Skip to content
RRCHNM Infra

Directory

Parsed at build time from the catalogs on the forge mirror of chnm/systems — 55602774, 2026-09-06 18:06 UTC. Freshness = mirror sync + the docs release cadence; for ground truth the catalogs themselves win.

Internal Gateway hostnames (20)

LAN-only *.rrchnm.internal names on the k0s Gateways (k0s-gateways.yaml)

AddressNameWhereNotes
alpine.rrchnm.internaldevl-vdi GatewayLAN-only
analytics.rrchnm.internalinternal GatewayLAN-only
arch.rrchnm.internaldevl-vdi GatewayLAN-only
argo.rrchnm.internalinternal GatewayLAN-only
bao.rrchnm.internalinternal GatewayLAN-only
crowdsec.rrchnm.internalinternal GatewayLAN-only
debian.rrchnm.internaldevl-vdi GatewayLAN-only
forge.rrchnm.internalinternal GatewayLAN-only
gamja.rrchnm.internalinternal GatewayLAN-only
grafana.rrchnm.internalinternal GatewayLAN-only
hubble.rrchnm.internalinternal GatewayLAN-only
irc.rrchnm.internalinternal GatewayLAN-only
juice.rrchnm.internaldevl-vdi GatewayLAN-only
kali.rrchnm.internaldevl-vdi GatewayLAN-only
metrics-write.rrchnm.internalinternal GatewayLAN-only
playwright.mcp.rrchnm.internalinternal GatewayLAN-only
relay.rrchnm.internalinternal GatewayLAN-only
tldraw.mcp.rrchnm.internalinternal GatewayLAN-only
turnstone.rrchnm.internalinternal GatewayLAN-only
ws.irc.rrchnm.internalinternal GatewayLAN-only

k0s public services (5)

Routed through the public Gateway with tier knobs (services-kubernetes.yaml)

AddressNameWhereNotes
docs.rrchnm.orgDocs (k0s)k0scampus-allowlisted
keila.rrchnm.orgKeila (k0s)k0scampus-allowlisted
popquiz.rrchnm.orgPopQuiz (k0s)k0scampus-allowlisted
postiz.rrchnm.orgPostiz (k0s)k0scampus-allowlisted
rrroster.rrchnm.orgRR-Roster (k0s)k0scampus-allowlisted

Infra services (40)

Platform endpoints — registry, DNS, CA, object store, package cache, LB stats (group_vars services: blocks × fleet hosts)

AddressNameWhereNotes
atlas.rrchnm.internal:8181/haproxy?statsHAProxy statsAQ114Per-node HAProxy live stats — frontend/backend health, session + byte counters, stick-table rates. LAN-only (:8181 open to operator + internal nets); each node's card shows that node's own process.
atomsk.rrchnm.internal:8443/1.0Incus REST APIRH461Same endpoint the `incus` CLI + the OpenTofu Incus provider use. TLS client-cert auth required; same cert as the dashboard.
atomsk.rrchnm.internal:8443/ui/Incus dashboardRH461Built-in browser UI (Incus 6+) — VMs / containers / storage / network on this host. Needs the operator's TLS client cert imported in the browser; hostname URL only (cert SAN excludes LAN IP).
azelf.rrchnm.internal:8080/healthCoreDNS healthAQ114Liveness probe (CoreDNS `health` plugin) — returns "OK" while the process is up
azelf.rrchnm.internal:8181/readyCoreDNS readyAQ114Readiness probe (CoreDNS `ready` plugin) — "OK" once all plugins are initialized
brahma.rrchnm.internal:3900Garage S3 APIRH461S3-compatible endpoint. Operator clients usually use the obj.rrchnm.internal alias (load-balanced across the cluster); these per-host URLs hit one node directly and are useful for liveness / single-node debugging.
brahma.rrchnm.internal:3903Garage admin APIRH461Cluster admin endpoint + Prometheus /metrics scrape target (LAN-only).
brahma.rrchnm.internal:3909Garage Web UIRH461Browser admin UI — bucket browse, key + access management, cluster topology. LAN-only; nftables exposes :3909 on the bootstrap node only, so 2 of the 3 cards have unreachable URLs by design (visit the bootstrap host's URL).
epimetheus.rrchnm.internal:8181/haproxy?statsHAProxy statsAQ114Per-node HAProxy live stats — frontend/backend health, session + byte counters, stick-table rates. LAN-only (:8181 open to operator + internal nets); each node's card shows that node's own process.
heimdall.rrchnm.internal:443/acme/acme/directorystep-ca ACME directoryAQ114ACME provisioner endpoint — cert-manager + step-cli + caddy ACME clients bootstrap from here
heimdall.rrchnm.internal:443/healthstep-ca healthAQ114Server health probe — returns {"status":"ok"} while the daemon is alive
heimdall.rrchnm.internal:443/roots.pemstep-ca rootsAQ114Public root certificate(s) for the internal CA chain (used by clients that need to pin manually)
ho-oh.rrchnm.internal:3142apt-cacher-ng proxyAQ114HTTP proxy endpoint for Debian apt mirrors
ho-oh.rrchnm.internal:3142/acng-report.htmlapt-cacher-ng adminAQ114Cache report + maintenance pages (basic-auth — acng_admin_user / acng_admin_password)
hyperion.rrchnm.internal:8443/1.0Incus REST APIAQ114Same endpoint the `incus` CLI + the OpenTofu Incus provider use. TLS client-cert auth required; same cert as the dashboard.
hyperion.rrchnm.internal:8443/ui/Incus dashboardAQ114Built-in browser UI (Incus 6+) — VMs / containers / storage / network on this host. Needs the operator's TLS client cert imported in the browser; hostname URL only (cert SAN excludes LAN IP).
ibuypwr.rrchnm.internal:8443/1.0Incus REST APIibuypwrSame endpoint the `incus` CLI + the OpenTofu Incus provider use. TLS client-cert auth required; same cert as the dashboard.
ibuypwr.rrchnm.internal:8443/ui/Incus dashboardibuypwrBuilt-in browser UI (Incus 6+) — VMs / containers / storage / network on this host. Needs the operator's TLS client cert imported in the browser; hostname URL only (cert SAN excludes LAN IP).
janus.rrchnm.internal:8181/haproxy?statsHAProxy statsAQ114Per-node HAProxy live stats for the k0s-public passthrough tier (janus/portunus/terminus) — frontend/backend health, session + byte counters. LAN-only (:8181 open to operator + internal nets).
kyojin.rrchnm.internal:8443/1.0Incus REST APIRH461Same endpoint the `incus` CLI + the OpenTofu Incus provider use. TLS client-cert auth required; same cert as the dashboard.
kyojin.rrchnm.internal:8443/ui/Incus dashboardRH461Built-in browser UI (Incus 6+) — VMs / containers / storage / network on this host. Needs the operator's TLS client cert imported in the browser; hostname URL only (cert SAN excludes LAN IP).
lugia.rrchnm.internal:3142apt-cacher-ng proxyRH461HTTP proxy endpoint for Debian apt mirrors
lugia.rrchnm.internal:3142/acng-report.htmlapt-cacher-ng adminRH461Cache report + maintenance pages (basic-auth — acng_admin_user / acng_admin_password)
mesprit.rrchnm.internal:8080/healthCoreDNS healthRH461Liveness probe (CoreDNS `health` plugin) — returns "OK" while the process is up
mesprit.rrchnm.internal:8181/readyCoreDNS readyRH461Readiness probe (CoreDNS `ready` plugin) — "OK" once all plugins are initialized
portunus.rrchnm.internal:8181/haproxy?statsHAProxy statsAQ114Per-node HAProxy live stats for the k0s-public passthrough tier (janus/portunus/terminus) — frontend/backend health, session + byte counters. LAN-only (:8181 open to operator + internal nets).
prometheus.rrchnm.internal:8181/haproxy?statsHAProxy statsAQ114Per-node HAProxy live stats — frontend/backend health, session + byte counters, stick-table rates. LAN-only (:8181 open to operator + internal nets); each node's card shows that node's own process.
shiva.rrchnm.internal:3900Garage S3 APIAQ114S3-compatible endpoint. Operator clients usually use the obj.rrchnm.internal alias (load-balanced across the cluster); these per-host URLs hit one node directly and are useful for liveness / single-node debugging.
shiva.rrchnm.internal:3903Garage admin APIAQ114Cluster admin endpoint + Prometheus /metrics scrape target (LAN-only).
shiva.rrchnm.internal:3909Garage Web UIAQ114Browser admin UI — bucket browse, key + access management, cluster topology. LAN-only; nftables exposes :3909 on the bootstrap node only, so 2 of the 3 cards have unreachable URLs by design (visit the bootstrap host's URL).
terminus.rrchnm.internal:8181/haproxy?statsHAProxy statsAQ114Per-node HAProxy live stats for the k0s-public passthrough tier (janus/portunus/terminus) — frontend/backend health, session + byte counters. LAN-only (:8181 open to operator + internal nets).
theia.rrchnm.internal:8443/1.0Incus REST APIAQ114Same endpoint the `incus` CLI + the OpenTofu Incus provider use. TLS client-cert auth required; same cert as the dashboard.
theia.rrchnm.internal:8443/ui/Incus dashboardAQ114Built-in browser UI (Incus 6+) — VMs / containers / storage / network on this host. Needs the operator's TLS client cert imported in the browser; hostname URL only (cert SAN excludes LAN IP).
thoth.rrchnm.internal:443Zot OCI registryRH461Pull-through cache for upstream container images + cosign-signed mirrored binaries
thoth.rrchnm.internal:443/v2/Zot v2 APIRH461OCI Distribution Spec endpoint (referenced by containerd hosts.toml on k0s workers)
uxie.rrchnm.internal:8080/healthCoreDNS healthRH461Liveness probe (CoreDNS `health` plugin) — returns "OK" while the process is up
uxie.rrchnm.internal:8181/readyCoreDNS readyRH461Readiness probe (CoreDNS `ready` plugin) — "OK" once all plugins are initialized
vishnu.rrchnm.internal:3900Garage S3 APIAQ114S3-compatible endpoint. Operator clients usually use the obj.rrchnm.internal alias (load-balanced across the cluster); these per-host URLs hit one node directly and are useful for liveness / single-node debugging.
vishnu.rrchnm.internal:3903Garage admin APIAQ114Cluster admin endpoint + Prometheus /metrics scrape target (LAN-only).
vishnu.rrchnm.internal:3909Garage Web UIAQ114Browser admin UI — bucket browse, key + access management, cluster topology. LAN-only; nftables exposes :3909 on the bootstrap node only, so 2 of the 3 cards have unreachable URLs by design (visit the bootstrap host's URL).

Docker stacks (6)

Compose stacks on the docker fleet (host_vars docker_compose_stacks)

AddressNameWhereNotes
chambers.legalmodernism.orgchambersarminLAN-only · caddy+HAProxy
kuvasz.rrchnm.internalkuvaszarminLAN-only · caddy+HAProxy
motioneye.rh461.rrchnm.internalmotioneyearminLAN-only · caddy+HAProxy
pgadm.rrchnm.orgpgadminarminpublic · caddy+HAProxy
xcp-ng.grafana.rrchnm.internalobservabilityarminLAN-only · caddy+HAProxy
xo.rrchnm.internalxoarminLAN-only · caddy+HAProxy

Static websites (23)

Caddy-served doc roots (websites-static.yaml)

AddressNameWhereNotes
20.rrchnm.orgRRCHNM @ 20RH461aliases: www.20.rrchnm.org · steward: chnm@gmu.edu
americanjewishlife.orgAmerican Jewish LifeRH461aliases: www.americanjewishlife.org
collectingthesetimes.orgCollecting These TimesRH461aliases: www.collectingthesetimes.org
eagleeyecitizen.orgEagle Eye CitizenRH461aliases: www.eagleeyecitizen.org
forustheliving.orgFor Us the LivingRH461aliases: www.forustheliving.org
hazon.collectingthesetimes.orgHazon Collecting These TimesRH461aliases: www.hazon.collectingthesetimes.org
hearingtheamericas.orgHearing the AmericasRH461
imagingthefrenchrevolution.rrchnm.orgImaging the French RevolutionRH461
iowmaterialhistorieswebinar.orgMaterial Histories of the Indian Ocean WorldRH461aliases: www.iowmaterialhistorieswebinar.org
islampers.dev.chnm.gmu.eduRussian Perspectives on IslamRH461campus-allowlisted
kahal.collectingthesetimes.orgKahal Collecting These TimesRH461aliases: www.kahal.collectingthesetimes.org
mallhistory.orgHistories of the National MallRH461aliases: www.mallhistory.org, mallhistory.us, www.mallhistory.us
occupyarchive.orgOccupy ArchiveRH461
onetable.collectingthesetimes.orgOnetable Collecting These TimesRH461aliases: www.onetable.collectingthesetimes.org
pandemicreligion.orgPandemic ReligionRH461aliases: www.pandemicreligion.org, covid.pandemicreligion.org, www.covid.pandemicreligion.org
plastercast.gmu.eduPlaster Cast CollectionRH461
preachinggoesviral.orgPreaching Goes ViralRH461aliases: www.preachinggoesviral.org
resoundingthearchives.orgReSounding the ArchivesRH461
s3.rrchnm.internalGarage S3 (TLS)AQ114LAN-only
static.rrchnm.orgRH461
thanksroy.orgThanks, RoyRH461aliases: www.thanksroy.org
transatlaenc.dev.chnm.gmu.eduTransatlantic EncountersRH461campus-allowlisted
virginiaslostat.orgVirginia's Lost ATRH461aliases: www.virginiaslostat.org

Hugo websites (23)

CI-built Hugo sites on the caddy fleet (websites-hugo.yaml)

AddressNameWhereNotes
1665plague.rrchnm.org1665 PlagueRH461
1812shipping.rrchnm.org1812 ShippingRH461
911.dev.chnm.gmu.eduSeptember 11 Digital ArchiveRH461
bracero.dev.chnm.gmu.eduBracero ArchiveRH461
dev.crdh.rrchnm.orgCurrent Research in Digital HistoryRH461
dev.teachinghistory.orgTeaching HistoryRH461
emm.dev.chnm.gmu.eduEarly Modern MapathonsRH461
emm.rrchnm.orgEarly Modern MapathonsRH461
games.rrchnm.orgRRCHNM GamesRH461
hugo.chnm.gmu.eduRRCHNM.orgRH461
hurricane.dev.chnm.gmu.eduHurricane Digital Memory BankRH461
illuminated.dev.chnm.gmu.eduIlluminatedRH461campus-allowlisted
jdh.dev.chnm.gmu.eduJournal of Digital HumanitiesRH461
journalofdigitalhumanities.orgJournal of Digital HumanitiesRH461
lynhaven.dev.chnm.gmu.eduLynhavenRH461
mappingtheuniversity.rrchnm.orgMapping the UniversityRH461
model-articles.rrchnm.orgModels of Argument-Driven Digital HistoryRH461
pwd.dev.chnm.gmu.eduPapers of the War DepartmentRH461
revolution.dev.chnm.gmu.eduLiberty, Equality, Fraternity: Exploring the French RevolutionRH461campus-allowlisted
rrchnm.orgRRCHNM.orgRH461
teachinghistory.orgTeaching HistoryRH461aliases: www.teachinghistory.org
wardepartmentpapers.orgPapers of the War DepartmentRH461
whc.dev.chnm.gmu.eduWorld History CommonsRH461

LAMP sites (4)

Per-site MariaDB is live; the PHP tier is the k0s LAMP-hybrid plan (websites-lamp catalog)

AddressNameWhereNotes
drupal.recroom.rrchnm.orgMariaDB on izanagi
omeka-classic.recroom.rrchnm.orgMariaDB on izanagi
omeka-s.recroom.rrchnm.orgMariaDB on izanagi
wordpress.recroom.rrchnm.orgMariaDB on izanagi