Kubernetes Namespaces¶
All workloads run on the mdapi-prod cluster (Harvester HCI / RKE2). Namespaces are organized by function.
About envuassu
"En Vuassu" is the name of the neighbourhood where multiple villas jointly own and manage a shared private space. The envuassu namespace hosts the services run for that small community of families (Nextcloud, Zammad ticketing, a dedicated Keycloak at login.envuassu.ch) — it is not an MDAPI-org service. It sits in the Web Hosting group below alongside the other independent web properties, and its identity is fully separate from the MDAPI Keycloak at idp.mdapi.ch.
Categories¶
Namespaces grouped by function. The Full Inventory table below lists every namespace with workloads, storage, and ingress.
Platform operators — kube-system (ingress-nginx), longhorn-system, rook-ceph (in-cluster Ceph), cert-manager, metallb-system, external-secrets, external-dns, cnpg-system (CloudNativePG), volsync-system (Ceph PVC backups), keel, reloader (config-change rollouts), descheduler, democratic-csi, fleet-*.
Identity & Auth (MDAPI org) — keycloak (idp.mdapi.ch), oauth2-proxy, openldap (LDAP + LAM).
Ops / DevOps — bootstrap (GitLab EE), windmill (automation), monitoring (VictoriaMetrics + Grafana + the alert plane), cribl (log streaming), openobserve (logs.mdapi.ch, indexed log search), zot (OCI registry), mirror (package mirror), squid (HTTP proxy), meshcentral (help.mdapi.ch, remote support for family devices).
Networking / Infrastructure — ntppool (Chrony GPS stratum-1), nameserver (BIND9 public DNS), technitium (internal DNS + DHCP), split-horizon (in-cluster unbound split-horizon resolver), opennic (tier-2 resolver), vpn (WireGuard), openvpn (OpenVPN admin UI), honeypot (Trapeye), certspotter (CT monitor), garage-witness (quorum witness for the external Garage cluster), ups (Network UPS Tools server), snowflake-proxy + webtunnel-bridge (donated-bandwidth Tor relays).
Collaboration & Comms — joplin (notes.mdapi.ch), paperless (documents.mdapi.ch, DMS), mail (full mail stack, 130 Gi), znc (IRC bouncer), mqtt (Mosquitto).
Domotics — home-assistant, appdaemon, esphome, frigate (NVR), scrypted (Nest → RTSP bridge for Frigate).
Media / TV — tv: 16-service stack (Plex, Sonarr, Radarr, Prowlarr, Bazarr, Tdarr, Autobrr, Seerr, Transmission + PIA, Threadfin × 2, Flaresolverr) on CephFS RWX volumes.
Portals — showcase (the public front door at mdapi.ch), lowcoder (the members' portal + self-service marketplace engine at start.mdapi.ch).
Web Hosting (independent properties) — spider3 (spider3.ch), coiffuredreams (coiffuredreams.ch), dellambrogio (dellambrogio.ch), ivodellambrogio (ivodellambrogio.ch), owncloud (cloud.mdapi.ch), envuassu (the En Vuassu neighbourhood community: Nextcloud + Zammad + Keycloak login.envuassu.ch).
Full Inventory¶
| Namespace | Key Workloads | Storage | Ingress / VIP |
|---|---|---|---|
bootstrap |
GitLab EE (webservice, sidekiq, toolbox, registry, kas) | Ceph RGW (S3) | gitlab.mdapi.ch |
cert-manager |
cert-manager operator | — | — |
certspotter |
certspotter (CT log monitor) | 5Gi | — |
cnpg-system |
CloudNativePG operator | — | — |
coiffuredreams |
WordPress + MariaDB | 4Gi | coiffuredreams.ch |
cribl |
Cribl Stream | 50Gi | cribl.mdapi.ch |
democratic-csi |
NFS + iSCSI CSI drivers | — | — |
descheduler |
Kubernetes descheduler | — | — |
dellambrogio |
WordPress (custom image) | — | dellambrogio.ch |
envuassu |
Nextcloud AIO + Zammad + Keycloak (neighbourhood community) | 200Gi data + more | cloud.envuassu.ch, suivi.envuassu.ch, login.envuassu.ch |
esphome |
ESPHome | 50Gi | esphome.mdapi.ch |
external-dns |
external-dns (RFC 2136 → Technitium) | — | — |
external-secrets |
External Secrets Operator | — | — |
frigate |
Frigate NVR | 11Gi | frigate.mdapi.ch |
garage-witness |
Garage quorum witness (external S3 cluster) | 2×5Gi | — |
home-assistant |
Home Assistant | — | home.mdapi.ch |
honeypot |
Trapeye | — | 192.168.1.45 |
ivodellambrogio |
WordPress + MariaDB | 2Gi | ivodellambrogio.ch |
joplin |
Joplin Server + MCP bridge + Postgres | 5Gi | notes.mdapi.ch |
keel |
Keel operator (poll every 4h) | — | — |
keycloak |
Keycloak + Postgres (MDAPI org SSO) | 5Gi | idp.mdapi.ch |
kube-system |
ingress-nginx | — | 192.168.1.191 |
longhorn-system |
Longhorn controller + UI | — | — |
lowcoder |
Lowcoder (members' portal engine) + MongoDB + Valkey | 10Gi | start.mdapi.ch |
mail |
docker-mailserver + Roundcube + Rspamd + Autoconfig | 130Gi | webmail.mdapi.ch |
meshcentral |
MeshCentral (NeDB on Longhorn, single replica) | 20Gi | help.mdapi.ch |
mirror |
Package mirror | 200Gi | mirror.mdapi.ch |
monitoring |
VictoriaMetrics (vmsingle + vmagent + vmalert) + Grafana + blackbox / Pushgateway / statuspage adapter | PVC (3y metrics) | grafana.mdapi.ch |
mqtt |
Eclipse Mosquitto | 5Gi | 192.168.1.43 |
nameserver |
BIND9 + Webmin | 1Gi | ns.mdapi.ch, 192.168.1.53 |
ntppool |
Chrony (GPS PPS, stratum-1) | — | 192.168.1.58 |
oauth2-proxy |
OAuth2 proxy | — | auth.mdapi.ch |
openldap |
OpenLDAP + LAM | 5Gi | lam.mdapi.ch, 192.168.1.52 |
opennic |
OpenNIC tier-2 resolver | — | 192.168.1.44 |
openobserve |
OpenObserve (indexed log search) | Ceph RGW (Parquet) + PVC | logs.mdapi.ch |
openvpn |
ovpn-admin UI (on mdapi-rancher) |
— | vpnadmin.home.tillo.ch |
owncloud |
OwnCloud + Postgres + Redis | 5Gi | cloud.mdapi.ch |
paperless |
Paperless-NGX + CNPG Postgres + Valkey | 100Gi docs + 5Gi pg | documents.mdapi.ch |
metallb-system |
MetalLB controller + speaker | — | — |
reloader |
Stakater Reloader (rolls workloads on ConfigMap / Secret change) | — | — |
rook-ceph |
Rook operator + Ceph cluster (18 OSDs, mgr dashboard) | Ceph OSDs on P420i + FusionIO + bay-5 SSDs | ceph.mdapi.ch |
scrypted |
Scrypted (Google Nest → RTSP bridge for Frigate) | 20Gi | scrypted.mdapi.ch |
showcase |
Static nginx public showcase | ConfigMap (static) | mdapi.ch, www.mdapi.ch |
snowflake-proxy |
Tor Snowflake proxy (donated bandwidth) | — | — |
spider3 |
Joomla + MariaDB | 52Gi | spider3.ch |
split-horizon |
unbound (split-horizon DNS resolver) | — | 192.168.1.1 |
squid |
Squid HTTP/S proxy | — | 192.168.1.50 |
technitium |
Technitium DNS + DHCP (primary + secondary) | — | 192.168.1.54 (DNS), 192.168.1.55 (DHCP) |
tv |
16-service media stack | CephFS RWX (ceph-filesystem) |
*.mdapi.ch per service |
ups |
NUT (Network UPS Tools) server | — | — |
volsync-system |
VolSync operator (Ceph PVC → Garage backups) | — | — |
vpn |
WireGuard (wg-prod) |
— | 31820/UDP (NodePort) |
webtunnel-bridge |
Tor WebTunnel bridge | — | — (unlisted by design) |
windmill |
Windmill + Postgres | 5Gi | windmill.mdapi.ch |
znc |
ZNC IRC bouncer | 2Gi | 192.168.1.51 |
zot |
Zot OCI registry | Garage S3 (zot-images) |
zot.mdapi.ch |
TV Namespace — Media Stack¶
The tv namespace runs a full arr-stack for media acquisition and management, sharing ReadWriteMany (RWX) CephFS volumes (via Rook) across all services. The library was migrated off a Longhorn RWX volume onto CephFS.
Plex Live TV / EPG
Operational notes on the Threadfin → Plex XMLTV ingest path — channel mapping, xepg.json editing, and forcing a Plex EPG re-ingest — live on the Plex Live TV / Threadfin EPG page.
| Service | Image | Role |
|---|---|---|
| pms-docker | plexinc/pms-docker | Media server |
| sonarr | linuxserver/sonarr | TV show management |
| radarr | linuxserver/radarr | Movie management |
| prowlarr | linuxserver/prowlarr | Indexer management |
| bazarr | linuxserver/bazarr | Subtitle management |
| tdarr | haveagitgat/tdarr | Transcode automation |
| seerr | ghcr.io/seerr-team/seerr | Request management |
| transmission | transmission + PIA VPN sidecar | Download client |
| autobrr | ghcr.io/autobrr/autobrr | Torrent automation |
| threadfin × 2 | custom (registry.mdapi.ch) | IPTV proxy |
| flaresolverr | flaresolverr | Cloudflare bypass |
RWX storage
The media library's RWX volumes are provided by CephFS (the ceph-filesystem storage class, via Rook), which handles concurrent multi-pod access natively. The earlier Longhorn RWX class (harvester-longhorn-2replicas-notmigratable) pinned replicas to fixed nodes to avoid live-migration issues with large RWX volumes; it is no longer used for the media stack.