# Chapter Introduction

## Overview

This chapter documents the foundational infrastructure layer that all other services
depend on. These nine services form the backbone of the Centerpoint stack — handling
reverse proxying, TLS, identity, DNS, threat detection, logging, and observability.

## Services in This Chapter

| Service            | Container(s)                                                | Purpose                                      |
|--------------------|-------------------------------------------------------------|----------------------------------------------|
| **Traefik v3**     | `traefik`                                                   | Reverse proxy and TLS termination            |
| **Step-CA**        | `step-ca`                                                   | Internal ACME certificate authority          |
| **Portainer EE**   | `portainer`                                                 | Docker container management UI               |
| **Authentik**      | `authentik-server`, `authentik-worker`, `authentik-postgresql`, `authentik-geoip` | SSO / identity provider |
| **AdGuard Home**   | `adguardhome`                                               | LAN DNS resolver and ad blocking             |
| **CrowdSec**       | `crowdsec`, `crowdsec-bouncer-traefik`                      | Collaborative threat detection and blocking  |
| **Dozzle**         | `dozzle`                                                    | Real-time container log viewer               |
| **Uptime-Kuma**    | `uptime-kuma`                                               | Service uptime and endpoint monitoring       |
| **Homepage**       | `homepage`                                                  | Homelab dashboard                            |

## Dependency Order

When starting from scratch, services must come up in this order:

1. **AdGuard Home** — `*.home.local` DNS must resolve before anything can find its neighbours
2. **Step-CA** — required for Traefik to issue internal certificates on first boot
3. **Traefik** — all named HTTPS routes depend on it
4. **Authentik** (PostgreSQL → Server → Worker) — required before any externally-accessible service that enforces SSO
5. **CrowdSec** → **CrowdSec Bouncer** — bouncer cannot connect to LAPI until CrowdSec is healthy
6. All other infrastructure services (Portainer, Dozzle, Uptime-Kuma, Homepage) can start in any order

---
*Last Updated: 2026-06-16*