digraph {
  compound=true;
  fontname="arial";
  rankdir=LR;
  splines="compound";
  newrank=true;

  node [
    color="#d3edea",
    fontname="arial",
    fontname="",
    fontsize=12,
    margin="0.22,0.110",
    shape=box, 
    style=filled
  ];

  edge [
    minlen=2
  ];

  subgraph cluster_home {
    label="LAN";

    router [ label="router" labelloc=c ];

    subgraph cluster_zero_day {
      label="zer0-daY host"

      subgraph cluster_lxc_zero_day {
	label="Incus containers"
        rank=same;

        influxdb_zero_day [ label="influxdb" labelloc=c ];
        unbound_zero_day [ label="unbound\n(ad-blocker)" labelloc=c ];
      }

      resolv_conf_zero_day [ label="resolv.conf" labelloc=c ];
      dnsmasq_zero_day [ label="Incus dnsmasq" labelloc=c ];
      dnsmasq_zero_day -> resolv_conf_zero_day -> unbound_zero_day

      influxdb_zero_day -> dnsmasq_zero_day
    }

    subgraph cluster_xps {
      label="xps host"

      dnsmasq_xps [ label="Incus dnsmasq" labelloc=c ];
      resolv_conf [ label="resolv.conf" labelloc=c ];

      subgraph cluster_lxc_xps {
        label="Incus containers"

        etc_xps [ label="..." labelloc=c ];
        qutebrowser [ label="qutebrowser" labelloc=c ];
      }
    
      qutebrowser -> dnsmasq_xps
      etc_xps -> dnsmasq_xps

      dnsmasq_xps -> resolv_conf
      resolv_conf -> unbound_zero_day
    }

    unbound_zero_day -> router [ dir="both" ];
  }

  subgraph cluster_linode {
    label="VPS"

    unbound_linode [ label="unbound" labelloc=c ];
    dnsmasq_incus_linode [ label="Incus dnsmasq" labelloc=c ];
    dnsmasq_linode [ label="dnsmasq" labelloc=c ];
    resolv_conf_linode [ label="resolv.conf"  labelloc=c ];

    subgraph cluster_linode_lxc {
      label="Incus containers"

      etc_linode [ label="..." labelloc=c ];
      blog [ label="blog" labelloc=c ];
    }

    etc_linode -> dnsmasq_incus_linode
    blog -> dnsmasq_incus_linode

    dnsmasq_incus_linode -> resolv_conf_linode -> dnsmasq_linode
    dnsmasq_incus_linode -> strongswan [ label="internal.home" ]

    dnsmasq_linode -> dnsmasq_incus_linode [ label="lxc.chromic.org" ]
    dnsmasq_linode -> strongswan [ label="internal.home" ]

    strongswan [label="strongswan" labelloc=c ];
  }

  router -> strongswan [ label="All traffic" ];
  strongswan -> router [ label="internal.home" ];

  strongswan -> unbound_linode

  roots [ label="dns roots" localloc=c ];
  linode_dns [ label="linode dns" localloc=c ];

  unbound_linode -> roots
  dnsmasq_linode -> linode_dns
}