65 lines
3.3 KiB
Markdown
65 lines
3.3 KiB
Markdown
|
# Networking
|
|||
|
|
|
|||
|
|
The Nest's networking stack handles external ingress (from the internet), internal routing (between services), and load balancing for services that require public IP addresses.
|
|||
|
|
|
|||
|
|
## External Ingress: HAProxy on pfSense
|
|||
|
|
|
|||
|
|
All traffic from the internet enters through an [HAProxy](https://www.haproxy.org/) instance running on the pfSense router. HAProxy performs:
|
|||
|
|
|
|||
|
|
- **TLS termination** — Handles SSL certificates for all `*.mynest.love` domains
|
|||
|
|
- **Hostname-based routing** — Forwards requests to the appropriate internal service based on the `Host` header
|
|||
|
|
- **Health checks** — Monitors backend availability and fails over if a node is down
|
|||
|
|
|
|||
|
|
HAProxy routes traffic to MetalLB-assigned IPs within the cluster, which then forward to Traefik ingress controllers.
|
|||
|
|
|
|||
|
|
## Internal Ingress: Traefik
|
|||
|
|
|
|||
|
|
[Traefik](https://traefik.io/) is the Kubernetes-native ingress controller. It receives traffic from HAProxy and routes it to the correct service based on:
|
|||
|
|
|
|||
|
|
- **Host headers** (e.g., `beak.mynest.love` → Jellyfin)
|
|||
|
|
- **Path prefixes** (e.g., `/_matrix/...` → Synapse, `/sfu/get` → LiveKit JWT service)
|
|||
|
|
- **Middleware annotations** for headers, redirects, and TLS enforcement
|
|||
|
|
|
|||
|
|
Traefik is configured via Kubernetes CRDs (`Ingress`, `Middleware`) defined in YAML files under `services/*/`.
|
|||
|
|
|
|||
|
|
## Load Balancing: MetalLB
|
|||
|
|
|
|||
|
|
[MetalLB](https://metallb.io/) provides Layer 2 load balancing for services that need a public IP (e.g., Matrix LiveKit's UDP ports, Forgejo SSH).
|
|||
|
|
|
|||
|
|
### Configuration
|
|||
|
|
|
|||
|
|
- **IP Pool:** `192.168.1.150`–`192.168.1.200` (defined in `metallb/metallb.yaml`)
|
|||
|
|
- **Advertisement Protocol:** L2 (ARP) — suitable for home networks without BGP support
|
|||
|
|
|
|||
|
|
### Services Using MetalLB
|
|||
|
|
|
|||
|
|
| Service | IP Assignment | Purpose |
|
|||
|
|
|---------|--------------|---------|
|
|||
|
|
| LiveKit (Matrix RTC) | `192.168.1.160` | WebRTC media relay (UDP/TCP) |
|
|||
|
|
| Forgejo SSH | Load-balanced | Git over SSH (port 22) |
|
|||
|
|
|
|||
|
|
## DNS & Hostname Resolution
|
|||
|
|
|
|||
|
|
- **External:** The `*.mynest.love` domain points to the pfSense router's public IP. HAProxy handles virtual hosting.
|
|||
|
|
- **Internal:** Services resolve via Kubernetes DNS (`<service>.<namespace>.svc.cluster.local`). External hostnames (e.g., `robin.home.nest`) are resolved via the home network's DNS server.
|
|||
|
|
|
|||
|
|
## TLS & Certificates
|
|||
|
|
|
|||
|
|
All external-facing services use TLS certificates issued by [Let's Encrypt](https://letsencrypt.org/) via cert-manager:
|
|||
|
|
|
|||
|
|
- **Cluster Issuer:** `letsencrypt-prod` (defined in `cert-manager/letsencrypt-cluster-issuer.yaml`)
|
|||
|
|
- **Challenge Type:** HTTP-01 (validated through Traefik)
|
|||
|
|
- **Auto-renewal:** Handled automatically by cert-manager 30 days before expiry
|
|||
|
|
|
|||
|
|
Internal-only services (e.g., `*.k3s.home.nest`) may use self-signed certificates or no TLS, depending on the service configuration.
|
|||
|
|
|
|||
|
|
## Network Policies
|
|||
|
|
|
|||
|
|
The cluster does not enforce strict network policies between namespaces by default. Services communicate freely within the cluster via Kubernetes DNS and ClusterIP services. For enhanced security, consider implementing [Kubernetes NetworkPolicies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) in future iterations.
|
|||
|
|
|
|||
|
|
## Related Documentation
|
|||
|
|
|
|||
|
|
- [MetalLB](metallb.md) — Detailed MetalLB configuration
|
|||
|
|
- [Security & Identity](security-and-identity.md) — TLS termination and authentication flow
|
|||
|
|
- [Architecture Overview](architecture-overview.md) — High-level data flow
|