# Phyllome Cloudron server (`my.phyllo.me`)

The Phyllome OS project's Cloudron platform. This is the *project* infrastructure
server — distinct from the home-LAN Cloudron (`my.lesloutres.ch`, see the
`inventory-of-devices` repo, which is personal-resource scoped and intentionally
does **not** document this box).

## At a glance

| Field | Value |
|---|---|
| Platform | Cloudron **10.0.5** |
| Admin URL | `https://my.phyllo.me` |
| Host OS | Ubuntu (managed by Cloudron installer) |
| Location | Not on the home LAN — out-of-LAN host; public DNS via IPv6 (`2001:41d0:1008:44d::1`) + the box behind the project's hosting |
| DNS provider | Gandi (PAT, `phyllo.me` + `phyllome.org`) |
| TLS | Let's Encrypt, wildcard (production `letsencrypt-prod`) |
| Domains | `phyllo.me`, `phyllome.org` |
| Backup | Cloudron box + app backups nightly; cleanup job keeps a rolling window (see event log `backup.cleanup.finish`) |

Remote-management interfaces:

- **Cloudron API / UI** — `cloudron-phyllome` (read) and `cloudron-phyllome-write`
  (write) MCP servers from the `automation` repo.
- **Gitea forge** — `git.phyllo.me`, Gitea **1.40.2** app (id `io.gitea.cloudronapp`).
  Read via `gitea-phyllome`, write via `gitea-phyllome-write`. Git-over-SSH on
  port **29418** (e.g. `ssh://git@git.phyllo.me:29418/owner/repo.git`).

## Apps

Cloudron app inventory on this box (subset relevant to the factory):

| FQDN | App | State | Role in the factory |
|---|---|---|---|
| `git.phyllo.me` | Gitea | running | Code host + Gitea Actions bus |
| `minio.phyllo.me` (+ `minio-api.phyllo.me`) | MinIO | running | S3 object storage (factory artifact staging candidate) |
| `kanboard.phyllo.me` / `kanboard.phyllome.org` | Wekan | running / stopped (preprod dup) | Project kanban |
| `wiki.phyllo.me` / `wiki.phyllome.org` | Wiki.js | running / stopped | Docs (live = wiki.phyllome.org) |
| `llamas.phyllo.me` | Open WebUI | stopped | AI chat (on demand) |
| `ks.phyllome.org` | Kutt | stopped | URL shortener (preprod) |
| `phyllo.me`, `www.phyllo.me` | Grav | running | Project website |

Full inventory is one `cloudron-phyllome_list_apps` call away; this file only
documents what the factory depends on.

## Factory-relevant services

- **Package registry** (Gitea Packages) holds the container images:
  - `devops/fedora-runner-image` (with `latest`) — runner job container
  - `devops/fedora-oci`, `devops/qemu-libvirt-oci-image` — builder images
  - `roots/fedora-iso-creation:42` — devcontainer referenced by test-actions
- **Gitea Actions** is enabled on the product repos.
- **Runners**: none registered yet → see `RUNBOOK.md`. Expected label: `fedora`.

## Access model

- `git.phyllo.me` user `lukas` (id 4, **not** Gitea admin) — used by the read and
  write API tokens.
- Runner registration requires a **runner registration token** from the Gitea UI
  (Settings → Actions → Runners) — admin/owner action, see RUNBOOK.
- Cloudron ownership is via an OIDC/owner account `superuser@phyllo.me`; API
  tokens (`tower-read`, `tower`, …) are created/deleted via the Cloudron UI
  (visible in the event log).