hermes-recovery/references/network-diagram.md

IT Pro Partner Infrastructure - Network Diagram

Network Topology (ASCII)

                           [ Users / Internet ]
                                    | (HTTP/S)
                                    v
                          +-------------------+
                          |   Cloudflare      |
                          |   (CDN / DNS)     |
                          +---------+---------+
                                    |
                                    v
                          +-------------------+
                          |   Primary Host    |
                          |      (Core)       |
                          | - Caddy Proxy     |
                          | - WireGuard Hub   |
                          | - SMTP Relay      |
                          +--+------+------+--+
                             |      |      |
     (WireGuard Port 51821)  |      |      | (Tailscale Mesh)
     +-----------------------+      |      +------------------------+
     v                              |                               v
[Home Router]                       |                         [Standby Host]
                                    |                         (app1-bu)
                                    v
  +-------------------+-------------+-------------+-------------------+
  |                   |                           |                   |
  v                   v                           v                   v
[Host A]          [Host B]                    [Host C]          [Legacy Net]
(app1)            (app2)                      (app3)            (Hetzner)
AI Stack          Net Mgmt                    Web Hosting       - AI Server
                                                                - Docker Box
                                                                - UNMS
                                                                - UniFi
                                                                - wphost02 <-+
                                                                             |
[Primary Host] ---(SSH Tunnel Port 33060 for MySQL)--------------------------+

Server Networks & IP Addressing

Internet Entry Points

• Cloudflare CDN/DNS: Proxies all public domains.
• Caddy Reverse Proxy: Hosted on Primary Host (Core), acts as the central ingress routing to internal services.

Active Server Networks

• Primary Host (Core): 152.53.192.33 — WireGuard hub (10.77.0.1), SMTP relay (port 2525), Caddy reverse proxy.
• Host A (app1): 152.53.36.131 — AI stack (Ollama).
• Host B (app2): 152.53.39.202 — Networking management.
• Host C (app3): 152.53.241.111 — Web hosting.
• Standby Host (app1-bu): 5.161.114.8 — Warm standby, connected via Tailscale to Core.

Legacy Hetzner Network (Pending Migration/Decommission)

• AI Server: 178.156.167.181 — Migrating to app1.
• Docker Box: 178.156.168.35 — nginx-proxy-manager, Uptime Kuma.
• wphost02: 5.161.62.38 — Decommissioning (MySQL accessed via SSH tunnel from Core).
• UNMS: 5.161.225.131 — Migrating to app2.
• UniFi: 178.156.131.57 — Migrating to app2.

Network Paths & VPN/Mesh Details

• Ingress Path: External Traffic -> Cloudflare (Ports 80/443) -> Primary Host (Core) -> Caddy Reverse Proxy -> Target Application/Service (Local or cross-host routing).
• WireGuard Network: Connects Primary Host/Core (10.77.0.1) and Home Router (10.77.0.2) on UDP port 51821.
• Tailscale Mesh: Secure mesh connection established between Primary Host (Core) and Standby Host (app1-bu) for warm standby synchronization and secure administrative access.
• Site-to-Site SSH Tunnel: Configured from Primary Host (Core) to legacy wphost02, forwarding local port 33060 to access the legacy MySQL database.

Service Ports Table

Port	Service/Protocol	Description / Routing
22	SSH	UFW-managed, key-only access across all hosts.
80 / 443	HTTP/HTTPS	Standard web traffic proxied via Caddy to backend services.
2525	SMTP Relay	Hosted on Primary Host (outbound email relay only).
3001	Uptime Kuma	Monitoring service on Legacy Docker Box.
8089	UNMS	Ubiquiti Network Management System (Legacy, migrating to app2).
8443	UniFi	UniFi Network Controller (Legacy, migrating to app2).
11434	Ollama	AI service running on Host A (app1).
33060	MySQL	Forwarded over SSH tunnel from Core to wphost02.
51821	WireGuard	Core-to-Home Router VPN tunnel.

DNS Zones

• All public domains are managed and proxied via Cloudflare CDN/DNS.
• Cloudflare acts as the primary defense layer and DNS resolution endpoint, obscuring internal host IP addresses for edge-routed traffic.