diff --git a/ct-inventory.md b/ct-inventory.md index 16d4932..9b40794 100644 --- a/ct-inventory.md +++ b/ct-inventory.md @@ -8,13 +8,13 @@ Verified 2026-05-20 via `pct list`, `pct config `, `qm config 100` on `nuc`. | 101 | shepard | LXC unpriv | 192.168.1.49/24 | 12 | 32768 | 500 GiB | Shepard product stack (Caddy, frontend, backend, Keycloak, Mongo, Neo4j, TimescaleDB) | mp0 NFS | Intel iGPU (card+render) | running | | 102 | dns | LXC unpriv | 192.168.1.2/24 | 2 | 1024 | 4 GiB | **AdGuard Home** — LAN DNS resolver + filter | — | no | running | | 103 | backrest | LXC unpriv | 192.168.1.3/24 | 1 | 4096 + 1024 swap | 8 GiB | **Backrest** (restic) backup scheduler | mp0 NFS | no | running | -| 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~65 containers) | mp0 NFS | Intel iGPU (card+render) | running | +| 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~70 containers); **Gitea** (:3000/:222) + **Coder** (:7080) migrated from CT 111 2026-05-26; **Proton Mail Bridge** (:1025 SMTP/:1143 IMAP) | mp0 NFS | Intel iGPU (card+render) | running | | 105 | nextcloud | LXC priv | 192.168.1.41/24 | 4 | 8196 | 100 GiB | Nextcloud AIO | mp0 NFS | Intel iGPU (render only) | running | | 108 | zoraxy | LXC unpriv | 192.168.1.4/24 | 2 | 2048 | 6 GiB | **Zoraxy** reverse proxy + ACME (`*.nuclide.systems`) | — | no | running | -| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:3010) + Portainer (:9000) + Dozzle (server) + docs-server; Dozzle agents on all 7 Docker hosts | — | no | running | +| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:10000) + Portainer (:9000) + Dozzle (server) + docs-server + **Infisical** (:8200, migrated from CT 112 2026-05-26); Dozzle agents on all 7 Docker hosts | — | no | running | | 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running | -| 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | Dev host — **Coder + Gitea** + workspaces | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running | -| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Infisical** secrets manager (own Postgres 16 + Redis 7; replaces scattered .env files) — LAN-only, no Zoraxy route | — | no | running | +| 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | **DECOMMISSIONED 2026-05-26** — Coder + Gitea migrated to CT 104; containers stopped; LXC pending removal | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running | +| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **DECOMMISSIONED 2026-05-26** — Infisical migrated to CT 109; containers stopped; LXC pending removal | — | no | running | | 113 | db | LXC unpriv | 192.168.1.6/24 | 2 | 4096 | 40 GiB | Shared Postgres 17 + pgAdmin + WAL-G → Garage S3; Arcane edge agent | — | no | running | UNAS NFS = `192.168.1.31:/var/nfs/shared/storage` over NFSv3. CT 105 (Nextcloud) is the lone outlier — it mounts the same UNAS share over **CIFS/SMB 3.1.1**, not NFS. diff --git a/infra/portmap.md b/infra/portmap.md index 27a9cba..9e9825e 100644 --- a/infra/portmap.md +++ b/infra/portmap.md @@ -42,6 +42,7 @@ | [10001](http://192.168.1.8:10001) | CT 109 | Dozzle | LAN only; live log viewer; agents on all 7 Docker hosts | | ~~10002~~ | ~~CT 109~~ | ~~Arcane~~ | **DECOMMISSIONED 2026-05-26** — replaced by Portainer | | [13080](http://192.168.1.8:13080) | CT 109 | docs-server | LAN only; mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min — migrated from CT 111 2026-05-23 | +| [8200](http://192.168.1.8:8200) | CT 109 | Infisical | LAN only; secrets manager; migrated from CT 112 2026-05-26; `http://secrets.nuclide.lan:8200` | | 9100 | CT 109 | node-exporter | host-network, self-scrape | | 9100 | CT 104 | node-exporter | standalone stack `/opt/stacks/monitoring/`; scraped by CT 109 | @@ -67,6 +68,19 @@ Scrape targets (CT 109 Prometheus): ~~`litellm` CT104:14000/metrics/~~ (**SUNSET --- +## Dev (CT 104 — migrated from CT 111 2026-05-26) + +| Port | Service | Container | Public URL | Notes | +|---|---|---|---|---| +| [3000](http://192.168.1.40:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC via Pocket-ID; Redis queue (`gitea_redis`) | +| [222](http://192.168.1.40:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` | +| [7080](http://192.168.1.40:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID | +| (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct104-runner`) | +| [1025](http://192.168.1.40:1025) | Proton Bridge SMTP | `proton-bridge` | — | LAN only; requires `docker exec -it proton-bridge /bin/bash` for initial login | +| [1143](http://192.168.1.40:1143) | Proton Bridge IMAP | `proton-bridge` | — | LAN only | + +--- + ## Security & Auth (11000–11999) | Port | Service | Container | Public URL | Notes | @@ -172,17 +186,13 @@ _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._ --- -## LXC 112 — secrets (`192.168.1.7`) +## ~~LXC 112 — secrets~~ (`192.168.1.7`) — **DECOMMISSIONED 2026-05-26** -CT 112 hosts Infisical. **LAN-only — no Zoraxy route; secrets must not be internet-exposed.** +Infisical migrated to CT 109 ops. Containers stopped; LXC pending removal. -| Port | Service | Container | Notes | -|---|---|---|---| -| 8200 | Infisical | `infisical` | LAN: `http://192.168.1.7:8200` — admin UI + API | -| (internal) | Postgres 16 | `infisical-db` | DB for Infisical only; no external port | -| (internal) | Redis 7 | `infisical-redis` | Session/queue backing; no external port | - -Stack at `/opt/stacks/infisical/` on CT 112. Deployed 2026-05-22. +| Port | Service | Notes | +|---|---|---| +| ~~8200~~ | ~~Infisical~~ | **Moved to CT 109:8200** | --- @@ -197,19 +207,15 @@ CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only --- -## LXC 111 — Dev (`192.168.1.42`) +## ~~LXC 111 — Dev~~ (`192.168.1.42`) — **DECOMMISSIONED 2026-05-26** -CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest. +All services migrated to CT 104. Containers stopped; LXC pending removal. -| Port | Service | Container | Public URL | Notes | -|---|---|---|---|---| -| [7080](http://192.168.1.42:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID; password auth disabled | -| [3000](http://192.168.1.42:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC; password form disabled | -| [222](http://192.168.1.42:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` | -| 5432 (internal) | coder-db | `coder-db` | — | Postgres 16 for Coder | -| 5432 (internal) | gitea-db | `gitea-db` | — | Postgres 16 for Gitea | -| (no port) | coder-fkrebs-dev | (workspace) | (Coder app proxy) | Active Coder workspace | -| (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct111-runner`) | +| Port | Service | Notes | +|---|---|---| +| ~~7080~~ | ~~Coder~~ | **Moved to CT 104:7080** | +| ~~3000~~ | ~~Gitea~~ | **Moved to CT 104:3000** | +| ~~222~~ | ~~Gitea SSH~~ | **Moved to CT 104:222** | --- @@ -238,9 +244,9 @@ Zoraxy routes to these external backends: | [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard | | [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API | | [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) | -| [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.42:3000` | Dev LXC 111 | Gitea (self-hosted Git) | -| [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.42:7080` | Dev LXC 111 | Coder (workspace orchestrator) | -| Gitea SSH | `192.168.1.42:222` | Dev LXC 111 | `ssh -p 222 git@git.nuclide.systems` | +| [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.40:3000` | Docker CT 104 | Gitea (migrated from CT 111 2026-05-26) | +| [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.40:7080` | Docker CT 104 | Coder (migrated from CT 111 2026-05-26) | +| Gitea SSH | `192.168.1.40:222` | Docker CT 104 | `ssh -p 222 git@git.nuclide.systems` | --- diff --git a/services/dev-environment.md b/services/dev-environment.md index 603df70..91f862e 100644 --- a/services/dev-environment.md +++ b/services/dev-environment.md @@ -1,6 +1,8 @@ -# Dev Environment — CT 111 (dev.nuclide.systems) +# Dev Environment — CT 104 (dev.nuclide.systems) -CT 111 hosts the self-hosted development platform: **Coder** (dev workspaces) + **Gitea** (internal repos). +**Migrated from CT 111 to CT 104 on 2026-05-26.** CT 111 ("dev") is decommissioned; LXC pending removal. + +CT 104 hosts the self-hosted development platform: **Coder** (dev workspaces) + **Gitea** (internal repos). ## Services @@ -126,16 +128,20 @@ Host git.nuclide.systems --- -## CT 111 specs +## CT 104 specs (current host) | | | |---|---| -| IP | 192.168.1.42 | -| Cores | 12 | -| RAM | 32GB | -| Rootfs | 60GB local-zfs (Docker image cache) | -| UNAS | /mnt/pve/unas (mp0) | -| GPU | renderD128 (Intel Arc Xe, by-path) | +| IP | 192.168.1.40 | +| Cores | 16 | +| RAM | 48GB | +| Rootfs | 200GB local-zfs | +| UNAS | /mnt/pve/unas (mp0) — coder + gitea data paths unchanged | +| GPU | renderD128 (Intel Arc Xe, idmapped) | + +Compose files at `/opt/stacks/coder/` and `/opt/stacks/gitea/` on CT 104. +Gitea uses Redis (`gitea-redis`) for queue/cache/session — required because CT 104 uses idmapped NFS which doesn't support LevelDB file locks. +Act-runner at `/opt/stacks/act-runner/` — runner name `ct104-runner`. --- diff --git a/services/proton-bridge.md b/services/proton-bridge.md new file mode 100644 index 0000000..0bb6381 --- /dev/null +++ b/services/proton-bridge.md @@ -0,0 +1,42 @@ +# Proton Mail Bridge + +Headless Proton Mail Bridge running on CT 104 — exposes ProtonMail account as SMTP/IMAP endpoints for local services (n8n, Infisical, etc.). + +## Stack + +- **Host**: CT 104 (`docker`, 192.168.1.40), `/opt/stacks/proton-bridge/docker-compose.yml` +- **Image**: `shenxn/protonmail-bridge:latest` +- **SMTP**: `192.168.1.40:1025` +- **IMAP**: `192.168.1.40:1143` +- **Config volume**: `proton-bridge_proton_config` + +## Initial login (one-time, interactive) + +```bash +ssh root@192.168.1.40 +docker exec -it proton-bridge /bin/bash +protonmail-bridge --cli +# Commands: login → (enter Proton credentials) → list (note bridge SMTP password) +# exit +``` + +After login the bridge stores credentials in the volume and runs headlessly on restart. + +## SMTP credentials for other services + +Once logged in, run `list` inside the CLI to get: +- **SMTP host**: `192.168.1.40` +- **SMTP port**: `1025` +- **SMTP user**: your Proton email address +- **SMTP password**: the bridge-generated password (not your Proton login password) +- **IMAP host**: `192.168.1.40` +- **IMAP port**: `1143` + +## Ops + +```bash +# CT 104 +cd /opt/stacks/proton-bridge +docker compose up -d --force-recreate proton-bridge +docker logs proton-bridge -f +``` diff --git a/services/secrets-manager.md b/services/secrets-manager.md index 08f9911..9fdbf8b 100644 --- a/services/secrets-manager.md +++ b/services/secrets-manager.md @@ -1,8 +1,8 @@ -# Secrets Manager — Infisical on CT 112 +# Secrets Manager — Infisical on CT 109 -**Status: deployed 2026-05-22.** Running at `http://192.168.1.7:8200` (LAN-only, no Zoraxy route — secrets must not be internet-exposed). +**Status: deployed 2026-05-22; migrated CT 112 → CT 109 on 2026-05-26.** Running at `http://192.168.1.8:8200` (`http://secrets.nuclide.lan:8200`). LAN-only, no Zoraxy route — secrets must not be internet-exposed. -Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 112 (`secrets`, `192.168.1.7`). Compose at `/opt/stacks/infisical/` on CT 112. +Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 109 (`ops`, `192.168.1.8`). Compose at `/opt/stacks/infisical/` on CT 109. CT 112 ("secrets") is decommissioned; LXC pending removal. ## Problem statement diff --git a/services/zoraxy.md b/services/zoraxy.md index 2ffb57f..4c5ccaa 100644 --- a/services/zoraxy.md +++ b/services/zoraxy.md @@ -17,8 +17,8 @@ Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat bac | ai.nuclide.systems | 192.168.1.40:14003 | ✓ | Bifrost LLM gateway (LiteLLM decommissioned 2026-05-26) | | ~~arcane.nuclide.systems~~ | ~~192.168.1.8:10002~~ | — | **DECOMMISSIONED 2026-05-26** — replaced by Portainer | | chat.nuclide.systems | 192.168.1.40:14002 | ✓ | Open WebUI (LobeChat decommissioned 2026-05-26) | -| dev.nuclide.systems | 192.168.1.42:7080 | ✓ | Coder (CT 111) | -| git.nuclide.systems | 192.168.1.42:3000 | — | Gitea (CT 111) | +| dev.nuclide.systems | 192.168.1.40:7080 | ✓ | Coder (CT 104; migrated from CT 111 2026-05-26) | +| git.nuclide.systems | 192.168.1.40:3000 | — | Gitea (CT 104; migrated from CT 111 2026-05-26) | | gotify.nuclide.systems | 192.168.1.40:10003 | ✓ | Gotify push notifications | | ha.nuclide.systems | 192.168.1.60:8123 | ✓ | Home Assistant (VM 100) | | hoarder.nuclide.systems | 192.168.1.40:17001 | — | Karakeep bookmarks |