# Network Architecture

One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. Pi-hole on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.

## Topology

```mermaid
graph TB
    subgraph WAN["G36 router 192.168.0.1"]
        EXT[Internet]
    end
    EXT -->|port forwards| C
    subgraph Dankclaw[192.168.0.143]
        C[Caddy :80 :443]
        D[Pi-hole :53]
        C -->|comfyui:8188| F[ComfyUI]
        C -->|192.168.0.143:3000| G[Gitea quadlet]
        C -->|192.168.0.143:8081| SE[SearXNG quadlet]
        C -->|192.168.0.143:3005| O[OpenWebUI quadlet]
        SE -->|network_mode service| GL[Gluetun VPN]
        GL -->|tunnel| EXT
    end
    subgraph Dankserver[192.168.0.235]
        C -->|192.168.0.235:8085| R[RomM]
        C -->|192.168.0.235:3923| P[Copyparty]
        C -->|192.168.0.235:8083| W[Calibre-Web]
        C -->|192.168.0.235:32400| PL[Plex host service]
    end
    CLIENT[LAN clients] -->|DHCP DNS| D
```

Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.

## Hostnames

| Scope | Convention | Resolved by |
|-------|------------|-------------|
| LAN | `romm.franksdank.cloud` → 192.168.0.143 | Pi-hole (`addn-hosts`) |
| WAN | `romm.franksdank.cloud` → 71.227.227.172 | Porkbun A record |

Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See [[LAN-DNS]] for the flow and the router hand-off.

## TLS

Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in [[Caddy]].

## Gluetun Path (SearXNG only)

SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[Gluetun]].

## Access Policy

- The **G36 router firewall** governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
- Caddy adds HTTP basic auth on the homepage and on sensitive services.
- LAN subnet: `192.168.0.0/24`.

## See Also

- [[LAN-DNS]] — name resolution, Pi-hole, router hand-off
- [[Caddy]] — vhost map, TLS, basic auth
- [[Dankserver Stack]], [[Dankclaw Stack]]
- [[Gluetun]]
- Knowledge base: [[Gluetun]], [[SearXNG]]