docs/services/zoraxy.md

Zoraxy Reverse Proxy

Zoraxy is a Go-based reverse proxy + ACME daemon running as a systemd service on LXC 108 (zoraxy, 192.168.1.4). Config lives in JSON files at /opt/zoraxy/conf/proxy/. Changes take effect after systemctl restart zoraxy.

Current route table

Audited 2026-05-23. All 22 public routes have:

• EnableAutoHTTPS: true — Zoraxy requests LE certs for *.nuclide.systems
• EnableWebsocketCustomHeaders: true — preserves WS upgrade headers through the proxy
• DisableHopByHopHeaderRemoval: true — keeps hop-by-hop headers intact for upstream

SkipWebSocketOriginCheck is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, Arcane, abs, ai, chat, ha, mcp, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed).

Domain	Upstream	SkipWSOrigin	Notes
abs.nuclide.systems	192.168.1.40:13003	✓	Audiobookshelf
ai.nuclide.systems	192.168.1.40:14003	✓	Bifrost LLM gateway (LiteLLM still on :14000, internal only)
arcane.nuclide.systems	192.168.1.8:10002	✓	Arcane (moved to CT 109 2026-05-23)
chat.nuclide.systems	192.168.1.40:14001	✓	LobeHub
dev.nuclide.systems	192.168.1.42:7080	✓	Coder (CT 111)
git.nuclide.systems	192.168.1.42:3000	—	Gitea (CT 111)
gotify.nuclide.systems	192.168.1.40:10003	✓	Gotify push notifications
ha.nuclide.systems	192.168.1.60:8123	✓	Home Assistant (VM 100)
hoarder.nuclide.systems	192.168.1.40:17001	—	Karakeep bookmarks
id.nuclide.systems	192.168.1.5:11000	—	Pocket-ID OIDC (CT 110)
immich.nuclide.systems	192.168.1.40:12000	✓	Immich photos
mcp.nuclide.systems	192.168.1.40:8080	✓	MCP gateway
memos.nuclide.systems	192.168.1.40:17000	—	Memos notes
n8n.nuclide.systems	192.168.1.40:16000	✓	n8n workflows
nc.nuclide.systems	192.168.1.41:11000	✓	Nextcloud AIO (CT 105)
ocpp.nuclide.systems	192.168.1.60:8887	✓	OCPP charger endpoint (HAOS)
s3.nuclide.systems	192.168.1.40:10004	✓	Garage S3 (web endpoint)
shepard.nuclide.systems	192.168.1.49:80	✓	Shepard frontend (CT 101)
shepard-api.nuclide.systems	192.168.1.49:8080	✓	Shepard API (CT 101)
shepard-auth.nuclide.systems	192.168.1.49:8082	✓	Shepard auth (CT 101)
traccar.nuclide.systems	192.168.1.40:15000	✓	Traccar GPS
vault.nuclide.systems	192.168.1.40:11001	✓	Vaultwarden

Intentionally LAN-only (no Zoraxy route): Dozzle (:10001), Homarr (:7575), Wetty (:4090), docs-server (:13080), paperless (:15003), paperless-ai (:15002), immich-tools. immich-tools.nuclide.systems is listed in portmap but route has not been created — defer until needed.

root.config — ProxyType=0 internal dashboard fallback (127.0.0.1:5487), no ACME.

Admin UI

http://192.168.1.4:8000

Zoraxy runs with -noauth=true — no login required on the LAN.

Adding a new route

Via admin UI

1. Reverse Proxy → Create Proxy Rules → New Proxy Rule
2. Enter the domain, set the upstream IP:port
3. TLS → Enable Auto HTTPS — tick it
4. Header Rewrite Rules → enable Disable Hop-by-Hop Removal and WebSocket Custom Headers
5. Save, allow 1–2 minutes for LE cert issuance

Via JSON (preferred for scripted changes)

Config files live at /opt/zoraxy/conf/proxy/<domain>.config on CT 108.

Minimum template for a new public route:

{
    "ProxyType": 1,
    "RootOrMatchingDomain": "example.nuclide.systems",
    "ActiveOrigins": [{"OriginIpOrDomain": "192.168.1.40:PORT", "Weight": 1}],
    "TlsOptions": {"EnableAutoHTTPS": true},
    "HeaderRewriteRules": {"DisableHopByHopHeaderRemoval": true},
    "EnableWebsocketCustomHeaders": true,
    "AccessFilterUUID": "default"
}

After editing, restart Zoraxy:

ssh root@192.168.1.4 'systemctl restart zoraxy'

Backup / restore

All configs are backed up at /tmp/zoraxy-backup-2026-05-21/ on CT 108 (22 files from the 2026-05-21 audit). To restore a single route:

ssh root@192.168.1.4 'cp /tmp/zoraxy-backup-2026-05-21/<domain>.config /opt/zoraxy/conf/proxy/ && systemctl restart zoraxy'

Decommissioned routes

.DECOMMISSIONED-* files in /opt/zoraxy/conf/proxy/ are ignored by Zoraxy. Current:

• daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20
• id.daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20

Auth posture

No routes have ForwardAuthURL set (no Tinyauth/auth middleware). Pocket-ID (id.nuclide.systems) is the OIDC IdP; apps that require auth implement it themselves (LobeHub, Coder, Gitea, Nextcloud). Public-facing routes like ha.nuclide.systems and ocpp.nuclide.systems have no proxy-level auth — upstream apps handle it.

Pending: Tinyauth or similar on unauthenticated-but-sensitive routes (arcane, gotify). Planned for CT 109 deployment.