Add section summary pages and make single-link admonitions clickable

2026-09-04 18:51:42 +02:00
parent f2cfa49150
commit 9c5a693281
60 changed files with 451 additions and 174 deletions
@@ -0,0 +1,68 @@
+---
+title: General
+description: General homelab knowledge, networking, storage, and hardware fundamentals that apply beyond any single self-hosted app.
+navigation:
+  icon: i-lucide-bookmark
+---
+
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
+## Homelab Fundamentals
+
+This section covers the general knowledge that [Serveex](/serveex/introduction) itself relies on but doesn't re-explain every time: how networking actually works at home, how to choose and set up storage, and what hardware to run it all on. Read it once, then link back to it from any app-specific guide.
+
+### Networking
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card{icon="i-lucide-router" title="NAT & DHCP" to="/general/networking/nat"}
+Port forwarding and fixed DHCP leases on your router
+::
+
+::card{icon="i-lucide-globe" title="DNS Zone" to="/general/networking/dns"}
+Reading and editing a domain's DNS zone
+::
+
+::card{icon="i-lucide-folder-sync" title="Samba" to="/general/networking/samba"}
+Share folders over the local network
+::
+::
+
+### Storage
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card{icon="i-lucide-database" title="RAID" to="/general/storage/raid"}
+Redundant disk arrays, hardware vs software
+::
+
+::card{icon="i-lucide-layers" title="ZFS" to="/general/storage/zfs"}
+Snapshots, checksums, and built-in redundancy
+::
+::
+
+### Hardware
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card{icon="i-lucide-cpu" title="The Basics" to="/general/hardware/basics"}
+CPUs, RAM, storage, and form factors
+::
+
+::card{icon="i-lucide-network" title="Network" to="/general/hardware/network"}
+Switches, NICs, and cabling
+::
+
+::card{icon="i-lucide-hard-drive" title="The ProloNAS" to="/general/hardware/prolonas"}
+A budget N100 home server build
+::
+::
@@ -43,10 +43,10 @@ This is useful when you have a server that must be accessible from the internet.
 To make the website accessible, you'll configure your router to redirect the domain request to your local server.  
 Assume your service runs on port `3000` locally (`http://192.168.1.50:3000`), you would redirect all traffic from port `443` on the router to port `3000` on the local server.

-::warning
+::warning{to="/serveex/core/swag"}

 __Warning:__ If you have multiple services to expose like `subdomain1.mydomain.com` and `subdomain2.mydomain.com`, your router cannot differentiate requests and forward to different ports.  
-  You must use a [Reverse Proxy](../../serveex/core/swag) to route traffic based on the request.
+  You must use a **Reverse Proxy** to route traffic based on the request.
 ::

 ## DHCP
@@ -40,8 +40,8 @@ Now, edit the file `/etc/samba/smb.conf`.
 sudo nano /etc/samba/smb.conf
 ```

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::

 Find the `workgroup` variable and name your workgroup (e.g., `workgroup = WORKGROUP`).
@@ -54,9 +54,9 @@ ZFS includes its own volume management system (vdevs). You can build a zpool usi

 ZFS handles all this natively: no external RAID software needed.

-::note
+::note{to="/general/storage/raid"}

-Check out the [article on RAID](/general/storage/raid) to find the right solution for your needs.
+Check out the **article on RAID** to find the right solution for your needs.
 ::

 ### Snapshots and Clones
@@ -76,8 +76,8 @@ Today, HDDs can store enormous amounts of data (up to 30TB, or 30,000 gigabytes,

 Generally, HDDs are best suited for storing data that doesn’t require frequent access or fast write speeds, such as media files (videos, photos), cloud drives, or archived data. They perform well in these scenarios and, most importantly, are significantly cheaper than SSDs for the same amount of storage.

-::tip{icon=""}
-✨ __Tip:__ Use multiple HDDs in [RAID](/general/storage/raid) to enhance performance and redundancy.
+::tip{icon="" to="/general/storage/raid"}
+✨ __Tip:__ Use multiple HDDs in **RAID** to enhance performance and redundancy.
 ::

 Comes in 3.5" and 2.5" formats; servers usually favor the more reliable 3.5".
@@ -58,7 +58,7 @@ Install and deploy Dockge
 ---
 icon: i-simple-icons-wireguard
 title: VPN
-to: /serveex/security/wireguard
+to: /serveex/core/wireguard
 ui:
  icon: text-[#88171A]
 ---
@@ -206,8 +206,8 @@ tree:
 sudo mkdir -p /docker/wireguard/config/wg_confs
 ```

-::tip{icon=""}
-✨ **Tip:** You can use [File Browser Quantum](/serveex/files/file-browser-quantum) instead of the terminal to edit and upload files.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ **Tip:** You can use **File Browser Quantum** instead of the terminal to edit and upload files.
 ::

 ### Create the wg0.conf file
@@ -8,9 +8,9 @@ description: Set up SWAG as a reverse proxy with automatic SSL, expose your serv

 [Swag](https://docs.linuxserver.io/general/swag/) is the core of this homelab. It’s a powerful reverse proxy that allows you to expose services on the internet using domain names, handling SSL certificate issuance (for encrypted connections), request routing, and access security (via HTTP auth or SSO like Authelia or Authentik). All the necessary documentation is [available here](https://docs.linuxserver.io/general/swag).

-::warning
+::warning{to="/serveex/core/wireguard"}

-SWAG is only useful for exposing your services to the internet, i.e. accessing them via a public URL like `https://service.mydomain.com`. If you don’t want to expose your services and prefer to always use a VPN to connect remotely, you can go [here instead](/serveex/security/wireguard).
+SWAG is only useful for exposing your services to the internet, i.e. accessing them via a public URL like `https://service.mydomain.com`. If you don’t want to expose your services and prefer to always use a VPN to connect remotely, you can go **here instead**.
 ::

 Below is an example exposing Dockge. We will install SWAG along with the dbip mod for geolocation-based blocking, and the dashboard mod for managing swag, fail2ban, and geolocation.
@@ -125,9 +125,9 @@ Assuming your DNS zone is managed by OVH (if not, please check for your [provide

 In CLI, go to the dns-conf folder and edit the `ovh.ini` file:

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for terminal-shy users:__
-You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit files instead of using terminal commands.
+You can use **File Browser Quantum** to browse and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -289,7 +289,7 @@ Now it's time to expose Dockge on the internet so you can access and manage your

 ::warning

-Dockge does not support multi-factor authentication. Exposing it online could compromise all connected machines. Only do this if you're using an MFA solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Dockge does not support multi-factor authentication. Exposing it online could compromise all connected machines. Only do this if you're using an MFA solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 ::steps{level="3"}
@@ -78,8 +78,8 @@ These two mods, merged into the SWAG container, require some configuration.

 Create a file `tunnelconfig.yml` to reference in your SWAG `compose.yaml`.

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using the terminal.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using the terminal.
 ::

 ```bash [Terminal]
@@ -204,8 +204,8 @@ Once done, deploy the stack. Check the logs: you should reach `server ready`.

 Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero Trust](https://one.dash.cloudflare.com/). By default, all subdomains will be routed through the tunnel, no need to define them [in your DNS zone](/general/networking/dns).

-::tip{icon=""}
-✨ __Tip:__ If you want to expose a service without a tunnel, just define an A record [in your DNS zone](/general/networking/dns). If resolution fails, disable the proxy function for that record, e.g. for `sub.mondomaine.fr`.
+::tip{icon="" to="/general/networking/dns"}
+✨ __Tip:__ If you want to expose a service without a tunnel, just define an A record **in your DNS zone**. If resolution fails, disable the proxy function for that record, e.g. for `sub.mondomaine.fr`.
 ![dns](/img/serveex/cf-dns.png)
 ::

@@ -175,8 +175,8 @@ Here we assume the TinyAuth network name is `tinyauth_default`. You can check th

 In the Swag folders, create the file `tinyauth.subdomain.conf`:

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -276,9 +276,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
@@ -154,8 +154,8 @@ Here we assume the Pocket ID network name is `pocket-id_default`. You can check

 In the Swag folders, create the file `id.subdomain.conf`:

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -73,7 +73,7 @@ We assume you have the subdomain `stats.mydomain.com` with a `CNAME` pointing to

 ::warning

-Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on the internet could compromise the machines it monitors. Only do this if you're using an MFA system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG; use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on the internet could compromise the machines it monitors. Only do this if you're using an MFA system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG; use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 ::steps{level="3"}
@@ -81,9 +81,9 @@ Uptime-Kuma does not use multi-factor authentication. Exposing Uptime-Kuma on th

 In the Swag folders, create the `stats.subdomain.conf` file.

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for those who dislike the terminal:__
-you can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit your files instead of using terminal commands.
+you can use **File Browser Quantum** to browse and edit your files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -237,9 +237,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
@@ -76,7 +76,7 @@ Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web

 ::warning

-Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [Wireguard](/serveex/security/wireguard).
+Dozzle does not use multi-factor authentication. Exposing Dozzle to the internet could compromise the connected machines. Only do this if you use a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG and instead use a VPN like [Wireguard](/serveex/core/wireguard).
 ::

 You may want to access Dozzle remotely and on all your devices. To do so, we’ll expose Dozzle via Swag.
@@ -120,8 +120,8 @@ We assume the Dozzle network name is `dozzle_default`. You can verify the connec

 In the Swag folder, create the `dozzle.subdomain.conf` file.

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to browse and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -258,9 +258,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -11,9 +11,9 @@ description: Install Speedtest Tracker to automatically measure and log your int
 ![speedtest-tracker](/img/serveex/speedtest-tracker.avif)

 ## Installation
-::note
+::note{to="https://docs.linuxserver.io/images/docker-speedtest-tracker/"}

-We will use the Docker image maintained by [LinuxServer.io](https://docs.linuxserver.io/images/docker-speedtest-tracker/)
+We will use the Docker image maintained by **LinuxServer.io**
 ::

 ::file-tree
@@ -82,8 +82,8 @@ GUID=1000
 PORT=3225 # port to access the web UI
 ```

-::tip{icon=""}
-✨ **Tip:** You can configure additional environment variables by referring to the [official documentation](https://docs.speedtest-tracker.dev/getting-started/environment-variables).
+::tip{icon="" to="https://docs.speedtest-tracker.dev/getting-started/environment-variables"}
+✨ **Tip:** You can configure additional environment variables by referring to the **official documentation**.
 ::

 Deploy the container and go to `http://yourserverip:3225`. Log in with the account `admin@exemple.com` and the password `password`. Don’t forget to change your ID and password once logged in!
@@ -101,7 +101,7 @@ Now we want to expose Speedtest Tracker to the internet so you can access it rem

 ::warning

-Speedtest Tracker does not use multi-factor authentication. Exposing it on the internet could compromise connected devices. Do so only if you use a multi-factor system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid using SWAG and prefer a VPN like [Wireguard](/serveex/security/wireguard).
+Speedtest Tracker does not use multi-factor authentication. Exposing it on the internet could compromise connected devices. Do so only if you use a multi-factor system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid using SWAG and prefer a VPN like [Wireguard](/serveex/core/wireguard).
 ::

 ::steps{level="3"}
@@ -261,9 +261,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -146,15 +146,15 @@ __If it fails:__ check your firewall rules.

 ::warning

-Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Beszel does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Only do this if you're using a system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 If you want to access Beszel remotely from all your devices, expose it using Swag.

-::note{icon=""}
+::note{icon="" to="/general/networking/nat"}
 📋 __Prerequisite:__
 <br/><br/>
-You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME` pointing to `mydomain.com`. Unless you're using Cloudflare Zero Trust, you must also have forwarded port `443` on your router to your server’s `443` port via [NAT rules](/general/networking/nat).
+You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME` pointing to `mydomain.com`. Unless you're using Cloudflare Zero Trust, you must also have forwarded port `443` on your router to your server’s `443` port via **NAT rules**.
 ::

 ::steps{level="3"}
@@ -190,8 +190,8 @@ We assume the network name is `beszel_default`. You can check connectivity by vi

 In Swag’s config folders, create `beszel.subdomain.conf`.

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit files instead of terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser Quantum** to browse and edit files instead of terminal commands.
 ::

 ```bash [Terminal]
@@ -315,9 +315,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -88,7 +88,7 @@ __If it fails:__ check your firewall rules.

 ::warning

-UpSnap does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Do this only if you're using a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid exposing it with SWAG and use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+UpSnap does not support multi-factor authentication. Exposing it on the internet could compromise connected machines. Do this only if you're using a multi-factor authentication system like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, avoid exposing it with SWAG and use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 You may want to access it remotely from all your devices. To do so, we'll expose UpSnap via Swag.
@@ -132,8 +132,8 @@ Here we assume the network name for upsnap is `upsnap_default`. You can check th

 In the Swag folders, create the file `upsnap.subdomain.conf`.

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate your files and edit documents instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to navigate your files and edit documents instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -270,9 +270,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -14,9 +14,9 @@ It covers the same basics: a media library with metadata and artwork, transcodin

 As always, we'll use the [linuxserver.io image](https://docs.linuxserver.io/images/docker-jellyfin).

-::note
+::note{to="/serveex/core/wireguard"}

-Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like [Wireguard](/serveex/security/wireguard).
+Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like **Wireguard**.
 ::

 ## Install Jellyfin
@@ -100,9 +100,9 @@ GUID=1000

 Deploy the stack. The local interface is available at `http://yourserverip:8096`.

-::note
+::note{to="https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration"}

-The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following [linuxserver.io's documentation](https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration).
+The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following **linuxserver.io's documentation**.
 ::

 ### Done !
@@ -116,9 +116,9 @@ On first visit, Jellyfin walks you through a setup wizard:

 And that's it! Add your media to `/media/movies` and `/media/tvseries` on your server. See below to start watching, at home or remotely.

-::note
+::note{to="/general/networking/samba"}

-If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the [Samba mount guide](/general/networking/samba) so Jellyfin can access it.
+If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the **Samba mount guide** so Jellyfin can access it.
 ::

 ## Hardware Transcoding
@@ -127,8 +127,8 @@ Jellyfin re-encodes video on the fly whenever a client can't play a file as-is:

 **Tone mapping** is a related, separate feature: converting HDR video (which needs a compatible HDR display to look right) down to SDR so it displays correctly on a screen, TV, or client that doesn't support HDR, instead of looking washed out or overly dark.

-::note
-This only applies to Intel (and some AMD) integrated GPUs passed through with `/dev/dri`, already included in this guide's `compose.yaml`. NVIDIA GPUs need a different setup entirely, covered in [linuxserver.io's documentation](https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration). If your server has no compatible GPU, transcoding still works, just entirely on the CPU.
+::note{to="https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration"}
+This only applies to Intel (and some AMD) integrated GPUs passed through with `/dev/dri`, already included in this guide's `compose.yaml`. NVIDIA GPUs need a different setup entirely, covered in **linuxserver.io's documentation**. If your server has no compatible GPU, transcoding still works, just entirely on the CPU.
 ::

 ::steps{level="3"}
@@ -186,24 +186,24 @@ __If it fails:__ check your firewall rules.
 ## Watching Away From Home

 ::warning
-Jellyfin won't be exposed to the internet on this site, unlike most other apps. Its native apps (phone, TV, Chromecast...) talk directly to its API rather than a browser, so a forward-auth layer like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik) can't sit in front of it without breaking login and playback on those clients, and Jellyfin itself has no built-in 2FA or OIDC to fall back on. So instead of exposing it, we'll reach it through the [WireGuard VPN](/serveex/security/wireguard) already set up earlier in this guide.
+Jellyfin won't be exposed to the internet on this site, unlike most other apps. Its native apps (phone, TV, Chromecast...) talk directly to its API rather than a browser, so a forward-auth layer like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik) can't sit in front of it without breaking login and playback on those clients, and Jellyfin itself has no built-in 2FA or OIDC to fall back on. So instead of exposing it, we'll reach it through the [WireGuard VPN](/serveex/core/wireguard) already set up earlier in this guide.
 ::

 Instead of routing a whole device's traffic through the VPN, or even the whole `10.8.0.0/24` VPN subnet, we'll use a tighter **split tunnel**: each remote device only routes traffic for your server's own VPN address through the tunnel. Everything else (browsing, other apps) stays on the device's normal connection, and the VPN is only ever used to reach that one machine.

-::note
+::note{to="/serveex/core/wireguard#client-server-setup"}

-This assumes your Jellyfin server already runs its own WireGuard client, connecting it to your VPN as described in [Client Server Setup](/serveex/security/wireguard#client-server-setup). Note the VPN address wg-easy assigned it (e.g. `10.8.0.2`); that's the address every device below will target.
+This assumes your Jellyfin server already runs its own WireGuard client, connecting it to your VPN as described in **Client Server Setup**. Note the VPN address wg-easy assigned it (e.g. `10.8.0.2`); that's the address every device below will target.
 ::

-::caution
-This split tunnel is a client-side convention, not a server-enforced security boundary: `AllowedIPs` is a routing setting, and wg-easy doesn't add any firewall rule to back it up by default. Anyone with access to a device (or its `.conf` file) could edit `AllowedIPs` back to something broader and reach whatever else your WireGuard server can route to, including other connected peers. If a peer is one of your own devices, that's usually an acceptable risk. If you're handing a peer to a third party (a friend, family member) who should only ever reach Jellyfin, see [Restricting a third-party peer to just Jellyfin](#restricting-a-third-party-peer-to-just-jellyfin) below for a way to actually enforce that server-side.
+::caution{to="#restricting-a-third-party-peer-to-just-jellyfin"}
+This split tunnel is a client-side convention, not a server-enforced security boundary: `AllowedIPs` is a routing setting, and wg-easy doesn't add any firewall rule to back it up by default. Anyone with access to a device (or its `.conf` file) could edit `AllowedIPs` back to something broader and reach whatever else your WireGuard server can route to, including other connected peers. If a peer is one of your own devices, that's usually an acceptable risk. If you're handing a peer to a third party (a friend, family member) who should only ever reach Jellyfin, see **Restricting a third-party peer to just Jellyfin** below for a way to actually enforce that server-side.
 ::

 ::steps{level="3"}
 ### Create a client in wg-easy for each device

-Following [Retrieve Configuration Files](/serveex/security/wireguard#retrieve-configuration-files), create one client per device (phone, computer, TV/streaming box) and download its config file.
+Following [Retrieve Configuration Files](/serveex/core/wireguard#retrieve-configuration-files), create one client per device (phone, computer, TV/streaming box) and download its config file.

 ### Narrow the tunnel to just the server

@@ -233,12 +233,12 @@ A `.conf` file is a credential, not just a settings file: whoever has it can con

 ### Restricting a third-party peer to just Jellyfin

-[wg-easy](/serveex/security/wireguard) (v15.3+) can enforce this itself, with a real firewall rule inside its own container rather than a client-side setting. This is the right approach when the peer belongs to someone else, not one of your own devices.
+[wg-easy](/serveex/core/wireguard) (v15.3+) can enforce this itself, with a real firewall rule inside its own container rather than a client-side setting. This is the right approach when the peer belongs to someone else, not one of your own devices.

 ::steps{level="4"}
 #### Enable the per-client firewall

-In [wg-easy](/serveex/security/wireguard)'s admin panel, go to the interface settings and enable **Per-Client Firewall**. It's marked experimental, but works by generating a dedicated `iptables` chain inside the wg-easy container.
+In [wg-easy](/serveex/core/wireguard)'s admin panel, go to the interface settings and enable **Per-Client Firewall**. It's marked experimental, but works by generating a dedicated `iptables` chain inside the wg-easy container.

 #### Restrict the peer's allowed destination

@@ -193,10 +193,10 @@ Detailed info:

 Once done, deploy the container.

-::note
+::note{to="/serveex/core/docker/#dockge"}

 **Startup logs will show a temporary password for `admin` user.**
-See logs in [Dockge](/serveex/core/docker/#dockge) to retrieve it, or type this command in a terminal:
+See logs in **Dockge** to retrieve it, or type this command in a terminal:
 ```bash [Terminal]
 docker logs qbittorrent 2>&1 | grep -i "temporary password"
 ```
@@ -224,7 +224,7 @@ When adding a download, remember to select the proper directory so Jellyfin can

 ::warning

-Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 To start downloads from outside your home, without a VPN, you can expose the Qbittorrent web UI.
@@ -267,8 +267,8 @@ We assume the network name is `seedbox_default`. You can confirm by checking the

 Now create/edit `seedbox.subdomain.conf`.

-::tip{icon=""}
-✨ __Terminal-free tip:__ use [File Browser Quantum](/serveex/files/file-browser-quantum) to edit files instead of using the terminal.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Terminal-free tip:__ use **File Browser Quantum** to edit files instead of using the terminal.
 ::

 ```bash [Terminal]
@@ -406,9 +406,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -388,7 +388,7 @@ It can be useful to expose Seerr if you want to send requests from outside your

 ::warning

-Seerr has no built-in two-factor authentication. Only expose it if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik). Otherwise, don't expose it with SWAG, use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Seerr has no built-in two-factor authentication. Only expose it if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik). Otherwise, don't expose it with SWAG, use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 ::note
@@ -429,8 +429,8 @@ Here we assume the Jellyfin network is named `jellyfin_default`. You can verify

 Create and edit the file `films.subdomain.conf`:

-::tip{icon=""}
-✨ __Tip:__ you can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ you can use **File Browser Quantum** to browse and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -591,9 +591,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -38,9 +38,9 @@ __Warning__: Do not add the Watchtower label to the Immich stack. Immich evolves

 Configure the `.env` file by copying the latest version [from here](https://github.com/immich-app/immich/blob/main/docker/example.env) and follow the comments in the file.

-::note
+::note{to="/general/networking/samba/"}

-If you're using a NAS or a network-shared drive via [Samba](/general/networking/samba/) to store your data, replace the value of `UPLOAD_LOCATION`{lang=properties} with the path to your shared folder.
+If you're using a NAS or a network-shared drive via **Samba** to store your data, replace the value of `UPLOAD_LOCATION`{lang=properties} with the path to your shared folder.
 ::

 ::tip{icon=""}
@@ -94,9 +94,9 @@ Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.

 In the SWAG folders, create a file named `immich.subdomain.conf`.

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}

-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -199,8 +199,8 @@ In Immich, go to _Administration > Settings > Authentication Settings > OAuth_,
 ### Done !
 ::

-::tip{icon=""}
-✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+::tip{icon="" to="/serveex/advanced/authentik"}
+✨ You can use **Authentik** instead of Pocket ID:

 1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `immich`, with the same three redirect URIs as above (type `Strict`).
 2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
@@ -11,9 +11,9 @@ description: Install Nextcloud to self-host your files, photos, and calendar, a
 ![Picture](/img/serveex/nextcloud.png)

 ## Installation
-::note
+::note{to="https://docs.linuxserver.io/images/docker-nextcloud/"}

-We'll be using the Docker image maintained by [LinuxServer.io](https://docs.linuxserver.io/images/docker-nextcloud/)
+We'll be using the Docker image maintained by **LinuxServer.io**
 ::

 ::file-tree
@@ -52,9 +52,9 @@ services:
    restart: unless-stopped
 ```

-::note
+::note{to="/general/networking/samba"}

-If you’re using a NAS or network-shared drive via [Samba](/general/networking/samba), replace `/docker/nextcloud/data` with the path to your shared folder.
+If you’re using a NAS or network-shared drive via **Samba**, replace `/docker/nextcloud/data` with the path to your shared folder.
 ::

 ### Set your environment variables
@@ -124,8 +124,8 @@ Redeploy the stack and wait for SWAG to become fully operational.

 In Nextcloud’s files, edit the `config.php` file:

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -232,8 +232,8 @@ In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and
 ### Done !
 ::

-::tip{icon=""}
-✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+::tip{icon="" to="/serveex/advanced/authentik"}
+✨ You can use **Authentik** instead of Pocket ID:

 1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Nextcloud`, with a redirect URI (type `Strict`) of `https://nextcloud.yourdomain.com/apps/user_oidc/code`.
 2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
@@ -107,7 +107,7 @@ __If it doesn't work:__ check your firewall rules.

 ::warning

-File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through Swag.
@@ -275,9 +275,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -115,9 +115,9 @@ Redeploy the stack by clicking "deploy" and wait for SWAG to be fully up.

 In the Swag folders, create the `pingvin.subdomain.conf` file.

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}

-✨ __Tip:__ you can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse your files and edit your documents instead of using terminal commands.
+✨ __Tip:__ you can use **File Browser Quantum** to browse your files and edit your documents instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -20,9 +20,9 @@ description: Install code-server to run VS Code in your browser from your homela
 ![code-server](https://github.com/coder/code-server/raw/main/docs/assets/screenshot-2.png)

 ## Installation
-::note
+::note{to="https://docs.linuxserver.io/images/docker-code-server/"}

-For this setup, we’ll use the [image maintained by LinuxServer.io](https://docs.linuxserver.io/images/docker-code-server/).
+For this setup, we’ll use the **image maintained by LinuxServer.io**.
 ::

 ::file-tree
@@ -167,8 +167,8 @@ Redeploy the stack by clicking “deploy” and wait until SWAG is fully operati

 Inside the Swag config folders, create the file `code.subdomain.conf`.

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -304,9 +304,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -113,8 +113,8 @@ Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational

 Inside the Swag folders, create the file `forgejo.subdomain.conf`.

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -240,8 +240,8 @@ Also enable __Skip local 2FA__.
 ### Done !
 ::

-::tip{icon=""}
-✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+::tip{icon="" to="/serveex/advanced/authentik"}
+✨ You can use **Authentik** instead of Pocket ID:

 1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Forgejo`, with a redirect URI (type `Strict`) of `https://forgejo.yourdomain.com/user/oauth2/authentik/callback`.
 2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
@@ -97,8 +97,8 @@ Restart the stack by clicking "deploy" and wait for SWAG to be fully operational

 Inside the Swag folders, create the file `tools.subdomain.conf`.

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -236,9 +236,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -143,9 +143,9 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational

 Create and open the file `adguard.subdomain.conf`

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for terminal haters:__
-You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit files instead of using terminal commands.
+You can use **File Browser Quantum** to browse and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -330,9 +330,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -110,8 +110,8 @@ __If it fails:__ check your firewall rules.
 ## Exposing Vaultwarden with SWAG
 The main benefit of Vaultwarden is being able to access it remotely from any device. We'll expose it through [SWAG](/serveex/core/swag).

-::note{icon=""}
-📋 __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
+::note{icon="" to="/general/networking/nat"}
+📋 __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via **NAT rules**.
 ::

 ::steps{level="3"}
@@ -147,8 +147,8 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational

 In SWAG's config folder, create the file `vault.subdomain.conf`:

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -300,8 +300,8 @@ Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will pro
 ### Done !
 ::

-::note
-See the [Vaultwarden SSO wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for the full list of options, including per-organization enforcement and master password policies.
+::note{to="https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect"}
+See the **Vaultwarden SSO wiki** for the full list of options, including per-organization enforcement and master password policies.
 ::

 ::::tip{icon=""}
@@ -6,6 +6,11 @@ description: Install Authentik as a self-hosted identity provider, configure MFA

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::note
+
+This is an advanced alternative to [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id): a single application handling both the forward-auth proxy and the OIDC provider roles, with built-in LDAP, SAML, and RBAC-style access policies (restricting who can reach which app, not just whether they're logged in) on top of its own admin UI for users, groups, and outposts. TinyAuth and Pocket ID stay lighter and simpler for a small homelab; Authentik is worth the extra setup once you need finer-grained access control or broader protocol support than OIDC alone.
+::
+
 [Authentik](https://goauthentik.io) is a single sign-on (SSO) tool that allows you to log in once to all platforms compatible with OpenID. It can also secure access to your exposed services by injecting itself via SWAG into requests to those services.

 For example, if you're exposing Dockge online at `dockge.mydomain.com`, you’ll first land on an Authentik login page when accessing it. If you've already authenticated with another Authentik-protected service, you won’t need to log in again. This allows you to authenticate only once per day for all protected services.
@@ -14,8 +19,6 @@ Authentik also supports multi-factor authentication, including TOTP (a code gene

 It's a great alternative to VPNs for securely exposing services, especially ones that lack MFA or login protection (e.g., the SWAG dashboard).

-Compared to the [TinyAuth](/serveex/security/tinyauth) + [Pocket ID](/serveex/security/pocket-id) combo used elsewhere on this site, Authentik is a heavier, more professional-grade platform: a single application handling both the forward-auth proxy and the OIDC provider roles, with built-in support for LDAP, SAML, and RBAC-style access policies (restricting who can reach which app, not just whether they're logged in), on top of its own admin UI for managing users, groups, and outposts. TinyAuth and Pocket ID stay lighter and simpler for a small homelab; Authentik is worth the extra setup once you need finer-grained access control or a broader protocol support than OIDC alone.
-
 Authentik has [extensive documentation](https://docs.goauthentik.io/docs/installation/docker-compose) and [great tutorials from Cooptonian](https://www.youtube.com/@cooptonian). Here, we’ll cover the basics using Dockge as an example.

 There are two main modes you should know:
@@ -207,9 +210,9 @@ We assume you have already created a subdomain like `auth.mydomain.com` in your

 Open the `authentik-server.conf` file:

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for those who dislike terminals:__
-You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -440,9 +443,9 @@ If you haven’t installed [Dockge](/serveex/core/docker/#installer-dockge-pour-
 sudo mkdir -P /docker/authentik-outpost
 ```

-::tip{icon=""}
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
 ✨ __Tip for terminal-averse users:__
-You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
+You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
 ::

 ### Create the compose file
@@ -584,22 +587,28 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
 Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).

 ## Migrating an Authentik Database
+
+::note
+
+The commands below assume the Postgres container is named `authentik-postgresql`, matching the [Installation](#installation) section above. Adjust it if you renamed yours.
+::
+
 On the source machine, dump the database:

 ```bash [Terminal]
-sudo docker exec authentik-postgres pg_dump -U authentik -F t authentik > /path/to/mydb.tar
+sudo docker exec authentik-postgresql pg_dump -U authentik -F t authentik > /path/to/mydb.tar
 ```

 Then transfer it to the target machine. On the target machine, copy the file into the Docker container:

 ```bash [Terminal]
-cp /path/to/mydb.tar authentik-postgres:/path/to/wherever
+cp /path/to/mydb.tar authentik-postgresql:/path/to/wherever
 ```

 (Optional) Purge existing tables:

 ```bash [Terminal]
-sudo docker exec -i authentik-postgres psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
+sudo docker exec -i authentik-postgresql psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgresql psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgresql psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
 ```

 Restore the database:
@@ -6,16 +6,21 @@ description: Install Arcane, a modern Docker and Compose management web UI, as a

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

-[Arcane](https://github.com/getarcaneapp/arcane) is a self-hosted web UI for managing Docker containers, images, volumes, and Compose stacks, in the same spirit as [Dockge](/serveex/core/docker#installer-dockge-pour-gérer-et-déployer-les-conteneurs). Compared to Dockge, Arcane is more full-featured: it can manage several remote Docker hosts from a single instance, and it supports OIDC login natively instead of relying on a separate forward-auth proxy.
+::note{to="/serveex/core/docker#installer-dockge-pour-gérer-et-déployer-les-conteneurs"}
+
+This is an advanced alternative to **Dockge**: it can manage several remote Docker hosts from a single instance, and supports OIDC login natively instead of relying on a separate forward-auth proxy.
+::
+
+[Arcane](https://github.com/getarcaneapp/arcane) is a self-hosted web UI for managing Docker containers, images, volumes, and Compose stacks.

 ![Arcane](/img/serveex/arcane.png)

 - [Arcane documentation](https://getarcane.app/docs/)
 - [Arcane on GitHub](https://github.com/getarcaneapp/arcane)

-::note
+::note{to="https://docs.linuxserver.io/images/docker-socket-proxy/"}

-Arcane needs access to the Docker socket to manage containers, which is effectively root access to your host. Instead of mounting the socket directly, this guide sits [Docker Socket Proxy](https://docs.linuxserver.io/images/docker-socket-proxy/) in front of it, only allowing the specific API permissions Arcane actually needs. Whatever you use, make sure Arcane itself is never reachable without authentication.
+Arcane needs access to the Docker socket to manage containers, which is effectively root access to your host. Instead of mounting the socket directly, this guide sits **Docker Socket Proxy** in front of it, only allowing the specific API permissions Arcane actually needs. Whatever you use, make sure Arcane itself is never reachable without authentication.
 ::

 ## Installation
@@ -149,7 +154,7 @@ The main benefit of this setup is being able to access Arcane remotely from all

 ::warning

-Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead, especially given the level of access Arcane has over your host.
+Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead, especially given the level of access Arcane has over your host.
 ::

 ::note
@@ -190,8 +195,8 @@ Here we assume the Arcane network name is `arcane_default`. You can check the co

 In the Swag folders, create the file `arcane.subdomain.conf`:

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -240,11 +245,11 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
 That's it! Arcane is now accessible from the internet.

 ## Connecting a Remote Host
-Arcane can manage several Docker hosts from a single instance. Each remote host runs a lightweight **agent** container that connects back to Arcane. Rather than exposing that connection to the internet, we'll route it over the [WireGuard VPN](/serveex/security/wireguard) already set up earlier, so the agent traffic never leaves your private network.
+Arcane can manage several Docker hosts from a single instance. Each remote host runs a lightweight **agent** container that connects back to Arcane. Rather than exposing that connection to the internet, we'll route it over the [WireGuard VPN](/serveex/core/wireguard) already set up earlier, so the agent traffic never leaves your private network.

-::note
+::note{to="/serveex/core/wireguard#client-server-setup"}

-This assumes both the Arcane host and the remote host already run their own WireGuard client, connected to your VPN as described in [Client Server Setup](/serveex/security/wireguard#client-server-setup). Note the VPN address wg-easy assigned to the __Arcane host__ (e.g. `10.8.0.3`); that's the address the remote agent will target below.
+This assumes both the Arcane host and the remote host already run their own WireGuard client, connected to your VPN as described in **Client Server Setup**. Note the VPN address wg-easy assigned to the __Arcane host__ (e.g. `10.8.0.3`); that's the address the remote agent will target below.
 ::

 ::steps{level="3"}
@@ -329,8 +334,8 @@ Redeploy the stack.

 That's it! Arcane now offers a "Login with Pocket ID" option alongside the local login form.

-::tip{icon=""}
-✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+::tip{icon="" to="/serveex/advanced/authentik"}
+✨ You can use **Authentik** instead of Pocket ID:

 1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Arcane`, with a redirect URI (type `Strict`) of `https://arcane.mydomain.com/auth/oidc/callback`.
 2. Note the provider's __Client ID__ and __Client Secret__.
@@ -0,0 +1,78 @@
+---
+title: My nonsense
+description: Small Python and Bash side projects, scripts, and tools built to solve specific homelab problems, outside of the main Serveex guides.
+navigation:
+  icon: i-lucide-bookmark
+---
+
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
+## Small Scripts and Side Projects
+
+Not everything fits into a "install this app" guide. This section collects the smaller Python and Bash projects written along the way: scripts that automate a specific chore, glue two apps together, or scratch a very particular itch. Less polished than [Serveex](/serveex/introduction), but often more fun.
+
+### Python
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card
+---
+icon: i-simple-icons-nvidia
+title: Nvidia Stock Bot
+to: /nonsense/python/nvidia-stock-bot
+ui:
+  icon: text-[#76B900]
+---
+Discord alerts for GPU stock availability
+::
+
+::card
+---
+icon: i-cbi-adguard
+title: Adguard CIDRE
+to: /nonsense/python/adguard-cidre
+ui:
+  icon: text-[#68BC71]
+---
+Auto-sync AdGuard Home's CIDR allowlists
+::
+
+::card{icon="i-brand-lumeex" title="Lumeex" to="/nonsense/python/lumeex"}
+A minimalist static photo gallery generator
+::
+
+::card{icon="i-brand-instameex" title="Instameex" to="/nonsense/python/instameex"}
+Merge SDR/HDR exports for Instagram HDR
+::
+::
+
+### Bash
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card{icon="i-lucide-copy-check" title="Servarr corrector" to="/nonsense/bash/servarr-duplicates"}
+Deduplicate Sonarr/Radarr libraries with hardlinks
+::
+
+::card{icon="i-lucide-lock-keyhole" title="LUKS Backup" to="/nonsense/bash/luks-backup"}
+Back up LUKS headers from encrypted disks
+::
+
+::card{icon="i-lucide-shield" title="Socat Proxy" to="/nonsense/bash/socat-proxy"}
+Bind-mount the Docker socket proxy for host-mode containers
+::
+
+::card{icon="i-lucide-thermometer" title="HotDisk" to="/nonsense/bash/hotdisk"}
+Shut down the server if disks overheat
+::
+
+::card{icon="i-lucide-database-backup" title="Backrest Docker Stop" to="/nonsense/bash/backrest-docker-stop"}
+Stop containers safely around a Backrest backup
+::
+::
@@ -0,0 +1,87 @@
+---
+title: Recycled
+description: Deprecated guides kept for reference, and alternative apps that were replaced elsewhere on the site but still work fine on their own.
+navigation:
+  icon: i-lucide-bookmark
+---
+
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
+## The Attic
+
+Not every article stays current forever. This section keeps two kinds of leftovers: guides for a setup that's been fully replaced elsewhere on the site (**Deprecated**), and guides for apps that are still perfectly valid choices, just not the ones [Serveex](/serveex/introduction) currently recommends (**Alternatives**). Nothing here is actively maintained, but nothing here is wrong either.
+
+### Deprecated
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card
+---
+icon: i-simple-icons-wireguard
+title: Wireguard 14
+to: /recycled/deprecated/wireguard-14
+ui:
+  icon: text-[#88171A]
+---
+The old wg-easy v14 setup, replaced by the current guide
+::
+
+::card{icon="i-noto-open-file-folder" title="File Browser" to="/recycled/deprecated/file-browser"}
+Replaced by File Browser Quantum
+::
+::
+
+### Alternatives
+
+:::div{class="relative"}
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+:::
+
+::card-group
+::card
+---
+icon: i-simple-icons-plex
+title: Plex
+to: /recycled/alternatives/plex
+ui:
+  icon: text-[#E5A00D]
+---
+The paid-tier alternative to Jellyfin
+::
+
+::card
+---
+icon: i-cbi-qbittorrent
+title: Qbittorrent for Plex
+to: /recycled/alternatives/qbittorrent-for-plex
+ui:
+  icon: text-[#2F67BA]
+---
+The Gluetun-based seedbox, paired with Plex
+::
+
+::card
+---
+icon: i-cbi-radarr
+title: Servarr for Plex
+to: /recycled/alternatives/servarr-for-plex
+ui:
+  icon: text-[#FFCB3D]
+---
+The Servarr stack, wired up for Plex instead of Jellyfin
+::
+
+::card
+---
+icon: i-simple-icons-gitea
+title: Gitea
+to: /recycled/alternatives/gitea
+ui:
+  icon: text-[#609926]
+---
+The original project Forgejo forked from
+::
+::
@@ -1,2 +0,0 @@
-title: Alternatives
-icon: i-lucide-trash-2
@@ -6,6 +6,11 @@ description: Archived guide to installing WireGuard VPN using linuxserver.io's o

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::note{to="/serveex/core/wireguard"}
+
+wg-easy 15 got a lot more complicated, "not so easy" anymore, arguably. That's exactly why this old v14 tutorial is worth keeping around: it's still the simplest way to get a WireGuard server running if you don't need what the new version adds.
+::
+
 ## Introduction
 Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.

@@ -46,9 +51,9 @@ So only VPN-connected devices can communicate with each other on the VPN, not wi
 - Ensure port `51821 TCP` is available for the web UI.
 ::

-::warning
+::warning{to="https://wg-easy.github.io/wg-easy/latest/"}

-__Warning:__ This guide uses version `14` of [wg-easy](https://wg-easy.github.io/wg-easy/latest/). Version `15` introduces breaking changes incompatible with this configuration.
+__Warning:__ This guide uses version `14` of **wg-easy**. Version `15` introduces breaking changes incompatible with this configuration.
 ::

 ::file-tree
@@ -183,8 +188,8 @@ tree:

 Create the folder `/docker/wireguard/config/wg_confs`:

-::tip{icon=""}
-✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to browse and edit files without terminal
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ Use **File Browser** to browse and edit files without terminal
 ::

 ```bash [Terminal]
@@ -6,6 +6,11 @@ description: Install File Browser to browse and manage your server files from a

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::warning{to="/serveex/files/file-browser-quantum"}
+
+Replaced by **File Browser Quantum**. The original project has a history of serious CVEs (a CSRF-to-backdoor-admin RCE, stored XSS, path traversal, auth bypass...) and was officially archived in September 2026, with the maintainers leaving known session-handling and command-execution issues unfixed for good. Don't deploy this version, especially not exposed to the internet.
+::
+
 [File Browser](https://github.com/filebrowser/filebrowser) is a web-based interface that lets you access and edit the files on your server.

 ![File Browser](/img/serveex/filebrowser.png)
@@ -57,7 +62,7 @@ __If it doesn’t work:__ check your firewall rules.

 ::warning

-File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 You may want to access File Browser remotely from all your devices. To do that, we’ll expose it through Swag.
@@ -233,9 +238,9 @@ server {
 }
 ```

-::note
+::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

-The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
+The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
 ::

 ::tip{icon=""}
@@ -0,0 +1,2 @@
+title: Alternatives
+icon: i-lucide-arrow-left-right
@@ -6,6 +6,11 @@ description: Install Plex Media Server with Tautulli on your homelab to stream m

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::note{to="/serveex/media/jellyfin"}
+
+This is an alternative to **Jellyfin**, kept here for reference. Plex isn't fully self-hosted: local playback still goes through Plex's own relay and requires a Plex account, and several features sit behind a Plex Pass paywall.
+::
+
 [Plex](https://www.plex.tv/fr/) is a self-hosted video streaming platform for managing your movie or TV show library and playing them locally or remotely. Plex has apps for TV, Android, iOS, Windows, and macOS, allowing you to stream your library just like Netflix.

 With *Plex Pass*, you can also organize and play your music content similar to Spotify, the difference being that it’s your content, hosted and streamed from your server.
@@ -131,9 +136,9 @@ Deploy the stack.
 The local interface is available at `http://yourserverip:32400/web/index.html`.  
 Tautulli is accessible at `http://yourserverip:8181`.

-::warning
+::warning{to="https://support.plex.tv/articles/200288586-installation/#toc-2"}

-You must be on your local network during Plex's initial setup. Otherwise, the URL will redirect to your Plex account without detecting your server. A VPN won't help. If you have no choice, [you can handle the setup remotely via SSH tunnel](https://support.plex.tv/articles/200288586-installation/#toc-2).
+You must be on your local network during Plex's initial setup. Otherwise, the URL will redirect to your Plex account without detecting your server. A VPN won't help. If you have no choice, **you can handle the setup remotely via SSH tunnel**.
 ::

 ### Done !
@@ -162,9 +167,9 @@ And that’s it! You now have a working Plex server!

 Simply add your media to `/media/movies` and `/media/tvseries` on your server. You can then install the Plex app on your devices and watch your favorite content locally or remotely.

-::note
+::note{to="/general/networking/samba"}

-If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the [Samba mount guide](/general/networking/samba) so Plex can access it.
+If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the **Samba mount guide** so Plex can access it.
 ::

 ## Expose Tautulli with Swag
@@ -210,8 +215,8 @@ Here we assume the Tautulli network name is `tautulli_default`. You can check th

 Copy and rename the file `tautulli.subdomain.conf.sample` to `tautulli.subdomain.conf`, then edit it:

-::tip{icon=""}
-✨ **Tip:** Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ **Tip:** Use **File Browser** to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -300,8 +305,8 @@ server {
 }
 ```

-::tip{icon=""}
-✨ You can protect this app with Authentik by removing the `#` before `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
+::tip{icon="" to="/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy"}
+✨ You can protect this app with Authentik by removing the `#` before `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to **create an application and provider in Authentik**.
 ::

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
@@ -6,6 +6,11 @@ description: Install qBittorrent with Gluetun and ProtonVPN to download torrents

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::note{to="/serveex/media/qbittorrent"}
+
+This is the seedbox setup paired with Plex rather than Jellyfin, kept here for reference. See **Qbittorrent** for the same setup paired with Jellyfin, the recommended alternative since Plex isn't fully self-hosted (its own relay, a required account) and gates features behind a Plex Pass paywall.
+::
+
 ![Picture](/img/serveex/qbit-vue.jpeg)

 To safely download your favorite media, we'll build a system using:
@@ -220,7 +225,7 @@ When adding a download, remember to select the proper directory so Plex can sync

 ::warning

-Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
+Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
 ::

 To start downloads from outside your home, without a VPN, you can expose the Qbittorrent web UI.
@@ -263,8 +268,8 @@ We assume the network name is `seedbox_default`. You can confirm by checking the

 Now create/edit `seedbox.subdomain.conf`.

-::tip{icon=""}
-✨ __Terminal-free tip:__ use [File Browser](/serveex/files/file-browser) to edit files instead of using the terminal.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Terminal-free tip:__ use **File Browser** to edit files instead of using the terminal.
 ::

 ```bash [Terminal]
@@ -324,8 +329,8 @@ server {
 }
 ```

-::tip{icon=""}
-✨ You can secure this app with Authentik by uncommenting the `authentik-server.conf` and `authentik-location.conf` lines. Don’t forget to [create an app and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
+::tip{icon="" to="/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy"}
+✨ You can secure this app with Authentik by uncommenting the `authentik-server.conf` and `authentik-location.conf` lines. Don’t forget to **create an app and provider in Authentik**.
 ::

 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
@@ -6,6 +6,11 @@ description: Automate media downloads with the Servarr stack, Radarr, Sonarr, Ba

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::note{to="/serveex/media/servarr"}
+
+This is the Servarr stack wired up for Plex rather than Jellyfin, kept here for reference. See **Automation** for the same stack paired with Jellyfin, the recommended alternative since Plex isn't fully self-hosted (its own relay, a required account) and gates features behind a Plex Pass paywall.
+::
+
 [Servarr](https://wiki.servarr.com/) is a suite of applications developed to automate the downloading, updating, and management of media. Here, we'll focus on movies and TV shows with the goal of:

 - Selecting a movie from a catalog through a web interface.
@@ -445,8 +450,8 @@ Here we assume the Tautulli network is named `plex_default`. You can verify the

 Create and edit the file `films.subdomain.conf`:

-::tip{icon=""}
-✨ __Tip:__ you can use [File Browser](/serveex/files/file-browser) to browse and edit files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ you can use **File Browser** to browse and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -6,6 +6,11 @@ description: Install Gitea, a lightweight self-hosted Git service to manage your

 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

+::note{to="/serveex/development/forgejo"}
+
+This is an alternative to **Forgejo**, the community-run fork created after Gitea's governance moved to a for-profit company, a concern for a project people expect to stay FOSS.
+::
+
 [Gitea](https://about.gitea.com/) is a self-hosted DevOps platform that allows you to manage repositories much like GitHub, but on your own infrastructure.

 ![gitea](https://about.gitea.com/img/home-screenshot.png)
@@ -110,8 +115,8 @@ Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational

 Inside the Swag folders, create the file `gitea.subdomain.conf`.

-::tip{icon=""}
-✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
+::tip{icon="" to="/serveex/files/file-browser-quantum"}
+✨ __Tip:__ You can use **File Browser** to navigate and edit your files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -18,11 +18,11 @@ Quoiqu'il en soit, désireux d'obtenir une RTX 5090 pour ma machine dédiée à

 Après moult déconvenues, je suis passé de ceci :

-![Nvidia Stock Bot Old](/img/nonsense/nvidia-stock-bot-old.svg)
+![Nvidia Stock Bot Old](/img/nonsense/nvidia-stock-bot-old-en.svg)

 à cela :

-![Nvidia Stock bot](/img/nonsense/nvidia-stock-bot.svg)
+![Nvidia Stock bot](/img/nonsense/nvidia-stock-bot-en.svg)

 Et plus récemment :