467 lines
13 KiB
YAML
467 lines
13 KiB
YAML
# Homelab inventory — canonical structured topology.
|
|
#
|
|
# Single source of truth. hosts/*.yaml is generated from this file by
|
|
# mcp/build_host_files.py; do NOT edit those by hand.
|
|
#
|
|
# Conventions:
|
|
# - hostname keys MUST match the actual `hostname` of the machine (on
|
|
# macOS: `scutil --get LocalHostName` if set).
|
|
# - `os:` one of: linux, macos
|
|
# - `kind:` one of: proxmox-host, lxc, vm, workstation, external
|
|
# ("external" is reserved for hosts the homelab CLI manages via ssh but
|
|
# that aren't homelab clients themselves — e.g. the IONOS netbird VPS
|
|
# with no /etc/age/key.txt and no /opt/homelab-context clone.)
|
|
# - `mesh:` lists addresses the host is reachable at. Both `netbird` and
|
|
# `tailscale` are accepted during the migration (see infrastructure/mesh.md).
|
|
# Prefer netbird FQDNs over raw IPs.
|
|
# - `age_pubkey:` provisioned by secrets-issuance on first bootstrap and
|
|
# committed back via `homelab client add --finalize-pubkey <key>`.
|
|
# - When a service moves hosts, update only the `services:` section here;
|
|
# never duplicate addresses elsewhere.
|
|
# - `ssh.user:` per-host login user. Default is `root` if omitted (matches
|
|
# every LXC + the PVE host). Set explicitly for workstations whose login
|
|
# user differs from `root`. Used by the `homelab` CLI to build
|
|
# `user@host` and to inform anyone running raw `netbird ssh` (which
|
|
# defaults to the LOCAL username — the gotcha that creates "user not
|
|
# found" errors when ssh'ing INTO machines that only have `root`).
|
|
#
|
|
# `homelab client add/remove` does surgical line-edits — comments survive.
|
|
# Avoid round-tripping the file through yaml.safe_dump (it strips comments).
|
|
|
|
mesh:
|
|
primary: netbird
|
|
accepted:
|
|
- netbird
|
|
- tailscale
|
|
netbird_subnet: 100.122.0.0/16
|
|
netbird_domain: netbird.selfhosted
|
|
services:
|
|
proxmox_ui:
|
|
url: https://proxmox.hubris.network
|
|
backend: hubris
|
|
port: 8006
|
|
gitea:
|
|
url: https://git.hubris.network
|
|
backend: gitea
|
|
backend_url: http://192.168.8.121:3000
|
|
caddy:
|
|
backend: caddy
|
|
role: reverse-proxy
|
|
note: terminates all *.hubris.network
|
|
authentik:
|
|
url: https://auth.hubris.network
|
|
backend: authentik
|
|
dns:
|
|
backend: dns
|
|
note: Technitium DNS, split-horizon zone
|
|
jellyfin:
|
|
url: https://media.hubris.network
|
|
backend: jellyfin
|
|
nextcloud:
|
|
url: https://cloud.hubris.network
|
|
backend: nextcloud
|
|
paperless:
|
|
url: https://paperless.hubris.network
|
|
backend: paperless
|
|
matrix:
|
|
url: https://matrix.hubris.network
|
|
backend: elementsynapse
|
|
photos:
|
|
url: https://photos.hubris.network
|
|
backend: mule-images
|
|
arr_stack:
|
|
backend: arriman
|
|
note: jellyseerr / qbit / sab on docker compose
|
|
artifacto:
|
|
backend: apps
|
|
url: https://artifacto.hubris.network
|
|
trmnl:
|
|
backend: trmnl
|
|
url: https://trmnl.hubris.network
|
|
note: self-hosted middleware for TRMNL e-ink plugins (polled by TRMNL cloud)
|
|
zimaos:
|
|
url: https://zimaos.hubris.network
|
|
backend: zimaos
|
|
haos:
|
|
backend: haos
|
|
homelab_mcp:
|
|
backend: apps
|
|
port: 9810
|
|
systemd_unit: homelab-mcp
|
|
public_host: mcp.hubris.network
|
|
endpoint: https://mcp.hubris.network/mcp
|
|
note: MCP server. Read-only context + management. Reachable on the LAN via Caddy
|
|
and from off-LAN via Netbird (192.168.8.0/24 is a network resource routed through
|
|
hubris).
|
|
secrets_issuance:
|
|
backend: apps
|
|
port: 9820
|
|
systemd_unit: secrets-issuance
|
|
public_host: secrets.hubris.network
|
|
endpoint: https://secrets.hubris.network/issue
|
|
note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN
|
|
subnets in MESH_SUBNETS).
|
|
hosts:
|
|
hubris:
|
|
kind: proxmox-host
|
|
os: linux
|
|
role: hypervisor
|
|
lan_ip: 192.168.8.77
|
|
mesh:
|
|
netbird:
|
|
ip: 100.122.38.109
|
|
fqdn: proxmox-server.netbird.selfhosted
|
|
ssh:
|
|
port: 22
|
|
netbird_port: 22022
|
|
user: root
|
|
mounts:
|
|
- /mnt/library
|
|
age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
|
|
trmnl:
|
|
kind: lxc
|
|
pve_id: 128
|
|
host: hubris
|
|
os: linux
|
|
role: trmnl-middleware
|
|
lan_ip: 192.168.8.211
|
|
public_host: trmnl.hubris.network
|
|
# not yet mesh/SOPS-enrolled — see containers/128-trmnl.md
|
|
house:
|
|
kind: lxc
|
|
pve_id: 129
|
|
host: strong
|
|
os: linux
|
|
role: family-planner
|
|
lan_ip: 192.168.8.244
|
|
public_host: house.hubris.network
|
|
notes:
|
|
- Docker host for Yuvomi (family planner). Created 2026-06-26.
|
|
- Migrated from hubris to strong 2026-07-05 (Phase 1 of strong migration plan).
|
|
- Runs Yuvomi container + WebDAV doc bridge to paperless
|
|
- 192.168.8.212 was the hubris IP before migration (now used by teddycloud via DHCP)
|
|
age_pubkey: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
|
|
jellyfin:
|
|
kind: lxc
|
|
pve_id: 101
|
|
host: strong
|
|
os: linux
|
|
role: media-server
|
|
lan_ip: 192.168.8.246
|
|
public_host: media.hubris.network
|
|
mesh:
|
|
tailscale:
|
|
fqdn: jellyfin
|
|
mounts:
|
|
- /mnt/media_local
|
|
notes:
|
|
- Jellyfin 10.11.11 with VAAPI hardware acceleration (Radeon 680M iGPU on strong)
|
|
- 4 cores / 8 GiB RAM / 1 GiB swap
|
|
- SSO-Auth plugin v4.0.0.4 with Authentik OIDC (no Caddy forward-auth gate)
|
|
- GPU passed via dev0+dev1: /dev/dri/renderD128 + card0
|
|
- Migrated from hubris to strong 2026-07-05 (Phase 2). Library on ludo-lvm.
|
|
age_pubkey: ''
|
|
nfs-export:
|
|
kind: lxc
|
|
pve_id: 102
|
|
host: hubris
|
|
os: linux
|
|
role: storage-export
|
|
lan_ip: 192.168.8.200
|
|
paperless:
|
|
kind: lxc
|
|
pve_id: 103
|
|
host: hubris
|
|
os: linux
|
|
role: document-archive
|
|
lan_ip: 192.168.8.130
|
|
public_host: paperless.hubris.network
|
|
mesh:
|
|
tailscale:
|
|
fqdn: paperless
|
|
mounts:
|
|
- /mnt/library
|
|
age_pubkey: ''
|
|
gitea:
|
|
kind: lxc
|
|
pve_id: 104
|
|
host: hubris
|
|
os: linux
|
|
role: git-server
|
|
lan_ip: 192.168.8.121
|
|
public_host: git.hubris.network
|
|
backend_port: 3000
|
|
mesh:
|
|
tailscale:
|
|
fqdn: gitea
|
|
mounts:
|
|
- /mnt/library
|
|
notes:
|
|
- Bare repos live at /mnt/library/repos/dtoro/*.git
|
|
age_pubkey: ''
|
|
apps:
|
|
kind: lxc
|
|
pve_id: 105
|
|
host: hubris
|
|
os: linux
|
|
role: docker-apps
|
|
lan_ip: 192.168.8.205
|
|
public_hosts:
|
|
- artifacto.hubris.network
|
|
mesh:
|
|
tailscale:
|
|
ip: 100.121.171.122
|
|
fqdn: apps
|
|
mounts:
|
|
- /mnt/library
|
|
runs:
|
|
- artifacto
|
|
- plantuml
|
|
- homelab-mcp
|
|
- secrets-issuance
|
|
# booklore removed 2026-06-29 → migrated to grimmory (LXC 130)
|
|
age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
|
|
auth-outpost:
|
|
kind: lxc
|
|
pve_id: 106
|
|
host: hubris
|
|
os: linux
|
|
role: authentik-gateway
|
|
lan_ip: 192.168.8.6
|
|
notes:
|
|
- Runs Authentik outpost (reverse-proxy/SSO enforcement) for protected services
|
|
dns:
|
|
kind: lxc
|
|
pve_id: 107
|
|
host: hubris
|
|
os: linux
|
|
role: dns-server
|
|
lan_ip: 192.168.8.2
|
|
notes:
|
|
- Technitium DNS, split-horizon zone for *.hubris.network
|
|
- Primary DNS for 192.168.8.0/24 LAN (inventory.services.dns references this)
|
|
nextcloud:
|
|
kind: lxc
|
|
pve_id: 114
|
|
host: hubris
|
|
os: linux
|
|
role: file-sync
|
|
lan_ip: 192.168.8.224
|
|
public_host: cloud.hubris.network
|
|
mesh:
|
|
tailscale:
|
|
fqdn: nextcloud
|
|
mounts:
|
|
- /mnt/library
|
|
age_pubkey: ''
|
|
elementsynapse:
|
|
kind: lxc
|
|
pve_id: 118
|
|
host: strong
|
|
os: linux
|
|
role: matrix-server
|
|
lan_ip: 192.168.8.242
|
|
public_host: matrix.hubris.network
|
|
mesh:
|
|
tailscale: {}
|
|
notes:
|
|
- Migrated from hubris to strong 2026-07-05 (Phase 1 of strong migration plan).
|
|
sophia:
|
|
kind: lxc
|
|
pve_id: 119
|
|
host: hubris
|
|
os: linux
|
|
role: workshop
|
|
lan_ip: 192.168.8.109
|
|
mesh:
|
|
tailscale:
|
|
fqdn: sophia
|
|
mounts:
|
|
- /mnt/library
|
|
age_pubkey: ''
|
|
mule-images:
|
|
kind: lxc
|
|
pve_id: 120
|
|
host: hubris
|
|
os: linux
|
|
role: photo-management
|
|
lan_ip: 192.168.8.136
|
|
public_host: photos.hubris.network
|
|
mesh:
|
|
tailscale:
|
|
fqdn: muleimage
|
|
mounts:
|
|
- /mnt/library
|
|
age_pubkey: ''
|
|
caddy:
|
|
kind: lxc
|
|
pve_id: 121
|
|
host: hubris
|
|
os: linux
|
|
role: reverse-proxy
|
|
lan_ip: 192.168.8.175
|
|
notes:
|
|
- Terminates all *.hubris.network
|
|
- /etc/caddy is a git checkout of dtoro/caddy-conf
|
|
peers:
|
|
- authentik
|
|
- gitea
|
|
arriman:
|
|
kind: lxc
|
|
pve_id: 122
|
|
host: strong
|
|
os: linux
|
|
role: arr-stack
|
|
lan_ip: 192.168.8.245
|
|
public_hosts:
|
|
- jellyseerr.hubris.network
|
|
- qbit.hubris.network
|
|
- sab.hubris.network
|
|
mesh:
|
|
tailscale:
|
|
fqdn: arr
|
|
mounts:
|
|
- /mnt/media_local
|
|
notes:
|
|
- Migrated from hubris to strong 2026-07-05 (Phase 2). Library on ludo-lvm.
|
|
- Contains homarr, radarr, sonarr, lidarr, sabnzbd, qbittorrent, bazarr, flaresolverr, prowlarr, jellyseerr
|
|
age_pubkey: ''
|
|
grimmory:
|
|
kind: lxc
|
|
pve_id: 130
|
|
host: strong
|
|
os: linux
|
|
role: book-library
|
|
lan_ip: 192.168.8.247
|
|
public_host: books.hubris.network
|
|
mounts:
|
|
- /mnt/media_local
|
|
notes:
|
|
- Docker host for Grimmory (community fork of Booklore). Created 2026-06-29.
|
|
- Migrated from hubris to strong 2026-07-05 (Phase 2d). Books on ludo-lvm.
|
|
age_pubkey: age1uellsemnjrzgfg9fxw4jefpy05laxzggwnwhh6ny3wl7alyp6v8q0muxet
|
|
seanime:
|
|
kind: lxc
|
|
pve_id: 133
|
|
host: strong
|
|
os: linux
|
|
role: anime-media-server
|
|
lan_ip: 192.168.8.248
|
|
public_host: seanime.hubris.network
|
|
mounts:
|
|
- /mnt/media_local/anime
|
|
notes:
|
|
- Seanime anime media server for online streaming + local library scanning
|
|
- Created 2026-07-05. Binary at /opt/seanime/bin/seanime, systemd service.
|
|
romm:
|
|
kind: lxc
|
|
pve_id: 134
|
|
host: strong
|
|
os: linux
|
|
role: rom-manager
|
|
lan_ip: 192.168.8.249
|
|
public_host: roms.hubris.network
|
|
mounts:
|
|
- /mnt/media_local
|
|
notes:
|
|
- Docker host for RomM (romm.app) self-hosted ROM manager. Created 2026-07-05.
|
|
- MariaDB sidecar at /opt/romm/docker-compose.yml.
|
|
- ROMs on ludo-lvm media volume at /mnt/media_local/roms.
|
|
- 1 core / 2 GiB RAM / 16 GiB rootfs (ludo-lvm).
|
|
# 123 (claudio-bot) — destroyed 2026-06-04, replaced by Hermes Agent
|
|
# 126 (plato) — destroyed 2026-06-28, notes workspace decommissioned
|
|
zimaos:
|
|
kind: vm
|
|
pve_id: 100
|
|
host: hubris
|
|
os: linux
|
|
role: nas-frontend-eval
|
|
lan_ip: 192.168.8.195
|
|
public_host: zimaos.hubris.network
|
|
haos:
|
|
kind: vm
|
|
pve_id: 108
|
|
host: hubris
|
|
os: linux
|
|
role: home-automation
|
|
lan_ip: 192.168.8.101
|
|
mesh:
|
|
tailscale:
|
|
fqdn: homeassistant
|
|
republic-laptop:
|
|
kind: workstation
|
|
os: linux
|
|
role: primary-dev
|
|
mesh:
|
|
netbird:
|
|
fqdn: republic-laptop.netbird.selfhosted
|
|
ssh:
|
|
user: dtoro
|
|
mac-mini:
|
|
kind: workstation
|
|
os: macos
|
|
role: dev
|
|
lan_ip: 192.168.178.182
|
|
mesh:
|
|
netbird:
|
|
fqdn: mac-mini-234-17.netbird.selfhosted
|
|
ssh:
|
|
user: dtoro
|
|
notes:
|
|
- Only macOS in the fleet. Bootstrap uses launchd.
|
|
age_pubkey: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
|
|
strong:
|
|
kind: proxmox-host
|
|
os: linux
|
|
role: hypervisor
|
|
lan_ip: 192.168.178.181
|
|
ssh:
|
|
user: root
|
|
notes:
|
|
- Reformatted from Linux workstation ("ludo-mini" in this wiki, still
|
|
the machine's nickname) to Proxmox VE 9.2.3 on 2026-07-01. Renamed
|
|
the inventory/wiki identity from ludo-mini to strong on the same day
|
|
so it matches the OS/cluster hostname everywhere (bootstrap looks up
|
|
hosts/$(hostname).yaml, so a mismatch would break enrollment).
|
|
- Joined hubris's "Homelab" cluster same day. 2-node, no QDevice
|
|
tiebreaker yet — see hosts/hubris.md quorum note.
|
|
- Netbird not yet installed (fresh OS wiped prior enrollment); reachable
|
|
today only via the household LAN / existing Fritz static route to
|
|
192.168.8.0/24. Re-enroll in mesh as a follow-up if off-LAN access
|
|
to this host itself (not just its future guests) is needed.
|
|
- First step of the planned library-SSD migration — see
|
|
.hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md
|
|
(filename kept as-is, it's a historical planning doc). Only Phase 1
|
|
(Proxmox install + cluster join) is done; no physical
|
|
drive move, service migration, or GPU passthrough has happened yet.
|
|
age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
|
|
netbird-vps:
|
|
kind: external
|
|
os: linux
|
|
role: netbird-mgmt
|
|
mesh:
|
|
netbird:
|
|
ip: 100.122.165.149
|
|
fqdn: netbird-ionos.netbird.selfhosted
|
|
ssh:
|
|
user: root
|
|
notes:
|
|
- Public IONOS VPS — hosts the vanilla netbird mgmt+signal+relay+dashboard
|
|
stack + host coturn (see infrastructure/vps-hardening.md +
|
|
infrastructure/mesh.md changelog 2026-05-21).
|
|
- NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context
|
|
clone. Managed via ssh from hubris; sshd is locked to hubris's pubkey.
|
|
- Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
|
|
- Configs rendered by `homelab render-vps-configs` from
|
|
vps/turnserver.conf.tmpl + vps/management.json.tmpl, with secrets
|
|
decrypted from secrets/turn-shared-secret.yaml +
|
|
secrets/netbird-authentik-oidc.yaml on hubris.
|
|
rclone:
|
|
kind: lxc
|
|
os: linux
|
|
role: backup
|
|
mesh:
|
|
netbird:
|
|
fqdn: rclone.netbird.selfhosted
|
|
age_pubkey: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
|