flowchart TB
  %% WAN
  Internet(("Internet\n1 Gbps full duplex"))
  Router["GL.iNet GL-MT6000\nWireGuard + AdGuard Home"]
  Switch["TP-Link TL-SG105S-M2\n2.5G switch"]

  Internet -->|1 Gbps| Router
  Router -->|2.5 Gbps| Switch

  %% Hosts
  MiniPC["Mini PC\nmicrok8s node\n1 Gbps"]
  FullPC["Server + GPU\nmicrok8s node\n2.5 Gbps"]
  TrueNAS["TrueNAS NAS\n2x2 mirror\n~32 TiB usable"]

  Router -->|1 Gbps| MiniPC
  Switch -->|2.5 Gbps| FullPC
  Switch -->|2.5 Gbps| TrueNAS

  %% TrueNAS services
  subgraph "TrueNAS services"
    MinIO["MinIO S3"]
    Shares["SMB / NFS shares"]
  end

  TrueNAS --> MinIO
  TrueNAS --> Shares

  %% microk8s clusters
  subgraph "Server microk8s"
    FullK8s["MoneyMachine / OpenWebUI / MM\nIngress + CF tunnels"]
  end

  subgraph "Mini PC microk8s"
    MiniK8s["Infra / monitoring\nCF tunnels"]
  end

  FullPC --> FullK8s
  MiniPC --> MiniK8s

  %% External access
  subgraph "External access"
    CF["Cloudflare tunnels / Zero Trust"]
    WGClients["WireGuard clients\nlaptops, phone, etc"]
  end

  FullK8s --> CF
  MiniK8s --> CF
  CF --> Internet
  Router -->|WireGuard| WGClients
flowchart TB
  subgraph "TrueNAS"
    TN[TrueNAS 32 TiB]
    TN --> MinIO[(MinIO S3)]
    TN --> SMB[SMB shares]
    TN --> NFS[NFS exports]
  end

  subgraph "Server microk8s"
    NSmm[namespace: neutron-mm]
    NSmedia[namespace: neutron-media]

    Selastic[Elasticsearch]
    Skibana[Kibana]
    Semby[Emby]
    Snextcloud[Nextcloud]
  end

  subgraph "Mini PC microk8s"
    NSinfra[namespace: neutron-infra]
    Scloudflared[cloudflared tunnels]
    Smonitoring[monitoring / observability]
  end

  NSmm --> Selastic
  NSmm --> Skibana
  NSmedia --> Semby
  NSmedia --> Snextcloud

  NSinfra --> Scloudflared
  NSinfra --> Smonitoring