Files

dtoro f5cd320433 Bootstrap Homelab-Docs wiki

Initial documentation of the hubris Proxmox homelab as a cross-linked
markdown wiki. Per-node pages, cross-cutting infrastructure pages, an
investigation log, and an operations cheatsheet. Each node and topic
ends with a Changelog section so changes can be tracked in-place going
forward.

Refreshed against live state on 2026-04-28 — 14 active LXCs (109
syncthing currently stopped) + 1 VM (108 haos). Reflects post-A/B-test
state of the 2026-04-21 hubris crash-loop investigation.

2026-04-28 22:53:09 +02:00

3.0 KiB

Raw Blame History

114 — `nextcloud`

Personal cloud / file collaboration. Source-of-truth for the photo libraries surfaced by mulita (120).

At a glance

Hostname: nextcloud
IP: 192.168.8.224
Privilege: privileged
Resources: 4 cores / 6 GiB RAM / 25 GiB rootfs
Mounts: /mnt/library ↔ /mnt/library (Nextcloud user files under /mnt/library/homecloud)
Public hostname: cloud.hubris.network → caddy

Auth

Native OIDC via user_oidc app. Username override pattern: Authentik user dtoro maps to local Nextcloud user admin via the nc_uid custom-claim scope. Configured via occ user_oidc:provider <name> --mapping-uid=nc_uid and --scope="openid profile email <app>-uid". See Authentik for the full pattern.

Redirect URI: /index.php/apps/user_oidc/code (NOT /apps/... — pretty URLs aren't on).

DNS workaround (load-bearing)

Nextcloud's PHP HTTP client (OC\Http\Client\DnsPinMiddleware) calls dns_get_record() directly — it bypasses /etc/hosts. So the Authentik OIDC discovery URL needs real DNS answering with 192.168.8.175 for auth.hubris.network. Recipe applied:

Local dnsmasq listening on 127.0.0.1:53, /etc/dnsmasq.d/hubris-internal.conf with address=/auth.hubris.network/192.168.8.175, server=192.168.8.1, server=1.1.1.1, interface=lo, bind-interfaces, no-hosts, no-resolv.
pct set 114 --nameserver "127.0.0.1 192.168.8.1 1.1.1.1" so the LXC starts with the right resolver order.
/etc/hosts override kept as belt-and-suspenders.

Also needs allow_local_remote_servers=true in config.php.

Once internal DNS at the router level handles *.hubris.network, this LXC-local dnsmasq can go away. See DNS.

Storage

Files at /mnt/library/homecloud. Owned by Nextcloud's own permission model — deliberately not on the media group, NC manages it itself and would complain. See media permissions.

mulita (120) — reads NC user trees + writes back via WebDAV
Authentik (124)
Caddy (121)
DNS
Mesh migration (DNS overrides explained)
Media permissions

Changelog

2026-04-28 — wiki entry created

Initial documentation.

2026-04-26 — Nextcloud-rooted libraries shipped (mulita)

mulita (120) now reads photos from /nextcloud-users/<nc_user>/files/... and writes mutations back via WebDAV. Pre-migration DB dump kept at /root/snapshots/mulita-pre-nc-migration-20260426-075132.dump.

2026-04-21 — wired into Authentik (native OIDC + nc_uid override)

Local dnsmasq added on this LXC because Guzzle bypasses /etc/hosts. Resolver order set to 127.0.0.1 192.168.8.1 1.1.1.1. Username override dtoro → admin.

3.0 KiB Raw Blame History

114 — nextcloud