Frank
e3eb5334cb
- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter - Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy reverse proxy, Grafana+Prometheus+Loki+Alloy observability - Caddyfiles with .local hostname convention and basicauth homepage - bind-mount storage policy, no named volumes - deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health) - docs/ Obsidian vault: per-service docs from frank-default-small research subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu) - bats test suite at 6 seams — 22 tests green
55 lines
1.7 KiB
Markdown
55 lines
1.7 KiB
Markdown
# Network Architecture
|
|
|
|
Both hosts run Caddy as the single entry point. Every service is reachable by hostname; the router firewall governs external access. On Dankclaw, SearXNG's outbound traffic exits through the Gluetun VPN container.
|
|
|
|
## Topology
|
|
|
|
```mermaid
|
|
graph TB
|
|
subgraph WAN[Router 192.168.0.1 firewall]
|
|
EXT[Internet]
|
|
end
|
|
EXT -->|port forward| DS[Caddy Dankserver]
|
|
EXT -->|port forward| DC[Caddy Dankclaw]
|
|
subgraph Dankserver[192.168.0.235]
|
|
DS --> R[RomM :8085]
|
|
DS --> P[Copyparty :3923]
|
|
DS --> W[Calibre-Web :8083]
|
|
end
|
|
subgraph Dankclaw[192.168.0.143]
|
|
DC --> O[OpenWebUI :3000]
|
|
DC --> G[Gitea :3001]
|
|
DC --> F[ComfyUI :8188]
|
|
DC --> GR[Grafana :3002]
|
|
DC --> PR[Prometheus :9090]
|
|
DC --> SE[SearXNG :8081]
|
|
SE -->|network_mode service| GL[Gluetun VPN]
|
|
GL -->|tunnel| EXT
|
|
end
|
|
```
|
|
|
|
## Hostnames
|
|
|
|
| Host | Convention |
|
|
|------|------------|
|
|
| Dankserver | `*.dankserver.local` → Caddy → service |
|
|
| Dankclaw | `*.dankclaw.local` → Caddy → service |
|
|
|
|
Users never type ports; Caddy maps names to upstreams.
|
|
|
|
## Gluetun Path (SearXNG only)
|
|
|
|
SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[VPN Routing for SearXNG]].
|
|
|
|
## Access Policy
|
|
|
|
- All services assume external access is possible; the **router firewall** governs what the WAN can reach.
|
|
- Caddy adds HTTP basic auth on the homepage and on sensitive services.
|
|
- LAN subnet: `192.168.0.0/24`.
|
|
|
|
## See Also
|
|
|
|
- [[Dankserver Stack]], [[Dankclaw Stack]]
|
|
- [[Caddy]], [[Gluetun]]
|
|
- Knowledge base: [[VPN Routing for SearXNG]], [[SearXNG Tuning]]
|