The physical network layout is documented in Hardware. That page is the source for the dual WAN design, the single UDM Pro, the UniFi Pro Max 16 path, the 10 Gb outbuilding link, the CRS317, and the private MS-01 Thunderbolt/USB4 storage ring.
This page only covers logical traffic flow and troubleshooting. Keeping the physical details on the hardware page prevents the network documentation from drifting into two competing versions.
| Traffic | Path |
|---|---|
| Public HTTPS | Cloudflare -> UDM Pro -> Traefik on Docker Swarm -> service on the Lab network. |
| Internal service traffic | Swarm overlay/external Lab network between app containers and shared services. |
| Storage traffic | MS-01 private USB4/Thunderbolt ring for Ceph traffic. |
| Swarm manager control | Keepalived VIP 10.0.30.40 across manager VMs. |
| Game/service ports | Published through Traefik or host-mode ports depending on the app. |
Most public services enter through Traefik. If a service needs login, the route may pass through Authentik middleware. CrowdSec and Cloudflare provide edge filtering before traffic reaches the backend application.
Cloudflare manages public DNS records and ACME DNS challenges. Traefik requests and stores certificates through the Cloudflare DNS challenge provider, while Technitium handles homelab DNS management. DDNS jobs update Cloudflare records for root, wildcard, game, and Git endpoints.
The practical rule is simple: if the hostname is public-facing, check Cloudflare and Traefik first. If the hostname is internal-only or behaving differently inside the lab, check Technitium and local resolver behavior.
Lab network.