# Services Directory

All homelab services, their hosts, ports, and current status.

*Last updated: 2026-05-27*

## Shared Databases (PD)

| Service | Port | Notes |
|---------|------|-------|
| PostgreSQL | 5432 | Shared across stacks via `ix-databases_shared-databases` network |
| MariaDB | 3306 | Shared across stacks |
| Redis | 6379 | Shared across stacks |

## Infrastructure (PD)

| Service | Port | URL | Status |
|---------|------|-----|--------|
| Homepage | 3300 | http://pd:3300 | ✅ Active |
| Dockhand | 3230 | http://pd:3230 | ✅ Active |
| Uptime Kuma | 3001 | http://pd:3001 | ✅ Active |
| Traefik | internal only | Pangolin-targeted internal ingress on `pangolin` network | ✅ Active |
| Gotify | 8443 | https://gotify.paccoco.com | ✅ Active |
| Gitea | 3002 / 2222 | http://pd:3002 / http://10.5.30.6:3002 (SSH: `ssh://git@10.5.30.6:2222/<owner>/<repo>.git`) | ✅ Active |
| Shlink | 8087 | http://pd:8087 | ✅ Active |
| Shlink Web Client | 8088 | http://pd:8088 | ✅ Active |
| RackPeek | 8283 | http://pd:8283 | ✅ Active |
| Authelia | 9091 | http://pd:9091 | ✅ Active internally on PD as legacy migration-only auth plumbing; public `auth.paccoco.com` now redirects to Authentik |
| Authentik | 9000 | http://pd:9000 / https://authentik.paccoco.com | ✅ Active; public identity front door for OIDC/SAML and forward-auth flows |
| Headscale | 8084 | http://pd:8084 | ✅ Active; control-plane container is running and host port is published |
| Headplane | 3005 | http://pd:3005 | ✅ Active; admin UI container is running and host port is published |

## AI Stack

| Service | Host | Port | Status |
|---------|------|------|--------|
| LiteLLM | PD | 4000 | ✅ Active |
| OpenWebUI | PD | 8282 | ✅ Active |
| Qdrant | PD | 6333 (HTTP) / 6334 (gRPC) | ✅ Active |
| Whisper (faster-whisper, CPU) | N.O.M.A.D. (10.5.30.7) | 8786 | ✅ Active |
| Whisper (faster-whisper, CUDA large-v3) | Rocinante (10.5.30.112) | 8787 | ⚠️ Re-check from N.O.M.A.D. if Whisper-specific traffic is needed; Ollama-only recovery was validated 2026-05-27 |
| SearXNG | PD | 8888 | ✅ Active |
| Ollama — light tier | PD (10.5.30.6) | 11434 | ✅ Active |
| Ollama — heavy tier | Rocinante (10.5.30.112) | 11434 | ✅ Reachable from N.O.M.A.D.; re-validated 2026-05-27 |
| Reranker (TEI) | Serenity (10.5.30.5) | 9787 | ✅ Active |

OpenClaw is no longer treated as an active PD service in the operator inventory. Only helper-artifact references remain under the school-intake planning docs.

## DNS / network control plane

| Service | Host | Port | Status |
|---------|------|------|--------|
| Technitium primary source node | PD (`10.5.30.8` via `technitium-pilot` macvlan stack) | 53 / 5380 | ⚠️ Container is running, but this pass did not directly verify the admin HTTP path because the service is not host-published and simple LAN-side `:5380` probes did not answer |
| Nebula Sync | PD | container-only | ⚠️ Container is present but currently reports `unhealthy`; re-check before treating old Pi-hole sync as healthy |

## Media (PD)

| Service | Port | Status |
|---------|------|--------|
| Plex | 32400 | ✅ Active |
| Tautulli | 8181 | ✅ Active |
| Audiobookshelf | 13358 | ✅ Active |
| Calibre-Web | 8183 | ✅ Active |
| Seerr (Overseerr) | 5055 | ✅ Active |

## Productivity / Home (PD)

| Service | Port | Status |
|---------|------|--------|
| Immich | 2283 | ✅ Active |
| Paperless-NGX | 8083 | ✅ Active; DOCX/Office ingestion via internal Tika + Gotenberg sidecars |
| Karakeep | 3100 | ✅ Active |
| n8n | 5678 | ✅ Active |
| Doris Dashboard | 8787 | ✅ Active on N.O.M.A.D. behind Pangolin -> Traefik -> Authentik at `https://doris.paccoco.com` |
| KitchenOwl | 8086 | ✅ Active |
| DoneTick | 2021 | ✅ Active |
| Dakboard Bridge | 5087 | ✅ Active |
| Qui | 7476 | ✅ Active |
| Dispatcharr | 9191 | ✅ Active |

## Smart Home (PD)

| Service | Port | Status |
|---------|------|--------|
| Home Assistant | 8123 | ✅ Active; Doris still treats this as manual until a stable operator-safe route exists from N.O.M.A.D. |
| Kima Hub | 3333 | ✅ Active |

## Monitoring (PD)

| Service | Port | Status |
|---------|------|--------|
| Grafana | 3000 | ✅ Active |
| Prometheus | 9090 | ✅ Active |
| Loki | internal | ✅ Active |
| Promtail | internal | ✅ Active |
| cAdvisor | internal | ✅ Active |
| MeshMonitor | 8081 | ✅ Active |

## Radio / Mesh

| Service | Host | Port | Status |
|---------|------|------|--------|
| MeshCore to MQTT relay | N.O.M.A.D. (10.5.30.7) | outbound MQTT only | ✅ Running as Docker container `mctomqtt` (`mctomqtt:latest`); config bind-mounted from `/etc/mctomqtt` |

## Local file intake

| Service | Host | Port | Status |
|---------|------|------|--------|
| LocalSend Trusted Inbox | N.O.M.A.D. (`10.5.1.16` on Trusted VLAN 51) | 53317/tcp+udp | ✅ Repo-tracked Docker stack at `/opt/localsend-nomad`; advertises `Doris Trusted Inbox`; writes directly into `/home/fizzlepoof/private/inbox-secrets`; Minerva auto-sort watches that inbox via `minerva-localsend-autosort.path`; same-host checks from N.O.M.A.D. are unreliable because of macvlan isolation |

## Mapping / Geo (PD)

| Service | Port | Status |
|---------|------|--------|
| TileServer GL | 8082 | ✅ Active |

## Game Servers (N.O.M.A.D. — 10.5.30.7)

| Service | Port | URL | Status | Notes |
|---------|------|-----|--------|-------|
| Pelican Panel | 80 / 443 | https://panel.paccoco.com | ✅ Active | For local health/probe use `http://10.5.30.7:8080`; local TLS path is self-signed and `panel.paccoco.com` resolves to `127.0.0.1` on N.O.M.A.D. |
| Wings Node API | 8443 / 443 | https://node1.paccoco.com | ✅ Active | `401` from the public endpoint is expected and means the daemon is reachable/auth-protected |
| Minecraft Server 25565 | 25565/tcp+udp | managed via Pelican | ✅ Active | Wings-managed Java server |
| Minecraft Server 25566 | 25566/tcp+udp | managed via Pelican | ✅ Active | Wings-managed Java/NeoForge server |