Edge on Kubernetes

Edge-only mode (TOWONEL_EDGE_ENABLED=true, TOWONEL_HUB_ENABLED=false). DaemonSet on hostNetwork so every node binds the public ports directly. The edge sits behind an L4 ingress (Envoy Gateway here) that adds PROXY v2.

HelmRelease

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: towonel-edge
  namespace: towonel
spec:
  chartRef:
    kind: OCIRepository
    name: towonel-edge
  interval: 30m
  values:
    defaultPodOptions:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      terminationGracePeriodSeconds: 30
      tolerations:
        - operator: Exists
    controllers:
      towonel-edge:
        type: daemonset
        annotations:
          reloader.stakater.com/auto: "true"
        containers:
          app:
            image:
              repository: codeberg.org/towonel/towonel-node
              tag: 0.1.1
            env:
              TOWONEL_HUB_ENABLED: "false"
              TOWONEL_EDGE_ENABLED: "true"
              TOWONEL_EDGE_LISTEN_ADDR: 0.0.0.0:8444
              TOWONEL_EDGE_HEALTH_LISTEN_ADDR: 0.0.0.0:9090
              TOWONEL_EDGE_HUB_LINK_ADDR: towonel-hub.towonel.svc.cluster.local:51444
              TOWONEL_EDGE_IROH_PORT: "51820"
              TOWONEL_EDGE_ADVERTISED_ADDRESSES: edge-eu.example.eu:8444
              TOWONEL_EDGE_PROXY_PROTOCOL: "true"
              TOWONEL_EDGE_LISTEN_WORKERS: "4"
              TOWONEL_DATA_DIR: /data
            envFrom:
              - secretRef: { name: towonel-edge-secret }
            probes:
              startup:
                enabled: true
                custom: true
                spec:
                  httpGet: { path: /health, port: 9090 }
                  periodSeconds: 5
                  failureThreshold: 60
              liveness:
                enabled: true
                custom: true
                spec:
                  httpGet: { path: /health, port: 9090 }
              readiness:
                enabled: true
                custom: true
                spec:
                  httpGet: { path: /health, port: 9090 }
            resources:
              requests: { cpu: 500m, memory: 256Mi }
              limits:   { memory: 2Gi }
    persistence:
      data:
        type: emptyDir
        globalMounts: [{ path: /data }]

Edges are stateless — emptyDir is enough. The hub-link reconnects on restart and the route table replays from the hub.

Secret

The edge only needs the hub-link PSK:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: towonel-edge
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword
  target: { name: towonel-edge-secret }
  data:
    - secretKey: TOWONEL_EDGE_HUB_LINK_PSK
      remoteRef: { key: towonel-hub, property: HUB_LINK_PSK }

Why hostNetwork + DaemonSet

• :443/:8444 need a stable public IP per node; hostNetwork gives it without a LoadBalancer.
• The iroh QUIC UDP socket on :51820 needs the host’s UDP namespace.
• One pod per node — LISTEN_WORKERS=4 shares the accept socket via SO_REUSEPORT for throughput.

L4 ingress

The edge listens on :8444 and requires PROXY v2. Front it with Envoy / Traefik / HAProxy on :443 — see Reverse proxy in front.