HAProxy

Kubernetes, K3s with embedded etcd on three server nodes.

API endpoint, HAProxy and Keepalived holding a virtual IP on the private network.

Ingress, Traefik bundled with K3s behind a Cloudflare load balancer locked down with authenticated origin pulls.

Reading the price sheet, 3H Cloud prices its dedicated CPU flavors linearly.

All cluster traffic stays on a 3H cloud private network.

The public interfaces accept only HTTPS from Cloudflare and SSH from a bastion.

Node public IP private IP role K3s one two hundred three zero one hundred thirteen ten ten zero zero ten server etcd K3s two two hundred three zero one hundred thirteen eleven ten zero zero eleven server etcd K3s three two hundred three zero one hundred thirteen twelve ten zero zero twelve server etcd API VIP and one ten zero zero one hundred Kubernetes API through HAProxy there are three important differences from the bare metal version.

Public IPs are optional Through the OpenStack API, a VM gets a public address only if you give it a port on the public network.

So what are you like? what are you planning to talk about a recent any book or are you giving any talk somewhere or what are you doing?

Uh, I'm just, uh, I'm currently, I'm working on, on, on, on my platform, a training platform that will include, uh, I never shared this with anyone, but I guess this is, so I'm working on my own website that I can move my, the current courses I have, and I'm going to focus on making advanced, intermediate to advanced courses about deep dive on a technology like Nginx or HAProxy or certain popular web server for those people who are interested in going in depth and understanding these technologies like databases.

I'll pick one of them and I go through them.

So I'm making that.

I'm also making the same site will be kind of a bug versus feature news site where if there is like if let's say if nginx fixed a very critical bug i would go through it and and explain how it works what was the effect and as a result what was the root cause And because of that, these kind of articles will link back to these courses.

And whoever reads these articles will get better at understanding the internals of these systems.

Because I'm fascinated about internals, especially of backend systems like NGINX, HAProxy, databases, etc.

I love that stuff.

There was a Hacker News thread a few years back where a commenter called Arnavian switched from OPNsense to Debian 12 and called it rock solid.

nftables to Firewalled, Unbound, systemd-networked, plus Haproxy running on the same box in per-service network namespaces.

Another one, Lazyweb, had a Debian 11 router at about 600 days of uptime pulling 20 to 30 watts idle, provisioned entirely by Ansible.

600 days.