Projects · Mini Hostpapa
Volume 1: Internet & Network Foundations
From zero networking knowledge to designing a hosting datacenter: packets, IP space, racks, firewalls, and every network requirement CloudStack expects.
Volume 1: Internet & Network Foundations
Alright. Volume 0 is done.
You know what HostKid is, how it makes money, who owns what, how we measure health, how we govern, and what customers trust us with. You even have the high-level architecture with the rack, the zones, and CloudStack on KVM.
And here is the honest problem with that page:
It names things it does not teach you.
VLAN. ToR switch. Storage VLAN. Virtual Router. Public IP range. Management network. Out of band. Guest traffic. Trunk. Bond.
Volume 0 said "numbered VLANs come later." Later is now.
This volume is not a trivia quiz about the OSI model. It is the difference between renting a rack and hoping versus walking into a datacenter with an IP plan, a VLAN plan, a firewall policy, and a CloudStack topology that actually boots.
What this volume is really for
Let me be very direct about the intent, because it shapes every doc here.
HostKid needs an IT manager who can build a datacenter footprint from nothing. Not someone who can recite acronyms. Someone who can answer, under pressure, in front of a colo engineer:
| Question you will be asked | Where this volume answers it |
|---|---|
| "What is your uplink handoff, copper or fiber, and how many?" | Doc 3, Datacenter & physical network |
| "Do you have your own IP space and ASN, or do you want ours?" | Doc 2, IP space, ASN & BGP |
| "Which VLANs do you want trunked to your ports?" | Doc 3 and Doc 4 |
| "What do you want blocked at the edge, and who handles abuse reports?" | Doc 4, Segmentation & edge defense |
| "Your hypervisors need which bridges, on which subnets?" | Doc 5, CloudStack network requirements |
The promise of Volume 1: a reader who starts with zero networking background finishes able to design, document, and defend the network of a small hosting company, and to explain every network requirement Apache CloudStack imposes before a single package is installed.
Who this volume is written for
Start at Doc 1 and read in order. Every term gets a plain definition before it gets used in a design. You will not be dropped into VLAN tagging without knowing what a frame is.
The five docs and how they build on each other
Five docs. Each one earns the next.
| Doc | The one question it answers | What you can do after it |
|---|---|---|
| 1. How the internet actually works | What happens between a customer click and a server reply? | Read a packet capture, subnet an address block, explain DNS and TLS without hand waving |
| 2. IP space, ASN & BGP | How does a hosting company become a real citizen of the internet? | Plan IPv4 scarcity and IPv6 abundance, understand RIR policy, decide transit vs your own ASN |
| 3. Datacenter & physical network foundations | What do we physically build inside a rented rack? | Produce a rack elevation, cabling plan, switch config outline, and power budget |
| 4. Segmentation, firewalls & edge defense | How do we keep tenants, staff, and attackers in separate lanes? | Design VLAN zones, edge firewall policy, anti spoofing, and a DDoS response path |
| 5. CloudStack network requirements & IP plan | What exactly does Apache CloudStack demand from our network? | Map traffic types to bridges, size IP ranges, open the right ports, avoid the classic pitfalls |
Because CloudStack does not build your network. It assumes you already built it correctly, then fails in confusing ways when you did not. Traffic labels, bridges, VLAN trunking, and reserved IP ranges are network decisions you make before installing anything. Volume 4 operates the platform. Volume 1 makes sure the platform has a floor to stand on.
The mental model we are building
Four layers. Every doc adds one.
| Layer | Plain English | Volume 1 doc |
|---|---|---|
| Protocol layer | How bits become conversations: frames, packets, sessions, names, certificates | Doc 1 |
| Identity layer | Who we are on the global internet: address blocks, ASN, routing announcements | Doc 2 |
| Physical layer | Metal, cables, switches, power, and the boring discipline that prevents outages | Doc 3 |
| Policy layer | Who may talk to whom, and what happens when something hostile shows up | Doc 4 |
| Platform contract | Translating all of the above into what CloudStack expects | Doc 5 |
Skipping a layer does not save time. It relocates the pain to 2 a.m. during your first customer incident, which is the most expensive place to learn subnetting.
What this volume does NOT cover
Boundaries keep the handbook honest.
| Topic | Where it lives |
|---|---|
| Linux network configuration, netplan, bridges and bonds on a real host, troubleshooting | Volume 2, lab environment |
| Choosing Proxmox vs CloudStack vs VMware | Volume 3 (decision already recorded in Volume 0) |
| Installing and operating CloudStack, zones, offerings, templates | Volume 4 |
| HAProxy, reverse proxy, load balancing, VPN implementation, tenant network operations | Volume 5, Networking |
| Storage arrays, Ceph design, backup strategy | Volume 6, Storage |
| Authoritative DNS product, zones for customers | Volume 12, DNS platform |
| Firewall tooling, CrowdSec, WAF rules, hardening playbooks | Volume 22, Security |
Volume 1 teaches you to design and justify the network. Volumes 4, 5, and 22 teach you to build, operate, and defend it with specific tools and configs.
How to read this volume
- Read Doc 1 even if you think you know it. We standardize vocabulary here so later docs stay short.
- Read Doc 2 before you talk to any provider. IP and ASN decisions have lead times measured in weeks, not hours.
- Read Doc 3 with a spreadsheet open. Rack units, power, port counts, and cable lengths are a shopping list.
- Read Doc 4 with your security hat on. This is where Volume 0 governance becomes packets and rules.
- Read Doc 5 last, twice. Once to understand CloudStack's demands, once to check your Doc 3 and Doc 4 designs actually satisfy them.
Each of the five docs currently carries its pinpoint outline: the exact topics, definitions, tables, diagrams, and labs it will contain. We are locking scope and sequence first, deliberately, so the deep content lands in the right place instead of sprawling across three docs.
Content gets developed doc by doc from here.
Next: How the internet actually works. We start with a single packet and refuse to hand wave.