Fix content audit findings across Serveex, Nonsense and recycled guides
Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Djeex
@@ -13,7 +13,7 @@ description: Set up SWAG as a reverse proxy with automatic SSL, expose your serv
|
||||
SWAG is only useful for exposing your services to the internet, i.e. accessing them via a public URL like `https://service.mydomain.com`. If you don’t want to expose your services and prefer to always use a VPN to connect remotely, you can go **here instead**.
|
||||
::
|
||||
|
||||
Below is an example exposing Dockge. We will install SWAG along with the dbip mod for geolocation-based blocking, and the dashboard mod for managing swag, fail2ban, and geolocation.
|
||||
Below is an example exposing Dockge. We will install SWAG along with the dbip mod for geolocation-based blocking, the dashboard mod for managing swag, fail2ban, and geolocation, and the auto-reload mod, which automatically reloads nginx whenever a config file changes, without having to restart the container.
|
||||
|
||||
**Reverse proxy principle and its application in our case:**
|
||||
|
||||
|
||||
@@ -101,32 +101,25 @@ We assume you've created a subdomain in your [DNS zone](/general/networking/dns)
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add UpSnap's network to SWAG
|
||||
### Make the host reachable from SWAG
|
||||
|
||||
Go to Dockge, and edit the SWAG compose by adding the UpSnap network:
|
||||
UpSnap runs with `network_mode: host` (needed for Wake-on-LAN broadcasts and network scanning to work reliably), so it never joins a Docker network SWAG could attach to like other stacks. Instead, give SWAG a way to reach the host itself:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
services:
|
||||
swag:
|
||||
container_name: # ...
|
||||
# ...
|
||||
networks: # Connects the container to the custom network
|
||||
# ...
|
||||
- upsnap # Network name declared in the stack
|
||||
|
||||
networks: # Defines the custom network
|
||||
# ...
|
||||
upsnap: # Network name declared in the stack
|
||||
name: upsnap_default # Actual name of the external network
|
||||
external: true # Indicates it's an external network
|
||||
# ...
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway" # resolves to the Docker host's own IP
|
||||
```
|
||||
|
||||
Restart the stack by clicking "deploy" and wait for SWAG to be fully operational.
|
||||
|
||||
::note
|
||||
|
||||
Here we assume the network name for upsnap is `upsnap_default`. You can check the connection in the SWAG dashboard at `http://yourserverip:81`.
|
||||
`host-gateway` is a special value Docker resolves to the host machine's IP automatically, so this works regardless of your server's actual address.
|
||||
::
|
||||
|
||||
### Create the subdomain.conf file
|
||||
@@ -184,7 +177,7 @@ server {
|
||||
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_app upsnap;
|
||||
set $upstream_app host.docker.internal;
|
||||
set $upstream_port 8095;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
@@ -262,7 +255,7 @@ server {
|
||||
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_app upsnap;
|
||||
set $upstream_app host.docker.internal;
|
||||
set $upstream_port 8095;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
|
||||
@@ -47,7 +47,7 @@ tree:
|
||||
If not already done, create the `downloads` folder under `/media`:
|
||||
|
||||
```bash [Terminal]
|
||||
mkdir -P /media/downloads
|
||||
mkdir -p /media/downloads
|
||||
```
|
||||
|
||||
### Deploy the stack
|
||||
@@ -88,7 +88,7 @@ services:
|
||||
devices:
|
||||
- /dev/net/tun:/dev/net/tun
|
||||
ports:
|
||||
- ${UI_PORT}:5695 # Port de la web-ui
|
||||
- ${UI_PORT}:${UI_PORT} # Port de la web-ui
|
||||
- 8000:8000 # Port de controle de Gluetun
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
@@ -321,7 +321,7 @@ server {
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_app gluetun;
|
||||
set $upstream_port 5555;
|
||||
set $upstream_port 5695;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
|
||||
@@ -399,7 +399,7 @@ server {
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_app gluetun;
|
||||
set $upstream_port 5555;
|
||||
set $upstream_port 5695;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
|
||||
|
||||
@@ -394,7 +394,7 @@ Seerr has no built-in two-factor authentication. Only expose it if you're using
|
||||
|
||||
::note
|
||||
|
||||
We assume you have the subdomain `films.mydomain.com` with a `CNAME` pointing to `films.fr` in your [DNS zone](/general/networking/dns). And that [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
|
||||
We assume you have the subdomain `films.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And that [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
|
||||
@@ -475,7 +475,7 @@ On your remote machine, use [Dockge](/serveex/core/docker/#install-dockge-to-man
|
||||
If you haven’t installed [Dockge](/serveex/core/docker/#install-dockge-to-manage-and-deploy-containers), create a folder `/srv/docker/authentik-outpost`, or directly via command line:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mkdir -P /srv/docker/authentik-outpost
|
||||
sudo mkdir -p /srv/docker/authentik-outpost
|
||||
```
|
||||
|
||||
::tip{icon="" to="/serveex/files/file-browser-quantum"}
|
||||
@@ -492,7 +492,7 @@ Via command line:
|
||||
```bash [Terminal]
|
||||
sudo nano /srv/docker/authentik-outpost/compose.yaml
|
||||
```
|
||||
Paste the following configuration, updating the version in `{AUTHENTIK_TAG:proxy:2024.2.3}`{lang=properties} to match your Authentik server version.
|
||||
Paste the following configuration, updating the version in `ghcr.io/goauthentik/proxy:2026.2`{lang=properties} to match your Authentik server version.
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
@@ -500,7 +500,7 @@ version: "3.5"
|
||||
services:
|
||||
authentik_proxy:
|
||||
container_name: authentik-outpost
|
||||
image: ghcr.io/goauthentik/proxy:2024.2.3
|
||||
image: ghcr.io/goauthentik/proxy:2026.2
|
||||
# Optionally specify which networks the container should be
|
||||
# might be needed to reach the core authentik server
|
||||
restart: unless-stopped
|
||||
|
||||
Reference in New Issue
Block a user