koopa-admin-log/host/overview/services.md

Service overview — koopa

Diagram

flowchart TB
  subgraph Internet
    Client[Client IPv4/IPv6]
  end

  subgraph VeciGate["VeciGate (MikroTik)"]
    DNAT80["DNAT :80 → koopa:9000"]
    DNAT443["DNAT :443 → koopa:9001"]
    DNATSSH["DNAT :23235 → koopa:22"]
    DNATTOR["DNAT :8080 → koopa:8080"]
  end

  subgraph Host["openSUSE host koopa"]
    subgraph Edge["Edge on host"]
      S80["systemd http-proxy.socket :80"]
      S443["systemd https-proxy.socket :443"]
      CaddyHTTP["Caddy :9000 HTTP\nACME + redirect"]
      CaddyHTTPS["Caddy :9001 HTTPS"]
      FW["firewalld public\n9000,9001,80,8080,ssh"]
    end

    subgraph Podman["podman rootless (hernani)"]
      Merch["taler-hacktivism\n:9010"]
      Exch["taler-exchange-hacktivism\n:9011"]
      Bank["taler-bank-hacktivism\n:9012"]
      Castopod["koopa-castopod\n:9020"]
      Bonfire["koopa-bonfire\n:9021"]
      Prime["koopa-prime jellyfin\n:9022"]
      BT["qbittorrent\n:9023"]
      Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
    end

    Tor["tor ORPort :8080"]
    SSH["sshd :22"]
  end

  Client --> DNAT80 --> CaddyHTTP
  Client --> DNAT443 --> CaddyHTTPS
  Client --> DNATSSH --> SSH
  Client --> DNATTOR --> Tor

  S80 --> CaddyHTTP
  S443 --> CaddyHTTPS

  CaddyHTTP -->|"/.well-known"| ACME["/var/www/acme"]
  CaddyHTTP -->|other| Redir[301 HTTPS]
  CaddyHTTPS -->|taler.hacktivism.ch| Merch
  CaddyHTTPS -->|exchange.hacktivism.ch| Exch
  CaddyHTTPS -->|bank.hacktivism.ch| Bank
  CaddyHTTPS -->|castopod.hacktivism.ch| Castopod
  CaddyHTTPS -->|bonfire.hacktivism.ch| Bonfire
  CaddyHTTPS -->|prime.hacktivism.ch| Prime
  CaddyHTTPS -->|bt.hacktivism.ch| BT
  CaddyHTTPS -->|git.hacktivism.ch| Forgejo

Port table

Port	Listener	Backend / notes
22	sshd	LAN; WAN via 23235
80	systemd socket	→ 127.0.0.1:9000
443	systemd socket	→ 127.0.0.1:9001
9000	caddy	HTTP + ACME
9001	caddy	HTTPS vhosts
9010	podman	merchant nginx
9011	podman	exchange httpd
9012	podman	bank libeufin
9020	podman	castopod
9021	podman	bonfire
9022	podman	jellyfin (prime)
9023	podman	qbittorrent (bt)
9024	podman	forgejo HTTP → git.hacktivism.ch
9200	podman	forgejo git-SSH (host-direct)
8080	tor	ORPort

Full port notes: configs/ports.md.

Service index (details elsewhere)

Service	Detail docs
Caddy	host/caddy/, configs/caddy/
firewalld	host/firewalld/
systemd proxies	host/systemd/
Merchant container	configs/taler-merchant/, scripts/taler-merchant/
Exchange container	configs/taler-exchange/, scripts/taler-exchange/
Forgejo rootless	configs/forgejo/, 2026/2026-07-10--forgejo-rootless.md
Tor monitoring scripts	scripts/monitoring/
VeciGate NAT	../vecigate-admin-log/ip/firewall/nat/