Travis Herbranson 7eb8d756d1 compile: first compile — 17 entities, 2 synthesis, all indexes rebuilt

Read all 62 source files (Dev: 37, Homelab: 22, Venture: 3, Reference: 0).

Entity pages created (17):
- Wiki/Reference: lovebug, jenny, sunnie, n8n, ob1, tailscale, authentik,
  traefik, cloudflare, obsidian, gitea, plant-based-southerner, claude-code,
  dispatch, docker
- Wiki/Homelab: proxmox
- Wiki/Dev: pbs-hub, herbydev

Synthesis pages created (2):
- Wiki/Homelab/homelab-ingress-stack — four-layer ingress model (Cloudflare +
  Traefik + Authentik + Tailscale); operational lessons from 10+ source files
- Wiki/Dev/ai-memory-architecture — three memory layers (wiki + OB1 + Dispatch
  context); ingest paths; harness-vs-model design decision

All 11 index pages rebuilt (Sources/Dev, Venture, Homelab, Reference, Sources
root; Wiki/Dev, Venture, Homelab, Reference, Wiki root; vault root index.md).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-08 18:15:31 -04:00

6.8 KiB

Raw Blame History

type

path

Homelab Ingress Stack

Synthesis

The ingress architecture across both PBS and homelab converges on a layered pattern: Cloudflare at the edge, Traefik as the origin ingress, Authentik as the identity gate, and Tailscale as the private mesh. These four components appear together across 10+ project plans and session notes and form a coherent security + routing philosophy.

The Four-Layer Model

Internet
  └── Cloudflare (DNS + CDN + DDoS + Tunnel)
        └── Traefik (TLS termination + routing + middleware)
              └── Authentik (SSO/OAuth2/OIDC gate)
                    └── Service (WordPress, n8n, MCP server, etc.)

Private (Tailscale)
  └── Direct service access (OB1, herbydev VNC, inter-service)

Layer 1: Cloudflare handles all public-facing concerns — authoritative DNS for both plantbasedsoutherner.com and herbylab.dev, CDN caching, DDoS/Bot Fight Mode, and zero-trust tunnel exposure (cloudflared). The cache rules use last-match-wins ordering with cookie-based bypass for authenticated members. The Cloudflare Tunnel pattern means origin servers never open inbound ports for public traffic — the tunnel initiates outbound, and Cloudflare routes to it.

Layer 2: Traefik is the Swiss Army knife — TLS termination (Let's Encrypt + Cloudflare DNS challenge for wildcards), Docker service discovery via labels, custom middleware (e.g., block-wpcron). It runs in both PBS and homelab contexts. After the March 2026 v3.6.11 upgrade, Traefik is stable; the UFW outage (missing DOCKER-USER rules) revealed that Docker + UFW interaction requires explicit outbound allow rules in after.rules.

Layer 3: Authentik gates sensitive services behind SSO. The MCP server was the first homelab service deployed behind Authentik OAuth2 (May 2026). The SSH CA project (step-ca + Authentik OIDC) extends this pattern to SSH key lifecycle — short-lived certificates replacing long-lived keys. The PBS security hardening plan adds Authentik/Authelia + Crowdsec as a second layer in front of WordPress admin.

Layer 4: Tailscale provides the private path — for services that should never be public (OB1, inter-VM communication) and for admin access (herbydev VNC). Tailscale and Cloudflare Tunnel serve complementary roles: Tunnel for public-facing services, Tailscale for private mesh.

PBS vs. Homelab Divergence

PBS infrastructure is primarily Cloudflare + Traefik (no Authentik currently — WordPress handles its own auth). Homelab is where Authentik lives. The convergence point is the MCP server, which uses all four layers: Cloudflare Tunnel for external access, Traefik for routing, Authentik for OAuth2, and Tailscale as an alternative access path.

Operational Lessons

UFW + Docker: Docker rewrites iptables in a way that bypasses UFW INPUT rules. The fix is explicit DOCKER-USER chain rules in /etc/ufw/after.rules. Missing these caused a production outage.
WP-Cron via Traefik: WordPress's built-in cron fires on HTTP requests, which Traefik handles normally. The Supercronic sidecar + block-wpcron middleware pattern removes this unpredictability.
Cloudflare cache + cookies: The last-match-wins rule ordering means the cookie-bypass rule must come after the broad cache rule. Getting this wrong served cached logged-in pages to guests.
DNS rebind protection: The Knot + Pi-hole chain requires Pi-hole rebind protection disabled for .herbylab.dev split-horizon entries — EDE 15 errors were the symptom.

Planned Additions

Crowdsec + Authelia — additional security layer for PBS WordPress admin
step-ca — short-lived SSH certificates issued via Authentik OIDC
PBSII (pbs-infrastructure-intelligence) — Go collector + log parser + n8n monitor feeding Claude API healer for automated incident response

Sources

traefik-deployment provides the canonical Traefik setup: Knot DNS primary/secondary integration, wildcard TLS via Cloudflare DNS challenge, Cloudflare Tunnel wiring, and Tailscale placement in the topology. This is the reference document for the ingress architecture.

homelab-mcp-server and 2026-05-06-homelab-mcp-server-stand-up document the first service deployed using the full four-layer pattern: Cloudflare Tunnel + Traefik + Authentik OAuth2 for mcp.herbylab.dev. The stand-up session notes capture the FastMCP Streamable HTTP setup.

cloudflare-cache-strategy and cloudflare-cache-rules capture the PBS CDN layer: last-match-wins rule design, cookie-bypass implementation, and n8n auto-purge integration. The session notes document the debugging process that revealed the rule ordering issue.

dns-knot-pihole-end-to-end and homelab-dns-decision capture the DNS architecture decision: Knot DNS as primary with secondary replica, Pi-hole as resolver, split-horizon for .herbylab.dev. The session notes document the rebind protection + EDE 15 debugging.

server-stability-and-security-hardening covers the March 2026 hardening sprint: Traefik v3.6.11 upgrade, Bot Fight Mode, MySQL OOM fix (768MB cap), WordPress memory cap.

ufw-docker-outage-fix documents the UFW + Docker interaction that caused a production outage, and the fix via explicit DOCKER-USER chain rules.

wp-cron-supercronic-deploy documents replacing WP-Cron with a Supercronic sidecar + block-wpcron middleware.

pbs-security-hardening and ssh-ca-with-step-ca-authentik cover the planned security expansions: Crowdsec + Authelia for PBS, step-ca + OIDC for SSH.

Open questions

Will the homelab run a second Traefik instance or share the PBS Traefik? The traefik-deployment plan implies a homelab-specific instance but this isn't fully resolved.
The PBSII intelligence layer (Go collector + Claude API healer) would sit at the meta layer above all of this — when does that project move from plan to active?
Crowdsec integration: does it sit in front of Traefik (as middleware) or beside it? The pbs-security-hardening plan doesn't fully specify placement.
As OB1 goes live, does it get a Cloudflare Tunnel path for external access, or remain Tailscale-only permanently?

6.8 KiB Raw Blame History