k8s-starter-pack/docs/network.md

Network map

Every real IP address this cluster hands out, and exactly what's reachable there. This file isn't a template with the rest of the repo — it's a log of your actual setup, meant to be updated every time an address is assigned or changed, so you (or Claude) never have to reverse-engineer "wait, what's running on .241 again?" from kubectl output.

Keep this current. If you're working with Claude and an IP changes — a new app gets a LoadBalancer address, the MetalLB pool is resized, Argo CD's address changes — ask it to update this file, or just point it here after any networking change. See CLAUDE.md for the standing instruction that tells Claude to do this on its own when it makes such a change itself.

The five nodes and the VIP

None of these are from the MetalLB pool below — they're the machines themselves and the shared address Talos elects between the three control-plane nodes. Set in talos/README.md; see docs/02-talos-bootstrap.md for what the VIP is and why it's separate from any one node's address. Port 6443 is the Kubernetes API on control-plane nodes; port 50000 is Talos's TLS-protected management API on every node.

Address	What	Port(s)	URL(s)
10.10.10.200	talos-455-i3b — control plane (Raspberry Pi 4)	6443, 50000	https://10.10.10.200:6443, https://10.10.10.200:50000
10.10.10.201	talos-9xy-iuk — control plane (Raspberry Pi 4)	6443, 50000	https://10.10.10.201:6443, https://10.10.10.201:50000
10.10.10.202	talos-k1b-7j5 — control plane (Raspberry Pi 4)	6443, 50000	https://10.10.10.202:6443, https://10.10.10.202:50000
10.10.10.203	talos-rss-v5l — worker01 (Proxmox VM on Gimli)	50000	https://10.10.10.203:50000
10.10.10.204	talos-vba-ood — worker02 (Proxmox VM on Titus)	50000	https://10.10.10.204:50000
10.10.10.210	Cluster VIP (use this one, not a node's own address)	6443	https://10.10.10.210:6443

MetalLB pool

This dedicated service range is advertised to the MikroTik at 10.10.10.1 with BGP by the two workers; it is not an L2 or DHCP pool.

Range	10.10.60.10-10.10.60.250
Router / ASN	MikroTik RB5009 10.10.10.1 / 64512
Worker ASN	64520
Configured in	apps/metallb/templates/

Allocated addresses (from the MetalLB pool)

Address	What	Namespace	Port(s)	URL	Source
10.10.60.10	Argo CD UI/API (argocd-server)	argocd	443	https://10.10.60.10	Patched to LoadBalancer by hand — see docs/05-metallb.md
10.10.60.12	ingress-nginx (shared, routes by hostname)	ingress-nginx	80, 443	http://10.10.60.12, https://10.10.60.12	apps/ingress-nginx/values.yaml — see docs/11-ingress.md

Add a row here every time you add a new app with its own dedicated LoadBalancer Service (see docs/08-adding-new-apps.md). Most apps should route through ingress-nginx by hostname instead — see the table below — and only need a dedicated address if they can't speak HTTP (a raw TCP service, for example). Leave the URL column's port number off only when it's the protocol default (80 for http://, 443 for https://) — include it otherwise.

Hostnames routed through ingress-nginx

Every real hostname routed to ingress-nginx's shared address (10.10.60.12), and which app it reaches. Public DNS is hosted on Cloudflare; internal overrides are served by Technitium where noted.

Hostname	App	Namespace	TLS	Source
demo.ahmza.com	Demo app	demo	Yes — letsencrypt-prod, real trusted cert (see docs/12-cert-manager.md)	apps/demo/ingress.yaml
mc.ahmza.com	Packwiz modpack files	mcpacks	Yes — letsencrypt-prod, real trusted certificate	apps/mcpacks/ingress.yaml
bazarr.ahmza.com	Bazarr subtitle manager	bazarr	Yes — letsencrypt-prod, real trusted certificate; Technitium overrides Cloudflare's NetBird route on the LAN	apps/bazarr/ingress.yaml
soulsync.ahmza.com	SoulSync media discovery	soulsync	Configured for letsencrypt-prod; verify the certificate after the first deployment; Technitium routes LAN clients to 10.10.60.12	apps/soulsync/ingress.yaml

Add a row here every time you point a new hostname at this cluster (see docs/11-ingress.md). The DNS record itself lives in Cloudflare, not in this repo — this table is just the log of what's real.

Free in the pool

Addresses from the range above that aren't spoken for yet. Update this alongside the table above so it's obvious at a glance what's safe to hand to the next app.

• 10.10.60.11, 10.10.60.13-10.10.60.250

(whoami's former 10.10.60.12 was reclaimed here after that app was removed as the docs/08 exercise — it now belongs to ingress-nginx instead. demo's former 10.10.60.11 was reclaimed the same way after that app moved to routing through ingress-nginx by hostname instead — see docs/11-ingress.md.)