182 services, described by themselves

Operations 67

• adminer

  Lightweight web interface for inspecting and editing databases.

  endpoints

  1

  variables

  4

• apt-cacher-ng

  Caching proxy that speeds up repeated operating-system package downloads.

  endpoints

  1

• authelia

  Authentication portal adding login and two-factor in front of stack services.

  endpoints

  1

  credentials

  3

  variables

  3

• backup-checker

  Observability suite

  Confirms backups arrived and were pushed offsite, and reports daily — an unverified backup counts as a failure.

  variables

  1

• browserless

  Managed headless browser pool for automated page rendering and testing.

  endpoints

  1

  credentials

  1

  variables

  2

• changedetection

  Watches web pages for changes and notifies when their content differs.

  variables

  4

• clamav

  Antivirus engine that scans uploaded files for malware.

• code-server

  Full VS Code development environment served in the browser.

  credentials

  1

  variables

  4

• coredns

  Local DNS for multi-project development, answering each project's hostnames with its own loopback address from a rendered zone file.

• crowdsec

  Behaviour-based intrusion detection that spots and blocks malicious traffic patterns.

  endpoints

  1

  credentials

  1

  variables

  1

• data-protection-agent

  Internal IT

  Backup and restore agent for Docker volumes and databases, with rclone sync to remote storage.

  credentials

  7

  variables

  50

• diun

  Notifies operators when newer versions of deployed container images are published.

  variables

  6

• dozzle

  Live log viewer for the containers in the stack.

  endpoints

  1

  variables

  3

• filebrowser

  Web file manager for browsing, uploading and sharing files in the stack.

  credentials

  2

  variables

  3

• fixer-master

  Observability suite

  Self-healing orchestrator: receives alerts and routes remediation to the right worker.

  variables

  1

• fixer-worker

  Observability suite

  Self-healing executor: watches local container events and carries out remediation actions on the host it runs on.

  endpoints

  1

  variables

  5

• forgejo

  Self-hosted git forge with issues, pull requests and package hosting.

  endpoints

  2

  variables

  4

• gitlab-runner

  Continuous-integration job runner that executes pipeline builds in containers.

  credentials

  1

• gotenberg

  Document conversion service that turns web pages and office files into PDFs.

  endpoints

  1

• guacamole

  Browser-based gateway for reaching remote desktops and terminals without a client.

  credentials

  2

  variables

  6

• guacd

  Protocol proxy daemon that backs the Guacamole remote desktop gateway.

• hive-build

  Builds hive-mind's corpus from documentation repositories, rendering their markdown and refusing credential-shaped content at the gate.

  credentials

  1

• hive-indexer

  Indexes a markdown corpus for hive-mind: chunks on document structure, embeds locally and writes the store the server reads. No ports, no ingress, and it refuses a pass that would silently shrink the index.

  credentials

  1

• hive-scribe

  Turns a user's proposed edit into a merge request authored as them — never a direct push. The only hive-mind container that holds write credentials.

• hive-sync

  Delivers each person's private space to their own enrolled devices and nothing else, so their notes are a live window onto the hive.

• hive-worker

  Turns session transcripts into archive summaries for personal spaces, so the server's write surface stays a simple append.

• homepage

  Dashboard start page giving operators one place to reach every stack service.

  variables

  3

• imgproxy

  On-the-fly image resizing and optimisation for fast page loads.

  endpoints

  1

  credentials

  2

  variables

  3

• it-tools

  Collection of handy developer utilities such as converters, generators and calculators.

  variables

  3

• keycloak

  Single sign-on identity provider for the stack.

  endpoints

  1

  credentials

  4

  variables

  4

• lldap

  Lightweight user directory with a simple web admin interface.

  endpoints

  2

  credentials

  2

  variables

  4

• localstack

  Local emulator of common cloud services for development and testing.

  endpoints

  1

  variables

  2

• mailtrap

  Mail catcher for development — captures outbound email and provides a web viewer (Mailpit).

• netbox

  Network source of truth for IP address management and datacentre inventory.

  credentials

  3

  variables

  6

• ntfy

  Push notification server that delivers alerts and messages to phones and desktops.

  variables

  4

• oauth2-proxy

  Adds provider-backed sign-in in front of upstream services.

  endpoints

  1

  credentials

  3

  variables

  4

• ofelia

  Scheduled task runner that executes cron jobs inside the stack's containers.

• pgadmin

  Web interface for administering the PostgreSQL database.

  endpoints

  1

  credentials

  2

  variables

  3

• phpmyadmin

  Web interface for administering the MySQL database.

  endpoints

  1

  variables

  4

• pihole

  Internal IT

  Network-wide DNS with ad-blocking for a local estate.

  credentials

  1

• portainer

  Web console for managing the container platform.

  endpoints

  1

  variables

  3

• redpanda-console

  Web console for browsing topics, messages and consumers on the streaming broker.

  endpoints

  1

  variables

  4

• restic-rest-server

  Backup repository server that restic clients push encrypted snapshots to.

  endpoints

  1

  variables

  1

• sandbox-builder

  Sandbox estate

  Provisions ephemeral sandbox containers on demand. Privileged by nature — treat accordingly.

  variables

  2

• selenium

  Headless Chrome on the stack network for browser-driven tests.

  endpoints

  3

  credentials

  1

  variables

  1

• semaphore

  Web console for running and scheduling automation playbooks with full history.

  credentials

  3

  variables

  4

• service-engine

  Stack service-engine — internal debugging and shell access component.

• smtp-relay

  Outbound email relay that delivers the stack's mail to the wider internet.

  endpoints

  1

  variables

  3

• step-ca

  Private certificate authority that issues TLS certificates for internal services.

  endpoints

  1

  credentials

  1

  variables

  3

• stirling-pdf

  Toolbox for merging, splitting, converting and editing PDF documents.

  variables

  4

• substrate-api

  Substrate control plane

  Microcelium Substrate control plane — FastAPI JSON API + HTMX UI + MCP server in one process.

• substrate-files

  Substrate control plane

  The platform's artefact shelf: boot images, installers and firmware served from one well-known place, so bare-metal installs, PXE boots and BMC updates all pull from the same source the platform builds into.

• substrate-registry

  Substrate control plane

  Substrate private OCI registry (registry:2) — bearer auth delegated to the substrate token endpoint; toggle service, up only while a deploy needs it.

• substrate-runner

  Substrate control plane

  Substrate job-runner daemon — claims queued jobs and runs the wrapper scripts that need docker.

• substrate-tang

  Network-bound disk encryption for the fleet: a server's encrypted disks unlock automatically only while it sits on the trusted network — taken off-site or off-net, they stay sealed. No passphrase to type at a console, no TPM dependency, keys held server-side and backed up.

• substrate-test

  Substrate control plane

  The control plane's contract test suite, profile-gated — never part of a default stack.

• syncthing

  Continuous file synchronisation between machines without a central server.

  endpoints

  1

  variables

  3

• tiny-tools

  Network / diagnostics shell container (dig, curl, mtr, nmap, tcpdump, ss, lsof, iperf3, socat) on the stack network — exec into it to debug from inside.

  variables

  2

• trivy

  Vulnerability scanner that checks container images and code for known security flaws.

  endpoints

  1

• unifi-controller

  Internal IT

  UniFi Network controller for managing Ubiquiti network devices.

• vaultwarden

  Self-hosted password vault compatible with Bitwarden clients.

  endpoints

  1

  credentials

  1

  variables

  4

• verdaccio

  Private npm package registry that also caches the public registry.

  endpoints

  1

  variables

  3

• wg-easy

  WireGuard VPN server with a web console for managing devices and peers.

  endpoints

  1

  credentials

  1

  variables

  4

• whoami

  Diagnostic echo page showing exactly what an incoming web request looks like.

  variables

  3

• wiremock

  Mock server that simulates external web services for testing.

  endpoints

  1

• woodpecker-agent

  Worker that executes the continuous-integration pipelines.

  credentials

  1

  variables

  2

• woodpecker-server

  Continuous-integration server that runs pipelines from the git forge.

  endpoints

  1

  credentials

  3

  variables

  6