Skip to content

Networking

Overlay networks, in order of how much traffic they carry.

network range carries peers
Netbird (WireGuard mesh) CGNAT 100.64.x.x/16 SSH, service access, all agent traffic all user peers + proxy-*
wg-direct 10.99.2.0/24 NFS only (vps-apps ↔ pi-home) vps-apps 10.99.2.1, pi-home 10.99.2.3
wgr-vpsnet 10.99.1.0/24 the only path to vps-net pi-home 10.99.1.10, vps-net 10.99.1.1

NFS is deliberately on wg-direct, not the mesh: it survives a Netbird outage and dies with its own tunnel. The mesh carries everything else.

Netbird mesh (control plane: vps-net)

  • Control plane (vpn.jmrdez.com:443) runs on vps-net — dead mesh = dead remote access.
  • Mesh DNS: pi-home (100.64.3.46) resolves mesh FQDNs + jmrdez.com, fallback 1.1.1.1.
  • Peer table (netbird status --json re-lists):
peer mesh IP
vps-apps (vps-jmrdez.nb.sh) 100.64.0.100
pi-home (dietpi.nb.sh) 100.64.3.46 (also mesh DNS)
laptop (jmz-glxybook.nb.sh) 100.64.1.25
phones/tablets 100.64.1.x / 100.64.7.x / 100.64.77.x
proxy-* (relay infra) 100.64.8.x

vps-net is not a mesh peer.

wg-direct (vps-apps ↔ pi-home, NFS)

vps-apps pi-home
tunnel IP 10.99.2.1/24 10.99.2.3/24
role NFS client NFS server
  • Exports: /mnt/pi-hdd/backups (restic repos, both hosts) and /mnt/pi-hdd/share (open/temp WebDAV drop).
  • all_squash + anonuid/anongid=1000 → remote root maps to the unprivileged dietpi user.
  • Mounts on vps-apps appear under /var/lib/docker/volumes/nfs_*.

wgr-vpsnet (pi-home ↔ vps-net)

The only route to vps-net. Native WireGuard, terminates on pi-home. Carries vps-net's beszel agent and sshd (10.99.1.1:22) access.

Access (SSH)

node command user / port
vps-apps ssh vps-apps jmrdez@100.64.0.100:27925 (~/.ssh/config alias)
pi-home ssh DietPi dietpi@100.64.3.46:27925
vps-net ssh -J DietPi <key>@10.99.1.1 sshd on :22 over wgr-vpsnet — laptop key not authorized

vps-net auth lives only on the hermes-ro fleet key inside the hermes container.

Public ingress

The only public path is the cloudflared token tunnel on pi-home. Everything else is mesh-only. Sensitive apps (Vaultwarden, Radicale, Home Assistant) have no public path at all. No port is published on 0.0.0.0 anywhere; firewalls (ufw on pi-home) are default-deny with explicit per-service mesh rules.