145 lines
9.2 KiB
Markdown
145 lines
9.2 KiB
Markdown
# Ports Registry — NAS Synology DS920+
|
|
# Derniere mise a jour : 03/07/2026 (resync etat REEL, 43 containers)
|
|
# LIRE CE FICHIER AVANT TOUT NOUVEAU DEPLOIEMENT
|
|
# Mettre a jour apres chaque ajout/suppression de service
|
|
|
|
---
|
|
|
|
## Regle absolue
|
|
Aucun nouveau service ne doit utiliser un port deja occupe.
|
|
Choisir un port libre et l'inscrire ici avant de deployer.
|
|
|
|
---
|
|
|
|
## SERVICES ACTIFS — Etat REEL au 03/07/2026
|
|
|
|
Source de verite = `docker ps` reel (via socket), pas le declaratif.
|
|
Colonne Exposition = binding reel constate. Restart/Health signales quand a risque.
|
|
|
|
| Service | Port | Domaine | Reseau | Exposition | Restart | Health | Notes |
|
|
|---------|------|---------|--------|------------|---------|--------|-------|
|
|
| n8n | 5678->5678 | n8n.bolbol.tn | n8n,n8n_default | 0.0.0.0 | **on-failure** | healthy | Orchestration centrale ; restart on-failure (voir alerte) |
|
|
| n8n-DB | interne | - | n8n_default | interne Docker | **on-failure** | **none** | Postgres n8n ; reseau n8n_default ; restart on-failure |
|
|
| Baserow | 3888->80 | baserow.bolbol.tn | baserow_baserow_network,n8n | 0.0.0.0 | unless-stopped | healthy | Base metier ; depends db+redis healthy |
|
|
| Baserow-DB | interne | - | baserow_baserow_network | interne Docker | unless-stopped | healthy | Postgres Baserow |
|
|
| Baserow-REDIS | interne | - | baserow_baserow_network | interne Docker | unless-stopped | healthy | Redis Baserow |
|
|
| gitea | 2222->22, 3232->3232 | gitea.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | healthy | Versioning (bolbol) ; SSH 2222 + 3232 |
|
|
| portainer | 9000->9000, 9443->9443 | portainer.bolbol.tn | bridge | 0.0.0.0 | unless-stopped | **none** | Gestion containers ; reseau bridge |
|
|
| nyora-notes | 8787->8787 | - | n8n | 0.0.0.0 | unless-stopped | healthy | Memoire inter-sessions Hermes (8787) |
|
|
| linux-mcp-nas | 127.0.0.1:3042->8000 | mcp-nas.nd.i234.me | n8n | 127.0.0.1 | always | healthy | MCP shell NAS ; bind 127.0.0.1 (via reverse-proxy) |
|
|
| bifrost | 3085->8080 | - (retire du WAN 03/07) | n8n | 0.0.0.0 | unless-stopped | healthy | Gateway LLM ; piege allow_all_keys DB |
|
|
| bifrost-proxy | 3086->80 | - | n8n | 0.0.0.0 | unless-stopped | **none** | Auth rewrite + cap 16384 tokens ; PAS de healthcheck |
|
|
| hermes-workspace-tt | 3010->3000 | hermes-tt.bolbol.tn | hermes-tt-net,n8n | 0.0.0.0 | unless-stopped | healthy | Workspace TT (agent=8650 interne) |
|
|
| hermes-workspace-nyora | 3020->3000 | hermes-nyora.bolbol.tn | hermes-nyora-net,n8n | 0.0.0.0 | unless-stopped | healthy | Workspace Nyora (agent=8660 interne) |
|
|
| hermes-workspace-perso | 3030->3000 | hermes-perso.bolbol.tn | hermes-perso-net,n8n | 0.0.0.0 | unless-stopped | healthy | Workspace Perso (agent=8670 interne) |
|
|
| hermes-agent-tt | interne | interne | hermes-tt-net,n8n | interne Docker | unless-stopped | healthy | Agent TT ; DeepSeek V4 Flash |
|
|
| hermes-agent-nyora | interne | interne | hermes-nyora-net,n8n | interne Docker | unless-stopped | healthy | Agent Nyora ; DeepSeek V4 Flash |
|
|
| hermes-agent-perso | interne | interne | hermes-perso-net,n8n | interne Docker | unless-stopped | healthy | Agent Perso ; DeepSeek V4 Flash |
|
|
| hermes-mail-proxy | 3060->8000 | - | n8n | 0.0.0.0 | unless-stopped | **none** | Proxy mail Hermes (3060) |
|
|
| nyora-doc-api | 3050->8000 | - | n8n | 0.0.0.0 | unless-stopped | healthy | Moteur doc unique (docx/xlsx/pptx/pdf) charte Nyora |
|
|
| redaction-pro | 3092->80 | llm.bolbol.tn | n8n | 0.0.0.0 | always | **none** | Assistant redaction LLM (proxy Bifrost) |
|
|
| context-hub | 3093->8000 | context.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | healthy | Contexte agents 5 scopes ; MCP SSE |
|
|
| family-help | 3041->8000 | help.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | **none** | IA familiale FastAPI+SQLite ; PAS de healthcheck |
|
|
| gsparc-mezzouna-api | 3040->8000 | gsparc-mezzouna.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | healthy | OCR carburant kimi-k2.6 |
|
|
| rla-api | 3005->3005 | rla.bolbol.tn | bridge | 0.0.0.0 | unless-stopped | **none** | RLA contrats TT ; reseau BRIDGE (voir alerte couplage) |
|
|
| reglement-definitif-api | 5099->5055 | - | n8n | 0.0.0.0 | **no** | **none** | Reglement definitif TT ; restart NO (voir alerte) |
|
|
| veille-frontend | 3055->3000 | veille.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | **none** | Veille IA ; depends veille-backend |
|
|
| veille-backend | interne | interne | n8n | interne Docker | unless-stopped | **none** | Backend veille FastAPI |
|
|
| dashboard-terrain | 8085->8080 | dashboard-terrain.bolbol.tn | n8n | 0.0.0.0 | unless-stopped | **none** | Dashboard terrain |
|
|
| panda-dashboard | 3021->80 | panda.bolbol.tn | n8n_default | 0.0.0.0 | always | **none** | Dashboard Fiat Panda ; reseau n8n_default |
|
|
| prompt-studio | 8090->8090 | - | n8n | 0.0.0.0 | unless-stopped | **none** | Prompt studio (8090) ; bind 0.0.0.0 LAN |
|
|
| Trilium | 4292->8080 | trilium.bolbol.tn | n8n,trilium_default | 0.0.0.0 | **no** | healthy | Notes ; restart NO (voir alerte) |
|
|
| Pingvin-Share | 6090->3000 | share.bolbol.tn / pv.bolbol.tn | n8n,pingvin_default | 0.0.0.0 | always | healthy | Partage fichiers |
|
|
| pihole | 3001->80, 192.168.100.33:53->53, 192.168.100.33:53->53/udp | - (admin 3001) | n8n | 0.0.0.0 | always | healthy | DNS LAN (53) + admin 3001 bind 0.0.0.0 |
|
|
| crowdsec | 127.0.0.1:9090->8080 | - | n8n | 127.0.0.1 | always | **none** | IDS ; bind 127.0.0.1:9090 ; parse auth.log+nginx error.log |
|
|
| crowdsec-firewall-bouncer | interne | - | host | interne Docker | always | **none** | Bouncer ipset ; network host ; NET_ADMIN |
|
|
| wg-easy | interne | vpn (UI 51821) | host | interne Docker | unless-stopped | healthy | VPN WireGuard 51820/udp ; network host ; MDP renforce 03/07 |
|
|
| watchtower-nas | interne | - | bridge | interne Docker | unless-stopped | healthy | Auto-update images (attention rollout :latest) |
|
|
| ovh-ddns | interne | - | ovh-ddns_default | interne Docker | unless-stopped | **none** | Mise a jour DNS dynamique OVH |
|
|
| flaresolverr | 8191->8191 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Bypass Cloudflare ; media-stack |
|
|
| prowlarr | 9696->9696 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Indexeur ; media-stack |
|
|
| radarr | 7878->7878 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Films ; media-stack |
|
|
| sonarr | 8989->8989 | - | media-stack_default | 0.0.0.0 | unless-stopped | **none** | Series ; media-stack |
|
|
| qbittorrent-vue | 6881->6881, 6881->6881/udp, 9866->9866 | qb.bolbol.tn | media-stack_default,qbittorrent-vue_default | 0.0.0.0 | unless-stopped | **none** | Torrent (6881) + UI 9866 |
|
|
|
|
---
|
|
|
|
## Bases de donnees (internes)
|
|
| Port | Service | Exposition |
|
|
|------|---------|------------|
|
|
| 5432 | postgres (n8n-DB, Baserow-DB) | interne / n8n_default |
|
|
| 6379 | redis (Baserow-REDIS) | interne |
|
|
|
|
---
|
|
|
|
## DSM Systeme (exposition WAN reelle : seuls 80/222/443/8080 forwardes par la box)
|
|
| Port | Service | Exposition |
|
|
|------|---------|------------|
|
|
| 80 | DSM HTTP / reverse-proxy | 0.0.0.0 |
|
|
| 222 | DSM SSH (OpenSSH 8.2) | 0.0.0.0 WAN — a fermer |
|
|
| 443 | DSM HTTPS / reverse-proxy | 0.0.0.0 |
|
|
| 2222 | Gitea SSH | 0.0.0.0 |
|
|
| 6690 | DSM Cloud Sync | 0.0.0.0 |
|
|
| 8080 | DSM / watchtower | 0.0.0.0 |
|
|
| 22222 | NAS SSH principal | 0.0.0.0 |
|
|
|
|
---
|
|
|
|
## SERVICES RETIRES (ne pas reinstaller, ne pas reutiliser le vhost)
|
|
| Service | Port libere | Retire | Remplace par |
|
|
|---------|-------------|--------|--------------|
|
|
| gotenberg | 3001 (repris par pihole) | 21/06 | nyora-doc-api |
|
|
| pandoc | 3002 | 21/06 | nyora-doc-api |
|
|
| document-factory | 3015 | 21/06 | nyora-doc-api |
|
|
| carbone | 4000 | 21/06 | nyora-doc-api |
|
|
| document-factory-api | 8002 | 21/06 | nyora-doc-api |
|
|
| pptx-tt-api | 8015 | 29/06 | nyora-doc-api (vhost pptx.bolbol.tn fantome a purger) |
|
|
| open-webui | 3091 | 29/06 | redaction-pro |
|
|
| tika | 9998 | — | gemini-3-flash OCR |
|
|
| paperless | 8021 | — | — |
|
|
| rayhan-frontend | 3013 | 29/06 | projet clos |
|
|
| rayhan-mysql | 3306 | 29/06 | projet clos |
|
|
| Plex | 32400 | — | absent du stack actuel |
|
|
|
|
---
|
|
|
|
## Plages libres recommandees
|
|
| Plage | Usage |
|
|
|-------|-------|
|
|
| 3013 | LIBRE (rayhan-frontend) |
|
|
| 3091 | LIBRE (open-webui) |
|
|
| 3015 | LIBRE (document-factory) |
|
|
| 3002 | LIBRE (pandoc) |
|
|
| 4000 | LIBRE (carbone) |
|
|
| 8002 | LIBRE (document-factory-api) |
|
|
| 8015 | LIBRE (pptx-tt-api) |
|
|
| 9998 | LIBRE (tika) |
|
|
| 8021 | LIBRE (paperless) |
|
|
| 3100-3199 | APIs internes |
|
|
| 8800-8899 | UIs web |
|
|
| 8900-8999 | Experimental |
|
|
|
|
---
|
|
|
|
## Ports a ne JAMAIS utiliser
|
|
- 3001 : pihole admin (repris depuis gotenberg)
|
|
- 8787 : nyora-notes
|
|
- 3000 : port interne Docker (ne pas exposer)
|
|
- 5432 : postgres interne
|
|
- 53 : pihole DNS
|
|
- 22 : SSH DSM interne (utiliser 22222)
|
|
|
|
---
|
|
|
|
## Historique des modifications (recentes)
|
|
| Date | Action | Port | Service |
|
|
|------|--------|------|---------|
|
|
| 2026-07-03 | RESYNC complet etat reel (43 containers) + audit securite | — | ports-registry.md v3 |
|
|
| 2026-07-03 | Bifrost retire du reverse-proxy WAN (securite) | 3085 | bifrost |
|
|
| 2026-07-03 | MDP UI wg-easy renforce 8->28 car | 51821 | wg-easy |
|
|
| 2026-06-29 | Resync partiel v2 (voir git history) | — | — |
|
|
|
|
> Note v3 : ce registre reflete l etat REEL constate via socket Docker le 03/07/2026.
|
|
> Services ajoutes vs v2 : pihole, prompt-studio, hermes-mail-proxy, context-hub, nyora-doc-api,
|
|
> gsparc-mezzouna-api, reglement-definitif-api, watchtower-nas, ovh-ddns, flaresolverr, crowdsec x2.
|