Services

What ISC³ runs besides the teaching machines: identity, VPN, backups, inventory, monitoring, alerting and the public web front (August 2026). Almost all of it lives as LXC containers and VMs on the rumba Proxmox node — the per-guest inventory (ID, address, resources) is on that page.

This page says what each service is and why it exists. The URL or address of every service, and what it asks you for, is the service access paths index in Operations.

Standing rules

• Publishing goes through the reverse proxy, never through the router. srv-web01 is the only guest reachable from the Internet and terminates TLS for every public name; adding a site means adding a vhost, not a port-forward.
• Published admin surfaces sit behind the admin gate — oauth2-proxy requiring the Keycloak group role-rack-admins in front of /admin paths. A published service that does work on a user's behalf sits behind the user gate instead — the same mechanism asking for isc or hevs.
• Identity is a chain for anything published: SWITCH edu-ID → Keycloak → the service. Keycloak is the only relying party the federation ever sees.
• Internal tools are gated by the VPN instead. NetBox, Oxidized, Healthchecks, ntfy, the status page and the mail relay are not published at all. NetBox still takes edu-ID through Keycloak; the others carry a local account or none, because they do not speak OIDC.

On-site services

Service	What it is	Runs on
Landing page & reverse proxy	The public front calypso.hevs.ch and the Caddy proxy that publishes every other public service; also serves the four static test sites	srv-web01, rumba
Keycloak	Identity broker federating to SWITCH edu-ID, manufacturing the group claims the other services consume	srv-keycloak, rumba
NetBird VPN	Self-service VPN — users enroll their own devices, access governed by identity groups; also the routing peer for the rack subnets	srv-netbird, rumba
NetBox	DCIM/IPAM source of truth — racks, U positions, cables, VLANs, prefixes and IP assignments for both sites	srv-netbox, rumba
Oxidized	Hourly pull of every network device's configuration into a git repo	srv-oxidized, rumba
Rack status & thermal alerts	Live state of every rack machine plus PDU readings, temperature history and the Telegram alert bot	srv-status, rumba
Healthchecks	Dead-man switch for the scheduled jobs — alerts when a backup or scrub stops pinging	srv-healthchecks, rumba
ntfy	Self-hosted push notifications, the alert path besides mail and Telegram	srv-ntfy, rumba
Outbound mail relay	The one Postfix relay every rack device and appliance submits to; holds the sole copy of the Infomaniak credential	srv-mail, rumba
Audience statistics	Umami — visitor counts and campaign attribution for every ISC web site, no cookie; tracker public, dashboard behind the admin gate	srv-stats (VM), rumba
Utility tools	Stirling-PDF, IT-Tools and CyberChef — three stateless browser tools for students and staff, the first user-facing wave	srv-stirling, srv-it-tools, srv-cyberchef, rumba
TISC Editor	Online Typst document editor and API, its own Keycloak login; migrated off the legacy VPS marcellus	srv-tisc-editor, rumba
UPS monitoring	NUT reading the rack UPS over USB — no network interface on the unit itself	rumba, host-level
Proxmox Backup Server	Off-host, deduplicated backups of rumba's guests	srv-pbs, a VM on the NAS

Three more services are documented elsewhere rather than here:

• Netdata — per-guest metrics, installed on the rumba host itself so every guest is collected without an agent: monitoring, rumba.
• ISC Learn DR mirror (VM 107) — a full Moodle restored from hannibal, kept as the disaster recovery copy: restore runbook.

Hosted elsewhere

Two Infomaniak VPS predate the rack. hannibal carries the ISC Learn Moodle platform and has its own section: ISC Learn. marcellus (legacy: LoRaWAN, WordPress sites) is compromised and to be discarded: external VPS — the TISC editor it used to carry has moved to its own guest.

The programme's public web sites — hub, landing page, curriculum, theses, clock, timetable, this documentation — are GitHub Pages builds, two of them also served from hannibal; the list, with where each one lives and its statistics id, is ISC web sites.

Planned

• GitLab — self-hosted, a future Keycloak client. The install runbook is in provisioning/gitlab/install-runbook.md.

Open items across all of the above: ops todo.