Remove decorative dashes and fix two broken admonitions

2026-08-30 19:53:57 +02:00
parent bb1a482a8d
commit 022a9d96bd
77 changed files with 10 additions and 239 deletions
@@ -186,7 +186,6 @@ Install and deploy Vaultwarden
 ::

 ## Coming Soon
---

 - Homepage, to have all your services at a glance and access them easily
 - Mkdocs for your documentation
@@ -13,7 +13,6 @@ description: Step-by-step guide to install Debian 13 on a home server and set up
 ![picture](/img/serveex/server.svg)

 ## Installation
---

 1. [BIOS Setup](https://www.debian.org/releases/stable/i386/ch03s06.en.html#bios-setup)
 2. [Download Debian Image](https://www.debian.org/download.en.html)
@@ -41,7 +40,6 @@ description: Step-by-step guide to install Debian 13 on a home server and set up
 9. Optional - [Wake Server Remotely (WoW - WoL)](https://dev.to/zakery1369/enable-wake-on-lan-on-debian-4ljd)

 ## Must-Have CLI Apps
---
 Some essential apps you’ll likely need at some point, so might as well install them early:
 ```sh
 sudo apt update
@@ -55,7 +53,6 @@ Additionally:
 - [lazydocker](https://github.com/jesseduffield/lazydocker) - CLI Docker container manager

 ## Useful Features
---
 ### Firewall

 - [ufw](https://www.zenarmor.com/docs/network-security-tutorials/how-to-set-up-a-firewall-with-ufw-on-debian)
@@ -20,7 +20,6 @@ Docker, to install deployable services in seconds and manage them with just a fe
 ![picture](/img/serveex/docker.svg)

 ## Install Docker
---
 Add the Docker repositories and GPG key:

 ```sh
@@ -55,7 +54,6 @@ From here on, we assume the stacks are installed in the `/docker` folder, create
 ::

 ## Install [Dockge](https://github.com/louislam/dockge) to manage and deploy containers
---
 [Dockge](https://github.com/louislam/dockge) is a web tool to create, configure, launch, and manage Docker containers. It's a simple, intuitive interface that’s lighter and easier for beginners than using the CLI or Portainer.

 ![picture](/img/serveex/dockge.png)
@@ -123,7 +121,6 @@ More info on [Dockge and how to use it](https://github.com/louislam/dockge)
 And there you go — Docker and a tool to easily manage your containers are ready!

 ## [Watchtower](https://watchtower.nickfedor.com/), to auto-update containers
---
 Watchtower is a container that checks for updates and pulls new images automatically, just by adding a label in your containers’ `compose.yml` files.

 ### Configuration
@@ -31,7 +31,6 @@ Below is an example exposing Dockge. We will install SWAG along with the dbip mo
 ![Picture](/img/serveex/reverse-proxy.svg)

 ## Installation
---

 ::note

@@ -182,14 +181,12 @@ include /config/nginx/dbip.conf;
 Restart the stack in Dockge. This time, the SSL certificate should be successfully generated! Check the logs to confirm the server is ready.

 ## Dashboard
---
 Access the dashboard locally by going to `http://yourserverip:81`
 On the left, you'll see a list of currently "proxied" services (none yet). On the right, the list of banned IPs. Below, various indicators. For more details, [click here](https://www.linuxserver.io/blog/introducing-swag-dashboard).

 ![picture](https://www.linuxserver.io/user/pages/03.blog/introducing-swag-dashboard/example.png)

 ## DBIP
---
 DBIP allows you to block connections based on countries. It relies on the configuration file named `dbip.conf` located in `/docker/swag/config/nginx`. [More info here](https://virtualize.link/secure/).

 In this example, we’ll configure it to block a list of countries known to be the source of most malicious traffic. We’ll also configure a variable to allow internal server traffic, your box’s local network, and a potential VPN in the 10.x.x.x range to access your services — but not the open internet.
@@ -267,7 +264,6 @@ server {
 ```

 ## Exposing Dockge
---
 ::note
 📋 __Prerequisite:__ <br/><br/>
 We assume that you have created a subdomain like `dockge.mydomain.com` in your [DNS zone](/general/networking/dns), with a `CNAME` pointing to `mydomain.com` and — unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare) — that you've forwarded port `443` from your router to the server's `443` in [your NAT rules](/general/networking/nat).
@@ -363,7 +359,6 @@ Redeploy the SWAG stack.
 Wait a moment, then visit `https://dockge.mydomain.com` in your browser — you should be redirected to Dockge. You can also check the service status from the dashboard (`http://yourserverip:81` on your local network).

 ## Exposing Another Service with SWAG
---
 SWAG includes templates for most known services, named `servicename.subdomain.conf.sample`. Just create the subdomain in your registrar's DNS zone (like OVH), point it to your main domain via a CNAME, then copy and rename the sample file:

 ```sh
@@ -16,7 +16,6 @@ description: Install and configure WireGuard VPN to securely access your homelab
 ::

 ## Introduction
---
 Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.

 Here we will use [Wireguard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
@@ -49,7 +48,6 @@ You *can* allow VPN clients to share access to their local networks, but we won
 So only VPN-connected devices can communicate with each other on the VPN, not with other local devices outside the VPN.

 ## Server Setup
---
 ::note
 📋 **Pre-flight Checklist:**

@@ -168,7 +166,6 @@ To configure clients:
 5. Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)

 ## Client Server Setup
---
 ::note

 We assume the client server runs Linux with Docker installed.
@@ -244,7 +241,6 @@ Repeat this setup for each client.
 ::

 ## Other Devices
---

 - **Mobile:** Install WireGuard and scan the QR code via the web UI (`http://server-ip:51821`)
 - **Desktop:** Install the WireGuard client and import the downloaded config file.
@@ -38,7 +38,6 @@ There are two main modes you should know:
 Both modes can be configured on a per-application basis.

 ## Installation
---
 Folder structure:
 ```sh
 root
@@ -202,7 +201,6 @@ __Warning:__ It’s recommended to create a new admin account and **disable** th
 ::

 ## Exposing Authentik
---
 To use Authentik outside your local network, you must expose it.

 ::note
@@ -299,7 +297,6 @@ Restart the stack and wait for SWAG to be fully operational.
 Done! You can now access Authentik via `https://auth.mydomain.com`

 ## Enable Multifactor Authentication
---
 The main value of Authentik is using multifactor authentication for all protected apps.

 - Go to `https://auth.mydomain.com`
@@ -313,11 +310,9 @@ The main value of Authentik is using multifactor authentication for all protecte
 You’ll now be prompted to enter a one-time code at every login.

 ## Protecting a Native App
---
 Authentik is natively compatible with several applications. You can find the list and [support here](https://docs.goauthentik.io/integrations/services/).

 ## Protecting an App via Reverse Proxy
---
 SWAG lets you insert Authentik’s login page between a request and access to your service. To do this:

 - Configure the authentication provider in Authentik.
@@ -372,7 +367,6 @@ Your new architecture looks like this:
 ![Picture](/img/serveex/authentik.svg)

 ## Protecting a Remote Server Service
---
 For a [native application](/serveex/security/authentik/#protecting-a-native-app) (via OAuth 2.0 or other), nothing changes.

 For a non-native app behind a reverse proxy, you must deploy an __Outpost__. An Outpost is a container acting as a local proxy — it's the target of your app's auth requests and the only one authorized to communicate with your Authentik API.
@@ -562,7 +556,6 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
 Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/security/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).

 ## Migrating an Authentik Database
---
 On the source machine, dump the database:

 ```sh
@@ -19,7 +19,6 @@ description: Use Cloudflare Tunnels and Zero Trust to expose homelab services wi
 ![cloudfare_tunnels](/img/serveex/cloudflared.svg)

 ## Introduction
---
 The _Zero Trust_ architecture is the practice of designing systems based on the principle of __"never trust, always verify"__, as opposed to the traditional principle of __"trust, but verify"__. This concept has become increasingly popular recently due to the growing number of attacks targeting user data. It’s a broad concept, but we’ll focus on how to apply _Zero Trust_ to the web services we host.

 _Cloudflare tunnels_ offer a simple way to implement _Zero Trust_, using [SWAG](/serveex/core/swag) and [Authentik](/serveex/security/authentik).
@@ -43,7 +42,6 @@ Here we’ll explain how to integrate SWAG with Cloudflare tunnels.
 ::

 ## Cloudflare Configuration
---
 ### DNS Zone

 First, you need to set Cloudflare as your [DNS zone](/general/networking/dns) manager. If you bought your domain from Cloudflare, that’s already done. Otherwise, check with your registrar how to add external DNS servers. Cloudflare provides [step-by-step documentation](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/) on how to configure a DNS Zone, whether your domain is external or registered with Cloudflare.
@@ -75,7 +73,6 @@ You must register for _Cloudflare Teams_ to access the _Zero Trust_ dashboard th
 Register [via this link](https://dash.teams.cloudflare.com/).

 ## SWAG Configuration
---
 ::note

 This guide assumes you own `mondomaine.fr` and that its DNS is correctly pointing to Cloudflare, as described above.
@@ -231,7 +228,6 @@ Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero
 ::

 ## Managing Multiple Tunnels for Multiple Servers
---
 By default, all subdomains of your domain are routed through the single tunnel. But if you have a second server, just change the tunnel name in that SWAG instance.

 In your DNS zone, redirect subdomains to the correct tunnel.
@@ -20,7 +20,6 @@ description: Install Uptime-Kuma to monitor your self-hosted services uptime, se
 ![picture](https://user-images.githubusercontent.com/1336778/212262296-e6205815-ad62-488c-83ec-a5b0d0689f7c.jpg)

 ## Installation
---
 Folder structure

 ```sh
@@ -19,7 +19,6 @@ description: Install Dozzle to monitor Docker container logs in real time from a
 ![Dozzle](https://blog.unixhost.pro/wp-content/uploads/2023/03/image-5.png)

 ## Installation
---
 Folder structure

 ```sh
@@ -73,7 +72,6 @@ DOMAIN=dozzle.mydomain.com
 Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web UI is up and running!

 ## Exposing Dozzle with Swag
---

 ::warning

@@ -19,7 +19,6 @@ description: Install Speedtest Tracker to automatically measure and log your int
 ![speedtest-tracker](/img/serveex/speedtest-tracker.avif)

 ## Installation
---
 ::note

 We will use the Docker image maintained by [LinuxServer.io](https://docs.linuxserver.io/images/docker-speedtest-tracker/)
@@ -91,7 +90,6 @@ PORT=3225 # port to access the web UI
 Deploy the container and go to `http://yourserverip:3225`. Log in with the account `[email protected]` and the password `password`. Don’t forget to change your ID and password once logged in!

 ## Expose Speedtest Tracker
---
 ::note
 📋 **Prerequisites:**  
 We assume that you've already created a subdomain like `speedtest.yourdomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `yourdomain.com`, and [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), you've also forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/networking/nat).
@@ -23,7 +23,6 @@ Beszel includes a hub with a web UI and an agent that collects data from your se
 ![Beszel](/img/serveex/beszel.png)

 ## Installation
---

 Folder structure

@@ -147,7 +146,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Expose Beszel with Swag
---

 ::warning

@@ -19,7 +19,6 @@ description: Install UpSnap to remotely wake up machines on your local network v
 ![Beszel](/img/serveex/upsnap.webp)

 ## Installation
---

 Folder structure

@@ -86,7 +85,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Exposing UpSnap with Swag
---

 ::warning

@@ -32,7 +32,6 @@ You’ll need to create a *Plex.tv* account. You don’t need to expose your Ple
 ::

 ## Install Plex
---
 Folder structure:
 ```sh
 root
@@ -144,7 +143,6 @@ You must be on your local network during Plex's initial setup. Otherwise, the UR
 ::

 ## Configure Plex
---
 Plex offers a range of free movies/shows. After creating your account, I recommend disabling everything in the _Online Services_ section to keep your library clean.

 Then go to the _Remote Access_ section and manually select a port (we’ll use `1234`). It's best not to use the default port.
@@ -173,7 +171,6 @@ If your media is stored on a network disk (e.g. NAS or external hard drive over
 ::

 ## Expose Tautulli with Swag
---
 You don’t need to expose Plex, as it's accessible via your Plex account on plex.tv.  

 However, you may want to expose Tautulli so you can view stats from a simple URL when you're not home.
@@ -29,7 +29,6 @@ Here’s the system we’ll set up:
 ![Picture](/img/serveex/qbit.svg)

 ## Configuration
---
 Folder structure

 ```sh
@@ -192,7 +191,6 @@ Detailed info:
 | `PW`       | Qbittorrent UI password | `password` |

 ## Deployment
---
 Once done, deploy the container.

 ::warning
@@ -214,7 +212,6 @@ You're done! In Qbittorrent settings, under "Downloads", set `/media/downloads`
 When adding a download, remember to select the proper directory so Plex can sync correctly (`/media/movies` or `/media/tvseries`). You can also automate this with categories and folders.

 ## Exposing the Web UI
---

 ::warning

@@ -25,7 +25,6 @@ Simple.
 We’ll start by deploying the stack and then proceed to configure each app and understand how they work.

 ## Install the Apps
---

 ### Docker Compose

@@ -232,7 +231,6 @@ MEDIA_PATH=
 Deploy the stack.

 ### Configure Radarr
---

 Radarr queries your torrent sources and lets you define the type of releases to prioritize. It can also upgrade your movies if a better version is available.

@@ -284,7 +282,6 @@ Go to *Settings > Connect*, add a new connection and choose *Plex Media Server*.
 - Go to *Settings > General* and copy your *API Key* for later use.

 ### Configure Sonarr
---

 Sonarr queries torrent sources and defines what kind of TV series releases to prioritize. It also upgrades series when better versions are available.

@@ -297,7 +294,6 @@ __If it fails:__ check your firewall rules.
 ::

 ### Configure Prowlarr
---

 Prowlarr acts as a proxy to manage your torrent indexers and link them to Radarr and Sonarr.

@@ -322,7 +318,6 @@ In *Settings > Apps*, add Radarr and Sonarr with the following details:
 - Click *Test*, then *Save* if all goes well.

 ### Configuring Bazarr
---
 Bazarr is an app that automatically searches for the correct subtitles in your preferred languages for all the movies and TV shows added by Radarr and Sonarr.

 Go to `http://yourserverip:6767`.
@@ -364,7 +359,6 @@ Go to *Settings > General* and create a username and password using *forms login
 Repeat the same steps for Radarr.

 ### Configuring Overseerr
---

 [Overseerr](https://overseerr.dev/) is an app that lets you browse a movie catalog and send requests to Sonarr and Radarr. Just browse movies or series, click *Request*, and the media will automatically be downloaded according to your Radarr or Sonarr settings. If the title hasn’t been released yet, it will be downloaded automatically when available. This way, episodes of a series appear in Plex without any manual intervention.

@@ -416,7 +410,6 @@ If the test succeeds, continue filling in the fields:
 And that’s it! Just request a movie or series, then check in qBittorrent or Radarr/Sonarr. Within a few minutes, your media will be available on Plex!

 ## Exposing Overseerr with SWAG
---

 It can be useful to expose Overseerr if you want to send requests from outside your network without a VPN, or if you've shared your Plex library with others and want them to have Overseerr access.

@@ -16,7 +16,6 @@ description: Install Immich, a self-hosted alternative to Google Photos and iClo
 ![Picture](/img/serveex/immich.png)

 ## Installation
---
 Folder structure

 ```sh
@@ -51,7 +50,6 @@ Deploy the container.
 You're done! You can connect and follow the setup instructions at `http://yourserverip:2283`.

 ## Exposing Immich with SWAG
---
 The main benefit of this setup is being able to access Immich remotely on all your devices. We'll expose Immich using SWAG.

 ::note
@@ -16,7 +16,6 @@ description: Install Nextcloud to self-host your files, photos, and calendar —
 ![Picture](/img/serveex/nextcloud.png)

 ## Installation
---
 ::note

 We'll be using the Docker image maintained by [LinuxServer.io](https://docs.linuxserver.io/images/docker-nextcloud/)
@@ -84,7 +83,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Exposing Nextcloud with Swag
---
 The goal of this setup is to access Nextcloud remotely from all your devices. We’ll use Swag to expose the app.

 ::note
@@ -19,7 +19,6 @@ description: Install File Browser to browse and manage your server files from a
 ![File Browser](/img/serveex/filebrowser.png)

 ## Installation
---
 Open Dockge, click on `compose`, name the stack `filebrowser`, then copy and paste the following:

 ```yaml
@@ -58,7 +57,6 @@ __If it doesn’t work:__ check your firewall rules.
 ::

 ## Exposing File Browser with Swag
---

 ::warning

@@ -19,7 +19,6 @@ description: Install Pingvin Share, a self-hosted file sharing platform to send
 ![picture](/img/serveex/pingvin.png)

 ## Installation
---
 Open Dockge, click `compose`, name the stack `pingvin`, then copy-paste this:

 ```yaml
@@ -80,7 +79,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Exposing Pingvin with Swag
---
 The whole point of a solution like this is being able to access it remotely, from all your devices. To do this, we'll expose Pingvin through Swag.

 ::note
@@ -20,7 +20,6 @@ description: Install code-server to run VS Code in your browser from your homela
 ![code-server](https://github.com/coder/code-server/raw/main/docs/assets/screenshot-2.png)

 ## Installation
---
 ::note

 For this setup, we’ll use the [image maintained by LinuxServer.io](https://docs.linuxserver.io/images/docker-code-server/).
@@ -107,7 +106,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Mount Folders
---
 You can mount folders into VS Code by adding the relevant volumes in `compose.yaml` (or via Dockge), then redeploy the container.

 ```yaml
@@ -121,7 +119,6 @@ services:
 Once inside VS Code, you'll have access to the mounted folder.

 ## Expose code-server with Swag
---
 The whole point of such a solution is to access it remotely from any device. To do this, we’ll expose code-server via Swag.

 ::note
@@ -19,7 +19,6 @@ description: Install Gitea, a lightweight self-hosted Git service to manage your
 ![gitea](https://about.gitea.com/img/home-screenshot.png)

 ## Installation
---
 Folder structure

 ```sh
@@ -73,7 +72,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Exposing Gitea with Swag
---
 The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Gitea through Swag.

 ::note
@@ -19,7 +19,6 @@ description: Install IT Tools, a self-hosted collection of handy utilities for d
 ![IT Tools](/img/serveex/it-tools.png)

 ## Installation
---

 Open Dockge, click on `compose`, name the stack `it-tools`, and paste the following:

@@ -56,7 +55,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Expose IT Tools with Swag
---
 You might want to access it remotely on all your devices. To do that, we'll expose IT Tools using Swag.

 ::note
@@ -38,7 +38,6 @@ This is how ads and malicious domains are blocked—Adguard blocks only the bad
 ![Picture](/img/serveex/adguard.svg)

 ## Installation
---
 Folder structure:

 ```sh
@@ -101,7 +100,6 @@ Go to `http://yourserverip:3000` and follow the setup instructions.
 That’s it! Adguard is deployed.

 ## Exposing AdGuard with SWAG
---
 To make AdGuard usable from outside your home network, you need to expose it.

 ::note
@@ -242,7 +240,6 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 And that's it! AdGuard is now exposed!

 ## Configure SSL/TLS Encryption
---
 Encryption is essential if you want to keep your queries to AdGuard private. Encrypting your queries ensures that no one—not even your ISP—can see your history. It also ensures that only your server can respond to you.

 To configure encryption:
@@ -261,7 +258,6 @@ To configure encryption:
 Done! Your future DNS queries are now protected!

 ## Configure Devices
---
 You have several options (which you can combine) to configure your devices.
 ### Secure the Local Network
 You can secure your local network with AdGuard by configuring your router to direct all DNS queries by default to AdGuard instead of your ISP’s DNS. Note: your router must allow DNS changes (Orange routers do not).
@@ -299,6 +295,5 @@ In Windows, you need to configure AdGuard for each network adapter you want to u
 All programs using that network adapter will now be filtered by AdGuard.

 ## Add Filters
---

 - Go to the settings and change the filters.
@@ -18,7 +18,6 @@ description: Install Vaultwarden, a self-hosted Bitwarden-compatible password ma
 Vaultwarden is a fork of [Bitwarden](https://bitwarden.com/fr-fr/help/).

 ## Installation
---
 Folder structure:

 ```sh
@@ -108,7 +107,6 @@ __If it fails:__ check your firewall rules.
 ::

 ## Exposing Vaultwarden with SWAG
---
 The main benefit of Vaultwarden is being able to access it remotely from any device. We'll expose it through [SWAG](/serveex/core/swag).

 ::note