diff --git a/ct-inventory.md b/ct-inventory.md index 35e3285..eced545 100644 --- a/ct-inventory.md +++ b/ct-inventory.md @@ -11,7 +11,7 @@ Verified 2026-05-20 via `pct list`, `pct config `, `qm config 100` on `nuc`. | 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~65 containers) | mp0 NFS | Intel iGPU (card+render) | running | | 105 | nextcloud | LXC priv | 192.168.1.41/24 | 4 | 8196 | 100 GiB | Nextcloud AIO | mp0 **CIFS** (`//192.168.1.31/storage`) | Intel iGPU (render only) | running | | 108 | zoraxy | LXC unpriv | 192.168.1.4/24 | 2 | 2048 | 6 GiB | **Zoraxy** reverse proxy + ACME (`*.nuclide.systems`) | — | no | running | -| 109 | observe | LXC | ⚠️ TBD (`.6`=CT 113, `.7`=CT 112) — likely `.8` | 4 | 8192 | 50 GiB | **Planned** — Prometheus, Loki, Grafana, Arcane Manager, Dozzle, Homarr, Diun, sshwifty, Tinyauth, socket-proxy; Alloy agents on all hosts | — | no | **planned** (see `infra/proxmox-state.md` §16) | +| 109 | ops | LXC | ⚠️ TBD (`.6`=CT 113, `.7`=CT 112) — likely `.8` | 4 | 8192 | 50 GiB | **Planned** — Prometheus, Loki, Grafana, Arcane Manager, Dozzle, Homarr, Diun, sshwifty, Tinyauth, socket-proxy; Alloy agents on all hosts | — | no | **planned** (see `infra/proxmox-state.md` §16) | | 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running | | 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | Dev host — **Coder + Gitea** + workspaces | mp0 NFS | Intel iGPU (render only; symlinked at `/dev/dri/renderD128`) | running | | 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | **Infisical** secrets manager (own Postgres 16 + Redis 7; replaces scattered .env files) — LAN-only, no Zoraxy route | — | no | running | diff --git a/infra/proxmox-state.md b/infra/proxmox-state.md index aeb8d9f..2752a2d 100644 --- a/infra/proxmox-state.md +++ b/infra/proxmox-state.md @@ -651,7 +651,7 @@ Both log to `/var/log/{adguard,zoraxy}-update.log` and journal. Manual invoke: ` ### Layer 5 — Docker images (the ~75 containers) -**Plan: deploy Diun on CT 109** (observability LXC, see §16). Diun watches image tags on registries, posts to Gotify when a new image is available. Pulls remain manual (`docker compose pull && up -d`) — protects against latest-tag drift like the n8n incident pinned in `/opt/stacks/n8n/docker-compose.yaml`. +**Plan: deploy Diun on CT 109** (ops LXC, see §16). Diun watches image tags on registries, posts to Gotify when a new image is available. Pulls remain manual (`docker compose pull && up -d`) — protects against latest-tag drift like the n8n incident pinned in `/opt/stacks/n8n/docker-compose.yaml`. **Layer 6 — Nextcloud-AIO**: self-updates via the mastercontainer (CT 105). No external mechanism needed. @@ -710,11 +710,11 @@ Recovery latency improved from 5 min → 1 min; logging structured in `journalct --- -## 16. CT 109 "observe" — planned observability + ops LXC +## 16. CT 109 "ops" — planned observability + ops LXC Single LXC holding everything monitoring/ops-shaped. Sizing target: **4 cores / 8 GiB RAM / 50 GiB rootfs**, unprivileged, nesting=1. RAM bumped from 6 → 8 GiB to accommodate Loki. Disk bumped from 30 → 50 GiB for Loki log retention (30d) alongside Prometheus TSDB. -⚠️ **IP conflict:** inventory originally assigned `192.168.1.6` but CT 113 (db) is already live at `.6`. CT 109 needs the next free infra IP — likely `.7` or `.8` (verify against UniFi DHCP table before provisioning). +⚠️ **IP conflict:** inventory originally assigned `192.168.1.6` but CT 113 (db) took `.6` and CT 112 (secrets) took `.7`. CT 109 needs the next free infra IP — likely `.8` (verify against UniFi DHCP table before provisioning). **Access model (initial):** LAN-only. No Zoraxy routes until Tinyauth is deployed. Services reachable directly by IP. @@ -881,7 +881,7 @@ Captured here so the eventual Homarr config can be assembled in one pass. Groups | **D-Link DGS-1210-28P** | `http://192.168.1.10/` | core L2 switch; host on port 10 | | UNAS Pro | `https://192.168.1.31/` | UniFi NAS | -### Group: `observability` (to populate when CT 109 lands) +### Group: `ops` (to populate when CT 109 lands) | Service | URL | |---|---| @@ -924,7 +924,7 @@ Immich, Nextcloud, Vaultwarden, Karakeep, Memos, Paperless-ngx, n8n, ComfyUI, Lo - **Wire Postfix relayhost** (Gmail/Postmark/your SMTP) so unattended-upgrades + zfs-zed + cron failures actually mail you. - **Rotate Backrest plan** to back up real data (currently still pointed at `/media/data-dir` — a 50 KB test file from August 2025); see §7. 4. **Medium term**: - - **Build CT 109** observability LXC (§16) — Prometheus + Grafana + Arcane Manager + Dozzle + Homarr + Diun + Tinyauth + - **Build CT 109** ops LXC (§16) — Prometheus + Grafana + Arcane Manager + Dozzle + Homarr + Diun + Tinyauth - Migrate Gotify from CT 104 to CT 109 (~30 min of env-var updates) - **Rotate exposed secrets** that appeared in this transcript: Arcane `OIDC_CLIENT_SECRET`, `ENCRYPTION_KEY`, `JWT_SECRET`; Immich `IMMICH_API_KEY` - Backrest: enable auth, redesign plans to cover all data tiers (§7), front via Tinyauth for OIDC diff --git a/services/homelab-architecture.md b/services/homelab-architecture.md index b13de6e..cfad97f 100644 --- a/services/homelab-architecture.md +++ b/services/homelab-architecture.md @@ -24,7 +24,7 @@ across ~23 compose stacks. Principle: **self-host everything**, OIDC SSO, - `108` lxc **zoraxy** — reverse proxy (2c/2G) → `.4` - `110` lxc **id** — Pocket-ID OIDC IdP (1c/1G/4G) → `.5`; migrated off 104 on 2026-05-20 - `111` lxc **dev** — Coder + Gitea (12c/32G/60G) → `.42`; new 2026-05-20 - - `109` lxc **observe** *(planned)* — Prometheus/Grafana/Arcane/Dozzle/Homarr/Tinyauth; see §16 of `infra/proxmox-state.md` + - `109` lxc **ops** *(planned)* — Prometheus/Grafana/Arcane/Dozzle/Homarr/Tinyauth; see §16 of `infra/proxmox-state.md` - `113` lxc **db** — postgres 17 + pgAdmin + WAL-G → Garage S3 + Arcane edge agent → `.6`; provisioned 2026-05-21 - Storages: `local` (dir), `local-zfs` (zfspool, ~1.9T), `unas` (nfs, ~20T). - **Ubiquiti UniFi** — UDM "Home" (UDMA6A8, UCG Fiber) gateway + 4× U7-series @@ -394,7 +394,7 @@ flowchart TB docker104["CT 104 · docker
(.40) · 16c/48G/200G
~65 containers · Intel Arc passthrough"] nc["CT 105 · nextcloud
(.41)
Nextcloud AIO (CIFS to UNAS)"] zoraxy["CT 108 · zoraxy
(.4)
reverse proxy + ACME"] - obs(["CT 109 · observe
(.6) · planned
Prom / Graf / Arcane / Homarr / Tinyauth"]) + obs(["CT 109 · ops
(.8) · planned
Prom / Graf / Arcane / Homarr / Tinyauth"]) id["CT 110 · id
(.5)
Pocket-ID (moved here 2026-05-20)"] dev["CT 111 · dev
(.42) · 12c/32G/60G
Coder + Gitea + workspaces · Intel Arc"] db(["CT 113 · db
(.?) · planned
shared Postgres + pgbouncer"]) @@ -444,12 +444,12 @@ flowchart LR ### MCP plane — gateway control, child workers -The MCP gateway on CT 104 is the OIDC-gated front; ~23 child MCP servers run on the same docker network (`ai-internal`). When CT 109 "observe" is built, the gateway moves to CT 109 and reaches CT 104's docker daemon via a socket-proxy; the children stay put. +The MCP gateway on CT 104 is the OIDC-gated front; ~23 child MCP servers run on the same docker network (`ai-internal`). When CT 109 "ops" is built, the gateway moves to CT 109 and reaches CT 104's docker daemon via a socket-proxy; the children stay put. ```mermaid flowchart LR client[["Claude Code / Cursor / LobeChat"]] - gw["MCP gateway
(CT 104 → CT 109 when 109 lands)
mcp.nuclide.systems"] + gw["MCP gateway
(CT 104 → CT 109 ops when 109 lands)
mcp.nuclide.systems"] client -- Bearer / OIDC --> gw subgraph "CT 104 · ai-internal docker net" direction TB