---
id: w1/m7/t005
title: Private network + stable LB IP (Traefik LoadBalancer)
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m7/t004]
---

## Objective

Enable the Hetzner private network and flip Traefik `service.spec.type` back to `LoadBalancer` for a stable IP that survives node changes (multi-node ready).

## Context

- `deploy/gitops/base/traefik.yaml` (current `ClusterIP` workaround + upgrade note) · `app-cluster.yml` (private network).

## Files

- `deploy/gitops/base/traefik.yaml` · `.github/workflows/app-cluster.yml`

## Acceptance criteria

- [ ] Traefik has a stable Hetzner LB IP on the private network; services remain reachable across a node replacement.

## Out of scope

- DNS/wildcard cert (separate work).
