Paccoco Homelab Network Topology

Current-state operator map as of 2026-05-23. Reflects live UniFi segmentation, the new Servers VLAN, restricted-lane DNS cutover to 10.5.30.53, and the broader Untrusted → Gateway shield with DHCP/mDNS preservation.
External access + WAN edge UniFi control plane + switching fabric Segmentation lanes Internet / Clients trusted users • phones • browsers Pangolin VPS + Newt reverse proxy for public subdomains Tailscale Serenity: 100.94.87.79 Cloudflare DNS paccoco.com records point to Pangolin VPS UDM Pro gateway + UniFi controller Mgmt IP: 10.5.0.1 Admin TCP blocked from Untrusted Switch Fabric USW-24-PoE — 10.5.0.10 USW Pro HD 24 — 10.5.0.135 10G links for PD + Serenity • 2.5G lanes for Nomad/FlyingDutchman/Rocinante Wi-Fi Access Points U7 Pro — 10.5.0.21 — active U6 LR — 10.5.0.20 currently disconnected in UniFi Policy Zones Internal = Mgmt + Trusted + Servers Untrusted = IoT + Camera + Old IoT Hotspot = Guest Management 10.5.0.0/24 UDM Pro • switches • AP management Core Infra UDM Pro 10.5.0.1 USW-24-PoE 10.5.0.10 • USW Pro HD 10.5.0.135 AP Control U7 Pro active U6 LR disconnected but still modeled Management stays operator-only Trusted 10.5.1.0/24 • VLAN 51 laptops • phones • tablets • daily-driver clients User Devices operator/admin endpoints live here can initiate into servers + untrusted lanes Wi-Fi SSID primary trusted network legacy compatibility cleanup still ongoing Allowed to initiate toward Untrusted Servers 10.5.30.0/24 • VLAN 30 core services + app stacks + AI + storage-adjacent hosts Core Hosts PlausibleDeniability — 10.5.30.6 Serenity — 10.5.30.5 N.O.M.A.D. — 10.5.30.7 Rocinante — 10.5.30.112 Shared Services Pi-hole HA VIP / DNS: 10.5.30.53 Gitea • Home Assistant • n8n • OpenWebUI • Qdrant LiteLLM • monitoring • media • productivity stacks Internal services reachable by trusted/admin workflows IoT 10.5.10.0/24 • VLAN 510 ecobees • MyQ • fridge • smart appliances DHCP DNS hands out 10.5.30.53 no longer depends on gateway-default DNS Gateway Access general gateway access blocked DHCP + mDNS preserved UDM admin TCP explicitly blocked Camera 10.5.20.0/24 • VLAN 520 Protect chimes + camera-adjacent gear Same shield posture as IoT DNS -> 10.5.30.53 • DHCP/mDNS preserved general gateway access blocked Guest / Hotspot 10.5.90.0/24 • VLAN 590 • internet-only lane Old IoT / Legacy Quarantine 192.168.1.0/24 • VLAN 2 shrinking-only containment lane same DNS/gateway shield pattern as IoT/Camera Allow Internal → Untrusted DNS only → 10.5.30.53 Blocked: general Untrusted → Gateway Blocked: UDM admin TCP from Camera / IoT / Old IoT Only proven exceptions stay Legend Trusted / operator lanes Servers / core services IoT / camera lanes Management / blocked security surfaces allowed path blocked path narrow preserved exception

Core hosts + routing facts

  • • PD 10.5.30.6 is the main Docker/control host.
  • • Serenity 10.5.30.5 handles NAS + ARR + Tailscale reachability.
  • • N.O.M.A.D. 10.5.30.7 runs local services and game/server workloads.
  • • Rocinante 10.5.30.112 carries heavy Ollama inference.
  • • UDM Pro stays at 10.5.0.1 on the management subnet.

What changed recently

  • • Servers VLAN is live at 10.5.30.0/24 (VLAN 30).
  • • IoT, Camera, and Old IoT now DHCP-advertise 10.5.30.53 for DNS.
  • • Broader Untrusted → Gateway block is live.
  • • DHCP and mDNS are still preserved for restricted lanes.
  • • UDM Pro admin TCP ports are explicitly blocked from Untrusted.

Still worth validating on real clients

  • • Renew one DHCP lease per restricted lane.
  • • Confirm DNS resolution works through 10.5.30.53.
  • • Confirm gateway admin/UI access fails from those lanes.
  • • Keep Google/cast validation as a separate laptop-present test wave.
  • • Treat any new exception as earned only by a real failing device.
Open locally with: xdg-open /home/fizzlepoof/repos/truenas-stacks/docs/architecture/network-topology-2026-05-23.html
Generated from current repo docs + live UniFi changes documented on 2026-05-23.