# How it's wired
The big picture of how traffic flows.
## Public → private
``` Internet → 161.97.210.86 → router (10.0.0.1) → pi4 edge (10.0.0.2) ```
- The router forwards WAN ports 80/443 to pi4 (the primary edge). - pi4 terminates HTTPS and forwards each hostname to the right host. - mini1 (`.4`) is the standby edge for LAN clients (dual-A DNS failover); it is not reachable from the public internet.
## DNS
- pi4 (`.2`) is primary DNS; mini1 (`.4`) and mini2 (`.5`) are backups. - All three run Pi-hole (ad blocking + LAN names) with unbound doing real DNS recursion. - mini1 runs DHCP (hands out `10.0.0.100–.254` and tells clients to use DNS `.2/.4/.5`).
## Typical routing
| Traffic | Goes to |
| ——— | ——— |
| Portal pages + repair shop | mini2 `.5:80` |
| Home Assistant | mini2 `.5:8123` |
| Social / Paperless / MeshCentral / Kuma | macpro `.3` |
| Authentik / books / comics | mini1 `.4` |
| Plex / media / Nextcloud / games / NovaTube | windows `.7` |
| Gotify / Kanboard / notes | pi5 `.13` |
## Family devices
Desktops, laptops, phones, and tablets are just clients — they reach the servers over the LAN; they don't host anything public.