Convert the remaining Serveex and recycled articles to steps
This commit is contained in:
Djeex
@@ -8,6 +8,8 @@ description: Install Pocket ID, a lightweight self-hosted OIDC provider that let
|
||||
|
||||
[Pocket ID](https://pocket-id.org) is a minimalist, self-hosted OIDC (OpenID Connect) provider built entirely around passkeys: instead of managing passwords, you and your users log in to compatible apps with a **passkey** (fingerprint, face unlock, or a hardware security key). It runs as a single lightweight container with no external database to manage, and it does exactly one thing well: issuing OIDC logins.
|
||||
|
||||
|
||||
|
||||
This makes it a good fit if you just need a simple, fast SSO backend, for example to pair with [TinyAuth](/serveex/security/tinyauth) as a lightweight forward-auth setup, or to log in directly to apps that natively support OIDC.
|
||||
|
||||
- [Pocket ID documentation](https://pocket-id.org/docs)
|
||||
|
||||
@@ -8,6 +8,8 @@ description: Install TinyAuth, a lightweight forward-auth proxy, and pair it wit
|
||||
|
||||
[TinyAuth](https://tinyauth.app) is a small forward-auth proxy: a single login page that Swag can insert in front of any app before letting a request through, checking whether a visitor is authenticated before forwarding them on.
|
||||
|
||||
|
||||
|
||||
It supports a simple local username/password login out of the box, and can also delegate login to an external OIDC provider. Here we'll use [Pocket ID](/serveex/security/pocket-id), so anyone visiting a protected app first authenticates with a passkey via Pocket ID, then gets forwarded through.
|
||||
|
||||
- [TinyAuth documentation](https://tinyauth.app/docs)
|
||||
|
||||
@@ -6,6 +6,8 @@ description: Install Jellyfin, a free and open-source media server, to stream yo
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
|
||||
|
||||
[Jellyfin](https://jellyfin.org) is a free, open-source alternative to Plex and Emby. Unlike Plex, it has no paid tiers, no telemetry, and doesn't require an online account to use or manage your server: everything runs locally and stays yours.
|
||||
|
||||
It covers the same basics: a media library with metadata and artwork, transcoding (including hardware acceleration), and apps for TV, Android, iOS, Windows, and macOS.
|
||||
|
||||
+19
-11
@@ -5,18 +5,10 @@ description: Install File Browser Quantum, a modernized fork of File Browser, to
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
# File Browser Quantum
|
||||
|
||||
::note
|
||||
🎯 __Objectives:__
|
||||
|
||||
- Install File Browser Quantum
|
||||
- Expose File Browser Quantum using Swag
|
||||
::
|
||||
|
||||
[File Browser Quantum](https://github.com/gtsteffaniak/filebrowser) is a community fork of [File Browser](/recycled/deprecated/file-browser), rewritten for better performance (indexed search, lower memory use) and configured through a single `config.yaml` file instead of a database-only setup.
|
||||
|
||||
If you're already using File Browser and it fits your needs, there's no need to switch. The two are independent projects with their own configuration and can't share data directly.
|
||||
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -33,6 +25,9 @@ tree:
|
||||
---
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Create the config file
|
||||
|
||||
Create the data folder:
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -61,6 +56,8 @@ server:
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click on `compose`, name the stack `filebrowser-quantum`, then copy and paste the following:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -98,6 +95,9 @@ Mount every folder you listed under `sources` in `config.yaml` at the same path
|
||||
|
||||
Deploy the container and go to `http://yourserverip:8020`. Log in with the default `admin` / `admin` credentials, then immediately change the password in your profile settings.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
::caution
|
||||
|
||||
__If it doesn't work:__ check your firewall rules.
|
||||
@@ -112,11 +112,14 @@ File Browser Quantum does not support multi-factor authentication. Exposing it p
|
||||
|
||||
You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through Swag.
|
||||
|
||||
::note
|
||||
::note{icon=""}
|
||||
|
||||
__Pre-requisite:__ We assume you've already created a subdomain like `fbq.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
|
||||
📋 __Pre-requisite:__ We assume you've already created a subdomain like `fbq.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add File Browser Quantum's network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file to add File Browser Quantum's network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -143,6 +146,8 @@ Here, we assume the network name for File Browser Quantum is `filebrowser-quantu
|
||||
|
||||
Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
In the Swag folders, create the file `fbq.subdomain.conf`.
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -199,6 +204,9 @@ server {
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
That's it! File Browser Quantum is now exposed.
|
||||
|
||||
## Protecting File Browser Quantum with TinyAuth
|
||||
@@ -77,7 +77,7 @@ __If it fails:__ check your firewall rules.
|
||||
## Exposing Pingvin with Swag
|
||||
The whole point of a solution like this is being able to access it remotely, from all your devices. To do this, we'll expose Pingvin through Swag.
|
||||
|
||||
::note
|
||||
::note{icon=""}
|
||||
📋 __Prerequisite:__ <br/><br/>
|
||||
We assume you have the subdomain `pingvin.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
@@ -38,6 +38,9 @@ tree:
|
||||
---
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click on `compose`, name the stack `code-server`, and paste the following:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -73,6 +76,8 @@ services:
|
||||
```
|
||||
::
|
||||
|
||||
### Set your environment variables
|
||||
|
||||
Choose a password and generate its hash:
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -100,6 +105,9 @@ __Note:__ Make sure to wrap the hash in single quotes `'`
|
||||
|
||||
Deploy the container and go to `http://yourserverip:8443`. Voilà, your code-server instance is up and running in the browser!
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
::caution
|
||||
|
||||
__If it fails:__ check your firewall rules.
|
||||
@@ -126,6 +134,9 @@ The whole point of such a solution is to access it remotely from any device. To
|
||||
__Preliminary:__ We assume you’ve created a subdomain like `code.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). Unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), we also assume you’ve forwarded port `443` from your router to port `443` on your server using [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add code-server's network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file to add code-server’s network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -152,6 +163,8 @@ We assume the network name is `code-server_default`. You can verify that the con
|
||||
|
||||
Redeploy the stack by clicking “deploy” and wait until SWAG is fully operational.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
Inside the Swag config folders, create the file `code.subdomain.conf`.
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -216,6 +229,9 @@ server {
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
That’s it! code-server is now exposed!
|
||||
|
||||
## Protecting code-server with TinyAuth
|
||||
|
||||
@@ -5,17 +5,12 @@ description: Install Forgejo, a lightweight self-hosted Git service to manage yo
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
# Forgejo
|
||||
|
||||
::note
|
||||
🎯 __Goals:__
|
||||
|
||||
- Install Forgejo
|
||||
- Expose Forgejo using Swag
|
||||
::
|
||||
|
||||
[Forgejo](https://forgejo.org/) is a self-hosted DevOps platform that allows you to manage repositories much like GitHub, but on your own infrastructure. It's a community-driven fork of Gitea.
|
||||
|
||||
|
||||
|
||||
## Installation
|
||||
|
||||
::file-tree
|
||||
@@ -30,6 +25,9 @@ tree:
|
||||
---
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click on `compose`, name the stack `forgejo`, and paste the following content:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -55,6 +53,8 @@ services:
|
||||
- 222:22
|
||||
```
|
||||
|
||||
### Set your environment variables
|
||||
|
||||
Fill out the `.env` file with the required information, for example:
|
||||
|
||||
```properties [.env]
|
||||
@@ -64,6 +64,9 @@ GID=1000
|
||||
|
||||
Deploy the container and go to `http://yourserverip:3333`. Your Forgejo instance is now up and running!
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
::caution
|
||||
|
||||
__If it fails:__ check your firewall rules.
|
||||
@@ -77,6 +80,9 @@ The benefit of this setup is being able to access it remotely from any of your d
|
||||
__Prerequisite:__ We assume you have created a subdomain such as `forgejo.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` pointing to `yourdomain.com`, and [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you have already forwarded port `443` from your router to your server’s port `443` in the [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add Forgejo's network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file by adding Forgejo's network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -103,6 +109,8 @@ We assume the Forgejo network name is `forgejo_default`. You can verify connecti
|
||||
|
||||
Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
Inside the Swag folders, create the file `forgejo.subdomain.conf`.
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -173,6 +181,8 @@ server {
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Configure Forgejo's domain
|
||||
|
||||
Now open the `app.ini` file from the container's file system:
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -190,6 +200,9 @@ ROOT_URL = https://forgejo.yourdomain.com/
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit, then restart the container.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
And that’s it! Forgejo is now exposed to the web.
|
||||
|
||||
## Protecting Forgejo with Pocket ID
|
||||
|
||||
@@ -5,14 +5,6 @@ description: Install IT Tools, a self-hosted collection of handy utilities for d
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
# IT Tools
|
||||
|
||||
::note
|
||||
🎯 __Goals:__
|
||||
|
||||
- Install IT Tools
|
||||
- Expose IT Tools with Swag
|
||||
::
|
||||
|
||||
[IT Tools](https://github.com/CorentinTh/it-tools) is a container exposing a web page that provides access to a wide range of development tools.
|
||||
|
||||
@@ -20,6 +12,9 @@ description: Install IT Tools, a self-hosted collection of handy utilities for d
|
||||
|
||||
## Installation
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click on `compose`, name the stack `it-tools`, and paste the following:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -48,6 +43,9 @@ services:
|
||||
|
||||
Deploy the container and visit `http://yourserverip:3222`. That’s it, your IT Tools web UI instance is up and running!
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
::caution
|
||||
|
||||
__If it fails:__ check your firewall rules.
|
||||
@@ -61,6 +59,9 @@ You might want to access it remotely on all your devices. To do that, we'll expo
|
||||
__Pre-requisite:__ We assume you’ve created a subdomain like `tools.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` set to `yourdomain.com`. Also, unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure you’ve already forwarded port `443` from your router to port `443` on your server in the [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add IT Tools' network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file to add the IT Tools network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -92,6 +93,8 @@ We also assume the SWAG network is named `swag_default`.
|
||||
|
||||
Restart the stack by clicking "deploy" and wait for SWAG to be fully operational.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
Inside the Swag folders, create the file `tools.subdomain.conf`.
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -157,6 +160,9 @@ server {
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
And that’s it! IT Tools is now exposed!
|
||||
|
||||
## Protecting IT Tools with TinyAuth
|
||||
|
||||
@@ -5,16 +5,6 @@ description: Install AdGuard Home for network-wide ad and tracker blocking with
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
# Adguard Home
|
||||
|
||||
::note
|
||||
🎯 __Goals:__
|
||||
|
||||
- Install and deploy Adguard
|
||||
- Expose Adguard
|
||||
- Secure DNS queries with SSL/TLS
|
||||
- Configure client devices
|
||||
::
|
||||
|
||||
[AdGuard Home](https://github.com/AdguardTeam/AdGuardHome) is a DNS server that blocks ads and tracking at the system level. Once configured, it will protect ALL your home devices without the need for any client-side software.
|
||||
|
||||
@@ -22,6 +12,8 @@ It works as a DNS server that redirects tracking domains to a “black hole,”
|
||||
|
||||
In practice, once it's in place, all you need to do is set your devices to use Adguard as their DNS server.
|
||||
|
||||
|
||||
|
||||
**Quick reminder of how DNS works:**
|
||||
|
||||
When you visit a site or use an app, it makes requests to various domains to load content, ads in particular. Your device doesn’t know the IP addresses of these domains, so it contacts a _Domain Name Server_ (DNS), which returns the current IP address.
|
||||
@@ -57,6 +49,9 @@ tree:
|
||||
We will also mount the `/docker/swag/config/etc/letsencrypt` folder to access Swag's SSL certificate.
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge and click `compose`
|
||||
|
||||
Name the stack `adguardhome` and paste the configuration below:
|
||||
@@ -97,14 +92,17 @@ Deploy the stack.
|
||||
|
||||
Go to `http://yourserverip:3000` and follow the setup instructions.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
That’s it! Adguard is deployed.
|
||||
|
||||
## Exposing AdGuard with SWAG
|
||||
To make AdGuard usable from outside your home network, you need to expose it.
|
||||
|
||||
::note
|
||||
::note{icon=""}
|
||||
|
||||
__Prerequisites:__ We assume you've created a subdomain like `adguard.mydomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `mydomain.com`, and that you’ve already forwarded port `443` from your router to port `443` on your server in your [NAT rules](/general/networking/nat). Also forward port `53` and port `853` to your server. These ports are used to route DNS requests.
|
||||
📋 __Prerequisites:__ We assume you've created a subdomain like `adguard.mydomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `mydomain.com`, and that you’ve already forwarded port `443` from your router to port `443` on your server in your [NAT rules](/general/networking/nat). Also forward port `53` and port `853` to your server. These ports are used to route DNS requests.
|
||||
::
|
||||
|
||||
::warning
|
||||
@@ -112,6 +110,9 @@ __Prerequisites:__ We assume you've created a subdomain like `adguard.mydomain.c
|
||||
Do not use Cloudflare tunnels to expose AdGuard, and make sure any proxying is disabled.
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add AdGuard's network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file to add the AdGuard network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -138,6 +139,8 @@ We assume here that the AdGuard network is named `adguard_default`. You can veri
|
||||
|
||||
Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
Create and open the file `adguard.subdomain.conf`
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -226,6 +229,9 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
## Protecting AdGuard with TinyAuth
|
||||
Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `adguard.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy). The `/dns-query` location is left out of the `auth_request` check, since DNS-over-HTTPS clients can't do an interactive login:
|
||||
|
||||
|
||||
@@ -26,6 +26,9 @@ tree:
|
||||
---
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Deploy the stack
|
||||
|
||||
Open Dockge, click on `compose`, name the stack `vaultwarden`, and paste the following:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -70,6 +73,8 @@ services:
|
||||
```
|
||||
::
|
||||
|
||||
### Set your environment variables
|
||||
|
||||
Next, generate a password hash to put in the `TOKEN` variable in `.env`:
|
||||
|
||||
```bash [Terminal]
|
||||
@@ -94,6 +99,9 @@ Then deploy the container.
|
||||
|
||||
Recently, Vaultwarden requires SSL to be accessed, which prevents access via a local IP. We'll expose it with SWAG, which provides an SSL certificate.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
::caution
|
||||
|
||||
__If it fails:__ check your firewall rules.
|
||||
@@ -106,6 +114,9 @@ The main benefit of Vaultwarden is being able to access it remotely from any dev
|
||||
📋 __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Add Vaultwarden's network to SWAG
|
||||
|
||||
In Dockge, go to the SWAG stack and edit the compose file to add the Vaultwarden network:
|
||||
|
||||
```yaml [compose.yaml]
|
||||
@@ -132,6 +143,8 @@ We're assuming the network name is `vaultwarden_default`. You can check connecti
|
||||
|
||||
Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational.
|
||||
|
||||
### Create the subdomain.conf file
|
||||
|
||||
In SWAG's config folder, create the file `vault.subdomain.conf`:
|
||||
|
||||
::tip{icon=""}
|
||||
@@ -230,6 +243,9 @@ server {
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
### Done !
|
||||
::
|
||||
|
||||
And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.com/admin` to access the admin panel and paste the password you specified when generatique the `ADMIN_TOKEN`. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
|
||||
|
||||
Don't forget to install Bitwarden browser extensions (they work with Vaultwarden) for [Chrome](https://chromewebstore.google.com/detail/gestionnaire-de-mots-de-p/nngceckbapebfimnlniiiahkandclblb) and [Firefox](https://addons.mozilla.org/fr/firefox/addon/bitwarden-password-manager/), as well as [iOS](https://apps.apple.com/fr/app/bitwarden/id1137397744) and [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden&hl=fr) apps to sync your passwords.
|
||||
|
||||
Reference in New Issue
Block a user