Networking
Overview
Centerpoint is reachable via four distinct paths depending on the use case.
| Path | Address / Domain | Use Case |
|---|---|---|
| LAN (physical) | 192.168.1.85 |
Direct IP access, management |
| Tailscale VPN | 100.117.158.101 |
Secure remote access |
| Traefik (internal) | *.home.local |
Named HTTPS on LAN |
| Traefik (external) | *.jeeves5454.ddns.net / *.jeevesconsults.ca |
Internet-facing HTTPS |
Physical Network
| Property | Value |
|---|---|
| Interface | enp47s0 |
| IP Address | 192.168.1.85/24 |
| Default Gateway | 192.168.1.1 (Unifi router) |
| Subnet | 192.168.1.0/24 |
The IP is assigned via DHCP with a static lease on the Unifi gateway, making it functionally static.
Tailscale Mesh VPN
Centerpoint runs as a Tailscale node and exit node, allowing remote devices to route all traffic through the home network.
| Peer | Tailscale IP | Platform | Notes |
|---|---|---|---|
| centerpoint | 100.117.158.101 |
Linux | This host — exit node |
| corsec | 100.101.27.107 |
Linux | HA OS server — also exit node |
| halcyon | 100.81.166.2 |
Windows | Active peer (direct connection) |
| Mobile | varies | iOS | Occasional peers |
Docker Network Architecture
Docker maintains approximately 25 bridge networks on the host. Each application stack follows a consistent isolation pattern:
| Network | Purpose |
|---|---|
traefik-net |
Shared bridge — all Traefik-fronted containers attach here |
*-internal |
Per-stack isolated networks for app-to-database communication |
media-network |
Shared bridge for media stack containers |
bridge |
Docker default (not used for production workloads) |
Typical stack pattern:
- Application container → attached to both
traefik-netand<stack>-internal - Database / cache sidecar → attached to
<stack>-internalonly (never on Traefik)
DNS
Internal (*.home.local): Resolved by AdGuard Home on the LAN. A wildcard DNS
record points *.home.local → 192.168.1.85 so Traefik receives all requests and
routes by hostname.
External (*.jeeves5454.ddns.net): DDNS via No-IP, keeps the external hostname
updated with the home WAN IP.
External (*.jeevesconsults.ca): Managed via DNS provider with appropriate
A / CNAME records pointing to the home WAN.
Notes / Gotchas
- If AdGuard Home is down, all
*.home.localDNS resolution fails. Services remain accessible via direct IP but HTTPS by hostname will not work. - Tailscale must be running (
tailscaled) for the100.xaddress to be reachable. - The large number of
br-*interfaces visible onip addris normal — Docker creates one per network. - Traefik handles all TLS termination; individual containers do not need to manage certificates.
Last Updated: 2026-06-16