Services¶
Every service in the stack: what it is, whether it is a Swarm container or a Proxmox VM, which node it runs on, and how it authenticates. Each row links to the service's full page (configuration, volumes, secrets, gotchas).
Runtime legend: C = Docker Swarm container, VM = Proxmox virtual machine, Physical = bare-metal host.
Authentication mode¶
- Native — the service has its own OIDC or SAML client wired to Authentik; Authentik only gates the login, the service handles its own routing.
- Forward-auth — the service has no OIDC/SAML support, so the whole
route sits behind Authentik's Traefik forward-auth middleware
(
authentik@swarm). - Own login — deliberately not gated by Authentik at all, because a forward-auth blanket would break native clients (Emby, Navidrome), block public visitors (Lychee's shared galleries), or block public tracking endpoints (Matomo, partially).
- N/A — the service is not itself behind a login gate (Traefik, Authentik).
Core¶
Required by the stack: ingress, identity, secrets, source control. Runs on
swarm-core.
| Service | Runtime | Auth | Description |
|---|---|---|---|
| Traefik | C | N/A | Ingress and reverse proxy; the only service exposing public ports 80/443 |
| Authentik | C | N/A | SSO and identity provider for the rest of the stack |
| VaultWarden | C | Native (OIDC) | Password and secret store |
| Gitea | C | Native (OIDC) | Source control |
| Zigbee2MQTT | C | Forward-auth | Zigbee bridge, publishes to the Home Assistant MQTT broker |
Apps¶
Primary workloads ("Important" tier). Also run on swarm-core.
| Service | Runtime | Auth | Description |
|---|---|---|---|
| Beszel | C | Forward-auth | Lightweight system monitoring |
| Duplicati | C | Forward-auth | Offsite encrypted backup of NFS data and database dumps |
| Firefly-III | C | Forward-auth | Personal finance |
| Immich | C | Native (OIDC) | Photo management |
| Kimai | C | Native (SAML) | Time tracking |
| Matomo | C | Native (OIDC, admin only) | Web analytics; tracking endpoints stay public |
| Mealie | C | Native (OIDC) | Recipe manager |
| NetBox | C | Native (OIDC) | Network source of truth (IPAM/DCIM) |
| Paperless-ngx | C | Native (OIDC) | Document management |
Appliances¶
Run as their own Proxmox VMs rather than Swarm containers.
| Service | Runtime | Auth | Description |
|---|---|---|---|
| Home Assistant | VM | Own login | Home automation (HAOS, for the add-on ecosystem) |
| Pi-hole | VM | Own login | Network DNS, kept independent of the Swarm |
| Nextcloud | VM | Own login | Files and collaboration (All-in-One appliance) |
| UniFi OS Server | VM | Own login | Ubiquiti network controller |
Media¶
Runs on swarm-media (physical host, holds the NVIDIA GPU).
| Service | Runtime | Auth | Description |
|---|---|---|---|
| Sonarr, Radarr, Lidarr, Prowlarr, Transmission | C | Forward-auth | TV/movie/music automation, indexer management, download client — one combined stack |
| Emby | C | Own login | Media server; GPU transcode once a GPU is fitted, CPU for now |
| Navidrome | C | Own login | Music streaming |
Experimental¶
Optional; can be dropped without affecting the rest of the stack. Also runs
on swarm-media.
| Service | Runtime | Auth | Description |
|---|---|---|---|
| Fleet | C | Native (SAML) | Device management |
| Linkding | C | Native (OIDC) | Bookmarks |
| Lychee | C | Own login | Photo albums with public shared galleries |
| Nagios | C | Forward-auth | Monitoring (overlaps Beszel) |
| Ontime | C | Forward-auth | Event rundown timer |
| OpenProject | C | Native (OIDC) | Project management |
| Snipe-IT | C | Native (SAML) | Asset management |
| What's Up Docker | C | Forward-auth | Container image update notifier |
Infrastructure nodes¶
Not application services, but part of the stack. See Resources for sizing and Network for addressing.
| Node | Runtime | Role |
|---|---|---|
| pve | Physical | Proxmox hypervisor host |
| swarm-core | VM (on pve) | Docker Swarm manager, tier=core |
| swarm-media | Physical | Docker Swarm worker, tier=media; holds the NVIDIA GPU |