fkrebs
a2f1d49170
- CT 111 (dev): Gitea + Coder + act-runner migrated to CT 104 - Gitea uses Redis for queue/cache/session (idmapped NFS LevelDB workaround) - Zoraxy routes dev/git updated to 192.168.1.40 - AdGuard dev.nuclide.lan updated to 192.168.1.40 - CT 112 (secrets): Infisical migrated to CT 109 - DB dump restored; SITE_URL updated to 192.168.1.8:8200 - AdGuard secrets.nuclide.lan updated to 192.168.1.8 - Proton Mail Bridge deployed on CT 104 (SMTP :1025, IMAP :1143) - Homepage updated: Dev group → ct104, Infisical → my-local, Background group added - portmap, ct-inventory, zoraxy, dev-environment, secrets-manager all updated Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
5.5 KiB
Zoraxy Reverse Proxy
Zoraxy is a Go-based reverse proxy + ACME daemon running as a systemd service on LXC 108 (
zoraxy, 192.168.1.4). Config lives in JSON files at/opt/zoraxy/conf/proxy/. Changes take effect aftersystemctl restart zoraxy.
Current route table
Audited 2026-05-23; updated 2026-05-26 (mcp.nuclide.systems removed, ai/chat backends swapped, arcane.nuclide.systems removed). 20 active public routes have:
EnableAutoHTTPS: true— Zoraxy requests LE certs for*.nuclide.systemsEnableWebsocketCustomHeaders: true— preserves WS upgrade headers through the proxyDisableHopByHopHeaderRemoval: true— keeps hop-by-hop headers intact for upstream
SkipWebSocketOriginCheck is enabled on routes that use WebSocket heavily (n8n, Coder, Gotify, Immich, abs, ai, chat, ha, nc, ocpp, s3, shepard*). Disabled on git, hoarder, id, memos (not needed).
| Domain | Upstream | SkipWSOrigin | Notes |
|---|---|---|---|
| abs.nuclide.systems | 192.168.1.40:13003 | ✓ | Audiobookshelf |
| ai.nuclide.systems | 192.168.1.40:14003 | ✓ | Bifrost LLM gateway (LiteLLM decommissioned 2026-05-26) |
| — | DECOMMISSIONED 2026-05-26 — replaced by Portainer | ||
| chat.nuclide.systems | 192.168.1.40:14002 | ✓ | Open WebUI (LobeChat decommissioned 2026-05-26) |
| dev.nuclide.systems | 192.168.1.40:7080 | ✓ | Coder (CT 104; migrated from CT 111 2026-05-26) |
| git.nuclide.systems | 192.168.1.40:3000 | — | Gitea (CT 104; migrated from CT 111 2026-05-26) |
| gotify.nuclide.systems | 192.168.1.40:10003 | ✓ | Gotify push notifications |
| ha.nuclide.systems | 192.168.1.60:8123 | ✓ | Home Assistant (VM 100) |
| hoarder.nuclide.systems | 192.168.1.40:17001 | — | Karakeep bookmarks |
| id.nuclide.systems | 192.168.1.5:11000 | — | Pocket-ID OIDC (CT 110) |
| immich.nuclide.systems | 192.168.1.40:12000 | ✓ | Immich photos |
| — | DECOMMISSIONED 2026-05-26 — mcp-gateway removed; MCP now at https://ai.nuclide.systems/mcp (Bifrost) |
||
| memos.nuclide.systems | 192.168.1.40:17000 | — | Memos notes |
| n8n.nuclide.systems | 192.168.1.40:16000 | ✓ | n8n workflows |
| nc.nuclide.systems | 192.168.1.41:11000 | ✓ | Nextcloud AIO (CT 105) |
| ocpp.nuclide.systems | 192.168.1.60:8887 | ✓ | OCPP charger endpoint (HAOS) |
| s3.nuclide.systems | 192.168.1.40:10004 | ✓ | Garage S3 (web endpoint) |
| shepard.nuclide.systems | 192.168.1.49:80 | ✓ | Shepard frontend (CT 101) |
| shepard-api.nuclide.systems | 192.168.1.49:8080 | ✓ | Shepard API (CT 101) |
| shepard-auth.nuclide.systems | 192.168.1.49:8082 | ✓ | Shepard auth (CT 101) |
| traccar.nuclide.systems | 192.168.1.40:15000 | ✓ | Traccar GPS |
| vault.nuclide.systems | 192.168.1.40:11001 | ✓ | Vaultwarden |
Intentionally LAN-only (no Zoraxy route): Dozzle (:10001), Homarr (:7575), Wetty (:4090), docs-server (:13080), paperless (:15003), paperless-ai (:15002), immich-tools. immich-tools.nuclide.systems is listed in portmap but route has not been created — defer until needed.
root.config — ProxyType=0 internal dashboard fallback (127.0.0.1:5487), no ACME.
Admin UI
http://192.168.1.4:8000
Zoraxy runs with -noauth=true — no login required on the LAN.
Adding a new route
Via admin UI
- Reverse Proxy → Create Proxy Rules → New Proxy Rule
- Enter the domain, set the upstream IP:port
- TLS → Enable Auto HTTPS — tick it
- Header Rewrite Rules → enable Disable Hop-by-Hop Removal and WebSocket Custom Headers
- Save, allow 1–2 minutes for LE cert issuance
Via JSON (preferred for scripted changes)
Config files live at /opt/zoraxy/conf/proxy/<domain>.config on CT 108.
Minimum template for a new public route:
{
"ProxyType": 1,
"RootOrMatchingDomain": "example.nuclide.systems",
"ActiveOrigins": [{"OriginIpOrDomain": "192.168.1.40:PORT", "Weight": 1}],
"TlsOptions": {"EnableAutoHTTPS": true},
"HeaderRewriteRules": {"DisableHopByHopHeaderRemoval": true},
"EnableWebsocketCustomHeaders": true,
"AccessFilterUUID": "default"
}
After editing, restart Zoraxy:
ssh root@192.168.1.4 'systemctl restart zoraxy'
Backup / restore
All configs are backed up at /tmp/zoraxy-backup-2026-05-21/ on CT 108 (22 files from the 2026-05-21 audit). To restore a single route:
ssh root@192.168.1.4 'cp /tmp/zoraxy-backup-2026-05-21/<domain>.config /opt/zoraxy/conf/proxy/ && systemctl restart zoraxy'
Decommissioned routes
.DECOMMISSIONED-* files in /opt/zoraxy/conf/proxy/ are ignored by Zoraxy. Current:
daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20id.daytona.nuclide.systems.config.DECOMMISSIONED-2026-05-20mcp.nuclide.systems.config— removed 2026-05-26 (mcp-gateway decommissioned; MCP now via Bifrost atai.nuclide.systems/mcp)arcane.nuclide.systems.config— removed 2026-05-26 (Arcane decommissioned; replaced by Portainer athttp://192.168.1.8:9000LAN-only)
Auth posture
No routes have ForwardAuthURL set (no Tinyauth/auth middleware). Pocket-ID (id.nuclide.systems) is the OIDC IdP; apps that require auth implement it themselves (Open WebUI, Coder, Gitea, Nextcloud). Public-facing routes like ha.nuclide.systems and ocpp.nuclide.systems have no proxy-level auth — upstream apps handle it.
Pending: Tinyauth or similar on unauthenticated-but-sensitive routes (gotify). Planned for CT 109 deployment.