feat(k8s): reserve a VIP block and narrow the tailscale routes (#305)

Reserve 192.168.5.192/27 as a dedicated kube-vip block, outside the router's DHCP pool (.2-.99): one /29 per cluster, k3s-test-1 gets .192/29 with the API VIP at .193.

Advertise only youko itself (.183/32) and that block over Tailscale, instead of the whole /24. The /24 route shadowed hosts that are already reachable directly, e.g. idols-ai at 192.168.5.100.

Deploy prerequisites (not in this repo): approve the new Tailscale routes; point kube-vip at the new VIP; move the *.writefor.fun wildcard from .101 to .183 and update scripts/darwin_set_proxy.py, since .101 is no longer advertised.

hosts/12kingdoms-youko/vpn.nix

@@ -1,4 +1,11 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  myvars,
+  ...
+}:
+let
+  inherit (myvars.networking) hostsAddr k8sVip;
+in
 {
   environment.systemPackages = [ pkgs.tailscale ];
 
@@ -11,8 +18,10 @@
 
     useRoutingFeatures = "server";
     extraSetFlags = [
-      # advertise homelab subnet via tailscale
-      "--advertise-routes=192.168.5.0/24"
+      # Advertise only youko itself and the k8s VIP block, not the whole /24:
+      # a /24 route would shadow hosts that are already reachable directly
+      # (e.g. idols-ai at 192.168.5.100).
+      "--advertise-routes=${hostsAddr.youko.ipv4}/32,${k8sVip.cidr}"
       "--accept-routes=false"
     ];
   };

vars/networking.nix

@@ -18,6 +18,23 @@ rec {
   ];
   prefixLength = 24;
 
+  # Dedicated VIP block for the k3s clusters, outside the router's DHCP pool
+  # (.2-.99). One /29 per cluster, handed to kube-vip: the first usable address
+  # is the control-plane API VIP, the rest are LoadBalancer service VIPs.
+  k8sVip = {
+    cidr = "192.168.5.192/27";
+    clusters = {
+      k3s-test-1 = {
+        cidr = "192.168.5.192/29";
+        apiVip = "192.168.5.193";
+      };
+      # Reserved for future clusters:
+      #   .200/29  apiVip .201
+      #   .208/29  apiVip .209
+      #   .216/29  apiVip .217
+    };
+  };
+
   hostsAddr = {
     # ============================================
     # Homelab's Physical Machines (VM hosts)