Add Pocket ID, TinyAuth and File Browser Quantum

content/en/3.serveex/10.advanced/.navigation.yml

@@ -0,0 +1,2 @@
+title: Advanced
+icon: i-lucide-flask-conical

content/en/3.serveex/10.advanced/1.authentik.md

@@ -1,6 +1,6 @@
 ---
 title: Authentik
-description: Install Authentik as a self-hosted identity provider — configure MFA and protect your services with SSO and reverse proxy authentication.
+description: Install Authentik as a self-hosted identity provider, configure MFA and protect your services with SSO and reverse proxy authentication.
 ---
 
 
@@ -367,9 +367,9 @@ Your new architecture looks like this:
 ![Picture](/img/serveex/authentik.svg)
 
 ## Protecting a Remote Server Service
-For a [native application](/serveex/security/authentik/#protecting-a-native-app) (via OAuth 2.0 or other), nothing changes.
+For a [native application](/serveex/advanced/authentik/#protecting-a-native-app) (via OAuth 2.0 or other), nothing changes.
 
-For a non-native app behind a reverse proxy, you must deploy an __Outpost__. An Outpost is a container acting as a local proxy — it's the target of your app's auth requests and the only one authorized to communicate with your Authentik API.
+For a non-native app behind a reverse proxy, you must deploy an __Outpost__. An Outpost is a container acting as a local proxy. It's the target of your app's auth requests and the only one authorized to communicate with your Authentik API.
 
 ::note
 Prerequisites:
@@ -378,13 +378,13 @@ Prerequisites:
 - If the app has no native integration, use a compatible reverse proxy. We will use [SWAG](/serveex/core/swag) here.
 ::
 
-This container will forward requests to your main [Authentik](/serveex/security/authentik#authentik) instance over the internet (or your local network). The server will perform checks and respond to the Outpost, which will allow or block access accordingly.
+This container will forward requests to your main [Authentik](/serveex/advanced/authentik#authentik) instance over the internet (or your local network). The server will perform checks and respond to the Outpost, which will allow or block access accordingly.
 
 ![auth-outpost](/img/serveex/auth-outpost.svg)
 
 ### Configuring Authentik
 
-Create your [providers and applications](/serveex/security/authentik/#protecting-a-native-app) as shown earlier.
+Create your [providers and applications](/serveex/advanced/authentik/#protecting-a-native-app) as shown earlier.
 
 Then, in the admin panel, go to _Applications > Outposts_, and create a new outpost.
 
@@ -553,7 +553,7 @@ proxy_pass http://$upstream_authentik:9000;
 
 Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
 
-Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/security/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 
 ## Migrating an Authentik Database
 On the source machine, dump the database:

content/en/3.serveex/3.security/3.pocket-id.md

@@ -0,0 +1,207 @@
+---
+title: Pocket ID
+description: Install Pocket ID, a lightweight self-hosted OIDC provider using passkeys, as a minimal alternative to Authentik for single sign-on.
+---
+
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
+# Pocket ID
+
+::note
+🎯 __Objectives:__
+
+- Install Pocket ID
+- Create your admin account and first passkey
+- Register an OIDC client for another app
+::
+
+[Pocket ID](https://pocket-id.org) is a minimalist, self-hosted OIDC (OpenID Connect) provider. Unlike [Authentik](/serveex/advanced/authentik), it doesn't try to do everything: no LDAP, no proxy outposts, no complex flow builder. It only does one thing: let you log in to OIDC-compatible apps with a **passkey** (fingerprint, face unlock, or security key) instead of a password.
+
+This makes it a good fit if you just need a simple, fast SSO backend, for example to pair with [TinyAuth](/serveex/security/tinyauth) as a lightweight forward-auth setup, or to log in directly to apps that natively support OIDC.
+
+- [Pocket ID documentation](https://pocket-id.org/docs)
+- [Pocket ID on GitHub](https://github.com/pocket-id/pocket-id)
+
+## Installation
+Folder structure:
+```text [Directory tree]
+root
+└── docker
+    └── pocket-id
+        ├── compose.yaml
+        ├── .env
+        └── data
+```
+
+Create the data folder:
+
+```bash [Terminal]
+sudo mkdir -p /docker/pocket-id/data
+```
+
+Generate an encryption key for the `.env` file:
+
+```bash [Terminal]
+openssl rand -base64 32
+```
+
+Open Dockge, click `compose`, name the stack `pocket-id`, and add the following config:
+
+```yaml [compose.yaml]
+---
+services:
+  pocket-id:
+    image: pocketid/pocket-id:v2
+    container_name: pocket-id
+    restart: unless-stopped
+    env_file:
+
+      - .env
+    volumes:
+
+      - /docker/pocket-id/data:/app/data
+    ports:
+
+      - 1411:1411
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:1411/healthz"]
+      interval: 90s
+      timeout: 5s
+      retries: 3
+```
+
+::tip
+✨ Add the Watchtower label to automate updates:
+
+```yaml [compose.yaml]
+services:
+  pocket-id:
+    #...
+    labels:
+
+      - com.centurylinklabs.watchtower.enable=true
+```
+::
+
+Fill in the `.env` file:
+
+```properties [.env]
+APP_URL=https://id.mydomain.com
+ENCRYPTION_KEY=
+TRUST_PROXY=true
+```
+
+| Variable | Value | Example |
+|----------|-------|---------|
+| `APP_URL`{lang=properties} | The public URL you'll use to reach Pocket ID (see exposure below) | `https://id.mydomain.com` |
+| `ENCRYPTION_KEY`{lang=properties} | The key generated above | `Q2pVEqsTNRkJSO9SkJzU3KZ2...` |
+| `TRUST_PROXY`{lang=properties} | Required since Pocket ID sits behind Swag | `true` |
+
+Deploy the stack. The local interface is available at `http://yourserverip:1411`.
+
+## First login
+Pocket ID doesn't use passwords: your first account is created with a **passkey**, which your browser or OS will generate for you (Windows Hello, Touch ID, a phone, or a hardware key like a YubiKey).
+
+- Go to `http://yourserverip:1411/setup`
+- Follow the prompts to create your admin account and register your first passkey
+
+::note
+
+Since `APP_URL` is already set to your future public domain, passkey registration may ask you to open Pocket ID from that domain instead. Expose it first (see below) if setup doesn't complete locally.
+::
+
+## Exposing Pocket ID with Swag
+Other apps need to reach Pocket ID over HTTPS to complete the OIDC login flow, so it must be exposed even if you only use it from home.
+
+::note
+
+We assume you have the subdomain `id.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you use Cloudflare Zero Trust](/serveex/security/cloudflare), your box's port `443` must be forwarded to your server's port `443` in [NAT rules](/general/networking/nat).
+::
+
+Go to Dockge and edit SWAG's compose file by adding Pocket ID's network:
+
+```yaml [compose.yaml]
+services:
+  swag:
+     container_name: # ...
+      # ... 
+     networks:                # Attach container to custom network 
+      # ...           
+
+      - pocket-id             # Name of the declared network
+
+networks:                     # Define the custom network
+  # ...
+  pocket-id:                  # Declared network name
+    name: pocket-id_default   # Actual external network name
+    external: true            # Marks it as externally defined
+```
+
+Redeploy the stack and wait for SWAG to be fully operational.
+
+::note
+
+Here we assume the Pocket ID network name is `pocket-id_default`. You can check the connection by visiting SWAG's dashboard at `http://yourserverip:81`.
+::
+
+In the Swag folders, create the file `id.subdomain.conf`:
+
+::tip{icon=""}
+✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
+::
+
+```bash [Terminal]
+sudo nano /docker/swag/config/nginx/proxy-confs/id.subdomain.conf
+```
+
+Paste the following configuration:
+
+```nginx [id.subdomain.conf]
+## Version 2023/12/19
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name id.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app pocket-id;
+        set $upstream_port 1411;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+    }
+}
+```
+
+::caution
+
+Don't put Pocket ID behind another authentication layer (Authentik, TinyAuth, HTTP auth...). It's the identity provider itself, so locking it away would prevent anyone, including you, from logging in.
+::
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+Wait a few minutes, then open `https://id.mydomain.com` in your browser.
+
+::caution
+
+__If it fails:__ check your firewall rules.
+::
+
+## Registering an OIDC client
+To let another app (e.g. [TinyAuth](/serveex/security/tinyauth)) log in through Pocket ID, you need to register it as an OIDC client:
+
+- Go to `https://id.mydomain.com`
+- Log in with your passkey
+- Go to _Administration > OIDC Clients_
+- Click _Add OIDC Client_
+- Fill in a name (e.g. `TinyAuth`) and the app's callback URL (provided by the app you're protecting)
+- Save, then copy the generated __Client ID__ and __Client Secret__. You'll need them in the other app's configuration
+
+And that's it! Pocket ID is ready to act as your OIDC provider. Head to the [TinyAuth guide](/serveex/security/tinyauth) to use it as a forward-auth login page for the rest of your apps.

content/en/3.serveex/3.security/4.tinyauth.md

@@ -0,0 +1,286 @@
+---
+title: TinyAuth
+description: Install TinyAuth, a lightweight forward-auth proxy, and pair it with Pocket ID to add SSO login in front of your self-hosted apps.
+---
+
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
+# TinyAuth
+
+::note
+🎯 __Objectives:__
+
+- Install TinyAuth
+- Log in via [Pocket ID](/serveex/security/pocket-id) (OIDC)
+- Protect an app behind Swag with forward-auth
+::
+
+[TinyAuth](https://tinyauth.app) is a small forward-auth proxy: a single login page that Swag can insert in front of any app before letting a request through, similar in spirit to [Authentik](/serveex/advanced/authentik)'s reverse-proxy mode, but without the rest of Authentik's identity-provider machinery.
+
+It supports a simple local username/password login out of the box, and can also delegate login to an external OIDC provider. Here we'll use [Pocket ID](/serveex/security/pocket-id), so anyone visiting a protected app first authenticates with a passkey via Pocket ID, then gets forwarded through.
+
+- [TinyAuth documentation](https://tinyauth.app/docs)
+- [TinyAuth on GitHub](https://github.com/tinyauthapp/tinyauth)
+
+::note
+
+This guide assumes you've already installed [Pocket ID](/serveex/security/pocket-id). You can skip the Pocket ID sections below and use TinyAuth with just a local username/password instead.
+::
+
+## Installation
+Folder structure:
+```text [Directory tree]
+root
+└── docker
+    └── tinyauth
+        ├── compose.yaml
+        ├── .env
+        └── data
+```
+
+Create the data folder:
+
+```bash [Terminal]
+sudo mkdir -p /docker/tinyauth/data
+```
+
+Generate a password hash for your local account:
+
+```bash [Terminal]
+sudo docker run -i -t --rm ghcr.io/tinyauthapp/tinyauth:v5 user create --interactive
+```
+
+::note
+
+Enable "Format for Docker" when prompted, so the generated hash is already escaped for use in a `.env` file.
+::
+
+Open Dockge, click `compose`, name the stack `tinyauth`, and add the following config:
+
+```yaml [compose.yaml]
+---
+services:
+  tinyauth:
+    image: ghcr.io/tinyauthapp/tinyauth:v5
+    container_name: tinyauth
+    restart: unless-stopped
+    env_file:
+
+      - .env
+    volumes:
+
+      - /docker/tinyauth/data:/data
+    ports:
+
+      - 3000:3000
+```
+
+::tip
+✨ Add the Watchtower label to automate updates:
+
+```yaml [compose.yaml]
+services:
+  tinyauth:
+    #...
+    labels:
+
+      - com.centurylinklabs.watchtower.enable=true
+```
+::
+
+Fill in the `.env` file:
+
+```properties [.env]
+TINYAUTH_APPURL=https://tinyauth.mydomain.com
+TINYAUTH_AUTH_USERS=
+```
+
+| Variable | Value | Example |
+|----------|-------|---------|
+| `TINYAUTH_APPURL`{lang=properties} | The public URL you'll use to reach TinyAuth (see exposure below) | `https://tinyauth.mydomain.com` |
+| `TINYAUTH_AUTH_USERS`{lang=properties} | The hash generated above | `user:$$2a$$10$$UdLYoJ5lgPsC0RKq...` |
+
+Deploy the stack. The local interface is available at `http://yourserverip:3000`.
+
+## Exposing TinyAuth with Swag
+TinyAuth needs its own subdomain: it's the page users land on before being forwarded to the app they actually want.
+
+::note
+
+We assume you have the subdomain `tinyauth.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you use Cloudflare Zero Trust](/serveex/security/cloudflare), your box's port `443` must be forwarded to your server's port `443` in [NAT rules](/general/networking/nat).
+::
+
+Go to Dockge and edit SWAG's compose file by adding TinyAuth's network:
+
+```yaml [compose.yaml]
+services:
+  swag:
+     container_name: # ...
+      # ... 
+     networks:               # Attach container to custom network 
+      # ...           
+
+      - tinyauth             # Name of the declared network
+
+networks:                    # Define the custom network
+  # ...
+  tinyauth:                  # Declared network name
+    name: tinyauth_default   # Actual external network name
+    external: true           # Marks it as externally defined
+```
+
+Redeploy the stack and wait for SWAG to be fully operational.
+
+::note
+
+Here we assume the TinyAuth network name is `tinyauth_default`. You can check the connection by visiting SWAG's dashboard at `http://yourserverip:81`.
+::
+
+In the Swag folders, create the file `tinyauth.subdomain.conf`:
+
+::tip{icon=""}
+✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
+::
+
+```bash [Terminal]
+sudo nano /docker/swag/config/nginx/proxy-confs/tinyauth.subdomain.conf
+```
+
+Paste the following configuration:
+
+```nginx [tinyauth.subdomain.conf]
+## Version 2023/12/19
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name tinyauth.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location / {
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app tinyauth;
+        set $upstream_port 3000;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+    }
+}
+```
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+Wait a few minutes, then open `https://tinyauth.mydomain.com` in your browser and log in with the username/password you created above.
+
+::caution
+
+__If it fails:__ check your firewall rules.
+::
+
+## Connecting TinyAuth to Pocket ID
+First, [register TinyAuth as an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client), using this callback URL:
+
+```text
+https://tinyauth.mydomain.com/api/oauth/callback/pocketid
+```
+
+Copy the __Client ID__ and __Client Secret__ Pocket ID gives you, then edit TinyAuth's `.env` file:
+
+```bash [Terminal]
+sudo nano /docker/tinyauth/.env
+```
+
+Add the following:
+
+```properties [.env]
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_NAME=Pocket ID
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTID=
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTSECRET=
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_AUTHURL=https://id.mydomain.com/authorize
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_TOKENURL=https://id.mydomain.com/api/oidc/token
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_USERINFOURL=https://id.mydomain.com/api/oidc/userinfo
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_REDIRECTURL=https://tinyauth.mydomain.com/api/oauth/callback/pocketid
+TINYAUTH_OAUTH_PROVIDERS_POCKETID_SCOPES=openid email profile
+```
+
+| Variable | Value |
+|----------|-------|
+| `CLIENTID`{lang=properties} | The client ID copied from Pocket ID |
+| `CLIENTSECRET`{lang=properties} | The client secret copied from Pocket ID |
+| `AUTHURL` / `TOKENURL` / `USERINFOURL`{lang=properties} | Pocket ID's public URL, with the paths shown above |
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+Redeploy the TinyAuth stack. On your next visit to `https://tinyauth.mydomain.com`, you'll see a "Login with Pocket ID" option alongside the local login form.
+
+::tip
+✨ To skip straight to Pocket ID and hide the local login form, add `TINYAUTH_OAUTH_AUTOREDIRECT=pocketid` to the same `.env` file.
+::
+
+## Protecting an app via reverse proxy
+Unlike Authentik, Swag doesn't ship a ready-made include file for TinyAuth, so we'll add the forward-auth check directly to the app's own `*.subdomain.conf`. We'll use Dockge as an example.
+
+Open the file:
+
+```bash [Terminal]
+sudo nano /docker/swag/config/nginx/proxy-confs/dockge.subdomain.conf
+```
+
+Add an internal `/tinyauth` location, and reference it from the app's `location /` block with `auth_request`:
+
+```nginx [dockge.subdomain.conf]{9-11,25}
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name dockge.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    location /tinyauth {
+        internal;
+        proxy_pass http://tinyauth:3000/api/auth/nginx;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+    }
+
+    location @tinyauth_login {
+        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
+    }
+
+    location / {
+        auth_request /tinyauth;
+        error_page 401 = @tinyauth_login;
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app dockge;
+        set $upstream_port 5001;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+    }
+}
+```
+
+::note
+
+The `location /tinyauth` block must be able to reach the TinyAuth container by its Docker name (`tinyauth` here). Add TinyAuth's network to this stack's compose file the same way you did [for Swag](/serveex/security/tinyauth#exposing-tinyauth-with-swag) if it isn't already attached.
+::
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+That's it! Visiting `https://dockge.mydomain.com` now redirects to TinyAuth first. Repeat this `location /tinyauth` / `auth_request` pattern in any other app's `*.subdomain.conf` to protect it the same way.
+
+::note
+
+Repeat this process for each app you want to protect (unless it has native OIDC support, in which case you can point it directly at Pocket ID instead).
+::

content/en/3.serveex/4.monitoring/1.uptime-kuma.md

@@ -75,7 +75,7 @@ We assume you have the subdomain `stats.mydomain.com` with a `CNAME` pointing to
 
 ::warning
 
-Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on the internet could compromise the machines it monitors. Only do this if you're using an MFA system like [Authentik](/serveex/security/authentik/). Otherwise, don’t expose it with SWAG; use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on the internet could compromise the machines it monitors. Only do this if you're using an MFA system like [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG; use a VPN like [Wireguard](/serveex/security/wireguard) instead.
 ::
 
 In the Swag folders, create the `stats.subdomain.conf` file.
@@ -174,11 +174,11 @@ That's it! Uptime-Kuma is now exposed, and you can access it via `https://stats.
 ::tip{icon=""}
 ✨ __Tip:__ 
 <br/><br>
-You can protect this app with Authentik by opening `stats.subdomain.conf` and uncommenting the lines:  
+You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `stats.subdomain.conf` and uncommenting the lines:  
 `include /config/nginx/authentik-server.conf;`  
 and  
 `include /config/nginx/authentik-location.conf;`.  
-Don’t forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy). If you want the public stats page to be accessible without authentication:
+Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy). If you want the public stats page to be accessible without authentication:
 
 - Edit the Uptime-Kuma provider
 - In *Advanced Protocol Settings > Authenticated Paths*, enter:

content/en/3.serveex/4.monitoring/2.dozzle.md

@@ -75,7 +75,7 @@ Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web
 
 ::warning
 
-Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [Authentik](/serveex/security/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [Wireguard](/serveex/security/wireguard).
+Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [Wireguard](/serveex/security/wireguard).
 ::
 
 You may want to access Dozzle remotely and on all your devices. To do so, we’ll expose Dozzle via Swag.
@@ -179,5 +179,5 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 And there you go, Dozzle is now exposed!
 
 ::tip
-✨ You can protect this app with Authentik by opening `dozzle.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and a provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `dozzle.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and a provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/4.monitoring/3.speedtest-tracker.md

@@ -99,7 +99,7 @@ Now we want to expose Speedtest Tracker to the internet so you can access it rem
 
 ::warning
 
-Speedtest Tracker does not use multi-factor authentication. Exposing it on the internet could compromise connected devices. Do so only if you use a multi-factor system like [Authentik](/serveex/security/authentik/). Otherwise, avoid using SWAG and prefer a VPN like [Wireguard](/serveex/security/wireguard).
+Speedtest Tracker does not use multi-factor authentication. Exposing it on the internet could compromise connected devices. Do so only if you use a multi-factor system like [Authentik](/serveex/advanced/authentik/). Otherwise, avoid using SWAG and prefer a VPN like [Wireguard](/serveex/security/wireguard).
 ::
 
 Open the `speedtest.subdomain.conf` file:
@@ -186,10 +186,10 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully up.
 This assumes the Speedtest Tracker network is named `speedtest-tracker_default`. You can verify the connection by visiting SWAG’s dashboard at `http://yourserverip:81`.
 ::
 
-Wait a moment, then visit `https://speedtest.yourdomain.com` in your browser — you should be redirected to Speedtest Tracker. You can check service status via the dashboard (`http://yourserverip:81` from the local network).
+Wait a moment, then visit `https://speedtest.yourdomain.com` in your browser. You should be redirected to Speedtest Tracker. You can check service status via the dashboard (`http://yourserverip:81` from the local network).
 
 ::tip
-✨ You can protect this app with Authentik by opening `speedtest.subdomain.conf` and uncommenting  
+✨ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `speedtest.subdomain.conf` and uncommenting  
 `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`.  
-Don’t forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/4.monitoring/4.beszel.md

@@ -1,6 +1,6 @@
 ---
 title: Beszel
-description: Install Beszel to monitor server CPU, RAM, disk, and network metrics — including remote servers — with a lightweight web dashboard.
+description: Install Beszel to monitor server CPU, RAM, disk, and network metrics, including remote servers, with a lightweight web dashboard.
 ---
 
 
@@ -16,7 +16,7 @@ description: Install Beszel to monitor server CPU, RAM, disk, and network metric
 - Expose Beszel with Swag
 ::
 
-[Beszel](https://beszel.dev/) is a container that gives you real-time access to hardware information from your servers and allows historical tracking. CPU activity, disk usage, temperatures, RAM—nothing escapes your monitoring. Beszel also lets you configure notifications and alerts when your predefined thresholds are exceeded.
+[Beszel](https://beszel.dev/) is a container that gives you real-time access to hardware information from your servers and allows historical tracking. CPU activity, disk usage, temperatures, RAM: nothing escapes your monitoring. Beszel also lets you configure notifications and alerts when your predefined thresholds are exceeded.
 
 Beszel includes a hub with a web UI and an agent that collects data from your server or a remote server.
 
@@ -149,7 +149,7 @@ __If it fails:__ check your firewall rules.
 
 ::warning
 
-Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like [Authentik](/serveex/security/authentik/). Otherwise, do not expose with SWAG—use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
 ::
 
 If you want to access Beszel remotely from all your devices, expose it using Swag.
@@ -157,7 +157,7 @@ If you want to access Beszel remotely from all your devices, expose it using Swa
 ::note
 📋 __Prerequisite:__
 <br/><br/>
-You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME` pointing to `mydomain.com`, and—unless you're using Cloudflare Zero Trust—you must have forwarded port `443` on your router to your server’s `443` port via [NAT rules](/general/networking/nat).
+You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME` pointing to `mydomain.com`. Unless you're using Cloudflare Zero Trust, you must also have forwarded port `443` on your router to your server’s `443` port via [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, edit Swag's compose file and add Beszel’s network:
@@ -244,8 +244,8 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-That’s it—Beszel is now exposed!
+That’s it! Beszel is now exposed!
 
 ::tip
-✨ You can protect this app with Authentik by opening `beszel.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `beszel.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/4.monitoring/5.upsnap.md

@@ -88,7 +88,7 @@ __If it fails:__ check your firewall rules.
 
 ::warning
 
-UpSnap does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Do this only if you're using a multi-factor authentication system like [Authentik](/serveex/security/authentik/). Otherwise, avoid exposing it with SWAG and use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+UpSnap does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Do this only if you're using a multi-factor authentication system like [Authentik](/serveex/advanced/authentik/). Otherwise, avoid exposing it with SWAG and use a VPN like [Wireguard](/serveex/security/wireguard) instead.
 ::
 
 You may want to access it remotely from all your devices. To do so, we'll expose UpSnap via Swag.
@@ -189,8 +189,8 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-And that’s it — you’ve exposed UpSnap!
+And that’s it! You’ve exposed UpSnap!
 
 ::tip
-✨ You can protect this app with Authentik by opening `upsnap.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `upsnap.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/6.cloud/1.immich.md

@@ -160,5 +160,5 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 That's it! Immich is now accessible from the internet. Don’t forget to install the [iOS](https://apps.apple.com/us/app/immich/id1613945652) / [Android](https://play.google.com/store/apps/details?id=app.alextran.immich) apps to sync your devices.
 
 ::tip{icon=""}
-✨ __Tip:__ You can protect this app with Authentik natively by [following these instructions](https://docs.goauthentik.io/integrations/services/immich/).
+✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/immich/).
 ::

content/en/3.serveex/6.cloud/2.nextcloud.md

@@ -1,6 +1,6 @@
 ---
 title: Nextcloud
-description: Install Nextcloud to self-host your files, photos, and calendar — a privacy-friendly alternative to Google Drive, OneDrive, and iCloud.
+description: Install Nextcloud to self-host your files, photos, and calendar, a privacy-friendly alternative to Google Drive, OneDrive, and iCloud.
 ---
 
 
@@ -139,7 +139,7 @@ Also add your domain in the `array` section. It should look like this:
 
 ```php [config.php]
 array (
-   0 => '192.168.0.1:444', # This line may differ—don’t change it!
+   0 => '192.168.0.1:444', # This line may differ, don’t change it!
    1 => 'nextcloud.yourdomain.com', # Add your domain here
 ),
 ```
@@ -188,8 +188,8 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-That’s it—you’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
+That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
 
 ::tip{icon=""}
-✨ __Tip:__ You can natively protect this app with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/nextcloud/).
+✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/nextcloud/).
 ::

content/en/3.serveex/7.files/1.file-browser.md

@@ -49,7 +49,7 @@ services:
     ```
 ::
 
-Deploy the container and go to `http://yourserverip:8010`. That’s it—your File Browser web UI is up and running!
+Deploy the container and go to `http://yourserverip:8010`. That’s it! Your File Browser web UI is up and running!
 
 ::caution
 
@@ -60,14 +60,14 @@ __If it doesn’t work:__ check your firewall rules.
 
 ::warning
 
-File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [Authentik](/serveex/security/authentik/). Otherwise, do not expose it with SWAG—use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
 ::
 
 You may want to access File Browser remotely from all your devices. To do that, we’ll expose it through Swag.
 
 ::note
 
-__Pre-requisite:__ We assume you've already created a subdomain like `files.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`, and—unless you're using Cloudflare Zero Trust—have already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
+__Pre-requisite:__ We assume you've already created a subdomain like `files.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, go to the SWAG stack and edit the compose file to add File Browser’s network:
@@ -156,8 +156,8 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-That’s it—File Browser is now exposed!
+That’s it! File Browser is now exposed!
 
 ::tip{icon=""}
-✨ __Tip:__ You can protect this app with Authentik by opening `files.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `files.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/7.files/2.pingvin.md

@@ -71,7 +71,7 @@ From here on, we assume the network name for Swag is `swag_default`.
     ```
 ::
 
-Deploy the container and go to `http://yourserverip:3600`. That's it—your Pingvin web UI instance is up and running!
+Deploy the container and go to `http://yourserverip:3600`. That's it! Your Pingvin web UI instance is up and running!
 
 ::caution
 
@@ -182,7 +182,7 @@ That's it, you've exposed Pingvin!
 
 ## Securing Pingvin with Authentik
 
-You can protect this app natively with Authentik by following the instructions below.
+You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) instead (register Pingvin as an OIDC client there, then fill in Pingvin's OAuth settings the same way as step 6 below), or with Authentik by following the instructions below.
 
 1. In your Authentik admin area, create an OAuth2/OpenID provider.
 
@@ -206,4 +206,4 @@ You can protect this app natively with Authentik by following the instructions b
 - `OpenID client ID` with the ID you copied in step 2.
 - `OpenID client secret` with the token you copied in step 2.
 
-That's it—from now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.
+That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.

content/en/3.serveex/7.files/3.file-browser-quantum.md

@@ -0,0 +1,205 @@
+---
+title: File Browser Quantum
+description: Install File Browser Quantum, a modernized fork of File Browser, to browse and manage your server files from a fast web interface.
+---
+
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
+# File Browser Quantum
+
+::note
+🎯 __Objectives:__
+
+- Install File Browser Quantum
+- Expose File Browser Quantum using Swag
+::
+
+[File Browser Quantum](https://github.com/gtsteffaniak/filebrowser) is a community fork of [File Browser](/serveex/files/file-browser), rewritten for better performance (indexed search, lower memory use) and configured through a single `config.yaml` file instead of a database-only setup.
+
+If you're already using File Browser and it fits your needs, there's no need to switch. The two are independent projects with their own configuration and can't share data directly.
+
+## Installation
+Folder structure:
+```text [Directory tree]
+root
+└── docker
+    └── filebrowser-quantum
+        ├── compose.yaml
+        └── data
+            ├── config.yaml
+            └── filebrowser.sqlite
+```
+
+Create the data folder:
+
+```bash [Terminal]
+sudo mkdir -p /docker/filebrowser-quantum/data
+```
+
+Create the `config.yaml` file:
+
+```bash [Terminal]
+sudo nano /docker/filebrowser-quantum/data/config.yaml
+```
+
+Paste the following, adding one `sources` entry per folder you want to browse:
+
+```yaml [config.yaml]
+server:
+  cacheDir: /home/filebrowser/data/tmp
+  sources:
+    - path: /docker
+      config:
+        defaultEnabled: true
+    - path: /media
+      config:
+        defaultEnabled: true
+```
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+Open Dockge, click on `compose`, name the stack `filebrowser-quantum`, then copy and paste the following:
+
+```yaml [compose.yaml]
+---
+services:
+  filebrowser-quantum:
+    container_name: filebrowser-quantum
+    image: gtstef/filebrowser:beta
+    restart: unless-stopped
+    volumes:
+
+      - /docker:/docker
+      - /media:/media
+      - /docker/filebrowser-quantum/data:/home/filebrowser/data
+    ports:
+
+      - 8020:80
+```
+
+::note
+
+Mount every folder you listed under `sources` in `config.yaml` at the same path inside the container (here `/docker` and `/media`), otherwise File Browser Quantum won't find them.
+::
+
+::tip{icon=""}
+✨ __Tip:__ Add the watchtower label to automate updates.
+
+    ```yaml [compose.yaml]
+    services:
+      filebrowser-quantum:
+        #...
+        labels:
+
+          - com.centurylinklabs.watchtower.enable=true
+    ```
+::
+
+Deploy the container and go to `http://yourserverip:8020`. Log in with the default `admin` / `admin` credentials, then immediately change the password in your profile settings.
+
+::caution
+
+__If it doesn't work:__ check your firewall rules.
+::
+
+## Exposing File Browser Quantum with Swag
+
+::warning
+
+File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) with [Pocket ID](/serveex/security/pocket-id), or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+::
+
+You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through Swag.
+
+::note
+
+__Pre-requisite:__ We assume you've already created a subdomain like `fbq.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
+::
+
+In Dockge, go to the SWAG stack and edit the compose file to add File Browser Quantum's network:
+
+```yaml [compose.yaml]
+services:
+  swag:
+     container_name: # ...
+      # ... 
+     networks:                          # Connects the container to the custom network 
+      # ...           
+
+      - filebrowser-quantum             # Name of the network declared in the stack
+    
+networks:                               # Defines the custom network
+  # ...
+  filebrowser-quantum:                  # Name of the network declared in the stack
+    name: filebrowser-quantum_default   # Actual name of the external network
+    external: true                      # Specifies it's an external network
+```
+
+::note
+
+Here, we assume the network name for File Browser Quantum is `filebrowser-quantum_default`. You can confirm the connection is working by accessing the SWAG dashboard at http://yourserverip:81.
+::
+
+Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.
+
+In the Swag folders, create the file `fbq.subdomain.conf`.
+
+```bash [Terminal]
+sudo nano /docker/swag/config/nginx/proxy-confs/fbq.subdomain.conf
+```
+
+And paste the following configuration:
+
+```nginx [fbq.subdomain.conf]
+## Version 2023/12/19
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name fbq.*;
+
+    include /config/nginx/ssl.conf;
+
+    client_max_body_size 0;
+
+    # enable for ldap auth (requires ldap-location.conf in the location block)
+    #include /config/nginx/ldap-server.conf;
+
+    # enable for Authelia (requires authelia-location.conf in the location block)
+    #include /config/nginx/authelia-server.conf;
+
+    # enable for Authentik (requires authentik-location.conf in the location block)
+    #include /config/nginx/authentik-server.conf;
+
+    location / {
+        # enable the next two lines for http auth
+        #auth_basic "Restricted";
+        #auth_basic_user_file /config/nginx/.htpasswd;
+
+        # enable for ldap auth (requires ldap-server.conf in the server block)
+        #include /config/nginx/ldap-location.conf;
+
+        # enable for Authelia (requires authelia-server.conf in the server block)
+        #include /config/nginx/authelia-location.conf;
+
+        # enable for Authentik (requires authentik-server.conf in the server block)
+        #include /config/nginx/authentik-location.conf;
+
+        include /config/nginx/proxy.conf;
+        include /config/nginx/resolver.conf;
+        set $upstream_app filebrowser-quantum;
+        set $upstream_port 80;
+        set $upstream_proto http;
+        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+    }
+}
+```
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+That's it! File Browser Quantum is now exposed.
+
+::tip{icon=""}
+✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `fbq.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
+::

content/en/3.serveex/8.development/1.code-server.md

@@ -1,6 +1,6 @@
 ---
 title: Code-Server
-description: Install code-server to run VS Code in your browser from your homelab — mount folders and expose it securely with SWAG.
+description: Install code-server to run VS Code in your browser from your homelab, mount folders and expose it securely with SWAG.
 ---
 
 
@@ -123,7 +123,7 @@ The whole point of such a solution is to access it remotely from any device. To
 
 ::note
 
-__Preliminary:__ We assume you’ve created a subdomain like `code.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns), and—unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare)—that you’ve forwarded port `443` from your router to port `443` on your server using [NAT rules](/general/networking/nat).
+__Preliminary:__ We assume you’ve created a subdomain like `code.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). Unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), we also assume you’ve forwarded port `443` from your router to port `443` on your server using [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, go to the SWAG stack and edit the compose file to add code-server’s network:
@@ -216,8 +216,8 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-That’s it — code-server is now exposed!
+That’s it! code-server is now exposed!
 
 ::tip{icon=""}
-✨ __Tip:__ You can protect this app with Authentik by opening `code.subdomain.conf` and uncommenting the lines `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `code.subdomain.conf` and uncommenting the lines `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/8.development/2.gitea.md

@@ -195,5 +195,5 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 And that’s it! Gitea is now exposed to the web.
 
 ::tip{icon=""}
-✨ __Tip:__ You can natively protect this app with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/gitea/).
+✨ __Tip:__ You can protect this app natively via OIDC with [Pocket ID](/serveex/security/pocket-id) (register it as an OIDC client), or with Authentik by [following these instructions](https://docs.goauthentik.io/integrations/services/gitea/).
 ::

content/en/3.serveex/8.development/3.it-tools.md

@@ -1,6 +1,6 @@
 ---
 title: IT Tools
-description: Install IT Tools, a self-hosted collection of handy utilities for developers — converters, encoders, formatters, and more.
+description: Install IT Tools, a self-hosted collection of handy utilities for developers, converters, encoders, formatters, and more.
 ---
 
 
@@ -158,8 +158,8 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-And that’s it — IT Tools is now exposed!
+And that’s it! IT Tools is now exposed!
 
 ::tip{icon=""}
-✨ __Tip:__ You can secure this app with Authentik by opening `tools.subdomain.conf` and uncommenting the lines `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and a provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ __Tip:__ You can secure this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `tools.subdomain.conf` and uncommenting the lines `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and a provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::

content/en/3.serveex/9.apps/1.adguard.md

@@ -24,7 +24,7 @@ In practice, once it's in place, all you need to do is set your devices to use A
 
 **Quick reminder of how DNS works:**
 
-When you visit a site or use an app, it makes requests to various domains to load content—ads in particular. Your device doesn’t know the IP addresses of these domains, so it contacts a _Domain Name Server_ (DNS), which returns the current IP address.
+When you visit a site or use an app, it makes requests to various domains to load content, ads in particular. Your device doesn’t know the IP addresses of these domains, so it contacts a _Domain Name Server_ (DNS), which returns the current IP address.
 
 By default, your device uses your ISP's DNS server, which is usually configured in your router or, for mobile devices, at the carrier’s CGNAT level. You can change this in your browser settings, your device’s system settings, or even directly in your router, depending on your ISP.
 
@@ -33,7 +33,7 @@ Adguard will act as a middleman between your device and the upstream DNS servers
 - If the domain is not in a blocklist, Adguard queries the upstream DNS servers and returns the correct IP to your device.
 - If the domain *is* in a blocklist, Adguard will block the request and return nothing, so the associated content won’t load.
 
-This is how ads and malicious domains are blocked—Adguard blocks only the bad domains, allowing the rest of the page to load normally.
+This is how ads and malicious domains are blocked: Adguard blocks only the bad domains, allowing the rest of the page to load normally.
 
 ![Picture](/img/serveex/adguard.svg)
 
@@ -229,7 +229,7 @@ server {
 ::tip{icon=""}
 ✨ __Tip:__ 
 <br/><br/>
-You can protect this app with Authentik by opening `adguard.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and a provider in Authentik](/serveex/security/authentik/#protéger-une-app-par-reverse-proxy). You’ll need to exclude the URL `https://adguard.mydomain.com/dns-query` from authentication:
+You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `adguard.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and a provider in Authentik](/serveex/advanced/authentik/#protecting-an-app-via-reverse-proxy). You’ll need to exclude the URL `https://adguard.mydomain.com/dns-query` from authentication:
 
 - Edit the AdGuard provider
 - Under *Advanced Protocol Settings > Authenticated Paths*, enter `^/dns-query`
@@ -240,7 +240,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 And that's it! AdGuard is now exposed!
 
 ## Configure SSL/TLS Encryption
-Encryption is essential if you want to keep your queries to AdGuard private. Encrypting your queries ensures that no one—not even your ISP—can see your history. It also ensures that only your server can respond to you.
+Encryption is essential if you want to keep your queries to AdGuard private. Encrypting your queries ensures that no one, not even your ISP, can see your history. It also ensures that only your server can respond to you.
 
 To configure encryption:
 

content/en/3.serveex/9.apps/2.vaultwarden.md

@@ -237,10 +237,10 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
-And there you go — Vaultwarden is now exposed! Visit `https://vault.yourdomain.com/admin` to access the admin panel and paste the password you specified when generatique the `ADMIN_TOKEN`. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
+And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.com/admin` to access the admin panel and paste the password you specified when generatique the `ADMIN_TOKEN`. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
 
 Don't forget to install Bitwarden browser extensions (they work with Vaultwarden) for [Chrome](https://chromewebstore.google.com/detail/gestionnaire-de-mots-de-p/nngceckbapebfimnlniiiahkandclblb) and [Firefox](https://addons.mozilla.org/fr/firefox/addon/bitwarden-password-manager/), as well as [iOS](https://apps.apple.com/fr/app/bitwarden/id1137397744) and [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden&hl=fr) apps to sync your passwords.
 
 ::tip{icon=""}
-✨ __Tip:__ You can protect this app with Authentik by opening `tools.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don't forget to [create an application and provider in Authentik](/serveex/security/authentik#protecting-an-app-via-reverse-proxy).
+✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `tools.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
 ::