Ryan Yin
4470b3d014
Move standalone repository docs from the root into docs/ and add a documentation index that links the moved docs and the code-local runbooks. Update Markdown links, source comments, and the root entry points to the new locations. Keep README.md and AGENTS.md at the root as required entry points. Assisted-by: DeepSeek Harness (deepseek-flash)
Youko - Homelab Services
Storage, operation and maintenance related services are running on this host (migrated here from the
retired aquamarine VM — the name now belongs to the inference server, not this host):
- Storage such as a git server, file server, torrent downloader, etc.
- Back up my personal data with restic; the data is encrypted on the client.
- Collect and monitor the metrics of my homelab.
Features
Storage and data
- gitea: Self-hosted git service (
gitea.nix). - sftpgo: SFTP / WebDAV server (
sftpgo.nix). - postgresql: Database for the homelab services (
postgresql.nix). - valkey: Redis-compatible cache for Immich (
valkey.nix).
Backups and object storage
- restic: Encrypted backups; hosts the REST server the desktops push to (
../default.nix). - rustfs: S3-compatible object storage (Loki chunks and Terraform state) (
rustfs.nix).
Media
- immich: Photo and video library with ML search (
immich/). - jellyfin: Media server (
jellyfin.nix). - transmission: BitTorrent client (
transmission.nix).
Network and observability
- caddy: Reverse proxy / TLS front end and the
file.writefor.funfile server (caddy.nix). - victoriametrics + vmalert + alertmanager + grafana: Monitor the metrics of my homelab
(
monitoring/). - homepage (
homepage/) + uptime-kuma (oci-containers/): Service dashboard and uptime checks.
All the services assume a reverse proxy in front: they listen on localhost, and a caddy service
listens on the local network interface and proxies requests to them. The exception is transmission,
which runs in its own network namespace and binds its RPC to 192.168.5.118.
transmission networking
transmission deliberately does not use the host's default gateway suzi (192.168.5.178): it is a
mihomo transparent proxy that hijacks DNS to fake IPs (only routable through the proxy) and has no
UPnP/NAT-PMP, so a proxied transmission can never accept inbound peers.
Instead the service runs in its own network namespace, with a veth on br0, the address
192.168.5.118, a default route at the main router (192.168.5.1), a real resolver, and a fixed
MAC for a stable IPv6 IID. It listens on 192.168.5.118:51413 (TCP/UDP and IPv6) and caddy reaches
its RPC at 192.168.5.118:9091. See transmission.nix for the implementation.