Skip to content

Canonical Lab

Objective

Provide a realistic headquarters deployment that validates the base Windows infrastructure pattern intended for the company's first real deployment before it is reused for additional customers or larger topologies.

Lab scope

  • Single HQ site
  • Approximate business size: 15 users
  • Representative endpoint sample instead of full-seat simulation
  • Separated Windows roles
  • Proxmox virtualization with MikroTik CHR as the authoritative router/firewall

The lab is a pre-production validation of the first company deployment target. It is not a separate reduced architecture with different core roles.

The approved day-zero equipment baseline for this site is documented in HQ Equipment Baseline.

Current starting point

Component State
HQ-CHR01 Deployed as VMID 4010 with RouterOS 7.21.5 Long-term
Windows Server template Available as VMID 4000 with build workflow on VLAN 110
GEILWAN WAN bridge with 172.31.255.1/30 on the Proxmox side
GEILLAN VLAN-aware LAN trunk for VLANs 2-4094
GEILLAN.100 on H1 172.20.100.11/24
VLAN 100 gateway on CHR 172.20.100.1

Authoritative deployed values

These values come directly from the deployment conversation and should be treated as the current lab truth unless the overlay explicitly changes them.

Property Value
Proxmox node H1
CHR hostname HQ-CHR01
CHR VMID 4010
CHR storage local-zfs
CHR CPU 2 vCPU
CHR memory 2048 MB
CHR disk 4 GB
CHR WAN bridge GEILWAN
CHR LAN bridge GEILLAN
CHR WAN IP 172.31.255.2/30
CHR WAN gateway 172.31.255.1
Template hostname TPL-WS2025
Template VMID 4000
Template build VLAN 110
Template build IP 172.20.110.10/24
Template build gateway 172.20.110.1
Recommended AD domain design corp.gntech.me
Recommended user UPN suffix gntech.me

First validated VM set

VM Role VLAN Addressing
HQ-DC01 AD DS, DNS, DHCP 20 Static
HQ-FS01 SMB shares 20 Static
HQ-CL01 Domain client 30 DHCP
HQ-CL02 Domain client 30 DHCP
HQ-PRN01 Printer validation target 40 Static or reserved

What this lab must prove

  • CHR routes required VLANs correctly.
  • Hypervisor management on VLAN 100 remains functional.
  • Servers on VLAN 20 can host core Windows services.
  • Clients on VLAN 30 can get leases, resolve DNS, join the domain, receive GPO, and access SMB.
  • Guest traffic on VLAN 70 remains isolated from internal services.
  • Backup workflow can target VLAN 90.
  • CHR is registered with a trial license during the lab so validation is not constrained by the default unlicensed bandwidth limit.

If the first real company deployment requires an infrastructure role, that role must be represented and validated in the lab before the deployment method is treated as approved.