Last updated: 2026-05-31
Gateway: UniFi Dream Machine Beast (UDMEA4C) at 10.0.2.1
UniFi OS 5.1.11 — runs the UniFi Network controller, WireGuard VPN server, and the LAN DNS relay.
| Network | VLAN | Subnet | Purpose |
|---|---|---|---|
| Pitts LAN | native | 10.0.2.0/24 | Trusted devices and servers |
| Pitts Guest | 20 | 10.0.20.0/24 | Guest Wi-Fi (Mos Eisley Guest SSID) |
| Kellerman Cameras | 30 | 10.0.30.0/24 | Cameras only |
| Pitts IoT | 40 | 10.0.40.0/24 | IoT devices (DeviceDetentionCenter SSID) |
| Pitts Media Stack | 50 | 10.0.50.0/24 | VPN-routed torrent egress |
| WireGuard Server | — | 10.0.100.0/24 | Remote-user VPN |
| SSID | Network | Security | Notes |
|---|---|---|---|
| Kellermanjaro | Pitts LAN | WPA3, PMF required | Primary SSID |
| Led ZeppLAN | Pitts LAN | WPA2, PMF optional | Sonos-only; UAPSD off intentional |
| Mos Eisley Guest | Pitts Guest | WPA3, PMF optional | Guest access |
| DeviceDetentionCenter | Pitts IoT | WPA2 | IoT replacement for retired Pitts IoT |
| Device | IP |
|---|---|
| UDM Beast (gateway) | 10.0.2.1 |
| USW Pro XG 24 PoE | 10.0.2.2 |
| USW 24 PoE | 10.0.2.3 |
| TrueNAS Mnemosyne | 10.0.2.10 |
| proxmox1 | 10.0.2.11 |
| Home Assistant | 10.0.2.12 |
| proxmox2 | 10.0.2.13 |
| NPM + cloudflared (LXC 101) | 10.0.2.14 |
| Pi-hole (LXC 102) | 10.0.2.15 |
| MCP server (LXC 103) | 10.0.2.18 |
| Vaultwarden (LXC 104) | 10.0.2.17 |
| Argus (AI compute) | 10.0.2.19 |
| Media server | 10.0.2.21 |
| Wiki / homelab-ops | 10.0.2.23 |
| vpn-torrent | 10.0.50.10 |
| Enphase Envoy | 10.0.40.137 |
All devices use Pi-hole (10.0.2.15) as their DNS resolver — set as both DNS1 and DNS2 via DHCP on every VLAN. The UDM's own WAN DNS also points to Pi-hole.
Pi-hole is authoritative for pittsfamily.me. All subdomains resolve to NPM (10.0.2.14) locally rather than to Cloudflare's proxy IPs. See Pi-hole for the full DNS architecture including the HTTPS/SVCB record blocking that prevents browsers from using Cloudflare's IP hints.
Public internet access to homelab services goes through Cloudflare Tunnel — no port forwards exist on the UDM.
| Service | URL |
|---|---|
| Router (UniFi) | router.pittsfamily.me |
| NPM | npm.pittsfamily.me |
| Pi-hole | pihole.pittsfamily.me |
Port 80 and 443 are not forwarded on the UDM. WireGuard runs on the UDM itself (no forward needed). All public web traffic reaches backends via Cloudflare Tunnel. See Cloudflare Tunnel.