mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-19 23:46:28 +03:00
Magnus HedemarkandGitHub
c7c4d3b74f
Engineering: backend-engineering, frontend-engineering, data-engineering, ml-engineering, platform-engineering, qa-methodology Executive: go-to-market, legal-strategy, operational-design, org-design, product-strategy ml-engineering: added missing training-infrastructure.md reference qa-methodology: added test-data-management, performance-testing, security-testing references All frontmatter converted to agent-skills convention. Source: https://github.com/magnus919/hermes-profiles
54 lines
4.2 KiB
Markdown
54 lines
4.2 KiB
Markdown
# Service Networking — Reference
|
|
|
|
## Reverse Proxy
|
|
|
|
### Traefik
|
|
|
|
- **Core model:** Dynamic routing — auto-discovers services via providers (Docker, Kubernetes, Consul, file), hot-reloads config
|
|
- **Key concepts:** Routers (HTTP/HTTPS/TCP/UDP), middlewares (rate limiting, auth, headers, retries, circuit breakers, compression, redirect), services (load balancing), entrypoints (ports), TLS automation via Let's Encrypt
|
|
- **Providers:** Docker provider (labels on containers), Kubernetes provider (IngressRoute CRD, or standard Ingress), file provider (static/dynamic YAML/TOML), Consul, etcd, Redis, ZooKeeper
|
|
- **Middleware chains:** Order matters — rate limit → auth → headers → retry; custom middleware via plugins (WebAssembly, Go), pass through ForwardAuth to external services
|
|
- **Observability:** Metrics (Prometheus, OpenTelemetry, Datadog, InfluxDB), access logs (in JSON), tracing (Jaeger, Zipkin, OpenTelemetry), dashboard UI
|
|
|
|
### nginx
|
|
|
|
- **Core model:** Static config (reload on change), high-concurrency event loop, reverse proxy, load balancer, TLS termination, caching
|
|
- **Key patterns:** `upstream` blocks for load balancing, `proxy_pass` for forwarding, `location` blocks for path routing, `map` for conditional logic, `limit_req`/`limit_conn` for rate limiting
|
|
- **Config management:** Templating (Jinja, envsubst), include directories for modular config, nginx -t for validation, reload via SIGHUP
|
|
|
|
### Caddy
|
|
|
|
- **Core model:** Automatic HTTPS (ZeroSSL/Lets Encrypt by default), simple `Caddyfile` syntax, JSON API for dynamic config
|
|
- **Key features:** HTTP/3 (QUIC) by default, on-demand TLS, HTTP->HTTPS redirects, reverse proxy with health checking, match blocks, matchers
|
|
- **Best for:** Simple deployments where Traefik's dynamic service discovery is overkill; excellent developer experience
|
|
|
|
## Mesh Networking
|
|
|
|
### Tailscale / Headscale
|
|
|
|
- **Core model:** WireGuard-based overlay network — nodes get unique Tailscale IP, communicate directly (NAT traversal), ACLs control access
|
|
- **ACL policy (huJSON):** `acls` (src/dest/proto/port), `groups` (user groupings), `tags` (device identity), `hosts` (alias mapping), `derpMap` relay configuration, `ssh` for Tailscale SSH
|
|
- **Key features:** Subnet routing (advertise routes), exit nodes (traffic to internet), ACL deny rules (refuse trailing), Funnel (allow internet traffic to local), Serve (host services on tailnet), MagicDNS
|
|
- **Headscale specifics:** Self-hosted control server, open-source, PostgreSQL/ SQLite backend, OIDC integration, CLI (`headscale users`, `headscale nodes`, `headscale routes`), DERP relay server setup
|
|
- **Lifecycle:** Node registration (pre-auth keys, web auth), expiry/node cleanup, key rotation (node keys, auth keys), multi-tailnet federation (Headscale sharing)
|
|
|
|
### WireGuard
|
|
|
|
- **Core model:** Layer 3 secure tunnel — single UDP port, kernel-level (fast), peer-to-peer, pre-shared or public-key auth
|
|
- **Config basics:** Interface (private key, address, listen port, DNS), Peer (public key, allowed IPs, endpoint, persistent keepalive)
|
|
- **Topology patterns:** Point-to-point (simple site-to-site), hub-and-spoke (central node routes), mesh (direct peer-to-peer), routed subnet (wg-quick tables, policy routing)
|
|
|
|
## Service Mesh
|
|
|
|
### Istio
|
|
|
|
- **Core model:** Sidecar proxy (Envoy) injected into pods — intercepts all traffic, applies mesh policies
|
|
- **Key concepts:** VirtualService (traffic routing, retries, timeouts, mirroring), DestinationRule (load balancing, connection pool, mTLS, circuit breaker), Gateway (ingress/egress), ServiceEntry (external services), PeerAuthentication (mTLS mode), AuthorizationPolicy (RBAC for services)
|
|
- **Observability:** Telemetry via Envoy — HTTP/gRPC metrics (Prometheus), distributed tracing (Jaeger/Zipkin/OpenTelemetry), access logs, Kiali for topology visualization
|
|
|
|
### Cilium
|
|
|
|
- **Core model:** eBPF-based — no sidecar injection, kernel-level networking and security
|
|
- **Key capabilities:** NetworkPolicy (identity-based, FQDN-based), Service Mesh (L7 policies, ingress/gateway API, L7 load balancing), Encryption (WireGuard in-kernel), Observability (Hubble: flow logs, metrics, UI, OpenTelemetry), ClusterMesh (multi-cluster networking)
|
|
- **Advantage over Istio:** No sidecar overhead, native eBPF performance, integrated with Tetragon for runtime security
|