Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

Captures the full workspace state built up to this point: - CLAUDE.md + README.md describing conventions and the four-host fleet (ana-ml2, ana-docker, nh3-docker, esh-docker-vm). - Per-host notes under servers/<host>/ with ssh-target fallback files and latest system-details snapshots (two in-compose credential leaks scrubbed; the upstream compose files still need to move those to .env). - scripts/: server_inspect.sh (read-only remote diagnostic), refresh-server-info.sh (dir-driven discovery + snapshot capture with validation warnings), add-host.sh, sync-stacks.sh (pull compose/conf trees), deploy-stack.sh (push with per-file diff + prompt). - stacks/: canonical compose for backrest, beszel, dozzle, llama-swap, rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired infinity reference. All use the .env-driven + traefik-net + homepage label pattern. - configs/restic/ana-docker/: first resticprofile config + pre-backup hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates for the other three hosts to come. - docs/pfi/: general infrastructure reference carried over. - .gitignore excludes .env, stacks-mirror/, and assorted secret/state filenames to prevent re-leaks on later commits.
2026-04-20 14:29:48 -07:00
commit e376d0aec9
55 changed files with 9101 additions and 0 deletions
@@ -0,0 +1,76 @@
+# esh-docker-vm
+
+General-purpose Docker host at the **ESH home-lab site** (`esteban.net` / `10.0.0.0/8` space). VM, no GPU. Separate scope from the PFI colo work but tracked here because it's part of the same fleet.
+
+## Network
+
+- **LAN IP:** 10.0.50.45
+- **FQDN:** `esh-vm-docker.esteban.net`
+- **Subnet:** `10.0.50.0/24` (inferred from macvlan config)
+- **SSH:** standard port 22
+- **Traefik entrypoints:** 80/443 terminate here; DNS-01 challenge via AWS Route53; protected by CrowdSec Traefik plugin
+
+## Hardware
+
+- **CPU:** 16 vCPU (QEMU virtual — VM)
+- **RAM:** 15.6 GB
+- **GPUs:** none
+- **Storage:** 250 GB root (ext4) + NFS mounts from `10.0.50.50`
+- **OS:** Debian 12 (bookworm), kernel 6.1.x
+- **Docker:** running (daemon socket at `/var/run/docker.sock`; also listens on `:2375`)
+
+## Key paths
+
+| Path | Purpose |
+|------|---------|
+| `/opt/docker/compose/<stack>/` | Compose files (also a git repo) |
+| `/opt/docker/conf/<stack>/` | Config bind mounts |
+| `/opt/docker/docker-bu/` | Legacy backup staging (ad-hoc) |
+| `/mnt/compose` | NFS — `10.0.50.50:/mnt/compose` |
+| `/mnt/backup` | NFS — `10.0.50.50:/mnt/backup` (volume-backup sidecars write here) |
+| `/mnt/documents` | NFS — `10.0.50.50:/mnt/documents` (Paperless-ngx source) |
+| `/mnt/books` | NFS — `10.0.50.50:/mnt/books` (Calibre library) |
+
+## Running stacks
+
+| Stack | Port(s) | Notes |
+|-------|---------|-------|
+| traefik | 80 / 443 / 8380 | Reverse proxy + TLS (AWS Route53 DNS-01); CrowdSec bouncer plugin |
+| cloudflare-ddns-esh | — | Keeps the `esteban.net` record in sync with the dynamic WAN IP |
+| adguard | 53 / 853 / 8080 / 8443 / 3000 / 784 | DNS + DoT for the ESH site |
+| dockge | 5001 | Docker stack management UI |
+| homepage | 5100 | Dashboard (`eshhome` / `eshhome.esteban.net`) |
+| uptime-kuma | 3001 | Service uptime monitor |
+| homeassistant | macvlan `10.0.50.46:8123` | Home automation (direct LAN IP via macvlan on `ens18`) |
+| esphome | host net / 6052 | ESPHome firmware dashboard |
+| mosquitto | 1883 | MQTT broker |
+| calibre | 8082 / 8181 / 8281 | Ebook server |
+| calibre-web | 8083 | Ebook web UI |
+| paperless-ngx (+ redis broker + volume-backup sidecar) | 8200 | Document archive; Postgres on `10.0.50.60:5432` |
+| pgadmin (+ volume-backup sidecar) | 5050 | Postgres admin UI |
+| drawio | 8087 / 8447 | Diagram editor |
+| dozzle-agent | 7007 | Log agent; feeds ana-docker's Dozzle hub |
+| beszel-esh-vm-docker (agent) | 45876 | Metrics agent; feeds ana-docker's Beszel hub |
+| portainer (+ portainer_agent) | 9443 / 8000 / 9001 | Container management UI (ad-hoc, no compose dir under `/opt/docker/compose/`) |
+
+## Refresh state
+
+```bash
+scripts/refresh-server-info.sh esh-docker-vm
+```
+
+Latest snapshot: `system-details.txt` (regenerate as needed).
+
+## Cross-site monitoring
+
+Like `nh3-docker`, this host runs **Dozzle** and **Beszel** agents that report back to the hubs on `ana-docker`, so container logs and metrics show up alongside PFI hosts in the shared dashboards.
+
+## Notes
+
+- **Macvlan for Home Assistant** — the HA container gets its own LAN IP (`10.0.50.46`) via a macvlan network on `ens18`, avoiding NAT so multicast/mDNS for HA discovery works cleanly.
+- **External Postgres** — Paperless-ngx connects to a DB running elsewhere (`10.0.50.60:5432`), not a sidecar. Paperless creds in that compose file currently look like defaults; rotate before exposing.
+- **Volume backups already in place** — `paperless-ngx` and `pgadmin` include `offen/docker-volume-backup:latest` sidecars that tar named volumes to `/mnt/backup/docker/esh-vm-docker/<stack>/`. When the fleet-wide restic plan lands, decide whether to subsume these or leave the per-stack sidecars alone.
+
+## Placement rule
+
+Home-lab workloads for the ESH site go here. Not part of the PFI colo topology.
@@ -0,0 +1 @@
+10.0.50.45
@@ -0,0 +1,961 @@
+
+===== HOST =====
+
+Hostname:   esh-vm-docker.esteban.net
+Date:       2026-04-19T22:15:59-07:00
+Uptime:     up 2 weeks, 6 days, 5 hours, 59 minutes
+OS:         Debian GNU/Linux 12 (bookworm)
+Kernel:     6.1.0-41-amd64
+Arch:       x86_64
+
+===== HARDWARE =====
+
+CPU cores:  16
+CPU model:  QEMU Virtual CPU version 2.5+
+MemTotal:   15.6 GB
+MemAvailable: 11.4 GB
+
+===== GPUS =====
+
+nvidia-smi not present (no NVIDIA GPUs or driver not installed)
+
+===== FILESYSTEMS (df) =====
+
+Filesystem                 Size  Used Avail Use% Mounted on
+/dev/sda1                  250G  122G  117G  52% /
+10.0.50.50:/mnt/backup      92T   26G   92T   1% /mnt/backup
+10.0.50.50:/mnt/compose    1.5T  4.1G  1.5T   1% /mnt/compose
+10.0.50.50:/mnt/documents   92T     0   92T   0% /mnt/documents
+10.0.50.50:/mnt/books       92T   96G   92T   1% /mnt/books
+
+===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
+
+UUID=a2e1bc05-3afa-4803-9ab2-dfee1d5c9e6c /               ext4    errors=remount-ro 0       1
+UUID=4f4fa84b-2b71-4ee5-9be4-2deb4c287d8e none            swap    sw              0       0
+/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
+10.0.50.50:/mnt/compose /mnt/compose nfs defaults 0 0
+10.0.50.50:/mnt/books /mnt/books nfs defaults 0 0
+10.0.50.50:/mnt/documents /mnt/documents nfs defaults 0 0
+10.0.50.50:/mnt/backup /mnt/backup nfs defaults 0 0
+
+===== TARGETED DATA PATHS =====
+
+/opt  (total: 62M)
+  total 16
+  drwxr-xr-x  4 root    root    4096 2025-03-18 23:59 .
+  drwxr-xr-x 19 root    root    4096 2025-12-29 14:50 ..
+  drwxr-xr-x  5 lkraven lkraven 4096 2025-03-18 23:58 docker
+  drwxrwxrwx  6 lkraven lkraven 4096 2024-06-13 22:00 docker-bu
+
+/opt/docker  (total: 53M)
+  total 32
+  drwxr-xr-x  5 lkraven lkraven 4096 2025-03-18 23:58 .
+  drwxr-xr-x  4 root    root    4096 2025-03-18 23:59 ..
+  drwxr-xr-x 18 lkraven lkraven 4096 2026-04-19 01:08 compose
+  drwxr-xr-x  7 lkraven lkraven 4096 2025-11-29 00:26 conf
+  drwxr-xr-x  8 lkraven lkraven 4096 2025-03-18 23:59 .git
+  -rw-r--r--  1 lkraven lkraven   34 2025-03-18 23:58 .gitignore
+  -rw-r--r--  1 lkraven lkraven 1059 2025-03-18 23:58 LICENSE
+  -rw-r--r--  1 lkraven lkraven   60 2025-03-18 23:58 README.md
+
+/opt/docker/compose  (total: 172K)
+  total 76
+  drwxr-xr-x 18 lkraven lkraven 4096 2026-04-19 01:08 .
+  drwxr-xr-x  5 lkraven lkraven 4096 2025-03-18 23:58 ..
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 adguard
+  drwxr-xr-x  2 root    root    4096 2026-04-19 01:07 beszel-esh-vm-docker
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 calibre
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 calibre-web
+  drwxr-xr-x  2 root    root    4096 2025-10-03 22:01 cloudflare-ddns-esh
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 dockge
+  drwxr-xr-x  2 root    root    4096 2026-04-19 00:30 dozzle-agent
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 drawio
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 esphome
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-08-31 17:39 homeassistant
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-05-19 22:10 homepage
+  drwxr-xr-x  2 root    root    4096 2025-11-29 00:40 mosquitto
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-08-28 09:37 paperless-ngx
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-08-31 17:41 pgadmin
+  -rw-r--r--  1 lkraven lkraven   25 2025-03-18 23:58 README.md
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-05-19 22:10 traefik
+  drwxr-xr-x  2 lkraven lkraven 4096 2025-03-18 23:58 uptimekuma
+
+/opt/docker/conf  (total: 50M)
+  total 28
+  drwxr-xr-x 7 lkraven lkraven 4096 2025-11-29 00:26 .
+  drwxr-xr-x 5 lkraven lkraven 4096 2025-03-18 23:58 ..
+  drwxr-xr-x 2 nas     nas     4096 2026-03-20 21:00 calibre-web
+  drwxr-xr-x 2 lkraven lkraven 4096 2025-10-03 22:13 cloudflare-ddns
+  drwxr-xr-x 5 lkraven lkraven 4096 2026-03-30 22:30 homepage
+  drwxr-xr-x 2    1883    1883 4096 2025-11-29 00:50 mosquitto
+  drwxr-xr-x 3 lkraven lkraven 4096 2025-03-18 23:58 traefik-esh
+
+/var/lib/docker  (total: 4.0K)
+
+/srv  (total: 20K)
+  total 12
+  drwxr-xr-x  3 root root 4096 2024-06-13 21:52 .
+  drwxr-xr-x 19 root root 4096 2025-12-29 14:50 ..
+  drwxrwxrwx  3 root root 4096 2024-06-13 21:54 backups
+
+
+===== DOCKER =====
+
+Server: 20.10.24+dfsg1   Client: 20.10.24+dfsg1
+
+----- docker info -----
+Containers:      24 (running 21, paused 0, stopped 3)
+Images:          84
+Runtimes:        map[io.containerd.runc.v2:{runc [] <nil>} io.containerd.runtime.v1.linux:{runc [] <nil>} runc:{runc [] <nil>}]
+Default runtime: runc
+Storage driver:  overlay2
+Root dir:        /var/lib/docker
+Server version:  20.10.24+dfsg1
+
+----- running containers -----
+NAMES                       IMAGE                                        STATUS                 PORTS
+beszel-agent                henrygd/beszel-agent:latest                  Up 21 hours            
+dozzle-agent                amir20/dozzle:latest                         Up 22 hours            0.0.0.0:7007->7007/tcp, 8080/tcp
+traefik                     traefik:latest                               Up 3 days              0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8380->8080/tcp, :::8380->8080/tcp
+paperless-ngx-webserver-1   ghcr.io/paperless-ngx/paperless-ngx:latest   Up 2 weeks (healthy)   0.0.0.0:8200->8000/tcp, :::8200->8000/tcp
+paperless-ngx-broker-1      redis:7                                      Up 2 weeks             6379/tcp
+paperless-ngx-backup-1      offen/docker-volume-backup:latest            Up 2 weeks             
+homepage                    ghcr.io/gethomepage/homepage:latest          Up 2 weeks (healthy)   0.0.0.0:5100->3000/tcp, :::5100->3000/tcp
+homeassistant               homeassistant/home-assistant:latest          Up 30 hours            
+mosquitto                   eclipse-mosquitto:latest                     Up 2 weeks             0.0.0.0:1883->1883/tcp, :::1883->1883/tcp
+adguardhome                 adguard/adguardhome                          Up 2 weeks             67-68/udp, 0.0.0.0:53->53/udp, :::53->53/udp, 443/udp, 0.0.0.0:53->53/tcp, :::53->53/tcp, 853/udp, 0.0.0.0:853->853/tcp, :::853->853/tcp, 3000/udp, 5443/tcp, 0.0.0.0:3000->3000/tcp, 0.0.0.0:784->784/udp, :::3000->3000/tcp, :::784->784/udp, 5443/udp, 6060/tcp, 0.0.0.0:8080->80/tcp, :::8080->80/tcp, 0.0.0.0:8443->443/tcp, :::8443->443/tcp
+cloudflare-ddns             timothyjmiller/cloudflare-ddns:latest        Up 2 weeks             
+pgadmin4_container          dpage/pgadmin4                               Up 2 weeks             443/tcp, 0.0.0.0:5050->80/tcp, :::5050->80/tcp
+pgadmin-backup-1            1127ad194f2f                                 Up 2 weeks             
+esphome                     ghcr.io/esphome/esphome                      Up 2 weeks (healthy)   
+drawio                      jgraph/drawio                                Up 2 weeks (healthy)   0.0.0.0:8087->8080/tcp, :::8087->8080/tcp, 0.0.0.0:8447->8443/tcp, :::8447->8443/tcp
+calibre-web                 lscr.io/linuxserver/calibre-web:latest       Up 2 weeks             0.0.0.0:8083->8083/tcp, :::8083->8083/tcp
+calibre                     lscr.io/linuxserver/calibre:latest           Up 2 weeks             3000-3001/tcp, 0.0.0.0:8181->8181/tcp, :::8181->8181/tcp, 0.0.0.0:8082->8080/tcp, :::8082->8080/tcp, 0.0.0.0:8281->8081/tcp, :::8281->8081/tcp
+45d2522a8cb6_uptime-kuma    louislam/uptime-kuma:latest                  Up 2 weeks (healthy)   0.0.0.0:3001->3001/tcp, :::3001->3001/tcp
+dockge-dockge-1             louislam/dockge:latest                       Up 2 weeks (healthy)   0.0.0.0:5001->5001/tcp, :::5001->5001/tcp
+portainer_agent             portainer/agent:2.19.4                       Up 2 weeks             0.0.0.0:9001->9001/tcp, :::9001->9001/tcp
+portainer                   portainer/portainer-ce:latest                Up 2 weeks             0.0.0.0:8000->8000/tcp, :::8000->8000/tcp, 0.0.0.0:9443->9443/tcp, :::9443->9443/tcp, 9000/tcp
+
+----- all containers -----
+NAMES                       IMAGE                                        STATUS
+beszel-agent                henrygd/beszel-agent:latest                  Up 21 hours
+dozzle-agent                amir20/dozzle:latest                         Up 22 hours
+traefik                     traefik:latest                               Up 3 days
+paperless-ngx-webserver-1   ghcr.io/paperless-ngx/paperless-ngx:latest   Up 2 weeks (healthy)
+paperless-ngx-broker-1      redis:7                                      Up 2 weeks
+paperless-ngx-backup-1      offen/docker-volume-backup:latest            Up 2 weeks
+homepage                    ghcr.io/gethomepage/homepage:latest          Up 2 weeks (healthy)
+homeassistant               homeassistant/home-assistant:latest          Up 30 hours
+mosquitto                   eclipse-mosquitto:latest                     Up 2 weeks
+adguardhome                 adguard/adguardhome                          Up 2 weeks
+friendly_maxwell            0745ced90756                                 Exited (13) 4 months ago
+focused_pascal              0745ced90756                                 Exited (13) 4 months ago
+pedantic_proskuriakova      0745ced90756                                 Exited (3) 4 months ago
+cloudflare-ddns             timothyjmiller/cloudflare-ddns:latest        Up 2 weeks
+pgadmin4_container          dpage/pgadmin4                               Up 2 weeks
+pgadmin-backup-1            1127ad194f2f                                 Up 2 weeks
+esphome                     ghcr.io/esphome/esphome                      Up 2 weeks (healthy)
+drawio                      jgraph/drawio                                Up 2 weeks (healthy)
+calibre-web                 lscr.io/linuxserver/calibre-web:latest       Up 2 weeks
+calibre                     lscr.io/linuxserver/calibre:latest           Up 2 weeks
+45d2522a8cb6_uptime-kuma    louislam/uptime-kuma:latest                  Up 2 weeks (healthy)
+dockge-dockge-1             louislam/dockge:latest                       Up 2 weeks (healthy)
+portainer_agent             portainer/agent:2.19.4                       Up 2 weeks
+portainer                   portainer/portainer-ce:latest                Up 2 weeks
+
+----- networks -----
+NAME                          DRIVER    SCOPE
+adguard_default               bridge    local
+bridge                        bridge    local
+calibre-web_default           bridge    local
+cloudflare-ddns-esh_default   bridge    local
+homeassistant_macvlan_net     macvlan   local
+homepage_default              bridge    local
+host                          host      local
+none                          null      local
+pgadmin_default               bridge    local
+traefik-net                   bridge    local
+
+----- networks (external, non-default — worth knowing for compose external: true) -----
+adguard_default
+calibre-web_default
+cloudflare-ddns-esh_default
+homepage_default
+pgadmin_default
+traefik-net
+
+----- named volumes -----
+VOLUME NAME                                                        DRIVER
+6cdde6cf4b58151d434e8a3da23e77d9c04acdaa574a91ff7bbe60ea113a2adf   local
+6f7206c067f22a53bf7d0c737f74075f849c11fd535b884c4d3cbb73d275bc21   local
+007fc81bd8008b22173f8e4a365b2ca43a37080902ab961a197dde0d8782c786   local
+8b1ff384b6cb4859c64a21b51d32780027a3682dc1852a36617b59870ea15e32   local
+adguard_adguard-confdir                                            local
+adguard_adguard-workdir                                            local
+ae127367f71c43b662b16c8232a135c59f2a873dcdf606dfa01967fad1ac915e   local
+beszel-esh-vm-docker_beszel_agent_data                             local
+beszel-vm-esh-nas_beszel_agent_data                                local
+c7a5978e1b811c4d5b15404e405c0ec32a541f8a921a054b0f725a3010a76684   local
+dockge_dockge_data                                                 local
+dozzle-agent_dozzle_agent_data                                     local
+homeassistant_homeassistant_data                                   local
+mosquitto_mosquitto_data                                           local
+mosquitto_mosquitto_log                                            local
+paperless-ngx_data                                                 local
+paperless-ngx_media                                                local
+paperless-ngx_redisdata                                            local
+pgadmin_pgadmin-data                                               local
+portainer_data                                                     local
+uptimekuma_uptime-kuma                                             local
+
+----- compose projects currently running -----
+adguard
+beszel-esh-vm-docker
+calibre
+calibre-web
+cloudflare-ddns-esh
+dockge
+dozzle-agent
+drawio
+esphome
+homeassistant
+homepage
+mosquitto
+paperless-ngx
+pgadmin
+traefik
+uptimekuma
+
+===== COMPOSE FILES (/opt/docker/compose/) =====
+
+
+>>> /opt/docker/compose/adguard/docker-compose.yml
+#version: "3"
+services:
+  adguardhome:
+    image: adguard/adguardhome
+    container_name: adguardhome
+    ports:
+      - 53:53/tcp
+      - 53:53/udp
+      - 784:784/udp
+      - 853:853/tcp
+      - 3000:3000/tcp
+      - 8080:80/tcp
+      - 8443:443/tcp
+    volumes:
+      - adguard-workdir:/opt/adguardhome/work
+      - adguard-confdir:/opt/adguardhome/conf
+    restart: unless-stopped
+    labels:
+      # This means the container will be stopped during backup to ensure
+      # backup integrity. You can omit this label if stopping during backup
+      # not required.  Can be omitted if false.
+      - docker-volume-backup.stop-during-backup=false
+      - homepage.group=ESH
+      - homepage.name=AdGuard Home
+      - homepage.icon=si-adguard
+      - homepage.description=DNS
+      - homepage.href=http://10.0.50.45:8080
+      - homepage.widget.type=adguard
+      - homepage.widget.url=http://10.0.50.45:8080
+      - homepage.widget.username=lkraven
+      - homepage.widget.password=[REDACTED-upstream-compose-inlines-this]
+    networks:
+      - tnet
+
+volumes:
+  adguard-workdir: null
+  adguard-confdir: null
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/beszel-esh-vm-docker/compose.yaml
+# Beszel — lightweight server/container monitoring.
+#
+# Hub: single web UI with the SQLite store. Agents: per-host metric collectors
+# that the hub pulls from over SSH.
+#
+# Multi-host layout via compose profiles:
+#   COMPOSE_PROFILES=hub          → hub only        (ana-docker)
+#   COMPOSE_PROFILES=hub,agent    → hub + local agent on the same host
+#   COMPOSE_PROFILES=agent        → agent only      (ana-ml2)
+#
+# The agent uses network_mode: host so it sees real host CPU/mem/net/disk
+# counters rather than container-scoped ones — that's why it can't share
+# the tnet network with the hub.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  beszel:
+    image: henrygd/beszel:${BESZEL_VERSION}
+    container_name: beszel
+    profiles: [hub]
+    restart: unless-stopped
+    ports:
+      - "${BESZEL_PORT}:8090"
+    volumes:
+      - beszel_data:/beszel_data
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8090/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=PFI-ANA
+      - homepage.name=Beszel
+      - homepage.icon=mdi-chart-line
+      - homepage.description=Server + container monitoring
+      - homepage.href=http://10.250.50.70:${BESZEL_PORT}
+
+  beszel-agent:
+    image: henrygd/beszel-agent:${BESZEL_VERSION}
+    container_name: beszel-agent
+    profiles: [agent]
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - beszel_agent_data:/var/lib/beszel-agent
+    environment:
+      - PORT=${BESZEL_AGENT_PORT:-45876}
+      - KEY=${BESZEL_HUB_KEY}
+      - HUB_URL=${HUB_URL}
+      - TOKEN=${BESZEL_TOKEN}
+      - EXTRA_FILESYSTEMS=${BESZEL_EXTRA_FS:-}
+
+volumes:
+  beszel_data:
+  beszel_agent_data:
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+>>> /opt/docker/compose/calibre/compose.yaml
+version: "2.1"
+services:
+  calibre:
+    image: lscr.io/linuxserver/calibre:latest
+    container_name: calibre
+    security_opt:
+      - seccomp:unconfined #optional
+    environment:
+      - PUID=2000
+      - PGID=2000
+      - TZ=America/Los_Angeles
+      - PASSWORD= #optional
+      - CLI_ARGS= #optional
+    volumes:
+      - /mnt/books/calibre:/config
+    ports:
+      - 8082:8080
+      - 8181:8181
+      - 8281:8081
+    restart: unless-stopped
+    labels:
+      - homepage.group=Media
+      - homepage.name=Calibre
+      - homepage.icon=mdi-bookshelf
+      - homepage.description=EBook Server (esh)
+      - homepage.href=http://10.0.50.45:8082
+    networks:
+      - tnet
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/calibre-web/compose.yaml
+services:
+  calibre-web:
+    image: lscr.io/linuxserver/calibre-web:latest
+    container_name: calibre-web
+    environment:
+      - PUID=2000
+      - PGID=2000
+      - TZ=Etc/UTC
+      - DOCKER_MODS=linuxserver/mods:universal-calibre #optional
+      - OAUTHLIB_RELAX_TOKEN_SCOPE=1 #optional
+    volumes:
+      - /opt/docker/conf/calibre-web:/config
+      - /mnt/books/calibre/calibre_library:/books
+    labels:
+      - homepage.group=Media
+      - homepage.name=Calibre-Web
+      - homepage.icon=si-calibreweb
+      - homepage.description=EBook Server (esh)
+      - homepage.href=http://10.0.50.45:8083
+    ports:
+      - 8083:8083
+    restart: unless-stopped
+networks: {}
+
+>>> /opt/docker/compose/cloudflare-ddns-esh/compose.yaml
+services:
+  cloudflare-ddns:
+    image: timothyjmiller/cloudflare-ddns:latest
+    container_name: cloudflare-ddns
+    volumes:
+      - /opt/docker/conf/cloudflare-ddns/config.json:/config.json
+    restart: unless-stopped
+networks: {}
+
+>>> /opt/docker/compose/dockge/compose.yaml
+services:
+  dockge:
+    image: louislam/dockge:latest
+    restart: unless-stopped
+    ports:
+      # Host Port : Container Port
+      - 5001:5001
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - dockge_data:/app/data
+      - /opt/docker/compose:/opt/docker/compose
+    labels:
+      - homepage.group=ESH
+      - homepage.name=Dockge
+      - homepage.icon=si-portainer
+      - homepage.description=Docker
+      - homepage.href=http://10.0.50.45:5001
+    environment:
+      # Tell Dockge where is your stacks directory
+      - DOCKGE_STACKS_DIR=/opt/docker/compose
+    networks:
+      - tnet
+
+volumes:
+  dockge_data: null
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/dozzle-agent/compose.yaml
+# Dozzle — container log viewer.
+#
+# Multi-host layout via compose profiles:
+#   COMPOSE_PROFILES=hub   → runs the web UI (deploy on ana-docker)
+#   COMPOSE_PROFILES=agent → runs the remote agent (deploy on ana-ml2)
+#
+# Same compose.yaml on both servers; per-host `.env` picks the profile.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  dozzle:
+    image: amir20/dozzle:${DOZZLE_VERSION}
+    container_name: dozzle
+    profiles:
+      - hub
+    restart: unless-stopped
+    ports:
+      - ${DOZZLE_PORT}:8080
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - dozzle_data:/data
+    environment:
+      - DOZZLE_HOSTNAME=${DOZZLE_HOSTNAME}
+      - DOZZLE_REMOTE_AGENT=${DOZZLE_REMOTE_AGENT:-}
+      - DOZZLE_AUTH_PROVIDER=${DOZZLE_AUTH_PROVIDER:-none}
+      - DOZZLE_USERNAME=${DOZZLE_USERNAME:-}
+      - DOZZLE_PASSWORD=${DOZZLE_PASSWORD:-}
+    healthcheck:
+      test:
+        - CMD
+        - /dozzle
+        - healthcheck
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=PFI-ANA
+      - homepage.name=Dozzle
+      - homepage.icon=mdi-text-box-search
+      - homepage.description=Container logs (ana-docker + ana-ml2)
+      - homepage.href=http://10.250.50.70:${DOZZLE_PORT}
+  dozzle-agent:
+    image: amir20/dozzle:${DOZZLE_VERSION}
+    container_name: dozzle-agent
+    profiles:
+      - agent
+    restart: unless-stopped
+    command: agent
+    ports:
+      - ${DOZZLE_AGENT_BIND:-0.0.0.0}:${DOZZLE_AGENT_PORT}:7007
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - dozzle_agent_data:/data
+    environment:
+      - DOZZLE_HOSTNAME=${DOZZLE_HOSTNAME}
+    networks:
+      - tnet
+volumes:
+  dozzle_data: null
+  dozzle_agent_data: null
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/drawio/compose.yaml
+services:
+  drawio:
+    image: jgraph/drawio
+    container_name: drawio
+    restart: unless-stopped
+    ports:
+      - 8087:8080
+      - 8447:8443
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://127.0.0.1:8080 || exit 1
+      interval: 1m30s
+      timeout: 10s
+      retries: 5
+      start_period: 10s
+    labels:
+      - homepage.group=Apps
+      - homepage.name=draw.io
+      - homepage.icon=mdi-pencil
+      - homepage.description=Draw.IO Graphing (esh)
+      - homepage.href=http://10.0.50.45:8087
+    networks:
+      - tnet
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/esphome/compose.yaml
+version: '3'
+services:
+  esphome:
+    container_name: esphome
+    image: ghcr.io/esphome/esphome
+    volumes:
+      - /path/to/esphome/config:/config
+      - /etc/localtime:/etc/localtime:ro
+    restart: always
+    privileged: true
+    network_mode: host
+    environment:
+      - USERNAME=test
+      - PASSWORD=ChangeMe
+>>> /opt/docker/compose/homeassistant/compose.yaml
+services:
+  homeassistant:
+    image: homeassistant/home-assistant:latest
+    container_name: homeassistant
+    environment:
+      - PUID=2000
+      - PGID=2000
+      - TZ=America/Los_Angeles
+    volumes:
+      - homeassistant_data:/config
+    restart: unless-stopped
+    env_file:
+      - .env
+    networks:
+      macvlan_net:
+        ipv4_address: 10.0.50.46
+    labels:
+      - homepage.group=Apps
+      - homepage.name=Home Assistant
+      - homepage.icon=si-homeassistant
+      - homepage.description=Home Automation (esh)
+      - homepage.href=http://10.0.50.46:8123
+networks:
+  macvlan_net:
+    driver: macvlan
+    driver_opts:
+      parent: ens18
+    ipam:
+      config:
+        - subnet: 10.0.50.0/24
+volumes:
+  homeassistant_data: null
+
+>>> /opt/docker/compose/homepage/compose.yaml
+services:
+  homepage:
+    image: ghcr.io/gethomepage/homepage:latest
+    container_name: homepage
+    environment:
+      PUID: 1000
+      PGID: 1000
+    ports:
+      - 5100:3000
+    volumes:
+      - /opt/docker/conf/homepage:/app/config # Make sure your local config directory exists
+      - /var/run/docker.sock:/var/run/docker.sock:ro # optional, for docker integrations
+    restart: unless-stopped
+    networks:
+      - tnet
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.homepage.rule=host(`eshhome`) || host(`10.0.50.45`)
+        || host (`eshhome.esteban.net`)
+      - traefik.http.services.homepage.loadbalancer.server.port=3000
+      - traefik.http.routers.homepage.priority=1
+    env_file:
+      - .env
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/mosquitto/compose.yaml
+services:
+  mosquitto:
+    container_name: mosquitto
+    image: eclipse-mosquitto:latest
+    restart: unless-stopped
+    ports:
+      - 1883:1883/tcp
+    volumes:
+      - /opt/docker/conf/mosquitto:/mosquitto/config
+      - mosquitto_data:/mosquitto/data
+      - mosquitto_log:/mosquitto/log
+    networks:
+      - tnet
+    labels:
+      - homepage.group=Apps
+      - homepage.name=Mosquitto
+      - homepage.icon=mdi-bug
+      - homepage.description=MQQT Broker port 1883
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+volumes:
+  mosquitto_data: null
+  mosquitto_log: null
+
+>>> /opt/docker/compose/paperless-ngx/compose.yaml
+#version: "3.4"
+services:
+  broker:
+    image: docker.io/library/redis:7
+    restart: unless-stopped
+    volumes:
+      - redisdata:/data
+    networks:
+      - tnet
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    restart: unless-stopped
+    depends_on:
+      - broker
+    ports:
+      - 8200:8000
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - -fs
+        - -S
+        - --max-time
+        - "2"
+        - http://localhost:8000
+      interval: 30s
+      timeout: 10s
+      retries: 5
+    volumes:
+      - data:/usr/src/paperless/data
+      - media:/usr/src/paperless/media
+      - /mnt/documents/paperless/export:/usr/src/paperless/export
+      - /mnt/documents/paperless/consume:/usr/src/paperless/consume
+    # env_file: docker-compose.env
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_DBHOST: 10.0.50.60
+      PAPERLESS_DBPORT: 5432
+      PAPERLESS_DBNAME: paperless-ng
+      PAPERLESS_DBUSER: paperless-ng
+      PAPERLESS_DBPASS: paperless-ng
+      # PAPERLESS_MEDIA_ROOT=/data/media
+      PAPERLESS_CONSUMPTION_DIR: /usr/src/paperless/consume
+      PAPERLESS_EXPORT_DIR: /usr/src/paperless/export
+      PAPERLESS_CONSUMER_POLLING: 30
+      # PAPERLESS_DATA_DIR=/config
+    labels:
+      - homepage.group=Media
+      - homepage.name=PaperlessNGX
+      - homepage.icon=mdi-file-cabinet
+      - homepage.description=Document Store (esh)
+      - homepage.href=http://10.0.50.45:8200
+      - homepage.sitemonitor=http://10.0.50.45:8200
+      - homepage.widget.type=paperlessngx
+      - homepage.widget.url=http://10.0.50.45:8200
+      - homepage.widget.key=${API_KEY}
+    networks:
+      - tnet
+    env_file:
+      - .env
+  backup:
+    image: offen/docker-volume-backup:latest
+    restart: always
+    volumes:
+      # volumes to backup.
+      - data:/backup/paperless-data:ro
+      - media:/backup/paperless-media:ro
+      - redisdata:/backup/paperless-redisdata:ro
+      - /mnt/backup/docker/esh-vm-docker/paperless:/archive
+      # can omit below if not stopping service.
+      # - /var/run/docker.sock:/var/run/docker.sock:ro
+    env_file:
+      - .env
+    networks:
+      - tnet
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+volumes:
+  data: null
+  media: null
+  redisdata: null
+
+>>> /opt/docker/compose/pgadmin/compose.yaml
+# version: "3.8"
+services:
+  pgadmin:
+    image: dpage/pgadmin4
+    container_name: pgadmin4_container
+    restart: always
+    ports:
+      - 5050:80
+    environment:
+      PGADMIN_DEFAULT_EMAIL: ${DEFAULT_EMAIL}
+      PGADMIN_DEFAULT_PASSWORD: ${DEFAULT_PASSWORD}
+    volumes:
+      - pgadmin-data:/var/lib/pgadmin
+    labels:
+      - homepage.group=Apps
+      - homepage.name=PGAdmin
+      - homepage.icon=mdi-database
+      - homepage.description=pgsql Manager (esh)
+      - homepage.href=http://10.0.50.45:5050
+    networks:
+      - tnet
+    env_file:
+      - .env
+  backup:
+    image: offen/docker-volume-backup:latest
+    restart: always
+    volumes:
+      # volumes to backup.
+      - pgadmin-data:/backup/pgadmin-data:ro
+      - /mnt/backup/docker/esh-vm-docker/pgadmin:/archive
+      # can omit below if not stopping service.
+      # - /var/run/docker.sock:/var/run/docker.sock:ro
+    env_file:
+      - .env
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+volumes:
+  pgadmin-data: null
+
+>>> /opt/docker/compose/traefik/docker-compose.yml
+#version: "3.3"
+
+services:
+  traefik:
+    image: traefik:latest
+    container_name: traefik
+    command:
+      - --log.level=DEBUG
+      - --configFile=/etc/traefik/traefik.yml
+      - --api.insecure=true
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --entrypoints.web.address=:80
+      - --experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      - --experimental.plugins.bouncer.version=v1.6.0
+    environment:
+      - AWS_ACCESS_KEY_ID=${AWS_KEY}
+      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET}
+      - AWS_REGION=${AWS_REGION}
+      - AWS_HOSTED_ZONE_ID=${AWS_ZONEID}
+    ports:
+      - 80:80
+      - 8380:8080
+      - 443:443
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /opt/docker/conf/traefik-esh:/etc/traefik
+    labels:
+      - homepage.group=ESH
+      - homepage.name=traefik
+      - homepage.icon=si-traefikproxy
+      - homepage.sitemonitor=http://10.0.50.45:8380
+      - homepage.href=http://10.0.50.45:8380
+      - homepage.widget.type=traefik
+      - homepage.widget.url=http://10.0.50.45:8380
+      - traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true
+      - traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=${CROWDSEC_KEY}
+      - traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapihost=crowdsec:8080
+      - traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=http
+      - traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecMode=live
+      - traefik.http.middlewares.crowdsec.plugin.bouncer.defaultDecisionSeconds=60
+    networks:
+      - tnet
+    env_file:
+      - .env
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+>>> /opt/docker/compose/uptimekuma/compose.yaml
+services:
+  uptime-kuma:
+    restart: always
+    ports:
+      - 3001:3001
+    volumes:
+      - uptime-kuma:/app/data
+    container_name: uptime-kuma
+    image: louislam/uptime-kuma:latest
+    labels:
+      - homepage.group=Apps
+      - homepage.name=Uptime Kuma
+      - homepage.icon=mdi-arrow-up-bold-circle
+      - homepage.description=Service Monitoring (esh)
+      - homepage.href=http://10.0.50.45:3001
+      - homepage.widget.type=uptimekuma
+      - homepage.widget.url=http://10.0.50.45:3001
+      - homepage.widget.slug=nethealth
+    networks:
+      - tnet
+volumes:
+  uptime-kuma: {}
+networks:
+  tnet:
+    name: traefik-net
+    external: true
+
+===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
+
+/opt/docker/conf
+/opt/docker/conf/calibre-web
+/opt/docker/conf/calibre-web/app.db
+/opt/docker/conf/calibre-web/.CALIBRE_RELEASE
+/opt/docker/conf/calibre-web/calibre-web.log
+/opt/docker/conf/calibre-web/calibre-web.log.1
+/opt/docker/conf/calibre-web/calibre-web.log.2
+/opt/docker/conf/calibre-web/client_secrets.json
+/opt/docker/conf/calibre-web/gdrive.db
+/opt/docker/conf/calibre-web/.key
+/opt/docker/conf/cloudflare-ddns
+/opt/docker/conf/cloudflare-ddns/config.json
+/opt/docker/conf/homepage
+/opt/docker/conf/homepage/bookmarks.yaml
+/opt/docker/conf/homepage/custom.css
+/opt/docker/conf/homepage/custom.js
+/opt/docker/conf/homepage/docker.yaml
+/opt/docker/conf/homepage/imgs
+/opt/docker/conf/homepage/imgs/bg1.jpg
+/opt/docker/conf/homepage/imgs/Thumbs.db
+/opt/docker/conf/homepage/kubernetes.yaml
+/opt/docker/conf/homepage/logs
+/opt/docker/conf/homepage/logs/homepage.log
+/opt/docker/conf/homepage/nas-tls
+/opt/docker/conf/homepage/nas-tls/ca.pem
+/opt/docker/conf/homepage/nas-tls/cert.pem
+/opt/docker/conf/homepage/nas-tls/key.pem
+/opt/docker/conf/homepage/proxmox.yaml
+/opt/docker/conf/homepage/services.yaml
+/opt/docker/conf/homepage/settings.yaml
+/opt/docker/conf/homepage/widgets.yaml
+/opt/docker/conf/mosquitto
+/opt/docker/conf/mosquitto/mosquitto.conf
+/opt/docker/conf/mosquitto/mosquitto.log
+/opt/docker/conf/mosquitto/mosquitto.passwd
+/opt/docker/conf/traefik-esh
+/opt/docker/conf/traefik-esh/certs
+/opt/docker/conf/traefik-esh/certs/acme.json
+/opt/docker/conf/traefik-esh/traefik.yml
+
+===== LISTENING PORTS =====
+
+0.0.0.0:111
+0.0.0.0:1883
+0.0.0.0:22
+0.0.0.0:3000
+0.0.0.0:3001
+0.0.0.0:443
+0.0.0.0:5001
+0.0.0.0:5050
+0.0.0.0:5100
+0.0.0.0:53
+0.0.0.0:6052
+0.0.0.0:7007
+0.0.0.0:80
+0.0.0.0:8000
+0.0.0.0:8080
+0.0.0.0:8082
+0.0.0.0:8083
+0.0.0.0:8087
+0.0.0.0:8181
+0.0.0.0:8200
+0.0.0.0:8281
+0.0.0.0:8380
+0.0.0.0:8443
+0.0.0.0:8447
+0.0.0.0:853
+0.0.0.0:9001
+0.0.0.0:9443
+[::]:111
+127.0.0.1:35469
+[::]:1883
+[::]:22
+*:2375
+[::]:3000
+[::]:3001
+[::]:443
+[::]:5001
+[::]:5050
+[::]:5100
+[::]:53
+[::]:80
+[::]:8000
+[::]:8080
+[::]:8082
+[::]:8083
+[::]:8087
+[::]:8181
+[::]:8200
+[::]:8281
+[::]:8380
+[::]:8443
+[::]:8447
+[::]:853
+[::]:9001
+[::]:9443
+
+===== MODEL / HUGGINGFACE CACHES =====
+
+
+===== DOCKER-ADJACENT SYSTEMD SERVICES =====
+
+containerd.service running
+docker.service running
+
+===== DONE =====
+
+Paste the above back into the chat, or pass a path as argv[1] to save.