Server

A single Ubuntu 24.04 LTS machine runs everything Teletype Games uses: the portal, the Git server, CI, the wiki, project management, analytics and the BBSes. Nearly every service is a Docker Compose stack, and Nginx is the entry point for all of them. This page is the public digest; the detailed operations documentation is internal (VPS assistant).

Overview

graph LR
  Internet -->|HTTPS| Nginx
  Internet -->|SSH| Gitea
  Internet -->|telnet| BBS[BBSes]
  Internet -->|FTP| FTP[FTP server]
  Nginx --> Gitea
  Nginx --> Woodpecker
  Nginx --> WebApp[Teletype Games portal]
  Nginx --> Grav[Grav wiki]
  Nginx --> Redmine
  Nginx --> Matomo
  Nginx --> ResourceSpace
  Nginx --> UptimeKuma[Uptime Kuma]
  Nginx --> Grafana
  Nginx --> Authentik
  Nginx --> GoAccess
  Nginx --> Static[Static sites]
  Woodpecker -->|build + deploy| WebApp
  Statusbot --> Discord
  Updater --> Discord
  UptimeKuma --> Discord
  Grafana -->|alerts| Discord

Services

Public addresses

The legacy *.teletype.hu and *.vps.teletype.hu names redirect to their teletypegames.org counterparts. Open ports are listed on Server ports.

How it runs

• Docker Compose stacks: every service has its own directory and compose file; most are git checkouts, so the configuration is version-controlled. A shared Makefile starts, stops and updates all of them.
• Every image is pinned to a version; no latest for external images. Updates are manual, monthly, preceded by a database dump.
• Container ports bind to localhost only; everything reaches the internet through Nginx. The exceptions are Gitea SSH and the three telnet BBSes.
• Automatic security updates (unattended-upgrades) on the host; a manual reboot after kernel updates.
• Configuration under version control: the Nginx config in its own git repository, the rest of /etc via etckeeper.

Security

• TLS everywhere, HSTS and the usual security headers; hidden files (.git, .env) blocked on every vhost.
• Admin interfaces (container manager, database admins, Webmin, Prometheus, Loki) are not on the internet; they are reachable only through an SSH tunnel. Grafana is public, but sign-in is Gitea-only, with no password login.
• The firewall (ufw) denies by default; root cannot log in over SSH, only explicitly allowed admin accounts.
• fail2ban bans SSH, Gitea, Redmine and web brute-force attempts at the nftables level, so it covers container ports too.
• auditd logs administrative commands; AIDE verifies system-file integrity daily.
• The Git server rejects AI-training and scraper bots that ignore robots.txt by user agent; expensive Gitea paths (diff, blame, archives) are off-limits to all crawlers.
• Every application connects to its database with its own user, scoped to its own schema.

Backups

Two chains: nightly database dumps (Gitea included) plus a mirror of every Gitea repository, followed by an rsync-based full mirror of all stacks, configuration and dumps to an off-site NAS. No versioning: the NAS always holds the latest state. Details: Backup.

Retired services

Recent changes

• 2026-10-23 – Gitea (with its own database) and Woodpecker moved out of the portal's stack into stacks of their own; Traefik retired, Nginx proxies straight to every service.
• 2026-10-18 – Uptime Kuma moved to uptime.teletypegames.org (monitor.* redirects; push and badge URLs keep working). Matomo moved to matomo.teletypegames.org (the old address redirects) and upgraded to 5.14. Matomo, Uptime Kuma and GoAccess moved behind Authentik sign-in (the GoAccess password is gone); a sign-in lasts half a year. Grafana dashboards grouped by title prefix instead of folders.
• 2026-10-17 – Resource tuning: Netdata retired, its alerts moved to Grafana; 4 GB swap, a memory limit on every container, lighter Apache and cAdvisor load (the machine's CPU use dropped to about a third).
• 2026-10-16 – Grafana public at grafana.teletypegames.org with Gitea sign-in; new dashboards (backup, ports, TLS, uptime, databases, BBS, logs, Gitea, Redmine, CI); ufw rules narrowed to TCP.
• 2026-10-16 – Backup: restic retired, replaced by an rsync-based full file mirror to the NAS (vps-backup-sync); the Gitea database joined the nightly dumps.
• 2026-09-13 – GoAccess traffic report; bot filtering and robots.txt on the Git server; etckeeper.
• 2026-09-11 – Post-audit overhaul: container ports moved to localhost, admin UIs behind SSH tunnel, fail2ban, auditd, AIDE, restic backups, Netdata; the portal switched to production mode; image versions pinned; Redmine, Matomo and Uptime Kuma upgraded; Orbit and Wiki.js retired.
• 2026-09-10 – Gitea security incident (CVE-2026-59774), contained the same day, Gitea upgraded to 1.27.1.