Service map

Authentik

Authentik is a piece fo software that acts as a central directory for user access to internal applications. It is deployed on Eros as a docker compose stack and has 3 containers:

• authentik-server-1 is the main container that runs the application.
  • Ports:
    9000 - reverse proxyed by caddy on auth.alacrity.ro.
• authentik-worker-1 is a worker container managed by the server instance.
  • No ports exposed.
• authentik-postgresql-1 is a PGSQL database.
  • No ports exposed.

The docker compse stack runs its own bridge network to allow the server container to access worker and postgres database.

Persistent volumes are located under /var/alacrity/auth-*.

More details regarding Autkentik's configuration and functioning can be found on its dedicated page.

Alacrity Wiki

The wiki is constructed using two containers:

• wiki-wiki-1 is the main application container.
  • Ports:
    3000 - reverse proxied by caddy on wiki.alacrity.ro.
• wiki-db-1 is the PGSQL database.

The docker compse stack runs its own bridge network to allow the application container to access the postgres database.

Persistent volumes are located under /var/alacrity/wiki-*.

The wiki application contains credentials that are stored in the database:

• Wiki-specific private SSH key, configured as deploy key only for the wiki repository in Github. Wiki can bidirectional sync with the repo. This is used to provide image path normalization and automated feed.
• OIDC data for integrating with the Authentik stack.

More details regarding wiki's permissioning system and security can be found in this section of Authentik's details page. The wiki runs a forked version of Wiki.js with fixes to the permission system.

URL Shortener

We use kutt as our URL shortener. We chose it because it can integrate with out existing OIDC infrastructure. We maintain a fork of kutt that fixes some inconsistencies with OIDC authorization flow. Built images of our fork are published to ghcr.io repository using Github Actions.

We do not expect a high amount of data, therefore kutt is deployed without a separate database (even though it supports postgres), but using the built-in sqlite.
To accelerate query latency, a redis instance is deployed alongside kutt.

• kutt-server-1 is the main container with kutt, deployed from ghcr.io/alacrity-education/kutt-oidc:v3.2.4-rc1.
  • Ports:
    3001 - reverse proxied by caddy on u.alacrity.ro.
• kutt-redis-1 is the redis instance. Default configuration, no volumes mounted or ports exposed.

The docker compse stack runs its own bridge network to allow the application container to access the redis cache.

Persistent volumes are located under /var/alacrity/kutt-*.

OIDC parameters to integrate with Authentik are stored in environment variables.

MeetMaster

We developed MeetMaster to help us display a QR code at our meetings that volunteers can scan and track attendance. It identifies users using OIDC with our Authentik.

It contains two containers, a SpringBoot application and a PostgreSQL database:

• meetmaster-app-1 contains the SpringBoot main java process. It is deployed from the latest ghcr.io image that we publish.
  • Ports:
    8083 - reverse proxied by caddy on attend.alacrity.ro.
• meetmaster-postgres-1 is the PGSQL database. It has not ports exposed outside the stack network.

The docker compse stack runs its own bridge network to allow the application container to access the PGSQL database.

The PGSQL volume is located at /var/alacrity/meetmaster-db.

OIDC parameters to integrate with Authentik are stored in environment variables.

Airbox Stack

Infrastructure to support data collection from AirBox will run on Eros.

TODO Alex Lucaci add details about airbox services once these have finished developing.

Monitoring (network-level)

TODO Alex Lucaci add details here regarding the MKTXP+Prometheus+Grafana test stack that monitors the network status.

Ceres HaOS

Ceres is a server that will run local IoT automations for the lab. It is not yet setup and no details about its software are decided yet.

TODO Not decided yet.

Site

TODO Sainenco

Odoo (intern)

TODO Sainenco

Booking system

TODO Sainenco

Services for external parties should be documented in their separate project pages.
If they require any physical infrastructure, that should be mentioned both in their dedicated docs and in the Network page.