123 lines
6.9 KiB
Markdown
123 lines
6.9 KiB
Markdown
# Siklos Docker Services — Project Knowledge
|
|
|
|
## Host
|
|
- **VM112 / siklos / docker-server**
|
|
- IP: `192.168.88.27`
|
|
- Specs: 4c/12GB RAM
|
|
- SSH: `jgitta@192.168.88.27` (via Proxmox host jump)
|
|
- Docker compose files: `/srv/docker/<service>/docker-compose.yml`
|
|
- Note: `vm.swappiness=10` set in `/etc/sysctl.conf` (April 2026)
|
|
|
|
## Running Containers (verified 2026-06-18)
|
|
|
|
| Container | Image | Port(s) | Compose Path |
|
|
|---|---|---|---|
|
|
| portainer | portainer/portainer-ce:latest | 9000, 9443 | /srv/docker/portainer/ |
|
|
| pihole | pihole/pihole:latest | 53, 8080 | /srv/docker/pihole/ |
|
|
| open-webui | ghcr.io/open-webui/open-webui:main | 3000 | /srv/docker/open-webui/ |
|
|
| onlyoffice | onlyoffice/documentserver | 8880 | /srv/docker/media/ |
|
|
| homarr | homarr:latest | 7575 | /srv/docker/homarr/ |
|
|
| uptime-kuma | uptime-kuma:2 | 3001 | /srv/docker/uptime-kuma/ |
|
|
| beszel | henrygd/beszel:latest | 8085 | /srv/docker/beszel/ |
|
|
| beszel-agent | henrygd/beszel-agent:latest | host (unix socket) | /srv/docker/beszel/ |
|
|
| glances | nicolargo/glances:latest | 61208 | /srv/docker/glances/ |
|
|
| meshcentral | typhonragewind/meshcentral:latest | 444 | /srv/docker/meshcentral/ |
|
|
| guacamole | jwetzell/guacamole | 8383 | /srv/docker/guacamole/ |
|
|
| karakeep-web-1 | karakeep:release | 3010 | /srv/docker/karakeep/ |
|
|
| karakeep-meilisearch-1 | meilisearch:v1.13.3 | 7700 (internal) | /srv/docker/karakeep/ |
|
|
| karakeep-chrome-1 | alpine-chrome:124 | — | /srv/docker/karakeep/ |
|
|
| linkwarden-linkwarden-1 | linkwarden:latest | 3015 | /srv/docker/linkwarden/ |
|
|
| linkwarden-postgres-1 | postgres:16-alpine | 5432 | /srv/docker/linkwarden/ |
|
|
| wordpress | wordpress:php8.3-apache | 8095 | /srv/docker/wordpress/ |
|
|
| wordpress-db | mariadb:10.11 | 3306 (internal) | /srv/docker/wordpress/ |
|
|
| dashy | lissy93/dashy:latest | 8081 | /srv/docker/dashy/ |
|
|
| dashboard | dashboard-dashboard | 8096 | /srv/docker/dashboard/ |
|
|
| grav | linuxserver/grav:latest | 8585 | /srv/docker/grav/ |
|
|
| watchtower | containrrr/watchtower | — | /srv/docker/watchtower/ |
|
|
|
|
## Open WebUI
|
|
- URL: `https://ai.jgitta.com`
|
|
- Port: 3000
|
|
- Compose: `/srv/docker/open-webui/docker-compose.yml`
|
|
- Connects to Ollama backend running on ThinkStation (192.168.88.41, no external port)
|
|
|
|
## Photo Management
|
|
- **Immich** runs on VM113 (photos, 192.168.88.32) — migrated from siklos in April 2026
|
|
- **PhotoPrism** was removed from siklos in June 2026 — Immich chosen as the single photo management solution
|
|
|
|
## Pi-hole
|
|
- Port: 53 (DNS), 8080 (web UI)
|
|
- URL: `https://pihole.jgitta.com`
|
|
- **Network mode: `host`** (no docker-proxy — eliminates the port-53 freeze bug)
|
|
- Config: `listeningMode = "ALL"` in pihole.toml
|
|
- **Upstream DNS: `192.168.88.1` only** (MikroTik) — MikroTik resolves local jgitta.com domains and forwards everything else to 1.1.1.1/8.8.8.8. Do NOT add 1.1.1.1 directly as a Pi-hole upstream — dnsmasq load-balances across all upstreams, which would cause local domains to sometimes resolve to the WAN IP instead of internal Caddy IP.
|
|
- FTL DB: `/etc/pihole/pihole-FTL.db`
|
|
- Rate limit: 300 concurrent queries
|
|
- Excluded from Watchtower auto-updates
|
|
- Pi-hole v6
|
|
- **Watchdog**: native cron on Siklos at `*/5 * * * *` → `/usr/local/bin/pihole-watchdog.sh` (restarts if DNS fails); Claude scheduled task is a secondary layer
|
|
- Uptime Kuma DNS monitor uses `192.168.88.27` (host IP, not Docker internal)
|
|
|
|
## Monitoring Stack — Beszel (migrated 2026-06-18)
|
|
|
|
Replaced Prometheus + Grafana + cAdvisor + node_exporter with **Beszel** — a lightweight all-in-one monitoring tool.
|
|
|
|
- **Hub**: Docker container on siklos, port 8085 → `https://beszel.jgitta.com`
|
|
- **Compose**: `/srv/docker/beszel/docker-compose.yml`
|
|
- **Architecture**: Hub communicates with agents over SSH (port 45876). On siklos the agent uses a unix socket (`/srv/docker/beszel/beszel_socket/beszel.sock`) to avoid Docker network isolation issues.
|
|
- **Agent deployment**: Binary + systemd service (`beszel-agent.service`) on each remote host. Install script: `curl -sL https://get.beszel.dev/agent | bash`
|
|
- **Universal token**: Used to auto-register agents — stored in PocketBase `universal_tokens` collection
|
|
- **Agents installed on**: siklos (.27), jellyfin (.10), thinkstation (.41), proxmox jg-hud (.25), PBS (.60), caddy (.110), photos VM113 (.32), OCIS VM114 (.63)
|
|
- **Alerts configured** (via PocketBase API, regular user token required — not superuser):
|
|
- `Status` — host goes down
|
|
- `CPU` — >90%
|
|
- `Memory` — >90%
|
|
- `Disk` — >85%
|
|
- **Notifications**: Telegram bot `8758434542:AAEW6omM7twyInsb2INuy6mD1w2EWXHqmzE`, chat `8260387200`
|
|
- **Uptime Kuma**: port 3001 (`status.jgitta.com`), joined to `pihole_default` network — handles HTTP/port/DNS uptime checks (separate from Beszel resource monitoring)
|
|
|
|
## OnlyOffice
|
|
- URL: `https://office.jgitta.com`
|
|
- Port: 8880 (all interfaces)
|
|
- Compose: `/srv/docker/media/docker-compose.yml`
|
|
- Replaces Collabora (`richdocuments` app is disabled in Nextcloud; `onlyoffice` app is enabled)
|
|
- JWT secret (must match Nextcloud config): `4f2b0c719af2de99befacfec9ca5e8373cbdeb76`
|
|
- Nextcloud `occ` settings (set on VM103/next):
|
|
- `DocumentServerUrl` = `https://office.jgitta.com/`
|
|
- `DocumentServerInternalUrl` = `http://192.168.88.27:8880/`
|
|
- `StorageUrl` = `https://next.jgitta.com/`
|
|
- `jwt_secret` = (matches container `local.json` above)
|
|
- `jwt_header` = `Authorization`
|
|
- To reconfigure after container recreation: re-run `occ config:app:set onlyoffice jwt_secret --value="<secret from local.json>"`
|
|
- Container JWT secret location: `/etc/onlyoffice/documentserver/local.json` → `.services.CoAuthoring.secret.inbox.string`
|
|
|
|
## Key Notes
|
|
- Watchtower excludes Pi-hole from auto-updates
|
|
- OnlyOffice replaced Collabora (lighter RAM usage)
|
|
- RAM reduced from 16GB → 12GB (April 2026, live via Proxmox balloon driver, no reboot) — freed further in June 2026 when PhotoPrism was removed
|
|
- `vm.swappiness=10` set to reduce swap pressure
|
|
- NFS mount `/mnt/immich-photos` (from VM113 192.168.88.32) is in fstab — read-only access to Immich photo storage
|
|
|
|
## Portainer Setup (April 2026)
|
|
|
|
Portainer CE manages Docker across three hosts from a single UI.
|
|
|
|
**Server (web UI):**
|
|
- URL: `http://192.168.88.27:9000` or `https://192.168.88.27:9443`
|
|
- Future URL (once Caddy SSH fixed): `https://portainer.jgitta.com`
|
|
- Compose: `/srv/docker/portainer/docker-compose.yml`
|
|
|
|
**Agents (managed remote environments):**
|
|
| Host | IP | Agent Port | Compose Path |
|
|
|---|---|---|---|
|
|
| jellyfin | 192.168.88.10 | 9001 | /srv/docker/portainer-agent/ |
|
|
| thinkstation | 192.168.88.41 | 9001 | /srv/docker/portainer-agent/ |
|
|
|
|
**Adding agents in Portainer UI (first-time setup):**
|
|
1. Open Portainer at `http://192.168.88.27:9000` and create your admin account
|
|
2. Go to **Environments → Add environment → Agent**
|
|
3. For jellyfin: name `jellyfin`, URL `192.168.88.10:9001`
|
|
4. For thinkstation: name `thinkstation`, URL `192.168.88.41:9001`
|
|
|
|
**Caddy config:** Entry for `portainer.jgitta.com` is ready in workspace Caddyfile — needs deploying once Caddy VM SSH access is restored.
|