Host: discourse

Single Debian 13 (trixie) box that runs the whole stack. Hostname is discourse for historical reasons (the forum was the first thing on it); it now hosts much more.

Identity

• Hostname: discourse
• OS: Debian GNU/Linux 13 (trixie), kernel 6.12.74
• Tailscale IP: 100.78.52.16 (MagicDNS: discourse.<TAILNET>.ts.net)

On-host (non-container) services

systemd unit	Purpose
ssh.service	OpenSSH — interactive login + SFTP subsystem
cloudflared.service	Primary Cloudflare Tunnel (config in /etc/cloudflared/)
tailscaled.service	Tailscale node + Funnel
docker.service	All containerised stacks
cron.service	Scheduled jobs

Everything else is a Docker container — see per-service pages.

Users

• Admin: drew (uid 1000) — sudo, key-only SSH login
• SFTP-only: guest (1002), matt (1003), nate (1004) — shell /sbin/nologin, chrooted, see SFTP

Ports listening

Port	Bind	Service
22	0.0.0.0	sshd (admin + SFTP)
80, 443	0.0.0.0	Discourse app container
2222	0.0.0.0	Forgejo git-over-ssh
3000	0.0.0.0	Forgejo web
8080	0.0.0.0	Landing — justaguylinux.com
8081	0.0.0.0	Filedrop nginx
8082	0.0.0.0	Landing — butterbian.org
8083	127.0.0.1	Filebrowser (loopback only — exposed via tunnel, not LAN)

Public exposure is gated entirely by Cloudflare Tunnel + Tailscale Funnel — listening on 0.0.0.0 is fine because the box has no public IP. LAN/Tailnet peers can hit any of these directly.

sshd highlights

/etc/ssh/sshd_config:

Subsystem	sftp	/usr/lib/openssh/sftp-server

Match Group sftpusers
    ChrootDirectory /var/sftp/shared
    ForceCommand internal-sftp
    PasswordAuthentication yes
    AllowTcpForwarding no
    X11Forwarding no

Admin login (drew) uses key auth; the Match Group sftpusers block re-enables password auth for that group only — non-technical SFTP users don't need to manage keys.

Firewall

No ufw, no project nftables rules. The box has no public IP and the router doesn't forward any ports — public access only happens through Cloudflare Tunnel and Tailscale Funnel, both outbound-initiated. LAN and tailnet peers can hit any listening port directly.

Cron

Just the standard Debian housekeeping (apt-compat, dpkg, logrotate, man-db, e2scrub_all). No user cron for drew, no homelab-specific scheduled jobs.

Backup

See Backups for the full procedure. Targets summary:

• /var/discourse/shared/standalone — Discourse data (db + uploads)
• /opt/forgejo/data — Forgejo repos + sqlite + LFS
• /var/sftp/shared/uploads — drop bucket
• /home/drew/docker/filebrowser/{srv,database,config} — filebrowser content + users
• /etc/cloudflared/ — tunnel credentials
• /etc/ssh/sshd_config + /etc/ssh/ssh_host_* — sshd state
• /var/landing/ — static site content + compose