13 docs tagged with "networking"

Network-wide DNS ad-blocker — every device on the home LAN points at it for resolution, ads and trackers never make it past the gateway.

Reusable Kustomize component that drops a baseline `NetworkPolicy` into every app's namespace — default-deny ingress + egress, with explicit allow-rules for what the app actually needs to talk to.

eBPF-based CNI providing pod networking, kube-proxy replacement, network policy, WireGuard node-to-node encryption, L2 announcements for LoadBalancer IPs, and Hubble flow visibility.

Dynamic DNS updater — keeps the public DNS records for the homelab in sync with the WAN IP, even when the ISP rotates it.

The connective layer of the homelab — three sites (edge, production, home) stitched together by a NetBird mesh, with VLAN segmentation in production and home.

Shared cluster resource that defines the internal `HTTPRoute` parent — the Gateway that internal-only apps attach to so their hostnames resolve on the home/mesh side without ever being routed publicly.

WireGuard mesh overlay (api.netbird.io) that ties the edge, production, and home environments into a single private network with identity-based access control.

NetBird peer running on the Maresa Synology host so the NAS is reachable over the mesh — Syncthing, AdGuard, and the Traefik dashboard all available to authenticated mesh members.

Use PROXY protocol v2 to carry the real client IP through netbird/SNAT and a multi-proxy chain — with Gitea (HTTP + SSH) as a worked example showing both mental models.

How the NetBird WireGuard overlay is woven through every layer of the homelab — the identity-owning Tofu environment, per-site networks and routing peers, workload sidecars, the in-cluster operator, and the two private DNS zones that keep everything reachable without public exposure.

End-to-end walkthrough of the homelab's ingress path — how a browser hitting immich.web.kueber.eu resolves DNS, lands on the Hetzner edge, crosses the NetBird mesh with PROXY protocol v2, terminates TLS on the production Envoy Gateway, and reaches the pod through Cilium.

Local reverse proxy + TLS terminator on the Maresa Synology host — exposes the host-local services (Syncthing UI, AdGuard UI, Traefik dashboard) on the internal *.maresa.int.kueber.eu zone with Let's Encrypt certs.

Home network — UniFi gateway and switch driving the four LAN subnets (management, IoT, private, guest), plus the FritzBox upstream and the energy LAN reachable only via NetBird.