fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
fc6507abd2cebb8fce19bbcdcdc47be39f519408
docs/infra/connection-hosts.md
T

350 lines
15 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Connection Hosts — nuclide.systems
Maintained reference for every host, LAN address, port, and public URL.
**Last verified: 2026-05-23.**
> Source of truth: [`ct-inventory.md`](../ct-inventory.md) (guests) · [`portmap.md`](portmap.md) (Docker ports) · [`homelab-architecture.md`](../services/homelab-architecture.md) (topology).
---
## Network infrastructure
| Device | LAN IP | Admin UI | Notes |
|---|---|---|---|
| **UDM Home** (UCG Fiber, UniFi OS 5.0.16) | `192.168.1.1` | `https://192.168.1.1` (SSO + MFA) | Gateway, DNS forwarder → AdGuard; port-forwards 80/443 → Zoraxy (`.4`), 15001 TCP/UDP → CT 104 |
| **D-Link DGS-1210-28P** | `192.168.1.10` | `http://192.168.1.10` (HTTP-only, pw: `tapirnase`) | 28-port PoE switch — physical core. UDM on port 26, CT 104 cluster on port 10, APs on ports 3 & 16. SNTP fixed 2026-05-19. |
| **UNAS Pro** (NFS server) | `192.168.1.31` | `http://192.168.1.31` | NFSv3 export: `192.168.1.31:/var/nfs/shared/storage` (→ `/mnt/pve/unas`). ~19 T bulk storage. |
| **UniFi U7 APs** | `.50` `.51` `.52` `.53` | via UDM | Hallway, In-wall, Bedroom (Schlafzimmer), Dining (Esszimmer). SSID: `nuclide`, WPA2/WPA3. |
| **TP-Link RE700X** | `192.168.1.187` | `http://192.168.1.187` | WiFi extender — NATs devices behind it (3D printer `.189` invisible to UniFi). |
---
## Proxmox VE host — `nuc`
| | Value |
|---|---|
| **IP** | `192.168.1.20` |
| **Admin UI** | `https://192.168.1.20:8006` (OIDC via Pocket-ID client `38469e7e`) |
| **SSH** | `ssh root@192.168.1.20` (key auth) |
| **Hardware** | Intel Core Ultra 7 155H · 22 threads · 64 GiB RAM · PVE 9.1.11 |
| **Storage** | `local-zfs` ~1.9 T (NVMe), `local` (dir), `unas` (NFS ~19 T) |
| **API token** | `root@pam!mcp` (PVEAuditor role, read-only) |
---
## LXC / VM guests
### VM 100 — `haos` (Home Assistant OS)
| | Value |
|---|---|
| **IP** | `192.168.1.60` (DHCP, stable) |
| **HA UI** | `https://ha.nuclide.systems` → `192.168.1.60:8123` |
| **SSH** | `ssh root@192.168.1.60` (key installed manually in HA terminal) |
| **OCPP** | `https://ocpp.nuclide.systems` → `192.168.1.60:8887` |
| **HA-MCP add-on** | `http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ` (gateway upstream, no TLS) |
| **Specs** | 4c / 16 GiB (balloon 4 GiB) / 32 GiB; USB Zigbee dongle passed through |
### CT 101 — `shepard`
| | Value |
|---|---|
| **IP** | `192.168.1.49` |
| **SSH** | `ssh root@192.168.1.49` |
| **Public** | `https://shepard.nuclide.systems` (Caddy → `:80`) · `https://shepard-api.nuclide.systems` (→ `:8080`) |
| **MCP** | `https://shepard.nuclide.systems/v2/mcp` (Bearer `${SHEPARD_API_KEY}`) |
| **Specs** | 12c / 32 GiB / 500 GiB + NFS; Intel iGPU (card+render) |
| **Stack** | Caddy, Shepard frontend/backend, Keycloak, Mongo, Neo4j, TimescaleDB |
### CT 102 — `dns` (AdGuard Home)
| | Value |
|---|---|
| **IP** | `192.168.1.2` |
| **SSH** | `ssh root@192.168.1.2` |
| **Admin UI** | `http://192.168.1.2` (port 80) |
| **DNS** | `192.168.1.2:53` — LAN resolver (UDM forwards all DNS here) |
| **Specs** | 2c / 1 GiB / 4 GiB |
### CT 103 — `backrest`
| | Value |
|---|---|
| **IP** | `192.168.1.3` |
| **SSH** | `ssh root@192.168.1.3` |
| **UI** | `http://192.168.1.3:9898` (LAN-only, no auth) |
| **Specs** | 1c / 512 MiB / 8 GiB + NFS (`/mnt/pve/unas`) |
| **Notes** | JottaCloud offsite via rclone; repos `services-repo` + `media-repo` |
### CT 104 — `docker` (main Docker host)
| | Value |
|---|---|
| **IP** | `192.168.1.40` |
| **SSH** | `ssh root@192.168.1.40` |
| **Specs** | 16c / 48 GiB / 200 GiB + NFS; Intel Arc iGPU (card+render) |
| **Role** | ~65 containers across ~23 compose stacks in `/opt/stacks/` |
See [Docker services table](#docker-services--ct-104) below for all ports.
### CT 105 — `nextcloud`
| | Value |
|---|---|
| **IP** | `192.168.1.41` |
| **SSH** | `ssh root@192.168.1.41` |
| **Public** | `https://nc.nuclide.systems` → `192.168.1.41:11000` |
| **Specs** | 4c / 8 GiB / 100 GiB + NFS (migrated to NFSv3 2026-05-22) |
| **Auth** | Pocket-ID OIDC (client `a14b8076`) |
### CT 108 — `zoraxy` (reverse proxy)
| | Value |
|---|---|
| **IP** | `192.168.1.4` |
| **SSH** | `ssh root@192.168.1.4` |
| **Admin UI** | `http://192.168.1.4:8000` (LAN only) |
| **Specs** | 2c / 2 GiB / 6 GiB |
| **Cert** | Wildcard `*.nuclide.systems` (ACME via Let's Encrypt) |
| **Config** | `proxy/zoraxy/routes.json` → `scripts/zoraxy_sync.py --apply` |
### CT 110 — `id` (Pocket-ID OIDC)
| | Value |
|---|---|
| **IP** | `192.168.1.5` |
| **SSH** | `ssh root@192.168.1.5` |
| **Public** | `https://id.nuclide.systems` → `192.168.1.5:11000` |
| **Specs** | 1c / 1 GiB / 4 GiB |
| **OIDC endpoints** | Authorization: `https://id.nuclide.systems/authorize` · Token: `https://id.nuclide.systems/api/oidc/token` · Userinfo: `https://id.nuclide.systems/api/oidc/userinfo` · Discovery: `https://id.nuclide.systems/.well-known/openid-configuration` |
### CT 111 — `dev` (Coder + Gitea)
| | Value |
|---|---|
| **IP** | `192.168.1.42` |
| **SSH** | `ssh root@192.168.1.42` |
| **Specs** | 12c / 32 GiB / 60 GiB + NFS; Intel Arc iGPU (render) |
| Port | Service | Public URL |
|---|---|---|
| 7080 | Coder | `https://dev.nuclide.systems` |
| 3000 | Gitea | `https://git.nuclide.systems` |
| 222 | Gitea SSH | `ssh -p 222 git@git.nuclide.systems` |
| 13080 | docs site | `http://192.168.1.42:13080` (LAN; mkdocs Material, auto-rebuild every 5 min) |
| internal | act-runner | — (`ct111-runner` Gitea Actions) |
### CT 112 — `secrets` (Infisical)
| | Value |
|---|---|
| **IP** | `192.168.1.7` |
| **SSH** | `ssh root@192.168.1.7` |
| **UI + API** | `http://192.168.1.7:8200` **(LAN-only — no Zoraxy route; must not be internet-exposed)** |
| **Specs** | 2c / 4 GiB / 20 GiB |
| **Stack** | `/opt/stacks/infisical/` — Infisical + Postgres 16 + Redis 7 (all internal, no external ports) |
### CT 113 — `db` (shared Postgres)
| | Value |
|---|---|
| **IP** | `192.168.1.6` |
| **SSH** | `ssh root@192.168.1.6` |
| **Specs** | 2c / 4 GiB / 40 GiB |
| Port | Service | Access |
|---|---|---|
| 5432 | Postgres 17 | LAN: `192.168.1.6:5432` — tenants: LiteLLM, paperless, memos, n8n (reverted), Vaultwarden |
| 5050 | pgAdmin 4 | `http://192.168.1.6:5050` (LAN only, no Zoraxy route) |
---
## Docker services — CT 104
All on `192.168.1.40` unless noted. Zoraxy (`192.168.1.4`) terminates TLS for public URLs.
### Infrastructure (10000–10999)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 10000 | `homepage` | — | Dashboard (LAN only) |
| 10001 | `dozzle` | `https://dozzle.nuclide.systems` | Log viewer |
| 10002 | `arcane` | `https://arcane.nuclide.systems` | Web IDE (OIDC `81cf4ed0`) |
| 10003 | `gotify` | `https://gotify.nuclide.systems` | Push notifications |
| 10004 | `garage` | `https://s3.nuclide.systems` | S3 API (Garage); internal: `http://garage:3900` |
| 10005 (localhost) | `garage` admin | — | Localhost only |
### Security & Auth (11000–11999)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 11001 | `vaultwarden` | `https://vault.nuclide.systems` | Password manager (OIDC client created, SSO not yet wired) |
### Media — Immich (12000–12999)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 12000 | `immich_server` | `https://immich.nuclide.systems` | Photos/videos (OIDC `9c91c18b`) |
| internal | `immich_power_tools` | `https://immich-tools.nuclide.systems` | Container-internal :3000, Zoraxy proxy |
### Media — Downloads / Arr (13000–13999)
All behind `vpn_gluetun` container network.
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 13001 | `rdtclient` | — | LAN only |
| 13002 | `prowlarr` | — | LAN only |
| 13003 | `audiobookshelf` | `https://abs.nuclide.systems` | OIDC `cbbf20d5` |
| 13004 | `shelfarr` | — | LAN only (OIDC `d8733fcc`) |
| 13005 | `flaresolverr` | — | Internal only |
| 30000 | `vpn_gluetun` | — | VPN HTTP control API |
### AI Stack (14000–14999, 8080, 18xxx)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 14000 | `litellm` | — | LLM proxy (internal only: `http://litellm:4000`); master key: `sk-tapirnase` |
| 14001 | `lobehub` | `https://chat.nuclide.systems` | Chat UI (OIDC `26f3c26b`) |
| 14002 | `qdrant_scientific` | — | Vector DB (LAN/internal only) |
| 14003 | `bifrost` | `https://ai.nuclide.systems` | LLM+MCP gateway; `/mcp` = MCP endpoint (29 clients, ~760 tools); master key: `sk-tapirnase` |
| ~~8080~~ | ~~`mcp-gateway`~~ | ~~`https://mcp.nuclide.systems`~~ | **DECOMMISSIONED 2026-05-26** — see [mcp-gateway.md](../services/mcp-gateway.md) |
| 18002 | `comfyui` | — | Image gen (Intel Arc); LAN only |
| 18003 | `comfyui-mcp` | via Bifrost `comfyui` client | FastMCP |
| 18005 | `docling-mcp` | via Bifrost `docling` client | PDF→Markdown |
| 18007 | `kroki-mcp` | via Bifrost `kroki` client | Diagram rendering |
| 18009 | `speaches` | — | TTS/STT; LAN only |
| 18011 | `upload-artifact-mcp` | via Bifrost `upload_artifact` client | S3 artifact upload |
| internal | `searxng` | — | `shared_backend`; used by LobeChat |
### Documents (15000–15999)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 15000 | `traccar` | `https://traccar.nuclide.systems` | GPS tracking UI |
| 15001 | `traccar` | — | TCP+UDP watch protocol (forwarded at UDM level) |
| 15002 | `paperless-ai` | `https://paperless-ai.nuclide.systems` | Internal-only Zoraxy policy |
| 15003 | `paperless-ngx-webserver-1` | `https://paperless.nuclide.systems` | Internal-only Zoraxy policy |
### Automation (16000–16999)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 16000 | `n8n` | `https://n8n.nuclide.systems` | Workflow automation (OIDC `33135ad4`); SQLite local disk |
### Notes & Bookmarks (17000–17999)
| Port | Container | Public URL | Notes |
|---|---|---|---|
| 17000 | `memos` | `https://memos.nuclide.systems` | Notes (OIDC `62bf4e0d`) |
| 17001 | `karakeep` | `https://hoarder.nuclide.systems` | Bookmarks (OIDC `d92f82b0`) |
### Storage Admin (20000–20999)
| Port | Container | Notes |
|---|---|---|
| 20010 (localhost) | `pgadmin` | shared-db pgAdmin, localhost only on CT 104 |
---
## External hardware
### QNAP UNAS Pro — NFS/SMB server
| | Value |
|---|---|
| **IP** | `192.168.1.31` |
| **Admin UI** | `http://192.168.1.31` |
| **NFS export** | `192.168.1.31:/var/nfs/shared/storage` (NFSv3 only; v4 not available) |
| **CIFS** | `//192.168.1.31/storage` (used by Nextcloud CT 105 only) |
### QNAP TS-251D — Klipper 3D printer host
| | Value |
|---|---|
| **IP** | `192.168.1.189` (behind TP-Link RE700X at `.187`) |
| **Mainsail** | `http://192.168.1.189:80` |
| **Moonraker** | `http://192.168.1.189:7125` |
| **Notes** | Klipper config backed up daily to `git.nuclide.systems/fkrebs/klipper-config` via cron |
---
## OIDC clients — Pocket-ID (`id.nuclide.systems`)
| Client ID | Service | Redirect URI |
|---|---|---|
| ~~`e73bb7b9`~~ | ~~litellm / mcp-gateway~~ | **DELETED 2026-05-26** |
| `26f3c26b` | lobehub | `https://chat.nuclide.systems/api/auth/callback/generic-oidc` |
| `81cf4ed0` | arcane | `https://arcane.nuclide.systems/auth/oidc/callback` |
| `33135ad4` | n8n | `https://n8n.nuclide.systems/auth/oidc/callback` |
| `9c91c18b` | immich | `https://immich.nuclide.systems/auth/login` + mobile |
| `62bf4e0d` | memos | `https://memos.nuclide.systems/auth/callback` |
| `d92f82b0` | karakeep | `https://hoarder.nuclide.systems/api/auth/callback/custom` |
| `a14b8076` | nextcloud | `https://nc.nuclide.systems/apps/user_oidc/code` |
| `0aee4280` | Coder | `https://dev.nuclide.systems/api/v2/users/oidc/callback` |
| `9444609e` | Gitea | `https://git.nuclide.systems/user/oauth2/pocket-id/callback` |
| `38469e7e` | Proxmox VE | `https://192.168.1.20:8006` |
| `cbbf20d5` | Audiobookshelf | `https://abs.nuclide.systems/…` + `*` |
| `d8733fcc` | shelfarr | `*` |
| ~~`78c78998`~~ | ~~Claude MCP (legacy)~~ | **DELETED 2026-05-26** |
| `82ca2d53` | nuc-ai (MCP spawned servers) | (empty) |
| `7fe1a14b` | zoraxy | (empty) |
| (new) | vaultwarden | `https://vault.nuclide.systems/auth/callback` — SSO not yet wired |
| ~~798a367f~~ | ~~daytona~~ | **DECOMMISSIONED — remove from Pocket-ID** |
---
## Quick-reference — all public URLs
| URL | Backend | Service |
|---|---|---|
| `https://ai.nuclide.systems` | `192.168.1.40:14003` | Bifrost (LLM+MCP gateway) — `/mcp` for MCP tools |
| `https://chat.nuclide.systems` | `192.168.1.40:14001` | LobeChat |
| ~~`https://mcp.nuclide.systems`~~ | ~~`192.168.1.40:8080`~~ | **DECOMMISSIONED 2026-05-26** |
| `https://id.nuclide.systems` | `192.168.1.5:11000` | Pocket-ID (OIDC) |
| `https://nc.nuclide.systems` | `192.168.1.41:11000` | Nextcloud |
| `https://ha.nuclide.systems` | `192.168.1.60:8123` | Home Assistant |
| `https://ocpp.nuclide.systems` | `192.168.1.60:8887` | EV charger OCPP |
| `https://shepard.nuclide.systems` | `192.168.1.49:80` | Shepard |
| `https://shepard-api.nuclide.systems` | `192.168.1.49:8080` | Shepard API |
| `https://dev.nuclide.systems` | `192.168.1.42:7080` | Coder |
| `https://git.nuclide.systems` | `192.168.1.42:3000` | Gitea |
| `https://arcane.nuclide.systems` | `192.168.1.40:10002` | Arcane |
| `https://dozzle.nuclide.systems` | `192.168.1.40:10001` | Dozzle (logs) |
| `https://gotify.nuclide.systems` | `192.168.1.40:10003` | Gotify |
| `https://s3.nuclide.systems` | `192.168.1.40:10004` | Garage S3 |
| `https://vault.nuclide.systems` | `192.168.1.40:11001` | Vaultwarden |
| `https://immich.nuclide.systems` | `192.168.1.40:12000` | Immich |
| `https://immich-tools.nuclide.systems` | `192.168.1.40` (internal) | Immich Power Tools |
| `https://abs.nuclide.systems` | `192.168.1.40:13003` | Audiobookshelf |
| `https://n8n.nuclide.systems` | `192.168.1.40:16000` | n8n |
| `https://memos.nuclide.systems` | `192.168.1.40:17000` | Memos |
| `https://hoarder.nuclide.systems` | `192.168.1.40:17001` | Karakeep |
| `https://traccar.nuclide.systems` | `192.168.1.40:15000` | Traccar |
| `https://paperless.nuclide.systems` | `192.168.1.40:15003` | Paperless-ngx (internal-only policy) |
| `https://paperless-ai.nuclide.systems` | `192.168.1.40:15002` | Paperless AI (internal-only policy) |
**Not publicly proxied** (LAN/localhost only): pgAdmin, ComfyUI, Qdrant, RDTClient, Prowlarr, ShelfArr, Flaresolverr, Speaches, AdGuard admin, Backrest UI, Infisical.
---
## SSH cheat-sheet
```bash
ssh root@192.168.1.20 # PVE host (nuc)
ssh root@192.168.1.40 # CT 104 docker
ssh root@192.168.1.41 # CT 105 nextcloud
ssh root@192.168.1.42 # CT 111 dev
ssh root@192.168.1.49 # CT 101 shepard
ssh root@192.168.1.2 # CT 102 dns (AdGuard)
ssh root@192.168.1.3 # CT 103 backrest
ssh root@192.168.1.4 # CT 108 zoraxy
ssh root@192.168.1.5 # CT 110 id (Pocket-ID)
ssh root@192.168.1.6 # CT 113 db (Postgres)
ssh root@192.168.1.7 # CT 112 secrets (Infisical)
ssh root@192.168.1.60 # VM 100 haos (Home Assistant — key must be installed manually)
ssh -p 222 git@git.nuclide.systems # Gitea SSH
```
All LXCs reachable from `nuc` host via root key. Use `pct exec <id> -- bash` for console access without SSH.
Reference in New Issue View Git Blame Copy Permalink