From 9a42d6a27def9aa6c9bade76ef50f46c635ae92b Mon Sep 17 00:00:00 2001 From: Administrator Date: Sun, 29 Mar 2026 16:05:36 +0000 Subject: [PATCH] docs: create Netgrimoire/service_Catalog --- Netgrimoire/service_Catalog.md | 355 +++++++++++++++++++++++++++++++++ 1 file changed, 355 insertions(+) create mode 100644 Netgrimoire/service_Catalog.md diff --git a/Netgrimoire/service_Catalog.md b/Netgrimoire/service_Catalog.md new file mode 100644 index 0000000..f5e4809 --- /dev/null +++ b/Netgrimoire/service_Catalog.md @@ -0,0 +1,355 @@ +--- +title: Netgrimoire Service Catalog +description: Done or soon to be +published: true +date: 2026-03-29T16:05:26.168Z +tags: +editor: markdown +dateCreated: 2026-03-29T16:05:26.168Z +--- + +# Netgrimoire Service Catalog + +> **Living document** โ€” tracks all deployed, configured, and planned services across the Netgrimoire homelab. +> Source of truth: Forgejo repo โ€” `compose/` = Docker Compose per host | `swarm/` = Docker Swarm | `archive/` = not running +> +> Status: โœ… Deployed & Configured | ๐Ÿ”ง Deployed, Needs Config | ๐Ÿ“‹ Planned | ๐Ÿ” Evaluating | โŒ Abandoned/Archived + +--- + +## ๐Ÿ—๏ธ Infrastructure Overview + +| Host | Role | IP | Runtime | +|------|------|----|---------| +| znas | NAS / Primary Swarm node | 192.168.5.10 | Docker Compose + Swarm manager | +| docker2 | VPN gateway host | โ€” | Docker Compose | +| docker3 | LibreNMS host | โ€” | Docker Compose | +| docker4 (hermes) | Mail server host | 192.168.5.16 | Docker Compose | +| docker5 | Media host | 192.168.5.18 | Docker Compose | +| Pi4s / NUCs | Swarm worker nodes | various | Docker Swarm workers | + +--- + +## ๐Ÿ“ก Network & Reverse Proxy + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | OPNsense | Firewall appliance | โ€” | Firewall / Dual-WAN / NAT | ATT igc1 primary; 5 static IPs allocated; legacy WAN retiring | +| ๐Ÿ”ง | Caddy (new) | znas / Swarm | โ€” | Reverse proxy โ€” CrowdSec edition | `serfriz/caddy-crowdsec-geoip-ratelimit-security-dockerproxy`; migration in progress; `caddy.yaml` | +| โœ… | Caddy (legacy) | znas / Swarm | โ€” | Reverse proxy | `lucaslorentz/caddy-docker-proxy`; `caddy-1.yaml` | +| โœ… | Authentik | znas / Swarm | โ€” | SSO / IdP | Protects `*.netgrimoire.com` services | +| โœ… | Authelia | znas / Swarm | โ€” | SSO / IdP | Protects `*.wasted-bandwidth.net` services | +| โœ… | WireGuard | OPNsense | โ€” | VPN | Peers: Obie (.2), pncfishandmore (.3), GLNet (.4/.6), PortaPotty (.5) โ€” 192.168.32.0/24 | +| โœ… | OpenVPN | OPNsense | โ€” | VPN | Configured alongside WireGuard | +| โœ… | Gluetun | docker2 / Compose | โ€” | VPN gateway container | PIA VPN; Jackett + Transmission share `network_mode: container:gluetun` | +| โœ… | Internal DNS | 192.168.5.7 | dns.netgrimoire.com | Internal name resolution | Technitium DNS; behind Authentik | +| โœ… | LLDAP | znas / Swarm | ldap.netgrimoire.com | Lightweight LDAP directory | `lldap/lldap:stable` + postgres; user management backend | +| ๐Ÿ“‹ | dnscrypt-proxy | TBD | โ€” | Encrypted upstream DNS | Pending install | +| ๐Ÿ“‹ | Suricata | OPNsense | โ€” | IDS/IPS | Pending config | +| ๐Ÿ“‹ | Zenarmor | OPNsense | โ€” | Deep packet inspection (free tier) | Pending install | +| ๐Ÿ“‹ | os-git-backup | OPNsense | โ€” | OPNsense config backup to git | Pending install | + +--- + +## ๐Ÿ”’ Security + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | CrowdSec | OPNsense + Swarm | โ€” | Threat intelligence / IP blocking | OPNsense bouncer active; Caddy bouncer in progress | +| โœ… | Vaultwarden | znas / Swarm | pass.netgrimoire.com | Password manager | `vaultwarden/server` | +| ๐Ÿ”ง | CrowdSec Caddy Bouncer | znas / Swarm | โ€” | HTTP-level blocking | Gradual rollout via `caddy.import=crowdsec` label per service | +| ๐Ÿ”ง | OPNsense Spamhaus + GeoIP | OPNsense | โ€” | IP blocklist / geo-blocking | Currently DISABLED โ€” needs fixing | +| ๐Ÿ“‹ | YubiKey PIV (SSH) | All hosts | โ€” | Smartcard SSH authentication | Highest-impact pending integration | +| ๐Ÿ“‹ | YubiKey Challenge-Response | znas | โ€” | LUKS / Kopia key derivation | Planned | + +--- + +## ๐Ÿ“ง Email + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | MailCow | docker4 / Compose | mail.netgrimoire.com + all domains | Self-hosted mail server | hermes.netgrimoire.com; MXRoute inbound filter + outbound relay for all 8 domains | +| โœ… | Roundcube | docker4 / Swarm | โ€” | Webmail | SSL peer verify disabled for internal dovecot; SRS catch-all aliases configured | +| โœ… | MXRoute | External | โ€” | Inbound filter + outbound relay | Two DKIM selectors: `mailcow` + `mxroute` | +| ๐Ÿ“‹ | Dedicated ATT_Mail IP | OPNsense | โ€” | Separate static IP for mail traffic | Assignment still pending | + +**Domains:** netgrimoire.com ยท pncharris.com ยท nucking-futz.com ยท wasted-bandwidth.net ยท florosafd.org ยท gnarlypandaproductions.com ยท pncfishandmore.com ยท pncharrisenterprises.com + +--- + +## ๐ŸŽฌ Media โ€” Video + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Jellyfin | docker5 / Compose | โ€” | Media server | Port 8096; VAAPI via `/dev/dri`; dedicated static IP 107.133.34.147 | +| โœ… | Jellyfinx | docker5 / Compose | โ€” | Green Door media server | Port 7096; separate instance; Green + AfterDark library mounts | +| โœ… | Sonarr | znas / Swarm | โ€” | TV show downloader | `linuxserver/sonarr` | +| โœ… | Radarr | znas / Swarm | โ€” | Movie downloader | `linuxserver/radarr` | +| โœ… | Bazarr | znas / Swarm | bazarr.netgrimoire.com | Subtitle management | `linuxserver/bazarr` | +| โœ… | Tunarr | znas / Swarm | โ€” | IPTV channel creation | `chrisbenincasa/tunarr`; ErsatzTV replacement (ErsatzTV archived Feb 2026) | +| โœ… | JellySeerr | znas / Swarm | requests.netgrimoire.com | Media request management | `fallenbagel/jellyseerr` | +| โœ… | JellyStat | znas / Swarm | โ€” | Jellyfin usage statistics | `cyfershepard/jellystat` + postgres | +| โœ… | TinyMediaManager | znas / Swarm | tmm.netgrimoire.com | Media metadata manager | `tinymediamanager/tinymediamanager` | +| โœ… | Pinchflat | znas / Swarm | pinchflat.netgrimoire.com | YouTube channel downloader | `kieraneglin/pinchflat` | +| ๐Ÿ“‹ | MeTube | TBD | โ€” | YouTube downloader | Needed for Tunarr period-accurate filler sourcing workflow | +| ๐Ÿ” | Wizarr | TBD | โ€” | Jellyfin user onboarding | Evaluating | + +--- + +## ๐ŸŽต Media โ€” Audio + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Lidarr | znas / Swarm | โ€” | Music downloader | (Caddy label not found in yaml โ€” likely static Caddyfile entry) | +| โœ… | Beets | znas / Swarm | beets.netgrimoire.com | Music library tagging | `linuxserver/beets` | +| ๐Ÿ” | Navidrome | TBD | โ€” | Music streaming server | Lightweight Subsonic-compatible | +| ๐Ÿ” | Soularr | TBD | โ€” | Soulseek integration for Lidarr | Strongly recommended; fills gaps Usenet/torrents miss | +| ๐Ÿ” | Tubifarry | TBD | โ€” | Spotify playlists โ†’ YouTube โ†’ Lidarr | https://github.com/TypNull/Tubifarry | + +--- + +## ๐Ÿ“š Media โ€” Books & Comics + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Calibre | znas / Compose | calibre.netgrimoire.com | Ebook library management | `linuxserver/calibre`; port 7070; behind Authentik; requires `seccomp=unconfined` (Compose-only) | +| โœ… | Calibre-Web Automated | znas / Swarm | books.netgrimoire.com ยท books.pncharris.com | Web UI + auto-import | `crocodilestick/calibre-web-automated`; dual-domain Caddy label | +| โœ… | Calibre-Web (library) | znas / Swarm | โ€” | Secondary Calibre-Web instance | `linuxserver/calibre-web`; hostname `calibre-netgrimoire`; `library.yaml` | +| โœ… | Readarr | znas / Swarm | โ€” | Book downloader | Using `blampe/rreading-glasses` image | +| ๐Ÿ“‹ | Mylar | znas / Swarm | โ€” | Comic book downloader | Not currently running; needs setup soon. Reference `archive/arr.yaml` for old config | +| โœ… | Kavita | znas / Swarm | kavita.netgrimoire.com | Ebook/comic reader | `jvmilazz0/kavita` | +| โœ… | Comixed | znas / Swarm | comics.netgrimoire.com | Comic library server | `comixed/comixed` | +| โœ… | FreshRSS | znas / Swarm | rss.netgrimoire.com | RSS aggregator | `linuxserver/freshrss` | +| ๐Ÿ” | Komga | TBD | โ€” | Comic/manga server | Evaluating vs Kavita/Comixed | +| ๐Ÿ” | MyAnonaMouse | TBD | โ€” | Private ebook tracker | Worth investigating | + +--- + +## ๐Ÿ“ฅ Download Stack + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | NZBGet | znas / Swarm | โ€” | Usenet download manager | `linuxserver/nzbget` | +| โœ… | SABnzbd | znas / Swarm | โ€” | Usenet download manager | `linuxserver/sabnzbd` | +| โœ… | NZBHydra | znas / Swarm | hydra.netgrimoire.com | Usenet indexer aggregator | `linuxserver/nzbhydra2:dev`; altHUB, NZBGeek, Drunken Slug, Usenet Crawler, DogNZB | +| โœ… | Jackett | docker2 / Compose | jackett.netgrimoire.com | Torrent indexer | Runs inside Gluetun network; behind Authentik | +| โœ… | Transmission | docker2 / Compose | โ€” | Torrent client | `network_mode: container:gluetun`; shares Gluetun VPN | +| โœ… | Recyclarr | znas / Swarm | โ€” | Sonarr/Radarr quality profile sync | `recyclarr/recyclarr` | +| โœ… | Profilarr | znas / Swarm | profilarr.netgrimoire.com | Quality profile management | `santiagosayshey/profilarr` | +| โœ… | Configarr | znas / Swarm | configarr.netgrimoire.com | Arr config management | `raydak-labs/configarr` | +| ๐Ÿ“‹ | Prowlarr | TBD | โ€” | Unified indexer manager | Low priority โ€” light torrent usage; NZBHydra covers current needs | + +--- + +## ๐Ÿค– AI & Automation (Gremlin Stack) + +> All pinned to `znas` node on Docker Swarm via `swarm/ollama.yaml`. + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Ollama | znas / Swarm | โ€” | Local LLM inference | CPU-only (Ryzen); 3Bโ€“14B models | +| โœ… | Open WebUI | znas / Swarm | โ€” | Chat interface for Ollama | `ghcr.io/open-webui/open-webui` | +| โœ… | Qdrant | znas / Swarm | โ€” | Vector database for RAG | Wiki.js / markdown doc search | +| โœ… | n8n | znas / Swarm | โ€” | Workflow automation | Forgejo webhook โ†’ doc gen, compose validation, alert triage | +| ๐Ÿ” | Perplexica | TBD | โ€” | Self-hosted AI search | https://github.com/ItzCrazyKns/Perplexica | + +--- + +## โ˜๏ธ Files, Notes & Personal Apps + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Nextcloud AIO | znas / Compose | cloud.netgrimoire.com | File sync / cloud storage | `nextcloud/all-in-one`; data at `/srv/NextCloud-AIO`; Caddy โ†’ port 11000 | +| โœ… | Immich | znas / Compose | immich.netgrimoire.com | Photo management | Port 2283; Postgres dump + Kopia backup; external photo + Nextcloud mounts | +| โœ… | Joplin Server | znas / Swarm | joplin.netgrimoire.com | Note sync server | `joplin/server` + postgres; Homepage widget configured | +| โœ… | Vikunja | znas / Swarm | task.netgrimoire.com | Task management | `vikunja/vikunja` + MariaDB | +| โœ… | Linkding | znas / Swarm | link.netgrimoire.com | Bookmark manager | `sissbruecker/linkding:1.13.0` | +| โœ… | Mealie | znas / Swarm | recipe.netgrimoire.com | Recipe manager | `ghcr.io/mealie-recipes/mealie` | +| โœ… | Wallos | znas / Swarm | expense.netgrimoire.com | Subscription / expense tracker | `bellamy/wallos` | +| โœ… | DailyTxT | znas / Swarm | โ€” | Encrypted diary | `phitux/dailytxt:2.x.x` | +| โœ… | Bigcapital | docker5 / Compose | accounts.netgrimoire.com | Accounting / invoicing | Static Caddyfile entry; `{{upstreams}}` doesn't work for Compose stacks | +| โœ… | Scanopy | znas / Swarm | scn.netgrimoire.com | Document scanner | `ghcr.io/scanopy/scanopy` (server + daemon) + postgres | +| โœ… | Glance | znas / Swarm | home.netgrimoire.com | Alternative dashboard | `glanceapp/glance` | +| ๐Ÿ“‹ | Memos | TBD | โ€” | Self-hosted journaling | Preferred journal addition (alongside Joplin for notes) | +| ๐Ÿ” | Wallabag | TBD | โ€” | Read-it-later / article saving | | +| ๐Ÿ” | Fluid Calendar | TBD | โ€” | Self-hosted calendar | https://github.com/dotnetfactory/fluid-calendar | +| ๐Ÿ” | Firefly III | TBD | โ€” | Personal finance / budgeting | | +| ๐Ÿ” | Stirling-PDF | TBD | โ€” | PDF editor / tools | | +| ๐Ÿ” | Excalidraw | TBD | โ€” | Collaborative whiteboard | | +| ๐Ÿ” | Baikal | TBD | โ€” | CalDAV / CardDAV sync | https://sabre.io/baikal/ | + +--- + +## ๐Ÿ“ Documentation & Dev + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Wiki.js | znas / Swarm | wiki.netgrimoire.com | Documentation wiki | `requarks/wiki:2` + postgres; Grimoire theme; Forgejo git backend | +| โœ… | Draw.io | znas / Swarm | draw.netgrimoire.com | Diagramming | `jgraph/drawio`; co-deployed in `wiki.yaml` | +| โœ… | Forgejo | znas / Swarm | git.netgrimoire.com | Self-hosted Git | `codeberg.org/forgejo/forgejo:11`; source of truth for Wiki.js + Gremlin | +| โœ… | Forgejo Runner | znas / Swarm | โ€” | CI/CD | `data.forgejo.org/forgejo/runner:4.0.0`; `gitrunner.yaml` | +| โœ… | VS Code Server | znas / Swarm | code.netgrimoire.com | Web-based IDE | `linuxserver/code-server` | +| โœ… | Webtop (ubuntu-kde) | znas / Compose | webtop.netgrimoire.com | Browser-based desktop | Software rendering via llvmpipe; behind Authentik | +| โœ… | Firefox (container) | znas / Swarm | firefox.netgrimoire.com | Containerized browser | `jlesage/firefox` | + +--- + +## ๐Ÿ“Š Monitoring & Observability + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Uptime Kuma | znas / Swarm | โ€” | Service uptime monitoring | `louislam/uptime-kuma:1` | +| โœ… | AutoKuma | znas / Swarm | โ€” | Auto-create Kuma monitors from labels | `ghcr.io/bigboot/autokuma`; co-deployed in `kuma.yaml` | +| โœ… | Beszel | znas / Swarm | โ€” | Docker resource monitoring | `henrygd/beszel` hub + agents on all nodes | +| โœ… | DIUN | znas / Swarm | โ€” | Docker image update notifications | `crazymax/diun`; label-based per-service | +| โœ… | ntfy | znas / Swarm | ntfy.netgrimoire.com | Push notifications | `binwiederhier/ntfy`; OPNsense alerts via CrowdSec HTTP plugin | +| โœ… | Dozzle | znas / Swarm | dozzle.netgrimoire.com | Real-time container logs | `amir20/dozzle`; behind Authentik | +| โœ… | Scrutiny | znas / Compose | scrutiny.netgrimoire.com | Disk S.M.A.R.T. monitoring | `analogj/scrutiny:master-omnibus`; monitors /dev/sdaโ€“sdg; behind Authentik | +| โœ… | Glances | znas / Compose | โ€” | Real-time system stats | `nicolargo/glances`; `network_mode: host`; co-deployed in `monitor.yaml` | +| โœ… | Graylog | docker4 / Compose | log.netgrimoire.com | Log aggregation | Graylog 6.0 + MongoDB 5 + DataNode (OpenSearch); compose-only (noted in file) | +| โœ… | LibreNMS | docker3 / Compose | nms.netgrimoire.com | Network/SNMP monitoring | Full stack: librenms + dispatcher + syslog-ng + snmptrapd + MariaDB + Redis; port 8000 | +| โœ… | Homelable | znas / Compose | โ€” | Infrastructure visualizer | Frontend + Backend via GHCR; MCP deferred (requires build from source) | +| โœ… | phpIPAM | znas / Swarm | ipam.netgrimoire.com | IP address management | `phpipam/phpipam-www` + cron + MariaDB | +| โœ… | Homepage | znas / Swarm | โ€” | Primary dashboard | `ghcr.io/gethomepage/homepage` | +| โœ… | Glance | znas / Swarm | home.netgrimoire.com | Alternative dashboard | `glanceapp/glance` | +| โœ… | Dockpeek | znas / Swarm | dockpeek.netgrimoire.com | Container inspector | `dockpeek/dockpeek` | +| โœ… | Loki + Promtail + Grafana | znas / Swarm | โ€” | Metrics/log stack | `logging.yaml`; Grafana 10.4.2 + Loki 2.9.3 + Promtail 2.9.3 | +| โœ… | phpMyAdmin + phpPgAdmin | znas / Swarm | โ€” | DB admin UIs | `SQL-mgmt.yaml` | +| โœ… | pgAdmin | znas / Swarm | โ€” | Postgres admin | `dpage/pgadmin4`; `database.yaml` | +| ๐Ÿ” | WatchYourLAN | TBD | โ€” | Network device tracker | https://github.com/aceberg/WatchYourLAN | +| ๐Ÿ” | NUT UPS | TBD | โ€” | UPS power management | https://hub.docker.com/r/instantlinux/nut-upsd | +| ๐Ÿ” | OliveTin | TBD | โ€” | Web button โ†’ shell command | Run commands from web UI | +| ๐Ÿ” | Swarm Dashboard | TBD | โ€” | Docker Swarm visualizer | https://github.com/mohsenasm/swarm-dashboard | + +--- + +## ๐Ÿ’พ Storage & Backup + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | OpenZFS (ZNAS) | znas | โ€” | Primary storage | ~94TB raw, two RAIDZ1 VDEVs; vault pool | +| โœ… | NFSv4 | znas | โ€” | Shared storage for Swarm | Loopback NFS at `/data/nfs/znas`; ZFS must fully mount before NFS starts | +| โœ… | Kopia (primary vault) | znas / Swarm | kopia.netgrimoire.com | Primary backup repo | `kopia.yaml`; dedup + replication | +| โœ… | Kopia (offsite vault) | znas / Swarm | vault.netgrimoire.com | Offsite replication server | `vault.yaml`; port 51516; separate dataset โ†’ ZFS raw send to Pi vaults | +| โœ… | syncoid | znas | โ€” | ZFS replication | Syncs vault/Green/Pocket โ†’ Pocket Grimoire | +| โœ… | Nextcloud AIO BorgBackup | znas | โ€” | Nextcloud-native backup | Local snapshots before Kopia | +| โœ… | Czkawka | znas / Swarm | dupes.netgrimoire.com | Duplicate file finder | `jlesage/czkawka` | +| โœ… | Cloud Commander | znas / Swarm | โ€” | Web file manager | `coderaiser/cloudcmd`; **two instances** (`cloudcmd.yaml` + `commander.yaml`) โ€” verify if intentional | +| โœ… | File Browser | znas / Swarm | โ€” | Web file manager | `filebrowser/filebrowser` | +| ๐Ÿ” | Manyfold | TBD | โ€” | 3D print model collector | https://github.com/manyfold3d/manyfold | + +--- + +## ๐Ÿ–ฅ๏ธ Management & Remote Access + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Portainer | znas / Swarm | docker.netgrimoire.com | Container management UI | `portainer/portainer-ce:2.33.6` + agents on all nodes | +| โœ… | ISPConfig | 192.168.4.11 | โ€” | Web/DNS hosting control panel | | +| โœ… | Cockpit | All hosts | win.netgrimoire.com | Linux server management | Caddy โ†’ `192.168.5.10:8006` | +| โœ… | Termix | znas / Swarm | termix.netgrimoire.com | Web-based terminal | `ghcr.io/lukegus/termix` | +| โœ… | DumbTerm | znas / Swarm | โ€” | Simple web terminal | `dockwareio/dumbterm` | +| โœ… | Windows 7 (VM) | znas / Compose | โ€” | Windows VM | `dockurr/windows`; `windows7.yaml` | +| ๐Ÿ” | Guacamole | TBD | โ€” | Remote desktop gateway | Previously tried as `nxterm` โ€” in archive | +| ๐Ÿ” | SSHwifty | TBD | โ€” | SSH web client | In archive; reconsidering | + +--- + +## ๐ŸŽญ Green Door (Adult Content) + +> Protected behind Authelia (`*.wasted-bandwidth.net`) + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Whisparr | znas / Swarm | โ€” | Adult content downloader | `ghcr.io/hotio/whisparr` | +| โœ… | Namer | znas / Compose | namer.wasted-bandwidth.net | Scene file namer | `theporndatabase/namer`; port 6980; data โ†’ `/data/nfs/Baxter/Green/` | +| โœ… | Stash (main) | znas / Compose | stash.wasted-bandwidth.net | Adult content library | `stashapp/stash`; port 9999 | +| โœ… | PocketStash | znas / Compose | โ€” | Stash for Pocket Grimoire | Separate instance; port 9998; data โ†’ `/export/Green/Pocket/`; `pocketstash.yaml` | + +--- + +## ๐ŸŒ Web Hosting + +| Status | App | Host / Runtime | URL | Purpose | Notes | +|--------|-----|----------------|-----|---------|-------| +| โœ… | Apache/PHP web | znas / Swarm | fish.pncharris.com ยท www.wasted-bandwidth.net | Static/PHP web hosting | `php:8.2-apache`; `web.yaml`; replicas: 1 | + +--- + +## ๐Ÿ“ฆ Archive (Not Currently Running) + +> Files in `archive/` โ€” previously evaluated or deployed, not currently active. + +| App | File | Notes | +|-----|------|-------| +| Plex | `plex.yaml` | Replaced by Jellyfin | +| Komodo | `komodo.yaml` | Container management platform โ€” evaluated, not deployed | +| cAdvisor | `cadvisor.yaml` | Container metrics โ€” not deployed | +| Peekaping | `peekaping.yaml` | Uptime monitor โ€” Kuma preferred | +| WatchState | `WatchState.yaml` | Jellyfin/Plex watch state sync | +| Nessus | `nessus.yaml` | Vulnerability scanner โ€” evaluated | +| NxTerm | `nxterm.yaml` | Guacamole-style remote desktop โ€” evaluated | +| SSHwifty | `sshwifty.yaml` | SSH web client โ€” evaluated | +| Wordpress Classifieds | `wordpress-classifieds.yaml` | Not deployed | +| Cal (calendar?) | `cal.yaml` | Evaluated | +| CrowdSec (standalone) | `crowdsec.yaml` | Merged into Caddy stack | +| Arr stack | `arr.yaml` | Old consolidated arr compose โ€” superseded by individual yamls | +| Caddyfile.old | `Caddyfile.old` | Legacy Caddyfile | + +--- + +## ๐Ÿ—ƒ๏ธ Ideas Backlog + +| App | Category | Notes | +|-----|----------|-------| +| Soularr | Audio | Soulseek for Lidarr; strongly recommended | +| Tubifarry | Audio | Spotify โ†’ YouTube โ†’ Lidarr | +| MeTube | Video | YouTube downloader for Tunarr filler | +| Memos | Journal | Preferred self-hosted journal pick | +| Wallabag | Reading | Read-it-later | +| Firefly III | Finance | Budgeting | +| Baikal | PIM | CalDAV/CardDAV | +| Fluid Calendar | PIM | https://github.com/dotnetfactory/fluid-calendar | +| Perplexica | AI | Self-hosted AI search | +| WatchYourLAN | Network | Device tracker | +| OliveTin | Automation | Web UI โ†’ shell commands | +| Swarm Dashboard | Monitoring | Swarm-aware visualizer | +| ContainerNursery | Automation | On-demand container start/stop | +| NUT UPS | Power | UPS management | +| Wire-pod for Vector | IoT | Anki Vector local server | +| Kindle reuse | IoT | Repurpose Kindle as weather/info display | +| Collectarr | Media | https://github.com/RiffSphere/Collectarr | +| SuggestArr | Media | Automated media recommendations | +| Recommendarr | Media | AI media recommendations | +| Manyfold | 3D Print | Model library | +| OrcaSlicer | 3D Print | Slicer web UI | +| Memos / Journiv | Journal | Self-hosted journaling (Memos preferred) | +| Romm | Gaming | ROM library manager | +| EmulatorJS | Gaming | Browser-based emulation | + +--- + +## ๐Ÿ”‘ Key Architecture Decisions & Gotchas + +> Reference these before deploying or modifying services. + +- **MailCow network isolation:** Only `nginx-mailcow` on the `netgrimoire` overlay. All other containers stay on internal bridge. Mixing causes PHP-FPM โ†’ Redis DNS conflicts. +- **caddy-docker-proxy + static Caddyfile conflict:** Never manage the same hostname via both Docker labels AND a static block. Pick one method exclusively per service. +- **`{{upstreams}}` is Swarm-only:** Does not work for Docker Compose stacks. Use static Caddyfile with container name or pinned IP. +- **Docker Compose `ports: []` override:** Does not nullify ports from base file. Remap to unused host ports instead. +- **Graylog is Compose-only:** The `graylog.yaml` file explicitly notes this โ€” do not attempt to run it in Swarm. +- **Calibre requires `seccomp=unconfined`:** Necessary for the desktop app container; incompatible with Swarm mode โ€” must remain in `compose/znas/`. +- **Kopia repos not ZFS-separable:** Use separate repositories with independent retention (`kopia.yaml` vs `vault.yaml`) rather than trying to separate at the ZFS snapshot level. +- **ZFS encryption:** In-place encryption impossible. Use rsync migration + `-w` flag for raw send to Pi vaults (no key needed on vault side). +- **SRS rewrite:** All domains using MXRoute inbound forwarding require catch-all aliases in MailCow to prevent `reject_unlisted_sender` rejections. +- **Docker Swarm DNS caching:** Use `endpoint_mode: dnsrr` for internal services; VIP only for published-port services. +- **NFS boot ordering on znas:** ZFS must fully mount before NFS starts โ€” systemd override required (`After=zfs-import.target zfs-mount.service`). Loopback NFS mount needs `x-systemd.after=nfs-server.service` in fstab. +- **Wiki.js angle brackets:** `` placeholders cause rendering hangs. Use `VALUE` or backtick format instead. +- **bcrypt in `.env`:** Wrap full hash in single quotes to preserve leading `$`. +- **Webtop GPU rendering:** Requires `LIBGL_ALWAYS_SOFTWARE=1` + `GALLIUM_DRIVER=llvmpipe`; remove `devices:/dev/dri` mapping. +- **Cloud Commander duplication:** Two nearly identical `coderaiser/cloudcmd` stacks exist (`cloudcmd.yaml` + `commander.yaml`) โ€” verify if intentional or a duplicate to clean up. +- **Lidarr missing Caddy label:** Lidarr yaml has no caddy label โ€” either routed via static Caddyfile or not yet exposed. Confirm and standardize. + +--- + +*Last updated: March 2026 | Source: Forgejo repo git archive* \ No newline at end of file