The MikroTik router manages two LAN VLANs plus several veth networks for RouterOS containers, and one WireGuard subnet.
| VLAN / Interface | Subnet | Purpose |
|---|---|---|
vlan88-work |
192.168.88.0/24 | Homelab infrastructure — all servers, K8s, NAS |
vlan20-home |
192.168.20.0/24 | Home devices — personal PCs, phones, TVs |
wireguard1 |
192.168.100.0/24 | VPN clients (WireGuard, UDP 13231) |
veth-upsnap |
192.168.200.0/24 | RouterOS container network — UpSnap WoL |
veth-cloudflared |
192.168.202.0/24 | RouterOS container network — Cloudflare tunnel |
veth-uptime-kuma |
192.168.203.0/24 | RouterOS container network — Uptime Kuma |
VLAN isolation: VLAN20 and VLAN88 cannot reach each other — enforced by MikroTik FORWARD drop rules. WireGuard clients have full access to both VLANs.
Three Proxmox hypervisors host nine Talos nodes (3 control plane + 6 workers) plus a few special-purpose VMs.
| IP Address | Hostname | Role | OS/Platform | Notes |
|---|---|---|---|---|
| 192.168.88.1 | MikroTik Router | Gateway / Firewall / DHCP | RouterOS 7.21 | Network gateway, DNS forwarding, hosts 4 RouterOS containers |
| 192.168.88.10-30 | MetalLB Pool | K8s LoadBalancer IPs | — | Auto-assigned by MetalLB L2 |
| 192.168.88.11 | technitium-primary-dns | DNS (LB) | K8s | externalTrafficPolicy: Local |
| 192.168.88.12 | Istio Gateway VIP | K8s Ingress | K8s | All *.homelab.vyanh.uk traffic (MetalLB L2) |
| 192.168.88.13 | technitium-secondary-dns | DNS (LB) | K8s | externalTrafficPolicy: Local |
| 192.168.88.16 | technitium-tertiary-dns | DNS (LB) | K8s | externalTrafficPolicy: Local — added 2026-04-20 |
| 192.168.88.19 | Synology NAS | DS920+ / NFS / Docker | DSM 7 | Primary storage, 4×8TB SHR |
| 192.168.88.100 | pve1 | Proxmox hypervisor | Proxmox VE 8 | talos-cp1 + talos-worker1/2/3 |
| 192.168.88.101 | pve2 | Proxmox hypervisor | Proxmox VE 8 | talos-cp2 + talos-worker4 + clawdbot (VM100) + TrueNAS-Scale (VM109) |
| 192.168.88.102 | pve3 | Proxmox hypervisor | Proxmox VE 8 | talos-cp3 + talos-worker5/6 + ollama LXC (CT102) |
| 192.168.88.103 | clawdbot | VM on pve2 | Ubuntu 24.04 | openclaw Telegram bot (@Javis456bot) gateway |
| 192.168.88.196 | ollama | LXC CT102 on pve3 | Ubuntu 24.04 | Ollama inference, AMD Radeon 780M iGPU, qwen2.5:14b |
| 192.168.88.230 | TrueNAS-Scale | Secondary NAS (VM109 on pve2) | TrueNAS Scale | NVMe backup storage, NFS for K8s |
| 192.168.88.240 | talos-worker6 | K8s Worker (pve3) | Talos Linux 1.12 | Workloads |
| 192.168.88.241 | talos-cp2 | K8s Control Plane (pve2) | Talos Linux 1.12 | API server, etcd, scheduler |
| 192.168.88.242 | talos-cp3 | K8s Control Plane (pve3) | Talos Linux 1.12 | API server, etcd, scheduler |
| 192.168.88.243 | talos-worker4 | K8s Worker (pve2) | Talos Linux 1.12 | Workloads |
| 192.168.88.244 | talos-worker5 | K8s Worker (pve3) | Talos Linux 1.12 | Workloads |
| 192.168.88.245 | Utility Server | Monitoring exporters | Linux | SNMP exporter, PVE exporter |
| 192.168.88.246 | talos-cp1 | K8s Control Plane (pve1) | Talos Linux 1.12 | API server, etcd, scheduler |
| 192.168.88.247 | talos-worker3 | K8s Worker (pve1) | Talos Linux 1.12 | Workloads |
| 192.168.88.248 | talos-worker2 | K8s Worker (pve1) | Talos Linux 1.12 | Workloads |
| 192.168.88.249 | talos-worker1 | K8s Worker (pve1) | Talos Linux 1.12 | Workloads, DB-affinity for Authentik PG |
Four containers run inside RouterOS, each on its own veth network. Reachable from VLAN88 via MikroTik firewall NAT/FORWARD rules.
| Container IP | Name | Purpose |
|---|---|---|
| 192.168.200.100 | app-upsnap | UpSnap Wake-on-LAN web UI (wol.homelab.vyanh.uk) |
| 192.168.202.2 | app-cloudflared | Cloudflare tunnel — terminates homelab-k8s tunnel locally |
| 192.168.203.100 | app-uptime-kuma | Uptime Kuma — migrated off NAS 2026-04-28 (uptime.homelab.vyanh.uk / status.vyanh.uk) |
| MikroTik primary | app-technitium | Tertiary Technitium DNS instance — AXFR secondary of K8s primary |
All K8s services are exposed via the Istio ingress gateway at 192.168.88.12 (MetalLB L2). TLS terminates on Istio using cert-manager-issued certificates from Let's Encrypt (DNS-01 via Cloudflare).
| Service | URL | Namespace | Auth |
|---|---|---|---|
| ArgoCD | https://argocd.homelab.vyanh.uk |
argocd | Authentik OIDC |
| Grafana | https://grafana.homelab.vyanh.uk |
monitoring | Authentik OIDC |
| Vault | https://vault.homelab.vyanh.uk |
vault | Token / OIDC |
| Vault UI | https://vault-ui.homelab.vyanh.uk |
vault-ui | Token |
| Harbor | https://harbor.homelab.vyanh.uk |
harbor | Authentik OIDC |
| Authentik | https://authentik.homelab.vyanh.uk |
authentik | Built-in |
| Technitium DNS (primary) | https://dns.homelab.vyanh.uk |
technitium | Password (Vault) |
| Technitium DNS (secondary) | https://dns2.homelab.vyanh.uk |
technitium | Password (Vault) |
| Technitium MikroTik | http://dns-mikrotik.homelab.vyanh.uk |
nas-ingress | Password (Vault) |
| Nextcloud | https://nextcloud.homelab.vyanh.uk |
nextcloud | Built-in |
| Longhorn | https://longhorn.homelab.vyanh.uk |
longhorn-system | — |
| VictoriaMetrics | https://victoria-metrics.homelab.vyanh.uk |
monitoring | — |
| VictoriaLogs | https://victoria-logs.homelab.vyanh.uk |
monitoring | — |
| Tempo | https://tempo.homelab.vyanh.uk |
monitoring | — |
| Hubble UI | https://hubble.homelab.vyanh.uk |
kube-system | — |
| Frigate | https://frigate.homelab.vyanh.uk |
frigate | Built-in |
| LifeOps | https://lifeops.homelab.vyanh.uk |
life-ops | JWT |
| LifeOps (public) | https://tracker.vyanh.uk |
life-ops | JWT |
| Wiki.js | https://wikijs.homelab.vyanh.uk |
nas-ingress | Built-in |
| Wiki.js (public) | https://wiki.vyanh.uk |
nas-ingress | Built-in — added 2026-04-29 |
| Vikunja | https://vikunja.homelab.vyanh.uk |
vikunja | Authentik OIDC — added 2026-04-30 |
| Vikunja (public) | https://tasks.vyanh.uk |
vikunja | Authentik OIDC |
| ntfy | https://ntfy.vyanh.uk |
nas-ingress | Token auth |
| Vaultwarden | https://vaultwarden.homelab.vyanh.uk |
nas-ingress | Built-in |
| Vaultwarden (public) | https://vault.vyanh.uk |
nas-ingress | Built-in |
| Uptime Kuma | https://uptime.homelab.vyanh.uk |
nas-ingress | — |
| Uptime Kuma (public) | https://status.vyanh.uk |
nas-ingress | — |
| Ente museum | https://auth.homelab.vyanh.uk + https://auth.vyanh.uk |
ente-auth | Built-in |
| Ente accounts | https://accounts.homelab.vyanh.uk + https://accounts.vyanh.uk |
ente-auth | Built-in |
| Public DoH | https://dns.vyanh.uk/dns-query |
technitium | — |
These services run on the Synology NAS (192.168.88.19) and are proxied through Istio via the nas-ingress component (sync wave 13):
| Service | Internal Port | Local URL | Public URL |
|---|---|---|---|
| Immich | :2283 |
https://immich.homelab.vyanh.uk |
— |
| Vaultwarden | :8843 |
https://vaultwarden.homelab.vyanh.uk |
https://vault.vyanh.uk |
| ntfy | :2586 |
— | https://ntfy.vyanh.uk |
| Portainer | :9443 (HTTPS) |
https://portainer.homelab.vyanh.uk |
— (local-only) |
| Homepage | :3000 |
https://homepage.homelab.vyanh.uk |
— |
| Paperless-ngx | :8010 |
https://paperless.homelab.vyanh.uk |
— |
| Wiki.js | :3080 |
https://wikijs.homelab.vyanh.uk |
https://wiki.vyanh.uk |
| Memos | :5230 |
https://memos.homelab.vyanh.uk |
— |
| MinIO Console | :9001 |
https://minio.homelab.vyanh.uk |
— (local-only) |
| MinIO API (S3) | :9000 |
https://s3.homelab.vyanh.uk |
— (local-only) |
| IT Tools | :4533 |
https://it-tools.homelab.vyanh.uk |
— |
| Door controller | :8766 |
https://door.homelab.vyanh.uk |
— (local-only) |
| GitLab | :3400 |
https://gitlab.homelab.vyanh.uk |
— (local-only) |
Migrated off NAS: Uptime Kuma — moved to RouterOS container
192.168.203.100:3001on 2026-04-28. Endpoint innas-ingressnow points there instead of the NAS.
The nas-ingress component creates Service + Endpoints + HTTPRoute for each entry, pointing at the NAS IP (or RouterOS container IP for Uptime Kuma / wol). HTTPS upstreams (Portainer, NAS DSM, Proxmox, TrueNAS) get a DestinationRule with insecureSkipVerify: true.
Local-only services are enforced by an AuthorizationPolicy in istio-system (local-only) that DENY-s requests whose source IP is outside 192.168.88.0/24 / 192.168.20.0/24 / 192.168.100.0/24 / 10.244.0.0/16.
A single Cloudflare tunnel homelab-k8s runs as a cloudflared container on the MikroTik router (app-cloudflared, container IP 192.168.202.2). It terminates the tunnel locally and routes each public hostname to the Istio gateway with a Host-header rewrite — so external traffic and LAN traffic both end up on the same Istio HTTPRoute / public TLS cert pair.
| Public URL | Tunnel rewrites Host to | Istio HTTPRoute |
|---|---|---|
https://wiki.vyanh.uk |
wikijs.homelab.vyanh.uk |
nas-ingress/wikijs |
https://ntfy.vyanh.uk |
(passthrough) | direct to 192.168.88.12 for ntfy.vyanh.uk |
https://vault.vyanh.uk |
vaultwarden.homelab.vyanh.uk |
nas-ingress/vaultwarden |
https://tracker.vyanh.uk |
lifeops.homelab.vyanh.uk |
life-ops/lifeops-tracker-public |
https://auth.vyanh.uk |
auth.homelab.vyanh.uk |
ente-auth/museum |
https://accounts.vyanh.uk |
accounts.homelab.vyanh.uk |
ente-auth/accounts |
https://dns.vyanh.uk |
(passthrough) | direct to 192.168.88.12 for DoH |
https://tasks.vyanh.uk |
vikunja.homelab.vyanh.uk |
vikunja/vikunja (added 2026-04-30) |
Moving cloudflared to MikroTik means the tunnel stays up even during full K8s cluster outages and removes K8s cluster resource consumption.
All *.vyanh.uk public hostnames are also reachable from the LAN without going through Cloudflare. Technitium holds local authoritative records pointing each hostname to the Istio gateway VIP 192.168.88.12, and Istio serves them directly with the matching public TLS cert (one Gateway listener per public hostname).
| Public Hostname | Resolves to (LAN) | Istio Listener |
|---|---|---|
vault.vyanh.uk |
192.168.88.12 |
https-vault-public → nas-ingress/vaultwarden |
wiki.vyanh.uk |
192.168.88.12 |
https-wiki-public → nas-ingress/wikijs |
status.vyanh.uk |
192.168.88.12 |
https-status-public → nas-ingress/uptime-kuma |
tracker.vyanh.uk |
192.168.88.12 |
https-tracker-public → life-ops/lifeops-tracker-public |
ntfy.vyanh.uk |
192.168.88.12 |
https-ntfy-public → nas-ingress/ntfy |
auth.vyanh.uk |
192.168.88.12 |
https-auth-public → ente-auth/museum |
accounts.vyanh.uk |
192.168.88.12 |
https-accounts-public → ente-auth/accounts |
dns.vyanh.uk |
192.168.88.12 |
https-dns-public → DoH endpoint |
tasks.vyanh.uk |
192.168.88.12 |
https-tasks-public → vikunja/vikunja |
The split DNS records are created automatically by the Technitium configure-job PostSync hook (ensure_split_dns function), applied to all three Technitium instances (primary, secondary, tertiary) on every ArgoCD sync.