86 lines
4.7 KiB
Markdown
86 lines
4.7 KiB
Markdown
# IT Pro Partner Infrastructure - Network Diagram
|
|
|
|
## Network Topology (ASCII)
|
|
|
|
```text
|
|
[ Users / Internet ]
|
|
| (HTTP/S)
|
|
v
|
|
+-------------------+
|
|
| Cloudflare |
|
|
| (CDN / DNS) |
|
|
+---------+---------+
|
|
|
|
|
v
|
|
+-------------------+
|
|
| Primary Host |
|
|
| (Core) |
|
|
| - Caddy Proxy |
|
|
| - WireGuard Hub |
|
|
| - SMTP Relay |
|
|
+--+------+------+--+
|
|
| | |
|
|
(WireGuard Port 51821) | | | (Tailscale Mesh)
|
|
+-----------------------+ | +------------------------+
|
|
v | v
|
|
[Home Router] | [Standby Host]
|
|
| (app1-bu)
|
|
v
|
|
+-------------------+-------------+-------------+-------------------+
|
|
| | | |
|
|
v v v v
|
|
[Host A] [Host B] [Host C] [Legacy Net]
|
|
(app1) (app2) (app3) (Hetzner)
|
|
AI Stack Net Mgmt Web Hosting - AI Server
|
|
- Docker Box
|
|
- UNMS
|
|
- UniFi
|
|
- wphost02 <-+
|
|
|
|
|
[Primary Host] ---(SSH Tunnel Port 33060 for MySQL)--------------------------+
|
|
```
|
|
|
|
## Server Networks & IP Addressing
|
|
|
|
### Internet Entry Points
|
|
* **Cloudflare CDN/DNS**: Proxies all public domains.
|
|
* **Caddy Reverse Proxy**: Hosted on Primary Host (Core), acts as the central ingress routing to internal services.
|
|
|
|
### Active Server Networks
|
|
* **Primary Host (Core)**: `152.53.192.33` — WireGuard hub (`10.77.0.1`), SMTP relay (port 2525), Caddy reverse proxy.
|
|
* **Host A (app1)**: `152.53.36.131` — AI stack (Ollama).
|
|
* **Host B (app2)**: `152.53.39.202` — Networking management.
|
|
* **Host C (app3)**: `152.53.241.111` — Web hosting.
|
|
* **Standby Host (app1-bu)**: `5.161.114.8` — Warm standby, connected via Tailscale to Core.
|
|
|
|
### Legacy Hetzner Network (Pending Migration/Decommission)
|
|
* **AI Server**: `178.156.167.181` — Migrating to app1.
|
|
* **Docker Box**: `178.156.168.35` — nginx-proxy-manager, Uptime Kuma.
|
|
* **wphost02**: `5.161.62.38` — Decommissioning (MySQL accessed via SSH tunnel from Core).
|
|
* **UNMS**: `5.161.225.131` — Migrating to app2.
|
|
* **UniFi**: `178.156.131.57` — Migrating to app2.
|
|
|
|
## Network Paths & VPN/Mesh Details
|
|
|
|
* **Ingress Path**: External Traffic -> Cloudflare (Ports 80/443) -> Primary Host (Core) -> Caddy Reverse Proxy -> Target Application/Service (Local or cross-host routing).
|
|
* **WireGuard Network**: Connects Primary Host/Core (`10.77.0.1`) and Home Router (`10.77.0.2`) on UDP port 51821.
|
|
* **Tailscale Mesh**: Secure mesh connection established between Primary Host (Core) and Standby Host (app1-bu) for warm standby synchronization and secure administrative access.
|
|
* **Site-to-Site SSH Tunnel**: Configured from Primary Host (Core) to legacy `wphost02`, forwarding local port 33060 to access the legacy MySQL database.
|
|
|
|
## Service Ports Table
|
|
|
|
| Port | Service/Protocol | Description / Routing |
|
|
| :--- | :--- | :--- |
|
|
| **22** | SSH | UFW-managed, key-only access across all hosts. |
|
|
| **80 / 443** | HTTP/HTTPS | Standard web traffic proxied via Caddy to backend services. |
|
|
| **2525** | SMTP Relay | Hosted on Primary Host (outbound email relay only). |
|
|
| **3001** | Uptime Kuma | Monitoring service on Legacy Docker Box. |
|
|
| **8089** | UNMS | Ubiquiti Network Management System (Legacy, migrating to app2). |
|
|
| **8443** | UniFi | UniFi Network Controller (Legacy, migrating to app2). |
|
|
| **11434** | Ollama | AI service running on Host A (app1). |
|
|
| **33060** | MySQL | Forwarded over SSH tunnel from Core to `wphost02`. |
|
|
| **51821** | WireGuard | Core-to-Home Router VPN tunnel. |
|
|
|
|
## DNS Zones
|
|
* All public domains are managed and proxied via **Cloudflare CDN/DNS**.
|
|
* Cloudflare acts as the primary defense layer and DNS resolution endpoint, obscuring internal host IP addresses for edge-routed traffic. |