Architecture
A Rocky Linux host runs a single-server K3s cluster whose packaged Traefik Ingress Controller handles public HTTPS. A separate workstation provides private GPU inference. Public ingress, private administration, cluster workloads, and GPU inference remain separate so that each can be maintained and recovered at its own boundary.
Choose a reading route
| What you want to understand | Start here, then follow the connection |
|---|---|
| Administer the server privately | WireGuard establishes the network path; SSH and NoMachine explain terminal and graphical authentication. |
| Review the result of a configuration change | Maintenance leads to reporting, AIDE integrity review and Linux Audit investigation. |
| Understand a public application | K3s explains shared ingress and storage; Linkwarden and Calagopus explain their workloads; CrowdSec follows ingress logs into detection and enforcement. |
| Follow a bookmark through classification | Linkwarden AI Tagger connects the application API and inference worker; Validation results shows recorded outcomes. |
The homepage map offers another way to explore these connections. Each topic keeps one page, with related explanations available across section boundaries.
System overview
Public HTTPS is intentionally limited to TCP 443: K3s ServiceLB exposes the Traefik LoadBalancer Service on 443, while public TCP 80 and an HTTP-to-HTTPS redirect are absent. Traefik uses DNS-01 for certificate issuance, and the static site runs as an immutable image served internally by unprivileged NGINX.
Security boundaries
Public exposure is deliberately scoped by router forwarding and the host firewall. The Traefik LoadBalancer Service exposes HTTPS on TCP 443, while game-server ports are controlled separately. The Calagopus Panel is a public application behind Traefik, but Wings, Docker control, SSH, NoMachine, the Kubernetes API, and inference remain outside that route. CrowdSec enforcement uses a native nftables bouncer that covers both host input and ServiceLB forwarding paths.
The tested single-server ServiceLB path preserves the real client address with externalTrafficPolicy: Local; that result describes this topology and is not permission to trust arbitrary forwarded headers. SSH requires an accepted public key followed by a PAM-backed TOTP challenge, while NoMachine keeps its system-password step and adds a separate TOTP challenge.
SELinux remains enforcing. Files, storage, and executables receive the labels required by their actual service boundaries instead of bypassing enforcement. Secrets and host-specific values remain outside source control, and public registration is disabled for the private Linkwarden instance.
Auditd attributes selected host configuration operations to processes and available login identities. AIDE checks selected files and directories against an explicitly approved integrity baseline. The local security report and doctor combine those observations with control health and exposure evidence. A persistent calendar timer produces recurring reports and catches up after missed runs; doctor supplies a fresh diagnosis. Both support operator review without changing controls or accepting baseline differences.
Technology choices
Rocky Linux provides the SELinux-enabled host. K3s supplies Kubernetes scheduling, storage primitives, ServiceLB, and the packaged Traefik Ingress Controller. CrowdSec consumes Traefik access logs and enforces decisions through native nftables. WireGuard supplies the private administration path. SSH hardening and NoMachine hardening add independent authentication controls. Calagopus separates its public Kubernetes Panel from host-level Wings and Docker game-server workloads.
Linkwarden uses PostgreSQL for application data and Meilisearch for search. The inference worker stays separate so GPU drivers, model storage, and desktop resource pressure do not complicate the stable server.
Recovery model
Recovery is staged by boundary: establish the Rocky Linux network, SELinux, firewall, and private-access baseline; restore K3s and its local storage; restore ingress and TLS state; restore application workloads; then validate public exposure from the outside in. Same-device backups protect against some configuration mistakes and failed upgrades but not device loss. Workload data, ACME state, release artifacts, and host-loss recovery remain distinct responsibilities.
Maintenance owns the cross-component lifecycle and troubleshooting order.