Host: docker1 — Wikantik and Roller Production

Role: production host for the Wikantik wiki (wiki.wikantik.com) and, since 2026-10-18, for Roller (blog.wikantik.com), both served publicly through a Cloudflare tunnel. LAN address 192.168.5.51 (docker1.lan; the LAN was renumbered from 192.168.0.0/24 on 2026-10-07).

What runs here

• Wikantik container (image ghcr.io/jakefearsd/wikantik), deployed as a Docker Compose stack (docker-compose.yml + docker-compose.prod.yml; details in Wikantik on Docker)
• PostgreSQL — the single wikantik database (users, groups, policy grants, API keys, Knowledge Graph, embeddings via pgvector, page metadata; role model is a single wikantik superuser keyed off POSTGRES_DB/POSTGRES_USER). Page text and attachments are not in the database: they live in a host bind-mount (WIKANTIK_PAGES_DIR, REMOTE_PAGES_DIR in remote.env)
• CPU ollama embeddings sidecar — serves qwen3-embedding:0.6b (1024-dim, fixed) for dense retrieval. The sidecar has no chat model: KG extraction and judge calls, when enabled, go to the external inference host (inference) according to WIKANTIK_GENAI_MODE and WIKANTIK_EXTRACTOR_BACKEND
• No cloudflared here. Public traffic for wiki.wikantik.com and blog.wikantik.com arrives through the single tunnel connector on the cloudflare host, which forwards plain HTTP to :8080 (Wikantik) and :8084 (Roller). No inbound port is exposed to the internet. See Home Lab Fleet and Ingress.
• jakemon Alloy agent and container-meta sidecar. They push metrics and logs to the central stack on inference. They also scrape Wikantik's /metrics (job wikantik) and run the PostgreSQL exporter against the wikantik database. Dashboards: wikantik-overview, wikantik-host and jakemon-postgres; backup freshness is on jakemon-reliability. Key bound alert runbooks for this host and wiki.wikantik.com include IncidentPostgresDown, IncidentHostConntrackHigh, IncidentHostFilesystemReadOnly, IncidentHostSystemdUnitFailed, IncidentSearchCrawlerErrors, IncidentSeoGoogleServerErrors, IncidentSeoImpressionsDropped, and IncidentSeoUrlSweepStale.

Roller

The blog platform (RollerHub), moved here from docker2 on 2026-10-18 with its data restored from docker2's last backup.

• Location: compose project roller in ~/roller: docker-compose.prod.yml plus .env. Not in /srv, because this host has no passwordless sudo.
• Images: ghcr.io/jakefearsd/roller and roller-caddy, with PostgreSQL, Umami, Listmonk and a backup sidecar in the same project.
• Ports: Caddy publishes host 8084 (SITE_HTTP_PORT, plain HTTP, the tunnel origin) and 8443; Wikantik keeps 8080. The Umami (127.0.0.1:8081) and Listmonk (127.0.0.1:18082) consoles are loopback-only: ssh -L 8081:127.0.0.1:8081 -L 18082:127.0.0.1:18082 docker1.lan.
• Forwarded headers: TRUSTED_PROXIES=192.168.5.50, so Caddy keeps the tunnel's X-Forwarded-For and X-Forwarded-Proto and drops anyone else's.
• Upgrades: bin/deploy-host.sh docker1 from the Roller repository. It backs up first, keeps the replaced .env and deploy files as *.bak-<UTC stamp> in ~/roller, runs deploy.sh and checks that the app runs the new image.
• Guides: RollerOnDocker for operation, RollerAdminAccountRunbook for admin accounts, RollerMcp for agents.

How it is managed

Wikantik routes through bin/remote.sh in the wikantik repo (Roller is upgraded with its own bin/deploy-host.sh, above) (ssh-driven, with a deploy lock and ControlMaster):

• bin/remote.sh deploy [--pull TAG] — build (or have the host pull ghcr.io/jakefearsd/wikantik:TAG from GHCR; the tag is X.Y.Z, with no v prefix), transfer, up -d, health-poll, auto-rollback on failed health
• bin/remote.sh rollback [--to X.Y.Z] — re-promote the :rollback image tag, or a specific retained version tag (the newest five are kept)
• bin/remote.sh status | logs | shell | psql | migrate — day-2 operations
• bin/remote.sh pages-push / pages-pull — rsync page content in/out
• bin/remote.sh backup-trigger [TIER] | backup-pull [DATE] | restore REMOTE_PATH — drive the backup sidecar

Configuration comes from the gitignored remote.env (ssh target, paths) and the gitignored .env.prod (application config). On every deploy remote.sh ships .env.prod to the host as .env, preferring it over a local .env; if .env.prod is missing it ships the local dev .env instead, so keep .env.prod current. See Wikantik Release and Deploy Process for the full release path and Wikantik Content vs Code Deployment for why page content does NOT ship with deploys.

Gotchas

• The page store and database survive deploys. Content fixes must go through the MCP authoring surface or pages-push, never through a redeploy.
• pages-pull is not a complete snapshot. It can fail with permission errors on container-owned page files and return a partial corpus; derive corpus-wide plans from the live index, not from a pull.
• Egress matters: Google SSO fetches OIDC discovery lazily and caches it — if docker1 loses egress, SSO fails only after the next restart, which looks like a release regression (an OidcDiscoverySelfCheck guards this).
• Backups are pulled by the NAS, not pushed — see NAS and Offsite Backups; do not add push-style backup jobs here.
• Cloudflare strips ETag on private/no-cache responses at the edge, so SSR 304 behavior differs from direct-origin testing.

See Also

• Home Lab Infrastructure Hub
• Host: inference: where this host's metrics and logs land
• JakemonHub: how to query them
• Home Lab Network and DNS — reaching this host when VPN breaks .lan