Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Add section summary pages and make single-link admonitions clickable

Browse Source
This commit is contained in:
Djeex
2026-09-04 18:51:42 +02:00
parent f2cfa49150
commit 9c5a693281
60 changed files with 451 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/91.advanced/2.arcane.md
+16 -11
View File
@@ -6,16 +6,21 @@ description: Install Arcane, a modern Docker and Compose management web UI, as a
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
[Arcane](https://github.com/getarcaneapp/arcane) is a self-hosted web UI for managing Docker containers, images, volumes, and Compose stacks, in the same spirit as [Dockge](/serveex/core/docker#installer-dockge-pour-gérer-et-déployer-les-conteneurs). Compared to Dockge, Arcane is more full-featured: it can manage several remote Docker hosts from a single instance, and it supports OIDC login natively instead of relying on a separate forward-auth proxy.
::note{to="/serveex/core/docker#installer-dockge-pour-gérer-et-déployer-les-conteneurs"}
This is an advanced alternative to **Dockge**: it can manage several remote Docker hosts from a single instance, and supports OIDC login natively instead of relying on a separate forward-auth proxy.
::
[Arcane](https://github.com/getarcaneapp/arcane) is a self-hosted web UI for managing Docker containers, images, volumes, and Compose stacks.
![Arcane](/img/serveex/arcane.png)
- [Arcane documentation](https://getarcane.app/docs/)
- [Arcane on GitHub](https://github.com/getarcaneapp/arcane)
::note
::note{to="https://docs.linuxserver.io/images/docker-socket-proxy/"}
Arcane needs access to the Docker socket to manage containers, which is effectively root access to your host. Instead of mounting the socket directly, this guide sits [Docker Socket Proxy](https://docs.linuxserver.io/images/docker-socket-proxy/) in front of it, only allowing the specific API permissions Arcane actually needs. Whatever you use, make sure Arcane itself is never reachable without authentication.
Arcane needs access to the Docker socket to manage containers, which is effectively root access to your host. Instead of mounting the socket directly, this guide sits **Docker Socket Proxy** in front of it, only allowing the specific API permissions Arcane actually needs. Whatever you use, make sure Arcane itself is never reachable without authentication.
::
## Installation
@@ -149,7 +154,7 @@ The main benefit of this setup is being able to access Arcane remotely from all
::warning
Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead, especially given the level of access Arcane has over your host.
Arcane's own local login has no multi-factor authentication. Only expose it if you're using [Pocket ID](/serveex/security/pocket-id) (see below) or [Authentik](/serveex/advanced/authentik) for login. Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead, especially given the level of access Arcane has over your host.
::
::note
@@ -190,8 +195,8 @@ Here we assume the Arcane network name is `arcane_default`. You can check the co
In the Swag folders, create the file `arcane.subdomain.conf`:
::tip{icon=""}
✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ Use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
::
```bash [Terminal]
@@ -240,11 +245,11 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
That's it! Arcane is now accessible from the internet.
## Connecting a Remote Host
Arcane can manage several Docker hosts from a single instance. Each remote host runs a lightweight **agent** container that connects back to Arcane. Rather than exposing that connection to the internet, we'll route it over the [WireGuard VPN](/serveex/security/wireguard) already set up earlier, so the agent traffic never leaves your private network.
Arcane can manage several Docker hosts from a single instance. Each remote host runs a lightweight **agent** container that connects back to Arcane. Rather than exposing that connection to the internet, we'll route it over the [WireGuard VPN](/serveex/core/wireguard) already set up earlier, so the agent traffic never leaves your private network.
::note
::note{to="/serveex/core/wireguard#client-server-setup"}
This assumes both the Arcane host and the remote host already run their own WireGuard client, connected to your VPN as described in [Client Server Setup](/serveex/security/wireguard#client-server-setup). Note the VPN address wg-easy assigned to the __Arcane host__ (e.g. `10.8.0.3`); that's the address the remote agent will target below.
This assumes both the Arcane host and the remote host already run their own WireGuard client, connected to your VPN as described in **Client Server Setup**. Note the VPN address wg-easy assigned to the __Arcane host__ (e.g. `10.8.0.3`); that's the address the remote agent will target below.
::
::steps{level="3"}
@@ -329,8 +334,8 @@ Redeploy the stack.
That's it! Arcane now offers a "Login with Pocket ID" option alongside the local login form.
::tip{icon=""}
✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
::tip{icon="" to="/serveex/advanced/authentik"}
✨ You can use **Authentik** instead of Pocket ID:
1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Arcane`, with a redirect URI (type `Strict`) of `https://arcane.mydomain.com/auth/oidc/callback`.
2. Note the provider's __Client ID__ and __Client Secret__.