vps-k8s/docs/network.md

Network map

Every real IP address this cluster hands out, and exactly what's reachable there. This file isn't a template with the rest of the repo — it's a log of your actual setup, meant to be updated every time an address is assigned or changed, so you (or Claude) never have to reverse-engineer "wait, what's running on .241 again?" from kubectl output.

Keep this current. If you're working with Claude and an IP changes — a new app gets a LoadBalancer address, the MetalLB pool is resized, Argo CD's address changes — ask it to update this file, or just point it here after any networking change. See CLAUDE.md for the standing instruction that tells Claude to do this on its own when it makes such a change itself.

Current deployment: single Hetzner VPS

This deployment uses one VPS rather than the three-node LAN layout below. Kubernetes management is intended to be reachable only through NetBird. The VPS is connected to the self-hosted NetBird service at https://netbird.ahmza.com, with peer address 100.71.84.31. Authenticated Talos API access over this private address is verified.

Address	What	Port	URL	Status
128.140.91.209	Talos management API (former public bootstrap access)	TCP 50000	tls://128.140.91.209:50000	Public firewall exception removed by administrator; use NetBird instead
100.71.84.31	Private Talos management API over NetBird	TCP 50000	tls://100.71.84.31:50000	Authenticated access verified from the administrator's devbox
100.71.84.31	Private Kubernetes API over NetBird	TCP 6443	https://100.71.84.31:6443	Authenticated kubectl access verified

The tls:// URL identifies a TLS-encrypted API connection, not a browser page. Public management ports 50000 and 6443 are intended to remain blocked by the Hetzner firewall. The administrator reports removing the public bootstrap exception; private Kubernetes access remained functional afterward. The Kubernetes API endpoint is https://100.71.84.31:6443, with the NetBird address included in its certificate configuration. Authenticated access from the administrator's devbox is verified, and Kubernetes is bootstrapped. Node prd-vps-fsn-01 has registered and reports 10.0.0.3 as its Kubernetes Internal-IP; direct management access on that address has not been tested. The three-node and MetalLB sections below are unused template references, not the current deployment.

The three nodes and the VIP

None of these are from the MetalLB pool below — they're the machines themselves and the shared address Talos elects between them. Set in talos/README.md; see docs/02-talos-bootstrap.md for what the VIP is and why it's separate from any one node's address.

Address	What	Port	URL
EDIT ME	Node 1	6443	https://EDIT ME:6443
EDIT ME	Node 2	6443	https://EDIT ME:6443
EDIT ME	Node 3	6443	https://EDIT ME:6443
EDIT ME	Cluster VIP (use this one, not a node's own address)	6443	https://EDIT ME:6443

MetalLB pool

Range	EDIT ME — e.g. 192.168.1.240-192.168.1.250
Configured in	apps/metallb/templates/ipaddresspool.yaml

Allocated addresses (from the MetalLB pool)

Address	What	Namespace	Port(s)	URL	Source
EDIT ME	Argo CD UI/API (argocd-server)	argocd	443	https://EDIT ME	Patched to LoadBalancer by hand — see docs/05-metallb.md
EDIT ME	Demo app	demo	80	http://EDIT ME	apps/demo/service.yaml

Add a row here every time you add a new app with a LoadBalancer Service (see docs/08-adding-new-apps.md). Leave the URL column's port number off only when it's the protocol default (80 for http://, 443 for https://) — include it otherwise.

Free in the pool

Addresses from the range above that aren't spoken for yet. Update this alongside the table above so it's obvious at a glance what's safe to hand to the next app.

• EDIT ME