# IT Pro Partner Infrastructure - Network Diagram

## Network Topology (ASCII)

```text
                           [ Users / Internet ]
                                    | (HTTP/S)
                                    v
                          +-------------------+
                          |   Cloudflare      |
                          |   (CDN / DNS)     |
                          +---------+---------+
                                    |
                                    v
                          +-------------------+
                          |   Primary Host    |
                          |      (Core)       |
                          | - Caddy Proxy     |
                          | - WireGuard Hub   |
                          | - SMTP Relay      |
                          +--+------+------+--+
                             |      |      |
     (WireGuard Port 51821)  |      |      | (Tailscale Mesh)
     +-----------------------+      |      +------------------------+
     v                              |                               v
[Home Router]                       |                         [Standby Host]
                                    |                         (app1-bu)
                                    v
  +-------------------+-------------+-------------+-------------------+
  |                   |                           |                   |
  v                   v                           v                   v
[Host A]          [Host B]                    [Host C]          [Legacy Net]
(app1)            (app2)                      (app3)            (Hetzner)
AI Stack          Net Mgmt                    Web Hosting       - AI Server
                                                                - Docker Box
                                                                - UNMS
                                                                - UniFi
                                                                - wphost02 <-+
                                                                             |
[Primary Host] ---(SSH Tunnel Port 33060 for MySQL)--------------------------+
```

## Server Networks & IP Addressing

### Internet Entry Points
* **Cloudflare CDN/DNS**: Proxies all public domains.
* **Caddy Reverse Proxy**: Hosted on Primary Host (Core), acts as the central ingress routing to internal services.

### Active Server Networks
* **Primary Host (Core)**: `152.53.192.33` — WireGuard hub (`10.77.0.1`), SMTP relay (port 2525), Caddy reverse proxy.
* **Host A (app1)**: `152.53.36.131` — AI stack (Ollama).
* **Host B (app2)**: `152.53.39.202` — Networking management.
* **Host C (app3)**: `152.53.241.111` — Web hosting.
* **Standby Host (app1-bu)**: `5.161.114.8` — Warm standby, connected via Tailscale to Core.

### Legacy Hetzner Network (Pending Migration/Decommission)
* **AI Server**: `178.156.167.181` — Migrating to app1.
* **Docker Box**: `178.156.168.35` — nginx-proxy-manager, Uptime Kuma.
* **wphost02**: `5.161.62.38` — Decommissioning (MySQL accessed via SSH tunnel from Core).
* **UNMS**: `5.161.225.131` — Migrating to app2.
* **UniFi**: `178.156.131.57` — Migrating to app2.

## Network Paths & VPN/Mesh Details

* **Ingress Path**: External Traffic -> Cloudflare (Ports 80/443) -> Primary Host (Core) -> Caddy Reverse Proxy -> Target Application/Service (Local or cross-host routing).
* **WireGuard Network**: Connects Primary Host/Core (`10.77.0.1`) and Home Router (`10.77.0.2`) on UDP port 51821.
* **Tailscale Mesh**: Secure mesh connection established between Primary Host (Core) and Standby Host (app1-bu) for warm standby synchronization and secure administrative access.
* **Site-to-Site SSH Tunnel**: Configured from Primary Host (Core) to legacy `wphost02`, forwarding local port 33060 to access the legacy MySQL database.

## Service Ports Table

| Port | Service/Protocol | Description / Routing |
| :--- | :--- | :--- |
| **22** | SSH | UFW-managed, key-only access across all hosts. |
| **80 / 443** | HTTP/HTTPS | Standard web traffic proxied via Caddy to backend services. |
| **2525** | SMTP Relay | Hosted on Primary Host (outbound email relay only). |
| **3001** | Uptime Kuma | Monitoring service on Legacy Docker Box. |
| **8089** | UNMS | Ubiquiti Network Management System (Legacy, migrating to app2). |
| **8443** | UniFi | UniFi Network Controller (Legacy, migrating to app2). |
| **11434** | Ollama | AI service running on Host A (app1). |
| **33060** | MySQL | Forwarded over SSH tunnel from Core to `wphost02`. |
| **51821** | WireGuard | Core-to-Home Router VPN tunnel. |

## DNS Zones
* All public domains are managed and proxied via **Cloudflare CDN/DNS**.
* Cloudflare acts as the primary defense layer and DNS resolution endpoint, obscuring internal host IP addresses for edge-routed traffic.