Internet → Gateway VPS (151.241.217.91, Hostkey B.V., Zürich)
│ wg4 tunnel
▼
hot-bm-nl (Hostkey NL, oVirt VPS — bare-metal replacement)
│ VLAN routing via vmbr0
├── VLAN 10 → sn-infra (10.10.10.100)
├── VLAN 30 → sn-web (10.10.30.102)
├── VLAN 50 → sn-monitor (10.10.50.104)
└── VLAN 70 → sn-security (10.10.70.106)
hot-pn and hot-erp-nl are separate standalone Hostkey VPSes (not Proxmox VMs), reached over their own dedicated WireGuard tunnels (wg3, wg5).
| Interface | Peer | Purpose |
|---|---|---|
| wg1 | — | Mr. Byrne's personal road-warrior VPN |
| wg3 | hot-pn | PrivateNexus's permanent home |
| wg4 | hot-bm-nl | Bare-metal replacement VLAN mesh |
| wg5 | hot-erp-nl | ERPNext's permanent home |
| wg6 | PBS | Proxmox Backup Server (local hardware, not a rented VPS) |
Before creating a new WireGuard interface, run wg show first — collision with wg1 has happened before.
Suffix: spangled-atlas.ts.net. Covers the Gateway, hot-bm-nl (Proxmox UI), all 4 VLAN VMs, hot-pn, hot-erp-nl, and admin workstations.
sn-infra, sn-web, sn-monitor, sn-security, hot-bm-nl, hot-pn, hot-erp-nl — all pre-configured in /root/.ssh/config, key at /root/.ssh/claude_code_key.
/16 (10.10.0.0/16) since Proxmox masquerades IPs between VLANs.