docs: top-10 fixes (PORTMAP, storage truth, banners, AdGuard scrub, zoraxy UCI removed, CT 111 section, Daytona purge)
This commit is contained in:
@@ -5,7 +5,7 @@ AdGuard DNS at `192.168.1.2` can handle internal domain resolution, eliminating
|
||||
|
||||
## Current Setup
|
||||
- **AdGuard URL**: `http://192.168.1.2`
|
||||
- **Status**: Running on Proxmox VM 102
|
||||
- **Status**: Running on Proxmox **LXC 102** (`dns`, 192.168.1.2)
|
||||
- **Homepage widget**: Configured
|
||||
|
||||
## AI Service DNS Entries
|
||||
@@ -48,7 +48,8 @@ Add these static DNS entries in AdGuard to resolve AI services locally:
|
||||
# Get session token first
|
||||
curl -c /tmp/cookies.txt -k -X POST http://192.168.1.2:3000/ \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"username": "root", "password": "tapirnase"}'
|
||||
-d "{\"username\": \"root\", \"password\": \"${ADGUARD_PASSWORD}\"}"
|
||||
# Export ADGUARD_PASSWORD from your shell env or a `.env` file — never hardcode.
|
||||
|
||||
# Add static DNS entry
|
||||
curl -s -k -c /tmp/cookies.txt -b /tmp/cookies.txt \
|
||||
@@ -115,8 +116,8 @@ echo "✅ Done! Add these in AdGuard UI manually."
|
||||
- `pp-api.nuclide.systems` → `192.168.1.40:8000` (Paperless API)
|
||||
|
||||
### Home Assistant
|
||||
- `ha.nuclide.systems` → `192.168.1.10` (Home Assistant)
|
||||
- `homeassistant.local` → `192.168.1.10` (mDNS fallback)
|
||||
- `ha.nuclide.systems` → `192.168.1.60` (Home Assistant OS VM 100)
|
||||
- `homeassistant.local` → `192.168.1.60` (mDNS fallback)
|
||||
|
||||
## Internal DNS Server Setup
|
||||
|
||||
@@ -200,7 +201,7 @@ S3_ENDPOINT=https://s3.nuclide.systems
|
||||
|
||||
## Notes
|
||||
|
||||
- AdGuard runs on VM 102 at `192.168.1.2`
|
||||
- AdGuard runs on **LXC 102** at `192.168.1.2`
|
||||
- All AI services run on `192.168.1.40`
|
||||
- Using same IP for all domains is intentional (single endpoint)
|
||||
- SSL certs are issued by Zoraxy (public domain validation)
|
||||
|
||||
@@ -10,7 +10,7 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO,
|
||||
`rpool/data/subvol-104-disk-0`. Mounts the UNAS NFS at `/mnt/pve/unas`.
|
||||
- **Proxmox VE** — host **`192.168.1.20:8006`**, single node **`nuc`**
|
||||
(Intel Core Ultra 7 155H, 22 threads, 64G RAM, PVE 9.1.11). API access via
|
||||
`root@pam!mcp` token (now `PVEAuditor`, read-only). **7 guests:**
|
||||
`root@pam!mcp` token (now `PVEAuditor`, read-only). **9 guests (+ 2 planned)** — canonical roster in [`ct-inventory.md`](../ct-inventory.md):
|
||||
- `100` qemu **haos** — Home Assistant OS VM (4c/16G) → `.60`
|
||||
- `101` lxc **shepard** — secondary Docker host (12c/16G/107G) → `.49`
|
||||
- `102` lxc **dns** — **AdGuard Home** (network DNS + ad/tracker blocking,
|
||||
@@ -22,6 +22,10 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO,
|
||||
- `104` lxc **docker** — **the primary `/opt/stacks` host** (16c/32G/215G) → `.40`
|
||||
- `105` lxc **nextcloud** — Nextcloud (4c/8G/107G) → `.41`
|
||||
- `108` lxc **zoraxy** — reverse proxy (2c/2G) → `.4`
|
||||
- `110` lxc **id** — Pocket-ID OIDC IdP (1c/1G/4G) → `.5`; migrated off 104 on 2026-05-20
|
||||
- `111` lxc **dev** — Coder + Gitea (12c/32G/60G) → `.42`; new 2026-05-20
|
||||
- `109` lxc **observe** *(planned)* — Prometheus/Grafana/Arcane/Dozzle/Homarr/Tinyauth; see §16 of `infra/proxmox-state.md`
|
||||
- `113` lxc **db** *(planned)* — shared Postgres + pgbouncer once second NVMe lands
|
||||
- Storages: `local` (dir), `local-zfs` (zfspool, ~1.9T), `unas` (nfs, ~20T).
|
||||
- **Ubiquiti UniFi** — UDM "Home" (UDMA6A8, UCG Fiber) gateway + 4× U7-series
|
||||
APs. Controller at **`https://192.168.1.1`** (UniFi OS 5.0.16, SSO + MFA
|
||||
@@ -133,12 +137,12 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO,
|
||||
- **Auth** — **PocketID** (`id.nuclide.systems`, OIDC, SQLite) is the
|
||||
**universal SSO/IdP for the entire ecosystem** — effectively every service
|
||||
authenticates via PocketID OIDC (LiteLLM, LobeChat, MCP gateway, Nextcloud,
|
||||
Daytona via the Keycloak→PocketID OIDC adapter, etc.). Single sign-on
|
||||
everywhere; one identity source to secure/audit.
|
||||
Coder, Gitea, Vaultwarden, etc.). Single sign-on everywhere; one identity
|
||||
source to secure/audit. Vaultwarden remains the lone gap as of 2026-05-20.
|
||||
|
||||
## Docker networks
|
||||
`ai-internal` (AI/MCP plane) · `shared_backend` (cross-stack DB/S3) ·
|
||||
plus per-stack: `arr-stack_default`, `daytona-minimal_daytona-network`,
|
||||
plus per-stack: `arr-stack_default`,
|
||||
`immich_default`, `karakeep_default`, `homepage_default`, `vpn_default`.
|
||||
The MCP gateway bridges `ai-internal` + `shared_backend`.
|
||||
|
||||
@@ -176,12 +180,15 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
|
||||
`mcp-gateway/config.json` (servers), `agents.json` + `prompts/` (agents).
|
||||
- **MCP servers** (gateway-managed): time, home-assistant (exact_upstream to
|
||||
`.60` ha-mcp), kroki (self-hosted: kroki+mermaid+excalidraw companions),
|
||||
daytona, fetch, sequential-thinking, ntfy, memos, docling, markitdown,
|
||||
crawl4ai, context7, wikipedia, papersearch, comfyui, bluesky (brianellin,
|
||||
rate-limit pending). Groups incl. `shepard-mcp`.
|
||||
- **Daytona** (`daytona.nuclide.systems`, daytona-minimal stack) — secure
|
||||
code sandboxes (Agent Operator deep-dives, shepard). Registry fixed to
|
||||
internal+host `:5000` (was misconfigured at 6000). Snapshot `sciviz-py`.
|
||||
**coder** (replaced daytona 2026-05-20), fetch, sequential-thinking, ntfy, memos,
|
||||
docling, markitdown, crawl4ai, context7, wikipedia, papersearch, comfyui,
|
||||
bluesky (brianellin, rate-limit pending). Groups incl. `shepard-mcp`.
|
||||
Gaps to close (community MCPs exist): gitea, paperless, karakeep, vaultwarden,
|
||||
proxmox-ve, audiobookshelf. See [`services/mcp-gateway.md`](mcp-gateway.md).
|
||||
- **Coder** (`dev.nuclide.systems`, CT 111) — replaced Daytona as the sandbox /
|
||||
dev-environment runtime. Templates: `python-uv` (persistent, GPU passthrough,
|
||||
baked LiteLLM env + Claude Code), `mcp-sandbox` (ephemeral, sci stack
|
||||
pre-baked). See [`services/dev-environment.md`](dev-environment.md).
|
||||
- **LobeChat** (`chat.nuclide.systems`, :14001) — chat UI; MCP plugins +
|
||||
agents in `lobechat` DB (lobe-postgres). Agents scriptable via
|
||||
`scripts/lobe_agent.py`. Native QStash scheduler NOT functional here →
|
||||
@@ -199,7 +206,7 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
|
||||
## Data layer
|
||||
- **shared-postgres** (pg16, `shared_backend`, data on local ZFS) — the
|
||||
**primary/standard DB for all deployments**. Tenants: LiteLLM, paperless,
|
||||
daytona, **memos** (migrated 2026-05-19). Superuser
|
||||
**memos** (migrated 2026-05-19), n8n (added 2026-05-19). Superuser
|
||||
`postgres` via unix socket; per-app dedicated role+db (role owns its db,
|
||||
password in the app stack's `.env`). Tuned 2026-05-19 (3G limit,
|
||||
shared_buffers 768M, max_conn 200).
|
||||
|
||||
+5
-60
@@ -1,5 +1,8 @@
|
||||
# Zoraxy Reverse Proxy Setup Guide
|
||||
|
||||
> **Zoraxy is a Go-based reverse proxy + ACME daemon, running as a systemd service in LXC 108. It is NOT OpenWRT. Earlier docs referenced \`uci\` commands — those are removed; configuration is via the admin UI or by editing JSON config files in \`/opt/zoraxy/conf/proxy/\` and restarting \`systemctl restart zoraxy\`.**
|
||||
|
||||
|
||||
## Overview
|
||||
Configure reverse proxies for AI service endpoints with automatic SSL certificates.
|
||||
|
||||
@@ -12,7 +15,7 @@ Configure reverse proxies for AI service endpoints with automatic SSL certificat
|
||||
| MCP Gateway | `mcp.nuclide.systems` | `192.168.1.40` | `8080` |
|
||||
| Garage S3 | `s3.nuclide.systems` | `192.168.1.40` | `10004` |
|
||||
|
||||
## Option A: Web UI (Easiest - No SSH Required)
|
||||
## Method A — Zoraxy admin UI (recommended)
|
||||
|
||||
### Step 1: Access Zoraxy Panel
|
||||
```
|
||||
@@ -74,65 +77,7 @@ Click **"Save"** at the bottom of the page.
|
||||
- Wait 1-2 minutes for certificates to be issued
|
||||
- Visual indicator: Green padlock icon in the UI
|
||||
|
||||
## Option B: SSH/UCI (Automated - Requires Root Access)
|
||||
|
||||
### Prerequisites
|
||||
- SSH access to Zoraxy with root credentials
|
||||
- Command-line access to Zoraxy's UCI config system
|
||||
|
||||
### Step 1: SSH into Zoraxy
|
||||
```bash
|
||||
ssh root@192.168.1.4
|
||||
```
|
||||
|
||||
### Step 2: Configure via UCI
|
||||
Run this command directly on Zoraxy:
|
||||
|
||||
```bash
|
||||
# Apply all rewrite rules
|
||||
uci set network.rewrite_litellm.enable='1'
|
||||
uci set network.rewrite_litellm.domain='litellm.nuclide.systems'
|
||||
uci set network.rewrite_litellm.target_type='0'
|
||||
uci set network.rewrite_litellm.target='192.168.1.40:14000'
|
||||
uci set network.rewrite_litellm.ssl='1'
|
||||
uci set network.rewrite_litellm.hsts='1'
|
||||
|
||||
uci set network.rewrite_lobehub.enable='1'
|
||||
uci set network.rewrite_lobehub.domain='chat.nuclide.systems'
|
||||
uci set network.rewrite_lobehub.target_type='0'
|
||||
uci set network.rewrite_lobehub.target='192.168.1.40:14001'
|
||||
uci set network.rewrite_lobehub.ssl='1'
|
||||
uci set network.rewrite_lobehub.hsts='1'
|
||||
|
||||
uci set network.rewrite_mcp.enable='1'
|
||||
uci set network.rewrite_mcp.domain='mcp.nuclide.systems'
|
||||
uci set network.rewrite_mcp.target_type='0'
|
||||
uci set network.rewrite_mcp.target='192.168.1.40:8080'
|
||||
uci set network.rewrite_mcp.ssl='1'
|
||||
uci set network.rewrite_mcp.hsts='1'
|
||||
|
||||
uci set network.rewrite_garage.enable='1'
|
||||
uci set network.rewrite_garage.domain='s3.nuclide.systems'
|
||||
uci set network.rewrite_garage.target_type='0'
|
||||
uci set network.rewrite_garage.target='192.168.1.40:10004'
|
||||
uci set network.rewrite_garage.ssl='1'
|
||||
uci set network.rewrite_garage.hsts='1'
|
||||
|
||||
# Commit and restart
|
||||
uci commit network
|
||||
/etc/init.d/network restart
|
||||
```
|
||||
|
||||
### Step 3: Verify
|
||||
```bash
|
||||
# Check if rewrite rules are loaded
|
||||
uci show network.rewrite_*
|
||||
|
||||
# Test connectivity
|
||||
curl -I http://litellm.nuclide.systems
|
||||
```
|
||||
|
||||
## Option C: Automated Script (Local)
|
||||
## Method B — automation via scripts/zoraxy_sync.py
|
||||
|
||||
Run from the control node:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user