# Mehrschichtige Inventur — K3s / DMZ / Proxy

Stand: 2026-06-08 UTC. Quelle: read-only SSH, kubectl, Docker/Nginx Proxy Manager DB. Keine Secret-Inhalte ausgewertet oder ausgegeben.

## 1. Edge / Netzwerk-Ebene
- OPNsense Router/Firewall: `192.168.20.1`
- Reverse Proxy: Raspberry Pi `192.168.20.20` (`raspi`)
- K3s DMZ Cluster: `192.168.20.40`, `192.168.20.45`
- Verkehrsfluss: Internet/Clients → OPNsense → Nginx Proxy Manager → K3s/Traefik/Services

## 2. Host-/System-Ebene
- `192.168.20.20` raspi: Debian 12, Docker, Nginx Proxy Manager + Portainer
- `192.168.20.40` mbrkanov-mini-it13: Ubuntu 22.04.5, control-plane/master, K3s `v1.28.4+k3s2`
- `192.168.20.45` mini-it13-02: Ubuntu 22.04.5, worker, K3s `v1.29.3+k3s1`
- Auffällig: K3s-/containerd-Versionen zwischen Nodes sind nicht einheitlich.

## 3. Container-/Cluster-Ebene
- Kubernetes: K3s, 2 Nodes, beide `Ready`
- StorageClasses: `local-path` und `longhorn` sind beide als Default markiert → prüfen, ob bewusst so gewollt.
- Longhorn ist installiert (`longhorn-system`).
- Traefik/ServiceLB ist aktiv (`kube-system`, svclb-Pods).

## 4. Namespace-/Mandanten-Ebene
| Namespace | Zuordnung | Objekte grob |
|---|---|---:|
| `bitwarden` | Cattaro/infra vermutlich | 0 |
| `dashy` | Plattform/legacy/shared | 3 |
| `default` | Plattform/legacy/shared | 11 |
| `hf-espocrm` | Pidoka/heckenfels.com vermutlich | 7 |
| `hf-matomo` | Pidoka/heckenfels.com vermutlich | 7 |
| `hf-mautic` | Pidoka/heckenfels.com vermutlich | 14 |
| `hf-n8n` | Pidoka/heckenfels.com vermutlich | 4 |
| `hf-suitecrm` | Pidoka/heckenfels.com vermutlich | 8 |
| `homarr` | Plattform/legacy/shared | 7 |
| `infra-argocd` | Cattaro/infra vermutlich | 13 |
| `keycloak` | Plattform/legacy/shared | 7 |
| `kube-node-lease` | Plattform/legacy/shared | 0 |
| `kube-public` | Plattform/legacy/shared | 0 |
| `kube-system` | Plattform/legacy/shared | 15 |
| `kubernetes-dashboard` | Plattform/legacy/shared | 4 |
| `longhorn-system` | Plattform/legacy/shared | 16 |
| `portainer` | Plattform/legacy/shared | 6 |
| `zammad` | Pidoka/heckenfels.com vermutlich | 17 |

## 5. Proxy-/Domain-Ebene
| Domain | Ziel | Firma/Scope | Hinweise |
|---|---|---|---|
| `nextcloud.cattaro.eu` | `http://192.168.20.30:80` | Cattaro | force SSL, websocket, block exploits |
| `service.heckenfels.com` | `http://192.168.20.40:8080` | Pidoka | force SSL, websocket, http2 |
| `office.cattaro.eu` | `http://192.168.188.40:80` | Cattaro | - |
| `meshcentral.cattaro.eu` | `http://192.168.188.42:2087` | Cattaro | - |
| `dashboard.heckenfels.com` | `http://192.168.20.40:30718` | Pidoka | - |
| `bitwarden.cattaro.eu` | `http://192.168.20.20:8080` | Cattaro | - |
| `matomo.heckenfels.com` | `http://192.168.20.40:80` | Pidoka | force SSL, websocket, http2 |
| `argocd.cattaro.eu` | `http://192.168.20.40:31797` | Cattaro | http2 |
| `mautic.heckenfels.com` | `http://192.168.20.40:31797` | Pidoka | websocket, http2, block exploits |
| `crm.heckenfels.com` | `http://192.168.20.40:31797` | Pidoka | websocket |
| `suitecrm.heckenfels.com` | `http://192.168.20.40:31797` | Pidoka | websocket |
| `n8n.heckenfels.com` | `https://192.168.20.40:443` | Pidoka | force SSL, http2, block exploits |

## 6. Kubernetes Services / Ingress-Ebene
- Services gefunden: 55
- Ingress-Objekte gefunden: 6
| Namespace | Ingress | Hosts |
|---|---|---|
| `hf-espocrm` | `espocrm` | `crm.heckenfels.com` |
| `hf-matomo` | `matomo-ingress` | `matomo.heckenfels.com` |
| `hf-mautic` | `mautic-ingress` | `mautic.heckenfels.com` |
| `hf-n8n` | `n8n` | `n8n.heckenfels.com` |
| `hf-suitecrm` | `suitecrm-suitecrm` | `suitecrm.heckenfels.com` |
| `infra-argocd` | `argocd-server` | `argocd.cattaro.eu` |

## 7. Workload-/Anwendungs-Ebene
| Namespace | Kind | Name | Ready/Schedule |
|---|---|---|---|
| `dashy` | Deployment | `my-dashy` | 1/1 |
| `default` | DaemonSet | `longhorn-iscsi-installation` | 2/2 |
| `default` | DaemonSet | `longhorn-nfs-installation` | 2/2 |
| `default` | StatefulSet | `my-release-keycloak` | 1/1 |
| `default` | StatefulSet | `my-release-postgresql` | 1/1 |
| `hf-espocrm` | Deployment | `espocrm` | 1/1 |
| `hf-espocrm` | StatefulSet | `hf-espocrm-mariadb` | 1/1 |
| `hf-matomo` | Deployment | `matomo` | 1/1 |
| `hf-matomo` | Deployment | `matomo-db` | 1/1 |
| `hf-mautic` | CronJob | `hf-mautic-mautic-campaigns-trigger` | schedule 10,25,40,55 * * * * |
| `hf-mautic` | CronJob | `hf-mautic-mautic-campaigns-update` | schedule 5,20,35,50 * * * * |
| `hf-mautic` | CronJob | `hf-mautic-mautic-segments-update` | schedule */15 * * * * |
| `hf-mautic` | Deployment | `hf-mautic-mautic` | 1/1 |
| `hf-mautic` | StatefulSet | `hf-mautic-mariadb` | 1/1 |
| `hf-mautic` | StatefulSet | `hf-mautic-redis-master` | 1/1 |
| `hf-n8n` | Deployment | `n8n` | 1/1 |
| `hf-suitecrm` | Deployment | `suitecrm-suitecrm` | 0/1 |
| `hf-suitecrm` | StatefulSet | `suitecrm-mariadb` | 0/1 |
| `homarr` | Deployment | `my-homarr` | 1/1 |
| `infra-argocd` | Deployment | `argocd-applicationset-controller` | 1/1 |
| `infra-argocd` | Deployment | `argocd-dex-server` | 1/1 |
| `infra-argocd` | Deployment | `argocd-notifications-controller` | 1/1 |
| `infra-argocd` | Deployment | `argocd-redis` | 1/1 |
| `infra-argocd` | Deployment | `argocd-repo-server` | 1/1 |
| `infra-argocd` | Deployment | `argocd-server` | 1/1 |
| `infra-argocd` | StatefulSet | `argocd-application-controller` | 1/1 |
| `keycloak` | StatefulSet | `keycloak` | 1/1 |
| `keycloak` | StatefulSet | `keycloak-postgresql` | 1/1 |
| `kube-system` | DaemonSet | `svclb-keycloak-99b8ca72` | 0/2 |
| `kube-system` | DaemonSet | `svclb-portainer-agent-e1e17ceb` | 2/2 |
| `kube-system` | DaemonSet | `svclb-portainer-b4d76427` | 2/2 |
| `kube-system` | DaemonSet | `svclb-traefik-fc909760` | 2/2 |
| `kube-system` | DaemonSet | `svclb-zammad-7c5f6f72` | 2/2 |
| `kube-system` | Deployment | `coredns` | 1/1 |
| `kube-system` | Deployment | `local-path-provisioner` | 1/1 |
| `kube-system` | Deployment | `metrics-server` | 1/1 |
| `kube-system` | Deployment | `sealed-secrets-controller` | 1/1 |
| `kube-system` | Deployment | `traefik` | 1/1 |
| `kubernetes-dashboard` | Deployment | `dashboard-metrics-scraper` | 1/1 |
| `kubernetes-dashboard` | Deployment | `kubernetes-dashboard` | 1/1 |
| `longhorn-system` | DaemonSet | `engine-image-ei-5cefaf2b` | 2/2 |
| `longhorn-system` | DaemonSet | `longhorn-csi-plugin` | 2/2 |
| `longhorn-system` | DaemonSet | `longhorn-manager` | 2/2 |
| `longhorn-system` | Deployment | `csi-attacher` | 3/3 |
| `longhorn-system` | Deployment | `csi-provisioner` | 3/3 |
| `longhorn-system` | Deployment | `csi-resizer` | 3/3 |
| `longhorn-system` | Deployment | `csi-snapshotter` | 3/3 |
| `longhorn-system` | Deployment | `longhorn-driver-deployer` | 1/1 |
| `longhorn-system` | Deployment | `longhorn-ui` | 2/2 |
| `portainer` | Deployment | `portainer` | 1/1 |
| `portainer` | Deployment | `portainer-agent` | 1/1 |
| `zammad` | Deployment | `zammad-memcached` | 1/1 |
| `zammad` | StatefulSet | `zammad` | 1/1 |
| `zammad` | StatefulSet | `zammad-elasticsearch-master` | 1/1 |
| `zammad` | StatefulSet | `zammad-postgresql` | 1/1 |
| `zammad` | StatefulSet | `zammad-redis-master` | 1/1 |

## 8. Storage-/Daten-Ebene
- PVCs gefunden: 22
| Namespace | PVC | Status | StorageClass | Size | Access |
|---|---|---|---|---:|---|
| `dashy` | `my-dashy-icons` | Bound | `local-path` | 100Gi | ReadWriteOnce |
| `default` | `data-my-release-postgresql-0` | Bound | `local-path` | 8Gi | ReadWriteOnce |
| `default` | `local-path-pvc` | Bound | `local-path` | 2Gi | ReadWriteOnce |
| `hf-espocrm` | `data-hf-espocrm-mariadb-0` | Bound | `longhorn` | 8Gi | ReadWriteOnce |
| `hf-matomo` | `matomo-db-pvc` | Bound | `longhorn` | 1Gi | ReadWriteOnce |
| `hf-matomo` | `matomo-pvc` | Bound | `longhorn` | 1Gi | ReadWriteOnce |
| `hf-mautic` | `data-hf-mautic-mariadb-0` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
| `hf-mautic` | `redis-data-hf-mautic-redis-master-0` | Bound | `longhorn` | 5Gi | ReadWriteOnce |
| `hf-n8n` | `n8n` | Bound | `longhorn` | 5Gi | ReadWriteOnce |
| `hf-suitecrm` | `data-suitecrm-mariadb-0` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
| `hf-suitecrm` | `suitecrm-suitecrm` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
| `homarr` | `my-homarr-config` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
| `homarr` | `my-homarr-data` | Bound | `local-path` | 100Gi | ReadWriteOnce |
| `homarr` | `my-homarr-data-mb` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
| `homarr` | `my-homarr-data-new` | Bound | `longhorn` | 100Gi | ReadWriteOnce |
| `homarr` | `my-homarr-icons` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
| `keycloak` | `data-keycloak-postgresql-0` | Bound | `local-path` | 8Gi | ReadWriteOnce |
| `portainer` | `portainer` | Bound | `local-path` | 10Gi | ReadWriteOnce |
| `zammad` | `data-zammad-elasticsearch-master-0` | Bound | `local-path` | 8Gi | ReadWriteOnce |
| `zammad` | `data-zammad-postgresql-0` | Bound | `local-path` | 8Gi | ReadWriteOnce |
| `zammad` | `redis-data-zammad-redis-master-0` | Bound | `local-path` | 8Gi | ReadWriteOnce |
| `zammad` | `zammad-var-zammad-0` | Bound | `local-path` | 5Gi | ReadWriteOnce |

## 9. GitOps-/ArgoCD-Ebene
- ArgoCD Applications gefunden: 5
| App | Namespace | Project | Sync | Health | Repo | Path/Chart | Destination |
|---|---|---|---|---|---|---|---|
| `suitecrm` | `infra-argocd` | `default` | Unknown | Progressing | `https://github.com/GitMasterOne/ArgoCD.git` | `charts/suitecrm` | `hf-suitecrm@https://kubernetes.default.svc` |
| `n8n` | `infra-argocd` | `default` | Synced | Healthy | `8gears.container-registry.com` | `library/n8n` | `hf-n8n@https://kubernetes.default.svc` |
| `apps` | `infra-argocd` | `default` | Unknown | Healthy | `https://github.com/GitMasterOne/ArgoCD` | `applications` | `infra-argocd@https://kubernetes.default.svc` |
| `hf-mautic` | `infra-argocd` | `default` | Unknown | Healthy | `https://github.com/GitMasterOne/ArgoCD.git` | `charts/mautic` | `hf-mautic@https://kubernetes.default.svc` |
| `hf-espocrm` | `infra-argocd` | `default` | Unknown | Healthy | `https://github.com/GitMasterOne/ArgoCD.git` | `espocrm` | `hf-espocrm@https://kubernetes.default.svc` |

## 10. Aktuelle Auffälligkeiten
- `hf-suitecrm` enthält mindestens einen `ImagePullBackOff`-Pod.
- `hf-mautic` erzeugt wiederholt fehlgeschlagene CronJobs/BackoffLimitExceeded.
- MariaDB-Probes/BackOff Hinweise bei `hf-suitecrm` und `hf-espocrm`.
- `svclb-keycloak` Pending wegen Port-Konflikt/HostPort-Belegung möglich.
- Viele Neustarts liegen ca. 36 Tage zurück; Ursache vermutlich Node-/Cluster-Neustart oder Wartungsereignis, separat prüfen.

## 11. Empfohlene Zielarchitektur der Inventur
- Ebene 1: Netzwerk/Firewall/DNS/NAT
- Ebene 2: Reverse Proxy / TLS / Domains
- Ebene 3: Host-/Node-Betriebssystem
- Ebene 4: K3s Plattformdienste: Traefik, CoreDNS, ServiceLB, Longhorn
- Ebene 5: Kubernetes Namespaces und Mandanten
- Ebene 6: GitOps/ArgoCD Apps und Repos
- Ebene 7: Anwendungen, Datenbanken, Jobs, PVCs
- Ebene 8: Betriebszustand: Health, Events, Logs, Backups, Updates