System:Network Architecture

This document describes the network architecture of the jb-vpn.uk infrastructure.

Network topology

Internet → VPS (87.106.61.62) → Caddy (443)
              ├→ 127.0.0.1 — Docker (WebApp, MediaWiki, phpMyAdmin)
              └→ OpenVPN (tun0) → NAS (10.8.0.2) — DSM, Plex, SSH

Network components

• VPS public IP: 87.106.61.62

• VPN network: 10.8.0.0/24

• VPN interface: tun0 (10.8.0.1 on VPS)

• NAS VPN IP: 10.8.0.2

• Edge proxy: Caddy (ports 80/443)

• TLS: Let's Encrypt (automatic via Caddy)

Traffic flow

1. Client request — user opens a hostname (e.g. wiki.jb-vpn.uk)
2. DNS — record points to 87.106.61.62
3. Caddy — receives HTTPS on port 443, terminates TLS
4. Routing — Caddy proxies to a local upstream or through tun0 to 10.8.0.2
5. Response — backend → Caddy → client

Example (main wiki):

Browser → wiki.jb-vpn.uk:443 → Caddy → 127.0.0.1:8010 (wiki-mediawiki)

Example (DSM):

Browser → dsm.jb-vpn.uk:443 → Caddy → https://10.8.0.2:5001

Network diagram

┌─────────────┐
│   Client    │
└──────┬──────┘
       │ HTTPS (443)
       ▼
┌─────────────────────────────────────┐
│         VPS (87.106.61.62)          │
│  ┌───────────────────────────────┐  │
│  │  Caddy (TLS + routing)        │  │
│  └───────────┬───────────────────┘  │
│              │                       │
│     ┌────────┴────────┐              │
│     ▼                 ▼              │
│  127.0.0.1         tun0 → 10.8.0.2   │
│  Docker stacks     NAS services      │
│  - 8010/8011 Wiki  - 5001 DSM        │
│  - 8008/8009 App   - 32400 Plex      │
│  - 8080 phpMyAdmin                   │
└─────────────────────────────────────┘

Ports

Public (VPS)

Port	Purpose
80	HTTP → HTTPS redirect (Caddy)
443	HTTPS (Caddy)
22	SSH (VPS admin)
1194/udp	OpenVPN server
22222	SSH forward to NAS (iptables)

Local (VPS 127.0.0.1)

Port	Service
8010	Main MediaWiki
8011	Werbs MediaWiki
3307	Wiki MariaDB
8008	WebApp production
8009	WebApp beta
8080	phpMyAdmin

NAS (via VPN 10.8.0.2)

Port	Service
5001	DSM (HTTPS)
32400	Plex
22	SSH

Related documentation

• [Components Components] — component details

• Services:Current Services — hostname inventory

• OpenVPN Integration — VPN and proxy interaction