Siklos Docker Services — Project Knowledge

Host

Container	Image	Port(s)	Compose Path
portainer	portainer/portainer-ce:latest	9000, 9443	/srv/docker/portainer/
pihole	pihole/pihole:latest	53, 8080	/srv/docker/pihole/
open-webui	ghcr.io/open-webui/open-webui:main	3000	/srv/docker/open-webui/
onlyoffice	onlyoffice/documentserver	8880	/srv/docker/media/
homarr	homarr:latest	7575	/srv/docker/homarr/
uptime-kuma	uptime-kuma:2	3001	/srv/docker/uptime-kuma/
beszel	henrygd/beszel:latest	8085	/srv/docker/beszel/
beszel-agent	henrygd/beszel-agent:latest	host (unix socket)	/srv/docker/beszel/
glances	nicolargo/glances:latest	61208	/srv/docker/glances/
meshcentral	typhonragewind/meshcentral:latest	444	/srv/docker/meshcentral/
guacamole	jwetzell/guacamole	8383	/srv/docker/guacamole/
karakeep-web-1	karakeep:release	3010	/srv/docker/karakeep/
karakeep-meilisearch-1	meilisearch:v1.13.3	7700 (internal)	/srv/docker/karakeep/
karakeep-chrome-1	alpine-chrome:124	—	/srv/docker/karakeep/
linkwarden-linkwarden-1	linkwarden:latest	3015	/srv/docker/linkwarden/
linkwarden-postgres-1	postgres:16-alpine	5432	/srv/docker/linkwarden/
wordpress	wordpress:php8.3-apache	8095	/srv/docker/wordpress/
wordpress-db	mariadb:10.11	3306 (internal)	/srv/docker/wordpress/
dashy	lissy93/dashy:latest	8081	/srv/docker/dashy/
dashboard	dashboard-dashboard	8096	/srv/docker/dashboard/
grav	linuxserver/grav:latest	8585	/srv/docker/grav/
watchtower	containrrr/watchtower	—	/srv/docker/watchtower/

Immich runs on VM113 (photos, 192.168.88.32) — migrated from siklos in April 2026
PhotoPrism was removed from siklos in June 2026 — Immich chosen as the single photo management solution

Port: 53 (DNS), 8080 (web UI)
URL: https://pihole.jgitta.com
Network mode: host (no docker-proxy — eliminates the port-53 freeze bug)
Config: listeningMode = "ALL" in pihole.toml
Upstream DNS: 192.168.88.1 only (MikroTik) — MikroTik resolves local jgitta.com domains and forwards everything else to 1.1.1.1/8.8.8.8. Do NOT add 1.1.1.1 directly as a Pi-hole upstream — dnsmasq load-balances across all upstreams, which would cause local domains to sometimes resolve to the WAN IP instead of internal Caddy IP.
FTL DB: /etc/pihole/pihole-FTL.db
Rate limit: 300 concurrent queries
Excluded from Watchtower auto-updates
Pi-hole v6
Watchdog: native cron on Siklos at */5 * * * * → /usr/local/bin/pihole-watchdog.sh (restarts if DNS fails); Claude scheduled task is a secondary layer
Uptime Kuma DNS monitor uses 192.168.88.27 (host IP, not Docker internal)

Replaced Prometheus + Grafana + cAdvisor + node_exporter with Beszel — a lightweight all-in-one monitoring tool.

Hub: Docker container on siklos, port 8085 → https://beszel.jgitta.com
Compose: /srv/docker/beszel/docker-compose.yml
Architecture: Hub communicates with agents over SSH (port 45876). On siklos the agent uses a unix socket (/srv/docker/beszel/beszel_socket/beszel.sock) to avoid Docker network isolation issues.
Agent deployment: Binary + systemd service (beszel-agent.service) on each remote host. Install script: curl -sL https://get.beszel.dev/agent | bash
Universal token: Used to auto-register agents — stored in PocketBase universal_tokens collection
Agents installed on: siklos (.27), jellyfin (.10), jgpc (.41), proxmox jg-hud (.25), PBS (.60), caddy (.110), photos VM113 (.32), OCIS VM114 (.63)
Alerts configured (via PocketBase API, regular user token required — not superuser):
- Status — host goes down
- CPU — >90%
- Memory — >90%
- Disk — >85%
Notifications: Telegram bot 8758434542:AAEW6omM7twyInsb2INuy6mD1w2EWXHqmzE, chat 8260387200
Uptime Kuma: port 3001 (status.jgitta.com), joined to pihole_default network — handles HTTP/port/DNS uptime checks (separate from Beszel resource monitoring)

URL: https://office.jgitta.com
Port: 8880 (all interfaces)
Compose: /srv/docker/media/docker-compose.yml
Replaces Collabora (richdocuments app is disabled in Nextcloud; onlyoffice app is enabled)
JWT secret (must match Nextcloud config): 4f2b0c719af2de99befacfec9ca5e8373cbdeb76
Nextcloud occ settings (set on VM103/next):
- DocumentServerUrl = https://office.jgitta.com/
- DocumentServerInternalUrl = http://192.168.88.27:8880/
- StorageUrl = https://next.jgitta.com/
- jwt_secret = (matches container local.json above)
- jwt_header = Authorization
To reconfigure after container recreation: re-run occ config:app:set onlyoffice jwt_secret --value="<secret from local.json>"
Container JWT secret location: /etc/onlyoffice/documentserver/local.json → .services.CoAuthoring.secret.inbox.string

Watchtower excludes Pi-hole from auto-updates
OnlyOffice replaced Collabora (lighter RAM usage)
RAM reduced from 16GB → 12GB (April 2026, live via Proxmox balloon driver, no reboot) — freed further in June 2026 when PhotoPrism was removed
vm.swappiness=10 set to reduce swap pressure
NFS mount /mnt/immich-photos (from VM113 192.168.88.32) is in fstab — read-only access to Immich photo storage

Portainer CE manages Docker across three hosts from a single UI.

Server (web UI):

Agents (managed remote environments):

Host	IP	Agent Port	Compose Path
jellyfin	192.168.88.10	9001	/srv/docker/portainer-agent/
jgpc	192.168.88.41	9001	/srv/docker/portainer-agent/

Adding agents in Portainer UI (first-time setup):

Caddy config: Entry for portainer.jgitta.com is ready in workspace Caddyfile — needs deploying once Caddy VM SSH access is restored.