104 lines
3.4 KiB
Markdown
104 lines
3.4 KiB
Markdown
# Service overview — koopa
|
||
|
||
**Live container/port inventory:** [`LIVE.md`](LIVE.md) (state as observed on host).
|
||
|
||
Diagram
|
||
|
||
```mermaid
|
||
flowchart TB
|
||
subgraph Internet
|
||
Client[Client IPv4/IPv6]
|
||
end
|
||
|
||
subgraph VeciGate["VeciGate (MikroTik)"]
|
||
DNAT80["DNAT :80 → koopa:9000"]
|
||
DNAT443["DNAT :443 → koopa:9001"]
|
||
DNATSSH["DNAT :23235 → koopa:22"]
|
||
DNATTOR["DNAT :8080 → koopa:8080"]
|
||
end
|
||
|
||
subgraph Host["openSUSE host koopa"]
|
||
subgraph Edge["Edge on host"]
|
||
S80["systemd http-proxy.socket :80"]
|
||
S443["systemd https-proxy.socket :443"]
|
||
CaddyHTTP["Caddy :9000 HTTP\nACME + redirect"]
|
||
CaddyHTTPS["Caddy :9001 HTTPS"]
|
||
FW["firewalld public\n9000,9001,80,8080,ssh"]
|
||
end
|
||
|
||
subgraph Podman["podman rootless (hernani)"]
|
||
Merch["taler-hacktivism\n:9010"]
|
||
Exch["taler-hacktivism-exchange-ansible\n:9011"]
|
||
Bank["taler-bank-hacktivism\n:9012"]
|
||
Castopod["koopa-castopod\n:9020"]
|
||
Bonfire["koopa-bonfire\n:9021"]
|
||
Prime["koopa-prime jellyfin\n:9022"]
|
||
BT["qbittorrent\n:9023"]
|
||
Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
|
||
Paivana["koopa-paivana\n:9025"]
|
||
end
|
||
|
||
Tor["tor ORPort :8080"]
|
||
SSH["sshd :22"]
|
||
end
|
||
|
||
Client --> DNAT80 --> CaddyHTTP
|
||
Client --> DNAT443 --> CaddyHTTPS
|
||
Client --> DNATSSH --> SSH
|
||
Client --> DNATTOR --> Tor
|
||
|
||
S80 --> CaddyHTTP
|
||
S443 --> CaddyHTTPS
|
||
|
||
CaddyHTTP -->|"/.well-known"| ACME["/var/www/acme"]
|
||
CaddyHTTP -->|other| Redir[301 HTTPS]
|
||
CaddyHTTPS -->|taler.hacktivism.ch| Merch
|
||
CaddyHTTPS -->|exchange.hacktivism.ch| Exch
|
||
CaddyHTTPS -->|bank.hacktivism.ch| Bank
|
||
CaddyHTTPS -->|castopod.hacktivism.ch| Castopod
|
||
CaddyHTTPS -->|bonfire.hacktivism.ch| Bonfire
|
||
CaddyHTTPS -->|prime.hacktivism.ch| Prime
|
||
CaddyHTTPS -->|bt.hacktivism.ch| BT
|
||
CaddyHTTPS -->|git.hacktivism.ch| Forgejo
|
||
CaddyHTTPS -->|paivana.hacktivism.ch| Paivana
|
||
```
|
||
|
||
## Port table
|
||
|
||
| Port | Listener | Backend / notes |
|
||
|------|----------|-----------------|
|
||
| 22 | sshd | LAN; WAN via 23235 |
|
||
| 80 | systemd socket | → 127.0.0.1:**9000** |
|
||
| 443 | systemd socket | → 127.0.0.1:**9001** |
|
||
| 9000 | caddy | HTTP + ACME |
|
||
| 9001 | caddy | HTTPS vhosts |
|
||
| 9010 | podman | **merchant** nginx |
|
||
| 9011 | podman | **exchange** httpd |
|
||
| 9012 | podman | **bank** libeufin |
|
||
| 9020 | podman | **castopod** |
|
||
| 9021 | podman | **bonfire** |
|
||
| 9022 | podman | **jellyfin** (prime) |
|
||
| 9023 | podman | **qbittorrent** (bt) |
|
||
| **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
|
||
| **9025** | podman | **paivana** → `paivana.hacktivism.ch` |
|
||
| **9200** | podman | **forgejo** git-SSH (host-direct) |
|
||
| 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
|
||
| 8080 | tor | ORPort |
|
||
|
||
Full port notes: `configs/ports.md`.
|
||
|
||
## Service index (details elsewhere)
|
||
|
||
| Service | Detail docs |
|
||
|---------|-------------|
|
||
| Caddy | `host/caddy/`, `configs/caddy/` |
|
||
| firewalld | `host/firewalld/` |
|
||
| systemd proxies | `host/systemd/` |
|
||
| Merchant container | `configs/taler-hacktivism/`, `scripts/taler-merchant/` |
|
||
| Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` |
|
||
| **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` |
|
||
| Paivana paywall | `configs/paivana/` |
|
||
| tops (`koopa-tops-ng*`) | `configs/tops/` |
|
||
| Tor relay (`koopa-tor-relay` podman) | `configs/tor/`, `host/tor/` |
|
||
| Tor monitoring scripts | `scripts/monitoring/` |
|
||
| VeciGate NAT | `../vecigate-admin-log/ip/firewall/nat/` |
|