Host: docker1 — Wikantik Production

Role: production host for the Wikantik wiki, served publicly as wiki.wikantik.com through a Cloudflare tunnel. LAN address 192.168.0.4 (docker1.lan).

What runs here

• Wikantik container (image ghcr.io/jakefearsd/wikantik), deployed as a Docker Compose stack
• PostgreSQL — the single wikantik database (all state: pages, users, KG, embeddings via pgvector schema; role model is a single wikantik superuser keyed off POSTGRES_DB/POSTGRES_USER)
• CPU ollama embeddings sidecar — serves qwen3-embedding:0.6b (1024-dim, fixed) for dense retrieval; prod is embeddings-only, no chat inference (the GPU inference host is decommissioned)
• cloudflared — outbound tunnel to Cloudflare; no inbound ports are exposed to the internet
• jakemon Alloy agent — ships metrics/logs to docker2

How it is managed

Everything routes through bin/remote.sh in the wikantik repo (ssh-driven, with a deploy lock and ControlMaster):

• bin/remote.sh deploy [--pull TAG] — build (or pull from GHCR), transfer, up -d, health-poll, auto-rollback on failed health
• bin/remote.sh rollback — re-promote the :rollback image tag
• bin/remote.sh status | logs | shell | psql | migrate — day-2 operations
• bin/remote.sh pages-push / pages-pull — rsync page content in/out

Configuration comes from the gitignored remote.env (ssh target, paths) and .env / .env.prod (application config — in this repo .env is repurposed for prod, unlike most projects). See Wikantik Release and Deploy Process for the full release path and Wikantik Content vs Code Deployment for why page content does NOT ship with deploys.

Gotchas

• The page store and database survive deploys. Content fixes must go through the MCP authoring surface or pages-push, never through a redeploy.
• Egress matters: Google SSO fetches OIDC discovery lazily and caches it — if docker1 loses egress, SSO fails only after the next restart, which looks like a release regression (an OidcDiscoverySelfCheck guards this).
• Backups are pulled by the NAS, not pushed — see NAS and Offsite Backups; do not add push-style backup jobs here.
• Cloudflare strips ETag on private/no-cache responses at the edge, so SSR 304 behavior differs from direct-origin testing.

See Also

• Home Lab Infrastructure Hub
• Host: docker2 — Monitoring Central — where this host's metrics land
• Home Lab Network and DNS — reaching this host when VPN breaks .lan