Skip to content

Infrahorst

Overview

  • Network: DMZ

Applications

Nginx

This is our central reverse proxy. It runs certbot to obtain certificates for all of our services.

By default everything is routed to the Kubernetes cluster using wildcards unless there is some rule added to overwrite them. The wildcards are overwritten e.g. for all services running on a virtual machine instead of the Kubernetes cluster.

The following domains are routed to the Kubernetes cluster by default: - *.aalen.space - *.sfz-aalen.space - *.hackwerk.fun

Furthermore the Nginx reverse proxy manages which of our services are reachable from the public internet. E.g. our homepage is accessible from the public internet while our Homeassistant service is only reachable from our network.

Authentik

This is our identity provider. It handles SSO for most of our internal services. See the Auth page for more.

bind9 DNS Server

This is our own DNS server, we use it for our external and internal DNS zones.

We expose this DNS server on the internet as the primary DNS server for: - sfz-aalen.space - aalen.space - hackwerk.fun - nerds-gegen-nazis.de - ostalb.info

In our internal network we have the following DNS zones: - hackwerk (query allowed from 10.0.0.0/8)