Kubernetes Namespaces¶
All workloads run on the mdapi-prod cluster (Harvester HCI / RKE2). Namespaces are organized by function.
About envuassu
"En Vuassu" is the name of the neighbourhood where multiple villas jointly own and manage a shared private space. The envuassu namespace hosts the services run for that small community of families (Nextcloud, Zammad ticketing, a dedicated Keycloak at login.envuassu.ch) — it is not an MDAPI-org service. It sits in the Web Hosting group below alongside the other independent web properties, and its identity is fully separate from the MDAPI Keycloak at idp.mdapi.ch.
Categories¶
Namespaces grouped by function. The Full Inventory table below lists every namespace with workloads, storage, and ingress.
Platform operators — kube-system (ingress-nginx), longhorn-system, rook-ceph (in-cluster Ceph), cephfs-kmod (DaemonSet compiling the ceph kernel module per kernel, with a cross-node Secret cache), cert-manager, cert-manager-infomaniak (Infomaniak DNS-01 webhook solver, for zones hosted at Infomaniak rather than self-hosted BIND9), metallb-system, external-secrets, external-dns, cnpg-system (CloudNativePG), volsync-system (Ceph PVC backups), keel, reloader (config-change rollouts), descheduler, democratic-csi, fleet-*, gitlab-runner-builder (GitLab CI runner for the OpenWrt buildroot workspace), ilo-cert-renewal (iLO certificate-renewal CronJob), akeyless-pg-bridge (Akeyless↔Postgres secrets bridge), gitlab-agent (GitLab Agent for Kubernetes), etcd-priority (CPU-priority node-tuner DaemonSet, keeps etcd scheduling latency bounded under host load).
Identity & Auth (MDAPI org) — keycloak (idp.mdapi.ch), oauth2-proxy, openldap (LDAP + LAM).
Ops / DevOps — bootstrap (GitLab EE), windmill (automation), monitoring (VictoriaMetrics + Grafana + the alert plane), cattle-monitoring-system (node-exporter + kube-state-metrics remnants of rancher-monitoring), cattle-logging-system (fluent-bit + journald-aggregator DaemonSets, rancher-logging shell), cattle-dashboards (sidecar-provisioned Grafana dashboard ConfigMaps, rancher-monitoring shell), cribl (log streaming), openobserve (logs.mdapi.ch, indexed log search), zot (OCI registry), mirror (package mirror), squid (HTTP proxy), meshcentral (help.mdapi.ch, remote support for family devices), horizon (Evertrust Horizon CLM), horizon-discovery (network cert discovery, horizon-netscan CronJob), evertrust-mcp (Horizon/Stream MCP bridges), stream (Evertrust Stream internal PKI — see Certificates & PKI), ciphertrust (CipherTrust Manager VM, Akeyless customer fragment), openbao (secrets failover plane), paperless-kustodyan (RegData RPS data-protection engine, dedicated to Paperless) + kustodyan-mcp (its MCP bridge), k8s-mcp (Kubernetes MCP server), tabby (self-hosted code-assist trial).
Networking / Infrastructure — ntppool (Chrony GPS stratum-1), ntppool-agent (NTP pool monitoring agent), nameserver (BIND9 public DNS), technitium (internal DNS + DHCP), split-horizon (in-cluster unbound split-horizon resolver), opennic (tier-2 resolver), jump (in-cluster jump seat on LB .62, ssh -p443 + mosh), honeypot (Trapeye), certspotter (CT monitor), garage-witness (quorum witness for the external Garage cluster), ups (Network UPS Tools server), snowflake-proxy + webtunnel-bridge (donated-bandwidth Tor relays).
Collaboration & Comms — joplin (notes.mdapi.ch), paperless (documents.mdapi.ch, DMS), mail (full mail stack, 130 Gi), znc (IRC bouncer), mqtt (Mosquitto).
Domotics — home-assistant, appdaemon, esphome, frigate (NVR), scrypted (Nest → RTSP bridge for Frigate).
Media / TV — tv: 14-service stack (Plex, Sonarr, Radarr, Prowlarr, Bazarr, Tdarr, Autobrr, Seerr, Transmission + PIA, Threadfin × 2, Flaresolverr, SFTPGo, rsync) on CephFS RWX volumes.
Portals — showcase (the public front door at mdapi.ch), portal (the members' portal + self-service marketplace at start.mdapi.ch — the marketplace itself is Windmill flows, not a separate namespace).
Web Hosting (independent properties) — spider3 (spider3.ch), coiffuredreams (coiffuredreams.ch), dellambrogio (dellambrogio.ch), ivodellambrogio (ivodellambrogio.ch), owncloud (cloud.mdapi.ch), envuassu (the En Vuassu neighbourhood community: Nextcloud + Zammad + Keycloak login.envuassu.ch), mdapiorg (permanent redirect: mdapi.org / *.mdapi.org → mdapi.ch).
Full Inventory¶
| Namespace | Key Workloads | Storage | Ingress / VIP |
|---|---|---|---|
akeyless-pg-bridge |
Akeyless↔Postgres secrets bridge | — | — |
appdaemon |
AppDaemon (Home Assistant automation engine) | 10Gi | — |
bootstrap |
GitLab EE (webservice, sidekiq, toolbox, registry, kas) | Ceph RGW (S3) | gitlab.mdapi.ch |
cattle-dashboards |
Sidecar-provisioned Grafana dashboard ConfigMaps (rancher-monitoring shell) | — | — |
cattle-logging-system |
fluent-bit + journald-aggregator DaemonSets (rancher-logging shell) | — | — |
cattle-monitoring-system |
node-exporter + kube-state-metrics (remnants of rancher-monitoring) | — | — |
cephfs-kmod |
DaemonSet compiling the ceph kernel module per kernel (cross-node Secret cache) | — | — |
cert-manager |
cert-manager operator | — | — |
cert-manager-infomaniak |
infomaniak-webhook (cert-manager DNS-01 solver for Infomaniak-hosted zones) | — | — |
certspotter |
certspotter (CT log monitor) | 5Gi | — |
ciphertrust |
CipherTrust Manager (KubeVirt VM) — Akeyless customer fragment | 200Gi (RWX) | cm.mdapi.ch |
cnpg-system |
CloudNativePG operator | — | — |
coiffuredreams |
WordPress + MariaDB | 4Gi | coiffuredreams.ch |
cribl |
Cribl Stream | 50Gi | cribl.mdapi.ch |
democratic-csi |
NFS + iSCSI CSI drivers | — | — |
descheduler |
Kubernetes descheduler | — | — |
dellambrogio |
WordPress (custom image) | — | dellambrogio.ch |
envuassu |
Nextcloud AIO + Zammad + Keycloak (neighbourhood community) | 200Gi data + more | cloud.envuassu.ch, suivi.envuassu.ch, login.envuassu.ch |
esphome |
ESPHome | 50Gi | esphome.mdapi.ch |
evertrust-mcp |
horizon-mcp + stream-mcp (Evertrust Horizon/Stream MCP bridges) | — | horizon-mcp.mdapi.ch, stream-mcp.mdapi.ch |
external-dns |
external-dns (RFC 2136 → Technitium) | — | — |
external-secrets |
External Secrets Operator | — | — |
frigate |
Frigate NVR | 11Gi | frigate.mdapi.ch |
garage-witness |
Garage quorum witness (external S3 cluster) | 2×5Gi | 192.168.1.59 (RPC) |
gitlab-agent |
GitLab Agent for Kubernetes (kas) | — | — |
gitlab-runner-builder |
GitLab CI runner (OpenWrt buildroot workspace) | — | — |
home-assistant |
Home Assistant | PVCs + CNPG recorder (ha-recorder-pg, barman → Garage) |
home.mdapi.ch |
honeypot |
Trapeye | — | 192.168.1.45 |
horizon |
Evertrust Horizon (certificate lifecycle management) + MongoDB | 15Gi | horizon.mdapi.ch |
horizon-discovery |
horizon-netscan CronJob (network cert discovery) |
— | — |
horizon-issuer |
Horizon ClusterIssuer controller (cert-manager-style issuer sourced from Horizon) | — | — |
ilo-cert-renewal |
iLO certificate-renewal CronJob | — | — |
ivodellambrogio |
WordPress + MariaDB | 2Gi | ivodellambrogio.ch |
joplin |
Joplin Server + MCP bridge + Postgres | 5Gi | notes.mdapi.ch |
jump |
In-cluster jump seat (ssh -p443 + mosh) + Guacamole + CNPG Postgres | 8Gi + guac-pg | jump.mdapi.ch, 192.168.1.62 |
k8s-mcp |
Kubernetes MCP server | — | k8s-mcp.mdapi.ch |
keel |
Keel operator (poll every 4h) | — | — |
keycloak |
Keycloak + Postgres (MDAPI org SSO) | 5Gi | idp.mdapi.ch |
kube-system |
ingress-nginx | — | 192.168.1.191 |
kustodyan-mcp |
Kustodyan MCP server | — | kustodyan-mcp.mdapi.ch |
longhorn-system |
Longhorn controller + UI | — | — |
mail |
docker-mailserver + Roundcube + Rspamd + Autoconfig | 130Gi | webmail.mdapi.ch |
mdapiorg |
nginx ingress: permanent redirect mdapi.org/*.mdapi.org → mdapi.ch |
— | mdapi.org, *.mdapi.org |
meshcentral |
MeshCentral (NeDB on Longhorn, single replica) | 20Gi | help.mdapi.ch |
mirror |
Package mirror | 200Gi | mirror.mdapi.ch |
monitoring |
VictoriaMetrics (vmsingle + vmagent + vmalert) + Grafana + blackbox / Pushgateway / statuspage adapter | PVC (3y metrics) | grafana.mdapi.ch |
mqtt |
Eclipse Mosquitto | 5Gi | 192.168.1.43 |
nameserver |
BIND9 + Webmin | 1Gi | ns.mdapi.ch, 192.168.1.53 |
ntppool |
Chrony (GPS PPS, stratum-1) | — | 192.168.1.58 |
ntppool-agent |
NTP pool monitoring agent | 1Gi | — |
oauth2-proxy |
OAuth2 proxy | — | auth.mdapi.ch |
openbao |
OpenBao (secrets failover plane) | — | — |
openldap |
OpenLDAP + LAM | 5Gi | lam.mdapi.ch, 192.168.1.52 |
opennic |
OpenNIC tier-2 resolver | — | 192.168.1.44 |
openobserve |
OpenObserve (indexed log search) | Ceph RGW (Parquet) + PVC | logs.mdapi.ch |
owncloud |
OwnCloud + Postgres + Redis | 5Gi | cloud.mdapi.ch |
paperless |
Paperless-NGX + CNPG Postgres + Valkey | 100Gi docs + 5Gi pg | documents.mdapi.ch |
paperless-kustodyan |
Kustodyan RPS engine + Valkey cache (dedicated to Paperless) | — | — |
portal |
Members' portal + marketplace engine (replaced Lowcoder) | — | start.mdapi.ch |
metallb-system |
MetalLB controller + speaker | — | — |
reloader |
Stakater Reloader (rolls workloads on ConfigMap / Secret change) | — | — |
rook-ceph |
Rook operator + Ceph cluster (18 OSDs, mgr dashboard) | Ceph OSDs on P420i + FusionIO + bay-5 SSDs | ceph.mdapi.ch |
scrypted |
Scrypted (Google Nest → RTSP bridge for Frigate) | 20Gi | scrypted.mdapi.ch |
showcase |
Static nginx public showcase | ConfigMap (static) | mdapi.ch, www.mdapi.ch |
snowflake-proxy |
Tor Snowflake proxy (donated bandwidth) | — | — |
spider3 |
Joomla + MariaDB | 52Gi | spider3.ch |
split-horizon |
unbound (split-horizon DNS resolver) | — | 192.168.1.1 |
squid |
Squid HTTP/S proxy | — | 192.168.1.50 |
stream |
Evertrust Stream (internal PKI: X.509 + SSH + TSA) + MongoDB | — | stream.mdapi.ch, crl.mdapi.ch |
tabby |
Tabby (self-hosted code-assist trial) + Ollama | 20Gi | tabby.mdapi.ch |
technitium |
Technitium DNS + DHCP (primary + secondary) | — | 192.168.1.54 (DNS), 192.168.1.55 (DHCP) |
tv |
14-service media stack | CephFS RWX (ceph-filesystem) |
*.mdapi.ch per service |
ups |
NUT (Network UPS Tools) server | — | — |
volsync-system |
VolSync operator (Ceph PVC → Garage backups) | — | — |
webtunnel-bridge |
Tor WebTunnel bridge | — | — (unlisted by design) |
windmill |
Windmill + Postgres | 5Gi | windmill.mdapi.ch |
znc |
ZNC IRC bouncer | 2Gi | 192.168.1.51 |
zot |
Zot OCI registry | Garage S3 (zot-images) |
zot.mdapi.ch |
TV Namespace — Media Stack¶
The tv namespace runs a full arr-stack for media acquisition and management, sharing ReadWriteMany (RWX) CephFS volumes (via Rook) across all services. The library was migrated off a Longhorn RWX volume onto CephFS.
Plex Live TV / EPG
Operational notes on the Threadfin → Plex XMLTV ingest path — channel mapping, xepg.json editing, and forcing a Plex EPG re-ingest — live on the Plex Live TV / Threadfin EPG page.
| Service | Image | Role |
|---|---|---|
| pms-docker | plexinc/pms-docker | Media server |
| sonarr | linuxserver/sonarr | TV show management |
| radarr | linuxserver/radarr | Movie management |
| prowlarr | linuxserver/prowlarr | Indexer management |
| bazarr | linuxserver/bazarr | Subtitle management |
| tdarr | haveagitgat/tdarr | Transcode automation |
| seerr | ghcr.io/seerr-team/seerr | Request management |
| transmission | transmission + PIA VPN sidecar | Download client |
| autobrr | ghcr.io/autobrr/autobrr | Torrent automation |
| threadfin × 2 | custom (registry.mdapi.ch) | IPTV proxy |
| flaresolverr | flaresolverr | Cloudflare bypass |
| sftpgo | drakkan/sftpgo | SFTP/FTP gateway (tv.files.mdapi.ch) |
| rsync | custom (registry.mdapi.ch) | rsync daemon for library transfers |
RWX storage
The media library's RWX volumes are provided by CephFS (the ceph-filesystem storage class, via Rook), which handles concurrent multi-pod access natively. The earlier Longhorn RWX class (harvester-longhorn-2replicas-notmigratable) pinned replicas to fixed nodes to avoid live-migration issues with large RWX volumes; it is no longer used for the media stack.