selfhosted2

Machines

Name	Role	OS	LAN IP	WG IP	SSH user
hector	Dev machine (this one)	Linux Mint Mate	—	—	—
agge	Backend server	Ubuntu Server	192.168.1.188	10.0.0.2	tebarbi
raspen	VPS / reverse proxy	Raspberry Pi OS Lite	192.168.1.187	10.0.0.1	rasput

Architecture

All traffic goes through raspen (single entry point):

nginx in Docker (vps/docker-compose.yml) terminates SSL and reverse proxies
WireGuard sidecar container encrypts traffic to agge
All backend services bind to 10.0.0.2 only (tunnel-only access)

Services

Domain	Service	Backend	Via raspen
git.home	Gitea	agge:10.0.0.2:3000 (HTTP), :2222 (SSH)	HTTPS :443, TCP :2222
nc.home	Nextcloud	agge:10.0.0.2:8080	HTTPS :443
pg.home	PostgreSQL	agge:10.0.0.2:5432	TCP :5432
raspen.home	Static page	Served directly by nginx	HTTP/HTTPS

Repo structure

backend/docker-compose.yml — agge stack (postgres, nextcloud, gitea, postgres_remote)
vps/docker-compose.yml — raspen stack (wireguard sidecar + nginx)
vps/nginx/conf.d/ — HTTP/HTTPS proxy configs
vps/nginx/stream.d/ — TCP stream proxy configs (postgres, gitea ssh)
vps/wireguard/wg_confs/ — WireGuard tunnel config
.env.example — template for secrets (real .env is gitignored)

Git remote

ssh://git@git.home:2222/scoot/selfhosted2.git

Conventions

The machines agge and raspen require sudo for most commands. Do not attempt to execute commands requiring sudo via SSH — present the command to the user and let them run it manually.

Password management

See .env.example for required variables. Real .env lives on hector and a copy on agge (chmod 600). To rotate: generate with openssl rand -base64 18, update .env, run ALTER USER in the container.

1.9 KiB Raw Blame History