HackersHostel — Homelab Infrastructure

Server: claw.eazyplugins.com · AlmaLinux 10.2 · Rootless Podman · Caddy · Anubis (Domain migrated from *.hackershostel.com → *.eazyplugins.com in 2026)

flowchart TB
    Internet(("Internet\n160.250.95.39")) -->|"HTTPS :443"| Caddy

    subgraph Caddy["Caddy 2.11.4 — TLS · security headers · @skip RFC1918"]
        C["claw.eazyplugins.com"]
    end

    Caddy --> Anubis
    Caddy --> Direct
    Caddy --> NonWeb

    subgraph Anubis["Anubis v1.27.0 — PoW challenge, 20 instances, ports 89XX"]
        direction TB
        subgraph A1["Web Services"]
            direction LR
            SearXNG["SearXNG\nsearch\n:8903"]
            Flame["Flame\ndashboard\n:8901"]
            Glances["Glances\nhealth\n:8902"]
            Dozzle["Dozzle\nlogs\n:8906"]
            PrivateBin["PrivateBin\npaste\n:8907"]
        end
        subgraph A2["Productivity"]
            direction LR
            ITTools["IT-Tools\ntools\n:8908"]
            BeaverHabits["BeaverHabits\nhabits\n:8909"]
            Tandoor["Tandoor\nrecipes\n:8910"]
            Vikunja["Vikunja\ntasks\n:8911"]
            Memos["Memos\nnotes\n:8912"]
        end
        subgraph A3["Data & Storage"]
            direction LR
            Linkwarden["Linkwarden\nbookmarks\n:8913"]
            Actual["Actual Budget\nbudget\n:8915"]
            Paperless["Paperless\ndocuments\n:8921"]
            LubeLogger["LubeLogger\nvehicles\n:8922"]
            BookOrbit["BookOrbit\nlibrary\n:8925"]
        end
        subgraph A4["Infrastructure"]
            direction LR
            UptimeKuma["Uptime Kuma\nstatus\n:8916"]
            Hermes["Hermes\nAI\n:8918"]
            FreeLLM["FreeLLMAPI\nLLM proxy\n:8924"]
        end
        subgraph A5["Host / Compose networks"]
            direction LR
            Jitsi["Jitsi Meet\nvideo\n:8904"]
            YourSpotify["YourSpotify\nmusic\n:3003"]
        end
    end

    subgraph Direct["Direct Access — No Anubis"]
        direction LR
        Radicale(("Radicale\nCalDAV\n:5232"))
        Cockpit(("Cockpit\n:9090"))
        FileBrowser(("File Browser\nCaddy native"))
        SpotifyAPI(("Spotify API\nOAuth\n:8082"))
        AudioBooks(("Audiobookshelf\nbooks\n:13378"))
    end

    subgraph NonWeb["Non-Web — No Caddy, direct port exposure"]
        direction LR
        RustDesk(("RustDesk\n:21115-21119"))
        TeamSpeak(("TeamSpeak 6\n:9987 UDP"))
        Diun(("Diun\nimage watcher"))
    end

    Anubis -.-> Podman
    Direct -.-> Podman
    NonWeb -.-> Podman

    subgraph Podman["Podman — Rootless · UID 1000 · SELinux enforcing"]
        direction LR
        Net["homelab-internal\nbridge network\n10.89.8.0/24"]
        Storage["Named volumes +\nbind mounts"]
        Updates["podman-auto-update daily\nDiun 4x/day\nweekly compose timers"]
    end

    style Internet fill:#475569,stroke:#94a3b8,color:#f1f5f9,stroke-width:2px
    style Caddy fill:#164e63,stroke:#22d3ee,color:#ecfeff,stroke-width:2px
    style Anubis fill:#4c0519,stroke:#f43f5e,color:#ffe4e6
    style Direct fill:#164e63,stroke:#22d3ee,color:#ecfeff
    style NonWeb fill:#334155,stroke:#94a3b8,color:#e2e8f0
    style Podman fill:#1e1b4b,stroke:#818cf8,color:#e0e7ff

    style A1 fill:#022c22,stroke:#2dd4bf,color:#ccfbf1
    style A2 fill:#022c22,stroke:#2dd4bf,color:#ccfbf1
    style A3 fill:#022c22,stroke:#2dd4bf,color:#ccfbf1
    style A4 fill:#022c22,stroke:#2dd4bf,color:#ccfbf1
    style A5 fill:#451a03,stroke:#fbbf24,color:#fef9c3

    style Jitsi fill:#92400e,stroke:#fbbf24,color:#fef9c3
    style YourSpotify fill:#92400e,stroke:#fbbf24,color:#fef9c3

Files

Key Gotchas

• Permissions-Policy: Use geolocation=() only. camera=(), microphone=() blocks getUserMedia in Chrome.
• Anubis + Compose: Both containers MUST share the same custom bridge network (or Anubis uses Network=host with 127.0.0.1 targets).
• Anubis listens on container port 8923 — each instance publishes its unique host port (89XX) to 8923.
• SELinux: Use :z (shared) not :Z (exclusive) for volume mounts on multi-container stacks.
• Podman rootless UID: Always 1000, not 0. Container nobody (65534) maps to host 589821.
• Never use Docker commands — always Podman.
• No firewalld, no CrowdSec — security is Caddy TLS + Anubis + SSH key-only auth. CrowdSec removed Aug 2026.
• anubis-jitsi is a PoW proxy, not Jitsi. docker-jitsi-meet_* containers are the real backend — never remove them.

Last updated: 2026-08-28 +++