haylanandClaude Bot
17747694bd
Replace MTP with draft-dflash and a separate DFlash2 drafter GGUF. Remove the qwen-classifier backend to free VRAM (GPU was at 100%). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
30 lines
1.8 KiB
Markdown
30 lines
1.8 KiB
Markdown
# Network access
|
|
|
|
> **Source of truth:** [`docker-compose.yml`](../docker-compose.yml) → the `ports:` / `expose:` entries of each service. This page explains *who can reach what, and why*; port numbers live in the source. If they disagree, the source wins.
|
|
|
|
Terms as defined in [`CONTEXT.md`](../CONTEXT.md). The stack doesn't run its own reverse proxy. The existing **reverse proxy** (Nginx Proxy Manager, not part of this stack) publishes the gateway under hostnames.
|
|
|
|
| What | Reachable from |
|
|
|---|---|
|
|
| Gateway API | LAN, and the internet via the reverse proxy |
|
|
| Gateway dashboard | LAN only |
|
|
| Backends | Stack network only (through the gateway) |
|
|
| qdrant | The server itself only |
|
|
|
|
## Gateway
|
|
|
|
- **API port (`OMNIROUTE_API_PORT`)**: published on the server's LAN address. Two reverse-proxy hosts point at it:
|
|
- `proxy-ai.home`: LAN only.
|
|
- `proxy-ai.haylan.ch`: internet, through the DMZ that already forwards to the reverse proxy, which also manages the TLS certificate.
|
|
|
|
Every call needs an [API key](gateway.md#api-keys), so the reverse proxy adds no auth of its own.
|
|
- **Dashboard port (`OMNIROUTE_DASHBOARD_PORT`)**: published on the LAN only. It's never registered in the reverse proxy and has no port-forward, so it isn't reachable from the internet. Keep it that way: the dashboard manages every API key.
|
|
|
|
## Backends
|
|
|
|
`llama-server` publishes no host port (`expose` only). It has no authentication, so it's reachable only on the stack's Docker network, through the gateway. Making it directly reachable would put an unauthenticated inference endpoint on the network. That's a deliberate security change, not a config tweak.
|
|
|
|
## qdrant
|
|
|
|
Bound to the server's loopback interface, because qdrant has no authentication. From another machine, use an SSH port-forward to the server.
|