matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
echo6-docs/vault/docs/software/caddy.md
echo6-autocommit 1441234ef4 auto: docs sync 2026-08-24T06:00:04+00:00 
Files changed: engine/lint-report.md vault/.obsidian/workspace.json vault/docs/services/services.md vault/docs/software/caddy.md vault/docs/software/dns.md vault/projects/meshtastic-headscale-runbook.md vault/runbooks/expose-service-contabo.md vault/runbooks/expose-service-edge2.md vault/runbooks/expose-service-home.md
2026-08-24 06:00:04 +00:00

11 KiB
Raw Blame History

title type tags aliases related updated
Caddy & DNS Reference reference
mesh
services
ip-allocation
lxc-service-migration
expose-service-edge2
authentik
2026-07-13

Caddy & DNS Reference

Migrated off Contabo → edge2 on 2026-06-19.

edge2 Caddy (front door)

Config: /etc/caddy/Caddyfile on edge2 (ssh edge2; root@<IP> is stale)

Global options: email admin@echo6.co, admin off (no live reload — must systemctl restart caddy)

Current Site Blocks

Domain Backend Service
auth.echo6.co 100.64.0.36:9000 (Tailscale, CT 105) authentik SSO
forge.echo6.co 100.64.0.34:3001 (Tailscale, CT 103) Forgejo Git
mail.echo6.co — Mailcow — moved to edge1 (separate mail-only host, 10.10.10.2:8453 via edge1's own Caddy); not on edge2
vpn.echo6.co 100.64.0.38:8084 (Tailscale, CT 107) Headscale
vpn.echo6.co/admin* 100.64.0.38:3100 (Tailscale, CT 107) Headplane
autodiscover.echo6.co — Mailcow autodiscover — moved to edge1 (10.10.10.2:8453); not on edge2
autoconfig.echo6.co — Mailcow autoconfig — moved to edge1 (10.10.10.2:8453); not on edge2
vault.echo6.co 100.64.0.33:8086 (Tailscale, CT 102) vaultwarden
proxmox.echo6.co https://100.64.0.6:8006 (via Tailscale) Proxmox VE (data node) — unchanged
wt.echo6.co — WATCHTOWER ops dashboard — decommissioned 2026-06-16 (was 100.64.0.1, now dead)
matrix.echo6.co 100.64.0.37:8008 + 100.64.0.37:8085 (Tailscale, CT 106) Matrix synapse + MAS (login/logout/refresh/auth_metadata → MAS:8085, _matrix/* → synapse:8008, default → MAS:8085)
element.echo6.co 100.64.0.37:8088 (Tailscale, CT 106) Element Web client
notes.echo6.co 100.64.0.35:5984 + 100.64.0.35:5985 (Tailscale, CT 104) LiveSync (CouchDB + provisioner, forward auth on /_provision*, CORS for Obsidian)
tak.echo6.co — TAK Server admin + SIGIL console — decommissioned 2026-06-16 (was 100.64.0.1, now dead)

Commands

ssh edge2
caddy validate --config /etc/caddy/Caddyfile
systemctl restart caddy  # admin off, so reload won't work
journalctl -u caddy -f

Utility Caddy (Home)

Location: CT 101 on utility Proxmox (192.168.1.101) Tailscale IP: 100.64.0.8 Config: /etc/caddy/Caddyfile inside CT 101 SSL Certs: /etc/caddy/certs/ (managed by acme.sh) Port forward: Router 80/443 → 192.168.1.101

Current Site Blocks

Domain Backend Pattern Service
mesh.echo6.co 192.168.1.100:8080 Local IP meshmonitor (authentik forward auth)
echo6.co 100.64.0.15:8080 Tailscale Echo6 Search (searxng) + Matrix well-known
search.echo6.co — — 301 redirect to echo6.co
nas.echo6.co 100.64.0.21:80 Tailscale OpenMediaVault (pi-nas)
immich.echo6.co 192.168.1.182:2283 Local IP immich (has 2FA)
nextcloud.echo6.co 192.168.1.183:11000 Local IP nextcloud AIO (SSO via Authentik)
jellyfin.echo6.co 100.64.0.18:8096 Tailscale Jellyfin media server (SSO via Authentik)
requests.echo6.co 100.64.0.18:5055 Tailscale Jellyseer request management (SSO via Authentik)
stream.echo6.co 192.168.1.170:80 Local IP peertube video streaming (SSO via Authentik)
ai.echo6.co 100.64.0.14:8080 Tailscale Open WebUI (SSO via Authentik)
files.echo6.co 100.64.0.24:8888 Tailscale recon PDF library (Authentik forward auth)
recon.echo6.co 100.64.0.24:8420 Tailscale recon dashboard + API
lidarr.echo6.co 100.64.0.18:8686 Tailscale lidarr music automation (Authentik forward auth)
navidrome.echo6.co 100.64.0.18:4533 Tailscale navidrome music server (Authentik forward auth, /rest/* exempt for Subsonic API)
vpn.idahomesh.com 192.168.1.106:8080 Local IP IdahoMesh Headscale VPN coordination
mwpreview.k7zvx.com 100.64.0.39:8090 Tailscale MeshWars public preview (CT 113, feat/places branch; /admin + /api/admin/* blocked -- 404 -- on this public host, reachable only over tailnet)

Commands

ssh root@192.168.1.241 'pct exec 101 -- cat /etc/caddy/Caddyfile'
ssh root@192.168.1.241 'pct exec 101 -- systemctl reload caddy'
ssh root@192.168.1.241 'pct exec 101 -- journalctl -u caddy -f'

dnsmasq (Tailscale Split DNS) — HISTORICAL / OBSOLETE

Not in use. Tailnet split-DNS for echo6.co was retired: echo6.co now resolves via public GoDaddy dns, not internal dnsmasq (see services). This section documents the OLD setup that ran on the original Contabo VPS (100.64.0.1) before its 2026-06-19 rebuild into edge1 (mail-only). That host and its 100.64.0.1 tailnet identity are dead — do not repoint these records to edge1 or edge2; kept below for historical reference only.

Config: /etc/dnsmasq.d/tailscale-dns.conf on Contabo (dead host, pre-2026-06-19) Listens on: 100.64.0.1:53 (dead)

Current Records

Domain Tailscale IP Service
auth.echo6.co 100.64.0.1 Authentik
forge.echo6.co 100.64.0.1 Forgejo
mail.echo6.co 100.64.0.1 Mailcow
vpn.echo6.co 100.64.0.1 Headscale
vault.echo6.co 100.64.0.1 Vaultwarden
proxmox.echo6.co 100.64.0.1 Proxmox VE (via Caddy)
stream.echo6.co 100.64.0.8 PeerTube (via Utility Caddy)
notes.echo6.co 100.64.0.1 LiveSync CouchDB + provisioner (via Contabo Caddy)
tak.echo6.co 100.64.0.1 TAK Server + SIGIL (via Contabo Caddy)
jellyfin.echo6.co 100.64.0.8 Jellyfin (via utility Caddy)
requests.echo6.co 100.64.0.8 Jellyseer (via utility Caddy)
wt.echo6.co 100.64.0.1 WATCHTOWER ops dashboard
ai.echo6.co 100.64.0.8 Open WebUI (via utility Caddy)
matrix.echo6.co 100.64.0.1 Matrix synapse (via Contabo Caddy)
element.echo6.co 100.64.0.1 Element Web (via Contabo Caddy)
echo6.co 100.64.0.8 Echo6 Search homepage (via utility Caddy)
files.echo6.co 100.64.0.8 recon PDF library (via utility Caddy)
recon.echo6.co 100.64.0.8 recon dashboard (via utility Caddy)
lidarr.echo6.co 100.64.0.8 Lidarr music automation (via utility Caddy)
navidrome.echo6.co 100.64.0.8 Navidrome music server (via utility Caddy)

Commands

# HISTORICAL — host is dead, commands no longer work
ssh root@100.64.0.1
nano /etc/dnsmasq.d/tailscale-dns.conf
systemctl restart dnsmasq
dig +short forge.echo6.co @100.64.0.1   # Test

GoDaddy DNS Records (echo6.co)

edge2 Services → 184.174.35.153

Subdomain Service
auth Authentik SSO
forge Forgejo Git
vpn Headscale VPN
vault Vaultwarden
matrix Matrix Synapse
element Element Web
notes LiveSync (CouchDB + provisioner)
proxmox Proxmox VE (via Tailscale to data node)

edge1 Services (mail-only host) → 5.189.158.149

Subdomain Service
mail Mailcow Email

Decommissioned records (removed from GoDaddy, 2026-06-16)

Subdomain Service
wt WATCHTOWER ops dashboard
tak TAK Server + SIGIL

Home Services → 199.6.36.163

Subdomain Service
@ Echo6 Search homepage (searxng)
ai Open WebUI
stream PeerTube
jellyfin Jellyfin
mesh MeshMonitor
nas OpenMediaVault (pi-nas)
search searxng (redirects to echo6.co)
immich Immich
nextcloud Nextcloud
requests Jellyseer
files RECON PDF library
recon RECON dashboard
lidarr Lidarr music automation
navidrome Navidrome music server

Email Records

Type Name Value
MX @ mail.echo6.co
CNAME autoconfig mail.echo6.co
CNAME autodiscover mail.echo6.co
TXT @ v=spf1 mx a:mail.echo6.co -all
TXT _dmarc v=DMARC1; p=quarantine
TXT dkim._domainkey (DKIM key)

Headscale Config

Location: /opt/headscale/ on edge2 (CT 107, managed via headscale-stack.service systemd reboot guard) Data: Named Docker volume headscale_headscale-data Config: /opt/headscale/config.yaml

dns:
  base_domain: echo6.mesh
  nameservers:
    global:
      - 1.1.1.1

oidc:
  issuer: "https://auth.echo6.co/application/o/headscale/"
  client_id: "headscale"

Split dns: Previously configured via dnsmasq on Contabo (pre-2026-06-19). Not verified on edge2/edge1 in this pass — flagged stale/unresolved; see ## dnsmasq (Tailscale Split DNS) section below (also unverified). Headplane: Deployed at vpn.echo6.co/admin - OIDC via Authentik. First login gets Owner.

Port Map (edge2)

Service Container Port Host Binding (Tailscale) Public Domain
Authentik 9000 100.64.0.36:9000 (CT 105) auth.echo6.co
Forgejo 3000 100.64.0.34:3001 (CT 103) forge.echo6.co
Forgejo SSH 22 edge2 iptables DNAT :2222 → 100.64.0.34:2222 (CT 103) Direct (not proxied)
Headscale 8080 100.64.0.38:8084 (CT 107) vpn.echo6.co
Headplane 3000 100.64.0.38:3100 (CT 107) vpn.echo6.co/admin
Vaultwarden 80 100.64.0.33:8086 (CT 102) vault.echo6.co
Vaultwarden WS 3012 100.64.0.33:3012 (CT 102) vault.echo6.co/notifications/hub
WATCHTOWER 8084 — wt.echo6.co — decommissioned 2026-06-16
Matrix Synapse 8008 100.64.0.37:8008 (CT 106) matrix.echo6.co (/_matrix/, /_synapse/)
Matrix MAS 8080 100.64.0.37:8085 (CT 106) matrix.echo6.co (login/logout/refresh/auth_metadata, default)
Element Web 80 100.64.0.37:8088 (CT 106) element.echo6.co
LiveSync CouchDB 5984 100.64.0.35:5984 (CT 104) notes.echo6.co
LiveSync Provisioner 8080 100.64.0.35:5985 (CT 104) notes.echo6.co/_provision/*
TAK Server Admin 8446 — tak.echo6.co — decommissioned 2026-06-16
SIGIL Console 8990 — tak.echo6.co/sigil — decommissioned 2026-06-16

Port Map (edge1 — mail-only, separate host)

Service Container Port Host Binding Public Domain
Mailcow 8453 10.10.10.2:8453 (CT 101, via edge1 host Caddy + DNAT) mail.echo6.co, autodiscover.echo6.co, autoconfig.echo6.co

Last updated: 2026-07-11 — Flip off Contabo completed: "Contabo Caddy" section → "edge2 Caddy" (front door for auth/forge/vpn/vault/matrix/element/notes/proxmox, CTs verified against ip-allocation/services); Mailcow + autodiscover/autoconfig moved to edge1 (separate mail-only host, not on edge2); WATCHTOWER + TAK/SIGIL marked decommissioned (dead 100.64.0.1 backends removed); Headscale config location + Port Map updated to edge2; ssh root@100.64.0.1 → ssh edge2. dnsmasq split-DNS section marked HISTORICAL/OBSOLETE (echo6.co split-DNS retired, ran on the dead pre-2026-06-19 Contabo host, not repointed to edge1/edge2 per services); GoDaddy DNS Records section corrected — edge2 services (auth/forge/vpn/vault/matrix/element/notes/proxmox) → 184.174.35.153, mail → edge1 5.189.158.149 (unchanged public IP), wt/tak marked as removed records. Prior: 2026-04-13 — Audit sync: added MAS routing on matrix.echo6.co, lidarr/navidrome/vpn.idahomesh.com to utility Caddy, proxmox/tak to GoDaddy, removed ghost docs.echo6.co entries, added dnsmasq lidarr/navidrome