Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Actions Projects Wiki Activity

Fix Done! spacing site-wide, and EN-only content errors (Docker/Linux mixup, missing spaces, ProloNAS pun explanation)

Browse Source
This commit is contained in:
Djeex
2026-09-07 13:49:44 +02:00
parent fbc33a5ff4
commit 328aa31600
38 changed files with 116 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/2.core/1.installation.md
+6 -6
View File
@@ -8,7 +8,7 @@ description: Step-by-step guide to install Debian 13 on a home server and set up
[Debian 13 "Trixie"](https://www.debian.org/) is the base this whole guide sits on. It's a plain, boring, stable Linux, and for a homelab that's exactly the point: package versions stay frozen for the life of the release, security patches keep coming for about five years counting LTS, so the machine keeps running for years instead of needing a rebuild every few months.
The other reason is that it stays out of your way. Appliance systems like Unraid, TrueNAS or Synology's DSM put their own layer on top of Docker, and the day you need something their interface doesn't expose, you're stuck working around it. Debian is just a server: you install what you want, where you want, and nothing is hidden behind someone else's UI. It also happens to be what most self-hosted projects target first, so their docs hand you `apt` commands that work as-is, Docker publishes an official Debian repository, and any error message you paste into a search engine already has years of answers behind it. A minimal install is light enough to leave nearly all the RAM and CPU of a small N100 box to your containers.
The other reason is that it stays out of your way. Appliance systems like Unraid, TrueNAS or Synology's DSM put their own layer on top of Linux, and the day you need something their interface doesn't expose, you're stuck working around it. Debian is just a server: you install what you want, where you want, and nothing is hidden behind someone else's UI. It also happens to be what most self-hosted projects target first, so their docs hand you `apt` commands that work as-is, Docker publishes an official Debian repository, and any error message you paste into a search engine already has years of answers behind it. A minimal install is light enough to leave nearly all the RAM and CPU of a small N100 box to your containers.
![picture](/img/serveex/server.svg)
@@ -55,7 +55,7 @@ _Screenshot from [this bootable USB guide on DEV Community](https://dev.to/devop
Writing takes a few minutes.
#### Done !
#### Done!
::
### Install Debian
@@ -117,7 +117,7 @@ Install it on the disk you just partitioned (`/dev/sda`, `/dev/nvme0n1`...), not
![Debian installer asking which device to install the GRUB boot loader to](/img/serveex/install/debian-install-grub.png)
#### Done !
#### Done!
::
::note
@@ -209,7 +209,7 @@ Keep your current SSH session open while you test. Open a **second** terminal an
The door is now closed for every other machine too, including the next one you'll want to connect from. To let a new one in, set `PasswordAuthentication yes` back in `hardening.conf`, restart SSH, run the two key steps above from that machine, then set it to `no` again and restart SSH one last time.
::
#### Done !
#### Done!
::
### Wake the server up remotely
@@ -278,7 +278,7 @@ wakeonlan aa:bb:cc:dd:ee:ff
Windows has no built-in sender, so the simplest route there is a phone app: any of the free *Wake on LAN* apps takes the MAC address and works the same way. The server should start within a couple of seconds.
#### Done !
#### Done!
::
::note
@@ -322,7 +322,7 @@ sudo reboot
A kernel or libc update only takes effect after a restart. Everything else applies immediately, so this is only needed when the upgrade touched one of those, and it's worth planning for a moment when nothing depends on the machine.
#### Done !
#### Done!
::
::tip
content/en/3.serveex/2.core/2.docker.md
+3 -3
View File
@@ -37,7 +37,7 @@ sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```
### Done !
### Done!
::
**More options:** [Install Docker for Debian 13](https://docs.docker.com/engine/install/debian/)
@@ -153,7 +153,7 @@ Then go to `http://yourserverip:3555` in your browser to access the login page.
More info on [Dockge and how to use it](https://github.com/louislam/dockge)
#### Done !
#### Done!
::
And there you go! Docker and a tool to easily manage your containers are ready!
@@ -264,7 +264,7 @@ services:
Then restart the modified stacks.
#### Done !
#### Done!
::
And that's it! You now have a solid base to start deploying the services you want!
content/en/3.serveex/2.core/3.wireguard.md
+3 -3
View File
@@ -150,7 +150,7 @@ Then go to *Administrator → Admin Panel → Config*:
- Change `Allowed IPs` from the default `0.0.0.0/0` (full tunnel) to `10.8.0.0/24` for **split tunneling**.
- Optionally remove the IPv6 entry from `Allowed IPs` if you don't want client IPv6 traffic routed through the tunnel. This only affects what clients tunnel, not the container's own IPv6 setup above.
### Done !
### Done!
::
### Retrieve Configuration Files
@@ -176,7 +176,7 @@ Set it to `25` if it’s a permanently connected client.
Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)
#### Done !
#### Done!
::
## Client Server Setup
@@ -255,7 +255,7 @@ cd /srv/docker/wireguard
sudo docker compose up -d
```
### Done !
### Done!
::
::note
content/en/3.serveex/2.core/4.swag.md
+3 -3
View File
@@ -175,7 +175,7 @@ include /config/nginx/dbip.conf;
Restart the stack in Dockge. This time, the SSL certificate should be successfully generated! Check the logs to confirm the server is ready.
### Done !
### Done!
::
## Dashboard
@@ -250,7 +250,7 @@ geo $lan-ip {
Save and close the file, then restart the stack.
### Done !
### Done!
::
In the domain config files (see next section), you can enable or disable the whitelist or blacklist ([see documentation here](https://www.forum-nas.fr/threads/tuto-installer-swag-en-docker-reverse-proxy.15057/)). In our case, the whitelist allows only French requests. The blacklist blocks only the listed countries. We'll use the blacklist, like so:
@@ -383,7 +383,7 @@ Redeploy the SWAG stack.
Wait a moment, then visit `https://dockge.mydomain.com` in your browser. You should be redirected to Dockge. You can also check the service status from the dashboard (`http://yourserverip:81` on your local network).
### Done !
### Done!
::
## Exposing Another Service with SWAG
content/en/3.serveex/3.security/2.cloudflare.md
+2 -2
View File
@@ -220,7 +220,7 @@ Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero
![dns](/img/serveex/cf-dns.png)
::
### Done !
### Done!
::
## Managing Multiple Tunnels for Multiple Servers
@@ -246,7 +246,7 @@ In the [Cloudflare DNS dashboard](https://dash.cloudflare.com/), click your doma
| `CNAME` | `subdomain1` | `yourtunnelid1.cfargotunnel.com` |
| `CNAME` | `subdomain2` | `yourtunnelid2.cfargotunnel.com` |
### Done !
### Done!
::
If you have many subdomains, point them to the above reference subdomains.
content/en/3.serveex/3.security/3.tinyauth.md
+4 -4
View File
@@ -96,7 +96,7 @@ TINYAUTH_AUTH_USERS=
Deploy the stack. The local interface is available at `http://yourserverip:3002`.
### Done !
### Done!
::
## Enabling Two-Factor Authentication
@@ -130,7 +130,7 @@ sudo docker run -i -t --rm ghcr.io/tinyauthapp/tinyauth:v5 user verify --interac
It re-prompts for the username, password, and current 6-digit code.
::
### Done !
### Done!
::
From now on, that user needs both their password and a valid code from their authenticator app to log in.
@@ -221,7 +221,7 @@ Wait a few minutes, then open `https://tinyauth.mydomain.com` in your browser an
__If it fails:__ check your firewall rules.
::
### Done !
### Done!
::
## Protecting an app via reverse proxy
@@ -284,7 +284,7 @@ The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs t
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That's it! Visiting `https://dockge.mydomain.com` now redirects to TinyAuth first. Repeat this `location /tinyauth` / `auth_request` pattern in any other app's `*.subdomain.conf` to protect it the same way.
content/en/3.serveex/3.security/4.pocket-id.md
+4 -4
View File
@@ -100,7 +100,7 @@ TRUST_PROXY=true
Deploy the stack. The local interface is available at `http://yourserverip:1411`.
### Done !
### Done!
::
## First login
@@ -205,7 +205,7 @@ Wait a few minutes, then open `https://id.mydomain.com` in your browser.
__If it fails:__ check your firewall rules.
::
### Done !
### Done!
::
## Registering an OIDC client
@@ -224,7 +224,7 @@ Go to _Administration > OIDC Clients_, then click _Add OIDC Client_. Fill in a n
Save, then copy the generated __Client ID__ and __Client Secret__. You'll need them in the other app's configuration.
### Done !
### Done!
::
## Connecting Pocket ID to TinyAuth
@@ -276,7 +276,7 @@ Redeploy the TinyAuth stack. On your next visit to `https://tinyauth.mydomain.co
✨ To skip straight to Pocket ID and hide the local login form, add `TINYAUTH_OAUTH_AUTOREDIRECT=pocketid` to the same `.env` file.
::
### Done !
### Done!
::
That's it! TinyAuth now offers passwordless login via Pocket ID for every app it protects.
content/en/3.serveex/4.monitoring/1.uptime-kuma.md
+3 -3
View File
@@ -62,7 +62,7 @@ You can now access the tool via `http://yourserverip:3200`.
__If it fails:__ check your firewall rules.
::
### Done !
### Done!
::
## Expose with Swag
@@ -173,7 +173,7 @@ Restart the stack and wait until SWAG is fully operational.
Here we assume that the network name of Uptime-Kuma is `uptime-kuma_default`. You can verify the connection by visiting SWAG's dashboard at `http://yourserverip:81`.
::
### Done !
### Done!
::
That's it! Uptime-Kuma is now exposed, and you can access it via `https://stats.mydomain.com`.
@@ -245,7 +245,7 @@ The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs t
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
Redeploy the stack. Uptime-Kuma will then be publicly reachable via `https://stats.mydomain.com`, with the status page open and everything else behind TinyAuth.
content/en/3.serveex/4.monitoring/2.dozzle.md
+2 -2
View File
@@ -101,7 +101,7 @@ DOMAIN=dozzle.mydomain.com
Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web UI is up and running!
### Done !
### Done!
::
## Exposing Dozzle with Swag
@@ -214,7 +214,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
And there you go, Dozzle is now exposed!
content/en/3.serveex/4.monitoring/3.speedtest-tracker.md
+2 -2
View File
@@ -89,7 +89,7 @@ PORT=3225 # port to access the web UI
Deploy the container and go to `http://yourserverip:3225`. Log in with the account `admin@exemple.com` and the password `password`. Don’t forget to change your ID and password once logged in!
### Done !
### Done!
::
## Exposing Speedtest Tracker with SWAG
@@ -194,7 +194,7 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully up.
This assumes the Speedtest Tracker network is named `speedtest-tracker_default`. You can verify the connection by visiting SWAG’s dashboard at `http://yourserverip:81`.
::
### Done !
### Done!
::
Wait a moment, then visit `https://speedtest.yourdomain.com` in your browser. You should be redirected to Speedtest Tracker. You can check service status via the dashboard (`http://yourserverip:81` from the local network).
content/en/3.serveex/4.monitoring/4.beszel.md
+2 -2
View File
@@ -108,7 +108,7 @@ For the `KEY` value, you'll need to launch Beszel once to get it.
Deploy the container and go to `http://yourserverip:8090`. Your Beszel web UI is now accessible!
### Done !
### Done!
::
::caution
@@ -286,7 +286,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That’s it! Beszel is now exposed!
content/en/3.serveex/4.monitoring/5.upsnap.md
+2 -2
View File
@@ -77,7 +77,7 @@ DNS=192.168.1.1 # DNS IP to resolve domain names, typically your router’s IP
Deploy the container and go to `http://yourserverip:8095`. Just follow the steps to create your account!
### Done !
### Done!
::
::caution
@@ -195,7 +195,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
And that’s it! You’ve exposed UpSnap!
content/en/3.serveex/5.media/1.jellyfin.md
+4 -4
View File
@@ -106,7 +106,7 @@ Deploy the stack. The local interface is available at `http://yourserverip:8096`
The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following **linuxserver.io's documentation**.
::
### Done !
### Done!
::
## Configure Jellyfin
@@ -160,7 +160,7 @@ Then uncheck any codec your specific GPU doesn't support hardware-decode for. [I
Further down the same page, enable **Tone mapping**. This only takes effect once the OpenCL mod above is installed and the stack redeployed; enabling it without that step first will make HDR transcodes fail instead of just skipping the tone mapping.
### Done !
### Done!
::
## Watching at Home
@@ -229,7 +229,7 @@ Replace `10.8.0.2` with whatever address your server actually got. Leaving the d
A `.conf` file is a credential, not just a settings file: whoever has it can connect to your VPN as that device. Once it's imported, delete it from the USB drive (and anywhere else you copied it, like Downloads folders), and never share it with anyone else.
::
### Done !
### Done!
::
### Restricting a third-party peer to just Jellyfin
@@ -258,7 +258,7 @@ docker exec wg-easy iptables -L WG_CLIENTS -n -v
You should see an `ACCEPT` line for that peer's IP pointing only at your Jellyfin server, followed by a catch-all `DROP`.
#### Done !
#### Done!
::
Once connected, open the Jellyfin app or `http://10.8.0.2:8096` (your server's VPN address) from that device. Only traffic to that address goes through the VPN; the rest of the device's connection is untouched.
content/en/3.serveex/5.media/2.qbittorrent.md
+3 -3
View File
@@ -184,7 +184,7 @@ Detailed info:
| `ID` | Qbittorrent UI login username | `user` |
| `PW` | Qbittorrent UI password | `password` |
### Done !
### Done!
::
## Deployment
@@ -214,7 +214,7 @@ __If login fails:__ check your firewall rules.
Change your username and password in the "webui" settings.
### Done !
### Done!
::
You're done! In Qbittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
@@ -331,7 +331,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the Qbittorrent interface.
content/en/3.serveex/5.media/3.servarr.md
+6 -6
View File
@@ -183,7 +183,7 @@ sudo chown -R 1000:1000 /srv/docker/seerr/config
Deploy the stack.
### Done !
### Done!
::
### Configure Radarr
@@ -240,7 +240,7 @@ Then, in Radarr, go to *Settings > Connect*, add a new connection and choose *Je
- Go to *Settings > General* and copy your *API Key* for later use.
#### Done !
#### Done!
::
### Configure Sonarr
@@ -280,7 +280,7 @@ In *Settings > Apps*, add Radarr and Sonarr with the following details:
- API Key: use the one copied from Radarr and Sonarr.
- Click *Test*, then *Save* if all goes well.
#### Done !
#### Done!
::
### Configuring Bazarr
@@ -325,7 +325,7 @@ Go to *Settings > General* and create a username and password using *forms login
Repeat the same steps for Radarr.
#### Done !
#### Done!
::
### Configuring Seerr
@@ -378,7 +378,7 @@ If the test succeeds, continue filling in the fields:
- Check all 4 boxes at the bottom.
- Save and continue.
#### Done !
#### Done!
::
And that’s it! Just request a movie or series, then check in qBittorrent or Radarr/Sonarr. Within a few minutes, your media will be available on Jellyfin!
@@ -503,7 +503,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
Wait a few minutes, then visit `http://films.mydomain.com` in your browser.
### Done !
### Done!
::
::caution
content/en/3.serveex/6.cloud/1.immich.md
+3 -3
View File
@@ -50,7 +50,7 @@ If you're using a NAS or a network-shared drive via **Samba** to store your data
Deploy the container. You can connect and follow the setup instructions at `http://yourserverip:2283`.
### Done !
### Done!
::
## Exposing Immich with SWAG
@@ -166,7 +166,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That's it! Immich is now accessible from the internet. Don’t forget to install the [iOS](https://apps.apple.com/us/app/immich/id1613945652) / [Android](https://play.google.com/store/apps/details?id=app.alextran.immich) apps to sync your devices.
@@ -197,7 +197,7 @@ In Immich, go to _Administration > Settings > Authentication Settings > OAuth_,
| Client ID | The client ID copied from Pocket ID |
| Client Secret | The client secret copied from Pocket ID |
### Done !
### Done!
::
::tip{icon="" to="/serveex/advanced/authentik"}
content/en/3.serveex/6.cloud/2.nextcloud.md
+3 -3
View File
@@ -76,7 +76,7 @@ PORT=4545
Deploy the stack and visit `http://yourserverip:4545` to complete the setup.
### Done !
### Done!
::
::caution
@@ -197,7 +197,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
@@ -230,7 +230,7 @@ In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and
| Discovery endpoint | Pocket ID's OIDC discovery URL |
| Scope | `openid email profile groups` |
### Done !
### Done!
::
::tip{icon="" to="/serveex/advanced/authentik"}
content/en/3.serveex/7.files/1.file-browser-quantum.md
+2 -2
View File
@@ -96,7 +96,7 @@ Mount every folder you listed under `sources` in `config.yaml` at the same path
Deploy the container and go to `http://yourserverip:8020`. Log in with the default `admin` / `admin` credentials, then immediately change the password in your profile settings.
### Done !
### Done!
::
::caution
@@ -205,7 +205,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That's it! File Browser Quantum is now exposed.
content/en/3.serveex/7.files/2.pingvin.md
+4 -4
View File
@@ -66,7 +66,7 @@ From here on, we assume the network name for Swag is `swag_default`.
Deploy the container and go to `http://yourserverip:3600`. That's it! Your Pingvin web UI instance is up and running!
### Done !
### Done!
::
::caution
@@ -179,7 +179,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That's it, you've exposed Pingvin!
@@ -206,7 +206,7 @@ In Pingvin, go to _Administration > Configuration > Social Login_ and fill in:
| Discovery URI | Pocket ID's OIDC discovery URL |
| Scope | `openid email profile groups` |
### Done !
### Done!
::
That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.
@@ -247,7 +247,7 @@ Leave Authentik, and go to Pingvin's admin interface. In the _"OAuth"_ section,
- `OpenID client ID` with the ID you copied in step 2.
- `OpenID client secret` with the token you copied in step 2.
#### Done !
#### Done!
::
:::
content/en/3.serveex/8.development/1.code-server.md
+2 -2
View File
@@ -97,7 +97,7 @@ __Note:__ Make sure to wrap the hash in single quotes `'`
Deploy the container and go to `http://yourserverip:8443`. Voilà, your code-server instance is up and running in the browser!
### Done !
### Done!
::
::caution
@@ -221,7 +221,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That’s it! code-server is now exposed!
content/en/3.serveex/8.development/2.forgejo.md
+3 -3
View File
@@ -65,7 +65,7 @@ GID=1000
Deploy the container and go to `http://yourserverip:3333`. Your Forgejo instance is now up and running!
### Done !
### Done!
::
::caution
@@ -201,7 +201,7 @@ ROOT_URL = https://forgejo.yourdomain.com/
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit, then restart the container.
### Done !
### Done!
::
And that’s it! Forgejo is now exposed to the web.
@@ -238,7 +238,7 @@ As an admin, go to _Site Administration > Identity & Access > Authentication Sou
Also enable __Skip local 2FA__.
### Done !
### Done!
::
::tip{icon="" to="/serveex/advanced/authentik"}
content/en/3.serveex/8.development/3.it-tools.md
+2 -2
View File
@@ -43,7 +43,7 @@ services:
Deploy the container and visit `http://yourserverip:3222`. That’s it, your IT Tools web UI instance is up and running!
### Done !
### Done!
::
::caution
@@ -160,7 +160,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
And that’s it! IT Tools is now exposed!
content/en/3.serveex/9.apps/1.adguard.md
+2 -2
View File
@@ -99,7 +99,7 @@ Go to `http://yourserverip:3000` and follow the setup instructions.
The setup wizard asks you to pick an admin interface port. Keep it at `3000`: the SWAG configuration further down assumes the admin interface stays on that port, and changing it here would make exposing AdGuard with SWAG fail with a 502 error.
::
### Done !
### Done!
::
That’s it! Adguard is deployed.
@@ -236,7 +236,7 @@ server {
}
```
### Done !
### Done!
::
## Protecting AdGuard with TinyAuth
content/en/3.serveex/9.apps/2.vaultwarden.md
+4 -4
View File
@@ -100,7 +100,7 @@ Then deploy the container.
Recently, Vaultwarden requires SSL to be accessed, which prevents access via a local IP. We'll expose it with SWAG, which provides an SSL certificate.
### Done !
### Done!
::
::caution
@@ -244,7 +244,7 @@ server {
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.com/admin` to access the admin panel and paste the password you specified when generatique the `ADMIN_TOKEN`. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
@@ -298,7 +298,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will prompt for SSO login instead of (or alongside) the local master password.
### Done !
### Done!
::
::note{to="https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect"}
@@ -329,7 +329,7 @@ SSO_CLIENT_SECRET=
SSO_SCOPES=email profile offline_access
```
#### Done !
#### Done!
::
:::
content/en/3.serveex/91.advanced/1.authentik.md
+6 -6
View File
@@ -229,7 +229,7 @@ You can then begin the initial setup by visiting:
__Warning:__ It’s recommended to create a new admin account and **disable** the default `akadmin` account.
::
### Done !
### Done!
::
## Exposing Authentik
@@ -333,7 +333,7 @@ networks: # Define the custom network
Restart the stack and wait for SWAG to be fully operational.
### Done !
### Done!
::
You can now access Authentik via `https://auth.mydomain.com`
@@ -350,7 +350,7 @@ Go to `https://auth.mydomain.com` and log in.
Go to _Settings_, click the _MFA_ section, then _Register_. Choose a method like _TOTP device_ (you'll need an authenticator app like Google Authenticator) and follow the steps.
### Done !
### Done!
::
You’ll now be prompted to enter a one-time code at every login.
@@ -402,7 +402,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
✨ __Tip:__ In Dockge's settings, you can disable Dockge's authentication to avoid double login. **Warning**: this means if the port is open on your local network, there will be no authentication at all.
::
### Done !
### Done!
::
Now when accessing `https://dockge.mydomain.com`, you’ll be redirected to the Authentik login screen.
@@ -616,7 +616,7 @@ proxy_pass http://$upstream_authentik:9000;
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
### Done !
### Done!
::
Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
@@ -661,5 +661,5 @@ Restore the database:
sudo docker exec authentik-postgresql pg_restore -U authentik -d authentik /path/to/wherever/mydb.tar
```
### Done !
### Done!
::
content/en/3.serveex/91.advanced/2.arcane.md
+4 -4
View File
@@ -142,7 +142,7 @@ PGID=1000
Deploy the stack. The local interface is available at `http://yourserverip:3552`.
### Done !
### Done!
::
::caution
@@ -240,7 +240,7 @@ Arcane's live updates run over a websocket, hence the `Upgrade`/`Connection` hea
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Done !
### Done!
::
That's it! Arcane is now accessible from the internet.
@@ -290,7 +290,7 @@ Deploy the stack.
Back in Arcane, the new environment should show as connected within a few seconds. Switch to it from the environment picker to manage that host's containers and stacks.
### Done !
### Done!
::
## Connecting Pocket ID
@@ -330,7 +330,7 @@ Redeploy the stack.
✨ To skip straight to Pocket ID and hide the local login form, set `OIDC_AUTO_REDIRECT_TO_PROVIDER=true`, or disable local login entirely under _Settings > Authentication_ for OIDC-only access.
::
### Done !
### Done!
::
That's it! Arcane now offers a "Login with Pocket ID" option alongside the local login form.