--- name: server-fleet-map description: Use when deciding WHICH host a piece of work belongs on, or when you need a host's connection details. Reference map of the FreeBSD/bastille jail fleet and what each host is actually for. --- # Server Fleet Map All hosts reachable over Tailscale (`root@`, SSH key `/root/.ssh/id_ed25519` unless noted). Each host has a distinct **purpose** — check this before assuming a new site/service belongs on whichever host you happen to already be connected to. | Host | Tailscale IP | Purpose | Notes | |---|---|---|---| | **staging** | `100.104.61.54` | Dev/staging — pre-production testing, throwaway experiments | New jail IPs here need the same arp-scan discipline as everywhere else on this shared LAN (see `bastille-jail-provisioning` skill) — this is where that gotcha was first found. | | **venus** | `100.109.251.127` (LAN `192.168.0.33`) | Corporate — internal business sites/tools, the iWP.es plugin-subscription platform, and other CloudHost-org first-party projects | Bastille jails, combined web+db (local MariaDB, no shared external DB host). New jails typically created via `bastille clone -a ` rather than from scratch. | | **granja** | `100.98.197.28` | Affiliate network — the travel/tourism site network (menorca.ro, palma.ro, and similar) | No public interface configured directly; sits behind a reverse-proxy manager (NPM) over Tailscale. See `docs/server-granja.md` for the local-curl-simulates-NPM testing trick. | | **funky** | `100.127.21.100` (LAN `192.168.0.218`) | Customers — sites migrated from the old Linux affiliate fleet, actual paying-customer properties (e.g. news.easycut.es, photomouse.ro) | Combined web+db+valkey, bastille jails. Migration target that absorbed several now-decommissioned Linux hosts (maagar, shoe, proton). | | **gringo** | `100.95.46.79` (LAN `192.168.168.68`) | Internal apps/tools host — replacement for the old Linux Docker host barky-1 | ~45 Bastille VNET jails on `10.20.0.0/24` (APIs, dashboards, Gitea, analytics, productivity tools). Default-deny outbound pf model; NPM dedicated ports `8000 + last octet`. See `docs/server-gringo.md`. | | **zamolxis** | `100.115.128.41` | Standalone (non-jailed) FreeBSD site host | Not part of the granja/external-fleet jail families — a single site (Newspaper/tagDiv theme, PHP 8.5) running directly on the host, not in a jail. | | **cabrera** | `100.100.108.19`, SSH port `79` | External Linux affiliate-network host (BTPanel-style) | Part of the older Linux fleet (alongside raptor/maagar/formentor/moonie/spunky/proton/shoe — several since decommissioned/migrated to funky). Hosts easycut.es's main WooCommerce e-commerce site directly (not jailed). | | **pinky** | `100.78.228.127` (`pinky.taild32c88.ts.net`) | Linux/Docker-only workloads — genuine Docker containers, or a Linux-only build toolchain (the **Android SDK + emulator** for Capacitor APK builds, e.g. Bauxa) | Not part of the FreeBSD/Bastille fleet above, but **same access pattern** — `root@`, standard key, no gotcha. (A 2026-08-13 session wrongly logged this host as SSH-blocked after only testing `malin@`; `root@` works fine, same as every other host here.) Gentoo Linux, 8vCPU/15GB RAM. Android SDK lives at `/opt/build-tools/android-sdk` on the host; host has **no JDK**, so APK compiles run inside a throwaway Docker container with the SDK + `/root/.gradle` bind-mounted in — no committed script for this yet, worth writing one before the next build. A long-lived `pesiq-android-emulator` container (`budtmo/docker-android`, Android 14) is available for install/functional testing via ADB (`:5556`) or noVNC (`:6081`) — usable for any project's APK, not just PesIQ. Also runs ArchiveBox + trawl (self-hosted anti-bot scraping engine) for web archiving — see `docs/server-pinky.md`. Don't default work here just because it's Linux-flavored — see "How to decide" below; this host is for genuinely Docker/Linux-specific needs only. Full detail: `docs/server-pinky.md` in granja. | | **phreak** | `100.76.207.107` | Second Bastille app host — SaaS products deliberately given their own dedicated host instead of joining gringo's shared jail fleet (Bauxa, Fleet Admin, Tracelead) | FreeBSD 15.1, only 3 jails as of 2026-08-17 (`bauxa`, `fleet-admin`, `tracelead`). **Connect by Tailscale IP, not the `phreak` hostname** — bare-hostname SSH fails host-key verification. **No pf default-deny-outbound configured** — unlike gringo, a real gap not a documented exception. Bauxa and Fleet Admin also still run in parallel on gringo (duplicate deployments, not yet reconciled — check both before assuming either is authoritative). Full detail: `docs/server-phreak.md` in granja. | ## How to decide where new work belongs 1. **What kind of thing is it?** A corporate/internal tool → venus. A customer's production site → funky. A new affiliate-network travel site → granja. A quick experiment or something not ready for anything resembling production → staging. **Default to FreeBSD (gringo) even for Linux-shaped work** — only use pinky if it genuinely needs Docker or a Linux-only toolchain (e.g. the Android SDK/emulator); "it's Linux/Docker-based elsewhere in this project" is not by itself a reason to put a stateless piece on pinky. 2. **Does it already have an established host from a related sibling project?** (e.g. another CloudHost-org first-party tool already lives on venus) — match that, don't scatter related things across hosts without a reason. 3. **When genuinely unsure, ask** rather than guessing — which host something lives on affects DNS, backup scope, and who has access to it later. ## Gitea (separate from any of the above) `https://devops.cloudhost.es` — not one of the site-hosting fleet, this is the internal git/CI host. Orgs seen so far: `CloudHost` (main internal projects + this skills repo), `iWP.es` (the plugin-subscription product and its forked/rebranded plugins), `InformatiQ` (the security plugin), `External` (mirrors of third-party repos for internal reference).