From cf2fe4435c1ca04a40db734bf7d5c1f6f7457b22 Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 28 Aug 2026 11:56:50 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20topology=20diagram=20as-it-stands=20?= =?UTF-8?q?=E2=80=94=20two-tier=20chain=20Caddy-TLS,=20Anubis=20verify,=20?= =?UTF-8?q?internal=20listener=208016?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the pre-Anubis direct-routing diagram with the live chain: Caddy TLS -> Anubis :8923 verify -> accepted traffic back to Caddy's internal listener :8016, where per-vhost routing resumes and Authentik's embedded outpost gates wrapped apps via forward_auth. Guarded set (homepage, search, hermes, prometheus, romm, files) and the exempt-by-construction set (auth, plex, gitea git paths, grafana) are listed explicitly. Access Policy bullet updated: basic auth was replaced by the challenge-then-forward_auth layering. --- .../Architecture/Network Architecture.md | 68 +++++++++++++------ 1 file changed, 47 insertions(+), 21 deletions(-) diff --git a/serverAppConfigs-docs/Architecture/Network Architecture.md b/serverAppConfigs-docs/Architecture/Network Architecture.md index b48da3a..eb8da25 100644 --- a/serverAppConfigs-docs/Architecture/Network Architecture.md +++ b/serverAppConfigs-docs/Architecture/Network Architecture.md @@ -4,32 +4,58 @@ One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) ## Topology +As of 2026-08-28 the front door is a two-tier chain: Caddy terminates TLS, +Anubis verifies the client (DENY known AI scrapers, CHALLENGE everyone +else), and accepted traffic returns to Caddy's internal listener on `:8016`, +where per-vhost routing resumes. Authentik's outpost then gates the wrapped +apps with `forward_auth`. See [[Anubis]] and [[Authentik]]. + ```mermaid graph TB - subgraph WAN["G36 router 192.168.0.1"] - EXT[Internet] + EXT[Internet] -->|port forwards 80/443| CADDY[Caddy TLS :80 :443 — Dankclaw] + LAN[LAN clients] -->|Pi-hole DNS :53| CADDY + + subgraph Dankclaw[Dankclaw 192.168.0.143] + CADDY -->|unwrapped vhosts route direct| DIRECT{direct routes} + CADDY -->|guarded vhosts| ANUBIS[Anubis verify :8923] + ANUBIS -->|deny AI bots| EXT + ANUBIS -->|challenge solved or bypassed| INT[Caddy internal listener :8016] + INT -->|forward_auth outpost| AUTH[Authentik server :9000 loopback] + INT --> HOME[Homepage file_server] + INT --> SEARCH[SearXNG via Gluetun netns :8081] + INT --> HERMES[Hermes :8090] + INT --> PROM[Prometheus :9090] + DIRECT -->|3000 + ssh 2222| GITEA[Gitea] + DIRECT -->|3005| OWEBUI[OpenWebUI] + DIRECT -->|3002| GRAFANA[Grafana :3000] + DIRECT -->|8083 web UI| PIHOLE[Pi-hole] + AUTH -->|login UI + sessions| AUTHDB[(Authentik Postgres :5432)] + SEARCH -.->|tunnel exit| GLU[Gluetun VPN] + GLU -.-> EXT end - EXT -->|port forwards| C - subgraph Dankclaw[192.168.0.143] - C[Caddy :80 :443] - D[Pi-hole :53] - C -->|comfyui:8188| F[ComfyUI] - C -->|192.168.0.143:3000| G[Gitea quadlet] - C -->|192.168.0.143:8081| SE[SearXNG quadlet] - C -->|192.168.0.143:3005| O[OpenWebUI quadlet] - SE -->|network_mode service| GL[Gluetun VPN] - GL -->|tunnel| EXT + + subgraph Dankserver[Dankserver 192.168.0.235] + ROMM[RomM :8085] + COPY[Copyparty :3923] + CAL[Calibre-Web :8083] + PLEX[Plex :32400] + JEL[Jellyfin :8096] + ARR[*arr stack + qBittorrent] end - subgraph Dankserver[192.168.0.235] - C -->|192.168.0.235:8085| R[RomM] - C -->|192.168.0.235:3923| P[Copyparty] - C -->|192.168.0.235:8083| W[Calibre-Web] - C -->|192.168.0.235:32400| PL[Plex host service] - end - CLIENT[LAN clients] -->|DHCP DNS| D + + INT -->|romm, files guarded paths| ROMM + DIRECT -->|plex plain-HTTP passthrough| PLEX + DIRECT --> CAL + DIRECT --> JEL + DIRECT --> ARR ``` -Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports. +Guarded (through Anubis): homepage, search, hermes, prometheus, romm, files. +Exempt by construction: `auth.` (the IdP login itself), plex (plain HTTP), +gitea (git smart-HTTP clients cannot solve JS challenges — `/info/refs` and +`git-*-pack` pass unchallenged), grafana (own auth). + + Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports. ## Hostnames @@ -51,7 +77,7 @@ SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetu ## Access Policy - The **G36 router firewall** governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state. -- Caddy adds HTTP basic auth on the homepage and on sensitive services. +- Access is layered: Anubis challenges/denies bots at the front door, then Authentik's embedded outpost (`forward_auth`) gates the wrapped apps. Apps with their own login (Grafana, Gitea, Plex) run unwrapped. See [[Anubis]] and [[Authentik]]. - LAN subnet: `192.168.0.0/24`. ## See Also