operations

🌐 Public Routes

Canonical map for moincraft.de subdomains, path routes, and future clean split between workspace wiki, Moincraft runtime, AIRI, Nexus, status, and KB.

Current live truth#

Surface Current public entry Backend/source Notes
Workspace/operator wiki https://wiki.moincraft.de/ /home/mc/wiki -> /var/www/moincraft-wiki/current Static Hugo release.
Moincraft app/game https://moincraft.de/ 127.0.0.1:4173 Main public app surface.
AIRI https://airi.moincraft.de/ 127.0.0.1:55466, 127.0.0.1:55467 UI plus LLM proxy routes.
Nexus https://moincraft.de/nexus/, https://moincraft.de/nexus-ws 127.0.0.1:18789, 127.0.0.1:18790 Keep compatibility until a dedicated subdomain has valid TLS.
Manifest/status https://moincraft.de/manifest/ /var/www/manifest Static map; treat generated facts as refreshable.
Moincraft relay https://moincraft.de/relay/ 127.0.0.1:55667 Operational API surface; do not broaden exposure casually.
MindServer https://moincraft.de/mindserver/ 127.0.0.1:55668 Operational API/WebSocket surface.
Prismarine viewer https://moincraft.de/viewer/ 127.0.0.1:55669 No built-in auth; protect before public use.
Minecraft moincraft.de:25565 Paper server Game server.

Clean target split#

Target Purpose Cutover rule
wiki.moincraft.de Workspace/operator wiki Already live; source is /home/mc/wiki.
moincraft.de Public Moincraft app/game Keep main domain focused on player-facing runtime.
airi.moincraft.de AIRI UI and LLM proxy Already live.
nexus.moincraft.de Nexus dashboard/API Enable only after TLS is valid; keep /nexus/ compatibility.
status.moincraft.de Static status/manifest Enable only after TLS is valid; keep /manifest/ compatibility.
kb.moincraft.de Optional KB board Enable only when KB is intentionally running behind basic auth and SSE-safe proxying.
research.moincraft.de Optional generated LLM/research wiki Needs public-safety review before exposure.

DNS currently resolves the planned nexus, status, and kb names to the server, but live TLS validation for those names is not valid yet. Do not enable HTTPS vhosts for them until certificate coverage is fixed and nginx -t passes.

KB proxy pattern#

@dustinbyrne/kb@0.4.1 does not provide a built-in dashboard password wall. If kb.moincraft.de is ever enabled, it must be a passworded reverse proxy in front of a local KB process:

server {
    listen 443 ssl http2;
    server_name kb.moincraft.de;

    auth_basic "OMP KB";
    auth_basic_user_file /etc/nginx/htpasswd-kb;

    location / {
        proxy_pass http://127.0.0.1:4040;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_read_timeout 1h;
    }
}

Do not put real usernames, password hashes, tokens, or private upstream details in this wiki.