From 56442ecfbcefff9388efaedbd42f649a0362a491 Mon Sep 17 00:00:00 2001 From: Claude Code Date: Sat, 4 Apr 2026 19:29:28 -0500 Subject: [PATCH] Replace nginx+ConfigMap intranet with Blazor Server app Replaces the 188KB ConfigMap-embedded HTML with a proper Blazor Server deployment (fc-intranet-web:latest on port 5300). The old nginx deployment, ConfigMaps (intranet-html, intranet-nginx-conf), and all embedded HTML are removed. The intranet is now a .NET 10 Blazor app with live health monitoring, REST API, 49 pages, and the unified Blue Jay theme. Source: github.com/astoltz/FlowerCore.Intranet.Web --- apps/intranet/intranet.yaml | 156 ++++++++++++------------------------ 1 file changed, 53 insertions(+), 103 deletions(-) diff --git a/apps/intranet/intranet.yaml b/apps/intranet/intranet.yaml index 0bf1dd6..d712606 100644 --- a/apps/intranet/intranet.yaml +++ b/apps/intranet/intranet.yaml @@ -5,136 +5,86 @@ metadata: app.kubernetes.io/part-of: bluejay-infra name: intranet --- -apiVersion: v1 -data: - default.conf: "server {\n listen 80;\n server_name _;\n root /usr/share/nginx/html;\n index index.html;\n\n location / {\n try_files $uri $uri/ =404;\n }\n\n location /healthz {\n access_log off;\n return 200 \"ok\";\n add_header Content-Type text/plain;\n }\n}\n" -kind: ConfigMap -metadata: - name: intranet-nginx-conf - namespace: intranet ---- -apiVersion: v1 -data: - index.html: "\n\n\n\n\nBlue Jay Lab Intranet - FlowerCore\n\n\n\n\n
\n \n

Blue Jay Lab Intranet

\n

BlueJay Network Infrastructure — 13 VLANs | 10 Physical Nodes | RKE2 Bare-Metal Cluster | 4 WiFi SSIDs | 18 Domains | 22 ArgoCD Apps | 41 Namespaces | NAS Storage | 4 Pi Devices | 21,437+ Tests

\n

Last updated: 2026-03-31 — BLUEJAY-WS openSUSE Leap 16 workstation live (Agent Zero GPU + Traefik + 14 Ollama models). SSH keys rotated across 8 nodes, 1Password Connect rebuilt. Print.Web +33 tests (CUPS, red stripe). Barcode lookup timeouts (10s/15s). Post-install scripts updated (openSUSE + Windows).

\n
Network Rebuild 100% Complete — /28 Fully Live — 22 ArgoCD Apps — 4 Pi Fleet Nodes — 21,437+ Tests Across 13 Services
\n
\n\n\n\n\n
\n

Overview

\n
\n
13
VLANs
\n
9
Physical Nodes
\n
3
RKE2 Nodes
\n
22
ArgoCD Apps
\n
13
Zabbix Hosts
\n
4
Pi Devices
\n
4
WiFi SSIDs
\n
9
VPN Servers
\n\ - \
13
Public IPs
\n
18
Domains
\n
14
Guac Connections
\n
9.1 TB
NAS Storage
\n
\n\n
Network Status: ALL PHASES COMPLETE + FULLY OPERATIONAL. K3s on noc1, bare-metal RKE2 on 3 NUCs. /28 FULLY LIVE: 13 VIPs, 30 port forwards, Cloudflare DNS. ArgoCD: 22 apps (via bluejay-infra ApplicationSet). Asterisk PBX: MetalLB .207, 4 PJSIP extensions, Twilio SIP trunk. Telephony: 11,081 tests, 236 MCP tools, ~390 endpoints, 67 Blazor pages. OpenVPN: 9 servers (4 tun + 4 tap + FIT), Andrew/Matt tested from Mac. Split-tunnel DNS. Monitoring: 36 Prometheus scrape jobs, 25 alert rules (5 groups), 12 Grafana dashboards, thermal printer alerting LIVE, IRC alerts. Zabbix: 10+ hosts. Print.Web: 530 tests, 21 pages, 15 MCP, HTTPS via noc-proxy. WiFi Portal: wifi.flowercore.io (Cloudflare-proxied, K8s). New K8s workloads: FlowerCore.Signage (fc-signage), FlowerCore.RemoteDesktop (fc-desktop), WiFi Portal (wifi-portal). 1Password: 7 services wired, 45+ vault items. Pi Fleet: 4 devices, PiManager deployed to piez (:5000) + pirelay (:5100). Guacamole: Blue Jay branded, 23 connections (incl. 9 fcadmin), 4 extensions. Total tests: 21,437+ across 13 services.
\n\n

Quick Links — Web UIs

\n
\n
pfSense
https://pfsense.iamworkin.lan
\n
UniFi Cloud Key
https://unifi.iamworkin.lan
\n
Synology WiFi (SRM)
http://wifi.iamworkin.lan:8000
\n
Element Web (Matrix)
https://element.iamworkin.lan
\n
Cockpit (noc1)
https://cockpit.iamworkin.lan
\n
Grafana
https://grafana.iamworkin.lan
\n
Prometheus
https://prometheus.iamworkin.lan
\n
Guacamole
https://guac.iamworkin.lan
\n
PKI Web
https://pki.iamworkin.lan
\n
ArgoCD
https://argocd.iamworkin.lan
\n
Zabbix
https://zabbix.iamworkin.lan
\n
Gitea
https://gitea.iamworkin.lan
\n
Frontier Modem
http://192.168.254.254
\n
BlueJayNAS (DSM)
https://nas.iamworkin.lan:5001
\n
Matrix Synapse
https://matrix.iamworkin.lan
\n
Telephony
https://telephony.iamworkin.lan
\n
Intranet
https://intranet.iamworkin.lan
\n
PiManager (piez)
http://piez.iamworkin.lan:5000
\n
PiManager (pirelay)
http://pirelay.iamworkin.lan:5100
\n
Print Service
https://print.iamworkin.lan
\n
Signage Web
https://signage.iamworkin.lan
\n
Selenium Grid
https://selenium.iamworkin.lan
\n
WiFi Portal
https://wifi.flowercore.io
\n
\n\n

Phase Progress

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PhaseDescriptionStatusProgress
1Frontier Modem ConfigDone100%
2pfSense Base (WAN, LAN, VIPs)Done100%
3VLAN Configuration (14 VLANs)Done100%
4Firewall Rules & AliasesDone100%
5Bare-Metal RKE2 (Harvester Decommissioned)Done100%
6OpenVPN (8 servers)Done100%
7NAT ConfigurationDone100%
8Traffic ShaperDone100%
9DNS + NTP + SNMPDone100%
10Switch + WiFi ConfigDone100%
11NOC1 + Bare-Metal RKE2Done100%
12GitOps + IaC (ArgoCD/Puppet)Done100%
13Documentation SyncDone100%
\n
\n\n\n
\n

ISP & WAN

\n
\n
\n
ISP: Frontier Communications
\n
    \n
  • Service: 1000/1000 Mbps fiber
    • \n
  • Account: 952-431-5646-020421-7
    • \n
  • Measured: 925 down / 677 up (MGMT VLAN)
    • \n
\n
\n
\n
Modem: NVG468MQ
\n \n
\n
\n

WAN Status

\n\n\n\n\n\n\n\n\n\n
PropertyValue
pfSense WAN Interfaceigc3 (DHCP from modem)
pfSense WAN IP192.168.254.122 (double NAT intentional)
Public /28 Block74.40.140.16/28
Gateway74.40.140.30
Usable Range74.40.140.17 – 74.40.140.29 (13 IPs)
\n
ISP /28 Routing: FULLY OPERATIONAL. Public subnet (74.40.140.16/28) is live. 13 VIPs on WAN (ix3), 12 hybrid outbound NAT rules, 28 port forwards. Cloudflare DNS with 28+ A records pointing to /28 IPs. DDNS: gateway.iamwork.in updates pfSense WAN DHCP IP via Cloudflare API.
\n

Modem Static Routes

\n\n\n\n\n\n\n
NameDestinationGatewayInterface
pfSense-Public-2874.40.140.16/28192.168.254.122LAN
pfSense-Private-Subnets10.0.0.0/8192.168.254.122LAN
\n

Public IP Allocation (13 usable)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IPFull AddressAssignmentVLAN(s)Services
.1674.40.140.16Network address—Unusable
.1774.40.140.17 ANDREW + VPN60Andrew tenant primary + VPN :1194/:1195
.1874.40.140.18 ANDREW #260Andrew secondary
.1974.40.140.19 MATT + VPN61Matt tenant primary + VPN :1194/:1195
.2074.40.140.20 MATT #261Matt secondary
.2174.40.140.21 DUSTIN + VPN62Dustin tenant primary + VPN :1194/:1195
.2274.40.140.22 SIERRA (Dustin #2)62Dustin secondary
.2374.40.140.23 ERIK + VPN63Erik tenant primary + VPN :1194/:1195
.2474.40.140.24 PROD57K8s web + mail (flowercore.io, SMTP)
.2574.40.140.25 FIT + VPN69FIT tenant primary + VPN :1194/:1195
.2674.40.140.26 FIT #269FIT secondary
.2774.40.140.27 COMMS57TeamSpeak, IRC, Matrix
.2874.40.140.28 SHARED59,64,65,66,67WORK+SCHOOL+GUEST+VOIP+EMPLOYEE outbound
.2974.40.140.29 HOME58Home traffic + Nintendo Switch static port NAT
.3074.40.140.30Gateway (Frontier)—ISP router
.3174.40.140.31Broadcast—Unusable
\n
\n\n\n
\n

pfSense Firewall

\n
\n
\n
Netgate 4100
\n \n
\n
\n
Firewall Stats
\n
    \n
  • Aliases: 36 (16 port, 5 host, 15 network)
    • \n
  • Rules: 90 active
    • \n
  • Policy: Air-gapped default — deny all, explicit allow
    • \n
  • SNMP: community \U0001F510 SNMP Community
    • \n
  • SNMP Modules: mibII, netgraph, pf, hostres, bridge
    • \n
\n
\n
\n
Services
\n
    \n
  • DNS: Unbound (DNSSEC, WAN-only outgoing, prefetch)
    • \n
  • DHCP: dhcpd on all 12 VLAN interfaces (.100-.199)
    • \n
  • NTP: ntpd on all VLAN interfaces, DHCP option 42
    • \n
  • Traffic Shaper: 24 dummynet pipes, fq_codel
    • \n
\n
\n
\n

VLAN Configuration (13 VLANs)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\ - \n\n
VLANNameSubnetDHCP RangeDown/Up (Mbps)PriorityPublic IP
56MGMT10.0.56.0/24.100-.199500 / 5005WAN DHCP
57PROD10.0.57.0/24.100-.199500 / 5005.24
58HOME10.0.58.0/24.100-.199800 / 8003.29
59EMPLOYEE10.0.59.0/24.100-.199500 / 5003.28 (shared)
60ANDREW10.0.60.0/24.100-.199300 / 3003.17
61MATT10.0.61.0/24.100-.199300 / 3003.19
62DUSTIN10.0.62.0/24.100-.199300 / 3003.21
63ERIK10.0.63.0/24.100-.199300 / 3003.23
64WORK10.0.64.0/24.100-.199500 / 5003.28 (shared)
65SCHOOL10.0.65.0/24.100-.199200 / 2001.28 (shared)
66GUEST10.0.66.0/24.100-.199100 / 501.28 (shared)
67VOIP10.0.67.0/24.100-.199100 / 1007.28 (shared)
69FIT10.0.69.0/24.100-.199300 / 3003.25
\n
Firewall Policy: MGMT has full access. HOME/WORK/SCHOOL get general internet. GUEST isolated except PROD web. Tenants fully isolated from each other — only PROD, DNS, NAS, and internet. VOIP is SIP-only outbound.
\n
\n\n\n
\n

Switching & WiFi

\n
\n
\n
UniFi Switch USW-Lite-16-PoE
\n \n
\n
\n
UniFi Cloud Key G2
\n \n
\n
\n
Synology RT6600AX (AP Mode)
\n \n
\n
\n
BlueJayNAS (Synology DS1621+)
\n
    \n
  • IP: nas.iamworkin.lan (HOME VLAN 58)
    • \n
  • DSM: https://nas.iamworkin.lan:5001
    • \n
  • Credentials: \U0001F510 BlueJayNAS
    • \n
  • Storage: 9.1 TB Btrfs (RAID)
    • \n
  • NFS Exports: Longhorn backup, shared media, ISO library
    • \n
  • SNMP: Enabled (Zabbix monitored)
    • \n
  • Zabbix: Host monitored via SNMP v2c
    • \n
  • Switch Port: 14 (Access, VLAN 58)
    • \n
\n
\n
\n

Switch Port Assignments

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PortDeviceModeVLANStatus
1pfSense UplinkTrunk (All)56-67UP
2rke2-agent2Trunk (All)56-67UP
3WiFi Uplink (Synology)Trunk, native 5857-67UP
4rke2-agent1Trunk (All)56-67UP
5Cloud Key G2Access56 (MGMT)UP (PoE)
6rke2-serverTrunk (All)56-67UP
7Available——Down
8noc1Trunk (All)56-67UP
9BLUEJAY-WS (Workstation)Access56 (MGMT)UP
10Available——Down
11edge2 (Pi 4)Access57 (PROD)UP
12Available——Down
13edge1 (Pi 5)Access57 (PROD)UP
14Synology NASAccess58 (HOME)UP
15Available——Down
16Synology 2Access58 (HOME)UP
\n

WiFi SSIDs

\n\n\n\n\n\n\n\n\n
SSIDBridgeVLANTypePassword
BlueJay-Homebr0untagged (58)Primary\U0001F510 BlueJay-Home WiFi
BlueJay-Guestbr266Custom (captive portal)\U0001F510 BlueJay-Guest WiFi
BlueJay-Workbr364Custom\U0001F510 BlueJay-Work WiFi
BlueJay-Schoolbr465Custom\U0001F510 BlueJay-School WiFi
\n
\n\n\n
\n

DNS Directory

\n
All entries are pfSense Unbound host overrides under iamworkin.lan. 55+ host overrides configured, plus 4 tenant wildcard redirect zones (*.bluejay.lan, *.timefortaco.lan, *.erik.lan, *.flowerinsider.lan → 10.0.56.200 Traefik).
\n

Management Devices

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
pfsense.iamworkin.lanpfsense.iamworkin.lan pfSense firewall
switch.iamworkin.lanswitch.iamworkin.lan UniFi PoE Switch
unifi.iamworkin.lanunifi.iamworkin.lan UniFi Cloud Key G2
wifi.iamworkin.lanwifi.iamworkin.lan Synology WiFi Router (AP)
nas.iamworkin.lannas.iamworkin.lan Synology NAS
\n

RKE2 Bare-Metal Cluster

\n\n\n\n\n\n\n\n
HostnameIPRole
rke2-server.iamworkin.lanrke2-server.iamworkin.lan RKE2 control plane (bare-metal, openSUSE Leap 16)
rke2-agent1.iamworkin.lanrke2-agent1.iamworkin.lan RKE2 worker node 1 (bare-metal, openSUSE Leap 16)
rke2-agent2.iamworkin.lanrke2-agent2.iamworkin.lan RKE2 worker node 2 (bare-metal, openSUSE Leap 16)
\n

NOC Services (noc1)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
noc1.iamworkin.lannoc1.iamworkin.lan NOC management node (K3s)
acme.iamworkin.lannoc1.iamworkin.lanstep-ca ACME CA
pki.iamworkin.lannoc1.iamworkin.lanPKI cert/CRL distribution
guac.iamworkin.lantraefik.iamworkin.lanApache Guacamole (Blue Jay branded, guacamole ns)
grafana.iamworkin.lantraefik.iamworkin.lanGrafana monitoring (monitoring ns, K8s primary)
prometheus.iamworkin.lantraefik.iamworkin.lanPrometheus metrics (monitoring ns, K8s primary)
cockpit.iamworkin.lantraefik.iamworkin.lanCockpit web console (noc-proxy ns → noc1:9090)
traefik.iamworkin.lan10.0.56.200Traefik dashboard (RKE2, MetalLB VIP)
op-connect.iamworkin.lannoc1.iamworkin.lan1Password Connect API (:8180)
\n

RKE2 Services (via Traefik at traefik.iamworkin.lan)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
rke2.iamworkin.lanrke2-server.iamworkin.lan RKE2 API server (bare-metal control plane)
rke2-traefik.iamworkin.lantraefik.iamworkin.lan Traefik LoadBalancer (MetalLB)
argocd.iamworkin.lantraefik.iamworkin.lanArgoCD GitOps (22 apps, all Healthy)
gitea.iamworkin.lantraefik.iamworkin.lanGitea Git hosting (SSH at MetalLB .201)
zabbix.iamworkin.lantraefik.iamworkin.lanZabbix monitoring (10+ hosts, trapper at .203)
guac.iamworkin.lantraefik.iamworkin.lanApache Guacamole (23 connections, Blue Jay branded)
irc.iamworkin.lantraefik.iamworkin.lanUnrealIRCd + Anope (ports 6667/6697/8067)
matrix.iamworkin.lantraefik.iamworkin.lanMatrix Synapse homeserver
element.iamworkin.lantraefik.iamworkin.lanElement Web (Matrix client)
intranet.iamworkin.lantraefik.iamworkin.lanLab intranet dashboard
pki.iamworkin.lantraefik.iamworkin.lanPKI cert/CRL distribution
mail.iamworkin.lantraefik.iamworkin.landocker-mailserver (SMTP at MetalLB .202)
telephony.iamwork.intraefik.iamworkin.lanFlowerCore.Telephony (:5100, Cloudflare origin cert)
telephony.iamworkin.lantraefik.iamworkin.lanFlowerCore.Telephony (internal, step-ca cert)
signage.iamworkin.lantraefik.iamworkin.lanFlowerCore.Signage.Web (fc-signage ns, :5190)
remotedesktop.iamworkin.lantraefik.iamworkin.lanFlowerCore.RemoteDesktop.Web (fc-desktop ns)
print.iamworkin.lantraefik.iamworkin.lanFlowerCore.Print.Web (noc-proxy ns → edge2:5200, HTTPS via step-ca)
grafana.iamworkin.lantraefik.iamworkin.lanGrafana (monitoring ns, K8s primary)
prometheus.iamworkin.lantraefik.iamworkin.lanPrometheus (monitoring ns, K8s primary)
cockpit.iamworkin.lantraefik.iamworkin.lanCockpit (noc-proxy ns → noc1:9090)
\n

RKE2 MetalLB Service IPs

\n\n\n\n\n\n\n\n\n\n\n
IPServicePorts
traefik.iamworkin.lanTraefik Ingress80, 443, 8080, 6667, 6697
gitea-ssh.iamworkin.lanGitea SSH22
mail.iamworkin.lanMail SMTP25, 465, 587
zabbix-trapper.iamworkin.lanZabbix Trapper10051
ts.iamworkin.lanTeamSpeak9987/UDP, 30033, 10011
asterisk.iamworkin.lanAsterisk SIP5060/UDP+TCP
\n

Production / Edge Nodes

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
macmini.iamworkin.lanmacmini.iamworkin.lan Mac Mini build node (Xcode)
edge1.iamworkin.lanedge1.iamworkin.lan Pi 5 + Hailo AI HAT+ 2
edge2.iamworkin.lanedge2.iamworkin.lan Pi 4 (Argon ONE, CI runner)
piez.iamworkin.lanpiez.iamworkin.lan Pi 4 + EZ Connect (PiManager :5000, GPIO/I2C/SPI)
pirelay.iamworkin.lanpirelay.iamworkin.lan Pi 3 + 4-ch Relay (PiManager :5100, KS0212)
\n

BLUEJAY-WS (openSUSE Leap 16 Workstation)

\n\n\n\n\n\n\n\n
HostnameIPRole
agent-zero-ws.iamworkin.lan10.0.56.20 Agent Zero (BLUEJAY-WS, R9700 GPU)
ollama-ws.iamworkin.lan10.0.56.20 Ollama 0.19.0 (14 models, ROCm + Vulkan)
bluejay-ws.iamworkin.lan10.0.56.20 Traefik v3.6.12 dashboard (BLUEJAY-WS)
\n

Planned / Windows (pre-registered)

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
dc1.iamworkin.lanTBD AD Domain Controller (planned — IP 10.0.56.20 now used by BLUEJAY-WS)
wac1.iamworkin.lan10.0.56.21 Windows Admin Center (planned)
rds1.iamworkin.lan10.0.57.20 Remote Desktop Services (planned)
iis1.iamworkin.lan10.0.57.21 IIS Web Server (planned)
proxy.iamworkin.lan10.0.56.22 Squid Authenticated Proxy (planned)
\n
\n\n\n
\n

Kubernetes Clusters

\n

K3s (noc1 — Emergency Fallback, Scaled to 0)

\n
\n
\n
K3s on noc1 (Standby)
\n
    \n
  • Node: noc1.iamworkin.lan (single-node)
    • \n
  • Version: K3s v1.34.5
    • \n
  • Status: Scaled to 0 — emergency fallback only
    • \n
  • Migration: All workloads moved to RKE2 (2026-03-09)
    • \n
  • Tools: kubectl v1.35.2, helm v3.20.0
    • \n
\n
\n
\n

Harvester HCI (DECOMMISSIONED 2026-03-09)

\n
\n
\n
Harvester Cluster — Decommissioned
\n
    \n
  • Status: Decommissioned — replaced by bare-metal RKE2
    • \n
  • Reason: 6 K8s control planes caused 100°C thermal throttling
    • \n
  • Migration: All 3 NUCs reformatted to openSUSE Leap 16, bare-metal RKE2
    • \n
  • Result: Temps 44-71°C, 1 control plane instead of 6
    • \n
\n
\n
\n

RKE2 (Bare-Metal Cluster)

\n
\n
\n
RKE2 Cluster
\n
    \n
  • Version: RKE2 v1.34.5+rke2r1
    • \n
  • OS: openSUSE Leap 16.0 (bare-metal)
    • \n
  • CNI: Calico (VXLAN mode)
    • \n
  • Pod CIDR: 10.42.0.0/16
    • \n
  • Service CIDR: 10.43.0.0/16
    • \n
  • Kubeconfig: /root/.kube/rke2.yaml on noc1 or WSL
    • \n
  • SSH: ed25519 key auth (root)
    • \n
\n
\n
\n
RKE2 Nodes (Bare-Metal)
\n
    \n
  • rke2-server: rke2-server.iamworkin.lan (i7-1260P / 64GB, control plane)
    • \n
  • rke2-agent1: rke2-agent1.iamworkin.lan (i7-1260P / 64GB, worker)
    • \n
  • rke2-agent2: rke2-agent2.iamworkin.lan (i5-1340P / 64GB, worker)
    • \n
  • SSH: root@10.0.56.{11,12,13} (ed25519 key)
    • \n
  • Puppet: profile::kubernetes::rke2 on all nodes
    • \n
\n
\n
\n
RKE2 Infrastructure
\n
    \n
  • MetalLB: L2 mode, pool 10.0.56.200-220
    • \n
  • Traefik: v3.6.10, 2 replicas, LB traefik.iamworkin.lan
    • \n
  • Longhorn: Default StorageClass (iSCSI), NAS backup integration
    • \n
  • Namespaces (41): fc-system, fc-signage, fc-desktop, fc-tenant-{andrew,matt,dustin,erik,fit}, tenant-{andrew,dustin,erik,fit,flowercore}, traefik-system, metallb-system, argocd, irc, mail, matrix, zabbix, guacamole, gitea, teamspeak, onepassword-system, cert-manager, telephony, monitoring, selenium, agent-zero, intranet, pki, noc-proxy, wifi-portal, voice, longhorn-system, kube-system, calico-system, tigera-operator
    • \n
  • IngressRoutes: 49 Traefik routes (internal + Cloudflare public)
    • \n
  • PVCs: 17 persistent volumes, ~69 Gi total (Longhorn iSCSI, NAS backup)
    • \n
  • ArgoCD: 22 apps via bluejay-infra ApplicationSet (all Healthy — includes agent-zero, asterisk, monitoring, voice, 5 tenant landing pages, guacamole, mail, matrix, IRC, telephony, Gitea, Zabbix, PKI, intranet, noc-services)
    • \n
  • 1Password: Operator v1.11.0 in onepassword-system, 7 CRDs syncing
    • \n
  • Cloudflare Origin Certs: *.flowercore.io + *.iamwork.in (15-year RSA) deployed across 8 namespaces
    • \n
\n
\n
\n

Cluster Resource Usage (2026-03-21)

\n\n\n\n\n\n\n\n
NodeCPUMemoryPodsRole
rke2-server866m (5%)19,293 Mi (30%)~40Control plane + worker
rke2-agent1616m (3%)20,905 Mi (32%)~40Worker
rke2-agent21,430m (8%)17,517 Mi (27%)~40Worker (Selenium + telephony)
\n
Capacity: 192 GB total RAM (64 GB/node), ~30% utilized. Selenium Grid (4 pods) + ArgoCD (7 pods) + Longhorn (29 pods) are the biggest consumers. Prometheus at 10 Gi retention (90 days). All stateful workloads backed up to BlueJayNAS via Longhorn NFS.
\n\n

pfSense Static Routes (K8s)

\n\n\n\n\n\n\n
DestinationGatewayPurpose
10.42.0.0/16rke2-server.iamworkin.lan (rke2-server)Pod CIDR routing
10.43.0.0/16rke2-server.iamworkin.lan (rke2-server)Service CIDR routing
\n
\n\n\n
\n

NOC Services (noc1)

\n
\n
\n
noc1 Host
\n
    \n
  • IP: noc1.iamworkin.lan
    • \n
  • SSH: root@noc1.iamworkin.lan
    • \n
  • Password: \U0001F510 noc1
    • \n
  • Guacamole: ▶ fcadmin SSH
    • \n
  • OS: openSUSE Leap Micro 6.2 (immutable)
    • \n
  • CPU: Intel Celeron N5105 (4C/4T)
    • \n
  • RAM: 32 GB
    • \n
  • Disk: 1TB NVMe (929GB free)
    • \n
  • Runtimes: Podman 5.4.2, K3s v1.34.5
    • \n
\n
\n
\n

Service Directory

\n\n\n\n\n\n\n\n\n\n\n\n\n
ServiceURLPortCredentialsStatus
Cockpithttps://cockpit.iamworkin.lan443 (Traefik)\U0001F510 noc1Online
Prometheushttps://prometheus.iamworkin.lan443 (Traefik, monitoring ns)No auth (90-day retention, ~36 scrape jobs)Online
Grafanahttps://grafana.iamworkin.lan443 (Traefik, monitoring ns)\U0001F510 GrafanaOnline
Node Exporterhttp://noc1.iamworkin.lan:91009100Metrics onlyOnline
SNMP Exportermonitoring ns (K8s ClusterIP :9116)9116pfSense + NAS + Switch + Printer SNMP scraperOnline
step-ca ACMEhttps://acme.iamworkin.lan:94439443\U0001F510 step-caOnline
1Password Connecthttp://op-connect.iamworkin.lan:81808180/8181API token authOnline
Puppet Servernoc1:81408140OpenVox Server 8.12 (Podman)Online
\n

RKE2 Services (22 ArgoCD Apps — All Healthy)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ServiceURLMetalLB / PortCredentialsStatus
ArgoCDhttps://argocd.iamworkin.lan443 (via Traefik)\U0001F510 ArgoCDOnline
Traefiktraefik.iamworkin.lan:8080MetalLB .200 — 80/443/8080/6667/6697\U0001F510 Traefik DashboardOnline
Giteahttps://gitea.iamworkin.lan.201 SSH:22 — HTTPS via Traefik\U0001F510 GiteaOnline
Guacamolehttps://guac.iamworkin.lan443 (via Traefik)\U0001F510 Apache GuacamoleOnline
UnrealIRCdirc.iamworkin.lan:6697 (TLS).200 — 6667/6697\U0001F510 IRC ServicesOnline
Anope (IRC Services)irc.iamworkin.lan:8067ClusterIP onlyNickServ, ChanServCrashLoop
Zabbixhttps://zabbix.iamworkin.lan.203 trapper — Web via Traefik\U0001F510 Zabbix MonitoringOnline
Mail (docker-mailserver)mail.iamworkin.lan.202 — SMTP 25/465/587\U0001F510 Mail ServerOnline
Matrix Synapsehttps://matrix.iamworkin.lan443 (via Traefik)\U0001F510 Matrix SynapseOnline
Element Webhttps://element.iamworkin.lan443 (via Traefik)Uses Matrix accountOnline
TeamSpeakts.iamworkin.lan.205 — 9987/UDP, 30033, 10011\U0001F510 TeamSpeakOnline
FlowerCore Landingflowercore.io443 (via Traefik, Cloudflare)Static pageOnline
PKI Webhttps://pki.iamworkin.lan443 (via Traefik)Public (CRL/certs)Online
Intranethttps://intranet.iamworkin.lan443 (via Traefik)Static pageOnline
Snappymailhttps://mail-web.iamworkin.lan443 (via Traefik)\U0001F510 SnappymailOnline
Telephonyhttps://telephony.iamworkin.lan5100 (via Traefik + Cloudflare)\U0001F510 TelephonyOnline
Asterisk PBXasterisk.iamworkin.lan:5060.207 — SIP 5060/UDP, RTP 10000-200004 PJSIP ext, Twilio trunkOnline
Agent Zerohttps://agent-zero.iamworkin.lan443 (via Traefik)\U0001F510 Agent ZeroOnline
Agent Zero (WS)https://agent-zero-ws.iamworkin.lan30050 (Traefik on BLUEJAY-WS)Same credentialsOnline
Ollama (WS)https://ollama-ws.iamworkin.lan11434 (Traefik on BLUEJAY-WS)No auth (LAN only)Online
1Password OperatorIn-cluster onlyonepassword-systemConnect tokenOnline
Selenium Gridhttps://selenium.iamworkin.lan443 (via Traefik)Hub + 2 Chrome + 1 FirefoxOnline
FlowerCore.Signagehttps://signage.iamworkin.lan443 (via Traefik, fc-signage ns)Blazor + REST + gRPC, 4,611 testsOnline
FlowerCore.RemoteDesktopremotedesktop.iamworkin.lan443 (via Traefik, fc-desktop ns)VDI platform, 34 tests, Phase 1Online
WiFi Portalwifi.flowercore.io443 (Cloudflare-proxied, wifi-portal ns)Captive portal for GUEST WiFiOnline
FlowerCore.Print.Webhttps://print.iamworkin.lan443 (noc-proxy → edge2:5200)21 pages, 9 symbologies, 15 MCP, 530 testsOnline
FlowerCore.Kioskkiosk.iamworkin.lan (planned)443 (Traefik, fc-kiosk ns, planned)8 pages, 8 REST controllers, 13 MCP, 108 tests, Windows Service + WPF trayPlanned
PiManager (piez)http://piez.iamworkin.lan:50005000 (piez direct)GPIO, I2C, SPI, 20 MCPOnline
PiManager (pirelay)http://pirelay.iamworkin.lan:51005100 (pirelay direct)4-ch relay, schedulingOnline
\n

Monitoring

\n
\n
\n
Prometheus (RKE2 K8s — Primary)
\n
    \n
  • Targets: ~36 scrape jobs (node-exporter: noc1 + 3 RKE2 + 4 Pi nodes, SNMP: pfSense + Switch + NAS + Printer, Print: CUPS + Print.Web OTEL + blackbox probes, PiManager: piez+pirelay, AI Stack: 4 blackbox probes, self + Grafana + blackbox)
    • \n
  • Alert Rules: 25 rules in 5 groups (ai-stack: 3, print-services: 6, pi-fleet: 7, snmp-devices: 5, infrastructure: 4)
    • \n
  • Thermal Alerting: LIVE — alerts with alert_channel=thermal_print route to NuPrint 210 via irc-notify
    • \n
  • IRC Alerts: LIVE — Grafana → irc-notify → UnrealIRCd\ - \ #alerts
    • \n
  • Retention: 90 days, 10 Gi PVC
    • \n
  • Config: scripts/monitoring/prometheus.yml (git) + K8s ConfigMap
    • \n
\n
\n
\n
Grafana (RKE2 K8s)
\n
    \n
  • Dashboards (12): ai-stack-health, print-services, pi-fleet, bluejay-edge-nodes, bluejay-network-overview, bluejay-operations, epson-et-3750-ecotank-printer, node-exporter-full — all backed up to scripts/monitoring/grafana/
    • \n
  • Datasource UID: prometheus (K8s monitoring ns)
    • \n
  • Datasources: Prometheus (K8s ClusterIP), Zabbix (alexanderzobnin-zabbix-datasource)
    • \n
  • Contact Points: IRC #alerts (default), Thermal Printer (critical alerts)
    • \n
\n
\n
\n
Zabbix (RKE2) — 10+ Hosts
\n
    \n
  • Agent Hosts (8): noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, piez, pirelay
    • \n
  • SNMP Hosts (4): pfSense, UniFi Switch, BlueJayNAS (DS1621+), Epson ET-3750 EcoTank
    • \n
  • Local (1): Zabbix server self-check
    • \n
  • Agent Version: Zabbix Agent 2 v7.0.22–7.2.15 on all 8 Linux nodes
    • \n
  • Passive checks: Server= includes MetalLB VIP + RKE2 node IPs + pod CIDR
    • \n
  • Counter Strategy: Simple change (delta), Change per second (rate), Calculated items (derived)
    • \n
  • Note: Mac Mini (macOS) pending Zabbix agent setup
    • \n
\n
\n
\n

Pi Fleet Services (FlowerCore.PiManager)

\n\n\n\n\n\n\n
DeviceURLPortCapabilitiesStatus
piez (Pi 4)http://piez.iamworkin.lan:50005000GPIO, I2C, SPI, Expanders (MCP23017/PCF8574/74HC595) — 10 pages, 35 API, 20 MCPOnline
pirelay (Pi 3)http://pirelay.iamworkin.lan:510051004-ch relay (KS0212, active-LOW), scheduling, usage tracking — 8 pages, relay APIOnline
\n
PiManager: Unified .NET 10 service deployed to both Pi nodes with different ASPNETCORE_ENVIRONMENT overlays. Config-driven capabilities — same binary, different features per device. Supports relay presets: ks0212-4ch, walfront-16ch, sainsmart-8ch. API docs at /scalar/v1 on each node.
\n\n

Guacamole Connection Groups (23 connections)

\n\n\n\n\n\n\n\n\n\n
GroupConnectionsProtocol
Kubernetes (3)rke2-server, rke2-agent1, rke2-agent2SSH
Network Devices (4)pfSense, UniFi Cloud Key, Synology WiFi (SRM), BlueJayNASSSH
Servers (3)noc1, Mac Mini (SSH), Mac Mini (VNC)SSH/VNC
Edge Nodes (4)edge1 (Pi 5 + AI), edge2 (Pi 4), piez (Pi 4 + EZ Connect), pirelay (Pi 3 + Relay)SSH
AI Access (fcadmin) (9)noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, macmini, piez, pirelaySSH
\n
Guacamole credentials: All connection passwords are stored in the Guacamole MySQL database (synced from 1Password). The AI Access (fcadmin) group (ID 5) provides 9 SSH connections using the shared \U0001F510 AI Shared SSH Key - fcadmin for one-click AI agent access. Access at https://guac.iamworkin.lan — \U0001F510 Apache Guacamole
\n
\n\n\n
\n

VPN & Security

\n
OpenVPN Status (2026-03-27): 9 servers (4 tun + 4 tap + FIT). Andrew + Matt TUN TESTED from Mac (Home WiFi via NAT reflection + mobile hotspot). Split-tunnel DNS (DOMAIN-ROUTE) working. Cert-only auth (server_tls). Friendly DNS: vpn-andrew/matt.flowercore.io.
\n

VPN Client Access

\n\n\n\n\n\n\n\n\n
TenantHostnamePortAuthStatus
ANDREWvpn-andrew.flowercore.io1194/UDPCert (TLS)Tested
MATTvpn-matt.flowercore.io1194/UDPCert (TLS)Tested
DUSTINvpn-dustin.flowercore.io1194/UDPCert (TLS)Ready
ERIKvpn-erik.flowercore.io1194/UDPCert (TLS)Ready
\n
Split-Tunnel DNS: Server pushes dhcp-option DOMAIN-ROUTE for iamworkin.lan, bluejay.lan, flowercore.io. macOS Viscosity/OpenVPN Connect automatically sets DNS mode to \"Split\" — only matching domains use VPN DNS (10.0.56.1).
\n
NAT Reflection: Pure NAT reflection enabled on all VPN port forwards. Internal clients (e.g., Home WiFi 10.0.58.x) can connect to public VIPs and pfSense hairpins the traffic. Works transparently with port translation (Matt: ext 1194 → int 1195).
\n

OpenVPN Server Configuration

\n\n\n\n\n\n\n\n\n\n
TenantVIPTUN PortTAP PortTunnel (TUN)Tunnel (TAP)VLAN
ANDREW.171194/UDP1195/UDP10.0.68.0/2710.0.68.128/2760
MATT.191194/UDP1195/UDP10.0.68.32/2710.0.68.160/2761
DUSTIN.211194/UDP1195/UDP10.0.68.64/2710.0.68.192/2762
ERIK.231194/UDP1195/UDP10.0.68.96/2710.0.68.224/2763
FIT.251194/UDP1195/UDP10.0.69.0/2710.0.69.128/2769
\n

VPN Certificate Infrastructure

\n\n\n\n\n\n\n\n\n\n
ComponentDetails
CABlueJay VPN CA (4096-bit RSA, SHA-256, 10-year)
Server Certs8 (one per VPN instance, 2048-bit RSA)
Client Certs4 (one per tenant, 2048-bit RSA)
TLS AuthShared HMAC key across all servers
Data CiphersAES-256-GCM, AES-128-GCM, CHACHA20-POLY1305
\n

IPsec Site-to-Site (Planned)

\n\n\n\n\n\n\n
TunnelLocalRemotePhase 1Phase 2 SAs
Matt.29 (pfSense WAN)Matt's public IPIKEv2, AES-256-GCM, DH 14+MATT (10.0.61.0/24) + PROD (10.0.57.0/24)
Dustin.29 (pfSense WAN)Dustin's public IPIKEv2, AES-256-GCM, DH 14+DUSTIN (10.0.62.0/24) + PROD (10.0.57.0/24)
\n

Security Policies

\n
\n
\n
Cloudflare Protection
\n
    \n
  • SSL Mode: Full (strict) on all 6 zones
    • \n
  • Origin Certs: *.flowercore.io + *.iamwork.in (15-year RSA), deployed across 8 K8s namespaces
    • \n
  • HSTS: Enabled on all zones
    • \n
  • Min TLS: 1.2
    • \n
  • Anti-spoofing: null MX, SPF -all, DMARC reject on non-email domains
    • \n
  • Cloudflare-only inbound: Port forwards for 80/443 restrict source to Cloudflare IP ranges
    • \n
\n
\n
\n
SSH Key Policy
\n
    \n
  • Key Type: ed25519 (deployed to all 10 physical nodes)
    • \n
  • WSL Key: stoltz@IAMWORKIN-WS — deployed\ - \ to noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, piez, pirelay, Mac Mini, BLUEJAY-WS
    • \n
  • noc1 Key: noc1-root + rke2@bluejay — management keys for remote nodes
    • \n
  • Root Login: Key-only (PermitRootLogin without-password)
    • \n
  • RKE2 Nodes: SELinux enforcing, chcon -t ssh_home_t on authorized_keys
    • \n
  • Last verified: 2026-03-21 (all 9 nodes confirmed)
    • \n
\n
\n
\n
Network Security Rules
\n
    \n
  • Forced DNS: HOME/WORK/SCHOOL/GUEST block port 53 except to gateway
    • \n
  • Blocked SMTP: Outbound 25/465/587 on HOME/WORK/SCHOOL/GUEST
    • \n
  • Firewall Policy: Deny-all default, explicit allow per VLAN
    • \n
  • Tenant Isolation: Tenants fully isolated from each other, only PROD + DNS + NAS + internet
    • \n
\n
\n
\n

PKI Hierarchy

\n\n\n\n\n\n\n\n\n\n\n\n
CAStatusPurpose
Root CA (IAmWorkin ACME CA)OperationalTrust anchor, ECDSA P-256, expires 2036. Install: print.iamworkin.lan/ca.crt
Intermediate CAOperationalIAmWorkin ACME CA Intermediate CA — signs all leaf certs
ACME CA (step-ca on noc1:9443)OperationalAutomated cert issuance. Consumers: cert-manager (K8s), pfSense ACME pkg, edge Traefik
pfSense ACMEOperationalpfsense.iamworkin.lan cert via acme.sh + step-ca. Set as WebGUI cert (2026-03-27)
Network CAPlannedSwitch, AP, pfSense device certs
Windows AD CS CAPlannedDomain-joined machine/user certs
Internal Services CAPlannedK8s service mesh, inter-service mTLS
\n
\n\n\n
\n

Remote Access — Blue Jay Gateway

\n
Apache Guacamole with Blue Jay branding, 1Password vault integration, K8s exec, and embedded panels. All credentials resolved from 1Password at connection time — no passwords stored in Guacamole.
\n\n
\n
\n
Guacamole Web UI
\n
    \n
  • URL: guac.iamworkin.lan
    • \n
  • Version: 1.6.0 + Blue Jay branding
    • \n
  • Admin: Guacamole
    • \n
  • K8s: guacamole namespace
    • \n
  • Ingress: Traefik → guacamole:8080 (WebSocket)
    • \n
  • ArgoCD: infra-guacamole
    • \n
\n
\n
\n
Extensions
\n
    \n
  • Blue Jay Branding — Full dark theme, custom login, logo
    • \n
  • 1Password Vault — ${VAULT_PASSWORD} token resolution
    • \n
  • TOTP MFA — Required for all users
    • \n
  • Auth Ban — 5 failures = 5min IP ban
    • \n
  • JSON Auth — Signed tokens for embedded panels
    • \n
  • Time Restrict — Per-connection time windows
    • \n
  • Recording Storage — NFS (Synology) playback
    • \n
  • Display Statistics — Performance metrics
    • \n
\n
\n
\n
1Password Integration
\n
    \n
  • Connect URL: onepassword-connect:8080 (K8s internal)
    • \n
  • Vault: IAmWorkin (qaphopopkryhbg353ukzhhuqoq)
    • \n
  • Token: Via OnePasswordItem CRD
    • \n
  • Rotation: Automatic — change in 1Password, Guacamole picks up on next connect
    • \n
  • Cache TTL: 5 minutes
    • \n
\n
\n
\n
Session Recording
\n
    \n
  • Storage: NFS on Synology (/volume1/guacamole/recordings)
    • \n
  • PVC: guacamole-recordings-pvc (50 Gi)
    • \n
  • Format: Guacamole native (playable in browser)
    • \n
  • Retention: Linked to connection history
    • \n
\n
\n
\n\n

Connection Inventory (${VAULT_*} tokens — no hardcoded passwords)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ConnectionProtocolHostVLAN1Password Item
MGMT (VLAN 56) — Infrastructure
pfSense — SSHSSHpfsense.iamworkin.lan56pfSense Admin
Cloud Key — SSHSSHunifi.iamworkin.lan56UniFi CloudKey
UniFi Switch — SSHSSHswitch.iamworkin.lan56UniFi CloudKey
noc1 — SSHSSHnoc1.iamworkin.lan56noc1 Root SSH
rke2-server — SSHSSHrke2-server.iamworkin.lan56RKE2 Server
rke2-agent1 — SSHSSHrke2-agent1.iamworkin.lan56RKE2 Agent 1
rke2-agent2 — SSHSSHrke2-agent2.iamworkin.lan56RKE2 Agent 2
PROD (VLAN 57) — Production
edge1 (Pi 5) — SSHSSHedge1.iamworkin.lan57Edge1 Pi5 SSH
edge2 (Pi 4) — SSHSSHedge2.iamworkin.lan57Edge2 Pi4 SSH
Mac Mini — SSHSSHmacmini.iamworkin.lan57Mac Mini
Mac Mini — VNCVNCmacmini.iamworkin.lan57Mac Mini
HOME (VLAN 58) — Home Network
Synology NAS — SSHSSHnas.iamworkin.lan58Synology NAS
Synology WiFi — SSHSSHwifi.iamworkin.lan58Synology SRM
piez (Pi 4) — SSHSSHpiez.iamworkin.lan58PiEZ SSH
pirelay (Pi 3) — SSHSSHpirelay.iamworkin.lan58PiRelay SSH
AI Access — fcadmin (Group 5, SSH key auth)
noc1 — fcadminSSHnoc1.iamworkin.lan56\U0001F510 fcadmin ▶ Connect
rke2-server — fcadminSSHrke2-server.iamworkin.lan56\U0001F510 fcadmin ▶ Connect
rke2-agent1 — fcadminSSHrke2-agent1.iamworkin.lan56\U0001F510 fcadmin ▶ Connect
rke2-agent2 — fcadminSSHrke2-agent2.iamworkin.lan56\U0001F510 fcadmin ▶ Connect
edge1 — fcadminSSHedge1.iamworkin.lan57\U0001F510 fcadmin ▶ Connect
edge2 — fcadminSSHedge2.iamworkin.lan57\U0001F510 fcadmin ▶ Connect
macmini — fcadminSSHmacmini.iamworkin.lan57\U0001F510 fcadmin ▶ Connect
piez — fcadminSSHpiez.iamworkin.lan58\U0001F510 fcadmin ▶ Connect
pirelay — fcadminSSHpirelay.iamworkin.lan58\U0001F510 fcadmin ▶ Connect
Kubernetes — Pod Exec (auto-synced every 2min)
argocd-serverK8Skubernetes.default.svc—(ServiceAccount)
gitea-0K8Skubernetes.default.svc—(ServiceAccount)
asteriskK8Skubernetes.default.svc—(ServiceAccount)
zabbix-serverK8Skubernetes.default.svc—(ServiceAccount)
synapseK8Skubernetes.default.svc—(ServiceAccount)
unrealircdK8Skubernetes.default.svc—(ServiceAccount)
\n\n

Embedded Panel (Quick SSH)

\n
The embedded panel below uses guacamole-common-js to connect directly to Guacamole's tunnel servlet. Requires authentication to guac.iamworkin.lan first.
\n
\n
\n
\n \n noc1 — SSH Terminal\n Open in Guacamole →\n
\n
\n

Connect via Blue Jay Remote Access to use the embedded terminal.
\n Requires bluejay-guac-embed.js and guacamole-common-js

\n
\n
\n
\n\n

Deployment Details

\n\n\n\n\n\n\n\n\n
ComponentImageReplicasResources
guacamole (Tomcat)fc-guacamole:1.6.0-bluejay1200m-1 CPU, 512Mi-1Gi
guacd (C proxy)guacamole/guacd:1.6.01200m-2 CPU, 256Mi-1Gi
MySQL 8mysql:8.01 (StatefulSet)100m-500m CPU, 256-512Mi
K8s Sync CronJobbitnami/kubectl:1.34every 2minminimal
\n\n

Files Reference

\n\n\n\n\n\n\n\n\n\n\n\n\n
ArtifactPath
Design plandocs/infrastructure/guacamole-customization-plan.md
K8s manifestsk8s/guacamole/*.yaml
Branding extensionk8s/guacamole/extensions/bluejay-branding/
1Password vault extensionk8s/guacamole/extensions/1password-vault/
Embed libraryk8s/guacamole/scripts/bluejay-guac-embed.js
Dockerfilek8s/guacamole/Dockerfile
Bootstrap scriptk8s/guacamole/scripts/bootstrap-connections.sh
Build/deploy scriptk8s/guacamole/scripts/build-image.sh
\n
\n\n\n
\n

Edge Nodes

\n
\n
\n
edge1 — Raspberry Pi 5 + Hailo AI
\n
    \n
  • IP: edge1.iamworkin.lan (PROD VLAN 57)
    • \n
  • SSH: stoltz@edge1.iamworkin.lan
    • \n
  • Password: \U0001F510 Edge1 Pi5 SSH
    • \n
  • Hardware: Pi 5 16GB + Hailo-10H 40 TOPS (AI HAT+ 2)
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • PCIe: Gen 3 x1 (8.0 GT/s)
    • \n
  • Power: 27W USB-C
    • \n
  • .NET SDK: 10.0.103
    • \n
  • GitHub Runner: v2.332.0 (labels: pi5, hailo)
    • \n
  • Node Exporter: :9100
    • \n
  • Puppet: profile::edge_ai
    • \n
  • Zabbix Agent: v7.2.15 (passive, port 10050)
    • \n
  • Switch Port: 13
    • \n
  • Disk: 93% (2.0GB free)
    • \n
  • Guacamole: ▶ fcadmin SSH
    • \n
\n
\n
\n
edge2 — Raspberry Pi 4 (Argon ONE)
\n
    \n
  • IP: edge2.iamworkin.lan (PROD VLAN 57)
    • \n
  • SSH: stoltz@edge2.iamworkin.lan
    • \n
  • Password: \U0001F510 Edge2 Pi4 SSH
    • \n
  • Hardware: Pi 4 Model B 4GB, Argon ONE case
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Fan Control: argononed.service (55°C=10%, 60°C=55%, 65°C=100%)
    • \n
  • .NET SDK: 10.0.103
    • \n
  • Print Service: LIVE FlowerCore.Print.Web (21 pages, 15 MCP tools, 530 tests, HTTPS via noc-proxy, CUPS+AirPrint)
    • \n
  • GitHub Runners: v2.332.0 — MySQL (edge2-mysql), PHP (edge2-php)
    • \n
  • Node Exporter: :9100
    • \n
  • Puppet: profile::edge_runner
    • \n
  • Zabbix Agent: v7.2.15 (passive, port 10050)
    • \n
  • Switch Port: 11
    • \n
  • Guacamole: SSH connection in Edge Nodes group | ▶ fcadmin SSH
    • \n
\n
\n
\n
piez — Raspberry Pi 4 + EZ Connect
\n
    \n
  • IP: piez.iamworkin.lan (HOME VLAN 58, WiFi)
    • \n
  • SSH: stoltz@piez.iamworkin.lan
    • \n
  • Password: \U0001F510 piez SSH
    • \n
  • Hardware: Pi 4 Model B 4GB + Pi EZ Connect board
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Role: GPIO prototyping, breadboard dev, I2C/SPI sensors
    • \n
  • .NET SDK: 10.0.201
    • \n
  • Web: LIVE FlowerCore.PiManager :5000 (10 pages, 35 API endpoints, 20 MCP tools)
    • \n
  • API Docs: Scalar :5000/scalar/v1
    • \n
  • Capabilities: GPIO, I2C, SPI, Expanders (MCP23017/PCF8574/74HC595)
    • \n
  • Node Exporter: :9100
    • \n
  • Zabbix Agent: v7.0.22 (passive, port 10050)
    • \n
  • Guacamole: SSH connection in Edge Nodes group | ▶ fcadmin SSH
    • \n
  • Dashboard: piez-prototyping.html
    • \n
\n
\n
\n
pirelay — Raspberry Pi 3 + 4-Ch Relay
\n
    \n
  • IP: pirelay.iamworkin.lan (HOME VLAN 58)
    • \n
  • SSH: stoltz@pirelay.iamworkin.lan
    • \n
  • Password: \U0001F510 pirelay SSH
    • \n
  • Hardware: Pi 3 Model B v1.2, 906 MB RAM + Keyestudio KS0212 4-channel relay shield
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Role: Relay controller, home automation prototyping
    • \n
  • Web: LIVE FlowerCore.PiManager :5100 (relay preset: ks0212-4ch)
    • \n
  • API Docs: Scalar :5100/scalar/v1
    • \n
  • GPIO (BCM, active-LOW): CH1=GPIO4, CH2=GPIO22, CH3=GPIO6, CH4=GPIO26
    • \n
  • Relay Ratings: 10A @ 250VAC / 30VDC per channel
    • \n
  • Node Exporter: :9100
    • \n
  • Zabbix Agent: v7.0.22 (passive, port 10050)
    • \n
  • Guacamole: SSH connection in Edge Nodes group | ▶ fcadmin SSH
    • \n
  • Dashboard: relay-controller.html
    • \n
\n
\n
\n
Mac Mini (Build/Test Node)
\n
    \n
  • IP: macmini.iamworkin.lan (PROD VLAN 57)
    • \n
  • SSH: bluejay@macmini.iamworkin.lan
    • \n
  • Credentials: \U0001F510 Mac Mini
    • \n
  • VNC: vnc://macmini.iamworkin.lan:5900 — \U0001F510 Mac Mini
    • \n
  • Hardware: Apple M1, 16GB RAM, 926GB SSD
    • \n
  • OS: macOS 26.3.1 (Darwin 25.3.0)
    • \n
  • Role: Xcode builds, Selenium Grid node, automated browser/app testing
    • \n
  • Guacamole: SSH + VNC connections in Servers group | ▶ fcadmin SSH
    • \n
\n
\n
\n\n

Edge2 — Print Service

\n
\n
\n
FlowerCore.Print.Web
\n
    \n
  • URL: https://print.iamworkin.lan (HTTPS via K8s noc-proxy + step-ca ACME)
    • \n
  • Direct: https://print.iamworkin.lan (HTTP, edge2 direct)
    • \n
  • Pages: 21 Blazor pages (Dashboard, Queue, Config, QR Generator, Barcode Generator, Product Lookup, AI Assistant, Test Print, Print Log, Webhooks, Batch Print, Web Print, SharePrint, QuickPrint, Paper Management, Admin, About, Error, NotFound + more)
    • \n
  • Tests: 530 (ALL PASS)
    • \n
  • Symbologies: 9 (Code128, EAN-13, QR, DataMatrix, ITF-14, UPC-A/E, Code39, Codabar)
    • \n
  • Features: Product cache DB, AI label generation, batch/combo labels, smart paper roll tracking, waste analysis, source policies, receipt photo analysis, recipe scraper+bookmarklet, SignalR job broadcasts, role-based ACL (Admin/Operator/PrintClient), ISBN auto-format, scanner JS interop
    • \n
  • MCP Tools: 15 tools for barcode/label generation, queue control, paper management, and waste summary
    • \n
  • Thermal Printer: NuPrint 210 (58mm ESC/POS, Linux USB, /dev/usb/lp0)
    • \n\ - \
  • CUPS: ZJ-58 raster driver, AirPrint/mDNS, cups_exporter (:9628)
    • \n
  • Monitoring: OTEL metrics → Prometheus, thermal printer alerting pipeline
    • \n
  • systemd: flowercore-print.service (auto-start)
    • \n
\n
\n
\n
2026-03-25 session note: The print service stayed reachable and small endpoints remained fast, but larger IPv4 responses from edge2 on :5200 and :9100 stalled after roughly 15-16 KB from this Mac. That looked like a host-side transport problem on edge2, not a VLAN block or missing stylesheet issue. Detailed write-up: print-service-session-learnings-2026-03-25.md
\n\n

BLUEJAY-WS AI Services (10.0.56.20)

\n
\n
\n
Agent Zero (WS)
\n
    \n
  • URL: https://agent-zero-ws.iamworkin.lan
    • \n
  • Port: 30050 (behind Traefik v3.6.12)
    • \n
  • Runtime: Podman pod (systemd user service with linger)
    • \n
  • Models: Chat: qwen3:32b, Utility: qwen2.5:3b, Embed: nomic-embed-text
    • \n
  • Config: /a0/usr/plugins/_model_config/config.json
    • \n
  • Ollama Access: host.containers.internal:11434 (NOT host IP)
    • \n
\n
\n
\n
Ollama 0.19.0 (WS)
\n
    \n
  • URL: https://ollama-ws.iamworkin.lan
    • \n
  • Port: 11434 (binds 0.0.0.0, LAN accessible)
    • \n
  • GPU: AMD Radeon AI PRO R9700 32GB GDDR6 (ROCm + Vulkan)
    • \n
  • Models: 14 installed (~155GB) on /home/ollama/.ollama/models (XFS)
    • \n
  • Key Models: qwen3:32b, qwen3-coder:30b, devstral:24b, deepseek-r1:32b, gemma3:27b, phi4:14b
    • \n
\n
\n
\n
Traefik v3.6.12 (WS)
\n
    \n
  • Dashboard: https://bluejay-ws.iamworkin.lan
    • \n
  • Runtime: Podman (root systemd service)
    • \n
  • TLS: step-ca ACME auto-provisioned certs from IAmWorkin ACME CA
    • \n
  • Routes: agent-zero-ws, ollama-ws, bluejay-ws
    • \n
\n
\n
\n
Piper TTS (WS)
\n
    \n
  • Port: tcp://localhost:30052
    • \n
  • Runtime: Podman pod
    • \n
\n
\n
\n
Two Agent Zeros coexist: agent-zero.iamworkin.lan → 10.0.56.200 (RKE2 Traefik, Pi AI models) | agent-zero-ws.iamworkin.lan → 10.0.56.20 (BLUEJAY-WS R9700 GPU). BLUEJAY-WS hardware: Intel Xeon w3-2425, 32GB DDR5, AMD R9700 32GB GDDR6. openSUSE Leap 16 (dual boot Windows 11). Sleep/suspend disabled.
\n\n

Edge1 AI & Speech Services

\n
\n
\n
Ollama (LLM Inference)
\n
    \n
  • API: http://edge1.iamworkin.lan:11434
    • \n
  • Model: qwen2.5-coder:7b (4.7GB Q4_K_M)
    • \n
  • Managed by: profile::edge::ollama (Puppet)
    • \n
  • Firewall: nftables port 11434 from MGMT+PROD
    • \n
  • Note: SD card 95% full — one model max
    • \n
\n
\n
\n
Piper TTS (Text-to-Speech)
\n
    \n
  • Version: piper-tts 1.4.1 in ~/piper-env venv
    • \n
  • Voices: en_US-amy-low (16kHz) + en_US-amy-medium (22kHz)
    • \n
  • Performance: RTF 0.10 (10x real-time), 222ms latency (short)
    • \n
  • CPU Usage: 3/4 cores (271%)
    • \n
  • Note: 16kHz matches G.711 natively for telephony
    • \n
\n
\n
\n
Hailo Whisper STT (Speech-to-Text)
\n
    \n
  • Model: Whisper-Base HEF (131MB, v5.1.1)
    • \n
  • Path: /opt/hailo-models/Whisper-Base.hef
    • \n
  • Performance: RTF 0.05-0.11 (10-18x real-time)
    • \n
  • Model Load: 1.2s cold start
    • \n
  • Multi-process: VDevice for coexistence with Frigate
    • \n
\n
\n
\n
Speech Pipeline Service
\n
    \n
  • API: http://edge1.iamworkin.lan:8500
    • \n
  • Endpoints: POST /tts, POST /stt, GET /health
    • \n
  • User: speech in hailo group
    • \n
  • Managed by: profile::edge::speech_pipeline (Puppet)
    • \n
  • Firewall: nftables port 8500 from MGMT+PROD
    • \n
\n
\n
\n
Twilio Voice Bridge (PoC)
\n
    \n
  • Location: /opt/twilio-bridge/ on edge1
    • \n
  • WebSocket: :8765 • TwiML: :8766
    • \n
  • Cloudflare Tunnel: bluejay-voice (3ddfa567-b0a7-40cb-9c57-7f20f3ec3637)
    • \n
  • URLs: voice.bluejay.dev (TwiML), voice-ws.bluejay.dev (WS)
    • \n
  • Services: cloudflared-tunnel on noc1, twilio-bridge + twilio-twiml on edge1
    • \n
  • Status: PoC — STT fixed, TTS stream API mismatch
    • \n
\n
\n
\n
\n\n\n
\n

Storage

\n
\n
\n
BlueJayNAS — Synology DS1621+
\n
    \n
  • IP: nas.iamworkin.lan (HOME VLAN 58, switch port 14)
    • \n
  • DNS: nas.iamworkin.lan, synology.iamworkin.lan
    • \n
  • DSM: https://nas.iamworkin.lan:5001 (v7.3.2-86009 Update 1)
    • \n
  • SSH: bluejay@nas.iamworkin.lan
    • \n
  • Credentials: \U0001F510 BlueJayNAS
    • \n
  • Model: DS1621+ (6-bay, AMD Ryzen V1500B)
    • \n
  • Storage: 9.1 TB Btrfs (RAID), ~7.8 TB free
    • \n
  • MAC: 00:11:32:f2:43:6b
    • \n
  • TLS Cert: ca.iamworkin.lan (step-ca ACME, expires 2026-06-03)
    • \n
  • NFS Domain: private.iamwork.in
    • \n
  • 2FA: TOTP enabled on DSM
    • \n
\n
\n
\n
NFS Exports & Services
\n
    \n
  • Longhorn Backup: nfs://nas.iamworkin.lan:/volume1/NetBackup/longhorn-backups
    • \n
  • Kubernetes Shared: /volume1/kubernetes (NFS mount for PVCs)
    • \n
  • Selenium Screenshots: /volume1/selenium/screenshots (AAT visual tests via PVC)
    • \n
  • Selenium Videos: /volume1/selenium/videos (test recordings)
    • \n
  • NFS Permissions: RKE2 nodes rke2-server/agent1/agent2 (MGMT VLAN cross-VLAN rule)
    • \n
  • Ports: NFS (2049), iSCSI (3260, no targets yet), DSM API (5001), SSH (22), SNMP (161)
    • \n
  • pfSense Rule: RKE2 → NAS on 2049/3260/5001
    • \n
\n
\n
\n
Monitoring & Security
\n
    \n
  • SNMP: v2c community \U0001F510 SNMP
    • \n
  • Zabbix\ - \ Host: BlueJayNAS (ID 10678) — Linux by SNMP template
    • \n
  • Prometheus: SNMP scrape via snmp-exporter (synology module)
    • \n
  • Auto Block: Enabled (brute-force protection)
    • \n
  • DSM Firewall: DO NOT ENABLE — synofirewall segfaults on 7.3.2, causes lockout
    • \n
  • admin account: ENABLED — never disable (breaks all admin-group privileges)
    • \n
  • SSH: Keep PasswordAuthentication yes (disabling breaks sudo/PAM)
    • \n
  • Guacamole: SSH connection in Network Devices group
    • \n
\n
\n
\n
Recovery Notes
\n
    \n
  • admin disabled recovery: Physical RESET button (4s hold, 1 beep) + power cycle
    • \n
  • Firewall lockout: Physical RESET (same procedure)
    • \n
  • Security hardening: Use pfSense cross-VLAN rules, NOT DSM-level firewall/SSH hardening
    • \n
  • CLI tools: /usr/syno/bin/synopkg, /usr/syno/sbin/synouser, /usr/syno/sbin/synogroup
    • \n
  • DSM API: https://nas.iamworkin.lan:5001/webapi/entry.cgi — SYNO.API.Auth + otp_code for 2FA
    • \n
\n
\n
\n\n

Longhorn Persistent Volume Claims (17 PVCs, ~69 Gi)

\n
Longhorn → NAS Backup: Longhorn is the default StorageClass on the RKE2 cluster (iSCSI). All 17 PVCs backed up to BlueJayNAS via NFS. Daily backups at 02:00 UTC (retain 14 days), hourly snapshots (retain 24).
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
NamespacePVCSizePurpose
monitoringprometheus-data + grafana-data12 GiPrometheus TSDB (90-day retention) + Grafana dashboards/DB
zabbixzabbix-postgres-data10 GiZabbix PostgreSQL (13 hosts, history/trends)
giteagitea-shared-storage10 GiGit repositories, LFS objects, attachments
telephonyasterisk-data + telephony-data10 GiAsterisk PBX config + FlowerCore.Telephony DB
matrixmatrix-postgres-data + synapse-data7 GiMatrix Synapse PostgreSQL + media store
mailmail-data + mail-state6 Gidocker-mailserver (Postfix queues, Dovecot mail)
agent-zeroagent-zero-data + knowledge6 GiAgent Zero persistent data + FAISS knowledge base
guacamoleguac-mysql-data5 GiGuacamole MySQL (23 connections, session history)
ircanope-data + unrealircd-data2 GiIRC services DB (channels, nicks) + UnrealIRCd config
teamspeakteamspeak-data1 GiTeamSpeak virtual server config + file transfers
\n\n\n\n\n\n\n\n\n\n
ComponentDetail
Storage BackendLonghorn (iSCSI, default StorageClass, 3 replicas per volume)
Backup Targetnfs://nas.iamworkin.lan:/volume1/NetBackup/longhorn-backups
Backup ScheduleDaily at 02:00 UTC (retain 14 days), hourly snapshots (retain 24)
RKE2 Requirementiscsid enabled on all nodes (systemctl enable --now iscsid)
Managed byPuppet profile::kubernetes::rke2 (prerequisites, kernel modules, sysctl)
\n\n

Synology CSI Driver (Pending)

\n
Status: Helm repo added, deployment pending. Will enable dynamic PVC provisioning directly from Synology NFS/iSCSI.
\n\n\n\n\n\n\n\n\n\n
ComponentDetail
DriverSynologyOpenSource/synology-csi v1.2.1
Helm Chartchristian-schlichtherle, v0.11.0
ProtocolsNFS, iSCSI, SMB
Service Accountk8s-csi (UID 1032) on BlueJayNAS
1Password\U0001F510 Synology CSI creds
\n
\n\n\n
\n

WiFi Networks

\n
Credentials: All WiFi passwords are stored in the IAmWorkin vault on 1Password. To connect a device, open the 1Password app, find the WiFi entry, and scan the QR code from there. Passwords are not stored in this page for security.
\n
QR Code Connection: Open 1Password → search for the SSID name → tap “Show QR Code” → scan with your device camera. The QR code encodes the full WIFI:T:WPA;S:{SSID};P:{PASSWORD};;; connection string.
\n\n
\n \n
\n
\n
BlueJay-Home
\n
HOME (VLAN 58)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Home\n
\n
\n VLAN\n 58 (untagged on AP)\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n Home network — personal / family use\n
\n
\n Bandwidth\n 800 / 800 Mbps\n
\n
\n Public IP\n 74.40.140.29\n
\n
\n
\n\n \n
\n
\n
BlueJay-Work
\n
WORK (VLAN 64)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Work\n
\n
\n VLAN\n 64\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n Work network — business devices\n
\n
\n Bandwidth\n 500 / 500 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-School
\n
SCHOOL (VLAN 65)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-School\n
\n
\n VLAN\n 65\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n School network — student devices\n
\n
\n Bandwidth\n 200 / 200 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-Guest
\n
GUEST (VLAN 66)
\n
\n
\n
\n \n \n \n \n \n Open network — no password required\n
\n
\n
\n
\n SSID\n BlueJay-Guest\n
\n
\n VLAN\n 66\n
\n
\n Security\n Open / Captive Portal (wifi.flowercore.io)\n
\n
\n Password\n None (open)\n
\n
\n Captive Portal\n wifi.flowercore.io — Cloudflare-proxied, public Let's Encrypt cert, K8s hosted\n
\n
\n Purpose\n Guest WiFi — fully isolated, NAT only, terms acceptance required\n
\n
\n Bandwidth\n 100 / 50 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n
\n\n

WiFi Access Point

\n
\n
\n
Synology RT6600AX (AP Mode)
\n \n
\n
\n\n
Network Isolation: Each SSID maps to a separate VLAN with independent firewall rules and bandwidth limits. GUEST is fully isolated with NAT — no access to internal resources. EMPLOYEE, WORK, and SCHOOL share public IP .28 with traffic shaping.
\n
\n\n\n
\n

Credentials & 1Password

\n
\n
\n
1Password Connect Server
\n
    \n
  • API: http://op-connect.iamworkin.lan:8180
    • \n
  • Sync: http://op-connect.iamworkin.lan:8181
    • \n
  • Host: noc1 (Podman containers)
    • \n
  • Status: Online
    • \n
\n
\n
\n
1Password K8s Operator
\n
    \n
  • Namespace: onepassword-system
    • \n
  • Chart: 1password/connect v2.3.0
    • \n
  • Operator: v1.11.0
    • \n
  • Poll Interval: 600s
    • \n
  • Status: Online
    • \n
\n
\n
\n
IAmWorkin Vault
\n
    \n
  • Vault Name: IAmWorkin
    • \n
  • Items: 45+ items (infra credentials + WiFi QR codes + Pi device passwords)
    • \n
  • AI SSH Key: \U0001F510 AI Shared SSH Key - fcadmin
    • \n
  • Rotation: Quarterly (Jan/Apr/Jul/Oct)
    • \n
  • Script: /opt/scripts/rotate-credentials.sh
    • \n
  • Timer: credential-rotation.timer
    • \n
\n
\n
\n\n
All infrastructure credentials are managed in 1Password. The IAmWorkin vault contains credentials for every service\ - \ listed on this intranet. K8s workloads (Zabbix, Matrix, Guacamole, Mail, IRC, Gitea, ArgoCD) sync secrets automatically via OnePasswordItem CRDs. Credential rotation runs quarterly via systemd timer.
\n\n

K8s Secret Sync (OnePasswordItem CRDs)

\n\n\n\n\n\n\n\n\n\n\n\n
NamespaceSecret NameSource (1Password Item)Status
zabbixzabbix-credentialsZabbix MonitoringSynced
matrixmatrix-credentialsMatrix SynapseSynced
guacamoleguacamole-credentialsApache GuacamoleSynced
mailmail-credentialsMail ServerSynced
ircirc-credentialsIRC ServicesSynced
giteagitea-credentialsGiteaSynced
argocdargocd-credentialsArgoCDSynced
\n\n

Pi Fleet & Edge Node Credentials

\n\n\n\n\n\n\n\n\n\n
DeviceIPUser1Password ItemServices
edge1 (Pi 5)edge1.iamworkin.lanstoltz\U0001F510 Edge1 Pi5 SSHOllama, Piper TTS, Hailo STT, Frigate
edge2 (Pi 4)edge2.iamworkin.lanstoltz\U0001F510 Edge2 Pi4 SSHPrint.Web, CUPS, GitHub Actions runners
piez (Pi 4)piez.iamworkin.lanstoltz\U0001F510 piezPiManager :5000 (GPIO, I2C, SPI)
pirelay (Pi 3)pirelay.iamworkin.lanstoltz\U0001F510 pirelayPiManager :5100 (4-ch relay)
Mac Minimacmini.iamworkin.lanbluejay\U0001F510 Mac MiniSSH + VNC :5900, Xcode builds
\n\n

Credential Rotation

\n
\n
\n
Rotation Script
\n
    \n
  • Path: /opt/scripts/rotate-credentials.sh
    • \n
  • Usage: rotate-credentials.sh {service|all} [--dry-run]
    • \n
  • Services: grafana, guacamole, zabbix, argocd, gitea, snappymail, traefik, matrix, harvester (17/17 complete, all XKCD-style)
    • \n
  • Schedule: Quarterly (1st of Jan/Apr/Jul/Oct at 03:00 UTC)
    • \n
  • Log: /var/log/credential-rotation.log
    • \n
\n
\n
\n
\n\n\n
\n

Planned Services

\n
All previously planned services (Gitea, IRC, Zabbix, ArgoCD, 1Password, Mail, Matrix, TeamSpeak, Guacamole, Signage, Telephony, RemoteDesktop, WiFi Portal, Monitoring, Selenium Grid) are now live on RKE2. Remaining planned items are Windows Server VMs and authenticated proxy.
\n\n\n\n\n\n\n\n\n\n
ServiceIPHostRoleStatus
Windows DC1TBDVM (hypervisor TBD)AD Domain Controller (iamworkin.lan) — IP 10.0.56.20 now used by BLUEJAY-WSPlanned
Windows WAC110.0.56.21VM (hypervisor TBD)Windows Admin CenterPlanned
Windows RDS110.0.57.20VM (hypervisor TBD)Remote Desktop ServicesPlanned
Windows IIS110.0.57.21VM (hypervisor TBD)IIS Web ServerPlanned
Squid Proxy10.0.56.22VM (hypervisor TBD)Authenticated web proxy (Kerberos/LDAP)Planned
\n
\n\n\n
\n

Network Topology

\n
\n\n
Internet
\n
\n
Frontier ONT + NVG468MQ Modem

WAN: 74.32.185.184 • /28: .17-.29

192.168.254.254 • DMZ to pfSense

\n
\n
pfSense Netgate 4100

WAN: igc3 (.122) • LAN: igc0 (802.1Q trunk)

13 VLANs • 13 VIPs • 28 port forwards • DNS/DHCP/NTP/SNMP

\n
\n
UniFi USW-Lite-16-PoE Switch

switch.iamworkin.lan • 16 ports • VLANs 56-67

\n
\n\n
\n
\n
noc1
\n

noc1.iamworkin.lan MGMT

\n

Celeron N5105 • 32GB • K3s + Podman

\n
    \n
  • step-ca :9443
  • Cockpit :9090
    • \n
  • Puppet :8140
  • 1Password Connect :8180
    • \n
  • node-exporter :9100
    • \n
\n
\n
\n
RKE2 Bare-Metal Cluster
\n

Traefik: traefik.iamworkin.lan MGMT

\n
    \n
  • rke2-server: .11 (i7-1260P/64GB, control plane)
    • \n
  • rke2-agent1: .12 (i7-1260P/64GB, worker)
    • \n
  • rke2-agent2: .13 (i5-1340P/64GB, worker)
    • \n
\n

RKE2 v1.34.5 • Calico • MetalLB • Longhorn • Traefik v3.6.10 • ArgoCD • 22 apps • 41 namespaces • Asterisk PBX

\n
\n
\n
WiFi (Synology RT6600AX)
\n

wifi.iamworkin.lan HOME

\n
    \n
  • BlueJay-Home (untagged)
    • \n
  • BlueJay-Guest (VLAN 66, captive portal)
    • \n
  • BlueJay-Work (VLAN 64)
  • BlueJay-School (VLAN 65)
    • \n
\n
\n
\n
PROD Nodes
\n

PROD VLAN 57

\n
    \n
  • Mac Mini: macmini.iamworkin.lan (Xcode)
    • \n
  • edge1 Pi5: edge1.iamworkin.lan (Hailo AI)
    • \n
  • edge2 Pi4: edge2.iamworkin.lan (CI runner)
    • \n
\n
\n
\n
HOME Pi Fleet
\n

HOME VLAN 58 • FlowerCore.PiManager

\n
    \n
  • piez Pi4: piez.iamworkin.lan (EZ Connect, GPIO/I2C/SPI) — :5000
    • \n
  • pirelay Pi3: pirelay.iamworkin.lan (KS0212 4-ch relay) — :5100
    • \n
  • Unified PiManager binary • config-driven • node-exporter • Zabbix
    • \n
\n
\n
\n
BLUEJAY-WS (Workstation)
\n

10.0.56.20 MGMT

\n

Xeon w3-2425 • 32GB DDR5 • R9700 32GB • openSUSE Leap 16

\n \n
\n
\n
Network Devices & Storage
\n
    \n
  • Cloud Key: unifi.iamworkin.lan
    • \n
  • BlueJayNAS (DS1621+): nas.iamworkin.lan
    • \n
  • 9.1TB Btrfs • NFS • Longhorn backup • SNMP
    • \n
  • Modem: 192.168.254.254
    • \n
\n
\n
\n
\n
\n\n\n
\n

Domains

\n
\n
17
Registered Domains
\n
1
Internal Domain
\n
1
Blog Hosting (DreamHost)
\n
18
Total Domains
\n
\n\n

FlowerCore Domains

\n\n\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
flowercore.ioFlowerCoreAndrewProduction APICloudflareNamecheap
flowerinsider.xyzFlowerCoreAndrewDev/stagingCloudflareNamecheap
flowerinsider.comFlowerCore CoAndrewCompany siteNamecheapNamecheap
flowerinsider.nlFlowerCore CoAndrewDutch siteNamecheapNamecheap
\n\n

Work Domains

\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
iamwork.inWorkAndrewEmployee portal, IVR, TelephonyCloudflareNamecheap
iamworkin.comWorkAndrewRedirectNamecheapNamecheap
\n\n

Personal & Tenant Domains

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
ackeroni.comErikErikPersonalNamecheapNamecheap
erckak.comErikErikPersonalNamecheapNamecheap
erckak.devErikErikDeveloper portfolioCloudflareNamecheap
digirido.comRandomAndrewDigiKey testingNamecheapNamecheap
timeforta.coDustinDustinPersonalCloudflareNamecheap
shenanjia.comWifeWifePersonal siteNamecheapNamecheap
bluejay.apiPersonal FunAndrewAPI experimentsNamecheapNamecheap
bluejay.devPersonal FunAndrewDev projects, voice bridgeCloudflareNamecheap
jayblue.devPersonal FunAndrewDev projectsNamecheapNamecheap
z.orbRandomAndrewShort URLNamecheapNamecheap
\n\n

Blog & Content Domains

\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
pebbleandpeanut.comBlogAndrewPersonal blogDreamHostNamecheap
pebblesandpeanuts.comBlogAndrewAlt redirectNamecheapNamecheap
\n\n

Internal Domain

\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderNotes
iamworkin.lanInternalAndrewInternal infrastructure, future AD DSpfSense Unbound52+ host overrides + 4 wildcard redirect zones, not publicly registered
\n\n

Cloudflare (6 Zones)

\n
\n
\n
Cloudflare Account
\n
    \n
  • Account: Astoltz@iamwork.in
    • \n
  • Plan: Pro (planned)
    • \n
  • NS: dan.ns.cloudflare.com, frida.ns.cloudflare.com
    • \n
  • All Zones: SSL Full(strict), HSTS, min TLS 1.2
    • \n
  • API Tokens: \U0001F510 Cloudflare API Tokens
    • \n
\n
\n
\n
Active Zones
\n
    \n
  • flowercore.io — Production API, landing page
    • \n
  • iamwork.in — Employee portal, telephony, DDNS
    • \n
  • bluejay.dev — Dev projects, voice bridge
    • \n
  • erckak.dev — Erik developer portfolio
    • \n
  • timeforta.co — Dustin personal
    • \n
  • flowerinsider.xyz — Dev/staging
    • \n
\n
\n
\n

Namecheap API

\n
\n
\n
API Configuration
\n
    \n
  • Base URL: https://api.namecheap.com/xml.response
    • \n
  • API User: astoltz
    • \n
  • API Key: \U0001F510 Namecheap API
    • \n
  • Sandbox URL: https://api.sandbox.namecheap.com/xml.response
    • \n
\n
\n
\n
Dynamic DNS
\n
    \n
  • Hostname: gateway.iamwork.in
    • \n
  • Points to: pfSense WAN IP (auto-updated)
    • \n
  • DDNS: gateway.iamwork.in → pfSense WAN DHCP IP (via Cloudflare API)
    • \n
  • Update Method: pfSense Dynamic DNS client (Cloudflare API token)
    • \n
  • Token: \U0001F510 Cloudflare pfSense Token
    • \n
\n
\n
\n\n

Internal DNS Architecture

\n
Split-Horizon DNS (LIVE): External requests to flowercore.io resolve via Cloudflare to public IP .24 (PROD). Internal requests resolve via pfSense Unbound to K8s MetalLB VIP (10.0.56.200), avoiding NAT hairpin. All internal infrastructure uses iamworkin.lan zone. 4 tenant .lan wildcard redirect zones configured in Unbound (base64-encoded custom_options).
\n\n

Planned IPv6 (ULA)

\n\n\n\n\n\n
PrefixSchemeMethod
fdbc:56:XX::/64XX = VLAN ID (e.g., fdbc:56:56::/64 for MGMT)SLAAC + DHCPv6 (servers), SLAAC-only (clients)
\n
\n\n\n\n\n" -kind: ConfigMap -metadata: - name: intranet-html - namespace: intranet ---- apiVersion: apps/v1 kind: Deployment metadata: - labels: - app: intranet - name: intranet + name: intranet-web namespace: intranet + labels: + app: intranet-web + app.kubernetes.io/part-of: bluejay-infra spec: replicas: 1 selector: matchLabels: - app: intranet + app: intranet-web template: metadata: labels: - app: intranet + app: intranet-web spec: containers: - - image: nginx:alpine - livenessProbe: - httpGet: - path: /healthz - port: 80 - initialDelaySeconds: 5 - periodSeconds: 10 - name: nginx - ports: - - containerPort: 80 - name: http - readinessProbe: - httpGet: - path: /healthz - port: 80 - initialDelaySeconds: 3 - periodSeconds: 5 - resources: - limits: - cpu: 50m - memory: 64Mi - requests: - cpu: 5m - memory: 16Mi - volumeMounts: - - mountPath: /etc/nginx/conf.d/default.conf - name: nginx-conf - subPath: default.conf - - mountPath: /usr/share/nginx/html - name: html - volumes: - - configMap: - name: intranet-nginx-conf - name: nginx-conf - - configMap: - name: intranet-html - name: html + - name: intranet-web + image: localhost/fc-intranet-web:latest + imagePullPolicy: Never + ports: + - containerPort: 5300 + name: http + env: + - name: ASPNETCORE_ENVIRONMENT + value: Production + - name: ASPNETCORE_URLS + value: "http://+:5300" + resources: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "512Mi" + cpu: "500m" + livenessProbe: + httpGet: + path: /health + port: 5300 + initialDelaySeconds: 10 + periodSeconds: 30 + readinessProbe: + httpGet: + path: /health + port: 5300 + initialDelaySeconds: 5 + periodSeconds: 10 --- apiVersion: v1 kind: Service metadata: - name: intranet + name: intranet-web namespace: intranet + labels: + app.kubernetes.io/part-of: bluejay-infra spec: - ports: - - name: http - port: 80 - targetPort: 80 selector: - app: intranet ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: intranet-tls - namespace: intranet -spec: - dnsNames: - - intranet.iamworkin.lan - issuerRef: - kind: ClusterIssuer - name: step-ca-acme - secretName: intranet-tls + app: intranet-web + ports: + - port: 5300 + targetPort: 5300 + name: http --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: intranet namespace: intranet + labels: + app.kubernetes.io/part-of: bluejay-infra spec: entryPoints: - - websecure + - websecure routes: - - kind: Rule - match: Host(`intranet.iamworkin.lan`) - services: - - name: intranet - port: 80 + - match: Host(`intranet.iamworkin.lan`) + kind: Rule + services: + - name: intranet-web + port: 5300 tls: - secretName: intranet-tls + certResolver: step-ca