From 6cbf1aa7cca59d4fc8aa7a2aa23453cdcb10fd38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= <hernani+magikoopa@vecirex.net>
Date: Wed, 8 Jul 2026 21:50:37 +0200
Subject: [PATCH] docs: openSUSE host tree with service overview (Caddy/ACME
 diagram)

---
 host/overview/services.md  | 77 ++++++++++++++++++++++++++++++++++++++
 host/overview/services.txt | 24 ++++++++++++
 2 files changed, 101 insertions(+)
 create mode 100644 host/overview/services.md
 create mode 100644 host/overview/services.txt

diff --git a/host/overview/services.md b/host/overview/services.md
new file mode 100644
index 0000000..e1fbbfb
--- /dev/null
+++ b/host/overview/services.md
@@ -0,0 +1,77 @@
+# Service overview — koopa
+
+## Diagram
+
+```mermaid
+flowchart TB
+  subgraph Internet
+    Client[Client IPv4/IPv6]
+  end
+
+  subgraph VeciGate["VeciGate (MikroTik)"]
+    DNAT80["DNAT :80 → koopa:9000"]
+    DNAT443["DNAT :443 → koopa:9001"]
+    DNATSSH["DNAT :23235 → koopa:22"]
+    DNATTOR["DNAT :8080 → koopa:8080"]
+  end
+
+  subgraph Host["openSUSE host koopa"]
+    subgraph Edge["Edge on host"]
+      S80["systemd http-proxy.socket :80"]
+      S443["systemd https-proxy.socket :443"]
+      CaddyHTTP["Caddy :9000 HTTP\nACME + redirect"]
+      CaddyHTTPS["Caddy :9001 HTTPS"]
+      FW["firewalld public\n9000,9001,80,8080,ssh"]
+    end
+
+    subgraph Podman["podman (hernani)"]
+      Merch["taler-hacktivism\n:9010 nginx TLS"]
+      Exch["taler-exchange-hacktivism\n:9011 exchange-httpd"]
+    end
+
+    Tor["tor ORPort :8080"]
+    SSH["sshd :22"]
+  end
+
+  Client --> DNAT80 --> CaddyHTTP
+  Client --> DNAT443 --> CaddyHTTPS
+  Client --> DNATSSH --> SSH
+  Client --> DNATTOR --> Tor
+
+  S80 --> CaddyHTTP
+  S443 --> CaddyHTTPS
+
+  CaddyHTTP -->|"/.well-known"| ACME["/var/www/acme"]
+  CaddyHTTP -->|other| Redir[301 HTTPS]
+  CaddyHTTPS -->|taler.hacktivism.ch| Merch
+  CaddyHTTPS -->|exchange.hacktivism.ch| Exch
+
+  Merch --> MSock["unix merchant-http.sock"]
+  Exch --> EDB["postgresql + secmods"]
+```
+
+## Port table
+
+| Port | Listener | Backend / notes |
+|------|----------|-----------------|
+| 22 | sshd | LAN; WAN via 23235 |
+| 80 | systemd socket | → 127.0.0.1:**9000** |
+| 443 | systemd socket | → 127.0.0.1:**9001** |
+| 9000 | caddy | HTTP + ACME |
+| 9001 | caddy | HTTPS vhosts |
+| 9010 | podman pasta | **merchant** nginx |
+| 9011 | podman pasta | **exchange** httpd |
+| 8080 | tor | ORPort |
+
+## Service index (details elsewhere)
+
+| Service | Detail docs |
+|---------|-------------|
+| Caddy | `host/caddy/`, `configs/caddy/` |
+| firewalld | `host/firewalld/` |
+| systemd proxies | `host/systemd/` |
+| Merchant container | `configs/taler-merchant/`, `scripts/taler-merchant/` |
+| Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` |
+
+| Tor monitoring scripts | `scripts/monitoring/` |
+| VeciGate NAT | `../vecigate-admin-log/ip/firewall/nat/` |
diff --git a/host/overview/services.txt b/host/overview/services.txt
new file mode 100644
index 0000000..a37748b
--- /dev/null
+++ b/host/overview/services.txt
@@ -0,0 +1,24 @@
+                         Internet
+                            |
+              +-------------+-------------+
+              |         VeciGate          |
+              |  :80→9000  :443→9001      |
+              |  :23235→22 :8080→8080     |
+              +-------------+-------------+
+                            |
+                     koopa 192.168.100.95
+                            |
+     +----------------------+----------------------+
+     |                      |                      |
+  systemd                Caddy                  other
+  :80 → 9000            :9000 HTTP              sshd :22
+  :443 → 9001           :9001 HTTPS             tor  :8080
+     |                      |
+     +----------+-----------+
+                |
+        +-------+--------+
+        |                |
+   :9010 merchant   :9011 exchange
+   (nginx TLS)      (httpd TCP)
+        |                |
+   unix sock        postgres/secmods