Skip to content

RTFM · Networking

Saphira networking and self-hosting

A practical guide to putting Saphira, MailDragon and webDragon on a home network, business LAN, remote server, or connected set of sites.

Saphira Linux dragon mascot

Choose your starting point

A home server may sit behind an ISP router. A business installation may sit behind several routed VLANs and a dedicated edge firewall. A remote server may already have public addresses. A multi-site installation may join all of those places with a VPN. These are different topologies, not four sizes of the same router.

The common shape

Topology 
Internet
    │
    ├── edge router or firewall
    │       ├── public services: MailDragon, webDragon, HAProxy
    │       └── private services: management, databases, VPN
    │
    └── routed LANs, VLANs, Wi-Fi, and remote sites

The important question is not whether a service is at home or in a datacentre. It is which interface receives the traffic, which route carries it, and which firewall rule permits it.

Saphira can be more than an application host

With the appropriate packages and careful design, Saphira can be the network-services host or router itself: DHCP and DNS can serve local networks, RA and SLAAC can establish IPv6, Prefix Delegation can feed downstream LANs, OVS and VLANs can separate traffic, nftables can enforce policy, HAProxy can publish selected services, and WireGuard can connect private networks.

Do not enable forwarding, RA, DHCP, VPN, or public services by copying a command without first drawing the interfaces and deciding which networks should be allowed to talk. A useful network has explicit boundaries.