jackos1998
d51f2d62b6
Add a top-level README mapping the boxes and a full docs/ tree: topic pages (architecture, networking, deployment), per-site box pages for colony and home with containers nested under their hosts, remote and mobile boxes, the installer, and the home switch fabric reference (folded in from home-switches.md, with AGENTS.md and code comments retargeted to its new home). Box pages carry marked assignment tables that CI regenerates from nixos.allAssignments. AGENTS.md points at the new docs and keeps its terse agent version of the mechanics, referring to the topic pages for depth.
2.3 KiB
2.3 KiB
kelder-spoder
The web container for the kelder site: Nextcloud plus an nginx (OpenResty) reverse proxy for the site's services.
- Source:
nixos/boxes/kelder/containers/spoder/ - Host: NixOS container on
kelder
Role
- Nextcloud (
nextcloud32) atcloud.hentai.engineer(trusted aliascloud-local.hentai.engineer), SQLite backend, data in/mnt/storage/nextcloud(/mnt/storageis bind-mounted from the host). - nginx reverse proxy (
openresty) terminating TLS for the site's public vhosts, with a wildcard ACME cert forhentai.engineervia Cloudflare DNS. The kelder host forwardshttp/httpsto this container; uploads are unlimited (clientMaxBodySize = 0) for Nextcloud's sake.
Network assignments
| Name | Assignment | IPv4 | IPv6 | Domain | Notes |
|---|---|---|---|---|---|
| spoder-ctr | internal | 172.16.64.3/24 gw 172.16.64.1 |
— | hentai.engineer |
Proxy vhosts
All under hentai.engineer, each with a *-local alias:
| vhost | Target | Auth |
|---|---|---|
monitor |
netdata on the kelder host (:19999) |
htpasswd |
kontent |
Jellyfin on kelder-acquisition (:8096, incl. websocket) |
— |
torrents |
Transmission on kelder-acquisition (:9091) |
htpasswd |
jackett |
Jackett on kelder-acquisition (:9117) |
htpasswd |
radarr |
Radarr on kelder-acquisition (:7878) |
htpasswd |
sonarr |
Sonarr on kelder-acquisition (:8989) |
htpasswd |
cloud |
Nextcloud (local) | — |
An init_worker_by_lua timer polls v4.ident.me every 5 minutes to track the site's public
IP; it feeds localRedirect rewrites (bounce public-IP clients to the *-local name) that
are currently disabled (commented out — Virgin Media filters DNS answers containing local
IPs, so the split doesn't work as intended).
Networking
internalassignment (namespoder-ctr) on the host'sctrsbridge, MTU 1420.
Notable config files
nixos/boxes/kelder/containers/spoder/default.nix— Nextcloud + ACME.nixos/boxes/kelder/containers/spoder/nginx.nix— reverse proxy vhosts.