Skip to content

# Connection Hosts — nuclide.systems

Maintained reference for every host, LAN address, port, and public URL. Last verified: 2026-05-23.

> Source of truth: `ct-inventory.md` (guests) · `portmap.md` (Docker ports) · `homelab-architecture.md` (topology).

## Network infrastructure

Device | LAN IP | Admin UI | Notes
--- | --- | --- | ---
UDM Home (UCG Fiber, UniFi OS 5.0.16) | `192.168.1.1` | `https://192.168.1.1` (SSO + MFA) | Gateway, DNS forwarder → AdGuard; port-forwards 80/443 → Zoraxy (`.4`), 15001 TCP/UDP → CT 104
D-Link DGS-1210-28P | `192.168.1.10` | `http://192.168.1.10` (HTTP-only, pw: `tapirnase`) | 28-port PoE switch — physical core. UDM on port 26, CT 104 cluster on port 10, APs on ports 3 & 16. SNTP fixed 2026-05-19.
UNAS Pro (NFS server) | `192.168.1.31` | `http://192.168.1.31` | NFSv3 export: `192.168.1.31:/var/nfs/shared/storage` (→ `/mnt/pve/unas`). ~19 T bulk storage.
UniFi U7 APs | `.50` `.51` `.52` `.53` | via UDM | Hallway, In-wall, Bedroom (Schlafzimmer), Dining (Esszimmer). SSID: `nuclide`, WPA2/WPA3.
TP-Link RE700X | `192.168.1.187` | `http://192.168.1.187` | WiFi extender — NATs devices behind it (3D printer `.189` invisible to UniFi).

## Proxmox VE host — `nuc`

| Value
--- | ---
IP | `192.168.1.20`
Admin UI | `https://192.168.1.20:8006` (OIDC via Pocket-ID client `38469e7e`)
SSH | `ssh root@192.168.1.20` (key auth)
Hardware | Intel Core Ultra 7 155H · 22 threads · 64 GiB RAM · PVE 9.1.11
Storage | `local-zfs` ~1.9 T (NVMe), `local` (dir), `unas` (NFS ~19 T)
API token | `root@pam!mcp` (PVEAuditor role, read-only)

## LXC / VM guests

### VM 100 — `haos` (Home Assistant OS)

| Value
--- | ---
IP | `192.168.1.60` (DHCP, stable)
HA UI | `https://ha.nuclide.systems` → `192.168.1.60:8123`
SSH | `ssh root@192.168.1.60` (key installed manually in HA terminal)
OCPP | `https://ocpp.nuclide.systems` → `192.168.1.60:8887`
HA-MCP add-on | `http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ` (gateway upstream, no TLS)
Specs | 4c / 16 GiB (balloon 4 GiB) / 32 GiB; USB Zigbee dongle passed through

### CT 101 — `shepard`

| Value
--- | ---
IP | `192.168.1.49`
SSH | `ssh root@192.168.1.49`
Public | `https://shepard.nuclide.systems` (Caddy → `:80`) · `https://shepard-api.nuclide.systems` (→ `:8080`)
MCP | `https://shepard.nuclide.systems/v2/mcp` (Bearer `${SHEPARD_API_KEY}`)
Specs | 12c / 32 GiB / 500 GiB + NFS; Intel iGPU (card+render)
Stack | Caddy, Shepard frontend/backend, Keycloak, Mongo, Neo4j, TimescaleDB

### CT 102 — `dns` (AdGuard Home)

| Value
--- | ---
IP | `192.168.1.2`
SSH | `ssh root@192.168.1.2`
Admin UI | `http://192.168.1.2` (port 80)
DNS | `192.168.1.2:53` — LAN resolver (UDM forwards all DNS here)
Specs | 2c / 1 GiB / 4 GiB

### CT 103 — `backrest`

| Value
--- | ---
IP | `192.168.1.3`
SSH | `ssh root@192.168.1.3`
UI | `http://192.168.1.3:9898` (LAN-only, no auth)
Specs | 1c / 512 MiB / 8 GiB + NFS (`/mnt/pve/unas`)
Notes | JottaCloud offsite via rclone; repos `services-repo` + `media-repo`

### CT 104 — `docker` (main Docker host)

| Value
--- | ---
IP | `192.168.1.40`
SSH | `ssh root@192.168.1.40`
Specs | 16c / 48 GiB / 200 GiB + NFS; Intel Arc iGPU (card+render)
Role | ~65 containers across ~23 compose stacks in `/opt/stacks/`

See Docker services table below for all ports.

### CT 105 — `nextcloud`

| Value
--- | ---
IP | `192.168.1.41`
SSH | `ssh root@192.168.1.41`
Public | `https://nc.nuclide.systems` → `192.168.1.41:11000`
Specs | 4c / 8 GiB / 100 GiB + NFS (migrated to NFSv3 2026-05-22)
Auth | Pocket-ID OIDC (client `a14b8076`)

### CT 108 — `zoraxy` (reverse proxy)

| Value
--- | ---
IP | `192.168.1.4`
SSH | `ssh root@192.168.1.4`
Admin UI | `http://192.168.1.4:8000` (LAN only)
Specs | 2c / 2 GiB / 6 GiB
Cert | Wildcard `*.nuclide.systems` (ACME via Let's Encrypt)
Config | `proxy/zoraxy/routes.json` → `scripts/zoraxy_sync.py --apply`

### CT 110 — `id` (Pocket-ID OIDC)

| Value
--- | ---
IP | `192.168.1.5`
SSH | `ssh root@192.168.1.5`
Public | `https://id.nuclide.systems` → `192.168.1.5:11000`
Specs | 1c / 1 GiB / 4 GiB
OIDC endpoints | Authorization: `https://id.nuclide.systems/authorize` · Token: `https://id.nuclide.systems/api/oidc/token` · Userinfo: `https://id.nuclide.systems/api/oidc/userinfo` · Discovery: `https://id.nuclide.systems/.well-known/openid-configuration`

### CT 111 — `dev` (Coder + Gitea)

| Value
--- | ---
IP | `192.168.1.42`
SSH | `ssh root@192.168.1.42`
Specs | 12c / 32 GiB / 60 GiB + NFS; Intel Arc iGPU (render)

Port | Service | Public URL
--- | --- | ---
7080 | Coder | `https://dev.nuclide.systems`
3000 | Gitea | `https://git.nuclide.systems`
222 | Gitea SSH | `ssh -p 222 git@git.nuclide.systems`
13080 | docs site | `http://192.168.1.42:13080` (LAN; mkdocs Material, auto-rebuild every 5 min)
internal | act-runner | — (`ct111-runner` Gitea Actions)

### CT 112 — `secrets` (Infisical)

| Value
--- | ---
IP | `192.168.1.7`
SSH | `ssh root@192.168.1.7`
UI + API | `http://192.168.1.7:8200` (LAN-only — no Zoraxy route; must not be internet-exposed)
Specs | 2c / 4 GiB / 20 GiB
Stack | `/opt/stacks/infisical/` — Infisical + Postgres 16 + Redis 7 (all internal, no external ports)

### CT 113 — `db` (shared Postgres)

| Value
--- | ---
IP | `192.168.1.6`
SSH | `ssh root@192.168.1.6`
Specs | 2c / 4 GiB / 40 GiB

Port | Service | Access
--- | --- | ---
5432 | Postgres 17 | LAN: `192.168.1.6:5432` — tenants: LiteLLM, paperless, memos, n8n (reverted), Vaultwarden
5050 | pgAdmin 4 | `http://192.168.1.6:5050` (LAN only, no Zoraxy route)

## Docker services — CT 104

All on `192.168.1.40` unless noted. Zoraxy (`192.168.1.4`) terminates TLS for public URLs.

### Infrastructure (10000–10999)

Port | Container | Public URL | Notes
--- | --- | --- | ---
10000 | `homepage` | — | Dashboard (LAN only)
10001 | `dozzle` | `https://dozzle.nuclide.systems` | Log viewer
10002 | `arcane` | `https://arcane.nuclide.systems` | Web IDE (OIDC `81cf4ed0`)
10003 | `gotify` | `https://gotify.nuclide.systems` | Push notifications
10004 | `garage` | `https://s3.nuclide.systems` | S3 API (Garage); internal: `http://garage:3900`
10005 (localhost) | `garage` admin | — | Localhost only

### Security & Auth (11000–11999)

Port | Container | Public URL | Notes
--- | --- | --- | ---
11001 | `vaultwarden` | `https://vault.nuclide.systems` | Password manager (OIDC client created, SSO not yet wired)

### Media — Immich (12000–12999)

Port | Container | Public URL | Notes
--- | --- | --- | ---
12000 | `immich_server` | `https://immich.nuclide.systems` | Photos/videos (OIDC `9c91c18b`)
internal | `immich_power_tools` | `https://immich-tools.nuclide.systems` | Container-internal :3000, Zoraxy proxy

### Media — Downloads / Arr (13000–13999)

All behind `vpn_gluetun` container network.

Port | Container | Public URL | Notes
--- | --- | --- | ---
13001 | `rdtclient` | — | LAN only
13002 | `prowlarr` | — | LAN only
13003 | `audiobookshelf` | `https://abs.nuclide.systems` | OIDC `cbbf20d5`
13004 | `shelfarr` | — | LAN only (OIDC `d8733fcc`)
13005 | `flaresolverr` | — | Internal only
30000 | `vpn_gluetun` | — | VPN HTTP control API

### AI Stack (14000–14999, 8080, 18xxx)

Port | Container | Public URL | Notes
--- | --- | --- | ---
14000 | `litellm` | — | LLM proxy (internal only: `http://litellm:4000`); master key: `sk-tapirnase`
14001 | `lobehub` | `https://chat.nuclide.systems` | Chat UI (OIDC `26f3c26b`)
14002 | `qdrant_scientific` | — | Vector DB (LAN/internal only)
14003 | `bifrost` | `https://ai.nuclide.systems` | LLM+MCP gateway; `/mcp` = MCP endpoint (29 clients, ~760 tools); master key: `sk-tapirnase`
~~8080~~ | ~~`mcp-gateway`~~ | ~~`https://mcp.nuclide.systems`~~ | DECOMMISSIONED 2026-05-26 — see mcp-gateway.md
18002 | `comfyui` | — | Image gen (Intel Arc); LAN only
18003 | `comfyui-mcp` | via Bifrost `comfyui` client | FastMCP
18005 | `docling-mcp` | via Bifrost `docling` client | PDF→Markdown
18007 | `kroki-mcp` | via Bifrost `kroki` client | Diagram rendering
18009 | `speaches` | — | TTS/STT; LAN only
18011 | `upload-artifact-mcp` | via Bifrost `upload_artifact` client | S3 artifact upload
internal | `searxng` | — | `shared_backend`; used by LobeChat

### Documents (15000–15999)

Port | Container | Public URL | Notes
--- | --- | --- | ---
15000 | `traccar` | `https://traccar.nuclide.systems` | GPS tracking UI
15001 | `traccar` | — | TCP+UDP watch protocol (forwarded at UDM level)
15002 | `paperless-ai` | `https://paperless-ai.nuclide.systems` | Internal-only Zoraxy policy
15003 | `paperless-ngx-webserver-1` | `https://paperless.nuclide.systems` | Internal-only Zoraxy policy

### Automation (16000–16999)

Port | Container | Public URL | Notes
--- | --- | --- | ---
16000 | `n8n` | `https://n8n.nuclide.systems` | Workflow automation (OIDC `33135ad4`); SQLite local disk

### Notes & Bookmarks (17000–17999)

Port | Container | Public URL | Notes
--- | --- | --- | ---
17000 | `memos` | `https://memos.nuclide.systems` | Notes (OIDC `62bf4e0d`)
17001 | `karakeep` | `https://hoarder.nuclide.systems` | Bookmarks (OIDC `d92f82b0`)

### Storage Admin (20000–20999)

Port | Container | Notes
--- | --- | ---
20010 (localhost) | `pgadmin` | shared-db pgAdmin, localhost only on CT 104

## External hardware

### QNAP UNAS Pro — NFS/SMB server

| Value
--- | ---
IP | `192.168.1.31`
Admin UI | `http://192.168.1.31`
NFS export | `192.168.1.31:/var/nfs/shared/storage` (NFSv3 only; v4 not available)
CIFS | `//192.168.1.31/storage` (used by Nextcloud CT 105 only)

### QNAP TS-251D — Klipper 3D printer host

| Value
--- | ---
IP | `192.168.1.189` (behind TP-Link RE700X at `.187`)
Mainsail | `http://192.168.1.189:80`
Moonraker | `http://192.168.1.189:7125`
Notes | Klipper config backed up daily to `git.nuclide.systems/fkrebs/klipper-config` via cron

## OIDC clients — Pocket-ID (`id.nuclide.systems`)

Client ID | Service | Redirect URI
--- | --- | ---
~~`e73bb7b9`~~ | ~~litellm / mcp-gateway~~ | DELETED 2026-05-26
`26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc`
`81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback`
`33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback`
`9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile
`62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback`
`d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom`
`a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code`
`0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback`
`9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback`
`38469e7e` | Proxmox VE | `https://192.168.1.20:8006`
`cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*`
`d8733fcc` | shelfarr | `*`
~~`78c78998`~~ | ~~Claude MCP (legacy)~~ | DELETED 2026-05-26
`82ca2d53` | nuc-ai (MCP spawned servers) | (empty)
`7fe1a14b` | zoraxy | (empty)
(new) | vaultwarden | `https://vault.nuclide.systems/auth/callback` — SSO not yet wired
~~798a367f~~ | ~~daytona~~ | DECOMMISSIONED — remove from Pocket-ID

## Quick-reference — all public URLs

URL | Backend | Service
--- | --- | ---
`https://ai.nuclide.systems` | `192.168.1.40:14003` | Bifrost (LLM+MCP gateway) — `/mcp` for MCP tools
`https://chat.nuclide.systems` | `192.168.1.40:14001` | LobeChat
~~`https://mcp.nuclide.systems`~~ | ~~`192.168.1.40:8080`~~ | DECOMMISSIONED 2026-05-26
`https://id.nuclide.systems` | `192.168.1.5:11000` | Pocket-ID (OIDC)
`https://nc.nuclide.systems` | `192.168.1.41:11000` | Nextcloud
`https://ha.nuclide.systems` | `192.168.1.60:8123` | Home Assistant
`https://ocpp.nuclide.systems` | `192.168.1.60:8887` | EV charger OCPP
`https://shepard.nuclide.systems` | `192.168.1.49:80` | Shepard
`https://shepard-api.nuclide.systems` | `192.168.1.49:8080` | Shepard API
`https://dev.nuclide.systems` | `192.168.1.42:7080` | Coder
`https://git.nuclide.systems` | `192.168.1.42:3000` | Gitea
`https://arcane.nuclide.systems` | `192.168.1.40:10002` | Arcane
`https://dozzle.nuclide.systems` | `192.168.1.40:10001` | Dozzle (logs)
`https://gotify.nuclide.systems` | `192.168.1.40:10003` | Gotify
`https://s3.nuclide.systems` | `192.168.1.40:10004` | Garage S3
`https://vault.nuclide.systems` | `192.168.1.40:11001` | Vaultwarden
`https://immich.nuclide.systems` | `192.168.1.40:12000` | Immich
`https://immich-tools.nuclide.systems` | `192.168.1.40` (internal) | Immich Power Tools
`https://abs.nuclide.systems` | `192.168.1.40:13003` | Audiobookshelf
`https://n8n.nuclide.systems` | `192.168.1.40:16000` | n8n
`https://memos.nuclide.systems` | `192.168.1.40:17000` | Memos
`https://hoarder.nuclide.systems` | `192.168.1.40:17001` | Karakeep
`https://traccar.nuclide.systems` | `192.168.1.40:15000` | Traccar
`https://paperless.nuclide.systems` | `192.168.1.40:15003` | Paperless-ngx (internal-only policy)
`https://paperless-ai.nuclide.systems` | `192.168.1.40:15002` | Paperless AI (internal-only policy)

Not publicly proxied (LAN/localhost only): pgAdmin, ComfyUI, Qdrant, RDTClient, Prowlarr, ShelfArr, Flaresolverr, Speaches, AdGuard admin, Backrest UI, Infisical.

## SSH cheat-sheet

    ssh root@192.168.1.20   # PVE host (nuc)
    ssh root@192.168.1.40   # CT 104 docker
    ssh root@192.168.1.41   # CT 105 nextcloud
    ssh root@192.168.1.42   # CT 111 dev
    ssh root@192.168.1.49   # CT 101 shepard
    ssh root@192.168.1.2    # CT 102 dns (AdGuard)
    ssh root@192.168.1.3    # CT 103 backrest
    ssh root@192.168.1.4    # CT 108 zoraxy
    ssh root@192.168.1.5    # CT 110 id (Pocket-ID)
    ssh root@192.168.1.6    # CT 113 db (Postgres)
    ssh root@192.168.1.7    # CT 112 secrets (Infisical)
    ssh root@192.168.1.60   # VM 100 haos (Home Assistant — key must be installed manually)
    ssh -p 222 git@git.nuclide.systems  # Gitea SSH

All LXCs reachable from `nuc` host via root key. Use `pct exec <id> -- bash` for console access without SSH.