Every host, its role, and how it's reached. Solid lines are always-on LAN links; dashed gold lines are brokered, session-scoped access with no standing tunnel; dotted green is storage replication.
Addresses are fictional — drawn from documentation-reserved ranges (RFC 5737 / RFC 1918), not the real network| Host | Address | Role |
|---|---|---|
| dns-01 / dns-02 | 10.42.30.11 / .12 | Primary/secondary internal resolvers |
| host-pve-01 / -02 | 10.42.30.21 / .22 | Hypervisors, Ceph replica ×2 between them |
| iam-01 | 10.42.30.30 | CA, secrets, SSO, access broker — single trust anchor |
| git-01 | 10.42.30.40 | Self-hosted Git, IaC + GitOps source |
| k8s-cp-01 | 10.42.30.51 | Kubernetes control-plane |
| k8s-worker-01 / -02 | 10.42.30.52 / .53 | Kubernetes workers |
| ingress vip | 10.42.30.60 | L2 load-balancer address for all ingress traffic |
| tailscale relay | 203.0.113.9 | Admin reachability only — no public web traffic |
| workstation | DHCP | No fixed address — never a target, only ever the client |
Unlike the internal addresses above, these are live DNS entries — they're already public, so there's nothing to anonymize. All four resolve through the Cloudflare Tunnel shown in the diagram, straight into the in-cluster ingress controller; none of them touch the tailscale relay or expose a home IP.
| Hostname | Routes to |
|---|---|
| refractare.com | Portfolio — this page |
| app.refractare.com | Phoenix frontend |
| api.refractare.com | Phoenix backend |
| sso.refractare.com | Identity provider login |
Every arrow into this network is either a permanent LAN link between hosts I control, or a dashed line that only exists for the length of one authenticated session. There is no third kind of connection.