---
created: 2026-07-30
modified: 2026-07-30
type: note
tags:
  - network
  - dev-ops
aliases: []
---

# Home Network Map

## Overview

| Network | Router/Gateway |
|---------|---------------|
| Subnet | `192.168.20.0/24` |
| Gateway | `192.168.20.1` |
| DNS | Pi-hole on .13 (primary) + .35 (secondary) |

---

## Machines

### .27 — sam-4screen-desktop (Main Desktop)

| Property | Value |
|----------|-------|
| **IP** | `192.168.20.27` |
| **Hostname** | `sam-4screen-desktop` |
| **OS** | NixOS |
| **SSH** | ✅ `sam@192.168.20.27` |
| **Tailscale** | ✅ `100.65.228.31` (sam-4screen-desktop-1) |
| **Role** | Daily driver. 4 monitors, 62GB RAM, Nvidia GPU. Zellij, Neovim, pi coding agent. |
| **Key services** | pi, pi-dashboard, Neovim, Zellij (with falcode + attention plugins), Home Manager managed |

### .13 — nixos-desktop (Server)

| Property | Value |
|----------|-------|
| **IP** | `192.168.20.13` |
| **Hostname** | `nixos-desktop` |
| **OS** | NixOS |
| **SSH** | ✅ `sam@192.168.20.13` |
| **Tailscale** | ✅ `100.114.62.46` (nixos-desktop) |
| **Role** | Docker host, OmniRoute LLM proxy, always-on server. 15.5GB RAM. |

| Docker containers | |
|---|---|
| **OmniRoute** | LLM proxy with combo routing (port 20128/20129). All pi LLM traffic routes through it. Combo `default-opencode-go-ds-flash` prioritises OpenCode-Go before falling through OpenRouter → DeepSeek direct → Google Gemini. See [[Pi Agent Extensions & Skills#OmniRoute — LLM Provider Router]] |
| **worldmonitor** | Geopolitical news dashboard (port 3002) |
| **mosquitto** | MQTT broker |
| **pihole** | DNS ad-blocking (primary) |
| **nebula-sync** | Pi-hole Gravity sync |
| **headroom** | Context compression proxy (port 8787) |
| **engram** | Journaling service (port 7437) |
| **n8n** | Workflow automation |
| **voice_bridge + voice_whisper** | MQTT audio bridge |
| **piper_tts** | Text-to-speech |
| **Plus:** pocketbase, doorbell_media, litellm, langfuse, airflow, trigger_dev, garage, t3_stack_react, sams-home-network | |

See [[Docker Containers]] for full container list.

### .51 — sam-thinkpad (Laptop)

| Property | Value |
|----------|-------|
| **IP** | `192.168.20.51` |
| **Hostname** | `sam-thinkpad` |
| **OS** | NixOS |
| **SSH** | ✅ `sam@192.168.20.51` |
| **Tailscale** | ✅ `100.88.161.102` (sam-thinkpad) |
| **Role** | Portable laptop. Used on-the-go and at home. pi, Neovim, Home Manager managed. |

### .35 — caddy-server (Reverse Proxy)

| Property | Value |
|----------|-------|
| **IP** | `192.168.20.35` |
| **Hostname** | `caddy-server` |
| **OS** | Ubuntu Server |
| **SSH** | ✅ `sam@192.168.20.35` |
| **Tailscale** | Not installed |
| **Role** | Caddy reverse proxy. Runs ~50 Docker containers (apps, dashboards, media, monitoring). |

**Proxied domains:**
| Domain | Proxied to |
|--------|-----------|
| `omniroute.lab.audasmedia.com.au` | `.13:20129` |
| `omniroute.home.lab` | `.13:20129` |
| `worldmonitor.lab.audasmedia.com.au` | `.13:3002` |
| `worldmonitor.home.lab` | `.13:3002` |

See [[Docker Containers]] for full container list on .35.

### .150 — Phone (Android)

| Property | Value |
|----------|-------|
| **IP** | `192.168.20.150` (static) |
| **Device** | Android phone |
| **SSH** | ✅ Termux → `ssh` from/to other machines (port 8022, user: `uO_a499`) |
| **Tailscale** | ✅ `100.101.49.17` (google-pixel-8a) |
| **Role** | Mobile access. Termux for SSH, Tailscale for remote, NTFY for notifications. |

---

## SSH Access Matrix

| From ↓ / To → | .27 desktop | .13 server | .51 laptop | .35 caddy | .150 phone |
|--------------|-------------|------------|------------|-----------|------------|
| **.27 desktop** | — | `sam@192.168.20.13` | `sam@192.168.20.51` | `sam@192.168.20.35` | `uO_a499@192.168.20.150:8022` |
| **.13 server** | `sam@192.168.20.27` | — | `sam@192.168.20.51` | `sam@192.168.20.35` | `uO_a499@192.168.20.150:8022` |
| **.51 laptop** | `sam@192.168.20.27` | `sam@192.168.20.13` | — | `sam@192.168.20.35` | `uO_a499@192.168.20.150:8022` |
| **.150 phone** | `sam@192.168.20.27` | `sam@192.168.20.13` | `sam@192.168.20.51` | `sam@192.168.20.35` | — (Termux local) |

**SSH config shortcut (`~/.ssh/config`):**
```text
Host phone
    HostName 192.168.20.150
    Port 8022
    User uO_a499
```

(Added to .27 and .51. .13 needs home.nix update — `~/.ssh/config` is a Nix store symlink.)

---

## Key Apps & Ports

| Port | Service | Machine |
|------|---------|---------|
| `22` | SSH | All |
| `53` | DNS (Pi-hole) | .13, .35 |
| `80/443` | Caddy reverse proxy | .35 |
| `1883` | MQTT (Mosquitto) | .13 |
| `3002` | worldmonitor | .13 |
| `8022` | SSH (Termux) | .150 phone |
| `8022` | SSH (Termux) | .150 phone |
| `20129` | OmniRoute API | .13 |
| `20128` | OmniRoute dashboard | .13 |
| `7437` | engram | .13 |
| `8787` | Headroom proxy | .13 |

---

## lan-mouse — Cross-Machine Mouse/Keyboard Sharing

| Detail | Value |
|--------|-------|
| **Version** | v0.10.0 (pre-encryption, from [GitHub releases](https://github.com/feschber/lan-mouse/releases/tag/v0.10.0)) |
| **Binary** | `~/.local/bin/lan-mouse` (same binary on all three) |
| **Service** | `~/.config/systemd/user/lan-mouse.service` (`systemctl --user start lan-mouse`) |
| **Config** | `~/.config/lan-mouse/config.toml` |
| **Port** | UDP 4242 |
| **Encryption** | None (plain UDP). v0.11.0 DTLS is broken between different NixOS builds. |

**Layout:** `.13 ← .27 → .51`
- .27: `[left] ips = ["192.168.20.13", "192.168.20.46"]` `.46` is .13's Wi-Fi — required.
- .27: `[right] ips = ["192.168.20.51"]`
- .13: `[right] ips = ["192.168.20.27"]`
- .51: `[left] ips = ["192.168.20.27"]`

**Startup flags:** `--daemon --capture-backend layer-shell`. On .13 also `--emulation-backend libei` (KDE).

**⚠️ Gotchas:**
- **Never use hostnames** — Tailscale resolves them to virtual IPs. Raw IPs only.
- **v0.11.0 will NOT work** — DTLS `Alert is Fatal or Close Notify` between different NixOS builds.
- **.13 needs both IPs** (wired `.13` + Wi-Fi `.46`) in every other machine's client list.
- **KDE (.13):** Accept the input emulation permission dialog on first run.

## Tailscale (Tailnet)

| Machine | Tailscale Name | Tailscale IP | Status |
|---------|---------------|-------------|--------|
| .27 desktop | sam-4screen-desktop-1 | `100.65.228.31` | ✅ Active |
| .13 server | nixos-desktop | `100.114.62.46` | ✅ Active |
| .51 laptop | sam-thinkpad | `100.88.161.102` | ✅ Active |
| .150 phone | google-pixel-8a | `100.101.49.17` | ⚠️ Offline (last seen 1d ago) |
| .35 caddy | — | — | ❌ Not installed |

Account: `samuelrolfe@gmail.com`

---

## DNS

| Server | IP | Role |
|--------|----|------|
| Pi-hole (primary) | `192.168.20.13` | DNS ad-blocking, local DNS for `.home.lab` domains |
| Pi-hole (secondary) | `192.168.20.35` | DNS ad-blocking, failover |

### Local domains needing DNS records

| Domain | Target | Status |
|--------|--------|--------|
| `omniroute.home.lab` | `.13:20128` | ✅ Created |
| `omniroute.lab.audasmedia.com.au` | `.35`→`.13:20129` | ✅ Caddy proxied |
| `worldmonitor.home.lab` | `.13:3002` | ❌ Needs Pi-hole record |
| `worldmonitor.lab.audasmedia.com.au` | `.35`→`.13:3002` | ❌ Needs DNS + Caddy done |