Network Topology¶
Overview¶
Network architecture connecting reference deployments and demonstrating WireGuard-based secure monitoring.
Network Diagram¶
┌─────────────────────────────────────────────────────────────────┐
│ Internet │
└────────────┬────────────────────────────────────┬────────────────┘
│ │
│ │
┌───────▼────────┐ ┌───────▼────────┐
│ prod.example.com│ │ Home Network │
│ (Linode VPS) │ │ 192.168.x.x │
│ │ └────────┬───────┘
│ Public Services:│ │
│ • Web (80/443) │ │
│ • Mail (25/587) │ ┌────────▼───────┐
│ • DNS (53) │ │ Nas Server │
│ • Gitea (3000) │ │ S3 Storage │
│ │ │ :8010 │
│ WireGuard Client│◄──────┐ └────────┬───────┘
│ 10.10.0.1 │ │ │
└─────────────────┘ │ │
│ ┌────────▼───────┐
┌──────┴──────┐ │ Proxmox Host │
│ WireGuard │ │ │
│ Tunnel │ │ ┌──────────┐ │
│ (Encrypted) │ │ │monitor11 │ │
└──────┬──────┘ │ │ VM │ │
│ │ │ │ │
┌─────────▼────────┐ │ │ Services:│ │
│ monitor11.example.com│◄─┼──┤ InfluxDB │ │
│ (Proxmox VM) │ │ │ :8086 │ │
│ │ │ │ Loki │ │
│ WireGuard Server │ │ │ :3100 │ │
│ 10.10.0.11 │ │ └──────────┘ │
│ │ └─────────────────┘
│ Receives: │
│ • Logs from prod │
│ • Metrics from all │
└────────────────────┘
Network Segments¶
Public Internet¶
Hosts: - prod.example.com (Linode VPS)
Exposed Services: - HTTP/HTTPS (80/443) - Web hosting - SMTP (25/587/465) - Mail server - DNS (53) - Bind9 name server - Gitea (3000) - Git repositories
Home Network (192.168.x.x)¶
Hosts: - storage.example.com - NAS with S3-compatible storage - Proxmox host - Hypervisor for VMs - monitor11.example.com - Monitoring VM
Internal Services: - S3 Storage (s3-server:8010) - Proxmox Web UI (192.168.x.x:8006)
WireGuard VPN (10.10.0.0/24)¶
Purpose: Secure tunnel for monitoring traffic
Endpoints: - 10.10.0.11 - monitor11.example.com (server) - 10.10.0.1 - prod.example.com (client)
Port: 51820 (UDP)
Traffic: - Logs: prod.example.com → monitor11:3100 (Loki) - Metrics: prod.example.com → monitor11:8086 (InfluxDB)
Data Flow¶
Metrics Collection¶
prod.example.com
│
├─ Telegraf collects system metrics
│ │
│ └─► WireGuard tunnel (10.10.0.1 → 10.10.0.11)
│ │
│ └─► monitor11:8086 (InfluxDB)
│ │
│ └─► S3 storage (s3-server:8010/influx11)
Log Collection¶
prod.example.com
│
├─ Alloy collects logs:
│ ├─ Apache
│ ├─ Fail2ban
│ ├─ Mail (journald)
│ ├─ Bind9 (journald)
│ └─ WireGuard (journald)
│
└─► WireGuard tunnel (10.10.0.1 → 10.10.0.11)
│
└─► monitor11:3100 (Loki)
│
└─► S3 storage (s3-server:8010/loki11)
Self-Monitoring¶
monitor11.example.com
│
├─ Telegraf collects local metrics
│ │
│ └─► localhost:8086 (InfluxDB)
│
└─ Monitors itself without external dependencies
Security Considerations¶
WireGuard Encryption¶
- All monitoring traffic encrypted via WireGuard
- Public keys only, no shared secrets
- Automatic key rotation possible
Firewall Rules¶
prod.example.com: - Allow outbound WireGuard (UDP 51820) - Block direct inbound to monitoring ports - All monitoring via encrypted tunnel
monitor11.example.com: - Allow inbound WireGuard (UDP 51820) - InfluxDB/Loki only accessible via WireGuard - No public exposure of monitoring services
Network Isolation¶
- Monitoring traffic separated from application traffic
- WireGuard provides network segmentation
- S3 storage on private network only
Bandwidth Considerations¶
Typical Traffic¶
Per hour from prod.example.com: - Logs: ~50-100 MB (depending on activity) - Metrics: ~5-10 MB
Daily: - Logs: ~1-2 GB - Metrics: ~100-200 MB
WireGuard Overhead¶
- Minimal overhead (~50 bytes per packet)
- Compression available if needed
- Persistent keepalive: 25 seconds
Future Expansion¶
Adding New Collectors¶
New Host
│
├─ Install Telegraf + Alloy
│
├─ Configure WireGuard client
│ ├─ Generate keys
│ ├─ Add to monitor11 allowed peers
│ └─ Assign IP in 10.10.0.0/24
│
└─ Point collectors to monitor11wg endpoints
Additional Monitoring Servers¶
Multiple monitor servers possible: - Add routes in WireGuard config - Load balance via DNS or Alloy config - Replicate S3 buckets if needed
Network Testing¶
Test WireGuard Connectivity¶
From prod.example:
Test Service Reachability¶
From prod.example.com:
Test S3 Storage¶
From monitor11:
References¶
- WireGuard config:
/etc/wireguard/wg0.conf - Alloy endpoint config:
roles/alloy/templates/config.alloy.j2 - Telegraf output config:
roles/telegraf/templates/telegraf.conf.j2 - CLAUDE.md: Reference Machines section