# CapeRadar home lab and project inventory

> Operational documentation. Current facts are verified on 2026-11-04 (ADT); recovered or earlier conversation notes are explicitly historical. No credentials, tokens, keys, or passwords belong on this page.

## Architecture

The home lab is centred on Proxmox host **pve02** (`192.168.4.100`). Public web applications run on Alpine VM **195**, `webapps-alpine` (`10.169.0.10`).

`Internet → Cloudflare DNS/HTTPS/WAF/cache → proxmox_tunnel → webapps-cloudflared on VM 195 → service bound to 10.169.0.10 → isolated Docker network → application`

Production services are managed together from **`/docker/deployment/compose.yaml` on VM 195** under the `webapps` Compose project. Update an existing app through that file; do not use a repository-local Compose file to create a competing production stack.

> Historical correction: older notes refer to LXC 169 as the tunnel connector. CT 169 no longer exists. The active public connector is the `webapps-cloudflared` Docker container on VM 195.

VM 195 normally reaches the private bridge through `eth0` and gateway `10.169.0.1`. Avoid adding a second LAN default route: a temporary `eth1` previously caused asymmetric tunnel-to-origin routing.

## Current production applications

| Service | Public hostname / origin | Notes |
|---|---|---|
| SynthWeb | `synth.caperadar.org`; `10.169.0.10:8181 → 8080` | Zyn Web synthesizer. |
| YamahaWeb | `cs30.caperadar.org`; `10.169.0.10:8484 → 8080` | CS-30 Web Model; explicit secure-origin settings. |
| Guitarstar | `fretboard.caperadar.org`; `10.169.0.10:8380 → 80` | Fretboard Studio; feedback uses its internal SMTP relay. |
| Gold Seal | `tuner.caperadar.org`; `10.169.0.10:8480 → 8081` | Browser tuner served by Caddy’s tunnel-specific HTTP config. |
| Pocket Band | `band.caperadar.org`; `10.169.0.10:8580 → 5173` | Frontend plus worker share an image; preserve `/srv/pocket-band/data` mounted at `/data`. |
| 606 Drums | `606.caperadar.org`; `10.169.0.10:6060 → 80` | 606-inspired browser drum machine. |
| CapeRadar Home | `10.169.0.10:8088 → 80` | Music launcher/home page; confirm public route in Cloudflare when changing it. |
| DopeWars | `dopewars.caperadar.org`; `10.169.0.10:8787 → 8787` | Neon Wars multiplayer; persistent data at `/srv/dopewars`. |
| Tetrinet | `tetrinet.caperadar.org`; `10.169.0.10:8980 → 8090` | Multiplayer service. |
| PirateBrowser | `10.169.0.10:8880 → 8080` | Crown & Cutlass/pirate web application. |
| Nightshift DJ | `10.169.0.10:8680 → 80` | Browser DJ app; health check enabled. |
| AcidStack / AcidStack Zyn | Loopback: `127.0.0.1:9180` / `127.0.0.1:9380` | Not confirmed as public services. |
| YouSync | Loopback: `127.0.0.1:9280` | Persistent state at `/srv/yousync`; not confirmed public. |

Most services use `restart: unless-stopped`, `no-new-privileges`, rotating JSON logs (10 MiB × 3), dropped capabilities/read-only filesystems where practical, and separate Compose networks.

## Deployment and cache conventions

1. Identify the VM checkout and current commit. Preserve local production edits.
2. Update/transfer the intended source. VM 195’s egress policy may prevent direct LAN Git access.
3. From `/docker/deployment`, rebuild only the target service: `doas docker compose up -d --build <service>`.
4. Check that service and make one focused public workflow check.
5. Never use `docker compose down` to update one service. For Pocket Band, update both frontend and worker.

Six established music services retain immutable content-versioned assets below `/_v/<release-digest>/…`. HTML/legacy URLs revalidate; immutable static files have long cache lifetimes. Do not overwrite an existing version URL or prematurely prune old asset releases: open browser tabs may still load lazy assets. Use narrow Cloudflare purges when necessary; do not cache HTML, APIs, or mutable fixed-name assets as “cache everything”.

New public services should bind specifically to `10.169.0.10:<port>`, be added narrowly to the connector allow-list, be tested from the connector path, then receive a verified Cloudflare tunnel hostname. Do not expose a new container on all interfaces by default.

## Platform services

| Role | Current placement / note |
|---|---|
| Wiki | Wiki.js runs in **CT 202**. |
| Git | Gitea (CT 175) and Forgejo (CT 177). |
| Security | Vaultwarden (CT 140), 2FAuth (CT 130), Unbound secondary (CT 192), Cloudflare/CrowdSec controls. |
| Monitoring | Grafana/Netdata workspaces and Prometheus PVE exporter (CT 167). |
| AI | Open WebUI (CT 159), AnythingLLM (CT 193), offlineAI project. |
| Other services | Navidrome, Immich, bookorbit, ROMM, ntfy, linkding, Actual Budget, and media/download tools run as separate LXC workloads. |
| Headscale | Runs on Google Cloud VM `gcp01`; never operate two writable instances against the same SQLite state/Noise keys. |

## Cloudflare OpenTelemetry receiver

`otel.caperadar.org` is **not** a general public application. It is a protected OTLP log-ingestion receiver:

`Cloudflare Worker security logs → otel.caperadar.org/v1/logs → homelab-otel tunnel → authenticated NGINX gateway on 192.168.4.160 → Alloy → Loki/Grafana`

It was introduced for the CrowdSec/404-guard Worker’s application and invocation logs. Unauthenticated public requests are rejected. It has no direct host port and should not contain credentials in this wiki. Removing the tunnel or receiver will stop this logging pipeline and impair the associated Grafana dashboard.

## Build workspace catalogue

`/home/nmacneil/build` is a source/work library, not a deployment manifest. Presence of a directory does **not** mean it is live.

### Audio and browser music

- **Deployed/public:** `synthweb`, `yamahaweb`, `goldseal`, `guitarstar`, `bandinaboxweb`, `606-Inspired-Synth-Drums`, and Nightshift from `webdj`.
- **Browser audio R&D:** `acidstack-cloud` and `acidstack-zyn` (recent work targets a C++/WebAssembly audio core to reduce dropouts), `pedalweb`, `CapeDSP`, `NeuralAmpModelerPlugin`, `vst-ready-pack`, `flstudio-docker`, and `0700-AAM`.

### Games, media and community apps

- `dopewars-web` and `dopewars-multiplayer-dependabot-evaluation`: Neon Wars multiplayer.
- `tetrinet`: deployed multiplayer service.
- `webpirates` / `PirateBrowser`: Crown & Cutlass application.
- `caperadar.org`: CapeRadar homepage.
- `nodecast-tv`, `subwebster`, `videoTranslatorExtenstion`, `crawl-fb`, `steam-headless`: retained media/game experiments or infrastructure.

### Networking, systems and operations

- `cloudflared_local`: Cloudflare/tunnel/cache/deployment reference and evidence.
- `crowdsec-gcp-cloudflare`: CrowdSec Worker/bouncer and summaries.
- `OpenBSD-WRT`: OpenBSD router appliance; portability and public-beta work.
- `luci-app-vpngate`, `androidvpngate`, `vpngate-replit`, `random-vpn`: VPN Gate/OpenWrt/Android tooling.
- `netdata*`, `grafana*`, `beszel`, `ntop-blacklist-digest`: monitoring and dashboards.
- `zfstui`, `proxtui`, `portsweb`, `fwbuilder`, `router-on-a-stick`, `dns-bench`, `telerisc`: storage, Proxmox, LAN, firewall, DNS, and diagnostics tools.

### Android, mobile, firmware and reverse engineering

- `iodeos-s5`, `nethunters5neo`, `s5neo-android10`, `s5neo-lineage15`, `s5neo-lineage16-android9`, `s5neoroms`: S5 Neo iodéOS, LineageOS, NetHunter kernel, and ROM environments.
- `galaxy-prime-kernel`, `twrp-j337w`, `sm-j327w`, `odin4`: Samsung kernel/recovery/flash work.
- `androidrecon`, `commando-vm`, `rea`, `wiiumod`, `gopher64-core`: security/reverse-engineering/emulation sources.

### Research and utilities

`ai-debater`, `offlineAI`, `appgenerator`, `everything-server`, `history-server`, `mitt`, `clirm`, `robotui`, `diskscan`, `diskscangrok`, `restic-windows-backup`, `capematrix`, `crypto prediction`, `worldmonitor-conflict-predictor`, `rtl-airband`, `rustspace`, `tdf`, `witchcraft`, and other retained folders are experiments, tools, forks, or references. Consult each repository README and Git history before deployment.

## Operational cautions

- Never store secrets, passwords, API keys, tunnel tokens, SMTP credentials, Headscale keys, or Wiki.js credentials in this wiki.
- Prefer current live inspection, production Compose, and current repository history over recovered notes.
- Preserve persistent data: Pocket Band, DopeWars, YouSync, retained static asset releases, and Headscale’s complete stopped state directory (including WAL files for backups).
- Recheck Cloudflare ingress, source commit, service health, and connector-to-origin reachability before a production change.