Remove decorative dashes and fix two broken admonitions

2026-08-30 19:53:57 +02:00
parent bb1a482a8d
commit 022a9d96bd
77 changed files with 10 additions and 239 deletions
@@ -16,7 +16,6 @@ description: Install and configure WireGuard VPN to securely access your homelab
 ::

 ## Introduction
---
 Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.

 Here we will use [Wireguard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
@@ -49,7 +48,6 @@ You *can* allow VPN clients to share access to their local networks, but we won
 So only VPN-connected devices can communicate with each other on the VPN, not with other local devices outside the VPN.

 ## Server Setup
---
 ::note
 📋 **Pre-flight Checklist:**

@@ -168,7 +166,6 @@ To configure clients:
 5. Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)

 ## Client Server Setup
---
 ::note

 We assume the client server runs Linux with Docker installed.
@@ -244,7 +241,6 @@ Repeat this setup for each client.
 ::

 ## Other Devices
---

 - **Mobile:** Install WireGuard and scan the QR code via the web UI (`http://server-ip:51821`)
 - **Desktop:** Install the WireGuard client and import the downloaded config file.
@@ -38,7 +38,6 @@ There are two main modes you should know:
 Both modes can be configured on a per-application basis.

 ## Installation
---
 Folder structure:
 ```sh
 root
@@ -202,7 +201,6 @@ __Warning:__ It’s recommended to create a new admin account and **disable** th
 ::

 ## Exposing Authentik
---
 To use Authentik outside your local network, you must expose it.

 ::note
@@ -299,7 +297,6 @@ Restart the stack and wait for SWAG to be fully operational.
 Done! You can now access Authentik via `https://auth.mydomain.com`

 ## Enable Multifactor Authentication
---
 The main value of Authentik is using multifactor authentication for all protected apps.

 - Go to `https://auth.mydomain.com`
@@ -313,11 +310,9 @@ The main value of Authentik is using multifactor authentication for all protecte
 You’ll now be prompted to enter a one-time code at every login.

 ## Protecting a Native App
---
 Authentik is natively compatible with several applications. You can find the list and [support here](https://docs.goauthentik.io/integrations/services/).

 ## Protecting an App via Reverse Proxy
---
 SWAG lets you insert Authentik’s login page between a request and access to your service. To do this:

 - Configure the authentication provider in Authentik.
@@ -372,7 +367,6 @@ Your new architecture looks like this:
 ![Picture](/img/serveex/authentik.svg)

 ## Protecting a Remote Server Service
---
 For a [native application](/serveex/security/authentik/#protecting-a-native-app) (via OAuth 2.0 or other), nothing changes.

 For a non-native app behind a reverse proxy, you must deploy an __Outpost__. An Outpost is a container acting as a local proxy — it's the target of your app's auth requests and the only one authorized to communicate with your Authentik API.
@@ -562,7 +556,6 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
 Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/security/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).

 ## Migrating an Authentik Database
---
 On the source machine, dump the database:

 ```sh
@@ -19,7 +19,6 @@ description: Use Cloudflare Tunnels and Zero Trust to expose homelab services wi
 ![cloudfare_tunnels](/img/serveex/cloudflared.svg)

 ## Introduction
---
 The _Zero Trust_ architecture is the practice of designing systems based on the principle of __"never trust, always verify"__, as opposed to the traditional principle of __"trust, but verify"__. This concept has become increasingly popular recently due to the growing number of attacks targeting user data. It’s a broad concept, but we’ll focus on how to apply _Zero Trust_ to the web services we host.

 _Cloudflare tunnels_ offer a simple way to implement _Zero Trust_, using [SWAG](/serveex/core/swag) and [Authentik](/serveex/security/authentik).
@@ -43,7 +42,6 @@ Here we’ll explain how to integrate SWAG with Cloudflare tunnels.
 ::

 ## Cloudflare Configuration
---
 ### DNS Zone

 First, you need to set Cloudflare as your [DNS zone](/general/networking/dns) manager. If you bought your domain from Cloudflare, that’s already done. Otherwise, check with your registrar how to add external DNS servers. Cloudflare provides [step-by-step documentation](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/) on how to configure a DNS Zone, whether your domain is external or registered with Cloudflare.
@@ -75,7 +73,6 @@ You must register for _Cloudflare Teams_ to access the _Zero Trust_ dashboard th
 Register [via this link](https://dash.teams.cloudflare.com/).

 ## SWAG Configuration
---
 ::note

 This guide assumes you own `mondomaine.fr` and that its DNS is correctly pointing to Cloudflare, as described above.
@@ -231,7 +228,6 @@ Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero
 ::

 ## Managing Multiple Tunnels for Multiple Servers
---
 By default, all subdomains of your domain are routed through the single tunnel. But if you have a second server, just change the tunnel name in that SWAG instance.

 In your DNS zone, redirect subdomains to the correct tunnel.