Data flows

The three paths that matter: visitors → apps, nightly backups, and recovery.

Public request path

How a visitor reaches a public side project.

1Visitor → DNS:…2Router :443 — the…3Pangolin edge: TLS…4WireGuard tunnel to…5Dokploy routes to the…6Response flows back…
  1. Visitor → DNS: app.yourdomain.com (or photos.yourdomain.com)
  2. Router :443 — the only open inbound port
  3. Pangolin edge: TLS termination + Google OAuth2 login (SSO / RBAC)
  4. WireGuard tunnel to NAS 1
  5. Dokploy routes to the app container — or Immich serves photos
  6. Response flows back the same way

Nightly backup chain

restic, multi-target, every night.

1Cron on NAS 1:…2restic backup → NAS 2…3restic backup → NAS 3…4Brother’s box: restic…5Healthcheck ping —…
  1. Cron on NAS 1: pg_dump the Immich database
  2. restic backup → NAS 2 (LAN, minutes)
  3. restic backup → NAS 3 (over the mesh, small delta)
  4. Brother’s box: restic copy NAS 3 → NAS 4 (his LAN)
  5. Healthcheck ping — alert on any failure

Restore path

Recovery order and expectations.

1NAS 2: LAN restore —…2NAS 3 / NAS 4:…3Order: restore DB…4Verify: Immich check…5Drill quarterly — a…
  1. NAS 2: LAN restore — hours
  2. NAS 3 / NAS 4: offsite restore — disaster case, days
  3. Order: restore DB dump first, then the library
  4. Verify: Immich check + spot-check photos
  5. Drill quarterly — a backup never restored is a hope