Architecture Diagram

Public Layer

The VPS is running Docker and has a few containers running on it. The main purpose of the VPS is a public entry point for the homelab. The VPS is running Netbird, both as a client and the dashboard.

Caddy acts as our reverse proxy. Anything in the public layer, like this documentation site, is deployed on the VPS and accessed through this Caddy. This Caddy layer also has a block to forward all internal domains to the homelab server on the private network through the Netbird tunnel. At this layer we are running Cerberus on our Caddy reverse proxy as well to deter automated traffic.

Private Layer

The home server is connected to this same Netbird network giving a secure entry to the home network. Caddy grabs the traffic, including anything forwarded from the VPS Netbird tunnel, and routes it to the appropriate Docker container or service while handling automated SSL encryption natively.