Publish sanitized current homelab architecture
Some checks failed
public-safety / privacy-and-secret-scan (push) Has been cancelled
Some checks failed
public-safety / privacy-and-secret-scan (push) Has been cancelled
This commit is contained in:
fizzlepoof
168
docs/services.md
Normal file
168
docs/services.md
Normal file
@@ -0,0 +1,168 @@
|
||||
# Current Service Placement
|
||||
|
||||
This is a public-safe service inventory verified against the live hosts during the September 2026 refresh. Versions, ports, addresses, domains, device IDs, and internal paths are intentionally omitted.
|
||||
|
||||
## Primary application host
|
||||
|
||||
### Core platform
|
||||
|
||||
- TrueNAS SCALE
|
||||
- Docker application runtime
|
||||
- shared PostgreSQL, MariaDB, and Redis
|
||||
- Traefik internal reverse proxy
|
||||
- Newt tunnel connector
|
||||
- Tailscale private-overlay connector
|
||||
- Authentik identity and SSO
|
||||
- Authelia retained for limited legacy migration paths
|
||||
- Headscale and Headplane pilot control plane
|
||||
- Gitea source hosting
|
||||
- Dockhand and Homepage administration interfaces
|
||||
|
||||
### AI and search
|
||||
|
||||
- Ollama always-on model serving
|
||||
- LiteLLM model gateway
|
||||
- Open WebUI
|
||||
- Qdrant vector database
|
||||
- SearXNG metasearch
|
||||
- Firecrawl API, browser worker, queue, and supporting data services
|
||||
- a VPN-isolated search egress path
|
||||
|
||||
### Media and libraries
|
||||
|
||||
- Plex
|
||||
- Tautulli
|
||||
- Audiobookshelf
|
||||
- Calibre Web Automated
|
||||
- Seerr
|
||||
- Immich application and machine-learning services
|
||||
- RomM
|
||||
- GameVault
|
||||
- Dispatcharr
|
||||
|
||||
Large libraries remain on the storage host and are mounted by the application host.
|
||||
|
||||
### Productivity and household applications
|
||||
|
||||
- Paperless-ngx with document conversion and extraction sidecars
|
||||
- Karakeep with browser and search sidecars
|
||||
- n8n
|
||||
- KitchenOwl
|
||||
- Donetick and a dashboard bridge
|
||||
- Shlink and its web client
|
||||
- Qui
|
||||
- Scholarsome
|
||||
- Doris Barbell
|
||||
- Kima Hub
|
||||
|
||||
### Monitoring and notification
|
||||
|
||||
- Grafana
|
||||
- Prometheus
|
||||
- Loki
|
||||
- Promtail
|
||||
- cAdvisor
|
||||
- node exporter
|
||||
- Netdata
|
||||
- Uptime Kuma
|
||||
- Gotify
|
||||
|
||||
### Radio visibility
|
||||
|
||||
- MeshMonitor
|
||||
- local map-tile service
|
||||
|
||||
## Storage and ingestion host
|
||||
|
||||
### Data plane
|
||||
|
||||
- ZFS-backed bulk storage
|
||||
- application-data and media datasets
|
||||
- snapshot and backup targets
|
||||
- synchronized school/document storage
|
||||
|
||||
### Media ingestion
|
||||
|
||||
- Sonarr, including a separate anime workflow
|
||||
- Radarr
|
||||
- Lidarr
|
||||
- Readarr variants
|
||||
- Prowlarr
|
||||
- Bazarr
|
||||
- qBittorrent through a VPN gateway
|
||||
- qbit_manage
|
||||
- Unpackerr
|
||||
- Autobrr
|
||||
- Notifiarr
|
||||
- Shelfmark
|
||||
|
||||
### Supporting services
|
||||
|
||||
- Syncthing hub
|
||||
- RustDesk rendezvous and relay
|
||||
- CPU text reranker
|
||||
- secondary Technitium DNS replica
|
||||
- Netdata
|
||||
- Hawser
|
||||
- Newt connector
|
||||
|
||||
## Offline and resilience host
|
||||
|
||||
### Offline knowledge platform
|
||||
|
||||
- Project N.O.M.A.D. administration layer
|
||||
- Kiwix
|
||||
- two Kolibri generations for retained content compatibility
|
||||
- CyberChef
|
||||
- Flatnotes
|
||||
- MeshCore Web
|
||||
- local Ollama and Qdrant
|
||||
|
||||
Project N.O.M.A.D.-managed containers are treated as an appliance layer and are not manually rebuilt by general maintenance automation.
|
||||
|
||||
### Local agents and household tools
|
||||
|
||||
- Honcho API, deriver, PostgreSQL/Vector database, and Redis
|
||||
- Doris Schoolhouse
|
||||
- Doris Kitchen
|
||||
- CPU Whisper service
|
||||
- LocalSend trusted intake
|
||||
- Hawser
|
||||
- node exporter
|
||||
|
||||
### Resilience and hardware-adjacent services
|
||||
|
||||
- Home Assistant OS in a KVM virtual machine with a dedicated Zigbee radio
|
||||
- secondary Technitium DNS replica
|
||||
- MeshCore companion observer as a system service
|
||||
- Pelican/Wings game-server management
|
||||
- Newt tunnel connector
|
||||
|
||||
## GPU operator workstation
|
||||
|
||||
- CachyOS desktop
|
||||
- high-performance NVIDIA GPU compute
|
||||
- optional heavy Ollama and speech workloads
|
||||
- Docker runtime
|
||||
- printing service
|
||||
- private-overlay access
|
||||
- file-synchronization client
|
||||
- 3D-printing and slicing applications
|
||||
|
||||
The workstation is intentionally opportunistic capacity. Background services must continue when it is asleep or offline.
|
||||
|
||||
## Low-power edge node
|
||||
|
||||
- weather collection and dispatch
|
||||
- mesh-radio/repeater support
|
||||
- wired server-lane placement
|
||||
- low-power always-on operation
|
||||
|
||||
## Placement rules
|
||||
|
||||
1. Shared applications and databases prefer the primary application host.
|
||||
2. Large data and media ingestion stay close to bulk storage.
|
||||
3. Offline knowledge and resilience services remain independent of the primary host.
|
||||
4. Heavy GPU work may use the workstation, but routine automation cannot require it.
|
||||
5. Hardware-adjacent radio and weather services stay on low-power edge nodes.
|
||||
6. DNS, file synchronization, and remote support span hosts to avoid a single failure domain.
|
||||
Reference in New Issue
Block a user