Install & Setup Notes

Ansible

• Seems to require export ANSIBLE_BECOME_EXE=sudo.ws due to this issue
• Run with ansible-playbook playbook.yml -i inventory.yml -kK where the flags have you manually input SSH password

Repo Structure

• ansible/ - Contains Ansible playbook to bootstrap K3s
• pulumi - IaC for managing cloud & k8s resources

Architecture Notes

Diagram

flowchart TB
    subgraph Internet
        Users[External Users]
        CF[Cloudflare]
    end

    subgraph Tailnet[Tailscale Network]
        Admin[Admin/Internal Users]
    end

    subgraph Cluster[K3s Cluster]
        subgraph Server["Control Plane (new-bermuda)"]
            subgraph Networking
                TSOperator[Tailscale Operator]
                Cloudflared[cloudflared pods]
            end

            subgraph Apps[Applications]
                Foundry[Foundry VTT]
                Glance[Glance Dashboard]
                Paperless[Paperless-ngx]
                Dashdot[Dashdot]
                Headlamp[Headlamp K8s UI]
            end

            subgraph Monitoring[Monitoring Stack]
                Prometheus[Prometheus]
                Grafana[Grafana]
                Alertmanager[Alertmanager]
            end

            subgraph Storage
                Longhorn[Longhorn Storage]
                LonghornPVC[(PVC: foundry-data 50Gi)]
                PaperlessPVCs[(PVCs: paperless x5)]
                GrafanaPV[(PV: Grafana)]
                Longhorn --> LonghornPVC
                Longhorn --> PaperlessPVCs
            end
        end

        subgraph Agent["Agent Node (infinite-granite) — Tainted: NoSchedule"]
            Satisfactory[Satisfactory Server]
            SatisfactoryPV[(PV: /home/jack/satisfactory)]
            Satisfactory --> SatisfactoryPV
        end
    end

    Users -->|HTTPS| CF
    CF -->|Zero Trust Auth| CF
    CF -->|Tunnel| Cloudflared
    Cloudflared -->|:30000| Foundry

    Admin -->|Tailscale Full Access| TSOperator
    TSOperator -->|Ingress HTTPS| Glance
    TSOperator -->|Ingress HTTPS| Foundry
    TSOperator -->|LoadBalancer UDP| Satisfactory
    TSOperator -->|Ingress HTTPS| Grafana
    TSOperator -->|Ingress HTTPS| Prometheus
    TSOperator -->|Ingress HTTPS| Alertmanager
    TSOperator -->|Ingress HTTPS| Paperless
    TSOperator -->|Ingress HTTPS| Dashdot
    TSOperator -->|Ingress HTTPS| Longhorn
    TSOperator -->|Ingress HTTPS| Headlamp

    Members[Tailnet Members] -->|Tailscale :7777 only| Satisfactory

    Foundry --> LonghornPVC
    Grafana --> GrafanaPV
    Paperless --> PaperlessPVCs
    Prometheus -.Scrapes.- Foundry
    Prometheus -.Scrapes.- Satisfactory
    Prometheus -.Scrapes.- Longhorn

    style CF fill:#f6821f
    style TSOperator fill:#4a5568
    style Foundry fill:#7c3aed
    style Glance fill:#10b981
    style Satisfactory fill:#f97316
    style Grafana fill:#ff6b6b
    style Prometheus fill:#e08234
    style Alertmanager fill:#e05d44
    style Paperless fill:#17541f
    style Dashdot fill:#6366f1
    style Headlamp fill:#326ce5
    style Agent fill:#3b82f6
    style Longhorn fill:#ef4444

Loading

Networking

• Cloudflare for 'application' access - in my case, Foundry for DnD sessions
• Tailscale for everything else
  • Tailscale K8s operator pod
  • ACL: admin user has full access; all other tailnet members restricted to Satisfactory server (port 7777) only

Pulumi

• Used to manage Cloudflare resources
  • Creates tunnel & DNS records
  • Creates zero-trust application
• Also creates Kubernetes resources, generally a file per application
• Bootstrap K8s cluster basically
• NOTE: in the future, probably will get more Hardware
  • perhaps a stack per machine? maybe? that may not make sense though if a cluster is machine agnostic

Resources / ideas

• Awesome Selfhosting
• K8s selfhosting reddit thread
• Maintaining containers for various self-hosted services on a single machine
• Use Tailscale and CF Tunnel together