diff --git a/common/ports-registry.md b/common/ports-registry.md index dc4986e..cfeb821 100644 --- a/common/ports-registry.md +++ b/common/ports-registry.md @@ -1,5 +1,5 @@ # Ports Registry — NAS Synology DS920+ -# Derniere mise a jour : 16 juin 2026 +# Derniere mise a jour : 03/07/2026 (resync etat REEL, 43 containers) # LIRE CE FICHIER AVANT TOUT NOUVEAU DEPLOIEMENT # Mettre a jour apres chaque ajout/suppression de service @@ -11,199 +11,134 @@ Choisir un port libre et l'inscrire ici avant de deployer. --- -## SERVICES ACTIFS — Etat au 16 juin 2026 +## SERVICES ACTIFS — Etat REEL au 03/07/2026 -Cette section est la source de verite sur ce qui tourne reellement. -Mise a jour obligatoire a chaque deploiement ET a chaque suppression. +Source de verite = `docker ps` reel (via socket), pas le declaratif. +Colonne Exposition = binding reel constate. Restart/Health signales quand a risque. -| Service | Port | URL / Domaine | Statut | Notes | -|----------------------|-------|------------------------------|----------|------------------------------------| -| n8n | 5678 | n8n.bolbol.tn | ACTIF | Orchestration centrale | -| Baserow | 3888 | baserow.bolbol.tn | ACTIF | Base de donnees metier | -| Gitea | 3232 | gitea.bolbol.tn | ACTIF | Versioning (compte bolbol) | -| Portainer | 9000 | portainer.bolbol.tn | ACTIF | Gestion containers | -| NyoraNotes | 8787 | - | ACTIF | Memoire inter-sessions Hermes | -| linux-mcp-nas | 3042 | mcp-nas.nd.i234.me | ACTIF | MCP shell NAS | -| Bifrost | 3085 | bifrost.bolbol.tn | ACTIF | Gateway LLM | -| bifrost-proxy | 3086 | - | ACTIF | Auth rewrite + cap 16384 tokens | -| hermes-workspace-tt | 3010 | hermes-tt.bolbol.tn | ACTIF | Hermes TT workspace | -| hermes-workspace-nyora| 3020 | hermes-nyora.bolbol.tn | ACTIF | Hermes Nyora workspace | -| hermes-workspace-perso| 3030 | hermes-perso.bolbol.tn | ACTIF | Hermes Perso workspace | -| hermes-agent-tt | 8650 | interne Docker | ACTIF | Agent TT | -| hermes-agent-nyora | 8660 | interne Docker | ACTIF | Agent Nyora | -| hermes-agent-perso | 8670 | interne Docker | ACTIF | Agent Perso | -| Pandoc | 3002 | - | ACTIF | Stack documentaire MD->DOCX/HTML | -| Gotenberg | 3001 | - | ACTIF | Stack documentaire HTML->PDF | -| Carbone | 4000 | - | ACTIF | Templates DOCX/XLSX + JSON | -| pptx-tt-api | 8015 | - | ACTIF | PPTX charte TT | -| Tika | 9998 | - | ACTIF | Extraction documents | -| Paperless | 8021 | paperless.bolbol.tn | ACTIF | GED | -| Trilium | 4292 | trilium.bolbol.tn | ACTIF | Notes | -| Pingvin-Share | 6090 | share.bolbol.tn | ACTIF | Partage fichiers | -| WireGuard (wg-easy) | 51820 | - | ACTIF | VPN UDP | -| wg-easy UI | 51821 | vpn.bolbol.tn | ACTIF | Interface WireGuard | -| Family Help | 3041 | help.bolbol.tn | ACTIF | IA familiale FastAPI+SQLite | -| nyora-veille | 3055 | veille.bolbol.tn | ACTIF | Veille IA vanilla JS/nginx | -| veille-backend | 8000 | interne Docker | ACTIF | Backend veille FastAPI | -| gsparc-mezzouna | — | gsparc-mezzouna.bolbol.tn | ACTIF | Gestion carburant fleet | -| rla-api | 3005 | - | ACTIF | RLA contrats TT | -| document-factory | 3015 | - | ACTIF | Usine documentaire | -| Plex | 32400 | - | ACTIF | Media | -| Radarr | 7878 | - | ACTIF | Media | -| Sonarr | 8989 | - | ACTIF | Media | -| Prowlarr | 9696 | - | ACTIF | Media | -| Open WebUI | 3091 | — | ACTIF | -| hermes-nyora-webui | 3021 | — | DESINSTALLE 15/06/2026 | Port 3021 LIBRE | -| hermes-dashboard | 3092 | — | DESINSTALLE 15/06/2026 | Port 3092 LIBRE | +| Service | Port | Domaine | Reseau | Exposition | Restart | Health | Notes | +|---------|------|---------|--------|------------|---------|--------|-------| +| n8n | 5678->5678 | n8n.bolbol.tn | n8n,n8n_default | 0.0.0.0 | **on-failure** | healthy | Orchestration centrale ; restart on-failure (voir alerte) | +| n8n-DB | interne | - | n8n_default | interne Docker | **on-failure** | **none** | Postgres n8n ; reseau n8n_default ; restart on-failure | +| Baserow | 3888->80 | baserow.bolbol.tn | baserow_baserow_network,n8n | 0.0.0.0 | unless-stopped | healthy | Base metier ; depends db+redis healthy | +| Baserow-DB | interne | - | baserow_baserow_network | interne Docker | unless-stopped | healthy | Postgres Baserow | +| Baserow-REDIS | interne | - | baserow_baserow_network | interne Docker | unless-stopped | healthy | Redis Baserow | +| gitea | 2222->22, 3232->3232 | gitea.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | healthy | Versioning (bolbol) ; SSH 2222 + 3232 | +| portainer | 9000->9000, 9443->9443 | portainer.bolbol.tn | bridge | 0.0.0.0 | unless-stopped | **none** | Gestion containers ; reseau bridge | +| nyora-notes | 8787->8787 | - | n8n | 0.0.0.0 | unless-stopped | healthy | Memoire inter-sessions Hermes (8787) | +| linux-mcp-nas | 127.0.0.1:3042->8000 | mcp-nas.nd.i234.me | n8n | 127.0.0.1 | always | healthy | MCP shell NAS ; bind 127.0.0.1 (via reverse-proxy) | +| bifrost | 3085->8080 | - (retire du WAN 03/07) | n8n | 0.0.0.0 | unless-stopped | healthy | Gateway LLM ; piege allow_all_keys DB | +| bifrost-proxy | 3086->80 | - | n8n | 0.0.0.0 | unless-stopped | **none** | Auth rewrite + cap 16384 tokens ; PAS de healthcheck | +| hermes-workspace-tt | 3010->3000 | hermes-tt.bolbol.tn | hermes-tt-net,n8n | 0.0.0.0 | unless-stopped | healthy | Workspace TT (agent=8650 interne) | +| hermes-workspace-nyora | 3020->3000 | hermes-nyora.bolbol.tn | hermes-nyora-net,n8n | 0.0.0.0 | unless-stopped | healthy | Workspace Nyora (agent=8660 interne) | +| hermes-workspace-perso | 3030->3000 | hermes-perso.bolbol.tn | hermes-perso-net,n8n | 0.0.0.0 | unless-stopped | healthy | Workspace Perso (agent=8670 interne) | +| hermes-agent-tt | interne | interne | hermes-tt-net,n8n | interne Docker | unless-stopped | healthy | Agent TT ; DeepSeek V4 Flash | +| hermes-agent-nyora | interne | interne | hermes-nyora-net,n8n | interne Docker | unless-stopped | healthy | Agent Nyora ; DeepSeek V4 Flash | +| hermes-agent-perso | interne | interne | hermes-perso-net,n8n | interne Docker | unless-stopped | healthy | Agent Perso ; DeepSeek V4 Flash | +| hermes-mail-proxy | 3060->8000 | - | n8n | 0.0.0.0 | unless-stopped | **none** | Proxy mail Hermes (3060) | +| nyora-doc-api | 3050->8000 | - | n8n | 0.0.0.0 | unless-stopped | healthy | Moteur doc unique (docx/xlsx/pptx/pdf) charte Nyora | +| redaction-pro | 3092->80 | llm.bolbol.tn | n8n | 0.0.0.0 | always | **none** | Assistant redaction LLM (proxy Bifrost) | +| context-hub | 3093->8000 | context.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | healthy | Contexte agents 5 scopes ; MCP SSE | +| family-help | 3041->8000 | help.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | **none** | IA familiale FastAPI+SQLite ; PAS de healthcheck | +| gsparc-mezzouna-api | 3040->8000 | gsparc-mezzouna.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | healthy | OCR carburant kimi-k2.6 | +| rla-api | 3005->3005 | rla.bolbol.tn | bridge | 0.0.0.0 | unless-stopped | **none** | RLA contrats TT ; reseau BRIDGE (voir alerte couplage) | +| reglement-definitif-api | 5099->5055 | - | n8n | 0.0.0.0 | **no** | **none** | Reglement definitif TT ; restart NO (voir alerte) | +| veille-frontend | 3055->3000 | veille.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | **none** | Veille IA ; depends veille-backend | +| veille-backend | interne | interne | n8n | interne Docker | unless-stopped | **none** | Backend veille FastAPI | +| dashboard-terrain | 8085->8080 | dashboard-terrain.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | **none** | Dashboard terrain | +| panda-dashboard | 3021->80 | panda.bolbol.tn | n8n_default | 0.0.0.0 | always | **none** | Dashboard Fiat Panda ; reseau n8n_default | +| prompt-studio | 8090->8090 | - | n8n | 0.0.0.0 | unless-stopped | **none** | Prompt studio (8090) ; bind 0.0.0.0 LAN | +| Trilium | 4292->8080 | trilium.bolbol.tn | n8n,trilium_default | 0.0.0.0 | **no** | healthy | Notes ; restart NO (voir alerte) | +| Pingvin-Share | 6090->3000 | share.bolbol.tn / pv.bolbol.tn | n8n,pingvin_default | 0.0.0.0 | always | healthy | Partage fichiers | +| pihole | 3001->80, 192.168.100.33:53->53, 192.168.100.33:53->53/udp | - (admin 3001) | n8n | 0.0.0.0 | always | healthy | DNS LAN (53) + admin 3001 bind 0.0.0.0 | +| crowdsec | 127.0.0.1:9090->8080 | - | n8n | 127.0.0.1 | always | **none** | IDS ; bind 127.0.0.1:9090 ; parse auth.log+nginx error.log | +| crowdsec-firewall-bouncer | interne | - | host | interne Docker | always | **none** | Bouncer ipset ; network host ; NET_ADMIN | +| wg-easy | interne | vpn (UI 51821) | host | interne Docker | unless-stopped | healthy | VPN WireGuard 51820/udp ; network host ; MDP renforce 03/07 | +| watchtower-nas | interne | - | bridge | interne Docker | unless-stopped | healthy | Auto-update images (attention rollout :latest) | +| ovh-ddns | interne | - | ovh-ddns_default | interne Docker | unless-stopped | **none** | Mise a jour DNS dynamique OVH | +| flaresolverr | 8191->8191 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Bypass Cloudflare ; media-stack | +| prowlarr | 9696->9696 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Indexeur ; media-stack | +| radarr | 7878->7878 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Films ; media-stack | +| sonarr | 8989->8989 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Series ; media-stack | +| qbittorrent-vue | 6881->6881, 6881->6881/udp, 9866->9866 | qb.bolbol.tn | media-stack_default,qbittorrent-vue_default | 0.0.0.0 | unless-stopped | **none** | Torrent (6881) + UI 9866 | --- -## Hermes Platform - -| Port | Service | Reseau | Exposition | -|------|--------------------------|---------|---------------------------------------------------| -| 3010 | hermes-workspace-tt | n8n | 0.0.0.0 | -| 3020 | hermes-workspace-nyora | n8n | 0.0.0.0 | -| 3030 | hermes-workspace-perso | n8n | 0.0.0.0 | -| 8650 | hermes-agent-tt | n8n | interne Docker uniquement | -| 8660 | hermes-agent-nyora | n8n | interne Docker uniquement | -| 8670 | hermes-agent-perso | n8n | interne Docker uniquement | - -> Maintenance Hermes : apres CHAQUE mise a jour des images, executer -> `/usr/local/bin/docker image prune -f` (builds :latest quotidiens empilent ~3.3GB). -> `scripts/cleanup-backups.sh` pour rotation data.bak (garde 2 derniers jeux). +## Bases de donnees (internes) +| Port | Service | Exposition | +|------|---------|------------| +| 5432 | postgres (n8n-DB, Baserow-DB) | interne / n8n_default | +| 6379 | redis (Baserow-REDIS) | interne | --- -## Stack Documentaire - -| Port | Service | Reseau | Exposition | -|------|--------------------------|---------|---------------| -| 3001 | gotenberg | n8n | 0.0.0.0 | -| 3002 | pandoc | n8n | 0.0.0.0 | -| 3003 | docx-generator | n8n | 127.0.0.1 | -| 3005 | rla-api | n8n | 0.0.0.0 | -| 3015 | document-factory | n8n | 0.0.0.0 | -| 4000 | carbone | n8n | 0.0.0.0 | -| 5099 | reglement-definitif-api | n8n | 0.0.0.0 | -| 8002 | document-factory-api | n8n | 0.0.0.0 | -| 8015 | pptx-tt-api | n8n | 0.0.0.0 | -| 9998 | tika | n8n | 0.0.0.0 | +## DSM Systeme (exposition WAN reelle : seuls 80/222/443/8080 forwardes par la box) +| Port | Service | Exposition | +|------|---------|------------| +| 80 | DSM HTTP / reverse-proxy | 0.0.0.0 | +| 222 | DSM SSH (OpenSSH 8.2) | 0.0.0.0 WAN — a fermer | +| 443 | DSM HTTPS / reverse-proxy | 0.0.0.0 | +| 2222 | Gitea SSH | 0.0.0.0 | +| 6690 | DSM Cloud Sync | 0.0.0.0 | +| 8080 | DSM / watchtower | 0.0.0.0 | +| 22222 | NAS SSH principal | 0.0.0.0 | --- -## AI Gateway - -| Port | Service | Reseau | Exposition | Notes | -|------|--------------------------|---------|---------------|------------------------------------| -| 3085 | bifrost | n8n | 0.0.0.0 | Gateway LLM multi-modeles | -| 3086 | bifrost-proxy | n8n | 0.0.0.0 | Auth rewrite + cap max_tokens | - ---- - -## Applications - -| Port | Service | Reseau | Exposition | -|-------|--------------------------|---------|---------------| -| 3041 | family-help | n8n | 0.0.0.0 | -| 3042 | linux-mcp-nas | n8n | 0.0.0.0 | -| 3055 | nyora-veille frontend | n8n | 0.0.0.0 | -| 3232 | gitea | bridge | 0.0.0.0 | -| 3888 | Baserow | n8n | 0.0.0.0 | -| 4292 | Trilium | n8n | 0.0.0.0 | -| 4501 | Obsidian-Remote | bridge | 0.0.0.0 | -| 5678 | n8n | n8n | 0.0.0.0 | -| 6090 | Pingvin-Share | bridge | 0.0.0.0 | -| 8000 | veille-backend | n8n | interne | -| 8021 | paperless | n8n | 127.0.0.1 | -| 8085 | dashboard-terrain | n8n | 0.0.0.0 | -| 8787 | nyora-notes | n8n | 0.0.0.0 | -| 9000 | portainer | bridge | 0.0.0.0 | -| 9443 | portainer (https) | bridge | 0.0.0.0 | -| 51820 | wg-easy (WireGuard) | host | 0.0.0.0 UDP | -| 51821 | wg-easy UI | host | 0.0.0.0 | -| 27123 | Obsidian-Remote sync | bridge | 0.0.0.0 | -| 27124 | Obsidian-Remote sync | bridge | 0.0.0.0 | - ---- - -## Media - -| Port | Service | Reseau | Exposition | -|-------|--------------------------|--------------------|---------------| -| 6881 | qbittorrent | media-stack_default| 0.0.0.0 | -| 7878 | radarr | media-stack_default| 0.0.0.0 | -| 8191 | flaresolverr | media-stack_default| 0.0.0.0 | -| 8989 | sonarr | media-stack_default| 0.0.0.0 | -| 9696 | prowlarr | media-stack_default| 0.0.0.0 | -| 9866 | qbittorrent UI | media-stack_default| 0.0.0.0 | -| 32400 | Plex | media-stack_default| local | - ---- - -## Bases de donnees (internes uniquement) - -| Port | Service | Exposition | -|-------|--------------------------|---------------| -| 5432 | postgres (multiple DBs) | 127.0.0.1 | -| 6379 | redis (multiple) | local | -| 3306 | mysql rayhan | local | - ---- - -## DSM Systeme - -| Port | Service | Exposition | -|-------|--------------------------|---------------| -| 80 | DSM HTTP | 0.0.0.0 | -| 222 | DSM SSH alternatif | 0.0.0.0 | -| 443 | DSM HTTPS | 0.0.0.0 | -| 2222 | Gitea SSH | 0.0.0.0 | -| 6690 | DSM Cloud Sync | 0.0.0.0 | -| 8080 | DSM / watchtower | 0.0.0.0 | -| 22222 | NAS SSH (port principal) | 0.0.0.0 | +## SERVICES RETIRES (ne pas reinstaller, ne pas reutiliser le vhost) +| Service | Port libere | Retire | Remplace par | +|---------|-------------|--------|--------------| +| gotenberg | 3001 (repris par pihole) | 21/06 | nyora-doc-api | +| pandoc | 3002 | 21/06 | nyora-doc-api | +| document-factory | 3015 | 21/06 | nyora-doc-api | +| carbone | 4000 | 21/06 | nyora-doc-api | +| document-factory-api | 8002 | 21/06 | nyora-doc-api | +| pptx-tt-api | 8015 | 29/06 | nyora-doc-api (vhost pptx.bolbol.tn fantome a purger) | +| open-webui | 3091 | 29/06 | redaction-pro | +| tika | 9998 | — | gemini-3-flash OCR | +| paperless | 8021 | — | — | +| rayhan-frontend | 3013 | 29/06 | projet clos | +| rayhan-mysql | 3306 | 29/06 | projet clos | +| Plex | 32400 | — | absent du stack actuel | --- ## Plages libres recommandees - -| Plage | Usage suggere | -|-------------|--------------------------------------| -| 3021 | LIBRE (hermes-nyora-webui desinstalle 15/06) | -| 3040-3099 | Extensions Hermes / nouveaux agents | -| 3091 | OCCUPE (Open WebUI actif port 3091) | -| 3092 | LIBRE (hermes-dashboard desinstalle 15/06) | -| 3100-3199 | APIs internes | -| 8800-8899 | UIs web supplementaires | -| 8900-8999 | Services experimentaux | +| Plage | Usage | +|-------|-------| +| 3013 | LIBRE (rayhan-frontend) | +| 3091 | LIBRE (open-webui) | +| 3015 | LIBRE (document-factory) | +| 3002 | LIBRE (pandoc) | +| 4000 | LIBRE (carbone) | +| 8002 | LIBRE (document-factory-api) | +| 8015 | LIBRE (pptx-tt-api) | +| 9998 | LIBRE (tika) | +| 8021 | LIBRE (paperless) | +| 3100-3199 | APIs internes | +| 8800-8899 | UIs web | +| 8900-8999 | Experimental | --- ## Ports a ne JAMAIS utiliser - -- 8787 : nyora-notes (conflit hermes-webui par defaut) +- 3001 : pihole admin (repris depuis gotenberg) +- 8787 : nyora-notes - 3000 : port interne Docker (ne pas exposer) -- 5432 : postgres (interne uniquement) -- 22 : SSH DSM interne (utiliser 22222) +- 5432 : postgres interne +- 53 : pihole DNS +- 22 : SSH DSM interne (utiliser 22222) --- -## Historique des modifications +## Historique des modifications (recentes) +| Date | Action | Port | Service | +|------|--------|------|---------| +| 2026-07-03 | RESYNC complet etat reel (43 containers) + audit securite | — | ports-registry.md v3 | +| 2026-07-03 | Bifrost retire du reverse-proxy WAN (securite) | 3085 | bifrost | +| 2026-07-03 | MDP UI wg-easy renforce 8->28 car | 51821 | wg-easy | +| 2026-06-29 | Resync partiel v2 (voir git history) | — | — | -| Date | Action | Port | Service | -|------------|-------------------------------------|-------|--------------------------| -| 2026-05-28 | Creation initiale du registre | — | — | -| 2026-05-28 | Deploiement hermes-nyora-webui | 3021 | hermes-nyora-webui | -| 2026-06-05 | Deploiement linux-mcp-nas | 3042 | linux-mcp-nas | -| 2026-06-05 | Migration WireGuard VPN vers NAS | 51820 | wg-easy | -| 2026-06-05 | Migration WireGuard UI vers NAS | 51821 | wg-easy UI | -| 2026-06-08 | Deploiement dashboard-terrain | 8085 | dashboard-terrain | -| 2026-06-09 | Deploiement Open WebUI | 3091 | open-webui | -| 2026-06-09 | Deploiement hermes-dashboard | 3092 | hermes-dashboard | -| 2026-06-11 | Deploiement nyora-veille | 3055 | veille-frontend | -| 2026-06-11 | Deploiement veille-backend | 8000 | veille-backend (interne) | -| 2026-06-15 | DESINSTALLATION hermes-nyora-webui | 3021 | LIBRE | -| 2026-06-15 | DESINSTALLATION hermes-dashboard | 3092 | LIBRE | -| 2026-06-16 | Deploiement Bifrost + bifrost-proxy | 3085 | bifrost | -| 2026-06-16 | Deploiement bifrost-proxy | 3086 | bifrost-proxy | -| 2026-06-16 | Ajout section Services Actifs | — | ports-registry.md v2 | +> Note v3 : ce registre reflete l etat REEL constate via socket Docker le 03/07/2026. +> Services ajoutes vs v2 : pihole, prompt-studio, hermes-mail-proxy, context-hub, nyora-doc-api, +> gsparc-mezzouna-api, reglement-definitif-api, watchtower-nas, ovh-ddns, flaresolverr, crowdsec x2.