From fc6507abd2cebb8fce19bbcdcdc47be39f519408 Mon Sep 17 00:00:00 2001 From: "fkrebs (via Claude)" Date: Tue, 26 May 2026 22:17:03 +0200 Subject: [PATCH] =?UTF-8?q?migrate=20id=20(Pocket-ID)=20CT=20110=20?= =?UTF-8?q?=E2=86=92=20CT=20109;=20destroy=20CT=20110?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Pocket-ID now on CT 109 ops at :11000 (was CT 110 :11000) - Zoraxy id.nuclide.systems → 192.168.1.8:11000 - AdGuard id.nuclide.lan → 192.168.1.8 - Homepage docker.yaml: removed ct110/ct111/ct112 (all destroyed) - Homepage services.yaml: pocket-id server: my-local - pocket-id.md: updated host, client table CTs corrected - portainer.md: CT 110 row struck through - portmap, ct-inventory, zoraxy all updated - CT 110 LXC destroyed Co-Authored-By: Claude Sonnet 4.6 --- ct-inventory.md | 4 ++-- infra/portmap.md | 7 ++++--- services/pocket-id.md | 12 ++++++------ services/portainer.md | 2 +- services/zoraxy.md | 2 +- 5 files changed, 14 insertions(+), 13 deletions(-) diff --git a/ct-inventory.md b/ct-inventory.md index ab05201..7bd511e 100644 --- a/ct-inventory.md +++ b/ct-inventory.md @@ -11,8 +11,8 @@ Verified 2026-05-20 via `pct list`, `pct config `, `qm config 100` on `nuc`. | 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~70 containers); **Gitea** (:3000/:222) + **Coder** (:7080) migrated from CT 111 2026-05-26; **Proton Mail Bridge** (:1025 SMTP/:1143 IMAP) | mp0 NFS | Intel iGPU (card+render) | running | | 105 | nextcloud | LXC priv | 192.168.1.41/24 | 4 | 8196 | 100 GiB | Nextcloud AIO | mp0 NFS | Intel iGPU (render only) | running | | 108 | zoraxy | LXC unpriv | 192.168.1.4/24 | 2 | 2048 | 6 GiB | **Zoraxy** reverse proxy + ACME (`*.nuclide.systems`) | — | no | running | -| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:10000) + Portainer (:9000) + Dozzle (server) + docs-server + **Infisical** (:8200, migrated from CT 112 2026-05-26); Dozzle agents on all 7 Docker hosts | — | no | running | -| 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running | +| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:10000) + Portainer (:9000) + Dozzle (server) + docs-server + **Infisical** (:8200) + **Pocket-ID** (:11000, migrated from CT 110 2026-05-26); Dozzle agents on all Docker hosts | — | no | running | +| ~~110~~ | ~~id~~ | — | — | — | — | — | **DESTROYED 2026-05-26** — Pocket-ID migrated to CT 109; LXC removed | — | — | — | | ~~111~~ | ~~dev~~ | — | — | — | — | — | **DESTROYED 2026-05-26** — Coder + Gitea migrated to CT 104; LXC removed | — | — | — | | ~~112~~ | ~~secrets~~ | — | — | — | — | — | **DESTROYED 2026-05-26** — Infisical migrated to CT 109; LXC removed | — | — | — | | 113 | db | LXC unpriv | 192.168.1.6/24 | 2 | 4096 | 40 GiB | Shared Postgres 17 + pgAdmin + WAL-G → Garage S3; Arcane edge agent | — | no | running | diff --git a/infra/portmap.md b/infra/portmap.md index 9e9825e..5ac0e70 100644 --- a/infra/portmap.md +++ b/infra/portmap.md @@ -38,11 +38,12 @@ | [9221](http://192.168.1.8:9221) | CT 109 | pve-exporter | Proxmox VE metrics; auth: `monitor@pve!prometheus` | | [12345](http://192.168.1.8:12345) | CT 109 | Alloy (self) | agent UI; also runs on all other hosts at :12345 | | [4090](http://192.168.1.8:4090) | CT 109 | Wetty | LAN only (127.0.0.1); web SSH → jump-menu.sh on nuc | -| [10000](http://192.168.1.8:10000) | CT 109 | Homepage | LAN only (`ops.nuclide.lan:10000`); service dashboard; remote Docker via socket-proxy :2375 on CT 110/111/112/113, direct TCP on CT 104 | +| [10000](http://192.168.1.8:10000) | CT 109 | Homepage | LAN only (`ops.nuclide.lan:10000`); service dashboard; remote Docker via socket-proxy :2375 on CT 113, direct TCP on CT 104 | | [10001](http://192.168.1.8:10001) | CT 109 | Dozzle | LAN only; live log viewer; agents on all 7 Docker hosts | | ~~10002~~ | ~~CT 109~~ | ~~Arcane~~ | **DECOMMISSIONED 2026-05-26** — replaced by Portainer | | [13080](http://192.168.1.8:13080) | CT 109 | docs-server | LAN only; mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min — migrated from CT 111 2026-05-23 | | [8200](http://192.168.1.8:8200) | CT 109 | Infisical | LAN only; secrets manager; migrated from CT 112 2026-05-26; `http://secrets.nuclide.lan:8200` | +| [11000](http://192.168.1.8:11000) | CT 109 | Pocket-ID | `https://id.nuclide.systems`; OIDC IdP; migrated from CT 110 2026-05-26 | | 9100 | CT 109 | node-exporter | host-network, self-scrape | | 9100 | CT 104 | node-exporter | standalone stack `/opt/stacks/monitoring/`; scraped by CT 109 | @@ -87,7 +88,7 @@ Scrape targets (CT 109 Prometheus): ~~`litellm` CT104:14000/metrics/~~ (**SUNSET |---|---|---|---|---| | [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager · Pocket-ID OIDC client created 2026-05-21; auth flow not yet configured | -> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20. See the [External Services](#external-services-not-on-nuc-docker) table below. +> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20, then **to CT 109** on 2026-05-26. See the [External Services](#external-services-not-on-nuc-docker) table below. --- @@ -243,7 +244,7 @@ Zoraxy routes to these external backends: | [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM 100 | EV charger OCPP | | [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard | | [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API | -| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) | +| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.8:11000` | Ops CT 109 | Pocket-ID OIDC IdP (migrated CT110→CT109 2026-05-26) | | [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.40:3000` | Docker CT 104 | Gitea (migrated from CT 111 2026-05-26) | | [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.40:7080` | Docker CT 104 | Coder (migrated from CT 111 2026-05-26) | | Gitea SSH | `192.168.1.40:222` | Docker CT 104 | `ssh -p 222 git@git.nuclide.systems` | diff --git a/services/pocket-id.md b/services/pocket-id.md index 3c5688a..2c9e297 100644 --- a/services/pocket-id.md +++ b/services/pocket-id.md @@ -1,7 +1,7 @@ # Pocket-ID — OIDC Identity Provider -**CT 110 "id"** · `192.168.1.5:11000` · `https://id.nuclide.systems` -Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres). +**CT 109 "ops"** · `192.168.1.8:11000` · `https://id.nuclide.systems` +Migrated CT 104 → CT 110 on 2026-05-20; CT 110 → CT 109 on 2026-05-26. SQLite-only (no Postgres). Compose at `/opt/stacks/pocketid/` on CT 109. ## What it does @@ -39,13 +39,13 @@ Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports | Service | CT | Client ID | Redirect URI | Notes | |---|---|---|---|---| -| Gitea | 111 | `9444609e-6151-4296-aaeb-576da886c887` | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled | -| Coder | 111 | `0aee4280-da5e-4782-a790-c7565c6c1366` | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled | +| Gitea | 104 | `9444609e-6151-4296-aaeb-576da886c887` | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled | +| Coder | 104 | `0aee4280-da5e-4782-a790-c7565c6c1366` | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled | | n8n | 104 | `33135ad4-a3ed-45d3-938f-639abd2b9663` | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 | | Vaultwarden | 104 | `7cda8d60-9bfa-44ca-ae9b-8ae436024a8b` | `https://vault.nuclide.systems/identity/connect/token` | created 2026-05-21; auth flow not yet wired | -| Homarr | 109 | `63a94e30-7bbf-4511-9a4c-82d992633427` | `http://192.168.1.8:7575/api/auth/callback/oidc` | SSO active 2026-05-23; LAN alias added 2026-05-24 | +| ~~Homarr~~ | ~~109~~ | ~~`63a94e30-7bbf-4511-9a4c-82d992633427`~~ | — | **DECOMMISSIONED** — replaced by Homepage | | Grafana | 109 | `92d987d5-d066-4e19-8fa1-960114c1244c` | `http://192.168.1.8:3000/login/generic_oauth` | SSO active 2026-05-23; PKCE enabled; LAN alias added 2026-05-24 | -| Infisical | 112 | `b2069075-ede2-4251-ad1f-9a62e6a188b3` | `http://192.168.1.7:8200/api/v1/sso/oidc/callback` | LAN alias added 2026-05-24; manual OIDC config still pending | +| Infisical | 109 | `b2069075-ede2-4251-ad1f-9a62e6a188b3` | `http://192.168.1.8:8200/api/v1/sso/oidc/callback` | migrated CT112→CT109 2026-05-26; manual OIDC config still pending | | Proxmox VE | host | `38469e7e-1fff-4841-83a9-74bf38d847eb` | `https://192.168.1.20:8006` | LAN alias added 2026-05-24 | | Nextcloud | 105 | `a14b8076-985c-4989-95f8-e0283bfbdf32` | `https://nc.nuclide.systems/apps/oidc_login/oidc` | | | Immich | 104 | `9c91c18b-e009-4371-9c54-b71d54e3c77a` | `https://photos.nuclide.systems/auth/login` | | diff --git a/services/portainer.md b/services/portainer.md index cbdcabe..2883dce 100644 --- a/services/portainer.md +++ b/services/portainer.md @@ -35,7 +35,7 @@ curl -X POST http://192.168.1.8:9000/api/licenses/add \ |---|---|---|---|---| | CT 109 | ops | unix:///var/run/docker.sock | — | built-in | | CT 104 | docker | 192.168.1.40 | 9001 | `/opt/stacks/portainer-agent.yml` | -| CT 110 | id | 192.168.1.5 | 9001 | `/opt/stacks/ops-agents/docker-compose.yml` | +| ~~CT 110~~ | ~~id~~ | ~~192.168.1.5~~ | — | **DESTROYED 2026-05-26** — Pocket-ID moved to CT 109 | | CT 111 | dev | 192.168.1.42 | 9001 | `/opt/stacks/ops-agents/docker-compose.yml` | | CT 112 | secrets | 192.168.1.7 | 9001 | `/opt/stacks/ops-agents/docker-compose.yml` | | CT 113 | db | 192.168.1.6 | 9001 | `/opt/stacks/db/docker-compose.yml` | diff --git a/services/zoraxy.md b/services/zoraxy.md index 4c5ccaa..2d4dfb1 100644 --- a/services/zoraxy.md +++ b/services/zoraxy.md @@ -22,7 +22,7 @@ Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat bac | gotify.nuclide.systems | 192.168.1.40:10003 | ✓ | Gotify push notifications | | ha.nuclide.systems | 192.168.1.60:8123 | ✓ | Home Assistant (VM 100) | | hoarder.nuclide.systems | 192.168.1.40:17001 | — | Karakeep bookmarks | -| id.nuclide.systems | 192.168.1.5:11000 | — | Pocket-ID OIDC (CT 110) | +| id.nuclide.systems | 192.168.1.8:11000 | — | Pocket-ID OIDC (CT 109; migrated from CT 110 2026-05-26) | | immich.nuclide.systems | 192.168.1.40:12000 | ✓ | Immich photos | | ~~mcp.nuclide.systems~~ | ~~192.168.1.40:8080~~ | — | **DECOMMISSIONED 2026-05-26** — mcp-gateway removed; MCP now at `https://ai.nuclide.systems/mcp` (Bifrost) | | memos.nuclide.systems | 192.168.1.40:17000 | — | Memos notes |