Snarf/SnarfCode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: document host-mode ingress real-IP preservation, conditional MFA policy, and remove deprecated gaia app

Browse Source
This commit is contained in:
Snarf
2026-10-30 15:18:34 -04:00
parent 6b12646a0f
commit d34852075a
2 changed files with 3 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/homelab_topology.md
View File

@@ -107,7 +107,9 @@ All Kubernetes resources are hosted on the **Compute VLAN (VLAN 20 — `140.44.4
External WAN traffic hitting `174.106.252.96` is forwarded to internal hosts as follows:
1. **Nginx Reverse Proxy:** Ports `80` & `443` forward to **`140.44.4.74`** (Legacy NPM/Pi-hole VM in Swarm).
1. **Nginx Reverse Proxy:** Ports `80` & `443` forward to **`140.44.4.74`** (`snshpd4lnxswm04` in Docker Swarm).
* *Real Client IP Preservation:* NPM runs with `mode: host` (`PublishMode: host`) pinned to `snshpd4lnxswm04`. This eliminates Docker Swarm overlay ingress SNAT (which previously masked all clients as `10.0.0.6`), ensuring `X-Forwarded-For` and `X-Real-IP` preserve the true WAN or LAN client IP.
* *Conditional Authentik MFA:* Authentik's `default-authentication-flow-authenticator-validate-stage` evaluates the real client IP. Connections from internal subnets (`14.4.4.0/24`, `14.44.4.0/24`, `140.44.4.0/24`, `14.10.10.0/24`) bypass MFA for frictionless homelab usage, while external WAN connections strictly enforce MFA.
2. **Dev Machine/Gaming:** Ports `8443`, `10823` & `27015-27050` forward to **`14.4.4.15`** (Desktop PC).
3. **Zabbix Trapper:** Ports `10051` & `10052` forward to **`140.44.4.51`** (Klipper ServiceLB on worker `sninfr0lnxwrk01` $\rightarrow$ routes to primary Zabbix server pod in `spaceport`).
@@ -129,7 +131,6 @@ This table records how subdomains on `*.snarfnet.net` route to internal IP addre
| `pihole.snarfnet.net` | HTTP | `140.44.4.70` (Swarm VIP) | 8041 | Legacy Swarm Pi-hole 1 |
| `pihole2.snarfnet.net` | HTTP | `140.44.4.70` (Swarm VIP) | 8042 | Legacy Swarm Pi-hole 2 |
| `shipyard.snarfnet.net` | HTTPS | `140.44.4.71` (Swarm 01) | 9443 | Portainer Server Console |
| `gaia.snarfnet.net` | HTTP | `140.44.4.72` (Swarm 02) | 80 | Gaia Web app / Stack |
| `shipyardcontrol.snarfnet.net` | HTTPS | `140.44.4.7` (AI Node) | 443 | Turing Pi Management / Hardware Panel |
| `ai.snarfnet.net` | HTTP | `140.44.4.8` (AI Web Node) | 8080 | Open WebUI Inference Interface |
| `aerodrome.snarfnet.net` | HTTPS | `140.44.4.34` (K3s VIP) | 443 | Rancher Management Console |

9
scripts/customize_authentik_dashboard.py
View File

@@ -340,15 +340,6 @@ APPLICATIONS = [
"meta_launch_url": "https://homebox.snarfnet.net",
"open_in_new_tab": True,
},
{
"slug": "gaia",
"name": "Gaia Web App",
"group": "Portals & Dashboards",
"meta_icon": "https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/open-webui.png",
"meta_description": "Swarm Services & AI Stack Portal",
"meta_launch_url": "https://gaia.snarfnet.net",
"open_in_new_tab": True,
},
{
"slug": "dakboard",
"name": "Dakboard Display",