Homelab Networking Model

Physical Network

Gear: Unifi throughout
Gateway / controller: UDM Pro (10.5.0.1, WAN 69.166.182.157)
Core / access switching:
- USW-24-PoE (10.5.0.10)
- USW Pro HD 24 (10.5.0.135)
Wi-Fi access points:
- U7 Pro (10.5.0.21) — active
- U6 LR (10.5.0.20) — currently disconnected in UniFi as of 2026-05-21
Main LAN: 10.5.1.x (Trusted VLAN)
Management VLAN: 10.5.0.x
Other VLANs: Cameras, Guest, IoT / Old IoT
Serenity IP: 10.5.1.5
N.O.M.A.D. IP: 10.5.1.16
PlausibleDeniability: 10.5.1.6 (static on LAN)

Remote Access

Pangolin VPS + Newt: Services exposed as subdomains via reverse proxy. Newt agents run on PD and N.O.M.A.D.
Tailscale: Personal remote access, runs on Serenity (100.94.87.79)
Cloudflared: No longer used. Dead container on Serenity to be removed.

DNS

Provider: Cloudflare
All public subdomains point at Pangolin VPS IP

Known Public Subdomains

paccoco.com → Pangolin VPS
panel.paccoco.com → Pelican Panel (N.O.M.A.D.)
node1.paccoco.com → Wings daemon (N.O.M.A.D., no auth)
meshmonitor.paccoco.com → Meshmonitor (PD)
gitea.paccoco.com → Gitea (PD)
ai.paccoco.com → OpenWebUI (PD) — DNS/Pangolin resource pending

Docker Networking (PlausibleDeniability)

ix-databases_shared-databases

Created by the databases stack. The databases compose file uses name: ix-databases so Docker names the network ix-databases_shared-databases, matching what all other stacks declare as external.

Any stack connecting to shared-postgres, shared-mariadb, or shared-redis must declare:

networks:
  ix-databases_shared-databases:
    external: true

pangolin

Created at runtime by the newt container in the infrastructure stack. Any service needing reverse-proxy exposure must declare:

networks:
  pangolin:
    external: true

Internal Service Model

Internal services run HTTP only behind the reverse proxy. Compose service names used for internal DNS between services in the same stack/network.

N.O.M.A.D. Networking Notes

panel.paccoco.com added to /etc/hosts → 127.0.0.1 for NAT loopback
nginx listens on 80 and 443 (self-signed cert) for Wings → Panel communication
Wings uses --ignore-certificate-errors for local loopback
Pangolin resource node1.paccoco.com has auth disabled (Wings handles its own auth)
Minecraft port 25565 TCP/UDP goes directly via home router port forward, not through Pangolin

2.5 KiB Raw Blame History