initial commit

2026-07-12 10:17:17 -04:00
commit dab5a4ebc6
1424 changed files with 330463 additions and 0 deletions
@@ -0,0 +1,73 @@
+# Docker Port Binding and Tailscale Reachability
+
+When Docker containers bind to `127.0.0.1` (loopback), they are only reachable from the host machine. Tailscale traffic arrives on the `tailscale0` interface and cannot reach `127.0.0.1`-bound ports.
+
+## Detection
+
+From the VPS via Tailscale:
+
+```bash
+# Port returns 000 (connection refused) — likely 127.0.0.1 binding
+curl -s -o /dev/null -w '%{http_code}' --connect-timeout 2 http://100.93.253.36:9925/
+# 000
+```
+
+On the home server, verify the binding:
+
+```bash
+docker inspect <container> --format '{{json .HostConfig.PortBindings}}' | python3 -m json.tool
+# {"9000/tcp": [{"HostIp": "127.0.0.1", "HostPort": "9925"}]}
+```
+
+## Solutions
+
+### Option A: Proxy through home nginx (preferred)
+
+The home server's nginx already has SSL configs for these services on ports 3443-3450. From the VPS, proxy to the home nginx SSL endpoint with SNI:
+
+```nginx
+proxy_pass https://100.93.253.36:3449;   # Mealie via home nginx
+proxy_ssl_verify off;
+proxy_ssl_server_name on;
+proxy_ssl_name grajmedia.duckdns.org;
+proxy_set_header Host grajmedia.duckdns.org;
+```
+
+This works because the home nginx listens on `0.0.0.0:3449` and proxies to `127.0.0.1:9925` locally.
+
+### Option B: Rebind container to 0.0.0.0
+
+Stop the container, recreate with `0.0.0.0` binding:
+
+```bash
+docker stop mealie
+docker rm mealie
+docker run -d --name mealie \
+  -p 0.0.0.0:9925:9000 \
+  ... (rest of original options)
+```
+
+**Downside**: the service becomes accessible on the LAN without SSL. Only do this for services that don't need the home nginx SSL layer.
+
+### Option C: SSH tunnel
+
+As a last resort, create an SSH tunnel from VPS to home server:
+
+```bash
+ssh -L 9925:127.0.0.1:9925 -N -f 100.93.253.36
+```
+
+Then nginx on the VPS proxies to `http://127.0.0.1:9925`.
+
+**Downside**: fragile, needs SSH keepalive, adds latency, requires SSH key setup.
+
+## Services by binding type (rayserver)
+
+| Service | Docker port | Binding | VPS approach |
+|---------|------------|---------|-------------|
+| Immich | 2283 | 0.0.0.0 | Direct HTTP |
+| Paperless | 8010 | 0.0.0.0 | Direct HTTP |
+| Home Assistant | 8123 | 0.0.0.0 (host net) | Direct HTTP |
+| Mealie | 9925 | 127.0.0.1 | Home nginx HTTPS proxy |
+| Audiobookshelf | 13378 | 0.0.0.0 | Direct HTTP |
+| PocketBase | 8091 | 127.0.0.1 | Home nginx HTTPS proxy |