# Port map (koopa)

| Port | Role |
|------|------|
| 22 | sshd (WAN often via VeciGate 23235) |
| 80 | systemd `http-proxy.socket` → Caddy **9000** |
| 443 | systemd `https-proxy.socket` → Caddy **9001** |
| 9000 | Caddy HTTP + ACME webroot |
| 9001 | Caddy HTTPS (vhosts) |
| **9010** | `goa-regio-ng` merchant API (HTTPS in CTR) |
| **9011** | `goa-regio-ng` exchange |
| **9012** | `goa-regio-ng` libeufin-bank |
| **9013–9015** | bank / exchange / merchant public landings (host nginx) |
| 9020 | `koopa-castopod` → `castopod.hacktivism.ch` |
| 9021 | `koopa-bonfire` → `bonfire.hacktivism.ch` |
| 9022 | `koopa-prime` (Jellyfin) → `prime.hacktivism.ch` |
| 9023 | qBittorrent → `bt.hacktivism.ch` |
| **9024** | `koopa-forgejo` (HTTP) → **`git.hacktivism.ch`** |
| **9025** | `koopa-paivana` → `paivana.hacktivism.ch` |
| **9026** | `koopa-lemmy-proxy` → `lemmy.hacktivism.ch` |
| **9027** | `koopa-decidim` → `decidim.hacktivism.ch` |
| **9028** | `koopa-paivana-silverbullet` → `silverbullet.hacktivism.ch` |
| **9029** | `koopa-paivana-galene` → `galene.hacktivism.ch` |
| **9030** | `koopa-paivana-cryptpad` → `cryptpad.hacktivism.ch` |
| **9031** | `koopa-paivana-meet` → `meet.hacktivism.ch` |
| **9032** | `koopa-bbb-front` → `bbb.hacktivism.ch` |
| **9200** | Forgejo git-SSH (host-direct; not Caddy) |
| 9090–9092 | `koopa-tops-ng1`…`ng3` → `tops.ng{1,2,3}.hacktivism.ch` |
| **8080** | host `tor.service` ORPort |
| **9051** | host Tor ControlPort (loopback) |

VeciGate: WAN **80→9000**, WAN **443→9001**.  
Public apps: Caddy on **9001** → 127.0.0.1:{9010–9015, 9020–9032, 9090–9092}.  
Git SSH needs **9200/tcp** if exposed to WAN.

| UDP range | Role |
|-----------|------|
| **10000–10099/udp** | Galene WebRTC |

| Extra | Role |
|-------|------|
| **1789** | `koopa-nym` mixnet |
| **1790** | `koopa-nym` verloc |
| **9080** | `koopa-nym` HTTP API |
| **9180** | lab `goa-regio-ng` HTTP (loopback; `configs/lab-local/`) |
| **9322** | lab `goa-regio-ng` SSH/ansible (loopback) |
| **8288** | lab `mytops-local` HTTP (loopback) |

login-health inventory: `scripts/login-health/koopa-login-health.sh`.