Hardware & Network Infrastructure

Hardware & Infrastructure

• Router: OPNsense

• Switch: Cisco 250 Series (L3 Managed)

• Compute Nodes:

  • Node 100: Minisforum HM90: 48GB RAM, Ryzen 9 4900H
  • Node 200: Dell Precision 3440 SFF: 64GB RAM, Intel E3 10th Gen CPU
  • Node 300: Minisforum HM90: 48GB RAM, Ryzen 9 4900H
  • DAS (Direct attached storage): Terramaster D6-320 DAS

• Network Storage:

  • Longhorn as Kubernetes Storage
  • TrueNAS pool RAIDZ1 (3x2TB, 4TB usable, HDD: CIFS/NFS, backups)
  • TrueNAS pool RAIDZ1 (3x2TB, 4TB usable, SSD: CIFS/NFS, hot-storage)
  • DAS: used for disk storage directly attached to Truenas scale VM running on node 200 (used for backups/pbs/cifs/nfs/nextcloud)

  Install TrueNas core on PVE

LACP Configuration & Dual WAN Setup

• LACP Bonding: Each server has two network cables in LACP mode for load balancing and redundancy.

• WAN Failover:

  • Primary WAN: Fiber ISP connection.
  • Backup WAN: 4G SIM-based connection via failover. (65 mbps up/down)

• Load Balancing Strategy:

  • LACP balance-tcp configured on the switch for optimized throughput to the servers.
  • OPNsense manages automatic failover between Fiber and backup SIM

  https://www.bsmithio.com/post/opnsense-dashboard/

  

Cloudflare Proxy & DMZ Access Control

• Cloudflare Proxy:
  • Reverse proxy (nginx-ingress on k8s) for services exposed in the DMZ.
  • DDoS protection and Web Application Firewall (WAF) enabled.
  • TLS termination managed by Cloudflare.
• Opnsense firewall rules:
  • Restrict access to internal services based on geolocation and IP reputation.
  • IDS/IPS, suricata, DoT enabled.

VLAN Segmentation

VLAN 1 segmentation:

• 10.100.0.0-10.100.0.100: Networking & Critical Services
• 10.100.0.111-10.100.0.120: Docker services
• 10.100.0.121-10.100.0.159: K8s services