Skip to content

Network truth — sites, VLANs, tunnel, DNS

Sites

Two sites, symmetric VLAN naming with 2nd-octet convention .1 = home, .2 = office.

Site WAN Default (user) LAN Infra Mgmt K8s-Nodes K8s-Services
home 79.227.94.24 192.168.1.0/24 10.1.1.0/24 10.1.0.0/24 10.1.10.0/24 10.1.20.0/24 10.1.30.0/24
office 80.152.169.202 192.168.2.0/24 — 10.2.0.0/24 10.2.10.0/24 10.2.20.0/24 10.2.30.0/24

Plus IoT VLAN 40 and Guest VLAN 50 per site (not used by k8s; not in the site-to-site tunnel — isolated).

Overlays: Pod CIDR 10.244.0.0/16, Service CIDR 10.96.0.0/12.

Site-to-site tunnel

  • Always up at the firewall level (verified via Unifi Site Manager).
  • UniFi gateway-to-gateway tunnel (Site Magic) between the home and office UDMs. Not IPsec; no IPsec daemon anywhere. Not yet in GitOps — Phase 9 adds terraform/unifi/.
  • Latency: normally ~150-200ms RTT, sometimes high-jitter / slow under load. etcd is tuned for this (heartbeat-interval=1000ms, election-timeout=10000ms).
  • Gateways route all VLANs freely between sites except wlan-iot and wlan-guest.

Never invent a firewall ACL to "fix" reachability — if a workstation can't reach a cluster IP, the cause is local (see workstation.md §Troubleshooting).

Kubernetes API endpoints

Endpoint Path Consumers
10.1.20.10:6443 kube-vip ARP-announced home-site kubectl + intra-cluster
10.2.20.10:6443 kube-vip ARP-announced office-site kubectl + intra-cluster
api.cauda.dev → 10.106.124.25 in-cluster CoreDNS only pods
k8s.infra.cauda.dev cloudflared TCP tunnel → 10.2.20.200:6443 public / any-VLAN workstation / Nautik iOS

Phase 5 (dual cloudflared) adds k8s-home.infra.cauda.dev + k8s-office.infra.cauda.dev as per-site fallbacks.

Cluster gateway VIPs

Site Pool name CIDR Gateway CR Announcer
home home-pool 10.1.30.10–.250 main-home (10.1.30.10), main (10.1.30.12, primary cloudflared origin), private-home (10.1.30.13, LAN-only APIs) home worker nodes only
office office-pool 10.2.30.10–.250 main-office (10.2.30.10), private-office (10.2.30.12, LAN-only APIs) office worker nodes only

Files: cluster/cilium-lb/, cluster/gateway/.

DNS

In-cluster CoreDNS (cluster/coredns/) — pods only:

  • *.cauda.dev → A 10.106.124.25 (Cilium Gateway ClusterIP) via template plugin.
  • AAAA blocked for cauda.dev until IPv6 rollout (Phase 7).
  • Upstreams: 1.1.1.1, 8.8.8.8.

LAN split-DNS (cluster/coredns-lan/) — one instance per site, consumed by the Unifi firewalls:

  • home: LB IP 10.1.30.11 → *.cauda.dev = 10.1.30.10
  • office: LB IP 10.2.30.11 → *.cauda.dev = 10.2.30.10
  • exact sabnzbd-api.media.cauda.dev override: home 10.1.30.13, office 10.2.30.12; these dedicated Gateways are not cloudflared origins.

Strict separation: cluster CoreDNS must not forward to LAN CoreDNS. Mixing them caused the sabnzbd "Server name does not resolve" regression (BUG-04).

Cloudflare

Known gaps

  • Unifi config (VLANs, firewall rules, site-to-site tunnel, BGP) not in GitOps. Phase 9 adds terraform/unifi/ via the paultyng/unifi provider.
  • Cloudflared: hand-built single tunnel → Phase 5 dual automated.
  • IPv6: fully disabled in cluster → Phase 7 after Cilium 1.20.