Service access paths
Where to go for every ISC³ service and what it will ask you for (August 2026).
This page is an index: each row links to the page that owns the service, and no
credential is repeated here — those live in the secretzone (docs/secretzone/,
see secrets management).
Three things decide whether you get in:
- The VPN — NetBird (standard) or the legacy WireGuard profiles.
Everything on the
192.168.88.0/24Calypso subnet, every*.calypsoname and every out-of-band address needs it. - edu-ID through Keycloak — the SSO login on
sso.isc-vs.ch. Realmischolds no password at all: edu-ID is the only way in, and the login page says which service asked. - The admin gate — oauth2-proxy in front of
the admin paths; it requires membership of the Keycloak group
rack-admins. There is a break-glass branch for the day Keycloak itself is broken, but having the VPN up does not trigger it: the public name resolves outward, so the request still arrives as an outside client. It takes the deliberate/etc/hostsstep described there.
Published on the public Internet
Everything below is served by the single srv-web01 reverse proxy;
no other guest is reachable from outside.
| Service | URL | Asks for |
|---|---|---|
| ISC landing page | https://calypso.hevs.ch | nothing |
| Static test sites | https://test.isc-vs.ch, test1–test3.isc-vs.ch | nothing |
| NetBird VPN dashboard | https://vpn.isc-vs.ch | edu-ID |
| Vaultwarden web vault | https://vault.isc-vs.ch | edu-ID, then your vault master password — the vault stays zero-knowledge, so SSO alone does not unlock it |
| Your ISC account settings | https://sso.isc-vs.ch/realms/isc/account/ | edu-ID |
Keycloak admin console, realm isc | https://sso.isc-vs.ch/admin/isc/console/ | admin gate (rack-admins), then edu-ID |
Keycloak admin console, realm master | https://sso.isc-vs.ch/admin/master/console/ | admin gate, then the local master admin — the only routinely used non-edu-ID login, and the one page that still wears the stock Keycloak theme |
| Vaultwarden admin | https://vault.isc-vs.ch/admin | admin gate, then the ADMIN_TOKEN |
Over the VPN only
Never published through the reverse proxy, no certificates, plain HTTP where it says so.
| Service | Address | Asks for |
|---|---|---|
| Proxmox on rumba | https://rumba:8006 | edu-ID (realm ISC SSO) or root@pam |
| Proxmox playground cluster | https://carnaval0.calypso:8006 (.19/.20 for the other two) | edu-ID (realm ISC SSO) or root@pam |
| Proxmox Backup Server | https://srv-pbs.calypso:8007 | root@pam |
| Rack status page | http://srv-status.calypso, history charts at /graphs.html | nothing |
| Netdata | http://rumba:19999, carnaval0–2:19999 | nothing |
| NAS Synology FS2500 | DSM at https://192.168.88.250:5001, plus SSH as IscAdmin | key-based SSH (the key must be in the ssh-agent) / secretzone for DSM |
| Calypso teaching nodes | SSH | your own account |
| Pagode | SSH, once racked | your own account |
| ISC Learn DR mirror | http://learn-test.calypso/learn | the mirror's Moodle admin — restore runbook |
| GitLab test instance | http://srv-gitlab.calypso | disposable, pending teardown |
The VPN looks like one address to every appliance
The CCR2004 source-NATs all WireGuard traffic to 192.168.88.1, so per-source-IP protections on
the 88 subnet see the whole admin team as a single client. This is what once auto-blocked
everyone on the NAS — the standing rule is on the network page.
Out-of-band and device management
| Device | Address | Credentials |
|---|---|---|
| MikroTik CCR2004 (router) | 192.168.88.1 — SSH, WebFig | secretzone; config exports in docs/secretzone/mikrotik/ |
| MikroTik CRS326 (switch) | 192.168.88.254 — SSH, WebFig | as above |
| PDU APC AP8681 | 192.168.88.10 — web UI, SSH; SNMP v2c community public is read-only and open | secretzone (docs/secretzone/pdu.md) |
| rumba iDRAC9 | 192.168.92.10 | secretzone |
| carnaval iDRAC8 ×3 | 192.168.90.18–.20 | secretzone |
Addressing for the out-of-band subnets is on the network page.
Hosted elsewhere
| Service | Access | Notes |
|---|---|---|
| ISC Learn (production Moodle) | https://isc.hevs.ch/learn/; SSH ssh -4 -p 20002 ubuntu@learn.isc-vs.ch | on the hannibal VPS; the SSH port is unreachable from inside Calypso — the uplink filters outbound odd ports |
| Marcellus (legacy VPS) | SSH | contents never inventoried — open item |
| Infomaniak manager | https://manager.infomaniak.com/ | billing and console for both VPS |
| ISC Inventory (Snipe-IT) | — | the docs do not record its endpoint yet |
Open items: ops todo.