network -- AS215932

weathermap

               WireGuard full mesh: OSPF6 + iBGP inside tunnels

          Transit NL          Transit DE             Securebit CH + SBIX
           AS34872       AS34872 / AS210233             AS58057 / RS
              |                  |                             |
       +------+-----+     +------+-----+               +-------+------+
       |  cr1.nl1   |=====|  cr1.de1   |===============|   cr1.ch1   |
       |  ::a NL    |ff00 |  ::b DE    |     ff08      |   ::c CH    |
       +--+------+--+     +--+------+--+               +---+-----+---+
          |      \\          /      |                    //     |
     ff02 |       \\ ff07   / ff08  | ff05          ff07//      | ff06
          |        \\      /        |                //        |
          +---------\\----/---------+---------------//---------+
                     \\  /                         //
                      \\/                         //
                   +---+-------------------------+---+
                   |          rtr / OVH FR ::d       |
                   |          NAT64 + DNS64          |
                   +---------------+-----------------+
                                   |
                        infra 2a0c:b641:b50:2::/64
                         dns api web proxy mon vpn

core routers

node	site	platform	overlay loopback	external role
cr1.nl1	Servperso NL	FreeBSD + FRR	2a0c:b641:b50::a	AS34872 transit
cr1.de1	Servperso DE	FreeBSD + FRR	2a0c:b641:b50::b	AS34872 + AS210233 transit
cr1.ch1	Securebit CH	FreeBSD + FRR	2a0c:b641:b50::c	AS58057 transit + SBIX RS
rtr	OVH FR	Debian + FRR	2a0c:b641:b50::d	edge / NAT64

WireGuard mesh

tunnel	ports	link prefix
cr1.nl1 wg0 ↔ cr1.de1 wg0	1337 ↔ 1337	ff00::/127
cr1.nl1 wg3 ↔ rtr wg0	1340 ↔ 1337	ff02::/127
cr1.de1 wg1 ↔ rtr wg1	1338 ↔ 1338	ff05::/127
cr1.ch1 wg0 ↔ rtr wg2	1339 ↔ 1339	ff06::/127
cr1.nl1 wg4 ↔ cr1.ch1 wg1	1341 ↔ 1341	ff07::/127
cr1.de1 wg2 ↔ cr1.ch1 wg2	1342 ↔ 1342	ff08::/127

overlay

Underlay (transit provider networks) is strictly separated from the AS215932 overlay. Core routers are joined by a full WireGuard mesh; iBGP and OSPFv3 run inside the tunnels.

Overlay prefix: 2a0c:b641:b50::/44
WireGuard link /127s under 2a0c:b641:b50:ffXX::/127
WireGuard endpoints pinned to underlay addresses (never overlay)
OSPFv3 carries loopback reachability between routers
iBGP full-mesh carries customer / infra prefixes

edge (OVH FR)

The rtr VM terminates transit on OVH and hosts the infra subnet 2a0c:b641:b50:2::/64. A dedicated overlay VRF (table 200, via systemd-networkd) keeps transit and overlay routing planes isolated. NAT64 (Jool) + DNS64 (Unbound) on rtr provide IPv4 reachability for the IPv6-only fleet via the well-known prefix 64:ff9b::/96.

routing policy

RPKI validation on all transit sessions
IRR objects registered in the RIPE database
AS-path filter drops own-ASN, private ASNs, and paths > 200 chars
TRANSIT-IN / TRANSIT-OUT route-maps applied to every transit peer
Prefix-list AS215932v6-out enforces egress announcements

services on the fleet

host	role	address
dns	Authoritative DNS (Knot)	2a0c:b641:b50:2::10
api	hyrule-cloud + PostgreSQL	2a0c:b641:b50:2::20
web	Web frontend	2a0c:b641:b50:2::30
proxy	TLS reverse proxy (Caddy)	2a0c:b641:b50:2::40
mon	Monitoring (Icinga + Prometheus)	2a0c:b641:b50:2::50
vpn	WireGuard VPN	2a0c:b641:b50:2::60