Network Architecture
MEGATRON uses a layered networking architecture combining Cloudflare tunnels for public ingress, Tailscale for private mesh networking, and Traefik for Kubernetes-level routing.
Architecture Overview
┌─────────────────────────────────────────────────────────────────┐
│ INTERNET │
└──────────────────────────┬──────────────────────────────────────┘
│
v
┌─────────────────────────────────────────────────────────────────┐
│ CLOUDFLARE (DNS + WAF) │
│ │
│ Domains: stiq.us, corestation.io, idp.pro, │
│ kelseyfarmequipment.com, m3gatr0n.com │
│ │
│ Tunnel: 6d8885c4-97d9-43fd-8426-78a00c2834f1 │
│ Routes: 49 hostname-based rules │
│ Pattern: hostname -> https://localhost:32672 (noTLSVerify) │
└──────────────────────────┬──────────────────────────────────────┘
│
v
┌─────────────────────────────────────────────────────────────────┐
│ MEGATRON (Host) │
│ │
│ cloudflared ──────> localhost:32672 │
│ │ │
│ v │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ Traefik Ingress Controller │ │
│ │ (kube-system, NodePort :32672) │ │
│ │ │ │
│ │ Host-based routing: │ │
│ │ *.stiq.us ──────────────> stiq / stiq-dev / stiq-staging │ │
│ │ *.corestation.io ───────> corestation / *-dev / *-staging │ │
│ │ *.idp.pro ──────────────> idp / idp-dev │ │
│ │ *.m3gatr0n.com ─────────> glamhub, auth, monitoring, etc │ │
│ │ kelseyfarmequipment.com > kelsey │ │
│ └────────────────────────────────────────────────────────────┘ │
│ │ │
│ v │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ K3s Pod Network (ClusterIP services) │ │
│ │ Linkerd Service Mesh (mTLS) │ │
│ └────────────────────────────────────────────────────────────┘ │
│ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ Tailscale Mesh (WireGuard) │ │
│ │ megatron: 100.70.25.47 │ │
│ │ mac-studio: 100.87.201.64 │ │
│ │ macbook-m4: 100.91.253.88 │ │
│ │ lambda: 100.108.49.109 │ │
│ └────────────────────────────────────────────────────────────┘ │
│ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ Docker Bridge Network │ │
│ │ Bibliotheca containers, Coolify │ │
│ │ localhost:8080 (qBittorrent), :8088 (nginx), :8000 │ │
│ └────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
Port Map
External Ports (Internet-facing via Cloudflare)
All public traffic enters through the Cloudflare tunnel -- no ports are directly exposed to the internet.
Host Ports
| Port | Service | Protocol | Access |
|---|---|---|---|
| 22 | SSH (normal) | TCP | LAN / Tailscale |
| 2222 | SSH (rescue, high priority) | TCP | LAN / Tailscale |
| 2223 | Forgejo SSH (Git) | TCP | LAN / Tailscale |
| 6443 | K3s API server | TCP | LAN / Tailscale |
| 8000 | Coolify | TCP | localhost |
| 8080 | qBittorrent (Bibliotheca) | TCP | localhost |
| 8088 | Bibliotheca nginx | TCP | localhost |
| 7700 | Meilisearch | TCP | localhost |
| 11434 | Ollama | TCP | ClusterIP / localhost |
| 32672 | Traefik NodePort (HTTPS) | TCP | localhost (cloudflared) |
| 3307 | MariaDB (Coolify) | TCP | localhost |
| 6380 | Redis (Coolify) | TCP | localhost |
Kubernetes Service Ports (ClusterIP, internal only)
| Service | Port | Namespace |
|---|---|---|
| Traefik | 80, 443 | kube-system |
| CoreDNS | 53 | kube-system |
| Prometheus | 9090 | monitoring |
| Grafana | 3000 | monitoring |
| Loki | 3100 | monitoring |
| AlertManager | 9093 | monitoring |
| Vault | 8200 | vault |
| Harbor | 443 | registry |
Network Layers
Layer 1: Cloudflare (Public Ingress)
All public traffic flows through Cloudflare, which provides DNS, DDoS protection, WAF, and the tunnel endpoint. See Cloudflare Tunnels.
Layer 2: Traefik (Kubernetes Ingress)
Traefik receives tunnel traffic on NodePort 32672 and routes based on hostname to the appropriate Kubernetes service. See Traefik Ingress.
Layer 3: Linkerd (Service Mesh)
Linkerd provides mutual TLS between pods, traffic metrics, and reliability features. See Linkerd.
Layer 4: Tailscale (Private Mesh)
Tailscale connects MEGATRON to other machines (Mac Studio, MacBook, Lambda) via WireGuard-based mesh VPN. See Tailscale.
Layer 5: Docker Bridge (Container Networking)
Non-K3s containers (Bibliotheca, Coolify) use Docker bridge networking with port mappings to localhost.
DNS Flow
User browser
│
v
DNS query: app.stiq.us
│
v
Cloudflare DNS ──> resolves to Cloudflare edge
│
v
Cloudflare tunnel routes to MEGATRON
│
v
cloudflared ──> https://localhost:32672
│
v
Traefik matches Host header ──> routes to K3s service
│
v
K3s service ──> Pod (via kube-proxy/iptables)
Key Networking Issues
- cert-manager HTTP-01 broken -- Cannot complete ACME challenges behind Cloudflare tunnel. Must migrate to DNS-01 solver.
- Harbor TLS NOT READY (20 days) -- Certificate pending due to HTTP-01 failure.
- Devtron TLS NOT READY (20 days) -- Same root cause.
- Monitoring wildcard cert NOT READY -- Same root cause.
See TLS Certificates for full details.