STRICT PERSONAL ENCLAVE • 100% PRIVATE

xk3s Fleet Topology & Cluster Manual

Comprehensive reference architecture, static network coordinates, mutual SSH key authentication matrix, and containerized workload topologies for the personal edge Kubernetes cluster.

1. Master Fleet Coordinates

The personal infrastructure consists of 7 primary devices and cluster nodes connected across local LAN, WireGuard cloud overlay, and Tailscale zero-trust meshes:

Device	Hostname	User	LAN IP	WireGuard	Tailscale	Ingress / Role
MacBook Air	das-MacBook-Air.local	da	192.168.4.•••	—	100.71.•••.••	Primary Workstation (M1, 16GB)
MacBook Pro	Doxs-MacBook-Pro.local	dx	192.168.4.•••	—	100.102.•••.••	Secondary Workstation (i9, 32GB)
x1 (Master)	x1	x1	192.168.4.•••	10.10.0.••	100.95.•••.••	K3s Master, NVMe Storage, API (6443)
x2 (Worker)	x2	x2	192.168.4.•••	10.10.0.••	100.71.•••.••	K3s Edge Worker, HDMI Kiosk, VNC (5900)
AWS Hub (EC2)	ip-172-31-2-180	ubuntu	—	10.10.0.••	—	Ingress Gateway (54.215.•••.••)
dphone	dphone	—	—	—	100.64.•••.••	Mobile iOS Zero-Trust Client

2. Remote Access & SSH Matrix

Passwordless ED25519 authentication is configured across all devices. Use these standard connection commands:

# Workstation Remote Access
ssh mbp # Connect to MacBook Pro (Tailscale)
ssh mbp-lan # Connect to MacBook Pro (LAN: 192.168.4.•••)
open vnc://dx@100.102.•••.•• # Screen Share VNC session

# Edge Cluster Node Access
ssh x1@100.95.•••.•• # Cluster Master x1 (Tailscale)
ssh x2@100.71.•••.•• # Edge Worker x2 (Tailscale)

# AWS Cloud Gateway
ssh ec2-pub # AWS EC2 Ingress Gateway (54.215.•••.••)

3. Dedicated K3s Kubernetes Cluster

The cluster runs lightweight Kubernetes (K3s) with dedicated control plane and edge worker nodes:

x1 Control Plane

MASTER

K3s API Server6443

Active WorkloadsIgnition, Influx, OpenPLC, Portainer

Storage Backend500GB NVMe PCIe

Internal ClusterIP10.43.0.0/16

Pod CIDR (Flannel)10.42.0.0/24

Operating SystemDebian 13 (Trixie)

x2 Edge Worker

WORKER

Worker AgentK3s v1.31+

Active WorkloadsGitea, Web HUD, Telegraf UNS

HDMI Kiosk SurfaceLocal Display / Chromium

VNC ServerPort 5900 (wayvnc)

Pod CIDR (Flannel)10.42.1.0/24

Hardware PlatformEdge Worker Node (8GB)

mbp-worker Compute

HEAVY COMPUTE

Hardware PlatformIntel Core i9 (8C/16T, 32GB RAM)

Allocated Worker12 vCPU • 24GB RAM

Pod CIDR (Flannel)10.42.2.0/24

Tailscale IP100.102.•••.••

Operating SystemUbuntu 24.04 LTS AMD64

AWS EC2 Ingress

GATEWAY

Reverse ProxyNginx 1.24+

SSL TerminationLet's Encrypt TLS 1.3

WireGuard Hub10.10.0.•• (UDP 51820)

Cloudflare ProxyZero-Trust Shield

Public IP54.215.•••.••

4. Multi-Tier Mesh Overlay

The network utilizes a three-tier overlay model guaranteeing encrypted connectivity across all environments:

Tier 1: Cloud-to-Edge Tunnel (WireGuard 10.10.0.0/24): Dedicated point-to-point encrypted link connecting AWS EC2 gateway to node x1 and node x2.
Tier 2: Zero-Trust Remote Mesh (Tailscale 100.64.0.0/10): Direct peer-to-peer WireGuard mesh connecting MacBook Air, MacBook Pro, mobile clients, and edge nodes without open inbound firewall ports.
Tier 3: Local Area Network (LAN 192.168.4.0/24): Ultra low-latency physical link between on-premise hardware workstations and edge micro-servers.

5. Hardware & Operating System Specifications

Node	Operating System	Arch	Processor	RAM	Storage
MacBook Air	macOS 26.5.2 (Darwin 25)	arm64	Apple M1 (8 cores)	16 GB Unified	500 GB NVMe APFS
MacBook Pro	macOS 26.7 (Darwin 25)	x86_64	Intel Core i9-9880H (8C/16T)	32 GB DDR4	1.1 TB NVMe APFS
x1 (Master)	Debian 13 (Trixie)	aarch64	Broadcom BCM2712 (4 cores)	16 GB LPDDR4X	500 GB NVMe PCIe Gen3
x2 (Worker)	Debian 12 (Bookworm)	aarch64	Broadcom BCM2712 (4 cores)	8 GB LPDDR4	64 GB MicroSD
AWS Hub	Ubuntu 24.04 LTS	x86_64	AWS Nitro vCPU	1 GB Burst	30 GB gp3 EBS