Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Add section summary pages and make single-link admonitions clickable

Browse Source
This commit is contained in:
Djeex
2026-09-04 18:51:42 +02:00
parent f2cfa49150
commit 9c5a693281
60 changed files with 451 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/91.advanced/1.authentik.md
+18 -9
View File
@@ -6,6 +6,11 @@ description: Install Authentik as a self-hosted identity provider, configure MFA
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
::note
This is an advanced alternative to [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id): a single application handling both the forward-auth proxy and the OIDC provider roles, with built-in LDAP, SAML, and RBAC-style access policies (restricting who can reach which app, not just whether they're logged in) on top of its own admin UI for users, groups, and outposts. TinyAuth and Pocket ID stay lighter and simpler for a small homelab; Authentik is worth the extra setup once you need finer-grained access control or broader protocol support than OIDC alone.
::
[Authentik](https://goauthentik.io) is a single sign-on (SSO) tool that allows you to log in once to all platforms compatible with OpenID. It can also secure access to your exposed services by injecting itself via SWAG into requests to those services.
For example, if you're exposing Dockge online at `dockge.mydomain.com`, you’ll first land on an Authentik login page when accessing it. If you've already authenticated with another Authentik-protected service, you won’t need to log in again. This allows you to authenticate only once per day for all protected services.
@@ -14,8 +19,6 @@ Authentik also supports multi-factor authentication, including TOTP (a code gene
It's a great alternative to VPNs for securely exposing services, especially ones that lack MFA or login protection (e.g., the SWAG dashboard).
Compared to the [TinyAuth](/serveex/security/tinyauth) + [Pocket ID](/serveex/security/pocket-id) combo used elsewhere on this site, Authentik is a heavier, more professional-grade platform: a single application handling both the forward-auth proxy and the OIDC provider roles, with built-in support for LDAP, SAML, and RBAC-style access policies (restricting who can reach which app, not just whether they're logged in), on top of its own admin UI for managing users, groups, and outposts. TinyAuth and Pocket ID stay lighter and simpler for a small homelab; Authentik is worth the extra setup once you need finer-grained access control or a broader protocol support than OIDC alone.
Authentik has [extensive documentation](https://docs.goauthentik.io/docs/installation/docker-compose) and [great tutorials from Cooptonian](https://www.youtube.com/@cooptonian). Here, we’ll cover the basics using Dockge as an example.
There are two main modes you should know:
@@ -207,9 +210,9 @@ We assume you have already created a subdomain like `auth.mydomain.com` in your
Open the `authentik-server.conf` file:
::tip{icon=""}
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip for those who dislike terminals:__
You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
::
```bash [Terminal]
@@ -440,9 +443,9 @@ If you haven’t installed [Dockge](/serveex/core/docker/#installer-dockge-pour-
sudo mkdir -P /docker/authentik-outpost
```
::tip{icon=""}
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip for terminal-averse users:__
You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands.
You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
::
### Create the compose file
@@ -584,22 +587,28 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
## Migrating an Authentik Database
::note
The commands below assume the Postgres container is named `authentik-postgresql`, matching the [Installation](#installation) section above. Adjust it if you renamed yours.
::
On the source machine, dump the database:
```bash [Terminal]
sudo docker exec authentik-postgres pg_dump -U authentik -F t authentik > /path/to/mydb.tar
sudo docker exec authentik-postgresql pg_dump -U authentik -F t authentik > /path/to/mydb.tar
```
Then transfer it to the target machine. On the target machine, copy the file into the Docker container:
```bash [Terminal]
cp /path/to/mydb.tar authentik-postgres:/path/to/wherever
cp /path/to/mydb.tar authentik-postgresql:/path/to/wherever
```
(Optional) Purge existing tables:
```bash [Terminal]
sudo docker exec -i authentik-postgres psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
sudo docker exec -i authentik-postgresql psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgresql psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgresql psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
```
Restore the database:
content/en/3.serveex/91.advanced/2.arcane.md
+16 -11
View File
@@ -6,16 +6,21 @@ description: Install Arcane, a modern Docker and Compose management web UI, as a
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
[Arcane](https://github.com/getarcaneapp/arcane) is a self-hosted web UI for managing Docker containers, images, volumes, and Compose stacks, in the same spirit as [Dockge](/serveex/core/docker#installer-dockge-pour-gérer-et-déployer-les-conteneurs). Compared to Dockge, Arcane is more full-featured: it can manage several remote Docker hosts from a single instance, and it supports OIDC login natively instead of relying on a separate forward-auth proxy.
::note{to="/serveex/core/docker#installer-dockge-pour-gérer-et-déployer-les-conteneurs"}
This is an advanced alternative to **Dockge**: it can manage several remote Docker hosts from a single instance, and supports OIDC login natively instead of relying on a separate forward-auth proxy.
::
[Arcane](https://github.com/getarcaneapp/arcane) is a self-hosted web UI for managing Docker containers, images, volumes, and Compose stacks.
![Arcane](/img/serveex/arcane.png)
- [Arcane documentation](https://getarcane.app/docs/)
- [Arcane on GitHub](https://github.com/getarcaneapp/arcane)
::note
::note{to="https://docs.linuxserver.io/images/docker-socket-proxy/"}
Arcane needs access to the Docker socket to manage containers, which is effectively root access to your host. Instead of mounting the socket directly, this guide sits [Docker Socket Proxy](https://docs.linuxserver.io/images/docker-socket-proxy/) in front of it, only allowing the specific API permissions Arcane actually needs. Whatever you use, make sure Arcane itself is never reachable without authentication.
Arcane needs access to the Docker socket to manage containers, which is effectively root access to your host. Instead of mounting the socket directly, this guide sits **Docker Socket Proxy** in front of it, only allowing the specific API permissions Arcane actually needs. Whatever you use, make sure Arcane itself is never reachable without authentication.
::
## Installation
@@ -149,7 +154,7 @@ The main benefit of this setup is being able to access Arcane remotely from all
::warning
Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead, especially given the level of access Arcane has over your host.
Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead, especially given the level of access Arcane has over your host.
::
::note
@@ -190,8 +195,8 @@ Here we assume the Arcane network name is `arcane_default`. You can check the co
In the Swag folders, create the file `arcane.subdomain.conf`:
::tip{icon=""}
✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
::
```bash [Terminal]
@@ -240,11 +245,11 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
That's it! Arcane is now accessible from the internet.
## Connecting a Remote Host
Arcane can manage several Docker hosts from a single instance. Each remote host runs a lightweight **agent** container that connects back to Arcane. Rather than exposing that connection to the internet, we'll route it over the [WireGuard VPN](/serveex/security/wireguard) already set up earlier, so the agent traffic never leaves your private network.
Arcane can manage several Docker hosts from a single instance. Each remote host runs a lightweight **agent** container that connects back to Arcane. Rather than exposing that connection to the internet, we'll route it over the [WireGuard VPN](/serveex/core/wireguard) already set up earlier, so the agent traffic never leaves your private network.
::note
::note{to="/serveex/core/wireguard#client-server-setup"}
This assumes both the Arcane host and the remote host already run their own WireGuard client, connected to your VPN as described in [Client Server Setup](/serveex/security/wireguard#client-server-setup). Note the VPN address wg-easy assigned to the __Arcane host__ (e.g. `10.8.0.3`); that's the address the remote agent will target below.
This assumes both the Arcane host and the remote host already run their own WireGuard client, connected to your VPN as described in **Client Server Setup**. Note the VPN address wg-easy assigned to the __Arcane host__ (e.g. `10.8.0.3`); that's the address the remote agent will target below.
::
::steps{level="3"}
@@ -329,8 +334,8 @@ Redeploy the stack.
That's it! Arcane now offers a "Login with Pocket ID" option alongside the local login form.
::tip{icon=""}
✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
::tip{icon="" to="/serveex/advanced/authentik"}
✨ You can use **Authentik** instead of Pocket ID:
1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Arcane`, with a redirect URI (type `Strict`) of `https://arcane.mydomain.com/auth/oidc/callback`.
2. Note the provider's __Client ID__ and __Client Secret__.