docs: add full homelab documentation structure

docs/architecture/NETWORKING_MODEL.md

@@ -0,0 +1,56 @@
+# Homelab Networking Model
+
+## Physical Network
+- **Gear:** Unifi throughout
+- **Main LAN:** 10.5.1.x (Trusted VLAN)
+- **Other VLANs:** Cameras, Guest, IoT
+- **Serenity IP:** 10.5.1.5
+- **N.O.M.A.D. IP:** 10.5.1.16
+- **PlausibleDeniability:** DHCP on LAN
+
+## Remote Access
+- **Pangolin VPS + Newt:** Services exposed as subdomains via reverse proxy. Newt agents run on PD and N.O.M.A.D.
+- **Tailscale:** Personal remote access, runs on Serenity (100.94.87.79)
+- **Cloudflared:** No longer used. Dead container on Serenity to be removed.
+
+## DNS
+- **Provider:** Cloudflare
+- All public subdomains point at Pangolin VPS IP
+
+## Known Public Subdomains
+- `paccoco.com` → Pangolin VPS
+- `panel.paccoco.com` → Pelican Panel (N.O.M.A.D.)
+- `node1.paccoco.com` → Wings daemon (N.O.M.A.D., no auth)
+- `meshmonitor.paccoco.com` → Meshmonitor (PD)
+- `gitea.paccoco.com` → Gitea (PD)
+- `ai.paccoco.com` → OpenWebUI (PD) — DNS/Pangolin resource pending
+
+## Docker Networking (PlausibleDeniability)
+
+### ix-databases_shared-databases
+Created by the `databases` stack. The databases compose file uses `name: ix-databases` so Docker names the network `ix-databases_shared-databases`, matching what all other stacks declare as external.
+
+Any stack connecting to shared-postgres, shared-mariadb, or shared-redis must declare:
+```yaml
+networks:
+  ix-databases_shared-databases:
+    external: true
+```
+
+### pangolin
+Created at runtime by the `newt` container in the infrastructure stack. Any service needing reverse-proxy exposure must declare:
+```yaml
+networks:
+  pangolin:
+    external: true
+```
+
+### Internal Service Model
+Internal services run HTTP only behind the reverse proxy. Compose service names used for internal DNS between services in the same stack/network.
+
+## N.O.M.A.D. Networking Notes
+- `panel.paccoco.com` added to `/etc/hosts` → `127.0.0.1` for NAT loopback
+- nginx listens on 80 and 443 (self-signed cert) for Wings → Panel communication
+- Wings uses `--ignore-certificate-errors` for local loopback
+- Pangolin resource `node1.paccoco.com` has auth disabled (Wings handles its own auth)
+- Minecraft port 25565 TCP/UDP goes directly via home router port forward, not through Pangolin