Configuration and settings management for the FlexNetOS home-lab network
control stack. This project provides a pure-Rust CLI (netctl) and supporting
documentation to manage the network infrastructure.
- Omada SDN Controller — TP-Link router, switches, and access points
- TRENDnet TEG-7124WS — Web-managed switch with LAG support
- AT&T BGW320-505 — Fiber gateway / modem monitoring
network-control (netctl) owns the off-host network fabric — the physical/SDN
infrastructure on the wire: the Omada controller, switches, access points, and the gateway
(VLANs, SSIDs, VPN policies, port/LAG config) ported from each vendor's web UI into Rust.
It does not own a host's own OS network stack. That is lane's
plane (per lane ADR-0003): a workstation's interfaces, addresses, routes, and the
netplan/NetworkManager rendering on that box (e.g. the Cognitum Seed USB link-local address
env-ctl depends on). The split is by layer, not by device:
| Layer | Owner |
|---|---|
| Off-host fabric (router/switch/AP/gateway, VLANs, SSIDs, VPN policy) | network-control / netctl |
| On-host OS network config (host NICs, addresses, routes, netplan/NM) | lane (ADR-0003) |
| Cross-machine relay + governed web egress | lane (ADR-0001/0002) |
Neither tool should reach into the other's layer. Coordinate via weave when a change spans both (e.g. a host route that depends on a new VLAN).
- Rust (stable toolchain; see
rust-toolchain.toml) - Pixi — recommended package manager for docs/legacy Python tasks
- Nushell — automation scripts in
scripts/nu/
# Rust
https://rustup.rs
# Pixi
curl -fsSL https://pixi.sh/install.sh | bash
# Nushell
pixi global install nushell# Build the Rust workspace
cargo build --workspace --locked
# Host networking snapshot
cargo run --bin netctl -- status
# Omada controller info
cargo run --bin netctl -- omada info --insecure
# AT&T modem WAN status
cargo run --bin netctl -- modemRun pixi run docs-serve and open http://127.0.0.1:8000, or see
docs/docs/ for the source.
| Command | Description |
|---|---|
netctl status |
Read-only host networking (interfaces, addresses, gateway, DNS). |
netctl bond plan|apply|status |
Plan/apply a persistent host-side LAG via netplan. |
netctl link set <if> up|down |
Live netlink interface state change. |
netctl link addr add|del <if> <cidr> |
Live address add/remove. |
netctl link route add|del <dest> [--via <gw>] [--dev <if>] |
Live route add/remove. |
netctl switch status |
Read the TRENDnet TEG-7124WS switch's LAG / trunk groups. |
netctl switch lag <id> <ports> [--mode lacp|static|disabled] |
Plan/apply a switch-side LAG. |
netctl omada info|status|aps |
Query the Omada SDN controller. |
netctl omada ssl-vpn status |
Read the Omada SSL VPN server configuration. |
netctl omada ssl-vpn enable [--apply] |
Enable/preview the Omada SSL VPN server (dry-run by default). |
netctl omada vpn-policy list |
List Omada VPN policies. |
netctl omada vpn-policy create [--apply] |
Create/preview a new Omada VPN policy (dry-run by default). |
netctl modem |
Monitor the upstream AT&T fiber gateway. |
netctl ssh <target> [cmd] |
Pure-Rust SSH remote exec. |
netctl relay id|serve|ping |
p2p relay between netctl nodes. |
netctl link …, netctl bond apply, and netctl switch lag are dry-run by
default — add --apply to commit. Disruptive live ops also require --force.
Use --json on any command for machine-readable output.
| Command | Description |
|---|---|
pixi run docs-serve |
Start documentation server |
pixi run health-check |
Check network health |
pixi run inventory |
View device inventory |
pixi run vlans |
View VLAN configuration |
network-control/
├── crates/
│ ├── netengine/ # Core logic library
│ ├── netctl/ # CLI front-end
│ └── netctl-gui/ # Native GUI front-end
├── config/ # Legacy Python configuration
├── docs/ # MkDocs documentation
├── infrastructure/ # IaC (Terraform, Ansible, MCP)
└── scripts/ # Nushell / PowerShell automation
- Site Health Score: 100
- Managed Devices: 3 (1 Gateway, 2 APs)
- Clients: 15 (5 wired, 10 wireless)
- SSID: FlexNetOS
| VLAN | Name | Subnet |
|---|---|---|
| 1 | Management | 10.0.1.0/24 |
| 10 | Compute | 10.0.10.0/24 |
| 30 | VLAN 30 | 10.0.30.0/24 |
| 40 | Media | 10.0.40.0/24 |
- Web UI: https://127.0.0.1:8043
Private - Internal Use Only