Platform architecture

Role split

neuralmeadow.xyz is the “app + mail + SSO” node. auxserver-prod is the raw Ubuntu Docker/Caddy node for heavier self-hosted stacks (Nextcloud, n8n, Radicale, HeyPuter, portal static).

That split keeps packaging models from fighting each other:

Concern	This host	Aux
App install UX	yunohost app install	Compose files under ~/
TLS / HTTP	Nginx + cert hooks	Caddy
Identity	OpenLDAP + SSOwat	Per-app / vault / keys
Mail	Full MTA/MDA stack	Generally not primary mail
VPN	Tailscale on-host	Often admin path via keys/SSH

Stack shape

Internet
  ├─ mail ports → Postfix / Dovecot (+ OpenDKIM, postsrsd)
  ├─ 80/443 → Nginx → app vhosts + SSOwat Lua
  ├─ 22 → sshd
  └─ LDAP(S) → slapd (directory)

Apps (packaged) ── MariaDB / PostgreSQL on localhost
Optional Docker ── bridge network for non-ynh workloads
Tailscale ── mesh admin + MagicDNS resolver preference

Why keep this platform

• Fast multi-app hosting with shared users
• Integrated mail for @ domains you control
• Diagnosis and backup CLIs aimed at solo operators
• SSOwat reduces per-app login sprawl

Why not put everything on this host

Large stateful products and custom Compose fleets have been standardized on aux (Caddy loopback pattern, operator skills, portal). Fighting this host’s nginx/SSO assumptions for those stacks costs more than a second VM.

See aux system architecture.