---
id: platform-network
area: platform
level: 3
title: "Artefact — Network layout and remote access"
claim: "A private mesh and SSH everywhere · services bound to loopback · and one public listener at the edge terminating TLS for the sites that are allowed to be seen."
confidence: running
period: "2020–"
tech: [Tailscale, SSH, Caddy, DNS, Termux]
metrics: [{label: "public listeners per service", value: 1}]
artefacts: []
public: true
last_verified: 2026-10-26
tags: [platform, networking, security, artefact]
---

The diagram below shows three hosts and one trust boundary; internal addresses, hostnames and public DNS names are generalised, not published.

## What the artefact is

The layout: hosts on a private mesh for remote access, SSH on every machine, a phone used as a terminal, and an edge host that terminates TLS and proxies to loopback-bound services. New services bind to loopback by default; making something public is an explicit edge change, not a side effect of starting a container.

## What it proves

Security posture chosen rather than inherited: no service is reachable because it happened to bind to all interfaces, and there is exactly one place where the outside world meets the estate.

## The layout

![Three hosts side by side. A build workstation hands a release to the runtime host, which runs the site, the vector store, a workflow worker and the model gateway inside a loopback trust boundary; the public edge terminates TLS and is the only host the internet can reach. All three join one private mesh, and backups run in three tiers.](../../assets/diagrams/homelab-topology.svg)

Read it left to right: work is built on one machine, runs on a memory-bound machine with every service bound to loopback, and is published by a single edge that terminates TLS. The dashed boundary is the point of the whole arrangement — crossing it is a deliberate change to the edge configuration, not a side effect of starting a container. Below both, the mesh carries remote access and the second backup tier, so neither depends on a port being open.

## When it is delivered

Delivered. Internal addressing, hostnames and public DNS names are excluded from publication by the redaction pass.