Add section summary pages and make single-link admonitions clickable
This commit is contained in:
Djeex
@@ -0,0 +1,2 @@
|
||||
title: Deprecated
|
||||
icon: i-lucide-trash-2
|
||||
@@ -0,0 +1,269 @@
|
||||
---
|
||||
title: Wireguard 14
|
||||
description: Archived guide to installing WireGuard VPN using linuxserver.io's older wireguard image, kept for reference only.
|
||||
---
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
::note{to="/serveex/core/wireguard"}
|
||||
|
||||
wg-easy 15 got a lot more complicated, "not so easy" anymore, arguably. That's exactly why this old v14 tutorial is worth keeping around: it's still the simplest way to get a WireGuard server running if you don't need what the new version adds.
|
||||
::
|
||||
|
||||
## Introduction
|
||||
Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.
|
||||
|
||||
Here we will use [Wireguard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
|
||||
|
||||
- [wg-easy](https://github.com/wg-easy/wg-easy) as the server, providing a very simple web UI to manage connections and download config files (including QR codes for phones)
|
||||
- [Wireguard](https://docs.linuxserver.io/images/docker-wireguard/?h=wireguard) as the client for Linux systems
|
||||
|
||||
Clients are also available for Windows, macOS, iOS, and Android.
|
||||
|
||||
The concept:
|
||||
|
||||
- On the internet, anyone can reach any internet box and thus any exposed server.
|
||||
- Your server is on your local network. It is accessible only locally unless services are explicitly exposed (as we did with Dockge). To access non-exposed resources, you must be on the same local network.
|
||||
- We want to securely access these unexposed services (like SSH) from anywhere.
|
||||
- We also want to connect services between servers, like linking two Dockge instances securely.
|
||||
|
||||
To achieve this, we’ll create a **Virtual Private Network** (VPN), i.e., a secure tunnel that only connected machines can use. They’ll appear to be on the same private network.
|
||||
|
||||
Additionally, you can add your phone, laptop, or other devices to the VPN and securely access your server resources wherever you are.
|
||||
|
||||
|
||||
|
||||
In this diagram, machine 1 is part of two networks:
|
||||
|
||||
- Its local network (devices behind the same router, e.g. `192.168.x.x` – machines 1 and 2)
|
||||
- The VPN network (VPN devices with a second IP, e.g. `10.8.x.x` – machines 1 and 4)
|
||||
|
||||
You *can* allow VPN clients to share access to their local networks, but we won’t do that here for security and subnet conflict reasons (e.g., if two remote machines use the same local IP like `192.168.1.1`).
|
||||
|
||||
So only VPN-connected devices can communicate with each other on the VPN, not with other local devices outside the VPN.
|
||||
|
||||
## Server Side
|
||||
::note
|
||||
📋 __Checklist:__
|
||||
|
||||
- Ensure port `51820 UDP` is available and properly forwarded through your router to the server (`Source 51820 UDP -> Destination 51820 UDP -> Server`).
|
||||
- Ensure port `51821 TCP` is available for the web UI.
|
||||
::
|
||||
|
||||
::warning{to="https://wg-easy.github.io/wg-easy/latest/"}
|
||||
|
||||
__Warning:__ This guide uses version `14` of **wg-easy**. Version `15` introduces breaking changes incompatible with this configuration.
|
||||
::
|
||||
|
||||
::file-tree
|
||||
---
|
||||
tree:
|
||||
/:
|
||||
- docker:
|
||||
- wg-easy:
|
||||
- config:
|
||||
- etc_wireguard/
|
||||
- compose.yaml
|
||||
- .env
|
||||
---
|
||||
::
|
||||
|
||||
The container runs in `HOST` mode, meaning it uses the host’s network stack directly.
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click `compose`, and name the stack `wg_easy`.
|
||||
|
||||
Paste the following configuration:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
services:
|
||||
wg-easy:
|
||||
network_mode: host
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
- LANG=en
|
||||
- WG_HOST=${HOST}
|
||||
- PASSWORD_HASH=${PW}
|
||||
- WG_DEFAULT_ADDRESS=${ADDRESS}
|
||||
- WG_HIDE_KEYS=never
|
||||
- WG_ALLOWED_IPS=${IPS}
|
||||
- WG_DEFAULT_DNS=
|
||||
- UI_TRAFFIC_STATS=true
|
||||
- UI_CHART_TYPE=1
|
||||
image: ghcr.io/wg-easy/wg-easy:14
|
||||
container_name: wg-easy
|
||||
volumes:
|
||||
- /docker/wg_easy/config/etc_wireguard:/etc/wireguard
|
||||
restart: unless-stopped
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
- SYS_MODULE
|
||||
```
|
||||
|
||||
::tip{icon=""}
|
||||
✨ __Tip:__
|
||||
|
||||
- You can also specify your own wireguard port with `WG_PORT`
|
||||
- Add the Watchtower label to enable automatic updates
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
services:
|
||||
wg-easy:
|
||||
#...
|
||||
labels:
|
||||
- com.centurylinklabs.watchtower.enable=true
|
||||
```
|
||||
::
|
||||
|
||||
In `.env`:
|
||||
|
||||
```properties [.env]
|
||||
HOST=
|
||||
PW=
|
||||
ADDRESS=
|
||||
IPS=
|
||||
```
|
||||
|
||||
| Variable | Description | Example |
|
||||
|--------------|-------------|---------|
|
||||
| `HOST` | IP of public access of your host (router ISP's IP if it's at home) | `80.75.137.27` |
|
||||
| `PW` | Bcrypt password hash, [generate here](https://bcrypt-generator.com/). **NOTE:** Double the `$` characters | `$$2a$$12$$FF6T4QqSP9Ho` |
|
||||
| `ADDRESS` | VPN DHCP address range, the `x` must remain, others can vary | `10.8.0.x` |
|
||||
| `IPS` | IPs routed by clients through the VPN. Use `10.8.0.0/24` to only route VPN traffic. To include local LAN, add `192.168.0.0/16` separated by commas. | `10.8.0.0/24` |
|
||||
|
||||
Deploy the stack.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
### Enable Forwarding on Host
|
||||
|
||||
To allow communication between VPN clients, enable:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo sysctl net.ipv4.ip_forward=1
|
||||
sudo sysctl net.ipv4.conf.all.src_valid_mark=1
|
||||
```
|
||||
|
||||
### Retrieve Configuration Files
|
||||
|
||||
To configure clients, download the config files from the server:
|
||||
|
||||
- Visit `http://your-server-ip:51821`
|
||||
- Create a client
|
||||
- Download the config file
|
||||
- Rename it to `wg0.conf`
|
||||
|
||||
::caution
|
||||
|
||||
If it fails, check firewall rules.
|
||||
::
|
||||
|
||||
## On the Client Server
|
||||
::note
|
||||
|
||||
Assumes the client is a Linux server with Docker installed
|
||||
::
|
||||
|
||||
::file-tree
|
||||
---
|
||||
tree:
|
||||
/:
|
||||
- docker:
|
||||
- wireguard:
|
||||
- config:
|
||||
- wg_confs/
|
||||
- compose.yaml
|
||||
---
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Create the config folder
|
||||
|
||||
Create the folder `/docker/wireguard/config/wg_confs`:
|
||||
|
||||
::tip{icon="" to="/serveex/files/file-browser-quantum"}
|
||||
✨ __Tip:__ Use **File Browser** to browse and edit files without terminal
|
||||
::
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mkdir -p /docker/wireguard/config/wg_confs
|
||||
```
|
||||
|
||||
### Copy the configuration file
|
||||
|
||||
Copy the `wg0.conf` file downloaded earlier:
|
||||
|
||||
::tip{icon=""}
|
||||
✨ __Tip:__ Easiest way is to transfer the file via SFTP to `/home/youruser`, then move it:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo cp ~/wg0.conf /docker/wireguard/config/wg_confs
|
||||
```
|
||||
::
|
||||
|
||||
### Deploy the container
|
||||
|
||||
Create `compose.yaml` in `/docker/wireguard`:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo nano /docker/wireguard/compose.yaml
|
||||
```
|
||||
|
||||
Paste:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
services:
|
||||
wireguard:
|
||||
image: lscr.io/linuxserver/wireguard:latest
|
||||
container_name: wireguard
|
||||
network_mode: host
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
- SYS_MODULE #optional
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
volumes:
|
||||
- /docker/wireguard/config:/config
|
||||
- /lib/modules:/lib/modules #optional
|
||||
restart: unless-stopped
|
||||
```
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
Start the container:
|
||||
|
||||
```bash [Terminal]
|
||||
cd /docker/wireguard
|
||||
sudo docker compose up -d
|
||||
```
|
||||
|
||||
::note
|
||||
|
||||
Repeat for each client
|
||||
::
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
## Other Devices
|
||||
|
||||
- **Phone:** Install Wireguard and scan the QR code from the web UI (`http://your-server-ip:51821`)
|
||||
- **PC:** Install the Wireguard client and import the config file
|
||||
|
||||
::warning
|
||||
|
||||
__Warning:__ If a client device is on the same LAN as the server, edit `wg0.conf` and change the endpoint to the local server IP:
|
||||
`Endpoint = your-server-ip:51820`
|
||||
::
|
||||
|
||||
And this is the result:
|
||||
|
||||
|
||||
@@ -0,0 +1,248 @@
|
||||
---
|
||||
title: File Browser
|
||||
description: Install File Browser to browse and manage your server files from a web interface, exposed securely with SWAG.
|
||||
---
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
::warning{to="/serveex/files/file-browser-quantum"}
|
||||
|
||||
Replaced by **File Browser Quantum**. The original project has a history of serious CVEs (a CSRF-to-backdoor-admin RCE, stored XSS, path traversal, auth bypass...) and was officially archived in September 2026, with the maintainers leaving known session-handling and command-execution issues unfixed for good. Don't deploy this version, especially not exposed to the internet.
|
||||
::
|
||||
|
||||
[File Browser](https://github.com/filebrowser/filebrowser) is a web-based interface that lets you access and edit the files on your server.
|
||||
|
||||
|
||||
|
||||
## Installation
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click on `compose`, name the stack `filebrowser`, then copy and paste the following:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
services:
|
||||
filebrowser:
|
||||
container_name: filebrowser
|
||||
volumes:
|
||||
- /docker/filebrowser/config:/config/
|
||||
- /path/to/your/folders:/yourfolders #add your folders to browse as /docker:/docker for exemple
|
||||
ports:
|
||||
- 8010:80
|
||||
image: filebrowser/filebrowser:s6
|
||||
```
|
||||
|
||||
::tip{icon=""}
|
||||
✨ __Tip:__ Add the watchtower label to each container to automate updates.
|
||||
|
||||
```yaml [compose.yaml]
|
||||
services:
|
||||
filebrowser:
|
||||
#...
|
||||
labels:
|
||||
|
||||
- com.centurylinklabs.watchtower.enable=true
|
||||
```
|
||||
::
|
||||
|
||||
Deploy the container and go to `http://yourserverip:8010`. That’s it! Your File Browser web UI is up and running!
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
::caution
|
||||
|
||||
__If it doesn’t work:__ check your firewall rules.
|
||||
::
|
||||
|
||||
## Exposing File Browser with Swag
|
||||
|
||||
::warning
|
||||
|
||||
File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
|
||||
::
|
||||
|
||||
You may want to access File Browser remotely from all your devices. To do that, we’ll expose it through Swag.
|
||||
|
||||
::note
|
||||
|
||||
__Pre-requisite:__ We assume you've already created a subdomain like `files.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add File Browser's network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file to add File Browser’s network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
---
|
||||
services:
|
||||
swag:
|
||||
container_name: # ...
|
||||
# ...
|
||||
networks: # Connects the container to the custom network
|
||||
# ...
|
||||
- filebrowser # Name of the network declared in the stack
|
||||
|
||||
networks: # Defines the custom network
|
||||
# ...
|
||||
filebrowser: # Name of the network declared in the stack
|
||||
name: filebrowser_default # Actual name of the external network
|
||||
external: true # Specifies it's an external network
|
||||
```
|
||||
|
||||
::note
|
||||
|
||||
Here, we assume the network name for File Browser is `filebrowser_default`. You can confirm the connection is working by accessing the SWAG dashboard at http://yourserverip:81.
|
||||
::
|
||||
|
||||
Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
In the Swag folders, create the file `files.subdomain.conf`.
|
||||
|
||||
```bash [Terminal]
|
||||
sudo nano /docker/swag/config/nginx/proxy-confs/files.subdomain.conf
|
||||
```
|
||||
|
||||
And paste the following configuration:
|
||||
|
||||
```nginx [files.subdomain.conf]
|
||||
## Version 2023/12/19
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
server_name files.*;
|
||||
|
||||
include /config/nginx/ssl.conf;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
#if ($lan-ip = yes) { set $geo-whitelist yes; }
|
||||
#if ($geo-whitelist = no) { return 404; }
|
||||
if ($geo-blacklist = no) { return 404; }
|
||||
|
||||
# enable for ldap auth (requires ldap-location.conf in the location block)
|
||||
#include /config/nginx/ldap-server.conf;
|
||||
|
||||
# enable for Authelia (requires authelia-location.conf in the location block)
|
||||
#include /config/nginx/authelia-server.conf;
|
||||
|
||||
# enable for Authentik (requires authentik-location.conf in the location block)
|
||||
#include /config/nginx/authentik-server.conf;
|
||||
|
||||
location / {
|
||||
# enable the next two lines for http auth
|
||||
#auth_basic "Restricted";
|
||||
#auth_basic_user_file /config/nginx/.htpasswd;
|
||||
|
||||
# enable for ldap auth (requires ldap-server.conf in the server block)
|
||||
#include /config/nginx/ldap-location.conf;
|
||||
|
||||
# enable for Authelia (requires authelia-server.conf in the server block)
|
||||
#include /config/nginx/authelia-location.conf;
|
||||
|
||||
# enable for Authentik (requires authentik-server.conf in the server block)
|
||||
#include /config/nginx/authentik-location.conf;
|
||||
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_app filebrowser;
|
||||
set $upstream_port 80;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
That’s it! File Browser is now exposed!
|
||||
|
||||
## Protecting File Browser with TinyAuth
|
||||
Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `files.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy):
|
||||
|
||||
```nginx [files.subdomain.conf]{26-38,41-42}
|
||||
## Version 2023/12/19
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
server_name files.*;
|
||||
|
||||
include /config/nginx/ssl.conf;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
#if ($lan-ip = yes) { set $geo-whitelist yes; }
|
||||
#if ($geo-whitelist = no) { return 404; }
|
||||
if ($geo-blacklist = no) { return 404; }
|
||||
|
||||
# enable for ldap auth (requires ldap-location.conf in the location block)
|
||||
#include /config/nginx/ldap-server.conf;
|
||||
|
||||
# enable for Authelia (requires authelia-location.conf in the location block)
|
||||
#include /config/nginx/authelia-server.conf;
|
||||
|
||||
# enable for Authentik (requires authentik-location.conf in the location block)
|
||||
#include /config/nginx/authentik-server.conf;
|
||||
|
||||
location /tinyauth {
|
||||
internal;
|
||||
proxy_pass http://tinyauth:3000/api/auth/nginx;
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $http_host;
|
||||
proxy_set_header X-Forwarded-Uri $request_uri;
|
||||
}
|
||||
|
||||
location @tinyauth_login {
|
||||
return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
|
||||
}
|
||||
|
||||
location / {
|
||||
auth_request /tinyauth;
|
||||
error_page 401 = @tinyauth_login;
|
||||
|
||||
# enable the next two lines for http auth
|
||||
#auth_basic "Restricted";
|
||||
#auth_basic_user_file /config/nginx/.htpasswd;
|
||||
|
||||
# enable for ldap auth (requires ldap-server.conf in the server block)
|
||||
#include /config/nginx/ldap-location.conf;
|
||||
|
||||
# enable for Authelia (requires authelia-server.conf in the server block)
|
||||
#include /config/nginx/authelia-location.conf;
|
||||
|
||||
# enable for Authentik (requires authentik-server.conf in the server block)
|
||||
#include /config/nginx/authentik-location.conf;
|
||||
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_app filebrowser;
|
||||
set $upstream_port 80;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}
|
||||
|
||||
The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
|
||||
::
|
||||
|
||||
::tip{icon=""}
|
||||
✨ __Tip:__ You can protect this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `files.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
|
||||
::
|
||||
Reference in New Issue
Block a user