ARCHITECTURE
Sanitized lab topology.
The diagram shows relationships and trust boundaries. Real IP addresses, ports, credentials, firewall-rule details, and device identifiers are intentionally withheld.
WAN
Internet
SECURITY EDGE
UniFi Dream Machine (UDM)
Firewall · Routing · VPN · VLANs
WIRED
UniFi USW 24 non-PoE switch
Endpoints · AP uplinks · Switching
WIRELESS
U6 Lite + U7 Lite
Multi-floor coverage
SEGMENTATION
Trusted + IoT VLANs
Controlled discovery
COMPUTE
CastleRock Proxmox
Linux LXC · Docker host
STORAGE
Synology + PhotoVault
SMB/CIFS · Media · Backups
APPLICATIONS
Immich environments
PostgreSQL · Cache · ML
SERVICES
Media + management
Plex · Portainer · FileBrowser
APPROVED HTTPS
Reverse proxy
Published services only
TRUST BOUNDARIES