# How it's wired

The big picture of how traffic flows.

## Public → private

```
Internet → 161.97.210.86 → router (10.0.0.1) → pi4 edge (10.0.0.2)
```

- The router forwards WAN ports 80/443 to **pi4** (the primary edge).
- pi4 terminates HTTPS and forwards each hostname to the right host.
- **mini1 (`.4`)** is the standby edge for LAN clients (dual-A DNS failover); it is not reachable from the public internet.

## DNS

- **pi4 (`.2`)** is primary DNS; **mini1 (`.4`)** and **mini2 (`.5`)** are backups.
- All three run Pi-hole (ad blocking + LAN names) with **unbound** doing real DNS recursion.
- **mini1** runs DHCP (hands out `10.0.0.100–.254` and tells clients to use DNS `.2/.4/.5`).

## Typical routing

| Traffic | Goes to |
|---------|---------|
| Portal pages + repair shop | mini2 `.5:80` |
| Home Assistant | mini2 `.5:8123` |
| Social / Paperless / MeshCentral / Kuma | macpro `.3` |
| Authentik / books / comics | mini1 `.4` |
| Plex / media / Nextcloud / games / NovaTube | windows `.7` |
| Gotify / Kanboard / notes | pi5 `.13` |

## Family devices

Desktops, laptops, phones, and tablets are just **clients** — they reach the servers over the LAN; they don't host anything public.