basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Update NETWORK_ARCHITECTURE.md to reflect Hetzner Load Balancer setup

Browse source 
- Add Hetzner Load Balancer (138.199.128.63) to network architecture diagram
- Update DNS configuration to show all domains pointing to Hetzner LB IP
- Update HTTP/HTTPS traffic flow to show traffic routing through Hetzner LB
- Update last modified date to 2026-08-02

Related to DEV-439.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-08-02 11:41:36 +00:00
parent fd0b589c10
commit 129496d78d
1 changed files with 26 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
infrastructure/networking/NETWORK_ARCHITECTURE.md
View file

@ -1,6 +1,6 @@
# BasicStack k3s Cluster Network Architecture # BasicStack k3s Cluster Network Architecture
**Last Updated:** 2026-07-06 **Last Updated:** 2026-08-02
**Cluster Version:** k3s v1.36.2+k3s1 **Cluster Version:** k3s v1.36.2+k3s1
## Overview ## Overview
@ -15,9 +15,16 @@ This document provides comprehensive documentation of the network configuration
┌──────────┴──────────┐ ┌──────────┴──────────┐
│ DNS (basicstack.de) │ │ DNS (basicstack.de) │
│ *.basicstack.de │ │ *.basicstack.de │
│ → 138.199.128.63 │
└──────────┬──────────┘ └──────────┬──────────┘
| |
┌─────────────────┴─────────────────┐ ┌─────────────────┴─────────────────┐
│ Hetzner Load Balancer │
│ IP: 138.199.128.63 │
│ Targets: k3s-cp-1 + workers 1-5 │
└─────────────────┬─────────────────┘
|
┌─────────────────┴─────────────────┐
│ Hetzner Cloud (fw-k3s) │ │ Hetzner Cloud (fw-k3s) │
│ Firewall: Port 80, 443, 25, │ │ Firewall: Port 80, 443, 25, │
│ 587, 465, 143, 993 │ │ 587, 465, 143, 993 │
@ -261,23 +268,26 @@ Ports:
#### Required DNS Records #### Required DNS Records
**A Records (HTTP/HTTPS Services):** **A Records (HTTP/HTTPS Services):**
All HTTPS services point to LoadBalancer IPs. Since we use multiple LoadBalancer IPs, DNS should point to the most stable/accessible IPs: All services point to the Hetzner Load Balancer IP address.
- Recommended: Point to worker node private IPs (10.42.1.2, 10.42.1.3, 10.42.1.5) OR **Current Configuration:**
- Alternative: Point to control-plane public IP (178.105.17.239) All domains and subdomains point to: **138.199.128.63** (Hetzner Load Balancer)
**Wildcard Option:** **Wildcard Option:**
``` ```
*.basicstack.de → 178.105.17.239 (or round-robin to worker IPs) *.basicstack.de → 138.199.128.63
``` ```
**Specific Records:** **Specific Records:**
``` ```
basicstack.org → 178.105.17.239 basicstack.org → 138.199.128.63
www.basicstack.org → 178.105.17.239 www.basicstack.org → 138.199.128.63
paperclip.basicstack.de → 178.105.17.239 paperclip.basicstack.de → 138.199.128.63
mail.basicstack.de → 178.105.17.239 mail.basicstack.de → 138.199.128.63
auth.basicstack.de → 178.105.17.239 auth.basicstack.de → 138.199.128.63
forgejo.basicstack.de → 138.199.128.63
directus.basicstack.de → 138.199.128.63
books.basicstack.de → 138.199.128.63
(etc. for all services) (etc. for all services)
``` ```
@ -424,9 +434,12 @@ Database and cache services (PostgreSQL, Redis) have restrictive policies that o
### Ingress Traffic (HTTP/HTTPS) ### Ingress Traffic (HTTP/HTTPS)
``` ```
Internet → DNS → Hetzner Firewall (fw-k3s) Internet → DNS (→ 138.199.128.63)
→ LoadBalancer IP (any worker node) → Hetzner Load Balancer
→ Traefik Ingress Controller (Pod on control-plane) → k3s Node (k3s-cp-1 or k3s-worker-1 through k3s-worker-5)
→ Hetzner Firewall (fw-k3s)
→ NodePort (auto-assigned by k3s ServiceLB)
→ Traefik Ingress Controller
→ Backend Service (ClusterIP) → Backend Service (ClusterIP)
→ Application Pods → Application Pods
``` ```