# Port Map — NUC 14 Docker Stacks > **Reverse proxy**: [Zoraxy v3.3.2](http://192.168.1.4:8000) on `192.168.1.4:8000` (LXC 108) > Wildcard cert `*.nuclide.systems` · source of truth: [`proxy/zoraxy/routes.json`](proxy/zoraxy/routes.json) > Manage routes: `uv run scripts/zoraxy_sync.py [--apply|--prune|--list]` ## Port Scheme | Range | Category | |---|---| | 10000–10999 | Infrastructure | | 11000–11999 | Security & Auth | | 12000–12999 | Media – Immich | | 13000–13999 | Media – Downloads / Arr | | 14000–14999 | AI Stack | | 15000–15999 | Documents | | 16000–16999 | Automation | | 17000–17999 | Notes & Bookmarks | | 18000–18999 | DevOps / Image Gen | | 19000–19999 | Tracking | | 20000–20999 | Storage Admin | | 30000–30999 | VPN Control | --- ## Infrastructure (10000–10999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [10000](http://192.168.1.40:10000) | Homepage | `homepage` | — | Dashboard, LAN only | | [10001](http://192.168.1.40:10001) | Dozzle | `dozzle` | [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | Log viewer | | [10002](http://192.168.1.40:10002) | Arcane | `arcane` | [arcane.nuclide.systems](https://arcane.nuclide.systems) | Web IDE | | [10003](http://192.168.1.40:10003) | Gotify | `gotify` | [gotify.nuclide.systems](https://gotify.nuclide.systems) | Push notifications | | [10004](http://192.168.1.40:10004) | Garage S3 API | `garage` | s3.nuclide.systems (non-responsive, see notes) | Internal: `http://garage:3900` | | 10005 (127.0.0.1 only) | Garage Admin | `garage` | — | localhost only | --- ## Security & Auth (11000–11999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager · **no Pocket-ID client yet — gap** | > Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20. See the [External Services](#external-services-not-on-nuc-docker) table below. --- ## Media – Immich (12000–12999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [12000](http://192.168.1.40:12000) | Immich | `immich_server` | [immich.nuclide.systems](https://immich.nuclide.systems) | Photos/videos | | — | Immich Power Tools | `immich_power_tools` | [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | Container-internal :3000, Zoraxy proxy | --- ## Media – Downloads / Arr Stack (13000–13999) All arr-stack services run behind `vpn_gluetun` container network. | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [13001](http://192.168.1.40:13001) | RDTClient | `rdtclient` | — | LAN only | | [13002](http://192.168.1.40:13002) | Prowlarr | `prowlarr` | — | LAN only | | [13003](http://192.168.1.40:13003) | Audiobookshelf | `audiobookshelf` | [abs.nuclide.systems](https://abs.nuclide.systems) | | | [13004](http://192.168.1.40:13004) | ShelfArr | `shelfarr` | — | LAN only | | [13005](http://192.168.1.40:13005) | Flaresolverr | `flaresolverr` | — | Internal only | | [30000](http://192.168.1.40:30000) | Gluetun VPN control | `vpn_gluetun` | — | HTTP control API | --- ## AI Stack (14000–14999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [14000](http://192.168.1.40:14000) | LiteLLM | `litellm` | [ai.nuclide.systems](https://ai.nuclide.systems) | LLM proxy gateway | | [14001](http://192.168.1.40:14001) | LobeHub | `lobehub` | [chat.nuclide.systems](https://chat.nuclide.systems) | Chat UI | | [14002](http://192.168.1.40:14002) | Qdrant | `qdrant_scientific` | — | Vector DB, internal only | | [8080](http://192.168.1.40:8080) | MCP Gateway | `mcp-gateway` | [mcp.nuclide.systems](https://mcp.nuclide.systems) | Pocket ID gated; spawns MCP servers on `ai-internal` | | [18002](http://192.168.1.40:18002) | ComfyUI | `comfyui` | — | LAN only (Intel Arc iGPU, FLUX.1-schnell GGUF) | | [18003](http://192.168.1.40:18003) | ComfyUI MCP | `comfyui-mcp` | — | FastMCP; reachable via gateway at `mcp.nuclide.systems/comfyui/mcp` | | — | SearXNG | `searxng` | — | Internal, `shared_backend`, used by LobeHub | --- ## Documents (15000–15999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [15000](http://192.168.1.40:15000) | Traccar HTTP | `traccar` | [traccar.nuclide.systems](https://traccar.nuclide.systems) | GPS tracking UI | | [15001](http://192.168.1.40:15001) | Traccar GPS | `traccar` | — | TCP+UDP watch protocol | | [15002](http://192.168.1.40:15002) | Paperless AI | `paperless-ai` | [paperless-ai.nuclide.systems](https://paperless-ai.nuclide.systems) | Internal-only Zoraxy policy | | [15003](http://192.168.1.40:15003) | Paperless-ngx | `paperless-ngx-webserver-1` | [paperless.nuclide.systems](https://paperless.nuclide.systems) | Internal-only Zoraxy policy | --- ## Automation (16000–16999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [16000](http://192.168.1.40:16000) | n8n | `n8n` | [n8n.nuclide.systems](https://n8n.nuclide.systems) | Workflow automation | --- ## Notes & Bookmarks (17000–17999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [17000](http://192.168.1.40:17000) | Memos | `memos` | [memos.nuclide.systems](https://memos.nuclide.systems) | Notes | | [17001](http://192.168.1.40:17001) | Karakeep | `karakeep` | [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | Bookmarks | --- ## DevOps (18000–18999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| --- ## Tracking (19000–19999) _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._ --- ## Storage Admin (20000–20999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | 20010 (127.0.0.1 only) | pgAdmin | `pgadmin` | — | localhost only | --- ## LXC 111 — Dev (`192.168.1.42`) CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest. | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [7080](http://192.168.1.42:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID; password auth disabled | | [3000](http://192.168.1.42:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC; password form disabled | | [222](http://192.168.1.42:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` | | 5432 (internal) | coder-db | `coder-db` | — | Postgres 16 for Coder | | 5432 (internal) | gitea-db | `gitea-db` | — | Postgres 16 for Gitea | | [13080](http://192.168.1.42:13080) | docs site | `docs-server` | — (LAN-only) | mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min | | (no port) | coder-fkrebs-dev | (workspace) | (Coder app proxy) | Active Coder workspace | | (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct111-runner`) | --- ## External Services (Not on NUC Docker) Zoraxy routes to these external backends: | Domain | Target | Host | Service | |---|---|---|---| | [ha.nuclide.systems](https://ha.nuclide.systems) | `192.168.1.60:8123` | Home Assistant VM 100 | Home automation | | [nc.nuclide.systems](https://nc.nuclide.systems) | `192.168.1.41:11000` | Nextcloud LXC 105 | Cloud storage | | [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM 100 | EV charger OCPP | | [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard | | [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API | | [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) | | [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.42:3000` | Dev LXC 111 | Gitea (self-hosted Git) | | [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.42:7080` | Dev LXC 111 | Coder (workspace orchestrator) | | Gitea SSH | `192.168.1.42:222` | Dev LXC 111 | `ssh -p 222 git@git.nuclide.systems` | --- ## Zoraxy Public Routes (proxied via `192.168.1.4`) | Domain | Backend (NUC `192.168.1.40`) | Port | |---|---|---| | [ai.nuclide.systems](https://ai.nuclide.systems) | litellm | 14000 | | [chat.nuclide.systems](https://chat.nuclide.systems) | lobehub | 14001 | | [mcp.nuclide.systems](https://mcp.nuclide.systems) | mcp-gateway | 8080 | | [arcane.nuclide.systems](https://arcane.nuclide.systems) | arcane | 10002 | | [gotify.nuclide.systems](https://gotify.nuclide.systems) | gotify | 10003 | | [vault.nuclide.systems](https://vault.nuclide.systems) | vaultwarden | 11001 | | [immich.nuclide.systems](https://immich.nuclide.systems) | immich_server | 12000 | | [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | immich_power_tools | (container-internal) | | [abs.nuclide.systems](https://abs.nuclide.systems) | audiobookshelf | 13003 | | [n8n.nuclide.systems](https://n8n.nuclide.systems) | n8n | 16000 | | [memos.nuclide.systems](https://memos.nuclide.systems) | memos | 17000 | | [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | karakeep | 17001 | | [traccar.nuclide.systems](https://traccar.nuclide.systems) | traccar | 15000 | | [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | dozzle | 10001 | **Not publicly proxied** (LAN / localhost only): pgadmin, paperless, paperless-ai, comfyui, comfyui-mcp, rdtclient, prowlarr, shelfarr, qdrant. --- ## Known Issues - **`s3.nuclide.systems`** (Garage external S3): non-responsive. Internal S3 `http://garage:3900` works fine for wal-g, memos, lobe. External binding risks quorum loss — deferred. - **`lobe-postgres` / `lobe-redis`**: host-port exposed (`0.0.0.0:5432/6379`) — firewall blocks external access but ideally restricted to localhost. --- ## OIDC Client Registry (Pocket ID — `id.nuclide.systems`) | Client ID | Name | Redirect URIs | |---|---|---| | `e73bb7b9` | litellm | (empty = accept all) — used by LiteLLM UI + MCP Gateway | | `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` | | `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` | | `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` | | `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile | | `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` | | `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` | | `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` | | `0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | | `9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | | `38469e7e` | Proxmox VE | `https://192.168.1.20:8006` | | `798a367f` | ~~daytona~~ | **ORPHAN — Daytona decommissioned 2026-05-20, remove** | | `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` | | `d8733fcc` | shelfarr | `*` | | `78c78998` | Claude MCP | `https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback` | | `82ca2d53` | nuc-ai | (empty) — used by spawned MCP servers | | `7fe1a14b` | zoraxy | (empty) | | `af2f837b` | mcp-auth | (empty) — legacy, unused | **OIDC Endpoints** (corrected 2026-05-17 — previously used wrong `/api/v1/oauth2/` path): - Authorization: `https://id.nuclide.systems/authorize` - Token: `https://id.nuclide.systems/api/oidc/token` - Userinfo: `https://id.nuclide.systems/api/oidc/userinfo` - Discovery: `https://id.nuclide.systems/.well-known/openid-configuration`