fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

zoraxy: remove arcane.nuclide.systems route (decommissioned 2026-05-26)

Browse Source
This commit is contained in:
Florian Krebs
2026-05-26 21:13:57 +02:00
parent 03fd23b37b
commit 4429b37c49
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/zoraxy.md
+5 -4
View File
@@ -4,18 +4,18 @@
## Current route table ## Current route table
Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat backends swapped). 21 active public routes have: Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat backends swapped, arcane.nuclide.systems removed). 20 active public routes have:
- `EnableAutoHTTPS: true` — Zoraxy requests LE certs for `*.nuclide.systems` - `EnableAutoHTTPS: true` — Zoraxy requests LE certs for `*.nuclide.systems`
- `EnableWebsocketCustomHeaders: true` — preserves WS upgrade headers through the proxy - `EnableWebsocketCustomHeaders: true` — preserves WS upgrade headers through the proxy
- `DisableHopByHopHeaderRemoval: true` — keeps hop-by-hop headers intact for upstream - `DisableHopByHopHeaderRemoval: true` — keeps hop-by-hop headers intact for upstream
`SkipWebSocketOriginCheck` is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, Arcane, abs, ai, chat, ha, mcp, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed). `SkipWebSocketOriginCheck` is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, abs, ai, chat, ha, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed).
| Domain | Upstream | SkipWSOrigin | Notes | | Domain | Upstream | SkipWSOrigin | Notes |
|--------|----------|:---:|-------| |--------|----------|:---:|-------|
| abs.nuclide.systems | 192.168.1.40:13003 | ✓ | Audiobookshelf | | abs.nuclide.systems | 192.168.1.40:13003 | ✓ | Audiobookshelf |
| ai.nuclide.systems | 192.168.1.40:14003 | ✓ | Bifrost LLM gateway (LiteLLM decommissioned 2026-05-26) | | ai.nuclide.systems | 192.168.1.40:14003 | ✓ | Bifrost LLM gateway (LiteLLM decommissioned 2026-05-26) |
| arcane.nuclide.systems | **192.168.1.8:10002** | ✓ | Arcane (moved to CT 109 2026-05-23) | | ~~arcane.nuclide.systems~~ | ~~192.168.1.8:10002~~ | — | **DECOMMISSIONED 2026-05-26** — replaced by Portainer |
| chat.nuclide.systems | 192.168.1.40:14002 | ✓ | Open WebUI (LobeChat decommissioned 2026-05-26) | | chat.nuclide.systems | 192.168.1.40:14002 | ✓ | Open WebUI (LobeChat decommissioned 2026-05-26) |
| dev.nuclide.systems | 192.168.1.42:7080 | ✓ | Coder (CT 111) | | dev.nuclide.systems | 192.168.1.42:7080 | ✓ | Coder (CT 111) |
| git.nuclide.systems | 192.168.1.42:3000 | — | Gitea (CT 111) | | git.nuclide.systems | 192.168.1.42:3000 | — | Gitea (CT 111) |
@@ -96,9 +96,10 @@ ssh root@192.168.1.4 'cp /tmp/zoraxy-backup-2026-05-21/<domain>.config /opt/zora
- `daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20` - `daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20`
- `id.daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20` - `id.daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20`
- `mcp.nuclide.systems.config` — removed 2026-05-26 (mcp-gateway decommissioned; MCP now via Bifrost at `ai.nuclide.systems/mcp`) - `mcp.nuclide.systems.config` — removed 2026-05-26 (mcp-gateway decommissioned; MCP now via Bifrost at `ai.nuclide.systems/mcp`)
- `arcane.nuclide.systems.config` — removed 2026-05-26 (Arcane decommissioned; replaced by Portainer at `http://192.168.1.8:9000` LAN-only)
## Auth posture ## Auth posture
No routes have `ForwardAuthURL` set (no Tinyauth/auth middleware). Pocket-ID (`id.nuclide.systems`) is the OIDC IdP; apps that require auth implement it themselves (Open WebUI, Coder, Gitea, Nextcloud). Public-facing routes like `ha.nuclide.systems` and `ocpp.nuclide.systems` have no proxy-level auth — upstream apps handle it. No routes have `ForwardAuthURL` set (no Tinyauth/auth middleware). Pocket-ID (`id.nuclide.systems`) is the OIDC IdP; apps that require auth implement it themselves (Open WebUI, Coder, Gitea, Nextcloud). Public-facing routes like `ha.nuclide.systems` and `ocpp.nuclide.systems` have no proxy-level auth — upstream apps handle it.
**Pending**: Tinyauth or similar on unauthenticated-but-sensitive routes (arcane, gotify). Planned for CT 109 deployment. **Pending**: Tinyauth or similar on unauthenticated-but-sensitive routes (gotify). Planned for CT 109 deployment.