fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: consistency pass 2026-05-23 (session ×4)

Browse Source 
- zoraxy.md: fix arcane upstream to CT109 (192.168.1.8:10002), add
  SkipWebSocketOriginCheck column, note missing routes (dozzle, etc.)
- arcane.md: reflect CT109 migration complete, expand agent table to
  all 8 environments, fix MANAGER_API_URL and DB paths
- ct-inventory.md: CT103 RAM 512→4096+swap; CT109 footnote complete
- proxmox-memory-audit.md: CT103 bump, add CT109+CT113 rows, fix sum
- portmap.md: add Wetty row, fix arcane backend, WAL-G scrape target,
  homepage decommissioned, dozzle LAN-only note
- mcp-gateway.md: add gitea/paperless/proxmox, count 26→29 servers
- RESUME.md: check off WAL-G, Loki, Zoraxy audit; CT109 in key state
  table; session ×4 completed items block

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Florian Krebs
2026-05-23 16:42:45 +02:00
parent 14137c32a7
commit 895658a115
7 changed files with 84 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/arcane.md
+17 -20
View File
@@ -1,8 +1,8 @@
# Arcane
Web-based Docker management IDE. Main instance on **CT 104** (`192.168.1.40:10002`, `arcane.nuclide.systems`). Manages containers on the local Docker host plus remote CTs via **edge agents**.
Web-based Docker management IDE. Main instance on **CT 109** (`192.168.1.8:10002`, `arcane.nuclide.systems`). Manages containers on all Docker hosts via **edge agents**. Migrated from CT 104 → CT 109 on 2026-05-23.
Stack: `/opt/stacks/arcane/docker-compose.yml` on CT 104.
Stack: `/opt/stacks/arcane/docker-compose.yml` on CT 109.
Image: `ghcr.io/getarcaneapp/arcane:latest`
Auth: OIDC via Pocket ID, admin: `fkrebs@nucli.de`
@@ -14,10 +14,16 @@ An edge agent (`ghcr.io/getarcaneapp/arcane-headless:latest`) runs inside each r
### Currently deployed agents
| CT | Hostname | Compose path | Status |
|----|----------|--------------|--------|
| CT 104 | docker | *(built-in NUC environment)* | online |
| CT 113 | db | `/opt/stacks/db/docker-compose.yml` | online (2026-05-21) |
| CT | Hostname | Environment | Compose path | Status |
|----|----------|------------|--------------|--------|
| CT 101 | shepard | shepard | `/opt/stacks/ops-agents/docker-compose.yml` | online |
| CT 104 | docker | docker | `/opt/stacks/ops-agents/docker-compose.yml` | online |
| CT 105 | nextcloud | nextcloud | `/opt/stacks/ops-agents/docker-compose.yml` | online |
| CT 110 | id | id | `/opt/stacks/ops-agents/docker-compose.yml` | online |
| CT 111 | dev | dev | `/opt/stacks/ops-agents/docker-compose.yml` | online |
| CT 112 | secrets | secrets | `/opt/stacks/ops-agents/docker-compose.yml` | online |
| CT 113 | db | db | `/opt/stacks/db/docker-compose.yml` | online |
| nuc | nuc | NUC (built-in) | *(built-in environment)* | online |
### Adding an edge agent to a new CT
@@ -41,7 +47,7 @@ Arcane stores the raw AGENT_TOKEN in `environments.access_token`. Insert it via:
import argon2, secrets, sqlite3, uuid
from datetime import datetime, timezone
db_path = "/rpool/data/subvol-104-disk-0/opt/stacks/arcane/data/arcane.db"
db_path = "/rpool/data/subvol-109-disk-0/opt/stacks/arcane/data/arcane.db"
env_id = "<id from step 1>" # paste the environment UUID here
conn = sqlite3.connect(db_path)
@@ -78,7 +84,7 @@ print("AGENT_TOKEN:", raw_token)
EDGE_AGENT: "true"
EDGE_TRANSPORT: poll
AGENT_TOKEN: ${ARCANE_AGENT_TOKEN}
MANAGER_API_URL: http://192.168.1.40:10002
MANAGER_API_URL: http://192.168.1.8:10002
deploy:
resources:
limits:
@@ -100,18 +106,9 @@ The environment should flip to `online` in `environments.status` within ~5 secon
---
## When Arcane moves to CT 109
## Migration to CT 109 — completed 2026-05-23
When Arcane migrates from CT 104 to CT 109 (the planned "observe" LXC):
1. Update `MANAGER_API_URL` in every edge agent's `.env` to the new CT 109 LAN IP
2. Update the Arcane compose `APP_URL` and network bindings
3. Update Zoraxy route for `arcane.nuclide.systems` to point to CT 109
4. Migrate the SQLite DB: `cp -a /opt/stacks/arcane/data/ <ct109-path>/`
5. Regenerate the admin API key (stored in memory, not config) since the DB port changes
6. Restart all edge agents with the new `MANAGER_API_URL`
Arcane environments (NUC, db, shepard) will reconnect automatically once `MANAGER_API_URL` is updated.
Arcane migrated from CT 104 → CT 109. All edge agents updated with `MANAGER_API_URL: http://192.168.1.8:10002`. Zoraxy upstream updated to `192.168.1.8:10002`. SQLite DB at `/opt/stacks/arcane/data/` on CT 109.
---
@@ -121,6 +118,6 @@ Arcane doesn't store plaintext API keys — use the DB-insert method above when
The key inserted for CLI use during CT 113 provisioning (`arc_a9695182...`) is linked to `fkrebs` user in the api_keys table. Rotate it after provisioning work is complete by deleting the row:
```sql
sqlite3 /rpool/data/subvol-104-disk-0/opt/stacks/arcane/data/arcane.db \
sqlite3 /rpool/data/subvol-109-disk-0/opt/stacks/arcane/data/arcane.db \
"DELETE FROM api_keys WHERE name='admin-cli';"
```
services/mcp-gateway.md
+6 -3
View File
@@ -12,9 +12,9 @@ DinD MCP gateway on CT 104. Single OAuth-gated entry point fronting 24 MCP serve
- **Browser Web UI** — Authorization-Code flow with httpOnly session cookie. `/ui` and `/api/*` accept cookie or Bearer; `/{srv}/` stays Bearer-only.
- **Secrets**: per-server OAuth client secrets live in `ai/.env` (read via `os.environ`), never hardcoded.
## Server inventory (as of 2026-05-22)
## Server inventory (as of 2026-05-23)
26 servers configured in `mcp-gateway/config.json`. **Status: 27 healthy.**
29 servers configured in `mcp-gateway/config.json`. **Status: 30 healthy** (includes gitea, paperless, proxmox added 2026-05-23).
| Group | Server | Kind | Notes |
|---|---|---|---|
@@ -45,10 +45,13 @@ DinD MCP gateway on CT 104. Single OAuth-gated entry point fronting 24 MCP serve
| | unifi | spawn | |
| **image** | comfyui | static | `comfyui-mcp:8000` (own stack, see [comfyui.md](comfyui.md)) |
| **storage** | upload-artifact | static | `upload-artifact-mcp:8000` |
| **infra** | gitea | static | `gitea-mcp:8000` — Gitea API MCP server |
| | paperless | static | `paperless-mcp:8000` — Paperless-ngx MCP (`@nloui/paperless-mcp` via mcp-proxy) |
| | proxmox | static | `proxmox-mcp:8000` — read-only PVE API (`PVEAuditor` role, token `root@pam!mcp`) |
> **Catalog bridge env var passthrough**: `mcp-proxy`'s `stdio_client` uses a sanitized env (`get_default_environment()`), stripping custom vars. For catalog servers that need env vars (e.g. `gitlab`), the bridge command **must** include `--pass-environment` so Docker CLI can resolve `-e KEY` passthrough from the bridge container's env.
> **Nextcloud server count**: 27 total (26 enabled + nextcloud now re-enabled 2026-05-22). Gateway updated to persist `enabled` flag across restarts.
> **Server count**: 30 total (27 from 2026-05-22 + gitea, paperless, proxmox added 2026-05-23). Gateway updated to persist `enabled` flag across restarts.
## Client registration
services/zoraxy.md
+29 -25
View File
@@ -4,35 +4,39 @@
## Current route table
Audited and fully configured 2026-05-21. All 22 public routes have:
Audited 2026-05-23. All 22 public routes have:
- `EnableAutoHTTPS: true` — Zoraxy requests LE certs for `*.nuclide.systems`
- `EnableWebsocketCustomHeaders: true` — preserves WS upgrade headers through the proxy
- `DisableHopByHopHeaderRemoval: true` — keeps hop-by-hop headers intact for upstream
| Domain | Upstream | Notes |
|--------|----------|-------|
| abs.nuclide.systems | 192.168.1.40:13003 | Absolut (abs) |
| ai.nuclide.systems | 192.168.1.40:14000 | LiteLLM gateway |
| arcane.nuclide.systems | 192.168.1.40:10002 | Arcane Manager |
| chat.nuclide.systems | 192.168.1.40:14001 | LobeHub |
| dev.nuclide.systems | 192.168.1.42:7080 | Coder (CT 111) |
| git.nuclide.systems | 192.168.1.42:3000 | Gitea (CT 111) |
| gotify.nuclide.systems | 192.168.1.40:10003 | Gotify push notifications |
| ha.nuclide.systems | 192.168.1.60:8123 | Home Assistant (VM 100) |
| hoarder.nuclide.systems | 192.168.1.40:17001 | Karakeep bookmarks |
| id.nuclide.systems | 192.168.1.5:11000 | Pocket-ID OIDC (CT 110) |
| immich.nuclide.systems | 192.168.1.40:12000 | Immich photos |
| mcp.nuclide.systems | 192.168.1.40:8080 | MCP gateway |
| memos.nuclide.systems | 192.168.1.40:17000 | Memos notes |
| n8n.nuclide.systems | 192.168.1.40:16000 | n8n workflows |
| nc.nuclide.systems | 192.168.1.41:11000 | Nextcloud AIO (CT 105) |
| ocpp.nuclide.systems | 192.168.1.60:8887 | OCPP charger endpoint (HAOS) |
| s3.nuclide.systems | 192.168.1.40:10004 | Garage S3 (web endpoint) |
| shepard.nuclide.systems | 192.168.1.49:80 | Shepard frontend (CT 101) |
| shepard-api.nuclide.systems | 192.168.1.49:8080 | Shepard API (CT 101) |
| shepard-auth.nuclide.systems | 192.168.1.49:8082 | Shepard auth (CT 101) |
| traccar.nuclide.systems | 192.168.1.40:15000 | Traccar GPS |
| vault.nuclide.systems | 192.168.1.40:11001 | Vaultwarden |
`SkipWebSocketOriginCheck` is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, Arcane, abs, ai, chat, ha, mcp, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed).
| Domain | Upstream | SkipWSOrigin | Notes |
|--------|----------|:---:|-------|
| abs.nuclide.systems | 192.168.1.40:13003 | ✓ | Audiobookshelf |
| ai.nuclide.systems | 192.168.1.40:14000 | ✓ | LiteLLM gateway |
| arcane.nuclide.systems | **192.168.1.8:10002** | ✓ | Arcane (moved to CT 109 2026-05-23) |
| chat.nuclide.systems | 192.168.1.40:14001 | ✓ | LobeHub |
| dev.nuclide.systems | 192.168.1.42:7080 | ✓ | Coder (CT 111) |
| git.nuclide.systems | 192.168.1.42:3000 | — | Gitea (CT 111) |
| gotify.nuclide.systems | 192.168.1.40:10003 | ✓ | Gotify push notifications |
| ha.nuclide.systems | 192.168.1.60:8123 | ✓ | Home Assistant (VM 100) |
| hoarder.nuclide.systems | 192.168.1.40:17001 | — | Karakeep bookmarks |
| id.nuclide.systems | 192.168.1.5:11000 | — | Pocket-ID OIDC (CT 110) |
| immich.nuclide.systems | 192.168.1.40:12000 | ✓ | Immich photos |
| mcp.nuclide.systems | 192.168.1.40:8080 | ✓ | MCP gateway |
| memos.nuclide.systems | 192.168.1.40:17000 | — | Memos notes |
| n8n.nuclide.systems | 192.168.1.40:16000 | ✓ | n8n workflows |
| nc.nuclide.systems | 192.168.1.41:11000 | ✓ | Nextcloud AIO (CT 105) |
| ocpp.nuclide.systems | 192.168.1.60:8887 | ✓ | OCPP charger endpoint (HAOS) |
| s3.nuclide.systems | 192.168.1.40:10004 | ✓ | Garage S3 (web endpoint) |
| shepard.nuclide.systems | 192.168.1.49:80 | ✓ | Shepard frontend (CT 101) |
| shepard-api.nuclide.systems | 192.168.1.49:8080 | ✓ | Shepard API (CT 101) |
| shepard-auth.nuclide.systems | 192.168.1.49:8082 | ✓ | Shepard auth (CT 101) |
| traccar.nuclide.systems | 192.168.1.40:15000 | ✓ | Traccar GPS |
| vault.nuclide.systems | 192.168.1.40:11001 | ✓ | Vaultwarden |
**Missing routes** (services listed in portmap but no Zoraxy config exists): `dozzle.nuclide.systems`, `immich-tools.nuclide.systems`, `paperless.nuclide.systems`, `paperless-ai.nuclide.systems`. These are either LAN-only or the routes were never created.
`root.config` — ProxyType=0 internal dashboard fallback (127.0.0.1:5487), no ACME.