mercury.kennethreitz.org/docs/inventory.md

# Dokploy inventory

*Last verified: 2026-06-04*

What's deployed on the Dokploy instance, with API IDs for scripting.

## Projects

### httpbin

> A simple HTTP request & response service.

| | |
|---|---|
| Project ID | `pr7LbZckEamcTDxZTDVd_` |
| Environment | `production` (`9WcQGl8yxLSq7OAYtTQ6I`) |

#### Application: httpbin

| | |
|---|---|
| URL | https://httpbin.kennethreitz.org |
| Application ID | `q_TboJiWsBtn6PRD3BfIO` |
| App name (Swarm service) | `httpbin-lmxabw` |
| Source | Docker image `kennethreitz/httpbin:latest` (Docker Hub) |
| Container port | 80 |
| Domain | `httpbin.kennethreitz.org` → A → `5.161.122.181` (DNSimple) |
| TLS | Let's Encrypt via Traefik (`certificateType: letsencrypt`) |
| Deployed | 2026-06-04 |

Redeploy: `scripts/api.sh application.deploy '{"applicationId":"q_TboJiWsBtn6PRD3BfIO"}'`

### poemsbysarah

> Poems by Sarah — static site (sarah-poems repo)

| | |
|---|---|
| Project ID | `6DVGWaAc221gBD0fww1vY` |
| Environment | `production` (`2LmxnWq6E4QGzaipaHRza`) |

#### Application: poemsbysarah

| | |
|---|---|
| URL | https://poemsbysarah.com (+ www, poemsbysarah.kennethreitz.org) |
| Application ID | `-JVyFxpxGQHsIJUBsNAT3` |
| App name (Swarm service) | `poemsbysarah-jc5l83` |
| Source | Custom git `git@github.com:kennethreitz/sarah-poems.git`, branch `main` |
| Auth | Dokploy SSH key `github-sarah-poems` (`PO4Ik1oy95XZzt_NjnrEd`), added as read-only GitHub deploy key "dokploy@mercury" |
| Build | Dockerfile (multi-stage: Python/uv builds static site → nginx:alpine serves) |
| Container port | 8080 |
| Domains | `poemsbysarah.com` (`qBT5H0GsBSLhLEqhN6nip`), `www.poemsbysarah.com` (`ic5BF71JRiV1FuhjslO6L`), `poemsbysarah.kennethreitz.org` (`Vgud4uu3054EE2Ru5dIIm`) |
| TLS | Let's Encrypt via Traefik |
| Auto-deploy | GitHub webhook (id `636431970`) on push → `$DOKPLOY_URL/api/deploy/<refreshToken>`; replaced the repo's old Fly Deploy action |
| Deployed | 2026-06-05 (migrated from Fly.io app `poemsbysarah`) |

Redeploy: `scripts/api.sh application.deploy '{"applicationId":"-JVyFxpxGQHsIJUBsNAT3"}'`

### kjvstudy

> KJV Study — kjvstudy.org Bible study site

| | |
|---|---|
| Project ID | `A649aIoEmJOdR00t3Pjbv` |
| Environment | `production` (`aaP2KaUXwe_YNP1L-P7Nj`) |

#### Application: kjvstudy

| | |
|---|---|
| URL | https://kjvstudy.org (+ www, kjvstudy.kennethreitz.org) |
| Application ID | `8Grj0KrNvoEQTubzgERAY` |
| App name (Swarm service) | `kjvstudy-bt2mgm` |
| Source | Custom git `git@github.com:kennethreitz/kjvstudy.org.git`, branch `main` |
| Auth | Dokploy SSH key `github-kjvstudy` (`p4OF0zEphdM124OgCjnNW`), read-only GitHub deploy key "dokploy@mercury" |
| Build | Dockerfile (multi-stage: uv deps → python:3.13-slim + granian ASGI, search index baked at build) |
| Container port | 8000 (`/health` endpoint) |
| Env | `PRELOAD_INTERLINEAR=false`, `WORKERS=2`, `RUNTIME_THREADS=2` |
| Domains | `kjvstudy.org` (`n5d7dr6glGHt0GZUcHY4Z`), `www.kjvstudy.org` (`_9BBfXI5RKJm6vCh7Srkd`), `kjvstudy.kennethreitz.org` (`Uz0GYQOZakCpX1080MxMA`) |
| TLS | Let's Encrypt via Traefik |
| Auto-deploy | Test-gated: GitHub Actions `deploy.yml` (push to main → pytest → curl `DOKPLOY_DEPLOY_URL` secret). No plain webhook — repo's deploys were test-gated on Fly, behavior preserved. ⚠️ The deploy endpoint silently no-ops (still 200) without a push payload: must send `x-github-event: push` header + `{"ref":"refs/heads/main"}` body. |
| Deployed | 2026-06-05 (migrated from Fly.io app `kjvstudy`) |

Redeploy: `scripts/api.sh application.deploy '{"applicationId":"8Grj0KrNvoEQTubzgERAY"}'`

### kennethreitz.org

> Personal site — tuftecms/granian

| | |
|---|---|
| Project ID | `Uy9ecVxT_JCLUhpIaJei6` |
| Environment | `production` (`vyHsgusrcY2YiP-b2SeMv`) |

#### Application: kennethreitz.org

| | |
|---|---|
| URL | https://kennethreitz.org |
| Application ID | `WOM59R7Q99Bk6Uhu1blJ0` |
| App name (Swarm service) | `kennethreitz-org` |
| Source | Custom git `git@github.com:kennethreitz/kennethreitz.org.git`, branch `main` |
| Auth | Dokploy SSH key `github-kennethreitz-org` (`1UnKE3iZu797vpUYaA5Gb`), read-only GitHub deploy key "dokploy@mercury" |
| Build | Dockerfile (astral/uv python3.14 + WeasyPrint deps, granian ASGI) |
| Container port | 8000 (`/health` endpoint) |
| Domains | `kennethreitz.org` (`OwJn1ashpFz7kUHFNNcvj`). `www` is a Squarespace CNAME — intentionally not on Dokploy. |
| TLS | Let's Encrypt via Traefik |
| Auto-deploy | GitHub webhook (id `636436048`) on push (old Fly workflow had no test gate) |
| Deployed | 2026-06-05 (migrated from Fly.io app `kr-website-icy-sea-7069`) |

Note: the Fly app had `AWS_*`/`BUCKET_NAME` (Tigris) secrets, but nothing in the
code references them — treated as leftovers and not carried over.

Redeploy: `scripts/api.sh application.deploy '{"applicationId":"WOM59R7Q99Bk6Uhu1blJ0"}'`

### interpretations

> Interpretations — album site (nginx static)

| | |
|---|---|
| Project ID | `xba7jeE0wgN1T8vwWfjVb` |
| Environment | `production` (`afyewWiiRd5wtJqe9EqVN`) |

#### Application: interpretations

| | |
|---|---|
| URL | https://interpretations.kennethreitz.org |
| Application ID | `arptPVNJZU0SIsk7z8G-E` |
| App name (Swarm service) | `interpretations` (suffix assigned by Dokploy) |
| Source | Custom git `git@github.com:kennethreitz/interpretations.git`, branch `main` |
| Auth | Dokploy SSH key `github-interpretations` (`TlDSsKKVz7O0Gpk_jYFVB`), read-only GitHub deploy key "dokploy@mercury" |
| Build | Dockerfile (nginx:alpine serving `site/`, zips full album at build) |
| Container port | 80 |
| Domains | `interpretations.kennethreitz.org` (`URm1R9zAWG4mugI77XBVi`) — DNS currently CNAME to Fly, needs flip to `5.161.122.181` |
| TLS | Let's Encrypt via Traefik |
| Auto-deploy | GitHub webhook (id `636437610`) on push (no tests in repo) |
| Deployed | 2026-06-05 (migrated from Fly.io app `interpretations`) |

Note: repo is heavy (~1.4 GB .git, mp3s tracked directly) — clones/builds are slow
but the site rarely changes.

Redeploy: `scripts/api.sh application.deploy '{"applicationId":"arptPVNJZU0SIsk7z8G-E"}'`

### photos

> photos.kennethreitz.org (ExifTree) — Django photo portfolio

| | |
|---|---|
| Project ID | `ZTrEB4hHFibiOjqGUaEvF` |
| Environment | `production` (`p0XGhTIy3NvO3Flwr7bVU`) |

#### Compose: photos (web + worker)

| | |
|---|---|
| URL | https://photos.kennethreitz.org |
| Compose ID | `WICLbVwy5JEbHz2SPb4tR` (appName `exiftree-1fms6x`) |
| Source | Custom git `git@github.com:kennethreitz/photos.kennethreitz.org.git`, branch `main`, `compose.prod.yml` |
| Auth | Dokploy SSH key `github-photos` (`a1BX7DYoCglQFXAwTEmy0`), read-only deploy key |
| Services | `web` (runbolt :8000, Traefik routes here) + `worker` (Celery, concurrency 2) |
| Domain | `photos.kennethreitz.org` (`x9rE8KS2nDGXlQjpUorfm`, serviceName `web`) — covered by wildcard `*.kennethreitz.org` A record |
| Env | DEBUG/SECRET_KEY/ALLOWED_HOSTS/DATABASE_URL/CELERY_*/AWS_* in Dokploy compose env. Celery brokers through Postgres via `sqla+postgresql+psycopg://` (explicit env override — repo only ships psycopg v3, default `sqla+postgresql://` wants psycopg2). `OPENAI_API_KEY` empty for now (AI describe disabled). |
| Storage | MinIO bucket `exiftree-media` (self-hosted, see minio compose below) — public URLs via `img.kennethreitz.org/exiftree-media`, path-style. Migrated from Tigris 2026-06-05: 166 GiB / 100,632 objects, `mc diff` verified clean. Tigris bucket retained as cold fallback. |
| Auto-deploy | GitHub webhook (id `636448741`) → `/api/deploy/compose/<refreshToken>` |
| Deployed | 2026-06-05 (migrated from Fly.io app `exiftree`; old `deploy.yml` + `daily-restart.yml` workflows removed) |

#### Database: exiftree-db

| | |
|---|---|
| Postgres ID | `BgAzfQ5lAXvd6jORAz2bs` (appName/host `exiftree-db-fsgd0w`) |
| Image | `postgres:17` (matches the Fly source version — pg16 cannot read pg17 dumps) |
| DB/user | `exiftree` / `exiftree` (password in Dokploy) |
| Data | Restored 2026-06-05 from Fly Postgres `exiftree-db` dump — 20,301 images, 168 MB. The Fly DB app still exists as a fallback snapshot. |

Redeploy: `scripts/api.sh compose.deploy '{"composeId":"WICLbVwy5JEbHz2SPb4tR"}'`

#### Compose: minio (photos media store)

> MinIO for photo media. Lives in the photos project. A *separate* MinIO in the
> infra project handles backups — see below.

| | |
|---|---|
| Compose ID | `UK8pWczw8d9GSmyLjZJiP` (appName `minio-q3xgqx`, sourceType raw, env `production` of photos) |
| S3 API | https://img.kennethreitz.org (container port 9000) — ⚠️ `media.` was first choice but it's an existing CNAME to the Synology NAS; check the zone before naming! |
| Console | https://media-minio.kennethreitz.org (container port 9001) |
| Data dir | `/mnt/objects/minio` — bind mount on the 250 GB `mercury-objects` Hetzner volume |
| Root user | `exiftree-admin` (password in Dokploy compose env) |
| Buckets | `exiftree-media` (anonymous download enabled) |
| Service account | access key in Dokploy (photos compose env) |

⚠️ Gotcha learned the hard way: Dokploy compose domains are applied as **container
labels at deploy time** — `domain.create`/`delete` alone changes nothing until the
compose is redeployed. Stale labels keep routing the old hostname.

### infra

> Infrastructure services (own project)

#### Compose: minio-backups

| | |
|---|---|
| Compose ID | `o5LlW9tAugh9K3nf5CTh5` (appName `minio-backups-o5fjyf`, raw) |
| S3 API | https://s3.kennethreitz.org (port 9000) |
| Console | https://minio.kennethreitz.org (port 9001) |
| Data dir | `/mnt/objects/minio-infra` (on the volume) |
| Root user | `infra-admin` (password in Dokploy compose env) |
| Buckets | `dokploy-backups` (private) |
| Service account | access key in the Dokploy destination config |

#### Compose: umami

| | |
|---|---|
| Compose ID | `hDl_SBuWUPhYesgIZYYRU` (appName `umami`, raw) |
| URL | https://analytics.kennethreitz.org (container port 3000) |
| Stack | umami (postgresql flavor) + dedicated postgres:17 (named volume `umami-db-data`) |
| Login | default `admin`/`umami` — **change on first login** |
| Notes | Nine sites registered + instrumented (incl. rhymepad, pytheory-playground 2026-06-12, and `pytheory-docs` = pytheory.org 2026-06-16 → website `abaa0013-d524-4583-b70e-6d0ff5b7360c`, snippet in the Sphinx `kennethreitz/pytheory` `docs/_templates/layout.html`, replacing a dead Gauges tracker). Public share dashboards enabled per site, all 9 linked from Glance's Analytics bookmark group. **Sharing is stored in the `share` table** (not a `website.share_id` column in this version): one row per site with `entity_id`=website_id, `share_type`=1, `parameters`='{"events": true, "overview": true}', and a random `slug` that is the public URL id (`/share/<slug>/<domain>`). New sites can be registered with a SQL insert into the `website` table, and shared with an insert into `share` (umami-db container `umami-avvc5k-umami-db-1`, user_id `41e2b680-648e-4b09-bcd7-3e2b10c06264`) — see pytheory-playground/pytheory-docs entries. |
| Daily email report | **n8n workflow** "Umami daily report" (id `zotWITv1CWUiIOEP`): Schedule (`15 12 * * *`, daily 12:15 UTC / ~08:15 ET) → Code node → Send Email. The Code node logic lives in `scripts/n8n-report-core.js` (login → fetch yesterday + prior day stats + top pages for all 9 sites by hard-coded website-id → styled HTML, day boundaries America/New_York). Emails a digest (totals + per-site pageviews/visitors/visits with day-over-day deltas + top 10 pages) to thepythonist@gmail.com. **Auth:** a dedicated umami user `reporter` (role `admin` — `view-only` sees no sites in v3) logs in via `/api/auth/login`; admin can read any website's stats by id even without owning it. **SMTP:** Gmail via n8n credential "Gmail SMTP 587 (reports)" — **port 587/STARTTLS, NOT 465** (465 is blocked outbound on this host). Gotcha: updating a workflow's schedule via the public API doesn't reload the live trigger — must POST `/deactivate` then `/activate` to re-register. Top pages need umami metrics `type=path` (not `url`). The earlier cron version (`scripts/umami-daily-report.py`, `/usr/local/sbin/`, queried Postgres directly) is **retired** — cron moved to `/root/umami-daily-report.cron.disabled`, script kept as a fallback. |

#### Compose: glance

| | |
|---|---|
| Compose ID | `CKS3H3zDpAB71FF0A-1cR` (appName `glance`, raw) |
| URL | https://home.kennethreitz.org (container port 8080) |
| Config | `/var/lib/glance/glance.yml` on the host. **Home**: clock, weather (Winchester VA, imperial), server-stats, Services monitor (15 sites — each links to its homepage via `url`, health-probed separately via `check-url`; minio links to the console but checks the S3 health endpoint), essays RSS, bookmarks (Admin + Analytics groups; Analytics has 9 Umami share-dashboard links), Hacker News. **Server**: docker-containers (ro socket mount), **"Dokploy Apps"** custom-api widget (hits `project.all`, renders 8 apps + 11 compose stacks with status dots), gitea activity RSS, stack release tracker. **Auth enabled** (user `kenneth`; auth secret-key must be exactly 64 bytes base64). Edit + restart container to change. Timestamped config backups on the host: `glance.yml.bak*-20260616`. |
| Secret in config | The "Dokploy Apps" widget stores the **`DOKPLOY_API_KEY` in plaintext** in `glance.yml` (`headers.x-api-key`). Host-only, **not** in git, but it is a full-access Dokploy API key. Harden later by moving it to a glance-container env var (`${VAR}`, needs a Dokploy redeploy) or a scoped/read-only key. |

#### Compose: icloud-drive (filebrowser)

| | |
|---|---|
| Compose ID | `-fIZL8clnGBaFjAJY84j9` (appName `icloud-drive`, raw) |
| URL | https://drive.kennethreitz.org (filebrowser, container port 80) |
| Login | `kenneth` (filebrowser requires ≥12-char passwords) |
| Data | `/mnt/objects/icloud-drive` (synced mirror under `current/`, deletions kept in dated `archive/`), filebrowser DB at `/mnt/objects/filebrowser` |
| Sync | systemd `icloud-sync.timer` hourly → `rclone sync icloud: …` with `--exclude "*.partial" --exclude ".*.icloud"` (those are iCloud's in-flight upload placeholders; without excluding them rclone exits non-zero and the unit falsely reports failure). Initial seed 290 GB done 2026-06-05. Log: `/var/log/icloud-sync.log`. ⚠️ Apple 2FA trust token expires ~monthly — `rclone config reconnect icloud:` on the server to refresh. |

#### Compose: gitea

| | |
|---|---|
| Compose ID | `PV7bUFe4wV-2G1WD8H57e` (appName `gitea-qdogok`, raw) |
| URL | https://git.kennethreitz.org (container port 3000) |
| Git SSH | `git.kennethreitz.org:2222` (host port 2222 → container 22) |
| Data dir | `/var/lib/gitea` (root disk; sqlite DB) |
| Admin | `kennethreitz` (password noted at setup; registration disabled) |
| Homepage | Custom landing page (`/var/lib/gitea/gitea/templates/home.tmpl` on the host) with a "Featured projects" card grid — edit the file and `docker restart` the gitea container to change picks |
| Mirrors | Pull-mirrors (8h refresh) of all repos from github.com/**kennethreitz** (100, incl. rhymepad.org), **not-kennethreitz** (38), and **kennethreitz-archive** (154) — all three owners public on Gitea — created via `/api/v1/repos/migrate` with a GitHub token |
| robots.txt | Custom at `/var/lib/gitea/gitea/robots.txt` (= `$GITEA_CUSTOM/robots.txt`, served live, no restart). Allows indexing of repo/code/release/wiki pages; disallows the infinite, CPU-expensive endpoints (`compare`, `blame`, `commit`/`commits`, `src/commit`, `raw`, `archive`) and faceted `?q=`/`?sort=` listings. Points crawlers at `/sitemap.xml` (gitea auto-generates it; 14 sub-sitemaps). Default gitea ships no robots.txt = everything crawlable, which let scrapers burn crawl budget + CPU on the trap URLs. See server.md "Gitea crawler storm". |
| Anti-scraper | Abusive crawler IPs dropped at the host `DOCKER-USER` iptables chain (NOT ufw — ufw is inactive and Docker bypasses it). Currently blocked: `216.73.216.4` (anon AWS, was 46% of traffic) and `57.141.0.0/24` (Meta crawler swarm — note: blocking Meta breaks FB/IG/WhatsApp link previews). Persisted by `block-scrapers.service`; edit IP list in `/usr/local/sbin/block-scrapers.sh` then `systemctl restart block-scrapers`. |

### Backups

| | |
|---|---|
| Destination | `minio` (`gZBEIrDnfDmRcv_pQQO7q`) → bucket `dokploy-backups` via https://s3.kennethreitz.org |
| Schedule | exiftree-db (postgres): daily 06:00 UTC, keep 14 (`backupId Wa4DDnhr2alAK_f7o7C5I`) — verified working with a manual run |

### immich

> Immich — self-hosted photo backup (Google Photos replacement)

| | |
|---|---|
| Compose ID | `yct1XQb0qsCZWQwYq16DT` (appName `immich`, raw — adapted from the official release compose) |
| URL | https://immich.kennethreitz.org (container port 2283) |
| Services | immich-server, immich-machine-learning, valkey 9, postgres 14 + vectorchord (pinned digests from upstream) |
| Data | `/mnt/objects/immich/library` (media) and `/mnt/objects/immich/db` (postgres) on the volume (resized to 750 GB for a ~500 GB Apple Photos migration) |
| Env | `IMMICH_VERSION=release`, `DB_PASSWORD` in Dokploy compose env |
| Notes | First registered account becomes admin. iPhone app → server URL → background backup. Mac Photos library migration planned via osxphotos → immich CLI. |



### strainsdb

> strainsdb.org — Django cannabis strain database (7,024 strains)

| | |
|---|---|
| URL | https://strainsdb.org (+ www) |
| Application ID | `8FAkmUQwPFTKCiIc8iyyo` (Swarm app `strainsdb`) |
| Source | Custom git `git@github.com:kennethreitz/strainsdb.org.git`, branch `main` |
| Auth | Dokploy SSH key `github-strainsdb`, read-only deploy key |
| Build | Dockerfile (python 3.12 + pipenv, gunicorn :8000) |
| Auto-deploy | GitHub webhook (id `636625919`) on push |
| Deploys | start-first ordering (zero-downtime) |
| DNS | Both records flipped from dead Fly app `shakti` to A → 5.161.122.181 (2026-06-05, via DNSimple API) |
| Caveats | `DEBUG=True` hardcoded in settings.py; SQLite ships in the image (writes lost on redeploy — same as Fly-era behavior) |
| Revived | 2026-06-05 — the Fly app was already destroyed; site was fully down before this deploy |

### n8n

> n8n — workflow automation

| | |
|---|---|
| Compose ID | `gRwvbIWFwIGDxyDuCeYG3` (appName `n8n-pfgiqr`, raw) |
| URL | https://n8n.kennethreitz.org (container port 5678) |
| Data | `/var/lib/n8n` (root disk; sqlite + encryption key) — `N8N_ENCRYPTION_KEY` also in Dokploy compose env |
| Auth | n8n owner account — first visitor claims it (set up immediately after deploy) |
| Notes | `WEBHOOK_URL` set for inbound webhooks; task runners enabled; TZ America/New_York |

### opengist (infra project)

> Opengist — self-hosted gists

| | |
|---|---|
| Compose ID | `AYu2u7VdZynbTPzAoVwfY` (appName `opengist-zvxug6`, raw) |
| URL | https://gist.kennethreitz.org (container port 6157, `/healthcheck`) |
| Git SSH | port `2223` (host) → 2222 (container); firewall rule added |
| Data | `/var/lib/opengist` (root disk, sqlite) |
| Auth | Admin account `kennethreitz` (house password); signup disabled (`OG_DISABLE_SIGNUP=true`) |
| Contents | Empty — for manual/ad-hoc gists. A bulk import of GitHub gists was attempted 2026-06-05 but abandoned: this Opengist build (`:1`) rejects any gist content containing a literal `%` and its token-create API was flaky. Gists remain on GitHub. To retry, pin an older Opengist tag (the `%` bug is a latest-tag regression). |

### photos-backup (iCloud Photos → Hetzner Object Storage)

> Off-site backup of iCloud Photos (839 GB) for Apple-lockout insurance

| | |
|---|---|
| Compose ID | `5OPgRX49aU0S-L5Gpzswi` (appName `photos-backup-imap2e`, raw) |
| Image | `mercury-photos-backup:latest` — built on host from `photos-backup/` (icloudpd + rclone + FUSE) |
| How | Single container FUSE-mounts the Hetzner bucket and runs icloudpd writing straight to it (no local-staging ceiling, no re-download loop). Watch mode, 6h interval. |
| Backend | Hetzner Object Storage bucket `kr-icloud-photos`, endpoint `hel1.your-objectstorage.com`, region `hel1` (⚠️ region MUST be set or S3 ops fail with LocationConstraintConflict) |
| Apple auth | icloudpd session in `/var/lib/icloudpd/cookies` (user did interactive 2FA). Datacenter-IP logins trip Apple's fraud detection — a bad-username attempt once returned a scary "account locked" message that wasn't a real lock. Token refreshes ~monthly. |
| Creds | S3 key + Apple ID in Dokploy compose env |

### Immich external libraries

Immich indexes two read-only rclone mounts (host systemd units, bound into immich-server with `rslave` propagation):
- `icloud-photos-mount.service` → `hz:kr-icloud-photos/library` at `/mnt/objects/icloud-photos` → `/icloud-photos` → library "iCloud Photos" (`5616024c-…`)
- `minio-photos-mount.service` → `m:exiftree-media/originals` at `/mnt/objects/minio-photos` → `/minio-photos` → library "photos.kennethreitz.org" (`8e870747-…`)

⚠️ Indexing over the transatlantic FUSE mount is slow and reads originals back for thumbnails (one-time egress ~bucket size). Fragile if a mount drops. Acceptable for archive browsing.

### storagebox-archive

> Off-site cold archive of S3 buckets → Hetzner Storage Box (BX21, 5 TB)

| | |
|---|---|
| Compose ID | `I01acQdiU5giQo5WrclIs` (appName `storagebox-archive`, raw, infra project) |
| Target | Hetzner Storage Box `u609317.your-storagebox.de:23` (SFTP/SSH). Key auth: mercury + Kenneth's Mac keys installed in `.ssh/authorized_keys`. Password also in compose env. |
| Schedule | rclone container, 24h loop: `exiftree-media` → `sbox:archives/exiftree-media`, `dokploy-backups` → `sbox:archives/dokploy-backups` |
| Why | `exiftree-media` (166 GB photo-site library) previously had ZERO backups — single copy on the volume. This is its first real off-server copy. |
| Note | Storage Box keep "external reachability" ON (mercury is US Hetzner Cloud, box is EU; Mac restores come from home). Compose YAML saved at repo root `storagebox-archive.compose.yml`. |

### dozzle (log dashboard)

> Live container-log dashboard for the backup/archive jobs

| | |
|---|---|
| Compose ID | `P38wZWXlREYXBhG75QQLi` (appName `dozzle`, raw, infra project) |
| URL | https://logs.kennethreitz.org (Traefik basicAuth `dozzle-auth@file`, user `kenneth`) |
| Scope | All containers on the host (no filter) |
| Purpose | Watch new files stream into cold storage. archive rclone runs with `-v` so each transfer logs `Copied (new): ...`. |

### iCloud Drive → Storage Box (in progress 2026-06-06)

- `drive.kennethreitz.org` (Filebrowser) **repointed** to read-only host mount
  `icloud-drive-sbox-mount.service` → `sbox:icloud-drive` (was the local volume mirror).
- Bulk copy local mirror → `sbox:icloud-drive` via **rsync over SSH** (~33 MiB/s; rclone-SFTP
  was only 2.5 MiB/s — **use rsync for bulk transfers to the Storage Box**, small files).
- Still TODO once rsync completes: repoint the `icloud-sync` timer to write iCloud →
  `sbox:icloud-drive` directly (Dokploy-managed), remove the 291 G local mirror, drop the
  redundant `icloud-drive` line from storagebox-archive. Then the volume holds ~only Immich.

### rhymepad

> RhymePad — phoneme-aware rhyme analysis for poets & rappers

| | |
|---|---|
| URL | https://rhymepad.org (canonical) + https://rhymepad.kennethreitz.org; www.rhymepad.org 301→apex |
| Application ID | `vw6R6B_8uK07_U1Mm48d-` (Swarm app `rhymepad`) |
| Source | Custom git `git@github.com:kennethreitz/rhymepad.org.git`, branch `main` (repo created 2026-06-07) |
| Auth | Dokploy SSH key `github-rhymepad`, read-only deploy key |
| Build | Dockerfile (python 3.12 + uv, FastAPI/uvicorn :8000, NLTK data pre-warmed for g2p-en) |
| API | `/api/analyze` (POST), `/api/lookup` (GET); static UI at `/` |
| Auto-deploy | GitHub webhook (id `637508735`), start-first updates |
| Deployed | 2026-06-07 |

### pytheory-playground

> PyTheory Playground — interactive music theory toolbox (pytheory + responder)

| | |
|---|---|
| URL | https://playground.pytheory.org |
| Project ID | `FaXCUHVmOaJu6w8G2Mz7t` |
| Environment | `production` (`wtnERcBz2nWQi56Xpb7hs`) |
| Application ID | `C2oKPwJ9cNXWmmLg-K-nL` (Swarm app `pytheory-playground-ju4thg`) |
| Source | Custom git `https://github.com/kennethreitz/pytheory-playground.git` (public, no auth), branch `main` |
| Build | Dockerfile (uv python 3.14 + lilypond + ffmpeg; responder app on :5042) |
| Domain | `playground.pytheory.org` (`pAS0p44NhPWjXYhWM8toa`) → A → 5.161.122.181; LE via Traefik |
| Auto-deploy | GitHub webhook (id `640130465`) on push → `$DOKPLOY_URL/api/deploy/<refreshToken>` |
| Analytics | Umami website `a691eb37-8047-4529-9ea8-64ef1957f564` (registered via SQL insert into the umami db — admin password isn't the documented default) |
| Deployed | 2026-06-12 |
| Note | pytheory.org registered 2026-06-12 via DNSimple. The apex (ALIAS → pytheory.kennethreitz.org → kennethreitz.github.io) and www serve the GitHub Pages docs for repo kennethreitz/pytheory (docs/CNAME = `pytheory.org`); only `playground.` lives on mercury |

Redeploy: `scripts/api.sh application.deploy '{"applicationId":"C2oKPwJ9cNXWmmLg-K-nL"}'`


## iCloud Drive cutover COMPLETE 2026-06-07

- 207,038 files / 311.5 GB rsynced to `sbox:icloud-drive` (verified, 0 errors).
- `drive.kennethreitz.org` (Filebrowser) reads `sbox:icloud-drive` via mount.
- `icloud-sync.service` repointed: iCloud → `sbox:icloud-drive` directly, **daily** (SFTP
  listing of 200k files is slow; backup cadence is fine daily). backup-dir on the box.
- storagebox-archive: icloud-drive line + local bind removed (now primary on the box).
- **Local 291 GB mirror removed** → volume 614G→323G, then cache reclaim → **65G used**.

## icloudpd cache: cleared the bulk bloat
The photos-backup rclone vfs-cache grew to 257G on the volume (the `--vfs-cache-max-size`
can't bound it during a bulk run — files pending the slow US→EU upload can't be evicted).
iCloud Photos download is now COMPLETE (bucket `kr-icloud-photos` = 437 GiB / 61k objects,
icloudpd idle). Cleared the stale cache; it now sits at ~34 MB and stays lean because
incrementals only fetch new photos. Volume usage: **65 GB** (Immich 59 + infra 6).

## Volume teardown readiness
Volume now holds only Immich (59G) + dokploy-backups MinIO (6G) + tiny. Ready for option A
(migrate to a ~250 GB volume, delete the 1 TB). Still gated on a Hetzner volume-quota bump
for a safe side-by-side migration.

## iCloud Photos backup — PARKED 2026-06-07

Abandoned the continuous icloudpd backup. Root cause: icloudpd downloads far faster
than the US→EU upload to Hetzner Object Storage drains, so the rclone vfs cache buffer
grows past any available disk (filled root twice + the volume once). Backpressure
(`--vfs-cache-min-free-space`) + an auto-stop watchdog were added and are committed, but
per owner decision we are NOT running it.
- photos-backup container: stopped, restart=no (won't revive).
- Partial backup retained: `kr-icloud-photos` bucket = ~498 GiB / 63k objects (of ~839 GiB).
  Kept as a real off-site snapshot; costs a few € in object storage. Delete if not wanted.
- iCloud **Drive** backup is UNAFFECTED and stays (daily sync → Storage Box, drive.kennethreitz.org).


## Traefik custom config (hand-written, NOT Dokploy-managed)

`/etc/dokploy/traefik/dynamic/custom-rhymepad-www-redirect.yml` (copy in repo `traefik/`):
301 redirects `www.rhymepad.org` → `https://rhymepad.org` (path-preserving). Uses priority
1000 to beat Dokploy's auto-generated www routers (priority 24), so it survives app
redeploys. Pattern to reuse for any www→apex redirect: separate dynamic file + high-priority
routers (web + websecure) with a `redirectRegex` middleware. Note: write the file locally and
scp it — backtick `Host()` rules get mangled by heredoc escaping.