k8s-starter-pack/docs/network.md

# Network map

Every real IP address this cluster hands out, and exactly what's reachable
there. This file isn't a template with the rest of the repo — it's a log
of *your* actual setup, meant to be updated every time an address is
assigned or changed, so you (or Claude) never have to reverse-engineer
"wait, what's running on .241 again?" from `kubectl` output.

> **Keep this current.** If you're working with Claude and an IP changes —
> a new app gets a `LoadBalancer` address, the MetalLB pool is resized,
> Argo CD's address changes — ask it to update this file, or just point it
> here after any networking change. See `CLAUDE.md` for the standing
> instruction that tells Claude to do this on its own when it makes such a
> change itself.

## The five nodes and the VIP

None of these are from the MetalLB pool below — they're the machines
themselves and the shared address Talos elects between the three control-plane
nodes. Set in [`talos/README.md`](../talos/README.md); see
[`docs/02-talos-bootstrap.md`](02-talos-bootstrap.md) for what the VIP is
and why it's separate from any one node's address. Port 6443 is the Kubernetes
API on control-plane nodes; port 50000 is Talos's TLS-protected management API
on every node.

| Address | What | Port(s) | URL(s) |
|---|---|---|---|
| `10.10.10.200` | `talos-455-i3b` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.200:6443`, `https://10.10.10.200:50000` |
| `10.10.10.201` | `talos-9xy-iuk` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.201:6443`, `https://10.10.10.201:50000` |
| `10.10.10.202` | `talos-k1b-7j5` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.202:6443`, `https://10.10.10.202:50000` |
| `10.10.10.203` | `talos-rss-v5l` — worker01 (Proxmox VM on Gimli) | 50000 | `https://10.10.10.203:50000` |
| `10.10.10.204` | `talos-vba-ood` — worker02 (Proxmox VM on Titus) | 50000 | `https://10.10.10.204:50000` |
| `10.10.10.210` | Cluster VIP (use this one, not a node's own address) | 6443 | `https://10.10.10.210:6443` |

## NetBird overlay

These addresses exist only inside the private NetBird overlay and are subject
to NetBird access policies. All Talos nodes use the official
`siderolabs/netbird` system extension.

| Address | What | Port(s) | URL(s) |
|---|---|---|---|
| `100.71.24.9` | `prd-vps-hel-01` — external Grafana and VictoriaMetrics host; internal name `prd-vps-hel-01.ahmza.com` (authoritative zone in Technitium) | 3000, 8428 | `http://prd-vps-hel-01.ahmza.com:3000`, `http://prd-vps-hel-01.ahmza.com:8428` |
| `100.71.236.121` | `ingress1` — Caddy HTTP origin gateway used by NetBird Reverse Proxy; the WireGuard overlay encrypts this leg | 80 | `http://100.71.236.121` |
| `100.71.121.67` | `talos-455-i3b` — control plane NetBird address | 50000 | `https://100.71.121.67:50000` |
| `100.71.157.217` | `talos-9xy-iuk` — control plane NetBird address | 50000 | `https://100.71.157.217:50000` |
| `100.71.242.40` | `talos-k1b-7j5` — control plane NetBird address | 50000 | `https://100.71.242.40:50000` |
| `100.71.3.210` | `talos-rss-v5l` — worker01 NetBird address | 50000 | `https://100.71.3.210:50000` |
| `100.71.29.51` | `talos-vba-ood` — worker02 NetBird address | 50000 | `https://100.71.29.51:50000` |

## MetalLB pool

This dedicated service range is advertised to the MikroTik at
`10.10.10.1` with BGP by the two workers; it is not an L2 or DHCP pool.

| | |
|---|---|
| Range | `10.10.60.10-10.10.60.250` |
| Router / ASN | MikroTik RB5009 `10.10.10.1` / `64512` |
| Worker ASN | `64520` |
| Configured in | [`apps/metallb/templates/`](../apps/metallb/templates/) |

## Allocated addresses (from the MetalLB pool)

| Address | What | Namespace | Port(s) | URL | Source |
|---|---|---|---|---|---|
| `10.10.60.10` | Argo CD UI/API (`argocd-server`) | `argocd` | 443 | `https://10.10.60.10` | Patched to `LoadBalancer` by hand — see [`docs/05-metallb.md`](05-metallb.md) |
| `10.10.60.11` | Reserved for the Authentik LDAP Outpost used by Jellyfin | `authentik` | 636 | `ldaps://10.10.60.11:636` | Planned Authentik deployment; verify the address and TLS certificate before migrating Jellyfin |
| `10.10.60.12` | ingress-nginx (shared, routes by hostname) | `ingress-nginx` | 80, 443 | `http://10.10.60.12`, `https://10.10.60.12` | [`apps/ingress-nginx/values.yaml`](../apps/ingress-nginx/values.yaml) — see [`docs/11-ingress.md`](11-ingress.md) |

Add a row here every time you add a new app with its own dedicated
`LoadBalancer` Service (see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)).
Most apps should route through ingress-nginx by hostname instead — see the
table below — and only need a dedicated address if they can't speak HTTP
(a raw TCP service, for example). Leave the URL column's port number off
only when it's the protocol default (80 for `http://`, 443 for `https://`)
— include it otherwise.

## Hostnames routed through ingress-nginx

Every real hostname routed to ingress-nginx's shared address
(`10.10.60.12`), and which app it reaches. Public DNS is hosted on
Cloudflare; internal overrides are served by Technitium where noted.

| Hostname | App | Namespace | TLS | Source |
|---|---|---|---|---|
| `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
| `auth.ahmza.com` | Authentik identity provider | `authentik` | Yes — `letsencrypt-prod`, trusted certificate and browser login verified; Technitium routes LAN clients to `10.10.60.12`. For public traffic, NetBird terminates public TLS and proxies HTTP through its encrypted WireGuard overlay to Caddy on `ingress1`; Caddy then uses certificate-validated HTTPS with `auth.ahmza.com` as SNI and the HTTP `Host` when connecting to ingress-nginx at `10.10.60.12:443` | [`apps/authentik/values.yaml`](../apps/authentik/values.yaml) |
| `blog.ahmza.com` | Hugo blog | `blog-ahmza-com` | Yes — `letsencrypt-prod`, certificate Ready. LAN DNS resolves to `10.10.60.12`; internal ingress and the public NetBird entry `72.62.6.42` both return HTTPS 200 with valid certificates and matching homepage content. Caddy on `ingress1` forwards to `10.10.60.12:443` with the blog hostname preserved for Host/SNI | [`apps/blog-ahmza-com/ingress.yaml`](../apps/blog-ahmza-com/ingress.yaml) |
| `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
| `bazarr.ahmza.com` | Bazarr subtitle manager | `bazarr` | Yes — `letsencrypt-prod`, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN | [`apps/bazarr/ingress.yaml`](../apps/bazarr/ingress.yaml) |
| `prowlarr.ahmza.com` | Prowlarr indexer manager | `prowlarr` | Configured for `letsencrypt-prod`; DNS and the certificate must be verified after the first deployment | [`apps/prowlarr/ingress.yaml`](../apps/prowlarr/ingress.yaml) |
| `qbittorrent.ahmza.com` | qBittorrent download client (outbound traffic through Proton VPN) | `qbittorrent` | Configured for `letsencrypt-prod`; DNS, certificate, and VPN health must be verified after the first deployment | [`apps/qbittorrent/ingress.yaml`](../apps/qbittorrent/ingress.yaml) |
| `radarr.ahmza.com` | Radarr movie manager | `radarr` | Yes — `letsencrypt-prod`, certificate Ready; LAN DNS resolves to `10.10.60.12` | [`apps/radarr/ingress.yaml`](../apps/radarr/ingress.yaml) |
| `sonarr.ahmza.com` | Sonarr TV manager | `sonarr` | Yes — `letsencrypt-prod`, certificate Ready; LAN DNS resolves to `10.10.60.12` | [`apps/sonarr/ingress.yaml`](../apps/sonarr/ingress.yaml) |
| `soulsync.ahmza.com` | SoulSync media discovery | `soulsync` | Configured for `letsencrypt-prod`; verify the certificate after the first deployment; Technitium routes LAN clients to `10.10.60.12` | [`apps/soulsync/ingress.yaml`](../apps/soulsync/ingress.yaml) |

Add a row here every time you point a new hostname at this cluster (see
[`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in
Cloudflare, not in this repo — this table is just the log of what's real.

## Free in the pool

Addresses from the range above that aren't spoken for yet. Update this
alongside the table above so it's obvious at a glance what's safe to hand
to the next app.

- `10.10.60.13-10.10.60.250`

(`whoami`'s former `10.10.60.12` was reclaimed here after that app was
removed as the docs/08 exercise — it now belongs to ingress-nginx instead.
`demo`'s former `10.10.60.11` was reclaimed the same way after that app
moved to routing through ingress-nginx by hostname instead — see
docs/11-ingress.md.)