Fleet overview — machines and access
Fleet overview — machines, addresses and access
Everything Conor runs, what it is for, and how to reach it. Audited read-only on 2026-11-06. Per-host detail and open issues: Fleet audit — 2026-11-06.
| host | role | public | tailnet | ssh from cbcore |
|---|---|---|---|---|
| cbcore | home server, Docker host, mail, Forgejo, wiki | 125.253.17.92 (dynamic residential) | 100.64.0.3 | local |
| vps2 | public edge: DNS, TLS, Caddy, headscale | 187.52.126.150 | 100.64.0.16 | vps2-conor |
| cbfarm | marketdata pipeline, Docker, KVM farm | 65.181.15.26 | 100.64.0.4 | cbfarm |
| jamievps | Jamie's production (Helios), not Conor's to break | 31.97.188.242 | 100.64.0.17 | jamievps-conor |
| vps (old) | still the public mail edge, being retired | 203.57.114.42 | 100.64.0.2 | conor@100.64.0.2 |
cbcore — Debian 13, Ryzen 9 7950X (32 threads), 31 GB RAM, 915 GB root
The always-on box. Public entry is only through vps2's Caddy over the tailnet;
almost every service binds 100.64.0.3:<port> rather than 0.0.0.0. Runs ~40
containers: mailcow (18), Forgejo + Postgres, Nextcloud + Collabora, Twenty CRM,
ComfyTax, tradingjournal, rss-hub, Feishin, qBittorrent behind NordVPN, Plex,
Ollama, netdata. Host Caddy serves the tailnet-bound site ports (:8000–:8102).
Root filesystem is 89% full (101 GB free) — the only real capacity timer in
the fleet. conor is in sudo and docker.
vps2 — Debian 13, 2 vCPU EPYC 9355P, 7.9 GB RAM, 99 GB disk (60 GB free)
The public edge since 2026-11-05. Caddy terminates TLS for all ~33 hostnames and
proxies back over the tailnet. Also runs headscale + headplane (tailnet control
plane, 12 nodes), cli-proxy-api on 100.64.0.16:8317, marketdata PHP on :8001,
and strata under PM2 on :3009/:3011. Sites live in /home/deploy/sites/<site>/ {releases,current,shared}, deployed by deploy-sites.timer every 60 s from
Forgejo. Only 2 vCPU — CPU-heavy work does not belong here.
cbfarm — Debian 13, Ryzen 5 3600 (12 threads), 16 GB RAM, 922 GB disk (800 GB free)
Bulk storage and compute. Source of the marketdata pipeline (cron 0 5 * * 2-6,
~/cronjobs/market-data) and of the strata repo. Docker runs Forgejo, Twenty
CRM and a MariaDB; host Caddy serves PHP sites on :8000–:8003 and :8007. KVM is
present and nested virt is enabled, so it can host VMs. 800 GB free — the place
to put anything big.
jamievps — Debian 13, 8 vCPU EPYC 9354P, 32 GB RAM, 394 GB disk (313 GB free)
Jamie's box, Conor has an account but no sudo. Runs the Helios stack
(api :8770, terminal :8030, coverage :8766, playground, gli-webhook), Caddy,
MariaDB on 127.0.0.1:3306, plus Helios timers including an auto-deployer.
No Docker installed. /home/jamie is 0700 and holds production — Conor's user
cannot read it and must not be given docker group membership, which would be
root-equivalent.
vps (old) — Debian 13, 1 vCPU, 967 MB RAM, 20 GB disk
Former edge. Everything except mail has moved to vps2, so it now only does
Postfix/Dovecot/HAProxy on the public mail ports (25, 465, 587, 993, 4190) and
holds the caddy-cert-stage, mailcow-ban-sync and mpanel-memory-graph
timers. Retire it once mail has cut over to vps2. RAM is tight (967 MB).
Conventions that bite
vps.seabee.meno longer means the old vps — DNS points at vps2, so thevpsssh alias fails the host-key check. Useconor@100.64.0.2.- Service ports on these hosts are usually bound to the tailnet IP. Reachable
from anywhere on the tailnet, invisible from the internet;
ss -tlnalone does not show whether that is intended, so check the bind address. - Sudo needs a password everywhere; automated work has to either ask Conor or
use a pre-installed narrow
sudoers.drule. - Timezones are
Australia/Sydneyon all five, but cron on vps2 has noCRON_TZsupport in Debian 13, so the host clock is what sets the schedule.