Engineering Glossary

Home Documentation Engineering Glossary

Networking

VLAN (Virtual Local Area Network): A way to split one physical switch or network into several isolated logical networks by tagging traffic with a numeric ID (1 to 4094). Devices on different VLANs cannot talk to each other unless a router or firewall allows it.
802.1Q trunk: A switch port configured to carry traffic for many VLANs at once, with each Ethernet frame tagged with its VLAN ID. Trunks typically connect switches to each other or to a firewall or hypervisor host.
Access port: A switch port that belongs to exactly one VLAN and carries untagged traffic for it. End devices such as PCs and printers plug into access ports.
Subnet: A range of IP addresses carved out of a larger network, written in CIDR notation such as 192.168.20.0/24. Hosts in the same subnet can talk directly; crossing to another subnet requires a router.
NAT (Network Address Translation): Rewriting of IP addresses in packet headers as traffic crosses a router, most commonly to let many private devices share one public IP address. Outbound NAT is routine; inbound NAT (port forwarding) exposes internal services and is avoided on this site in favour of a tunnel.
DHCP reservation: A rule on the DHCP server that always hands the same IP address to a device with a given MAC address. Used for infrastructure (hypervisor hosts, switches, cluster nodes) so their addresses are stable without manual configuration on each device.
DNS (Domain Name System): The distributed system that translates names such as tyfsadik.org into IP addresses. This lab runs self-hosted DNS so internal services resolve to internal addresses without depending on a public resolver.
Reverse proxy: A server that accepts requests from clients and forwards them to one or more backend services, presenting a single public entry point. In this cluster the ingress-nginx controller fills this role, routing by hostname and path.
TLS certificate: A signed digital document that proves a server owns a domain name and enables encrypted HTTPS connections. Certificates expire and must be renewed; cert-manager automates that in the cluster.
Bridge mode: A configuration where a network device (modem, access point, or virtual switch) forwards traffic transparently at layer 2 instead of routing it. A bridged wireless link behaves as if both ends were plugged into the same switch.
Backhaul: The link that carries traffic from a remote part of a network back to the core. In the server room, the 5 GHz wireless bridge between the laptop nodes and the main switch is a wireless backhaul.

Virtualization & Orchestration

Hypervisor: Software that runs multiple virtual machines on one physical host by allocating CPU, memory, and I/O between them. A type-1 (bare-metal) hypervisor runs directly on the hardware without a general-purpose host OS.
Proxmox VE: An open-source type-1 hypervisor platform based on Debian Linux that combines KVM virtual machines and LXC containers behind one web management interface. The lab runs Proxmox VE 8.x on its physical hosts.
VM vs LXC container: A VM virtualizes an entire machine, including its own kernel, so it can run any guest OS. An LXC container shares the host's Linux kernel and isolates only userspace, which is lighter but limited to Linux workloads.
Kubernetes: An open-source orchestrator that schedules containerized workloads across a cluster of machines, restarts failed ones, and exposes them as services. It is an API-driven control system, not a virtualization platform.
kubeadm: The official Kubernetes tool for bootstrapping a cluster from upstream components: it initializes the control plane, joins worker nodes, and configures certificates, without hiding the underlying mechanics. This site uses it specifically to stay close to upstream Kubernetes.
Control plane: The set of Kubernetes components that make cluster-wide decisions: the API server, etcd datastore, scheduler, and controller managers. Losing the control plane does not stop running workloads, but nothing new can be scheduled or changed.
Worker node: A cluster machine that runs the actual workload pods. It runs a kubelet agent and a container runtime, and reports its status back to the control plane.
Pod: The smallest deployable unit in Kubernetes: one or more containers that share a network namespace and storage volumes and are scheduled together on one node.
CNI (Container Network Interface): The plugin standard Kubernetes uses to wire pods into a network. A CNI plugin assigns pod IP addresses and programs the routes and rules that let pods reach each other across nodes.
Calico: A CNI plugin that provides pod networking and network policy enforcement using standard routing rather than an overlay in its common configuration. The lab runs Calico v3.28.0.
MetalLB: A load balancer implementation for bare-metal Kubernetes clusters. It hands out real IP addresses from a configured pool for LoadBalancer-type services, a job that cloud providers normally do automatically. The lab runs MetalLB v0.14.5.
Ingress: A Kubernetes resource that routes external HTTP and HTTPS traffic into cluster services based on hostname and path rules. An ingress controller (here ingress-nginx v1.10.1) is the component that actually implements those rules.
Longhorn: A distributed block storage system for Kubernetes that replicates volumes across the disks of cluster nodes and presents them as persistent volumes. The lab runs Longhorn v1.6.2.
Persistent volume claim (PVC): A Kubernetes request for storage of a given size and access mode. A provisioner such as Longhorn satisfies the claim by creating a volume, which the pod then mounts like a disk.
Node drain: Safely evicting all pods from a node (with rescheduling elsewhere) before maintenance such as reboots or upgrades. Draining respects disruption budgets so workloads stay available.

Storage

Raw vs usable capacity: Raw capacity is the sum of the drive sizes on the label. Usable capacity is what remains after RAID redundancy, filesystem overhead, and (in replicated systems such as Longhorn) replication copies are subtracted, and it is always smaller.
RAID (Redundant Array of Independent Disks): Combining multiple drives so data survives one or more drive failures, or so reads and writes go faster. RAID protects against drive failure only; it is not a backup.
Parity: Extra data computed from the real data and spread across drives so that a missing drive's contents can be reconstructed. RAID 5 uses single parity (survives one failure); RAID 6 uses double parity (survives two).
JBOD (Just a Bunch of Disks): Presenting drives to the operating system individually with no RAID layer in between. Software such as ZFS or Longhorn then manages redundancy itself, which is why JBOD is common in homelab storage nodes.
Snapshot: A point-in-time, copy-on-write record of a volume's state. Snapshots are fast and cheap but live on the same storage, so they protect against accidental deletion or bad changes, not against hardware loss.
Replication vs backup: Replication continuously copies data to a second location so it is available quickly after a failure; it also copies deletions and corruption. Backup keeps independent, versioned copies so you can go back in time. They solve different problems.
3-2-1 backup rule: Keep at least 3 copies of important data, on 2 different types of media or systems, with 1 copy offsite. It is the baseline against which any homelab backup plan should be measured.
SMART (Self-Monitoring, Analysis and Reporting Technology): Health telemetry built into drives: reallocated sectors, temperature, power-on hours, and error counts. Watching SMART data gives early warning of drive failure before data is lost.

Security

Zero trust: A security model where no request is trusted just because it comes from inside the network; every access is authenticated and authorized against identity and policy. Practically, it replaces "reach the LAN, reach everything" with per-service, identity-based access.
VLAN segmentation: Using separate VLANs (with firewall rules between them) to limit what can reach what: for example management interfaces on VLAN 10, cluster traffic on VLAN 20, and services on VLAN 30. A compromise in one segment does not automatically reach the others.
Firewall rule: A single allow-or-deny statement matching traffic by source, destination, port, and protocol. Rule order matters, and the safest default is to deny everything not explicitly allowed.
Least privilege: Granting each user, service account, or process only the permissions it needs for its actual job, and nothing more. It limits the blast radius of both mistakes and compromises.
Secrets management: Storing credentials, API keys, and certificates in a dedicated system with access control and rotation, instead of in config files, shell history, or source code. In Kubernetes this means Secret objects or an external secrets store, never committed manifests.
fail2ban: A daemon that watches service logs (SSH is the classic case) and temporarily firewall-blocks source IPs after repeated failed logins. It slows down password-guessing noise; it is a complement to key-only auth, not a replacement for it.

AI / Machine Learning

LLM (Large Language Model): A neural network trained on large text corpora to predict the next token, which makes it able to answer questions, write, and reason within limits. Examples include the Llama, Mistral, and Qwen families.
Inference: Running a trained model to produce output from new input, as opposed to training it. Inference cost is dominated by model size and available memory bandwidth, which is why local inference is a hardware question.
Quantization: Reducing the numeric precision of a model's weights (for example from 16-bit to 4-bit) so it uses far less memory and runs faster, at the cost of some quality. Quantization is what makes large models practical on consumer hardware.
GGUF: A file format for quantized models used by llama.cpp and compatible runners. A single GGUF file contains the quantized weights plus metadata, and file names encode the quantization level (such as Q4_K_M).
Context window: The maximum number of tokens a model can consider at once, covering both the input and the generated reply. Longer conversations or documents beyond the window are truncated or lost.
Tokens per second: The generation speed of an LLM: how many output tokens it produces per second. It is the number a user actually feels, and on local hardware it is set mostly by VRAM bandwidth and model size.
GPU VRAM: The dedicated memory on a graphics card. For local inference, VRAM capacity determines which model sizes and quantization levels fit entirely on the GPU; spilling to system RAM slows generation sharply.
RAG (Retrieval-Augmented Generation): A pattern where the system first retrieves relevant documents from a store, then inserts them into the prompt so the model answers from supplied material rather than memory alone. It reduces made-up answers for questions about specific documents.

Defence & Research

Terms used on the defence hardware program pages. Those projects are hobby-scale simulations and experiments, and the terms below are used in that context.

Passive acoustic detection: Detecting and classifying objects (drones, vessels, vehicles) by listening to the sound they emit, using microphones or hydrophones, without transmitting any signal. "Passive" means the sensor reveals nothing about itself by emitting.
GPS-denied navigation: Navigating when satellite positioning is unavailable or deliberately jammed, using alternatives such as inertial sensors, visual odometry, or terrain matching. The core challenge is bounding the drift that accumulates without an absolute fix.
Sensor fusion: Combining readings from several sensors (for example IMU, camera, and acoustic arrays) into one estimate that is better than any single source, usually with a filter such as a Kalman filter. It trades compute for robustness against any one sensor failing or being fooled.
SITL (Software In The Loop): Running real vehicle firmware (such as ArduPilot) against a simulated vehicle and physics engine (such as Gazebo) on a computer, with no hardware involved. It lets control logic be tested and broken safely before anything flies or drives.
DDIL (Denied, Degraded, Intermittent, Limited): A shorthand for communications environments where links are jammed, slow, or only occasionally available. Systems designed for DDIL must keep working autonomously and synchronize opportunistically when a link appears.

Networking

Virtualization & Orchestration

Storage

Security

AI / Machine Learning

Defence & Research

See Also