Eric Li DevOps & Network Architecture

Lab Power-Down and a Day Mapping the Hotel Network

Homelab · 2026-10-07 · Wednesday · 11:44 PM · 6 min read · Eric Li

A long one, from about 00:10 to 23:44. The early hours were a full lab shutdown and its fallout, then a few small jobs, and from about midday to early evening I was on site at the hotel.

Shutting the lab down

Overnight I shut down the NAS and then all four Proxmox nodes. Before powering anything off I disabled the NAS backup storage on every node, set the HA resources to ignored and stopped the HA services. The local resource managers keep their watchdogs armed for five minutes or more, and I didn't want a node fencing itself on the way down. Guests went down cleanly, then the nodes in order: pve04, pve03, pve02, pve01, the last at about 00:54.

I believed I had saved a shutdown procedure and couldn't find it. It was only on my PC. Coming back up, I found that HA-managed guests, including my workstation VM, don't start by themselves after a power-up. Each one needs a manual set-to-started from pve01, which I should have known. The order is gateway, switches, the Raspberry Pi with the quorum vote, then the nodes, and check all five votes before re-arming HA.

Immich down after the reboot

At 04:43 I noticed Immich was down. The main Ubuntu server had restarted at 01:25, tried its two NAS mounts once while the NAS was still off and never retried. Immich then saw an empty library folder and crash-looped. I mounted the shares by hand from pve03 and restarted Immich, and the site came back with all six storage checks passing at 04:46. I also added an automount option to both NAS lines in fstab so the mounts retry on demand. That stays untested until the server next reboots.

Smaller jobs

Around 02:40 I drafted an introduction email about a role, after talking to someone on the flight home from Malaysia, and updated my CV and LinkedIn text. Nothing is sent yet. I also changed the portfolio tagline to "DevOps & Network Architecture enthusiast". The blog pages still carried the old wording, so I fixed the build script and templates to apply it everywhere. I caught up on four missing journal entries and published them. I also set the Windows SMB client cache lifetimes to zero on my PC, because new files took ages to show up on the mapped drives.

Rooms and ports at the hotel

My first job on site was proving which core switch port each room's TV lands on, using the controller's port page while my Mac sat in each TV jack. Only a few rooms were free. Room 11 is port 1, room 12 is port 2, room 16 is port 6 and room 18 is port 8. Room 14's jack is dead and I left the occupied rooms alone. I first read room 11 as port 6 and was wrong. The port page lags by up to two minutes, and port 6 was a different TV that had just been switched on. After a refresh it was port 1. Four outdoor access points on that switch are named after rooms, which is a trap if you go by name.

In the comms room SSH to the cores kept hanging, and I wasted a while blaming routes. The cause was that I was plugged into the other core from the one I thought, on a different port. Checking LLDP first showed it. After that I got DHCP on the right VLAN, added both routes and connected with the legacy key algorithms those switches need. I captured the MAC tables and neighbour lists from both cores and identified most devices from their vendor prefixes. I also wrote down some faults to raise with the hotel's IT provider, which I'm not detailing here.

In the other building I hand-traced the patch panel to the core switch for all 16 room ports. Two TVs happened to be on, and the ports that lit up matched my trace. One room is unplugged at the panel and I don't know why.

Locking down the IPTV island

I put authentication on the console of both IPTV switches. Each change went in under a five-minute commit timer, and I saved and checked both configs afterwards.

Then I ran the proof tests with the uplink port opened briefly:

One test was inconclusive, because macOS sends a leave message even when I kill the process. I also found an eighth box that had missed the port isolation group, and added it after confirming the picture was fine. The uplink went back to shut and I saved a config on both switches.

A firewall zone on the temporary router

Reviewing the pilot plan, I realised that once the island joins the hotel, anything on the new VLAN gets the temporary router as its gateway, in the same zone as management, the tuner and my Tailscale routes. A room jack could have reached the server's admin page, and maybe my home lab. So that evening I built a separate zone for the island that only allows internet out, with a five-minute auto-revert armed. I fumbled it: I pasted markdown fences into the shell and the backticks ran as commands, and my first SSH test ran on the router instead of the Mac. Once I reached both switches from the Mac over Tailscale I cancelled the revert. The boxes had internet through the new zone. I haven't done a lockout test from a room jack or checked the zone survives a router reboot.

The pilot request

From about 20:00 I wrote the request to the hotel's IT provider for the VLAN 220 pilot. It asks for the VLAN on the core switch with IGMP on but not as querier, the island's port on VLAN 220 only, tagging on the trunk, and fast leave off. That port can't also carry the live TV VLAN, because it would bridge the live network into the island with two DHCP servers and two queriers. The pilot rooms are 11, 16 and 18, since the others are occupied. My contact isn't technical, so I split it into a plain cover note and a technical attachment, then rewrote it as a ticket reply because the provider works through tickets. At 23:44 it was still unsent. It went out just after midnight.

Still open