# Multi-Server Deployment with On-Demand Services

## Overview

This guide explains the **current multi-server architecture** where:
- **Core Server**: Handles external traffic (ports 80/443); runs DuckDNS, Traefik (multi-provider), Authelia
- **Additional Servers**: Run Sablier (lazy loading) with direct port exposure; no local Traefik
- **Manual Routing**: Core Traefik routes to IP:PORT combinations via YAML configuration files
- **Independent Management**: Each server manages its own containers with lazy loading

> **Note**: This document describes the current simplified architecture. Additional servers are "headless" - they expose ports directly without local reverse proxy.

## Architecture Diagram

```
┌─────────────────────────────────────────────────────────────────┐
│                    🌐 PUBLIC INTERNET                          │
│  HTTPS Traffic (Ports 80/443 forwarded from router)             │
└─────────────────────────────┬────┬──────────────────────────────┘
                              │    |
                     HTTP(S)  ▼       HTTPS
                              |    |
┌─────────────────────────────┼────┼──────────────────────────────┐
│  CORE SERVER                │    |                              │
|                             ▼                                   |
│  ┌───────────────┐       ┌──────────┐      ┌────────────────┐   │
│  │ Core Services │       │ Traefik  │      │ Local Services │   │
│  │   Authelia    │ ----  │          │ ---- │                │   │
│  │   DuckDNS     │       │          │      │                │   │
│  └───────────────┘       └────┬─────┘      └────────────────┘   │
│                               │                                 │
│                ┌──────────────┼────────────┐                    │
│                │  Routes:                  │                    │
│                │  • Local (labels)         │                    │
│                │  • Remote (YAML files)    │                    │
|                |                           |                    |
|                └──────────────┬────────────┘                    |
|                               |                                 |
└───────────────────────────────┼─────────────────────────────────┘
                                │
       HTTP (internal network)  │
       No SSL/TLS encryption    │
                                ▼
┌───────────────────────────────┼─────────────────────────────────┐
│  ADDITIONAL SERVER                                              │
|                                                                 |
│    ┌───────────────┐  ┌────────────────┐  ┌────────────────┐    │
│    │ Sablier       │  │ Your Apps      │  │ Dockge         |    |
│    │ lazy loading  │  │ expose ports   │  │                |    |
│    │               │  │                │  │                |    |
│    └───────────────┘  └────────────────┘  └────────────────┘    │
└─────────────────────────────────────────────────────────────────┘

```

### Traffic Flow Summary

1. **Internet → Core**: HTTPS (ports 80/443 forwarded from router)
2. **Core → Additional**: HTTP (internal network, no encryption needed)
3. **Additional → Core**: HTTP (direct response to core Traefik)

# Deployment Process

## Step 1: Deploy Core Server

On the core server, run `ez-homelab.sh`  
* Use Option 1 to Install Prerequisites
* Then Option 2 to Deploy Core Server

This deploys: DuckDNS, Traefik(core), Authelia, Dashboards & Infrastructure

From Dockge you can start/stop any of the stacks or containers.

**Port Forwarding**:
- Forward ports 80 & 443 from your router
- Only this server requires port forwarding

## Step 2: Deploy Additional Server

On the additional server, run `ez-homelab.sh`  
* Use Option 1 to Install Prerequisites
* Then Option 3 to Deploy Additional Server

This deploys: Sablier (lazy loading), Dashboards & Infrastructure

From Dockge you can start/stop any of the stacks or containers.

**No Port Forwarding Required**:
- Services are accessed through core server

## How It Works

### Traffic Flow

1. **User accesses** `https://sonarr.yourdomain.duckdns.org` (HTTPS from internet)
2. **Core Traefik** receives HTTPS request:
   - Checks Authelia for authentication (SSO)
   - Routes to additional server: `http://192.168.1.100:8989` (HTTP internally)
3. **Additional server** receives direct HTTP request:
   - Service container receives request on exposed port
   - If stopped, Sablier starts the container
   - Shows loading page while container starts
4. **Service responds** directly back to core Traefik via HTTP, then HTTPS to user

### Key Points

- **External Traffic**: Always HTTPS (SSL/TLS encrypted)
- **Internal Traffic**: Always HTTP (no encryption needed on local network)
- **No Double Encryption**: Core Traefik terminates SSL, forwards plain HTTP internally

### Service Registration

When you deploy an additional server:
1. Services are deployed with exposed ports (no Traefik labels)
2. Core server creates YAML route files pointing to IP:PORT
3. Core Traefik loads routes automatically
4. Services become accessible at `https://servicename.hostname.yourdomain.duckdns.org`

### Key Benefits

- **Simplified Architecture**: No local Traefik on additional servers
- **Direct Port Access**: Services expose ports directly (no reverse proxy overhead)
- **Centralized Access**: All services accessed through one domain
- **Unified SSO**: Authelia on core server protects all services
- **Local Lazy Loading**: Sablier manages containers on each server independently