# Connection Hosts — nuclide.systems

Maintained reference for every host, LAN address, port, and public URL.
**Last verified: 2026-05-23.**

> Source of truth: [`ct-inventory.md`](../ct-inventory.md) (guests) · [`portmap.md`](portmap.md) (Docker ports) · [`homelab-architecture.md`](../services/homelab-architecture.md) (topology).

---

## Network infrastructure

| Device | LAN IP | Admin UI | Notes |
|---|---|---|---|
| **UDM Home** (UCG Fiber, UniFi OS 5.0.16) | `192.168.1.1` | `https://192.168.1.1` (SSO + MFA) | Gateway, DNS forwarder → AdGuard; port-forwards 80/443 → Zoraxy (`.4`), 15001 TCP/UDP → CT 104 |
| **D-Link DGS-1210-28P** | `192.168.1.10` | `http://192.168.1.10` (HTTP-only, pw: `tapirnase`) | 28-port PoE switch — physical core. UDM on port 26, CT 104 cluster on port 10, APs on ports 3 & 16. SNTP fixed 2026-05-19. |
| **UNAS Pro** (NFS server) | `192.168.1.31` | `http://192.168.1.31` | NFSv3 export: `192.168.1.31:/var/nfs/shared/storage` (→ `/mnt/pve/unas`). ~19 T bulk storage. |
| **UniFi U7 APs** | `.50` `.51` `.52` `.53` | via UDM | Hallway, In-wall, Bedroom (Schlafzimmer), Dining (Esszimmer). SSID: `nuclide`, WPA2/WPA3. |
| **TP-Link RE700X** | `192.168.1.187` | `http://192.168.1.187` | WiFi extender — NATs devices behind it (3D printer `.189` invisible to UniFi). |

---

## Proxmox VE host — `nuc`

| | Value |
|---|---|
| **IP** | `192.168.1.20` |
| **Admin UI** | `https://192.168.1.20:8006` (OIDC via Pocket-ID client `38469e7e`) |
| **SSH** | `ssh root@192.168.1.20` (key auth) |
| **Hardware** | Intel Core Ultra 7 155H · 22 threads · 64 GiB RAM · PVE 9.1.11 |
| **Storage** | `local-zfs` ~1.9 T (NVMe), `local` (dir), `unas` (NFS ~19 T) |
| **API token** | `root@pam!mcp` (PVEAuditor role, read-only) |

---

## LXC / VM guests

### VM 100 — `haos` (Home Assistant OS)

| | Value |
|---|---|
| **IP** | `192.168.1.60` (DHCP, stable) |
| **HA UI** | `https://ha.nuclide.systems` → `192.168.1.60:8123` |
| **SSH** | `ssh root@192.168.1.60` (key installed manually in HA terminal) |
| **OCPP** | `https://ocpp.nuclide.systems` → `192.168.1.60:8887` |
| **HA-MCP add-on** | `http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ` (gateway upstream, no TLS) |
| **Specs** | 4c / 16 GiB (balloon 4 GiB) / 32 GiB; USB Zigbee dongle passed through |

### CT 101 — `shepard`

| | Value |
|---|---|
| **IP** | `192.168.1.49` |
| **SSH** | `ssh root@192.168.1.49` |
| **Public** | `https://shepard.nuclide.systems` (Caddy → `:80`) · `https://shepard-api.nuclide.systems` (→ `:8080`) |
| **MCP** | `https://shepard.nuclide.systems/v2/mcp` (Bearer `${SHEPARD_API_KEY}`) |
| **Specs** | 12c / 32 GiB / 500 GiB + NFS; Intel iGPU (card+render) |
| **Stack** | Caddy, Shepard frontend/backend, Keycloak, Mongo, Neo4j, TimescaleDB |

### CT 102 — `dns` (AdGuard Home)

| | Value |
|---|---|
| **IP** | `192.168.1.2` |
| **SSH** | `ssh root@192.168.1.2` |
| **Admin UI** | `http://192.168.1.2` (port 80) |
| **DNS** | `192.168.1.2:53` — LAN resolver (UDM forwards all DNS here) |
| **Specs** | 2c / 1 GiB / 4 GiB |

### CT 103 — `backrest`

| | Value |
|---|---|
| **IP** | `192.168.1.3` |
| **SSH** | `ssh root@192.168.1.3` |
| **UI** | `http://192.168.1.3:9898` (LAN-only, no auth) |
| **Specs** | 1c / 512 MiB / 8 GiB + NFS (`/mnt/pve/unas`) |
| **Notes** | JottaCloud offsite via rclone; repos `services-repo` + `media-repo` |

### CT 104 — `docker` (main Docker host)

| | Value |
|---|---|
| **IP** | `192.168.1.40` |
| **SSH** | `ssh root@192.168.1.40` |
| **Specs** | 16c / 48 GiB / 200 GiB + NFS; Intel Arc iGPU (card+render) |
| **Role** | ~65 containers across ~23 compose stacks in `/opt/stacks/` |

See [Docker services table](#docker-services--ct-104) below for all ports.

### CT 105 — `nextcloud`

| | Value |
|---|---|
| **IP** | `192.168.1.41` |
| **SSH** | `ssh root@192.168.1.41` |
| **Public** | `https://nc.nuclide.systems` → `192.168.1.41:11000` |
| **Specs** | 4c / 8 GiB / 100 GiB + NFS (migrated to NFSv3 2026-05-22) |
| **Auth** | Pocket-ID OIDC (client `a14b8076`) |

### CT 108 — `zoraxy` (reverse proxy)

| | Value |
|---|---|
| **IP** | `192.168.1.4` |
| **SSH** | `ssh root@192.168.1.4` |
| **Admin UI** | `http://192.168.1.4:8000` (LAN only) |
| **Specs** | 2c / 2 GiB / 6 GiB |
| **Cert** | Wildcard `*.nuclide.systems` (ACME via Let's Encrypt) |
| **Config** | `proxy/zoraxy/routes.json` → `scripts/zoraxy_sync.py --apply` |

### CT 110 — `id` (Pocket-ID OIDC)

| | Value |
|---|---|
| **IP** | `192.168.1.5` |
| **SSH** | `ssh root@192.168.1.5` |
| **Public** | `https://id.nuclide.systems` → `192.168.1.5:11000` |
| **Specs** | 1c / 1 GiB / 4 GiB |
| **OIDC endpoints** | Authorization: `https://id.nuclide.systems/authorize` · Token: `https://id.nuclide.systems/api/oidc/token` · Userinfo: `https://id.nuclide.systems/api/oidc/userinfo` · Discovery: `https://id.nuclide.systems/.well-known/openid-configuration` |

### CT 111 — `dev` (Coder + Gitea)

| | Value |
|---|---|
| **IP** | `192.168.1.42` |
| **SSH** | `ssh root@192.168.1.42` |
| **Specs** | 12c / 32 GiB / 60 GiB + NFS; Intel Arc iGPU (render) |

| Port | Service | Public URL |
|---|---|---|
| 7080 | Coder | `https://dev.nuclide.systems` |
| 3000 | Gitea | `https://git.nuclide.systems` |
| 222 | Gitea SSH | `ssh -p 222 git@git.nuclide.systems` |
| 13080 | docs site | `http://192.168.1.42:13080` (LAN; mkdocs Material, auto-rebuild every 5 min) |
| internal | act-runner | — (`ct111-runner` Gitea Actions) |

### CT 112 — `secrets` (Infisical)

| | Value |
|---|---|
| **IP** | `192.168.1.7` |
| **SSH** | `ssh root@192.168.1.7` |
| **UI + API** | `http://192.168.1.7:8200` **(LAN-only — no Zoraxy route; must not be internet-exposed)** |
| **Specs** | 2c / 4 GiB / 20 GiB |
| **Stack** | `/opt/stacks/infisical/` — Infisical + Postgres 16 + Redis 7 (all internal, no external ports) |

### CT 113 — `db` (shared Postgres)

| | Value |
|---|---|
| **IP** | `192.168.1.6` |
| **SSH** | `ssh root@192.168.1.6` |
| **Specs** | 2c / 4 GiB / 40 GiB |

| Port | Service | Access |
|---|---|---|
| 5432 | Postgres 17 | LAN: `192.168.1.6:5432` — tenants: LiteLLM, paperless, memos, n8n (reverted), Vaultwarden |
| 5050 | pgAdmin 4 | `http://192.168.1.6:5050` (LAN only, no Zoraxy route) |

---

## Docker services — CT 104

All on `192.168.1.40` unless noted. Zoraxy (`192.168.1.4`) terminates TLS for public URLs.

### Infrastructure (10000–10999)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 10000 | `homepage` | — | Dashboard (LAN only) |
| 10001 | `dozzle` | `https://dozzle.nuclide.systems` | Log viewer |
| 10002 | `arcane` | `https://arcane.nuclide.systems` | Web IDE (OIDC `81cf4ed0`) |
| 10003 | `gotify` | `https://gotify.nuclide.systems` | Push notifications |
| 10004 | `garage` | `https://s3.nuclide.systems` | S3 API (Garage); internal: `http://garage:3900` |
| 10005 (localhost) | `garage` admin | — | Localhost only |

### Security & Auth (11000–11999)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 11001 | `vaultwarden` | `https://vault.nuclide.systems` | Password manager (OIDC client created, SSO not yet wired) |

### Media — Immich (12000–12999)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 12000 | `immich_server` | `https://immich.nuclide.systems` | Photos/videos (OIDC `9c91c18b`) |
| internal | `immich_power_tools` | `https://immich-tools.nuclide.systems` | Container-internal :3000, Zoraxy proxy |

### Media — Downloads / Arr (13000–13999)

All behind `vpn_gluetun` container network.

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 13001 | `rdtclient` | — | LAN only |
| 13002 | `prowlarr` | — | LAN only |
| 13003 | `audiobookshelf` | `https://abs.nuclide.systems` | OIDC `cbbf20d5` |
| 13004 | `shelfarr` | — | LAN only (OIDC `d8733fcc`) |
| 13005 | `flaresolverr` | — | Internal only |
| 30000 | `vpn_gluetun` | — | VPN HTTP control API |

### AI Stack (14000–14999, 8080, 18xxx)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 14000 | `litellm` | — | LLM proxy (internal only: `http://litellm:4000`); master key: `sk-tapirnase` |
| 14001 | `lobehub` | `https://chat.nuclide.systems` | Chat UI (OIDC `26f3c26b`) |
| 14002 | `qdrant_scientific` | — | Vector DB (LAN/internal only) |
| 14003 | `bifrost` | `https://ai.nuclide.systems` | LLM+MCP gateway; `/mcp` = MCP endpoint (29 clients, ~760 tools); master key: `sk-tapirnase` |
| 8080 | `mcp-gateway` | `https://mcp.nuclide.systems` | **PENDING DECOMMISSION** — legacy FastAPI DinD gateway; see [mcp-gateway.md](../services/mcp-gateway.md) |
| 18002 | `comfyui` | — | Image gen (Intel Arc); LAN only |
| 18003 | `comfyui-mcp` | via Bifrost `comfyui` client | FastMCP |
| 18005 | `docling-mcp` | via Bifrost `docling` client | PDF→Markdown |
| 18007 | `kroki-mcp` | via Bifrost `kroki` client | Diagram rendering |
| 18009 | `speaches` | — | TTS/STT; LAN only |
| 18011 | `upload-artifact-mcp` | via Bifrost `upload_artifact` client | S3 artifact upload |
| internal | `searxng` | — | `shared_backend`; used by LobeChat |

### Documents (15000–15999)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 15000 | `traccar` | `https://traccar.nuclide.systems` | GPS tracking UI |
| 15001 | `traccar` | — | TCP+UDP watch protocol (forwarded at UDM level) |
| 15002 | `paperless-ai` | `https://paperless-ai.nuclide.systems` | Internal-only Zoraxy policy |
| 15003 | `paperless-ngx-webserver-1` | `https://paperless.nuclide.systems` | Internal-only Zoraxy policy |

### Automation (16000–16999)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 16000 | `n8n` | `https://n8n.nuclide.systems` | Workflow automation (OIDC `33135ad4`); SQLite local disk |

### Notes & Bookmarks (17000–17999)

| Port | Container | Public URL | Notes |
|---|---|---|---|
| 17000 | `memos` | `https://memos.nuclide.systems` | Notes (OIDC `62bf4e0d`) |
| 17001 | `karakeep` | `https://hoarder.nuclide.systems` | Bookmarks (OIDC `d92f82b0`) |

### Storage Admin (20000–20999)

| Port | Container | Notes |
|---|---|---|
| 20010 (localhost) | `pgadmin` | shared-db pgAdmin, localhost only on CT 104 |

---

## External hardware

### QNAP UNAS Pro — NFS/SMB server

| | Value |
|---|---|
| **IP** | `192.168.1.31` |
| **Admin UI** | `http://192.168.1.31` |
| **NFS export** | `192.168.1.31:/var/nfs/shared/storage` (NFSv3 only; v4 not available) |
| **CIFS** | `//192.168.1.31/storage` (used by Nextcloud CT 105 only) |

### QNAP TS-251D — Klipper 3D printer host

| | Value |
|---|---|
| **IP** | `192.168.1.189` (behind TP-Link RE700X at `.187`) |
| **Mainsail** | `http://192.168.1.189:80` |
| **Moonraker** | `http://192.168.1.189:7125` |
| **Notes** | Klipper config backed up daily to `git.nuclide.systems/fkrebs/klipper-config` via cron |

---

## OIDC clients — Pocket-ID (`id.nuclide.systems`)

| Client ID | Service | Redirect URI |
|---|---|---|
| `e73bb7b9` | litellm / mcp-gateway | (empty — accepts all) |
| `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` |
| `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` |
| `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` |
| `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile |
| `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` |
| `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` |
| `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` |
| `0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback` |
| `9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` |
| `38469e7e` | Proxmox VE | `https://192.168.1.20:8006` |
| `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` |
| `d8733fcc` | shelfarr | `*` |
| `78c78998` | Claude MCP (legacy) | `https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback` — **remove when mcp-gateway decommissioned** |
| `82ca2d53` | nuc-ai (MCP spawned servers) | (empty) |
| `7fe1a14b` | zoraxy | (empty) |
| (new) | vaultwarden | `https://vault.nuclide.systems/auth/callback` — SSO not yet wired |
| ~~798a367f~~ | ~~daytona~~ | **DECOMMISSIONED — remove from Pocket-ID** |

---

## Quick-reference — all public URLs

| URL | Backend | Service |
|---|---|---|
| `https://ai.nuclide.systems` | `192.168.1.40:14003` | Bifrost (LLM+MCP gateway) — `/mcp` for MCP tools |
| `https://chat.nuclide.systems` | `192.168.1.40:14001` | LobeChat |
| `https://mcp.nuclide.systems` | `192.168.1.40:8080` | MCP gateway (**pending decommission**) |
| `https://id.nuclide.systems` | `192.168.1.5:11000` | Pocket-ID (OIDC) |
| `https://nc.nuclide.systems` | `192.168.1.41:11000` | Nextcloud |
| `https://ha.nuclide.systems` | `192.168.1.60:8123` | Home Assistant |
| `https://ocpp.nuclide.systems` | `192.168.1.60:8887` | EV charger OCPP |
| `https://shepard.nuclide.systems` | `192.168.1.49:80` | Shepard |
| `https://shepard-api.nuclide.systems` | `192.168.1.49:8080` | Shepard API |
| `https://dev.nuclide.systems` | `192.168.1.42:7080` | Coder |
| `https://git.nuclide.systems` | `192.168.1.42:3000` | Gitea |
| `https://arcane.nuclide.systems` | `192.168.1.40:10002` | Arcane |
| `https://dozzle.nuclide.systems` | `192.168.1.40:10001` | Dozzle (logs) |
| `https://gotify.nuclide.systems` | `192.168.1.40:10003` | Gotify |
| `https://s3.nuclide.systems` | `192.168.1.40:10004` | Garage S3 |
| `https://vault.nuclide.systems` | `192.168.1.40:11001` | Vaultwarden |
| `https://immich.nuclide.systems` | `192.168.1.40:12000` | Immich |
| `https://immich-tools.nuclide.systems` | `192.168.1.40` (internal) | Immich Power Tools |
| `https://abs.nuclide.systems` | `192.168.1.40:13003` | Audiobookshelf |
| `https://n8n.nuclide.systems` | `192.168.1.40:16000` | n8n |
| `https://memos.nuclide.systems` | `192.168.1.40:17000` | Memos |
| `https://hoarder.nuclide.systems` | `192.168.1.40:17001` | Karakeep |
| `https://traccar.nuclide.systems` | `192.168.1.40:15000` | Traccar |
| `https://paperless.nuclide.systems` | `192.168.1.40:15003` | Paperless-ngx (internal-only policy) |
| `https://paperless-ai.nuclide.systems` | `192.168.1.40:15002` | Paperless AI (internal-only policy) |

**Not publicly proxied** (LAN/localhost only): pgAdmin, ComfyUI, Qdrant, RDTClient, Prowlarr, ShelfArr, Flaresolverr, Speaches, AdGuard admin, Backrest UI, Infisical.

---

## SSH cheat-sheet

```bash
ssh root@192.168.1.20   # PVE host (nuc)
ssh root@192.168.1.40   # CT 104 docker
ssh root@192.168.1.41   # CT 105 nextcloud
ssh root@192.168.1.42   # CT 111 dev
ssh root@192.168.1.49   # CT 101 shepard
ssh root@192.168.1.2    # CT 102 dns (AdGuard)
ssh root@192.168.1.3    # CT 103 backrest
ssh root@192.168.1.4    # CT 108 zoraxy
ssh root@192.168.1.5    # CT 110 id (Pocket-ID)
ssh root@192.168.1.6    # CT 113 db (Postgres)
ssh root@192.168.1.7    # CT 112 secrets (Infisical)
ssh root@192.168.1.60   # VM 100 haos (Home Assistant — key must be installed manually)
ssh -p 222 git@git.nuclide.systems  # Gitea SSH
```

All LXCs reachable from `nuc` host via root key. Use `pct exec <id> -- bash` for console access without SSH.