STRICT PERSONAL ENCLAVE • 100% PRIVATE

xk3s Fleet Topology & Cluster Manual

Comprehensive reference architecture, static network coordinates, mutual SSH key authentication matrix, and containerized workload topologies for the personal edge Kubernetes cluster.

1. Master Fleet Coordinates

The decoupled dual-cluster personal infrastructure connects across local LAN, direct WireGuard cloud overlay, and Tailscale zero-trust meshes:

Device	Hostname	User	LAN IP	WireGuard	Tailscale	Ingress / Role
x1 · LXD Edge Host · VMs & LXC	x1	x1	xx.xx.xx.33 (eth0) / xx.xx.xx.139 (wlan0)	xx.xx.xx.2	xx.xx.xx.43	LXD edge virtualization, LXC applications, NVMe storage
x2 · Field RF Radar & Scanner Node	x2	x2	xx.xx.xx.42 (eth0) / xx.xx.xx.210 (wlan0)	xx.xx.xx.3	xx.xx.xx.80	Dedicated field RF radar and scanner operations
x3 · Compute & Engineering Station	x3	x	xx.xx.xx.172	xx.xx.xx.5	xx.xx.xx.65	Field compute, emergency engineering, disaster recovery
xpve · Host x · VMs & LXC	x	root	xx.xx.xx.59 (Wi-Fi)	xx.xx.xx.4	xx.xx.xx.102	Proxmox VE 9.2 Hypervisor • 100% Headless Clamshell (8C/16T, 32GB RAM, 2TB NVMe)
ec2 · Cloud Ingress	aws-hub	ubuntu	—	xx.xx.xx.1	—	Ingress Gateway & HA Router (xx.xx.xx.95)

2. Remote Access & SSH Matrix

Passwordless ED25519 authentication is configured across all devices. Use these standard connection commands:

# Operator SSH aliases · current fleet
ssh x1 # LXD Edge Host · VMs & LXC
ssh x2 # Field RF Radar & Scanner Node
ssh x3 # Compute & Engineering Station
ssh xpve # Host x · Proxmox VMs & LXC
ssh ec2-pub # Cloud ingress

3. Fleet Virtualization & RKE2 Architecture

RKE2 application cluster

VM 101 on xpve · 1 verified node(s): rke2-master. Actual namespace and pod placement appear in live telemetry.

x1 · LXD Edge Host · VMs & LXC

LXD edge virtualization: 7 LXC containers. K3s is stopped.

x2 · Field RF Radar & Scanner Node

Field RF radar and scanner operations. K3s is stopped.

x3 · Compute & Engineering Station

Field compute and engineering. K3s is stopped.

xpve · Host x · VMs & LXC

Host x runs Proxmox VMs and LXC, including RKE2 VM 101 and the x-db SQL historian.

ec2 · Cloud Ingress

Public HTTPS ingress, WireGuard hub and private Fleet Intelligence portal.

4. Multi-Tier Mesh Overlay

The network utilizes a multi-tier overlay model guaranteeing encrypted connectivity across all fleet endpoints:

Tier 1: Cloud-to-Edge Mesh (WireGuard 10.10.0.0/24): Dedicated point-to-point encrypted link connecting AWS EC2 gateway ec2 (xx.xx.xx.1) to the appropriate edge host x1 (xx.xx.xx.2), edge worker x2 (xx.xx.xx.3), hypervisor x (xx.xx.xx.4), and compute worker x3 (xx.xx.xx.5).
Tier 2: Zero-Trust Remote Mesh (Tailscale 100.64.0.0/10): Direct peer-to-peer WireGuard mesh connecting x1 (xx.xx.xx.43), x2 (xx.xx.xx.80), x3 (xx.xx.xx.65), and x (xx.xx.xx.102).
Tier 3: Local Area Network (LAN 192.168.4.0/22): Ultra low-latency physical link connecting Gigabit Ethernet on x1 (xx.xx.xx.33 / standby Wi-Fi xx.xx.xx.139), Gigabit Ethernet on x2 (xx.xx.xx.42 / standby Wi-Fi xx.xx.xx.210), x3 (xx.xx.xx.172), and x (xx.xx.xx.59).

5. Hardware & Operating System Specifications

Device / role	OS & kernel	Processor	RAM	Storage
x1 · LXD Edge Host · VMs & LXC	Ubuntu 24.04.5 LTS 6.8.0-1065-raspi	Cortex-A76 · 4 logical CPUs	15.60 GiB	938.38 GiB root filesystem
x2 · Field RF Radar & Scanner Node	Debian GNU/Linux 12 (bookworm) 6.12.109+rpt-rpi-2712	Cortex-A76 · 4 logical CPUs	7.87 GiB	28.77 GiB root filesystem
x3 · Compute & Engineering Station	Ubuntu 24.04.5 LTS 7.0.0-38-generic	Intel(R) Celeron(R) N4500 @ 1.10GHz · 2 logical CPUs	7.57 GiB	117.55 GiB root filesystem
xpve · Host x · VMs & LXC	Proxmox VE 9.2.21 / Debian GNU/Linux 13 (trixie) 7.0.14-20-pve	Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz · 16 logical CPUs	31.24 GiB	93.93 GiB root filesystem
ec2 · Cloud Ingress	Ubuntu 24.04.5 LTS 7.0.0-1012-aws	Intel(R) Xeon(R) Platinum 8175M CPU @ 2.50GHz · 2 logical CPUs	0.89 GiB	23.17 GiB root filesystem

Host labels match Mission Control. CPU and memory values are measured independently of VM/container allocations; storage shows root-filesystem capacity. VM and LXC guest details appear in live telemetry.

6. Active Edge Endpoints Directory

36 services, using the same names, device/environment assignments, logos and launch URLs as the main dashboard. Expand a category or search for a service.

Cyber & Network Defense (4)

rke2-compliancexpve · RKE2 · RKE2 · 30891 · RKE2 data connected

Portal	Application host	Data source
Fleet Intelligence	ec2 · private portal	Fleet inventory / operator directory
Docs	RKE2 host · VM 101 · port 30870	Published fleet documentation + RKE2 PostgreSQL
Cyber	RKE2 host · VM 101 · port 30850	RKE2 PostgreSQL ignition_db
OTSec	RKE2 host · VM 101 · port 30860	RKE2 PostgreSQL ignition_db
Ignition Logs	RKE2 host · VM 101 · port 31950	RKE2 gateways / PostgreSQL ignition_db