Every component, every connection between them, and the two separate doors traffic arrives through — with each arrow labelled so it says what it actually carries.
Follow any arrow from top to bottom and you have a complete request. Container addresses are deliberately absent: Docker assigns them in start order and they change whenever the stack is recreated.
Jellyfin is the only thing the house can reach, and that arrow never passes through Caddy. Every other service is on a blue path or on no path at all.
It connects straight to the disk, bypassing Docker and Caddy — which is why it keeps working when both are broken. That independence is deliberate: it is the way back in.
The library and its backup are both inside the /mnt/t7 outline —
which the drawing shows better than prose can. It is the top entry in
the gap list.
Syncthing’s sync port, :22000, is also open on the house WiFi. It is
safe there because every peer must be approved by device ID and it carries no
admin access — but it is a second thing listening on the amber interface, so it is
worth knowing about rather than discovering.
The clearest way to see the point of a reverse proxy is to draw the same system without one.
The prediction has been tested twice. Adding the downloader meant one Caddy block and one more port on an existing certificate; adding n8n meant the same again. Neither was a new security decision.
It runs on the host, not in a container, so it needs neither Docker’s port forwarding nor Caddy’s routing. That is the way back in when something else is broken.
Routing it through Caddy would mean installing a certificate on every roommate device. Instead that traffic stays on the house network in plain HTTP, where the WiFi’s own encryption covers it.
n8n and ollama publish no host port at all — Caddy and n8n reach them by container name. A port that is never published cannot be published to the wrong interface.
It shares gluetun’s namespace rather than having its own, so the tunnel is the only way out. A dead tunnel means no connection at all, rather than a fallback to the house line.
Jellyfin can read the library but not change it, so no bug can delete it. The cost is no subtitle downloads and no metadata sidecars — and it matters more now that backups live on the same drive.
It is not a live connection. A systemd timer runs
bin/homie-backup nightly; the rest of the time that path does not
exist.