# Infrastructure Topology

A visual map of the Kaburu MSP network. Designed for: - AI models parsing the wiki (Mermaid is plain text they can read) - Steve's network ops mate taking over cold if needed - Anyone needing to understand what connects where and why

—

## Network Diagram (Mermaid)

```mermaid graph TB

  INTERNET[Internet] -->|PPPoE / Static IP 49.13.202.144| HZ[Hetzner VPS<br/>kaburusvr.uk<br/>Ubuntu 24 / CyberPanel<br/>49.13.202.144]

  INTERNET -->|Virgin Media 1Gbps| OP[OPNsense Firewall<br/>192.168.0.1<br/>FreeBSD]

  OP -->|Mullvad VPN<br/>WireGuard tunnel| INTERNET
  OP -->|LAN 192.168.0.0/24| Z840[kaburuaibox<br/>HP Z840 Workstation<br/>192.168.0.253]
  OP -->|LAN 192.168.0.0/24| UV[ubuntu-svr<br/>Mini PC<br/>192.168.0.252]
  OP -->|LAN 192.168.0.0/24| TN[TrueNAS SCALE<br/>HP MicroServer Gen8<br/>192.168.0.251]

  subgraph TAILSCALE_MESH["Tailscale Mesh 100.x.x.x"]
      HZ_TS[kaburusvr<br/>100.112.54.2]
      Z840_TS[kaburuaibox<br/>100.120.18.44]
      UV_TS[ubuntu-svr<br/>100.101.7.86]
      OP_TS[OPNsense<br/>100.127.64.74]
  end

  HZ_TS <-->|Tailscale SSH + WP-CLI| Z840_TS
  HZ_TS ~~~|Tailscale blocked| TN

  Z840_TS -.->|Tailscale SSH<br/>LAN preferred| UV_TS
  Z840_TS -.->|Tailscale SSH<br/>ACL blocked| TN

  Z840 -->|SSH ~/.ssh/id_ed256| UV
  Z840 -->|SSH /opt/hermes/config/<br/>hetzner_id_ed25519| HZ
  Z840 -->|SSH ~/.ssh/id_ed256| TN
  UV -->|Coral TPU passthrough| TN

```

—

## Node Roles

—

## Access Summary

⚠️ Critical rules: - OPNsense NEVER responds to ping — intentional - TrueNAS is LAN-only — Tailscale ACL blocks kaburuaibox → TrueNAS - Never SSH as root to ubuntu-svr or TrueNAS - SSH from LAN to internet is blocked by OPNsense — use Tailscale for external access

—

## Network Topology Details

### Internet Connectivity - Primary: Virgin Media 1Gbps → OPNsense PPPoE - Hetzner: Direct internet via 49.13.202.144 (routed through Cloudflare for HTTP/S) - VPN: Mullvad WireGuard tunnel on OPNsense for privacy/exit

### LAN (192.168.0.0/24) - OPNsense is DHCP server and local DNS (dnsmasq) - All local servers have static DHCP leases - No WiFi — everything wired - Outbound SSH to internet is blocked by firewall policy

### Tailscale (100.x.x.x) - Mesh VPN connecting all nodes - Primary use: secure access from kaburuaibox to Hetzner and off-LAN access - ACLs restrict TrueNAS access to SSH port 22 only

—

## Service Map

### kaburuaibox (Z840) — 192.168.0.253

### kaburusvr.uk (Hetzner) — 49.13.202.144

### ubuntu-svr — 192.168.0.252

### TrueNAS — 192.168.0.251

—

## Backup Flow ``` kaburuaibox → Hetzner (daily rsync of sites) Hetzner → TrueNAS (daily ZFS send) Wiki → git (local) + TrueNAS (nightly age-encrypted archive) kaburuaibox config → TrueNAS NFS share ```

—

## Emergency Contacts

—

## Single Points of Failure

—

## Related Pages

- kaburusvr — Hetzner server details - z840 — kaburuaibox specs and services - truenas — Storage pool layout - ubuntu-svr — Frigate/Omada details - opnsense — Firewall rules - tailscale — Mesh VPN config - credentials — API tokens and keys - hermes — Agent documentation - snmp — Monitoring traps