SKYHOUSE.dev Journal

Why: Documenting active services that pre-date the journal — captured during the 2026-05 audit so the cheat sheet has a citation target.

Three personal-use containers were found running and healthy during the audit: a self-hosted Bitwarden-compatible vault, an AirDrop-style local file sharing tool, and a shared photo-moments app. None had Compose files under /home/plex — they appear to be standalone docker run deployments. This entry records their current wiring so we have a reference for future maintenance.

1. Vaultwarden — vault.skyhouse.dev

Vaultwarden (vaultwarden/server:latest) is the household password manager, providing a Bitwarden-compatible API and web vault. NPM proxy host 20 (20.conf) routes vault.skyhouse.dev to the container via Docker DNS (vaultwarden:80), which means NPM and the container share a Docker network.

The proxy host has an IP allowlist that restricts access to the LAN and Docker bridge ranges — specifically 192.168.1.0/24 and 172.16.0.0/12 — followed by deny all. Vaultwarden is therefore not externally reachable; you must be on the LAN or tunneled in. The TLS cert is npm-31. No Compose file was found; if the container is ever lost it will need to be recreated from the original docker run parameters (data directory TBD from container inspect).

2. Pairdrop — share.skyhouse.dev / share.botaa.org

Pairdrop (lscr.io/linuxserver/pairdrop:latest) provides browser-based peer-to-peer file transfers without account creation — effectively AirDrop for the LAN and any device with a browser. Unusually, it is fronted by two NPM proxy hosts pointing at the same backend on port 3000:

• NPM 18 (18.conf) → share.skyhouse.dev, cert npm-28
• NPM 19 (19.conf) → share.botaa.org, cert npm-29

Both hostnames are public (no allowlist). No Compose file found — standalone container.

3. SharedMoments — btst.skyhouse.dev

SharedMoments (techkev/sharedmoments) is a lightweight shared photo album app. NPM proxy host 25 (25.conf) routes btst.skyhouse.dev → 192.168.1.136:5001, cert npm-40. The container is live and there is no Compose file — it runs as a standalone docker run deployment. The btst_default Docker network is in active use by this container and must not be removed — an earlier audit draft wrongly flagged it as stale.

All three of these containers lack Compose files, which means their restart flags and volume mounts live only in the running container's configuration — worth capturing via docker inspect before any host maintenance that might lose running-container state.