Architecture Overview

graph TB
    subgraph INTERNET["Internet"]
        USER["Users / Web Browser"]
        DEV["Developer"]
        MOBILE["Remote Clients\nLaptop / Mobile"]
        GH[("GitHub")]
        HC[("Healthchecks.io")]
    end

    subgraph VPS["Hetzner VPS — CX43 · Ubuntu 24.04 · Falkenstein"]
        TRAEFIK["Traefik\nReverse Proxy + Let's Encrypt"]

        subgraph VPS_WEB["Web Hosting"]
            NGINX["Nginx\nStatic Sites"]
            DECAP["Decap OAuth\nCMS Auth Provider"]
        end

        subgraph VPS_AUTH["Identity & Auth"]
            AUTHENTIK["Authentik\nSSO / OIDC"]
            AUTH_DB[("PostgreSQL")]
            AUTH_REDIS[("Redis")]
        end

        subgraph VPS_VPN["VPN & Tunneling"]
            NETBIRD["Netbird Server\nManagement · Signal · Relay"]
            PANGOLIN["Pangolin\nResource Gateway"]
            GERBIL["Gerbil\nWireGuard Endpoint"]
            WG_CLIENT["WireGuard Client\nBackhaul Tunnel"]
        end
    end

    subgraph HOMELAB["TrueNAS Homelab — 192.168.50.203"]
        DOCKGE["Dockge\nStack Manager"]

        subgraph HL_DNS["DNS Stack"]
            PIHOLE["Pi-hole\nDNS + Ad Blocker"]
            UNBOUND["Unbound\nRecursive Resolver"]
        end

        subgraph HL_VPN["VPN Clients"]
            WGEASY["wg-easy\nWireGuard Server"]
            NEWT["Newt\nPangolin Peer"]
            NB_GW["Netbird\nGateway Peer"]
        end

        subgraph HL_APPS["Applications"]
            MC["Minecraft Server\nPaper · Java 21"]
            BACKREST["Backrest\nRestic Backup"]
        end

        HL_STORAGE[("TrueNAS Storage\n/mnt/pool")]
    end

    subgraph OFFSITE["Off-site Storage"]
        STORAGEBOX[("Hetzner Storage Box BX11\n1 TB · SFTP · Helsinki")]
    end

    %% Inbound HTTPS
    USER -->|HTTPS :443| TRAEFIK
    MOBILE -->|HTTPS :443| TRAEFIK

    %% Traefik routing
    TRAEFIK --> NGINX
    TRAEFIK --> DECAP
    TRAEFIK --> AUTHENTIK
    TRAEFIK --> NETBIRD
    TRAEFIK --> PANGOLIN

    %% Authentik internals
    AUTHENTIK --- AUTH_DB
    AUTHENTIK --- AUTH_REDIS

    %% Netbird SSO
    NETBIRD -.->|SSO auth| AUTHENTIK

    %% CI/CD pipeline
    DEV -->|git push| GH
    GH -->|SSH + rsync| NGINX
    DECAP -->|OAuth2| GH

    %% WireGuard backhaul VPS ↔ Homelab
    WG_CLIENT <-->|WireGuard 10.8.0.0/24| WGEASY

    %% Pangolin resource tunnel
    PANGOLIN --- GERBIL
    GERBIL <-->|WireGuard 100.89.128.0/24| NEWT

    %% Netbird mesh VPN
    MOBILE <-->|Netbird P2P / Relay| NB_GW
    NB_GW -->|routes 192.168.50.0/24| PIHOLE
    NB_GW -->|routes 192.168.50.0/24| MC

    %% DNS chain
    PIHOLE -->|port 5335| UNBOUND
    UNBOUND -->|recursive lookup| INTERNET

    %% Backup flows
    BACKREST --- HL_STORAGE
    BACKREST -->|SSHFS mount| VPS
    BACKREST -->|SFTP :23| STORAGEBOX
    BACKREST -.->|success ping| HC

    %% Dockge manages stacks
    DOCKGE -.->|manages| HL_DNS
    DOCKGE -.->|manages| HL_VPN
    DOCKGE -.->|manages| HL_APPS