Fix Done! spacing site-wide, and EN-only content errors (Docker/Linux mixup, missing spaces, ProloNAS pun explanation)

2026-09-07 13:49:44 +02:00
parent fbc33a5ff4
commit 328aa31600
38 changed files with 116 additions and 116 deletions
@@ -61,7 +61,7 @@ Then scroll to the end of the file and add the following configuration:
 ```

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
-### Done !
+### Done!
 ::

 ### Create a Samba User and Group
@@ -111,7 +111,7 @@ sudo smbpasswd -a sambauser
 ```bash [Terminal]
 sudo smbpasswd -e sambauser
 ```
-### Done !
+### Done!
 ::

 ## Accessing a Shared Folder
@@ -12,13 +12,13 @@ This article was written before the __massive__ increase in computer hardware pr

 When you decide to dive into the adventure of running your own home server, the same questions usually come up: _“Where should I start?”_, _“Isn’t it expensive?”_. And often, people either give up or end up buying a proprietary NAS that they’ll throw away a year later once they realize it only brings headaches and wasted money.

-A server isn’t a piece of furniture. It’s simply any computer capable of running Linux.That’s why mini PCs powered by **Intel N100** processors are so popular: for around $100–130 on Chinese platforms, you can get a machine that runs **24/7** for years, capable of handling everything you’d expect from a home server or personal cloud without sacrificing performance.
+A server isn’t a piece of furniture. It’s simply any computer capable of running Linux. That’s why mini PCs powered by **Intel N100** processors are so popular: for around $100–130 on Chinese platforms, you can get a machine that runs **24/7** for years, capable of handling everything you’d expect from a home server or personal cloud without sacrificing performance.

 It’s **objectively inexpensive**, and anyone with a bit of curiosity can get started.

 A mini PC for $100 + a USB dock for $50 that holds multiple hard drives = a complete platform for $150, versus **$350–1200** for branded NAS systems.

-That’s all a **ProloNAS** is. It’s then up to you to scale your storage capacity according to your needs.
+That’s all a **ProloNAS** is: a NAS anyone can afford. The name is a French pun, *prolo* (slang for "working-class") plus *NAS*, a home server for the rest of us, not just people who can drop $1000 on a branded box. It’s then up to you to scale your storage capacity according to your needs.

 ![](/img/global/prolonas.svg)

@@ -32,11 +32,11 @@ That’s all a **ProloNAS** is. It’s then up to you to scale your storage capa

 ## Why a NAS?

-A **NAS** (Network Attached Storage) is a machine centered around storage, designed to be shared over a network.The idea is to have a **reliable and secure** storage space that serves as the backbone for your personal services and apps such as a self-hosted cloud like [Nextcloud](/serveex/cloud/nextcloud), a photo sync tool like [Immich](/serveex/cloud/immich), or a media server like [Jellyfin](/serveex/media/jellyfin). You can also store camera footage, backups, or even development projects on it.
+A **NAS** (Network Attached Storage) is a machine centered around storage, designed to be shared over a network. The idea is to have a **reliable and secure** storage space that serves as the backbone for your personal services and apps such as a self-hosted cloud like [Nextcloud](/serveex/cloud/nextcloud), a photo sync tool like [Immich](/serveex/cloud/immich), or a media server like [Jellyfin](/serveex/media/jellyfin). You can also store camera footage, backups, or even development projects on it.

 ### But why not just use a mini PC with an external hard drive?

-Sure, a simple mini PC with 1–2 TB of storage will do for most people.And your movie collection might fit on an external drive of a few extra terabytes. But that’s **neither reliable nor scalable** a single shock or hardware failure could permanently destroy your data.
+Sure, a simple mini PC with 1–2 TB of storage will do for most people. And your movie collection might fit on an external drive of a few extra terabytes. But that’s **neither reliable nor scalable**: a single shock or hardware failure could permanently destroy your data.

 A real NAS is built around **storage reliability**. It uses redundancy strategies like [RAID](/general/storage/raid) to protect against drive failure, and snapshot systems like [ZFS](/general/storage/zfs) to guard against corruption.

@@ -32,7 +32,7 @@ Options change how a command behaves. They come in two flavours, and most comman
 - **Short**, a single dash and a single letter: `ls -a`. They can be stacked, so `ls -l -a -h` is usually written `ls -lah`.
 - **Long**, two dashes and a whole word: `ls --all`. Longer to type, but you can still tell what it does six months later, which is why they're the better choice in a script.

-Some options expect a value right after them: `ssh-keygen -t ed25519` (`-t` for type), `rsync --exclude @eaDir`. And case matters, always. In `ls`, `-r` reverses the sort order while `-R` walks into subfolders. Two different things, one letter apart.
+Some options expect a value right after them: `ssh-keygen -t ed25519` (`-t` for type), `rsync --exclude @eaDir`. And case matters, always. In `ls`, `-r` reverses the sort order while `-R` walks into subfolders. Same letter, different case.

 ### Arguments and paths

@@ -55,7 +55,7 @@ sudo btop

 Click a process to select it, :kbd{value="Esc"} opens the menu, :kbd{value="Q"} quits. The `+` and `-` keys fold and unfold the panels if the screen feels crowded.

-#### Done !
+#### Done!
 ::

 ## `duf`, disk space that reads like a table
@@ -79,7 +79,7 @@ sudo duf

 Local disks, network shares and system mounts are grouped separately. Add `--only local` to hide the pseudo-filesystems Docker leaves behind.

-#### Done !
+#### Done!
 ::

 ## `ncdu`, finding what ate the disk
@@ -105,7 +105,7 @@ Arrows to move, :kbd{value="Enter"} to open a folder, :kbd{value="D"} to delete
 :kbd{value="D"} deletes immediately, with a single confirmation and no recycle bin. Run `ncdu` without `sudo` when you're only looking, so a mistyped key can't touch anything the system owns.
 ::

-#### Done !
+#### Done!
 ::

 ## `tldr`, the manual without the 400 lines
@@ -133,7 +133,7 @@ The examples are fetched once and stored locally, so the command works offline a
 tldr rsync
 ```

-#### Done !
+#### Done!
 ::

 ## `lazydocker`, managing containers from the terminal
@@ -198,7 +198,7 @@ The [full list](https://github.com/jesseduffield/lazydocker/blob/master/docs/key
 Being outside `apt` also means it won't be updated by `apt full-upgrade`. Repeat these steps when you want a newer version.
 ::

-#### Done !
+#### Done!
 ::

 ## `ufw`, a firewall you can actually read
@@ -257,6 +257,6 @@ To                         Action      From
 443/tcp                    ALLOW IN    Anywhere
 ```

-#### Done !
+#### Done!
 ::

@@ -8,7 +8,7 @@ description: Step-by-step guide to install Debian 13 on a home server and set up

 [Debian 13 "Trixie"](https://www.debian.org/) is the base this whole guide sits on. It's a plain, boring, stable Linux, and for a homelab that's exactly the point: package versions stay frozen for the life of the release, security patches keep coming for about five years counting LTS, so the machine keeps running for years instead of needing a rebuild every few months.

-The other reason is that it stays out of your way. Appliance systems like Unraid, TrueNAS or Synology's DSM put their own layer on top of Docker, and the day you need something their interface doesn't expose, you're stuck working around it. Debian is just a server: you install what you want, where you want, and nothing is hidden behind someone else's UI. It also happens to be what most self-hosted projects target first, so their docs hand you `apt` commands that work as-is, Docker publishes an official Debian repository, and any error message you paste into a search engine already has years of answers behind it. A minimal install is light enough to leave nearly all the RAM and CPU of a small N100 box to your containers.
+The other reason is that it stays out of your way. Appliance systems like Unraid, TrueNAS or Synology's DSM put their own layer on top of Linux, and the day you need something their interface doesn't expose, you're stuck working around it. Debian is just a server: you install what you want, where you want, and nothing is hidden behind someone else's UI. It also happens to be what most self-hosted projects target first, so their docs hand you `apt` commands that work as-is, Docker publishes an official Debian repository, and any error message you paste into a search engine already has years of answers behind it. A minimal install is light enough to leave nearly all the RAM and CPU of a small N100 box to your containers.

 ![picture](/img/serveex/server.svg)

@@ -55,7 +55,7 @@ _Screenshot from [this bootable USB guide on DEV Community](https://dev.to/devop

 Writing takes a few minutes.

-#### Done !
+#### Done!
 ::

 ### Install Debian
@@ -117,7 +117,7 @@ Install it on the disk you just partitioned (`/dev/sda`, `/dev/nvme0n1`...), not

 ![Debian installer asking which device to install the GRUB boot loader to](/img/serveex/install/debian-install-grub.png)

-#### Done !
+#### Done!
 ::

 ::note
@@ -209,7 +209,7 @@ Keep your current SSH session open while you test. Open a **second** terminal an
 The door is now closed for every other machine too, including the next one you'll want to connect from. To let a new one in, set `PasswordAuthentication yes` back in `hardening.conf`, restart SSH, run the two key steps above from that machine, then set it to `no` again and restart SSH one last time.
 ::

-#### Done !
+#### Done!
 ::

 ### Wake the server up remotely
@@ -278,7 +278,7 @@ wakeonlan aa:bb:cc:dd:ee:ff

 Windows has no built-in sender, so the simplest route there is a phone app: any of the free *Wake on LAN* apps takes the MAC address and works the same way. The server should start within a couple of seconds.

-#### Done !
+#### Done!
 ::

 ::note
@@ -322,7 +322,7 @@ sudo reboot

 A kernel or libc update only takes effect after a restart. Everything else applies immediately, so this is only needed when the upgrade touched one of those, and it's worth planning for a moment when nothing depends on the machine.

-#### Done !
+#### Done!
 ::

 ::tip
@@ -37,7 +37,7 @@ sudo apt-get update
 sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 ```

-### Done !
+### Done!
 ::

 **More options:** [Install Docker for Debian 13](https://docs.docker.com/engine/install/debian/)
@@ -153,7 +153,7 @@ Then go to `http://yourserverip:3555` in your browser to access the login page.

 More info on [Dockge and how to use it](https://github.com/louislam/dockge)

-#### Done !
+#### Done!
 ::

 And there you go! Docker and a tool to easily manage your containers are ready!
@@ -264,7 +264,7 @@ services:

 Then restart the modified stacks.

-#### Done !
+#### Done!
 ::

 And that's it! You now have a solid base to start deploying the services you want!
@@ -150,7 +150,7 @@ Then go to *Administrator → Admin Panel → Config*:
 - Change `Allowed IPs` from the default `0.0.0.0/0` (full tunnel) to `10.8.0.0/24` for **split tunneling**.
 - Optionally remove the IPv6 entry from `Allowed IPs` if you don't want client IPv6 traffic routed through the tunnel. This only affects what clients tunnel, not the container's own IPv6 setup above.

-### Done !
+### Done!
 ::

 ### Retrieve Configuration Files
@@ -176,7 +176,7 @@ Set it to `25` if it’s a permanently connected client.

 Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)

-#### Done !
+#### Done!
 ::

 ## Client Server Setup
@@ -255,7 +255,7 @@ cd /srv/docker/wireguard
 sudo docker compose up -d
 ```

-### Done !
+### Done!
 ::

 ::note
@@ -175,7 +175,7 @@ include /config/nginx/dbip.conf;

 Restart the stack in Dockge. This time, the SSL certificate should be successfully generated! Check the logs to confirm the server is ready.

-### Done !
+### Done!
 ::

 ## Dashboard
@@ -250,7 +250,7 @@ geo $lan-ip {

 Save and close the file, then restart the stack.

-### Done !
+### Done!
 ::

 In the domain config files (see next section), you can enable or disable the whitelist or blacklist ([see documentation here](https://www.forum-nas.fr/threads/tuto-installer-swag-en-docker-reverse-proxy.15057/)). In our case, the whitelist allows only French requests. The blacklist blocks only the listed countries. We'll use the blacklist, like so:
@@ -383,7 +383,7 @@ Redeploy the SWAG stack.

 Wait a moment, then visit `https://dockge.mydomain.com` in your browser. You should be redirected to Dockge. You can also check the service status from the dashboard (`http://yourserverip:81` on your local network).

-### Done !
+### Done!
 ::

 ## Exposing Another Service with SWAG
@@ -220,7 +220,7 @@ Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero
 ![dns](/img/serveex/cf-dns.png)
 ::

-### Done !
+### Done!
 ::

 ## Managing Multiple Tunnels for Multiple Servers
@@ -246,7 +246,7 @@ In the [Cloudflare DNS dashboard](https://dash.cloudflare.com/), click your doma
 | `CNAME` | `subdomain1` | `yourtunnelid1.cfargotunnel.com`       |
 | `CNAME` | `subdomain2` | `yourtunnelid2.cfargotunnel.com`       |

-### Done !
+### Done!
 ::

 If you have many subdomains, point them to the above reference subdomains.
@@ -96,7 +96,7 @@ TINYAUTH_AUTH_USERS=

 Deploy the stack. The local interface is available at `http://yourserverip:3002`.

-### Done !
+### Done!
 ::

 ## Enabling Two-Factor Authentication
@@ -130,7 +130,7 @@ sudo docker run -i -t --rm ghcr.io/tinyauthapp/tinyauth:v5 user verify --interac
 It re-prompts for the username, password, and current 6-digit code.
 ::

-### Done !
+### Done!
 ::

 From now on, that user needs both their password and a valid code from their authenticator app to log in.
@@ -221,7 +221,7 @@ Wait a few minutes, then open `https://tinyauth.mydomain.com` in your browser an
 __If it fails:__ check your firewall rules.
 ::

-### Done !
+### Done!
 ::

 ## Protecting an app via reverse proxy
@@ -284,7 +284,7 @@ The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs t

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That's it! Visiting `https://dockge.mydomain.com` now redirects to TinyAuth first. Repeat this `location /tinyauth` / `auth_request` pattern in any other app's `*.subdomain.conf` to protect it the same way.
@@ -100,7 +100,7 @@ TRUST_PROXY=true

 Deploy the stack. The local interface is available at `http://yourserverip:1411`.

-### Done !
+### Done!
 ::

 ## First login
@@ -205,7 +205,7 @@ Wait a few minutes, then open `https://id.mydomain.com` in your browser.
 __If it fails:__ check your firewall rules.
 ::

-### Done !
+### Done!
 ::

 ## Registering an OIDC client
@@ -224,7 +224,7 @@ Go to _Administration > OIDC Clients_, then click _Add OIDC Client_. Fill in a n

 Save, then copy the generated __Client ID__ and __Client Secret__. You'll need them in the other app's configuration.

-### Done !
+### Done!
 ::

 ## Connecting Pocket ID to TinyAuth
@@ -276,7 +276,7 @@ Redeploy the TinyAuth stack. On your next visit to `https://tinyauth.mydomain.co
 ✨ To skip straight to Pocket ID and hide the local login form, add `TINYAUTH_OAUTH_AUTOREDIRECT=pocketid` to the same `.env` file.
 ::

-### Done !
+### Done!
 ::

 That's it! TinyAuth now offers passwordless login via Pocket ID for every app it protects.
@@ -62,7 +62,7 @@ You can now access the tool via `http://yourserverip:3200`.
 __If it fails:__ check your firewall rules.
 ::

-### Done !
+### Done!
 ::

 ## Expose with Swag
@@ -173,7 +173,7 @@ Restart the stack and wait until SWAG is fully operational.
 Here we assume that the network name of Uptime-Kuma is `uptime-kuma_default`. You can verify the connection by visiting SWAG's dashboard at `http://yourserverip:81`.
 ::

-### Done !
+### Done!
 ::

 That's it! Uptime-Kuma is now exposed, and you can access it via `https://stats.mydomain.com`.
@@ -245,7 +245,7 @@ The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs t

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 Redeploy the stack. Uptime-Kuma will then be publicly reachable via `https://stats.mydomain.com`, with the status page open and everything else behind TinyAuth.
@@ -101,7 +101,7 @@ DOMAIN=dozzle.mydomain.com

 Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web UI is up and running!

-### Done !
+### Done!
 ::

 ## Exposing Dozzle with Swag
@@ -214,7 +214,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 And there you go, Dozzle is now exposed!
@@ -89,7 +89,7 @@ PORT=3225 # port to access the web UI

 Deploy the container and go to `http://yourserverip:3225`. Log in with the account `admin@exemple.com` and the password `password`. Don’t forget to change your ID and password once logged in!

-### Done !
+### Done!
 ::

 ## Exposing Speedtest Tracker with SWAG
@@ -194,7 +194,7 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully up.
 This assumes the Speedtest Tracker network is named `speedtest-tracker_default`. You can verify the connection by visiting SWAG’s dashboard at `http://yourserverip:81`.
 ::

-### Done !
+### Done!
 ::

 Wait a moment, then visit `https://speedtest.yourdomain.com` in your browser. You should be redirected to Speedtest Tracker. You can check service status via the dashboard (`http://yourserverip:81` from the local network).
@@ -108,7 +108,7 @@ For the `KEY` value, you'll need to launch Beszel once to get it.

 Deploy the container and go to `http://yourserverip:8090`. Your Beszel web UI is now accessible!

-### Done !
+### Done!
 ::

 ::caution
@@ -286,7 +286,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That’s it! Beszel is now exposed!
@@ -77,7 +77,7 @@ DNS=192.168.1.1 # DNS IP to resolve domain names, typically your router’s IP

 Deploy the container and go to `http://yourserverip:8095`. Just follow the steps to create your account!

-### Done !
+### Done!
 ::

 ::caution
@@ -195,7 +195,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 And that’s it! You’ve exposed UpSnap!
@@ -106,7 +106,7 @@ Deploy the stack. The local interface is available at `http://yourserverip:8096`
 The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following **linuxserver.io's documentation**.
 ::

-### Done !
+### Done!
 ::

 ## Configure Jellyfin
@@ -160,7 +160,7 @@ Then uncheck any codec your specific GPU doesn't support hardware-decode for. [I

 Further down the same page, enable **Tone mapping**. This only takes effect once the OpenCL mod above is installed and the stack redeployed; enabling it without that step first will make HDR transcodes fail instead of just skipping the tone mapping.

-### Done !
+### Done!
 ::

 ## Watching at Home
@@ -229,7 +229,7 @@ Replace `10.8.0.2` with whatever address your server actually got. Leaving the d
 A `.conf` file is a credential, not just a settings file: whoever has it can connect to your VPN as that device. Once it's imported, delete it from the USB drive (and anywhere else you copied it, like Downloads folders), and never share it with anyone else.
 ::

-### Done !
+### Done!
 ::

 ### Restricting a third-party peer to just Jellyfin
@@ -258,7 +258,7 @@ docker exec wg-easy iptables -L WG_CLIENTS -n -v

 You should see an `ACCEPT` line for that peer's IP pointing only at your Jellyfin server, followed by a catch-all `DROP`.

-#### Done !
+#### Done!
 ::

 Once connected, open the Jellyfin app or `http://10.8.0.2:8096` (your server's VPN address) from that device. Only traffic to that address goes through the VPN; the rest of the device's connection is untouched.
@@ -184,7 +184,7 @@ Detailed info:
 | `ID`       | Qbittorrent UI login username | `user` |
 | `PW`       | Qbittorrent UI password | `password` |

-### Done !
+### Done!
 ::

 ## Deployment
@@ -214,7 +214,7 @@ __If login fails:__ check your firewall rules.

 Change your username and password in the "webui" settings.

-### Done !
+### Done!
 ::

 You're done! In Qbittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
@@ -331,7 +331,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the Qbittorrent interface.
@@ -183,7 +183,7 @@ sudo chown -R 1000:1000 /srv/docker/seerr/config

 Deploy the stack.

-### Done !
+### Done!
 ::

 ### Configure Radarr
@@ -240,7 +240,7 @@ Then, in Radarr, go to *Settings > Connect*, add a new connection and choose *Je

 - Go to *Settings > General* and copy your *API Key* for later use.

-#### Done !
+#### Done!
 ::

 ### Configure Sonarr
@@ -280,7 +280,7 @@ In *Settings > Apps*, add Radarr and Sonarr with the following details:
 - API Key: use the one copied from Radarr and Sonarr.
 - Click *Test*, then *Save* if all goes well.

-#### Done !
+#### Done!
 ::

 ### Configuring Bazarr
@@ -325,7 +325,7 @@ Go to *Settings > General* and create a username and password using *forms login

 Repeat the same steps for Radarr.

-#### Done !
+#### Done!
 ::

 ### Configuring Seerr
@@ -378,7 +378,7 @@ If the test succeeds, continue filling in the fields:
 - Check all 4 boxes at the bottom.
 - Save and continue.

-#### Done !
+#### Done!
 ::

 And that’s it! Just request a movie or series, then check in qBittorrent or Radarr/Sonarr. Within a few minutes, your media will be available on Jellyfin!
@@ -503,7 +503,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct

 Wait a few minutes, then visit `http://films.mydomain.com` in your browser.

-### Done !
+### Done!
 ::

 ::caution
@@ -50,7 +50,7 @@ If you're using a NAS or a network-shared drive via **Samba** to store your data

 Deploy the container. You can connect and follow the setup instructions at `http://yourserverip:2283`.

-### Done !
+### Done!
 ::

 ## Exposing Immich with SWAG
@@ -166,7 +166,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That's it! Immich is now accessible from the internet. Don’t forget to install the [iOS](https://apps.apple.com/us/app/immich/id1613945652) / [Android](https://play.google.com/store/apps/details?id=app.alextran.immich) apps to sync your devices.
@@ -197,7 +197,7 @@ In Immich, go to _Administration > Settings > Authentication Settings > OAuth_,
 | Client ID | The client ID copied from Pocket ID |
 | Client Secret | The client secret copied from Pocket ID |

-### Done !
+### Done!
 ::

 ::tip{icon="" to="/serveex/advanced/authentik"}
@@ -76,7 +76,7 @@ PORT=4545

 Deploy the stack and visit `http://yourserverip:4545` to complete the setup.

-### Done !
+### Done!
 ::

 ::caution
@@ -197,7 +197,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
@@ -230,7 +230,7 @@ In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and
 | Discovery endpoint | Pocket ID's OIDC discovery URL |
 | Scope | `openid email profile groups` |

-### Done !
+### Done!
 ::

 ::tip{icon="" to="/serveex/advanced/authentik"}
@@ -96,7 +96,7 @@ Mount every folder you listed under `sources` in `config.yaml` at the same path

 Deploy the container and go to `http://yourserverip:8020`. Log in with the default `admin` / `admin` credentials, then immediately change the password in your profile settings.

-### Done !
+### Done!
 ::

 ::caution
@@ -205,7 +205,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That's it! File Browser Quantum is now exposed.
@@ -66,7 +66,7 @@ From here on, we assume the network name for Swag is `swag_default`.

 Deploy the container and go to `http://yourserverip:3600`. That's it! Your Pingvin web UI instance is up and running!

-### Done !
+### Done!
 ::

 ::caution
@@ -179,7 +179,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That's it, you've exposed Pingvin!
@@ -206,7 +206,7 @@ In Pingvin, go to _Administration > Configuration > Social Login_ and fill in:
 | Discovery URI | Pocket ID's OIDC discovery URL |
 | Scope | `openid email profile groups` |

-### Done !
+### Done!
 ::

 That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.
@@ -247,7 +247,7 @@ Leave Authentik, and go to Pingvin's admin interface. In the _"OAuth"_ section,
 - `OpenID client ID` with the ID you copied in step 2.
 - `OpenID client secret` with the token you copied in step 2.

-#### Done !
+#### Done!
 ::

 :::
@@ -97,7 +97,7 @@ __Note:__ Make sure to wrap the hash in single quotes `'`

 Deploy the container and go to `http://yourserverip:8443`. Voilà, your code-server instance is up and running in the browser!

-### Done !
+### Done!
 ::

 ::caution
@@ -221,7 +221,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That’s it! code-server is now exposed!
@@ -65,7 +65,7 @@ GID=1000

 Deploy the container and go to `http://yourserverip:3333`. Your Forgejo instance is now up and running!

-### Done !
+### Done!
 ::

 ::caution
@@ -201,7 +201,7 @@ ROOT_URL = https://forgejo.yourdomain.com/

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit, then restart the container.

-### Done !
+### Done!
 ::

 And that’s it! Forgejo is now exposed to the web.
@@ -238,7 +238,7 @@ As an admin, go to _Site Administration > Identity & Access > Authentication Sou

 Also enable __Skip local 2FA__.

-### Done !
+### Done!
 ::

 ::tip{icon="" to="/serveex/advanced/authentik"}
@@ -43,7 +43,7 @@ services:

 Deploy the container and visit `http://yourserverip:3222`. That’s it, your IT Tools web UI instance is up and running!

-### Done !
+### Done!
 ::

 ::caution
@@ -160,7 +160,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 And that’s it! IT Tools is now exposed!
@@ -99,7 +99,7 @@ Go to `http://yourserverip:3000` and follow the setup instructions.
 The setup wizard asks you to pick an admin interface port. Keep it at `3000`: the SWAG configuration further down assumes the admin interface stays on that port, and changing it here would make exposing AdGuard with SWAG fail with a 502 error.
 ::

-### Done !
+### Done!
 ::

 That’s it! Adguard is deployed.
@@ -236,7 +236,7 @@ server {
 }
 ```

-### Done !
+### Done!
 ::

 ## Protecting AdGuard with TinyAuth
@@ -100,7 +100,7 @@ Then deploy the container.

 Recently, Vaultwarden requires SSL to be accessed, which prevents access via a local IP. We'll expose it with SWAG, which provides an SSL certificate.

-### Done !
+### Done!
 ::

 ::caution
@@ -244,7 +244,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.com/admin` to access the admin panel and paste the password you specified when generatique the `ADMIN_TOKEN`. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
@@ -298,7 +298,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct

 Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will prompt for SSO login instead of (or alongside) the local master password.

-### Done !
+### Done!
 ::

 ::note{to="https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect"}
@@ -329,7 +329,7 @@ SSO_CLIENT_SECRET=
 SSO_SCOPES=email profile offline_access
 ```

-#### Done !
+#### Done!
 ::

 :::
@@ -229,7 +229,7 @@ You can then begin the initial setup by visiting:
 __Warning:__ It’s recommended to create a new admin account and **disable** the default `akadmin` account.
 ::

-### Done !
+### Done!
 ::

 ## Exposing Authentik
@@ -333,7 +333,7 @@ networks:                    # Define the custom network

 Restart the stack and wait for SWAG to be fully operational.

-### Done !
+### Done!
 ::

 You can now access Authentik via `https://auth.mydomain.com`
@@ -350,7 +350,7 @@ Go to `https://auth.mydomain.com` and log in.

 Go to _Settings_, click the _MFA_ section, then _Register_. Choose a method like _TOTP device_ (you'll need an authenticator app like Google Authenticator) and follow the steps.

-### Done !
+### Done!
 ::

 You’ll now be prompted to enter a one-time code at every login.
@@ -402,7 +402,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 ✨ __Tip:__ In Dockge's settings, you can disable Dockge's authentication to avoid double login. **Warning**: this means if the port is open on your local network, there will be no authentication at all.
 ::

-### Done !
+### Done!
 ::

 Now when accessing `https://dockge.mydomain.com`, you’ll be redirected to the Authentik login screen.
@@ -616,7 +616,7 @@ proxy_pass http://$upstream_authentik:9000;

 Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.

-### Done !
+### Done!
 ::

 Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
@@ -661,5 +661,5 @@ Restore the database:
 sudo docker exec authentik-postgresql pg_restore -U authentik -d authentik /path/to/wherever/mydb.tar
 ```

-### Done !
+### Done!
 ::
@@ -142,7 +142,7 @@ PGID=1000

 Deploy the stack. The local interface is available at `http://yourserverip:3552`.

-### Done !
+### Done!
 ::

 ::caution
@@ -240,7 +240,7 @@ Arcane's live updates run over a websocket, hence the `Upgrade`/`Connection` hea

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That's it! Arcane is now accessible from the internet.
@@ -290,7 +290,7 @@ Deploy the stack.

 Back in Arcane, the new environment should show as connected within a few seconds. Switch to it from the environment picker to manage that host's containers and stacks.

-### Done !
+### Done!
 ::

 ## Connecting Pocket ID
@@ -330,7 +330,7 @@ Redeploy the stack.
 ✨ To skip straight to Pocket ID and hide the local login form, set `OIDC_AUTO_REDIRECT_TO_PROVIDER=true`, or disable local login entirely under _Settings > Authentication_ for OIDC-only access.
 ::

-### Done !
+### Done!
 ::

 That's it! Arcane now offers a "Login with Pocket ID" option alongside the local login form.
@@ -64,7 +64,7 @@ Deletion cancelled.

 Answer `y` and it runs for real. Anything that isn't `rm`, `sudo apt update`, `sudo systemctl restart docker`, goes through without a prompt.

-### Done !
+### Done!
 ::

 ::note
@@ -140,7 +140,7 @@ IPS=

 Deploy the stack.

-### Done !
+### Done!
 ::

 ### Enable Forwarding on Host
@@ -252,7 +252,7 @@ sudo docker compose up -d
 Repeat for each client
 ::

-### Done !
+### Done!
 ::

 ## Other Devices
@@ -50,7 +50,7 @@ services:

 Deploy the container and go to `http://yourserverip:8010`. That’s it! Your File Browser web UI is up and running!

-### Done !
+### Done!
 ::

 ::caution
@@ -163,7 +163,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 That’s it! File Browser is now exposed!
@@ -142,7 +142,7 @@ Tautulli is accessible at `http://yourserverip:8181`.
 You must be on your local network during Plex's initial setup. Otherwise, the URL will redirect to your Plex account without detecting your server. A VPN won't help. If you have no choice, **you can handle the setup remotely via SSH tunnel**.
 ::

-### Done !
+### Done!
 ::

 ## Configure Plex
@@ -312,7 +312,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 Wait a few minutes, then open `http://tautulli.mydomain.com` in your browser.
@@ -189,7 +189,7 @@ Detailed info:
 | `ID`       | Qbittorrent UI login username | `user` |
 | `PW`       | Qbittorrent UI password | `password` |

-### Done !
+### Done!
 ::

 ## Deployment
@@ -215,7 +215,7 @@ __If login fails:__ check your firewall rules.

 Change your username and password in the "webui" settings.

-### Done !
+### Done!
 ::

 You're done! In Qbittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
@@ -336,7 +336,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the Qbittorrent interface.
@@ -209,7 +209,7 @@ MEDIA_PATH=

 Deploy the stack.

-### Done !
+### Done!
 ::

 ### Configure Radarr
@@ -264,7 +264,7 @@ Go to *Settings > Connect*, add a new connection and choose *Plex Media Server*.

 - Go to *Settings > General* and copy your *API Key* for later use.

-#### Done !
+#### Done!
 ::

 ### Configure Sonarr
@@ -304,7 +304,7 @@ In *Settings > Apps*, add Radarr and Sonarr with the following details:
 - API Key: use the one copied from Radarr and Sonarr.
 - Click *Test*, then *Save* if all goes well.

-#### Done !
+#### Done!
 ::

 ### Configuring Bazarr
@@ -349,7 +349,7 @@ Go to *Settings > General* and create a username and password using *forms login

 Repeat the same steps for Radarr.

-#### Done !
+#### Done!
 ::

 ### Configuring Overseerr
@@ -404,7 +404,7 @@ If the test succeeds, continue filling in the fields:
 - Check all 4 boxes at the bottom.
 - Save and continue.

-#### Done !
+#### Done!
 ::

 And that’s it! Just request a movie or series, then check in qBittorrent or Radarr/Sonarr. Within a few minutes, your media will be available on Plex!
@@ -522,7 +522,7 @@ server {

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

-### Done !
+### Done!
 ::

 Wait a few minutes, then visit `http://films.mydomain.com` in your browser.
@@ -67,7 +67,7 @@ GID=1000

 Deploy the container and go to `http://yourserverip:3333`. Your Gitea instance is now up and running!

-### Done !
+### Done!
 ::

 ::caution
@@ -203,7 +203,7 @@ ROOT_URL = https://gitea.yourdomain.com/

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit, then restart the container.

-### Done !
+### Done!
 ::

 And that’s it! Gitea is now exposed to the web.