MoolMeow Backend Network Architecture: A Comprehensive Guide! 🚀

Hello fellow developers! 😊 Today I’m excited to share how I connected my on-premises Kubernetes cluster to the internet for the MoolMeow project. If you’re running servers from home, this will be super helpful! 🍯

🌐 Overall Network Flow

Let’s start with the big picture! The MoolMeow network is structured in multiple layers:

Client 🖥️
   ↓
Cloudflare ☁️ (DNS + HTTPS/TLS termination)
   ↓
MikroTik Router 🌉 (Port forwarding + NAT + Firewall)
   ↓
MetalLB 🔄 (Kubernetes LoadBalancer)
   ↓
Ingress Controller 🚦 (nginx ingress)
   ↓
Kubernetes Services 🔹 (ClusterIP)
   ↓
Pods 📦 (Application backend)

Now, let’s explore each layer in detail! 🔍

☁️ Layer 1: Cloudflare

Role: Global DNS and first line of HTTPS security

• DNS Configuration

  • *.moolmeow.local → Your home IP address
  • Benefit: DNS updates automatically if your home IP changes

• Security Benefits

  • Free SSL/TLS certificates (Let’s Encrypt)
  • DDoS protection
  • “Full (strict)” mode for end-to-end encryption

🌉 Layer 2: MikroTik Router

Role: Securely forwarding external traffic to Kubernetes

• Port Forwarding Configuration

  • Forward external ports 80/443 to Kubernetes LoadBalancer IP
  • Example: External Port 80 → 10.98.63.xx:80

• Firewall Settings

  • Strict rules allowing only necessary ports
  • Optional country-based IP blocking (block access from specific countries)

• NAT Configuration

  • src-nat setup to allow internal Kubernetes nodes to communicate externally
  • Protects internal IP address scheme (using private IPs)

🔄 Layer 3: MetalLB

Role: Implementing LoadBalancer in bare-metal environments (without cloud!)

• Setup Method

  • IP address pool configuration: Specify 10.98.63.xx/xx range
  • Enable L2 advertisement mode

• How It Works

  • Assigns IPs when Kubernetes services request LoadBalancer type
  • Responds to ARP requests, instructing local network to route traffic to that IP

• Real Configuration Example

  apiVersion: metallb.io/v1beta1
  kind: IPAddressPool
  metadata:
    name: first-pool
    namespace: metallb-system
  spec:
    addresses:
    - 10.98.63.50-10.98.63.70  # IP range to use
  

🚦 Layer 4: NGINX Ingress Controller

Role: Routing traffic to various services (by domain, by path)

• Installation Method

  • Easy installation with Helm chart

  helm install ingress-nginx ingress-nginx/ingress-nginx \
    --namespace ingress-nginx \
    --create-namespace
  

• Key Features

  • Host-based routing (different subdomain for each service)
  • Path-based routing (distribution within same domain based on URL path)
  • TLS certificate management (if needed)
  • Advanced features like rate limiting, redirections, etc.

• Real Ingress Example

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: minio-console
    namespace: minio
  spec:
    ingressClassName: nginx
    rules:
    - host: minio.moolmeow.local
      http:
        paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: minio-console
              port:
                number: 9001
  

🔹 Layer 5: Kubernetes Services

Role: Providing stable endpoints for pod sets

• Main Services

  • ArgoCD server
  • Jenkins
  • MinIO console
  • Other backend services

• Configuration Approach

  • Mostly using ClusterIP type (for internal communication)
  • Targeting appropriate pods with Selector
  • Exposing necessary ports

📦 Layer 6: Application Pods

Role: Running actual applications

• Components

  • MoolMeow Backend API server
  • Authentication service
  • Database
  • Cache server
  • Media storage

• Storage Connection

  • Data persistence with NFS-based PV/PVC
  • Using MinIO object storage

💡 Useful Tips

Testing in Local Development Environment

• Add the following to your /etc/hosts file

  10.98.63.xx jenkins.moolmeow.local10.98.63.xx argocd.moolmeow.local10.98.63.xx minio.moolmeow.local
  

Enhancing Security

• Utilize Cloudflare’s free WAF (Web Application Firewall)
• Block unnecessary ports on MikroTik
• Apply Kubernetes network policies

Setting Up Monitoring

• Monitor network traffic with Prometheus + Grafana
• Configure alerts to detect abnormal traffic

🎯 Benefits of MoolMeow Network Architecture

1. Cost Efficiency – Using LoadBalancer without cloud services
2. Security – Multiple layers of security measures
3. Scalability – Easy expansion as traffic increases
4. Flexibility – Hosting multiple services with a single IP

📝 Conclusion

Running a Kubernetes cluster at home and exposing services externally isn’t easy, but with this layered network configuration, you can operate services reliably and securely. I hope that the configuration we learned through the MoolMeow project helps with your home server operations too! 🙌

If you have any questions or want to know more details, please leave a comment! I’d be happy to share more technical specifics. 💌