49 lines
3.3 KiB
Markdown
49 lines
3.3 KiB
Markdown
---
|
|
title: Domains and Tunnels
|
|
type: infrastructure
|
|
status: active
|
|
created: 2026-07-22
|
|
updated: 2026-07-22
|
|
verified_on: 2026-07-22
|
|
confidence: high
|
|
tags: [infrastructure, network, cloudflare]
|
|
sources: [raw/configs/hermes-config-sanitized.txt]
|
|
---
|
|
|
|
# Domains and Tunnels
|
|
|
|
## Purpose
|
|
Where `martinwa.org` subdomains point, and how they reach internal services.
|
|
|
|
## How it works
|
|
- **Verified:** All `*.martinwa.org` public hostnames are served by a single `cloudflared` daemon running on **ct207 (webserver)**, tunnel name `ct207-tunnel` (ID `339a6757-5574-4723-a16c-da4769535caa`), config at `/etc/cloudflared/config.yml` on ct207.
|
|
- **Verified:** `cloudflared` is not installed on this host (ct460/hermes) — Hermes has no local tunnel process to manage or restart. Any tunnel-side incident (hostname down, wrong target) must be fixed on ct207, not here.
|
|
- Two other Cloudflare tunnels exist in the same account (`Cloudo`, `Ifttt-ssh-webhook`, `livinity-liv`) but are unrelated to Hermes/ct207 and out of scope for this page.
|
|
|
|
## Hostnames relevant to Hermes
|
|
| Hostname | Target | Notes |
|
|
|---|---|---|
|
|
| `hermes.martinwa.org` | `http://100.118.5.51:19119` | Public Hermes dashboard — nginx on ct460 proxies 19119→127.0.0.1:9119 |
|
|
| `hermes-desktop.martinwa.org` | `http://100.118.5.51:5174` | Hermes desktop companion; sets `Host: hermes.kangaroo-eel.ts.net` |
|
|
| `hermesagent.martinwa.org` | `http://100.98.205.112:9119` | The **older/original** Hermes agent (ct450 "hermesagent"), kept alive alongside the current ct460 instance |
|
|
| `ssh-hermes.martinwa.org` | `ssh://100.118.5.51:22` | SSH to this host over the tunnel |
|
|
| `mcp-portal.martinwa.org` | (not in ct207 ingress list; see note below) | Referenced in Hermes config as an MCP server URL (`https://mcp-portal.martinwa.org/mcp`) |
|
|
| `omniroute.martinwa.org` | `http://omniroute.kangaroo-eel.ts.net:20128` | Public front for [[systems/omniroute]] |
|
|
| `nanobot.martinwa.org` / `nano-ssh.martinwa.org` | `100.122.189.81` (ct333 "clawtest") | See [[comparisons/hermes-vs-nanobot]] |
|
|
|
|
`mcp-portal.martinwa.org` is not present in the ct207 ingress list captured during this audit — it may be served by a different tunnel/host, or the ingress list may have moved since. **Unknown**, flagged for follow-up rather than guessed.
|
|
|
|
## Full ct207 ingress list (context, not all Hermes-related)
|
|
The tunnel also fronts: `pve.martinwa.org` (Proxmox UI), `docker.martinwa.org` (Portainer), `runtipi.martinwa.org`, `homar.martinwa.org`, `nextcloud.martinwa.org`, `readlater.martinwa.org`, `velvet.martinwa.org`, `overtchat.martinwa.org`, `freellmapi.martinwa.org`, `omnideb.martinwa.org`, `newstarter.martinwa.org`, and SSH endpoints for debianvm/pve/webserver. These belong to the wider homelab, not Hermes specifically — recorded here only so an ingress diff is possible later.
|
|
|
|
## History
|
|
- ct207's `/etc/cloudflared/` directory has ~25 dated `config.yml.bak*` files going back to 2026-06-18, including several during ct460's own setup (`config.yml.before-hermes-ct460-20260717203530`, `...before-hermes-desktop-20260718`, `...before-hermesagent-20260718085557`) — evidence the ingress list has been actively iterated on throughout Hermes's bring-up.
|
|
|
|
## Relevant runbooks
|
|
- [[runbooks/diagnose-docker]]
|
|
|
|
## Related
|
|
- [[systems/cloudflare-tunnel]]
|
|
- [[infrastructure/network-map]]
|
|
- [[infrastructure/hosts]]
|