🌐 Topologia de Rede Completa
graph TB
subgraph INTERNET["☁️ Internet"]
USER["👤 Usuário"]
end
subgraph ORACLE["Oracle VM — 163.176.160.103"]
NGINX["🌐 Nginx\n(TLS + Reverse Proxy)"]
WG_OR["🔒 WireGuard\n10.10.10.1/24"]
CERT["🔐 Let's Encrypt\nTLS Certs"]
DNS["📡 DuckDNS\nbookstack-diego\nrancher-diego"]
end
subgraph TUNNEL["🔗 WireGuard Tunnel (~12ms)"]
WG_LAB["🔒 WireGuard\n10.10.10.2/24"]
end
subgraph LAB["Lab — 192.168.0.50"]
DOCKER["🐳 Docker\nbeautiful_galileo"]
subgraph K3S["K3s Embedded (Rancher)"]
direction TB
subgraph BOOKNS["namespace: bookstack"]
BS["📚 BookStack\n5 pods"]
MDB["🗄️ MariaDB Galera\n3 pods"]
RD["⚡ Redis HA + Sentinel\n3 pods"]
LOKI["📊 Loki"]
end
subgraph RANCHERNS["namespace: cattle-system"]
RANCHER["🐳 Rancher\nv2.12.2"]
end
METAL["⚙️ MetalLB"]
end
IPT["🧱 iptables\nDNAT wg0→172.17.0.2"]
end
subgraph RKE2["RKE2 Cluster (Stacked)"]
W1["worker1\n192.168.0.51\netcd+cp+worker"]
W2["worker2\n192.168.0.52\netcd+cp+worker"]
W3["worker3\n192.168.0.53\netcd+cp+worker"]
W1 <-->|"etcd sync"| W2
W2 <-->|"etcd sync"| W3
W1 <-->|"etcd sync"| W3
end
USER -->|"HTTPS"| DNS
DNS -->|"TLS termination"| NGINX
NGINX --> CERT
NGINX -->|"WireGuard\n10.10.10.1:80"| WG_OR
WG_OR <-->|"tunnel"| WG_LAB
WG_LAB --> IPT
IPT -->|"DNAT\n172.17.0.2:8888"| DOCKER
IPT -->|"DNAT\n172.17.0.2:443"| RANCHER
DOCKER --> BS
DOCKER --> MDB
DOCKER --> RD
BS --> MDB
BS --> RD
DOCKER --> LOKI
RANCHER -->|"gerencia"| K3S
RANCHER -.->|"manages"| W1
RANCHER -.->|"manages"| W2
RANCHER -.->|"manages"| W3
style INTERNET fill:#1a1e2e,stroke:#30363d
style ORACLE fill:#1a2332,stroke:#58a6ff
style TUNNEL fill:#1a2e1a,stroke:#3fb950
style LAB fill:#1a1e2e,stroke:#d29922
style K3S fill:#1a1e2e,stroke:#bc8cff
style BOOKNS fill:#162216,stroke:#3fb950
style RANCHERNS fill:#162216,stroke:#d29922
style RKE2 fill:#1a2332,stroke:#58a6ff
📚 Fluxo de Acesso ao BookStack
sequenceDiagram
autonumber
participant U as 👤 Usuário
participant DNS as 📡 DuckDNS
participant SSL as 🔐 Let's Encrypt
participant NGINX as 🌐 Nginx (Oracle)
participant WG as 🔒 WireGuard
participant IPT as 🧱 iptables (Lab)
participant K3S as 🐳 K3s Port-Forward
participant BS as 📚 BookStack Pod
participant DB as 🗄️ MariaDB Galera
participant RD as ⚡ Redis HA
U->>DNS: HTTPS bookstack-diego.duckdns.org
DNS-->>U: 163.176.160.103
U->>NGINX: TLS handshake
NGINX->>SSL: Verify certificate
SSL-->>NGINX: OK
NGINX->>U: TLS established
U->>NGINX: GET / (HTTP/2)
NGINX->>WG: proxy_pass http://10.10.10.2/
WG->>IPT: WireGuard tunnel (10.10.10.1→10.10.10.2)
IPT->>K3S: DNAT wg0:80 → 172.17.0.2:8888
K3S->>BS: kubectl port-forward → :80
BS->>RD: Check session cache
RD-->>BS: Session data
BS->>DB: Query content
DB-->>BS: Result
BS-->>U: HTML Response (200 OK)
Note over U,BS: Portas: 80/443 → WireGuard:80 → DNAT:8888 → port-forward:80
🔄 Fluxo de Dados - BookStack
graph LR
subgraph EXTERNAL["Acesso Externo"]
BROWSER["🌐 Browser"]
end
subgraph EDGE["Oracle VM (Edge)"]
NGINX2["Nginx\nTLS termination"]
end
subgraph VPN["WireGuard Tunnel"]
TUNNEL2["10.10.10.1 ↔ 10.10.10.2"]
end
subgraph K3S2["K3s (Docker .50)"]
PF["port-forward\n8888→80"]
BS2["BookStack\n5 replicas"]
MDB2["MariaDB Galera\n3 nodes"]
RD2["Redis HA\n3 nodes + Sentinel"]
end
BROWSER -->|"HTTPS"| NGINX2
NGINX2 -->|"HTTP"| TUNNEL2
TUNNEL2 -->|"DNAT"| PF
PF --> BS2
BS2 -->|"write"| MDB2
BS2 -->|"cache"| RD2
MDB2 <-->|"Galera sync"| MDB2
RD2 <-->|"Replication"| RD2
style EXTERNAL fill:#1a1e2e,stroke:#30363d
style EDGE fill:#1a2332,stroke:#58a6ff
style VPN fill:#1a2e1a,stroke:#3fb950
style K3S2 fill:#1a1e2e,stroke:#bc8cff
🐳 Fluxo de Acesso ao Rancher
sequenceDiagram
autonumber
participant U as 👤 Usuário
participant DNS as 📡 DuckDNS
participant NGINX as 🌐 Nginx (Oracle)
participant WG as 🔒 WireGuard
participant IPT as 🧱 iptables (Lab)
participant RANCHER as 🐳 Rancher (Docker)
participant K3S as ⚙️ K3s Embedded
U->>DNS: HTTPS rancher-diego.duckdns.org
DNS-->>U: 163.176.160.103
U->>NGINX: TLS handshake
NGINX->>U: TLS established
U->>NGINX: GET /
NGINX->>WG: proxy_pass https://10.10.10.2:9443/
Note over NGINX: proxy_ssl_verify off
WG->>IPT: WireGuard tunnel
IPT->>RANCHER: DNAT wg0:9443 → 172.17.0.2:443
RANCHER->>K3S: API calls (embedded K3s)
K3S-->>RANCHER: Cluster state
RANCHER-->>U: Dashboard (200 OK)
Note over U,RANCHER: Portas: 443 → WireGuard:9443 → DNAT:443 → Rancher container
📊 Rancher gerencia dois clusters
graph TB
subgraph RANCHER3["🐳 Rancher Management (Docker .50)"]
RUI["🌐 Rancher UI\nrancher-diego.duckdns.org"]
API["📡 Rancher API"]
FLEET["🔀 Fleet Agent"]
end
subgraph K3S3["Cluster K3s (Embedded)"]
K3SPODS["BookStack, Redis,\nMariaDB, Loki,\nMetalLB, etc."]
end
subgraph RKE23["Cluster RKE2 (Workers)"]
W13["worker1\n.51"]
W23["worker2\n.52"]
W33["worker3\n.53"]
end
RUI --> API
API --> FLEET
FLEET -->|"manages"| K3S3
FLEET -.->|"import\ncluster"| W13
FLEET -.->|"import\ncluster"| W23
FLEET -.->|"import\ncluster"| W33
style RANCHER3 fill:#1a2332,stroke:#d29922
style K3S3 fill:#162216,stroke:#3fb950
style RKE23 fill:#1a2332,stroke:#58a6ff
☸️ K3s Cluster (Embuthido no Docker .50)
graph TB
subgraph HOST["🖥️ Lab .50 (192.168.0.50)"]
DOCKER4["🐳 Docker\nbeautiful_galileo\nrancher/rancher:v2.12.2"]
end
subgraph K3S4["⚙️ K3s Embedded"]
subgraph NS_BOOK["📚 namespace: bookstack"]
BS4["BookStack Deployment\n5 pods (3/3 ready)\nClusterIP: 10.43.4.228\nLB: 192.168.0.70"]
MDB4["MariaDB Galera\n3 pods (1/1 ready)\nClusterIP: 10.43.106.40\nHeadless: 3306/4567/4568"]
RD4["Redis HA + Sentinel\n3 pods (2/2 ready)\nClusterIP: 10.43.229.9\nHeadless: 6379/26379"]
LOKI4["Loki\nClusterIP: 3100"]
PROM4["Promtail\nDaemonSet"]
PMA4["phpMyAdmin"]
end
subgraph NS_RANCHER["🐳 namespace: cattle-system"]
RANCHER4["Rancher v2.12.2\nWebhook + API Extension"]
end
subgraph NS_FLEET["🔀 namespace: cattle-fleet-system"]
FLEET4["Fleet Controller\nGitJob + HelmOps"]
end
subgraph NS_INFRA["⚙️ namespace: kube-system"]
DNS4["CoreDNS\n10.43.0.10:53"]
LP4["Local Path\nProvisioner"]
end
subgraph NS_ML["🔩 namespace: metallb-system"]
ML4["MetalLB\nController + Speaker"]
end
end
subgraph PV4["💾 Persistent Volumes"]
PVC_MDB["MariaDB PVC\n3x 5Gi\nlocal-path"]
PVC_RD["Redis PVC\n3x 1Gi\nlocal-path"]
PVC_BS["BookStack PVC\n5Gi RWX\nlocal-path"]
end
DOCKER4 --> K3S4
BS4 --> MDB4
BS4 --> RD4
MDB4 --> PVC_MDB
RD4 --> PVC_RD
BS4 --> PVC_BS
style HOST fill:#1a1e2e,stroke:#d29922
style K3S4 fill:#162216,stroke:#bc8cff
style NS_BOOK fill:#0d1a0d,stroke:#3fb950
style NS_RANCHER fill:#1a1a0d,stroke:#d29922
style NS_FLEET fill:#1a1a0d,stroke:#d29922
style NS_INFRA fill:#0d0d1a,stroke:#58a6ff
style NS_ML fill:#0d0d1a,stroke:#58a6ff
style PV4 fill:#1a0d1a,stroke:#bc8cff
🔧 RKE2 Cluster (Stacked - .51, .52, .53)
graph TB
subgraph RKE25["⚙️ RKE2 v1.33.13 Cluster"]
subgraph W15["worker1 — 192.168.0.51"]
ETCD1["etcd"]
CP1["Control Plane\nAPI Server\nScheduler\nController Manager"]
WK1["Worker\nkubelet\nkube-proxy"]
end
subgraph W25["worker2 — 192.168.0.52"]
ETCD2["etcd"]
CP2["Control Plane\nAPI Server\nScheduler\nController Manager"]
WK2["Worker\nkubelet\nkube-proxy"]
end
subgraph W35["worker3 — 192.168.0.53"]
ETCD3["etcd"]
CP3["Control Plane\nAPI Server\nScheduler\nController Manager"]
WK3["Worker\nkubelet\nkube-proxy"]
end
end
ETCD1 <-->|"Raft\nconsensus"| ETCD2
ETCD2 <-->|"Raft\nconsensus"| ETCD3
ETCD1 <-->|"Raft\nconsensus"| ETCD3
CP1 <-->|"API sync"| CP2
CP2 <-->|"API sync"| CP3
CP1 <-->|"API sync"| CP3
WK1 -.->|"register"| CP1
WK2 -.->|"register"| CP2
WK3 -.->|"register"| CP3
style RKE25 fill:#1a2332,stroke:#58a6ff
style W15 fill:#0d1a2e,stroke:#3fb950
style W25 fill:#0d1a2e,stroke:#3fb950
style W35 fill:#0d1a2e,stroke:#3fb950
📋 Configuração RKE2
| Propriedade | Valor |
|---|
| Versão | v1.33.13+rke2r1 |
| Topology | Stacked (etcd+CP+worker em cada node) |
| etcd | Embutido (3 membros, Raft consensus) |
| Container Runtime | containerd://2.2.5-k3s1 |
| CNI | Calico (cilium_host detected) |
| Kubeconfig | /etc/rancher/rke2/rke2.yaml |
| kubectl | /var/lib/rancher/rke2/bin/kubectl |
| Service CIDR | 10.43.0.0/16 (cluster) |
| Pod CIDR | 10.42.0.0/16 (cluster) |
| Acesso | sudo kubectl --kubeconfig /etc/rancher/rke2/rke2.yaml |