oikos/containers/131-teddycloud.md

131 — teddycloud

Open-source replacement server for Toniebox smart audio devices (Tonieboxes). Serves device content and API on port 443 and exposes a management web UI at teddy.hubris.network.

At a glance

• Hostname: teddycloud
• IP: 192.168.8.243 (DHCP reservation; MAC bc:24:11:11:7a:df)
• Privilege: privileged
• Resources: 1 core / 1 GiB RAM / 16 GiB rootfs (Debian 12)
• Mounts: /mnt/library (mp0) — TeddyCloud content at /mnt/library/cloud/leon
• Public hostname: none (LAN-only)

Role

Replaces the Boxine cloud (prod.de.bb-online.com) as the backend for Leon's Toniebox. Tonieboxes connect on port 443 using a custom CA cert issued by TeddyCloud. Content (Tonies) is stored on the NAS at /mnt/library/cloud/leon and is accessible from the management UI.

Service / port map

Service	Listen	Notes
TeddyCloud device API	0.0.0.0:443	HTTPS, TeddyCloud self-signed CA, Toniebox connects here
TeddyCloud HTTP	0.0.0.0:80	Redirects to 443
TeddyCloud web UI	0.0.0.0:8443	HTTPS management UI — fronted by Caddy at teddy.hubris.network (backend uses tls_insecure_skip_verify for self-signed cert on LAN hop)

Docker Compose

/opt/teddycloud/docker-compose.yml:

services:
  teddycloud:
    image: ghcr.io/toniebox-reverse-engineering/teddycloud:latest
    ports:
      - "80:80"
      - "443:443"
      - "8443:8443"
    volumes:
      - certs:/teddycloud/certs
      - config:/teddycloud/config
      - /mnt/library/cloud/leon:/teddycloud/content
      - /mnt/library/cloud/leon:/teddycloud/library
    restart: unless-stopped

volumes:
  certs:
  config:

certs and config are Docker named volumes (runtime state). content and library are bind-mounted from /mnt/library/cloud/leon so audio content persists across container rebuilds and is browsable from the host.

Storage / config paths

• /opt/teddycloud/docker-compose.yml — compose file
• Docker volume teddycloud_certs — TeddyCloud CA + server certs (generated on first boot)
• Docker volume teddycloud_config — TeddyCloud config
• /mnt/library/cloud/leon/ — Tonie content + library (NAS bind mount)

Networking

Two separate traffic paths — different IPs, no port 443 conflict:

Management UI (browser):

teddy.hubris.network → Technitium → 192.168.8.175 (Caddy) → 192.168.8.243:8443

Toniebox device traffic:

prod.de.bb-online.com → Technitium override → 192.168.8.243:443 (TeddyCloud direct)

Caddy terminates TLS for the management UI (IONOS DNS-01 wildcard cert). TeddyCloud terminates TLS for device traffic with its own self-signed CA — the Toniebox must have this CA installed.

DNS overrides in Technitium

Record	Type	Value	Purpose
teddy.hubris.network	A	192.168.8.175	Management UI → Caddy (standard pattern)
prod.de.bb-online.com	A	192.168.8.243	Toniebox device traffic → TeddyCloud direct

The prod.de.bb-online.com override is Technitium-only — it intercepts Toniebox DNS locally without touching public DNS. The dns-sync.py cron on LXC 107 skips non-hubris.network records, so it stays local.

Config notes

• core.boxCertAuth=false — client cert validation disabled. The box connects without presenting its unique client cert. Set in /var/lib/docker/volumes/teddycloud_config/_data/config.ini (TeddyCloud hot-reloads on change).
• If you ever want per-box auth, flip to true and supply certs/client/ca.der, client.der, private.der extracted from the box flash.

Toniebox onboarding — ESP32 SD card method

Leon's box is ESP32 generation. No hardware mod required.

1. Download the TeddyCloud CA cert from the web UI: Security → CA Certificate → Download CA (ca.der).
2. Power off the Toniebox, remove the SD card.
3. On the SD card, create folder cert/ at the root.
4. Copy the downloaded ca.der into cert/ca.der on the SD card.
5. Reinsert SD card, power on the box.
6. The box patches itself to trust TeddyCloud's CA, then resolves prod.de.bb-online.com via Technitium's override (192.168.8.243) and connects on port 443.

Reference: upstream wiki — ESP32 SD card method.

Related

• Caddy (121) — LAN reverse proxy (teddy.hubris.network → 192.168.8.243:8443)
• DNS (107) — Technitium A records for teddy.hubris.network and prod.de.bb-online.com
• Media permissions — NAS /mnt/library mount pattern

Changelog

2026-06-29 — provisioned

LXC 131 created (Debian 12, privileged, nesting=1). Docker installed. TeddyCloud running via Docker Compose at /opt/teddycloud/. Content bind-mounted from /mnt/library/cloud/leon. Caddy block added at teddy.hubris.network → :8443. Technitium A records: teddy.hubris.network → 192.168.8.175 (Caddy), prod.de.bb-online.com → 192.168.8.243 (device traffic direct).