# Port Map — NUC 14 Docker Stacks > **Reverse proxy**: [Zoraxy v3.3.2](http://192.168.1.4:8000) on `192.168.1.4:8000` (LXC 108) > Wildcard cert `*.nuclide.systems` · source of truth: [`proxy/zoraxy/routes.json`](proxy/zoraxy/routes.json) > Manage routes: `uv run scripts/zoraxy_sync.py [--apply|--prune|--list]` ## Port Scheme | Range | Category | |---|---| | 3100 | Loki (log aggregation) | | 9090 | Prometheus (monitoring) | | 9091 | Grafana (monitoring) | | 9100 | node-exporter (host metrics) | | 12345 | Alloy (log agent UI) | | 10000–10999 | Infrastructure | | 11000–11999 | Security & Auth | | 12000–12999 | Media – Immich | | 13000–13999 | Media – Downloads / Arr | | 14000–14999 | AI Stack | | 15000–15999 | Documents | | 16000–16999 | Automation | | 17000–17999 | Notes & Bookmarks | | 18000–18999 | DevOps / Image Gen | | 19000–19999 | Tracking | | 20000–20999 | Storage Admin | | 30000–30999 | VPN Control | --- ## Monitoring — CT 109 ops (192.168.1.8) | Port | Host | Service | Notes | |---|---|---|---| | [9090](http://192.168.1.8:9090) | CT 109 | Prometheus | LAN only; 90d retention | | [3000](http://192.168.1.8:3000) | CT 109 | Grafana | LAN only; admin/tapirnase | | [3100](http://192.168.1.8:3100) | CT 109 | Loki | LAN only; 30d retention; log aggregation | | [9221](http://192.168.1.8:9221) | CT 109 | pve-exporter | Proxmox VE metrics; auth: `monitor@pve!prometheus` | | [12345](http://192.168.1.8:12345) | CT 109 | Alloy (self) | agent UI; also runs on all other hosts at :12345 | | 9100 | CT 109 | node-exporter | host-network, self-scrape | | 9100 | CT 104 | node-exporter | standalone stack `/opt/stacks/monitoring/`; scraped by CT 109 | Scrape targets (CT 109 Prometheus): `litellm` CT104:14000/metrics/ (bearer sk-tapirnase), `node-ct104` :9100, `node-ct109` :9100, `home-assistant` 192.168.1.60:8123/api/prometheus (HA token), `prometheus` self. LiteLLM metrics: `litellm_settings.callbacks: ["prometheus"]` in `ai/litellm-config/config.yaml`. **Alloy (log agent)**: deployed on all 12 hosts → ships to Loki at CT 109:3100. - Docker hosts (CT 101/104/105/109/110/111/112/113): container at `/opt/stacks/alloy/`; reads Docker socket + journald - Binary/systemd (CT 102/103/108 + nuc): `/etc/alloy/config.alloy`; reads journald only - HA VM 100: pending — install Promtail add-on from `https://github.com/mdegat01/hassio-addons`; set Loki URL to `http://192.168.1.8:3100/loki/api/v1/push` --- ## Infrastructure (10000–10999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [10000](http://192.168.1.40:10000) | Homepage | `homepage` | — | Dashboard, LAN only | | [10001](http://192.168.1.40:10001) | Dozzle | `dozzle` | [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | Log viewer | | [10002](http://192.168.1.40:10002) | Arcane | `arcane` | [arcane.nuclide.systems](https://arcane.nuclide.systems) | Web IDE | | [10003](http://192.168.1.40:10003) | Gotify | `gotify` | [gotify.nuclide.systems](https://gotify.nuclide.systems) | Push notifications | | [10004](http://192.168.1.40:10004) | Garage S3 API | `garage` | [s3.nuclide.systems](https://s3.nuclide.systems) | FIXED 2026-05-21: proxied by Zoraxy with ACME TLS. Garage API accessible at `https://s3.nuclide.systems`. Internal: `http://garage:3900` | | 10005 (127.0.0.1 only) | Garage Admin | `garage` | — | localhost only | --- ## Security & Auth (11000–11999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager · Pocket-ID OIDC client created 2026-05-21; auth flow not yet configured | > Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20. See the [External Services](#external-services-not-on-nuc-docker) table below. --- ## Media – Immich (12000–12999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [12000](http://192.168.1.40:12000) | Immich | `immich_server` | [immich.nuclide.systems](https://immich.nuclide.systems) | Photos/videos | | — | Immich Power Tools | `immich_power_tools` | [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | Container-internal :3000, Zoraxy proxy | --- ## Media – Downloads / Arr Stack (13000–13999) All arr-stack services run behind `vpn_gluetun` container network. | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [13001](http://192.168.1.40:13001) | RDTClient | `rdtclient` | — | LAN only | | [13002](http://192.168.1.40:13002) | Prowlarr | `prowlarr` | — | LAN only | | [13003](http://192.168.1.40:13003) | Audiobookshelf | `audiobookshelf` | [abs.nuclide.systems](https://abs.nuclide.systems) | | | [13004](http://192.168.1.40:13004) | ShelfArr | `shelfarr` | — | LAN only | | [13005](http://192.168.1.40:13005) | Flaresolverr | `flaresolverr` | — | Internal only | | [30000](http://192.168.1.40:30000) | Gluetun VPN control | `vpn_gluetun` | — | HTTP control API | --- ## AI Stack (14000–14999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [14000](http://192.168.1.40:14000) | LiteLLM | `litellm` | [ai.nuclide.systems](https://ai.nuclide.systems) | LLM proxy gateway | | [14001](http://192.168.1.40:14001) | LobeHub | `lobehub` | [chat.nuclide.systems](https://chat.nuclide.systems) | Chat UI | | [14002](http://192.168.1.40:14002) | Qdrant | `qdrant_scientific` | — | Vector DB, internal only | | [8080](http://192.168.1.40:8080) | MCP Gateway | `mcp-gateway` | [mcp.nuclide.systems](https://mcp.nuclide.systems) | Pocket ID gated; spawns MCP servers on `ai-internal` | | [18002](http://192.168.1.40:18002) | ComfyUI | `comfyui` | — | LAN only (Intel Arc iGPU, FLUX.1-schnell GGUF) | | [18003](http://192.168.1.40:18003) | ComfyUI MCP | `comfyui-mcp` | — | FastMCP; reachable via gateway at `mcp.nuclide.systems/comfyui/mcp` | | [18005](http://192.168.1.40:18005) | Docling MCP | `docling-mcp` | — | SAIA Docling PDF→Markdown; reachable via gateway | | [18007](http://192.168.1.40:18007) | Kroki MCP | `kroki-mcp` | — | Diagram rendering; reachable via gateway | | [18009](http://192.168.1.40:18009) | Speaches | `speaches` | — | TTS/STT; LAN only | | ~~18010~~ | ~~Shepard MCP~~ | ~~`shepard-mcp`~~ | — | **DECOMMISSIONED 2026-05-21** — replaced by native `https://shepard.nuclide.systems/v2/mcp` (streamable HTTP; gateway entry: `shepard`, auth via `${SHEPARD_API_KEY}`) | | [18011](http://192.168.1.40:18011) | Upload-artifact MCP | `upload-artifact-mcp` | — | S3 chat-artifacts upload; reachable via gateway | | — | SearXNG | `searxng` | — | Internal, `shared_backend`, used by LobeHub | --- ## Documents (15000–15999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [15000](http://192.168.1.40:15000) | Traccar HTTP | `traccar` | [traccar.nuclide.systems](https://traccar.nuclide.systems) | GPS tracking UI | | [15001](http://192.168.1.40:15001) | Traccar GPS | `traccar` | — | TCP+UDP watch protocol | | [15002](http://192.168.1.40:15002) | Paperless AI | `paperless-ai` | [paperless-ai.nuclide.systems](https://paperless-ai.nuclide.systems) | Internal-only Zoraxy policy | | [15003](http://192.168.1.40:15003) | Paperless-ngx | `paperless-ngx-webserver-1` | [paperless.nuclide.systems](https://paperless.nuclide.systems) | Internal-only Zoraxy policy | --- ## Automation (16000–16999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [16000](http://192.168.1.40:16000) | n8n | `n8n` | [n8n.nuclide.systems](https://n8n.nuclide.systems) | Workflow automation | --- ## Notes & Bookmarks (17000–17999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [17000](http://192.168.1.40:17000) | Memos | `memos` | [memos.nuclide.systems](https://memos.nuclide.systems) | Notes | | [17001](http://192.168.1.40:17001) | Karakeep | `karakeep` | [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | Bookmarks | --- ## DevOps (18000–18999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | — | MCP servers (Gitea repos) | See AI Stack §18000 | — | `mcp-comfyui`, `mcp-docling`, `mcp-upload-artifact` at `git.nuclide.systems/fkrebs/` (`mcp-shepard` decommissioned) | --- ## Tracking (19000–19999) _Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._ --- ## Storage Admin (20000–20999) | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | 20010 (127.0.0.1 only) | pgAdmin | `pgadmin` | — | shared-db pgAdmin, localhost only (CT 104) | --- ## LXC 112 — secrets (`192.168.1.7`) CT 112 hosts Infisical. **LAN-only — no Zoraxy route; secrets must not be internet-exposed.** | Port | Service | Container | Notes | |---|---|---|---| | 8200 | Infisical | `infisical` | LAN: `http://192.168.1.7:8200` — admin UI + API | | (internal) | Postgres 16 | `infisical-db` | DB for Infisical only; no external port | | (internal) | Redis 7 | `infisical-redis` | Session/queue backing; no external port | Stack at `/opt/stacks/infisical/` on CT 112. Deployed 2026-05-22. --- ## LXC 113 — db (`192.168.1.6`) CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only. | Port | Service | Container | Notes | |---|---|---|---| | 5432 | Postgres 17 | `postgres` | LAN: `192.168.1.6:5432` — accepts app connections from all CTs | | 5050 | pgAdmin 4 | `pgadmin` | LAN only: `http://192.168.1.6:5050` — no Zoraxy route | --- ## LXC 111 — Dev (`192.168.1.42`) CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest. | Port | Service | Container | Public URL | Notes | |---|---|---|---|---| | [7080](http://192.168.1.42:7080) | Coder | `coder` | [dev.nuclide.systems](https://dev.nuclide.systems) | Workspace orchestrator; OIDC via Pocket-ID; password auth disabled | | [3000](http://192.168.1.42:3000) | Gitea | `gitea` | [git.nuclide.systems](https://git.nuclide.systems) | Self-hosted Git; OIDC; password form disabled | | [222](http://192.168.1.42:222) | Gitea SSH | `gitea` | — | `ssh -p 222 git@git.nuclide.systems` | | 5432 (internal) | coder-db | `coder-db` | — | Postgres 16 for Coder | | 5432 (internal) | gitea-db | `gitea-db` | — | Postgres 16 for Gitea | | [13080](http://192.168.1.42:13080) | docs site | `docs-server` | — (LAN-only) | mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min | | (no port) | coder-fkrebs-dev | (workspace) | (Coder app proxy) | Active Coder workspace | | (no port) | act-runner | `act-runner` | — | Gitea Actions runner (`ct111-runner`) | --- ## QNAP TS-251D (`192.168.1.189`) Celeron J4025, 2-core. Hosts Klipper natively (not Docker). | Port | Service | Notes | |---|---|---| | 80 | Mainsail | 3D printer web UI | | 7125 | Moonraker | Klipper API | Config backed up daily to `git.nuclide.systems/fkrebs/klipper-config` via cron at 03:00 → covered offsite by Backrest `services/gitea` path. --- ## External Services (Not on NUC Docker) Zoraxy routes to these external backends: | Domain | Target | Host | Service | |---|---|---|---| | [ha.nuclide.systems](https://ha.nuclide.systems) | `192.168.1.60:8123` | Home Assistant VM 100 | Home automation | | [nc.nuclide.systems](https://nc.nuclide.systems) | `192.168.1.41:11000` | Nextcloud LXC 105 | Cloud storage | | [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM 100 | EV charger OCPP | | [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard | | [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API | | [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) | | [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.42:3000` | Dev LXC 111 | Gitea (self-hosted Git) | | [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.42:7080` | Dev LXC 111 | Coder (workspace orchestrator) | | Gitea SSH | `192.168.1.42:222` | Dev LXC 111 | `ssh -p 222 git@git.nuclide.systems` | --- ## Zoraxy Public Routes (proxied via `192.168.1.4`) | Domain | Backend (NUC `192.168.1.40`) | Port | |---|---|---| | [ai.nuclide.systems](https://ai.nuclide.systems) | litellm | 14000 | | [chat.nuclide.systems](https://chat.nuclide.systems) | lobehub | 14001 | | [mcp.nuclide.systems](https://mcp.nuclide.systems) | mcp-gateway | 8080 | | [arcane.nuclide.systems](https://arcane.nuclide.systems) | arcane | 10002 | | [gotify.nuclide.systems](https://gotify.nuclide.systems) | gotify | 10003 | | [vault.nuclide.systems](https://vault.nuclide.systems) | vaultwarden | 11001 | | [immich.nuclide.systems](https://immich.nuclide.systems) | immich_server | 12000 | | [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | immich_power_tools | (container-internal) | | [abs.nuclide.systems](https://abs.nuclide.systems) | audiobookshelf | 13003 | | [n8n.nuclide.systems](https://n8n.nuclide.systems) | n8n | 16000 | | [memos.nuclide.systems](https://memos.nuclide.systems) | memos | 17000 | | [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | karakeep | 17001 | | [traccar.nuclide.systems](https://traccar.nuclide.systems) | traccar | 15000 | | [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | dozzle | 10001 | | [s3.nuclide.systems](https://s3.nuclide.systems) | garage | 10004 | **Not publicly proxied** (LAN / localhost only): pgadmin, paperless, paperless-ai, comfyui, comfyui-mcp, rdtclient, prowlarr, shelfarr, qdrant. --- ## Known Issues - **`lobe-postgres` / `lobe-redis`**: host-port exposed (`0.0.0.0:5432/6379`) — firewall blocks external access but ideally restricted to localhost. --- ## OIDC Client Registry (Pocket ID — `id.nuclide.systems`) | Client ID | Name | Redirect URIs | |---|---|---| | `e73bb7b9` | litellm | (empty = accept all) — used by LiteLLM UI + MCP Gateway | | `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` | | `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` | | `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` | | `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile | | `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` | | `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` | | `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` | | `0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback` | | `9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` | | `38469e7e` | Proxmox VE | `https://192.168.1.20:8006` | | ~~798a367f~~ | ~~daytona~~ | **DECOMMISSIONED — remove from Pocket-ID** | | `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` | | `d8733fcc` | shelfarr | `*` | | `78c78998` | Claude MCP | `https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback` | | `82ca2d53` | nuc-ai | (empty) — used by spawned MCP servers | | `7fe1a14b` | zoraxy | (empty) | | `af2f837b` | mcp-auth | (empty) — legacy, unused | | (new) | vaultwarden | `https://vault.nuclide.systems/auth/callback` | Created 2026-05-21; SSO wiring deferred | **OIDC Endpoints** (corrected 2026-05-17 — previously used wrong `/api/v1/oauth2/` path): - Authorization: `https://id.nuclide.systems/authorize` - Token: `https://id.nuclide.systems/api/oidc/token` - Userinfo: `https://id.nuclide.systems/api/oidc/userinfo` - Discovery: `https://id.nuclide.systems/.well-known/openid-configuration`