208 lines
10 KiB
Markdown
208 lines
10 KiB
Markdown
# Port Map — NUC 14 Docker Stacks
|
||
|
||
> **Reverse proxy**: [Zoraxy v3.3.2](http://192.168.1.4:8000) on `192.168.1.4:8000` (LXC 108)
|
||
> Wildcard cert `*.nuclide.systems` · source of truth: [`proxy/zoraxy/routes.json`](proxy/zoraxy/routes.json)
|
||
> Manage routes: `uv run scripts/zoraxy_sync.py [--apply|--prune|--list]`
|
||
|
||
## Port Scheme
|
||
|
||
| Range | Category |
|
||
|---|---|
|
||
| 10000–10999 | Infrastructure |
|
||
| 11000–11999 | Security & Auth |
|
||
| 12000–12999 | Media – Immich |
|
||
| 13000–13999 | Media – Downloads / Arr |
|
||
| 14000–14999 | AI Stack |
|
||
| 15000–15999 | Documents |
|
||
| 16000–16999 | Automation |
|
||
| 17000–17999 | Notes & Bookmarks |
|
||
| 18000–18999 | DevOps / Image Gen |
|
||
| 19000–19999 | Tracking |
|
||
| 20000–20999 | Storage Admin |
|
||
| 30000–30999 | VPN Control |
|
||
|
||
---
|
||
|
||
## Infrastructure (10000–10999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [10000](http://192.168.1.40:10000) | Homepage | `homepage` | — | Dashboard, LAN only |
|
||
| [10001](http://192.168.1.40:10001) | Dozzle | `dozzle` | [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | Log viewer |
|
||
| [10002](http://192.168.1.40:10002) | Arcane | `arcane` | [arcane.nuclide.systems](https://arcane.nuclide.systems) | Web IDE |
|
||
| [10003](http://192.168.1.40:10003) | Gotify | `gotify` | [gotify.nuclide.systems](https://gotify.nuclide.systems) | Push notifications |
|
||
| [10004](http://192.168.1.40:10004) | Garage S3 API | `garage` | s3.nuclide.systems (non-responsive, see notes) | Internal: `http://garage:3900` |
|
||
| 10005 (127.0.0.1 only) | Garage Admin | `garage` | — | localhost only |
|
||
|
||
---
|
||
|
||
## Security & Auth (11000–11999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [11000](http://192.168.1.40:11000) | Pocket ID | `pocket-id` | [id.nuclide.systems](https://id.nuclide.systems) | OIDC provider |
|
||
| [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager |
|
||
|
||
---
|
||
|
||
## Media – Immich (12000–12999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [12000](http://192.168.1.40:12000) | Immich | `immich_server` | [immich.nuclide.systems](https://immich.nuclide.systems) | Photos/videos |
|
||
| — | Immich Power Tools | `immich_power_tools` | [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | Container-internal :3000, Zoraxy proxy |
|
||
|
||
---
|
||
|
||
## Media – Downloads / Arr Stack (13000–13999)
|
||
|
||
All arr-stack services run behind `vpn_gluetun` container network.
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [13001](http://192.168.1.40:13001) | RDTClient | `rdtclient` | — | LAN only |
|
||
| [13002](http://192.168.1.40:13002) | Prowlarr | `prowlarr` | — | LAN only |
|
||
| [13003](http://192.168.1.40:13003) | Audiobookshelf | `audiobookshelf` | [abs.nuclide.systems](https://abs.nuclide.systems) | |
|
||
| [13004](http://192.168.1.40:13004) | ShelfArr | `shelfarr` | — | LAN only |
|
||
| [13005](http://192.168.1.40:13005) | Flaresolverr | `flaresolverr` | — | Internal only |
|
||
| [30000](http://192.168.1.40:30000) | Gluetun VPN control | `vpn_gluetun` | — | HTTP control API |
|
||
|
||
---
|
||
|
||
## AI Stack (14000–14999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [14000](http://192.168.1.40:14000) | LiteLLM | `litellm` | [ai.nuclide.systems](https://ai.nuclide.systems) | LLM proxy gateway |
|
||
| [14001](http://192.168.1.40:14001) | LobeHub | `lobehub` | [chat.nuclide.systems](https://chat.nuclide.systems) | Chat UI |
|
||
| [14002](http://192.168.1.40:14002) | Qdrant | `qdrant_scientific` | — | Vector DB, internal only |
|
||
| [8080](http://192.168.1.40:8080) | MCP Gateway | `mcp-gateway` | [mcp.nuclide.systems](https://mcp.nuclide.systems) | Pocket ID gated; spawns MCP servers on `ai-internal` |
|
||
| [18002](http://192.168.1.40:18002) | ComfyUI | `comfyui` | — | LAN only (Intel Arc iGPU, FLUX.1-schnell GGUF) |
|
||
| [18003](http://192.168.1.40:18003) | ComfyUI MCP | `comfyui-mcp` | — | FastMCP; reachable via gateway at `mcp.nuclide.systems/comfyui/mcp` |
|
||
| — | SearXNG | `searxng` | — | Internal, `shared_backend`, used by LobeHub |
|
||
|
||
---
|
||
|
||
## Documents (15000–15999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [15000](http://192.168.1.40:15000) | Traccar HTTP | `traccar` | [traccar.nuclide.systems](https://traccar.nuclide.systems) | GPS tracking UI |
|
||
| [15001](http://192.168.1.40:15001) | Traccar GPS | `traccar` | — | TCP+UDP watch protocol |
|
||
| [15002](http://192.168.1.40:15002) | Paperless AI | `paperless-ai` | [paperless-ai.nuclide.systems](https://paperless-ai.nuclide.systems) | Internal-only Zoraxy policy |
|
||
| [15003](http://192.168.1.40:15003) | Paperless-ngx | `paperless-ngx-webserver-1` | [paperless.nuclide.systems](https://paperless.nuclide.systems) | Internal-only Zoraxy policy |
|
||
|
||
---
|
||
|
||
## Automation (16000–16999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [16000](http://192.168.1.40:16000) | n8n | `n8n` | [n8n.nuclide.systems](https://n8n.nuclide.systems) | Workflow automation |
|
||
|
||
---
|
||
|
||
## Notes & Bookmarks (17000–17999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [17000](http://192.168.1.40:17000) | Memos | `memos` | [memos.nuclide.systems](https://memos.nuclide.systems) | Notes |
|
||
| [17001](http://192.168.1.40:17001) | Karakeep | `karakeep` | [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | Bookmarks |
|
||
|
||
---
|
||
|
||
## DevOps (18000–18999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| [18000](http://192.168.1.40:18000) | Daytona API | `daytona-minimal-api-1` | [daytona.nuclide.systems](https://daytona.nuclide.systems) | Dev sandbox |
|
||
| [18001](http://192.168.1.40:18001) | Daytona SSH | `daytona-minimal-ssh-gateway-1` | — | SSH gateway |
|
||
|
||
---
|
||
|
||
## Tracking (19000–19999)
|
||
|
||
_Traccar moved to 15000–15001 (Documents range). 19000–19001 now free._
|
||
|
||
---
|
||
|
||
## Storage Admin (20000–20999)
|
||
|
||
| Port | Service | Container | Public URL | Notes |
|
||
|---|---|---|---|---|
|
||
| 20010 (127.0.0.1 only) | pgAdmin | `pgadmin` | — | localhost only |
|
||
|
||
---
|
||
|
||
## External Services (Not on NUC Docker)
|
||
|
||
Zoraxy routes to these external backends:
|
||
|
||
| Domain | Target | Host | Service |
|
||
|---|---|---|---|
|
||
| [ha.nuclide.systems](https://ha.nuclide.systems) | `192.168.1.60:8123` | Home Assistant VM | Home automation |
|
||
| [nc.nuclide.systems](https://nc.nuclide.systems) | `192.168.1.41:11000` | Nextcloud LXC | Cloud storage |
|
||
| [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM | EV charger OCPP |
|
||
| [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Docker host | Shepard |
|
||
| [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Docker host | Shepard API |
|
||
|
||
---
|
||
|
||
## Zoraxy Public Routes (proxied via `192.168.1.4`)
|
||
|
||
| Domain | Backend (NUC `192.168.1.40`) | Port |
|
||
|---|---|---|
|
||
| [ai.nuclide.systems](https://ai.nuclide.systems) | litellm | 14000 |
|
||
| [chat.nuclide.systems](https://chat.nuclide.systems) | lobehub | 14001 |
|
||
| [mcp.nuclide.systems](https://mcp.nuclide.systems) | mcp-gateway | 8080 |
|
||
| [arcane.nuclide.systems](https://arcane.nuclide.systems) | arcane | 10002 |
|
||
| [gotify.nuclide.systems](https://gotify.nuclide.systems) | gotify | 10003 |
|
||
| [id.nuclide.systems](https://id.nuclide.systems) | pocket-id | 11000 |
|
||
| [vault.nuclide.systems](https://vault.nuclide.systems) | vaultwarden | 11001 |
|
||
| [immich.nuclide.systems](https://immich.nuclide.systems) | immich_server | 12000 |
|
||
| [immich-tools.nuclide.systems](https://immich-tools.nuclide.systems) | immich_power_tools | (container-internal) |
|
||
| [abs.nuclide.systems](https://abs.nuclide.systems) | audiobookshelf | 13003 |
|
||
| [n8n.nuclide.systems](https://n8n.nuclide.systems) | n8n | 16000 |
|
||
| [memos.nuclide.systems](https://memos.nuclide.systems) | memos | 17000 |
|
||
| [hoarder.nuclide.systems](https://hoarder.nuclide.systems) | karakeep | 17001 |
|
||
| [daytona.nuclide.systems](https://daytona.nuclide.systems) | daytona-api | 18000 |
|
||
| [traccar.nuclide.systems](https://traccar.nuclide.systems) | traccar | 15000 |
|
||
| [dozzle.nuclide.systems](https://dozzle.nuclide.systems) | dozzle | 10001 |
|
||
|
||
**Not publicly proxied** (LAN / localhost only): pgadmin, paperless, paperless-ai, comfyui, comfyui-mcp, rdtclient, prowlarr, shelfarr, qdrant.
|
||
|
||
---
|
||
|
||
## Known Issues
|
||
|
||
- **`s3.nuclide.systems`** (Garage external S3): non-responsive. Internal S3 `http://garage:3900` works fine for wal-g, memos, lobe. External binding risks quorum loss — deferred.
|
||
- **`lobe-postgres` / `lobe-redis`**: host-port exposed (`0.0.0.0:5432/6379`) — firewall blocks external access but ideally restricted to localhost.
|
||
|
||
---
|
||
|
||
## OIDC Client Registry (Pocket ID — `id.nuclide.systems`)
|
||
|
||
| Client ID | Name | Redirect URIs |
|
||
|---|---|---|
|
||
| `e73bb7b9` | litellm | (empty = accept all) — used by LiteLLM UI + MCP Gateway |
|
||
| `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` |
|
||
| `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` |
|
||
| `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` |
|
||
| `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile |
|
||
| `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` |
|
||
| `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` |
|
||
| `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` |
|
||
| `798a367f` | daytona | `https://daytona.nuclide.systems` |
|
||
| `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` |
|
||
| `d8733fcc` | shelfarr | `*` |
|
||
| `78c78998` | Claude MCP | `https://claude.ai/api/mcp/auth_callback` + `https://mcp.nuclide.systems/mcp/auth/callback` |
|
||
| `82ca2d53` | nuc-ai | (empty) — used by spawned MCP servers |
|
||
| `7fe1a14b` | zoraxy | (empty) |
|
||
| `af2f837b` | mcp-auth | (empty) — legacy, unused |
|
||
|
||
**OIDC Endpoints** (corrected 2026-05-17 — previously used wrong `/api/v1/oauth2/` path):
|
||
- Authorization: `https://id.nuclide.systems/authorize`
|
||
- Token: `https://id.nuclide.systems/api/oidc/token`
|
||
- Userinfo: `https://id.nuclide.systems/api/oidc/userinfo`
|
||
- Discovery: `https://id.nuclide.systems/.well-known/openid-configuration`
|