feat(npm): add internal domain aliases for all external hosts
Add *.schweitz.internal domains as HTTP-only alternatives to *.schweitz.net domains for programmatic access without SSL or Authentik authentication. - Configure 11 internal domain proxy hosts in NPM - Document internal domain setup process in setup-new-host.md - Add internal domains reference table to CONTAINERS.md - Update external domains list with library and tatlock mappings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.5
+25
-2
@@ -48,7 +48,30 @@
|
||||
- **amp.schweitz.net** → AMP Game Server
|
||||
- **housekeeping.schweitz.net** → Home Assistant
|
||||
- **documents.schweitz.net** → Paperless-ngx
|
||||
- **tatlock.schweitz.net** → (Reserved)
|
||||
- **library.schweitz.net** → Wiki.js
|
||||
- **tatlock.schweitz.net** → Open WebUI
|
||||
|
||||
### Internal Domains (HTTP, No Auth)
|
||||
|
||||
Internal domains provide LAN-accessible URLs without SSL or Authentik, ideal for programmatic access, scripts, and healthchecks. Each mirrors its external counterpart.
|
||||
|
||||
| Internal Domain | Backend | Port |
|
||||
|-----------------|---------|------|
|
||||
| home.schweitz.internal | localhost | 9999 |
|
||||
| media.schweitz.internal | localhost | 8096 |
|
||||
| cloud.schweitz.internal | localhost | 8082 |
|
||||
| api.schweitz.internal | localhost | 8083 |
|
||||
| code.schweitz.internal | localhost | 8084 |
|
||||
| amp.schweitz.internal | localhost | 8080 |
|
||||
| housekeeping.schweitz.internal | localhost | 8123 |
|
||||
| documents.schweitz.internal | 192.168.86.149 | 8091 |
|
||||
| git.schweitz.internal | localhost | 3002 |
|
||||
| library.schweitz.internal | localhost | 8088 |
|
||||
| tatlock.schweitz.internal | localhost | 82 |
|
||||
|
||||
**DNS Resolution:** Via `/etc/hosts` on tower-of-joy (192.168.86.149)
|
||||
|
||||
**Usage:** `curl http://api.schweitz.internal/health` or `docker pull git.schweitz.internal/jpmschweitzer/core-api:latest`
|
||||
|
||||
### External Repositories
|
||||
|
||||
@@ -690,4 +713,4 @@ redis-cli -h redis-shared # Redis connection
|
||||
|
||||
---
|
||||
|
||||
*Last Updated: 2025-12-14*
|
||||
*Last Updated: 2025-12-25*
|
||||
|
||||
+119
-2
@@ -259,6 +259,123 @@ If already logged into another `.schweitz.net` service:
|
||||
|
||||
---
|
||||
|
||||
## Setting Up an Internal Domain (*.schweitz.internal)
|
||||
|
||||
Internal domains provide LAN-accessible URLs without SSL or Authentik authentication, ideal for:
|
||||
- Programmatic API access (scripts, automation, healthchecks)
|
||||
- Local development and testing
|
||||
- Container-to-container communication via DNS
|
||||
- Avoiding port number confusion on LAN
|
||||
|
||||
### Pattern
|
||||
|
||||
Every external `<service>.schweitz.net` domain has a corresponding `<service>.schweitz.internal` domain that:
|
||||
- Uses HTTP only (no SSL certificates)
|
||||
- Has NO Authentik forward auth
|
||||
- Points to the same backend service
|
||||
- Resolves via `/etc/hosts` on the server
|
||||
|
||||
### Current Internal Domains
|
||||
|
||||
| Internal Domain | Backend | External Equivalent |
|
||||
|-----------------|---------|---------------------|
|
||||
| home.schweitz.internal | localhost:9999 | home.schweitz.net |
|
||||
| media.schweitz.internal | localhost:8096 | media.schweitz.net |
|
||||
| cloud.schweitz.internal | localhost:8082 | cloud.schweitz.net |
|
||||
| api.schweitz.internal | localhost:8083 | api.schweitz.net |
|
||||
| code.schweitz.internal | localhost:8084 | code.schweitz.net |
|
||||
| amp.schweitz.internal | localhost:8080 | amp.schweitz.net |
|
||||
| housekeeping.schweitz.internal | localhost:8123 | housekeeping.schweitz.net |
|
||||
| documents.schweitz.internal | 192.168.86.149:8091 | documents.schweitz.net |
|
||||
| git.schweitz.internal | localhost:3002 | git.schweitz.net |
|
||||
| library.schweitz.internal | localhost:8088 | library.schweitz.net |
|
||||
| tatlock.schweitz.internal | localhost:82 | tatlock.schweitz.net |
|
||||
|
||||
### Step 1: Add DNS Entry
|
||||
|
||||
Add the internal domain to `/etc/hosts` on the tower-of-joy server:
|
||||
|
||||
```bash
|
||||
# Add to /etc/hosts
|
||||
192.168.86.149 <service>.schweitz.internal
|
||||
```
|
||||
|
||||
### Step 2: Create NPM Proxy Host
|
||||
|
||||
**Via NPM UI (port 8000):**
|
||||
|
||||
**Details Tab:**
|
||||
|
||||
| Setting | Value |
|
||||
|---------|-------|
|
||||
| Domain Names | `<service>.schweitz.internal` |
|
||||
| Scheme | `http` |
|
||||
| Forward Hostname/IP | Same as external domain (e.g., `localhost`) |
|
||||
| Forward Port | Same as external domain |
|
||||
| Cache Assets | On (optional) |
|
||||
| Block Common Exploits | On |
|
||||
| Websockets Support | On (if needed) |
|
||||
|
||||
**SSL Tab:** Leave empty (no SSL for internal domains)
|
||||
|
||||
**Advanced Tab:** Leave empty (no Authentik forward auth)
|
||||
|
||||
**Via NPM API:**
|
||||
|
||||
```bash
|
||||
# Get token
|
||||
TOKEN=$(curl -s -X POST http://localhost:81/api/tokens \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"identity": "<email>", "secret": "<password>"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
|
||||
|
||||
# Create internal proxy host
|
||||
curl -s -X POST http://localhost:81/api/nginx/proxy-hosts \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"domain_names": ["<service>.schweitz.internal"],
|
||||
"forward_scheme": "http",
|
||||
"forward_host": "localhost",
|
||||
"forward_port": <port>,
|
||||
"access_list_id": 0,
|
||||
"certificate_id": 0,
|
||||
"ssl_forced": false,
|
||||
"caching_enabled": true,
|
||||
"block_exploits": true,
|
||||
"advanced_config": "",
|
||||
"allow_websocket_upgrade": true,
|
||||
"http2_support": false,
|
||||
"hsts_enabled": false,
|
||||
"hsts_subdomains": false,
|
||||
"enabled": true,
|
||||
"locations": []
|
||||
}'
|
||||
```
|
||||
|
||||
### Step 3: Test
|
||||
|
||||
```bash
|
||||
curl -s -o /dev/null -w "%{http_code}" http://<service>.schweitz.internal/
|
||||
```
|
||||
|
||||
Expected: `200`, `302` (redirect), or service-specific response.
|
||||
|
||||
### Usage Examples
|
||||
|
||||
```bash
|
||||
# API calls without auth
|
||||
curl http://api.schweitz.internal/health
|
||||
|
||||
# Git operations (Docker image pulls)
|
||||
docker pull git.schweitz.internal/jpmschweitzer/core-api:latest
|
||||
|
||||
# Healthchecks in Docker Compose
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -fSs http://git.schweitz.internal/api/healthz"]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Appendix: Portainer API for Remote Stack Deployment
|
||||
|
||||
When you cannot access the Portainer web UI (e.g., outside home network), you can deploy stacks via the API.
|
||||
@@ -453,5 +570,5 @@ curl -s -X PUT http://192.168.86.149:81/api/nginx/proxy-hosts/<proxy_id> \
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-12-24
|
||||
**Based on**: library.schweitz.net setup session, Paperless-ngx API deployment
|
||||
**Last Updated**: 2025-12-25
|
||||
**Based on**: library.schweitz.net setup session, Paperless-ngx API deployment, Internal domain consolidation
|
||||
|
||||
Reference in New Issue
Block a user