That’s actually awesome! Thank you for sharing this with us. We also have an old iPad Air in the drawer but I hesitated to use it as a HA Display because it does not need to be always on and draw power without anyone looking at it. I was thinking about getting an E-Ink Display, but from what I have read, you managed to remotely trigger the iPad on / off when a presence detector fires? I do not have one yet, but I need to try this.

In another post here you write, that you parse PDFs from your Waste collector to get the schedules… you are probably aware of it, but in HACS, there is an Add-On “Waste Collection Schedule” that has support for the APIs of hundreds of waste collectors around the world. Maybe your area is included: https://github.com/mampfes/hacs_waste_collection_schedule

Edit: If it would be possible to let it render a HA Dashboard, it would actually be able to display everything that HA already can, without the need to implement the functionality within your Add-On. This is just after I started reading the GitHub page and Documentation, so maybe you already do that. I am not asking for interactivity like when opening the HA Website in the Browser (which might or might not work on very old iPads), but just “converting” a specific Dashboard to a picture and show it on the Screen. Let it update every X minutes and we can see everything we can render within HA.

Thank you very much for your reply. So the bottomline is, that when bound to a residential ISP, we most likely have no chance to utilize our own AS and IPv6 Prefix without the help of a 3rd party (ASN peering aside, which is needed of course, no matter what). So it’s usually involving tunnels to get it up and running. That solves the mystery somewhat for me and I think I know in which direction I have to do my research.

I think I will start prototyping with route64 (which you mentioned above), but if I get this up and running, I would appreciate it if you could PM me the LIRs you have on your list. If I can wrap my head around this, if the fees are still in the ballpark you mentioned above, that sounds very reasonable to use this in my Homelab and gather experience with IPv6 and AS.

Thanks again for your help :-)

May I ask how you got this started? Hosting your own ASN, as far as I understand only works if my ISP would actually route traffic to my ASN, right? I am thinking about getting into IPv6 for self-hosting and I could ask my ISP to change my current setup (I only have IPv4, but a public one, without CGNAT) and I do not trust them that they mess this up. So my preferred way would be to not touch anything on the ISP side and host my own ASN and find a Sponsor for a /48 Block. I still cannot wrap my head around this.

Just that I understand you correctly: You got your ASN and /48 block from RIPE (or a Sponsor I assume) and you host your own AS? Or is the AS hosted by someone else? If the latter, I wonder how traffic can find to your home or to your Server locations.

Nothing of this would work without getting in touch with my ISP, and I fear the usual resedential IPs will not care.

I never really used Playlists, so I cannot comment on that, sorry. The only thing I do is subscribing to some channels in Invidious when I am on my PC and I do see them in Kodi. Usually I search for what I am interested in and that works fine for me in Kodi and Invidious. Invidious is still in active development, but you meant the Kodi Plugin maybe? I hope it is not abandoned and just not worked on because it still… works? :-)

I use the Kodi Invidious Plugin and my own Invidious instance.

The .10 or .20 just advises Docker to create that specific Subinterface automatically. In my example ip link will show new interfaces called br0.10 and br0.20 after creating the macvlan networks for VLAN IDs 10 and 20. You do not need to adjust your Netplan config when doing it like that. I would even assume that you are not allowed to define VLAN ID 10 and 20 in that particular case also in Netplan. I would expect that this will cause issues. Also see https://docs.docker.com/engine/network/drivers/macvlan/ in the 802.1Q trunk bridge mode section.

There are probably multiple ways to do all of this, but this is how I did it and it works for me since a few years without touching it again. All VLANs are separated from each other and no VLAN has access to the LAN side. Everything is forced to go through tagged VLANs via the switch to the Firewall, where I then create rules to allow / deny traffic from / to all my networks and the Internet.

For me, this setup is very simple to re-implement should my Host go down. No special configuration in Netplan is needed. Only create the Docker Networks and start up my stacks again.

I can’t see your full setup / config from here, but a) you are not overengineering that. Using VLANs to segment networks is a very good practice. And although Docker (nor Podman) allow macvlan when running rootless, my gutfeeling tells me that segmenting my network takes priority over running rootless, because I think that attack vectors by traversing networks are much more common that breaking out of a container into the host. But this is just my gutfeeling. b) I think I run here what you want to achieve, so I try to explain what I did.

My Setup is similar to yours. OPNsense (OpenWRT before that), a Switch that is capable of VLAN and a Ubuntu Server with a single NIC that hosts all the Compose stacks.

1. You already configured your VLANs in OPNsense, so I will just mention that I created mine via Interface -> Devices -> VLAN on the LAN Interface of my OPNsense and then used the Assignments to finally make them available. On the OPNSense each one gets a static IP from the respective Network I defined for the VLAN.
2. On the Docker Host, in Netplan I configured the single NIC I have as a Bridge. I cannot remember if that was necessary or if I just planned ahead, should I add a 2nd NIC later on, to prevent that I need to reconfigure the whole networking again. Of course that Bridge sits in my LAN and the Netplan Config looks like this:

network:
  ethernets:
    eno1:
      dhcp4: no
  version: 2
  bridges:
    br0:
      addresses:
      - 192.x.x.3/24
      nameservers:
        addresses:
        - 192.x.x.x
        search:
        - my.lan
        - local
      routes:
      - to: default
        via: 192.x.x.1
      interfaces:
        - eno1

3. Now that the Docker Containers can use the VLANs, I had to create Docker Networks as macvlan like this:

docker network create -d macvlan --subnet=192.x.10.0/24 --gateway=192.x.10.1 -o parent=br0.10 vlan10
docker network create -d macvlan --subnet=192.x.20.0/24 --gateway=192.x.20.1 -o parent=br0.20 vlan20

4. Now for a Container to make use of those Networks, you have to define them as External in the Compose Stack like this:

services:
  my-service:
    image: blah
    ...
    networks:
      vlan10:

networks:
  vlan10:
    name: vlan10
    external: true

In 4. you have the option to not define an ipv4_address in the networks section. Then Docker will just pick its own addresses when the containers start. Letting OPNsense assign IP addresses dynamically in such a VLAN is something that did not work for me. So either you let Docker pick the IPs when starting a stack, or you define your IP addresses in the stack. If you do the latter, you have to do it for every stack that ever joins that VLAN, otherwise Docker might pick an IP that you already assigned manually and that stack will not start.

I also wanted to have some services running directly in the LAN via Docker. This setup is a bit more involved and requires you to create a SHIM Network, otherwise the Docker Host itself will not be capable of accessing Containers running in the LAN Network. This was the case for my Pi-Hole for example, that I wanted to have an IP in my LAN Network and had to be reachable by the Docker Host itself too. There is a very good post about Macvlan and SHIM Networks in this blog: https://blog.oddbit.com/post/2018-03-12-using-docker-macvlan-networks/

I hope this helps. Do not give up. Segmenting your Networks is important, especially if you plan to publish some services over the Internet.

Just a thought about the Switch. Maybe you could plug it into a Powersocket that is monitored in HA, like a NOUS A1-T? If power draw goes up, the Switch is on. This could easily be “hacked” by the kids by plugging the switch into another Powersocket. But if the Switch has a reliable Standby power draw, that could be monitored too. If that is zero, the someone is cheating :-)

Monitoring the Switch when not docked, could maybe done via WiFi? Check if the MAC (or the IP if fixed via DHCP) is online or not. Of course this also helps if the Switch is always Online when used. I do not have one, so I do not know.

Since you are German, don´t forget the Impressum. I think it is mandatory and some people are dicks.