Skip to content

Infrastructure

Machine translation of the French original.

The park consists of six Docker hosts and five non-Docker machines (as of 2026-10-06). Approximately three hundred containers are distributed among them according to a simple logic: GPUs and media on one side, infrastructure services on the other, storage in the center, and two separate areas — the secrets vault on its own machine, and the AI agents in their sandbox.

  • Park hosts — addresses, SSH ports, role, Compose base.
  • Storage and vault — where the data resides, and which copy is authoritative.

The Map

flowchart TB
    subgraph cave["Cave — pièce ventilée"]
        nas["NAS Synology<br/>~35 conteneurs · NFSv4 · edge WAN"]
        compute["vm-compute-01<br/>~85 conteneurs · GPU"]
        subgraph pve["vm-compute-02 — hyperviseur Proxmox"]
            vmdocker["vm-docker<br/>~100 conteneurs"]
            vmaddons["vm-addons<br/>~30 conteneurs · passerelle MCP"]
            vmagents["vm-agents<br/>~35 conteneurs · agents IA, sans secret"]
            vmclaude["vm-claude<br/>dev, pas de Docker"]
        end
        bao["pi-bao<br/>coffre OpenBao, sans Docker"]
    end

    subgraph bureau["Bureau"]
        mac["Mac Pro<br/>Obsidian, plus aucune VM"]
        paw["paw-01<br/>poste d'administration"]
    end

    subgraph ailleurs["Hors LAN"]
        vps["vps-fr-ovh<br/>~15 conteneurs · nœud de sortie"]
    end

    vmdocker ---|"NFS"| nas
    vmclaude ---|"NFS"| nas
    compute ---|"NFS"| nas
    nas ---|"proxy interne"| vmdocker
    vps -.->|"tailnet"| nas

    classDef edge stroke-width:3px
    class nas edge

The NAS is at the center for two distinct reasons that should not be confused: it hosts the disks (NFS for everyone) and it is the entry point from the Internet. Both roles fall on the same machine, but nothing connects them.

The One-Sentence Breakdown

What's running Where Why there
Reverse proxy, identity, Git, databases vm-docker Service host, no GPU, close to the NAS
*arr, Plex, Immich-ML, local LLMs, Home Assistant vm-compute-01 The only one with a GPU
Immich, Syncthing, NFS shares, edge WAN NAS Synology This is where the disks are
MCP gateway, small services vm-addons Taken off the GPU host to free up its memory
Team AI agents vm-agents Sandbox: a compromised agent cannot find any secrets from the park
Machine secrets (OpenBao) pi-bao A machine that only does one thing: nothing else to compromise
Exit node, external probes vps-fr-ovh Outside the LAN, by design

rtl-pi no longer exists

rtl-pi (l-ancien-pi) has been decommissioned since 2026-08-25: shut down, offline, and removed from Dockhand. An older note referring to "five Docker hosts" describes the previous setup. Do not diagnose this as a failure, and do not put it back in an inventory.

vm-rtx4070ti has been renamed

The GPU host is now called vm-compute-01 since 2026-08-27 – the machine and the SSH account. Any previous documentation that refers to "rtx" refers to this machine.

Dernière vérification de cette page : 2026-10-06