From 94137a2986c0e379f995aaab38b7839b8de156f8 Mon Sep 17 00:00:00 2001
From: DaystromMoira <skyerangerdelta+1@pldyn.net>
Date: Tue, 11 Aug 2026 11:50:47 +0000
Subject: [PATCH] docs(infra): add network topology

---
 infrastructure/network.md | 57 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 infrastructure/network.md

diff --git a/infrastructure/network.md b/infrastructure/network.md
new file mode 100644
index 0000000..0461637
--- /dev/null
+++ b/infrastructure/network.md
@@ -0,0 +1,57 @@
+# Network Topology
+
+**Last updated:** 2026-08-11
+
+## Overview
+
+The Daystrom Institute management network uses a flat `/24` subnet for all
+infrastructure nodes. External traffic enters via Unifi and is routed to the
+Traefik reverse proxy running on `impulse-controller`.
+
+## Subnets
+
+| Subnet | Purpose |
+|--------|---------|
+| 192.168.50.0/24 | Management / infrastructure |
+
+## Key Nodes
+
+| Hostname | IP | Role |
+|----------|----|------|
+| impulse-controller | 192.168.50.120 | Docker Swarm manager, Traefik ingress |
+
+## Ingress Architecture
+
+```
+Internet
+  │
+  ▼
+Unifi (external ingress)
+  │
+  ▼
+impulse-controller (192.168.50.120)
+  │
+  ▼
+Traefik v3 (reverse proxy / TLS termination)
+  │
+  ▼
+Swarm services (via master-proxy-overlay)
+```
+
+- **Reverse proxy:** Traefik v3 on `impulse-controller`
+- **Overlay network:** `master-proxy-overlay` — Traefik and Swarm services only
+- **Portainer UI:** https://192.168.50.120:9443
+- **External ingress handler:** Unifi → impulse-controller
+
+## TLS
+
+- Provider: Cloudflare DNS challenge
+- Managed by: Traefik (automatic cert issuance and renewal)
+- HTTP→HTTPS redirect enforced at the Traefik layer
+
+## Sharp Edges
+
+> **Docker NOT on `daystrom`** — `daystrom` is the Hermes host. Docker is not
+> installed there. All containerised workloads run on Swarm nodes
+> (`impulse-controller` and peers). Do not attempt to run `docker` commands
+> from `daystrom`.