haylanandClaude Bot
17747694bd
Replace MTP with draft-dflash and a separate DFlash2 drafter GGUF. Remove the qwen-classifier backend to free VRAM (GPU was at 100%). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
1.8 KiB
Network access
Source of truth:
docker-compose.yml→ theports:/expose:entries of each service. This page explains who can reach what, and why; port numbers live in the source. If they disagree, the source wins.
Terms as defined in CONTEXT.md. The stack doesn't run its own reverse proxy. The existing reverse proxy (Nginx Proxy Manager, not part of this stack) publishes the gateway under hostnames.
| What | Reachable from |
|---|---|
| Gateway API | LAN, and the internet via the reverse proxy |
| Gateway dashboard | LAN only |
| Backends | Stack network only (through the gateway) |
| qdrant | The server itself only |
Gateway
-
API port (
OMNIROUTE_API_PORT): published on the server's LAN address. Two reverse-proxy hosts point at it:proxy-ai.home: LAN only.proxy-ai.haylan.ch: internet, through the DMZ that already forwards to the reverse proxy, which also manages the TLS certificate.
Every call needs an API key, so the reverse proxy adds no auth of its own.
-
Dashboard port (
OMNIROUTE_DASHBOARD_PORT): published on the LAN only. It's never registered in the reverse proxy and has no port-forward, so it isn't reachable from the internet. Keep it that way: the dashboard manages every API key.
Backends
llama-server publishes no host port (expose only). It has no authentication, so it's reachable only on the stack's Docker network, through the gateway. Making it directly reachable would put an unauthenticated inference endpoint on the network. That's a deliberate security change, not a config tweak.
qdrant
Bound to the server's loopback interface, because qdrant has no authentication. From another machine, use an SSH port-forward to the server.