# Network map

Every real IP address this cluster hands out, and exactly what's reachable
there. This file isn't a template with the rest of the repo — it's a log
of *your* actual setup, meant to be updated every time an address is
assigned or changed, so you (or Claude) never have to reverse-engineer
"wait, what's running on .241 again?" from `kubectl` output.

> **Keep this current.** If you're working with Claude and an IP changes —
> a new app gets a `LoadBalancer` address, the MetalLB pool is resized,
> Argo CD's address changes — ask it to update this file, or just point it
> here after any networking change. See `CLAUDE.md` for the standing
> instruction that tells Claude to do this on its own when it makes such a
> change itself.

## Current deployment: single Hetzner VPS

This deployment uses one VPS rather than the three-node LAN layout below.
Kubernetes management is intended to be reachable only through NetBird.
The VPS is connected to the self-hosted NetBird service at
`https://netbird.ahmza.com`, with peer address `100.71.84.31`.
Authenticated Talos API access over this private address is verified.

| Address | What | Port | URL | Status |
|---|---|---|---|---|
| `128.140.91.209` | Talos management API (former public bootstrap access) | TCP 50000 | `tls://128.140.91.209:50000` | Public firewall exception removed by administrator; use NetBird instead |
| `100.71.84.31` | Private Talos management API over NetBird | TCP 50000 | `tls://100.71.84.31:50000` | Authenticated access verified from the administrator's devbox |
| `100.71.84.31` | Private Kubernetes API over NetBird | TCP 6443 | `https://100.71.84.31:6443` | Authenticated kubectl access verified |

The `tls://` URL identifies a TLS-encrypted API connection, not a browser
page. Public management ports 50000 and 6443 are intended to remain blocked
by the Hetzner firewall. The administrator reports removing the public
bootstrap exception; private Kubernetes access remained functional afterward.
The Kubernetes API endpoint is `https://100.71.84.31:6443`, with the NetBird
address included in its certificate configuration. Authenticated access
from the administrator's devbox is verified, and Kubernetes is bootstrapped.
Node `prd-vps-fsn-01` has registered and reports `10.0.0.3` as its Kubernetes
Internal-IP; direct management access on that address has not been tested.
The three-node and MetalLB sections below are unused template references,
not the current deployment.

## The three nodes and the VIP

None of these are from the MetalLB pool below — they're the machines
themselves and the shared address Talos elects between them. Set in
[`talos/README.md`](../talos/README.md); see
[`docs/02-talos-bootstrap.md`](02-talos-bootstrap.md) for what the VIP is
and why it's separate from any one node's address.

| Address | What | Port | URL |
|---|---|---|---|
| `EDIT ME` | Node 1 | 6443 | `https://EDIT ME:6443` |
| `EDIT ME` | Node 2 | 6443 | `https://EDIT ME:6443` |
| `EDIT ME` | Node 3 | 6443 | `https://EDIT ME:6443` |
| `EDIT ME` | Cluster VIP (use this one, not a node's own address) | 6443 | `https://EDIT ME:6443` |

## MetalLB pool

| | |
|---|---|
| Range | `EDIT ME — e.g. 192.168.1.240-192.168.1.250` |
| Configured in | [`apps/metallb/templates/ipaddresspool.yaml`](../apps/metallb/templates/ipaddresspool.yaml) |

## Allocated addresses (from the MetalLB pool)

| Address | What | Namespace | Port(s) | URL | Source |
|---|---|---|---|---|---|
| `EDIT ME` | Argo CD UI/API (`argocd-server`) | `argocd` | 443 | `https://EDIT ME` | Patched to `LoadBalancer` by hand — see [`docs/05-metallb.md`](05-metallb.md) |
| `EDIT ME` | Demo app | `demo` | 80 | `http://EDIT ME` | [`apps/demo/service.yaml`](../apps/demo/service.yaml) |

Add a row here every time you add a new app with a `LoadBalancer` Service
(see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)). Leave the URL
column's port number off only when it's the protocol default (80 for
`http://`, 443 for `https://`) — include it otherwise.

## Free in the pool

Addresses from the range above that aren't spoken for yet. Update this
alongside the table above so it's obvious at a glance what's safe to hand
to the next app.

- `EDIT ME`