# Topology data for the generated inventory in documents/TOPOLOGY.md.
# Run from docker/ repo root: python3 scripts/build-topology.py --in-place
# to regenerate the prose around the Archify diagram (requires PyYAML).
#
# When adding a new stack: add it to the appropriate app_categories[].stacks list
# (or to infra if it is infrastructure/monitoring). Keep stack names in
# alphabetical order within each category. Update the category description
# if the new stack changes what the category represents.

ingress:
  - id: tunnel
    label: "cloudflare-tunnel<br>(optional)"
  - id: caddy
    label: "caddy<br>Reverse proxy<br>:80 / :443"

vpn:
  - id: headscale
    label: "headscale<br>Mesh VPN (Tailscale)"
  - id: wireguard
    label: "wireguard<br>Remote access VPN"
  - id: gluetun
    label: "gluetun<br>Container egress VPN"
  - id: netbird
    label: "netbird<br>WireGuard mesh VPN"

# Application categories. Order here defines order in the diagram (alphabetical by id).
app_categories:
  - id: apps_acquisition
    name: "Media acquisition & *arr"
    descriptor: "torrents, *arr, Usenet"
    stacks:
      - bazarr
      - explo
      - flaresolverr
      - librarr
      - lidarr
      - metube
      - mylar3
      - nzbget
      - nzbhydra2
      - qbittorrent
      - prowlarr
      - radarr
      - readarr
      - rtorrent-flood
      - seerr
      - sonarr
      - soulseek
      - whisparr
    description: "download clients and *arr automation (torrents, Usenet, Sonarr/Radarr/Lidarr/Readarr, Bazarr, Explo, Librarr, MeTube, Mylar3, Soulseek)"

  - id: apps_ai
    name: "AI & LLM"
    descriptor: "local models, chat UIs"
    stacks:
      - anything-llm
      - kokoro-tts
      - litellm
      - openai-oauth
      - ollama
      - open-webui
      - librechat
      - open-notebook
      - paperclip
      - vane
      - whisper-asr
    description: "local models and chat UIs (Ollama, Open WebUI, LibreChat, Open Notebook, Paperclip, Vane, Anything LLM, LiteLLM, Kokoro TTS, Whisper ASR)"

  - id: apps_dev
    name: "Developer & IT utilities"
    descriptor: "it-tools, ConvertX, CUPS, Dozzle, Gitea, Kasm, CI, dashboard, PDF, NetBox, PostHog, Snipe-IT"
    stacks:
      - baserow
      - beszel
      - code-server
      - convertx
      - cups
      - dozzle
      - gitea
      - harbor
      - homarr
      - it-tools
      - kasm
      - mattermost
      - netbox
      - nodepad
      - gotify
      - changedetection
      - posthog
      - snipe-it
      - stirling-pdf
      - terminus
      - termix
      - komodo
      - woodpecker-ci
    description: "it-tools, ConvertX, CUPS print server, Dozzle, Gitea, Harbor, Woodpecker CI, Homarr dashboard, Baserow, Stirling-PDF, Gotify, Changedetection.io, NetBox, PostHog, Snipe-IT, code-server, Beszel, Mattermost, Terminus, NodePad, Asking-NG"

  - id: apps_gaming
    name: "Gaming"
    descriptor: "ROMs, Steam, in-browser emulation"
    stacks:
      - archisteamfarm
      - romm
      - twitch-drops-miner
    description: "Steam automation (ArchiSteamFarm), ROM manager and in-browser emulation (RomM), Twitch drops mining"

  - id: apps_home
    name: "Home automation & IoT"
    descriptor: "Home Assistant, MQTT, Zigbee"
    stacks:
      - home-assistant
      - music-assistant
      - mosquitto
      - zigbee2mqtt
    description: "Home Assistant, Mosquitto (MQTT), Zigbee2MQTT"

  - id: apps_links
    name: "Links, shorteners & presence"
    descriptor: "YOURLS, Shlink, Linkstack, Stoat, homepage"
    stacks:
      - glance
      - homepage
      - linkstack
      - shlink
      - stoat
      - yourls
    description: "YOURLS, Shlink, Linkstack, Stoat, Glance, static homepage/landing"

  - id: apps_media
    name: "Media & personal data"
    descriptor: "photos, docs, music, RSS, notes"
    stacks:
      - affine
      - appflowy
      - actual-budget
      - dawarich
      - homebox
      - lubelogger
      - wallos
      - archivebox
      - audiobookshelf
      - tubearchivist
      - zimi
      - bookstack
      - calibre-web
      - cryptpad
      - docuseal
      - emby
      - firefly-iii
      - freshrss
      - hedgedoc
      - immich
      - jellyfin
      - jellystat
      - joplin-server
      - logseq-sync
      - kavita
      - komga
      - lanraragi
      - linkding
      - linkwarden
      - mealie
      - navidrome
      - nextcloud
      - oasis
      - outline
      - paperless-ai-next
      - paperless-gpt
      - paperless-ngx
      - picard
      - plex
      - seafile
      - slink
      - super-productivity
      - syncthing
      - trilium
      - vikunja
    description: "consumption and personal content (photos, docs, music, tagging/organization, recipes, bookmarks, RSS, comics, eBooks, tasks, wiki, notes, budgeting, Affine, Appflowy, CryptPad, Trilium, Oasis, Paperless AI)"

  - id: apps_osint
    name: "OSINT & recon"
    descriptor: "homelab-user/email/phone recon"
    stacks:
      - social-hunt
      - maigret
      - spiderfoot
      - phoneinfoga
      - theharvester
      - holehe
      - blackbird
      - ghunt
      - metagoofil
      - reconftw
      - sublist3r
      - ail
      - web-check
    description: "homelab-user/email/phone recon, breach lookups, subdomain enumeration, AIL"

  - id: apps_privacy
    name: "Privacy & opt-out"
    descriptor: "data broker deletion"
    stacks:
      - naisho
      - privotron
    description: "data broker deletion (Naisho, Privotron)"

  - id: apps_search
    name: "Search"
    descriptor: "SearXNG metasearch, Meilisearch"
    stacks:
      - meilisearch
      - searx-ng
    description: "SearXNG, Meilisearch"

  - id: apps_sec_tooling
    name: "Security & compliance tooling"
    descriptor: "SBOM, threat model, scanner, forensics"
    stacks:
      - acquire
      - dependency-track
      - docker-forensics-toolkit
      - plaso
      - threat-dragon
      - zap
      - zed-attack-proxy
    description: "SBOM/vuln tracking (Dependency-Track), threat modeling (Threat Dragon), web scanner (ZAP/ZAP GUI), digital forensics (Acquire, Plaso, Docker Forensics Toolkit)"

  - id: apps_security
    name: "Security & identity"
    descriptor: "passwords, secrets, aliases, IdP"
    stacks:
      - authentik
      - enclosed
      - guacamole
      - infisical
      - keycloak
      - password-pusher
      - privatebin
      - rustdesk
      - simplelogin
      - vaultwarden
    description: "passwords, secrets, aliases, remote desktop, secure sharing, IdP (Keycloak, authentik, Enclosed, RustDesk)"

  - id: apps_tor
    name: "Tor / dark web"
    descriptor: "OnionScan, OnionProbe, TorBot"
    stacks:
      - onionprobe
      - onionscan
      - torbot
    description: "OnionScan, OnionProbe, TorBot"

  - id: apps_workflow
    name: "Workflow automation"
    descriptor: "n8n, Node-RED"
    stacks:
      - calcom
      - n8n
      - node-red
    description: "n8n, Node-RED, Cal.com"

# Infrastructure & monitoring. Order is alphabetical by id.
infra:
  - id: adguard-home
    label: "adguard-home<br>DNS / ad blocking"
  - id: alertmanager
    label: "alertmanager<br>Alert routing"
  - id: blackbox-exporter
    label: "blackbox-exporter<br>Probes"
  - id: cadvisor
    label: "cAdvisor<br>Container metrics"
  - id: crowdsec
    label: "crowdsec<br>Security engine"
  - id: ddns-updater
    label: "ddns-updater<br>Dynamic DNS"
  - id: diun
    label: "diun<br>Image update notifier"
  - id: dockergc
    label: "docker-gc<br>Docker GC job"
  - id: grafana
    label: "grafana<br>Dashboards"
  - id: kuma
    label: "uptime-kuma<br>Monitoring"
  - id: loki
    label: "loki<br>Log aggregation"
  - id: mailpit
    label: "mailpit<br>SMTP catcher"
  - id: minio
    label: "minio<br>S3 object storage"
  - id: node-exporter
    label: "node-exporter<br>Host metrics"
  - id: nut-server
    label: "nut-server<br>UPS monitor"
  - id: ntopng
    label: "ntopng<br>Traffic analytics"
  - id: pihole
    label: "pihole<br>DNS sinkhole"
  - id: portainer
    label: "portainer<br>Docker UI"
  - id: postfix
    label: "postfix<br>SMTP relay"
  - id: prometheus
    label: "prometheus<br>Metrics"
  - id: backrest
    label: "Backrest<br>Backup browser"
  - id: restic
    label: "restic<br>Backups (cron)"
  - id: scrutiny
    label: "scrutiny<br>SMART disk health"
  - id: snowflake-relay
    label: "snowflake-relay<br>Tor bridge relay"
  - id: umami
    label: "umami<br>Web analytics"
  - id: unbound
    label: "unbound<br>DNS resolver"
  - id: vector
    label: "vector<br>Log shipper"
  - id: watchtower
    label: "watchtower<br>Auto-updates"

# App category IDs that use Gluetun for egress (dashed edge to gluetun).
gluetun_egress:
  - apps_acquisition

# App category IDs that use Postfix for SMTP (dashed edge to postfix).
smtp_clients:
  - apps_privacy
  - apps_workflow

# Relations: from → to (label) for diagram and short description for prose.
relations:
  - from: users
    to: tunnel
    description: "Clients use optional Cloudflare Tunnel to reach Caddy."
  - from: users
    to: caddy
    description: "Clients reach Caddy directly (local DNS or tunnel)."
  - from: tunnel
    to: caddy
    description: "Tunnel forwards to Caddy by hostname."
  - from: users
    to: wireguard
    description: "Clients connect via WireGuard for remote access."
  - from: users
    to: headscale
    description: "Clients join mesh via Headscale (Tailscale)."
  - from: caddy
    to: apps
    description: "Caddy routes HTTP(S) to all application stacks by hostname."
  - from: caddy
    to: infra
    description: "Caddy is managed and monitored by infra services."
  - from: wireguard
    to: caddy
    label: VPN
    description: "VPN clients reach Caddy and apps."
  - from: headscale
    to: caddy
    label: mesh
    description: "Mesh clients reach Caddy and apps."
  - from: apps_acquisition
    to: gluetun
    label: VPN egress
    description: "Media acquisition stacks send traffic through Gluetun (VPN)."
  - from: gluetun
    to: outbound
    label: egress
    description: "Gluetun egresses via VPN provider to internet."
  - from: apps_privacy
    to: postfix
    label: mail
    description: "Privacy/opt-out apps send mail via Postfix."
  - from: apps_workflow
    to: postfix
    label: mail
    description: "Workflow apps (e.g. n8n) send mail via Postfix."
  - from: postfix
    to: mailpit
    label: relay (internal-only)
    description: "When RELAYHOST=mailpit:1025, Postfix relays to Mailpit; no external delivery."
  - from: caddy
    to: crowdsec
    label: logs
    description: "Caddy logs feed CrowdSec security engine."
  - from: kuma
    to: caddy
    label: health
    description: "Uptime Kuma monitors Caddy and app health."
  - from: prometheus
    to: cadvisor
    label: scrapes
    description: "Prometheus scrapes cAdvisor for container metrics."
  - from: grafana
    to: prometheus
    label: queries
    description: "Grafana queries Prometheus for dashboards."
  - from: watchtower
    to: apps
    label: updates
    description: "Watchtower updates container images for app stacks."
  - from: dockergc
    to: apps
    label: cleanup
    description: "Docker GC cleans stopped containers and unused images."
  - from: diun
    to: users
    label: notify
    description: "Diun notifies users of new image tags."
  - from: portainer
    to: apps
    label: manage
    description: "Portainer manages Docker stacks and containers."