From 65c0c8e53f356413bc20f3076aed8ff5bfdb984f Mon Sep 17 00:00:00 2001 From: ahmza Date: Wed, 28 Oct 2026 12:59:24 +0000 Subject: [PATCH] updated network --- docs/network.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/network.md b/docs/network.md index 1e18670..b069b63 100644 --- a/docs/network.md +++ b/docs/network.md @@ -13,6 +13,32 @@ assigned or changed, so you (or Claude) never have to reverse-engineer > instruction that tells Claude to do this on its own when it makes such a > change itself. +## Current deployment: single Hetzner VPS + +This deployment uses one VPS rather than the three-node LAN layout below. +Kubernetes management is intended to be reachable only through NetBird. +The VPS is connected to the self-hosted NetBird service at +`https://netbird.ahmza.com`, with peer address `100.71.84.31`. +Authenticated Talos API access over this private address is verified. + +| Address | What | Port | URL | Status | +|---|---|---|---|---| +| `128.140.91.209` | Talos management API (former public bootstrap access) | TCP 50000 | `tls://128.140.91.209:50000` | Public firewall exception removed by administrator; use NetBird instead | +| `100.71.84.31` | Private Talos management API over NetBird | TCP 50000 | `tls://100.71.84.31:50000` | Authenticated access verified from the administrator's devbox | +| `100.71.84.31` | Private Kubernetes API over NetBird | TCP 6443 | `https://100.71.84.31:6443` | Authenticated kubectl access verified | + +The `tls://` URL identifies a TLS-encrypted API connection, not a browser +page. Public management ports 50000 and 6443 are intended to remain blocked +by the Hetzner firewall. The administrator reports removing the public +bootstrap exception; private Kubernetes access remained functional afterward. +The Kubernetes API endpoint is `https://100.71.84.31:6443`, with the NetBird +address included in its certificate configuration. Authenticated access +from the administrator's devbox is verified, and Kubernetes is bootstrapped. +Node `prd-vps-fsn-01` has registered and reports `10.0.0.3` as its Kubernetes +Internal-IP; direct management access on that address has not been tested. +The three-node and MetalLB sections below are unused template references, +not the current deployment. + ## The three nodes and the VIP None of these are from the MetalLB pool below — they're the machines