dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

docs(teddycloud): correct IP, port, disable boxCertAuth, ESP32 onboarding

Browse Source 
Real IP is 192.168.8.243 (not .214). Web UI is on port 8443 HTTPS,
not 8080. Caddy backend uses tls_insecure_skip_verify. boxCertAuth
disabled so ESP32 Toniebox connects without client cert extraction.
Added SD card onboarding steps for Leon's ESP32 box.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-29 22:13:11 +02:00
parent 77b3a6f677
commit a45e4f6f29
3 changed files with 25 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
containers/131-teddycloud.md
View File

@@ -5,7 +5,7 @@ Open-source replacement server for Toniebox smart audio devices (Tonieboxes). Se
## At a glance
- **Hostname:** `teddycloud`
- **IP:** `192.168.8.214` (DHCP reservation)
- **IP:** `192.168.8.243` (DHCP reservation; MAC `bc:24:11:11:7a:df`)
- **Privilege:** privileged
- **Resources:** 1 core / 1 GiB RAM / 16 GiB rootfs (Debian 12)
- **Mounts:** `/mnt/library` (`mp0`) — TeddyCloud content at `/mnt/library/cloud/leon`
@@ -21,8 +21,7 @@ Replaces the Boxine cloud (`prod.de.bb-online.com`) as the backend for Leon's To
|---------|--------|-------|
| TeddyCloud device API | `0.0.0.0:443` | HTTPS, TeddyCloud self-signed CA, Toniebox connects here |
| TeddyCloud HTTP | `0.0.0.0:80` | Redirects to 443 |
| TeddyCloud web UI | `0.0.0.0:8080` | HTTP management UI — fronted by Caddy at `teddy.hubris.network` |
| TeddyCloud web UI (HTTPS) | `0.0.0.0:8443` | HTTPS management UI (direct, not Caddy-fronted) |
| TeddyCloud web UI | `0.0.0.0:8443` | HTTPS management UI — fronted by Caddy at `teddy.hubris.network` (backend uses `tls_insecure_skip_verify` for self-signed cert on LAN hop) |
## Docker Compose
@@ -35,7 +34,6 @@ services:
ports:
- "80:80"
- "443:443"
- "8080:8080"
- "8443:8443"
volumes:
- certs:/teddycloud/certs
@@ -64,12 +62,12 @@ Two separate traffic paths — different IPs, no port 443 conflict:
**Management UI (browser):**
```
teddy.hubris.network → Technitium → 192.168.8.175 (Caddy) → 192.168.8.214:8080
teddy.hubris.network → Technitium → 192.168.8.175 (Caddy) → 192.168.8.243:8443
```
**Toniebox device traffic:**
```
prod.de.bb-online.com → Technitium override → 192.168.8.214:443 (TeddyCloud direct)
prod.de.bb-online.com → Technitium override → 192.168.8.243:443 (TeddyCloud direct)
```
Caddy terminates TLS for the management UI (IONOS DNS-01 wildcard cert). TeddyCloud terminates TLS for device traffic with its own self-signed CA — the Toniebox must have this CA installed.
@@ -79,21 +77,31 @@ Caddy terminates TLS for the management UI (IONOS DNS-01 wildcard cert). TeddyCl
| Record | Type | Value | Purpose |
|--------|------|-------|---------|
| `teddy.hubris.network` | A | `192.168.8.175` | Management UI → Caddy (standard pattern) |
| `prod.de.bb-online.com` | A | `192.168.8.214` | Toniebox device traffic → TeddyCloud direct |
| `prod.de.bb-online.com` | A | `192.168.8.243` | Toniebox device traffic → TeddyCloud direct |
The `prod.de.bb-online.com` override is Technitium-only — it intercepts Toniebox DNS locally without touching public DNS. The `dns-sync.py` cron on LXC 107 skips non-`hubris.network` records, so it stays local.
## Toniebox onboarding
## Config notes
To point a Toniebox at TeddyCloud:
- `core.boxCertAuth=false` — client cert validation disabled. The box connects without presenting its unique client cert. Set in `/var/lib/docker/volumes/teddycloud_config/_data/config.ini` (TeddyCloud hot-reloads on change).
- If you ever want per-box auth, flip to `true` and supply `certs/client/ca.der`, `client.der`, `private.der` extracted from the box flash.
1. Download the TeddyCloud CA cert from the web UI: **Settings → TeddyCloud CA**.
2. Flash it to the Toniebox via SD card or firmware patch (procedure varies by hardware generation — see [upstream wiki](https://github.com/toniebox-reverse-engineering/teddycloud/wiki)).
3. The box resolves `prod.de.bb-online.com` to Technitium's override (`192.168.8.214`) and connects on port 443 using TeddyCloud's CA.
## Toniebox onboarding — ESP32 SD card method
Leon's box is ESP32 generation. No hardware mod required.
1. Download the TeddyCloud CA cert from the web UI: **Security → CA Certificate → Download CA** (`ca.der`).
2. Power off the Toniebox, remove the SD card.
3. On the SD card, create folder `cert/` at the root.
4. Copy the downloaded `ca.der` into `cert/ca.der` on the SD card.
5. Reinsert SD card, power on the box.
6. The box patches itself to trust TeddyCloud's CA, then resolves `prod.de.bb-online.com` via Technitium's override (`192.168.8.243`) and connects on port 443.
Reference: [upstream wiki — ESP32 SD card method](https://github.com/toniebox-reverse-engineering/teddycloud/wiki).
## Related
- [Caddy (121)](121-caddy.md) — LAN reverse proxy (`teddy.hubris.network → 192.168.8.214:8080`)
- [Caddy (121)](121-caddy.md) — LAN reverse proxy (`teddy.hubris.network → 192.168.8.243:8443`)
- [DNS (107)](../infrastructure/dns.md) — Technitium A records for `teddy.hubris.network` and `prod.de.bb-online.com`
- [Media permissions](../infrastructure/media-permissions.md) — NAS `/mnt/library` mount pattern
@@ -101,4 +109,4 @@ To point a Toniebox at TeddyCloud:
### 2026-06-29 — provisioned
LXC 131 created (Debian 12, privileged, nesting=1). Docker installed. TeddyCloud running via Docker Compose at `/opt/teddycloud/`. Content bind-mounted from `/mnt/library/cloud/leon`. Caddy block added at `teddy.hubris.network → :8080`. Technitium A records: `teddy.hubris.network → 192.168.8.175` (Caddy), `prod.de.bb-online.com → 192.168.8.214` (device traffic direct).
LXC 131 created (Debian 12, privileged, nesting=1). Docker installed. TeddyCloud running via Docker Compose at `/opt/teddycloud/`. Content bind-mounted from `/mnt/library/cloud/leon`. Caddy block added at `teddy.hubris.network → :8443`. Technitium A records: `teddy.hubris.network → 192.168.8.175` (Caddy), `prod.de.bb-online.com → 192.168.8.243` (device traffic direct).

2
containers/index.md
View File

@@ -18,7 +18,7 @@ All containers live on [`hubris`](../hosts/hubris.md). Each row links to the per
| 128 | [trmnl](128-trmnl.md) | 192.168.8.211 | unpriv | 1 | 768 MiB | 8 GiB | — | `trmnl.hubris.network` | running |
| 129 | [house](129-house.md) | 192.168.8.212 | unpriv | 1 | 1344 MiB | 8 GiB | — | `house.hubris.network` | running |
| 130 | [grimmory](130-grimmory.md) | 192.168.8.213 | priv | 1 | 2 GiB | 16 GiB | `/mnt/library` | `books.hubris.network` | running |
| 131 | [teddycloud](131-teddycloud.md) | 192.168.8.214 | priv | 1 | 1 GiB | 16 GiB | `/mnt/library` | `teddy.hubris.network` (LAN only) | running |
| 131 | [teddycloud](131-teddycloud.md) | 192.168.8.243 | priv | 1 | 1 GiB | 16 GiB | `/mnt/library` | `teddy.hubris.network` (LAN only) | running |
## Recently destroyed (kept for archaeology)

4
infrastructure/dns.md
View File

@@ -40,7 +40,7 @@ address=/nfs-export.hubris.network/192.168.8.200
**Non-`hubris.network` override (Toniebox device traffic):**
```
address=/prod.de.bb-online.com/192.168.8.214 # → TeddyCloud (131) direct on :443
address=/prod.de.bb-online.com/192.168.8.243 # → TeddyCloud (131) direct on :443
```
This intercepts Toniebox DNS locally without touching public DNS. The `dns-sync.py` cron on LXC 107 skips non-`hubris.network` records — this entry is Technitium-only.
@@ -85,7 +85,7 @@ Either:
## Changelog
### 2026-06-29 — `teddy.hubris.network` added; `prod.de.bb-online.com` override added
TeddyCloud (LXC 131) provisioned. `teddy.hubris.network → 192.168.8.175` (Caddy → TeddyCloud web UI at :8080). Non-hubris override `prod.de.bb-online.com → 192.168.8.214` routes Toniebox device HTTPS traffic directly to TeddyCloud port 443 — this bypasses Caddy and is Technitium-only (dns-sync cron does not replicate non-hubris.network records to the NetBird managed zone).
TeddyCloud (LXC 131) provisioned. `teddy.hubris.network → 192.168.8.175` (Caddy → TeddyCloud web UI at :8443). Non-hubris override `prod.de.bb-online.com → 192.168.8.243` routes Toniebox device HTTPS traffic directly to TeddyCloud port 443 — this bypasses Caddy and is Technitium-only (dns-sync cron does not replicate non-hubris.network records to the NetBird managed zone).
### 2026-06-28 — `plato.hubris.network` removed
Plato (LXC 126) decommissioned. Technitium entry deleted; dns-sync cron reaped the NetBird managed zone record.