tomasz-syn-grzegorza
359afb3a59
Infrastructure configs for GMKtec K11 (Docker, vLLM, LocalAI, ComfyUI, control-plane, gpu-fan agent, Server UI with CLI/file explorer/GPU fan curve). Co-authored-by: Cursor <cursoragent@cursor.com>
90 lines
2.6 KiB
Markdown
90 lines
2.6 KiB
Markdown
# NPMPlus — reverse proxy + Let's Encrypt
|
|
|
|
[NPMPlus](https://github.com/ZoeyVid/NPMPlus) (fork nginx-proxy-manager) exposes backend services on **HTTPS** with automatic certificates.
|
|
|
|
On this host it proxies **LocalAI** at `https://llm.rtx1.mobile.agency-ai.dev` → `http://127.0.0.1:8070`.
|
|
|
|
## Ports (host network)
|
|
|
|
| Port | Protocol | Service |
|
|
|------|----------|---------|
|
|
| 80 | tcp | HTTP (ACME challenge + redirects) |
|
|
| 443 | tcp, udp | HTTPS / HTTP3 |
|
|
| 81 | tcp | NPMPlus admin UI (HTTPS) |
|
|
|
|
## Prerequisites
|
|
|
|
1. `/data` mounted (tutorial 04)
|
|
2. DNS `A` record: `llm.rtx1.mobile.agency-ai.dev` → public IP
|
|
3. Router port forward: `80`, `443/tcp`, `443/udp` → `192.168.100.5`
|
|
4. `ACME_EMAIL` in `.env` (Let's Encrypt notifications)
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
cd stacks/npmplus
|
|
cp .env.example .env
|
|
# Edit ACME_EMAIL (and optionally INITIAL_ADMIN_*)
|
|
./scripts/start.sh
|
|
```
|
|
|
|
Admin UI: `https://<LAN-IP>:81` (default login `admin@example.org` unless `INITIAL_ADMIN_EMAIL` set).
|
|
|
|
## Admin access (LAN)
|
|
|
|
Use **`https://192.168.100.90:81`** (or your LAN IP), **not** `http://`.
|
|
|
|
| Symptom | Cause |
|
|
|---------|-------|
|
|
| `http://IP:81` does not load UI | Port 81 serves HTTPS only; HTTP returns 308 redirect |
|
|
| Browser shows certificate error | Default cert has no SAN for IP; run cert regeneration (below) |
|
|
| `docker ps` shows empty PORTS | Normal with `network_mode: host` — check with `ss -tlnp \| grep ':81'` |
|
|
|
|
Regenerate admin cert with SAN for your LAN IP:
|
|
|
|
```bash
|
|
sudo ./scripts/regenerate-admin-cert.sh
|
|
```
|
|
|
|
After regeneration, open `https://<LAN-IP>:81`, click through the self-signed cert warning once, then log in.
|
|
|
|
## Proxy host — LocalAI
|
|
|
|
In NPMPlus UI → **Hosts** → **Proxy Hosts** → Add:
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Domain | `llm.rtx1.mobile.agency-ai.dev` |
|
|
| Scheme | `http` |
|
|
| Forward hostname | `127.0.0.1` |
|
|
| Forward port | `8070` |
|
|
| SSL | Request new certificate, Force SSL, HTTP/2 |
|
|
| Websockets | Enabled |
|
|
|
|
Clients send `Authorization: Bearer <LOCALAI_API_KEY>` (same key as in `stacks/localai/.env`).
|
|
|
|
Test:
|
|
|
|
```bash
|
|
curl -s https://llm.rtx1.mobile.agency-ai.dev/v1/models \
|
|
-H "Authorization: Bearer $LOCALAI_API_KEY"
|
|
```
|
|
|
|
## Firewall
|
|
|
|
```bash
|
|
sudo ./scripts/configure-firewall.sh
|
|
```
|
|
|
|
Restricts direct access to LocalAI (8070) and gpu-fan (8090); allows 80/443 for NPMPlus.
|
|
|
|
## Data
|
|
|
|
Persistent files: `/data/apps/npmplus/`
|
|
|
|
## Related
|
|
|
|
- LocalAI stack: [`../localai/README.md`](../localai/README.md)
|
|
- Client handoff: [`../localai/coding-agent/APP-CLIENT-HANDOFF.md`](../localai/coding-agent/APP-CLIENT-HANDOFF.md)
|
|
- Tutorial: [`../../manual-tutorial/07-npmplus-reverse-proxy.md`](../../manual-tutorial/07-npmplus-reverse-proxy.md)
|