Fix config and variable mismatches found in the audit
This commit is contained in:
Djeex
@@ -6,7 +6,7 @@ description: Set up Samba on Debian to share folders over your local network and
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
Samba is a protocol that allows access to a folder located on a network drive. It can be configured on macOS, Windows, or Linux.
|
||||
Samba is a free implementation of the SMB/CIFS protocol, allowing access to a folder located on a network drive. It can be configured on macOS, Windows, or Linux.
|
||||
|
||||
There are many tutorials for setting up Samba on Windows or on NAS systems like Synology, but here we focus on Debian.
|
||||
|
||||
@@ -146,11 +146,11 @@ sudo nano /smb/.credentials
|
||||
Write:
|
||||
|
||||
```properties [.credentials]
|
||||
username=smbuser
|
||||
username=sambauser
|
||||
password=password
|
||||
```
|
||||
|
||||
* `smbuser`: the user we created on the `remote-machine`
|
||||
* `sambauser`: the user we created on the `remote-machine`
|
||||
* `password`: the password set earlier
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
@@ -199,7 +199,7 @@ sudo cp /etc/fstab /etc/fstab.bak
|
||||
Then add the mount configuration line:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo echo //remote-ip/video /mnt/video cifs _netdev,nofail,credentials=/smb/.credentials,x-systemd.automount,x-systemd.device-timeout=15 0 0 >> /etc/fstab
|
||||
echo "//remote-ip/video /mnt/video cifs _netdev,nofail,credentials=/smb/.credentials,x-systemd.automount,x-systemd.device-timeout=15 0 0" | sudo tee -a /etc/fstab
|
||||
```
|
||||
|
||||
Reboot the machine:
|
||||
|
||||
@@ -157,6 +157,11 @@ services:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
```
|
||||
|
||||
::warning
|
||||
|
||||
`WATCHTOWER_REMOVE_VOLUMES=true` deletes a container's anonymous volumes as soon as it's updated. Combined with a `latest` tag, an automatic update can silently wipe data for any app that still stores something in an anonymous (unnamed) volume instead of a bind mount.
|
||||
::
|
||||
|
||||
#### Set your environment variables
|
||||
|
||||
Fill in the `.env` section in Dockge with the following:
|
||||
@@ -177,8 +182,11 @@ To have Watchtower monitor your other containers, add this to their `compose.yml
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
labels:
|
||||
- com.centurylinklabs.watchtower.enable=true
|
||||
services:
|
||||
yourapp:
|
||||
# ...
|
||||
labels:
|
||||
- com.centurylinklabs.watchtower.enable=true
|
||||
```
|
||||
|
||||
Then restart the modified stacks.
|
||||
|
||||
@@ -60,8 +60,7 @@ tree:
|
||||
- srv:
|
||||
- docker:
|
||||
- wg-easy:
|
||||
- config:
|
||||
- etc_wireguard/
|
||||
- etc_wireguard/
|
||||
- compose.yaml
|
||||
- .env
|
||||
---
|
||||
@@ -70,7 +69,7 @@ tree:
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click **Compose**, and name the stack `wg_easy`.
|
||||
Open Dockge, click **Compose**, and name the stack `wg-easy`.
|
||||
|
||||
Copy the following configuration:
|
||||
|
||||
@@ -79,7 +78,7 @@ Copy the following configuration:
|
||||
services:
|
||||
wg-easy:
|
||||
environment:
|
||||
- INSECURE=true
|
||||
- INSECURE=true # disables the web UI's own HTTPS; fine on a LAN-only or SWAG-fronted setup, remove it otherwise
|
||||
image: ghcr.io/wg-easy/wg-easy:15
|
||||
container_name: wg-easy
|
||||
networks:
|
||||
@@ -148,8 +147,8 @@ Once connected, follow the web UI instructions to:
|
||||
|
||||
Then go to *Administrator → Admin Panel → Config*:
|
||||
|
||||
- Change `Allowed IPs` from `0.0.0.0/24` to `10.8.0.0/24` for **split tunneling**.
|
||||
- Remove IPv6 (it often causes unnecessary issues).
|
||||
- Change `Allowed IPs` from the default `0.0.0.0/0` (full tunnel) to `10.8.0.0/24` for **split tunneling**.
|
||||
- Optionally remove the IPv6 entry from `Allowed IPs` if you don't want client IPv6 traffic routed through the tunnel. This only affects what clients tunnel, not the container's own IPv6 setup above.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
@@ -390,7 +390,7 @@ Wait a moment, then visit `https://dockge.mydomain.com` in your browser. You sho
|
||||
SWAG includes templates for most known services, named `servicename.subdomain.conf.sample`. Just create the subdomain in your registrar's DNS zone (like OVH), point it to your main domain via a CNAME, then copy and rename the sample file:
|
||||
|
||||
```bash [Terminal]
|
||||
cd /srv/docker/swag/config/proxy-confs
|
||||
cd /srv/docker/swag/config/nginx/proxy-confs
|
||||
sudo cp servicename.subdomain.conf.sample servicename.subdomain.conf
|
||||
```
|
||||
|
||||
|
||||
@@ -58,7 +58,7 @@ Once created, your token will only be shown once. Save it securely, as it cannot
|
||||
|
||||
You must register for _Cloudflare Teams_ to access the _Zero Trust_ dashboard that manages tunnels and access policies. This is a premium service, but there’s a free plan for up to 50 users, perfect for a home lab. Keep in mind that a valid credit card is required to register, but the free plan incurs no charges.
|
||||
|
||||
Register [via this link](https://dash.teams.cloudflare.com/).
|
||||
Register [via this link](https://one.dash.cloudflare.com/).
|
||||
|
||||
## SWAG Configuration
|
||||
::note
|
||||
@@ -124,6 +124,17 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
|
||||
|
||||
### Deploy the SWAG stack
|
||||
|
||||
::warning
|
||||
|
||||
This replaces your whole SWAG service definition. If you already added a `networks:` section or `EXTRA_DOMAINS` for other apps (Dockge, TinyAuth, etc.), merge those into the block below instead of pasting over them, or you'll lose that configuration.
|
||||
::
|
||||
|
||||
Make sure the fail2ban database file already exists, or Docker will create a directory in its place instead of mounting the file, silently breaking ban persistence:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo touch /srv/docker/swag/config/fail2ban/fail2ban.sqlite3
|
||||
```
|
||||
|
||||
In Dockge, edit your SWAG stack with this:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -190,7 +201,7 @@ TUNNEL_PW=
|
||||
| Variable | Value | Example |
|
||||
|----------------|-------------------------------------------------------------|--------------------------------|
|
||||
| `PUID` | User ID (`id username`) | `1000` |
|
||||
| `GUID` | Group ID (`id username`) | `1000` |
|
||||
| `PGID` | Group ID (`id username`) | `1000` |
|
||||
| `DOMAIN` | Your reserved domain | `mondomaine.fr` |
|
||||
| `PLUGIN` | DNS provider (also configure `cloudflare.ini`) | `cloudflare` |
|
||||
| `EMAIL` | Email for the certificate | `you@email.com` |
|
||||
|
||||
@@ -64,7 +64,7 @@ services:
|
||||
volumes:
|
||||
- /srv/docker/tinyauth/data:/data
|
||||
ports:
|
||||
- 3000:3000
|
||||
- 3002:3000 # host port only, avoids clashing with AdGuard's own 3000
|
||||
```
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -94,7 +94,7 @@ TINYAUTH_AUTH_USERS=
|
||||
| `TINYAUTH_APPURL`{lang=properties} | The public URL you'll use to reach TinyAuth (see exposure below) | `https://tinyauth.mydomain.com` |
|
||||
| `TINYAUTH_AUTH_USERS`{lang=properties} | The hash generated above | `user:$$2a$$10$$UdLYoJ5lgPsC0RKq...` |
|
||||
|
||||
Deploy the stack. The local interface is available at `http://yourserverip:3000`.
|
||||
Deploy the stack. The local interface is available at `http://yourserverip:3002`.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
@@ -63,7 +63,7 @@ services:
|
||||
ports:
|
||||
- 1411:1411
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:1411/healthz"]
|
||||
test: ["CMD", "/app/pocket-id", "healthcheck"]
|
||||
interval: 90s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
@@ -111,7 +111,7 @@ Pocket ID doesn't use passwords: your first account is created with a **passkey*
|
||||
|
||||
::note
|
||||
|
||||
Since `APP_URL` is already set to your future public domain, passkey registration may ask you to open Pocket ID from that domain instead. Expose it first (see below) if setup doesn't complete locally.
|
||||
Passkeys require a secure context: HTTPS, or `localhost`. Registering one from `http://yourserverip:1411` on another machine will be refused by the browser, since that's plain HTTP to a non-`localhost` address. If setup doesn't complete locally, expose Pocket ID first (see below) and finish setup over HTTPS instead.
|
||||
::
|
||||
|
||||
## Exposing Pocket ID with Swag
|
||||
|
||||
@@ -71,7 +71,7 @@ services:
|
||||
Fill in the `.env`, for example:
|
||||
|
||||
```properties [.env]
|
||||
RANGE=192.168.1.0/24 # scans all devices on the local network with an IP between 192.168.0.1 and 192.168.1.255
|
||||
SCAN_RANGE=192.168.1.0/24 # scans all devices on the local network with an IP between 192.168.1.1 and 192.168.1.254
|
||||
DNS=192.168.1.1 # DNS IP to resolve domain names, typically your router’s IP
|
||||
```
|
||||
|
||||
|
||||
@@ -162,14 +162,14 @@ Set your `.env` file with the variables below:
|
||||
|
||||
```properties [.env]
|
||||
PUID=
|
||||
GUID=
|
||||
PGID=
|
||||
MEDIA_PATH=
|
||||
```
|
||||
|
||||
| Variable | Description | Example |
|
||||
|----------------|-------------------------------------------------------------------------------------------------|-------------|
|
||||
| `PUID` | Set using your user info (check with `id yourusername`) | `1000` |
|
||||
| `GUID` | Same as above | `1000` |
|
||||
| `PGID` | Same as above | `1000` |
|
||||
| `MEDIA_PATH` | Path to your media folder, here: `/media`. It must match the one used by Qbittorrent. | `/media` |
|
||||
|
||||
::note
|
||||
|
||||
@@ -37,7 +37,7 @@ tree:
|
||||
/:
|
||||
- srv:
|
||||
- docker:
|
||||
- adguard:
|
||||
- adguardhome:
|
||||
- confdir/
|
||||
- workdir/
|
||||
- compose.yaml
|
||||
@@ -62,10 +62,11 @@ Name the stack `adguardhome` and paste the configuration below:
|
||||
services:
|
||||
adguardhome:
|
||||
container_name: adguard
|
||||
image: adguard/adguardhome
|
||||
image: adguard/adguardhome:latest
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- 53:53/udp
|
||||
- 53:53/tcp
|
||||
- 8080:80/tcp
|
||||
- 4443:443/tcp
|
||||
- 853:853/tcp
|
||||
@@ -93,6 +94,11 @@ Deploy the stack.
|
||||
|
||||
Go to `http://yourserverip:3000` and follow the setup instructions.
|
||||
|
||||
::warning
|
||||
|
||||
The setup wizard asks you to pick an admin interface port. Keep it at `3000`: the SWAG configuration further down assumes the admin interface stays on that port, and changing it here would make exposing AdGuard with SWAG fail with a 502 error.
|
||||
::
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
|
||||
@@ -63,8 +63,8 @@ sudo mkdir -p /srv/docker/authentik/media /srv/docker/authentik/certs /srv/docke
|
||||
Navigate to the `authentik` folder via `cd /srv/docker/authentik` and generate a password and secret key to include in the `.env` file:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo echo "PG_PASS=$(openssl rand 36 | base64)" >> .env
|
||||
sudo echo "AUTHENTIK_SECRET_KEY=$(openssl rand 60 | base64)" >> .env
|
||||
echo "PG_PASS=$(openssl rand 36 | base64)" | sudo tee -a .env
|
||||
echo "AUTHENTIK_SECRET_KEY=$(openssl rand 60 | base64)" | sudo tee -a .env
|
||||
```
|
||||
|
||||
::note
|
||||
|
||||
@@ -197,14 +197,14 @@ Set your `.env` file with the variables below:
|
||||
|
||||
```properties [.env]
|
||||
PUID=
|
||||
GUID=
|
||||
PGID=
|
||||
MEDIA_PATH=
|
||||
```
|
||||
|
||||
| Variable | Description | Example |
|
||||
|----------------|-------------------------------------------------------------------------------------------------|-------------|
|
||||
| `PUID` | Set using your user info (check with `id yourusername`) | `1000` |
|
||||
| `GUID` | Same as above | `1000` |
|
||||
| `PGID` | Same as above | `1000` |
|
||||
| `MEDIA_PATH` | Path to your media folder, here: `/media`. It must match the one used by Qbittorrent. | `/media` |
|
||||
|
||||
Deploy the stack.
|
||||
|
||||
Reference in New Issue
Block a user