oikos/containers/131-teddycloud.md

131 — teddycloud

Open-source replacement server for Toniebox smart audio devices (Tonieboxes). Serves device content and API on port 443 and exposes a management web UI at teddy.hubris.network.

At a glance

• Hostname: teddycloud
• IP: 192.168.8.214 (DHCP reservation)
• Privilege: privileged
• Resources: 1 core / 1 GiB RAM / 16 GiB rootfs (Debian 12)
• Mounts: /mnt/library (mp0) — TeddyCloud content at /mnt/library/cloud/leon
• Public hostname: none (LAN-only)

Role

Replaces the Boxine cloud (prod.de.bb-online.com) as the backend for Leon's Toniebox. Tonieboxes connect on port 443 using a custom CA cert issued by TeddyCloud. Content (Tonies) is stored on the NAS at /mnt/library/cloud/leon and is accessible from the management UI.

Service / port map

Service	Listen	Notes
TeddyCloud device API	0.0.0.0:443	HTTPS, TeddyCloud self-signed CA, Toniebox connects here
TeddyCloud HTTP	0.0.0.0:80	Redirects to 443
TeddyCloud web UI	0.0.0.0:8080	HTTP management UI — fronted by Caddy at teddy.hubris.network
TeddyCloud web UI (HTTPS)	0.0.0.0:8443	HTTPS management UI (direct, not Caddy-fronted)

Docker Compose

/opt/teddycloud/docker-compose.yml:

services:
  teddycloud:
    image: ghcr.io/toniebox-reverse-engineering/teddycloud:latest
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
      - "8443:8443"
    volumes:
      - certs:/teddycloud/certs
      - config:/teddycloud/config
      - /mnt/library/cloud/leon:/teddycloud/content
      - /mnt/library/cloud/leon:/teddycloud/library
    restart: unless-stopped

volumes:
  certs:
  config:

certs and config are Docker named volumes (runtime state). content and library are bind-mounted from /mnt/library/cloud/leon so audio content persists across container rebuilds and is browsable from the host.

Storage / config paths

• /opt/teddycloud/docker-compose.yml — compose file
• Docker volume teddycloud_certs — TeddyCloud CA + server certs (generated on first boot)
• Docker volume teddycloud_config — TeddyCloud config
• /mnt/library/cloud/leon/ — Tonie content + library (NAS bind mount)

Networking

Two separate traffic paths — different IPs, no port 443 conflict:

Management UI (browser):

teddy.hubris.network → Technitium → 192.168.8.175 (Caddy) → 192.168.8.214:8080

Toniebox device traffic:

prod.de.bb-online.com → Technitium override → 192.168.8.214:443 (TeddyCloud direct)

Caddy terminates TLS for the management UI (IONOS DNS-01 wildcard cert). TeddyCloud terminates TLS for device traffic with its own self-signed CA — the Toniebox must have this CA installed.

DNS overrides in Technitium

Record	Type	Value	Purpose
teddy.hubris.network	A	192.168.8.175	Management UI → Caddy (standard pattern)
prod.de.bb-online.com	A	192.168.8.214	Toniebox device traffic → TeddyCloud direct

The prod.de.bb-online.com override is Technitium-only — it intercepts Toniebox DNS locally without touching public DNS. The dns-sync.py cron on LXC 107 skips non-hubris.network records, so it stays local.

Toniebox onboarding

To point a Toniebox at TeddyCloud:

1. Download the TeddyCloud CA cert from the web UI: Settings → TeddyCloud CA.
2. Flash it to the Toniebox via SD card or firmware patch (procedure varies by hardware generation — see upstream wiki).
3. The box resolves prod.de.bb-online.com to Technitium's override (192.168.8.214) and connects on port 443 using TeddyCloud's CA.

Related

• Caddy (121) — LAN reverse proxy (teddy.hubris.network → 192.168.8.214:8080)
• DNS (107) — Technitium A records for teddy.hubris.network and prod.de.bb-online.com
• Media permissions — NAS /mnt/library mount pattern

Changelog

2026-06-29 — provisioned

LXC 131 created (Debian 12, privileged, nesting=1). Docker installed. TeddyCloud running via Docker Compose at /opt/teddycloud/. Content bind-mounted from /mnt/library/cloud/leon. Caddy block added at teddy.hubris.network → :8080. Technitium A records: teddy.hubris.network → 192.168.8.175 (Caddy), prod.de.bb-online.com → 192.168.8.214 (device traffic direct).