Components

Every box in the lab — role, software, data, failure mode, backup role. Hardware specs TBD until sized.

layer

region

Access — the door & the clients

Identity, TLS, routing, and the public-internet devices that reach the lab through the edge.

Pangolin Edge

Public front door: TLS, login, route-by-name, site-mesh endpoint. All public traffic passes through here.

AccessIstanbulpublic

runs on: Compute — active box

stores on: Own small Postgres volume on the active box

ports: 443/tcp · 51820/udp

· Compute service — containers on the active box

· isolated compose project (exit path to Option B)

failure: Compromise = outer wall breached. Mitigated: isolated compose project, kept updated, monitored.

backup: Edge state is tiny and portable — re-deployable in ~1 hour.

Family clients

Public-internet devices (phones, laptops). Untrusted endpoints — access only via authenticated sessions at the edge; the edge is the trust boundary.

AccessInternet / meshpublic

· Nothing to buy

failure: Stolen or compromised device = session risk. Mitigate: 2FA at the edge, per-user accounts, device revocation.

backup: Phones are the source of truth until Immich sync completes.

Compute — services (run on the active box)

Workloads. Their data lives on storage — see the “stores on” line on each card.

Dokploy

Deploy platform for public side projects: git-deploy, databases, built-in backups.

ComputeIstanbulactive

runs on: Compute — active box

stores on: App databases + volumes on NAS 1 (ZFS pool)

ports: internal only

· Compute service — containers on the active box

failure: App-level outage only; never touches photos.

backup: Dokploy built-in DB backups (app-level).

Immich

Google Photos alternative — single primary instance, family sync, ML search. Public URL gated by Google OAuth2 SSO at the edge; data stored on NAS 1.

ComputeIstanbulpublic

runs on: Compute — active box

stores on: Library + Postgres on NAS 1 (ZFS pool)

· Compute service — containers on the active box

· CPU for ML jobs

failure: Now a public surface: keep patched, auth-tested, monitored. Data loss = restore from NAS 2 / NAS 3 (hours).

backup: Source of the backup chain (pg_dump + library).

Storage — NAS units (data lives here)

ZFS pools. Passive units run nothing but SSH (restic targets). NAS 1 shares hardware with compute under Option A.

NAS 1 · ACTIVE

The active storage unit in Istanbul — the ZFS pool holding the live photo library, databases, and app volumes. Shares hardware with the compute services under Option A.

StorageIstanbulactive

· Real CPU/RAM (Immich ML + Dokploy)

· ≥ 32 GB RAM class

· TBD

failure: Disk failure / hardware death → restore from NAS 2.

backup: Primary data source — pushes nightly restic to NAS 2 + NAS 3.

NAS 2 · PASSIVE

Local mirror for fast recovery — LAN-speed restores in hours.

StorageIstanbulpassive

· Dumb storage: disks + SSH only

· TBD

failure: Dead disk → replace + re-sync from NAS 1.

backup: Local backup — nightly restic over LAN.

NAS 3 · PASSIVE

First offsite copy — the disaster-recovery leg, at brother’s place in Tallinn.

StorageTallinnpassive

· Dumb storage

· TBD

failure: Dead disk → replace + re-sync.

backup: Offsite #1 — nightly restic over the site mesh.

NAS 4 · PASSIVE

Second offsite copy, synced locally in Tallinn — zero Istanbul upload bandwidth.

StorageTallinnpassive

· Dumb storage

· Same apartment as NAS 3 (shared failure domain)

· TBD

failure: Dead disk → re-copy from NAS 3 (LAN).

backup: Offsite #2 — restic copy from NAS 3 on brother’s LAN.

Network — plumbing

The router, the site mesh, and the single inbound path.

Router

The only inbound path into the lab: forwards 443 + WireGuard UDP to the Pangolin edge. Nothing else exposed.

NetworkIstanbulactive

ports: 443/tcp → Pangolin · 51820/udp → Pangolin

· TBD

· static IP obtainable, DDNS optional

failure: ISP outage or hardware death takes the public edge down.

backup: —

Site Mesh

Site-to-site link Istanbul ⇄ Tallinn. One tool covers edge + mesh (no Headscale).

NetworkInternet / meshactive

· Logical link — no dedicated hardware

failure: Pangolin down = public access + backup pipe down (accepted tradeoff).

backup: Carries the nightly NAS 1 → NAS 3 restic traffic.