Port Map — NUC 14 Docker Stacks
Reverse proxy: Zoraxy v3.3.2 on 192.168.1.4:8000 (LXC 108)
Wildcard cert *.nuclide.systems · source of truth: proxy/zoraxy/routes.json
Manage routes: uv run scripts/zoraxy_sync.py [--apply|--prune|--list]
Port Scheme
| Range |
Category |
| 10000–10999 |
Infrastructure |
| 11000–11999 |
Security & Auth |
| 12000–12999 |
Media – Immich |
| 13000–13999 |
Media – Downloads / Arr |
| 14000–14999 |
AI Stack |
| 15000–15999 |
Documents |
| 16000–16999 |
Automation |
| 17000–17999 |
Notes & Bookmarks |
| 18000–18999 |
DevOps / Image Gen |
| 19000–19999 |
Tracking |
| 20000–20999 |
Storage Admin |
| 30000–30999 |
VPN Control |
Infrastructure (10000–10999)
Security & Auth (11000–11999)
Media – Immich (12000–12999)
Media – Downloads / Arr Stack (13000–13999)
All arr-stack services run behind vpn_gluetun container network.
| Port |
Service |
Container |
Public URL |
Notes |
| 13001 |
RDTClient |
rdtclient |
— |
LAN only |
| 13002 |
Prowlarr |
prowlarr |
— |
LAN only |
| 13003 |
Audiobookshelf |
audiobookshelf |
abs.nuclide.systems |
|
| 13004 |
ShelfArr |
shelfarr |
— |
LAN only |
| 13005 |
Flaresolverr |
flaresolverr |
— |
Internal only |
| 30000 |
Gluetun VPN control |
vpn_gluetun |
— |
HTTP control API |
AI Stack (14000–14999)
| Port |
Service |
Container |
Public URL |
Notes |
| 14000 |
LiteLLM |
litellm |
ai.nuclide.systems |
LLM proxy gateway |
| 14001 |
LobeHub |
lobehub |
chat.nuclide.systems |
Chat UI |
| 14002 |
Qdrant |
qdrant_scientific |
— |
Vector DB, internal only |
| 8080 |
MCP Gateway |
mcp-gateway |
mcp.nuclide.systems |
Pocket ID gated; spawns MCP servers on ai-internal |
| 18002 |
ComfyUI |
comfyui |
— |
LAN only (Intel Arc iGPU, FLUX.1-schnell GGUF) |
| 18003 |
ComfyUI MCP |
comfyui-mcp |
— |
FastMCP; reachable via gateway at mcp.nuclide.systems/comfyui/mcp |
| — |
SearXNG |
searxng |
— |
Internal, shared_backend, used by LobeHub |
Documents (15000–15999)
Automation (16000–16999)
Notes & Bookmarks (17000–17999)
DevOps (18000–18999)
| Port |
Service |
Container |
Public URL |
Notes |
| 18000 |
Daytona API |
daytona-minimal-api-1 |
daytona.nuclide.systems |
Dev sandbox |
| 18001 |
Daytona SSH |
daytona-minimal-ssh-gateway-1 |
— |
SSH gateway |
Tracking (19000–19999)
Traccar moved to 15000–15001 (Documents range). 19000–19001 now free.
Storage Admin (20000–20999)
| Port |
Service |
Container |
Public URL |
Notes |
| 20010 (127.0.0.1 only) |
pgAdmin |
pgadmin |
— |
localhost only |
External Services (Not on NUC Docker)
Zoraxy routes to these external backends:
Zoraxy Public Routes (proxied via 192.168.1.4)
Not publicly proxied (LAN / localhost only): pgadmin, paperless, paperless-ai, comfyui, comfyui-mcp, rdtclient, prowlarr, shelfarr, qdrant.
Known Issues
s3.nuclide.systems (Garage external S3): non-responsive. Internal S3 http://garage:3900 works fine for wal-g, memos, lobe. External binding risks quorum loss — deferred.lobe-postgres / lobe-redis: host-port exposed (0.0.0.0:5432/6379) — firewall blocks external access but ideally restricted to localhost.
OIDC Client Registry (Pocket ID — id.nuclide.systems)
| Client ID |
Name |
Redirect URIs |
e73bb7b9 |
litellm |
(empty = accept all) — used by LiteLLM UI + MCP Gateway |
26f3c26b |
lobehub |
https://chat.nuclide.systems/api/auth/callback/generic-oidc |
81cf4ed0 |
arcane |
https://arcane.nuclide.systems/auth/oidc/callback |
33135ad4 |
n8n |
https://n8n.nuclide.systems/auth/oidc/callback |
9c91c18b |
immich |
https://immich.nuclide.systems/auth/login + mobile |
62bf4e0d |
memos |
https://memos.nuclide.systems/auth/callback |
d92f82b0 |
karakeep |
https://hoarder.nuclide.systems/api/auth/callback/custom |
a14b8076 |
nextcloud |
https://nc.nuclide.systems/apps/user_oidc/code |
798a367f |
daytona |
https://daytona.nuclide.systems |
cbbf20d5 |
Audiobookshelf |
https://abs.nuclide.systems/… + * |
d8733fcc |
shelfarr |
* |
78c78998 |
Claude MCP |
https://claude.ai/api/mcp/auth_callback + https://mcp.nuclide.systems/mcp/auth/callback |
82ca2d53 |
nuc-ai |
(empty) — used by spawned MCP servers |
7fe1a14b |
zoraxy |
(empty) |
af2f837b |
mcp-auth |
(empty) — legacy, unused |
OIDC Endpoints (corrected 2026-05-17 — previously used wrong /api/v1/oauth2/ path):
- Authorization:
https://id.nuclide.systems/authorize
- Token:
https://id.nuclide.systems/api/oidc/token
- Userinfo:
https://id.nuclide.systems/api/oidc/userinfo
- Discovery:
https://id.nuclide.systems/.well-known/openid-configuration
