serverAppConfigs/docs/Architecture/Network Architecture.md

Network Architecture

One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. dnsmasq on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.

Topology

graph TB
    subgraph WAN["G36 router 192.168.0.1"]
        EXT[Internet]
    end
    EXT -->|port forwards| C
    subgraph Dankclaw[192.168.0.143]
        C[Caddy :80 :443]
        D[dnsmasq :53]
        C -->|comfyui:8188| F[ComfyUI]
        C -->|192.168.0.143:3000| G[Gitea quadlet]
        C -->|192.168.0.143:8081| SE[SearXNG quadlet]
        C -->|192.168.0.143:3005| O[OpenWebUI quadlet]
        SE -->|network_mode service| GL[Gluetun VPN]
        GL -->|tunnel| EXT
    end
    subgraph Dankserver[192.168.0.235]
        C -->|192.168.0.235:8085| R[RomM]
        C -->|192.168.0.235:3923| P[Copyparty]
        C -->|192.168.0.235:8083| W[Calibre-Web]
        C -->|192.168.0.235:32400| PL[Plex host service]
    end
    CLIENT[LAN clients] -->|DHCP DNS| D

Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.

Hostnames

Scope	Convention	Resolved by
LAN	romm.franksdank.cloud → 192.168.0.143	dnsmasq (addn-hosts)
WAN	romm.franksdank.cloud → 71.227.227.172	Porkbun A record

Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See LAN-DNS for the flow and the router hand-off.

TLS

Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in Caddy.

Gluetun Path (SearXNG only)

SearXNG attaches to the Gluetun network namespace (network_mode: service:gluetun). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in VPN Routing for SearXNG.

Access Policy

• The G36 router firewall governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
• Caddy adds HTTP basic auth on the homepage and on sensitive services.
• LAN subnet: 192.168.0.0/24.

See Also

• LAN-DNS — name resolution, dnsmasq, router hand-off
• Caddy — vhost map, TLS, basic auth
• Dankserver Stack, Dankclaw Stack
• Gluetun
• Knowledge base: VPN Routing for SearXNG, SearXNG Tuning