Every public service on this host is routed through Caddy on
:443 with automatic
Let’s Encrypt certificates via sslip.io, so each one answers on its own HTTPS name.
AI & agents
Hermes Agent
Dashboard, web UI and backend. Mobile clients must use this HTTPS name — Android
refuses cleartext HTTP to a public IP. Backend also listens on :9119;
API server on :9120.
LiteLLM Proxy
Multi-provider LLM proxy on :4000. Every request needs a key; UI at
/ui, health at /health.
OpenCode
OpenCode server on :49374. Returns 401 without a token; Caddy adds basic
auth on top.
Search & data
SearXNG
Self-hosted meta search engine (Docker, :8088). No bot detection, no
CAPTCHA — this is what the agent’s web searches go through.
copyparty
File sharing hub on :3923, argon2-hashed accounts. Anonymous visitors can
browse /user_uploads/; the whole home folder needs a login.
Other
Pull-day Picker
Exercise picker. Caddy serves this one directly from disk; other paths on that hostname are refused.
Hermes Relay
WebSocket server on :8767 for the Android app’s terminal and bridge
channels. Plain HTTP requests return 400 by design — a browser tab will not connect.
The empty Coolify-managed PostgreSQL instance that published 5432 to the
internet has been removed, along with its nginx access proxy. Both halves are gone, so
the port no longer answers from outside.
Some listeners have no sensible web face: Hermes Gateway (messaging integration, no HTTP)
and the pull-picker static server on 127.0.0.1:8099, since Caddy serves its
files directly instead. Waydroid, LXC and the GPU plumbing are infrastructure, not
services.
One Caddy instance on :80/:443 terminates TLS for every
hostname above. Because admin off is set in the Caddyfile, edits are applied
with systemctl restart pull-picker-proxy.service — a
reload will not take effect.