mrwick/notebook

drag or arrow keys to move · scroll to zoom · esc to exit

map

How the pieces connect. No addresses, and every hostname is generic.

Scroll to walk through the city, or press explore to fly it yourself.

Homelab mapPhone and laptops reach a VPS over HTTPS. Caddy on the VPS forwards each request to a service, and asks the login server first for private ones. A tailnet joins the VPS to a home machine that runs the media apps.phonelaptopsbrowsers, appsVPSCaddyHTTPSAutheliaprivate appsRSS, status,financeown loginvault, DNShomemachinemediaasks firsttailnetHomelab mapphone · laptopsbrowsers, appsVPSCaddyHTTPSAutheliaprivateappsRSS, status,financeown loginvault, DNShome machinemediaasks firsttailnet

Reading the map

  1. Every request from a phone or a laptop reaches Caddy. Caddy is the only service that publishes a web port.
  2. For a private app, Caddy first asks Authelia, shown by the dashed line. A visitor without a session gets the login page.
  3. Some services keep their own login, because phone apps and DNS clients cannot pass a web login page. The password manager, the DNS resolver, and the one service at home are in this group.
  4. The home machine has no public address. A private network, the tailnet, joins it to the VPS. Caddy forwards media hostnames over that link.

For the reasoning behind each box, readwhat a reverse proxy does andsingle sign-on in plain words. To build the VPS side, followbuild the one-VPS stack.