jackos1998
d51f2d62b6
Add a top-level README mapping the boxes and a full docs/ tree: topic pages (architecture, networking, deployment), per-site box pages for colony and home with containers nested under their hosts, remote and mobile boxes, the installer, and the home switch fabric reference (folded in from home-switches.md, with AGENTS.md and code comments retargeted to its new home). Box pages carry marked assignment tables that CI regenerates from nixos.allAssignments. AGENTS.md points at the new docs and keeps its terse agent version of the mechanics, referring to the topic pages for depth.
55 lines
2.3 KiB
Markdown
55 lines
2.3 KiB
Markdown
# kelder-spoder
|
|
|
|
The web container for the kelder site: Nextcloud plus an nginx (OpenResty) reverse proxy for
|
|
the site's services.
|
|
|
|
- **Source:** [`nixos/boxes/kelder/containers/spoder/`](../../nixos/boxes/kelder/containers/spoder)
|
|
- **Host:** NixOS container on [`kelder`](kelder.md)
|
|
|
|
## Role
|
|
|
|
- **Nextcloud** (`nextcloud32`) at `cloud.hentai.engineer` (trusted alias
|
|
`cloud-local.hentai.engineer`), SQLite backend, data in `/mnt/storage/nextcloud`
|
|
(`/mnt/storage` is bind-mounted from the host).
|
|
- **nginx reverse proxy** (`openresty`) terminating TLS for the site's public vhosts, with a
|
|
wildcard ACME cert for `hentai.engineer` via Cloudflare DNS. The kelder host forwards
|
|
`http`/`https` to this container; uploads are unlimited (`clientMaxBodySize = 0`) for
|
|
Nextcloud's sake.
|
|
|
|
## Network assignments
|
|
|
|
<!-- assignments: kelder-spoder -->
|
|
<!-- assignments-start -->
|
|
| Name | Assignment | IPv4 | IPv6 | Domain | Notes |
|
|
|---|---|---|---|---|---|
|
|
| spoder-ctr | internal | `172.16.64.3/24 gw 172.16.64.1` | — | hentai.engineer | |
|
|
<!-- assignments-end -->
|
|
|
|
## Proxy vhosts
|
|
|
|
All under `hentai.engineer`, each with a `*-local` alias:
|
|
|
|
| vhost | Target | Auth |
|
|
| --- | --- | --- |
|
|
| `monitor` | `netdata` on the kelder host (:19999) | `htpasswd` |
|
|
| `kontent` | Jellyfin on `kelder-acquisition` (:8096, incl. websocket) | — |
|
|
| `torrents` | Transmission on `kelder-acquisition` (:9091) | `htpasswd` |
|
|
| `jackett` | Jackett on `kelder-acquisition` (:9117) | `htpasswd` |
|
|
| `radarr` | Radarr on `kelder-acquisition` (:7878) | `htpasswd` |
|
|
| `sonarr` | Sonarr on `kelder-acquisition` (:8989) | `htpasswd` |
|
|
| `cloud` | Nextcloud (local) | — |
|
|
|
|
An `init_worker_by_lua` timer polls `v4.ident.me` every 5 minutes to track the site's public
|
|
IP; it feeds `localRedirect` rewrites (bounce public-IP clients to the `*-local` name) that
|
|
are currently **disabled** (commented out — Virgin Media filters DNS answers containing local
|
|
IPs, so the split doesn't work as intended).
|
|
|
|
## Networking
|
|
|
|
- `internal` assignment (name `spoder-ctr`) on the host's `ctrs` bridge, MTU 1420.
|
|
|
|
## Notable config files
|
|
|
|
- [`nixos/boxes/kelder/containers/spoder/default.nix`](../../nixos/boxes/kelder/containers/spoder/default.nix) — Nextcloud + ACME.
|
|
- [`nixos/boxes/kelder/containers/spoder/nginx.nix`](../../nixos/boxes/kelder/containers/spoder/nginx.nix) — reverse proxy vhosts.
|