388 lines
11 KiB
Markdown
388 lines
11 KiB
Markdown
# Infrastructure Diagram - xtrm-lab.org
|
|
|
|
**Generated:** 2026-01-22
|
|
**Domain:** xtrm-lab.org
|
|
**WAN IP:** 62.73.120.142
|
|
|
|
---
|
|
|
|
## Network Topology Overview
|
|
|
|
```mermaid
|
|
graph TB
|
|
subgraph Internet
|
|
WAN[/"🌐 Internet<br/>WAN: 62.73.120.142"/]
|
|
end
|
|
|
|
subgraph Router["MikroTik hAP ax³ (192.168.31.1)"]
|
|
direction TB
|
|
subgraph RouterContainers["Docker Containers"]
|
|
AGH["🛡️ AdGuard Home<br/>172.17.0.5<br/>DNS/DoH/DoT/DoQ"]
|
|
TS["🔗 Tailscale<br/>172.17.0.4"]
|
|
end
|
|
end
|
|
|
|
subgraph LAN["LAN Network (192.168.31.0/24)"]
|
|
Switch["🔌 CSS326 Switch<br/>192.168.31.9"]
|
|
AP["📶 cAP ac<br/>192.168.31.6"]
|
|
Unraid["🖥️ Unraid Server<br/>192.168.31.2"]
|
|
end
|
|
|
|
WAN --> Router
|
|
Router --> Switch
|
|
Switch --> AP
|
|
Switch --> Unraid
|
|
```
|
|
|
|
---
|
|
|
|
## Port Forwarding / NAT Rules
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
subgraph WAN["Internet (62.73.120.142)"]
|
|
P80[":80"]
|
|
P443[":443"]
|
|
P853[":853"]
|
|
P8853[":8853"]
|
|
P32400[":32400"]
|
|
P51413[":51413"]
|
|
P21115[":21115-21119"]
|
|
end
|
|
|
|
subgraph Destinations
|
|
Traefik80["Traefik<br/>192.168.31.2:8001"]
|
|
Traefik443["Traefik<br/>192.168.31.2:44301"]
|
|
DoT["AdGuard DoT<br/>172.17.0.5:853"]
|
|
DoQ["AdGuard DoQ<br/>172.17.0.5:8853"]
|
|
Plex["Plex<br/>192.168.31.2:32400"]
|
|
Transmission["Transmission<br/>192.168.31.2:51413"]
|
|
RustDesk["RustDesk<br/>192.168.31.2"]
|
|
end
|
|
|
|
P80 --> Traefik80
|
|
P443 --> Traefik443
|
|
P853 --> DoT
|
|
P8853 --> DoQ
|
|
P32400 --> Plex
|
|
P51413 --> Transmission
|
|
P21115 --> RustDesk
|
|
```
|
|
|
|
---
|
|
|
|
## Unraid Docker Services
|
|
|
|
### Core Infrastructure & Security
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph Core["Core Infrastructure"]
|
|
dockersocket["🔌 dockersocket<br/>172.18.0.2:2375"]
|
|
traefik["🔀 traefik<br/>172.18.0.3<br/>:8001→80, :44301→443"]
|
|
homarr["🏠 homarr<br/>172.18.0.4<br/>xtrm-lab.org"]
|
|
end
|
|
|
|
subgraph Security["Security & Identity"]
|
|
authentik["🔐 authentik<br/>172.18.0.11<br/>auth.xtrm-lab.org"]
|
|
authentik_worker["⚙️ authentik-worker<br/>172.18.0.12"]
|
|
vaultwarden["🔑 vaultwarden<br/>172.18.0.15<br/>vault.xtrm-lab.org"]
|
|
end
|
|
|
|
subgraph Databases["Databases"]
|
|
postgresql["🐘 postgresql17<br/>172.18.0.13:5432"]
|
|
redis["📦 Redis<br/>172.18.0.14:6379"]
|
|
end
|
|
|
|
traefik --> dockersocket
|
|
authentik --> postgresql
|
|
authentik --> redis
|
|
authentik_worker --> authentik
|
|
```
|
|
|
|
### DevOps & CI/CD
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph DevOps["DevOps Stack"]
|
|
gitea["📚 gitea<br/>172.18.0.31<br/>git.xtrm-lab.org<br/>:2222→22, :3005→3000"]
|
|
woodpecker_server["🪵 woodpecker-server<br/>172.18.0.32<br/>ci.xtrm-lab.org"]
|
|
woodpecker_agent["🤖 woodpecker-agent<br/>172.18.0.33"]
|
|
end
|
|
|
|
gitea --> woodpecker_server
|
|
woodpecker_server --> woodpecker_agent
|
|
```
|
|
|
|
### DNS Infrastructure
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph RouterDNS["MikroTik Router DNS"]
|
|
adguard["🛡️ AdGuard Home<br/>172.17.0.5<br/>PRIMARY<br/>DoH/DoT/DoQ"]
|
|
end
|
|
|
|
subgraph UnraidDNS["Unraid DNS (Secondary)"]
|
|
pihole["🕳️ Pi-hole<br/>192.168.31.4<br/>ph1.xtrm-lab.org"]
|
|
unbound["🔄 Unbound<br/>192.168.31.5<br/>Recursive DNS"]
|
|
doh_server["🌐 DoH-Server<br/>172.18.0.22"]
|
|
end
|
|
|
|
adguard -->|Fallback| pihole
|
|
pihole --> unbound
|
|
```
|
|
|
|
### Network Management
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph NetMgmt["Network Management"]
|
|
netbox["📋 NetBox<br/>172.24.0.5<br/>netbox.xtrm-lab.org"]
|
|
netdisco["🔍 NetDisco<br/>172.18.0.41<br/>netdisco.xtrm-lab.org"]
|
|
unimus["💾 Unimus<br/>unimus.xtrm-lab.org<br/>Config Backup"]
|
|
slurpit["🔎 Slurp'it<br/>slurpit.xtrm-lab.org<br/>Network Discovery"]
|
|
end
|
|
|
|
subgraph NetBoxStack["NetBox Stack"]
|
|
nb_postgres["🐘 netbox-postgres<br/>172.24.0.4"]
|
|
nb_redis["📦 netbox-redis<br/>172.24.0.2"]
|
|
nb_worker["⚙️ netbox-worker<br/>172.24.0.6"]
|
|
end
|
|
|
|
netbox --> nb_postgres
|
|
netbox --> nb_redis
|
|
nb_worker --> netbox
|
|
```
|
|
|
|
### Monitoring
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph Monitoring["Monitoring Stack"]
|
|
uptime["📊 Uptime Kuma<br/>172.18.0.20<br/>uptime.xtrm-lab.org"]
|
|
uptime_api["🔌 Uptime-Kuma-API<br/>172.18.0.18"]
|
|
autokuma["🤖 AutoKuma<br/>172.18.0.19"]
|
|
netalert["🚨 NetAlertX<br/>netalert.xtrm-lab.org"]
|
|
speedtest["📈 Speedtest<br/>172.18.0.21<br/>speedtest.xtrm-lab.org"]
|
|
end
|
|
|
|
autokuma --> uptime
|
|
uptime_api --> uptime
|
|
```
|
|
|
|
### Media & Storage
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph Media["Media & Storage"]
|
|
plex["🎬 Plex<br/>:32400<br/>plex.xtrm-lab.org"]
|
|
nextcloud["☁️ Nextcloud<br/>172.18.0.24<br/>nextcloud.xtrm-lab.org"]
|
|
transmission["📥 Transmission<br/>:9091, :51413"]
|
|
timemachine["🕐 TimeMachine<br/>192.168.31.12"]
|
|
libation["📚 Libation<br/>172.18.0.23<br/>Audiobooks"]
|
|
end
|
|
```
|
|
|
|
### Productivity
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph Productivity["Productivity Apps"]
|
|
actual["💰 Actual Budget<br/>172.18.0.16<br/>actual.xtrm-lab.org"]
|
|
n8n["⚡ n8n<br/>172.18.0.17<br/>n8n.xtrm-lab.org"]
|
|
karakeep["📝 Karakeep<br/>172.18.0.25<br/>karakeep.xtrm-lab.org"]
|
|
end
|
|
```
|
|
|
|
### Remote Access & Home Automation
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph Remote["Remote Access"]
|
|
rustdesk_hbbs["🖥️ RustDesk ID<br/>:21115-21119<br/>rustdesk.xtrm-lab.org"]
|
|
rustdesk_hbbr["📡 RustDesk Relay"]
|
|
end
|
|
|
|
subgraph Home["Home Automation"]
|
|
ha["🏡 Home Assistant<br/>ha.xtrm-lab.org"]
|
|
urbackup["💾 UrBackup<br/>urbackup.xtrm-lab.org"]
|
|
end
|
|
|
|
rustdesk_hbbs --> rustdesk_hbbr
|
|
```
|
|
|
|
---
|
|
|
|
## Complete Service Flow
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph Internet["🌐 Internet"]
|
|
User["👤 User"]
|
|
end
|
|
|
|
subgraph MikroTik["MikroTik Router"]
|
|
NAT["NAT/Firewall"]
|
|
AGH["AdGuard Home<br/>DNS/DoH/DoT"]
|
|
end
|
|
|
|
subgraph Unraid["Unraid Server"]
|
|
Traefik["Traefik<br/>Reverse Proxy"]
|
|
|
|
subgraph Services["Services"]
|
|
Auth["Authentik"]
|
|
Git["Gitea"]
|
|
CI["Woodpecker"]
|
|
NB["NetBox"]
|
|
UK["Uptime Kuma"]
|
|
PX["Plex"]
|
|
NC["Nextcloud"]
|
|
HA["Home Assistant"]
|
|
end
|
|
end
|
|
|
|
User -->|HTTPS :443| NAT
|
|
User -->|DoH/DoT| AGH
|
|
NAT -->|:44301| Traefik
|
|
Traefik --> Auth
|
|
Traefik --> Git
|
|
Traefik --> CI
|
|
Traefik --> NB
|
|
Traefik --> UK
|
|
Traefik --> NC
|
|
NAT -->|:32400| PX
|
|
Traefik --> HA
|
|
```
|
|
|
|
---
|
|
|
|
## Docker Networks
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph dockerproxy["dockerproxy (172.18.0.0/16)"]
|
|
dp_traefik["traefik"]
|
|
dp_authentik["authentik"]
|
|
dp_gitea["gitea"]
|
|
dp_homarr["homarr"]
|
|
dp_uptime["UptimeKuma"]
|
|
dp_more["...40+ services"]
|
|
end
|
|
|
|
subgraph netbox_net["netbox (172.24.0.0/16)"]
|
|
nb_main["netbox"]
|
|
nb_pg["netbox-postgres"]
|
|
nb_redis["netbox-redis"]
|
|
end
|
|
|
|
subgraph br0["br0 macvlan (192.168.31.0/24)"]
|
|
br_pihole["Pi-hole<br/>192.168.31.4"]
|
|
br_unbound["Unbound<br/>192.168.31.5"]
|
|
br_tm["TimeMachine<br/>192.168.31.12"]
|
|
end
|
|
|
|
subgraph host_net["host network"]
|
|
h_plex["plex"]
|
|
h_netalert["NetAlertX"]
|
|
h_unimus["unimus"]
|
|
h_ha["HomeAssistant"]
|
|
end
|
|
```
|
|
|
|
---
|
|
|
|
## Service Summary Tables
|
|
|
|
### Core Infrastructure
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| Reverse Proxy | traefik | 172.18.0.3 | 8001→80, 44301→443 | traefik.xtrm-lab.org |
|
|
| Docker Socket | dockersocket | 172.18.0.2 | 2375 | - |
|
|
| Dashboard | homarr | 172.18.0.4 | 10004→7575 | xtrm-lab.org |
|
|
|
|
### Security & Identity
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| Identity Provider | authentik | 172.18.0.11 | 9000, 9443 | auth.xtrm-lab.org |
|
|
| Password Manager | vaultwarden | 172.18.0.15 | 4743→80 | vault.xtrm-lab.org |
|
|
|
|
### DNS Infrastructure
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| AdGuard Home | adguardhome | 172.17.0.5 | 5355, 443, 853, 8853 | dns.xtrm-lab.org |
|
|
| Pi-hole | binhex-official-pihole | 192.168.31.4 | 53, 80 | ph1.xtrm-lab.org |
|
|
| Unbound | unbound | 192.168.31.5 | 53 | - |
|
|
|
|
### DevOps & CI/CD
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| Git Server | gitea | 172.18.0.31 | 2222→22, 3005→3000 | git.xtrm-lab.org |
|
|
| CI/CD Server | woodpecker-server | 172.18.0.32 | 80, 443, 8000 | ci.xtrm-lab.org |
|
|
|
|
### Network Management
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| NetBox | netbox | 172.24.0.5 | 8090→8080 | netbox.xtrm-lab.org |
|
|
| NetDisco | netdisco-web | 172.18.0.41 | 5000 | netdisco.xtrm-lab.org |
|
|
| Unimus | unimus | host | - | unimus.xtrm-lab.org |
|
|
| Slurpit | slurpit-portal | dockerproxy | 80 | slurpit.xtrm-lab.org |
|
|
|
|
### Monitoring
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| Uptime Kuma | UptimeKuma | 172.18.0.20 | 3001 | uptime.xtrm-lab.org |
|
|
| NetAlertX | NetAlertX | host | - | netalert.xtrm-lab.org |
|
|
| Speedtest | speedtest-tracker | 172.18.0.21 | 1180→80 | speedtest.xtrm-lab.org |
|
|
|
|
### Media & Storage
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| Plex | plex | host | 32400 | plex.xtrm-lab.org |
|
|
| Nextcloud | Nextcloud | 172.18.0.24 | 8666→80 | nextcloud.xtrm-lab.org |
|
|
| Transmission | transmission | bridge | 9091, 51413 | - |
|
|
|
|
### Productivity
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| Actual Budget | actual-budget | 172.18.0.16 | 5006 | actual.xtrm-lab.org |
|
|
| n8n | n8n | 172.18.0.17 | 5678 | n8n.xtrm-lab.org |
|
|
| Karakeep | karakeep | 172.18.0.25 | 3000 | karakeep.xtrm-lab.org |
|
|
|
|
### Remote Access & Backup
|
|
| Service | Container | IP | Ports | URL |
|
|
|---------|-----------|-----|-------|-----|
|
|
| RustDesk | rustdesk-hbbs | bridge | 21115-21119 | rustdesk.xtrm-lab.org |
|
|
| Home Assistant | HomeAssistant_inabox | host | - | ha.xtrm-lab.org |
|
|
| UrBackup | UrBackup | host | - | urbackup.xtrm-lab.org |
|
|
|
|
---
|
|
|
|
## Encrypted DNS Endpoints
|
|
|
|
| Protocol | Endpoint | Port |
|
|
|----------|----------|------|
|
|
| DoH | https://dns.xtrm-lab.org/dns-query | 443 |
|
|
| DoT | tls://dns.xtrm-lab.org | 853 |
|
|
| DoQ | quic://dns.xtrm-lab.org | 8853 |
|
|
|
|
---
|
|
|
|
## Quick Reference
|
|
|
|
**SSH Access:**
|
|
```bash
|
|
# Unraid
|
|
ssh -i ~/.ssh/id_ed25519_unraid root@192.168.31.2 -p 422
|
|
|
|
# MikroTik
|
|
ssh -i /root/.ssh/mikrotik_key -p 2222 unraid@192.168.31.1
|
|
```
|
|
|
|
**Key URLs:**
|
|
- 🏠 Dashboard: https://xtrm-lab.org
|
|
- 🔐 Auth: https://auth.xtrm-lab.org
|
|
- 📚 Git: https://git.xtrm-lab.org
|
|
- 🪵 CI/CD: https://ci.xtrm-lab.org
|
|
- 📋 NetBox: https://netbox.xtrm-lab.org
|
|
- 📊 Uptime: https://uptime.xtrm-lab.org
|