Networking is split between Docker-internal networks, Tailscale private access,
and CoreDNS private service naming.
Each stack owns an internal backend network:
core_backend core service traffic
observability_backend observability service traffic
llm_backend LiteLLM, Langfuse, and LLM Postgres traffic
Cross-stack service discovery uses:
infra_shared_backend
This shared network is external and must exist before stack startup.
Production private access is through Tailscale.
LLM HTTP services are reached through private NGINX:
LiteLLM http://litellm.victus.io
Langfuse http://langfuse.victus.io
Production does not publish LiteLLM or Langfuse service ports directly. NGINX
binds to the configured Tailscale IP and proxies to the services over
infra_shared_backend.
CoreDNS owns private DNS for the victus.io zone.
The core stack provides DNS-backed service names for private infrastructure
consumers. DNS target IP is derived from runtime configuration.
LLM private names:
litellm.victus.io <TAILSCALE_IPV4>
langfuse.victus.io <TAILSCALE_IPV4>
llm stack.