Stack inventory
State: May 3, 2026 — end of Tier 4.
Repo type — see strategy.md.
Image source — upstream = published image used directly; gitea-registry = built off-host, pushed to gitea.alexandru.macocian.me/amacocian/<name>:<tag>.
Migrated (/mnt/nas/stacks/<name>/)
Morgott (owner host)
| Charlie repo |
Stack path |
Image source |
Notes |
caddy |
caddy/ |
local build |
edge reverse proxy + caddy-security |
authentik |
authentik/ |
upstream |
IdP; postgres + redis + server + worker |
ldap |
ldap/ |
upstream |
openldap + ldap-ui |
ddclient |
ddclient/ |
upstream |
dynamic DNS |
vaultwarden |
vaultwarden/ |
upstream |
password vault |
bookstack |
bookstack/ |
upstream |
wiki (+ mariadb) |
monica |
monica/ |
gitea-registry monica:4.x |
CRM (custom 4.x fork; + mariadb) |
miniflux |
miniflux/ |
upstream |
RSS (+ postgres) |
mealie |
mealie/ |
upstream |
recipes (sqlite) |
homarr |
homarr/ |
upstream |
dashboard |
paperless-ngx |
paperless-ngx/ |
upstream |
docs (+ redis) |
victoriametrics |
victoriametrics/ |
upstream |
vm + vmauth + vmalert + alertmanager + grafana |
gssh |
gssh/ |
gitea-registry gssh:latest |
web SSH terminal |
Melina (owner host)
| Charlie repo |
Stack path |
Image source |
Notes |
gitea |
gitea/ |
upstream |
the git server itself (deployed manually, never via runner-on-self) |
mediacompose |
mediacompose/ |
upstream |
jellyfin + arr + qbt-via-gluetun |
searxng |
searxng/ |
upstream |
metasearch (+ valkey) |
invidious |
invidious/ |
gitea-registry invidious:oidc-support |
YouTube frontend (+ companion + db + gluetun) |
planka |
planka/ |
upstream |
kanban (+ postgres) |
audiobookshelf |
audiobookshelf/ |
upstream |
audiobooks |
directoryadmin |
directoryadmin/ |
gitea-registry directoryadmin:latest |
LDAP admin UI |
Singleton — morgott
| Charlie repo |
Stack path |
Image source |
Notes |
portainer |
portainer/ |
upstream |
container UI; CSRF trusted-origins set via CLI |
cert-issuer |
cert-issuer/ |
upstream smallstep/step-ca:0.30.2 |
SSH user-cert CA. gssh mints via JWK provisioner. Design: cert-issuer.md. |
cert-syncer |
cert-syncer/ |
upstream smallstep/step-cli:0.30.2-trixie |
Active bridge from cert-issuer to /mnt/nas/ca/. Renews managed server certs (today: ldap.lan), keeps trust artefacts fresh. Doesn't restart consumers — see cert-watch. Design: cert-issuer.md. |
Sidecar image (consumed by other stacks)
| Charlie repo |
Image |
Used by |
Notes |
cert-watch |
gitea-registry cert-watch:latest |
ldap (today) |
Tiny alpine sidecar. Polls cert files, restarts sibling containers on change via docker.sock. Add to any stack consuming a cert-syncer-managed cert. |
Shared — multi-host
| Charlie repo |
Hosts |
Layout |
Notes |
portainer-agent |
morgott, melina, mohg, miquella |
docker-compose.yml + docker-compose.miquella.yml |
DSM gets a per-host compose (no /var/lib/docker/volumes bind) |
otelcollector |
morgott, melina, miquella |
docker-compose.yml (shared) |
malenia (launchd + install-mac.sh) deferred — see roadmap |
Planned (new infra)
| Charlie repo |
Owner |
Status |
Notes |
runners |
morgott + melina |
not started |
Gitea Actions runners. Design: roadmap Phase 2. |
Pending (Tier 5 — long tail)
| Charlie repo |
Old path |
Owner |
Repo type |
Status |
shell |
home/shell/ |
— (config, all hosts) |
init |
not started |
first-time-setup |
home/first-time-setup.md |
— (docs) |
init |
not started |
server-mgmt-utils |
home/ServerManagementUtils/ |
morgott |
rewrite |
mostly dead — extract temp/storage scripts (move to otelcollector/scripts/ or host-scripts), then archive |
plist |
home/plist/ |
? |
TBD |
classify before deciding |
Decommissioned
| Stack |
Old path |
Notes |
watchtower |
home/watchtower.retired/ |
Retired May 3, 2026 without replacement. Diun-based image-update flow is planned (roadmap Phase 3). |
Mirrors (Gitea pull-mirror, no host action)
Naming: Charlie/<name>-mirror.
| Mirror |
Upstream |
Status |
gssh source |
https://github.com/AlexMacocian/Gssh |
pushed to amacocian/Gssh (manual) |
monica source |
https://github.com/AlexMacocian/monica (4.x) |
mirror under amacocian/monica |
directoryadmin source |
https://github.com/AlexMacocian/DirectoryAdmin |
mirror under amacocian/DirectoryAdmin |
invidious source |
https://github.com/AlexMacocian/invidious (oidc-support) |
mirror under amacocian/invidious |
Optional later (upstreams we don't customise but want offline):
caddy, authentik, paperless-ngx, mealie, victoriametrics, searxng-docker, nitter, gitea, act_runner.
Non-stack dirs
| Path |
Action |
/mnt/nas/ca/ |
leave; out of scope |
/mnt/nas/ldap/ |
rename → /mnt/nas/ldap-certs/ (deferred — not blocking anything) |
/mnt/nas/media-server/ |
rename → /mnt/nas/media/ (deferred — bind paths in mediacompose .env reference the old name) |
/mnt/nas/portainer/data/ |
move → /mnt/nas/data/portainer/ when portainer migrates |
/mnt/nas/home/*.retired/ |
delete after Tier 5 done and one week of stability |
/mnt/nas/home/ |
rmdir after all .retired/ dirs removed |
Alexandru Macocian