Pocket-ID moved CT 110 → CT 109 on 2026-05-26 (per ct-inventory).
Gitea/Coder moved CT 111 → CT 104 on 2026-05-26.
Infisical moved CT 112 → CT 109 on 2026-05-26.
Zoraxy note in the intro updated to Traefik.
Fixes contradictions found during the CT 104 disk-full incident:
- Arcane: was DECOMMISSIONED 2026-05-26 + local, not "migrated to UNAS"
(volumes.md and storage.md disagreed).
- arr-stack: fully on UNAS incl. SQLite configs on services/arr-stack/;
media/downloads on media/ share. Radarr/Sonarr not deployed. Removed
stale "plan to migrate" rows pointing at local /opt/stacks/arr-stack.
- n8n: local (DB on CT 113), not UNAS.
- Garage: metadata is SQLite (not LMDB); keep off NFS; refreshed bucket
table with real sizes (82 GB, mostly WAL-G PG backups).
- Marked sunsets: karakeep, memos, litellm, daytona.
- crawl4ai: correct name mcp-crawl4ai, no mounts, cache-growth TODO.
- Added ZFS snapshot note: refquota hides snapshot bloat from container df;
pre-tier1-backups snapshot held 97.9 GB.
Both services no longer in use. Compose files renamed, all data
(CT 104 local + UNAS + Postgres memos DB) deleted. Restic snapshots
rewritten to strip both paths (13 modified, ~7 GiB freed on JottaCloud).
Traefik routes removed, Pocket-ID OIDC clients deleted. Garage S3
memos bucket key revoked; bucket deletion blocked by quorum error
and is flagged for a separate Garage repair pass.
Traefik router + service added on CT 109 pointing to HAOS :8095. Uses the
Cloudflare wildcard cert (*.nuclide.systems), no per-host CF record. LAN
resolution via existing AdGuard wildcard rewrite → 192.168.1.8.
- LiteLLM sunset 2026-05-28: container removed, config dir renamed
.DECOMMISSIONED-2026-05-28, prometheus scrape job deleted, CT 113
litellm DB + role dropped. Bifrost now connects directly to upstream
LLM providers (verified: openai → SAIA chat-ai.academiccloud.de).
- Open WebUI data (CT 104 uploads + vector_db, 192K) now staged to
UNAS /services/open-webui via openwebui-prestage.sh and included in
Backrest services-backup-plan. Open WebUI chats/users live in CT 113
Postgres owui DB (already in WAL-G).
- Miniflux confirmed DB-only — already covered by WAL-G.
- backrest.md and homelab-architecture.md updated; services-overview.md
marks LiteLLM row strikethrough.
- CT 108 Zoraxy decommissioned -> Traefik on CT 109
- Add critical blind spots: Vaultwarden (local FS, not backed up),
Garage S3 data (WAL-G archive store, not backed up), Paperless media
- Fix services plan path list to match actual Backrest config.json
- Mark stale plan paths: arcane, arr-stack, gluetun
- Note Garage config incident: garage.toml became a directory after
Portainer redeploy; fixed 2026-05-28 by manual replace + layout apply
Traefik v3 now handles all *.nuclide.systems traffic (ports 80/443).
ACME DNS-01 via Cloudflare, HTTP/2, Keep-Alive fix for Immich.
CT 108 backup: vzdump-lxc-108-2026_05_28-00_46_45.tar.zst on UNAS.
Prometheus scrapes /api/metrics via X-API-Key, alert rules for
environment health, Grafana dashboard at uid=portainer-be.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- SAIA rate limits: minute=30/1m active at provider level; hour/day rows exist but not linked
- VK governance: allow_all_keys SQL workaround, allowed_models must be non-null JSON text
- Fix stale sk-tapirnase reference in add-MCP-client example (now uses cookie auth)
- Add LLM provider table
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Port 14000 row struck as SUNSET; replaced by Bifrost
- Prometheus scrape target for LiteLLM struck
- e73bb7b9 Pocket-ID client row struck as DELETED
- Removed litellm from "not publicly proxied" list
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- mcp-gateway.md: full rewrite for Bifrost at ai.nuclide.systems/mcp;
29 clients / ~760 tools; VK auth; n8n+shepard blocked on
streamable-HTTP; legacy gateway decommission checklist added
- connection-hosts.md: Bifrost at port 14003 is now ai.nuclide.systems;
LiteLLM demoted to internal-only; mcp.nuclide.systems marked pending
decommission; OIDC client 78c78998 flagged for removal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ct104-conf repo tracks /opt/stacks/ compose files and configs daily.
Bifrost and Open WebUI now covered.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Per-host + per-service LAN-only aliases added 2026-05-24 on CT 102.
Stable names → host IPs; clients use names instead of bare IPs so
service moves only require an AdGuard edit, not N app updates.
Use case driver: Immich Android HTTP/2 Keep-Alive bug — per-SSID
'nuclide' local URL https://immich.nuclide.lan:12000 bypasses Zoraxy.
Lists all containers without LAN-published ports across CT 104/105/109/110/111/112/113.
Recommends keep-internal vs expose for each. Confirms the public/LAN/docker-internal
tiering is clean across the fleet.
Living doc at http://192.168.1.8:13080/services-overview/.
Categorised by AI/files/identity/dev/home/ops/network with external
Zoraxy routes, internal LAN IP:port, host, and doc cross-links.
fkrebs