Files

T

fkrebs 0d83f83bc0 docs: MCP gateway git/gitlab/paper-search; CT 109 plan; new backrest/db/arcane docs

- mcp-gateway.md: 26 servers (added git, gitlab, paper-search catalog bridge);
  document --pass-environment requirement for env var passthrough in DinD bridges
- ct-inventory.md + homelab-architecture.md: CT 109 IP conflict, CT 113 live
- proxmox-state.md §16: Loki, sshwifty, Alloy, IP conflict note, sidecar table
  expanded to CT 103/111/113; build order updated
- infra/portmap.md: CT 113 db section; QNAP TS-251D (Klipper/Mainsail)
- services/backrest.md: full backup strategy doc (new)
- services/databases.md: CT 113 postgres/WAL-G/pgAdmin doc (new)
- services/arcane.md: Docker management IDE doc (new)
- CHANGELOG.md: 2026-05-22 entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-22 09:35:07 +02:00

13 KiB

Raw Blame History

Port Map — NUC 14 Docker Stacks

Reverse proxy: Zoraxy v3.3.2 on 192.168.1.4:8000 (LXC 108) Wildcard cert *.nuclide.systems · source of truth: proxy/zoraxy/routes.json Manage routes: uv run scripts/zoraxy_sync.py [--apply|--prune|--list]

Port Scheme

Range	Category
10000–10999	Infrastructure
11000–11999	Security & Auth
12000–12999	Media – Immich
13000–13999	Media – Downloads / Arr
14000–14999	AI Stack
15000–15999	Documents
16000–16999	Automation
17000–17999	Notes & Bookmarks
18000–18999	DevOps / Image Gen
19000–19999	Tracking
20000–20999	Storage Admin
30000–30999	VPN Control

Infrastructure (10000–10999)

Port	Service	Container	Public URL	Notes
10000	Homepage	`homepage`	—	Dashboard, LAN only
10001	Dozzle	`dozzle`	dozzle.nuclide.systems	Log viewer
10002	Arcane	`arcane`	arcane.nuclide.systems	Web IDE
10003	Gotify	`gotify`	gotify.nuclide.systems	Push notifications
10004	Garage S3 API	`garage`	s3.nuclide.systems	FIXED 2026-05-21: proxied by Zoraxy with ACME TLS. Garage API accessible at `https://s3.nuclide.systems`. Internal: `http://garage:3900`
10005 (127.0.0.1 only)	Garage Admin	`garage`	—	localhost only

Security & Auth (11000–11999)

Port	Service	Container	Public URL	Notes
11001	Vaultwarden	`vaultwarden`	vault.nuclide.systems	Password manager · Pocket-ID OIDC client created 2026-05-21; auth flow not yet configured

Pocket-ID migrated from this CT to LXC 110 on 2026-05-20. See the External Services table below.

Media – Immich (12000–12999)

Port	Service	Container	Public URL	Notes
12000	Immich	`immich_server`	immich.nuclide.systems	Photos/videos
—	Immich Power Tools	`immich_power_tools`	immich-tools.nuclide.systems	Container-internal :3000, Zoraxy proxy

Media – Downloads / Arr Stack (13000–13999)

All arr-stack services run behind vpn_gluetun container network.

Port	Service	Container	Public URL	Notes
13001	RDTClient	`rdtclient`	—	LAN only
13002	Prowlarr	`prowlarr`	—	LAN only
13003	Audiobookshelf	`audiobookshelf`	abs.nuclide.systems
13004	ShelfArr	`shelfarr`	—	LAN only
13005	Flaresolverr	`flaresolverr`	—	Internal only
30000	Gluetun VPN control	`vpn_gluetun`	—	HTTP control API

AI Stack (14000–14999)

Port	Service	Container	Public URL	Notes
14000	LiteLLM	`litellm`	ai.nuclide.systems	LLM proxy gateway
14001	LobeHub	`lobehub`	chat.nuclide.systems	Chat UI
14002	Qdrant	`qdrant_scientific`	—	Vector DB, internal only
8080	MCP Gateway	`mcp-gateway`	mcp.nuclide.systems	Pocket ID gated; spawns MCP servers on `ai-internal`
18002	ComfyUI	`comfyui`	—	LAN only (Intel Arc iGPU, FLUX.1-schnell GGUF)
18003	ComfyUI MCP	`comfyui-mcp`	—	FastMCP; reachable via gateway at `mcp.nuclide.systems/comfyui/mcp`
18005	Docling MCP	`docling-mcp`	—	SAIA Docling PDF→Markdown; reachable via gateway
18007	Kroki MCP	`kroki-mcp`	—	Diagram rendering; reachable via gateway
18009	Speaches	`speaches`	—	TTS/STT; LAN only
~~18010~~	~~Shepard MCP~~	~~`shepard-mcp`~~	—	DECOMMISSIONED 2026-05-21 — replaced by native `https://shepard.nuclide.systems/v2/mcp` (streamable HTTP; gateway entry: `shepard`, auth via `${SHEPARD_API_KEY}`)
18011	Upload-artifact MCP	`upload-artifact-mcp`	—	S3 chat-artifacts upload; reachable via gateway
—	SearXNG	`searxng`	—	Internal, `shared_backend`, used by LobeHub

Documents (15000–15999)

Port	Service	Container	Public URL	Notes
15000	Traccar HTTP	`traccar`	traccar.nuclide.systems	GPS tracking UI
15001	Traccar GPS	`traccar`	—	TCP+UDP watch protocol
15002	Paperless AI	`paperless-ai`	paperless-ai.nuclide.systems	Internal-only Zoraxy policy
15003	Paperless-ngx	`paperless-ngx-webserver-1`	paperless.nuclide.systems	Internal-only Zoraxy policy

Automation (16000–16999)

Port	Service	Container	Public URL	Notes
16000	n8n	`n8n`	n8n.nuclide.systems	Workflow automation

Notes & Bookmarks (17000–17999)

Port	Service	Container	Public URL	Notes
17000	Memos	`memos`	memos.nuclide.systems	Notes
17001	Karakeep	`karakeep`	hoarder.nuclide.systems	Bookmarks

DevOps (18000–18999)

Port	Service	Container	Public URL	Notes

Tracking (19000–19999)

Traccar moved to 15000–15001 (Documents range). 19000–19001 now free.

Storage Admin (20000–20999)

Port	Service	Container	Public URL	Notes
20010 (127.0.0.1 only)	pgAdmin	`pgadmin`	—	shared-db pgAdmin, localhost only (CT 104)

LXC 113 — db (`192.168.1.6`)

CT 113 is the dedicated postgres LXC. No public proxy routes — LAN access only.

Port	Service	Container	Notes
5432	Postgres 17	`postgres`	LAN: `192.168.1.6:5432` — accepts app connections from all CTs
5050	pgAdmin 4	`pgadmin`	LAN only: `http://192.168.1.6:5050` — no Zoraxy route

LXC 111 — Dev (`192.168.1.42`)

CT 111 hosts the self-hosted dev platform. Same Pocket-ID SSO as the rest.

Port	Service	Container	Public URL	Notes
7080	Coder	`coder`	dev.nuclide.systems	Workspace orchestrator; OIDC via Pocket-ID; password auth disabled
3000	Gitea	`gitea`	git.nuclide.systems	Self-hosted Git; OIDC; password form disabled
222	Gitea SSH	`gitea`	—	`ssh -p 222 git@git.nuclide.systems`
5432 (internal)	coder-db	`coder-db`	—	Postgres 16 for Coder
5432 (internal)	gitea-db	`gitea-db`	—	Postgres 16 for Gitea
13080	docs site	`docs-server`	— (LAN-only)	mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min
(no port)	coder-fkrebs-dev	(workspace)	(Coder app proxy)	Active Coder workspace
(no port)	act-runner	`act-runner`	—	Gitea Actions runner (`ct111-runner`)

QNAP TS-251D (`192.168.1.189`)

Celeron J4025, 2-core. Hosts Klipper natively (not Docker).

Port	Service	Notes
80	Mainsail	3D printer web UI
7125	Moonraker	Klipper API

Config backed up daily to git.nuclide.systems/fkrebs/klipper-config via cron at 03:00 → covered offsite by Backrest services/gitea path.

External Services (Not on NUC Docker)

Zoraxy routes to these external backends:

Domain	Target	Host	Service
ha.nuclide.systems	`192.168.1.60:8123`	Home Assistant VM 100	Home automation
nc.nuclide.systems	`192.168.1.41:11000`	Nextcloud LXC 105	Cloud storage
ocpp.nuclide.systems	`192.168.1.60:8887`	Home Assistant VM 100	EV charger OCPP
shepard.nuclide.systems	`192.168.1.49:80`	Shepard LXC 101	Shepard
shepard-api.nuclide.systems	`192.168.1.49:8080`	Shepard LXC 101	Shepard API
id.nuclide.systems	`192.168.1.5:11000`	Pocket-ID LXC 110	OIDC IdP (migrated 2026-05-20)
git.nuclide.systems	`192.168.1.42:3000`	Dev LXC 111	Gitea (self-hosted Git)
dev.nuclide.systems	`192.168.1.42:7080`	Dev LXC 111	Coder (workspace orchestrator)
Gitea SSH	`192.168.1.42:222`	Dev LXC 111	`ssh -p 222 git@git.nuclide.systems`

Zoraxy Public Routes (proxied via `192.168.1.4`)

Domain	Backend (NUC `192.168.1.40`)	Port
ai.nuclide.systems	litellm	14000
chat.nuclide.systems	lobehub	14001
mcp.nuclide.systems	mcp-gateway	8080
arcane.nuclide.systems	arcane	10002
gotify.nuclide.systems	gotify	10003
vault.nuclide.systems	vaultwarden	11001
immich.nuclide.systems	immich_server	12000
immich-tools.nuclide.systems	immich_power_tools	(container-internal)
abs.nuclide.systems	audiobookshelf	13003
n8n.nuclide.systems	n8n	16000
memos.nuclide.systems	memos	17000
hoarder.nuclide.systems	karakeep	17001
traccar.nuclide.systems	traccar	15000
dozzle.nuclide.systems	dozzle	10001
s3.nuclide.systems	garage	10004

Not publicly proxied (LAN / localhost only): pgadmin, paperless, paperless-ai, comfyui, comfyui-mcp, rdtclient, prowlarr, shelfarr, qdrant.

Known Issues

lobe-postgres / lobe-redis: host-port exposed (0.0.0.0:5432/6379) — firewall blocks external access but ideally restricted to localhost.

OIDC Client Registry (Pocket ID — `id.nuclide.systems`)

Client ID	Name	Redirect URIs
`e73bb7b9`	litellm	(empty = accept all) — used by LiteLLM UI + MCP Gateway
`26f3c26b`	lobehub	`https://chat.nuclide.systems/api/auth/callback/generic-oidc`
`81cf4ed0`	arcane	`https://arcane.nuclide.systems/auth/oidc/callback`
`33135ad4`	n8n	`https://n8n.nuclide.systems/auth/oidc/callback`
`9c91c18b`	immich	`https://immich.nuclide.systems/auth/login` + mobile
`62bf4e0d`	memos	`https://memos.nuclide.systems/auth/callback`
`d92f82b0`	karakeep	`https://hoarder.nuclide.systems/api/auth/callback/custom`
`a14b8076`	nextcloud	`https://nc.nuclide.systems/apps/user_oidc/code`
`0aee4280`	Coder	`https://dev.nuclide.systems/api/v2/users/oidc/callback`
`9444609e`	Gitea	`https://git.nuclide.systems/user/oauth2/pocket-id/callback`
`38469e7e`	Proxmox VE	`https://192.168.1.20:8006`
~~798a367f~~	~~daytona~~	DECOMMISSIONED — remove from Pocket-ID
`cbbf20d5`	Audiobookshelf	`https://abs.nuclide.systems/…` + `*`
`d8733fcc`	shelfarr	`*`
`78c78998`	Claude MCP	`https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback`
`82ca2d53`	nuc-ai	(empty) — used by spawned MCP servers
`7fe1a14b`	zoraxy	(empty)
`af2f837b`	mcp-auth	(empty) — legacy, unused
(new)	vaultwarden	`https://vault.nuclide.systems/auth/callback`

OIDC Endpoints (corrected 2026-05-17 — previously used wrong /api/v1/oauth2/ path):

Authorization: https://id.nuclide.systems/authorize
Token: https://id.nuclide.systems/api/oidc/token
Userinfo: https://id.nuclide.systems/api/oidc/userinfo
Discovery: https://id.nuclide.systems/.well-known/openid-configuration

13 KiB Raw Blame History Unescape Escape