Files

T

Frank 0f59316be9 docs: Pi-hole KB page + dnsmasq retirement across the vault

- new docs/Infrastructure/Pi-hole.md (quadlet, records, upstream, web UI,
  failure modes incl. the rootless /etc/hosts single-label echo)
- LAN-DNS.md: Pi-hole quadlet section, router hand-off, host DNS
- Network Architecture / Caddy / Homepage / index / AGENTS.md: name swap

2026-08-24 13:54:35 -07:00

2.6 KiB

Raw Blame History

Network Architecture

One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. Pi-hole on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.

Topology

graph TB
    subgraph WAN["G36 router 192.168.0.1"]
        EXT[Internet]
    end
    EXT -->|port forwards| C
    subgraph Dankclaw[192.168.0.143]
        C[Caddy :80 :443]
        D[Pi-hole :53]
        C -->|comfyui:8188| F[ComfyUI]
        C -->|192.168.0.143:3000| G[Gitea quadlet]
        C -->|192.168.0.143:8081| SE[SearXNG quadlet]
        C -->|192.168.0.143:3005| O[OpenWebUI quadlet]
        SE -->|network_mode service| GL[Gluetun VPN]
        GL -->|tunnel| EXT
    end
    subgraph Dankserver[192.168.0.235]
        C -->|192.168.0.235:8085| R[RomM]
        C -->|192.168.0.235:3923| P[Copyparty]
        C -->|192.168.0.235:8083| W[Calibre-Web]
        C -->|192.168.0.235:32400| PL[Plex host service]
    end
    CLIENT[LAN clients] -->|DHCP DNS| D

Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.

Hostnames

Scope	Convention	Resolved by
LAN	`romm.franksdank.cloud` → 192.168.0.143	Pi-hole (`addn-hosts`)
WAN	`romm.franksdank.cloud` → 71.227.227.172	Porkbun A record

Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See LAN-DNS for the flow and the router hand-off.

TLS

Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in Caddy.

Gluetun Path (SearXNG only)

SearXNG attaches to the Gluetun network namespace (network_mode: service:gluetun). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in Gluetun.

Access Policy

The G36 router firewall governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
Caddy adds HTTP basic auth on the homepage and on sensitive services.
LAN subnet: 192.168.0.0/24.

2.6 KiB Raw Blame History