basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Update NETWORK_ARCHITECTURE.md to reflect Hetzner Load Balancer setup

Browse source 
- Add Hetzner Load Balancer (138.199.128.63) to network architecture diagram
- Update DNS configuration to show all domains pointing to Hetzner LB IP
- Update HTTP/HTTPS traffic flow to show traffic routing through Hetzner LB
- Update last modified date to 2026-08-02

Related to DEV-439.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-08-02 11:41:36 +00:00
parent fd0b589c10
commit 129496d78d
1 changed files with 26 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
infrastructure/networking/NETWORK_ARCHITECTURE.md
View file

@ -1,6 +1,6 @@
# BasicStack k3s Cluster Network Architecture
**Last Updated:** 2026-07-06
**Last Updated:** 2026-08-02
**Cluster Version:** k3s v1.36.2+k3s1
## Overview
@ -15,9 +15,16 @@ This document provides comprehensive documentation of the network configuration
┌──────────┴──────────┐
│ DNS (basicstack.de) │
│ *.basicstack.de │
│ → 138.199.128.63 │
└──────────┬──────────┘
|
┌─────────────────┴─────────────────┐
│ Hetzner Load Balancer │
│ IP: 138.199.128.63 │
│ Targets: k3s-cp-1 + workers 1-5 │
└─────────────────┬─────────────────┘
|
┌─────────────────┴─────────────────┐
│ Hetzner Cloud (fw-k3s) │
│ Firewall: Port 80, 443, 25, │
│ 587, 465, 143, 993 │
@ -261,23 +268,26 @@ Ports:
#### Required DNS Records
**A Records (HTTP/HTTPS Services):**
All HTTPS services point to LoadBalancer IPs. Since we use multiple LoadBalancer IPs, DNS should point to the most stable/accessible IPs:
All services point to the Hetzner Load Balancer IP address.
- Recommended: Point to worker node private IPs (10.42.1.2, 10.42.1.3, 10.42.1.5) OR
- Alternative: Point to control-plane public IP (178.105.17.239)
**Current Configuration:**
All domains and subdomains point to: **138.199.128.63** (Hetzner Load Balancer)
**Wildcard Option:**
```
*.basicstack.de → 178.105.17.239 (or round-robin to worker IPs)
*.basicstack.de → 138.199.128.63
```
**Specific Records:**
```
basicstack.org → 178.105.17.239
www.basicstack.org → 178.105.17.239
paperclip.basicstack.de → 178.105.17.239
mail.basicstack.de → 178.105.17.239
auth.basicstack.de → 178.105.17.239
basicstack.org → 138.199.128.63
www.basicstack.org → 138.199.128.63
paperclip.basicstack.de → 138.199.128.63
mail.basicstack.de → 138.199.128.63
auth.basicstack.de → 138.199.128.63
forgejo.basicstack.de → 138.199.128.63
directus.basicstack.de → 138.199.128.63
books.basicstack.de → 138.199.128.63
(etc. for all services)
```
@ -424,9 +434,12 @@ Database and cache services (PostgreSQL, Redis) have restrictive policies that o
### Ingress Traffic (HTTP/HTTPS)
```
Internet → DNS → Hetzner Firewall (fw-k3s)
→ LoadBalancer IP (any worker node)
→ Traefik Ingress Controller (Pod on control-plane)
Internet → DNS (→ 138.199.128.63)
→ Hetzner Load Balancer
→ k3s Node (k3s-cp-1 or k3s-worker-1 through k3s-worker-5)
→ Hetzner Firewall (fw-k3s)
→ NodePort (auto-assigned by k3s ServiceLB)
→ Traefik Ingress Controller
→ Backend Service (ClusterIP)
→ Application Pods
```