Service access paths
Where to go for every ISC³ service and what it will ask you for (August 2026).
This page is an index: each row links to the page that owns the service, and no
credential is repeated here — those live in the secretzone (secretzone/,
see secrets management).
Three things decide whether you get in:
- The VPN — NetBird. Everything on the
192.168.88.0/24appliances subnet, every*.isc3name and every out-of-band address needs it. The legacy MikroTik WireGuard fleet was turned off on 2026-08-07; one break-glass peer remains enabled on the CCR2004 (secretzone/wireguard.md). - edu-ID through Keycloak — the SSO login on
sso.isc-vs.ch. Realmischolds no password: edu-ID is the only way in, and the login page says which service asked. - The admin gate — oauth2-proxy in front of
the admin paths; it requires membership of the Keycloak group
role-rack-admins. There is a break-glass branch for the day Keycloak itself is broken, but having the VPN up does not trigger it: the public name resolves outward, so the request still arrives as an outside client. It takes the deliberate/etc/hostsstep described there.
Published on the public Internet
Everything below is served by the single srv-web01 reverse proxy;
no other guest is reachable from outside.
| Service | URL | Asks for |
|---|---|---|
| ISC landing page | https://calypso.hevs.ch | nothing |
| Static test sites | https://test.isc-vs.ch, test1–test2.isc-vs.ch | nothing |
| srv-docker01 | https://test3.isc-vs.ch | edu-ID (user gate, groups isc/hevs) |
| Audience statistics (Umami) | https://stats.isc-vs.ch | admin gate (role-rack-admins), then the Umami login (secretzone) — the tracker paths ask for nothing |
| NetBird VPN dashboard | https://vpn.isc-vs.ch | edu-ID |
| Your ISC account settings | https://sso.isc-vs.ch/realms/isc/account/ | edu-ID |
Keycloak admin console, realm isc | https://sso.isc-vs.ch/admin/isc/console/ | admin gate (role-rack-admins), then edu-ID |
Keycloak admin console, realm master | https://sso.isc-vs.ch/admin/master/console/ | admin gate, then the local master admin — the only routinely used non-edu-ID login, and the one page that still wears the stock Keycloak theme |
Over the VPN only
Never published through the reverse proxy, no certificates, plain HTTP where it says so.
| Service | Address | Asks for |
|---|---|---|
| Proxmox on rumba | https://rumba:8006 | edu-ID (realm ISC SSO) or root@pam |
| Proxmox playground cluster | https://carnavalN.isc3:8006 (any node shows the whole cluster) | edu-ID (realm ISC SSO) or root@pam |
| Proxmox Backup Server | https://srv-pbs.isc3:8007 | root@pam |
| Rack status page | http://srv-status.isc3, history charts at /graphs.html | nothing |
| Netdata | http://rumba:19999, carnaval0–2:19999 | nothing |
| NetBox | http://srv-netbox.isc3/ | edu-ID through Keycloak, role-rack-admins only; local admin at /login/ is the break-glass path |
| Oxidized | http://srv-oxidized.isc3/ | nothing — the VPN is the gate |
| Healthchecks | http://srv-healthchecks.isc3/ | local account, registration closed (secretzone) |
| ntfy | http://srv-ntfy.isc3/ | publisher (write) or reader (read) — deny-all, no anonymous access |
| Outbound mail relay | SMTP on srv-mail.isc3:25 | nothing — source and recipient allowlists instead of a password |
| NAS Synology FS2500 | DSM at https://192.168.88.250:5001, plus SSH as IscAdmin | key-based SSH (the key must be in the ssh-agent) / secretzone for DSM |
| Tango | SSH, once racked | your own account |
| ISC Learn DR mirror | http://learn-test.isc3/learn | the mirror's Moodle admin — restore runbook |
The VPN looks like one address to every appliance
The CCR2004 source-NATs all WireGuard traffic to 192.168.88.1, so per-source-IP protections on
the 88 subnet see the whole admin team as a single client. This is what once auto-blocked
everyone on the NAS — the standing rule is on the network page.
Out-of-band and device management
| Device | Address | Credentials |
|---|---|---|
| MikroTik CCR2004 (router) | 192.168.88.1 — SSH, WebFig | secretzone; config exports in secretzone/mikrotik/ |
| MikroTik CRS326 (switch) | 192.168.88.254 — SSH, WebFig | as above |
| PDU APC AP8681 | 192.168.88.10 — web UI, SSH; SNMP v2c community public is read-only and open | secretzone (secretzone/pdu.md) |
| rumba iDRAC9 | 192.168.92.10 | secretzone |
| carnaval iDRAC8 ×3 | 192.168.90.18–.20 | secretzone |
Addressing for the out-of-band subnets is on the network page.
Hosted elsewhere
| Service | Access | Notes |
|---|---|---|
| ISC Learn (production Moodle) | https://isc.hevs.ch/learn/; SSH ssh -4 -p 20002 ubuntu@learn.isc-vs.ch | on the hannibal VPS; the SSH port is unreachable from inside the rack network — the uplink filters outbound odd ports |
| Marcellus (legacy VPS) | SSH ssh ubuntu@marcellus.begincoding.net | key-based, passwordless sudo; password auth is off. Inventoried August 2026; migration and decommissioning are an open item |
| Infomaniak manager | https://manager.infomaniak.com/ | billing and console for both VPS |
| ISC Inventory (Snipe-IT) | https://isc-inventory.isc-vs.ch | on the hannibal VPS; per-user credentials, permissions and request flow |
Open items: ops todo.