Skip to content

Network topology

Everything in the estate, where it lives, and how to reach it. Accurate as of 2026-08-12.

The estate at a glance

flowchart TB
    inet(("Internet"))
    cf["Cloudflare<br/>Tunnel + Access"]
    players["Bedrock players"]
    mac["MacBook<br/>(roaming)"]

    subgraph vps["DigitalOcean VPS &nbsp;·&nbsp; 138.68.187.177"]
        npm["NPM proxy<br/>80/443 · UDP 19132/34/36"]
        wg["WireGuard hub<br/>wg0 · 10.10.0.1/24"]
        rd["RustDesk relay"]
    end

    subgraph home["Home LAN · 192.168.1.0/24"]
        subgraph pve["pve · Proxmox on OptiPlex 7060 · .138"]
            jarvis["VM 100 jarvis<br/>Home Assistant"]
            fr24["VM 102 fr24<br/>Flightradar"]
            mc["VM 103 minecraft<br/>.224 · wg 10.10.0.2"]
            ops["LXC 104 ops<br/>.190 · backup brain<br/>+ subnet router"]
            pbs["LXC 101 pbs<br/>(stopped, destroy Sep 9)"]
        end
        nas[("Synology NAS · .5<br/>/volume1/pbs")]
        pcs["pc1 · pc2 · tablet"]
    end

    inet --> cf --> npm
    players -- "UDP" --> npm
    npm -- "stream" --> wg
    wg -- "tunnel" --> mc
    mac -. "tailnet" .-> rd
    pve == "NFS" ==> nas
    ops == "kopia repo" ==> nas
    mac -. "tailnet" .-> ops
    ops -. "subnet route to whole LAN" .-> pcs

    classDef dead stroke-dasharray: 5 5,opacity:0.55;
    class pbs dead;

Solid arrows = physical/permanent paths · thick = storage · dotted = overlay networks (Tailscale).

Hosts

Host IP What it is Access
pve 192.168.1.138 Proxmox VE on the OptiPlex 7060 MFF — runs every VM/LXC below ssh proxmox (ProxyJump) or direct via Tailscale
NAS 192.168.1.5 Synology, 7 TB — the backup target (NFS) DSM web UI on LAN / via Tailscale
vps 138.68.187.177 DigitalOcean droplet — public entry point ssh vps (port 2222, key-only, fail2ban)
MacBook roaming Elliott's laptop, kopia endpoint backup@macbook physically present / Tailscale
pc1 LAN (DHCP) Elliott gaming PC, MAC 34:5a:60:ce:33:17 WoL-capable (wake gated)
pc2 LAN (DHCP) Rory gaming PC, MAC 30:56:0f:44:c7:a7 WoL-capable
tablet LAN (WiFi) Diagnostic tablet, MAC ec:4c:8c:96:da:4d WiFi → WoL unreliable

Proxmox guests (pve, 192.168.1.138)

VMID Name Type IP Role
100 jarvis VM LAN Home Assistant
101 pbs LXC 192.168.1.201 Decommissioned — see below
102 fr24 VM LAN Flightradar24 feeder
103 minecraft VM 192.168.1.224 / wg 10.10.0.2 Three Bedrock servers (runbook)
104 ops LXC 192.168.1.190 Backup brain + remote-access hub — see below

LXC 101 (pbs) is retired but still present

PBS is decommissioned (stopped, onboot=0) because a PBS datastore on Synology NFS never produced a single successful backup. It is kept only as a rollback safety net — destroy after 2026-09-09. Do not start it, do not point anything at it. VM backups are now plain nightly vzdump to the NAS — details in Backups overview.

ops (LXC 104) — the box that matters

Unprivileged Debian 12 container. If backups or remote access misbehave, start here (ssh root@192.168.1.190). It runs:

  • Kopia repository server — https://192.168.1.190:51515, TLS, per-machine users (backup@mc, backup@macbook, …), repo data on the NAS at /mnt/nas-kopia/repo
  • Google Drive sync — 04:00 rclone of the latest vzdump set (off-site)
  • ntfy monitoring — pages on new problems, daily digest ~09:00 UK
  • Tailscale subnet router for 192.168.1.0/24 (Tailscale)
  • WoL framework — wol-wake.sh pc1|pc2; automated timers gated off until Veeam exists
  • Central config in /etc/backup-stack/backup-targets.env; secrets in /etc/backup-stack/*.env (0600)
  • Endpoint onboarding is one command: add-backup-endpoint.sh <name> (onboarding)

VPS roles

The droplet no longer holds any backups (leg fully retired 2026-08-11). It is purely a front door — full detail in VPS:

  • Nginx Proxy Manager (Docker) — HTTPS proxying + Minecraft UDP passthrough (19132/19134/19136 → 10.10.0.2 over WireGuard)
  • WireGuard hub — wg0 10.10.0.1/24, peers mc=10.10.0.2, io=10.10.0.3 (WireGuard)
  • RustDesk relay and Tailscale node

NAS shares layout

Single NFS export /volume1/pbs (name is historical — it predates PBS's retirement):

Path Contents Written by
/volume1/pbs/dump/ Nightly 02:00 vzdump archives of VMs 100/102/103 (zstd, keep 7 daily + 4 weekly) pve, via Proxmox NFS storage pbs
/volume1/pbs/kopia/ Kopia repository (file/endpoint backups) ops, mounted at /mnt/nas-kopia

The export is IP-restricted (pve and ops; the old pbs entry 192.168.1.201 should be dropped when the export is rebuilt at the UNAS Pro 4 migration).

Never put a PBS datastore on this NFS export

Synology NFS lacks the locking semantics PBS needs — 62 nights of "green" backups were silently empty. History in Security history and Backups overview.

SSH access paths

Aliases live in ~/.ssh/config on the Mac:

ssh vps          # elliott@138.68.187.177 -p 2222
ssh -J vps minecraft@10.10.0.2      # Minecraft VM (user is minecraft, not elliott)
ssh proxmox      # ProxyJump vps → minecraft@10.10.0.2 → root@192.168.1.138
ssh pbs          # ProxyJump … → 192.168.1.201  (dead once LXC 101 is destroyed)
ssh root@192.168.1.190              # ops — direct on LAN or over Tailscale

Tailscale has largely replaced the ProxyJump chains

With the ops subnet router live, any tailnet device can hit 192.168.1.x addresses directly — ssh root@192.168.1.190 works from Scotland. The VPS ProxyJump paths remain the fallback when Tailscale is down ("Tailscale is stopped" is the first suspect — see Tailscale and Unreachable).

Web entry points

URL / port Path in Protected by
mc-admin.byers.cc cloudflared tunnel → NPM Cloudflare Access (mc-admin)
Minecraft UDP 19132/19134/19136 VPS NPM stream → WireGuard → VM 103 allowlist on the servers
RustDesk relay (21115–21119) VPS — tailnet-only, not a public entry closed to the public, verified 2026-08-12 (Remote desktop)