apiVersion: v1 kind: Namespace metadata: labels: app.kubernetes.io/part-of: bluejay-infra name: intranet --- apiVersion: v1 data: default.conf: "server {\n listen 80;\n server_name _;\n root /usr/share/nginx/html;\n index index.html;\n\n location / {\n try_files $uri $uri/ =404;\n }\n\n location /healthz {\n access_log off;\n return 200 \"ok\";\n add_header Content-Type text/plain;\n }\n}\n" kind: ConfigMap metadata: name: intranet-nginx-conf namespace: intranet --- apiVersion: v1 data: index.html: "\n\n\n\n\nBlue Jay Lab Intranet - FlowerCore\n\n\n\n\n
\n \n

Blue Jay Lab Intranet

\n

BlueJay Network Infrastructure — 12 VLANs | 6 Nodes | 3 Kubernetes Clusters | 5 WiFi SSIDs | 18 Domains | 15 Services Live

\n

Last updated: 2026-03-10

\n
Network Rebuild ~90% Complete — ISP /28 Fix Pending
\n
\n\n\n\n\n
\n

Overview

\n
\n
12
VLANs
\n
6
Physical Nodes
\n
3
Harvester VMs
\n
43+
DNS Entries
\n
17
Guacamole Conns
\n
5
WiFi SSIDs
\n
8
VPN Tunnels
\n
13
Public IPs
\n
18
Domains
\n
\n\n
Network Status: ~90% Complete. Phases 1-4, 6-10 done. K3s on noc1, Harvester 3-node cluster + RKE2 workload cluster operational. ISP /28 routing broken — Frontier fix expected ~2026-03-09. Currently single public IP via double-NAT.
\n\n

Quick Links — Web UIs

\n
\n
pfSense
https://10.0.56.1
\n
UniFi Cloud Key
https://10.0.56.3
\n
Synology WiFi (SRM)
http://10.0.58.2:8000
\n
Harvester / Rancher
https://10.0.56.14
\n
Cockpit (noc1)
https://10.0.56.10:9090
\n
Grafana
http://10.0.56.10:3000
\n
Prometheus
http://10.0.56.10:9091
\n
Guacamole
http://10.0.56.10:30080/guacamole/
\n
PKI Web
http://pki.iamworkin.lan:30081
\n
ArgoCD
https://argocd.iamworkin.lan
\n
Zabbix
https://zabbix.iamworkin.lan
\n
Gitea
https://gitea.iamworkin.lan
\n
Frontier Modem
http://192.168.254.254
\n
\n\n

Phase Progress

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PhaseDescriptionStatusProgress
1Frontier Modem ConfigDone100%
2pfSense Base (WAN, LAN, VIPs)Done100%
3VLAN Configuration (12 VLANs)Done100%
4Firewall Rules & AliasesDone100%
5Harvester + K8s ArchitectureIn Progress95%
6OpenVPN (8 servers)Done100%
7NAT ConfigurationDone100%
8Traffic ShaperDone100%
9DNS + NTP + SNMPDone100%
10Switch + WiFi ConfigDone100%
11NOC1 + Harvester InstallationIn Progress90%
12GitOps + IaC ResetIn Progress65%
13Documentation SyncIn Progress90%
\n
\n\n\n
\n

ISP & WAN

\n
\n
\n
ISP: Frontier Communications
\n
    \n
  • Service: 1000/1000 Mbps fiber
    • \n
  • Account: 952-431-5646-020421-7
    • \n
  • Measured: 925 down / 677 up (MGMT VLAN)
    • \n
\n
\n
\n
Modem: NVG468MQ
\n
    \n
  • Web: http://192.168.254.254
    • \n
  • Credentials: admin / 5108967609
    • \n
  • Serial: 184795207512112
    • \n
  • Firmware: 9.3.0h7d91
    • \n
  • WAN IP: 74.32.187.152/22
    • \n
  • Config: DMZ to pfSense, WiFi OFF, firewall OFF
    • \n
\n
\n
\n

WAN Status

\n\n\n\n\n\n\n\n\n\n
PropertyValue
pfSense WAN Interfaceix3 (DHCP from modem)
pfSense WAN IP192.168.254.122 (double NAT intentional)
Public /28 Block74.40.140.16/28
Gateway74.40.140.30
Usable Range74.40.140.17 – 74.40.140.29 (13 IPs)
\n
ISP /28 Routing BROKEN: Frontier confirmed the public subnet (74.40.140.16/28) is broken — return traffic not routed to modem WAN (74.32.185.184). Fix expected ~2026-03-09. Currently single public IP via double-NAT through modem private LAN.
\n

Modem Static Routes

\n\n\n\n\n\n\n
NameDestinationGatewayInterface
pfSense-Public-2874.40.140.16/28192.168.254.122LAN
pfSense-Private-Subnets10.0.0.0/8192.168.254.122LAN
\n

Public IP Allocation (13 usable)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IPFull AddressAssignmentVLAN(s)Services
.1674.40.140.16Network address—Unusable
.1774.40.140.17 ANDREW + VPN60Andrew tenant primary + VPN :1194/:1195
.1874.40.140.18 MATT + VPN61Matt tenant primary + VPN :1194/:1195
.1974.40.140.19 DUSTIN + VPN62Dustin tenant primary + VPN :1194/:1195
.2074.40.140.20 ERIK + VPN63Erik tenant primary + VPN :1194/:1195
.2174.40.140.21 PROD57K8s Traefik shared ingress (flowercore.io)
.2274.40.140.22Reserved——
.2374.40.140.23Reserved——
.2474.40.140.24Reserved——
.2574.40.140.25Reserved——
.2674.40.140.26Reserved——
.2774.40.140.27Reserved——
.2874.40.140.28 SHARED59,64,65,66,67WORK+SCHOOL+GUEST+VOIP+EMPLOYEE outbound
.2974.40.140.29 HOME58Home traffic + Nintendo Switch static port NAT
.3074.40.140.30Gateway (Frontier)—ISP\ \ router
.3174.40.140.31Broadcast—Unusable
\n
\n\n\n
\n

pfSense Firewall

\n
\n
\n
Netgate 4100
\n
    \n
  • Web: https://10.0.56.1
    • \n
  • Credentials: admin / SCOOBY_entry1latimer
    • \n
  • SSH: admin@10.0.56.1
    • \n
  • Hardware: 2x SFP+, 4x 2.5GbE (igc0-3)
    • \n
  • WAN: ix3 — LAN: igc0 (802.1Q trunk)
    • \n
  • Domain: iamworkin.lan
    • \n
\n
\n
\n
Firewall Stats
\n
    \n
  • Aliases: 36 (16 port, 5 host, 15 network)
    • \n
  • Rules: 90 active
    • \n
  • Policy: Air-gapped default — deny all, explicit allow
    • \n
  • SNMP: community bluejay_monitor
    • \n
  • SNMP Modules: mibII, netgraph, pf, hostres, bridge
    • \n
\n
\n
\n
Services
\n
    \n
  • DNS: Unbound (DNSSEC, WAN-only outgoing, prefetch)
    • \n
  • DHCP: dhcpd on all 12 VLAN interfaces (.100-.199)
    • \n
  • NTP: ntpd on all VLAN interfaces, DHCP option 42
    • \n
  • Traffic Shaper: 24 dummynet pipes, fq_codel
    • \n
\n
\n
\n

VLAN Configuration (12 VLANs)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VLANNameSubnetDHCP RangeDown/Up (Mbps)PriorityPublic IP
56MGMT10.0.56.0/24.100-.199500 / 5005WAN DHCP
57PROD10.0.57.0/24.100-.199500 / 5005.21
58HOME10.0.58.0/24.100-.199800 / 8003.29
59EMPLOYEE10.0.59.0/24.100-.199500 / 5003.28 (shared)
60ANDREW10.0.60.0/24.100-.199300 / 3003.17
61MATT10.0.61.0/24.100-.199300 / 3003.18
62DUSTIN10.0.62.0/24.100-.199300 / 3003.19
63ERIK10.0.63.0/24.100-.199300 / 3003.20
64WORK10.0.64.0/24.100-.199500 / 5003.28 (shared)
65SCHOOL10.0.65.0/24.100-.199200 / 2001.28 (shared)
66GUEST10.0.66.0/24.100-.199100 / 501.28 (shared)
67VOIP10.0.67.0/24.100-.199100 / 1007.28 (shared)
\n
Firewall Policy: MGMT has full access. HOME/WORK/SCHOOL get general internet. GUEST isolated except PROD web. Tenants fully isolated from each other — only PROD, DNS, NAS, and internet. VOIP is SIP-only outbound.
\n
\n\n\n
\n

Switching & WiFi

\n
\n
\n
UniFi Switch USW-Lite-16-PoE
\n
    \n
  • IP: 10.0.56.2
    • \n
  • MAC: 74:ac:b9:e3:93:ba
    • \n
  • SSH: GOShDkH@10.0.56.2
    • \n
  • SSH Password: 6IDvT8vmQH6QqsP
    • \n
  • Firmware: 7.2.123.16565
    • \n
  • CLI: Type cli for Realtek switch CLI
    • \n
\n
\n
\n
UniFi Cloud Key G2
\n
    \n
  • Web: https://10.0.56.3
    • \n
  • Credentials: admin / nest7BEGGAR*revoked
    • \n
  • SSH: root@10.0.56.3 / 6IDvT8vmQH6QqsP
    • \n
  • Network Version: 7.1.61
    • \n
  • MongoDB: port 27117 (database ace)
    • \n
\n
\n
\n
Synology RT6600AX (AP Mode)
\n
    \n
  • Web: http://10.0.58.2:8000
    • \n
  • Credentials: bluejay / galileo_parisian8ADMIRE
    • \n
  • SSH: bluejay@10.0.58.2 port 22
    • \n
  • MAC: 90:09:d0:3d:64:ae
    • \n
  • Mode: AP (bridge), all trunk ports enabled
    • \n
\n
\n
\n

Switch Port Assignments

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PortDeviceModeVLANStatus
1pfSense UplinkTrunk (All)56-67UP
2harvester3Trunk (All)56-67UP
3WiFi Uplink (Synology)Trunk, native 5857-67UP
4harvester2Trunk (All)56-67UP
5Cloud Key G2Access56 (MGMT)UP (PoE)
6harvester1Trunk (All)56-67UP
7Available——Down
8noc1Trunk (All)56-67UP
9WorkstationAccess56 (MGMT)UP
10Available——Down
11edge2 (Pi 4)Access57 (PROD)UP
12Available——Down
13edge1 (Pi 5)Access57 (PROD)UP
14Synology NASAccess58 (HOME)UP
15Available——Down
16Synology 2Access58 (HOME)UP
\n

WiFi SSIDs

\n\n\n\n\n\n\n\n\n\n
SSIDBridgeVLANTypePassword
BlueJay-Homebr0untagged (58)PrimaryStarling-Tundra-Condor-Coral
BlueJay-Employeebr259CustomMerlin~Ivory~Oakleaf~Bramble
BlueJay-Workbr364CustomForge.Hawk.Oakleaf.Topaz
BlueJay-Schoolbr465CustomHarbor-Eagle-Condor-Topaz
BlueJay-Guestgbr066Guest (isolation+NAT)Eagle.Oriole.Osprey.Silver
\n
\n\n\n
\n

DNS Directory

\n
All entries are pfSense Unbound host overrides under iamworkin.lan. 42+ total entries configured.
\n

Management Devices

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
pfsense.iamworkin.lan10.0.56.1 pfSense firewall
switch.iamworkin.lan10.0.56.2 UniFi PoE Switch
unifi.iamworkin.lan10.0.56.3 UniFi Cloud Key G2
wifi.iamworkin.lan10.0.58.2 Synology WiFi Router (AP)
nas.iamworkin.lan10.0.58.3 Synology NAS
\n

Harvester Cluster

\n\n\n\n\n\n\n\n\n
HostnameIPRole
harvester.iamworkin.lan10.0.56.14 Harvester VIP (cluster dashboard)
harvester1.iamworkin.lan10.0.56.11 Harvester node 1
harvester2.iamworkin.lan10.0.56.12 Harvester node 2
harvester3.iamworkin.lan10.0.56.13 Harvester node 3
\n

NOC Services (noc1)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
noc1.iamworkin.lan10.0.56.10 NOC management node (K3s)
acme.iamworkin.lan10.0.56.10step-ca ACME CA
pki.iamworkin.lan10.0.56.10PKI cert/CRL distribution
guac.iamworkin.lan10.0.56.10Apache Guacamole
grafana.iamworkin.lan10.0.56.10Grafana monitoring
prometheus.iamworkin.lan10.0.56.10Prometheus metrics
cockpit.iamworkin.lan10.0.56.10Cockpit web console
traefik.iamworkin.lan10.0.56.10Traefik dashboard (K3s)
gitea.iamworkin.lan10.0.56.10Gitea Git hosting (K3s, :3000/SSH :30022)
irc.iamworkin.lan10.0.56.10UnrealIRCd IRC server (K3s, TLS 6697)
intranet.iamworkin.lan10.0.56.10Lab intranet dashboard (K3s + Traefik TLS)
zabbix.iamworkin.lan10.0.56.10Zabbix monitoring (K3s, :30083, 10 hosts)
op-connect.iamworkin.lan10.0.56.101Password Connect (planned)
\n

RKE2 Workload Cluster

\n\n\n\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
rke2.iamworkin.lan10.0.56.118 RKE2 API server
rke2-node1.iamworkin.lan10.0.56.118RKE2 node 1 (on harvester2)
rke2-node2.iamworkin.lan10.0.56.119 RKE2 node 2 (on harvester1)
rke2-node3.iamworkin.lan10.0.56.120 RKE2 node 3 (on harvester3)
rke2-traefik.iamworkin.lan10.0.56.200 Traefik LoadBalancer (MetalLB)
rke2-ingress.iamworkin.lan10.0.56.200RKE2 ingress (MetalLB)
argocd.iamworkin.lan10.0.56.200ArgoCD GitOps (RKE2 via Traefik)
test.iamworkin.lan10.0.56.200RKE2 test workload
\n

Production / Edge Nodes

\n\n\n\n\n\n\n\n
HostnameIPRole
macmini.iamworkin.lan10.0.57.50 Mac Mini build node (Xcode)
edge1.iamworkin.lan10.0.57.15 Pi 5 + Hailo AI HAT+ 2
edge2.iamworkin.lan10.0.57.16 Pi 4 (Argon ONE, CI runner)
\n

Planned / Windows (pre-registered)

\n\n\n\n\n\n\n\n\n\n
HostnameIPRole
dc1.iamworkin.lan10.0.56.20 AD Domain Controller (planned)
wac1.iamworkin.lan10.0.56.21 Windows Admin Center (planned)
rds1.iamworkin.lan10.0.57.20 Remote Desktop Services (planned)
iis1.iamworkin.lan10.0.57.21 IIS Web Server (planned)
proxy.iamworkin.lan10.0.56.22 Squid Authenticated Proxy (planned)
\n
\n\n\n
\n

Kubernetes Clusters

\n

K3s (noc1 — Management Services)

\n
\n
\n
K3s on noc1
\n
    \n
  • Node: 10.0.56.10 (single-node)
    • \n
  • Version: K3s v1.34.5
    • \n
  • Traefik: Disabled (using NodePort)
    • \n
  • ServiceLB: Disabled
    • \n
  • Tools: kubectl v1.35.2, virtctl v1.7.0, helm v3.20.0
    • \n
\n
\n
\n
K3s Services
\n
    \n
  • Guacamole — :30080
    • \n
  • PKI Web — :30081
    • \n
  • Gitea — :3000 (SSH :30022)
    • \n
  • UnrealIRCd + Anope — :6667/:6697
    • \n
  • Zabbix — :30083
    • \n
\n
\n
\n

Harvester HCI (VM Platform)

\n
\n
\n
Harvester Cluster
\n
    \n
  • Dashboard: https://10.0.56.14
    • \n
  • Credentials: admin / getup-billion4AGAINST
    • \n
  • Version:\ \ Harvester v1.7.1 (K8s v1.34.3+rke2r3)
    • \n
  • Kubeconfig: /root/.kube/harvester.yaml on noc1
    • \n
  • Cluster Token: iamworkin.bluejay
    • \n
\n
\n
\n
Harvester Nodes
\n
    \n
  • harvester1: 10.0.56.11 — i7-1260P / 64GB
    • \n
  • harvester2: 10.0.56.12 — i7-1260P / 64GB
    • \n
  • harvester3: 10.0.56.13 — i5-1340P / 64GB
    • \n
  • SSH: rancher@10.0.56.{11,12,13}
    • \n
  • Password: 1qaz@WSX3edc$RFV
    • \n
\n
\n
\n
Harvester Resources
\n
    \n
  • VM Images: 11 (Ubuntu, openSUSE, Windows, SQL Server)
    • \n
  • VM Networks: 13 (12 VLAN bridges + mgmt-untagged)
    • \n
  • Storage: Longhorn (replica count 2)
    • \n
  • Active VMs: rke2-node1, rke2-node2, rke2-node3
    • \n
\n
\n
\n

RKE2 (Workload Cluster)

\n
\n
\n
RKE2 Cluster
\n
    \n
  • Version: RKE2 v1.34.4+rke2r1
    • \n
  • OS: openSUSE Leap 16.0 (cloud image)
    • \n
  • CNI: Calico (VXLAN mode)
    • \n
  • Pod CIDR: 10.42.0.0/16
    • \n
  • Service CIDR: 10.43.0.0/16
    • \n
  • Kubeconfig: /root/.kube/rke2.yaml on noc1
    • \n
  • Token: bluejay-rke2-2026
    • \n
  • Root Password: BlueJay-RKE2-2026
    • \n
\n
\n
\n
RKE2 Nodes
\n
    \n
  • rke2-node1: 10.0.56.118 (on harvester2)
    • \n
  • rke2-node2: 10.0.56.119 (on harvester1)
    • \n
  • rke2-node3: 10.0.56.120 (on harvester3)
    • \n
  • Specs: 4 vCPU, 16Gi RAM, 80Gi disk each
    • \n
  • SSH Key: /root/.ssh/rke2-nodes (ed25519)
    • \n
\n
\n
\n
RKE2 Infrastructure
\n
    \n
  • MetalLB: v0.14.9, L2 mode, pool 10.0.56.200-220
    • \n
  • Traefik: v3.6.9, 2 replicas, LB 10.0.56.200
    • \n
  • Namespaces: fc-system, fc-tenant-andrew, fc-tenant-matt, fc-tenant-dustin, fc-tenant-erik, test, traefik-system, metallb-system
    • \n
  • NetworkPolicies: Applied to all 5 tenant namespaces
    • \n
  • Test: nginx + IngressRoute on test.iamworkin.lan verified
    • \n
\n
\n
\n

pfSense Static Routes (K8s)

\n\n\n\n\n\n\n
DestinationGatewayPurpose
10.42.0.0/1610.0.56.118 (rke2-node1)Pod CIDR routing
10.43.0.0/1610.0.56.118 (rke2-node1)Service CIDR routing
\n
\n\n\n
\n

NOC Services (noc1)

\n
\n
\n
noc1 Host
\n
    \n
  • IP: 10.0.56.10
    • \n
  • SSH: root@10.0.56.10
    • \n
  • Password: 1qaz@WSX3edc$RFV
    • \n
  • OS: openSUSE Leap Micro 6.2 (immutable)
    • \n
  • CPU: Intel Celeron N5105 (4C/4T)
    • \n
  • RAM: 32 GB
    • \n
  • Disk: 1TB NVMe (929GB free)
    • \n
  • Runtimes: Podman 5.4.2, K3s v1.34.5
    • \n
\n
\n
\n

Service Directory

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ServiceURLPortCredentialsStatus
Cockpithttps://10.0.56.10:90909090root / 1qaz@WSX3edc$RFVOnline
Prometheushttp://10.0.56.10:90919091No auth (90-day retention)Online
Grafanahttp://10.0.56.10:30003000admin / BlueJay-Monitor-2026 Online
Node Exporterhttp://10.0.56.10:91009100Metrics onlyOnline
SNMP Exporterhttp://10.0.56.10:91169116pfSense SNMP scraperOnline
Guacamolehttp://10.0.56.10:30080/guacamole/30080guacadmin / BlueJay-Guac-2026 Online
step-ca ACMEhttps://acme.iamworkin.lan:94439443Password: BlueJay-StepCA-2026 Online
PKI Webhttp://pki.iamworkin.lan:3008130081Public (CRL/certs)Online
Giteahttps://gitea.iamworkin.lan3000bluejay / BlueJay-Gitea-2026 Online
UnrealIRCdirc.iamworkin.lan:6697 (TLS)6697OPER: bluejay / NickServ: BlueJay-IRC-2026 Online
Zabbixhttps://zabbix.iamworkin.lan30083Admin / BlueJay-NOC-Monitor-2026! Online
\n

RKE2 Services

\n\n\n\n\n\n\n

Prometheus Alerting (8 rules)

\n

NodeDown, PfSenseDown, HighCPU, HighMemory, DiskSpaceLow, and 3 additional rules. 2 Grafana dashboards: Node Exporter Full + BlueJay Network Overview.

\n

Guacamole Connection Groups (16 connections)

\n
ServiceURLPortCredentialsStatus
ArgoCDhttps://argocd.iamworkin.lan443 (via Traefik)admin / Hau6JLvtxeFoEKMC — bluejay / BlueJay-ArgoCD-2026 Online
Traefikhttps://rke2-traefik.iamworkin.lan80/443 (MetalLB 10.0.56.200)Dashboard: :8080Online
\n\n\n\n\n\n\n\n
GroupConnectionsProtocol
Kubernetes (6)Harvester 1, Harvester 2, Harvester 3, RKE2 Node 1,\ \ RKE2 Node 2, RKE2 Node 3SSH
Network Devices (4)pfSense, UniFi Cloud Key, UniFi Switch, Synology WiFiSSH
Servers (5)noc1, Mac Mini (SSH+VNC), Edge1 Pi5, Synology NAS, Edge2 Pi4SSH/VNC
Web Consoles (1)Harvester DashboardHTTPS
\n
\n\n\n
\n

VPN & Security

\n
OpenVPN Status: 8 servers were configured and verified but have been cleaned out pending ISP /28 fix. CA and certificates remain in pfSense config. Will re-create bound to new tenant VIPs (.17-.20) after Frontier restores /28 routing.
\n

OpenVPN Configuration

\n\n\n\n\n\n\n\n\n
TenantVIPTUN PortTAP PortTunnel (TUN)Tunnel (TAP)VLAN
ANDREW.171194/UDP1195/UDP10.0.68.0/2710.0.68.128/2760
MATT.181194/UDP1195/UDP10.0.68.32/2710.0.68.160/2761
DUSTIN.191194/UDP1195/UDP10.0.68.64/2710.0.68.192/2762
ERIK.201194/UDP1195/UDP10.0.68.96/2710.0.68.224/2763
\n

VPN Certificate Infrastructure

\n\n\n\n\n\n\n\n\n\n
ComponentDetails
CABlueJay VPN CA (4096-bit RSA, SHA-256, 10-year)
Server Certs8 (one per VPN instance, 2048-bit RSA)
Client Certs4 (one per tenant, 2048-bit RSA)
TLS AuthShared HMAC key across all servers
Data CiphersAES-256-GCM, AES-128-GCM, CHACHA20-POLY1305
\n

IPsec Site-to-Site (Planned)

\n\n\n\n\n\n\n
TunnelLocalRemotePhase 1Phase 2 SAs
Matt.29 (pfSense WAN)Matt's public IPIKEv2, AES-256-GCM, DH 14+MATT (10.0.61.0/24) + PROD (10.0.57.0/24)
Dustin.29 (pfSense WAN)Dustin's public IPIKEv2, AES-256-GCM, DH 14+DUSTIN (10.0.62.0/24) + PROD (10.0.57.0/24)
\n

PKI Hierarchy

\n\n\n\n\n\n\n\n\n\n
CAStatusPurpose
Root CA (IAmWorkin ACME CA)OperationalTrust anchor, ECDSA P-256, expires 2036
ACME CA (step-ca on noc1)OperationalAutomated cert issuance via ACME protocol
Network CAPlannedSwitch, AP, pfSense device certs
Windows AD CS CAPlannedDomain-joined machine/user certs
Internal Services CAPlannedK8s service mesh, inter-service mTLS
\n
\n\n\n
\n

Edge Nodes

\n
\n
\n
edge1 — Raspberry Pi 5 + Hailo AI
\n
    \n
  • IP: 10.0.57.15 (PROD VLAN 57)
    • \n
  • SSH: stoltz@10.0.57.15
    • \n
  • Password: 1qaz@WSX3edc$RFV
    • \n
  • Hardware: Pi 5 16GB + Hailo-10H 40 TOPS
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • PCIe: Gen 3 x1 (8.0 GT/s)
    • \n
  • Power: 27W USB-C
    • \n
  • .NET SDK: 10.0.103
    • \n
  • GitHub Runner: v2.332.0 (labels: pi5, hailo)
    • \n
  • Node Exporter: :9100
    • \n
  • Switch Port: 13
    • \n
\n
\n
\n
edge2 — Raspberry Pi 4 (Argon ONE)
\n
    \n
  • IP: 10.0.57.16 (PROD VLAN 57)
    • \n
  • SSH: stoltz@10.0.57.16
    • \n
  • Password: 1qaz@WSX3edc$RFV
    • \n
  • Hardware: Pi 4 Model B 4GB, Argon ONE case
    • \n
  • OS: Debian 13 (trixie) aarch64
    • \n
  • Fan Control: argononed.service
    • \n
  • .NET SDK: 10.0.103
    • \n
  • GitHub Runner: v2.332.0 (labels: pi4, ci-runner)
    • \n
  • Node Exporter: :9100
    • \n
  • Switch Port: 11
    • \n
\n
\n
\n
Mac Mini (Build/Test Node)
\n
    \n
  • IP: 10.0.57.50 (PROD VLAN 57)
    • \n
  • SSH: bluejay@10.0.57.50
    • \n
  • Password: indigene-new-neptune-nuthatch
    • \n
  • VNC Password: tacokisses
    • \n
  • Role: Xcode builds, automated browser/app testing
    • \n
\n
\n
\n
\n\n\n
\n

WiFi Networks

\n
Credentials: All WiFi passwords are stored in the IAmWorkin vault on 1Password. To connect a device, open the 1Password app, find the WiFi entry, and scan the QR code from there. Passwords are not stored in this page for security.
\n
QR Code Connection: Open 1Password → search for the SSID name → tap “Show QR Code” → scan with your device camera. The QR code encodes the full WIFI:T:WPA;S:{SSID};P:{PASSWORD};;; connection string.
\n\n
\n \n
\n
\n
BlueJay-Home
\n
HOME (VLAN 58)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Home\n
\n
\n VLAN\n 58 (untagged on AP)\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n See 1Password\n
\n
\n Purpose\n Home network — personal / family use\n
\n
\n Bandwidth\n 800 / 800 Mbps\n
\n
\n Public IP\n 74.40.140.29\n
\n
\n
\n\n \n
\n
\n
BlueJay-Employee
\n
EMPLOYEE (VLAN 59)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Employee\n
\n
\n VLAN\n 59\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n See 1Password\n
\n
\n Purpose\n Employee network — staff device access\n
\n
\n Bandwidth\n 500 / 500 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-Work
\n
WORK (VLAN 64)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-Work\n
\n
\n VLAN\n 64\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n See 1Password\n
\n
\n Purpose\n Work network — business devices\n
\n
\n Bandwidth\n 500 / 500 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-School
\n
SCHOOL (VLAN 65)
\n
\n
\n
\n \n \n \n \n \n Scan from 1Password app\n
\n
\n
\n
\n SSID\n BlueJay-School\n
\n
\n VLAN\n 65\n
\n
\n Security\n WPA2/WPA3\n
\n
\n Password\n See 1Password\n
\n
\n Purpose\n School network — student devices\n
\n
\n Bandwidth\n 200 / 200 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n\n \n
\n
\n
BlueJay-Guest
\n
GUEST (VLAN 66)
\n
\n
\n
\n \n \n \n \n \n Open network — no password required\n
\n
\n
\n
\n SSID\n BlueJay-Guest\n
\n
\n VLAN\n 66\n
\n
\n Security\n Open / Captive Portal\n
\n
\n Password\n None (open)\n
\n
\n Purpose\n Guest WiFi — fully isolated, NAT only\n
\n
\n Bandwidth\n 100 / 50 Mbps\n
\n
\n Public IP\n 74.40.140.28 (shared)\n
\n
\n
\n
\n\n

WiFi Access Point

\n
\n
\n
Synology RT6600AX (AP Mode)
\n
    \n
  • Management: http://10.0.58.2:8000
    • \n
  • Credentials: bluejay / galileo_parisian8ADMIRE
    • \n
  • Mode: Access Point (bridge mode), all trunk ports enabled
    • \n
  • Bands: Wi-Fi 6E (2.4 GHz + 5 GHz + 6 GHz)
    • \n
  • Switch Port: 3 (trunk, native VLAN 58)
    • \n
\n
\n
\n\n
Network Isolation: Each SSID maps to a separate VLAN with independent firewall rules and bandwidth limits. GUEST is fully isolated with NAT — no access to internal resources. EMPLOYEE, WORK, and SCHOOL share public IP .28 with traffic shaping.
\n
\n\n\n
\n

Credentials & 1Password

\n
\n
\n
1Password Connect Server
\n
    \n
  • API: http://10.0.56.10:8180
    • \n
  • Sync: http://10.0.56.10:8181
    • \n
  • Host: noc1 (Podman containers)
    • \n
  • Status: Online
    • \n
\n
\n
\n
1Password K8s Operator
\n
    \n
  • Namespace: onepassword-system
    • \n
  • Chart: 1password/connect v2.3.0
    • \n
  • Operator: v1.11.0
    • \n
  • Poll Interval: 600s
    • \n
  • Status: Online
    • \n
\n
\n
\n
IAmWorkin Vault
\n
    \n
  • Vault Name: IAmWorkin
    • \n
  • Items: 26+ credentials
    • \n
  • Rotation: Quarterly (Jan/Apr/Jul/Oct)
    • \n
  • Script: /opt/scripts/rotate-credentials.sh
    • \n
  • Timer: credential-rotation.timer
    • \n
\n
\n
\n\n
All infrastructure credentials are managed in 1Password. The IAmWorkin vault contains credentials for every service listed on this intranet. K8s workloads (Zabbix, Matrix, Guacamole, Mail, IRC, Gitea, ArgoCD) sync secrets automatically via OnePasswordItem CRDs. Credential rotation runs quarterly via systemd timer.
\n\n

K8s Secret Sync (OnePasswordItem CRDs)

\n\n\n\n\n\n\n\n\n\n\n\n
NamespaceSecret NameSource (1Password Item)Status
zabbixzabbix-credentialsZabbix MonitoringSynced
matrixmatrix-credentialsMatrix SynapseSynced
guacamoleguacamole-credentialsApache GuacamoleSynced
mailmail-credentialsMail ServerSynced
ircirc-credentialsIRC ServicesSynced
giteagitea-credentialsGiteaSynced
argocdargocd-credentialsArgoCDSynced
\n\n

Credential Rotation

\n
\n
\n
Rotation Script
\n
    \n
  • Path: /opt/scripts/rotate-credentials.sh
    • \n
  • Usage: rotate-credentials.sh {service|all} [--dry-run]
    • \n
  • Services: grafana, guacamole, zabbix, argocd, gitea, snappymail, traefik, matrix, harvester
    • \n
  • Schedule: Quarterly (1st of Jan/Apr/Jul/Oct at 03:00 UTC)
    • \n
  • Log: /var/log/credential-rotation.log
    • \n
\n
\n
\n
\n\n\n
\n

Planned Services

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ServiceIPHostRoleStatus
Windows DC110.0.56.20Harvester VMAD Domain Controller (iamworkin.lan)Planned
Windows WAC110.0.56.21Harvester VMWindows Admin CenterPlanned
Windows RDS110.0.57.20Harvester VMRemote Desktop ServicesPlanned
Windows IIS110.0.57.21Harvester VMIIS Web ServerPlanned
Gitea10.0.56.10K3s (noc1)Git hosting (gitea.iamworkin.lan)Live
UnrealIRCd10.0.56.10K3s (noc1)IRC server (irc.iamworkin.lan:6697)Live
Zabbix10.0.56.10K3s (noc1)Network monitoring (zabbix.iamworkin.lan, 10 hosts)Live
1Password Connect10.0.56.10noc1Secrets management APIPlanned
Squid Proxy10.0.56.22Harvester VMAuthenticated web proxy (Kerberos/LDAP)Planned
ArgoCD10.0.56.200RKE2 (via Traefik)GitOps for K8s workloads (argocd.iamworkin.lan)Live
\n
\n\n\n
\n

Network Topology

\n
\n\n
Internet
\n
\n
Frontier ONT + NVG468MQ Modem

WAN: 74.32.187.152 • /28: .17-.29

192.168.254.254 • DMZ to pfSense

\n
\n
pfSense Netgate 4100

WAN: ix3 (.122) • LAN: igc0 (802.1Q trunk)

12 VLANs • 36 aliases • 90 rules • DNS/DHCP/NTP/SNMP

\n
\n
UniFi USW-Lite-16-PoE Switch

10.0.56.2 • 16 ports • VLANs 56-67

\n
\n\n
\n
\n
noc1
\n

10.0.56.10 MGMT

\n

Celeron N5105 • 32GB • K3s + Podman

\n
    \n
  • Guacamole :30080
  • Grafana :3000
  • Prometheus :9091
    • \n
  • step-ca :9443
  • Gitea :3000
  • IRC :6697
    • \n
  • Zabbix :30083
  • Cockpit\ \ :9090
  • Puppet :8140
    • \n
\n
\n
\n
Harvester Cluster
\n

VIP: 10.0.56.14 MGMT

\n
    \n
  • harvester1: .11 (i7-1260P/64GB)
    • \n
  • harvester2: .12 (i7-1260P/64GB)
    • \n
  • harvester3: .13 (i5-1340P/64GB)
    • \n
\n

Harvester v1.7.1 • Longhorn • Rancher embedded

\n
\n
\n
RKE2 Workload Cluster
\n

Traefik: 10.0.56.200 MGMT

\n
    \n
  • rke2-node1: .118 (on harvester2)
    • \n
  • rke2-node2: .119 (on harvester1)
    • \n
  • rke2-node3: .120 (on harvester3)
    • \n
\n

Calico • MetalLB • Traefik v3.6.9 • ArgoCD

\n
\n
\n
WiFi (Synology RT6600AX)
\n

10.0.58.2 HOME

\n
    \n
  • BlueJay-Home (untagged)
  • BlueJay-Employee (VLAN 59)
    • \n
  • BlueJay-Work (VLAN 64)
  • BlueJay-School (VLAN 65)
    • \n
  • BlueJay-Guest (VLAN 66)
    • \n
\n
\n
\n
PROD Nodes
\n

PROD VLAN 57

\n
    \n
  • Mac Mini: 10.0.57.50 (Xcode)
    • \n
  • edge1 Pi5: 10.0.57.15 (Hailo AI)
    • \n
  • edge2 Pi4: 10.0.57.16 (CI runner)
    • \n
\n
\n
\n
Network Devices
\n
    \n
  • Cloud Key: 10.0.56.3
    • \n
  • NAS: 10.0.58.3
    • \n
  • Modem: 192.168.254.254
    • \n
\n
\n
\n
\n
\n\n\n
\n

Domains

\n
\n
17
Registered Domains
\n
1
Internal Domain
\n
1
Blog Hosting (DreamHost)
\n
18
Total Domains
\n
\n\n

FlowerCore Domains

\n\n\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
flowercore.ioFlowerCoreAndrewProduction APICloudflareNamecheap
flowerinsider.xyzFlowerCoreAndrewDev/stagingNamecheapNamecheap
flowerinsider.comFlowerCore CoAndrewCompany siteNamecheapNamecheap
flowerinsider.nlFlowerCore CoAndrewDutch siteNamecheapNamecheap
\n\n

Work Domains

\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
iamwork.inWorkAndrewEmployee portal, IVRNamecheapNamecheap
iamworkin.comWorkAndrewRedirectNamecheapNamecheap
\n\n

Personal & Tenant Domains

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
ackeroni.comErikErikPersonalNamecheapNamecheap
erckak.comErikErikPersonalNamecheapNamecheap
erckak.devErikErikDeveloper portfolioNamecheapNamecheap
digirido.comRandomAndrewDigiKey testingNamecheapNamecheap
timeforta.coDustinDustinPersonalNamecheapNamecheap
shenanjia.comWifeWifePersonal siteNamecheapNamecheap
bluejay.apiPersonal FunAndrewAPI experimentsNamecheapNamecheap
bluejay.devPersonal FunAndrewDev projectsNamecheapNamecheap
jayblue.devPersonal FunAndrewDev projectsNamecheapNamecheap
z.orbRandomAndrewShort URLNamecheapNamecheap
\n\n

Blog & Content Domains

\n\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderRegistrar
pebbleandpeanut.comBlogAndrewPersonal blogDreamHostNamecheap
pebblesandpeanuts.comBlogAndrewAlt redirectNamecheapNamecheap
\n\n

Internal Domain

\n\n\n\n\n\n
DomainCategoryOwnerPurposeDNS ProviderNotes
iamworkin.lanInternalAndrewInternal infrastructure, future AD DSpfSense Unbound43+ host overrides, not publicly registered
\n\n

Namecheap API

\n
\n
\n
API Configuration
\n
    \n
  • Base URL: https://api.namecheap.com/xml.response
    • \n
  • API User: astoltz
    • \n
  • API Key: e36f347844fb4cc3a82d4e0f4e4af82e
    • \n
  • Sandbox URL: https://api.sandbox.namecheap.com/xml.response
    • \n
\n
\n
\n
Dynamic DNS
\n
    \n
  • Hostname: gateway.iamwork.in
    • \n
  • Points to: pfSense WAN IP (auto-updated)
    • \n
  • DDNS Endpoint: https://dynamicdns.park-your-domain.com/update?host=gateway&domain=iamwork.in&password=d8ad7194c9224c26bc50cfa5feb8764e
    • \n
  • Update Method: pfSense Dynamic DNS client or cron
    • \n
\n
\n
\n\n

Internal DNS Architecture

\n
Split-Horizon DNS (planned): External requests to flowercore.io resolve via Cloudflare to public IP .21. Internal requests resolve via pfSense Unbound to K8s MetalLB VIP (10.0.56.200), avoiding NAT hairpin. All internal infrastructure uses iamworkin.lan zone.
\n\n

Planned IPv6 (ULA)

\n\n\n\n\n\n
PrefixSchemeMethod
fdbc:56:XX::/64XX = VLAN ID (e.g., fdbc:56:56::/64 for MGMT)SLAAC + DHCPv6 (servers),\ \ SLAAC-only (clients)
\n
\n\n\n\n\n" kind: ConfigMap metadata: name: intranet-html namespace: intranet --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: intranet name: intranet namespace: intranet spec: replicas: 1 selector: matchLabels: app: intranet template: metadata: labels: app: intranet spec: containers: - image: nginx:alpine livenessProbe: httpGet: path: /healthz port: 80 initialDelaySeconds: 5 periodSeconds: 10 name: nginx ports: - containerPort: 80 name: http readinessProbe: httpGet: path: /healthz port: 80 initialDelaySeconds: 3 periodSeconds: 5 resources: limits: cpu: 50m memory: 64Mi requests: cpu: 5m memory: 16Mi volumeMounts: - mountPath: /etc/nginx/conf.d/default.conf name: nginx-conf subPath: default.conf - mountPath: /usr/share/nginx/html name: html volumes: - configMap: name: intranet-nginx-conf name: nginx-conf - configMap: name: intranet-html name: html --- apiVersion: v1 kind: Service metadata: name: intranet namespace: intranet spec: ports: - name: http port: 80 targetPort: 80 selector: app: intranet --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: intranet-tls namespace: intranet spec: dnsNames: - intranet.iamworkin.lan issuerRef: kind: ClusterIssuer name: step-ca-acme secretName: intranet-tls --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: intranet namespace: intranet spec: entryPoints: - websecure routes: - kind: Rule match: Host(`intranet.iamworkin.lan`) services: - name: intranet port: 80 tls: secretName: intranet-tls