# Architecture

## Infrastructure layers

```
┌─────────────────────────────────────────────────────────┐
│  pve1.sweet.home  (Proxmox VE — production hypervisor)  │
│                                                         │
│  ┌────────────┐  ┌──────────┐  ┌──────────────────────┐ │
│  │ server-    │  │ docker   │  │ nix-cache  pxe-boot  │ │
│  │ nixos VM   │  │ LXC      │  │ LXC        LXC       │ │
│  │ (baremetal │  │ 192.168  │  │ .224       .223      │ │
│  │  GUI host) │  │ .2.225   │  └──────────────────────┘ │
│  └────────────┘  └──────────┘                           │
│  ┌────────────┐  ┌──────────┐  ┌──────────────────────┐ │
│  │ domain-    │  │ pxe-boot │  │ ha-server-1  ha-     │ │
│  │ controller │  │ LXC      │  │ VM .2.228    server-2│ │
│  │ FreeIPA VM │  │ PXE DHCP │  │              VM .2.227│ │
│  │ .2.253     │  │ .2.223   │  └──────────────────────┘ │
│  └────────────┘  └──────────┘                           │
└─────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────┐
│  pve-test.sweet.home  (Proxmox VE — sandbox)            │
│  WiFi-connected. Safe for scratch VMs/LXCs.             │
└─────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────┐
│  raspberrypi.tail13f623.ts.net  (Raspberry Pi 4)        │
│  Edge monitoring via Tailscale.                         │
│  Traefik · Uptime Kuma · CrowdSec · Beszel agent        │
└─────────────────────────────────────────────────────────┘
```

## Configuration management matrix

| Host | Managed by | How |
|------|-----------|-----|
| pve1, pve-test | Ansible (`proxmox-hardening` role) | `ansible/playbooks/proxmox.yml` |
| domain-controller | Ansible (`freeipa` role) | `ansible/playbooks/freeipa.yml` |
| pihole | Ansible (`pihole` role) | `ansible/playbooks/pihole.yml` |
| raspberrypi | Ansible (`raspberrypi` role) | `ansible/playbooks/raspi.yml` |
| docker LXC | NixOS flake | `nixos/` — `proxmox-docker` target |
| nix-cache LXC | NixOS flake | `nixos/` — `proxmox-nix-cache` target |
| pxe-boot LXC | NixOS flake | `nixos/` — `proxmox-pxe-boot` target |
| ha-server-1/2 | NixOS flake | `nixos/` — `proxmox-ha-server-1/2` targets |
| baremetal workstation | NixOS flake | `nixos/` — `baremetal-gui` target |

## Authentication and DNS backbone

FreeIPA (`SWEET.HOME` realm) provides:
- Kerberos SSO for all IPA-enrolled hosts
- LDAP user/group directory (`admins`, `docker-access` groups)
- Authoritative DNS for the entire LAN (Pi-hole decommissioned; FreeIPA is the sole resolver)
- Certificate authority for internal TLS

All hosts (Proxmox nodes, Raspberry Pi, Docker host) are IPA-enrolled via SSSD.
The `admins` group has passwordless sudo on all enrolled hosts.
The `docker-access` group (GID 50010) grants Docker socket access on Docker hosts.

DHCP is handled by the router. PXE-specific DHCP options are served by the `pxe-boot` LXC.

## Monitoring stack

```
Beszel agents (every host)
    └─→ Beszel hub (stacks/docker — beszel.lan.ddnsgeek.com)

Uptime Kuma (stacks/docker — monitor-kuma.lan.ddnsgeek.com)
    └─→ monitors all public endpoints

Gotify (stacks/docker)
    └─→ receives: WUD alerts, Docker health checks, drift detection notifications

WUD (stacks/docker)
    └─→ watches: local docker host + Raspberry Pi (via Tailscale)
```