Data collected by live audit on 2026-07-11. Regenerate rather than hand-edit resource numbers.
Single flat LAN — 192.168.86.0/24, gateway/DNS 192.168.86.1 (ISP/router, DHCP). No VLANs, no managed switching documented. Remote access is Tailscale-only; no WAN port-forwards are documented (verify at the router — several codycodez.com names are proxied by NPM and monitored externally, which implies 80/443 forwarding to 192.168.86.201).
graph TD
INET((Internet)) --- RTR[Router / gw+DNS<br/>192.168.86.1]
RTR --- NAS[NAS .100<br/>Immich · uptime · WikiJS]
RTR --- M910[M910q .101<br/>n8n · NPM · Homepage · Arr<br/>Kitchen · Ghost · Storj · Authentik]
RTR --- SPC[SuperPC .102<br/>Odysseus · Frigate · MQTT · OpenProject]
RTR --- MINI[mini-pc .13<br/>Jellyfin VM]
RTR --- CAM1[Camera .30]
RTR --- CAM2[Camera .31]
TS{Tailscale tailnet<br/>tailbacb1d.ts.net} -.- NAS
TS -.- M910
TS -.- SPC
TS -.- MINI
TS -.- G[9 guests with tailscaled]
graph LR
U[Browser] -->|https *.codycodez.com| NPM[Nginx Proxy Manager<br/>.201 :80/:443]
NPM -->|forward-auth some hosts| AUTH[Authentik outpost<br/>.213 :9443]
NPM --> FRIG[Frigate .212:8971]
NPM --> JELLY[Jellyfin .6:8096]
NPM --> IMM[Immich .203:2283]
NPM --> N8N[n8n .200:5678]
NPM --> HP[Homepage .204:3000]
NPM --> OP[OpenProject .214:8080]
NPM --> ODY[Odysseus .208:7000]
NPM --> BLOG[Ghost .210:2368]
NPM --> STJ[Storj dash .211:14002]
- .1 router · .2 MQTT (deliberate low IP for IoT clients) · .6 Jellyfin VM
- .10–.13 Proxmox nodes (R710-2 .10, R610 .12, mini-pc .13)
- .30+ cameras
- .100–.102 Proxmox nodes (NAS, M910q, SuperPC)
- .200–.216 LXC services, roughly in deployment order — next free: .217
- .231 personal PC (DHCP)
Full table: IP Plan. Ports: Ports. DNS names: DNS Records.
¶ Guest network standards
- LXCs: static IP on vmbr0,
firewall=1 on most NICs (note: no datacenter firewall rules are defined, so this is currently a no-op)
- DNS inside guests: 8.8.8.8 (static) or 100.100.100.100 when tailscaled runs inside the guest (fine — MagicDNS resolves locally; do not point a guest without tailscaled at MagicDNS)
searchdomain: 8.8.8.8 appears on all LXCs — it's a junk value (harmless); use a real domain or leave empty on new builds
- VLAN segmentation (cameras/IoT vs trusted) — see VLAN Plan
- Local DNS (Pi-hole/AdGuard or router overrides) so
*.codycodez.com can resolve internally without hairpin