Data collected by live audit on 2026-10-11. Regenerate rather than hand-edit resource numbers.
Single flat LAN: 192.168.86.0/24, gateway/DHCP/DNS 192.168.86.1 (Verizon Fios CR1000A). A Fios Wi-Fi extender sits at .100. DHCP pool .25-.75 (verified on the router); every static device lives outside it. No VLANs, no managed switching documented. Second site: Dad's house 192.168.30.0/24, reached over Tailscale via the subnet router hanna-household (details). Remote access is Tailscale-only; no WAN port-forwards are documented (verify at the router: several codycodez.com names are proxied by NPM and monitored externally, which implies 80/443 forwarding to 192.168.86.201).
graph TD
INET((Internet)) --- RTR[Fios router CR1000A<br/>.1 gw + DHCP + DNS]
RTR --- LAN{{192.168.86.0/24<br/>flat LAN}}
LAN --- EXT[Fios extender .100]
LAN --- DHCPB[DHCP pool .25-.75<br/>phones, TVs, IoT, PCs]
LAN --- N_M910q["M910q node .101<br/>12 LXCs<br/>.150 mail<br/>.200 n8n<br/>.201 Nginx-Proxy<br/>.204 Homepage (stopped)<br/>.207 Arr-Stack<br/>.208 Odysseus (stopped)<br/>.209 AI-Recipe-Book (stopped)<br/>.210 Ghost<br/>.211 Storj<br/>.213 Authentik<br/>.215 uptime<br/>.216 WikiJS"]
LAN --- N_SuperPC["SuperPC node .102<br/>16 LXCs<br/>.2 MQTT<br/>.6 jellyfin<br/>.202 ntfy<br/>.203 Immich<br/>.212 Frigate<br/>.214 OpenProject<br/>.217 HomeAssistant<br/>.218 ollama<br/>.219 hanna-properties-backend (stopped)<br/>.220 amp-manager (stopped)<br/>.221 household-hub<br/>.222 crm (stopped)<br/>.223 obsidian (stopped)<br/>.224 terraria-ai (stopped)<br/>.225 network<br/>.226 jarvis"]
LAN --- N_NAS["NAS node .103<br/>0 LXCs"]
LAN -.- TS{{Tailscale tailnet}}
TS -.- HH[hanna-household<br/>subnet router]
HH --- DAD{{"Dad's house<br/>192.168.30.0/24"}}
Full address table: IP Plan.
graph LR
U[Browser] -->|https *.codycodez.com| NPM[Nginx Proxy Manager<br/>.201 :80/:443]
NPM -->|forward-auth some hosts| AUTH[Authentik outpost<br/>.213 :9443]
NPM --> FRIG[Frigate .212:8971]
NPM --> JELLY[Jellyfin .6:8096]
NPM --> IMM[Immich .203:2283]
NPM --> N8N[n8n .200:5678]
NPM --> HP[Homepage .204:3000]
NPM --> OP[OpenProject .214:8080]
NPM --> ODY[Odysseus .208:7000]
NPM --> BLOG[Ghost .210:2368]
NPM --> STJ[Storj dash .211:14002]
- .1 Fios router · .2 MQTT (deliberate low IP for IoT clients) · .6 Jellyfin
- .25-.75 DHCP pool: never static
- .86-.89 TP-Link smart plugs · .90-.99 cameras block (.90-.93 in use, the rest left open for more cameras)
- .100 Fios extender · .101-.103 Proxmox nodes (M910q, SuperPC, NAS)
- .150 mail LXC
- .200-.224 LXC services, roughly in deployment order; next free: .225 (reserved for the
network LXC)
- Retired: .5 Pi-hole, .10 R710-2, .12 R610, .13 mini-pc
Full table: IP Plan. Ports: Ports. DNS names: DNS Records.
¶ Guest network standards
- LXCs: static IP on vmbr0,
firewall=1 on most NICs (note: no datacenter firewall rules are defined, so this is currently a no-op)
- DNS inside guests: 8.8.8.8 (static) or 100.100.100.100 when tailscaled runs inside the guest (fine — MagicDNS resolves locally; do not point a guest without tailscaled at MagicDNS)
searchdomain: 8.8.8.8 appears on all LXCs — it's a junk value (harmless); use a real domain or leave empty on new builds
- VLAN segmentation (cameras/IoT vs trusted) — see VLAN Plan
- Local DNS (Pi-hole/AdGuard or router overrides) so
*.codycodez.com can resolve internally without hairpin