jgitta/homelab-configs
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: major update — Caddy section, correct ports, volume path warning, remove grav (2026-05-07)

Browse Source
This commit is contained in:
Jozsef Gtta
2026-05-07 13:18:30 +00:00
parent 8ef48fc8f4
commit 748f3cafc6
1 changed files with 77 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+77 -48
View File
@@ -14,6 +14,11 @@ All stacks are managed via **Portainer** at http://192.168.88.27:9000 (or https:
> **Note:** The API token above is for automation/scripting. Keep it private.
> To call the Portainer API: `curl -H "X-API-Key: <token>" http://192.168.88.27:9000/api/stacks`
> **Important — Volume Paths:** All volume mounts in Portainer stacks **must use absolute paths**
> (e.g. `/srv/docker/myapp/data:/app/data`). Relative paths (e.g. `./data`) resolve to
> Portainer's internal `/data/compose/<id>/` directory and will lose data if the stack is
> redeployed with a different ID. This was audited and corrected on 2026-05-07.
## Hosts
| Host | IP | Role | Portainer Endpoint ID | Docker Version |
@@ -24,31 +29,30 @@ All stacks are managed via **Portainer** at http://192.168.88.27:9000 (or https:
## Stack Inventory
### siklos (192.168.88.27) — 21 stacks
### siklos (192.168.88.27) — 20 stacks
| Stack | Port(s) | Data Path | Notes |
|---|---|---|---|
| actual-budget | 5006 | /srv/docker/actual-budget | Budget tracking |
| dashboard | 3010 | /srv/docker/dashboard | Custom homepage (built locally) |
| dashy | 4080 | /srv/docker/dashy | Dashboard |
| gitea | 3002, 2222 | /srv/docker/gitea/data | Git server — this repo |
| glances | 61208 | — | System monitoring |
| goldengames | 3011 | /srv/docker/goldengames | (built locally) |
| grav | 8080 | /srv/docker/grav | CMS |
| guacamole | 8085 | /srv/docker/guacamole | Remote desktop gateway |
| homarr | 7575 | /srv/docker/homarr | Dashboard |
| karakeep | 3000 | /srv/docker/karakeep | Bookmarks / read-later |
| kopia | 51515 | /srv/docker/kopia | Backup tool (backs up to TrueNAS) |
| linkwarden | 3010 | /srv/docker/linkwarden | Link manager |
| litellm | 4000 | /srv/docker/litellm | LLM API gateway |
| meshcentral | 4430, 4080 | /srv/docker/meshcentral | Remote management |
| monitoring | 9090, 3020, 8090, 9108-9109 | /srv/docker/monitoring | Prometheus + Grafana + cAdvisor |
| onlyoffice | 8086 | /srv/docker/onlyoffice | Office document server |
| pihole | 53, 80, 443 | /srv/docker/pihole | DNS ad blocker |
| portainer | 9000, 9443 | /srv/docker/portainer | Container management UI |
| uptime-kuma | 3001 | /srv/docker/uptime-kuma | Uptime monitoring |
| watchtower | — | — | Auto-updates containers |
| wordpress | 8081 | /srv/docker/wordpress | WordPress site |
| Stack | Port(s) | Data Path | URL | Notes |
|---|---|---|---|---|
| actual-budget | 5006 | /srv/docker/actual-budget | budget.jgitta.com | Budget tracking |
| dashboard | 8096 | /srv/docker/dashboard | dashboard.jgitta.com | Custom homepage |
| dashy | 8081 | /srv/docker/dashy | dashy.jgitta.com | Dashboard |
| gitea | 3002, 2222 | /srv/docker/gitea/data | gitea.jgitta.com | Git server — this repo |
| glances | 61208 | — | glances.jgitta.com | System monitoring |
| goldengames | 3030 | /srv/docker/goldengames | goldengamer.org | (built locally) |
| guacamole | 8080 | /srv/docker/guacamole | apache.jgitta.com | Apache Guacamole — remote desktop gateway |
| homarr | 7575 | /srv/docker/homarr/.homarr/appdata | homarr.jgitta.com | Dashboard |
| karakeep | 3010 | /srv/docker/karakeep | notes.jgitta.com | Bookmarks / read-later |
| kopia | 51515 | /srv/docker/kopia | kopia.jgitta.com | Backup tool (backs up to TrueNAS) |
| linkwarden | 3015 | /srv/docker/linkwarden/pgdata | links.jgitta.com | Link manager |
| litellm | 4000 | /srv/docker/litellm | — | LLM API gateway |
| meshcentral | 444 | /srv/docker/meshcentral | mesh.jgitta.com | Remote management |
| monitoring | 9090, 3020, 8090 | /srv/docker/monitoring | grafana.jgitta.com | Prometheus + Grafana + cAdvisor |
| onlyoffice | 8880 | /srv/docker/onlyoffice | office.jgitta.com | Office document server (replaced Collabora) |
| pihole | host network | /srv/docker/pihole | pihole.jgitta.com | DNS ad blocker + faster-whisper + open-webui |
| portainer | 9000, 9443 | /srv/docker/portainer | portainer.jgitta.com | Container management UI |
| uptime-kuma | 3001 | /srv/docker/uptime-kuma/data | status.jgitta.com | Uptime monitoring |
| watchtower | — | — | — | Auto-updates containers |
| wordpress | 8095 | /srv/docker/wordpress | jgitta.com | WordPress site |
### jellyfin (192.168.88.10) — 3 stacks
@@ -65,23 +69,55 @@ All stacks are managed via **Portainer** at http://192.168.88.27:9000 (or https:
| frigate | 5000, 8554, 8555 | /srv/docker/frigate | NVR / camera AI |
| open-webui | 3000 | /srv/docker/open-webui | Ollama web UI |
| portainer-agent | 9001 | — | Portainer agent (shows "limited" — expected, see notes) |
| stirling-pdf | 8090 | /srv/docker/stirling-pdf | PDF tools |
| stirling-pdf | 8081 | /srv/docker/stirling-pdf | PDF tools |
## Caddy Reverse Proxy
Caddy runs on a dedicated VM at **192.168.88.110** (alias: `caddy`) as a systemd service.
It handles all HTTPS termination and reverse proxying for `*.jgitta.com` subdomains.
TLS certificates are obtained automatically via **Cloudflare DNS challenge** (Let's Encrypt).
Config location: `/etc/caddy/` on the caddy VM.
### File Structure
| File | Purpose |
|---|---|
| `Caddyfile` | Main file — sets global options, imports snippets and sites |
| `snippets.caddy` | Reusable blocks: `web_secure`, `internal_only`, `proxy_timeouts`, etc. |
| `sites/infrastructure.caddy` | Management/tool services (portainer, kopia, grafana, pihole, etc.) |
| `sites/media.caddy` | Media and automation stack (jellyfin, sonarr, radarr, next, etc.) |
| `sites/homenet.caddy` | Internal `.homenet` HTTP-only domains (no TLS) |
| `sites/goldengamer.caddy` | goldengamer.org external domain |
### Key Snippets
- **`internal_only`** — Blocks requests from outside `192.168.88.0/24` and `192.168.2.0/24` via `abort`. Used on sensitive services (portainer, pihole, proxmox, etc.).
- **`web_secure`** — Standard security headers + gzip compression.
- **`proxy_timeouts`** — 90s read/write timeouts on upstream connections.
### DNS Notes
- Internal services use **MikroTik DNS** (`192.168.88.1`) to resolve `*.jgitta.com` → `192.168.88.110`.
- Browsers with **DNS-over-HTTPS (DoH)** enabled (e.g. Brave) bypass MikroTik DNS and use public resolvers, which have no record of internal-only subdomains. Disable DoH in browser settings or ensure Cloudflare DNS has grey-cloud records pointing to the WAN IP for all subdomains.
- Public-facing services use **Cloudflare DNS** (grey cloud) → WAN IP → MikroTik port-forwards 443 → Caddy VM.
- `internal_only` services should use grey-cloud Cloudflare records (not orange/proxied) — orange cloud sends traffic from Cloudflare's IPs which `internal_only` will abort, causing a 520 error.
## Data Directory Convention
All stack data and config is stored under `/srv/docker/<stack-name>/` on each host.
All stack data is stored under `/srv/docker/<stack-name>/` on each host.
**All Portainer volume mounts must use absolute paths** — relative paths break on stack redeploy.
Old compose files were renamed to `.bak` after migration to Portainer.
### siklos
- Config/data: `/srv/docker/<stack>/`
- Old compose files renamed to `.bak` in same directory
## Kopia Backup Notes (updated 2026-05-07)
### thinkstation-p710
- Config/data: `/srv/docker/<stack>/`
- Portainer agent data volume: `portainer_agent_data` (Docker named volume — persists TLS certs)
### jellyfin
- Media data: `/srv/docker/` (bind-mounted into arr containers)
Kopia backs up Nextcloud data (VM 103) and other sources to TrueNAS NFS.
- Cache limit set to 4 GB content + 512 MB metadata (`kopia cache set`)
- `/tmp` and `/app/logs` are bind-mounted out of the container to prevent overlay2 growth
- After-snapshot hook pings Uptime Kuma heartbeat at `status.jgitta.com` after each backup
- If disk fills up again, check `/srv/docker/kopia/tmp/` for leftover verify/restore artifacts
- Ignore policy active for `/data/.claude` in the Nextcloud data source
## Portainer Agent Notes
@@ -93,21 +129,14 @@ siklos to manage all three Docker hosts from one UI.
The portainer-agent cannot redeploy itself through its own proxy (catch-22). The agent
is stable and the endpoint is fully functional. Agent data is persisted in the
`portainer_agent_data` Docker named volume so TLS certs survive restarts.
Compose file: `/srv/docker/portainer-agent/docker-compose.yml`
## Kopia Backup Notes (2026-05-06)
Kopia backs up Nextcloud data (VM 103) and other sources to TrueNAS NFS.
- Cache limit set to 4 GB content + 512 MB metadata (`kopia cache set`)
- `/tmp` and `/app/logs` are now bind-mounted out of the container (prevents overlay2 growth)
- If disk fills up again, check `/srv/docker/kopia/tmp/` for leftover verify/restore artifacts
- Ignore policy added for `/data/.claude` in the Nextcloud data source
## Proxmox / Infrastructure Notes
| Item | Details |
|---|---|
| Proxmox host | 192.168.88.1 |
| TrueNAS | 192.168.88.5 |
| Nextcloud VM | VM 103 (192.168.88.x) |
| Docker server VM | VM 112 = siklos |
| Proxmox host | 192.168.88.25 |
| PBS | 192.168.88.60 |
| TrueNAS | 192.168.88.24 |
| Nextcloud VM | VM 103 (192.168.88.62) |
| Docker server VM | VM 112 = siklos (192.168.88.27) |
| Caddy proxy VM | 192.168.88.110 |