docs: dissolve Stacks chapter → infra/; reconcile portmap, storage, changelog (2026-05-21)

- Move PORTMAP, storage, volumes, docker-networks from stacks/ → infra/ - Remove stacks/todo.md (content migrated to CHANGELOG + ideas) - portmap: add new MCP servers (18005/07/09/10/11), fix s3.nuclide.systems entry, update Daytona OIDC row to DECOMMISSIONED, add Vaultwarden OIDC placeholder, add DevOps table row for MCP server Gitea repos - storage: add Garage S3 buckets subsection (lobe-files + chat-artifacts) - docker-networks: remove daytona-minimal_daytona-network row + daytona from "Stacks Keeping Own Networks" list - ct-inventory: add CT 112 (secrets/Infisical, planned) - CHANGELOG: prepend 2026-05-21 entry (docs, S3, MCP, dev env, Gitea repos, planned) - ideas/stack-ideas: add §11 Renovate Bot, §12 egress firewall, §13 local LLM - mkdocs.yml: replace nav — dissolve Stacks chapter, add infra/ entries
2026-05-21 07:54:21 +02:00
parent 630c5e0ae5
commit ad0fdd2beb
8 changed files with 91 additions and 179 deletions
@@ -0,0 +1,236 @@
+# Port Map — NUC 14 Docker Stacks
+
+> **Reverse proxy**: [Zoraxy v3.3.2](http://192.168.1.4:8000) on `192.168.1.4:8000` (LXC 108)
+> Wildcard cert `*.nuclide.systems` · source of truth: [`proxy/zoraxy/routes.json`](proxy/zoraxy/routes.json)
+> Manage routes: `uv run scripts/zoraxy_sync.py [--apply|--prune|--list]`
+
+## Port Scheme
+
+| Range | Category |
+|---|---|
+| 10000–10999 | Infrastructure |
+| 11000–11999 | Security & Auth |
+| 12000–12999 | Media – Immich |
+| 13000–13999 | Media – Downloads / Arr |
+| 14000–14999 | AI Stack |
+| 15000–15999 | Documents |
+| 16000–16999 | Automation |
+| 17000–17999 | Notes & Bookmarks |
+| 18000–18999 | DevOps / Image Gen |
+| 19000–19999 | Tracking |
+| 20000–20999 | Storage Admin |
+| 30000–30999 | VPN Control |
+
+---
+
+## Infrastructure (10000–10999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [10000](http://192.168.1.40:10000) | Homepage | `homepage` | — | Dashboard, LAN only |
+| [10001](http://192.168.1.40:10001) | Dozzle | `dozzle` | [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | Log viewer |
+| [10002](http://192.168.1.40:10002) | Arcane | `arcane` | [arcane.nuclide.systems](https://arcane.nuclide.systems) | Web IDE |
+| [10003](http://192.168.1.40:10003) | Gotify | `gotify` | [gotify.nuclide.systems](https://gotify.nuclide.systems) | Push notifications |
+| [10004](http://192.168.1.40:10004) | Garage S3 API | `garage` | [s3.nuclide.systems](https://s3.nuclide.systems) | FIXED 2026-05-21: proxied by Zoraxy with ACME TLS. Garage API accessible at `https://s3.nuclide.systems`. Internal: `http://garage:3900` |
+| 10005 (127.0.0.1 only) | Garage Admin | `garage` | — | localhost only |
+
+---
+
+## Security & Auth (11000–11999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager · Pocket-ID OIDC client created 2026-05-21; auth flow not yet configured |
+
+> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20. See the [External Services](#external-services-not-on-nuc-docker) table below.
+
+---
+
+## Media – Immich (12000–12999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [12000](http://192.168.1.40:12000) | Immich | `immich_server` | [immich.nuclide.systems](https://immich.nuclide.systems) | Photos/videos |
+| — | Immich Power Tools | `immich_power_tools` | [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | Container-internal :3000, Zoraxy proxy |
+
+---
+
+## Media – Downloads / Arr Stack (13000–13999)
+
+All arr-stack services run behind `vpn_gluetun` container network.
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [13001](http://192.168.1.40:13001) | RDTClient | `rdtclient` | — | LAN only |
+| [13002](http://192.168.1.40:13002) | Prowlarr | `prowlarr` | — | LAN only |
+| [13003](http://192.168.1.40:13003) | Audiobookshelf | `audiobookshelf` | [abs.nuclide.systems](https://abs.nuclide.systems) | |
+| [13004](http://192.168.1.40:13004) | ShelfArr | `shelfarr` | — | LAN only |
+| [13005](http://192.168.1.40:13005) | Flaresolverr | `flaresolverr` | — | Internal only |
+| [30000](http://192.168.1.40:30000) | Gluetun VPN control | `vpn_gluetun` | — | HTTP control API |
+
+---
+
+## AI Stack (14000–14999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [14000](http://192.168.1.40:14000) | LiteLLM | `litellm` | [ai.nuclide.systems](https://ai.nuclide.systems) | LLM proxy gateway |
+| [14001](http://192.168.1.40:14001) | LobeHub | `lobehub` | [chat.nuclide.systems](https://chat.nuclide.systems) | Chat UI |
+| [14002](http://192.168.1.40:14002) | Qdrant | `qdrant_scientific` | — | Vector DB, internal only |
+| [8080](http://192.168.1.40:8080) | MCP Gateway | `mcp-gateway` | [mcp.nuclide.systems](https://mcp.nuclide.systems) | Pocket ID gated; spawns MCP servers on `ai-internal` |
+| [18002](http://192.168.1.40:18002) | ComfyUI | `comfyui` | — | LAN only (Intel Arc iGPU, FLUX.1-schnell GGUF) |
+| [18003](http://192.168.1.40:18003) | ComfyUI MCP | `comfyui-mcp` | — | FastMCP; reachable via gateway at `mcp.nuclide.systems/comfyui/mcp` |
+| [18005](http://192.168.1.40:18005) | Docling MCP | `docling-mcp` | — | SAIA Docling PDF→Markdown; reachable via gateway |
+| [18007](http://192.168.1.40:18007) | Kroki MCP | `kroki-mcp` | — | Diagram rendering; reachable via gateway |
+| [18009](http://192.168.1.40:18009) | Speaches | `speaches` | — | TTS/STT; LAN only |
+| [18010](http://192.168.1.40:18010) | Shepard MCP | `shepard-mcp` | — | Shepard research platform; reachable via gateway |
+| [18011](http://192.168.1.40:18011) | Upload-artifact MCP | `upload-artifact-mcp` | — | S3 chat-artifacts upload; reachable via gateway |
+| — | SearXNG | `searxng` | — | Internal, `shared_backend`, used by LobeHub |
+
+---
+
+## Documents (15000–15999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [15000](http://192.168.1.40:15000) | Traccar HTTP | `traccar` | [traccar.nuclide.systems](https://traccar.nuclide.systems) | GPS tracking UI |
+| [15001](http://192.168.1.40:15001) | Traccar GPS | `traccar` | — | TCP+UDP watch protocol |
+| [15002](http://192.168.1.40:15002) | Paperless AI | `paperless-ai` | [paperless-ai.nuclide.systems](https://paperless-ai.nuclide.systems) | Internal-only Zoraxy policy |
+| [15003](http://192.168.1.40:15003) | Paperless-ngx | `paperless-ngx-webserver-1` | [paperless.nuclide.systems](https://paperless.nuclide.systems) | Internal-only Zoraxy policy |
+
+---
+
+## Automation (16000–16999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [16000](http://192.168.1.40:16000) | n8n | `n8n` | [n8n.nuclide.systems](https://n8n.nuclide.systems) | Workflow automation |
+
+---
+
+## Notes & Bookmarks (17000–17999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [17000](http://192.168.1.40:17000) | Memos | `memos` | [memos.nuclide.systems](https://memos.nuclide.systems) | Notes |
+| [17001](http://192.168.1.40:17001) | Karakeep | `karakeep` | [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | Bookmarks |
+
+---
+
+## DevOps (18000–18999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+<!-- Daytona DECOMMISSIONED 2026-05-20; replaced by Coder on CT 111. Compose renamed *.DECOMMISSIONED-2026-05-20. -->
+| — | MCP servers (Gitea repos) | See AI Stack §18000 | — | `mcp-comfyui`, `mcp-docling`, `mcp-shepard`, `mcp-upload-artifact` at `git.nuclide.systems/fkrebs/` |
+
+---
+
+## Tracking (19000–19999)
+
+_Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._
+
+---
+
+## Storage Admin (20000–20999)
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| 20010 (127.0.0.1 only) | pgAdmin | `pgadmin` | — | localhost only |
+
+---
+
+## LXC 111 — Dev (`192.168.1.42`)
+
+CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest.
+
+| Port | Service | Container | Public URL | Notes |
+|---|---|---|---|---|
+| [7080](http://192.168.1.42:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID; password auth disabled |
+| [3000](http://192.168.1.42:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC; password form disabled |
+| [222](http://192.168.1.42:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` |
+| 5432 (internal) | coder-db | `coder-db` | — | Postgres 16 for Coder |
+| 5432 (internal) | gitea-db | `gitea-db` | — | Postgres 16 for Gitea |
+| [13080](http://192.168.1.42:13080) | docs site | `docs-server` | — (LAN-only) | mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min |
+| (no port) | coder-fkrebs-dev | (workspace) | (Coder app proxy) | Active Coder workspace |
+| (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct111-runner`) |
+
+---
+
+## External Services (Not on NUC Docker)
+
+Zoraxy routes to these external backends:
+
+| Domain | Target | Host | Service |
+|---|---|---|---|
+| [ha.nuclide.systems](https://ha.nuclide.systems) | `192.168.1.60:8123` | Home Assistant VM 100 | Home automation |
+| [nc.nuclide.systems](https://nc.nuclide.systems) | `192.168.1.41:11000` | Nextcloud LXC 105 | Cloud storage |
+| [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM 100 | EV charger OCPP |
+| [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard |
+| [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API |
+| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) |
+| [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.42:3000` | Dev LXC 111 | Gitea (self-hosted Git) |
+| [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.42:7080` | Dev LXC 111 | Coder (workspace orchestrator) |
+| Gitea SSH | `192.168.1.42:222` | Dev LXC 111 | `ssh -p 222 git@git.nuclide.systems` |
+
+---
+
+## Zoraxy Public Routes (proxied via `192.168.1.4`)
+
+| Domain | Backend (NUC `192.168.1.40`) | Port |
+|---|---|---|
+| [ai.nuclide.systems](https://ai.nuclide.systems) | litellm | 14000 |
+| [chat.nuclide.systems](https://chat.nuclide.systems) | lobehub | 14001 |
+| [mcp.nuclide.systems](https://mcp.nuclide.systems) | mcp-gateway | 8080 |
+| [arcane.nuclide.systems](https://arcane.nuclide.systems) | arcane | 10002 |
+| [gotify.nuclide.systems](https://gotify.nuclide.systems) | gotify | 10003 |
+| [vault.nuclide.systems](https://vault.nuclide.systems) | vaultwarden | 11001 |
+| [immich.nuclide.systems](https://immich.nuclide.systems) | immich_server | 12000 |
+| [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | immich_power_tools | (container-internal) |
+| [abs.nuclide.systems](https://abs.nuclide.systems) | audiobookshelf | 13003 |
+| [n8n.nuclide.systems](https://n8n.nuclide.systems) | n8n | 16000 |
+| [memos.nuclide.systems](https://memos.nuclide.systems) | memos | 17000 |
+| [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | karakeep | 17001 |
+| [traccar.nuclide.systems](https://traccar.nuclide.systems) | traccar | 15000 |
+| [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | dozzle | 10001 |
+| [s3.nuclide.systems](https://s3.nuclide.systems) | garage | 10004 |
+
+**Not publicly proxied** (LAN / localhost only): pgadmin, paperless, paperless-ai, comfyui, comfyui-mcp, rdtclient, prowlarr, shelfarr, qdrant.
+
+---
+
+## Known Issues
+
+- **`lobe-postgres` / `lobe-redis`**: host-port exposed (`0.0.0.0:5432/6379`) — firewall blocks external access but ideally restricted to localhost.
+
+---
+
+## OIDC Client Registry (Pocket ID — `id.nuclide.systems`)
+
+| Client ID | Name | Redirect URIs |
+|---|---|---|
+| `e73bb7b9` | litellm | (empty = accept all) — used by LiteLLM UI + MCP Gateway |
+| `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` |
+| `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` |
+| `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` |
+| `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile |
+| `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` |
+| `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` |
+| `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` |
+| `0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback` |
+| `9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` |
+| `38469e7e` | Proxmox VE | `https://192.168.1.20:8006` |
+| ~~798a367f~~ | ~~daytona~~ | **DECOMMISSIONED — remove from Pocket-ID** |
+| `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` |
+| `d8733fcc` | shelfarr | `*` |
+| `78c78998` | Claude MCP | `https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback` |
+| `82ca2d53` | nuc-ai | (empty) — used by spawned MCP servers |
+| `7fe1a14b` | zoraxy | (empty) |
+| `af2f837b` | mcp-auth | (empty) — legacy, unused |
+| (new) | vaultwarden | `https://vault.nuclide.systems/auth/callback` | Created 2026-05-21; SSO wiring deferred |
+
+**OIDC Endpoints** (corrected 2026-05-17 — previously used wrong `/api/v1/oauth2/` path):
+- Authorization: `https://id.nuclide.systems/authorize`
+- Token: `https://id.nuclide.systems/api/oidc/token`
+- Userinfo: `https://id.nuclide.systems/api/oidc/userinfo`
+- Discovery: `https://id.nuclide.systems/.well-known/openid-configuration`