Part 4 covered the four apps running on the day server and mentioned, in passing, that the NAS is the source of truth for media and the day server works from a local copy. This post is the rest of that story: why the NAS used to run those apps itself, why that stopped working, and what the day server's job has quietly grown into since.
Part 3 covered the compute layer — two servers, bare metal, Docker straight on top. This post covers what's actually running on the day-only box for media: Plex, Navidrome, Kavita, and Audiobookshelf.
Part 3 covered the move to bare-metal Docker, and mentioned in passing that the always-on server runs n8n, Dockhand, and Caddy. This post is about that last one — specifically, about what it replaced: Nginx Proxy Manager, which sat in front of everything before this. Where it lives on the network is nothing new; it's still on the Trusted VLAN, in the Secure zone, per part 2 — nothing about the migration changed that.
Part 2 covered the network the Lab VLAN sits on. This post covers what's actually running inside it — and a decision I made and then partly reversed: standing up Proxmox on both servers, then tearing it back down in favour of running Docker straight on bare metal.
Part 1 covered the physical layer — where the gear lives and how it gets a wired connection. This post covers what's built on top of it: the gateway, the VLAN layout, and the firewall model that ties them together. Later posts move up the stack into the compute layer and the reverse proxy sitting in front of it.
When my wife and I moved into our current home seven years ago, I wanted the network gear tucked away in the loft rather than piled up behind the TV. Wiring the house for Ethernet turned out to be a bigger job than I'd expected, and since it wasn't urgent, it kept sliding down the to-do list. That changed last December, when a problem with the existing setup made it worth finally tackling properly.