A central launchpad for infrastructure, identity, AI, email, secure file transfer, password management, machine secrets, DevOps, repositories, and private server operations.
v9 • Browser IDE • LAN Map • Mobile Friendly
Quick Access
🗄️
Configured
Synology NAS
DSM administration, storage, packages, certificates, reverse proxy, and Container Manager.
Access: Open https://code.yotamchopra.com from a browser and authenticate with the code-server password. The password value stays only on Bizon in ~/.config/code-server/config.yaml and is intentionally not stored on this dashboard.
Productivity: Keep source code, terminals, Git, Docker, Java/Maven, Python, Node/Angular and local AI tooling on the Bizon while using a lightweight browser from another computer. Your development environment stays persistent even when the client laptop changes.
🖥️
LAN / Private
Bizon AI Workstation
GPU workstation and local AI backend for Open WebUI, with three reserved/static LAN interfaces.
OSUbuntu / BizonOS
eno1192.168.1.30
enp179s0f1192.168.1.31
enp179s0f0192.168.1.32
AI RuntimeOllama :11434
Remote AccessSSH / RDP
Installed environment
CUDA 13.2 • NVIDIA stack • Ollama • local model experiments. Open WebUI on Synology uses Bizon as the local AI/model backend.
🏠
Configured
Home Lab Portal
This Web Station page is the central index for your home infrastructure and services.
URLyotamchopra.com
HostingSynology Web Station
File/volume1/web/index.html
LAN & Hosts
🐧
LAN / Private
ALMONDS Linux
Secondary Linux host with fixed Wi-Fi and Ethernet addresses for predictable local administration and services.
Wi-Fi · wlp2s0192.168.1.33/24
Ethernet · enp0s31f6192.168.1.34/24
Network StateStatic / wait-online cleared
💾
LAN / Private
Time Capsule
LAN backup and storage target mounted from Synology and used for Bizon backup/testing.
LAN IP192.168.1.238
ProtocolSMB
Synology Test~25.5 MB/s write · ~20.5 MB/s read
Bizon Test~8.6 MB/s write · ~70–75 MB/s read
Messaging & Communications
✉️
Configured
Synology MailPlus Server
Private email platform hosted on the Synology NAS for mailbox delivery, SMTP services, MailPlus web access, and mail administration.
Webmail: https://mail.yotamchopra.com
Mail services: Synology MailPlus Server / Postfix / Dovecot
TLS certificate: mail.yotamchopra.com
Keep mailbox passwords, SMTP credentials, relay credentials, DKIM private keys, API keys, and recovery information out of this public page.
📨
Reference
Email DNS & Deliverability
Reference area for the DNS and trust records that support reliable outbound and inbound email delivery.
Important DNSMX / SPF / DKIM / DMARC
Network RequirementPTR / Reverse DNS
PurposeMail Reputation & Delivery
Operational note
Treat mail as a separate infrastructure service from the dashboard itself. Public DNS, TLS certificates,
reverse DNS/PTR, port availability, and sender reputation all affect deliverability.
Secure File Transfer
📁
Configured
Synology SFTP
Secure file transfer service hosted on the Synology NAS using SFTP over SSH.
Inside the SFTP prompt: put filename uploads from local → NAS get filename downloads from NAS → local lls / lpwd / lcd operate on the local computer ls / pwd / cd operate on the Synology side
Keep the SFTP user restricted to only the shared folders it needs. Prefer SSH-key authentication for long-term Internet-facing use.
🔑
Reference
SFTP Access Notes
Connection reference for command-line clients, WinSCP, FileZilla, and future SSH-key authentication.
Hostsftp.yotamchopra.com
Port22022
EncryptionSSH
Preferred AuthSSH Key
Client settings
WinSCP / FileZilla settings:
Protocol: SFTP
Host: sftp.yotamchopra.com
Port: 22022
Username: use your dedicated SFTP account
Do not publish passwords or private SSH keys on this page.
Passwords & Secrets
🔒
Configured
Vaultwarden
Self-hosted Bitwarden-compatible password manager for passwords, secure notes, API keys, recovery information, and personal credentials.
Public URL: https://vault.yotamchopra.com
Admin URL: https://vault.yotamchopra.com/admin
Persistent data: /volume1/docker/vaultwarden/vw-data
Use Vaultwarden for human-managed secrets such as passwords, secure notes, API keys, recovery information, and credentials.
Do not place actual passwords, admin tokens, client secrets, private keys, or recovery codes on this dashboard.
🛡️
SSO Tuning
Vaultwarden SSO
Synology OIDC integration for Vaultwarden authentication. Initial OIDC authentication works; session handling and account-email alignment are being finalized.
Identity ProviderSynology SSO
ProtocolOIDC
Authoritysso.yotamchopra.com/webman/sso
Callback/identity/connect/oidc-signin
Current SSO notes
Synology authentication and Secure SignIn approval are working. Vaultwarden should use
Use SSO only for auth not the session lifecycle because Synology does not provide a refresh token in the current flow.
Also ensure the email returned by Synology SSO matches the existing Vaultwarden account before enabling automatic account linking.
Machine Secrets
🔐
Configured
OpenBao
Machine-to-machine secrets manager for application credentials, API keys, service tokens, database passwords, SMTP credentials, and CI/CD secrets.
Public URL: https://secrets.yotamchopra.com
Local API: http://127.0.0.1:8200
Container: openbao
Storage: Raft
Unseal model: 3 shares / threshold 2
Use OpenBao for machine/application secrets. Do not put the root token, unseal keys, AppRole Secret IDs,
private keys, or actual application passwords on this public dashboard.
🤝
Reference
OpenBao Machine Access
Applications should authenticate with a dedicated machine identity and narrowly scoped policy instead of using the root token.
Preferred AuthAppRole
Token ModelShort-lived / Policy-scoped
Example ConsumersSpring Boot / Jenkins / JFrog / Open WebUI
Each application should only be able to read its own path.
🧯
Recovery
OpenBao Restart / Recovery
After a NAS or container restart, OpenBao may start sealed and require any 2 of the 3 unseal keys before applications can read secrets.
Healthy StateSealed = false
Unseal RequirementAny 2 of 3 keys
BackupRaft snapshot + Hyper Backup
Quick recovery steps
1. Confirm the container is running.
2. Run bao status.
3. If sealed, run bao operator unseal twice using two different unseal keys.
4. Verify Sealed = false.
5. Test one known secret or application integration.
🧠
Rule of Thumb
Vaultwarden vs OpenBao
Keep human-managed credentials and machine-managed credentials separate.
VaultwardenSecrets for people
OpenBaoSecrets for machines
Simple memory aid
Vaultwarden = secrets for ME OpenBao = secrets for MACHINES
Development Productivity
⚡
Bizon Powered
Develop Anywhere, Compute on Bizon
Use any modern browser as the front end while the Bizon remains the persistent development and compute workstation.
Client FlexibilityWindows · Mac · Linux · tablet browser
Productivity advantages
• No need to duplicate SDKs and repositories across multiple client computers.
• Builds and containers use Bizon's CPU/GPU/storage instead of the client device.
• Terminal sessions, Git repositories and project configuration remain in one place.
• Open the same environment remotely without moving source files between machines.
• Local Ollama models can be integrated with coding tools without sending model workloads to another host.
Machine Secrets Values intentionally excluded from this page
JFrog Repository Map
Candidateeis-maven-candidate-local
Releaseeis-maven-release-local
Snapshoteis-maven-snapshot-local
Remotemaven-remote
Virtualeis-maven-virtual
Librarieslibs-release / libs-snapshot
Planned / Optional Services
🐳
Planned
Portainer
Optional Docker management UI for containers, stacks, logs, and runtime visibility.
Suggested URLportainer.yotamchopra.com
🌿
Planned
Gitea
Self-hosted Git service for templates, MuleSoft experiments, and home-lab repositories.
Suggested URLgit.yotamchopra.com
⚙️
Planned
Jenkins
CI/CD learning environment for build pipelines, artifact publishing, and deployment tests.
Suggested URLjenkins.yotamchopra.com
📊
Planned
Grafana
Monitoring and observability dashboard for NAS, containers, and AI services.
Suggested URLgrafana.yotamchopra.com
🧭
Planned
Git Governance
A future lightweight governance view for repositories, teams, templates, and delivery controls.
RoleGovernance / Visibility
🧠
Planned
EIS Learning Agent
A future local agent for architecture notes, integration patterns, CI/CD knowledge, and learning.
RoleLocal AI Assistant
Security: This v9 page intentionally includes your private LAN addressing for operational reference. If yotamchopra.com is publicly reachable, consider protecting this page with authentication or publishing a redacted public copy. Never place passwords, API tokens, OAuth client secrets, SSH/private keys, OpenBao root/unseal keys, recovery codes, or other secret values here.