homelab-configs/siklos-docker-services.md

# Siklos Docker Services — Project Knowledge

## Host
- **VM112 / siklos / docker-server**
- IP: `192.168.88.27`
- Specs: 4c/12GB RAM
- SSH: `jgitta@192.168.88.27` (via Proxmox host jump)
- Docker compose files: `/srv/docker/<service>/docker-compose.yml`
- Note: `vm.swappiness=10` set in `/etc/sysctl.conf` (April 2026)

## Running Containers (verified 2026-06-18)

| Container | Image | Port(s) | Compose Path |
|---|---|---|---|
| portainer | portainer/portainer-ce:latest | 9000, 9443 | /srv/docker/portainer/ |
| pihole | pihole/pihole:latest | 53, 8080 | /srv/docker/pihole/ |
| open-webui | ghcr.io/open-webui/open-webui:main | 3000 | /srv/docker/open-webui/ |
| onlyoffice | onlyoffice/documentserver | 8880 | /srv/docker/media/ |
| homarr | homarr:latest | 7575 | /srv/docker/homarr/ |
| uptime-kuma | uptime-kuma:2 | 3001 | /srv/docker/uptime-kuma/ |
| beszel | henrygd/beszel:latest | 8085 | /srv/docker/beszel/ |
| beszel-agent | henrygd/beszel-agent:latest | host (unix socket) | /srv/docker/beszel/ |
| glances | nicolargo/glances:latest | 61208 | /srv/docker/glances/ |
| meshcentral | typhonragewind/meshcentral:latest | 444 | /srv/docker/meshcentral/ |
| guacamole | jwetzell/guacamole | 8383 | /srv/docker/guacamole/ |
| karakeep-web-1 | karakeep:release | 3010 | /srv/docker/karakeep/ |
| karakeep-meilisearch-1 | meilisearch:v1.13.3 | 7700 (internal) | /srv/docker/karakeep/ |
| karakeep-chrome-1 | alpine-chrome:124 | — | /srv/docker/karakeep/ |
| linkwarden-linkwarden-1 | linkwarden:latest | 3015 | /srv/docker/linkwarden/ |
| linkwarden-postgres-1 | postgres:16-alpine | 5432 | /srv/docker/linkwarden/ |
| wordpress | wordpress:php8.3-apache | 8095 | /srv/docker/wordpress/ |
| wordpress-db | mariadb:10.11 | 3306 (internal) | /srv/docker/wordpress/ |
| dashy | lissy93/dashy:latest | 8081 | /srv/docker/dashy/ |
| dashboard | dashboard-dashboard | 8096 | /srv/docker/dashboard/ |
| grav | linuxserver/grav:latest | 8585 | /srv/docker/grav/ |
| watchtower | containrrr/watchtower | — | /srv/docker/watchtower/ |

## Open WebUI
- URL: `https://ai.jgitta.com`
- Port: 3000
- Compose: `/srv/docker/open-webui/docker-compose.yml`
- Connects to Ollama backend running on jgpc (192.168.88.41, no external port)

## Photo Management
- **Immich** runs on VM113 (photos, 192.168.88.32) — migrated from siklos in April 2026
- **PhotoPrism** was removed from siklos in June 2026 — Immich chosen as the single photo management solution

## Pi-hole
- Port: 53 (DNS), 8080 (web UI)
- URL: `https://pihole.jgitta.com`
- **Network mode: `host`** (no docker-proxy — eliminates the port-53 freeze bug)
- Config: `listeningMode = "ALL"` in pihole.toml
- **Upstream DNS: `192.168.88.1` only** (MikroTik) — MikroTik resolves local jgitta.com domains and forwards everything else to 1.1.1.1/8.8.8.8. Do NOT add 1.1.1.1 directly as a Pi-hole upstream — dnsmasq load-balances across all upstreams, which would cause local domains to sometimes resolve to the WAN IP instead of internal Caddy IP.
- FTL DB: `/etc/pihole/pihole-FTL.db`
- Rate limit: 300 concurrent queries
- Excluded from Watchtower auto-updates
- Pi-hole v6
- **Watchdog**: native cron on Siklos at `*/5 * * * *` → `/usr/local/bin/pihole-watchdog.sh` (restarts if DNS fails); Claude scheduled task is a secondary layer
- Uptime Kuma DNS monitor uses `192.168.88.27` (host IP, not Docker internal)

## Monitoring Stack — Beszel (migrated 2026-06-18)

Replaced Prometheus + Grafana + cAdvisor + node_exporter with **Beszel** — a lightweight all-in-one monitoring tool.

- **Hub**: Docker container on siklos, port 8085 → `https://beszel.jgitta.com`
- **Compose**: `/srv/docker/beszel/docker-compose.yml`
- **Architecture**: Hub communicates with agents over SSH (port 45876). On siklos the agent uses a unix socket (`/srv/docker/beszel/beszel_socket/beszel.sock`) to avoid Docker network isolation issues.
- **Agent deployment**: Binary + systemd service (`beszel-agent.service`) on each remote host. Install script: `curl -sL https://get.beszel.dev/agent | bash`
- **Universal token**: Used to auto-register agents — stored in PocketBase `universal_tokens` collection
- **Agents installed on**: siklos (.27), jellyfin (.10), jgpc (.41), proxmox jg-hud (.25), PBS (.60), caddy (.110), photos VM113 (.32), OCIS VM114 (.63)
- **Alerts configured** (via PocketBase API, regular user token required — not superuser):
  - `Status` — host goes down
  - `CPU` — >90%
  - `Memory` — >90%
  - `Disk` — >85%
- **Notifications**: Telegram bot `8758434542:AAEW6omM7twyInsb2INuy6mD1w2EWXHqmzE`, chat `8260387200`
- **Uptime Kuma**: port 3001 (`status.jgitta.com`), joined to `pihole_default` network — handles HTTP/port/DNS uptime checks (separate from Beszel resource monitoring)

## OnlyOffice
- URL: `https://office.jgitta.com`
- Port: 8880 (all interfaces)
- Compose: `/srv/docker/media/docker-compose.yml`
- Replaces Collabora (`richdocuments` app is disabled in Nextcloud; `onlyoffice` app is enabled)
- JWT secret (must match Nextcloud config): `4f2b0c719af2de99befacfec9ca5e8373cbdeb76`
- Nextcloud `occ` settings (set on VM103/next):
  - `DocumentServerUrl` = `https://office.jgitta.com/`
  - `DocumentServerInternalUrl` = `http://192.168.88.27:8880/`
  - `StorageUrl` = `https://next.jgitta.com/`
  - `jwt_secret` = (matches container `local.json` above)
  - `jwt_header` = `Authorization`
- To reconfigure after container recreation: re-run `occ config:app:set onlyoffice jwt_secret --value="<secret from local.json>"`
- Container JWT secret location: `/etc/onlyoffice/documentserver/local.json` → `.services.CoAuthoring.secret.inbox.string`

## Key Notes
- Watchtower excludes Pi-hole from auto-updates
- OnlyOffice replaced Collabora (lighter RAM usage)
- RAM reduced from 16GB → 12GB (April 2026, live via Proxmox balloon driver, no reboot) — freed further in June 2026 when PhotoPrism was removed
- `vm.swappiness=10` set to reduce swap pressure
- NFS mount `/mnt/immich-photos` (from VM113 192.168.88.32) is in fstab — read-only access to Immich photo storage

## Portainer Setup (April 2026)

Portainer CE manages Docker across three hosts from a single UI.

**Server (web UI):**
- URL: `http://192.168.88.27:9000` or `https://192.168.88.27:9443`
- Future URL (once Caddy SSH fixed): `https://portainer.jgitta.com`
- Compose: `/srv/docker/portainer/docker-compose.yml`

**Agents (managed remote environments):**
| Host | IP | Agent Port | Compose Path |
|---|---|---|---|
| jellyfin | 192.168.88.10 | 9001 | /srv/docker/portainer-agent/ |
| jgpc | 192.168.88.41 | 9001 | /srv/docker/portainer-agent/ |

**Adding agents in Portainer UI (first-time setup):**
1. Open Portainer at `http://192.168.88.27:9000` and create your admin account
2. Go to **Environments → Add environment → Agent**
3. For jellyfin: name `jellyfin`, URL `192.168.88.10:9001`
4. For jgpc: name `jgpc`, URL `192.168.88.41:9001`

**Caddy config:** Entry for `portainer.jgitta.com` is ready in workspace Caddyfile — needs deploying once Caddy VM SSH access is restored.