dbb-server runs Coolify project Platform and the client projects beside it. This page is the list. Names, domains, and backup schedules come from the Coolify database. Exposure and repo paths come from the repo.
Auth, docs, the LLM gateway, storage, and the shared data services.
AstraZeneca CLL, DotAI, Go Straight, My Emissions, Renewables UnWind, and Seraphiim.
Coolify, Traefik, Tailscale, the firewall, the worker, Rex, and grokbot.
How a hostname reaches a container, or stops at the gate.
server.daz.dev hostname on port 80 or 443. UFW allows those two ports on the public interface. Traefik, the coolify-proxy container, terminates TLS.coolify.server.daz.dev matches /data/coolify/proxy/dynamic/dbb-coolify-lockdown.yaml. The UI is Tailscale-only. /webhooks stays public.docs, guests, llm, minio, pgadmin, s3, uptime, and transcribe match dbb-tailscale-only-apps.yaml. A source outside the tailnet, loopback, and 10.0.0.0/8 receives 403. guests then asks Authelia who is signed in.dbb-auth@file from dbb-preview-auth.yaml. An unsigned visitor is sent to auth.server.daz.dev.coolify network.Project Platform, environment production. Shared services use dbb-<app>[-<role>], with no environment suffix. The rule is in Conventions.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
dbb-auth |
Sign-in portal for dev, staging, and preview hosts. | Application. Authelia 4.39.28. | auth.server.daz.dev | Public | None | platform/auth.md |
dbb-guests |
Add, revoke, and extend dbb-auth guests. | Application. Node. | guests.server.daz.dev | Tailscale-only, then Darren’s sign-in | Users-file copies in /home/daz/_backups-auth/dbb-guests |
Guests |
dbb-docs |
The documentation site. | Application. Astro Starlight. | docs.server.daz.dev | Tailscale-only | None | apps/dbb-docs |
dbb-litellm |
OpenAI-compatible LLM gateway. Provider keys stay on the proxy. | Compose. LiteLLM 1.108.4. | llm.server.daz.dev | Tailscale-only | None on the proxy | LLM gateway |
dbb-litellm-db |
Postgres for gateway spend logs and virtual keys. | Database. Postgres 17.8. | None | Internal only | Nightly, local | LLM gateway |
dbb-minio |
S3-compatible object storage. | Service. pgsty/silo RELEASE.2026-10-26T00-00-00Z. |
minio.server.daz.dev, s3.server.daz.dev | Tailscale-only | None | platform/data.md |
dbb-pgadmin |
UI for the Coolify Postgres servers. | Service. pgAdmin 9.19.0. | pgadmin.server.daz.dev | Tailscale-only | None | platform/compose/dbb-pgadmin.yml |
dbb-postgres-previews |
Empty database per pull request. The container hostname is dbb-postgres-preview. |
Service. Postgres 17.8. | None | Internal only | None | platform/data.md |
dbb-redis |
Shared cache and queues. | Service. Redis 8.2.8. | None | Internal only | None | platform/compose/dbb-redis.yml |
dbb-transcribe-webapp |
Turns a URL or an upload into a transcript. | Application. Astro. | transcribe.server.daz.dev | Tailscale-only | None on the app | dbb-transcribe |
dbb-transcribe-db |
Postgres for transcript jobs. | Database. Postgres 17.8. | None | Internal only | Nightly, local | dbb-transcribe |
dbb-uptime |
Checks public sites and posts to Slack. | Compose. Gatus 5.38.0. | uptime.server.daz.dev | Tailscale-only | None | platform/uptime.md |
A nightly database backup is 02:00 UTC, dump all, seven local copies, fourteen days. Off-site copy is off. dbb-litellm-db and dbb-transcribe-db use that schedule. The preview Postgres, Redis, and MinIO do not.
LiteLLM virtual keys live in dbb-litellm-db and are listed on the LLM gateway page. Current aliases: oneisland-devbox-omp (omp in oneisland-devbox, Morph models only) and Darren’s personal freespend keys dbb-mba-m4 and dbb-mbp-m4 (same Morph set, no budget or rate limits, metadata owner=darren and purpose=freespend). Secrets are not in this repo.
Client and app projects keep <app>-<role>-<env>. Dev and staging websites use dbb-auth and send X-Robots-Tag: noindex where the router label says so. Production for these clients is not this machine. See craftapplied-server.
Project AstraZeneca. WordPress for the CLL microsite.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
astrazeneca-cll-website-dev |
Development WordPress site. | Application. WordPress 7.1.4. | astrazeneca-cll-website-dev.server.daz.dev | dbb-auth |
None | craftapplied/astrazeneca-cll |
astrazeneca-cll-website-staging |
Staging WordPress site. | Application. WordPress 7.1.4. | astrazeneca-cll-website-staging.server.daz.dev | dbb-auth |
None | craftapplied/astrazeneca-cll |
astrazeneca-cll-db-dev |
Development database for that site. | Database. MariaDB 12.3.3. | None | Internal only | Nightly, local | Coolify database |
astrazeneca-cll-db-staging |
Staging database for that site. | Database. MariaDB 12.3.3. | None | Internal only | Nightly, local | Coolify database |
Project DotAI. Astro site.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
dotai-website-staging |
Staging site. | Application. Astro. | dotai-website-staging.server.daz.dev | dbb-auth |
None | craftapplied/dotai-website |
dotai-website-production |
Production holding page. No domain is attached. | Application. Astro. | None | Not published | None | craftapplied/dotai-website |
Project Go Straight. Environment development only. A local-only Rust repo at /home/daz/Code/project-gostraight, history scrubbed (main dbd96db), still with no git remote and no domain. Pre-scrub bundles under /home/daz/_backups-git/project-gostraight/ still hold palettes, pending Darren’s yes.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
project-gostraight-dev |
Isolated Rust 1.99.1 dev container. Tests run offline. | Service. Compose, no network. | None | Not published | Nightly local git bundle, last 7 | gostraight-dev |
Project One Island. Environment development only. One Island Bot drives the project’s devbox. Server Bot owns the image, the Coolify service, egress, and upgrades. Instance settings, who drives the box, and how to work in it are on the One Island page.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
oneisland-devbox |
Project devbox for the One Island rewrite. | Service. Compose, internal network plus Squid egress. | None | Not published | None. Code is in git; the home volume is not backed up. | One Island |
oneisland-db-dev |
Disposable PostGIS 18 sidecar for that devbox. | Service. Compose sidecar, internal network only, no host port. | None | Not published | None. Disposable, no backups. | One Island |
Project My Emissions. Development and an empty staging environment. No production environment on this machine.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
myemissions-website-dev |
Development WordPress site. | Application. WordPress 7.1.4, PHP 8.5. | myemissions-website-dev.server.daz.dev | dbb-auth |
None | craftapplied/myemissions |
myemissions-db-dev |
Development database for that site. | Database. MariaDB 12.3.3. | None | Internal only | Nightly, local | Coolify database |
Project Mitsubishi Electric. Environments development and staging. No application and no database.
Project Renewables UnWind. Environment development.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
renewablesunwind-api-dev |
HTTP API for the rewrite. | Application. NestJS. | renewablesunwind-api-dev.server.daz.dev | dbb-auth |
None | craftapplied/renewablesunwind |
renewablesunwind-webapp-dev |
Browser app for the rewrite. | Application. TanStack Start. | renewablesunwind-webapp-dev.server.daz.dev | dbb-auth |
None | craftapplied/renewablesunwind |
renewablesunwind-db-dev |
Development Postgres for the rewrite. | Database. Postgres 17.8. | None. Tailnet host port. | Tailscale-only | Nightly, local | Coolify database |
Project Seraphiim. Environment development.
| Name | What it does | Kind | Domains | Exposure | Backups | Where |
|---|---|---|---|---|---|---|
seraphiim-inloop-webapp-dev |
InLoop web app. | Application. Rails. | seraphiim-inloop-development.server.daz.dev | dbb-auth |
None | craftapplied/seraphiim |
seraphiim-inloop-db-dev |
Development Postgres for that app. | Database. Postgres 17.8. | None. Tailnet host port. | Tailscale-only | Nightly, local | Coolify database |
These pieces are not Coolify applications.
Coolify
The panel is coolify.server.daz.dev. Tailscale-only, except /webhooks. Containers coolify, coolify-db, coolify-redis, coolify-sentinel. Sentinel (coollabsio/sentinel:1.1.5) is enabled and was left as it is. Project devbox usage is also logged on the host by dbb-devbox-stats.timer to /var/log/dbb/devbox-stats.jsonl.
Traefik
coolify-proxy reads /data/coolify/proxy/dynamic/. The lockdown, the Tailscale list, and the preview auth file live there. Copies of the last two are platform/traefik-tailscale-only-apps.yaml and platform/traefik-preview-auth.yaml.
Tailscale
tailscaled is the host tailnet. The address is 100.88.192.87. Split DNS for server.daz.dev answers on the tailnet.
Firewall
UFW allows public 80 and 443. SSH is limited to the tailnet and the private ranges. Postgres 5432-5499 is limited to the tailnet address. fail2ban jails sshd.
Cursor worker
cursor-worker.service runs the self-hosted worker as daz, named dbb-server. No public port.
Rex
Personal terminal server, process rex, hostname dbb-rex. Owner-only on its own tailnet device. Rex.
grokbot
Server Bot’s computer on the tailnet. Hostname grokbot, address 100.114.254.5, MagicDNS grokbot.tail8026fe.ts.net, tag tag:serverbot. It SSHs to dbb-server as daz. The older names grokbot-box and grok-bot-box (100.69.127.78) are gone.
grokbot runs a userspace tailscaled. Its state is /home/box/.local/state/tailscale. A restart loop starts from ~/.bashrc on the box. That state can be empty after a box restart, which logs the node out. If tailscaled comes back logged out, re-approve or re-auth the node in the Tailscale admin. Then check that /home/box/.local/state/tailscale/tailscaled.state is non-empty (a logged-in node has been about 2.4 KB, not 0 bytes), that tailscale status shows hostname grokbot with tag tag:serverbot, and that ssh dbb-server works.
gostraight-dev is platform/gostraight/gostraight-dev, installed at ~/.local/bin/gostraight-dev. go-straight-dev is a symlink to it. It runs commands in the project-gostraight-dev container. The host has no Rust.
devbox is platform/devbox/devbox, installed at ~/.local/bin/devbox. Each project gets a symlink to it, <project>-devbox. The helper opens a login zsh as daz in that project’s container, in ~/Code/<project>, and <project>-devbox <cmd> runs a command there instead. It sets SHELL=/usr/bin/zsh so herdr does not fall back to /bin/sh. bash remains available as a fallback. Plain devbox lists the running devboxes. The shared image is dbb-devbox; the image tag is the freeze and rollback point. See platform/devbox/README.md. The first instance, and how to work in it, is on the One Island page.
dbb-wp-cli is platform/wordpress/dbb-wp-cli. It is not installed on the host. It starts one throwaway WordPress CLI container per command.
dbb-transcribe is the web app above. Each job runs on the M1 worker over SSH. The worker has no Coolify resource and no URL of its own.
craftapplied-server is a separate machine. Client production sites run there. dbb-server holds dev, staging, and the platform. craftapplied.com is not served by dbb-server.