Network¶

Namespace: network

App	Notes
envoy-gateway	Two gateway instances: envoy-external + envoy-internal
pangolin-operator	Manages Pangolin VPS resources + Newt WireGuard tunnel for `*.t0m.co`
external-dns	Syncs envoy-external HTTPRoutes → Cloudflare DNS
unifi-dns	Syncs HTTPRoutes → UniFi controller for LAN resolution
multus	CNI for secondary network interfaces (VPN VLAN)
tailscale	Mesh VPN access to the cluster
certificates	Shared TLS certificate resources
echo	Test endpoint for debugging ingress, external access
greenlight	Custom UniFi network status dashboard

Config Notes¶

Envoy Gateway

The ingress layer. Two separate gateway instances handle different traffic:

envoy-external: Internet-facing. A Pangolin VPS (RackNerd) terminates the Cloudflare-proxied A record at external.t0m.co and forwards through a Newt WireGuard tunnel to this gateway. All *.t0m.co traffic enters here.
envoy-internal: LAN-only. UniFi DNS points LAN clients directly to this gateway's LoadBalancer IP.

Apps attach to one or both gateways via HTTPRoute resources. Authentication is handled by SecurityPolicy resources that forward to the Authentik outpost.

Multus

Provides secondary network interfaces for pods that need direct LAN or VLAN access. Currently used by qBittorrent (VPN VLAN 99), Home Assistant, and ESPHome (LAN device discovery).

DNS Flow¶

flowchart LR
    subgraph External
        A1["App creates HTTPRoute"] --> B1["external-dns"] --> C1["Cloudflare DNS\n(proxied)"] --> D1["Pangolin VPS\n+ Newt tunnel"] --> E1["envoy-external"]
    end
    subgraph Internal
        A2["App creates HTTPRoute"] --> B2["unifi-dns"] --> C2["UniFi\nController"] --> E2["envoy-internal"]
    end