haylanandClaude Bot
a0e5e9704b
- CONTEXT.md glossary - README reduced to intro, quickstart and doc index - new architecture.md, gateway.md (from proxy-key-onboarding.md), operations.md; network-access.md rewritten - coding-cli-setup: stale OMNIROUTE_PORT:-4000 endpoint, terms and duplicated per-slot/classifier explanations fixed - research/README.md index; proxy-request-priority.md moved there as superseded Every doc names keys instead of restating values and links its source. Refs #55 (#56, #57, #59, #60) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.8 KiB
Network access
Source of truth:
docker-compose.yml→ theports:/expose:entries of each service. This page explains who can reach what, and why; port numbers live in the source. If they disagree, the source wins.
Terms as defined in CONTEXT.md. The stack doesn't run its own reverse proxy. The existing reverse proxy (Nginx Proxy Manager, not part of this stack) publishes the gateway under hostnames.
| What | Reachable from |
|---|---|
| Gateway API | LAN, and the internet via the reverse proxy |
| Gateway dashboard | LAN only |
| Backends | Stack network only (through the gateway) |
| qdrant | The server itself only |
Gateway
-
API port (
OMNIROUTE_API_PORT): published on the server's LAN address. Two reverse-proxy hosts point at it:proxy-ai.home: LAN only.proxy-ai.haylan.ch: internet, through the DMZ that already forwards to the reverse proxy, which also manages the TLS certificate.
Every call needs an API key, so the reverse proxy adds no auth of its own.
-
Dashboard port (
OMNIROUTE_DASHBOARD_PORT): published on the LAN only. It's never registered in the reverse proxy and has no port-forward, so it isn't reachable from the internet. Keep it that way: the dashboard manages every API key.
Backends
llama-server and qwen-classifier publish no host port (expose only). They have no authentication, so they're reachable only on the stack's Docker network, through the gateway. Making them directly reachable would put an unauthenticated inference endpoint on the network. That's a deliberate security change, not a config tweak.
qdrant
Bound to the server's loopback interface, because qdrant has no authentication. From another machine, use an SSH port-forward to the server.