docs: top-10 fixes (PORTMAP, storage truth, banners, AdGuard scrub, zoraxy UCI removed, CT 111 section, Daytona purge)

services/homelab-architecture.md

@@ -10,7 +10,7 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO,
   `rpool/data/subvol-104-disk-0`. Mounts the UNAS NFS at `/mnt/pve/unas`.
 - **Proxmox VE** — host **`192.168.1.20:8006`**, single node **`nuc`**
   (Intel Core Ultra 7 155H, 22 threads, 64G RAM, PVE 9.1.11). API access via
-  `root@pam!mcp` token (now `PVEAuditor`, read-only). **7 guests:**
+  `root@pam!mcp` token (now `PVEAuditor`, read-only). **9 guests (+ 2 planned)** — canonical roster in [`ct-inventory.md`](../ct-inventory.md):
   - `100` qemu **haos** — Home Assistant OS VM (4c/16G) → `.60`
   - `101` lxc **shepard** — secondary Docker host (12c/16G/107G) → `.49`
   - `102` lxc **dns** — **AdGuard Home** (network DNS + ad/tracker blocking,
@@ -22,6 +22,10 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO,
   - `104` lxc **docker** — **the primary `/opt/stacks` host** (16c/32G/215G) → `.40`
   - `105` lxc **nextcloud** — Nextcloud (4c/8G/107G) → `.41`
   - `108` lxc **zoraxy** — reverse proxy (2c/2G) → `.4`
+  - `110` lxc **id** — Pocket-ID OIDC IdP (1c/1G/4G) → `.5`; migrated off 104 on 2026-05-20
+  - `111` lxc **dev** — Coder + Gitea (12c/32G/60G) → `.42`; new 2026-05-20
+  - `109` lxc **observe** *(planned)* — Prometheus/Grafana/Arcane/Dozzle/Homarr/Tinyauth; see §16 of `infra/proxmox-state.md`
+  - `113` lxc **db** *(planned)* — shared Postgres + pgbouncer once second NVMe lands
   - Storages: `local` (dir), `local-zfs` (zfspool, ~1.9T), `unas` (nfs, ~20T).
 - **Ubiquiti UniFi** — UDM "Home" (UDMA6A8, UCG Fiber) gateway + 4× U7-series
   APs. Controller at **`https://192.168.1.1`** (UniFi OS 5.0.16, SSO + MFA
@@ -133,12 +137,12 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO,
 - **Auth** — **PocketID** (`id.nuclide.systems`, OIDC, SQLite) is the
   **universal SSO/IdP for the entire ecosystem** — effectively every service
   authenticates via PocketID OIDC (LiteLLM, LobeChat, MCP gateway, Nextcloud,
-  Daytona via the Keycloak→PocketID OIDC adapter, etc.). Single sign-on
-  everywhere; one identity source to secure/audit.
+  Coder, Gitea, Vaultwarden, etc.). Single sign-on everywhere; one identity
+  source to secure/audit. Vaultwarden remains the lone gap as of 2026-05-20.
 
 ## Docker networks
 `ai-internal` (AI/MCP plane) · `shared_backend` (cross-stack DB/S3) ·
-plus per-stack: `arr-stack_default`, `daytona-minimal_daytona-network`,
+plus per-stack: `arr-stack_default`,
 `immich_default`, `karakeep_default`, `homepage_default`, `vpn_default`.
 The MCP gateway bridges `ai-internal` + `shared_backend`.
 
@@ -176,12 +180,15 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
   `mcp-gateway/config.json` (servers), `agents.json` + `prompts/` (agents).
 - **MCP servers** (gateway-managed): time, home-assistant (exact_upstream to
   `.60` ha-mcp), kroki (self-hosted: kroki+mermaid+excalidraw companions),
-  daytona, fetch, sequential-thinking, ntfy, memos, docling, markitdown,
-  crawl4ai, context7, wikipedia, papersearch, comfyui, bluesky (brianellin,
-  rate-limit pending). Groups incl. `shepard-mcp`.
-- **Daytona** (`daytona.nuclide.systems`, daytona-minimal stack) — secure
-  code sandboxes (Agent Operator deep-dives, shepard). Registry fixed to
-  internal+host `:5000` (was misconfigured at 6000). Snapshot `sciviz-py`.
+  **coder** (replaced daytona 2026-05-20), fetch, sequential-thinking, ntfy, memos,
+  docling, markitdown, crawl4ai, context7, wikipedia, papersearch, comfyui,
+  bluesky (brianellin, rate-limit pending). Groups incl. `shepard-mcp`.
+  Gaps to close (community MCPs exist): gitea, paperless, karakeep, vaultwarden,
+  proxmox-ve, audiobookshelf. See [`services/mcp-gateway.md`](mcp-gateway.md).
+- **Coder** (`dev.nuclide.systems`, CT 111) — replaced Daytona as the sandbox /
+  dev-environment runtime. Templates: `python-uv` (persistent, GPU passthrough,
+  baked LiteLLM env + Claude Code), `mcp-sandbox` (ephemeral, sci stack
+  pre-baked). See [`services/dev-environment.md`](dev-environment.md).
 - **LobeChat** (`chat.nuclide.systems`, :14001) — chat UI; MCP plugins +
   agents in `lobechat` DB (lobe-postgres). Agents scriptable via
   `scripts/lobe_agent.py`. Native QStash scheduler NOT functional here →
@@ -199,7 +206,7 @@ The MCP gateway bridges `ai-internal` + `shared_backend`.
 ## Data layer
 - **shared-postgres** (pg16, `shared_backend`, data on local ZFS) — the
   **primary/standard DB for all deployments**. Tenants: LiteLLM, paperless,
-  daytona, **memos** (migrated 2026-05-19). Superuser
+  **memos** (migrated 2026-05-19), n8n (added 2026-05-19). Superuser
   `postgres` via unix socket; per-app dedicated role+db (role owns its db,
   password in the app stack's `.env`). Tuned 2026-05-19 (3G limit,
   shared_buffers 768M, max_conn 200).