# Network Architecture

Both hosts run Caddy as the single entry point. Every service is reachable by hostname; the router firewall governs external access. On Dankclaw, SearXNG's outbound traffic exits through the Gluetun VPN container.

## Topology

```mermaid
graph TB
    subgraph WAN[Router 192.168.0.1 firewall]
        EXT[Internet]
    end
    EXT -->|port forward| DS[Caddy Dankserver]
    EXT -->|port forward| DC[Caddy Dankclaw]
    subgraph Dankserver[192.168.0.235]
        DS --> R[RomM :8085]
        DS --> P[Copyparty :3923]
        DS --> W[Calibre-Web :8083]
    end
    subgraph Dankclaw[192.168.0.143]
        DC --> O[OpenWebUI :3000]
        DC --> G[Gitea :3001]
        DC --> F[ComfyUI :8188]
        DC --> GR[Grafana :3002]
        DC --> PR[Prometheus :9090]
        DC --> SE[SearXNG :8081]
        SE -->|network_mode service| GL[Gluetun VPN]
        GL -->|tunnel| EXT
    end
```

## Hostnames

| Host | Convention |
|------|------------|
| Dankserver | `*.dankserver.local` → Caddy → service |
| Dankclaw | `*.dankclaw.local` → Caddy → service |

Users never type ports; Caddy maps names to upstreams.

## Gluetun Path (SearXNG only)

SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[VPN Routing for SearXNG]].

## Access Policy

- All services assume external access is possible; the **router firewall** governs what the WAN can reach.
- Caddy adds HTTP basic auth on the homepage and on sensitive services.
- LAN subnet: `192.168.0.0/24`.

## See Also

- [[Dankserver Stack]], [[Dankclaw Stack]]
- [[Caddy]], [[Gluetun]]
- Knowledge base: [[VPN Routing for SearXNG]], [[SearXNG Tuning]]