Editing System:Network Architecture

This document describes the network architecture of the jb-vpn.uk infrastructure.

== Network topology ==

<pre>
Internet → VPS (87.106.61.62) → Caddy (443)
              ├→ 127.0.0.1 — Docker (WebApp, MediaWiki, phpMyAdmin)
              └→ OpenVPN (tun0) → NAS (10.8.0.2) — DSM, Plex, SSH
</pre>

== Network components ==

* '''VPS public IP''': <code>87.106.61.62</code>

* '''VPN network''': <code>10.8.0.0/24</code>

* '''VPN interface''': <code>tun0</code> (<code>10.8.0.1</code> on VPS)

* '''NAS VPN IP''': <code>10.8.0.2</code>

* '''Edge proxy''': Caddy (ports 80/443)

* '''TLS''': Let's Encrypt (automatic via Caddy)

== Traffic flow ==

# '''Client request''' — user opens a hostname (e.g. <code>wiki.jb-vpn.uk</code>)
# '''DNS''' — record points to <code>87.106.61.62</code>
# '''Caddy''' — receives HTTPS on port 443, terminates TLS
# '''Routing''' — Caddy proxies to a local upstream or through <code>tun0</code> to <code>10.8.0.2</code>
# '''Response''' — backend → Caddy → client

Example (main wiki):

<pre>
Browser → wiki.jb-vpn.uk:443 → Caddy → 127.0.0.1:8010 (wiki-mediawiki)
</pre>

Example (DSM):

<pre>
Browser → dsm.jb-vpn.uk:443 → Caddy → https://10.8.0.2:5001
</pre>

== Network diagram ==

<pre>
┌─────────────┐
│   Client    │
└──────┬──────┘
       │ HTTPS (443)
       ▼
┌─────────────────────────────────────┐
│         VPS (87.106.61.62)          │
│  ┌───────────────────────────────┐  │
│  │  Caddy (TLS + routing)        │  │
│  └───────────┬───────────────────┘  │
│              │                       │
│     ┌────────┴────────┐              │
│     ▼                 ▼              │
│  127.0.0.1         tun0 → 10.8.0.2   │
│  Docker stacks     NAS services      │
│  - 8010/8011 Wiki  - 5001 DSM        │
│  - 8008/8009 App   - 32400 Plex      │
│  - 8080 phpMyAdmin                   │
└─────────────────────────────────────┘
</pre>

== Ports ==

=== Public (VPS) ===

{| class="wikitable"
|-
| Port || Purpose
|-
| 80 || HTTP → HTTPS redirect (Caddy)
|-
| 443 || HTTPS (Caddy)
|-
| 22 || SSH (VPS admin)
|-
| 1194/udp || OpenVPN server
|-
| 22222 || SSH forward to NAS (iptables)
|}

=== Local (VPS <code>127.0.0.1</code>) ===

{| class="wikitable"
|-
| Port || Service
|-
| 8010 || Main MediaWiki
|-
| 8011 || Werbs MediaWiki
|-
| 3307 || Wiki MariaDB
|-
| 8008 || WebApp production
|-
| 8009 || WebApp beta
|-
| 8080 || phpMyAdmin
|}

=== NAS (via VPN <code>10.8.0.2</code>) ===

{| class="wikitable"
|-
| Port || Service
|-
| 5001 || DSM (HTTPS)
|-
| 32400 || Plex
|-
| 22 || SSH
|}

== Related documentation ==

* [Components Components] — component details

* [[Services:Current Services]] — hostname inventory

* [[OpenVPN:Integration|OpenVPN Integration]] — VPN and proxy interaction


[[Category:Documentation]]
[[Category:Documentation/System]]