Skip to main content

​
Traffic Flow

No ports are exposed to the internet (the mail listeners are the sole exception — see Known Edges). All inbound HTTP goes through the Cloudflare tunnel. TLS is terminated at Cloudflare; everything behind the tunnel is plain HTTP.

​
DNS

Domain *.augustin.ai managed in Cloudflare. A wildcard CNAME points at the tunnel — no per-service DNS config needed.

​
Cloudflare Tunnel

cloudflared runs as a k3s Deployment in the mesh namespace (2 replicas). It connects outbound to Cloudflare and forwards traffic to the Envoy Gateway proxy. The origin is configured in the Cloudflare dashboard as http://192.168.1.16:8890 (pentium’s LAN IP), which reaches the Envoy proxy directly because the proxy binds that port on pentium via hostNetwork.

​
Routing — Gateway API + Envoy Gateway

The cluster’s public routing layer is the Kubernetes Gateway API, served by Envoy Gateway — the sole controller (Traefik has been fully removed; there are no classic Ingress objects left). Manifests: cluster/infra/envoy-gateway/ and cluster/infra/gateway-api/.
  • One shared Gateway web in ns envoy-gateway-system, HTTP-only, port 8890, allowedRoutes.namespaces.from: All.
  • Its managed proxy runs on pentium with hostNetwork: true (replacing Traefik’s old hostPort 8890).
  • Every service is exposed by an HTTPRoute in its own namespace, with parentRefs to the web Gateway and a hostname rule → its Service.

​
CNI / Inter-node Transport

The three nodes sit on one plain LAN. k3s’s default flannel CNI rides that LAN directly. There is no private mesh — the old Tailscale/Headscale overlay was deleted; nodes are always on the same physical network.

​
LAN

All three nodes are static (inet static in /etc/network/interfaces + a static ip_address= stanza in /etc/dhcpcd.conf; .bak-static-20260816 backups alongside). Node-level state, out of git. NICs: pentium/i3 enp2s0, i5 enp1s0. /etc/resolv.conf is now hand-written — nothing maintains it once DHCP is gone. A reservation alone was not enough: these addresses are load-bearing where nothing re-reads a lease — --node-ip, flannel’s public-ip, LiveKit’s node_ip, the tunnel origin — and a change silently partitions that node’s pods while it still reports Ready (i5, 2026-08-15). Keep the router reservations too, so the address is never handed elsewhere. dhcpcd runs as a long-lived daemon from networking.service, so editing interfaces(5) alone changes nothing live: pkill -x dhcpcd then ip addr change <addr> dev <nic> valid_lft forever preferred_lft forever.

​
SSH

  • Mac / remote → pentium via the Cloudflare tunnel: ssh ssh.augustin.ai (pentium is the SSH bastion).
  • pentium → i3: ssh i3 (works).
  • pentium → i5: ssh i5 (works; pentium’s key is in i5’s authorized_keys).

​
T3 Code relay

t3.augustin.ai reaches the laptop’s T3 Code listener without opening a LAN port on pentium. The laptop reverse-forwards 127.0.0.1:3773 into /home/user/.t3-relay/t3.sock; a pentium-pinned, cluster-only relay pod mounts that directory and exposes the socket to Envoy through a Kubernetes Service. Install the reconnecting macOS LaunchAgent:
The route is unavailable when T3 Code, the laptop, or its SSH session is down. Cloudflare Access certificate refresh can require an interactive ssh ssh.augustin.ai before launchd reconnects.

​
Known Edges

  • Mail is the open-ports exception. stalwart’s IMAPS/SMTPS/submission/managesieve ports are a NodePort on i3 (993→31028, 465→32267, 587→31303, 4190→32414) — k3s runs --disable servicelb, so there is no LoadBalancer controller. Mail needs real listeners; everything else stays behind the tunnel.