Malin
09a96c74dc
root@ works fine (standard key, same as every other host) — the SSH-blocked claim was from a session that only tested malin@pinky. Adds real survey detail: SDK path, no-JDK-on-host build pattern, the shared Android emulator container.
5.2 KiB
5.2 KiB
name, description
| name | description |
|---|---|
| server-fleet-map | Use when deciding WHICH host a piece of work belongs on, or when you need a host's connection details. Reference map of the FreeBSD/bastille jail fleet and what each host is actually for. |
Server Fleet Map
All hosts reachable over Tailscale (root@<host>, SSH key
/root/.ssh/id_ed25519 unless noted). Each host has a distinct
purpose — check this before assuming a new site/service belongs on
whichever host you happen to already be connected to.
| Host | Tailscale IP | Purpose | Notes |
|---|---|---|---|
| staging | 100.104.61.54 |
Dev/staging — pre-production testing, throwaway experiments | New jail IPs here need the same arp-scan discipline as everywhere else on this shared LAN (see bastille-jail-provisioning skill) — this is where that gotcha was first found. |
| venus | 100.109.251.127 (LAN 192.168.0.33) |
Corporate — internal business sites/tools, the iWP.es plugin-subscription platform, and other CloudHost-org first-party projects | Bastille jails, combined web+db (local MariaDB, no shared external DB host). New jails typically created via bastille clone -a <known-good-base> rather than from scratch. |
| granja | 100.98.197.28 |
Affiliate network — the travel/tourism site network (menorca.ro, palma.ro, and similar) | No public interface configured directly; sits behind a reverse-proxy manager (NPM) over Tailscale. See docs/server-granja.md for the local-curl-simulates-NPM testing trick. |
| funky | 100.127.21.100 (LAN 192.168.0.218) |
Customers — sites migrated from the old Linux affiliate fleet, actual paying-customer properties (e.g. news.easycut.es, photomouse.ro) | Combined web+db+valkey, bastille jails. Migration target that absorbed several now-decommissioned Linux hosts (maagar, shoe, proton). |
| gringo | 100.95.46.79 (LAN 192.168.168.68) |
Internal apps/tools host — replacement for the old Linux Docker host barky-1 | ~45 Bastille VNET jails on 10.20.0.0/24 (APIs, dashboards, Gitea, analytics, productivity tools). Default-deny outbound pf model; NPM dedicated ports 8000 + last octet. See docs/server-gringo.md. |
| zamolxis | 100.115.128.41 |
Standalone (non-jailed) FreeBSD site host | Not part of the granja/external-fleet jail families — a single site (Newspaper/tagDiv theme, PHP 8.5) running directly on the host, not in a jail. |
| cabrera | 100.100.108.19, SSH port 79 |
External Linux affiliate-network host (BTPanel-style) | Part of the older Linux fleet (alongside raptor/maagar/formentor/moonie/spunky/proton/shoe — several since decommissioned/migrated to funky). Hosts easycut.es's main WooCommerce e-commerce site directly (not jailed). |
| pinky | 100.78.228.127 (pinky.taild32c88.ts.net) |
Linux/Docker-only workloads — genuine Docker containers, or a Linux-only build toolchain (the Android SDK + emulator for Capacitor APK builds, e.g. Bauxa) | Not part of the FreeBSD/Bastille fleet above, but same access pattern — root@, standard key, no gotcha. (A 2026-08-13 session wrongly logged this host as SSH-blocked after only testing malin@; root@ works fine, same as every other host here.) Gentoo Linux, 8vCPU/15GB RAM. Android SDK lives at /opt/build-tools/android-sdk on the host; host has no JDK, so APK compiles run inside a throwaway Docker container with the SDK + /root/.gradle bind-mounted in — no committed script for this yet, worth writing one before the next build. A long-lived pesiq-android-emulator container (budtmo/docker-android, Android 14) is available for install/functional testing via ADB (:5556) or noVNC (:6081) — usable for any project's APK, not just PesIQ. Don't default work here just because it's Linux-flavored — see "How to decide" below; this host is for genuinely Docker/Linux-specific needs only. Full detail: docs/server-pinky.md in granja. |
How to decide where new work belongs
- What kind of thing is it? A corporate/internal tool → venus. A customer's production site → funky. A new affiliate-network travel site → granja. A quick experiment or something not ready for anything resembling production → staging. Default to FreeBSD (gringo) even for Linux-shaped work — only use pinky if it genuinely needs Docker or a Linux-only toolchain (e.g. the Android SDK/emulator); "it's Linux/Docker-based elsewhere in this project" is not by itself a reason to put a stateless piece on pinky.
- Does it already have an established host from a related sibling project? (e.g. another CloudHost-org first-party tool already lives on venus) — match that, don't scatter related things across hosts without a reason.
- When genuinely unsure, ask rather than guessing — which host something lives on affects DNS, backup scope, and who has access to it later.
Gitea (separate from any of the above)
https://devops.cloudhost.es — not one of the site-hosting fleet, this
is the internal git/CI host. Orgs seen so far: CloudHost (main
internal projects + this skills repo), iWP.es (the plugin-subscription
product and its forked/rebranded plugins), InformatiQ (the security
plugin), External (mirrors of third-party repos for internal
reference).