6936c3f82a
Corrected stale claims found by cross-referencing git history and live kubectl/SSH state: - Drop Terraform provisioning claim (VMs are created by the ansible-homelab proxmox role via community.proxmox.proxmox_kvm; terraform/ is empty) - Bump k3s badge to the version actually running (v1.36) - Drop Elastic Stack as a live logging path - it was disabled in favor of agentmemory and has no namespace or ArgoCD Application anymore - Drop zeroclaw from the app list - manifests exist but it was never wired into ArgoCD's app registry, so it has never actually run Added detail confirmed against live state: Longhorn's Hetzner backup target, node_cleanup containerd-pruning timer, MikroTik static DHCP leases, Prometheus cardinality/false-positive-alert tuning, actual CNPG cluster inventory, corrected MetalLB pool size, aya01's real NFS capacity, k3s-server11's post-rebuild spec drift, and the naruto01 etcd quorum concentration.
87 lines
2.7 KiB
Markdown
87 lines
2.7 KiB
Markdown
# Networking
|
||
|
||
## IP layout
|
||
|
||
| Segment | Range | Purpose |
|
||
|---------|-------|---------|
|
||
| LAN | `192.168.20.0/24` | All VMs — flat layer 2 |
|
||
| MetalLB pool | `192.168.20.240–250` (11 IPs) within LAN | LoadBalancer services in Kubernetes |
|
||
| K8s service CIDR | `10.43.0.0/16` | In-cluster service IPs |
|
||
| K8s pod CIDR | `10.42.0.0/16` | Pod networking (Flannel) |
|
||
| WireGuard | `10.133.7.0/24` | VPN tunnel: cluster ↔ edge VPS |
|
||
|
||
A handful of k3s nodes have static DHCP leases pinned on the MikroTik router (managed via Ansible, config backed up to Git on every run) — cheap insurance against a lease renewal quietly moving a node's IP out from under kube-vip or the inventory.
|
||
|
||
---
|
||
|
||
## Traffic flows
|
||
|
||
### Public services (Cloudflare tunnel)
|
||
|
||
```
|
||
User → Cloudflare (CDN + DDoS) → Cloudflared pod (×2, in-cluster) → Traefik → Service
|
||
```
|
||
|
||
Cloudflare handles CDN and TLS termination. No ports are forwarded on the home router.
|
||
|
||
### VPS-proxied services (Pangolin tunnel)
|
||
|
||
```
|
||
User → Edge VPS → Traefik (VPS) → Pangolin server → Newt client (in-cluster) → Traefik → Service
|
||
```
|
||
|
||
Used for services that need HTTP(S) proxying without Cloudflare in front.
|
||
|
||
### Remote admin (WireGuard VPN)
|
||
|
||
```
|
||
Admin → WireGuard client → Edge VPS (WireGuard server)
|
||
→ wg-gateway pod (10.133.7.4)
|
||
→ K8s service CIDR (10.43.0.0/16)
|
||
```
|
||
|
||
The `mii-wireguard` pod is the WireGuard client inside the cluster. It masquerades the K8s service CIDR so all cluster services are reachable over the VPN without split-DNS.
|
||
|
||
### Gitea → ArgoCD webhook
|
||
|
||
```
|
||
Gitea (docker-host11) → push webhook → ArgoCD (in-cluster) → reconcile manifests
|
||
```
|
||
|
||
ArgoCD polls on a schedule and also receives webhooks on git push.
|
||
|
||
### ArgoCD Image Updater → Gitea
|
||
|
||
```
|
||
Image Updater detects new tag in registry
|
||
→ commits updated annotation to Gitea repo
|
||
→ ArgoCD detects commit → re-syncs Deployment
|
||
```
|
||
|
||
Keeps image versions in Git without a human in the loop.
|
||
|
||
### Media stack
|
||
|
||
```
|
||
Prowlarr (indexer aggregator)
|
||
→ Sonarr / Radarr (request management)
|
||
→ download client + Gluetun sidecar (VPN-isolated)
|
||
→ Unpackarr (extract archives)
|
||
→ NFS share on aya01
|
||
→ Jellyfin (on docker-host11, CPU-only transcoding)
|
||
```
|
||
|
||
---
|
||
|
||
## Certificate management
|
||
|
||
Cert-Manager handles all TLS automatically via Let's Encrypt DNS-01 using the Cloudflare API. DNS-01 works for internal-only domains and wildcard certs without exposing any HTTP endpoint.
|
||
|
||
The edge VPS uses the Netcup DNS API for its own certs.
|
||
|
||
---
|
||
|
||
## Service mesh
|
||
|
||
Istio runs in Ambient mode — no sidecars. The `ztunnel` DaemonSet runs on every node and handles transparent L4 proxying for all pods in the mesh. Waypoint proxies (L7) are not yet deployed.
|