One TLS edge on phonewave, a GPU box behind it, Pi build agents, and a kit that leaves the house
Guided views
Explore this system
Step through curated paths without changing the source diagram.
Beat
Next
ReadyChapter 01 / 01
Guided chapter
Diagram guideExplore this system
Inspecting compiled semantics
E ExportT ThemeS Style0 Reset+ Zoom in- Zoom outEsc Close
Find a node
⌕/
No matching nodes
Semantic passport
Verified source
Authored reach
Route probeChoose a start node
Pick two semantic nodes on the diagram
Choose the source, then the destination. Direction matters.
Semantic lensCompare system roles
Choose up to two semantic kinds. One reveals its real traffic; two compare only direct authored relationships.
Choose a kind to inspect its nodes and touching relationships.
Semantic radar
Building overview
Click nodeDrag to pan
Who serves what
• phonewave owns the only public TLS edge, all persistent state, and CI
• reading-steiner is the only host with a GPU — everything model-shaped lives there
• karakuri.* resolves to phonewave, which proxies onward to reading-steiner's own Traefik
Auth and identity
• Traefik forward-auths protected routers to Authelia before they reach a service
• Tegata owns users, groups, and invites, then writes Authelia's YAML
• Authelia's user list is never hand-edited
Builds and evidence
• Pushes to GitHub trigger Woodpecker; phonewave and the three Pis each run an agent, and a host is never converged by the agent living on it
• Prometheus scrapes six hosts; AutoKuma declares the Uptime Kuma board
• zukan and sonae are regenerated as CI steps, not by any running service
The kit is conditional
• amadeus is only reachable at home in PREP mode
• It pulls paperless, bitwarden, kit TLS, and a kit DB dump nightly at 03:00
• In the field its monitoring targets go stale — alerts stay OK by design
What's Actually Running
• phonewave: 37 compose stacks across 11 categories — 30 behind the App & NAS node, the rest drawn as nodes of their own; Home Assistant runs on a host beside it