fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

migrate dev→CT104, secrets→CT109; add proton-bridge; sunset CT111/CT112

Browse Source 
- CT 111 (dev): Gitea + Coder + act-runner migrated to CT 104
  - Gitea uses Redis for queue/cache/session (idmapped NFS LevelDB workaround)
  - Zoraxy routes dev/git updated to 192.168.1.40
  - AdGuard dev.nuclide.lan updated to 192.168.1.40
- CT 112 (secrets): Infisical migrated to CT 109
  - DB dump restored; SITE_URL updated to 192.168.1.8:8200
  - AdGuard secrets.nuclide.lan updated to 192.168.1.8
- Proton Mail Bridge deployed on CT 104 (SMTP :1025, IMAP :1143)
- Homepage updated: Dev group → ct104, Infisical → my-local, Background group added
- portmap, ct-inventory, zoraxy, dev-environment, secrets-manager all updated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Florian Krebs
2026-05-26 22:08:08 +02:00
parent bcbe9e7a88
commit a2f1d49170
6 changed files with 95 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ct-inventory.md
+4 -4
View File
@@ -8,13 +8,13 @@ Verified 2026-05-20 via `pct list`, `pct config <id>`, `qm config 100` on `nuc`.
| 101 | shepard | LXC unpriv | 192.168.1.49/24 | 12 | 32768 | 500 GiB | Shepard product stack (Caddy, frontend, backend, Keycloak, Mongo, Neo4j, TimescaleDB) | mp0 NFS | Intel iGPU (card+render) | running |
| 102 | dns | LXC unpriv | 192.168.1.2/24 | 2 | 1024 | 4 GiB | **AdGuard Home** — LAN DNS resolver + filter | — | no | running |
| 103 | backrest | LXC unpriv | 192.168.1.3/24 | 1 | 4096 + 1024 swap | 8 GiB | **Backrest** (restic) backup scheduler | mp0 NFS | no | running |
| 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~65 containers) | mp0 NFS | Intel iGPU (card+render) | running |
| 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~70 containers); **Gitea** (:3000/:222) + **Coder** (:7080) migrated from CT 111 2026-05-26; **Proton Mail Bridge** (:1025 SMTP/:1143 IMAP) | mp0 NFS | Intel iGPU (card+render) | running |
| 105 | nextcloud | LXC priv | 192.168.1.41/24 | 4 | 8196 | 100 GiB | Nextcloud AIO | mp0 NFS | Intel iGPU (render only) | running |
| 108 | zoraxy | LXC unpriv | 192.168.1.4/24 | 2 | 2048 | 6 GiB | **Zoraxy** reverse proxy + ACME (`*.nuclide.systems`) | — | no | running |
| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:3010) + Portainer (:9000) + Dozzle (server) + docs-server; Dozzle agents on all 7 Docker hosts | — | no | running |
| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:10000) + Portainer (:9000) + Dozzle (server) + docs-server + **Infisical** (:8200, migrated from CT 112 2026-05-26); Dozzle agents on all 7 Docker hosts | — | no | running |
| 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running |
| 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | Dev host — **Coder + Gitea** + workspaces | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running |
| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Infisical** secrets manager (own Postgres 16 + Redis 7; replaces scattered .env files) — LAN-only, no Zoraxy route | — | no | running |
| 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | **DECOMMISSIONED 2026-05-26** — Coder + Gitea migrated to CT 104; containers stopped; LXC pending removal | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running |
| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **DECOMMISSIONED 2026-05-26** — Infisical migrated to CT 109; containers stopped; LXC pending removal | — | no | running |
| 113 | db | LXC unpriv | 192.168.1.6/24 | 2 | 4096 | 40 GiB | Shared Postgres 17 + pgAdmin + WAL-G → Garage S3; Arcane edge agent | — | no | running |
UNAS NFS = `192.168.1.31:/var/nfs/shared/storage` over NFSv3. CT 105 (Nextcloud) is the lone outlier — it mounts the same UNAS share over **CIFS/SMB 3.1.1**, not NFS.
infra/portmap.md
+29 -23
View File
@@ -42,6 +42,7 @@
| [10001](http://192.168.1.8:10001) | CT 109 | Dozzle | LAN only; live log viewer; agents on all 7 Docker hosts |
| ~~10002~~ | ~~CT 109~~ | ~~Arcane~~ | **DECOMMISSIONED 2026-05-26** — replaced by Portainer |
| [13080](http://192.168.1.8:13080) | CT 109 | docs-server | LAN only; mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min — migrated from CT 111 2026-05-23 |
| [8200](http://192.168.1.8:8200) | CT 109 | Infisical | LAN only; secrets manager; migrated from CT 112 2026-05-26; `http://secrets.nuclide.lan:8200` |
| 9100 | CT 109 | node-exporter | host-network, self-scrape |
| 9100 | CT 104 | node-exporter | standalone stack `/opt/stacks/monitoring/`; scraped by CT 109 |
@@ -67,6 +68,19 @@ Scrape targets (CT 109 Prometheus): ~~`litellm` CT104:14000/metrics/~~ (**SUNSET
---
## Dev (CT 104 — migrated from CT 111 2026-05-26)
| Port | Service | Container | Public URL | Notes |
|---|---|---|---|---|
| [3000](http://192.168.1.40:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC via Pocket-ID; Redis queue (`gitea_redis`) |
| [222](http://192.168.1.40:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` |
| [7080](http://192.168.1.40:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID |
| (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct104-runner`) |
| [1025](http://192.168.1.40:1025) | Proton Bridge SMTP | `proton-bridge` | — | LAN only; requires `docker exec -it proton-bridge /bin/bash` for initial login |
| [1143](http://192.168.1.40:1143) | Proton Bridge IMAP | `proton-bridge` | — | LAN only |
---
## Security & Auth (11000–11999)
| Port | Service | Container | Public URL | Notes |
@@ -172,17 +186,13 @@ _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._
---
## LXC 112 — secrets (`192.168.1.7`)
## ~~LXC 112 — secrets~~ (`192.168.1.7`) — **DECOMMISSIONED 2026-05-26**
CT 112 hosts Infisical. **LAN-only — no Zoraxy route; secrets must not be internet-exposed.**
Infisical migrated to CT 109 ops. Containers stopped; LXC pending removal.
| Port | Service | Container | Notes |
|---|---|---|---|
| 8200 | Infisical | `infisical` | LAN: `http://192.168.1.7:8200` — admin UI + API |
| (internal) | Postgres 16 | `infisical-db` | DB for Infisical only; no external port |
| (internal) | Redis 7 | `infisical-redis` | Session/queue backing; no external port |
Stack at `/opt/stacks/infisical/` on CT 112. Deployed 2026-05-22.
| Port | Service | Notes |
|---|---|---|
| ~~8200~~ | ~~Infisical~~ | **Moved to CT 109:8200** |
---
@@ -197,19 +207,15 @@ CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only
---
## LXC 111 — Dev (`192.168.1.42`)
## ~~LXC 111 — Dev~~ (`192.168.1.42`) — **DECOMMISSIONED 2026-05-26**
CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest.
All services migrated to CT 104. Containers stopped; LXC pending removal.
| Port | Service | Container | Public URL | Notes |
|---|---|---|---|---|
| [7080](http://192.168.1.42:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID; password auth disabled |
| [3000](http://192.168.1.42:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC; password form disabled |
| [222](http://192.168.1.42:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` |
| 5432 (internal) | coder-db | `coder-db` | — | Postgres 16 for Coder |
| 5432 (internal) | gitea-db | `gitea-db` | — | Postgres 16 for Gitea |
| (no port) | coder-fkrebs-dev | (workspace) | (Coder app proxy) | Active Coder workspace |
| (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct111-runner`) |
| Port | Service | Notes |
|---|---|---|
| ~~7080~~ | ~~Coder~~ | **Moved to CT 104:7080** |
| ~~3000~~ | ~~Gitea~~ | **Moved to CT 104:3000** |
| ~~222~~ | ~~Gitea SSH~~ | **Moved to CT 104:222** |
---
@@ -238,9 +244,9 @@ Zoraxy routes to these external backends:
| [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard |
| [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API |
| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) |
| [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.42:3000` | Dev LXC 111 | Gitea (self-hosted Git) |
| [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.42:7080` | Dev LXC 111 | Coder (workspace orchestrator) |
| Gitea SSH | `192.168.1.42:222` | Dev LXC 111 | `ssh -p 222 git@git.nuclide.systems` |
| [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.40:3000` | Docker CT 104 | Gitea (migrated from CT 111 2026-05-26) |
| [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.40:7080` | Docker CT 104 | Coder (migrated from CT 111 2026-05-26) |
| Gitea SSH | `192.168.1.40:222` | Docker CT 104 | `ssh -p 222 git@git.nuclide.systems` |
---
services/dev-environment.md
+15 -9
View File
@@ -1,6 +1,8 @@
# Dev Environment — CT 111 (dev.nuclide.systems)
# Dev Environment — CT 104 (dev.nuclide.systems)
CT 111 hosts the self-hosted development platform: **Coder** (dev workspaces) + **Gitea** (internal repos).
**Migrated from CT 111 to CT 104 on 2026-05-26.** CT 111 ("dev") is decommissioned; LXC pending removal.
CT 104 hosts the self-hosted development platform: **Coder** (dev workspaces) + **Gitea** (internal repos).
## Services
@@ -126,16 +128,20 @@ Host git.nuclide.systems
---
## CT 111 specs
## CT 104 specs (current host)
| | |
|---|---|
| IP | 192.168.1.42 |
| Cores | 12 |
| RAM | 32GB |
| Rootfs | 60GB local-zfs (Docker image cache) |
| UNAS | /mnt/pve/unas (mp0) |
| GPU | renderD128 (Intel Arc Xe, by-path) |
| IP | 192.168.1.40 |
| Cores | 16 |
| RAM | 48GB |
| Rootfs | 200GB local-zfs |
| UNAS | /mnt/pve/unas (mp0) — coder + gitea data paths unchanged |
| GPU | renderD128 (Intel Arc Xe, idmapped) |
Compose files at `/opt/stacks/coder/` and `/opt/stacks/gitea/` on CT 104.
Gitea uses Redis (`gitea-redis`) for queue/cache/session — required because CT 104 uses idmapped NFS which doesn't support LevelDB file locks.
Act-runner at `/opt/stacks/act-runner/` — runner name `ct104-runner`.
---
services/proton-bridge.md
+42
View File
@@ -0,0 +1,42 @@
# Proton Mail Bridge
Headless Proton Mail Bridge running on CT 104 — exposes ProtonMail account as SMTP/IMAP endpoints for local services (n8n, Infisical, etc.).
## Stack
- **Host**: CT 104 (`docker`, 192.168.1.40), `/opt/stacks/proton-bridge/docker-compose.yml`
- **Image**: `shenxn/protonmail-bridge:latest`
- **SMTP**: `192.168.1.40:1025`
- **IMAP**: `192.168.1.40:1143`
- **Config volume**: `proton-bridge_proton_config`
## Initial login (one-time, interactive)
```bash
ssh root@192.168.1.40
docker exec -it proton-bridge /bin/bash
protonmail-bridge --cli
# Commands: login → (enter Proton credentials) → list (note bridge SMTP password)
# exit
```
After login the bridge stores credentials in the volume and runs headlessly on restart.
## SMTP credentials for other services
Once logged in, run `list` inside the CLI to get:
- **SMTP host**: `192.168.1.40`
- **SMTP port**: `1025`
- **SMTP user**: your Proton email address
- **SMTP password**: the bridge-generated password (not your Proton login password)
- **IMAP host**: `192.168.1.40`
- **IMAP port**: `1143`
## Ops
```bash
# CT 104
cd /opt/stacks/proton-bridge
docker compose up -d --force-recreate proton-bridge
docker logs proton-bridge -f
```
services/secrets-manager.md
+3 -3
View File
@@ -1,8 +1,8 @@
# Secrets Manager — Infisical on CT 112
# Secrets Manager — Infisical on CT 109
**Status: deployed 2026-05-22.** Running at `http://192.168.1.7:8200` (LAN-only, no Zoraxy route — secrets must not be internet-exposed).
**Status: deployed 2026-05-22; migrated CT 112 → CT 109 on 2026-05-26.** Running at `http://192.168.1.8:8200` (`http://secrets.nuclide.lan:8200`). LAN-only, no Zoraxy route — secrets must not be internet-exposed.
Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 112 (`secrets`, `192.168.1.7`). Compose at `/opt/stacks/infisical/` on CT 112.
Stack: `infisical/infisical:latest-postgres` + Postgres 16 + Redis 7, all on CT 109 (`ops`, `192.168.1.8`). Compose at `/opt/stacks/infisical/` on CT 109. CT 112 ("secrets") is decommissioned; LXC pending removal.
## Problem statement
services/zoraxy.md
+2 -2
View File
@@ -17,8 +17,8 @@ Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat bac
| ai.nuclide.systems | 192.168.1.40:14003 | ✓ | Bifrost LLM gateway (LiteLLM decommissioned 2026-05-26) |
| ~~arcane.nuclide.systems~~ | ~~192.168.1.8:10002~~ | — | **DECOMMISSIONED 2026-05-26** — replaced by Portainer |
| chat.nuclide.systems | 192.168.1.40:14002 | ✓ | Open WebUI (LobeChat decommissioned 2026-05-26) |
| dev.nuclide.systems | 192.168.1.42:7080 | ✓ | Coder (CT 111) |
| git.nuclide.systems | 192.168.1.42:3000 | — | Gitea (CT 111) |
| dev.nuclide.systems | 192.168.1.40:7080 | ✓ | Coder (CT 104; migrated from CT 111 2026-05-26) |
| git.nuclide.systems | 192.168.1.40:3000 | — | Gitea (CT 104; migrated from CT 111 2026-05-26) |
| gotify.nuclide.systems | 192.168.1.40:10003 | ✓ | Gotify push notifications |
| ha.nuclide.systems | 192.168.1.60:8123 | ✓ | Home Assistant (VM 100) |
| hoarder.nuclide.systems | 192.168.1.40:17001 | — | Karakeep bookmarks |