7eb8d756d1
Read all 62 source files (Dev: 37, Homelab: 22, Venture: 3, Reference: 0). Entity pages created (17): - Wiki/Reference: lovebug, jenny, sunnie, n8n, ob1, tailscale, authentik, traefik, cloudflare, obsidian, gitea, plant-based-southerner, claude-code, dispatch, docker - Wiki/Homelab: proxmox - Wiki/Dev: pbs-hub, herbydev Synthesis pages created (2): - Wiki/Homelab/homelab-ingress-stack — four-layer ingress model (Cloudflare + Traefik + Authentik + Tailscale); operational lessons from 10+ source files - Wiki/Dev/ai-memory-architecture — three memory layers (wiki + OB1 + Dispatch context); ingest paths; harness-vs-model design decision All 11 index pages rebuilt (Sources/Dev, Venture, Homelab, Reference, Sources root; Wiki/Dev, Venture, Homelab, Reference, Wiki root; vault root index.md). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
95 lines
6.8 KiB
Markdown
95 lines
6.8 KiB
Markdown
---
|
|
type: synthesis
|
|
path: Wiki/Homelab
|
|
tags:
|
|
- traefik
|
|
- cloudflare
|
|
- authentik
|
|
- homelab
|
|
- networking
|
|
sources:
|
|
- "[[Sources/Homelab/traefik-deployment]]"
|
|
- "[[Sources/Homelab/homelab-mcp-server]]"
|
|
- "[[Sources/Homelab/2026-05-06-homelab-mcp-server-stand-up]]"
|
|
- "[[Sources/Dev/cloudflare-cache-strategy]]"
|
|
- "[[Sources/Dev/cloudflare-cache-rules]]"
|
|
- "[[Sources/Homelab/dns-knot-pihole-end-to-end]]"
|
|
- "[[Sources/Homelab/homelab-dns-decision]]"
|
|
- "[[Sources/Homelab/server-stability-and-security-hardening]]"
|
|
- "[[Sources/Homelab/wp-cron-supercronic-deploy]]"
|
|
- "[[Sources/Homelab/ufw-docker-outage-fix]]"
|
|
- "[[Sources/Homelab/pbs-security-hardening]]"
|
|
- "[[Sources/Homelab/ssh-ca-with-step-ca-authentik]]"
|
|
created: 2026-05-08
|
|
updated: 2026-05-08
|
|
---
|
|
|
|
# Homelab Ingress Stack
|
|
|
|
## Synthesis
|
|
|
|
The ingress architecture across both PBS and homelab converges on a layered pattern: Cloudflare at the edge, Traefik as the origin ingress, Authentik as the identity gate, and Tailscale as the private mesh. These four components appear together across 10+ project plans and session notes and form a coherent security + routing philosophy.
|
|
|
|
### The Four-Layer Model
|
|
|
|
```
|
|
Internet
|
|
└── Cloudflare (DNS + CDN + DDoS + Tunnel)
|
|
└── Traefik (TLS termination + routing + middleware)
|
|
└── Authentik (SSO/OAuth2/OIDC gate)
|
|
└── Service (WordPress, n8n, MCP server, etc.)
|
|
|
|
Private (Tailscale)
|
|
└── Direct service access (OB1, herbydev VNC, inter-service)
|
|
```
|
|
|
|
**Layer 1: Cloudflare** handles all public-facing concerns — authoritative DNS for both `plantbasedsoutherner.com` and `herbylab.dev`, CDN caching, DDoS/Bot Fight Mode, and zero-trust tunnel exposure (`cloudflared`). The cache rules use last-match-wins ordering with cookie-based bypass for authenticated members. The Cloudflare Tunnel pattern means origin servers never open inbound ports for public traffic — the tunnel initiates outbound, and Cloudflare routes to it.
|
|
|
|
**Layer 2: Traefik** is the Swiss Army knife — TLS termination (Let's Encrypt + Cloudflare DNS challenge for wildcards), Docker service discovery via labels, custom middleware (e.g., `block-wpcron`). It runs in both PBS and homelab contexts. After the March 2026 v3.6.11 upgrade, Traefik is stable; the UFW outage (missing DOCKER-USER rules) revealed that Docker + UFW interaction requires explicit outbound allow rules in `after.rules`.
|
|
|
|
**Layer 3: Authentik** gates sensitive services behind SSO. The MCP server was the first homelab service deployed behind Authentik OAuth2 (May 2026). The SSH CA project (step-ca + Authentik OIDC) extends this pattern to SSH key lifecycle — short-lived certificates replacing long-lived keys. The PBS security hardening plan adds Authentik/Authelia + Crowdsec as a second layer in front of WordPress admin.
|
|
|
|
**Layer 4: Tailscale** provides the private path — for services that should never be public (OB1, inter-VM communication) and for admin access (herbydev VNC). Tailscale and Cloudflare Tunnel serve complementary roles: Tunnel for public-facing services, Tailscale for private mesh.
|
|
|
|
### PBS vs. Homelab Divergence
|
|
|
|
PBS infrastructure is primarily Cloudflare + Traefik (no Authentik currently — WordPress handles its own auth). Homelab is where Authentik lives. The convergence point is the MCP server, which uses all four layers: Cloudflare Tunnel for external access, Traefik for routing, Authentik for OAuth2, and Tailscale as an alternative access path.
|
|
|
|
### Operational Lessons
|
|
|
|
- **UFW + Docker**: Docker rewrites iptables in a way that bypasses UFW INPUT rules. The fix is explicit DOCKER-USER chain rules in `/etc/ufw/after.rules`. Missing these caused a production outage.
|
|
- **WP-Cron via Traefik**: WordPress's built-in cron fires on HTTP requests, which Traefik handles normally. The Supercronic sidecar + `block-wpcron` middleware pattern removes this unpredictability.
|
|
- **Cloudflare cache + cookies**: The last-match-wins rule ordering means the cookie-bypass rule must come after the broad cache rule. Getting this wrong served cached logged-in pages to guests.
|
|
- **DNS rebind protection**: The Knot + Pi-hole chain requires Pi-hole rebind protection disabled for `.herbylab.dev` split-horizon entries — EDE 15 errors were the symptom.
|
|
|
|
### Planned Additions
|
|
|
|
- **Crowdsec + Authelia** — additional security layer for PBS WordPress admin
|
|
- **step-ca** — short-lived SSH certificates issued via Authentik OIDC
|
|
- **PBSII (pbs-infrastructure-intelligence)** — Go collector + log parser + n8n monitor feeding Claude API healer for automated incident response
|
|
|
|
## Sources
|
|
|
|
**traefik-deployment** provides the canonical Traefik setup: Knot DNS primary/secondary integration, wildcard TLS via Cloudflare DNS challenge, Cloudflare Tunnel wiring, and Tailscale placement in the topology. This is the reference document for the ingress architecture.
|
|
|
|
**homelab-mcp-server** and **2026-05-06-homelab-mcp-server-stand-up** document the first service deployed using the full four-layer pattern: Cloudflare Tunnel + Traefik + Authentik OAuth2 for `mcp.herbylab.dev`. The stand-up session notes capture the FastMCP Streamable HTTP setup.
|
|
|
|
**cloudflare-cache-strategy** and **cloudflare-cache-rules** capture the PBS CDN layer: last-match-wins rule design, cookie-bypass implementation, and n8n auto-purge integration. The session notes document the debugging process that revealed the rule ordering issue.
|
|
|
|
**dns-knot-pihole-end-to-end** and **homelab-dns-decision** capture the DNS architecture decision: Knot DNS as primary with secondary replica, Pi-hole as resolver, split-horizon for `.herbylab.dev`. The session notes document the rebind protection + EDE 15 debugging.
|
|
|
|
**server-stability-and-security-hardening** covers the March 2026 hardening sprint: Traefik v3.6.11 upgrade, Bot Fight Mode, MySQL OOM fix (768MB cap), WordPress memory cap.
|
|
|
|
**ufw-docker-outage-fix** documents the UFW + Docker interaction that caused a production outage, and the fix via explicit DOCKER-USER chain rules.
|
|
|
|
**wp-cron-supercronic-deploy** documents replacing WP-Cron with a Supercronic sidecar + `block-wpcron` middleware.
|
|
|
|
**pbs-security-hardening** and **ssh-ca-with-step-ca-authentik** cover the planned security expansions: Crowdsec + Authelia for PBS, step-ca + OIDC for SSH.
|
|
|
|
## Open questions
|
|
|
|
- Will the homelab run a second Traefik instance or share the PBS Traefik? The traefik-deployment plan implies a homelab-specific instance but this isn't fully resolved.
|
|
- The PBSII intelligence layer (Go collector + Claude API healer) would sit at the meta layer above all of this — when does that project move from plan to active?
|
|
- Crowdsec integration: does it sit in front of Traefik (as middleware) or beside it? The pbs-security-hardening plan doesn't fully specify placement.
|
|
- As OB1 goes live, does it get a Cloudflare Tunnel path for external access, or remain Tailscale-only permanently?
|