Network

Topics planned for this section:

• WireGuard mesh and the 10.21.x addressing plan.
• The SNAT relay pair and why giratina’s traffic egresses as 10.21.2.1/.2.
• Anycast: 10.21.100.1 (DNS), .2 (patroni), .3 (kafka), and the healthchecker that gates them.
• DNS: two Pi-holes, the *.lab wildcard trap, and the scoped CoreDNS zone for the pod.
• Ingress: Cloudflare Zero Trust tunnels, k3s Traefik, and the externalIPs behaviour that makes mesh addresses answer on 80/443 even when the host behind them is down.
• Egress identity per host (which host leaves from which country/ASN, and when that matters).