Networking

IP layout

Segment	Range	Purpose
LAN	`192.168.20.0/24`	All VMs — flat layer 2
MetalLB pool	Reserved /28 within LAN	LoadBalancer services in Kubernetes
K8s service CIDR	`10.43.0.0/16`	In-cluster service IPs
K8s pod CIDR	`10.42.0.0/16`	Pod networking (Flannel)
WireGuard	`10.133.7.0/24`	VPN tunnel: cluster ↔ edge VPS

Traffic flows

Public services (Cloudflare tunnel)

User → Cloudflare (CDN + DDoS) → Cloudflared pod (×2, in-cluster) → Traefik → Service

Cloudflare handles CDN and TLS termination. No ports are forwarded on the home router.

VPS-proxied services (Pangolin tunnel)

User → Edge VPS → Traefik (VPS) → Pangolin server → Newt client (in-cluster) → Traefik → Service

Used for services that need HTTP(S) proxying without Cloudflare in front.

Remote admin (WireGuard VPN)

Admin → WireGuard client → Edge VPS (WireGuard server)
      → wg-gateway pod (10.133.7.4)
      → K8s service CIDR (10.43.0.0/16)

The mii-wireguard pod is the WireGuard client inside the cluster. It masquerades the K8s service CIDR so all cluster services are reachable over the VPN without split-DNS.

Gitea → ArgoCD webhook

Gitea (docker-host11) → push webhook → ArgoCD (in-cluster) → reconcile manifests

ArgoCD polls on a schedule and also receives webhooks on git push.

ArgoCD Image Updater → Gitea

Image Updater detects new tag in registry
  → commits updated annotation to Gitea repo
  → ArgoCD detects commit → re-syncs Deployment

Keeps image versions in Git without a human in the loop.

Media stack

Prowlarr (indexer aggregator)
  → Sonarr / Radarr (request management)
  → download client + Gluetun sidecar (VPN-isolated)
  → Unpackarr (extract archives)
  → NFS share on aya01
  → Jellyfin (on docker-host11, hardware transcoding via Intel QuickSync)

Certificate management

Cert-Manager handles all TLS automatically via Let's Encrypt DNS-01 using the Cloudflare API. DNS-01 works for internal-only domains and wildcard certs without exposing any HTTP endpoint.

The edge VPS uses the Netcup DNS API for its own certs.

Service mesh

Istio runs in Ambient mode — no sidecars. The ztunnel DaemonSet runs on every node and handles transparent L4 proxying for all pods in the mesh. Waypoint proxies (L7) are not yet deployed.

2.4 KiB Raw Blame History Unescape Escape