Port and Service Mapping Reference¶
Last Updated: 2025-12-08
Overview¶
This document provides a complete reference of all services, their ports, network assignments, and access points in the infrastructure.
Service Port Mapping¶
| Service | Container Name | Internal Port | External Port | Network(s) | Public Access |
|---|---|---|---|---|---|
| Traefik | traefik | 80, 443, 8080 | 80, 443, 8080 | traefik_proxy | Yes (80/443), No (8080) |
| PostgreSQL | supa-db | 5432 | - | supabase_default | No (internal only) |
| Supabase Auth | supa-auth | 8081 | - | supabase_default, traefik_proxy | Yes (via Traefik) |
| Supabase REST | supa-rest | 3000 | - | supabase_default, traefik_proxy | Yes (via Traefik) |
| Supabase Storage | supa-storage | 5000 | - | supabase_default, traefik_proxy | Yes (via Traefik) |
| Supabase Studio | supa-studio | 3000 | - | supabase_default, traefik_proxy | Yes (via Traefik) |
| Supabase Meta | supa-meta | 8080 | - | supabase_default | No (internal only) |
| Open WebUI | open-webui | 8080 | - | traefik_proxy, supabase_default | Yes (via Traefik) |
| n8n | n8n | 5678 | 127.0.0.1:5678 | traefik_proxy, supabase_default | Yes (via Traefik) |
| MyApp | myapp | 8080 | - | traefik_proxy, supabase_default | Yes (via Traefik) |
| Gitea | gitea | 3000, 22 | 3000, 2222 | traefik_proxy | Yes (via Traefik) |
| StackWiz MCP | stackwiz-mcp | 3000 | - | traefik_proxy | Yes (via Traefik) |
| Apprise | apprise | 8000 | - | traefik_proxy | Yes (via Traefik) |
| ntfy | ntfy | 80 | - | traefik_proxy | Yes (via Traefik) |
| Mailrise | mailrise | 8025 | 8025 | supabase_default | No (internal only) |
| Uptime Kuma | uptime-kuma | 3001 | - | traefik_proxy | Yes (via Traefik) |
| Metube | metube | 8081 | - | traefik_proxy | Yes (via Traefik) |
| Watchtower | watchtower | 8080 | - | - | No (health checks only) |
| Paperless NGX | paperless | 8000 | - | traefik_proxy, paperless_internal | Yes (via Traefik) |
| Paperless DB | paperless-db | 5432 | - | paperless_internal | No (internal only) |
| Paperless Redis | paperless-redis | 6379 | - | paperless_internal | No (internal only) |
| Paperless-AI | paperless-ai | 3000 | 127.0.0.1:3003 | traefik_proxy | Yes (via Traefik) |
| AdGuard Home | adguard | 3000, 53 | 53 (DNS) | traefik_proxy | Yes (via Traefik) |
| Authentik Server | authentik-server-1 | 9000, 9443 | - | traefik_proxy, authentik_internal | Yes (via Traefik) |
| Authentik Worker | authentik-worker-1 | - | - | authentik_internal | No (background worker) |
| Authentik Redis | authentik-redis-1 | 6379 | - | authentik_internal | No (internal only) |
| Prometheus | prometheus | 9090 | 127.0.0.1:9090 | monitoring_network, traefik_proxy | Yes (via Traefik) |
| Grafana | grafana | 3000 | 127.0.0.1:3001 | monitoring_network, traefik_proxy | Yes (via Traefik) |
| Loki | loki | 3100 | 127.0.0.1:3100 | monitoring_network | No (internal only) |
| AlertManager | alertmanager | 9093 | 127.0.0.1:9093 | monitoring_network | No (internal only) |
| Node Exporter | node-exporter | 9100 | 127.0.0.1:9100 | monitoring_network | No (metrics only) |
| Promtail | promtail | 9080 | - | monitoring_network | No (log collection) |
| Glance | glance | 8080 | - | traefik_proxy | Yes (via Traefik) |
| Rclone | rclone | 5572 | - | traefik_proxy | Yes (via Traefik) |
| LiteLLM | litellm | 4000 | - | traefik_proxy | Yes (via Traefik) |
| Cache Redis | cache-redis | 6379 | 127.0.0.1:6380 | cache_redis_network | No (internal only) |
| Session Redis | session-redis | 6379 | 127.0.0.1:6381 | session_redis_network | No (internal only) |
| Coolify | coolify | 8000 | 8000 | traefik_proxy, coolify_internal | Yes (via Traefik) |
| Coolify DB | coolify-db | 5432 | - | coolify_internal | No (internal only) |
| Coolify Redis | coolify-redis | 6379 | - | coolify_internal | No (internal only) |
| Jellyfin | jellyfin | 8096, 8920 | - | traefik_proxy | Yes (via Traefik) |
| Zipline | zipline | 3000 | - | traefik_proxy, zipline_internal | Yes (via Traefik) |
| Zipline DB | zipline-db | 5432 | - | zipline_internal | No (internal only) |
| Postiz | postiz | 5000, 3000 | - | traefik_proxy, postiz_internal | Yes (via Traefik) |
| Postiz Postgres | postiz-postgres | 5432 | - | postiz_internal | No (internal only) |
| Postiz Redis | postiz-redis | 6379 | - | postiz_internal | No (internal only) |
| Netdata | netdata | 19999 | - | traefik_proxy | Yes (via Traefik) |
| Portainer | portainer | 9000 | 9443 | traefik_proxy | Yes (via Traefik) |
| Homarr | homarr | 7575 | - | traefik_proxy | Yes (via Traefik) |
| Stremthru | stremthru | 8080 | - | traefik_proxy | Yes (via Traefik) |
| Zurg | zurg | 8081 | - | zurg_network | No (media mount) |
| CodeScribe | codescribe | 3000 | - | traefik_proxy | Yes (via Traefik) |
Public URLs and Access Points¶
| Service | URL | Path | Description |
|---|---|---|---|
| Traefik Dashboard | https://traefik.rbnk.uk | / | Traefik management dashboard (auth required) |
| Supabase Studio | https://supabase.rbnk.uk | / | Database management UI |
| Supabase Auth API | https://supabase.rbnk.uk | /auth/v1/* | GoTrue authentication API |
| Supabase REST API | https://supabase.rbnk.uk | /rest/v1/* | PostgREST database API |
| Supabase Storage API | https://supabase.rbnk.uk | /storage/v1/* | S3-compatible object storage |
| Open WebUI | https://openwebui.rbnk.uk | / | AI chat interface |
| n8n | https://n8n.rbnk.uk | / | Workflow automation platform |
| MyApp | https://myapp.rbnk.uk | / | Example application |
| Gitea | https://gitea.rbnk.uk | / | Self-hosted Git service |
| Gitea API | https://gitea.rbnk.uk | /api/v1/* | Gitea REST API |
| StackWiz MCP | https://stackwiz-mcp.rbnk.uk | / | AI-powered stack management MCP server |
| Apprise | https://apprise.rbnk.uk | / | Universal notification aggregator |
| Apprise API | https://apprise.rbnk.uk | /notify/* | REST API for sending notifications |
| ntfy | https://ntfy.rbnk.uk | / | Push notification server |
| ntfy API | https://ntfy.rbnk.uk | / |
Topic-based notification publishing |
| Uptime Kuma | https://uptime.rbnk.uk | / | Service monitoring dashboard |
| Metube | https://metube.rbnk.uk | / | YouTube video downloader with web interface |
| Paperless NGX | https://paperless.rbnk.uk | / | Document management system |
| Paperless-AI | https://paperless-ai.rbnk.uk | / | AI-powered document analysis and chat |
| AdGuard Home | https://dns.rbnk.uk | / | DNS filtering and ad blocking dashboard |
| Authentik | https://auth.rbnk.uk | / | Identity provider and SSO |
| Prometheus | https://prometheus.rbnk.uk | / | Metrics database and query UI |
| Grafana | https://grafana.rbnk.uk | / | Metrics visualization and dashboards |
| Glance | https://glance.rbnk.uk | / | Infrastructure dashboard |
| Rclone | https://rclone.rbnk.uk | / | Cloud storage management UI |
| LiteLLM | https://litellm.rbnk.uk | / | LLM proxy API |
| Coolify | https://coolify.rbnk.uk | / | Application deployment platform |
| Jellyfin | https://jellyfin.rbnk.uk | / | Media streaming server |
| Zipline | https://zipline.rbnk.uk | / | File sharing platform |
| Postiz | https://postiz.rbnk.uk | / | Social media scheduler |
| Netdata | https://netdata.rbnk.uk | / | Real-time system monitoring |
| Portainer | https://portainer.rbnk.uk | / | Docker container management |
| Homarr | https://homarr.rbnk.uk | / | Dashboard and bookmarks |
| Stremthru | https://stremthru.rbnk.uk | / | Video streaming service |
| CodeScribe | https://codescribe.rbnk.uk | / | Code documentation generator API |
| CodeScribe API | https://codescribe.rbnk.uk | /api/* | REST API for documentation generation |
Docker Networks¶
traefik_proxy¶
- Purpose: External-facing network for services requiring public access
- Services: All services with Traefik labels
- Type: Bridge network
- Scope: Cross-container communication for HTTP/HTTPS routing
paperless_internal¶
- Purpose: Internal network for Paperless NGX components
- Services: paperless, paperless-db, paperless-redis
- Type: Bridge network
- Scope: Secure communication between Paperless containers
supabase_internal¶
- Purpose: Internal network for Supabase components
- Services: All Supabase containers, plus apps needing database access
- Type: Bridge network
- Scope: Secure internal communication between services
cache_redis_network¶
- Purpose: Shared Redis cache network for ephemeral data
- Services: cache-redis, Gitea, Stremthru, future caching services
- Type: Bridge network
- Scope: High-performance shared caching
session_redis_network¶
- Purpose: Shared Redis session network for persistent sessions
- Services: session-redis, Gitea, future session-based services
- Type: Bridge network
- Scope: Persistent session storage
monitoring_network¶
- Purpose: Internal network for monitoring stack
- Services: prometheus, grafana, loki, alertmanager, promtail, node-exporter
- Type: Bridge network
- Scope: Metrics and log collection
authentik_internal¶
- Purpose: Internal network for Authentik components
- Services: authentik-server, authentik-worker, authentik-redis
- Type: Bridge network
- Scope: Identity provider infrastructure
Port Conflict Avoidance Strategies¶
1. Internal Port Isolation¶
- Services use internal ports that don't conflict (even if numbers overlap)
- Container isolation ensures services like supa-rest (3000) and supa-studio (3000) coexist
- No direct host port binding except where necessary
2. Host Port Binding Guidelines¶
- Use 127.0.0.1 prefix for local-only access (e.g.,
127.0.0.1:5678:5678) - Avoid binding to 0.0.0.0 unless public access is required
- Document all host port bindings in service compose files
3. Port Allocation Ranges¶
- System Services: 80, 443 (Traefik only)
- Database: 5432 (internal only)
- Application Services: 3000-5999
- Management UIs: 8080-8999
- Custom Services: 9000+
4. Conflict Resolution Process¶
- Check existing services with
docker ps --format "table {{.Names}}\t{{.Ports}}" - Use
ss -tlnp | grep <port>to verify host port availability - Prefer Traefik routing over direct port exposure
- Document any new port allocations in this file
Service Discovery¶
Internal Service Names¶
Services can reach each other using container names within the same network:
- PostgreSQL: supa-db:5432
- Supabase Auth: supa-auth:8081
- Supabase REST: supa-rest:3000
- Supabase Storage: supa-storage:5000
- Apprise: apprise:8000
- ntfy: ntfy:80
- Mailrise: mailrise:8025
- Uptime Kuma: uptime-kuma:3001
- Metube: metube:8081
- Paperless NGX: paperless:8000
- Paperless DB: paperless-db:5432
- Paperless Redis: paperless-redis:6379
- Paperless-AI: paperless-ai:3000
- CodeScribe: codescribe:3000
External Access Pattern¶
All external access should go through Traefik:
1. Service exposes internal port
2. Joins traefik_proxy network
3. Traefik labels define routing rules
4. SSL termination handled by Traefik
Debugging Port Issues¶
Common Commands¶
# View all container ports
docker ps --format "table {{.Names}}\t{{.Ports}}"
# Check specific service ports
docker inspect <container> | jq '.[0].NetworkSettings.Ports'
# Verify host port availability
ss -tlnp | grep <port>
# Test internal connectivity
docker exec <container> nc -zv <target-container> <port>
Troubleshooting Steps¶
- Verify container is running:
docker ps | grep <service> - Check logs for binding errors:
docker logs <container> - Ensure correct network membership:
docker inspect <container> | jq '.[0].NetworkSettings.Networks' - Test Traefik routing:
curl -H "Host: <domain>" http://localhost