bolbol
/
nas-runbooks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
nas-runbooks/common/ports-registry.md

9.2 KiB
Raw Blame History

Ports Registry — NAS Synology DS920+

Derniere mise a jour : 03/07/2026 (resync etat REEL, 43 containers)

LIRE CE FICHIER AVANT TOUT NOUVEAU DEPLOIEMENT

Mettre a jour apres chaque ajout/suppression de service

Regle absolue

Aucun nouveau service ne doit utiliser un port deja occupe. Choisir un port libre et l'inscrire ici avant de deployer.

SERVICES ACTIFS — Etat REEL au 03/07/2026

Source de verite = docker ps reel (via socket), pas le declaratif. Colonne Exposition = binding reel constate. Restart/Health signales quand a risque.

Service Port Domaine Reseau Exposition Restart Health Notes
n8n 5678->5678 n8n.bolbol.tn n8n,n8n_default 0.0.0.0 on-failure healthy Orchestration centrale ; restart on-failure (voir alerte)
n8n-DB interne - n8n_default interne Docker on-failure none Postgres n8n ; reseau n8n_default ; restart on-failure
Baserow 3888->80 baserow.bolbol.tn baserow_baserow_network,n8n 0.0.0.0 unless-stopped healthy Base metier ; depends db+redis healthy
Baserow-DB interne - baserow_baserow_network interne Docker unless-stopped healthy Postgres Baserow
Baserow-REDIS interne - baserow_baserow_network interne Docker unless-stopped healthy Redis Baserow
gitea 2222->22, 3232->3232 gitea.bolbol.tn n8n 0.0.0.0 unless-stopped healthy Versioning (bolbol) ; SSH 2222 + 3232
portainer 9000->9000, 9443->9443 portainer.bolbol.tn bridge 0.0.0.0 unless-stopped none Gestion containers ; reseau bridge
nyora-notes 8787->8787 - n8n 0.0.0.0 unless-stopped healthy Memoire inter-sessions Hermes (8787)
linux-mcp-nas 127.0.0.1:3042->8000 mcp-nas.nd.i234.me n8n 127.0.0.1 always healthy MCP shell NAS ; bind 127.0.0.1 (via reverse-proxy)
bifrost 3085->8080 - (retire du WAN 03/07) n8n 0.0.0.0 unless-stopped healthy Gateway LLM ; piege allow_all_keys DB
bifrost-proxy 3086->80 - n8n 0.0.0.0 unless-stopped none Auth rewrite + cap 16384 tokens ; PAS de healthcheck
hermes-workspace-tt 3010->3000 hermes-tt.bolbol.tn hermes-tt-net,n8n 0.0.0.0 unless-stopped healthy Workspace TT (agent=8650 interne)
hermes-workspace-nyora 3020->3000 hermes-nyora.bolbol.tn hermes-nyora-net,n8n 0.0.0.0 unless-stopped healthy Workspace Nyora (agent=8660 interne)
hermes-workspace-perso 3030->3000 hermes-perso.bolbol.tn hermes-perso-net,n8n 0.0.0.0 unless-stopped healthy Workspace Perso (agent=8670 interne)
hermes-agent-tt interne interne hermes-tt-net,n8n interne Docker unless-stopped healthy Agent TT ; DeepSeek V4 Flash
hermes-agent-nyora interne interne hermes-nyora-net,n8n interne Docker unless-stopped healthy Agent Nyora ; DeepSeek V4 Flash
hermes-agent-perso interne interne hermes-perso-net,n8n interne Docker unless-stopped healthy Agent Perso ; DeepSeek V4 Flash
hermes-mail-proxy 3060->8000 - n8n 0.0.0.0 unless-stopped none Proxy mail Hermes (3060)
nyora-doc-api 3050->8000 - n8n 0.0.0.0 unless-stopped healthy Moteur doc unique (docx/xlsx/pptx/pdf) charte Nyora
redaction-pro 3092->80 llm.bolbol.tn n8n 0.0.0.0 always none Assistant redaction LLM (proxy Bifrost)
context-hub 3093->8000 context.bolbol.tn n8n 0.0.0.0 unless-stopped healthy Contexte agents 5 scopes ; MCP SSE
family-help 3041->8000 help.bolbol.tn n8n 0.0.0.0 unless-stopped none IA familiale FastAPI+SQLite ; PAS de healthcheck
gsparc-mezzouna-api 3040->8000 gsparc-mezzouna.bolbol.tn n8n 0.0.0.0 unless-stopped healthy OCR carburant kimi-k2.6
rla-api 3005->3005 rla.bolbol.tn bridge 0.0.0.0 unless-stopped none RLA contrats TT ; reseau BRIDGE (voir alerte couplage)
reglement-definitif-api 5099->5055 - n8n 0.0.0.0 no none Reglement definitif TT ; restart NO (voir alerte)
veille-frontend 3055->3000 veille.bolbol.tn n8n 0.0.0.0 unless-stopped none Veille IA ; depends veille-backend
veille-backend interne interne n8n interne Docker unless-stopped none Backend veille FastAPI
dashboard-terrain 8085->8080 dashboard-terrain.bolbol.tn n8n 0.0.0.0 unless-stopped none Dashboard terrain
panda-dashboard 3021->80 panda.bolbol.tn n8n_default 0.0.0.0 always none Dashboard Fiat Panda ; reseau n8n_default
prompt-studio 8090->8090 - n8n 0.0.0.0 unless-stopped none Prompt studio (8090) ; bind 0.0.0.0 LAN
Trilium 4292->8080 trilium.bolbol.tn n8n,trilium_default 0.0.0.0 no healthy Notes ; restart NO (voir alerte)
Pingvin-Share 6090->3000 share.bolbol.tn / pv.bolbol.tn n8n,pingvin_default 0.0.0.0 always healthy Partage fichiers
pihole 3001->80, 192.168.100.33:53->53, 192.168.100.33:53->53/udp - (admin 3001) n8n 0.0.0.0 always healthy DNS LAN (53) + admin 3001 bind 0.0.0.0
crowdsec 127.0.0.1:9090->8080 - n8n 127.0.0.1 always none IDS ; bind 127.0.0.1:9090 ; parse auth.log+nginx error.log
crowdsec-firewall-bouncer interne - host interne Docker always none Bouncer ipset ; network host ; NET_ADMIN
wg-easy interne vpn (UI 51821) host interne Docker unless-stopped healthy VPN WireGuard 51820/udp ; network host ; MDP renforce 03/07
watchtower-nas interne - bridge interne Docker unless-stopped healthy Auto-update images (attention rollout :latest)
ovh-ddns interne - ovh-ddns_default interne Docker unless-stopped none Mise a jour DNS dynamique OVH
flaresolverr 8191->8191 - media-stack_default 0.0.0.0 unless-stopped none Bypass Cloudflare ; media-stack
prowlarr 9696->9696 - media-stack_default 0.0.0.0 unless-stopped none Indexeur ; media-stack
radarr 7878->7878 - media-stack_default 0.0.0.0 unless-stopped none Films ; media-stack
sonarr 8989->8989 - media-stack_default 0.0.0.0 unless-stopped none Series ; media-stack
qbittorrent-vue 6881->6881, 6881->6881/udp, 9866->9866 qb.bolbol.tn media-stack_default,qbittorrent-vue_default 0.0.0.0 unless-stopped none Torrent (6881) + UI 9866

Bases de donnees (internes)

Port Service Exposition
5432 postgres (n8n-DB, Baserow-DB) interne / n8n_default
6379 redis (Baserow-REDIS) interne

DSM Systeme (exposition WAN reelle : seuls 80/222/443/8080 forwardes par la box)

Port Service Exposition
80 DSM HTTP / reverse-proxy 0.0.0.0
222 DSM SSH (OpenSSH 8.2) 0.0.0.0 WAN — a fermer
443 DSM HTTPS / reverse-proxy 0.0.0.0
2222 Gitea SSH 0.0.0.0
6690 DSM Cloud Sync 0.0.0.0
8080 DSM / watchtower 0.0.0.0
22222 NAS SSH principal 0.0.0.0

SERVICES RETIRES (ne pas reinstaller, ne pas reutiliser le vhost)

Service Port libere Retire Remplace par
gotenberg 3001 (repris par pihole) 21/06 nyora-doc-api
pandoc 3002 21/06 nyora-doc-api
document-factory 3015 21/06 nyora-doc-api
carbone 4000 21/06 nyora-doc-api
document-factory-api 8002 21/06 nyora-doc-api
pptx-tt-api 8015 29/06 nyora-doc-api (vhost pptx.bolbol.tn fantome a purger)
open-webui 3091 29/06 redaction-pro
tika 9998 — gemini-3-flash OCR
paperless 8021 — —
rayhan-frontend 3013 29/06 projet clos
rayhan-mysql 3306 29/06 projet clos
Plex 32400 — absent du stack actuel

Plages libres recommandees

Plage Usage
3013 LIBRE (rayhan-frontend)
3091 LIBRE (open-webui)
3015 LIBRE (document-factory)
3002 LIBRE (pandoc)
4000 LIBRE (carbone)
8002 LIBRE (document-factory-api)
8015 LIBRE (pptx-tt-api)
9998 LIBRE (tika)
8021 LIBRE (paperless)
3100-3199 APIs internes
8800-8899 UIs web
8900-8999 Experimental

Ports a ne JAMAIS utiliser

  • 3001 : pihole admin (repris depuis gotenberg)
  • 8787 : nyora-notes
  • 3000 : port interne Docker (ne pas exposer)
  • 5432 : postgres interne
  • 53 : pihole DNS
  • 22 : SSH DSM interne (utiliser 22222)

Historique des modifications (recentes)

Date Action Port Service
2026-07-03 RESYNC complet etat reel (43 containers) + audit securite — ports-registry.md v3
2026-07-03 Bifrost retire du reverse-proxy WAN (securite) 3085 bifrost
2026-07-03 MDP UI wg-easy renforce 8->28 car 51821 wg-easy
2026-06-29 Resync partiel v2 (voir git history) — —

Note v3 : ce registre reflete l etat REEL constate via socket Docker le 03/07/2026. Services ajoutes vs v2 : pihole, prompt-studio, hermes-mail-proxy, context-hub, nyora-doc-api, gsparc-mezzouna-api, reglement-definitif-api, watchtower-nas, ovh-ddns, flaresolverr, crowdsec x2.