Infrastructure Overview¶
Last updated: 2026-08-22
Cluster¶
- Hypervisor: Proxmox VE (192.168.1.144) — hosts all nebula VMs and DMZ VMs
- K8s: MicroK8s 5-node HA cluster, v1.32.9 on Ubuntu 24.04 (nebula-1 through nebula-5, 192.168.1.15–19)
- Namespaces:
heezyholds most workloads;gitea,openbao,external-secrets,secrets,longhorn-system,metallb-system,ingressandgpu-operator-resourceshold the rest - Storage: Longhorn (block/RWO, 3 replicas by default), NFS via TrueNAS (RWX for media/shared data)
- Ingress: SWAG (nginx) at MetalLB VIP 192.168.1.25, TLS via Let's Encrypt
- DNS: dnsmasq (192.168.1.29) — authoritative for heezy.local, heezy.info, trentnielsen.me, heezy.blog. Pi-hole (192.168.1.27) is the resolver DHCP hands out; it forwards to dnsmasq and holds no zone records of its own.
Networking¶
| VLAN | Subnet | Zone | Purpose |
|---|---|---|---|
| native | 192.168.1.0/24 | SHARED | Servers, k8s nodes, infra |
| 200 | 192.168.2.0/24 | USERS | Clients, desktops, wireless |
| 3 | 192.168.3.0/24 | DMZ | Public-facing game servers |
| 2000 | 192.168.200.0/24 | PROD | Reserved, unused |
Firewall: FortiGate at 192.168.1.1. All routing between VLANs goes through the FortiGate. DMZ never initiates connections into SHARED/USERS. All firewall rules managed as code in terraform-heezy.
Key Hosts¶
| Host | IP | Role |
|---|---|---|
| fortigate | 192.168.1.1 | Firewall, router, DHCP |
| shared-lgtm | 192.168.1.10 | Idle; kept as the LGTM rollback |
| nebula-1 | 192.168.1.15 | MicroK8s node |
| nebula-2 | 192.168.1.16 | MicroK8s node |
| nebula-3 | 192.168.1.17 | MicroK8s node |
| nebula-4 | 192.168.1.18 | MicroK8s node |
| nebula-5 | 192.168.1.19 | MicroK8s node |
| big-boi | 192.168.1.21 | Plex/Steam server, Postgres, Ollama, LGTM stack, GPU (RTX 3070) |
| cisco-switch | 192.168.1.26 | Core switch |
| shared-dnsmasq | 192.168.1.29 | dnsmasq DNS server |
| proxmox | 192.168.1.144 | Proxmox VE hypervisor |
| nfs-server | 192.168.1.200 | TrueNAS NFS storage |
MicroK8s picks three of the five nodes as dqlite voters and promotes a standby automatically when one
goes away, so which node is a "master" is not fixed and should not be encoded anywhere. Read the
current split with microk8s status on any node.
MetalLB VIPs¶
Pool default-addresspool is 192.168.1.25–192.168.1.40.
| VIP | Service | Purpose |
|---|---|---|
| 192.168.1.25 | SWAG | Main ingress — all HTTPS services route here |
| 192.168.1.27 | Pi-hole | DNS + admin UI |
| 192.168.1.28 | Plex | Direct Plex access |
| 192.168.1.30 | SWAG-Plex | Plex reverse proxy |
| 192.168.1.31 | Gitea | Git server (port 3000) |
| 192.168.1.32 | OpenBao | Secrets manager (port 8200) |
| 192.168.1.33 | Uptime Kuma | Direct app access on :3001 (SWAG does not proxy its Socket.IO API) |
| 192.168.1.34 | slskd | Soulseek daemon behind the gluetun VPN sidecar |
DMZ Hosts¶
| Host | IP | Ports | Service |
|---|---|---|---|
| dmz-minecraft | 192.168.3.13 | 19132/UDP | Minecraft Bedrock |
| dmz-cs16 | 192.168.3.14 | 27015/UDP, 80/TCP | Counter-Strike 1.6 |
| dmz-minecraft-java | 192.168.3.15 | 25565/TCP | Minecraft Java |
| dmz-ut2k4 | 192.168.3.16 | 7777-7787/UDP, 28902/TCP | Unreal Tournament 2004 |
Monitoring Stack¶
All on big-boi (192.168.1.21) as Docker Compose, with config and data under /mnt/lgtm:
| Service | Port | URL |
|---|---|---|
| Grafana | 3000 | https://grafana.heezy.info |
| Prometheus | 9090 | http://192.168.1.21:9090 |
| Loki | 3100 | http://192.168.1.21:3100 |
| Tempo | 3200 | OTLP on 4317/4318 |
| Mimir | 9009 | — |
| snmp-exporter | 9116 | Polls the FortiGate and the Cisco switch |
| Promtail | 514/UDP | Syslog receiver for network gear |
Promtail also runs as a systemd service on all 12 Linux hosts (the five nebula nodes get a
k8s-specific scrape config), and as a DaemonSet in the heezy namespace for container logs. Both
ship to Loki.
big-boi¶
big-boi (192.168.1.21) is a Plex/Steam headless server and Docker Compose host. It is not a
CI/CD runner, and nothing schedules work on it. All automation runs on k8s act-runner pods.
Containers on big-boi: Plex, Steam headless, SWAG, Ollama, Open WebUI, Postgres, nvidia-gpu-exporter.
The Postgres container is still named n8n-postgres for historical reasons; it now serves the
heezy, maintenance and projects databases. n8n and the OpenClaw agent were retired in August
2026 and their workflows now run as Python CronJobs in k8s — see Mailbot.
Tailscale runs here as a systemd service. NFS share mounted at /nfs (from TrueNAS 192.168.1.200,
dataset Arr1/SMB). SSH access via the mcp-admin user.