Skip to content

# Notes for agents working in /opt/stacks (CT 104 "docker")

Most stacks here are intentional and active. Two things deserve explicit awareness so no agent "helpfully" reverts them:

## Pocket-ID is gone from this CT (migrated 2026-05-20)

- Pocket-ID moved off CT 104 to dedicated CT 110 ("id", 192.168.1.5).
- The compose file `/opt/stacks/pocketid/docker-compose.yml` was deliberately renamed to `docker-compose.yml.MIGRATED-TO-CT110-2026-05-20` so accidental `docker compose up` in that directory is a no-op.
- The data dir `/opt/stacks/pocketid/data/` is a migration snapshot only. It is stale; authoritative writes happen on CT 110 since the cutover.
- Zoraxy upstream for `id.nuclide.systems` now points at `192.168.1.5:11000`.
- Do not restart, `compose up`, or re-deploy pocket-id here. If something appears broken in OIDC, investigate CT 110 instead. SSH/Console access via `pct enter 110` on the host, or `https://192.168.1.5:11000/`.

## Dormant stacks — defined but not running on purpose

Per the audit on 2026-05-20, the following stack directories exist but their containers are intentionally not running. Some are planned to move to CT 109 "observe" when that LXC is built; others are legacy experiments waiting on a decision:

- `/opt/stacks/arcane/` — Manager will move to CT 109; edge agent eventually deploys here
- `/opt/stacks/dozzle/` — UI will move to CT 109; agent eventually deploys here
- `/opt/stacks/homepage/` — replaced by Homarr on CT 109; can be removed once CT 109 lands
- `/opt/stacks/arr-stack/`, `streamio/`, `nexa/`, `qdrant/`, `proxy/`, `vpn/` — legacy experiments

Do not start these without checking with the operator first.

## MCP gateway leaves, MCP child containers stay (planned)

When CT 109 "observe" lands, `/opt/stacks/ai/mcp-gateway/` moves to CT 109 (it's a control plane: OIDC, agent scheduling, token store, usage stats). The ~20 MCP child server containers in this CT (`mcp-searxng`, `mcp-gotify`, `mcp-immich`, `mcp-fetch`, `mcp-time`, `comfyui-mcp`, `coder-mcp`, `kroki-mcp`, etc.) stay here on CT 104.

The migrated gateway will reach this CT's docker daemon over the planned docker-socket-proxy (see `/docs/proxmox-optimizations.md` §16). Until CT 109 exists, the gateway runs locally and uses the bind-mounted socket. Do not piecemeal-move the gateway; it's tied to the CT 109 build.

## What is safe to do here

- Anything to do with the actively-running ~65 containers (Immich, n8n, Karakeep, ComfyUI, Vaultwarden, Paperless, LobeChat, LiteLLM, MCP servers, etc.). Daytona was decommissioned 2026-05-20 — compose files renamed `.DECOMMISSIONED-2026-05-20`; do not restart.
- Image pulls + rebuilds for the active stacks (mind the n8n version pin — see its `docker-compose.yaml` comment).
- Rotate exposed secrets in `.env` files (compose YAMLs themselves are git-tracked).