Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Actions Projects Wiki Activity

Add Uptime-Kuma introduction, write descriptive alt text site-wide, and fix brand capitalization and filenames with spaces

Browse Source
This commit is contained in:
Djeex
2026-09-07 14:35:25 +02:00
parent eff68287f2
commit 67d593cb73
90 changed files with 380 additions and 376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/2.general/2.networking/1.nat.md
+1 -1
View File
@@ -7,7 +7,7 @@ description: Learn how NAT, port forwarding, and DHCP work on a home router. Con
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
![picture](/img/global/nat.svg)
![Diagram of NAT translating a private LAN address to a public IP address](/img/global/nat.svg)
## What is a "port"?
content/en/2.general/2.networking/2.dns.md
+1 -1
View File
@@ -12,7 +12,7 @@ When you browse a website or use an app, requests are made to one or more domain
The DNS zone is like a registry with signposts that direct your requests to the correct destination.
![Picture](/img/global/dns.svg)
![Diagram of a DNS zone directing requests to the right server](/img/global/dns.svg)
## The DNS Zone
content/en/2.general/3.storage/1.raid.md
+5 -5
View File
@@ -30,7 +30,7 @@ RAID is not a backup system but a service continuity system! It only allows hot-
### No RAID
<div style="display: flex; align-items: center;">
<img src="/img/global/no-raid.svg" alt="Image" style="max-width: 30%; max-height:230px; margin-right: 20px;">
<img src="/img/global/no-raid.svg" alt="Disks with no RAID redundancy" style="max-width: 30%; max-height:230px; margin-right: 20px;">
<ul>
<li>Just your disks, without RAID. Data is stored disk by disk.</li>
<li>If you lose a disk, only its data is lost.</li>
@@ -43,7 +43,7 @@ Use your disks without RAID when you're not afraid of data loss and can tolerate
### RAID 0
<div style="display: flex; align-items: center;">
<img src="/img/global/raid0.svg" alt="Image" style="max-width: 30%; max-height:230px; margin-right: 20px;">
<img src="/img/global/raid0.svg" alt="RAID 0 striping data across disks" style="max-width: 30%; max-height:230px; margin-right: 20px;">
<ul>
<li>OS sees 1 drive.</li>
<li>Data is striped across all disks.</li>
@@ -59,7 +59,7 @@ Use RAID 0 when you prioritize performance and are not concerned about data loss
### RAID 1
<div style="display: flex; align-items: center;">
<img src="/img/global/raid1.svg" alt="Image" style="max-width: 30%; max-height:230px; margin-right: 20px;">
<img src="/img/global/raid1.svg" alt="RAID 1 mirroring data across disks" style="max-width: 30%; max-height:230px; margin-right: 20px;">
<ul>
<li>OS sees 1 drive.</li>
<li>All disks contain identical data.</li>
@@ -78,7 +78,7 @@ Use RAID 1 for strong redundancy. Each disk contains all data, so performance re
### RAID 5
<p align="center">
<img src="/img/global/raid5.svg" alt="Image" style="max-width: 40%; margin-right: 20px;">
<img src="/img/global/raid5.svg" alt="RAID 5 with distributed parity" style="max-width: 40%; margin-right: 20px;">
</p>
- OS sees 1 drive.
@@ -92,7 +92,7 @@ Use RAID 5 when you want reliable storage with 3 to 5 disks and minimal space lo
### RAID 6
<p align="center">
<img src="/img/global/raid6.svg" alt="Image" style="max-width: 50%; margin-right: 20px;">
<img src="/img/global/raid6.svg" alt="RAID 6 with double distributed parity" style="max-width: 50%; margin-right: 20px;">
</p>
- OS sees 1 drive.
content/en/2.general/3.storage/2.zfs.md
+1 -1
View File
@@ -24,7 +24,7 @@ Here’s what we’re most interested in:
- Its robust error notifications and monitoring.
## Structure
![](/img/global/zfs.svg)
![ZFS logo](/img/global/zfs.svg)
ZFS has a unique structure:
content/en/2.general/4.hardware/1.basics.md
+5 -5
View File
@@ -31,7 +31,7 @@ Larger boards generally offer more ports and features. Pre-built systems might u
## CPU
<div style="display: flex; align-items: center;">
<img src="/img/global/cpu.svg" alt="Image" style="max-width: 25%; max-height:230px; margin-right: 20px;">
<img src="/img/global/cpu.svg" alt="CPU icon" style="max-width: 25%; max-height:230px; margin-right: 20px;">
<p>The <strong>CPU</strong> (Central Processing Unit) is the computer's calculator. It processes most software tasks. Modern CPUs have multiple cores, often with virtual threads, to better handle workloads. They need to be cooled using either an active cooler (with a fan) or a passive one (fanless), depending on power consumption (watts). Choose your CPU based on how you plan to use the server.</p>
</div>
@@ -51,7 +51,7 @@ For low-power home servers or NAS (non-intensive computing), consider Intel N100
## RAM
<p align="center">
<img src="/img/global/ram.svg" alt="Image" style="max-width: 65%;">
<img src="/img/global/ram.svg" alt="RAM icon" style="max-width: 65%;">
</p>
__RAM__ (Random Access Memory) is fast, temporary memory used by the CPU (and iGPU if applicable) for quick access during execution. It clears periodically and when the machine powers down. Better RAM = better CPU performance.
@@ -67,7 +67,7 @@ Depending on the required performance, one can choose between a dedicated GPU wi
## HDD(s)
<p align="center">
<img src="/img/global/hdd.svg" alt="Image" style="max-width: 50%; margin-right: 20px;">
<img src="/img/global/hdd.svg" alt="Hard disk drive icon" style="max-width: 50%; margin-right: 20px;">
</p>
An __HDD__ (Hard Disk Drive), or hard drive, is a component used to store data. It was once the standard storage device in computers. HDDs consist of one or more stacked platters and read/write heads, somewhat like a vinyl record player.
@@ -85,7 +85,7 @@ Comes in 3.5" and 2.5" formats; servers usually favor the more reliable 3.5".
## SSD(s)
<p align="center">
<img src="/img/global/nvme.svg" alt="Image" style="max-width: 50%; margin-right: 20px;">
<img src="/img/global/nvme.svg" alt="NVMe SSD icon" style="max-width: 50%; margin-right: 20px;">
</p>
An __SSD__ (Solid State Drive) is a small circuit board with memory chips soldered onto it, used to store information. Unlike RAM, these chips retain data even when not powered, meaning the information is preserved after a reboot. SSDs are generally used as the main storage medium for your server.
@@ -144,7 +144,7 @@ To choose the right PSU, a common rule of thumb is to estimate your system’s p
## Case
<div style="display: flex; align-items: center;">
<img src="/img/global/case.svg" alt="Image" style="max-width: 25%; max-height:230px; margin-right: 20px;">
<img src="/img/global/case.svg" alt="Computer case icon" style="max-width: 25%; max-height:230px; margin-right: 20px;">
<p>The <strong>case</strong> is also an essential component of your machine. It plays a key role in cooling, through its fans and airflow design, and it determines the form factor compatibility for your motherboard, power supply, and any dedicated GPU you may install.
</p>
</div>
content/en/2.general/4.hardware/3.prolonas.md
+1 -1
View File
@@ -20,7 +20,7 @@ A mini PC for $100 + a USB dock for $50 that holds multiple hard drives = a comp
That’s all a **ProloNAS** is: a NAS anyone can afford. The name is a French pun, *prolo* (slang for "working-class") plus *NAS*, a home server for the rest of us, not just people who can drop $1000 on a branded box. It’s then up to you to scale your storage capacity according to your needs.
![](/img/global/prolonas.svg)
![Diagram of a mini PC paired with a DAS enclosure forming a ProloNAS](/img/global/prolonas.svg)
## Example Hardware
content/en/3.serveex/1.introduction.md
+4 -4
View File
@@ -9,7 +9,7 @@ navigation:
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
## A Home Lab by a Beginner, for Beginners
![](/img/serveex/serveex-server.svg)
![Diagram of a home server replacing cloud services](/img/serveex/serveex-server.svg)
**Serveex** is primarily a personal project aimed at hosting as many everyday services as possible at home, without relying on proprietary platforms (Google, Apple, Netflix, etc.). The goal was to experiment, learn, and document every step along the way. This is purely a scientific project and is not intended for production use.
@@ -62,7 +62,7 @@ to: /serveex/core/wireguard
ui:
icon: text-[#88171A]
---
Install and deploy Wireguard
Install and deploy WireGuard
::
::card{icon="i-noto-globe-showing-americas" title="Reverse Proxy" to="/serveex/core/swag"}
@@ -174,7 +174,7 @@ to: /serveex/media/qbittorrent
ui:
icon: text-[#2F67BA]
---
Install and deploy Qbittorrent
Install and deploy qBittorrent
::
::card
@@ -284,7 +284,7 @@ to: /serveex/apps/adguard
ui:
icon: text-[#68BC71]
---
Install and deploy Adguard Home
Install and deploy AdGuard Home
::
::card
content/en/3.serveex/2.core/1.installation.md
+1 -1
View File
@@ -10,7 +10,7 @@ description: Step-by-step guide to install Debian 13 on a home server and set up
The other reason is that it stays out of your way. Appliance systems like Unraid, TrueNAS or Synology's DSM put their own layer on top of Linux, and the day you need something their interface doesn't expose, you're stuck working around it. Debian is just a server: you install what you want, where you want, and nothing is hidden behind someone else's UI. It also happens to be what most self-hosted projects target first, so their docs hand you `apt` commands that work as-is, Docker publishes an official Debian repository, and any error message you paste into a search engine already has years of answers behind it. A minimal install is light enough to leave nearly all the RAM and CPU of a small N100 box to your containers.
![picture](/img/serveex/server.svg)
![Server icon](/img/serveex/server.svg)
## Installation
content/en/3.serveex/2.core/2.docker.md
+2 -2
View File
@@ -12,7 +12,7 @@ A **container** sidesteps the problem: it packages an app together with everythi
**Docker** is the tool that builds, starts and manages these containers. Point it at an *image*, a ready-made snapshot of an app maintained by its developers, and it downloads it and runs it in one command. The rest of Serveex is built entirely on it: every app from here on is one Docker container, or a handful of them working together.
![picture](/img/serveex/docker.svg)
![Diagram of Docker containers running isolated from the host system](/img/serveex/docker.svg)
## Install Docker
::steps{level="3"}
@@ -53,7 +53,7 @@ sudo mkdir /srv/docker
## Install [Dockge](https://github.com/louislam/dockge) to manage and deploy containers
[Dockge](https://github.com/louislam/dockge) is a web tool to create, configure, launch, and manage Docker containers. It's a simple, intuitive interface that’s lighter and easier for beginners than using the CLI or Portainer.
![picture](/img/serveex/dockge.png)
![Dockge web interface for managing Docker Compose stacks](/img/serveex/dockge.png)
### Configuration
content/en/3.serveex/2.core/3.wireguard.md
+5 -5
View File
@@ -1,5 +1,5 @@
---
title: Wireguard
title: WireGuard
description: Install and configure WireGuard VPN to securely access your homelab from anywhere and connect all your devices to your private network.
---
@@ -9,10 +9,10 @@ description: Install and configure WireGuard VPN to securely access your homelab
## Introduction
Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.
Here we will use [Wireguard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
Here we will use [WireGuard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
- [wg-easy](https://github.com/wg-easy/wg-easy) as the server, providing a very simple web UI to manage connections and download config files (including QR codes for phones)
- [Wireguard](https://docs.linuxserver.io/images/docker-wireguard/?h=wireguard) as the client for Linux systems
- [WireGuard](https://docs.linuxserver.io/images/docker-wireguard/?h=wireguard) as the client for Linux systems
Clients are also available for Windows, macOS, iOS, and Android.
@@ -27,7 +27,7 @@ To achieve this, we’ll create a **Virtual Private Network** (VPN), i.e., a sec
Additionally, you can add your phone, laptop, or other devices to the VPN and securely access your server resources wherever you are.
![picture](/img/serveex/vpn.svg)
![Diagram of a VPN tunnel connecting a remote device to the home network](/img/serveex/vpn.svg)
In this diagram, machine 1 is part of two networks:
@@ -276,4 +276,4 @@ Repeat this setup for each client.
And here’s the final setup overview:
![picture](/img/serveex/wireguard.svg)
![Diagram of the WireGuard client-server tunnel setup](/img/serveex/wireguard.svg)
content/en/3.serveex/2.core/4.swag.md
+5 -5
View File
@@ -6,7 +6,7 @@ description: Set up SWAG as a reverse proxy with automatic SSL, expose your serv
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
[Swag](https://docs.linuxserver.io/general/swag/) is the core of this homelab. It’s a powerful reverse proxy that allows you to expose services on the internet using domain names, handling SSL certificate issuance (for encrypted connections), request routing, and access security (via HTTP auth or SSO like Authelia or Authentik). All the necessary documentation is [available here](https://docs.linuxserver.io/general/swag).
[SWAG](https://docs.linuxserver.io/general/swag/) is the core of this homelab. It’s a powerful reverse proxy that allows you to expose services on the internet using domain names, handling SSL certificate issuance (for encrypted connections), request routing, and access security (via HTTP auth or SSO like Authelia or Authentik). All the necessary documentation is [available here](https://docs.linuxserver.io/general/swag).
::warning{to="/serveex/core/wireguard"}
@@ -17,7 +17,7 @@ Below is an example exposing Dockge. We will install SWAG along with the dbip mo
**Reverse proxy principle and its application in our case:**
![Picture](/img/serveex/reverse-proxy.svg)
![Diagram of a reverse proxy forwarding requests to the right backend service](/img/serveex/reverse-proxy.svg)
## Installation
@@ -161,7 +161,7 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
### Enable DBIP in nginx.conf
Now configure swag to access DBIP, the geolocation-based access control module. Open the `nginx.conf` file:
Now configure SWAG to access DBIP, the geolocation-based access control module. Open the `nginx.conf` file:
```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/nginx.conf
@@ -182,7 +182,7 @@ Restart the stack in Dockge. This time, the SSL certificate should be successful
Access the dashboard locally by going to `http://yourserverip:81`
On the left, you'll see a list of currently "proxied" services (none yet). On the right, the list of banned IPs. Below, various indicators. For more details, [click here](https://www.linuxserver.io/blog/introducing-swag-dashboard).
![picture](/img/serveex/swag-dashboard.png)
![SWAG dashboard showing proxied services and banned IPs](/img/serveex/swag-dashboard.png)
## DBIP
DBIP allows you to block connections based on countries. It relies on the configuration file named `dbip.conf` located in `/srv/docker/swag/config/nginx`. [More info here](https://virtualize.link/secure/).
@@ -290,7 +290,7 @@ Now it's time to expose Dockge on the internet so you can access and manage your
::warning
Dockge does not support multi-factor authentication. Exposing it online could compromise all connected machines. Only do this if you're using an MFA solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
Dockge does not support multi-factor authentication. Exposing it online could compromise all connected machines. Only do this if you're using an MFA solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
::steps{level="3"}
content/en/3.serveex/3.security/3.tinyauth.md
+5 -5
View File
@@ -1,12 +1,12 @@
---
title: TinyAuth
description: Install TinyAuth, a lightweight forward-auth proxy, and pair it with Pocket ID to add SSO login in front of your self-hosted apps. Protect your app behind Swag with forward-auth.
description: Install TinyAuth, a lightweight forward-auth proxy, and pair it with Pocket ID to add SSO login in front of your self-hosted apps. Protect your app behind SWAG with forward-auth.
---
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
[TinyAuth](https://tinyauth.app) is a small forward-auth proxy: a single login page that Swag can insert in front of any app before letting a request through, checking whether a visitor is authenticated before forwarding them on.
[TinyAuth](https://tinyauth.app) is a small forward-auth proxy: a single login page that SWAG can insert in front of any app before letting a request through, checking whether a visitor is authenticated before forwarding them on.
![tinyauth](/img/serveex/tinyauth.png)
@@ -135,7 +135,7 @@ It re-prompts for the username, password, and current 6-digit code.
From now on, that user needs both their password and a valid code from their authenticator app to log in.
## Exposing TinyAuth with Swag
## Exposing TinyAuth with SWAG
TinyAuth needs its own subdomain: it's the page users land on before being forwarded to the app they actually want.
::note
@@ -174,7 +174,7 @@ Here we assume the TinyAuth network name is `tinyauth_default`. You can check th
### Create the subdomain.conf file
In the Swag folders, create the file `tinyauth.subdomain.conf`:
In the SWAG folders, create the file `tinyauth.subdomain.conf`:
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
@@ -225,7 +225,7 @@ __If it fails:__ check your firewall rules.
::
## Protecting an app via reverse proxy
Swag doesn't ship a ready-made include file for TinyAuth, so we'll add the forward-auth check directly to the app's own `*.subdomain.conf`. We'll use Dockge as an example.
SWAG doesn't ship a ready-made include file for TinyAuth, so we'll add the forward-auth check directly to the app's own `*.subdomain.conf`. We'll use Dockge as an example.
::steps{level="3"}
### Open the app's subdomain.conf file
content/en/3.serveex/3.security/4.pocket-id.md
+3 -3
View File
@@ -96,7 +96,7 @@ TRUST_PROXY=true
|----------|-------|---------|
| `APP_URL`{lang=properties} | The public URL you'll use to reach Pocket ID (see exposure below) | `https://id.mydomain.com` |
| `ENCRYPTION_KEY`{lang=properties} | The key generated above | `Q2pVEqsTNRkJSO9SkJzU3KZ2...` |
| `TRUST_PROXY`{lang=properties} | Required since Pocket ID sits behind Swag | `true` |
| `TRUST_PROXY`{lang=properties} | Required since Pocket ID sits behind SWAG | `true` |
Deploy the stack. The local interface is available at `http://yourserverip:1411`.
@@ -114,7 +114,7 @@ Pocket ID doesn't use passwords: your first account is created with a **passkey*
Passkeys require a secure context: HTTPS, or `localhost`. Registering one from `http://yourserverip:1411` on another machine will be refused by the browser, since that's plain HTTP to a non-`localhost` address. If setup doesn't complete locally, expose Pocket ID first (see below) and finish setup over HTTPS instead.
::
## Exposing Pocket ID with Swag
## Exposing Pocket ID with SWAG
Other apps need to reach Pocket ID over HTTPS to complete the OIDC login flow, so it must be exposed even if you only use it from home.
::note
@@ -153,7 +153,7 @@ Here we assume the Pocket ID network name is `pocket-id_default`. You can check
### Create the subdomain.conf file
In the Swag folders, create the file `id.subdomain.conf`:
In the SWAG folders, create the file `id.subdomain.conf`:
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
content/en/3.serveex/4.monitoring/1.uptime-kuma.md
+6 -4
View File
@@ -6,7 +6,9 @@ description: Install Uptime-Kuma to monitor your self-hosted services uptime, se
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
![picture](/img/serveex/uptime_kuma.jpg)
[Uptime-Kuma](https://github.com/louislam/uptime-kuma) is a self-hosted monitoring tool that regularly checks whether your other services and sites are up and reachable, and alerts you the moment one goes down. It can also build a public status page to share your services' health with others.
![Uptime-Kuma dashboard showing monitored services and their status](/img/serveex/uptime_kuma.jpg)
## Installation
@@ -65,7 +67,7 @@ __If it fails:__ check your firewall rules.
### Done!
::
## Expose with Swag
## Expose with SWAG
::note{icon=""}
📋 __Before you begin:__
<br/><br/>
@@ -74,13 +76,13 @@ We assume you have the subdomain `stats.mydomain.com` with a `CNAME` pointing to
::warning
Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on the internet could compromise the machines it monitors. Only do this if you're using an MFA system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG; use a VPN like [Wireguard](/serveex/core/wireguard) instead.
Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on the internet could compromise the machines it monitors. Only do this if you're using an MFA system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG; use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
::steps{level="3"}
### Create the subdomain.conf file
In the Swag folders, create the `stats.subdomain.conf` file.
In the SWAG folders, create the `stats.subdomain.conf` file.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip for those who dislike the terminal:__
content/en/3.serveex/4.monitoring/2.dozzle.md
+4 -4
View File
@@ -104,14 +104,14 @@ Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web
### Done!
::
## Exposing Dozzle with Swag
## Exposing Dozzle with SWAG
::warning
Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [Wireguard](/serveex/core/wireguard).
Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [WireGuard](/serveex/core/wireguard).
::
You may want to access Dozzle remotely and on all your devices. To do so, we’ll expose Dozzle via Swag.
You may want to access Dozzle remotely and on all your devices. To do so, we’ll expose Dozzle via SWAG.
::note{icon=""}
📋 __Before you begin:__
@@ -150,7 +150,7 @@ We assume the Dozzle network name is `dozzle_default`. You can verify the connec
### Create the subdomain.conf file
In the Swag folder, create the `dozzle.subdomain.conf` file.
In the SWAG folder, create the `dozzle.subdomain.conf` file.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to browse and edit files instead of using terminal commands.
content/en/3.serveex/4.monitoring/3.speedtest-tracker.md
+1 -1
View File
@@ -102,7 +102,7 @@ Now we want to expose Speedtest Tracker to the internet so you can access it rem
::warning
Speedtest Tracker does not use multi-factor authentication. Exposing it on the internet could compromise connected devices. Do so only if you use a multi-factor system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid using SWAG and prefer a VPN like [Wireguard](/serveex/core/wireguard).
Speedtest Tracker does not use multi-factor authentication. Exposing it on the internet could compromise connected devices. Do so only if you use a multi-factor system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid using SWAG and prefer a VPN like [WireGuard](/serveex/core/wireguard).
::
::steps{level="3"}
content/en/3.serveex/4.monitoring/4.beszel.md
+7 -7
View File
@@ -182,14 +182,14 @@ Deploy the stack on the remote server. Data will begin flowing into the web UI a
__If it fails:__ check your firewall rules.
::
## Expose Beszel with Swag
## Expose Beszel with SWAG
::warning
Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
If you want to access Beszel remotely from all your devices, expose it using Swag.
If you want to access Beszel remotely from all your devices, expose it using SWAG.
::note{icon="" to="/general/networking/nat"}
📋 __Prerequisite:__
@@ -200,7 +200,7 @@ You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME`
::steps{level="3"}
### Add Beszel's network to SWAG
In Dockge, edit Swag's compose file and add Beszel’s network:
In Dockge, edit SWAG's compose file and add Beszel’s network:
```yaml [compose.yaml]
---
@@ -219,16 +219,16 @@ networks:
external: true
```
Redeploy the stack and wait for Swag to become fully operational.
Redeploy the stack and wait for SWAG to become fully operational.
::note
We assume the network name is `beszel_default`. You can check connectivity by visiting Swag's dashboard at `http://yourserverip:81`.
We assume the network name is `beszel_default`. You can check connectivity by visiting SWAG's dashboard at `http://yourserverip:81`.
::
### Create the subdomain.conf file
In Swag’s config folders, create `beszel.subdomain.conf`.
In SWAG’s config folders, create `beszel.subdomain.conf`.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ Use **File Browser Quantum** to browse and edit files instead of terminal commands.
content/en/3.serveex/4.monitoring/5.upsnap.md
+4 -4
View File
@@ -85,14 +85,14 @@ Deploy the container and go to `http://yourserverip:8095`. Just follow the steps
__If it fails:__ check your firewall rules.
::
## Exposing UpSnap with Swag
## Exposing UpSnap with SWAG
::warning
UpSnap does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Do this only if you're using a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid exposing it with SWAG and use a VPN like [Wireguard](/serveex/core/wireguard) instead.
UpSnap does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Do this only if you're using a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid exposing it with SWAG and use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
You may want to access it remotely from all your devices. To do so, we'll expose UpSnap via Swag.
You may want to access it remotely from all your devices. To do so, we'll expose UpSnap via SWAG.
::note{icon=""}
📋 __Beforehand:__
@@ -131,7 +131,7 @@ Here we assume the network name for upsnap is `upsnap_default`. You can check th
### Create the subdomain.conf file
In the Swag folders, create the file `upsnap.subdomain.conf`.
In the SWAG folders, create the file `upsnap.subdomain.conf`.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to navigate your files and edit documents instead of using terminal commands.
content/en/3.serveex/5.media/1.jellyfin.md
+1 -1
View File
@@ -16,7 +16,7 @@ As always, we'll use the [linuxserver.io image](https://docs.linuxserver.io/imag
::note{to="/serveex/core/wireguard"}
Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like **Wireguard**.
Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like **WireGuard**.
::
## Install Jellyfin
content/en/3.serveex/5.media/2.qbittorrent.md
+15 -15
View File
@@ -1,24 +1,24 @@
---
title: Qbittorrent
title: qBittorrent
description: Install qBittorrent with Gluetun and ProtonVPN to download torrents securely behind a VPN on your self-hosted server.
---
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
![Picture](/img/serveex/qbit-vue.jpeg)
![VueTorrent web interface showing active torrent downloads](/img/serveex/qbit-vue.jpeg)
To safely download your favorite media, we'll build a system using:
- [Qbittorrent](https://github.com/linuxserver/docker-qbittorrent) as the BitTorrent client
- [qBittorrent](https://github.com/linuxserver/docker-qbittorrent) as the BitTorrent client
- [Proton VPN Plus](https://protonvpn.com/torrenting), a VPN to secure your traffic. You need a subscription (promos available) to access the BitTorrent protocol. You can also use another VPN as long as it supports BitTorrent.
- [Gluetun](https://github.com/qdm12/gluetun)
- [Qbittorrent port update](https://codeberg.org/TechnoSam/qbittorrent-gluetun-port-update) to automatically update the VPN port (which changes regularly).
- [qBittorrent port update](https://codeberg.org/TechnoSam/qbittorrent-gluetun-port-update) to automatically update the VPN port (which changes regularly).
- The [VueTorrent](https://github.com/gabe565/linuxserver-mod-vuetorrent) mod for a modern and intuitive UI.
Here’s the system we’ll set up:
![Picture](/img/serveex/qbit.svg)
![Diagram of qBittorrent routing its traffic through the Gluetun VPN tunnel](/img/serveex/qbit.svg)
## Configuration
@@ -34,7 +34,7 @@ tree:
- gluetun/
- compose.yaml
- .env
- "media # linked to Jellyfin and Qbittorrent":
- "media # linked to Jellyfin and qBittorrent":
- "downloads/ # generic downloads, selected in settings"
- "movies/ # used for downloading movies"
- "tvseries/ # used for downloading TV shows"
@@ -122,7 +122,7 @@ services:
### Configure the download port update
Before editing the `.env` in Dockge, let's configure the download port update. Proton and most VPNs rotate the forwarding port, which must be communicated to Qbittorrent.
Before editing the `.env` in Dockge, let's configure the download port update. Proton and most VPNs rotate the forwarding port, which must be communicated to qBittorrent.
We’ve added the mod `ghcr.io/t-anc/gsp-qbittorent-gluetun-sync-port-mod` to the container.
@@ -181,8 +181,8 @@ Detailed info:
| `UI_PORT` | Port for accessing the web UI | `5695` |
| `PR_KEY` | Private key from Proton | `buKsjNHLyzKMM1qYnzOy4s7SHfly` |
| `GSP_KEY` | Key you generated for port update | `MnBa47MeVmk7xiv` |
| `ID` | Qbittorrent UI login username | `user` |
| `PW` | Qbittorrent UI password | `password` |
| `ID` | qBittorrent UI login username | `user` |
| `PW` | qBittorrent UI password | `password` |
### Done!
::
@@ -217,7 +217,7 @@ Change your username and password in the "webui" settings.
### Done!
::
You're done! In Qbittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
You're done! In qBittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
When adding a download, remember to select the proper directory so Jellyfin can sync correctly (`/media/movies` or `/media/tvseries`). You can also automate this with categories and folders.
@@ -225,10 +225,10 @@ When adding a download, remember to select the proper directory so Jellyfin can
::warning
Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
qBittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
To start downloads from outside your home, without a VPN, you can expose the Qbittorrent web UI.
To start downloads from outside your home, without a VPN, you can expose the qBittorrent web UI.
::note
@@ -334,9 +334,9 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
### Done!
::
Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the Qbittorrent interface.
Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the qBittorrent interface.
## Protecting Qbittorrent with TinyAuth
## Protecting qBittorrent with TinyAuth
Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `seedbox.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy):
```nginx [seedbox.subdomain.conf]{26-38,41-42}
@@ -418,4 +418,4 @@ The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs t
And that’s it! You now have a ready-to-use media center.
![Picture](/img/serveex/seed.svg)
![Diagram of the complete seedbox setup, from qBittorrent to SWAG](/img/serveex/seed.svg)
content/en/3.serveex/5.media/3.servarr.md
+7 -7
View File
@@ -49,7 +49,7 @@ tree:
::warning
__Warning:__ Make sure to follow this file structure carefully, especially the `media` folder. This folder must be mounted **exactly the same way** in both the _Qbittorrent_ compose file (`/your/path/media:/media`) and the _arr_ applications. If not, the _arr_ apps may not recognize the path provided by Qbittorrent and will fail to create _hardlinks_. Without hardlinks, the _arr_ apps will copy the files instead, **doubling the space used** on your storage.
__Warning:__ Make sure to follow this file structure carefully, especially the `media` folder. This folder must be mounted **exactly the same way** in both the _Qbittorrent_ compose file (`/your/path/media:/media`) and the _arr_ applications. If not, the _arr_ apps may not recognize the path provided by qBittorrent and will fail to create _hardlinks_. Without hardlinks, the _arr_ apps will copy the files instead, **doubling the space used** on your storage.
::
::steps{level="3"}
@@ -170,7 +170,7 @@ MEDIA_PATH=
|----------------|-------------------------------------------------------------------------------------------------|-------------|
| `PUID` | Set using your user info (check with `id yourusername`) | `1000` |
| `PGID` | Same as above | `1000` |
| `MEDIA_PATH` | Path to your media folder, here: `/media`. It must match the one used by Qbittorrent. | `/media` |
| `MEDIA_PATH` | Path to your media folder, here: `/media`. It must match the one used by qBittorrent. | `/media` |
::note
@@ -207,7 +207,7 @@ Create an account and choose *forms login*.
::warning
__Warning:__ If you already have movies in `movies` from Qbittorrent, do not let Radarr add them. Radarr might modify them, which could stop seeding in Qbittorrent.
__Warning:__ If you already have movies in `movies` from qBittorrent, do not let Radarr add them. Radarr might modify them, which could stop seeding in qBittorrent.
::
#### Configure Profiles
@@ -216,12 +216,12 @@ Go to *Settings > Profiles*. These are your default quality profiles. When you m
![profiles_radarr](/img/serveex/radarr1.png)
#### Add Qbittorrent
#### Add qBittorrent
In *Settings > Download Clients*, add Qbittorrent.
In *Settings > Download Clients*, add qBittorrent.
- Use your server IP as *Host* and port `5695` if following this guide.
- Provide your Qbittorrent *Username* and *Password*.
- Provide your qBittorrent *Username* and *Password*.
- Click *Test*.
- If successful, click *Save*.
@@ -389,7 +389,7 @@ It can be useful to expose Seerr if you want to send requests from outside your
::warning
Seerr has no built-in two-factor authentication. Only expose it if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik). Otherwise, don't expose it with SWAG, use a VPN like [Wireguard](/serveex/core/wireguard) instead.
Seerr has no built-in two-factor authentication. Only expose it if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik). Otherwise, don't expose it with SWAG, use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
::note
content/en/3.serveex/6.cloud/1.immich.md
+1 -1
View File
@@ -8,7 +8,7 @@ description: Install Immich, a self-hosted alternative to Google Photos and iClo
[Immich](https://immich.app/docs/overview/introduction) is a self-hosted photo and video management solution that replaces cloud services like Google Photos or iCloud. It offers powerful features like face recognition and geolocation.
![Picture](/img/serveex/immich.png)
![Immich web interface showing a photo library timeline](/img/serveex/immich.png)
## Installation
content/en/3.serveex/6.cloud/2.nextcloud.md
+4 -4
View File
@@ -8,7 +8,7 @@ description: Install Nextcloud to self-host your files, photos, and calendar, a
[Nextcloud](https://nextcloud.com/) is a self-hosted solution that allows you to access and synchronize your data across all your devices. It also includes collaboration features, calendar, and more. It’s a great alternative to services like Google Drive, iCloud, or OneDrive.
![Picture](/img/serveex/nextcloud.png)
![Nextcloud web interface showing files and folders](/img/serveex/nextcloud.png)
## Installation
::note{to="https://docs.linuxserver.io/images/docker-nextcloud/"}
@@ -84,8 +84,8 @@ Deploy the stack and visit `http://yourserverip:4545` to complete the setup.
__If it fails:__ check your firewall rules.
::
## Exposing Nextcloud with Swag
The goal of this setup is to access Nextcloud remotely from all your devices. We’ll use Swag to expose the app.
## Exposing Nextcloud with SWAG
The goal of this setup is to access Nextcloud remotely from all your devices. We’ll use SWAG to expose the app.
::note
@@ -155,7 +155,7 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
### Create the subdomain.conf file
In Swag’s folders, create the file `nextcloud.subdomain.conf`:
In SWAG’s folders, create the file `nextcloud.subdomain.conf`:
```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/proxy-confs/nextcloud.subdomain.conf
content/en/3.serveex/7.files/1.file-browser-quantum.md
+4 -4
View File
@@ -104,14 +104,14 @@ Deploy the container and go to `http://yourserverip:8020`. Log in with the defau
__If it doesn't work:__ check your firewall rules.
::
## Exposing File Browser Quantum with Swag
## Exposing File Browser Quantum with SWAG
::warning
File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through Swag.
You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through SWAG.
::note{icon=""}
@@ -149,7 +149,7 @@ Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.
### Create the subdomain.conf file
In the Swag folders, create the file `fbq.subdomain.conf`.
In the SWAG folders, create the file `fbq.subdomain.conf`.
```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/proxy-confs/fbq.subdomain.conf
content/en/3.serveex/7.files/2.pingvin.md
+9 -9
View File
@@ -8,7 +8,7 @@ description: Install Pingvin Share, a self-hosted file sharing platform to send
[Pingvin](https://github.com/stonith404/pingvin-share) is a tool for quickly sharing files, similar to WeTransfer. Its many sharing options (password, expiration time, custom link, etc.) make it the ideal tool for sharing files quickly. Pingvin can also create _upload requests_, i.e. a shareable link you can send to someone so they can upload their files for you to retrieve.
![picture](/img/serveex/pingvin.png)
![Pingvin Share web interface for uploading and sharing files](/img/serveex/pingvin.png)
## Installation
@@ -42,7 +42,7 @@ services:
```
::note
From here on, we assume the network name for Swag is `swag_default`.
From here on, we assume the network name for SWAG is `swag_default`.
::
::tip{icon=""}
@@ -74,8 +74,8 @@ Deploy the container and go to `http://yourserverip:3600`. That's it! Your Pingv
__If it fails:__ check your firewall rules.
::
## Exposing Pingvin with Swag
The whole point of a solution like this is being able to access it remotely, from all your devices. To do this, we'll expose Pingvin through Swag.
## Exposing Pingvin with SWAG
The whole point of a solution like this is being able to access it remotely, from all your devices. To do this, we'll expose Pingvin through SWAG.
::note{icon=""}
📋 __Prerequisite:__ <br/><br/>
@@ -113,7 +113,7 @@ Redeploy the stack by clicking "deploy" and wait for SWAG to be fully up.
### Create the subdomain.conf file
In the Swag folders, create the `pingvin.subdomain.conf` file.
In the SWAG folders, create the `pingvin.subdomain.conf` file.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
@@ -224,15 +224,15 @@ In your Authentik admin area, create an OAuth2/OpenID provider.
Fill in each section as follows, replacing `mydomain.com` with your own domain. Copy the `Client ID` and `Client Secret` fields somewhere safe.
![picture](/img/serveex/pingvin-auth1.png)
![picture](/img/serveex/pingvin-auth2.png)
![picture](/img/serveex/pingvin-auth3.png)
![Authentik OAuth2/OpenID provider configuration screen, part 1](/img/serveex/pingvin-auth1.png)
![Authentik OAuth2/OpenID provider configuration screen, part 2](/img/serveex/pingvin-auth2.png)
![Authentik OAuth2/OpenID provider configuration screen, part 3](/img/serveex/pingvin-auth3.png)
#### Create the application
Save and create a `pingvin` application as follows.
![picture](/img/serveex/pingvin-auth4.png)
![Authentik application creation screen for Pingvin Share](/img/serveex/pingvin-auth4.png)
#### Add the provider to your outpost
content/en/3.serveex/8.development/1.code-server.md
+3 -3
View File
@@ -118,8 +118,8 @@ services:
```
Once inside VS Code, you'll have access to the mounted folder.
## Expose code-server with Swag
The whole point of such a solution is to access it remotely from any device. To do this, we’ll expose code-server via Swag.
## Expose code-server with SWAG
The whole point of such a solution is to access it remotely from any device. To do this, we’ll expose code-server via SWAG.
::note
@@ -157,7 +157,7 @@ Redeploy the stack by clicking “deploy” and wait until SWAG is fully operati
### Create the subdomain.conf file
Inside the Swag config folders, create the file `code.subdomain.conf`.
Inside the SWAG config folders, create the file `code.subdomain.conf`.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
content/en/3.serveex/8.development/2.forgejo.md
+3 -3
View File
@@ -73,8 +73,8 @@ Deploy the container and go to `http://yourserverip:3333`. Your Forgejo instance
__If it fails:__ check your firewall rules.
::
## Exposing Forgejo with Swag
The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Forgejo through Swag.
## Exposing Forgejo with SWAG
The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Forgejo through SWAG.
::note
@@ -112,7 +112,7 @@ Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational
### Create the subdomain.conf file
Inside the Swag folders, create the file `forgejo.subdomain.conf`.
Inside the SWAG folders, create the file `forgejo.subdomain.conf`.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
content/en/3.serveex/8.development/3.it-tools.md
+3 -3
View File
@@ -51,8 +51,8 @@ Deploy the container and visit `http://yourserverip:3222`. That’s it, your IT
__If it fails:__ check your firewall rules.
::
## Expose IT Tools with Swag
You might want to access it remotely on all your devices. To do that, we'll expose IT Tools using Swag.
## Expose IT Tools with SWAG
You might want to access it remotely on all your devices. To do that, we'll expose IT Tools using SWAG.
::note
@@ -95,7 +95,7 @@ Restart the stack by clicking "deploy" and wait for SWAG to be fully operational
### Create the subdomain.conf file
Inside the Swag folders, create the file `tools.subdomain.conf`.
Inside the SWAG folders, create the file `tools.subdomain.conf`.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
content/en/3.serveex/9.apps/1.adguard.md
+11 -11
View File
@@ -1,5 +1,5 @@
---
title: Adguard Home
title: AdGuard Home
description: Install AdGuard Home for network-wide ad and tracker blocking with DNS-over-HTTPS, client management, and custom filtering rules.
---
@@ -10,9 +10,9 @@ description: Install AdGuard Home for network-wide ad and tracker blocking with
It works as a DNS server that redirects tracking domains to a “black hole,” preventing your devices from connecting to them.
In practice, once it's in place, all you need to do is set your devices to use Adguard as their DNS server.
In practice, once it's in place, all you need to do is set your devices to use AdGuard as their DNS server.
![adguard](/img/serveex/adguard.png)
![AdGuard](/img/serveex/adguard.png)
**Quick reminder of how DNS works:**
@@ -20,14 +20,14 @@ When you visit a site or use an app, it makes requests to various domains to loa
By default, your device uses your ISP's DNS server, which is usually configured in your router or, for mobile devices, at the carrier’s CGNAT level. You can change this in your browser settings, your device’s system settings, or even directly in your router, depending on your ISP.
Adguard will act as a middleman between your device and the upstream DNS servers. If you configure your devices to use Adguard:
AdGuard will act as a middleman between your device and the upstream DNS servers. If you configure your devices to use AdGuard:
- If the domain is not in a blocklist, Adguard queries the upstream DNS servers and returns the correct IP to your device.
- If the domain *is* in a blocklist, Adguard will block the request and return nothing, so the associated content won’t load.
- If the domain is not in a blocklist, AdGuard queries the upstream DNS servers and returns the correct IP to your device.
- If the domain *is* in a blocklist, AdGuard will block the request and return nothing, so the associated content won’t load.
This is how ads and malicious domains are blocked: Adguard blocks only the bad domains, allowing the rest of the page to load normally.
This is how ads and malicious domains are blocked: AdGuard blocks only the bad domains, allowing the rest of the page to load normally.
![Picture](/img/serveex/adguard.svg)
![Diagram of AdGuard filtering a DNS request against a blocklist](/img/serveex/adguard.svg)
## Installation
@@ -47,7 +47,7 @@ tree:
::note
We will also mount the `/srv/docker/swag/config/etc/letsencrypt` folder to access Swag's SSL certificate.
We will also mount the `/srv/docker/swag/config/etc/letsencrypt` folder to access SWAG's SSL certificate.
::
::steps{level="3"}
@@ -102,7 +102,7 @@ The setup wizard asks you to pick an admin interface port. Keep it at `3000`: th
### Done!
::
That’s it! Adguard is deployed.
That’s it! AdGuard is deployed.
## Exposing AdGuard with SWAG
To make AdGuard usable from outside your home network, you need to expose it.
@@ -363,7 +363,7 @@ To configure encryption:
- Go to _Settings_ then _Encryption_.
- Set the options as follows:
![Picture](/img/serveex/adguard-chiffrement.png)
![AdGuard Home encryption settings screen](/img/serveex/adguard-chiffrement.png)
- Below, in the _Certificates_ section, check _Use file path for certificate_
- In the input field, enter `/swag-ssl/live/mydomain.com/fullchain.pem`, replacing `mydomain.com` with your actual domain.
content/en/3.serveex/91.advanced/1.authentik.md
+6 -6
View File
@@ -25,11 +25,11 @@ There are two main modes you should know:
- The first allows apps with native support for OpenID-compatible SSO to connect directly to Authentik. This is the preferred method, as the app itself decides what’s public and what’s protected.
![Picture](/img/serveex/auth-native.svg)
![Diagram of an app connecting natively to Authentik via OpenID](/img/serveex/auth-native.svg)
- The second method injects Authentik authentication through SWAG before reaching the target service.
![Picture](/img/serveex/auth-proxy.svg)
![Diagram of Authentik injecting authentication through SWAG as a reverse proxy](/img/serveex/auth-proxy.svg)
Both modes can be configured on a per-application basis.
@@ -374,15 +374,15 @@ Why do this when Dockge already has authentication? Because Dockge uses weak HTT
- Select _Applications_ then _Create with wizard_
- Fill in the fields as shown:
![Picture](/img/serveex/auth1.png)
![Authentik application creation wizard](/img/serveex/auth1.png)
- At the next step, choose "Forward authentication (single application)" and configure it as shown (flows are important):
![Picture](/img/serveex/auth2.png)
![Authentik forward authentication provider configuration](/img/serveex/auth2.png)
- Next, go to the _Outposts_ menu on the left and edit _authentik Embedded Outpost_:
![Picture](/img/serveex/auth3.png)
![Authentik embedded outpost application list](/img/serveex/auth3.png)
- Add the `dockge` application by moving it to the right column and save.
@@ -414,7 +414,7 @@ Repeat this process for each app you want to protect (unless it has native integ
Your new architecture looks like this:
![Picture](/img/serveex/authentik.svg)
![Diagram of the resulting architecture with Authentik protecting apps via SWAG](/img/serveex/authentik.svg)
## Protecting a Remote Server Service
For a [native application](/serveex/advanced/authentik/#protecting-a-native-app) (via OAuth 2.0 or other), nothing changes.
content/en/3.serveex/91.advanced/2.arcane.md
+2 -2
View File
@@ -155,7 +155,7 @@ The main benefit of this setup is being able to access Arcane remotely from all
::warning
Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead, especially given the level of access Arcane has over your host.
Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead, especially given the level of access Arcane has over your host.
::
::note
@@ -194,7 +194,7 @@ Here we assume the Arcane network name is `arcane_default`. You can check the co
### Create the subdomain.conf file
In the Swag folders, create the file `arcane.subdomain.conf`:
In the SWAG folders, create the file `arcane.subdomain.conf`:
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
content/en/4.stockeex/1.introduction.md
+1 -1
View File
@@ -15,5 +15,5 @@ currently writing, come back later...
--
```
<div align="center">
<img src="/img/stockeex/stockeex-raid.svg" alt="Image" style="max-width: 60%;">
<img src="/img/stockeex/stockeex-raid.svg" alt="Diagram of a RAID array" style="max-width: 60%;">
</div>
content/en/5.nonsense/1.summary.md
+1 -1
View File
@@ -32,7 +32,7 @@ Discord alerts for GPU stock availability
::card
---
icon: i-cbi-adguard
title: Adguard CIDRE
title: AdGuard CIDRE
to: /nonsense/python/adguard-cidre
ui:
icon: text-[#68BC71]
content/en/5.nonsense/2.python/2.adguard-cidre.md
+10 -10
View File
@@ -1,33 +1,33 @@
---
title: Adguard CIDRE
title: AdGuard CIDRE
description: A Python script to sync AdGuard Home CIDR allowlists automatically, securing your self-hosted DNS server exposed to the internet.
---
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
Adguard Home is a fantastic solution for DNS-level ad blocking and rewriting requests, perfect for removing ISP DNS trackers or intrusive ads.
AdGuard Home is a fantastic solution for DNS-level ad blocking and rewriting requests, perfect for removing ISP DNS trackers or intrusive ads.
It works great locally, but if you want all your devices (even on the go) to benefit, you’ll need to expose Adguard to the internet. Unfortunately, that means anyone can use it, potentially overloading your €1/month remote VPS.
It works great locally, but if you want all your devices (even on the go) to benefit, you’ll need to expose AdGuard to the internet. Unfortunately, that means anyone can use it, potentially overloading your €1/month remote VPS.
Adguard allows whitelisting or blacklisting clients. The problem? To whitelist a client, you need their IP, but for mobile phones, that IP changes often. Instead of trying to whitelist ever-changing IPs, the better approach is to block broader IP ranges by region.
AdGuard allows whitelisting or blacklisting clients. The problem? To whitelist a client, you need their IP, but for mobile phones, that IP changes often. Instead of trying to whitelist ever-changing IPs, the better approach is to block broader IP ranges by region.
CIDRE is a tool that syncs geo-targeted IP ranges with firewalls. Instead of running CIDRE with a full firewall stack on the remote server, I figured I could just import those regularly updated IP ranges into Adguard’s blocklist.
CIDRE is a tool that syncs geo-targeted IP ranges with firewalls. Instead of running CIDRE with a full firewall stack on the remote server, I figured I could just import those regularly updated IP ranges into AdGuard’s blocklist.
Thus, Adguard CIDRE Sync was born: a container that syncs Adguard’s blocklist with CIDRE’s updated IP ranges on a schedule of your choosing.
Thus, AdGuard CIDRE Sync was born: a container that syncs AdGuard’s blocklist with CIDRE’s updated IP ranges on a schedule of your choosing.
The idea is to:
- Backup Adguard’s config file on first run (original untouched version saved)
- Backup AdGuard’s config file on first run (original untouched version saved)
- Download selected country IP ranges via an environment variable
- Let you manually add custom IPs via a file
- Concatenate, backup the config again (as the updated version), and inject the list into the correct blocklist section
- Reload Adguard by restarting the container (using Docker socket proxy for limited permissions)
- Reload AdGuard by restarting the container (using Docker socket proxy for limited permissions)
All fully autonomous, with frequency set via environment variable in the `docker-compose` config.
More info directly on the repo:
::card{title="🐋 __Adguard CIDRE Sync__" to="https://git.djeex.fr/Djeex/adguard-cidre" target="_blank"}
Adguard blocklist sync bot
::card{title="🐋 __AdGuard CIDRE Sync__" to="https://git.djeex.fr/Djeex/adguard-cidre" target="_blank"}
AdGuard blocklist sync bot
::
content/en/5.nonsense/3.bash/1.servarr-duplicates.md
+1 -1
View File
@@ -8,7 +8,7 @@ description: A bash script to detect and fix duplicate media files in Sonarr and
Six months after downloading terabytes of media, I realized that Sonarr and Radarr were copying them into my Plex library instead of creating hardlinks. This happens due to a counterintuitive mechanism: if you mount multiple folders in Sonarr/Radarr, it sees them as different filesystems and thus cannot create hardlinks. That’s why you should mount only one parent folder containing all child folders (like `downloads`, `movies`, `tvseries` inside a `media` parent folder).
So I restructured my directories, manually updated every path in Qbittorrent, Plex, and others. The last challenge was finding a way to detect existing duplicates, delete them, and automatically create hardlinks instead, to save space.
So I restructured my directories, manually updated every path in qBittorrent, Plex, and others. The last challenge was finding a way to detect existing duplicates, delete them, and automatically create hardlinks instead, to save space.
::file-tree
---
content/en/5.nonsense/3.bash/3.socat-proxy.md
+1 -1
View File
@@ -23,7 +23,7 @@ With this setup, Docker Socket Proxy communicates with Socat Proxy in their isol
In short:
![](/img/nonsense/socat-proxy.svg)
![Diagram of Socat Proxy relaying the Docker socket between isolated networks](/img/nonsense/socat-proxy.svg)
For example, with Beszel, the configuration would look like this:
content/en/6.recycled/1.summary.md
+2 -2
View File
@@ -21,7 +21,7 @@ Not every article stays current forever. This section keeps two kinds of leftove
::card
---
icon: i-simple-icons-wireguard
title: Wireguard 14
title: WireGuard 14
to: /recycled/deprecated/wireguard-14
ui:
icon: text-[#88171A]
@@ -55,7 +55,7 @@ The paid-tier alternative to Jellyfin
::card
---
icon: i-cbi-qbittorrent
title: Qbittorrent for Plex
title: qBittorrent for Plex
to: /recycled/alternatives/qbittorrent-for-plex
ui:
icon: text-[#2F67BA]
content/en/6.recycled/2.deprecated/1.wireguard-14.md
+7 -7
View File
@@ -1,5 +1,5 @@
---
title: Wireguard 14
title: WireGuard 14
description: Archived guide to installing WireGuard VPN using linuxserver.io's older wireguard image, kept for reference only.
---
@@ -14,10 +14,10 @@ wg-easy 15 got a lot more complicated, "not so easy" anymore, arguably. That's e
## Introduction
Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.
Here we will use [Wireguard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
Here we will use [WireGuard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
- [wg-easy](https://github.com/wg-easy/wg-easy) as the server, providing a very simple web UI to manage connections and download config files (including QR codes for phones)
- [Wireguard](https://docs.linuxserver.io/images/docker-wireguard/?h=wireguard) as the client for Linux systems
- [WireGuard](https://docs.linuxserver.io/images/docker-wireguard/?h=wireguard) as the client for Linux systems
Clients are also available for Windows, macOS, iOS, and Android.
@@ -32,7 +32,7 @@ To achieve this, we’ll create a **Virtual Private Network** (VPN), i.e., a sec
Additionally, you can add your phone, laptop, or other devices to the VPN and securely access your server resources wherever you are.
![picture](/img/serveex/vpn.svg)
![Diagram of a VPN tunnel connecting a remote device to the home network](/img/serveex/vpn.svg)
In this diagram, machine 1 is part of two networks:
@@ -257,8 +257,8 @@ Repeat for each client
## Other Devices
- **Phone:** Install Wireguard and scan the QR code from the web UI (`http://your-server-ip:51821`)
- **PC:** Install the Wireguard client and import the config file
- **Phone:** Install WireGuard and scan the QR code from the web UI (`http://your-server-ip:51821`)
- **PC:** Install the WireGuard client and import the config file
::warning
@@ -268,4 +268,4 @@ __Warning:__ If a client device is on the same LAN as the server, edit `wg0.conf
And this is the result:
![picture](/img/serveex/wireguard.svg)
![Diagram of the WireGuard client-server tunnel setup](/img/serveex/wireguard.svg)
content/en/6.recycled/2.deprecated/2.file-browser.md
+4 -4
View File
@@ -58,14 +58,14 @@ Deploy the container and go to `http://yourserverip:8010`. That’s it! Your Fil
__If it doesn’t work:__ check your firewall rules.
::
## Exposing File Browser with Swag
## Exposing File Browser with SWAG
::warning
File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
You may want to access File Browser remotely from all your devices. To do that, we’ll expose it through Swag.
You may want to access File Browser remotely from all your devices. To do that, we’ll expose it through SWAG.
::note
@@ -103,7 +103,7 @@ Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.
### Create the subdomain.conf file
In the Swag folders, create the file `files.subdomain.conf`.
In the SWAG folders, create the file `files.subdomain.conf`.
```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/proxy-confs/files.subdomain.conf
content/en/6.recycled/3.alternatives/1.plex.md
+3 -3
View File
@@ -15,7 +15,7 @@ This is an alternative to **Jellyfin**, kept here for reference. Plex isn't full
With *Plex Pass*, you can also organize and play your music content similar to Spotify, the difference being that it’s your content, hosted and streamed from your server.
![picture](/img/serveex/plex.png)
![Plex web interface showing a media library](/img/serveex/plex.png)
We'll also install [Tautulli](https://docs.linuxserver.io/images/docker-tautulli/), a tool that provides detailed stats about Plex. As always, we'll use linuxserver.io images where possible.
@@ -150,7 +150,7 @@ Plex offers a range of free movies/shows. After creating your account, I recomme
Then go to the _Remote Access_ section and manually select a port (we’ll use `1234`). It's best not to use the default port.
![picture](/img/serveex/plex-port.png)
![Plex Remote Access settings with a manually chosen port](/img/serveex/plex-port.png)
- On your router, forward TCP port `1234` to port `32400` for your server’s IP using [NAT rules](/general/networking/nat).
- Once done, return to Plex to verify that remote access is functional.
@@ -173,7 +173,7 @@ Simply add your media to `/media/movies` and `/media/tvseries` on your server. Y
If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the **Samba mount guide** so Plex can access it.
::
## Expose Tautulli with Swag
## Expose Tautulli with SWAG
You don’t need to expose Plex, as it's accessible via your Plex account on plex.tv.
However, you may want to expose Tautulli so you can view stats from a simple URL when you're not home.
content/en/6.recycled/3.alternatives/2.qbittorrent for plex.md → content/en/6.recycled/3.alternatives/2.qbittorrent-for-plex.md
+15 -15
View File
@@ -1,5 +1,5 @@
---
title: Qbittorrent for Plex
title: qBittorrent for Plex
description: Install qBittorrent with Gluetun and ProtonVPN to download torrents securely behind a VPN on your self-hosted server.
---
@@ -8,22 +8,22 @@ description: Install qBittorrent with Gluetun and ProtonVPN to download torrents
::note{to="/serveex/media/qbittorrent"}
This is the seedbox setup paired with Plex rather than Jellyfin, kept here for reference. See **Qbittorrent** for the same setup paired with Jellyfin, the recommended alternative since Plex isn't fully self-hosted (its own relay, a required account) and gates features behind a Plex Pass paywall.
This is the seedbox setup paired with Plex rather than Jellyfin, kept here for reference. See **qBittorrent** for the same setup paired with Jellyfin, the recommended alternative since Plex isn't fully self-hosted (its own relay, a required account) and gates features behind a Plex Pass paywall.
::
![Picture](/img/serveex/qbit-vue.jpeg)
![VueTorrent web interface showing active torrent downloads](/img/serveex/qbit-vue.jpeg)
To safely download your favorite media, we'll build a system using:
- [Qbittorrent](https://github.com/linuxserver/docker-qbittorrent) as the BitTorrent client
- [qBittorrent](https://github.com/linuxserver/docker-qbittorrent) as the BitTorrent client
- [Proton VPN Plus](https://protonvpn.com/torrenting), a VPN to secure your traffic. You need a subscription (promos available) to access the BitTorrent protocol. You can also use another VPN as long as it supports BitTorrent.
- [Gluetun](https://github.com/qdm12/gluetun)
- [Qbittorrent port update](https://codeberg.org/TechnoSam/qbittorrent-gluetun-port-update) to automatically update the VPN port (which changes regularly).
- [qBittorrent port update](https://codeberg.org/TechnoSam/qbittorrent-gluetun-port-update) to automatically update the VPN port (which changes regularly).
- The [VueTorrent](https://github.com/gabe565/linuxserver-mod-vuetorrent) mod for a modern and intuitive UI.
Here’s the system we’ll set up:
![Picture](/img/serveex/qbit.svg)
![Diagram of qBittorrent routing its traffic through the Gluetun VPN tunnel](/img/serveex/qbit.svg)
## Configuration
@@ -39,7 +39,7 @@ tree:
- gluetun/
- compose.yaml
- .env
- "media # linked to Plex and Qbittorrent":
- "media # linked to Plex and qBittorrent":
- "downloads/ # generic downloads, selected in settings"
- "movies/ # used for downloading movies"
- "tvseries/ # used for downloading TV shows"
@@ -127,7 +127,7 @@ services:
### Configure the port-forwarding sync
Before editing the `.env` in Dockge, let's configure the download port update. Proton and most VPNs rotate the forwarding port, which must be communicated to Qbittorrent.
Before editing the `.env` in Dockge, let's configure the download port update. Proton and most VPNs rotate the forwarding port, which must be communicated to qBittorrent.
We’ve added the mod `ghcr.io/t-anc/gsp-qbittorent-gluetun-sync-port-mod` to the container.
@@ -186,8 +186,8 @@ Detailed info:
| `UI_PORT` | Port for accessing the web UI | `5695` |
| `PR_KEY` | Private key from Proton | `buKsjNHLyzKMM1qYnzOy4s7SHfly` |
| `GSP_KEY` | Key you generated for port update | `MnBa47MeVmk7xiv` |
| `ID` | Qbittorrent UI login username | `user` |
| `PW` | Qbittorrent UI password | `password` |
| `ID` | qBittorrent UI login username | `user` |
| `PW` | qBittorrent UI password | `password` |
### Done!
::
@@ -218,7 +218,7 @@ Change your username and password in the "webui" settings.
### Done!
::
You're done! In Qbittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
You're done! In qBittorrent settings, under "Downloads", set `/media/downloads` as the default folder.
When adding a download, remember to select the proper directory so Plex can sync correctly (`/media/movies` or `/media/tvseries`). You can also automate this with categories and folders.
@@ -226,10 +226,10 @@ When adding a download, remember to select the proper directory so Plex can sync
::warning
Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
qBittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [WireGuard](/serveex/core/wireguard) instead.
::
To start downloads from outside your home, without a VPN, you can expose the Qbittorrent web UI.
To start downloads from outside your home, without a VPN, you can expose the qBittorrent web UI.
::note
@@ -339,8 +339,8 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
### Done!
::
Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the Qbittorrent interface.
Wait a few minutes, then go to `https://seedbox.mydomain.com`. You should land on the qBittorrent interface.
And that’s it! You now have a ready-to-use media center.
![Picture](/img/serveex/seed.svg)
![Diagram of the complete seedbox setup, from qBittorrent to SWAG](/img/serveex/seed.svg)
content/en/6.recycled/3.alternatives/3.servarr for plex.md → content/en/6.recycled/3.alternatives/3.servarr-for-plex.md
+6 -6
View File
@@ -57,7 +57,7 @@ tree:
::warning
__Warning:__ Make sure to follow this file structure carefully, especially the `media` folder. This folder must be mounted **exactly the same way** in both the _Qbittorrent_ compose file (`/your/path/media:/media`) and the _arr_ applications.
If not, the _arr_ apps may not recognize the path provided by Qbittorrent and will fail to create _hardlinks_.
If not, the _arr_ apps may not recognize the path provided by qBittorrent and will fail to create _hardlinks_.
Without hardlinks, the _arr_ apps will copy the files instead, **doubling the space used** on your storage.
::
@@ -205,7 +205,7 @@ MEDIA_PATH=
|----------------|-------------------------------------------------------------------------------------------------|-------------|
| `PUID` | Set using your user info (check with `id yourusername`) | `1000` |
| `PGID` | Same as above | `1000` |
| `MEDIA_PATH` | Path to your media folder, here: `/media`. It must match the one used by Qbittorrent. | `/media` |
| `MEDIA_PATH` | Path to your media folder, here: `/media`. It must match the one used by qBittorrent. | `/media` |
Deploy the stack.
@@ -233,7 +233,7 @@ Create an account and choose *forms login*.
::warning
__Warning:__ If you already have movies in `movies` from Qbittorrent, do not let Radarr add them. Radarr might modify them, which could stop seeding in Qbittorrent.
__Warning:__ If you already have movies in `movies` from qBittorrent, do not let Radarr add them. Radarr might modify them, which could stop seeding in qBittorrent.
::
#### Configure Profiles
@@ -242,12 +242,12 @@ Go to *Settings > Profiles*. These are your default quality profiles. When you m
![profiles_radarr](/img/serveex/radarr1.png)
#### Add Qbittorrent
#### Add qBittorrent
In *Settings > Download Clients*, add Qbittorrent.
In *Settings > Download Clients*, add qBittorrent.
- Use your server IP as *Host* and port `5695` if following this guide.
- Provide your Qbittorrent *Username* and *Password*.
- Provide your qBittorrent *Username* and *Password*.
- Click *Test*.
- If successful, click *Save*.
content/en/6.recycled/3.alternatives/4.gitea.md
+3 -3
View File
@@ -75,8 +75,8 @@ Deploy the container and go to `http://yourserverip:3333`. Your Gitea instance i
__If it fails:__ check your firewall rules.
::
## Exposing Gitea with Swag
The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Gitea through Swag.
## Exposing Gitea with SWAG
The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Gitea through SWAG.
::note
@@ -114,7 +114,7 @@ Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational
### Create the subdomain.conf file
Inside the Swag folders, create the file `gitea.subdomain.conf`.
Inside the SWAG folders, create the file `gitea.subdomain.conf`.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser** to navigate and edit your files instead of using terminal commands.
content/en/index.md
+1 -1
View File
@@ -17,7 +17,7 @@ seo:
:::::
:::::div{class="my-6 pt-[25px] pb-[25px]"}
![](/img/global/docudjeex-home.svg){.w-full}
![Docudjeex homepage illustration](/img/global/docudjeex-home.svg){.w-full}
:::::
:::::div{class="flex flex-col sm:flex-row sm:items-center gap-3"}