TITLE=Server
ROUTE=/infrastructure/server
LOCALE=en
MODIFIED=1792565451
URL=https://wiki.teletypegames.org/infrastructure/server
L=1 https://nginx.org/
L=2 https://traefik.io/
L=3 https://gitea.io/
L=4 https://woodpecker-ci.org/
L=5 #22
L=6 https://getgrav.org/
L=7 https://www.redmine.org/
L=8 https://matomo.org/
L=9 https://www.resourcespace.com/
L=10 https://uptime.kuma.pet/
L=11 https://goaccess.io/
L=12 #50
L=13 #16
L=14 #49
L=15 #73
L=16 #66
L=17 #28
L=18 #70
L=19 https://uptime.teletypegames.org
L=20 https://matomo.teletypegames.org


q│ A single Ubuntu 24.04 LTS machine runs everything Teletype Games uses: the

q│ portal, the Git server, CI, the wiki, project management, analytics and the

q│ BBSes. Nearly every service is a Docker Compose stack, and Nginx is the

q│ entry point for all of them. This page is the public digest; the detailed

q│ operations documentation is internal.


1Overview

1════════


p graph LR                                                                     

p   Internet -->|HTTPS| Nginx                                                  

p   Internet -->|SSH| Gitea                                                    

p   Internet -->|telnet| BBS[BBSes]                                            

p   Internet -->|FTP| FTP[FTP server]                                          

p   Nginx --> Traefik                                                          

p   Traefik --> Gitea                                                          

p   Traefik --> Woodpecker                                                     

p   Traefik --> WebApp[Teletype Games portal]                                  

p   Nginx --> Grav[Grav wiki]                                                  

p   Nginx --> Redmine                                                          

p   Nginx --> Matomo                                                           

p   Nginx --> ResourceSpace                                                    

p   Nginx --> UptimeKuma[Uptime Kuma]                                          

p   Nginx --> Grafana                                                          

p   Nginx --> Authentik                                                        

p   Nginx --> GoAccess                                                         

p   Nginx --> Static[Static sites]                                             

p   Woodpecker -->|build + deploy| WebApp                                      

p   Statusbot --> Discord                                                      

p   Updater --> Discord                                                        

p   UptimeKuma --> Discord                                                     

p   Grafana -->|alerts| Discord                                                


1Services

1════════


t┌───────────────────────┬────────────────────────────────────────────────────┐

t│
h Service               
t│
h What it does                                       
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 1Nginx                 
t│
0 Entry point for all web traffic, TLS termination   
t│

t│
0                       
t│
0 with Let's Encrypt certificates, security headers, 
t│

t│
0                       
t│
0 bot filtering.                                     
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 2Traefik               
t│
0 Internal reverse proxy in front of the main        
t│

t│
0                       
t│
0 stack's containers (Gitea, Woodpecker, portal),    
t│

t│
0                       
t│
0 routing by host and path.                          
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 3Gitea                 
t│
0 Self-hosted Git: repositories, code review,        
t│

t│
0                       
t│
0 issues, package registry. Registration is closed.  
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 4Woodpecker            
t│
0 CI/CD engine integrated with Gitea. It also        
t│

t│
0                       
t│
0 deploys the portal: push to master → tests → image 
t│

t│
0                       
t│
0 build → database migration → container swap.       
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 Teletype Games portal 
t│
0 Vue frontend + Rails API on the 5WarpEngine catalog 
t│

t│
0                       
t│
0 engine, backed by MySQL. Running in production     
t│

t│
0                       
t│
0 mode from its own images since September 2026.     
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 6Grav                  
t│
0 This wiki: a flat-file CMS whose content lives in  
t│

t│
0                       
t│
0 a git repository. Alongside it run a fetcher (git  
t│

t│
0                       
t│
0 sync via webhook) and the wiki's telnet BBS view.  
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 7Redmine               
t│
0 Project management: tasks, bugs, milestones.       
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 8Matomo                
t│
0 Privacy-friendly analytics for the public sites.   
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 9ResourceSpace         
t│
0 Digital asset management: game art, audio, video,  
t│

t│
0                       
t│
0 documents.                                         
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 10Uptime Kuma           
t│
0 Availability and certificate-expiry monitoring     
t│

t│
0                       
t│
0 with Discord alerts.                               
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 Grafana               
t│
0 Monitoring UI: metric and log dashboards for the   
t│

t│
0                       
t│
0 machine, containers, backups, ports, logs, and the 
t│

t│
0                       
t│
0 team's Gitea, Redmine and CI activity. Data from   
t│

t│
0                       
t│
0 Prometheus and Loki; sign in with a Gitea account. 
t│

t│
0                       
t│
0 The server's alerts (CPU, memory, disk, inodes,    
t│

t│
0                       
t│
0 swap, OOM, restart loops, databases, backup,       
t│

t│
0                       
t│
0 certificates, CI) go to Discord as Grafana rules.  
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 Authentik             
t│
0 Central sign-in: one account per member for every  
t│

t│
0                       
t│
0 system (OIDC, SAML, forward auth).                 
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 11GoAccess              
t│
0 Real-time traffic report from the Nginx log,       
t│

t│
0                       
t│
0 behind Authentik sign-in.                          
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 12FTP server            
t│
0 Anonymous, read-only FTP for the DOS tools: the    
t│

t│
0                       
t│
0 13DOSINST program store (
cAPPS
0) and the 14TTGWIKI wiki  
t│

t│
0                       
t│
0 export (
cWIKI
0), and the WarpEngine game files for   
t│

t│
0                       
t│
0 any FTP client (
cWARP
0).                             
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 15Model service         
t│
0 llama.cpp in router mode on the internal           
t│

t│
0                       
t│
0 
cinterstack
0 network: small language models behind   
t│

t│
0                       
t│
0 one OpenAI-compatible address, a key per caller.   
t│

t│
0                       
t│
0 Today it runs Qwen3.5 0.8B, the model of the 16BBS's 
t│

t│
0                       
t│
0 SERMO and a general small model for any stack, and 
t│

t│
0                       
t│
0 Gemma 3 270M on demand.                            
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 BBSes                 
t│
0 Three telnet terminals: the 16Teletype Games BBS,    
t│

t│
0                       
t│
0 the "Definitely not an Impostor" post-game         
t│

t│
0                       
t│
0 terminal and the wiki's BBS view.                  
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 Statusbot             
t│
0 Pascal Discord scheduler that opens weekly status  
t│

t│
0                       
t│
0 threads. Outbound only.                            
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 Updater               
t│
0 Go service watching Gitea commits, wiki updates    
t│

t│
0                       
t│
0 and Redmine issues, posting to Discord webhooks.   
t│

t│
0                       
t│
0 Outbound only.                                     
t│

t├───────────────────────┼────────────────────────────────────────────────────┤

t│
0 Static sites          
t│
0 
cteletype.hu
0 (busybox httpd) and 
cenigmazene.hu
0      
t│

t│
0                       
t│
0 (Astro build served directly by Nginx).            
t│

t└───────────────────────┴────────────────────────────────────────────────────┘


1Public addresses

1════════════════


t┌────────────────────────────┬───────────────────────────────────────────────┐

t│
h Address                    
t│
h Service                                       
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 teletypegames.org          
t│
0 Teletype Games portal                         
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 git.teletypegames.org      
t│
0 Gitea (SSH on port 2222)                      
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 ci.teletypegames.org       
t│
0 Woodpecker CI                                 
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 wiki.teletypegames.org     
t│
0 this wiki                                     
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 pm.teletypegames.org       
t│
0 Redmine                                       
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 assets.teletypegames.org   
t│
0 ResourceSpace                                 
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 uptime.teletypegames.org   
t│
0 Uptime Kuma (Authentik sign-in;               
t│

t│
0                            
t│
0 monitor.teletypegames.org and                 
t│

t│
0                            
t│
0 monitor.teletype.hu redirect here)            
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 grafana.teletypegames.org  
t│
0 Grafana (Gitea sign-in)                       
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 ftp.teletypegames.org      
t│
0 12FTP server (port 21)                          
t│

t├────────────────────────────┼───────────────────────────────────────────────┤

t│
0 teletype.hu, enigmazene.hu 
t│
0 static sites                                  
t│

t└────────────────────────────┴───────────────────────────────────────────────┘

The legacy 
c*.teletype.hu
0 and 
c*.vps.teletype.hu
0 names redirect to their

cteletypegames.org
0 counterparts. Open ports are listed on Server ports.


1How it runs

1═══════════

• 
bDocker Compose stacks
0: every service has its own directory and compose file;
  most are git checkouts, so the configuration is version-controlled. A shared
  Makefile starts, stops and updates all of them.
• 
bEvery image is pinned to a version
0; no 
clatest
0 for external images. Updates
  are manual, monthly, preceded by a database dump.
• 
bContainer ports bind to localhost only
0; everything reaches the internet
  through Nginx. The exceptions are Gitea SSH and the three telnet BBSes.
• 
bAutomatic security updates
0 (unattended-upgrades) on the host; a manual
  reboot after kernel updates.
• 
bConfiguration under version control
0: the Nginx config in its own git
  repository, the rest of 
c/etc
0 via etckeeper.


1Security

1════════

• TLS everywhere, HSTS and the usual security headers; hidden files (
c.git
0,
  
c.env
0) blocked on every vhost.
• Admin interfaces (container manager, database admins, Webmin, Prometheus,
  Loki) are 
bnot on the internet
0; they are reachable only through an SSH
  tunnel. Grafana is public, but sign-in is Gitea-only, with no password
  login.
• The firewall (ufw) denies by default; root cannot log in over SSH, only
  explicitly allowed admin accounts.
• fail2ban bans SSH, Gitea, Redmine and web brute-force attempts at the
  nftables level, so it covers container ports too.
• auditd logs administrative commands; AIDE verifies system-file integrity
  daily.
• The Git server rejects AI-training and scraper bots that ignore robots.txt
  by user agent; expensive Gitea paths (diff, blame, archives) are off-limits
  to all crawlers.
• Every application connects to its database with its own user, scoped to its
  own schema.


1Backups

1═══════

Two chains: nightly database dumps (Gitea included) plus a mirror of every
Gitea repository, followed by an rsync-based full mirror of all stacks,
configuration and dumps to an off-site NAS. No versioning: the NAS always
holds the latest state. Details: 17Backup.


1Retired services

1════════════════


t┌─────────┬─────────────────┬────────────────────────────────────────────────┐

t│
h When    
t│
h What            
t│
h Note                                           
t│

t├─────────┼─────────────────┼────────────────────────────────────────────────┤

t│
0 2026-10 
t│
0 Netdata         
t│
0 its alerts became Grafana rules, Prometheus    
t│

t│
0         
t│
0                 
t│
0 collects the metrics                           
t│

t├─────────┼─────────────────┼────────────────────────────────────────────────┤

t│
0 2026-09 
t│
0 18Teletype Orbit  
t│
0 stopped; source and data archived              
t│

t├─────────┼─────────────────┼────────────────────────────────────────────────┤

t│
0 2026-09 
t│
0 Wiki.js         
t│
0 the old wiki database; content now lives here  
t│

t│
0         
t│
0                 
t│
0 in Grav                                        
t│

t├─────────┼─────────────────┼────────────────────────────────────────────────┤

t│
0 2026-09 
t│
0 OpenVPN         
t│
0 unused, disabled                               
t│

t├─────────┼─────────────────┼────────────────────────────────────────────────┤

t│
0 2026-09 
t│
0 Countdowner     
t│
0 
ccountdown.teletype.hu
0 redirects to the portal  
t│

t├─────────┼─────────────────┼────────────────────────────────────────────────┤

t│
0 2026-09 
t│
0 Discourse forum 
t│
0 
cforum.teletype.hu
0 redirects to the portal's    
t│

t│
0         
t│
0                 
t│
0 contact page                                   
t│

t└─────────┴─────────────────┴────────────────────────────────────────────────┘


1Recent changes

1══════════════

• 
b2026-10-18
0 – Uptime Kuma moved to 19uptime.teletypegames.org (monitor.*
  redirects; push and badge URLs keep working). Matomo moved to
  20matomo.teletypegames.org (the old address redirects) and upgraded to 5.14.
  Matomo, Uptime Kuma and GoAccess moved behind Authentik sign-in (the
  GoAccess password is gone); a sign-in lasts half a year. Grafana dashboards
  grouped by title prefix instead of folders.
• 
b2026-10-17
0 – Resource tuning: Netdata retired, its alerts moved to Grafana;
  4 GB swap, a memory limit on every container, lighter Apache and cAdvisor
  load (the machine's CPU use dropped to about a third).
• 
b2026-10-16
0 – Grafana public at grafana.teletypegames.org with Gitea sign-in;
  new dashboards (backup, ports, TLS, uptime, databases, BBS, logs, Gitea,
  Redmine, CI); ufw rules narrowed to TCP.
• 
b2026-10-16
0 – Backup: restic retired, replaced by an rsync-based full file
  mirror to the NAS (
cvps-backup-sync
0); the Gitea database joined the nightly
  dumps.
• 
b2026-09-13
0 – GoAccess traffic report; bot filtering and robots.txt on the
  Git server; etckeeper.
• 
b2026-09-11
0 – Post-audit overhaul: container ports moved to localhost, admin
  UIs behind SSH tunnel, fail2ban, auditd, AIDE, restic backups, Netdata; the
  portal switched to production mode; image versions pinned; Redmine, Matomo
  and Uptime Kuma upgraded; Orbit and Wiki.js retired.
• 
b2026-09-10
0 – Gitea security incident (CVE-2026-59774), contained the same
  day, Gitea upgraded to 1.27.1.