---
title: IT Tools
description: Install IT Tools, a self-hosted collection of handy utilities for developers, converters, encoders, formatters, and more.
---


:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

[IT Tools](https://github.com/CorentinTh/it-tools) is a container exposing a web page that provides access to a wide range of development tools.

![IT Tools](/img/serveex/it-tools.png)

## Installation

::steps{level="3"}
### Deploy the stack

Open Dockge, click on `compose`, name the stack `it-tools`, and paste the following:

```yaml [compose.yaml]
---
services:
  it-tools:
    container_name: it-tools
    restart: unless-stopped
    image: corentinth/it-tools:latest
    ports:
      - 3222:80
```

::tip{icon=""}
✨ __Tip:__ Add the Watchtower label to each container to enable automatic updates.

    ```yaml [compose.yaml]
    services:
      it-tools:
        #...
        labels:

          - com.centurylinklabs.watchtower.enable=true
    ```
::

Deploy the container and visit `http://yourserverip:3222`. That’s it, your IT Tools web UI instance is up and running!

### Done !
::

::caution

__If it fails:__ check your firewall rules.
::

## Expose IT Tools with Swag
You might want to access it remotely on all your devices. To do that, we'll expose IT Tools using Swag.

::note

__Pre-requisite:__ We assume you’ve created a subdomain like `tools.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` set to `yourdomain.com`. Also, unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure you’ve already forwarded port `443` from your router to port `443` on your server in the [NAT rules](/general/networking/nat).
::

::steps{level="3"}
### Add IT Tools' network to SWAG

In Dockge, go to the SWAG stack and edit the compose file to add the IT Tools network:

```yaml [compose.yaml]
---
services:
  swag:
     container_name: # ...
      # ...
     networks:              # Connects the container to the custom network 
      # ...           
      - it-tools            # Network name as defined in the IT Tools stack
    
networks:                   # Defines the custom network
  # ...
  it-tools:                 # Network name as defined in the IT Tools stack
    name: it-tools_default  # Actual name of the external network
    external: true          # Indicates it's an external network
```

::note

We assume the IT Tools network is named `it-tools_default`. You can check connectivity by visiting the SWAG dashboard at http://yourserverip:81.
::

::note

We also assume the SWAG network is named `swag_default`.
::

Restart the stack by clicking "deploy" and wait for SWAG to be fully operational.

### Create the subdomain.conf file

Inside the Swag folders, create the file `tools.subdomain.conf`.

::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
::

```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/proxy-confs/tools.subdomain.conf
```

Paste the configuration below:

```nginx [tools.subdomain.conf]
## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name tools.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app it-tools;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}
```

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

### Done !
::

And that’s it! IT Tools is now exposed!

## Protecting IT Tools with TinyAuth
Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `tools.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy):

```nginx [tools.subdomain.conf]{26-38,41-42}
## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name tools.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location /tinyauth {
        internal;
        proxy_pass http://tinyauth:3000/api/auth/nginx;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
    }

    location @tinyauth_login {
        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
    }

    location / {
        auth_request /tinyauth;
        error_page 401 = @tinyauth_login;

        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app it-tools;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}
```

::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
::

::tip{icon=""}
✨ __Tip:__ You can secure this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `tools.subdomain.conf` and uncommenting the lines `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and a provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
::
