{
  "meta": {
    "dump_base": "/mnt/user/backups/borg/dumps/latest",
    "appdata_base": "/mnt/user/appdata",
    "secrets_path": "/mnt/user/appdata/secrets"
  },
  "services": {
    "traefik": {
      "description": "Zentraler Reverse Proxy, TLS, Docker-Label-Routing",
      "tier": 1,
      "category": "core",
      "container_name": "traefik",
      "dependencies": [],
      "url": "https://traefik.kaleschke.info",
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/traefik/dynamic", "/mnt/user/appdata/traefik/letsencrypt"],
      "first_check": "Host-Ports 80/443 erreichbar? dynamic/ korrekt auf Host synchronisiert?",
      "notes": "dynamic configs werden NICHT automatisch von Komodo deployed — manueller Host-Sync noetig"
    },
    "adguard": {
      "description": "DNS-Server / LAN DNS",
      "tier": 1,
      "category": "core",
      "container_name": "adguard",
      "dependencies": ["unbound"],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/adguard/conf", "/mnt/user/appdata/adguard/work"],
      "first_check": "Port 53 erreichbar? Unbound healthy? dns_net Konnektivitaet?",
      "notes": "Ports 53 und 8082 dokumentierte Host-Port-Ausnahmen"
    },
    "unbound": {
      "description": "Upstream DNS Resolver fuer AdGuard",
      "tier": 1,
      "category": "core",
      "container_name": "unbound",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/unbound/config"],
      "first_check": "dns_net Konnektivitaet pruefen; Container-Logs auf Fehler pruefen",
      "notes": "rebuildbar; isoliert in dns_net"
    },
    "tailscale": {
      "description": "VPN / Remote-Zugang",
      "tier": 1,
      "category": "core",
      "container_name": "tailscale",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/tailscale"],
      "first_check": "Tailscale Status auf Host pruefen; State-Datei fuer Key-Renewal vorhanden?",
      "notes": "network_mode: host; NET_ADMIN, NET_RAW, /dev/net/tun — dokumentierte VPN-Ausnahmen"
    },
    "gitea": {
      "description": "Git-Server — operative Quelle der Wahrheit fuer GitOps",
      "tier": 1,
      "category": "core",
      "container_name": "gitea",
      "dependencies": ["traefik"],
      "url": "https://git.kaleschke.info",
      "dump_file": null,
      "data_paths": ["/mnt/user/services/gitea/data"],
      "first_check": "HTTPS erreichbar? SQLite in /data intakt? SSH-Port 222 erreichbar?",
      "notes": "SQLite in /data — kein separater Dump; ohne externen Mirror im DR kritisch"
    },
    "authelia": {
      "description": "ForwardAuth — zentrale Authentifizierung fuer Admin-UIs",
      "tier": 1,
      "category": "security",
      "container_name": "authelia",
      "dependencies": ["postgresql17", "traefik"],
      "url": "https://auth.kaleschke.info",
      "dump_file": "postgresql17-authelia.dump",
      "data_paths": ["/mnt/user/appdata/authelia/config"],
      "first_check": "PostgreSQL healthy? SMTP via GMX erreichbar? Host-Config aktuell (Repo-Baseline != Host)?",
      "notes": "kein Redis-Session-Backend; SMTP-Notifier GMX; Repo-Baseline muss manuell in Host-Config gemerged werden"
    },
    "vaultwarden": {
      "description": "Passwort-Tresor",
      "tier": 1,
      "category": "security",
      "container_name": "vaultwarden",
      "dependencies": ["traefik"],
      "url": "https://vault.kaleschke.info",
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/vaultwarden"],
      "first_check": "HTTPS erreichbar? Appdata-Volume intakt?",
      "notes": "ADMIN_TOKEN_FILE; keine direkten Host-Ports"
    },
    "postgresql17": {
      "description": "Shared PostgreSQL 18 Cluster (historischer Containername)",
      "tier": 1,
      "category": "infra",
      "container_name": "postgresql17",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/postgresql18"],
      "first_check": "backend_net Konnektivitaet? Disk-Space auf /mnt/user/appdata? pg_isready im Container?",
      "notes": "Dumps per Dienst unter dumps/latest; raw DB nicht primaerer Restore-Weg; alter PG17-Pfad bleibt nur Rollback-Altstand"
    },
    "komodo-core": {
      "description": "GitOps UI / API / Stack-Manager",
      "tier": 1,
      "category": "ops",
      "container_name": "komodo-core",
      "dependencies": ["komodo-mongo", "gitea", "traefik"],
      "url": "https://komodo.kaleschke.info",
      "dump_file": "komodo-mongo.archive.gz",
      "data_paths": ["/mnt/user/appdata/komodo/core"],
      "first_check": "MongoDB healthy? Gitea erreichbar? komodo_net Konnektivitaet?",
      "notes": "keine pauschale Authelia-ForwardAuth; Gitea DNS override konfiguriert"
    },
    "komodo-mongo": {
      "description": "Komodo Datenbank (MongoDB)",
      "tier": 1,
      "category": "infra",
      "container_name": "komodo-mongo",
      "dependencies": [],
      "url": null,
      "dump_file": "komodo-mongo.archive.gz",
      "data_paths": ["/mnt/user/appdata/komodo/mongo"],
      "first_check": "komodo_net Konnektivitaet? Disk-Space? mongosh ping?",
      "notes": "Dump-Integritaet nach Major-Upgrades pruefen"
    },
    "komodo-periphery": {
      "description": "Komodo Host-Agent (Stack-Deployments)",
      "tier": 1,
      "category": "ops",
      "container_name": "komodo-periphery",
      "dependencies": ["komodo-core"],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/komodo/periphery"],
      "first_check": "Docker-Socket lesbar? /mnt/user/services gemountet? komodo_net Verbindung zu Core?",
      "notes": "Docker-Socket-Ausnahme dokumentiert; /mnt/user/services Mount fuer Stack-Workspaces"
    },
    "redis": {
      "description": "Shared Redis Cache",
      "tier": 2,
      "category": "infra",
      "container_name": "redis",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/redis"],
      "first_check": "backend_net Konnektivitaet? redis-cli ping erreichbar?",
      "notes": "transiente Daten; bewusst nicht Backup-kritisch"
    },
    "paperless-ngx": {
      "description": "Dokumentenmanagement",
      "tier": 2,
      "category": "app",
      "container_name": "paperless-ngx",
      "dependencies": ["postgresql17", "redis", "traefik"],
      "url": "https://paperless.kaleschke.info",
      "dump_file": "postgresql17-paperless.dump",
      "data_paths": [
        "/mnt/user/appdata/paperless-ngx/data",
        "/mnt/user/documents/paperless",
        "/mnt/user/documents/scans_inbox"
      ],
      "first_check": "Redis healthy? PostgreSQL healthy? backend_net Konnektivitaet?",
      "notes": "DB/Redis Secrets als Stack ENV (keine _FILE Variante)"
    },
    "paperless-gpt": {
      "description": "KI-Ergaenzung fuer Paperless",
      "tier": 2,
      "category": "app",
      "container_name": "paperless-gpt",
      "dependencies": ["paperless-ngx", "traefik"],
      "url": "https://paperless-gpt.kaleschke.info",
      "dump_file": null,
      "data_paths": [
        "/mnt/user/appdata/paperless-gpt/data",
        "/mnt/user/appdata/paperless-gpt/prompts"
      ],
      "first_check": "Paperless API erreichbar? LLM/Ollama erreichbar? API Token gesetzt?",
      "notes": "API Token als Stack ENV; abhaengig von laufendem Paperless"
    },
    "immich_server": {
      "description": "Foto-/Video-App",
      "tier": 2,
      "category": "app",
      "container_name": "immich_server",
      "dependencies": ["immich_postgres", "immich_redis", "immich_machine_learning", "traefik"],
      "url": "https://immich.kaleschke.info",
      "dump_file": "immich.dump",
      "data_paths": ["/mnt/user/photos/immich", "/mnt/user/photos/family_archive"],
      "first_check": "immich_postgres healthy? immich_redis healthy? ML healthy? immich_default Netz?",
      "notes": "native App-Auth; externes Fotoarchiv gemountet"
    },
    "immich_postgres": {
      "description": "Immich-Datenbank",
      "tier": 2,
      "category": "infra",
      "container_name": "immich_postgres",
      "dependencies": [],
      "url": null,
      "dump_file": "immich.dump",
      "data_paths": ["/mnt/user/appdata/immich_postgres_vectorchord"],
      "first_check": "immich_default Netz? Disk-Space? pg_isready?",
      "notes": "PG14 mit VectorChord/pgvector; nie ins frontend_net; immich_default Netz isoliert; alter immich_postgres-Pfad bleibt nur Rollback-Altstand"
    },
    "immich_redis": {
      "description": "Immich Cache",
      "tier": 2,
      "category": "infra",
      "container_name": "immich_redis",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": [],
      "first_check": "immich_default Netz? redis-cli ping?",
      "notes": "rebuildbar; anonymes Volume — named volume als offenes TODO"
    },
    "immich_machine_learning": {
      "description": "Immich ML (Gesichtserkennung, Suche)",
      "tier": 2,
      "category": "infra",
      "container_name": "immich_machine_learning",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": [],
      "first_check": "immich_default Netz? model-cache Volume vorhanden?",
      "notes": "rebuildbar; intern-only"
    },
    "mealie": {
      "description": "Rezeptverwaltung",
      "tier": 2,
      "category": "app",
      "container_name": "mealie",
      "dependencies": ["mealie-postgres", "traefik"],
      "url": "https://mealie.kaleschke.info",
      "dump_file": "mealie.dump",
      "data_paths": ["/mnt/user/appdata/mealie/data"],
      "first_check": "mealie-postgres healthy? mealie_internal Netz erreichbar?",
      "notes": "App + DB in internem Netz getrennt (mealie_internal)"
    },
    "mealie-postgres": {
      "description": "Mealie-Datenbank",
      "tier": 2,
      "category": "infra",
      "container_name": "mealie-postgres",
      "dependencies": [],
      "url": null,
      "dump_file": "mealie.dump",
      "data_paths": ["/mnt/user/appdata/mealie/postgres18"],
      "first_check": "mealie_internal Netz? Disk-Space?",
      "notes": "interne DB; mealie_internal Netz"
    },
    "mail-archiver": {
      "description": "Mail-Archivierung (IMAP)",
      "tier": 2,
      "category": "app",
      "container_name": "mail-archiver",
      "dependencies": ["postgresql17", "authelia", "traefik"],
      "url": "https://mail.kaleschke.info",
      "dump_file": "postgresql17-mailarchiver.dump",
      "data_paths": ["/mnt/user/appdata/mailarchiver/data-protection-keys"],
      "first_check": "PostgreSQL healthy? Internet-/IMAP-Zugang? Authelia healthy?",
      "notes": "Hybrid: frontend_net fuer IMAP/Internet, backend_net fuer DB"
    },
    "nextcloud": {
      "description": "Datei-/Cloud-Dienst",
      "tier": 2,
      "category": "app",
      "container_name": "nextcloud",
      "dependencies": ["nextcloud-postgres", "nextcloud-redis", "traefik"],
      "url": "https://cloud.kaleschke.info",
      "dump_file": null,
      "data_paths": [
        "/mnt/user/appdata/nextcloud/html",
        "/mnt/user/documents/nextcloud-data"
      ],
      "first_check": "nextcloud-postgres healthy? nextcloud-redis healthy? nextcloud_internal Netz?",
      "notes": "native App-Auth (kein zentrales ForwardAuth); WebDAV/CardDAV beachten"
    },
    "nextcloud-postgres": {
      "description": "Nextcloud-Datenbank",
      "tier": 2,
      "category": "infra",
      "container_name": "nextcloud-postgres",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/nextcloud/postgres18"],
      "first_check": "nextcloud_internal Netz? Disk-Space?",
      "notes": "interne DB"
    },
    "nextcloud-redis": {
      "description": "Nextcloud Cache / Locking",
      "tier": 2,
      "category": "infra",
      "container_name": "nextcloud-redis",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/nextcloud/redis"],
      "first_check": "nextcloud_internal Netz? redis-cli ping?",
      "notes": "rebuildbar"
    },
    "ntfy": {
      "description": "Push-Benachrichtigungen (Alert-Backbone)",
      "tier": 2,
      "category": "app",
      "container_name": "ntfy",
      "dependencies": ["traefik"],
      "url": "https://ntfy.kaleschke.info",
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/ntfy"],
      "first_check": "HTTPS erreichbar? NTFY_BEHIND_PROXY=true gesetzt? Traefik healthy?",
      "notes": "KRITISCH: Ausfall bedeutet keine anderen Alerts ankommen"
    },
    "glance": {
      "description": "Homelab-Dashboard",
      "tier": 3,
      "category": "ops",
      "container_name": "glance",
      "dependencies": ["traefik"],
      "url": "https://glance.kaleschke.info",
      "dump_file": null,
      "data_paths": [],
      "first_check": "Traefik erreichbar? Docker-Socket-Proxy intern erreichbar? API-Tokens fuer Widgets gueltig?",
      "notes": "aktives Homelab-Dashboard; Homepage wurde entfernt"
    },
    "monitoring-grafana": {
      "description": "Zentrale Observability-UI",
      "tier": 3,
      "category": "ops",
      "container_name": "monitoring-grafana",
      "dependencies": [
        "monitoring-prometheus",
        "monitoring-loki",
        "monitoring-influxdb3-core",
        "traefik"
      ],
      "url": "https://monitoring.kaleschke.info",
      "dump_file": null,
      "data_paths": ["grafana_data"],
      "first_check": "Authelia-Redirect? Datasources Prometheus, Loki und InfluxDB 3 Core gruen?",
      "notes": "ersetzt alten Grafana-Altstand und Uptime-Kuma-Views"
    },
    "monitoring-influxdb3-core": {
      "description": "Zeitreihen- / Metrikdaten fuer Monitoring und Home Assistant",
      "tier": 3,
      "category": "ops",
      "container_name": "monitoring-influxdb3-core",
      "dependencies": ["monitoring-grafana"],
      "url": null,
      "dump_file": null,
      "data_paths": [
        "/mnt/user/appdata/influxdb3/data",
        "/mnt/user/appdata/influxdb3/plugins"
      ],
      "first_check": "LAN-Port 8181 erreichbar? 401 ohne Token = OK (erwartet). Disk-Space?",
      "notes": "LAN-only Host-Port 8181; kein frontend_net; laeuft als user 0"
    },
    "scrutiny": {
      "description": "Laufwerks- / SMART-Monitoring",
      "tier": 3,
      "category": "ops",
      "container_name": "scrutiny",
      "dependencies": ["traefik"],
      "url": "https://scrutiny.kaleschke.info",
      "dump_file": null,
      "data_paths": [
        "/mnt/user/appdata/scrutiny/config",
        "/mnt/user/appdata/scrutiny/influxdb"
      ],
      "first_check": "Device-Mounts vorhanden? privileged=true gesetzt? Traefik erreichbar?",
      "notes": "privileged: true dokumentierte Ausnahme"
    },
    "glances": {
      "description": "System- / Container-Monitoring",
      "tier": 3,
      "category": "ops",
      "container_name": "glances",
      "dependencies": ["traefik"],
      "url": "https://glances.kaleschke.info",
      "dump_file": null,
      "data_paths": [],
      "first_check": "Docker-Socket lesbar? rootfs gemountet? Traefik erreichbar?",
      "notes": "rebuildbar; Docker-Socket und rootfs Mounts"
    },
    "borg-ui": {
      "description": "Borg Backup- / Restore UI",
      "tier": 3,
      "category": "ops",
      "container_name": "borg-ui",
      "dependencies": ["traefik"],
      "url": "https://borg.kaleschke.info",
      "dump_file": null,
      "data_paths": [
        "/mnt/user/appdata/borg-ui/data",
        "/mnt/user/backups/borg/dumps"
      ],
      "first_check": "Borg-Repo-Credentials vorhanden? Backup-Mounts erreichbar? Traefik healthy?",
      "notes": "breite Mounts bewusst dokumentiert; /local/secrets im DR-Scope"
    },
    "hermes-gateway": {
      "description": "Hermes Agent Gateway / AI Ops Assistant",
      "tier": 3,
      "category": "ops",
      "container_name": "hermes-gateway",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/hermes-agent/data"],
      "first_check": "hermes_net:8642/health erreichbar? SSH-Key gemountet? LLM-Provider erreichbar?",
      "notes": "kein Docker-Socket; SSH terminal backend; echte .env auf Host-Appdata"
    },
    "ddns-updater": {
      "description": "Cloudflare / DDNS Aktualisierung",
      "tier": 3,
      "category": "infra",
      "container_name": "ddns-updater",
      "dependencies": [],
      "url": null,
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/ddns-updater"],
      "first_check": "Internetzugang? Cloudflare API erreichbar? Config vorhanden?",
      "notes": "bewusst in frontend_net weil backend_net internal ist"
    },
    "code-server": {
      "description": "Web-Editor / Operations Workspace",
      "tier": 3,
      "category": "ops",
      "container_name": "code-server",
      "dependencies": ["traefik"],
      "url": "https://code.kaleschke.info",
      "dump_file": null,
      "data_paths": [
        "/mnt/user/appdata/code-server",
        "/mnt/user/services/dev"
      ],
      "first_check": "Traefik erreichbar? PASSWORD_FILE lesbar?",
      "notes": "PASSWORD_FILE; Workspaces bei Restore beachten"
    },
    "filebrowser": {
      "description": "Datei-Browser fuer Appdata",
      "tier": 3,
      "category": "ops",
      "container_name": "filebrowser",
      "dependencies": ["traefik"],
      "url": "https://files.kaleschke.info",
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/filebrowser"],
      "first_check": "Appdata-Mounts erreichbar? Traefik healthy?",
      "notes": "breiter /mnt/user/appdata Mount; Einschraenkung langfristig als TODO"
    },
    "speedtest-tracker": {
      "description": "Speedtest-Monitoring",
      "tier": 3,
      "category": "ops",
      "container_name": "speedtest-tracker",
      "dependencies": ["traefik"],
      "url": "https://speedtest.kaleschke.info",
      "dump_file": null,
      "data_paths": ["/mnt/user/appdata/speedtest-tracker/config"],
      "first_check": "APP_KEY gesetzt? Internetzugang fuer Speedtest vorhanden?",
      "notes": "APP_KEY, ADMIN_PASSWORD als Stack ENV"
    },
    "bentopdf": {
      "description": "PDF-Tooling",
      "tier": 3,
      "category": "app",
      "container_name": "bentopdf",
      "dependencies": ["traefik"],
      "url": "https://pdf.kaleschke.info",
      "dump_file": null,
      "data_paths": [],
      "first_check": "COOP/COEP Middleware gesetzt? Traefik healthy?",
      "notes": "rebuildbar; keine kritische Persistenz"
    }
  }
}