vps/vps1-startpoint.md

VPS1 Analysis - vps1.phiiiil.de

Generated: 2025-01-25 Last Updated: 2026-01-25 Target Host: vps1.phiiiil.de (152.53.119.222)

System Overview

Hardware & OS

• OS: Debian GNU/Linux 12 (bookworm)
• Kernel: Linux 6.1.0-40-arm64 (ARM64 architecture)
• CPU: aarch64
• RAM: 15GB total, ~13GB available
• Swap: 975MB
• Disk: 1TB (1006GB), 55GB used (6%), ~900GB free

Network

• Public IP: 152.53.119.222/22
• Interface: enp7s0 (46:50:f9:68:52:91)
• DNS: 46.38.225.230, 46.38.252.230
• Domain: phiiiil.de with subdomains pointing to this host

Docker Installation

• Docker Engine: 20.10.24+dfsg1
• Docker Compose: v5.0.2
• Service Status: Active (running since Nov 11, 2025)
• Docker Networks:
  • bridge (default)
  • netbird_netbird - Shared network for all services
  • immich_default - Immich containers
  • host (for Coturn TURN server)

Running Services

Netbird VPN (8 containers)

Status: ✅ Running (healthy)

Container	Image	Purpose	Network
netbird-zitadel-1	zitadel:v2.64.1	Identity Provider (OIDC)	netbird_netbird
netbird-caddy-1	caddy:latest	Reverse Proxy (80/443)	netbird_netbird, immich_default
netbird-management-1	management:latest	Management API	netbird_netbird
netbird-coturn-1	coturn:latest	TURN/STUN Relay	host
netbird-zdb-1	postgres:16-alpine	Zitadel DB	netbird_netbird
netbird-signal-1	signal:latest	Signal Service	netbird_netbird
netbird-dashboard-1	dashboard:latest	Web UI	netbird_netbird
netbird-relay-1	relay:latest	Relay Service	netbird_netbird

Features:

• VPN management and user authentication
• Centralized SSO via Zitadel
• Caddy reverse proxy for all services
• Automatic SSL certificate management

Immich (4 containers)

Status: ✅ Running (healthy)

Container	Image	Purpose	Ports
immich_server	immich-server:release	Main application	2283:2283
immich_machine_learning	immich-machine-learning:release	ML/AI features	-
immich_postgres	postgres:14-vector	Database (healthy)	-
immich_redis	valkey:8-bookworm	Cache (healthy)	-

Important: Immich contains 34,694 files (39GB) of photos - Automated daily backup at 04:00 ✅

Gitea (2 containers)

Status: ✅ Running (healthy)

Container	Image	Purpose	Ports
gitea	gitea/gitea:latest	Git hosting	3000/tcp, 2222:22
gitea-db	postgres:16-alpine	Database (healthy)	5432/tcp

Configuration:

• Admin: User phil created
• Database: PostgreSQL with strong password
• SSH: Port 2222
• Network: netbird_netbird
• Registration: Disabled (private instance)

Docker Compose Projects

1. Netbird + Caddy

Location: /home/phil/docker/netbird/

Files:

• docker-compose.yml - Main compose file
• Caddyfile - Reverse proxy configuration for all services
• dashboard.env, relay.env, zitadel.env, zdb.env - Environment configs
• management.json - Management configuration
• turnserver.conf - Coturn TURN server config
• machinekey/ - Zitadel machine keys

Caddy Configuration:

• nb.phiiiil.de:443 - Netbird Dashboard & API
• git.phiiiil.de:443 - Gitea reverse proxy
• immich.phiiiil.de:443 - Immich reverse proxy
• Security headers applied to all routes
• Automatic SSL certificates via Let's Encrypt

Exposed Ports: 80/tcp, 443/tcp, 443/udp

2. Immich

Location: /home/phil/docker/immich-app/

Files:

• docker-compose.yml - Compose file (4 services)
• .env - Environment configuration
• library/ - Photo storage (34,694 files, 39GB) ✅ Backed up daily
• postgres/ - Database files

Configuration:

• Upload location: ./library
• Database location: ./postgres
• Timezone: Europe/Berlin
• Exposed port: 2283 (internal)
• Backup: Automated daily at 04:00 using rsync

3. Gitea

Location: /home/phil/docker/gitea/

Files:

• docker-compose.yml - Compose file (2 services)
• .env - Database password

Configuration:

• Domain: git.phiiiil.de
• Database: PostgreSQL 16
• SSH port: 2222
• Network: netbird_netbird (shared)
• User registration disabled

Docker Volumes

Volume	Purpose	Associated Containers
gitea_gitea_db_data	Gitea PostgreSQL data	gitea-db
gitea_gitea_data	Gitea application data	gitea
immich_model-cache	ML model caching	immich-machine-learning
netbird_netbird_caddy_data	Caddy SSL certificates	netbird-caddy-1
netbird_netbird_management	Netbird management data	netbird-management-1
netbird_netbird_zdb_data	Zitadel PostgreSQL	netbird-zdb-1
netbird_netbird_zitadel_certs	Zitadel certificates	netbird-zitadel-1

Current Architecture

                    ┌─────────────────────────────────────┐
                    │       vps1.phiiiil.de (152.53...)    │
                    │         Debian 12 (ARM64)            │
                    │         UFW + Fail2ban               │
                    └─────────────────────────────────────┘
                                       │
            ┌──────────────────────────┼──────────────────────────┐
            │                          │                          │
    ┌───────▼────────┐       ┌────────▼────────┐      ┌────────▼────────┐
    │  Netbird VPN   │       │    Immich       │      │     Gitea      │
    │  + Caddy       │       │  (3 containers) │      │  (2 containers) │
    │  (8 containers)│       │                 │      │                 │
    │                │       │ - Server (2283) │      │ - App (3000)    │
    │ - Caddy (443)  │       │ - ML            │      │ - SSH (2222)   │
    │ - Management   │       │ - PostgreSQL    │      │ - PostgreSQL   │
    │ - Dashboard    │       │ - Redis         │      │                 │
    │ - Zitadel      │       │ - 37GB photos   │      │                 │
    │ - Signal/Relay │       │                 │      │                 │
    └────────────────┘       └─────────────────┘      └─────────────────┘
            │                          │                          │
    nb.phiiiil.de          immich.phiiiil.de          git.phiiiil.de
    (reverse proxy)         (via Caddy)                (via Caddy)

Security Status

✅ Configured

• UFW Firewall: Active and configured
  • Only necessary ports exposed (22, 80, 443, 2283, 2222)
  • Default deny incoming policy
• Fail2ban: Active protecting SSH
  • Currently blocking 6 IPs
  • 3 strikes = 1 hour ban
• Security Headers: All domains have HSTS, X-Frame-Options, CSP
• SSH: Key authentication only (no password)
• Backups: Automated daily backups (databases + photos) ✅

⚠️ Important

• ✅ Immich photos (39GB) - Automated backup implemented (04:00)
• Remote backup storage recommended (mount to /mnt/backup)
• OIDC SSO integration plan created (ready to configure)

System Administration

SSH Access

• User: phil
• Config: ~/.ssh/config (Host vps1)
• Key: ~/.ssh/id_rsa (RSA)
• Connection: ssh vps1

Docker Management

• All compose projects in /home/phil/docker/
• Use docker compose (v5) for management
• Docker service enabled and running

Automated Backups

Database Backup (02:00):

• Script: /home/phil/docker/backup/backup.sh
• Location: /mnt/backup/latest/
• Retention: 30 days
• Log: /var/log/vps-backup.log

Photo Backup (04:00) ✨ NEW:

• Script: /home/phil/docker/backup/backup-immich-photos.sh
• Location: /mnt/backup/immich-photos/latest/
• Retention: 30 days
• Log: /var/log/immich-photo-backup.log

Cron Jobs

• 0 2 * * * /home/phil/docker/backup/backup.sh >> /var/log/vps-backup.log 2>&1
• 0 4 * * * /home/phil/docker/backup/backup-immich-photos.sh >> /var/log/immich-photo-backup.log 2>&1

System Resources

Disk Usage

• Total: 1TB (1006GB)
• Used: 92GB (10%)
• Available: 863GB
• Critical Data:
  • Immich photos: 39GB in /home/phil/docker/immich-app/library/ ✅ Backed up
  • Photo backup: 39GB in /mnt/backup/immich-photos/
  • Databases: ~83MB total

Memory

• Total: 15GB
• Used: ~2GB
• Available: ~13GB

Services Status

• Total Containers: 12
• Healthy: 6 (with health checks)
• All Running: Yes

Access URLs

Service	URL	Credentials
Netbird Dashboard	https://nb.phiiiil.de	Configure in Netbird
Immich	https://immich.phiiiil.de	Create admin account
Gitea	https://git.phiiiil.de	User: phil / Password: j8bKvIl3AtIp5aTG
Git via SSH	git@152.53.119.222:2222	Use Gitea credentials

Documentation Files

• vps1-state-25012026.md - Current system state and operational guide
• vps1-todo.md - Action items and maintenance tasks
• docs/deployment-summary.md - Deployment details and maintenance tasks
• docs/oidc-integration-guide.md - How to configure SSO with Netbird Zitadel
• docs/sso-integration-plan.md - Complete SSO implementation plan (NEW)
• docs/sso-integration-diagram.txt - SSO architecture diagrams (NEW)
• docs/immich-backup-implementation.md - Photo backup implementation (NEW)

Next Steps

All core services are operational with complete backup coverage. Optional enhancements:

1. Remote backup storage - Mount storage to /mnt/backup for off-site backups
2. OIDC SSO - Configure Gitea/Immich with Netbird Zitadel (plan created)
3. Monitoring - Set up container health monitoring

---

Last Updated: 2026-01-25 Status: ✅ Production Ready