kaffa/obsidian
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HAProxy APISIX 9080/9443 프론트엔드 추가, infra-hosts Traefik 전환 반영

Browse Source
This commit is contained in:
kappa
2026-03-25 16:20:00 +09:00
parent e916cec273
commit 27ab321bfb
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
infra/infra-hosts.md
View File

@@ -17,7 +17,7 @@ tags: [infra, network, kr-zone, openwrt]
| incus-kr1 | 100.84.111.28 | Incus+K3s 호스트 (서울) | GTX 1080 Ti, K3s control-plane (LAN 192.168.9.214), default 프로젝트 |
| incus-kr2 | 100.119.109.41 | Incus+K3s 호스트 (서울) | K3s control-plane (LAN 192.168.9.135), default, inbest 프로젝트 |
| incus-hp2 | 100.100.52.34 | Incus+K3s 호스트 (서울) | Xeon E5-2670 32코어, 188GB RAM, K3s control-plane (LAN 192.168.9.134), default, inbest 프로젝트 |
| openwrt-gw | 100.66.60.66 | OpenWrt 라우터 (서울) | HAProxy: 80/443 → APISIX hostNetwork 9080/9443 (3노드 roundrobin) |
| openwrt-gw | 100.66.60.66 | OpenWrt 라우터 (서울) | HAProxy: 80/443 → Traefik hostPort (3노드), 9080/9443 → APISIX NodePort 30233/31137 (3노드) |
| sandbox-tokyo | 100.79.87.48 | 테스트 서버 (도쿄, Linode) | vault-prod, wg-easy, nginx-tcp-proxy (Docker) |
| relay4wd | 100.103.161.4 | APISIX Gateway (서울, AWS Lightsail) | inbest 전용, Docker APISIX 3.15.0, Debian 12, nano $5/월, SSH: admin + lightsail.pem |
| synology | LAN 192.168.9.100 / 192.168.205.100 (2.5G) | NAS (시놀로지) | Tailscale 미사용, LAN 접근 |
@@ -34,13 +34,14 @@ tags: [infra, network, kr-zone, openwrt]
주요 네임스페이스: anvil, apisix, argocd, cert-manager, db, gitea, ironclad, kroki, longhorn-system, monitoring, mq, openmemory, rabbitmq-system, safeline, system-upgrade, tools, vault
게이트웨이: APISIX 단독 (Traefik 완전 제거, 2026-03-25)
- APISIX Deployment replicas 3, hostPort 9080/9443 바인딩
- apisix-gateway Service: 80→9080, 443→9443
- APISIX Ingress Controller 2.0.1 + Gateway API 기반 CRD 라우팅
- CoreDNS hairpin rewrite: apisix-gateway.apisix.svc.cluster.local
게이트웨이: Traefik (메인) + APISIX (SafeLine WAF 전용), 2026-03-25 전환
- Traefik DaemonSet, hostPort 80/443 + Gateway API
- APISIX Deployment replica 1, SafeLine WAF chaitin-waf 플러그인 연동, Admin API 수동 관리
- CoreDNS hairpin rewrite: traefik.kube-system.svc.cluster.local
트래픽 흐름: 외부 → OpenWrt HAProxy (TCP 80/443) + nftables (UDP 443) → APISIX hostPort (9080/9443, 3노드) → K3s 서비스 → pods
트래픽 흐름:
- 일반: 외부 → OpenWrt HAProxy(:80/:443) → Traefik hostPort(80/443, 3노드) → K3s 서비스
- WAF: 외부 → OpenWrt HAProxy(:9080/:9443) → APISIX NodePort(30233/31137, 3노드) → K3s 서비스
### Helm 릴리스