Infrastructure Overview¶
Last updated: 2026-06-23
Cluster¶
- Hypervisor: Proxmox (192.168.1.144) — hosts all nebula VMs and DMZ VMs
- K8s: MicroK8s 5-node HA cluster (nebula-1 through nebula-5, 192.168.1.15–19)
- Namespace:
heezyfor all homelab workloads - Storage: Longhorn (block/RWO, replicated across 3 nodes), NFS via TrueNAS (RWX for media/shared data)
- Ingress: SWAG (nginx) at MetalLB VIP 192.168.1.25, TLS via Let's Encrypt
- DNS: dnsmasq (192.168.1.29) — authoritative for heezy.local, heezy.info, trentnielsen.me, heezy.blog
Networking¶
| VLAN | Subnet | Zone | Purpose |
|---|---|---|---|
| native | 192.168.1.0/24 | SHARED | Servers, k8s nodes, infra |
| 200 | 192.168.2.0/24 | USERS | Clients, desktops, wireless |
| 3 | 192.168.3.0/24 | DMZ | Public-facing game servers |
Firewall: FortiGate at 192.168.1.1. All routing between VLANs goes through the FortiGate. DMZ never initiates connections into SHARED/USERS. All firewall rules managed as code in terraform-heezy.
Key Hosts¶
| Host | IP | Role |
|---|---|---|
| fortigate | 192.168.1.1 | Firewall, router, DHCP |
| shared-lgtm | 192.168.1.10 | Grafana + Loki + Prometheus + Tempo + Mimir |
| nebula-1 | 192.168.1.15 | MicroK8s node (HA standby) |
| nebula-2 | 192.168.1.16 | MicroK8s node (HA master) |
| nebula-3 | 192.168.1.17 | MicroK8s node (HA master) |
| nebula-4 | 192.168.1.18 | MicroK8s node (HA standby) |
| nebula-5 | 192.168.1.19 | MicroK8s node (HA master) |
| big-boi | 192.168.1.21 | Plex/Steam server, n8n, OpenClaw, Postgres, GPU (RTX 3070) |
| shared-dnsmasq | 192.168.1.29 | dnsmasq DNS server |
| proxmox | 192.168.1.144 | Proxmox VE hypervisor |
| nfs-server | 192.168.1.200 | TrueNAS NFS storage |
MetalLB VIPs¶
| VIP | Service | Purpose |
|---|---|---|
| 192.168.1.25 | SWAG | Main ingress — all HTTPS services route here |
| 192.168.1.27 | Pi-hole | DNS + admin UI |
| 192.168.1.28 | Plex | Direct Plex access |
| 192.168.1.30 | SWAG-Plex | Plex reverse proxy |
| 192.168.1.31 | Gitea | Git server (port 3000) |
| 192.168.1.32 | OpenBao | Secrets manager (port 8200) |
DMZ Hosts¶
| Host | IP | Ports | Service |
|---|---|---|---|
| dmz-minecraft | 192.168.3.13 | 19132/UDP | Minecraft Bedrock |
| dmz-cs16 | 192.168.3.14 | 27015/UDP, 80/TCP | Counter-Strike 1.6 |
| dmz-minecraft-java | 192.168.3.15 | 25565/TCP | Minecraft Java |
| dmz-ut2k4 | 192.168.3.16 | 7777-7787/UDP, 28902/TCP | Unreal Tournament 2004 |
Monitoring Stack¶
All on shared-lgtm (192.168.1.10) as Docker Compose:
| Service | Port | URL |
|---|---|---|
| Grafana | 3000 | https://grafana.heezy.info |
| Prometheus | 9090 | http://192.168.1.10:9090 |
| Loki | 3100 | http://192.168.1.10:3100 |
| Tempo | 3200 | — |
| Mimir | 9009 | — |
Promtail runs as a DaemonSet on all k8s nodes, shipping container logs to Loki.
big-boi¶
big-boi (192.168.1.21) is a Plex/Steam headless server and Docker Compose host. It is not a CI/CD runner. All automation runs on k8s act-runner pods.
Services on big-boi: Plex, Steam headless, n8n, OpenClaw, Postgres (heezy + n8n DBs), Ollama, Open WebUI.
NFS share mounted at /nfs (from TrueNAS 192.168.1.200). SSH access via mcp-admin user.