Service catalog
This is the canonical service lifecycle, ownership, criticality, recovery priority, image, listener, and dependency record. Runtime rows were verified on 2026-07-17 unless noted.
Current services
| Service | Host/runtime | Image/version | Listener or route | Owner / priority | Evidence |
|---|---|---|---|---|---|
| OPNsense | VM 100 |
Version unverified on 2026-07-17 | LAN 192.168.0.1, DMZ 192.168.2.1 last verified 2026-07-02 |
IT Operations / P1 | VM running; guest access unavailable |
| Technitium DNS | CT 102, native service |
Package version unverified | 192.168.2.2:53, console :5380 |
IT Operations / P2 | Service/listeners verified |
| Caddy ingress | CT 103, native service |
Caddy v2.11.4 |
:80, :443 |
IT Operations / P2 | Service/listeners/routes verified |
| PostgreSQL | CT 101, rootless Podman |
postgres:16-alpine |
Podman network only, 5432/tcp |
IT Operations / P3 | Healthy container |
| Forgejo | CT 101, rootless Podman |
codeberg.org/forgejo/forgejo:11 |
git.kh3group.com; 30080; SSH 2222 |
IT Operations / P3 | Container/unit verified |
| Forgejo Actions runner | CT 101, rootless Podman |
forgejo/runner:6.3.1 |
Control plane http://forgejo:3000; no host listener |
IT Operations / P3 | Container/unit/config verified |
| Vaultwarden | CT 101, rootless Podman |
vaultwarden:latest-alpine |
pass.kh3group.com; 30081 |
IT Operations / P3 | Container/unit verified |
| Adminer | CT 101, rootless Podman |
adminer:4.8.1 |
dbgui.kh3group.com; 30082 |
IT Operations / P4 | Container/unit verified; access policy must protect route |
| Dozzle | CT 101, rootless Podman |
dozzle:latest |
30083; admin route |
IT Operations / P4 | Container/unit verified |
| Documentation static backend | CT 101, rootless Podman |
caddy:2-alpine |
30084; docs.kh3group.com |
IT Operations / P3 | Publishing architecture |
| KH3 dev static backend | CT 101, rootless Podman |
caddy:2-alpine |
30085; kh3-dev-site.kh3group.com |
Development / P4 | Container/unit verified |
| Headscale | ovps-me, rootless Podman |
Headscale v0.29.1 |
vpn.kh3group.com |
IT Operations / P2 | Version/nodes verified |
| Headplane | ovps-me, rootless Podman |
headplane:latest |
vpn-ui.kh3group.com |
IT Operations / P3 | Container running |
| VPS Caddy | ovps-me, rootless Podman |
custom Cloudflare build | :80, :443 |
IT Operations / P2 | Container running |
| Tailscale subnet router | CT 105, native client |
Version unverified 2026-07-17 | Routes 192.168.0.0/24, 192.168.2.0/24 |
IT Operations / P2 | Headscale routes verified |
| RustDesk OSS | CT 106, rootless Podman |
rustdesk-server:latest |
21115/tcp, 21116/tcp+udp, 21117/tcp |
IT Operations / P3 | Service last verified 2026-07-02; guest running 2026-07-17 |
| khysite | CT 104 |
Deployment source unverified | 192.168.2.5 |
Owner/priority unverified | Guest only verified |
P1 is the first recovery priority; P4 is lower. Business owners are not known for several applications and must be assigned before destructive changes.
Transitional or unverified services
The application and website pages for Homebox, Stirling PDF, Appsmith, MeshCentral, Receipt App, MariaDB, MongoDB, Portainer, Dashboard, Noticeboard, and older websites describe the 2026-06-09 Docker estate. Their present runtime, owner, data, and replacement status were not verified on 2026-07-17. They are historical evidence, not current operating instructions.
Retired or historical platform
| Component | Historical role | Current replacement |
|---|---|---|
| pfSense | Firewall VM and old .100 LAN |
OPNsense VM 100 |
Docker CT 100 |
Application platform | Rootless Podman CT 101 |
| Traefik | HTTPS ingress | Caddy CT 103 |
Pi-hole/Cloudflared CT 107 |
Client DNS | Technitium CT 102 |
| Drone publication | CI copy to CT 103 |
Forgejo Actions shared publish volume |
Nginx docs container/direct CT 103 files |
Static docs | docs-static on CT 101 |
Use history before attempting recovery from the older pages.
Safe service inventory command
ssh pvessh 'pct exec 101 -- runuser -l podsvc -c \
"podman ps --format \"table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}\""'
Do not print environment values or inspect secret-bearing files.