fc233bd27f
Audited 14 documentation files against live cluster state and Terraform code. Architecture docs: - databases.md: MySQL 8.4.4, proxmox-lvm storage (not iSCSI), anti-affinity excludes k8s-node1 (GPU), 2Gi/3Gi resources, 7-day rotation (not 24h), CNPG 2 instances, PostGIS 16, postgresql.dbaas has endpoints - overview.md: 1x CPU, ~160GB RAM, all nodes 32GB, proxmox-lvm storage, correct Vault paths (secret/ not kv/) - compute.md: 272GB physical host RAM, ~160GB allocated to VMs - secrets.md: 7-day rotation, 7 MySQL + 5 PG roles, correct ESO config - networking.md: MetalLB pool 10.0.20.200-220 - ci-cd.md: 9 GHA projects, travel_blog 5.7GB Runbooks: - restore-mysql/postgresql: backup files are .sql.gz (not .sql) - restore-vault: weekly backup (not daily), auto-unseal sidecar note - restore-vaultwarden: PVC is proxmox (not iscsi) - restore-full-cluster: updated node roles, removed trading Reference docs: - CLAUDE.md: 7-day rotation, removed trading from PG list - AGENTS.md: 100+ stacks, proxmox-lvm, platform empty shell - service-catalog.md: 6 new stacks, 14 stack column updates
137 lines
5.8 KiB
Markdown
137 lines
5.8 KiB
Markdown
# Service Catalog
|
|
|
|
> Auto-maintained reference. See `.claude/CLAUDE.md` for operational guidance.
|
|
|
|
## Critical - Network & Auth (Tier: core)
|
|
| Service | Description | Stack |
|
|
|---------|-------------|-------|
|
|
| wireguard | VPN server | wireguard |
|
|
| technitium | DNS server (10.0.20.101) | technitium |
|
|
| headscale | Tailscale control server | headscale |
|
|
| traefik | Ingress controller (Helm) | traefik |
|
|
| xray | Proxy/tunnel | platform |
|
|
| authentik | Identity provider (SSO) | authentik |
|
|
| cloudflared | Cloudflare tunnel | cloudflared |
|
|
| authelia | Auth middleware (may be merged into ebooks or removed) | platform |
|
|
| monitoring | Prometheus/Grafana/Loki stack | monitoring |
|
|
|
|
## Storage & Security (Tier: cluster)
|
|
| Service | Description | Stack |
|
|
|---------|-------------|-------|
|
|
| vaultwarden | Bitwarden-compatible password manager | platform |
|
|
| redis | Shared Redis at `redis.redis.svc.cluster.local` | redis |
|
|
| immich | Photo management (GPU) | immich |
|
|
| nvidia | GPU device plugin | nvidia |
|
|
| metrics-server | K8s metrics | metrics-server |
|
|
| uptime-kuma | Status monitoring | uptime-kuma |
|
|
| crowdsec | Security/WAF | crowdsec |
|
|
| kyverno | Policy engine | kyverno |
|
|
|
|
## Admin
|
|
| Service | Description | Stack |
|
|
|---------|-------------|-------|
|
|
| k8s-dashboard | Kubernetes dashboard | k8s-dashboard |
|
|
| reverse-proxy | Generic reverse proxy | reverse-proxy |
|
|
|
|
## Active Use
|
|
| Service | Description | Stack |
|
|
|---------|-------------|-------|
|
|
| mailserver | Email (docker-mailserver) | mailserver |
|
|
| shadowsocks | Proxy | shadowsocks |
|
|
| webhook_handler | Webhook processing | webhook_handler |
|
|
| tuya-bridge | Smart home bridge | tuya-bridge |
|
|
| dawarich | Location history | dawarich |
|
|
| owntracks | Location tracking | owntracks |
|
|
| nextcloud | File sync/share | nextcloud |
|
|
| calibre | E-book management (may be merged into ebooks stack) | calibre |
|
|
| onlyoffice | Document editing | onlyoffice |
|
|
| f1-stream | F1 streaming | f1-stream |
|
|
| rybbit | Analytics | rybbit |
|
|
| isponsorblocktv | SponsorBlock for TV | isponsorblocktv |
|
|
| actualbudget | Budgeting (factory pattern) | actualbudget |
|
|
| insta2spotify | Instagram reel song ID to Spotify playlist | insta2spotify |
|
|
| trading-bot | Event-driven trading with sentiment analysis | trading-bot |
|
|
| claude-memory | Persistent memory MCP server | claude-memory |
|
|
|
|
## Optional
|
|
| Service | Description | Stack |
|
|
|---------|-------------|-------|
|
|
| blog | Personal blog | blog |
|
|
| descheduler | Pod descheduler | descheduler |
|
|
| hackmd | Collaborative markdown | hackmd |
|
|
| kms | Key management | kms |
|
|
| privatebin | Encrypted pastebin | privatebin |
|
|
| vault | HashiCorp Vault | vault |
|
|
| reloader | ConfigMap/Secret reloader | reloader |
|
|
| city-guesser | Game | city-guesser |
|
|
| echo | Echo server | echo |
|
|
| url | URL shortener | url |
|
|
| excalidraw | Whiteboard | excalidraw |
|
|
| travel_blog | Travel blog | travel_blog |
|
|
| dashy | Dashboard | dashy |
|
|
| send | Firefox Send | send |
|
|
| ytdlp | YouTube downloader | ytdlp |
|
|
| wealthfolio | Finance tracking | wealthfolio |
|
|
| audiobookshelf | Audiobook server (may be merged into ebooks stack) | audiobookshelf |
|
|
| paperless-ngx | Document management | paperless-ngx |
|
|
| jsoncrack | JSON visualizer | jsoncrack |
|
|
| servarr | Media automation (Sonarr/Radarr/etc) | servarr |
|
|
| ntfy | Push notifications | ntfy |
|
|
| cyberchef | Data transformation | cyberchef |
|
|
| diun | Docker image update notifier | diun |
|
|
| meshcentral | Remote management | meshcentral |
|
|
| homepage | Dashboard/startpage | homepage |
|
|
| matrix | Matrix chat server | matrix |
|
|
| linkwarden | Bookmark manager | linkwarden |
|
|
| changedetection | Web change detection | changedetection |
|
|
| tandoor | Recipe manager | tandoor |
|
|
| n8n | Workflow automation | n8n |
|
|
| real-estate-crawler | Property crawler | real-estate-crawler |
|
|
| tor-proxy | Tor proxy | tor-proxy |
|
|
| forgejo | Git forge | forgejo |
|
|
| freshrss | RSS reader | freshrss |
|
|
| navidrome | Music streaming | navidrome |
|
|
| networking-toolbox | Network tools | networking-toolbox |
|
|
| stirling-pdf | PDF tools | stirling-pdf |
|
|
| speedtest | Speed testing | speedtest |
|
|
| freedify | Music streaming (factory pattern) | freedify |
|
|
| netbox | Network documentation | netbox |
|
|
| infra-maintenance | Maintenance jobs | infra-maintenance |
|
|
| ollama | LLM server (GPU) | ollama |
|
|
| frigate | NVR/camera (GPU) | frigate |
|
|
| ebook2audiobook | E-book to audio (GPU) | ebook2audiobook |
|
|
| affine | Visual canvas/whiteboard (PostgreSQL + Redis) | affine |
|
|
| health | Apple Health data dashboard (PostgreSQL) | health |
|
|
| whisper | Wyoming Faster Whisper STT (CPU on GPU node) | whisper |
|
|
| grampsweb | Genealogy web app (Gramps Web) | grampsweb |
|
|
| openclaw | AI agent gateway (OpenClaw) | openclaw |
|
|
| poison-fountain | Anti-AI scraping (tarpit + poison) | poison-fountain |
|
|
| priority-pass | Boarding pass color transformer | priority-pass |
|
|
| status-page | Status page | status-page |
|
|
| plotting-book | Book plotting/world-building app | plotting-book |
|
|
|
|
## Cloudflare Domains
|
|
|
|
### Proxied (CDN + WAF enabled)
|
|
```
|
|
blog, hackmd, privatebin, url, echo, f1tv, excalidraw, send,
|
|
audiobookshelf, jsoncrack, ntfy, cyberchef, homepage, linkwarden,
|
|
changedetection, tandoor, n8n, stirling-pdf, dashy, city-guesser,
|
|
travel, netbox
|
|
```
|
|
|
|
### Non-Proxied (Direct DNS)
|
|
```
|
|
mail, wg, headscale, immich, calibre, vaultwarden,
|
|
mailserver-antispam, mailserver-admin, webhook, uptime,
|
|
owntracks, dawarich, tuya, meshcentral, nextcloud, actualbudget,
|
|
onlyoffice, forgejo, freshrss, navidrome, ollama, openwebui,
|
|
isponsorblocktv, speedtest, freedify, rybbit, paperless,
|
|
servarr, prowlarr, bazarr, radarr, sonarr, flaresolverr,
|
|
jellyfin, jellyseerr, tdarr, affine, health, family, openclaw
|
|
```
|
|
|
|
### Special Subdomains
|
|
- `*.viktor.actualbudget` - Actualbudget factory instances
|
|
- `*.freedify` - Freedify factory instances
|
|
- `mailserver.*` - Mail server components (antispam, admin)
|