From 848288af7a18b3390379d666275e2581af46493c Mon Sep 17 00:00:00 2001 From: Claude Code Date: Sun, 22 Mar 2026 01:28:57 -0500 Subject: [PATCH] =?UTF-8?q?Fix=20Traefik=20dashboard=20link=20=E2=80=94=20?= =?UTF-8?q?point=20to=20:8080/dashboard/=20not=20catchall=20404?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- apps/intranet/intranet.yaml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/apps/intranet/intranet.yaml b/apps/intranet/intranet.yaml index ce89da1..ecf9367 100644 --- a/apps/intranet/intranet.yaml +++ b/apps/intranet/intranet.yaml @@ -21,18 +21,18 @@ data: >copy (double NAT intentional)\nPublic /28 Block74.40.140.16/28 \nGateway74.40.140.30 \nUsable Range74.40.140.17 – 74.40.140.29 (13 IPs)\n\n\n
ISP /28 Routing: FULLY OPERATIONAL. Public subnet (74.40.140.16/28) is live. 13 VIPs on WAN (ix3), 12 hybrid outbound NAT rules, 28 port forwards. Cloudflare DNS with 28+ A records pointing to /28 IPs. DDNS: gateway.iamwork.in updates pfSense WAN DHCP IP via Cloudflare API.
\n

Modem Static Routes

\n\n\n\n\n\n\n
NameDestinationGatewayInterface
pfSense-Public-2874.40.140.16/28192.168.254.122LAN
pfSense-Private-Subnets10.0.0.0/8192.168.254.122LAN
\n

Public IP Allocation (13 usable)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IPFull AddressAssignmentVLAN(s)Services
.1674.40.140.16Network address—Unusable
.1774.40.140.17 ANDREW + VPN60Andrew tenant primary + VPN :1194/:1195
.1874.40.140.18 ANDREW #260Andrew secondary
.1974.40.140.19 MATT + VPN61Matt tenant primary + VPN :1194/:1195
.2074.40.140.20 MATT #261Matt secondary
.2174.40.140.21 DUSTIN + VPN62Dustin tenant primary + VPN :1194/:1195
.2274.40.140.22 SIERRA (Dustin #2)62Dustin secondary
.2374.40.140.23 ERIK + VPN63Erik tenant primary + VPN :1194/:1195
.2474.40.140.24 PROD57K8s web + mail (flowercore.io, SMTP)
.2574.40.140.25 FIT + VPN69FIT tenant primary + VPN :1194/:1195
.2674.40.140.26 FIT #269FIT secondary
.2774.40.140.27 COMMS57TeamSpeak, IRC, Matrix
.2874.40.140.28 SHARED59,64,65,66,67WORK+SCHOOL+GUEST+VOIP+EMPLOYEE outbound
.2974.40.140.29 HOME58Home traffic + Nintendo Switch static port NAT
.3074.40.140.30Gateway (Frontier)—ISP router
.3174.40.140.31Broadcast—Unusable
\n\n\n\n
\n

pfSense Firewall

\n
\n
\n
Netgate 4100
\n \n
\n
\n
Firewall Stats
\n
    \n
  • Aliases: 36 (16 port, 5 host, 15 network)
    • \n
  • Rules: 90 active
    • \n
  • Policy: Air-gapped default — deny all, explicit allow
    • \n
  • SNMP: community \U0001F510 SNMP Community
    • \n
  • SNMP Modules: mibII, netgraph, pf, hostres, bridge
    • \n
\n
\n
\n
Services
\n
    \n
  • DNS: Unbound (DNSSEC, WAN-only outgoing, prefetch)
    • \n
  • DHCP: dhcpd on all 12 VLAN interfaces (.100-.199)
    • \n
  • NTP: ntpd on all VLAN interfaces, DHCP option 42
    • \n
  • Traffic Shaper: 24 dummynet pipes, fq_codel
    • \n
\n
\n
\n

VLAN Configuration (13 VLANs)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VLANNameSubnetDHCP RangeDown/Up (Mbps)PriorityPublic IP
56MGMT10.0.56.0/24.100-.199500 / 5005WAN DHCP
57PROD10.0.57.0/24.100-.199500 / 5005.24
58HOME10.0.58.0/24.100-.199800 / 8003.29
59EMPLOYEE10.0.59.0/24.100-.199500 / 5003.28 (shared)
60ANDREW10.0.60.0/24.100-.199300 / 3003.17
61MATT10.0.61.0/24.100-.199300 / 3003.19
62DUSTIN10.0.62.0/24.100-.199300 / 3003.21
63ERIK10.0.63.0/24.100-.199300 / 3003.23
64WORK10.0.64.0/24.100-.199500 / 5003.28 (shared)
65SCHOOL10.0.65.0/24.100-.199200 / 2001.28 (shared)
66GUEST10.0.66.0/24.100-.199100 / 501.28 (shared)
67VOIP10.0.67.0/24.100-.199100 / 1007.28 (shared)
69FIT10.0.69.0/24.100-.199300 / 3003.25
\n
Firewall Policy: MGMT has full access. HOME/WORK/SCHOOL get general internet. GUEST isolated except PROD web. Tenants fully isolated from each other — only PROD, DNS, NAS, and internet. VOIP is SIP-only outbound.
\n
\n\n\n
\n

Switching & WiFi

\n
\n
\n
UniFi Switch USW-Lite-16-PoE
\n \n
\n
\n
UniFi Cloud Key G2
\n \n
\n
\n
Synology RT6600AX (AP Mode)
\n \n
\n
\n
BlueJayNAS (Synology DS1621+)
\n
    \n
  • IP: nas.iamworkin.lan (HOME VLAN 58)
    • \n
  • DSM: https://nas.iamworkin.lan:5001
    • \n
  • Credentials: \U0001F510 BlueJayNAS
    • \n
  • Storage: 9.1 TB Btrfs (RAID)
    • \n
  • NFS Exports: Longhorn backup, shared media, ISO library
    • \n
  • SNMP: Enabled (Zabbix monitored)
    • \n
  • Zabbix: Host monitored via SNMP v2c
    • \n
  • Switch Port: 14 (Access, VLAN 58)
    • \n
\n
\n
\n

Switch Port Assignments

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PortDeviceModeVLANStatus
1pfSense UplinkTrunk (All)56-67UP
2rke2-agent2Trunk (All)56-67UP
3WiFi Uplink (Synology)Trunk, native 5857-67UP
4rke2-agent1Trunk (All)56-67UP
5Cloud Key G2Access56 (MGMT)UP (PoE)
6rke2-serverTrunk (All)56-67UP
7Available——Down
8noc1Trunk (All)56-67UP
9WorkstationAccess56 (MGMT)UP
10Available——Down
11edge2 (Pi 4)Access57 (PROD)UP
12Available——Down
13edge1 (Pi 5)Access57 (PROD)UP
14Synology NASAccess58 (HOME)UP
15Available——Down
16Synology 2Access58 (HOME)UP
\n

WiFi SSIDs

\n\n\n\n\n\n\n\n\n\n
SSIDBridgeVLANTypePassword
BlueJay-Homebr0untagged (58)Primary\U0001F510 BlueJay-Home WiFi
BlueJay-Employeebr259Custom\U0001F510 BlueJay-Employee WiFi
BlueJay-Workbr364Custom\U0001F510 BlueJay-Work WiFi
BlueJay-Schoolbr465Custom\U0001F510 BlueJay-School WiFi
BlueJay-Guestgbr066Guest (isolation+NAT)\U0001F510 BlueJay-Guest WiFi
\n
\n\n\n
\n

DNS Directory

\n
All entries are pfSense Unbound host overrides under iamworkin.lan. 52+ host overrides configured, plus 4 tenant wildcard redirect zones (*.bluejay.lan, *.timefortaco.lan, *.erik.lan, *.flowerinsider.lan → 10.0.56.200 Traefik).
\n

Management Devices

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
pfsense.iamworkin.lanpfsense.iamworkin.lan pfSense firewall
switch.iamworkin.lanswitch.iamworkin.lan UniFi PoE Switch
unifi.iamworkin.lanunifi.iamworkin.lan UniFi Cloud Key G2
wifi.iamworkin.lanwifi.iamworkin.lan Synology WiFi Router (AP)
nas.iamworkin.lannas.iamworkin.lan Synology NAS
\n

RKE2 Bare-Metal Cluster

\n\n\n\n\n\n\n\n
HostnameIPRole
rke2-server.iamworkin.lanrke2-server.iamworkin.lan RKE2 control plane (bare-metal, openSUSE Leap 16)
rke2-agent1.iamworkin.lanrke2-agent1.iamworkin.lan RKE2 worker node 1 (bare-metal, openSUSE Leap 16)
rke2-agent2.iamworkin.lanrke2-agent2.iamworkin.lan RKE2 worker node 2 (bare-metal, openSUSE Leap 16)
\n

NOC Services (noc1)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
noc1.iamworkin.lannoc1.iamworkin.lan NOC management node (K3s)
acme.iamworkin.lannoc1.iamworkin.lanstep-ca ACME CA
pki.iamworkin.lannoc1.iamworkin.lanPKI cert/CRL distribution
guac.iamworkin.lannoc1.iamworkin.lanApache Guacamole
grafana.iamworkin.lantraefik.iamworkin.lanGrafana monitoring (monitoring ns, noc1 Podman stopped 2026-03-18, K8s only)
prometheus.iamworkin.lantraefik.iamworkin.lanPrometheus metrics (monitoring ns, noc1 Podman stopped 2026-03-18, K8s only)
cockpit.iamworkin.lantraefik.iamworkin.lanCockpit web console (noc-proxy ns → noc1:9090)
traefik.iamworkin.lannoc1.iamworkin.lanTraefik dashboard (K3s, legacy)
op-connect.iamworkin.lannoc1.iamworkin.lan1Password Connect API (:8180)
\n

RKE2 Services (via Traefik at traefik.iamworkin.lan)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
rke2.iamworkin.lanrke2-server.iamworkin.lan RKE2 API server (bare-metal control plane)
rke2-traefik.iamworkin.lantraefik.iamworkin.lan Traefik LoadBalancer (MetalLB)
argocd.iamworkin.lantraefik.iamworkin.lanArgoCD GitOps (22 apps, all Healthy)
gitea.iamworkin.lantraefik.iamworkin.lanGitea Git hosting (SSH at MetalLB .201)
zabbix.iamworkin.lantraefik.iamworkin.lanZabbix monitoring (10 hosts, trapper at .203)
guac.iamworkin.lantraefik.iamworkin.lanApache Guacamole (17 connections)
irc.iamworkin.lantraefik.iamworkin.lanUnrealIRCd + Anope (ports 6667/6697/8067)
matrix.iamworkin.lantraefik.iamworkin.lanMatrix Synapse homeserver
element.iamworkin.lantraefik.iamworkin.lanElement Web (Matrix client)
intranet.iamworkin.lantraefik.iamworkin.lanLab intranet dashboard
pki.iamworkin.lantraefik.iamworkin.lanPKI cert/CRL distribution
mail.iamworkin.lantraefik.iamworkin.landocker-mailserver (SMTP at MetalLB .202)
telephony.iamwork.intraefik.iamworkin.lanFlowerCore.Telephony (:5100, Cloudflare origin cert)
telephony.iamworkin.lantraefik.iamworkin.lanFlowerCore.Telephony (internal, step-ca cert)
grafana.iamworkin.lantraefik.iamworkin.lanGrafana (monitoring ns, noc1 Podman stopped 2026-03-18, K8s only)
prometheus.iamworkin.lantraefik.iamworkin.lanPrometheus (monitoring ns, noc1 Podman stopped 2026-03-18, K8s only)
cockpit.iamworkin.lantraefik.iamworkin.lanCockpit (noc-proxy ns → noc1:9090)
\n

RKE2 MetalLB Service IPs

\n\n\n\n\n\n\n\n\n\n
IPServicePorts
traefik.iamworkin.lanTraefik Ingress80, 443, 8080, 6667, 6697
gitea-ssh.iamworkin.lanGitea SSH22
mail.iamworkin.lanMail SMTP25, 465, 587
zabbix-trapper.iamworkin.lanZabbix Trapper10051
ts.iamworkin.lanTeamSpeak9987/UDP, 30033, 10011
\n

Production / Edge Nodes

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
macmini.iamworkin.lanmacmini.iamworkin.lan Mac Mini build node (Xcode)
edge1.iamworkin.lanedge1.iamworkin.lan Pi 5 + Hailo AI HAT+ 2
edge2.iamworkin.lanedge2.iamworkin.lan Pi 4 (Argon ONE, CI runner)
piez.iamworkin.lanpiez.iamworkin.lan Pi 4 + EZ Connect (PiManager :5000, GPIO/I2C/SPI)
pirelay.iamworkin.lanpirelay.iamworkin.lan Pi 3 + 4-ch Relay (PiManager :5100, KS0212)
\n

Planned / Windows (pre-registered)

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
dc1.iamworkin.lan10.0.56.20 AD Domain Controller (planned)
wac1.iamworkin.lan10.0.56.21 Windows Admin Center (planned)
rds1.iamworkin.lan10.0.57.20 Remote Desktop Services (planned)
iis1.iamworkin.lan10.0.57.21 IIS Web Server (planned)
proxy.iamworkin.lan10.0.56.22 Squid Authenticated Proxy (planned)
\n
\n\n\n
\n

Kubernetes Clusters

\n

K3s (noc1 — Emergency Fallback, Scaled to 0)

\n
\n
\n
K3s on noc1 (Standby)
\n
    \n
  • Node: noc1.iamworkin.lan (single-node)
    • \n
  • Version: K3s v1.34.5
    • \n
  • Status: Scaled to 0 — emergency fallback only
    • \n
  • Migration: All workloads moved to RKE2 (2026-03-09)
    • \n
  • Tools: kubectl v1.35.2, helm v3.20.0
    • \n
\n
\n
\n

Harvester HCI (DECOMMISSIONED 2026-03-09)

\n
\n
\n
Harvester Cluster — Decommissioned
\n
    \n
  • Status: Decommissioned — replaced by bare-metal RKE2
    • \n
  • Reason: 6 K8s control planes caused 100°C thermal throttling
    • \n
  • Migration: All 3 NUCs reformatted to openSUSE Leap 16, bare-metal RKE2
    • \n
  • Result: Temps 44-71°C, 1 control plane instead of 6
    • \n
\n
\n
\n

RKE2 (Bare-Metal Cluster)

\n
\n
\n
RKE2 Cluster
\n
    \n
  • Version: RKE2 v1.34.5+rke2r1
    • \n
  • OS: openSUSE Leap 16.0 (bare-metal)
    • \n
  • CNI: Calico (VXLAN mode)
    • \n
  • Pod CIDR: 10.42.0.0/16
    • \n
  • Service CIDR:\ - \ 10.43.0.0/16
    • \n
  • Kubeconfig: /root/.kube/rke2.yaml on noc1 or WSL
    • \n
  • SSH: ed25519 key auth (root)
    • \n
\n
\n
\n
RKE2 Nodes (Bare-Metal)
\n
    \n
  • rke2-server: rke2-server.iamworkin.lan (i7-1260P / 64GB, control plane)
    • \n
  • rke2-agent1: rke2-agent1.iamworkin.lan (i7-1260P / 64GB, worker)
    • \n
  • rke2-agent2: rke2-agent2.iamworkin.lan (i5-1340P / 64GB, worker)
    • \n
  • SSH: root@10.0.56.{11,12,13} (ed25519 key)
    • \n
  • Puppet: profile::kubernetes::rke2 on all nodes
    • \n
\n
\n
\n
RKE2 Infrastructure
\n
    \n
  • MetalLB: L2 mode, pool 10.0.56.200-220
    • \n
  • Traefik: v3.3.4, 2 replicas, LB traefik.iamworkin.lan
    • \n
  • Longhorn: Default StorageClass (iSCSI), NAS backup integration
    • \n
  • Namespaces (33): fc-system, fc-tenant-{andrew,matt,dustin,erik,fit}, tenant-{andrew,dustin,erik,fit,flowercore}, traefik-system, metallb-system, argocd, irc, mail, matrix, zabbix, guacamole, gitea, teamspeak, onepassword-system, cert-manager, telephony, monitoring, selenium, agent-zero, intranet, pki, noc-proxy, longhorn-system, kube-system, calico-system, tigera-operator
    • \n
  • IngressRoutes: 44 Traefik routes (internal + Cloudflare public)
    • \n
  • PVCs: 17 persistent volumes, ~69 Gi total (Longhorn iSCSI, NAS backup)
    • \n
  • ArgoCD: 22 apps via bluejay-infra ApplicationSet (all Healthy — includes agent-zero, asterisk, monitoring, voice, 5 tenant landing pages, guacamole, mail, matrix, IRC, telephony, Gitea, Zabbix, PKI, intranet, noc-services)
    • \n
  • 1Password: Operator v1.11.0 in onepassword-system, 7 CRDs syncing
    • \n
  • Cloudflare Origin Certs: *.flowercore.io + *.iamwork.in (15-year RSA) deployed across 8 namespaces
    • \n
\n
\n
\n

Cluster Resource Usage (2026-03-21)

\n\n\n\n\n\n\n\n
NodeCPUMemoryPodsRole
rke2-server866m (5%)19,293 Mi (30%)~40Control plane + worker
rke2-agent1616m (3%)20,905 Mi (32%)~40Worker
rke2-agent21,430m (8%)17,517 Mi (27%)~40Worker (Selenium + telephony)
\n
Capacity: 192 GB total RAM (64 GB/node), ~30% utilized. Selenium Grid (4 pods) + ArgoCD (7 pods) + Longhorn (29 pods) are the biggest consumers. Prometheus at 10 Gi retention (90 days). All stateful workloads backed up to BlueJayNAS via Longhorn NFS.
\n\n

pfSense Static Routes (K8s)

\n\n\n\n\n\n\n
DestinationGatewayPurpose
10.42.0.0/16rke2-server.iamworkin.lan (rke2-server)Pod CIDR routing
10.43.0.0/16rke2-server.iamworkin.lan (rke2-server)Service CIDR routing
\n
\n\n\n
\n

NOC Services (noc1)

\n
\n
\n
noc1 Host
\n
    \n
  • IP: noc1.iamworkin.lan
    • \n
  • SSH: root@pfsense.iamworkin.lan0
    • \n
  • Password: \U0001F510 noc1
    • \n
  • OS: openSUSE Leap Micro 6.2 (immutable)
    • \n
  • CPU: Intel Celeron N5105 (4C/4T)
    • \n
  • RAM: 32 GB
    • \n
  • Disk: 1TB NVMe (929GB free)
    • \n
  • Runtimes: Podman 5.4.2, K3s v1.34.5
    • \n
\n
\n
\n

Service Directory

\n\n\n\n\n\n\n\n\n\n\n\n\n
ServiceURLPortCredentialsStatus
Cockpithttps://cockpit.iamworkin.lan443 (Traefik)\U0001F510 noc1Online
Prometheushttps://prometheus.iamworkin.lan
Also: https://prometheus.iamworkin.lan (noc1 direct)		443 (Traefik)No auth (90-day retention, 11 targets)Online
Grafanahttps://grafana.iamworkin.lan
Also: https://grafana.iamworkin.lan (noc1 direct)		443 (Traefik)\U0001F510 GrafanaOnline
Node Exporterhttp://noc1.iamworkin.lan:91009100Metrics onlyOnline
SNMP Exporterhttp://noc1.iamworkin.lan:91169116pfSense + NAS + Switch + Printer SNMP scraperOnline
step-ca ACMEhttps://acme.iamworkin.lan:94439443\U0001F510 step-caOnline
1Password Connecthttp://op-connect.iamworkin.lan:81808180/8181API token authOnline
Puppet Servernoc1:81408140OpenVox Server 8.12 (Podman)Online
\n

RKE2 Services (22 ArgoCD Apps — All Healthy)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ServiceURLMetalLB / PortCredentialsStatus
ArgoCDhttps://argocd.iamworkin.lan443 (via Traefik)\U0001F510 ArgoCDOnline
Traefikhttps://rke2-traefik.iamworkin.lan.200 — 80/443/8080/6667/6697Dashboard: :8080Online
Giteahttps://gitea.iamworkin.lan.201 SSH:22 — HTTPS via Traefik\U0001F510 GiteaOnline
Guacamolehttps://guac.iamworkin.lan443 (via Traefik)\U0001F510 Apache GuacamoleOnline
UnrealIRCd + Anopeirc.iamworkin.lan:6697 (TLS).200 — 6667/6697/8067\U0001F510 IRC ServicesOnline
Zabbixhttps://zabbix.iamworkin.lan.203 trapper — Web via Traefik\U0001F510 Zabbix MonitoringOnline
Mail (docker-mailserver)mail.iamworkin.lan.202 — SMTP 25/465/587\U0001F510 Mail ServerOnline
Matrix Synapsehttps://matrix.iamworkin.lan443 (via Traefik)\U0001F510 Matrix SynapseOnline
Element Webhttps://element.iamworkin.lan443 (via Traefik)Uses Matrix accountOnline
TeamSpeakts.iamworkin.lan.205 — 9987/UDP, 30033, 10011\U0001F510 TeamSpeakOnline
FlowerCore Landingflowercore.io443 (via Traefik, Cloudflare)Static pageOnline
PKI Webhttps://pki.iamworkin.lan443 (via Traefik)Public (CRL/certs)Online
Intranethttps://intranet.iamworkin.lan443 (via Traefik)Static pageOnline
Snappymailhttps://mail-web.iamworkin.lan443 (via Traefik)\U0001F510 SnappymailOnline
Telephonyhttps://telephony.iamworkin.lan5100 (via Traefik + Cloudflare)\U0001F510 TelephonyOnline
Asterisk PBXasterisk.iamworkin.lan:5060.207 — SIP 5060/UDP, RTP 10000-200004 PJSIP ext, Twilio trunkOnline
Agent Zerohttps://agent-zero.iamworkin.lan443 (via Traefik)\U0001F510 Agent ZeroOnline
1Password OperatorIn-cluster onlyonepassword-systemConnect tokenOnline
Selenium Gridhttps://selenium.iamworkin.lan443 (via Traefik)Hub + 2 Chrome + 1 FirefoxOnline
FlowerCore.Print.Webhttp://print.iamworkin.lan:52005200 (edge2 direct)12 pages, 9 symbologies, 10 MCPOnline
PiManager (piez)http://piez.iamworkin.lan:50005000 (piez direct)GPIO, I2C, SPI, 20 MCPOnline
PiManager (pirelay)http://pirelay.iamworkin.lan:51005100 (pirelay direct)4-ch relay, schedulingOnline
Frigate NVRhttp://edge1.iamworkin.lan:50005000 (edge1 direct)\U0001F510 FrigateOnline
\n

Monitoring

\n
\n
\n
Prometheus (noc1)
\n
    \n
  • Targets: 15 scrape jobs (node-exporter: noc1 + 3 RKE2 + 2 edge + piez + pirelay, SNMP: pfSense + Cloud Key + Switch + NAS + Printer, Blackbox: 4 AI stack probes, self)
    • \n
  • Alert Rules: 8 (NodeDown, PfSenseDown, HighCPU, HighMemory, DiskSpaceLow, +3)
    • \n
  • Config: /opt/monitoring/prometheus/prometheus.yml
    • \n
  • Reload: podman kill -s SIGHUP prometheus
    • \n
\n
\n
\n
Grafana (noc1:3000)
\n
    \n
  • Version: v12.4.0
    • \n
  • Dashboards: BlueJay Network Overview, Node Exporter Full (#1860), BlueJay Edge Nodes, BlueJay Operations (Prometheus+Zabbix unified) — all in BlueJay folder
    • \n
  • Datasources: Prometheus (http://localhost:9090), Zabbix (alexanderzobnin-zabbix-datasource v6.2.1)
    • \n
\n
\n
\n
Zabbix (RKE2) — 13 Hosts
\n
    \n
  • Agent Hosts (8): noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, piez, pirelay
    • \n
  • SNMP Hosts (3): pfSense, UniFi Switch, BlueJayNAS (DS1621+)
    • \n
  • SNMP Host (1): Epson ET-3750 EcoTank
    • \n
  • Local (1): Zabbix server self-check
    • \n
  • Agent Version: Zabbix Agent 2 v7.0.22–7.2.15 on all 8 Linux nodes
    • \n
  • Passive checks: Server= includes MetalLB VIP + RKE2 node IPs + pod CIDR
    • \n
  • Note: Mac Mini (macOS) pending Zabbix agent setup
    • \n
\n
\n
\n

Pi Fleet Services (FlowerCore.PiManager)

\n\n\n\n\n\n\n
DeviceURLPortCapabilitiesStatus
piez (Pi 4)http://piez.iamworkin.lan:50005000GPIO, I2C, SPI, Expanders (MCP23017/PCF8574/74HC595) — 10 pages, 35 API, 20 MCPOnline
pirelay (Pi 3)http://pirelay.iamworkin.lan:510051004-ch relay (KS0212, active-LOW), scheduling, usage tracking — 8 pages, relay APIOnline
\n
PiManager: Unified .NET 10 service deployed to both Pi nodes with different ASPNETCORE_ENVIRONMENT overlays. Config-driven capabilities — same binary, different features per device. Supports relay presets: ks0212-4ch, walfront-16ch, sainsmart-8ch. API docs at /scalar/v1 on each node.
\n\n

Guacamole Connection Groups (14 connections)

\n\n\n\n\n\n\n\n\n
GroupConnectionsProtocol
Kubernetes (3)rke2-server, rke2-agent1, rke2-agent2SSH
Network Devices (4)pfSense, UniFi Cloud Key, Synology WiFi (SRM), BlueJayNASSSH
Servers (3)noc1, Mac Mini (SSH), Mac Mini (VNC)SSH/VNC
Edge Nodes (4)edge1 (Pi 5 + AI), edge2 (Pi 4), piez (Pi 4 + EZ Connect), pirelay (Pi 3 + Relay)SSH
\n
Guacamole credentials: All connection passwords are stored in the Guacamole MySQL database (synced from 1Password). Access at https://guac.iamworkin.lan — \U0001F510 Apache Guacamole
\n
\n\n\n
\n

VPN & Security

\n
OpenVPN Status: 8 servers configured and operational. Bound to tenant VIPs (.17, .19, .21, .23, .25). Each tenant has TUN (L3 routed) and TAP (L2 bridged) instances on ports 1194/1195 UDP.
\n

OpenVPN Configuration

\n\n\n\n\n\n\n\n\n\n
TenantVIPTUN PortTAP PortTunnel (TUN)Tunnel (TAP)VLAN
ANDREW.171194/UDP1195/UDP10.0.68.0/2710.0.68.128/2760
MATT.191194/UDP1195/UDP10.0.68.32/2710.0.68.160/2761
DUSTIN.211194/UDP1195/UDP10.0.68.64/2710.0.68.192/2762
ERIK.231194/UDP1195/UDP10.0.68.96/2710.0.68.224/2763
FIT.251194/UDP1195/UDP10.0.69.0/2710.0.69.128/2769
\n

VPN Certificate Infrastructure

\n\n\n\n\n\n\n\n\n\n
ComponentDetails
CABlueJay VPN CA (4096-bit RSA, SHA-256, 10-year)
Server Certs8 (one per VPN instance, 2048-bit RSA)
Client Certs4 (one per tenant, 2048-bit RSA)
TLS AuthShared HMAC key across all servers
Data CiphersAES-256-GCM, AES-128-GCM, CHACHA20-POLY1305
\n

IPsec Site-to-Site (Planned)

\n\n\n\n\n\n\n
TunnelLocalRemotePhase 1Phase 2 SAs
Matt.29 (pfSense WAN)Matt's public IPIKEv2, AES-256-GCM, DH 14+MATT (10.0.61.0/24) + PROD (10.0.57.0/24)
Dustin.29 (pfSense WAN)Dustin's public IPIKEv2, AES-256-GCM, DH 14+DUSTIN (10.0.62.0/24) + PROD (10.0.57.0/24)
\n

Security Policies

\n
\n
\n
Cloudflare Protection
\n
    \n
  • SSL Mode: Full (strict) on all 6 zones
    • \n
  • Origin Certs: *.flowercore.io + *.iamwork.in (15-year RSA), deployed across 8 K8s namespaces
    • \n
  • HSTS: Enabled on all zones
    • \n
  • Min TLS: 1.2
    • \n
  • Anti-spoofing: null MX, SPF -all, DMARC reject on non-email domains
    • \n
  • Cloudflare-only inbound: Port forwards for 80/443 restrict source to Cloudflare IP ranges
    • \n
\n
\n
\n
SSH Key Policy
\n
    \n
  • Key Type: ed25519 (deployed to all 9 physical nodes)
    • \n
  • WSL Key: stoltz@IAMWORKIN-WS — deployed to noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, piez, pirelay, Mac Mini
    • \n
  • noc1 Key: noc1-root + rke2@bluejay — management keys for remote nodes
    • \n
  • Root Login: Key-only (PermitRootLogin without-password)
    • \n
  • RKE2 Nodes: SELinux enforcing, chcon -t ssh_home_t on authorized_keys
    • \n
  • Last verified: 2026-03-21 (all 9 nodes confirmed)
    • \n
\n
\n
\n
Network Security Rules
\n
    \n
  • Forced DNS: HOME/WORK/SCHOOL/GUEST block port 53 except to gateway
    • \n
  • Blocked SMTP: Outbound 25/465/587 on HOME/WORK/SCHOOL/GUEST
    • \n
  • Firewall Policy: Deny-all default, explicit allow per VLAN
    • \n
  • Tenant Isolation: Tenants fully isolated from each other, only PROD + DNS + NAS + internet
    • \n
\n
\n
\n

PKI Hierarchy

\n\n\n\n\n\n\n\n\n\n
CAStatusPurpose
Root CA (IAmWorkin ACME CA)OperationalTrust anchor, ECDSA P-256, expires 2036
ACME CA (step-ca on noc1)OperationalAutomated cert issuance via ACME protocol
Network CAPlannedSwitch, AP, pfSense device certs
Windows AD CS CAPlannedDomain-joined machine/user certs
Internal Services CAPlannedK8s service mesh, inter-service mTLS
\n
\n\n\n
\n

Remote Access — Blue Jay Gateway

\n
Apache Guacamole with Blue Jay branding, 1Password vault integration, K8s exec, and embedded panels. All credentials resolved from 1Password at connection time — no passwords stored in Guacamole.
\n\n
\n
\n
Guacamole Web UI
\n
    \n
  • URL: guac.iamworkin.lan
    • \n
  • Version: 1.6.0 + Blue Jay branding
    • \n
  • Admin: Guacamole
    • \n
  • K8s: guacamole namespace
    • \n
  • Ingress: Traefik → guacamole:8080 (WebSocket)
    • \n
  • ArgoCD: infra-guacamole
    • \n
\n
\n
\n
Extensions
\n
    \n
  • Blue Jay Branding — Full dark theme, custom login, logo
    • \n
  • 1Password Vault — ${VAULT_PASSWORD} token resolution
    • \n
  • TOTP MFA — Required for all users
    • \n
  • Auth Ban — 5 failures = 5min IP ban
    • \n
  • JSON Auth — Signed tokens for embedded panels
    • \n
  • Time Restrict — Per-connection time windows
    • \n
  • Recording Storage — NFS (Synology) playback
    • \n
  • Display Statistics — Performance metrics
    • \n
\n
\n
\n
1Password Integration
\n
    \n
  • Connect URL: onepassword-connect:8080 (K8s internal)
    • \n
  • Vault: IAmWorkin (qaphopopkryhbg353ukzhhuqoq)
    • \n
  • Token: Via OnePasswordItem CRD
    • \n
  • Rotation: Automatic — change in 1Password, Guacamole picks up on next connect
    • \n
  • Cache TTL: 5 minutes
    • \n
\n
\n
\n
Session Recording
\n
    \n
  • Storage: NFS on Synology (/volume1/guacamole/recordings)
    • \n
  • PVC: guacamole-recordings-pvc (50 Gi)
    • \n
  • Format: Guacamole native (playable in browser)
    • \n
  • Retention: Linked to connection history
    • \n
\n
\n
\n\n

Connection Inventory (${VAULT_*} tokens — no hardcoded passwords)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ConnectionProtocolHostVLAN1Password Item
MGMT (VLAN 56) — Infrastructure
pfSense — SSHSSHpfsense.iamworkin.lan56pfSense Admin
Cloud Key — SSHSSHunifi.iamworkin.lan56UniFi CloudKey
UniFi Switch — SSHSSHswitch.iamworkin.lan56UniFi CloudKey
noc1 — SSHSSHnoc1.iamworkin.lan56noc1 Root SSH
rke2-server — SSHSSHrke2-server.iamworkin.lan56RKE2 Server
rke2-agent1 — SSHSSHrke2-agent1.iamworkin.lan56RKE2 Agent 1
rke2-agent2 — SSHSSHrke2-agent2.iamworkin.lan56RKE2 Agent 2
PROD (VLAN 57) — Production
edge1 (Pi 5) — SSHSSHedge1.iamworkin.lan57Edge1 Pi5 SSH
edge2 (Pi 4) — SSHSSHedge2.iamworkin.lan57Edge2 Pi4 SSH
Mac Mini — SSHSSHmacmini.iamworkin.lan57Mac Mini
Mac Mini — VNCVNCmacmini.iamworkin.lan57Mac Mini
HOME (VLAN 58) — Home Network
Synology NAS — SSHSSHnas.iamworkin.lan58Synology NAS
Synology WiFi — SSHSSHwifi.iamworkin.lan58Synology SRM
piez (Pi 4) — SSHSSHpiez.iamworkin.lan58PiEZ SSH
pirelay (Pi 3) — SSHSSHpirelay.iamworkin.lan58PiRelay SSH
Kubernetes — Pod Exec (auto-synced every 2min)
argocd-serverK8Skubernetes.default.svc—(ServiceAccount)
gitea-0K8Skubernetes.default.svc—(ServiceAccount)
asteriskK8Skubernetes.default.svc—(ServiceAccount)
zabbix-serverK8Skubernetes.default.svc—(ServiceAccount)
synapseK8Skubernetes.default.svc—(ServiceAccount)
unrealircdK8Skubernetes.default.svc—(ServiceAccount)
\n\n

Embedded Panel (Quick SSH)

\n
The embedded panel below uses guacamole-common-js to connect directly to Guacamole's tunnel servlet. Requires authentication to guac.iamworkin.lan first.
\n
\n
\n
\n \n noc1 — SSH Terminal\n Open in Guacamole →\n
\n
\n

Connect via Blue Jay Remote Access to use the embedded terminal.
\n Requires bluejay-guac-embed.js and guacamole-common-js

\n
\n
\n
\n\n

Deployment Details

\n\n\n\n\n\n\n\n\n
ComponentImageReplicasResources
guacamole (Tomcat)fc-guacamole:1.6.0-bluejay1200m-1 CPU, 512Mi-1Gi
guacd (C proxy)guacamole/guacd:1.6.01200m-2 CPU, 256Mi-1Gi
MySQL 8mysql:8.01 (StatefulSet)100m-500m CPU, 256-512Mi
K8s Sync CronJobbitnami/kubectl:1.34every 2minminimal
\n\n

Files Reference

\n\n\n\n\n\n\n\n\n\n\n\n\n
ArtifactPath
Design plandocs/infrastructure/guacamole-customization-plan.md
K8s manifestsk8s/guacamole/*.yaml
Branding extensionk8s/guacamole/extensions/bluejay-branding/
1Password vault extensionk8s/guacamole/extensions/1password-vault/
Embed libraryk8s/guacamole/scripts/bluejay-guac-embed.js
Dockerfilek8s/guacamole/Dockerfile
Bootstrap scriptk8s/guacamole/scripts/bootstrap-connections.sh
Build/deploy scriptk8s/guacamole/scripts/build-image.sh
\n
\n\n\n
\n

Edge Nodes

\n
\n
\n
edge1 — Raspberry Pi 5 + Hailo AI
\n
    \n
  • IP: edge1.iamworkin.lan (PROD VLAN 57)
    • \n
  • SSH: stoltz@edge1.iamworkin.lan
    • \n
  • Password: \U0001F510 Edge1 Pi5 SSH
    • \n
  • Hardware: Pi 5 16GB + Hailo-10H 40 TOPS (AI HAT+ 2)
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • PCIe: Gen 3 x1 (8.0 GT/s)
    • \n
  • Power: 27W USB-C
    • \n
  • .NET SDK: 10.0.103
    • \n
  • GitHub Runner: v2.332.0 (labels: pi5, hailo)
    • \n
  • Node Exporter: :9100
    • \n
  • Puppet: profile::edge_ai
    • \n
  • Zabbix Agent: v7.2.15 (passive, port 10050)
    • \n
  • Switch Port: 13
    • \n
  • Disk: 93% (2.0GB free)
    • \n
\n
\n
\n
edge2 — Raspberry Pi 4 (Argon ONE)
\n
    \n
  • IP: edge2.iamworkin.lan (PROD VLAN 57)
    • \n
  • SSH: stoltz@edge2.iamworkin.lan
    • \n
  • Password: \U0001F510 Edge2 Pi4 SSH
    • \n
  • Hardware: Pi 4 Model B 4GB, Argon ONE case
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Fan Control: argononed.service (55°C=10%, 60°C=55%, 65°C=100%)
    • \n
  • .NET SDK: 10.0.103
    • \n
  • Print Service: LIVE FlowerCore.Print.Web :5200 (12 pages, 9 symbologies, AI barcode)
    • \n
  • GitHub\ - \ Runners: v2.332.0 — MySQL (edge2-mysql), PHP (edge2-php)
    • \n
  • Node Exporter: :9100
    • \n
  • Puppet: profile::edge_runner
    • \n
  • Zabbix Agent: v7.2.15 (passive, port 10050)
    • \n
  • Switch Port: 11
    • \n
  • Guacamole: SSH connection in Edge Nodes group
    • \n
\n
\n
\n
piez — Raspberry Pi 4 + EZ Connect
\n
    \n
  • IP: piez.iamworkin.lan (HOME VLAN 58, WiFi)
    • \n
  • SSH: stoltz@piez.iamworkin.lan
    • \n
  • Password: \U0001F510 piez SSH
    • \n
  • Hardware: Pi 4 Model B 4GB + Pi EZ Connect board
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Role: GPIO prototyping, breadboard dev, I2C/SPI sensors
    • \n
  • .NET SDK: 10.0.201
    • \n
  • Web: LIVE FlowerCore.PiManager :5000 (10 pages, 35 API endpoints, 20 MCP tools)
    • \n
  • API Docs: Scalar :5000/scalar/v1
    • \n
  • Capabilities: GPIO, I2C, SPI, Expanders (MCP23017/PCF8574/74HC595)
    • \n
  • Node Exporter: :9100
    • \n
  • Zabbix Agent: v7.0.22 (passive, port 10050)
    • \n
  • Guacamole: SSH connection in Edge Nodes group
    • \n
  • Dashboard: piez-prototyping.html
    • \n
\n
\n
\n
pirelay — Raspberry Pi 3 + 4-Ch Relay
\n
    \n
  • IP: pirelay.iamworkin.lan (HOME VLAN 58)
    • \n
  • SSH: stoltz@pirelay.iamworkin.lan
    • \n
  • Password: \U0001F510 pirelay SSH
    • \n
  • Hardware: Pi 3 Model B v1.2, 906 MB RAM + Keyestudio KS0212 4-channel relay shield
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Role: Relay controller, home automation prototyping
    • \n
  • Web: LIVE FlowerCore.PiManager :5100 (relay preset: ks0212-4ch)
    • \n
  • API Docs: Scalar :5100/scalar/v1
    • \n
  • GPIO (BCM, active-LOW): CH1=GPIO4, CH2=GPIO22, CH3=GPIO6, CH4=GPIO26
    • \n
  • Relay Ratings: 10A @ 250VAC / 30VDC per channel
    • \n
  • Node Exporter: :9100
    • \n
  • Zabbix Agent: v7.0.22 (passive, port 10050)
    • \n
  • Guacamole: SSH connection in Edge Nodes group
    • \n
  • Dashboard: relay-controller.html
    • \n
\n
\n
\n
Mac Mini (Build/Test Node)
\n
    \n
  • IP: macmini.iamworkin.lan (PROD VLAN 57)
    • \n
  • SSH: bluejay@macmini.iamworkin.lan
    • \n
  • Credentials: \U0001F510 Mac Mini
    • \n
  • VNC: vnc://macmini.iamworkin.lan:5900 — \U0001F510 Mac Mini
    • \n
  • Hardware: Apple M1, 16GB RAM, 926GB SSD
    • \n
  • OS: macOS 26.3.1 (Darwin 25.3.0)
    • \n
  • Role: Xcode builds, Selenium Grid node, automated browser/app testing
    • \n
  • Guacamole: SSH + VNC connections in Servers group
    • \n
\n
\n
\n\n

Edge2 — Print Service

\n
\n
\n
FlowerCore.Print.Web
\n
    \n
  • URL: http://print.iamworkin.lan:5200
    • \n
  • Pages: 12 Blazor pages (barcode gen, batch print, product cache, AI labels)
    • \n
  • Symbologies: 9 (Code128, EAN-13, QR, DataMatrix, ITF-14, UPC-A/E, Code39, Codabar)
    • \n
  • Features: Product cache DB, AI label generation (Ollama on Pi), batch barcodes, combo labels
    • \n
  • MCP Tools: 10 tools for programmatic barcode/label generation
    • \n
  • Thermal Printer: Connected Epson ET-3750 (printer.iamworkin.lan)
    • \n
  • systemd: flowercore-print.service (auto-start)
    • \n
\n
\n
\n\n

Edge1 AI & Speech Services

\n
\n
\n
Ollama (LLM Inference)
\n
    \n
  • API: http://edge1.iamworkin.lan:11434
    • \n
  • Model: qwen2.5-coder:7b (4.7GB Q4_K_M)
    • \n
  • Managed by: profile::edge::ollama (Puppet)
    • \n
  • Firewall: nftables port 11434 from MGMT+PROD
    • \n
  • Note: SD card 95% full — one model max
    • \n
\n
\n
\n
Piper TTS (Text-to-Speech)
\n
    \n
  • Version: piper-tts 1.4.1 in ~/piper-env venv
    • \n
  • Voices: en_US-amy-low (16kHz) + en_US-amy-medium (22kHz)
    • \n
  • Performance: RTF 0.10 (10x real-time), 222ms latency (short)
    • \n
  • CPU Usage: 3/4 cores (271%)
    • \n
  • Note: 16kHz matches G.711 natively for telephony
    • \n
\n
\n
\n
Hailo Whisper STT (Speech-to-Text)
\n
    \n
  • Model: Whisper-Base HEF (131MB, v5.1.1)
    • \n
  • Path: /opt/hailo-models/Whisper-Base.hef
    • \n
  • Performance: RTF 0.05-0.11 (10-18x real-time)
    • \n
  • Model Load: 1.2s cold start
    • \n
  • Multi-process: VDevice for coexistence with Frigate
    • \n
\n
\n
\n
Speech Pipeline Service
\n
    \n
  • API: http://edge1.iamworkin.lan:8500
    • \n
  • Endpoints: POST /tts, POST /stt, GET /health
    • \n
  • User: speech in hailo group
    • \n
  • Managed by: profile::edge::speech_pipeline (Puppet)
    • \n
  • Firewall: nftables port 8500 from MGMT+PROD
    • \n
\n
\n
\n
Twilio Voice Bridge (PoC)
\n
    \n
  • Location: /opt/twilio-bridge/ on edge1
    • \n
  • WebSocket: :8765 • TwiML: :8766
    • \n
  • Cloudflare Tunnel: bluejay-voice (3ddfa567-b0a7-40cb-9c57-7f20f3ec3637)
    • \n
  • URLs: voice.bluejay.dev (TwiML), voice-ws.bluejay.dev (WS)
    • \n
  • Services: cloudflared-tunnel on noc1, twilio-bridge + twilio-twiml on edge1
    • \n
  • Status: PoC — STT fixed, TTS stream API mismatch
    • \n
\n
\n
\n
\n\n\n
\n

Storage

\n
\n
\n
BlueJayNAS — Synology DS1621+
\n
    \n
  • IP: nas.iamworkin.lan (HOME VLAN 58, switch port 14)
    • \n
  • DNS: nas.iamworkin.lan, synology.iamworkin.lan
    • \n
  • DSM: https://nas.iamworkin.lan:5001 (v7.3.2-86009 Update 1)
    • \n
  • SSH: bluejay@nas.iamworkin.lan
    • \n
  • Credentials: \U0001F510 BlueJayNAS
    • \n
  • Model: DS1621+ (6-bay, AMD Ryzen V1500B)
    • \n
  • Storage: 9.1 TB Btrfs (RAID), ~7.8 TB free
    • \n
  • MAC: 00:11:32:f2:43:6b
    • \n
  • TLS Cert: ca.iamworkin.lan (step-ca ACME, expires 2026-06-03)
    • \n
  • NFS Domain: private.iamwork.in
    • \n
  • 2FA: TOTP enabled on DSM
    • \n
\n
\n
\n
NFS Exports & Services
\n
    \n
  • Longhorn Backup: nfs://nas.iamworkin.lan:/volume1/NetBackup/longhorn-backups
    • \n
  • Kubernetes Shared: /volume1/kubernetes (NFS mount for PVCs)
    • \n
  • Selenium Screenshots: /volume1/selenium/screenshots (AAT visual tests via PVC)
    • \n
  • Selenium Videos: /volume1/selenium/videos (test recordings)
    • \n
  • NFS Permissions: RKE2 nodes rke2-server/agent1/agent2 (MGMT VLAN cross-VLAN rule)
    • \n
  • Ports: NFS (2049), iSCSI (3260, no targets yet), DSM API (5001), SSH (22), SNMP (161)
    • \n
  • pfSense Rule: RKE2 → NAS on 2049/3260/5001
    • \n
\n
\n
\n
Monitoring & Security
\n
    \n
  • SNMP: v2c community \U0001F510 SNMP
    • \n
  • Zabbix Host: BlueJayNAS (ID 10678) — Linux by SNMP template
    • \n
  • Prometheus: SNMP scrape via snmp-exporter (synology module)
    • \n
  • Auto Block: Enabled (brute-force protection)
    • \n
  • DSM Firewall: DO NOT ENABLE — synofirewall segfaults on 7.3.2, causes lockout
    • \n
  • admin account: ENABLED — never disable (breaks all admin-group privileges)
    • \n
  • SSH: Keep PasswordAuthentication yes (disabling breaks sudo/PAM)
    • \n
  • Guacamole: SSH connection in Network Devices group
    • \n
\n
\n
\n
Recovery Notes
\n
    \n
  • admin disabled recovery: Physical RESET button (4s hold, 1 beep) + power cycle
    • \n
  • Firewall lockout: Physical RESET (same procedure)
    • \n
  • Security hardening: Use pfSense cross-VLAN rules, NOT DSM-level firewall/SSH hardening
    • \n
  • CLI tools: /usr/syno/bin/synopkg, /usr/syno/sbin/synouser, /usr/syno/sbin/synogroup
    • \n
  • DSM API: https://nas.iamworkin.lan:5001/webapi/entry.cgi — SYNO.API.Auth + otp_code for 2FA
    • \n
\n
\n
\n\n

Longhorn Persistent Volume Claims (17 PVCs, ~69 Gi)

\n
Longhorn → NAS Backup: Longhorn is the default StorageClass on the RKE2 cluster (iSCSI). All 17 PVCs backed up to BlueJayNAS via NFS. Daily backups at 02:00 UTC (retain 14 days), hourly snapshots (retain 24).
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
NamespacePVCSizePurpose
monitoringprometheus-data + grafana-data12 GiPrometheus TSDB (90-day retention) + Grafana dashboards/DB
zabbixzabbix-postgres-data10 GiZabbix PostgreSQL (13 hosts, history/trends)
giteagitea-shared-storage10 GiGit repositories, LFS objects, attachments
telephonyasterisk-data + telephony-data10 GiAsterisk PBX config + FlowerCore.Telephony DB
matrixmatrix-postgres-data + synapse-data7 GiMatrix Synapse PostgreSQL + media store
mailmail-data + mail-state6 Gidocker-mailserver (Postfix queues, Dovecot mail)
agent-zeroagent-zero-data + knowledge6 GiAgent Zero persistent data + FAISS knowledge base
guacamoleguac-mysql-data5 GiGuacamole MySQL (14 connections, session history)
ircanope-data + unrealircd-data2 GiIRC services DB (channels, nicks) + UnrealIRCd config
teamspeakteamspeak-data1 GiTeamSpeak virtual server config + file transfers
\n\n\n\n\n\n\n\n\n\n
ComponentDetail
Storage BackendLonghorn (iSCSI, default StorageClass, 3 replicas per volume)
Backup Targetnfs://nas.iamworkin.lan:/volume1/NetBackup/longhorn-backups
Backup ScheduleDaily at 02:00 UTC (retain 14 days), hourly snapshots (retain 24)
RKE2 Requirementiscsid enabled on all nodes (systemctl enable --now iscsid)
Managed byPuppet profile::kubernetes::rke2 (prerequisites, kernel modules, sysctl)
\n\n

Synology CSI Driver (Pending)

\n
Status: Helm repo added, deployment pending. Will enable dynamic PVC provisioning directly from Synology NFS/iSCSI.
\n\n\n\n\n\n\n\n\n\n
ComponentDetail
DriverSynologyOpenSource/synology-csi v1.2.1
Helm Chartchristian-schlichtherle, v0.11.0
ProtocolsNFS, iSCSI, SMB
Service Accountk8s-csi (UID 1032) on BlueJayNAS
1Password\U0001F510 Synology CSI creds
\n
\n\n\n
\n

WiFi Networks

\n
Credentials: All WiFi passwords are stored in the IAmWorkin vault on 1Password. To connect a device, open the 1Password app, find the WiFi entry, and scan the QR code from there. Passwords are not stored in this page for security.
\n
QR Code Connection: Open 1Password → search for the SSID name → tap “Show QR Code” → scan with your device camera. The QR code encodes the full WIFI:T:WPA;S:{SSID};P:{PASSWORD};;; connection string.
\n\n
\n \n
\n
\n
BlueJay-Home
\n
HOME (VLAN 58)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Home\n
\n
\n VLAN\n 58 (untagged on AP)\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n Home network — personal / family use\n
\n
\n Bandwidth\n 800 / 800 Mbps\n
\n
\n Public IP\n 74.40.140.29\n
\n
\n
\n\n \n
\n
\n
BlueJay-Employee
\n
EMPLOYEE (VLAN 59)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Employee\n
\n
\n VLAN\n 59\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n Employee network — staff device access\n
\n
\n Bandwidth\n 500 / 500 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-Work
\n
WORK (VLAN 64)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Work\n
\n
\n VLAN\n 64\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n Work network — business devices\n
\n
\n Bandwidth\n 500 / 500 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-School
\n
SCHOOL (VLAN 65)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-School\n
\n
\n VLAN\n 65\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n \U0001F510 Open in 1Password\n
\n
\n Purpose\n School network — student devices\n
\n
\n Bandwidth\n 200 / 200 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-Guest
\n
GUEST (VLAN 66)
\n
\n
\n
\n \n \n \n \n \n Open network — no password required\n
\n
\n
\n
\n SSID\n BlueJay-Guest\n
\n
\n VLAN\n 66\n
\n
\n Security\n Open / Captive Portal\n
\n
\n Password\n None (open)\n
\n
\n Purpose\n Guest WiFi — fully isolated, NAT only\n
\n
\n Bandwidth\n 100 / 50 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n
\n\n

WiFi Access Point

\n
\n
\n
Synology RT6600AX (AP Mode)
\n \n
\n
\n\n
Network Isolation: Each SSID maps to a separate VLAN with independent firewall rules and bandwidth limits. GUEST is fully isolated with NAT — no access to internal resources. EMPLOYEE, WORK, and SCHOOL share public IP .28 with traffic shaping.
\n
\n\n\n
\n

Credentials & 1Password

\n
\n
\n
1Password Connect Server
\n
    \n
  • API: http://op-connect.iamworkin.lan:8180
    • \n
  • Sync: http://op-connect.iamworkin.lan:8181
    • \n
  • Host: noc1 (Podman containers)
    • \n
  • Status: Online
    • \n
\n
\n
\n
1Password K8s Operator
\n
    \n
  • Namespace: onepassword-system
    • \n
  • Chart: 1password/connect v2.3.0
    • \n
  • Operator: v1.11.0
    • \n
  • Poll Interval: 600s
    • \n
  • Status: Online
    • \n
\n
\n
\n
IAmWorkin Vault
\n
    \n
  • Vault Name: IAmWorkin
    • \n
  • Items: 45+ items (infra credentials + WiFi QR codes + Pi device passwords)
    • \n
  • Rotation: Quarterly (Jan/Apr/Jul/Oct)
    • \n
  • Script: /opt/scripts/rotate-credentials.sh
    • \n
  • Timer: credential-rotation.timer
    • \n
\n
\n
\n\n
All infrastructure credentials are managed in 1Password. The IAmWorkin vault contains credentials for every service listed on this intranet. K8s workloads (Zabbix, Matrix, Guacamole, Mail, IRC, Gitea, ArgoCD) sync secrets automatically via OnePasswordItem CRDs. Credential rotation runs quarterly via systemd timer.
\n\n

K8s Secret Sync (OnePasswordItem CRDs)

\n\n\n\n\n\n\n\n\n\n\n\n
NamespaceSecret NameSource (1Password Item)Status
zabbixzabbix-credentialsZabbix MonitoringSynced
matrixmatrix-credentialsMatrix SynapseSynced
guacamoleguacamole-credentialsApache GuacamoleSynced
mailmail-credentialsMail ServerSynced
ircirc-credentialsIRC ServicesSynced
giteagitea-credentialsGiteaSynced
argocdargocd-credentialsArgoCDSynced
\n\n

Pi Fleet & Edge Node Credentials

\n\n\n\n\n\n\n\n\n\n
DeviceIPUser1Password ItemServices
edge1 (Pi 5)edge1.iamworkin.lanstoltz\U0001F510 Edge1 Pi5 SSHOllama, Piper TTS, Hailo STT, Frigate
edge2 (Pi 4)edge2.iamworkin.lanstoltz\U0001F510 Edge2 Pi4 SSHGitHub Actions runners
piez (Pi 4)piez.iamworkin.lanstoltz\U0001F510 piezPiManager :5000 (GPIO, I2C, SPI)
pirelay (Pi 3)pirelay.iamworkin.lanstoltz\U0001F510 pirelayPiManager :5100 (4-ch relay)
Mac Minimacmini.iamworkin.lanbluejay\U0001F510 Mac MiniSSH + VNC :5900, Xcode builds
\n\n

Credential Rotation

\n
\n
\n
Rotation Script
\n
    \n
  • Path: /opt/scripts/rotate-credentials.sh
    • \n
  • Usage: rotate-credentials.sh {service|all} [--dry-run]
    • \n
  • Services: grafana, guacamole, zabbix, argocd, gitea, snappymail, traefik, matrix, harvester (17/17 complete, all XKCD-style)
    • \n
  • Schedule: Quarterly (1st of Jan/Apr/Jul/Oct at 03:00 UTC)
    • \n
  • Log: /var/log/credential-rotation.log
    • \n
\n
\n
\n
\n\n\n
\n

Planned Services

\n
All previously planned services (Gitea, IRC, Zabbix, ArgoCD, 1Password, Mail, Matrix, TeamSpeak, Guacamole) are now live on RKE2. Remaining planned items are Windows Server VMs and authenticated proxy.
\n\n\n\n\n\n\n\n\n\n
ServiceIPHostRoleStatus
Windows DC110.0.56.20VM (hypervisor TBD)AD Domain Controller (iamworkin.lan)Planned
Windows WAC110.0.56.21VM (hypervisor TBD)Windows Admin CenterPlanned
Windows RDS110.0.57.20VM (hypervisor TBD)Remote\ - \ Desktop ServicesPlanned
Windows IIS110.0.57.21VM (hypervisor TBD)IIS Web ServerPlanned
Squid Proxy10.0.56.22VM (hypervisor TBD)Authenticated web proxy (Kerberos/LDAP)Planned
\n
\n\n\n
\n

Network Topology

\n
\n\n
Internet
\n
\n
Frontier ONT + NVG468MQ Modem

WAN: 74.32.185.184 • /28: .17-.29

192.168.254.254 • DMZ to pfSense

\n
\n
pfSense Netgate 4100

WAN: ix3 (.122) • LAN: igc0 (802.1Q trunk)

13 VLANs • 13 VIPs • 28 port forwards • DNS/DHCP/NTP/SNMP

\n
\n
UniFi USW-Lite-16-PoE Switch

switch.iamworkin.lan • 16 ports • VLANs 56-67

\n
\n\n
\n
\n
noc1
\n

noc1.iamworkin.lan MGMT

\n

Celeron N5105 • 32GB • K3s + Podman

\n
    \n
  • Grafana :3000
  • Prometheus :9091
    • \n
  • step-ca :9443
  • Cockpit :9090
    • \n
  • Puppet :8140
  • 1Password Connect :8180
    • \n
\n
\n
\n
RKE2 Bare-Metal Cluster
\n

Traefik: traefik.iamworkin.lan MGMT

\n
    \n
  • rke2-server: .11 (i7-1260P/64GB, control plane)
    • \n
  • rke2-agent1: .12 (i7-1260P/64GB, worker)
    • \n
  • rke2-agent2: .13 (i5-1340P/64GB, worker)
    • \n
\n

RKE2 v1.34.5 • Calico • MetalLB • Longhorn • Traefik v3.3.4 • ArgoCD • 11 apps • Asterisk PBX

\n
\n
\n
WiFi (Synology RT6600AX)
\n

wifi.iamworkin.lan HOME

\n
    \n
  • BlueJay-Home (untagged)
  • BlueJay-Employee (VLAN 59)
    • \n
  • BlueJay-Work (VLAN 64)
  • BlueJay-School (VLAN 65)
    • \n
  • BlueJay-Guest (VLAN 66)
    • \n
\n
\n
\n
PROD Nodes
\n

PROD VLAN 57

\n
    \n
  • Mac Mini: macmini.iamworkin.lan (Xcode)
    • \n
  • edge1 Pi5: edge1.iamworkin.lan (Hailo AI)
    • \n
  • edge2 Pi4: edge2.iamworkin.lan (CI runner)
    • \n
\n
\n
\n
HOME Pi Fleet
\n

HOME VLAN 58 • FlowerCore.PiManager

\n
    \n
  • piez Pi4: piez.iamworkin.lan (EZ Connect, GPIO/I2C/SPI) — :5000
    • \n
  • pirelay Pi3: pirelay.iamworkin.lan (KS0212 4-ch relay) — :5100
    • \n
  • Unified PiManager binary • config-driven • node-exporter • Zabbix
    • \n
\n
\n
\n
Network Devices & Storage
\n
    \n
  • Cloud Key: unifi.iamworkin.lan
    • \n
  • BlueJayNAS (DS1621+): nas.iamworkin.lan
    • \n
  • 9.1TB Btrfs • NFS • Longhorn backup • SNMP
    • \n
  • Modem: 192.168.254.254
    • \n
\n
\n
\n
\n
\n\n\n
\n

Domains

\n
\n
17
Registered Domains
\n
1
Internal Domain
\n
1
Blog Hosting (DreamHost)
\n
18
Total Domains
\n
\n\n

FlowerCore Domains

\n\n\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
flowercore.ioFlowerCoreAndrewProduction APICloudflareNamecheap
flowerinsider.xyzFlowerCoreAndrewDev/stagingCloudflareNamecheap
flowerinsider.comFlowerCore CoAndrewCompany siteNamecheapNamecheap
flowerinsider.nlFlowerCore CoAndrewDutch siteNamecheapNamecheap
\n\n

Work Domains

\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
iamwork.inWorkAndrewEmployee portal, IVR, TelephonyCloudflareNamecheap
iamworkin.comWorkAndrewRedirectNamecheapNamecheap
\n\n

Personal & Tenant Domains

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
ackeroni.comErikErikPersonalNamecheapNamecheap
erckak.comErikErikPersonalNamecheapNamecheap
erckak.devErikErikDeveloper portfolioCloudflareNamecheap
digirido.comRandomAndrewDigiKey testingNamecheapNamecheap
timeforta.coDustinDustinPersonalCloudflareNamecheap
shenanjia.comWifeWifePersonal siteNamecheapNamecheap
bluejay.apiPersonal FunAndrewAPI experimentsNamecheapNamecheap
bluejay.devPersonal FunAndrewDev projects, voice bridgeCloudflareNamecheap
jayblue.devPersonal FunAndrewDev projectsNamecheapNamecheap
z.orbRandomAndrewShort URLNamecheapNamecheap
\n\n

Blog & Content Domains

\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
pebbleandpeanut.comBlogAndrewPersonal blogDreamHostNamecheap
pebblesandpeanuts.comBlogAndrewAlt redirectNamecheapNamecheap
\n\n

Internal Domain

\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderNotes
iamworkin.lanInternalAndrewInternal infrastructure, future AD DSpfSense Unbound52+ host overrides + 4 wildcard redirect zones, not publicly registered
\n\n

Cloudflare (6 Zones)

\n
\n
\n
Cloudflare Account
\n
    \n
  • Account: Astoltz@iamwork.in
    • \n
  • Plan: Pro (planned)
    • \n
  • NS: dan.ns.cloudflare.com, frida.ns.cloudflare.com
    • \n
  • All Zones: SSL Full(strict), HSTS, min TLS 1.2
    • \n
  • API Tokens: \U0001F510 Cloudflare API Tokens
    • \n
\n
\n
\n
Active Zones
\n
    \n
  • flowercore.io — Production API, landing page
    • \n
  • iamwork.in — Employee portal, telephony, DDNS
    • \n
  • bluejay.dev — Dev projects, voice bridge
    • \n
  • erckak.dev — Erik developer portfolio
    • \n
  • timeforta.co — Dustin personal
    • \n
  • flowerinsider.xyz — Dev/staging
    • \n
\n
\n
\n

Namecheap API

\n
\n
\n
API Configuration
\n
    \n
  • Base URL: https://api.namecheap.com/xml.response
    • \n
  • API User: astoltz
    • \n
  • API Key: \U0001F510 Namecheap API
    • \n
  • Sandbox URL: https://api.sandbox.namecheap.com/xml.response
    • \n
\n
\n
\n
Dynamic DNS
\n
    \n
  • Hostname: gateway.iamwork.in
    • \n
  • Points to: pfSense WAN IP (auto-updated)
    • \n
  • DDNS: gateway.iamwork.in → pfSense WAN DHCP IP (via Cloudflare API)
    • \n
  • Update Method: pfSense Dynamic DNS client (Cloudflare API token)
    • \n
  • Token: \U0001F510 Cloudflare pfSense Token
    • \n
\n
\n
\n\n

Internal DNS Architecture

\n
Split-Horizon DNS (LIVE): External requests to flowercore.io resolve via Cloudflare to public IP .24 (PROD). Internal requests resolve via pfSense Unbound to K8s MetalLB VIP (10.0.56.200), avoiding NAT hairpin. All internal infrastructure uses iamworkin.lan zone. 4 tenant .lan wildcard redirect zones configured in Unbound (base64-encoded custom_options).
\n\n

Planned IPv6 (ULA)

\n\n\n\n\n\n
PrefixSchemeMethod
fdbc:56:XX::/64XX = VLAN ID (e.g., fdbc:56:56::/64 for MGMT)SLAAC + DHCPv6 (servers), SLAAC-only (clients)
\n
\n\n\n\n\n" + \ 10.43.0.0/16\n
  • Kubeconfig: /root/.kube/rke2.yaml on noc1 or WSL
    • \n
  • SSH: ed25519 key auth (root)
    • \n \n \n
    \n
    RKE2 Nodes (Bare-Metal)
    \n \n
    \n
    \n
    RKE2 Infrastructure
    \n \n
    \n\n

    Cluster Resource Usage (2026-03-21)

    \n\n\n\n\n\n\n\n
    NodeCPUMemoryPodsRole
    rke2-server866m (5%)19,293 Mi (30%)~40Control plane + worker
    rke2-agent1616m (3%)20,905 Mi (32%)~40Worker
    rke2-agent21,430m (8%)17,517 Mi (27%)~40Worker (Selenium + telephony)
    \n
    Capacity: 192 GB total RAM (64 GB/node), ~30% utilized. Selenium Grid (4 pods) + ArgoCD (7 pods) + Longhorn (29 pods) are the biggest consumers. Prometheus at 10 Gi retention (90 days). All stateful workloads backed up to BlueJayNAS via Longhorn NFS.
    \n\n

    pfSense Static Routes (K8s)

    \n\n\n\n\n\n\n
    DestinationGatewayPurpose
    10.42.0.0/16rke2-server.iamworkin.lan (rke2-server)Pod CIDR routing
    10.43.0.0/16rke2-server.iamworkin.lan (rke2-server)Service CIDR routing
    \n\n\n\n
    \n

    NOC Services (noc1)

    \n
    \n
    \n
    noc1 Host
    \n
      \n
    • IP: noc1.iamworkin.lan
      • \n
    • SSH: root@pfsense.iamworkin.lan0
      • \n
    • Password: \U0001F510 noc1
      • \n
    • OS: openSUSE Leap Micro 6.2 (immutable)
      • \n
    • CPU: Intel Celeron N5105 (4C/4T)
      • \n
    • RAM: 32 GB
      • \n
    • Disk: 1TB NVMe (929GB free)
      • \n
    • Runtimes: Podman 5.4.2, K3s v1.34.5
      • \n
    \n
    \n
    \n

    Service Directory

    \n\n\n\n\n\n\n\n\n\n\n\n\n
    ServiceURLPortCredentialsStatus
    Cockpithttps://cockpit.iamworkin.lan443 (Traefik)\U0001F510 noc1Online
    Prometheushttps://prometheus.iamworkin.lan
    Also: https://prometheus.iamworkin.lan (noc1 direct)    		443 (Traefik)No auth (90-day retention, 11 targets)Online
    Grafanahttps://grafana.iamworkin.lan
    Also: https://grafana.iamworkin.lan (noc1 direct)    		443 (Traefik)\U0001F510 GrafanaOnline
    Node Exporterhttp://noc1.iamworkin.lan:91009100Metrics onlyOnline
    SNMP Exporterhttp://noc1.iamworkin.lan:91169116pfSense + NAS + Switch + Printer SNMP scraperOnline
    step-ca ACMEhttps://acme.iamworkin.lan:94439443\U0001F510 step-caOnline
    1Password Connecthttp://op-connect.iamworkin.lan:81808180/8181API token authOnline
    Puppet Servernoc1:81408140OpenVox Server 8.12 (Podman)Online
    \n

    RKE2 Services (22 ArgoCD Apps — All Healthy)

    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    ServiceURLMetalLB / PortCredentialsStatus
    ArgoCDhttps://argocd.iamworkin.lan443 (via Traefik)\U0001F510 ArgoCDOnline
    Traefiktraefik.iamworkin.lan:8080MetalLB .200 — 80/443/8080/6667/6697\U0001F510 Traefik DashboardOnline
    Giteahttps://gitea.iamworkin.lan.201 SSH:22 — HTTPS via Traefik\U0001F510 GiteaOnline
    Guacamolehttps://guac.iamworkin.lan443 (via Traefik)\U0001F510 Apache GuacamoleOnline
    UnrealIRCd + Anopeirc.iamworkin.lan:6697 (TLS).200 — 6667/6697/8067\U0001F510 IRC ServicesOnline
    Zabbixhttps://zabbix.iamworkin.lan.203 trapper — Web via Traefik\U0001F510 Zabbix MonitoringOnline
    Mail (docker-mailserver)mail.iamworkin.lan.202 — SMTP 25/465/587\U0001F510 Mail ServerOnline
    Matrix Synapsehttps://matrix.iamworkin.lan443 (via Traefik)\U0001F510 Matrix SynapseOnline
    Element Webhttps://element.iamworkin.lan443 (via Traefik)Uses Matrix accountOnline
    TeamSpeakts.iamworkin.lan.205 — 9987/UDP, 30033, 10011\U0001F510 TeamSpeakOnline
    FlowerCore Landingflowercore.io443 (via Traefik, Cloudflare)Static pageOnline
    PKI Webhttps://pki.iamworkin.lan443 (via Traefik)Public (CRL/certs)Online
    Intranethttps://intranet.iamworkin.lan443 (via Traefik)Static pageOnline
    Snappymailhttps://mail-web.iamworkin.lan443 (via Traefik)\U0001F510 SnappymailOnline
    Telephonyhttps://telephony.iamworkin.lan5100 (via Traefik + Cloudflare)\U0001F510 TelephonyOnline
    Asterisk PBXasterisk.iamworkin.lan:5060.207 — SIP 5060/UDP, RTP 10000-200004 PJSIP ext, Twilio trunkOnline
    Agent Zerohttps://agent-zero.iamworkin.lan443 (via Traefik)\U0001F510 Agent ZeroOnline
    1Password OperatorIn-cluster onlyonepassword-systemConnect tokenOnline
    Selenium Gridhttps://selenium.iamworkin.lan443 (via Traefik)Hub + 2 Chrome + 1 FirefoxOnline
    FlowerCore.Print.Webhttp://print.iamworkin.lan:52005200 (edge2 direct)12 pages, 9 symbologies, 10 MCPOnline
    PiManager (piez)http://piez.iamworkin.lan:50005000 (piez direct)GPIO, I2C, SPI, 20 MCPOnline
    PiManager (pirelay)http://pirelay.iamworkin.lan:51005100 (pirelay direct)4-ch relay, schedulingOnline
    Frigate NVRhttp://edge1.iamworkin.lan:50005000 (edge1 direct)\U0001F510 FrigateOnline
    \n

    Monitoring

    \n
    \n
    \n
    Prometheus (noc1)
    \n
      \n
    • Targets: 15 scrape jobs (node-exporter: noc1 + 3 RKE2 + 2 edge + piez + pirelay, SNMP: pfSense + Cloud Key + Switch + NAS + Printer, Blackbox: 4 AI stack probes, self)
      • \n
    • Alert Rules: 8 (NodeDown, PfSenseDown, HighCPU, HighMemory, DiskSpaceLow, +3)
      • \n
    • Config: /opt/monitoring/prometheus/prometheus.yml
      • \n
    • Reload: podman kill -s SIGHUP prometheus
      • \n
    \n
    \n
    \n
    Grafana (noc1:3000)
    \n
      \n
    • Version: v12.4.0
      • \n
    • Dashboards: BlueJay Network Overview, Node Exporter Full (#1860), BlueJay Edge Nodes, BlueJay Operations (Prometheus+Zabbix unified) — all in BlueJay folder
      • \n
    • Datasources: Prometheus (http://localhost:9090), Zabbix (alexanderzobnin-zabbix-datasource v6.2.1)
      • \n
    \n
    \n
    \n
    Zabbix (RKE2) — 13 Hosts
    \n
      \n
    • Agent Hosts (8): noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, piez, pirelay
      • \n
    • SNMP Hosts (3): pfSense, UniFi Switch, BlueJayNAS (DS1621+)
      • \n
    • SNMP Host (1): Epson ET-3750 EcoTank
      • \n
    • Local (1): Zabbix server self-check
      • \n
    • Agent Version: Zabbix Agent 2 v7.0.22–7.2.15 on all 8 Linux nodes
      • \n
    • Passive checks: Server= includes MetalLB VIP + RKE2 node IPs + pod CIDR
      • \n
    • Note: Mac Mini (macOS) pending Zabbix agent setup
      • \n
    \n
    \n
    \n

    Pi Fleet Services (FlowerCore.PiManager)

    \n\n\n\n\n\n\n
    DeviceURLPortCapabilitiesStatus
    piez (Pi 4)http://piez.iamworkin.lan:50005000GPIO, I2C, SPI, Expanders (MCP23017/PCF8574/74HC595) — 10 pages, 35 API, 20 MCPOnline
    pirelay (Pi 3)http://pirelay.iamworkin.lan:510051004-ch relay (KS0212, active-LOW), scheduling, usage tracking — 8 pages, relay APIOnline
    \n
    PiManager: Unified .NET 10 service deployed to both Pi nodes with different ASPNETCORE_ENVIRONMENT overlays. Config-driven capabilities — same binary, different features per device. Supports relay presets: ks0212-4ch, walfront-16ch, sainsmart-8ch. API docs at /scalar/v1 on each node.
    \n\n

    Guacamole Connection Groups (14 connections)

    \n\n\n\n\n\n\n\n\n
    GroupConnectionsProtocol
    Kubernetes (3)rke2-server, rke2-agent1, rke2-agent2SSH
    Network Devices (4)pfSense, UniFi Cloud Key, Synology WiFi (SRM), BlueJayNASSSH
    Servers (3)noc1, Mac Mini (SSH), Mac Mini (VNC)SSH/VNC
    Edge Nodes (4)edge1 (Pi 5 + AI), edge2 (Pi 4), piez (Pi 4 + EZ Connect), pirelay (Pi 3 + Relay)SSH
    \n
    Guacamole credentials: All connection passwords are stored in the Guacamole MySQL database (synced from 1Password). Access at https://guac.iamworkin.lan — \U0001F510 Apache Guacamole
    \n
    \n\n\n
    \n

    VPN & Security

    \n
    OpenVPN Status: 8 servers configured and operational. Bound to tenant VIPs (.17, .19, .21, .23, .25). Each tenant has TUN (L3 routed) and TAP (L2 bridged) instances on ports 1194/1195 UDP.
    \n

    OpenVPN Configuration

    \n\n\n\n\n\n\n\n\n\n
    TenantVIPTUN PortTAP PortTunnel (TUN)Tunnel (TAP)VLAN
    ANDREW.171194/UDP1195/UDP10.0.68.0/2710.0.68.128/2760
    MATT.191194/UDP1195/UDP10.0.68.32/2710.0.68.160/2761
    DUSTIN.211194/UDP1195/UDP10.0.68.64/2710.0.68.192/2762
    ERIK.231194/UDP1195/UDP10.0.68.96/2710.0.68.224/2763
    FIT.251194/UDP1195/UDP10.0.69.0/2710.0.69.128/2769
    \n

    VPN Certificate Infrastructure

    \n\n\n\n\n\n\n\n\n\n
    ComponentDetails
    CABlueJay VPN CA (4096-bit RSA, SHA-256, 10-year)
    Server Certs8 (one per VPN instance, 2048-bit RSA)
    Client Certs4 (one per tenant, 2048-bit RSA)
    TLS AuthShared HMAC key across all servers
    Data CiphersAES-256-GCM, AES-128-GCM, CHACHA20-POLY1305
    \n

    IPsec Site-to-Site (Planned)

    \n\n\n\n\n\n\n
    TunnelLocalRemotePhase 1Phase 2 SAs
    Matt.29 (pfSense WAN)Matt's public IPIKEv2, AES-256-GCM, DH 14+MATT (10.0.61.0/24) + PROD (10.0.57.0/24)
    Dustin.29 (pfSense WAN)Dustin's public IPIKEv2, AES-256-GCM, DH 14+DUSTIN (10.0.62.0/24) + PROD (10.0.57.0/24)
    \n

    Security Policies

    \n
    \n
    \n
    Cloudflare Protection
    \n
      \n
    • SSL Mode: Full (strict) on all 6 zones
      • \n
    • Origin Certs: *.flowercore.io + *.iamwork.in (15-year RSA), deployed across 8 K8s namespaces
      • \n
    • HSTS: Enabled on all zones
      • \n
    • Min TLS: 1.2
      • \n
    • Anti-spoofing: null MX, SPF -all, DMARC reject on non-email domains
      • \n
    • Cloudflare-only inbound: Port forwards for 80/443 restrict source to Cloudflare IP ranges
      • \n
    \n
    \n
    \n
    SSH Key Policy
    \n
      \n
    • Key Type: ed25519 (deployed to all 9 physical nodes)
      • \n
    • WSL Key: stoltz@IAMWORKIN-WS — deployed to noc1, rke2-server, rke2-agent1, rke2-agent2, edge1, edge2, piez, pirelay, Mac Mini
      • \n
    • noc1 Key: noc1-root + rke2@bluejay — management keys for remote nodes
      • \n
    • Root Login: Key-only (PermitRootLogin without-password)
      • \n
    • RKE2 Nodes: SELinux enforcing, chcon -t ssh_home_t on authorized_keys
      • \n
    • Last verified: 2026-03-21 (all 9 nodes confirmed)
      • \n
    \n
    \n
    \n
    Network Security Rules
    \n
      \n
    • Forced DNS: HOME/WORK/SCHOOL/GUEST block port 53 except to gateway
      • \n
    • Blocked SMTP: Outbound 25/465/587 on HOME/WORK/SCHOOL/GUEST
      • \n
    • Firewall Policy: Deny-all default, explicit allow per VLAN
      • \n
    • Tenant Isolation: Tenants fully isolated from each other, only PROD + DNS + NAS + internet
      • \n
    \n
    \n
    \n

    PKI Hierarchy

    \n\n\n\n\n\n\n\n\n\n
    CAStatusPurpose
    Root CA (IAmWorkin ACME CA)OperationalTrust anchor, ECDSA P-256, expires 2036
    ACME CA (step-ca on noc1)OperationalAutomated cert issuance via ACME protocol
    Network CAPlannedSwitch, AP, pfSense device certs
    Windows AD CS CAPlannedDomain-joined machine/user certs
    Internal Services CAPlannedK8s service mesh, inter-service mTLS
    \n
    \n\n\n
    \n

    Remote Access — Blue Jay Gateway

    \n
    Apache Guacamole with Blue Jay branding, 1Password vault integration, K8s exec, and embedded panels. All credentials resolved from 1Password at connection time — no passwords stored in Guacamole.
    \n\n
    \n
    \n
    Guacamole Web UI
    \n
      \n
    • URL: guac.iamworkin.lan
      • \n
    • Version: 1.6.0 + Blue Jay branding
      • \n
    • Admin: Guacamole
      • \n
    • K8s: guacamole namespace
      • \n
    • Ingress: Traefik → guacamole:8080 (WebSocket)
      • \n
    • ArgoCD: infra-guacamole
      • \n
    \n
    \n
    \n
    Extensions
    \n
      \n
    • Blue Jay Branding — Full dark theme, custom login, logo
      • \n
    • 1Password Vault — ${VAULT_PASSWORD} token resolution
      • \n
    • TOTP MFA — Required for all users
      • \n
    • Auth Ban — 5 failures = 5min IP ban
      • \n
    • JSON Auth — Signed tokens for embedded panels
      • \n
    • Time Restrict — Per-connection time windows
      • \n
    • Recording Storage — NFS (Synology) playback
      • \n
    • Display Statistics — Performance metrics
      • \n
    \n
    \n
    \n
    1Password Integration
    \n
      \n
    • Connect URL: onepassword-connect:8080 (K8s internal)
      • \n
    • Vault: IAmWorkin (qaphopopkryhbg353ukzhhuqoq)
      • \n
    • Token: Via OnePasswordItem CRD
      • \n
    • Rotation: Automatic — change in 1Password, Guacamole picks up on next connect
      • \n
    • Cache TTL: 5 minutes
      • \n
    \n
    \n
    \n
    Session Recording
    \n
      \n
    • Storage: NFS on Synology (/volume1/guacamole/recordings)
      • \n
    • PVC: guacamole-recordings-pvc (50 Gi)
      • \n
    • Format: Guacamole native (playable in browser)
      • \n
    • Retention: Linked to connection history
      • \n
    \n
    \n
    \n\n

    Connection Inventory (${VAULT_*} tokens — no hardcoded passwords)

    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    ConnectionProtocolHostVLAN1Password Item
    MGMT (VLAN 56) — Infrastructure
    pfSense — SSHSSHpfsense.iamworkin.lan56pfSense Admin
    Cloud Key — SSHSSHunifi.iamworkin.lan56UniFi CloudKey
    UniFi Switch — SSHSSHswitch.iamworkin.lan56UniFi CloudKey
    noc1 — SSHSSHnoc1.iamworkin.lan56noc1 Root SSH
    rke2-server — SSHSSHrke2-server.iamworkin.lan56RKE2 Server
    rke2-agent1 — SSHSSHrke2-agent1.iamworkin.lan56RKE2 Agent 1
    rke2-agent2 — SSHSSHrke2-agent2.iamworkin.lan56RKE2 Agent 2
    PROD (VLAN 57) — Production
    edge1 (Pi 5) — SSHSSHedge1.iamworkin.lan57Edge1 Pi5 SSH
    edge2 (Pi 4) — SSHSSHedge2.iamworkin.lan57Edge2 Pi4 SSH
    Mac Mini — SSHSSHmacmini.iamworkin.lan57Mac Mini
    Mac Mini — VNCVNCmacmini.iamworkin.lan57Mac Mini
    HOME (VLAN 58) — Home Network
    Synology NAS — SSHSSHnas.iamworkin.lan58Synology NAS
    Synology WiFi — SSHSSHwifi.iamworkin.lan58Synology SRM
    piez (Pi 4) — SSHSSHpiez.iamworkin.lan58PiEZ SSH
    pirelay (Pi 3) — SSHSSHpirelay.iamworkin.lan58PiRelay SSH
    Kubernetes — Pod Exec (auto-synced every 2min)
    argocd-serverK8Skubernetes.default.svc—(ServiceAccount)
    gitea-0K8Skubernetes.default.svc—(ServiceAccount)
    asteriskK8Skubernetes.default.svc—(ServiceAccount)
    zabbix-serverK8Skubernetes.default.svc—(ServiceAccount)
    synapseK8Skubernetes.default.svc—(ServiceAccount)
    unrealircdK8Skubernetes.default.svc—(ServiceAccount)
    \n\n

    Embedded Panel (Quick SSH)

    \n
    The embedded panel below uses guacamole-common-js to connect directly to Guacamole's tunnel servlet. Requires authentication to guac.iamworkin.lan first.
    \n
    \n
    \n
    \n \n noc1 — SSH Terminal\n Open in Guacamole →\n
    \n
    \n

    Connect via Blue Jay Remote Access to use the embedded terminal.
    \n Requires bluejay-guac-embed.js and guacamole-common-js

    \n
    \n
    \n
    \n\n

    Deployment Details

    \n\n\n\n\n\n\n\n\n
    ComponentImageReplicasResources
    guacamole (Tomcat)fc-guacamole:1.6.0-bluejay1200m-1 CPU, 512Mi-1Gi
    guacd (C proxy)guacamole/guacd:1.6.01200m-2 CPU, 256Mi-1Gi
    MySQL 8mysql:8.01 (StatefulSet)100m-500m CPU, 256-512Mi
    K8s Sync CronJobbitnami/kubectl:1.34every 2minminimal
    \n\n

    Files Reference

    \n\n\n\n\n\n\n\n\n\n\n\n\n
    ArtifactPath
    Design plandocs/infrastructure/guacamole-customization-plan.md
    K8s manifestsk8s/guacamole/*.yaml
    Branding extensionk8s/guacamole/extensions/bluejay-branding/
    1Password vault extensionk8s/guacamole/extensions/1password-vault/
    Embed libraryk8s/guacamole/scripts/bluejay-guac-embed.js
    Dockerfilek8s/guacamole/Dockerfile
    Bootstrap scriptk8s/guacamole/scripts/bootstrap-connections.sh
    Build/deploy scriptk8s/guacamole/scripts/build-image.sh
    \n
    \n\n\n
    \n

    Edge Nodes

    \n
    \n
    \n
    edge1 — Raspberry Pi 5 + Hailo AI
    \n
      \n
    • IP: edge1.iamworkin.lan (PROD VLAN 57)
      • \n
    • SSH: stoltz@edge1.iamworkin.lan
      • \n
    • Password: \U0001F510 Edge1 Pi5 SSH
      • \n
    • Hardware: Pi 5 16GB + Hailo-10H 40 TOPS (AI HAT+ 2)
      • \n
    • OS: Debian 13 (trixie) aarch64
      • \n
    • PCIe: Gen 3 x1 (8.0 GT/s)
      • \n
    • Power: 27W USB-C
      • \n
    • .NET SDK: 10.0.103
      • \n
    • GitHub Runner: v2.332.0 (labels: pi5, hailo)
      • \n
    • Node Exporter: :9100
      • \n
    • Puppet: profile::edge_ai
      • \n
    • Zabbix Agent: v7.2.15 (passive, port 10050)
      • \n
    • Switch Port: 13
      • \n
    • Disk: 93% (2.0GB free)
      • \n
    \n
    \n
    \n
    edge2 — Raspberry Pi 4 (Argon ONE)
    \n
      \n
    • IP: edge2.iamworkin.lan (PROD VLAN 57)
      • \n
    • SSH: stoltz@edge2.iamworkin.lan
      • \n
    • Password: \U0001F510 Edge2 Pi4 SSH
      • \n
    • Hardware: Pi 4 Model B 4GB, Argon ONE case
      • \n
    • OS: Debian 13 (trixie) aarch64
      • \n
    • Fan Control: argononed.service (55°C=10%, 60°C=55%, 65°C=100%)
      • \n
    • .NET SDK: 10.0.103
      • \n
    • Print Service: LIVE FlowerCore.Print.Web :5200 (12 pages, 9 symbologies, AI barcode)
      • \n
    • GitHub Runners: v2.332.0 — MySQL (edge2-mysql), PHP (edge2-php)
      • \n
    • Node Exporter: :9100
      • \n
    • Puppet: profile::edge_runner
      • \n
    • Zabbix Agent: v7.2.15 (passive, port 10050)
      • \n
    • Switch Port: 11
      • \n
    • Guacamole: SSH connection in Edge Nodes group
      • \n
    \n
    \n
    \n
    piez — Raspberry Pi 4 + EZ Connect
    \n
      \n
    • IP: piez.iamworkin.lan (HOME VLAN 58, WiFi)
      • \n
    • SSH: stoltz@piez.iamworkin.lan
      • \n
    • Password: \U0001F510 piez SSH
      • \n
    • Hardware: Pi 4 Model B 4GB + Pi EZ Connect board
      • \n
    • OS: Debian 13 (trixie) aarch64
      • \n
    • Role: GPIO prototyping, breadboard dev, I2C/SPI sensors
      • \n
    • .NET SDK: 10.0.201
      • \n
    • Web: LIVE FlowerCore.PiManager :5000 (10 pages, 35 API endpoints, 20 MCP tools)
      • \n
    • API Docs: Scalar :5000/scalar/v1
      • \n
    • Capabilities: GPIO, I2C, SPI, Expanders (MCP23017/PCF8574/74HC595)
      • \n
    • Node Exporter: :9100
      • \n
    • Zabbix Agent: v7.0.22 (passive, port 10050)
      • \n
    • Guacamole: SSH connection in Edge Nodes group
      • \n
    • Dashboard: piez-prototyping.html
      • \n
    \n
    \n
    \n
    pirelay — Raspberry Pi 3 + 4-Ch Relay
    \n
      \n
    • IP: pirelay.iamworkin.lan (HOME VLAN 58)
      • \n
    • SSH: stoltz@pirelay.iamworkin.lan
      • \n
    • Password: \U0001F510 pirelay SSH
      • \n
    • Hardware: Pi 3 Model B v1.2, 906 MB RAM + Keyestudio KS0212 4-channel relay shield
      • \n
    • OS: Debian 13 (trixie) aarch64
      • \n
    • Role: Relay controller, home automation prototyping
      • \n
    • Web: LIVE FlowerCore.PiManager :5100 (relay preset: ks0212-4ch)
      • \n
    • API Docs: Scalar :5100/scalar/v1
      • \n
    • GPIO (BCM, active-LOW): CH1=GPIO4, CH2=GPIO22, CH3=GPIO6, CH4=GPIO26
      • \n
    • Relay Ratings: 10A @ 250VAC / 30VDC per channel
      • \n
    • Node Exporter: :9100
      • \n
    • Zabbix Agent: v7.0.22 (passive, port 10050)
      • \n
    • Guacamole: SSH connection in Edge Nodes group
      • \n
    • Dashboard: relay-controller.html
      • \n
    \n
    \n
    \n
    Mac Mini (Build/Test Node)
    \n
      \n
    • IP: macmini.iamworkin.lan (PROD VLAN 57)
      • \n
    • SSH: bluejay@macmini.iamworkin.lan
      • \n
    • Credentials: \U0001F510 Mac Mini
      • \n
    • VNC: vnc://macmini.iamworkin.lan:5900 — \U0001F510 Mac Mini
      • \n
    • Hardware: Apple M1, 16GB RAM, 926GB SSD
      • \n
    • OS: macOS 26.3.1 (Darwin 25.3.0)
      • \n
    • Role: Xcode builds, Selenium Grid node, automated browser/app testing
      • \n
    • Guacamole: SSH + VNC connections in Servers group
      • \n
    \n
    \n
    \n\n

    Edge2 — Print Service

    \n
    \n
    \n
    FlowerCore.Print.Web
    \n
      \n
    • URL: http://print.iamworkin.lan:5200
      • \n
    • Pages: 12 Blazor pages (barcode gen, batch print, product cache, AI labels)
      • \n
    • Symbologies: 9 (Code128, EAN-13, QR, DataMatrix, ITF-14, UPC-A/E, Code39, Codabar)
      • \n
    • Features: Product cache DB, AI label generation (Ollama on Pi), batch barcodes, combo labels
      • \n
    • MCP Tools: 10 tools for programmatic barcode/label generation
      • \n
    • Thermal Printer: Connected Epson ET-3750 (printer.iamworkin.lan)
      • \n
    • systemd: flowercore-print.service (auto-start)
      • \n
    \n
    \n
    \n\n

    Edge1 AI & Speech Services

    \n
    \n
    \n
    Ollama (LLM Inference)
    \n
      \n
    • API: http://edge1.iamworkin.lan:11434
      • \n
    • Model: qwen2.5-coder:7b (4.7GB Q4_K_M)
      • \n
    • Managed by: profile::edge::ollama (Puppet)
      • \n
    • Firewall: nftables port 11434 from MGMT+PROD
      • \n
    • Note: SD card 95% full — one model max
      • \n
    \n
    \n
    \n
    Piper TTS (Text-to-Speech)
    \n
      \n
    • Version: piper-tts 1.4.1 in ~/piper-env venv
      • \n
    • Voices: en_US-amy-low (16kHz) + en_US-amy-medium (22kHz)
      • \n
    • Performance: RTF 0.10 (10x real-time), 222ms latency (short)
      • \n
    • CPU Usage: 3/4 cores (271%)
      • \n
    • Note: 16kHz matches G.711 natively for telephony
      • \n
    \n
    \n
    \n
    Hailo Whisper STT (Speech-to-Text)
    \n
      \n
    • Model: Whisper-Base HEF (131MB, v5.1.1)
      • \n
    • Path: /opt/hailo-models/Whisper-Base.hef
      • \n
    • Performance: RTF 0.05-0.11 (10-18x real-time)
      • \n
    • Model Load: 1.2s cold start
      • \n
    • Multi-process: VDevice for coexistence with Frigate
      • \n
    \n
    \n
    \n
    Speech Pipeline Service
    \n
      \n
    • API: http://edge1.iamworkin.lan:8500
      • \n
    • Endpoints: POST /tts, POST /stt, GET /health
      • \n
    • User: speech in hailo group
      • \n
    • Managed by: profile::edge::speech_pipeline (Puppet)
      • \n
    • Firewall: nftables port 8500 from MGMT+PROD
      • \n
    \n
    \n
    \n
    Twilio Voice Bridge (PoC)
    \n
      \n
    • Location: /opt/twilio-bridge/ on edge1
      • \n
    • WebSocket: :8765 • TwiML: :8766
      • \n
    • Cloudflare Tunnel: bluejay-voice (3ddfa567-b0a7-40cb-9c57-7f20f3ec3637)
      • \n
    • URLs: voice.bluejay.dev (TwiML), voice-ws.bluejay.dev (WS)
      • \n
    • Services: cloudflared-tunnel on noc1, twilio-bridge + twilio-twiml on edge1
      • \n
    • Status: PoC\ + \ — STT fixed, TTS stream API mismatch
      • \n
    \n
    \n
    \n
    \n\n\n
    \n

    Storage

    \n
    \n
    \n
    BlueJayNAS — Synology DS1621+
    \n
      \n
    • IP: nas.iamworkin.lan (HOME VLAN 58, switch port 14)
      • \n
    • DNS: nas.iamworkin.lan, synology.iamworkin.lan
      • \n
    • DSM: https://nas.iamworkin.lan:5001 (v7.3.2-86009 Update 1)
      • \n
    • SSH: bluejay@nas.iamworkin.lan
      • \n
    • Credentials: \U0001F510 BlueJayNAS
      • \n
    • Model: DS1621+ (6-bay, AMD Ryzen V1500B)
      • \n
    • Storage: 9.1 TB Btrfs (RAID), ~7.8 TB free
      • \n
    • MAC: 00:11:32:f2:43:6b
      • \n
    • TLS Cert: ca.iamworkin.lan (step-ca ACME, expires 2026-06-03)
      • \n
    • NFS Domain: private.iamwork.in
      • \n
    • 2FA: TOTP enabled on DSM
      • \n
    \n
    \n
    \n
    NFS Exports & Services
    \n
      \n
    • Longhorn Backup: nfs://nas.iamworkin.lan:/volume1/NetBackup/longhorn-backups
      • \n
    • Kubernetes Shared: /volume1/kubernetes (NFS mount for PVCs)
      • \n
    • Selenium Screenshots: /volume1/selenium/screenshots (AAT visual tests via PVC)
      • \n
    • Selenium Videos: /volume1/selenium/videos (test recordings)
      • \n
    • NFS Permissions: RKE2 nodes rke2-server/agent1/agent2 (MGMT VLAN cross-VLAN rule)
      • \n
    • Ports: NFS (2049), iSCSI (3260, no targets yet), DSM API (5001), SSH (22), SNMP (161)
      • \n
    • pfSense Rule: RKE2 → NAS on 2049/3260/5001
      • \n
    \n
    \n
    \n
    Monitoring & Security
    \n
      \n
    • SNMP: v2c community \U0001F510 SNMP
      • \n
    • Zabbix Host: BlueJayNAS (ID 10678) — Linux by SNMP template
      • \n
    • Prometheus: SNMP scrape via snmp-exporter (synology module)
      • \n
    • Auto Block: Enabled (brute-force protection)
      • \n
    • DSM Firewall: DO NOT ENABLE — synofirewall segfaults on 7.3.2, causes lockout
      • \n
    • admin account: ENABLED — never disable (breaks all admin-group privileges)
      • \n
    • SSH: Keep PasswordAuthentication yes (disabling breaks sudo/PAM)
      • \n
    • Guacamole: SSH connection in Network Devices group
      • \n
    \n
    \n
    \n
    Recovery Notes
    \n
      \n
    • admin disabled recovery: Physical RESET button (4s hold, 1 beep) + power cycle
      • \n
    • Firewall lockout: Physical RESET (same procedure)
      • \n
    • Security hardening: Use pfSense cross-VLAN rules, NOT DSM-level firewall/SSH hardening
      • \n
    • CLI tools: /usr/syno/bin/synopkg, /usr/syno/sbin/synouser, /usr/syno/sbin/synogroup
      • \n
    • DSM API: https://nas.iamworkin.lan:5001/webapi/entry.cgi — SYNO.API.Auth + otp_code for 2FA
      • \n
    \n
    \n
    \n\n

    Longhorn Persistent Volume Claims (17 PVCs, ~69 Gi)

    \n
    Longhorn → NAS Backup: Longhorn is the default StorageClass on the RKE2 cluster (iSCSI). All 17 PVCs backed up to BlueJayNAS via NFS. Daily backups at 02:00 UTC (retain 14 days), hourly snapshots (retain 24).
    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    NamespacePVCSizePurpose
    monitoringprometheus-data + grafana-data12 GiPrometheus TSDB (90-day retention) + Grafana dashboards/DB
    zabbixzabbix-postgres-data10 GiZabbix PostgreSQL (13 hosts, history/trends)
    giteagitea-shared-storage10 GiGit repositories, LFS objects, attachments
    telephonyasterisk-data + telephony-data10 GiAsterisk PBX config + FlowerCore.Telephony DB
    matrixmatrix-postgres-data + synapse-data7 GiMatrix Synapse PostgreSQL + media store
    mailmail-data + mail-state6 Gidocker-mailserver (Postfix queues, Dovecot mail)
    agent-zeroagent-zero-data + knowledge6 GiAgent Zero persistent data + FAISS knowledge base
    guacamoleguac-mysql-data5 GiGuacamole MySQL (14 connections, session history)
    ircanope-data + unrealircd-data2 GiIRC services DB (channels, nicks) + UnrealIRCd config
    teamspeakteamspeak-data1 GiTeamSpeak virtual server config + file transfers
    \n\n\n\n\n\n\n\n\n\n
    ComponentDetail
    Storage BackendLonghorn (iSCSI, default StorageClass, 3 replicas per volume)
    Backup Targetnfs://nas.iamworkin.lan:/volume1/NetBackup/longhorn-backups
    Backup ScheduleDaily at 02:00 UTC (retain 14 days), hourly snapshots (retain 24)
    RKE2 Requirementiscsid enabled on all nodes (systemctl enable --now iscsid)
    Managed byPuppet profile::kubernetes::rke2 (prerequisites, kernel modules, sysctl)
    \n\n

    Synology CSI Driver (Pending)

    \n
    Status: Helm repo added, deployment pending. Will enable dynamic PVC provisioning directly from Synology NFS/iSCSI.
    \n\n\n\n\n\n\n\n\n\n
    ComponentDetail
    DriverSynologyOpenSource/synology-csi v1.2.1
    Helm Chartchristian-schlichtherle, v0.11.0
    ProtocolsNFS, iSCSI, SMB
    Service Accountk8s-csi (UID 1032) on BlueJayNAS
    1Password\U0001F510 Synology CSI creds
    \n
    \n\n\n
    \n

    WiFi Networks

    \n
    Credentials: All WiFi passwords are stored in the IAmWorkin vault on 1Password. To connect a device, open the 1Password app, find the WiFi entry, and scan the QR code from there. Passwords are not stored in this page for security.
    \n
    QR Code Connection: Open 1Password → search for the SSID name → tap “Show QR Code” → scan with your device camera. The QR code encodes the full WIFI:T:WPA;S:{SSID};P:{PASSWORD};;; connection string.
    \n\n
    \n \n
    \n
    \n
    BlueJay-Home
    \n
    HOME (VLAN 58)
    \n
    \n
    \n
    \n \n \n \n \n \n Scan from 1Password app\n
    \n
    \n
    \n
    \n SSID\n BlueJay-Home\n
    \n
    \n VLAN\n 58 (untagged on AP)\n
    \n
    \n Security\n WPA2/WPA3\n
    \n
    \n Password\n \U0001F510 Open in 1Password\n
    \n
    \n Purpose\n Home network — personal / family use\n
    \n
    \n Bandwidth\n 800 / 800 Mbps\n
    \n
    \n Public IP\n 74.40.140.29\n
    \n
    \n
    \n\n \n
    \n
    \n
    BlueJay-Employee
    \n
    EMPLOYEE (VLAN 59)
    \n
    \n
    \n
    \n \n \n \n \n \n Scan from 1Password app\n
    \n
    \n
    \n
    \n SSID\n BlueJay-Employee\n
    \n
    \n VLAN\n 59\n
    \n
    \n Security\n WPA2/WPA3\n
    \n
    \n Password\n \U0001F510 Open in 1Password\n
    \n
    \n Purpose\n Employee network — staff device access\n
    \n
    \n Bandwidth\n 500 / 500 Mbps\n
    \n
    \n Public IP\n 74.40.140.28 (shared)\n
    \n
    \n
    \n\n \n
    \n
    \n
    BlueJay-Work
    \n
    WORK (VLAN 64)
    \n
    \n
    \n
    \n \n \n \n \n \n Scan from 1Password app\n
    \n
    \n
    \n
    \n SSID\n BlueJay-Work\n
    \n
    \n VLAN\n 64\n
    \n
    \n Security\n WPA2/WPA3\n
    \n
    \n Password\n \U0001F510 Open in 1Password\n
    \n
    \n Purpose\n Work network — business devices\n
    \n
    \n Bandwidth\n 500 / 500 Mbps\n
    \n
    \n Public IP\n 74.40.140.28 (shared)\n
    \n
    \n
    \n\n \n
    \n
    \n
    BlueJay-School
    \n
    SCHOOL (VLAN 65)
    \n
    \n
    \n
    \n \n \n \n \n \n Scan from 1Password app\n
    \n
    \n
    \n
    \n SSID\n BlueJay-School\n
    \n
    \n VLAN\n 65\n
    \n
    \n Security\n WPA2/WPA3\n
    \n
    \n Password\n \U0001F510 Open in 1Password\n
    \n
    \n Purpose\n School network — student devices\n
    \n
    \n Bandwidth\n 200 / 200 Mbps\n
    \n
    \n Public IP\n 74.40.140.28 (shared)\n
    \n
    \n
    \n\n \n
    \n
    \n
    BlueJay-Guest
    \n
    GUEST (VLAN 66)
    \n
    \n
    \n
    \n \n \n \n \n \n Open network — no password required\n
    \n
    \n
    \n
    \n SSID\n BlueJay-Guest\n
    \n
    \n VLAN\n 66\n
    \n
    \n Security\n Open / Captive Portal\n
    \n
    \n Password\n None (open)\n
    \n
    \n Purpose\n Guest WiFi — fully isolated, NAT only\n
    \n
    \n Bandwidth\n 100 / 50 Mbps\n
    \n
    \n Public IP\n 74.40.140.28 (shared)\n
    \n
    \n
    \n
    \n\n

    WiFi Access Point

    \n
    \n
    \n
    Synology RT6600AX (AP Mode)
    \n \n
    \n
    \n\n
    Network Isolation: Each SSID maps to a separate VLAN with independent firewall rules and bandwidth limits. GUEST is fully isolated with NAT — no access to internal resources. EMPLOYEE, WORK, and SCHOOL share public IP .28 with traffic shaping.
    \n
    \n\n\n
    \n

    Credentials & 1Password

    \n
    \n
    \n
    1Password Connect Server
    \n
      \n
    • API: http://op-connect.iamworkin.lan:8180
      • \n
    • Sync: http://op-connect.iamworkin.lan:8181
      • \n
    • Host: noc1 (Podman containers)
      • \n
    • Status: Online
      • \n
    \n
    \n
    \n
    1Password K8s Operator
    \n
      \n
    • Namespace: onepassword-system
      • \n
    • Chart: 1password/connect v2.3.0
      • \n
    • Operator: v1.11.0
      • \n
    • Poll Interval: 600s
      • \n
    • Status: Online
      • \n
    \n
    \n
    \n
    IAmWorkin Vault
    \n
      \n
    • Vault Name: IAmWorkin
      • \n
    • Items: 45+ items (infra credentials + WiFi QR codes + Pi device passwords)
      • \n
    • Rotation: Quarterly (Jan/Apr/Jul/Oct)
      • \n
    • Script: /opt/scripts/rotate-credentials.sh
      • \n
    • Timer: credential-rotation.timer
      • \n
    \n
    \n
    \n\n
    All infrastructure credentials are managed in 1Password. The IAmWorkin vault contains credentials for every service listed on this intranet. K8s workloads (Zabbix, Matrix, Guacamole, Mail, IRC, Gitea, ArgoCD) sync secrets automatically via OnePasswordItem CRDs. Credential rotation runs quarterly via systemd timer.
    \n\n

    K8s Secret Sync (OnePasswordItem CRDs)

    \n\n\n\n\n\n\n\n\n\n\n\n
    NamespaceSecret NameSource (1Password Item)Status
    zabbixzabbix-credentialsZabbix MonitoringSynced
    matrixmatrix-credentialsMatrix SynapseSynced
    guacamoleguacamole-credentialsApache GuacamoleSynced
    mailmail-credentialsMail ServerSynced
    ircirc-credentialsIRC ServicesSynced
    giteagitea-credentialsGiteaSynced
    argocdargocd-credentialsArgoCDSynced
    \n\n

    Pi Fleet & Edge Node Credentials

    \n\n\n\n\n\n\n\n\n\n
    DeviceIPUser1Password ItemServices
    edge1 (Pi 5)edge1.iamworkin.lanstoltz\U0001F510 Edge1 Pi5 SSHOllama, Piper TTS, Hailo STT, Frigate
    edge2 (Pi 4)edge2.iamworkin.lanstoltz\U0001F510 Edge2 Pi4 SSHGitHub Actions runners
    piez (Pi 4)piez.iamworkin.lanstoltz\U0001F510 piezPiManager :5000 (GPIO, I2C, SPI)
    pirelay (Pi 3)pirelay.iamworkin.lanstoltz\U0001F510 pirelayPiManager :5100 (4-ch relay)
    Mac Minimacmini.iamworkin.lanbluejay\U0001F510 Mac MiniSSH + VNC :5900, Xcode builds
    \n\n

    Credential Rotation

    \n
    \n
    \n
    Rotation Script
    \n
      \n
    • Path: /opt/scripts/rotate-credentials.sh
      • \n
    • Usage: rotate-credentials.sh {service|all} [--dry-run]
      • \n
    • Services: grafana, guacamole, zabbix, argocd, gitea, snappymail, traefik, matrix, harvester (17/17 complete, all XKCD-style)
      • \n
    • Schedule: Quarterly (1st of Jan/Apr/Jul/Oct at 03:00 UTC)
      • \n
    • Log: /var/log/credential-rotation.log
      • \n
    \n
    \n
    \n
    \n\n\n
    \n

    Planned Services

    \n
    All previously planned services (Gitea, IRC, Zabbix, ArgoCD, 1Password, Mail, Matrix, TeamSpeak, Guacamole) are now live on RKE2. Remaining planned items are Windows Server VMs and authenticated proxy.
    \n\n\n\n\n\n\n\n\n\n
    ServiceIPHostRoleStatus
    Windows DC110.0.56.20VM (hypervisor TBD)AD Domain Controller (iamworkin.lan)Planned
    Windows WAC110.0.56.21VM (hypervisor TBD)Windows Admin CenterPlanned
    Windows RDS110.0.57.20VM (hypervisor TBD)Remote Desktop ServicesPlanned
    Windows IIS110.0.57.21VM (hypervisor TBD)IIS Web ServerPlanned
    Squid Proxy10.0.56.22VM (hypervisor TBD)Authenticated web proxy (Kerberos/LDAP)Planned
    \n
    \n\n\n
    \n

    Network Topology

    \n
    \n\n
    Internet
    \n
    \n
    Frontier ONT + NVG468MQ Modem

    WAN: 74.32.185.184 • /28: .17-.29

    192.168.254.254 • DMZ to pfSense

    \n
    \n
    pfSense Netgate 4100

    WAN: ix3 (.122) • LAN: igc0 (802.1Q trunk)

    13 VLANs • 13 VIPs • 28 port forwards • DNS/DHCP/NTP/SNMP

    \n
    \n
    UniFi USW-Lite-16-PoE Switch

    switch.iamworkin.lan • 16 ports • VLANs 56-67

    \n
    \n\n
    \n
    \n
    noc1
    \n

    noc1.iamworkin.lan MGMT

    \n

    Celeron N5105 • 32GB • K3s + Podman

    \n
      \n
    • Grafana :3000
    • Prometheus :9091
      • \n
    • step-ca :9443
    • Cockpit :9090
      • \n
    • Puppet :8140
    • 1Password Connect :8180
      • \n
    \n
    \n
    \n
    RKE2 Bare-Metal Cluster
    \n

    Traefik: traefik.iamworkin.lan MGMT

    \n
      \n
    • rke2-server: .11 (i7-1260P/64GB, control plane)
      • \n
    • rke2-agent1: .12 (i7-1260P/64GB, worker)
      • \n
    • rke2-agent2: .13 (i5-1340P/64GB, worker)
      • \n
    \n

    RKE2 v1.34.5 • Calico • MetalLB • Longhorn • Traefik v3.3.4 • ArgoCD • 11 apps • Asterisk PBX

    \n
    \n
    \n
    WiFi (Synology RT6600AX)
    \n

    wifi.iamworkin.lan HOME

    \n
      \n
    • BlueJay-Home (untagged)
    • BlueJay-Employee (VLAN 59)
      • \n
    • BlueJay-Work (VLAN 64)
    • BlueJay-School (VLAN 65)
      • \n
    • BlueJay-Guest (VLAN 66)
      • \n
    \n
    \n
    \n
    PROD Nodes
    \n

    PROD VLAN 57

    \n
      \n
    • Mac Mini: macmini.iamworkin.lan (Xcode)
      • \n
    • edge1 Pi5: edge1.iamworkin.lan (Hailo AI)
      • \n
    • edge2 Pi4: edge2.iamworkin.lan (CI runner)
      • \n
    \n
    \n
    \n
    HOME Pi Fleet
    \n

    HOME VLAN 58 • FlowerCore.PiManager

    \n
      \n
    • piez Pi4: piez.iamworkin.lan (EZ Connect, GPIO/I2C/SPI) — :5000
      • \n
    • pirelay Pi3: pirelay.iamworkin.lan (KS0212 4-ch relay) — :5100
      • \n
    • Unified PiManager binary • config-driven • node-exporter • Zabbix
      • \n
    \n
    \n
    \n
    Network Devices & Storage
    \n
      \n
    • Cloud Key: unifi.iamworkin.lan
      • \n
    • BlueJayNAS (DS1621+): nas.iamworkin.lan
      • \n
    • 9.1TB Btrfs • NFS • Longhorn backup • SNMP
      • \n
    • Modem: 192.168.254.254
      • \n
    \n
    \n
    \n
    \n
    \n\n\n
    \n

    Domains

    \n
    \n
    17
    Registered Domains
    \n
    1
    Internal Domain
    \n
    1
    Blog Hosting (DreamHost)
    \n
    18
    Total Domains
    \n
    \n\n

    FlowerCore Domains

    \n\n\n\n\n\n\n\n\n
    DomainCategoryOwnerPurposeDNS ProviderRegistrar
    flowercore.ioFlowerCoreAndrewProduction APICloudflareNamecheap
    flowerinsider.xyzFlowerCoreAndrewDev/stagingCloudflareNamecheap
    flowerinsider.comFlowerCore CoAndrewCompany siteNamecheapNamecheap
    flowerinsider.nlFlowerCore CoAndrewDutch siteNamecheapNamecheap
    \n\n

    Work Domains

    \n\n\n\n\n\n\n
    DomainCategoryOwnerPurposeDNS ProviderRegistrar
    iamwork.inWorkAndrewEmployee portal, IVR, TelephonyCloudflareNamecheap
    iamworkin.comWorkAndrewRedirectNamecheapNamecheap
    \n\n

    Personal & Tenant Domains

    \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    DomainCategoryOwnerPurposeDNS ProviderRegistrar
    ackeroni.comErikErikPersonalNamecheapNamecheap
    erckak.comErikErikPersonalNamecheapNamecheap
    erckak.devErikErikDeveloper portfolioCloudflareNamecheap
    digirido.comRandomAndrewDigiKey testingNamecheapNamecheap
    timeforta.coDustinDustinPersonalCloudflareNamecheap
    shenanjia.comWifeWifePersonal siteNamecheapNamecheap
    bluejay.apiPersonal FunAndrewAPI experimentsNamecheapNamecheap
    bluejay.devPersonal FunAndrewDev projects, voice bridgeCloudflareNamecheap
    jayblue.devPersonal FunAndrewDev projectsNamecheapNamecheap
    z.orbRandomAndrewShort URLNamecheapNamecheap
    \n\n

    Blog & Content Domains

    \n\n\n\n\n\n\n
    DomainCategoryOwnerPurposeDNS ProviderRegistrar
    pebbleandpeanut.comBlogAndrewPersonal blogDreamHostNamecheap
    pebblesandpeanuts.comBlogAndrewAlt redirectNamecheapNamecheap
    \n\n

    Internal Domain

    \n\n\n\n\n\n
    DomainCategoryOwnerPurposeDNS ProviderNotes
    iamworkin.lanInternalAndrewInternal infrastructure, future AD DSpfSense Unbound52+ host overrides + 4 wildcard redirect zones, not publicly registered
    \n\n

    Cloudflare (6 Zones)

    \n
    \n
    \n
    Cloudflare Account
    \n
      \n
    • Account: Astoltz@iamwork.in
      • \n
    • Plan: Pro (planned)
      • \n
    • NS: dan.ns.cloudflare.com, frida.ns.cloudflare.com
      • \n
    • All Zones: SSL Full(strict), HSTS, min TLS 1.2
      • \n
    • API Tokens: \U0001F510 Cloudflare API Tokens
      • \n
    \n
    \n
    \n
    Active Zones
    \n
      \n
    • flowercore.io — Production API, landing page
      • \n
    • iamwork.in — Employee portal, telephony, DDNS
      • \n
    • bluejay.dev — Dev projects, voice bridge
      • \n
    • erckak.dev — Erik developer portfolio
      • \n
    • timeforta.co — Dustin personal
      • \n
    • flowerinsider.xyz — Dev/staging
      • \n
    \n
    \n
    \n

    Namecheap API

    \n
    \n
    \n
    API Configuration
    \n
      \n
    • Base URL: https://api.namecheap.com/xml.response
      • \n
    • API User: astoltz
      • \n
    • API Key: \U0001F510 Namecheap API
      • \n
    • Sandbox URL: https://api.sandbox.namecheap.com/xml.response
      • \n
    \n
    \n
    \n
    Dynamic DNS
    \n
      \n
    • Hostname: gateway.iamwork.in
      • \n
    • Points to: pfSense WAN IP (auto-updated)
      • \n
    • DDNS: gateway.iamwork.in → pfSense WAN DHCP IP (via Cloudflare API)
      • \n
    • Update Method: pfSense Dynamic DNS client (Cloudflare API token)
      • \n
    • Token: \U0001F510 Cloudflare pfSense Token
      • \n
    \n
    \n
    \n\n

    Internal DNS Architecture

    \n
    Split-Horizon DNS (LIVE): External requests to flowercore.io resolve via Cloudflare to public IP .24 (PROD). Internal requests resolve via pfSense Unbound to K8s MetalLB VIP (10.0.56.200), avoiding NAT hairpin. All internal infrastructure uses iamworkin.lan zone. 4 tenant .lan wildcard redirect zones configured in Unbound (base64-encoded custom_options).
    \n\n

    Planned IPv6 (ULA)

    \n\n\n\n\n\n
    PrefixSchemeMethod
    fdbc:56:XX::/64XX = VLAN ID (e.g., fdbc:56:56::/64 for MGMT)SLAAC + DHCPv6 (servers), SLAAC-only (clients)
    \n
    \n\n\n\n\n" kind: ConfigMap metadata: name: intranet-html