup, recovery, and WebFinder details.

Manraj Local SSH Access¶

Manraj's Windows laptop (MANIBOB) was provisioned for local-network SSH on 2026-08-27. It is not enrolled in Zeul's tailnet. The public key fingerprint is SHA256:HirgBqvYEsLkRKRJ/MScUqCc9fM5NqQMpbahP/1Oue0.

The private key stays on MANIBOB. The initial account password and onboarding record are stored outside the repository in the private robot infrastructure secrets file provided separately.

For remote access, Manraj's separate tailnet contains only his laptop (MANIBOB, 100.94.97.30) and Vicon Windows (100.84.179.109). The Vicon host is used as an SSH jump host to the local lab targets; it does not advertise the lab subnet or act as an exit node.

Locations¶

Toronto (Home) -- Primary location¶

Devices:

Secondary network: Bell Wi-Fi (separate Bell Home Hub router). More permissive NAT (Endpoint-Independent Filtering). Direct Tailscale connections work without UPnP.

Kingston (Remote) -- Workstation location¶

Workstation:

Two physical NICs: - enp5s0 (1G): Connected to Kingston UniFi, active internet path - enp3s0 (10G): Has PPPoE config for Bell on VLAN 35 (enp3s0.35). Currently INACTIVE. Keep PPPoE off -- stale endpoints confuse Tailscale's hole-punching.

Other Kingston devices:

Backup access: Teleport VPN can reach workstation at LAN IP 192.168.2.239 when Tailscale is down.

Network Diagram¶

flowchart TD
    subgraph TOR["Toronto — Home"]
        TONT["Bell ONT"] -- "PPPoE" --> UX["UniFi UX<br/>dynamic public IP"]
        UX --> ZMAC["zmac<br/>192.168.177.133<br/>TS: 100.117.222.41"]
        UX --> TSR["tsrelay<br/>192.168.177.228<br/>TS: 100.95.40.19<br/>relay :40000"]
        BHH["Bell Home Hub"] --> ZMAC2["zmac (Bell Wi-Fi)"]
    end
    subgraph KNG["Kingston — Remote"]
        CGNAT["Bell CGNAT"] --> KONT["Bell ONT"]
        KONT -- "PPPoE" --> KUX["UniFi<br/>WAN 10.130.37.119"]
        KUX --> WS["workstation<br/>192.168.2.239<br/>TS: 100.101.214.44"]
        KUX --> STOR["storage<br/>192.168.2.26<br/>TS: 100.106.137.64"]
    end

Tailscale Devices¶

Services and On-Demand Desktop¶

Workstation (Kingston)¶

• Tailscale
• Sunshine + Moonlight desktop: on demand via stream-desktop
• GDM: autologin enabled, Wayland disabled (X11 only for NVIDIA), normally stopped until stream-desktop start
• X11: headless virtual display via xorg.conf MetaModes, normally stopped until stream-desktop start

tsrelay (Toronto)¶

Throughput Benchmarks (Tailscale Direct, Feb 2026)¶

Pi (wired) to Workstation¶

Mac (Wi-Fi) to Workstation¶

Raw ISP speeds (Ookla)¶

Bottlenecks¶

1. Kingston CGNAT outbound: Hard packet drops above ~260 Mbps. Cross-network speeds drop significantly vs Bell-internal tests.
2. Mac Wi-Fi: Caps at ~250 Mbps LAN, further reduced through WireGuard to ~80-109 Mbps. Wired connection fixes this.
3. Tailscale MTU 1280: More packets per byte, higher overhead.