Recently Updated Pages
Lessons on the baseline
Tune to the role, not dogmatically. Swap off for k8s nodes, on (small) elsewhere. BBR where it f...
What's in the baseline
The recurring adjustments, and the reasoning for each: Swap — present and small on the general V...
Why a baseline at all
Every VM in the lab gets the same small set of OS-level adjustments before it does any real work....
The template
The template is one VM (ID 9999) prepared once: a current Ubuntu cloud image, the QEMU guest agen...
Why golden images
There are ~15 VMs in this lab. Not one of them was installed from an ISO by hand. Every single on...
Lessons on provisioning
One golden image, cloned many times. Consistency first; it kills "works on that box" bugs. Bake ...
Grow-on-first-boot, and a clean teardown
Two finishing touches make the recipe pleasant to live with. Disks grow to fit. The template's di...
Injecting per-VM identity with cloud-init
Cloning gives you fifteen identical machines. Cloud-init is what makes each one itself on first b...
Lessons on bastion access
One way in. Internal VMs expose no SSH to the internet; the bastion is the single public SSH end...
Hardening, and a host-key surprise
Because the bastion is the one publicly-reachable SSH endpoint, it's the one that gets the most a...
The ProxyJump pattern
You don't want to manually SSH to the bastion and then SSH again — that's clumsy and breaks tooli...
Why a jump host
None of the internal VMs accept SSH from the internet. There's exactly one machine you can SSH to...
A gotcha that cost an afternoon
A war story, because the lessons that stick are the ones that bit you. A backend's address was ch...
TLS terminates here, once
There is exactly one place in the whole lab that deals with certificates: HAProxy on pfSense. It ...
HAProxy: one door, many rooms
All the web services share a single public IP, so something has to look at each incoming request ...
NAT: how private VMs reach the world
The VMs live on a private range that isn't routable on the internet. They still need to fetch pac...
The front door
Everything that's reachable from the outside world passes through one VM: a pfSense firewall/rout...
Architecture & Prerequisites
Diagram
Lessons learned & gotchas
MTU is the one that will haunt you. A vSwitch with VXLAN encapsulation adds overhead to every fr...
Why we designed it this way
The cluster makes a few structural choices on purpose: Two vSwitches, not one. One private (clus...