Architecture Overview

Last updated: 2026-06-22

High-Level Map

Internet / Comcast Business
        |
        v
Cloudflare DNS / WAF / Zero Trust / tunnels where used
        |
        v
UniFi UDM-SE (10.10.10.1)  -- IDS/IPS, routing, firewall, LAN gateway
        |
        +-- UniFi switching/AP layer
        |     +-- USW Flex Mini 10.10.10.5
        |     +-- U6 Pro 10.10.10.6
        |     +-- US-8-60W 10.10.10.7
        |     +-- USW Lite 8 PoE 10.10.10.8
        |     +-- U6-Extender 10.10.10.9
        |
        +-- Proxmox node `proxmox` (10.10.10.251)
        |     +-- VM/LXC workloads: Docker 237, Wazuh 233, Hermes 234,
        |         Home Assistant 215, Fing 206, FreshRSS 209, CasaOS 243,
        |         WireGuard 248, LinkStack, Unbound, Ubuntu template
        |
        +-- Hyper-V NUC (10.10.10.90) -- VM inventory NEEDS VERIFICATION
        |
        +-- Docker host 10.10.10.76 -- URBackup / backup-verify / ErsatzTV / Portainer
        |
        +-- PBS-NUC (10.10.10.77)
        |     +-- Backup datastore mounted from QNAPNAS3 `/PVE` over NFSv3
        |
        +-- QNAP NAS units
              +-- QNAPNAS1 10.10.10.232 -- NAS + media app containers
              +-- QNAPNAS2 10.10.10.231 -- NAS + media app containers
              +-- QNAPNAS3 10.10.10.230 -- TS-664, `/PVE` backup storage

Traffic Flow

Public DNS/edge protections live in Cloudflare.
LAN routing, firewalling, and IDS/IPS live on the UniFi UDM-SE.
Public/self-hosted app ingress primarily lands on Nginx Proxy Manager on 10.10.10.237, published on 80/81/443.
LAN-only apps generally stay on high local ports on 10.10.10.237, 10.10.10.76, or QNAP container ports.
Remote internal access should prefer trusted paths such as VPN/Tailscale/Zero Trust patterns rather than per-app public logins.

Compute Layer

Proxmox at 10.10.10.251 is the main virtualization layer.
Docker VM 101 at 10.10.10.237 carries most self-hosted services and Portainer endpoint 2.
Wazuh VM 103 at 10.10.10.233 carries SIEM/API services.
Hermes VM 108 at 10.10.10.234 runs Hermes Agent/Gilfoyle and operational scripts.
Hyper-V NUC at 10.10.10.90 exists and is monitored, but its guest inventory NEEDS VERIFICATION.
Docker host 10.10.10.76 exists, reachable by SSH, and currently runs URBackup and supporting containers. Its physical/virtual placement NEEDS VERIFICATION.

Storage and Backup Flow

Proxmox workloads
   -> PBS backup jobs
   -> PBS-NUC 10.10.10.77
   -> NFSv3 datastore: 10.10.10.230:/PVE on QNAPNAS3

Endpoints / selected hosts
   -> URBackup on 10.10.10.76:55414

Docker app data
   -> Local Docker host paths and container volumes
   -> Selected app-specific sync/backup scripts, including WikiDocs GitHub sync

Known backup bottleneck: PBS datastore traffic to QNAPNAS3 has a historical 1GbE full-duplex link clue. If backup performance is weird, verify NIC negotiation before sacrificing goats.

Monitoring and Security Flow

Uptime Kuma on 10.10.10.237:3661 tracks infra, network gear, external services, TLS, and application endpoints.
Wazuh on 10.10.10.233 collects endpoint/security telemetry.
CrowdSec runs on 10.10.10.237:18080 with firewall/cloudflare/nginx bouncers.
UniFi threat/IDS data is monitored by scheduled reports.
Hermes scheduled jobs on 10.10.10.234 poll Proxmox, PBS, Wazuh, CrowdSec, AdGuard, Docker/Portainer, UniFi, Uptime Kuma, URBackup, NPM certs, and Tailscale key expiry.

NEEDS VERIFICATION

Exact VLAN layout and firewall policy matrix.
Hyper-V NUC guest inventory and backup relationship.
Full QNAP interconnect speeds and which switch ports each NAS uses.
Exact Cloudflare Tunnel vs NPM split for each public application.
Whether 10.10.10.76 is physical, Hyper-V-hosted, or otherwise virtualized.