Skip to main content

Networking

Overview

Centerpoint is reachable via four distinct paths depending on the use case.

Path Address / Domain Use Case
LAN (physical) 192.168.1.85 Direct IP access, management
Tailscale VPN 100.117.158.101 Secure remote access
Traefik (internal) *.home.local Named HTTPS on LAN
Traefik (external) *.jeeves5454.ddns.net / *.jeevesconsults.ca Internet-facing HTTPS

Physical Network

Property Value
Interface enp47s0
IP Address 192.168.1.85/24
Default Gateway 192.168.1.1 (Unifi router)
Subnet 192.168.1.0/24

The IP is assigned via DHCP with a static lease on the Unifi gateway, making it functionally static.

Tailscale Mesh VPN

Centerpoint runs as a Tailscale node and exit node, allowing remote devices to route all traffic through the home network.

Peer Tailscale IP Platform Notes
centerpoint 100.117.158.101 Linux This host — exit node
corsec 100.101.27.107 Linux HA OS server — also exit node
halcyon 100.81.166.2 Windows Active peer (direct connection)
Mobile varies iOS Occasional peers

Docker Network Architecture

Docker maintains approximately 25 bridge networks on the host. Each application stack follows a consistent isolation pattern:

Network Purpose
traefik-net Shared bridge — all Traefik-fronted containers attach here
*-internal Per-stack isolated networks for app-to-database communication
media-network Shared bridge for media stack containers
bridge Docker default (not used for production workloads)

Typical stack pattern:

  • Application container → attached to both traefik-net and <stack>-internal
  • Database / cache sidecar → attached to <stack>-internal only (never on Traefik)

DNS

Internal (*.home.local): Resolved by AdGuard Home on the LAN. A wildcard DNS record points *.home.local → 192.168.1.85 so Traefik receives all requests and routes by hostname.

External (*.jeeves5454.ddns.net): DDNS via No-IP, keeps the external hostname updated with the home WAN IP.

External (*.jeevesconsults.ca): Managed via DNS provider with appropriate A / CNAME records pointing to the home WAN.

Notes / Gotchas

  • If AdGuard Home is down, all *.home.local DNS resolution fails. Services remain accessible via direct IP but HTTPS by hostname will not work.
  • Tailscale must be running (tailscaled) for the 100.x address to be reachable.
  • The large number of br-* interfaces visible on ip addr is normal — Docker creates one per network.
  • Traefik handles all TLS termination; individual containers do not need to manage certificates.

Last Updated: 2026-06-16

No comments to display

Back to top