migrate id (Pocket-ID) CT 110 → CT 109; destroy CT 110

- Pocket-ID now on CT 109 ops at :11000 (was CT 110 :11000) - Zoraxy id.nuclide.systems → 192.168.1.8:11000 - AdGuard id.nuclide.lan → 192.168.1.8 - Homepage docker.yaml: removed ct110/ct111/ct112 (all destroyed) - Homepage services.yaml: pocket-id server: my-local - pocket-id.md: updated host, client table CTs corrected - portainer.md: CT 110 row struck through - portmap, ct-inventory, zoraxy all updated - CT 110 LXC destroyed Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 22:17:03 +02:00
parent cf2aad887b
commit fc6507abd2
5 changed files with 14 additions and 13 deletions
@@ -11,8 +11,8 @@ Verified 2026-05-20 via `pct list`, `pct config <id>`, `qm config 100` on `nuc`.
 | 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~70 containers); **Gitea** (:3000/:222) + **Coder** (:7080) migrated from CT 111 2026-05-26; **Proton Mail Bridge** (:1025 SMTP/:1143 IMAP) | mp0 NFS | Intel iGPU (card+render) | running |
 | 105 | nextcloud | LXC priv | 192.168.1.41/24 | 4 | 8196 | 100 GiB | Nextcloud AIO | mp0 NFS | Intel iGPU (render only) | running |
 | 108 | zoraxy | LXC unpriv | 192.168.1.4/24 | 2 | 2048 | 6 GiB | **Zoraxy** reverse proxy + ACME (`*.nuclide.systems`) | — | no | running |
-| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:10000) + Portainer (:9000) + Dozzle (server) + docs-server + **Infisical** (:8200, migrated from CT 112 2026-05-26); Dozzle agents on all 7 Docker hosts | — | no | running |
+| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | **Ops** — Prometheus + Grafana + Loki + Alloy + pve-exporter + **Homepage** (:10000) + Portainer (:9000) + Dozzle (server) + docs-server + **Infisical** (:8200) + **Pocket-ID** (:11000, migrated from CT 110 2026-05-26); Dozzle agents on all Docker hosts | — | no | running |
-| 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | **Pocket-ID** OIDC IdP (`id.nuclide.systems`); migrated off CT 104 on 2026-05-20 | — | no | running |
+| ~~110~~ | ~~id~~ | — | — | — | — | — | **DESTROYED 2026-05-26** — Pocket-ID migrated to CT 109; LXC removed | — | — | — |
 | ~~111~~ | ~~dev~~ | — | — | — | — | — | **DESTROYED 2026-05-26** — Coder + Gitea migrated to CT 104; LXC removed | — | — | — |
 | ~~112~~ | ~~secrets~~ | — | — | — | — | — | **DESTROYED 2026-05-26** — Infisical migrated to CT 109; LXC removed | — | — | — |
 | 113 | db | LXC unpriv | 192.168.1.6/24 | 2 | 4096 | 40 GiB | Shared Postgres 17 + pgAdmin + WAL-G → Garage S3; Arcane edge agent | — | no | running |
@@ -38,11 +38,12 @@
 | [9221](http://192.168.1.8:9221) | CT 109 | pve-exporter | Proxmox VE metrics; auth: `monitor@pve!prometheus` |
 | [12345](http://192.168.1.8:12345) | CT 109 | Alloy (self) | agent UI; also runs on all other hosts at :12345 |
 | [4090](http://192.168.1.8:4090) | CT 109 | Wetty | LAN only (127.0.0.1); web SSH → jump-menu.sh on nuc |
-| [10000](http://192.168.1.8:10000) | CT 109 | Homepage | LAN only (`ops.nuclide.lan:10000`); service dashboard; remote Docker via socket-proxy :2375 on CT 110/111/112/113, direct TCP on CT 104 |
+| [10000](http://192.168.1.8:10000) | CT 109 | Homepage | LAN only (`ops.nuclide.lan:10000`); service dashboard; remote Docker via socket-proxy :2375 on CT 113, direct TCP on CT 104 |
 | [10001](http://192.168.1.8:10001) | CT 109 | Dozzle | LAN only; live log viewer; agents on all 7 Docker hosts |
 | ~~10002~~ | ~~CT 109~~ | ~~Arcane~~ | **DECOMMISSIONED 2026-05-26** — replaced by Portainer |
 | [13080](http://192.168.1.8:13080) | CT 109 | docs-server | LAN only; mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min — migrated from CT 111 2026-05-23 |
 | [8200](http://192.168.1.8:8200) | CT 109 | Infisical | LAN only; secrets manager; migrated from CT 112 2026-05-26; `http://secrets.nuclide.lan:8200` |
 | [11000](http://192.168.1.8:11000) | CT 109 | Pocket-ID | `https://id.nuclide.systems`; OIDC IdP; migrated from CT 110 2026-05-26 |
 | 9100 | CT 109 | node-exporter | host-network, self-scrape |
 | 9100 | CT 104 | node-exporter | standalone stack `/opt/stacks/monitoring/`; scraped by CT 109 |
@@ -87,7 +88,7 @@ Scrape targets (CT 109 Prometheus): ~~`litellm` CT104:14000/metrics/~~ (**SUNSET
 |---|---|---|---|---|
 | [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager · Pocket-ID OIDC client created 2026-05-21; auth flow not yet configured |
-> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20. See the [External Services](#external-services-not-on-nuc-docker) table below.
+> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20, then **to CT 109** on 2026-05-26. See the [External Services](#external-services-not-on-nuc-docker) table below.
 ---
@@ -243,7 +244,7 @@ Zoraxy routes to these external backends:
 | [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM 100 | EV charger OCPP |
 | [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard |
 | [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API |
-| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) |
+| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.8:11000` | Ops CT 109 | Pocket-ID OIDC IdP (migrated CT110→CT109 2026-05-26) |
 | [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.40:3000` | Docker CT 104 | Gitea (migrated from CT 111 2026-05-26) |
 | [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.40:7080` | Docker CT 104 | Coder (migrated from CT 111 2026-05-26) |
 | Gitea SSH | `192.168.1.40:222` | Docker CT 104 | `ssh -p 222 git@git.nuclide.systems` |
@@ -1,7 +1,7 @@
 # Pocket-ID — OIDC Identity Provider
-**CT 110 "id"** · `192.168.1.5:11000` · `https://id.nuclide.systems`  
+**CT 109 "ops"** · `192.168.1.8:11000` · `https://id.nuclide.systems`  
-Migrated from CT 104 on 2026-05-20. SQLite-only (no Postgres).
+Migrated CT 104 → CT 110 on 2026-05-20; CT 110 → CT 109 on 2026-05-26. SQLite-only (no Postgres). Compose at `/opt/stacks/pocketid/` on CT 109.
 ## What it does
@@ -39,13 +39,13 @@ Pocket-ID is a lightweight OIDC 2.1 / OAuth 2.0 IdP. Every service that supports
 | Service | CT | Client ID | Redirect URI | Notes |
 |---|---|---|---|---|
-| Gitea | 111 | `9444609e-6151-4296-aaeb-576da886c887` | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled |
+| Gitea | 104 | `9444609e-6151-4296-aaeb-576da886c887` | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | SSO active; local password sign-in disabled |
-| Coder | 111 | `0aee4280-da5e-4782-a790-c7565c6c1366` | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled |
+| Coder | 104 | `0aee4280-da5e-4782-a790-c7565c6c1366` | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | SSO active; password auth disabled |
 | n8n | 104 | `33135ad4-a3ed-45d3-938f-639abd2b9663` | `https://n8n.nuclide.systems/rest/oauth2-credential/callback` | encryption key rotated 2026-05-22 |
 | Vaultwarden | 104 | `7cda8d60-9bfa-44ca-ae9b-8ae436024a8b` | `https://vault.nuclide.systems/identity/connect/token` | created 2026-05-21; auth flow not yet wired |
-| Homarr | 109 | `63a94e30-7bbf-4511-9a4c-82d992633427` | `http://192.168.1.8:7575/api/auth/callback/oidc` | SSO active 2026-05-23; LAN alias added 2026-05-24 |
+| ~~Homarr~~ | ~~109~~ | ~~`63a94e30-7bbf-4511-9a4c-82d992633427`~~ | — | **DECOMMISSIONED** — replaced by Homepage |
 | Grafana | 109 | `92d987d5-d066-4e19-8fa1-960114c1244c` | `http://192.168.1.8:3000/login/generic_oauth` | SSO active 2026-05-23; PKCE enabled; LAN alias added 2026-05-24 |
-| Infisical | 112 | `b2069075-ede2-4251-ad1f-9a62e6a188b3` | `http://192.168.1.7:8200/api/v1/sso/oidc/callback` | LAN alias added 2026-05-24; manual OIDC config still pending |
+| Infisical | 109 | `b2069075-ede2-4251-ad1f-9a62e6a188b3` | `http://192.168.1.8:8200/api/v1/sso/oidc/callback` | migrated CT112→CT109 2026-05-26; manual OIDC config still pending |
 | Proxmox VE | host | `38469e7e-1fff-4841-83a9-74bf38d847eb` | `https://192.168.1.20:8006` | LAN alias added 2026-05-24 |
 | Nextcloud | 105 | `a14b8076-985c-4989-95f8-e0283bfbdf32` | `https://nc.nuclide.systems/apps/oidc_login/oidc` | |
 | Immich | 104 | `9c91c18b-e009-4371-9c54-b71d54e3c77a` | `https://photos.nuclide.systems/auth/login` | |
@@ -35,7 +35,7 @@ curl -X POST http://192.168.1.8:9000/api/licenses/add \
 |---|---|---|---|---|
 | CT 109 | ops | unix:///var/run/docker.sock | — | built-in |
 | CT 104 | docker | 192.168.1.40 | 9001 | `/opt/stacks/portainer-agent.yml` |
-| CT 110 | id | 192.168.1.5 | 9001 | `/opt/stacks/ops-agents/docker-compose.yml` |
+| ~~CT 110~~ | ~~id~~ | ~~192.168.1.5~~ | — | **DESTROYED 2026-05-26** — Pocket-ID moved to CT 109 |
 | CT 111 | dev | 192.168.1.42 | 9001 | `/opt/stacks/ops-agents/docker-compose.yml` |
 | CT 112 | secrets | 192.168.1.7 | 9001 | `/opt/stacks/ops-agents/docker-compose.yml` |
 | CT 113 | db | 192.168.1.6 | 9001 | `/opt/stacks/db/docker-compose.yml` |
@@ -22,7 +22,7 @@ Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat bac
 | gotify.nuclide.systems | 192.168.1.40:10003 | ✓ | Gotify push notifications |
 | ha.nuclide.systems | 192.168.1.60:8123 | ✓ | Home Assistant (VM 100) |
 | hoarder.nuclide.systems | 192.168.1.40:17001 | — | Karakeep bookmarks |
-| id.nuclide.systems | 192.168.1.5:11000 | — | Pocket-ID OIDC (CT 110) |
+| id.nuclide.systems | 192.168.1.8:11000 | — | Pocket-ID OIDC (CT 109; migrated from CT 110 2026-05-26) |
 | immich.nuclide.systems | 192.168.1.40:12000 | ✓ | Immich photos |
 | ~~mcp.nuclide.systems~~ | ~~192.168.1.40:8080~~ | — | **DECOMMISSIONED 2026-05-26** — mcp-gateway removed; MCP now at `https://ai.nuclide.systems/mcp` (Bifrost) |
 | memos.nuclide.systems | 192.168.1.40:17000 | — | Memos notes |