Add connection-hosts and mcp-servers maintained docs

- infra/connection-hosts.md: every host, LAN IP, port, and public URL across all Proxmox guests, Docker services, network infra, and external hardware; OIDC client registry; SSH cheat-sheet - services/mcp-servers.md: all 27 MCP servers with full credentials, upstream URLs, transport, group, gateway management API examples, and gateway .env token inventory Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-23 01:03:59 +02:00
parent 396aa0e48e
commit 25da11b53a
2 changed files with 881 additions and 0 deletions
@@ -0,0 +1,348 @@
+# Connection Hosts — nuclide.systems
+
+Maintained reference for every host, LAN address, port, and public URL.
+**Last verified: 2026-05-23.**
+
+> Source of truth: [`ct-inventory.md`](../ct-inventory.md) (guests) · [`portmap.md`](portmap.md) (Docker ports) · [`homelab-architecture.md`](../services/homelab-architecture.md) (topology).
+
+---
+
+## Network infrastructure
+
+| Device | LAN IP | Admin UI | Notes |
+|---|---|---|---|
+| **UDM Home** (UCG Fiber, UniFi OS 5.0.16) | `192.168.1.1` | `https://192.168.1.1` (SSO + MFA) | Gateway, DNS forwarder → AdGuard; port-forwards 80/443 → Zoraxy (`.4`), 15001 TCP/UDP → CT 104 |
+| **D-Link DGS-1210-28P** | `192.168.1.10` | `http://192.168.1.10` (HTTP-only, pw: `tapirnase`) | 28-port PoE switch — physical core. UDM on port 26, CT 104 cluster on port 10, APs on ports 3 & 16. SNTP fixed 2026-05-19. |
+| **UNAS Pro** (NFS server) | `192.168.1.31` | `http://192.168.1.31` | NFSv3 export: `192.168.1.31:/var/nfs/shared/storage` (→ `/mnt/pve/unas`). ~19 T bulk storage. |
+| **UniFi U7 APs** | `.50` `.51` `.52` `.53` | via UDM | Hallway, In-wall, Bedroom (Schlafzimmer), Dining (Esszimmer). SSID: `nuclide`, WPA2/WPA3. |
+| **TP-Link RE700X** | `192.168.1.187` | `http://192.168.1.187` | WiFi extender — NATs devices behind it (3D printer `.189` invisible to UniFi). |
+
+---
+
+## Proxmox VE host — `nuc`
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.20` |
+| **Admin UI** | `https://192.168.1.20:8006` (OIDC via Pocket-ID client `38469e7e`) |
+| **SSH** | `ssh root@192.168.1.20` (key auth) |
+| **Hardware** | Intel Core Ultra 7 155H · 22 threads · 64 GiB RAM · PVE 9.1.11 |
+| **Storage** | `local-zfs` ~1.9 T (NVMe), `local` (dir), `unas` (NFS ~19 T) |
+| **API token** | `root@pam!mcp` (PVEAuditor role, read-only) |
+
+---
+
+## LXC / VM guests
+
+### VM 100 — `haos` (Home Assistant OS)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.60` (DHCP, stable) |
+| **HA UI** | `https://ha.nuclide.systems` → `192.168.1.60:8123` |
+| **SSH** | `ssh root@192.168.1.60` (key installed manually in HA terminal) |
+| **OCPP** | `https://ocpp.nuclide.systems` → `192.168.1.60:8887` |
+| **HA-MCP add-on** | `http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ` (gateway upstream, no TLS) |
+| **Specs** | 4c / 16 GiB (balloon 4 GiB) / 32 GiB; USB Zigbee dongle passed through |
+
+### CT 101 — `shepard`
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.49` |
+| **SSH** | `ssh root@192.168.1.49` |
+| **Public** | `https://shepard.nuclide.systems` (Caddy → `:80`) · `https://shepard-api.nuclide.systems` (→ `:8080`) |
+| **MCP** | `https://shepard.nuclide.systems/v2/mcp` (Bearer `${SHEPARD_API_KEY}`) |
+| **Specs** | 12c / 32 GiB / 500 GiB + NFS; Intel iGPU (card+render) |
+| **Stack** | Caddy, Shepard frontend/backend, Keycloak, Mongo, Neo4j, TimescaleDB |
+
+### CT 102 — `dns` (AdGuard Home)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.2` |
+| **SSH** | `ssh root@192.168.1.2` |
+| **Admin UI** | `http://192.168.1.2` (port 80) |
+| **DNS** | `192.168.1.2:53` — LAN resolver (UDM forwards all DNS here) |
+| **Specs** | 2c / 1 GiB / 4 GiB |
+
+### CT 103 — `backrest`
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.3` |
+| **SSH** | `ssh root@192.168.1.3` |
+| **UI** | `http://192.168.1.3:9898` (LAN-only, no auth) |
+| **Specs** | 1c / 512 MiB / 8 GiB + NFS (`/mnt/pve/unas`) |
+| **Notes** | JottaCloud offsite via rclone; repos `services-repo` + `media-repo` |
+
+### CT 104 — `docker` (main Docker host)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.40` |
+| **SSH** | `ssh root@192.168.1.40` |
+| **Specs** | 16c / 48 GiB / 200 GiB + NFS; Intel Arc iGPU (card+render) |
+| **Role** | ~65 containers across ~23 compose stacks in `/opt/stacks/` |
+
+See [Docker services table](#docker-services--ct-104) below for all ports.
+
+### CT 105 — `nextcloud`
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.41` |
+| **SSH** | `ssh root@192.168.1.41` |
+| **Public** | `https://nc.nuclide.systems` → `192.168.1.41:11000` |
+| **Specs** | 4c / 8 GiB / 100 GiB + NFS (migrated to NFSv3 2026-05-22) |
+| **Auth** | Pocket-ID OIDC (client `a14b8076`) |
+
+### CT 108 — `zoraxy` (reverse proxy)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.4` |
+| **SSH** | `ssh root@192.168.1.4` |
+| **Admin UI** | `http://192.168.1.4:8000` (LAN only) |
+| **Specs** | 2c / 2 GiB / 6 GiB |
+| **Cert** | Wildcard `*.nuclide.systems` (ACME via Let's Encrypt) |
+| **Config** | `proxy/zoraxy/routes.json` → `scripts/zoraxy_sync.py --apply` |
+
+### CT 110 — `id` (Pocket-ID OIDC)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.5` |
+| **SSH** | `ssh root@192.168.1.5` |
+| **Public** | `https://id.nuclide.systems` → `192.168.1.5:11000` |
+| **Specs** | 1c / 1 GiB / 4 GiB |
+| **OIDC endpoints** | Authorization: `https://id.nuclide.systems/authorize` · Token: `https://id.nuclide.systems/api/oidc/token` · Userinfo: `https://id.nuclide.systems/api/oidc/userinfo` · Discovery: `https://id.nuclide.systems/.well-known/openid-configuration` |
+
+### CT 111 — `dev` (Coder + Gitea)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.42` |
+| **SSH** | `ssh root@192.168.1.42` |
+| **Specs** | 12c / 32 GiB / 60 GiB + NFS; Intel Arc iGPU (render) |
+
+| Port | Service | Public URL |
+|---|---|---|
+| 7080 | Coder | `https://dev.nuclide.systems` |
+| 3000 | Gitea | `https://git.nuclide.systems` |
+| 222 | Gitea SSH | `ssh -p 222 git@git.nuclide.systems` |
+| 13080 | docs site | `http://192.168.1.42:13080` (LAN; mkdocs Material, auto-rebuild every 5 min) |
+| internal | act-runner | — (`ct111-runner` Gitea Actions) |
+
+### CT 112 — `secrets` (Infisical)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.7` |
+| **SSH** | `ssh root@192.168.1.7` |
+| **UI + API** | `http://192.168.1.7:8200` **(LAN-only — no Zoraxy route; must not be internet-exposed)** |
+| **Specs** | 2c / 4 GiB / 20 GiB |
+| **Stack** | `/opt/stacks/infisical/` — Infisical + Postgres 16 + Redis 7 (all internal, no external ports) |
+
+### CT 113 — `db` (shared Postgres)
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.6` |
+| **SSH** | `ssh root@192.168.1.6` |
+| **Specs** | 2c / 4 GiB / 40 GiB |
+
+| Port | Service | Access |
+|---|---|---|
+| 5432 | Postgres 17 | LAN: `192.168.1.6:5432` — tenants: LiteLLM, paperless, memos, n8n (reverted), Vaultwarden |
+| 5050 | pgAdmin 4 | `http://192.168.1.6:5050` (LAN only, no Zoraxy route) |
+
+---
+
+## Docker services — CT 104
+
+All on `192.168.1.40` unless noted. Zoraxy (`192.168.1.4`) terminates TLS for public URLs.
+
+### Infrastructure (10000–10999)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 10000 | `homepage` | — | Dashboard (LAN only) |
+| 10001 | `dozzle` | `https://dozzle.nuclide.systems` | Log viewer |
+| 10002 | `arcane` | `https://arcane.nuclide.systems` | Web IDE (OIDC `81cf4ed0`) |
+| 10003 | `gotify` | `https://gotify.nuclide.systems` | Push notifications |
+| 10004 | `garage` | `https://s3.nuclide.systems` | S3 API (Garage); internal: `http://garage:3900` |
+| 10005 (localhost) | `garage` admin | — | Localhost only |
+
+### Security & Auth (11000–11999)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 11001 | `vaultwarden` | `https://vault.nuclide.systems` | Password manager (OIDC client created, SSO not yet wired) |
+
+### Media — Immich (12000–12999)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 12000 | `immich_server` | `https://immich.nuclide.systems` | Photos/videos (OIDC `9c91c18b`) |
+| internal | `immich_power_tools` | `https://immich-tools.nuclide.systems` | Container-internal :3000, Zoraxy proxy |
+
+### Media — Downloads / Arr (13000–13999)
+
+All behind `vpn_gluetun` container network.
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 13001 | `rdtclient` | — | LAN only |
+| 13002 | `prowlarr` | — | LAN only |
+| 13003 | `audiobookshelf` | `https://abs.nuclide.systems` | OIDC `cbbf20d5` |
+| 13004 | `shelfarr` | — | LAN only (OIDC `d8733fcc`) |
+| 13005 | `flaresolverr` | — | Internal only |
+| 30000 | `vpn_gluetun` | — | VPN HTTP control API |
+
+### AI Stack (14000–14999, 8080, 18xxx)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 14000 | `litellm` | `https://ai.nuclide.systems` | LLM proxy; internal: `http://litellm:4000`; master key: `sk-tapirnase` |
+| 14001 | `lobehub` | `https://chat.nuclide.systems` | Chat UI (OIDC `26f3c26b`) |
+| 14002 | `qdrant_scientific` | — | Vector DB (LAN/internal only) |
+| 8080 | `mcp-gateway` | `https://mcp.nuclide.systems` | MCP gateway (OIDC `e73bb7b9`); API key: `JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA` |
+| 18002 | `comfyui` | — | Image gen (Intel Arc); LAN only |
+| 18003 | `comfyui-mcp` | via gateway `/comfyui/mcp` | FastMCP |
+| 18005 | `docling-mcp` | via gateway `/docling/mcp` | PDF→Markdown |
+| 18007 | `kroki-mcp` | via gateway `/kroki/mcp` | Diagram rendering |
+| 18009 | `speaches` | — | TTS/STT; LAN only |
+| 18011 | `upload-artifact-mcp` | via gateway `/upload-artifact/mcp` | S3 artifact upload |
+| internal | `searxng` | — | `shared_backend`; used by LobeChat |
+
+### Documents (15000–15999)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 15000 | `traccar` | `https://traccar.nuclide.systems` | GPS tracking UI |
+| 15001 | `traccar` | — | TCP+UDP watch protocol (forwarded at UDM level) |
+| 15002 | `paperless-ai` | `https://paperless-ai.nuclide.systems` | Internal-only Zoraxy policy |
+| 15003 | `paperless-ngx-webserver-1` | `https://paperless.nuclide.systems` | Internal-only Zoraxy policy |
+
+### Automation (16000–16999)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 16000 | `n8n` | `https://n8n.nuclide.systems` | Workflow automation (OIDC `33135ad4`); SQLite local disk |
+
+### Notes & Bookmarks (17000–17999)
+
+| Port | Container | Public URL | Notes |
+|---|---|---|---|
+| 17000 | `memos` | `https://memos.nuclide.systems` | Notes (OIDC `62bf4e0d`) |
+| 17001 | `karakeep` | `https://hoarder.nuclide.systems` | Bookmarks (OIDC `d92f82b0`) |
+
+### Storage Admin (20000–20999)
+
+| Port | Container | Notes |
+|---|---|---|
+| 20010 (localhost) | `pgadmin` | shared-db pgAdmin, localhost only on CT 104 |
+
+---
+
+## External hardware
+
+### QNAP UNAS Pro — NFS/SMB server
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.31` |
+| **Admin UI** | `http://192.168.1.31` |
+| **NFS export** | `192.168.1.31:/var/nfs/shared/storage` (NFSv3 only; v4 not available) |
+| **CIFS** | `//192.168.1.31/storage` (used by Nextcloud CT 105 only) |
+
+### QNAP TS-251D — Klipper 3D printer host
+
+| | Value |
+|---|---|
+| **IP** | `192.168.1.189` (behind TP-Link RE700X at `.187`) |
+| **Mainsail** | `http://192.168.1.189:80` |
+| **Moonraker** | `http://192.168.1.189:7125` |
+| **Notes** | Klipper config backed up daily to `git.nuclide.systems/fkrebs/klipper-config` via cron |
+
+---
+
+## OIDC clients — Pocket-ID (`id.nuclide.systems`)
+
+| Client ID | Service | Redirect URI |
+|---|---|---|
+| `e73bb7b9` | litellm / mcp-gateway | (empty — accepts all) |
+| `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` |
+| `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` |
+| `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` |
+| `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile |
+| `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` |
+| `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` |
+| `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` |
+| `0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback` |
+| `9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` |
+| `38469e7e` | Proxmox VE | `https://192.168.1.20:8006` |
+| `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` |
+| `d8733fcc` | shelfarr | `*` |
+| `78c78998` | Claude MCP | `https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback` |
+| `82ca2d53` | nuc-ai (MCP spawned servers) | (empty) |
+| `7fe1a14b` | zoraxy | (empty) |
+| (new) | vaultwarden | `https://vault.nuclide.systems/auth/callback` — SSO not yet wired |
+| ~~798a367f~~ | ~~daytona~~ | **DECOMMISSIONED — remove from Pocket-ID** |
+
+---
+
+## Quick-reference — all public URLs
+
+| URL | Backend | Service |
+|---|---|---|
+| `https://ai.nuclide.systems` | `192.168.1.40:14000` | LiteLLM (LLM proxy) |
+| `https://chat.nuclide.systems` | `192.168.1.40:14001` | LobeChat |
+| `https://mcp.nuclide.systems` | `192.168.1.40:8080` | MCP gateway |
+| `https://id.nuclide.systems` | `192.168.1.5:11000` | Pocket-ID (OIDC) |
+| `https://nc.nuclide.systems` | `192.168.1.41:11000` | Nextcloud |
+| `https://ha.nuclide.systems` | `192.168.1.60:8123` | Home Assistant |
+| `https://ocpp.nuclide.systems` | `192.168.1.60:8887` | EV charger OCPP |
+| `https://shepard.nuclide.systems` | `192.168.1.49:80` | Shepard |
+| `https://shepard-api.nuclide.systems` | `192.168.1.49:8080` | Shepard API |
+| `https://dev.nuclide.systems` | `192.168.1.42:7080` | Coder |
+| `https://git.nuclide.systems` | `192.168.1.42:3000` | Gitea |
+| `https://arcane.nuclide.systems` | `192.168.1.40:10002` | Arcane |
+| `https://dozzle.nuclide.systems` | `192.168.1.40:10001` | Dozzle (logs) |
+| `https://gotify.nuclide.systems` | `192.168.1.40:10003` | Gotify |
+| `https://s3.nuclide.systems` | `192.168.1.40:10004` | Garage S3 |
+| `https://vault.nuclide.systems` | `192.168.1.40:11001` | Vaultwarden |
+| `https://immich.nuclide.systems` | `192.168.1.40:12000` | Immich |
+| `https://immich-tools.nuclide.systems` | `192.168.1.40` (internal) | Immich Power Tools |
+| `https://abs.nuclide.systems` | `192.168.1.40:13003` | Audiobookshelf |
+| `https://n8n.nuclide.systems` | `192.168.1.40:16000` | n8n |
+| `https://memos.nuclide.systems` | `192.168.1.40:17000` | Memos |
+| `https://hoarder.nuclide.systems` | `192.168.1.40:17001` | Karakeep |
+| `https://traccar.nuclide.systems` | `192.168.1.40:15000` | Traccar |
+| `https://paperless.nuclide.systems` | `192.168.1.40:15003` | Paperless-ngx (internal-only policy) |
+| `https://paperless-ai.nuclide.systems` | `192.168.1.40:15002` | Paperless AI (internal-only policy) |
+
+**Not publicly proxied** (LAN/localhost only): pgAdmin, ComfyUI, Qdrant, RDTClient, Prowlarr, ShelfArr, Flaresolverr, Speaches, AdGuard admin, Backrest UI, Infisical.
+
+---
+
+## SSH cheat-sheet
+
+```bash
+ssh root@192.168.1.20   # PVE host (nuc)
+ssh root@192.168.1.40   # CT 104 docker
+ssh root@192.168.1.41   # CT 105 nextcloud
+ssh root@192.168.1.42   # CT 111 dev
+ssh root@192.168.1.49   # CT 101 shepard
+ssh root@192.168.1.2    # CT 102 dns (AdGuard)
+ssh root@192.168.1.3    # CT 103 backrest
+ssh root@192.168.1.4    # CT 108 zoraxy
+ssh root@192.168.1.5    # CT 110 id (Pocket-ID)
+ssh root@192.168.1.6    # CT 113 db (Postgres)
+ssh root@192.168.1.7    # CT 112 secrets (Infisical)
+ssh root@192.168.1.60   # VM 100 haos (Home Assistant — key must be installed manually)
+ssh -p 222 git@git.nuclide.systems  # Gitea SSH
+```
+
+All LXCs reachable from `nuc` host via root key. Use `pct exec <id> -- bash` for console access without SSH.