b5c1bf7591
Capture what is actually running on host koopa: podman names/ports, Caddy vhosts, and hernani paths. Authoritative snapshot: host/overview/LIVE.md. Rename docs to live container taler-hacktivism-exchange-ansible (not the short taler-exchange-hacktivism label). Add public-only mirror of ~/ansible-taler-exchange deploy helpers (no secrets.yml).
3.1 KiB
3.1 KiB
Service overview — koopa
Live container/port inventory: LIVE.md (state as observed on host).
Diagram
flowchart TB
subgraph Internet
Client[Client IPv4/IPv6]
end
subgraph VeciGate["VeciGate (MikroTik)"]
DNAT80["DNAT :80 → koopa:9000"]
DNAT443["DNAT :443 → koopa:9001"]
DNATSSH["DNAT :23235 → koopa:22"]
DNATTOR["DNAT :8080 → koopa:8080"]
end
subgraph Host["openSUSE host koopa"]
subgraph Edge["Edge on host"]
S80["systemd http-proxy.socket :80"]
S443["systemd https-proxy.socket :443"]
CaddyHTTP["Caddy :9000 HTTP\nACME + redirect"]
CaddyHTTPS["Caddy :9001 HTTPS"]
FW["firewalld public\n9000,9001,80,8080,ssh"]
end
subgraph Podman["podman rootless (hernani)"]
Merch["taler-hacktivism\n:9010"]
Exch["taler-hacktivism-exchange-ansible\n:9011"]
Bank["taler-bank-hacktivism\n:9012"]
Castopod["koopa-castopod\n:9020"]
Bonfire["koopa-bonfire\n:9021"]
Prime["koopa-prime jellyfin\n:9022"]
BT["qbittorrent\n:9023"]
Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
end
Tor["tor ORPort :8080"]
SSH["sshd :22"]
end
Client --> DNAT80 --> CaddyHTTP
Client --> DNAT443 --> CaddyHTTPS
Client --> DNATSSH --> SSH
Client --> DNATTOR --> Tor
S80 --> CaddyHTTP
S443 --> CaddyHTTPS
CaddyHTTP -->|"/.well-known"| ACME["/var/www/acme"]
CaddyHTTP -->|other| Redir[301 HTTPS]
CaddyHTTPS -->|taler.hacktivism.ch| Merch
CaddyHTTPS -->|exchange.hacktivism.ch| Exch
CaddyHTTPS -->|bank.hacktivism.ch| Bank
CaddyHTTPS -->|castopod.hacktivism.ch| Castopod
CaddyHTTPS -->|bonfire.hacktivism.ch| Bonfire
CaddyHTTPS -->|prime.hacktivism.ch| Prime
CaddyHTTPS -->|bt.hacktivism.ch| BT
CaddyHTTPS -->|git.hacktivism.ch| Forgejo
Port table
| Port | Listener | Backend / notes |
|---|---|---|
| 22 | sshd | LAN; WAN via 23235 |
| 80 | systemd socket | → 127.0.0.1:9000 |
| 443 | systemd socket | → 127.0.0.1:9001 |
| 9000 | caddy | HTTP + ACME |
| 9001 | caddy | HTTPS vhosts |
| 9010 | podman | merchant nginx |
| 9011 | podman | exchange httpd |
| 9012 | podman | bank libeufin |
| 9020 | podman | castopod |
| 9021 | podman | bonfire |
| 9022 | podman | jellyfin (prime) |
| 9023 | podman | qbittorrent (bt) |
| 9024 | podman | forgejo HTTP → git.hacktivism.ch |
| 9200 | podman | forgejo git-SSH (host-direct) |
| 8080 | tor | ORPort |
Full port notes: configs/ports.md.
Service index (details elsewhere)
| Service | Detail docs |
|---|---|
| Caddy | host/caddy/, configs/caddy/ |
| firewalld | host/firewalld/ |
| systemd proxies | host/systemd/ |
| Merchant container | configs/taler-merchant/, scripts/taler-merchant/ |
| Exchange container | configs/taler-exchange/, scripts/taler-exchange/ |
| Forgejo rootless | configs/forgejo/, 2026/2026-07-10--forgejo-rootless.md |
Tor relay (tor.service) |
configs/tor/, host/tor/ |
| Tor monitoring scripts | scripts/monitoring/ |
| VeciGate NAT | ../vecigate-admin-log/ip/firewall/nat/ |