docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable
This commit is contained in:
Hernâni Marques
commit
96961f23f5
268 changed files with 24161 additions and 0 deletions
16
host/README.md
Normal file
16
host/README.md
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
# openSUSE host `koopa`
|
||||
|
||||
OS: **openSUSE Tumbleweed** · hostname **koopa** · LAN `192.168.100.95/24` · public AAAA on `eno1`
|
||||
|
||||
This directory holds **host-level** config only (systemd, firewalld, Caddy, network).
|
||||
Application configs stay under `configs/taler-*` and `scripts/`.
|
||||
|
||||
| Path | Content |
|
||||
|------|---------|
|
||||
| `overview/` | Service map (diagram + table) |
|
||||
| `systemd/` | socket proxies + caddy drop-in |
|
||||
| `firewalld/` | public zone dump |
|
||||
| `caddy/` | live Caddyfile |
|
||||
| `network/` | addressing notes |
|
||||
|
||||
Edge router: **VeciGate** (`../vecigate-admin-log`).
|
||||
185
host/caddy/Caddyfile
Normal file
185
host/caddy/Caddyfile
Normal file
|
|
@ -0,0 +1,185 @@
|
|||
# Internal only (not in the browser URL):
|
||||
# 9010 merchant API | 9011 exchange API | 9012 bank API
|
||||
# 9013 bank landing | 9014 exchange landing | 9015 merchant landing
|
||||
# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | | 9200 forgejo-ssh
|
||||
# 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
|
||||
|
||||
{
|
||||
email info+koopa@hacktivism.ch
|
||||
http_port 9000
|
||||
https_port 9001
|
||||
auto_https disable_redirects
|
||||
# Caddy listens on 9001 behind VeciGate/https-proxy :443.
|
||||
# Default HTTP/3 would send Alt-Svc: h3=":9001" — break public HTTPS on :443.
|
||||
servers {
|
||||
protocols h1 h2
|
||||
}
|
||||
}
|
||||
|
||||
(proxy_public) {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Port 443
|
||||
header_down Location "^https?://[^/]+:90[0-9]{2}(.*)$" "https://{host}$1"
|
||||
}
|
||||
|
||||
taler.hacktivism.ch {
|
||||
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9015 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# SPA: /webui → /webui/
|
||||
redir /webui /webui/ 302
|
||||
|
||||
# Merchant API + WebUI (nginx :9010 → unix socket)
|
||||
reverse_proxy https://127.0.0.1:9010 {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
exchange.hacktivism.ch {
|
||||
tls /etc/caddy/certs/exchange.hacktivism.ch/fullchain.pem /etc/caddy/certs/exchange.hacktivism.ch/privkey.pem
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9014 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:9011 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
bank.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
|
||||
# Public landing first
|
||||
redir / /intro/ 302
|
||||
|
||||
handle /intro* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
# Static terms/privacy on landing nginx :9013
|
||||
handle /terms* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
handle /privacy* {
|
||||
reverse_proxy 127.0.0.1:9013 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:9012 {
|
||||
import proxy_public
|
||||
}
|
||||
}
|
||||
|
||||
castopod.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9020 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
}
|
||||
}
|
||||
|
||||
bonfire.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9021 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
prime.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9022 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
flush_interval -1
|
||||
}
|
||||
}
|
||||
|
||||
bt.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9023 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
}
|
||||
}
|
||||
|
||||
# 9024 forgejo HTTP (SSH :9200 host-direct, not via Caddy)
|
||||
git.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9024 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
flush_interval -1
|
||||
transport http {
|
||||
read_timeout 3600s
|
||||
write_timeout 3600s
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# Taler Operations design previews (static nginx)
|
||||
tops.ng1.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9090 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
}
|
||||
|
||||
tops.ng2.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9091 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
}
|
||||
|
||||
tops.ng3.hacktivism.ch {
|
||||
header Alt-Svc "clear"
|
||||
reverse_proxy 127.0.0.1:9092 {
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-For {remote_host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
}
|
||||
|
||||
http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
|
||||
handle /.well-known/acme-challenge/* {
|
||||
root * /var/www/acme
|
||||
file_server
|
||||
}
|
||||
handle {
|
||||
redir https://{host}{uri} permanent
|
||||
}
|
||||
}
|
||||
19
host/caddy/README.md
Normal file
19
host/caddy/README.md
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# Host Caddy
|
||||
|
||||
Live: `/etc/caddy/Caddyfile` on koopa (root/`caddy` group).
|
||||
Canonical mirror in this repo: **`configs/caddy/Caddyfile`** (same content as `host/caddy/Caddyfile`).
|
||||
|
||||
| Listen | Role |
|
||||
|--------|------|
|
||||
| **9000** | HTTP + ACME webroot + HTTPS redirect |
|
||||
| **9001** | HTTPS vhosts |
|
||||
|
||||
Public sites: `taler` / `exchange` / `bank` / `castopod` / `bonfire` / `prime` / `bt` / **`git`** / **`paivana`** / tops.ng*.
|
||||
Forgejo HTTP: Caddy → `127.0.0.1:9024`. Git SSH is **host :9200** (not Caddy).
|
||||
|
||||
Validate/reload on host:
|
||||
|
||||
```bash
|
||||
sudo caddy validate --config /etc/caddy/Caddyfile
|
||||
sudo systemctl reload caddy
|
||||
```
|
||||
18
host/firewalld/README.md
Normal file
18
host/firewalld/README.md
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
# firewalld (zone `public`, interface `eno1`)
|
||||
|
||||
## Open ports (current)
|
||||
|
||||
| Port | Purpose |
|
||||
|------|---------|
|
||||
| 80/tcp | systemd → Caddy HTTP 9000 |
|
||||
| 9000/tcp | Caddy HTTP (VeciGate WAN:80) |
|
||||
| 9001/tcp | Caddy HTTPS (VeciGate WAN:443) |
|
||||
| 8080/tcp | Tor OR |
|
||||
| 23235/tcp | (legacy list; SSH is service `ssh` on 22) |
|
||||
| services | `ssh`, `dhcpv6-client` |
|
||||
|
||||
## Removed
|
||||
|
||||
- 443/tcp, 8082/tcp — obsolete after 9000-series DNAT
|
||||
|
||||
Live dump: `list-all.txt`.
|
||||
19
host/firewalld/list-all.txt
Normal file
19
host/firewalld/list-all.txt
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
public (default, active)
|
||||
target: default
|
||||
ingress-priority: 0
|
||||
egress-priority: 0
|
||||
icmp-block-inversion: no
|
||||
interfaces: eno1
|
||||
sources:
|
||||
services: dhcpv6-client ssh
|
||||
ports: 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp
|
||||
protocols:
|
||||
forward: yes
|
||||
masquerade: no
|
||||
forward-ports:
|
||||
source-ports:
|
||||
icmp-blocks:
|
||||
rich rules:
|
||||
|
||||
# Snapshot note (2026-07-10): 9200/tcp = Forgejo git-SSH (verified open).
|
||||
# Re-export as root: firewall-cmd --list-all > host/firewalld/list-all.txt
|
||||
10
host/network/README.md
Normal file
10
host/network/README.md
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
# Network
|
||||
|
||||
| Interface | Address | Role |
|
||||
|-----------|---------|------|
|
||||
| eno1 | 192.168.100.95/24 | LAN (default route via VeciGate) |
|
||||
| eno1 | 2a02:168:53a8::/64 (dynamic) | Global IPv6 (AAAA for taler/exchange) |
|
||||
| lo | 127.0.0.1 | local |
|
||||
|
||||
SSH: LAN `:22`, WAN via VeciGate `23235` → `:22`.
|
||||
Tor ORPort: `:8080` (WAN DNAT on VeciGate).
|
||||
104
host/overview/LIVE.md
Normal file
104
host/overview/LIVE.md
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
# Live inventory — koopa (2026-07-13)
|
||||
|
||||
Snapshot of **what runs on host koopa** (openSUSE Tumbleweed). No secrets.
|
||||
|
||||
Refresh command ideas:
|
||||
|
||||
```bash
|
||||
hostname; date -R
|
||||
podman ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'
|
||||
systemctl is-active caddy
|
||||
systemctl --user is-active container-koopa-tor-relay
|
||||
ss -lntp | grep -E '90[0-9]{2}|9200|8080'
|
||||
```
|
||||
|
||||
## Host
|
||||
|
||||
| Item | Value |
|
||||
|------|--------|
|
||||
| Hostname | `koopa` |
|
||||
| Role | App host behind VeciGate (WAN :80→9000, :443→9001) |
|
||||
| Edge | Caddy **9000/9001**, systemd socket proxies **80/443** |
|
||||
| Tor | **podman `koopa-tor-relay`** (host net) ORPort **8080** dual-stack, ControlPort **127.0.0.1:9051** — not host `tor.service` |
|
||||
|
||||
## Running podman containers
|
||||
|
||||
| Name | Image | Ports (host) | Public site |
|
||||
|------|--------|--------------|-------------|
|
||||
| `taler-hacktivism` | `localhost/taler-hacktivism-live:landing` | **9010**, **9015** | `taler.hacktivism.ch` |
|
||||
| **`taler-hacktivism-exchange-ansible`** | `localhost/taler-hacktivism-exchange-ansible:landing` | **9011**, **9014** | `exchange.hacktivism.ch` |
|
||||
| `taler-hacktivism-bank` | **`localhost/taler-hacktivism-banking:live`** | **9012**, **9013** | `bank.hacktivism.ch` |
|
||||
| `koopa-castopod` (+ mariadb, redis) | `castopod/castopod:1` | **9020** | `castopod.hacktivism.ch` |
|
||||
| `koopa-bonfire` (+ postgres) | `bonfire:1.0.5-social-amd64` | **9021** | `bonfire.hacktivism.ch` |
|
||||
| `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` |
|
||||
| `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` |
|
||||
| `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
|
||||
| **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) |
|
||||
| `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` |
|
||||
| `koopa-tops-ng2` | `nginx` | **9091** | `tops.ng2.hacktivism.ch` |
|
||||
| `koopa-tops-ng3` | `nginx` | **9092** | `tops.ng3.hacktivism.ch` |
|
||||
|
||||
### Naming note (exchange)
|
||||
|
||||
Live exchange container is **`taler-hacktivism-exchange-ansible`** (not `taler-hacktivism-exchange-ansible` / not without `-ansible`).
|
||||
Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exchange-ansible/`).
|
||||
|
||||
## Caddy vhosts → backends
|
||||
|
||||
| Host | Backend |
|
||||
|------|---------|
|
||||
| `taler.hacktivism.ch` | 9010 (API) + 9015 (`/intro`) |
|
||||
| `exchange.hacktivism.ch` | 9011 + 9014 (`/intro`) |
|
||||
| `bank.hacktivism.ch` | 9012 + 9013 (`/intro`, terms, privacy) |
|
||||
| `castopod.hacktivism.ch` | 9020 |
|
||||
| `bonfire.hacktivism.ch` | 9021 |
|
||||
| `prime.hacktivism.ch` | 9022 |
|
||||
| `bt.hacktivism.ch` | 9023 |
|
||||
| `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
|
||||
| `tops.ng1.hacktivism.ch` | 9090 |
|
||||
| `tops.ng2.hacktivism.ch` | 9091 |
|
||||
| `tops.ng3.hacktivism.ch` | 9092 |
|
||||
|
||||
Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
|
||||
|
||||
## Paths on host (`hernani`)
|
||||
|
||||
| Path | Role |
|
||||
|------|------|
|
||||
| `~/ansible-taler-exchange/` | Ansible + scripts for exchange-ansible container |
|
||||
| `~/koopa-castopod/` | Castopod compose |
|
||||
| `~/koopa-bonfire/` | Bonfire compose + gitbot |
|
||||
| `~/koopa-prime/` | Jellyfin + qBittorrent |
|
||||
| `~/koopa-forgejo/` | Forgejo rootless |
|
||||
| `~/koopa-tops/` | tops.ng1–ng3 (`koopa-tops-ng*`) |
|
||||
| `~/koopa-caddy/` | Caddyfile working tree on host |
|
||||
| `~/koopa-tor-relay/` | Tor relay container (torrc, data/identity, log) |
|
||||
|
||||
## Start models
|
||||
|
||||
| Stack | How |
|
||||
|-------|-----|
|
||||
| Taler merchant/bank | root `start_base_services_*` → service user → `/usr/local/bin/start_*.sh` |
|
||||
| Exchange (GOA) | `~/ansible-taler-exchange/run-container-koopa.sh` then `deploy-hacktivism-goa.sh` |
|
||||
| User apps | `cd ~/koopa-* && podman-compose up -d` |
|
||||
| tops (ng1–ng3) | user unit `container-koopa-tops.service` (linger) |
|
||||
|
||||
## Config mirrors in this repo (`configs/`)
|
||||
|
||||
| Live container | Git path |
|
||||
|----------------|----------|
|
||||
| `taler-hacktivism` | `configs/taler-hacktivism/` |
|
||||
| `taler-hacktivism-bank` (image **…-banking**) | `configs/taler-hacktivism-bank/` |
|
||||
| `taler-hacktivism-exchange-ansible` | `configs/taler-exchange-ansible/` + conf in `configs/taler-exchange/` |
|
||||
| `koopa-tops-ng1` … `ng3` | `configs/tops/` |
|
||||
|
||||
## Related docs in this repo
|
||||
|
||||
| Topic | Doc |
|
||||
|-------|-----|
|
||||
| Ports | `configs/ports.md` |
|
||||
| Diagram | `host/overview/services.md` |
|
||||
| Exchange Ansible (koopa) | `configs/taler-exchange-ansible/` |
|
||||
| Forgejo | `2026/2026-07-10--forgejo-rootless.md` |
|
||||
| Bonfire public feeds | `configs/bonfire/public-feeds.md` |
|
||||
| Castopod content | `2026/2026-07-09--castopod-content.md` |
|
||||
100
host/overview/services.md
Normal file
100
host/overview/services.md
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
# Service overview — koopa
|
||||
|
||||
**Live container/port inventory:** [`LIVE.md`](LIVE.md) (state as observed on host).
|
||||
|
||||
Diagram
|
||||
|
||||
```mermaid
|
||||
flowchart TB
|
||||
subgraph Internet
|
||||
Client[Client IPv4/IPv6]
|
||||
end
|
||||
|
||||
subgraph VeciGate["VeciGate (MikroTik)"]
|
||||
DNAT80["DNAT :80 → koopa:9000"]
|
||||
DNAT443["DNAT :443 → koopa:9001"]
|
||||
DNATSSH["DNAT :23235 → koopa:22"]
|
||||
DNATTOR["DNAT :8080 → koopa:8080"]
|
||||
end
|
||||
|
||||
subgraph Host["openSUSE host koopa"]
|
||||
subgraph Edge["Edge on host"]
|
||||
S80["systemd http-proxy.socket :80"]
|
||||
S443["systemd https-proxy.socket :443"]
|
||||
CaddyHTTP["Caddy :9000 HTTP\nACME + redirect"]
|
||||
CaddyHTTPS["Caddy :9001 HTTPS"]
|
||||
FW["firewalld public\n9000,9001,80,8080,ssh"]
|
||||
end
|
||||
|
||||
subgraph Podman["podman rootless (hernani)"]
|
||||
Merch["taler-hacktivism\n:9010"]
|
||||
Exch["taler-hacktivism-exchange-ansible\n:9011"]
|
||||
Bank["taler-bank-hacktivism\n:9012"]
|
||||
Castopod["koopa-castopod\n:9020"]
|
||||
Bonfire["koopa-bonfire\n:9021"]
|
||||
Prime["koopa-prime jellyfin\n:9022"]
|
||||
BT["qbittorrent\n:9023"]
|
||||
Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
|
||||
end
|
||||
|
||||
Tor["tor ORPort :8080"]
|
||||
SSH["sshd :22"]
|
||||
end
|
||||
|
||||
Client --> DNAT80 --> CaddyHTTP
|
||||
Client --> DNAT443 --> CaddyHTTPS
|
||||
Client --> DNATSSH --> SSH
|
||||
Client --> DNATTOR --> Tor
|
||||
|
||||
S80 --> CaddyHTTP
|
||||
S443 --> CaddyHTTPS
|
||||
|
||||
CaddyHTTP -->|"/.well-known"| ACME["/var/www/acme"]
|
||||
CaddyHTTP -->|other| Redir[301 HTTPS]
|
||||
CaddyHTTPS -->|taler.hacktivism.ch| Merch
|
||||
CaddyHTTPS -->|exchange.hacktivism.ch| Exch
|
||||
CaddyHTTPS -->|bank.hacktivism.ch| Bank
|
||||
CaddyHTTPS -->|castopod.hacktivism.ch| Castopod
|
||||
CaddyHTTPS -->|bonfire.hacktivism.ch| Bonfire
|
||||
CaddyHTTPS -->|prime.hacktivism.ch| Prime
|
||||
CaddyHTTPS -->|bt.hacktivism.ch| BT
|
||||
CaddyHTTPS -->|git.hacktivism.ch| Forgejo
|
||||
```
|
||||
|
||||
## Port table
|
||||
|
||||
| Port | Listener | Backend / notes |
|
||||
|------|----------|-----------------|
|
||||
| 22 | sshd | LAN; WAN via 23235 |
|
||||
| 80 | systemd socket | → 127.0.0.1:**9000** |
|
||||
| 443 | systemd socket | → 127.0.0.1:**9001** |
|
||||
| 9000 | caddy | HTTP + ACME |
|
||||
| 9001 | caddy | HTTPS vhosts |
|
||||
| 9010 | podman | **merchant** nginx |
|
||||
| 9011 | podman | **exchange** httpd |
|
||||
| 9012 | podman | **bank** libeufin |
|
||||
| 9020 | podman | **castopod** |
|
||||
| 9021 | podman | **bonfire** |
|
||||
| 9022 | podman | **jellyfin** (prime) |
|
||||
| 9023 | podman | **qbittorrent** (bt) |
|
||||
| **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
|
||||
| **9200** | podman | **forgejo** git-SSH (host-direct) |
|
||||
| 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
|
||||
| 8080 | tor | ORPort |
|
||||
|
||||
Full port notes: `configs/ports.md`.
|
||||
|
||||
## Service index (details elsewhere)
|
||||
|
||||
| Service | Detail docs |
|
||||
|---------|-------------|
|
||||
| Caddy | `host/caddy/`, `configs/caddy/` |
|
||||
| firewalld | `host/firewalld/` |
|
||||
| systemd proxies | `host/systemd/` |
|
||||
| Merchant container | `configs/taler-hacktivism/`, `scripts/taler-merchant/` |
|
||||
| Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` |
|
||||
| **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` |
|
||||
| tops (`koopa-tops-ng*`) | `configs/tops/` |
|
||||
| Tor relay (`koopa-tor-relay` podman) | `configs/tor/`, `host/tor/` |
|
||||
| Tor monitoring scripts | `scripts/monitoring/` |
|
||||
| VeciGate NAT | `../vecigate-admin-log/ip/firewall/nat/` |
|
||||
24
host/overview/services.txt
Normal file
24
host/overview/services.txt
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
Internet
|
||||
|
|
||||
+-------------+-------------+
|
||||
| VeciGate |
|
||||
| :80→9000 :443→9001 |
|
||||
| :23235→22 :8080→8080 |
|
||||
+-------------+-------------+
|
||||
|
|
||||
koopa 192.168.100.95
|
||||
|
|
||||
+----------------------+----------------------+
|
||||
| | |
|
||||
systemd Caddy other
|
||||
:80 → 9000 :9000 HTTP sshd :22
|
||||
:443 → 9001 :9001 HTTPS tor :8080
|
||||
| |
|
||||
+----------+-----------+
|
||||
|
|
||||
+-------+--------+
|
||||
| |
|
||||
:9010 merchant :9011 exchange
|
||||
(nginx TLS) (httpd TCP)
|
||||
| |
|
||||
unix sock postgres/secmods
|
||||
13
host/systemd/README.md
Normal file
13
host/systemd/README.md
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# systemd units (host)
|
||||
|
||||
| Unit | Role |
|
||||
|------|------|
|
||||
| `caddy.service` | reverse proxy (drop-in: no `--resume`) |
|
||||
| `http-proxy.socket` | bind **:80** → `systemd-socket-proxyd` → `127.0.0.1:9000` |
|
||||
| `https-proxy.socket` | bind **:443** → `systemd-socket-proxyd` → `127.0.0.1:9001` |
|
||||
| `https-proxy@.service` | template: `systemd-socket-proxyd 127.0.0.1:%i` |
|
||||
| `firewalld.service` | host firewall |
|
||||
| `sshd.service` | SSH |
|
||||
| `tor.service` | Tor relay (ORPort 8080) |
|
||||
|
||||
Privileged ports 80/443 are held by **systemd**, not by Caddy (Caddy listens on 9000/9001 as user `caddy`).
|
||||
3
host/systemd/caddy.service.d-no-resume.conf
Normal file
3
host/systemd/caddy.service.d-no-resume.conf
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
|
||||
11
host/systemd/http-proxy.socket
Normal file
11
host/systemd/http-proxy.socket
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
[Unit]
|
||||
Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
|
||||
|
||||
[Socket]
|
||||
ListenStream=0.0.0.0:80
|
||||
ListenStream=[::]:80
|
||||
BindIPv6Only=yes
|
||||
Service=https-proxy@9000.service
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
11
host/systemd/https-proxy.socket
Normal file
11
host/systemd/https-proxy.socket
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
[Unit]
|
||||
Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
|
||||
|
||||
[Socket]
|
||||
ListenStream=0.0.0.0:443
|
||||
ListenStream=[::]:443
|
||||
BindIPv6Only=yes
|
||||
Service=https-proxy@9001.service
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
5
host/systemd/https-proxy@.service
Normal file
5
host/systemd/https-proxy@.service
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
[Unit]
|
||||
Description=Proxy for incoming HTTPS traffic to port %i
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i
|
||||
27
host/tor/README.md
Normal file
27
host/tor/README.md
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# Tor on koopa
|
||||
|
||||
**Runtime:** podman **`koopa-tor-relay`** (not host `tor.service`).
|
||||
**Config mirror:** `configs/tor/` (`torrc`, Containerfile, migrate script, user unit).
|
||||
**Data/identity:** `~/koopa-tor-relay/data` (same keys as former `/var/lib/tor`).
|
||||
|
||||
| Port | Bind | Role |
|
||||
|------|------|------|
|
||||
| **8080** | `0.0.0.0` + `[::]` | ORPort (dual-stack) |
|
||||
| **9051** | `127.0.0.1` | ControlPort (nyx / stem) |
|
||||
|
||||
Non-exit relay (`ExitRelay 0`, `SocksPort 0`).
|
||||
|
||||
### Root checklist
|
||||
|
||||
```bash
|
||||
sudo systemctl disable --now tor
|
||||
sudo systemctl mask tor
|
||||
# linger already required for rootless user units:
|
||||
# sudo loginctl enable-linger hernani
|
||||
```
|
||||
|
||||
### User unit
|
||||
|
||||
```bash
|
||||
systemctl --user enable --now container-koopa-tor-relay.service
|
||||
```
|
||||
Loading…
Add table
Add a link
Reference in a new issue