63 lines
2.6 KiB
Markdown
63 lines
2.6 KiB
Markdown
# Network Architecture
|
|
|
|
One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. dnsmasq on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.
|
|
|
|
## Topology
|
|
|
|
```mermaid
|
|
graph TB
|
|
subgraph WAN["G36 router 192.168.0.1"]
|
|
EXT[Internet]
|
|
end
|
|
EXT -->|port forwards| C
|
|
subgraph Dankclaw[192.168.0.143]
|
|
C[Caddy :80 :443]
|
|
D[dnsmasq :53]
|
|
C -->|comfyui:8188| F[ComfyUI]
|
|
C -->|192.168.0.143:3000| G[Gitea quadlet]
|
|
C -->|192.168.0.143:8081| SE[SearXNG quadlet]
|
|
C -->|192.168.0.143:3005| O[OpenWebUI quadlet]
|
|
SE -->|network_mode service| GL[Gluetun VPN]
|
|
GL -->|tunnel| EXT
|
|
end
|
|
subgraph Dankserver[192.168.0.235]
|
|
C -->|192.168.0.235:8085| R[RomM]
|
|
C -->|192.168.0.235:3923| P[Copyparty]
|
|
C -->|192.168.0.235:8083| W[Calibre-Web]
|
|
C -->|192.168.0.235:32400| PL[Plex host service]
|
|
end
|
|
CLIENT[LAN clients] -->|DHCP DNS| D
|
|
```
|
|
|
|
Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.
|
|
|
|
## Hostnames
|
|
|
|
| Scope | Convention | Resolved by |
|
|
|-------|------------|-------------|
|
|
| LAN | `romm.franksdank.cloud` → 192.168.0.143 | dnsmasq (`addn-hosts`) |
|
|
| WAN | `romm.franksdank.cloud` → 71.227.227.172 | Porkbun A record |
|
|
|
|
Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See [[LAN-DNS]] for the flow and the router hand-off.
|
|
|
|
## TLS
|
|
|
|
Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in [[Caddy]].
|
|
|
|
## Gluetun Path (SearXNG only)
|
|
|
|
SearXNG attaches to the Gluetun network namespace (`network_mode: service:gluetun`). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in [[VPN Routing for SearXNG]].
|
|
|
|
## Access Policy
|
|
|
|
- The **G36 router firewall** governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
|
|
- Caddy adds HTTP basic auth on the homepage and on sensitive services.
|
|
- LAN subnet: `192.168.0.0/24`.
|
|
|
|
## See Also
|
|
|
|
- [[LAN-DNS]] — name resolution, dnsmasq, router hand-off
|
|
- [[Caddy]] — vhost map, TLS, basic auth
|
|
- [[Dankserver Stack]], [[Dankclaw Stack]]
|
|
- [[Gluetun]]
|
|
- Knowledge base: [[VPN Routing for SearXNG]], [[SearXNG Tuning]] |