Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Convert step-by-step sections to the steps component

Browse Source
This commit is contained in:
Djeex
2026-09-02 18:16:20 +02:00
parent 11c5432955
commit b864251f48
5 changed files with 186 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/10.advanced/1.authentik.md
+57 -22
View File
@@ -5,15 +5,6 @@ description: Install Authentik as a self-hosted identity provider, configure MFA
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
# Authentik
::note
🎯 __Objectives:__
- Install and expose Authentik
- Configure Multi-Factor Authentication (MFA)
- Protect a native app or an app behind a reverse proxy
::
[Authentik](https://goauthentik.io) is a single sign-on (SSO) tool that allows you to log in once to all platforms compatible with OpenID. It can also secure access to your exposed services by injecting itself via SWAG into requests to those services.
@@ -51,12 +42,15 @@ root
└── ssh
```
Create the folders:
::steps{level="3"}
### Create the folders
```bash [Terminal]
sudo mkdir -p /docker/authentik/media /docker/authentik/certs /docker/authentik/custom-template /docker/authentik/ssh
```
### Generate secrets
Navigate to the `authentik` folder via `cd /docker/authentik` and generate a password and secret key to include in the `.env` file:
```bash [Terminal]
@@ -72,6 +66,8 @@ To generate the keys, we created the folders ahead of deployment using Dockge. D
```
::
### Deploy the stack
Open Dockge and search for "authentik" in the inactive stacks.
Name the stack `authentik` and paste the following configuration, replacing `{AUTHENTIK_TAG:-2026.2}`{lang=properties} with [the latest version of Authentik](https://goauthentik.io/docs/releases).
@@ -189,6 +185,8 @@ volumes:
driver: local
```
### Begin the initial setup
In the `.env` file, the `PG_PASS` and `AUTHENTIK_SECRET_KEY` variables are already set.
Deploy the stack.
@@ -200,6 +198,9 @@ You can then begin the initial setup by visiting:
__Warning:__ It’s recommended to create a new admin account and **disable** the default `akadmin` account.
::
### Done !
::
## Exposing Authentik
To use Authentik outside your local network, you must expose it.
@@ -208,6 +209,9 @@ To use Authentik outside your local network, you must expose it.
We assume you have already created a subdomain like `auth.mydomain.com` in your [DNS zone](/general/networking/dns), with a CNAME pointing to `mydomain.com`. Also, unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), you must have already forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/networking/nat).
::
::steps{level="3"}
### Verify authentik-server.conf
Open the `authentik-server.conf` file:
::tip{icon=""}
@@ -228,6 +232,8 @@ proxy_pass http://$upstream_authentik:9000;
If not, make the necessary changes, then save with :kbd{value="Ctrl+O"}, :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
### Create the subdomain.conf file
Create the `auth.subdomain.conf` file:
```bash [Terminal]
@@ -273,6 +279,8 @@ server {
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
### Add Authentik's network to SWAG
Go to Dockge, and edit the SWAG compose file to add the Authentik network:
```yaml [compose.yaml]
@@ -294,18 +302,25 @@ networks: # Define the custom network
Restart the stack and wait for SWAG to be fully operational.
Done! You can now access Authentik via `https://auth.mydomain.com`
### Done !
::
You can now access Authentik via `https://auth.mydomain.com`
## Enable Multifactor Authentication
The main value of Authentik is using multifactor authentication for all protected apps.
- Go to `https://auth.mydomain.com`
- Log in
- Go to _Settings_
- Click the _MFA_ section
- Click _Register_
- Choose a method like _TOTP device_ (you'll need an authenticator app like Google Authenticator)
- Follow the steps
::steps{level="3"}
### Log in to Authentik
Go to `https://auth.mydomain.com` and log in.
### Register an MFA method
Go to _Settings_, click the _MFA_ section, then _Register_. Choose a method like _TOTP device_ (you'll need an authenticator app like Google Authenticator) and follow the steps.
### Done !
::
You’ll now be prompted to enter a one-time code at every login.
@@ -320,6 +335,7 @@ SWAG lets you insert Authentik’s login page between a request and access to yo
Why do this when Dockge already has authentication? Because Dockge uses weak HTTP authentication. With Authentik, you get strong MFA authentication and automatic login to all apps protected by Authentik. This secures access to Dockge and other apps without needing a VPN.
::steps{level="3"}
### Configuring Authentik
- Go to Authentik
@@ -351,12 +367,15 @@ Uncomment the two lines `#include /config/nginx/authentik-server.conf;`
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
Done! Now when accessing `https://dockge.mydomain.com`, you’ll be redirected to the Authentik login screen.
::tip{icon=""}
✨ __Tip:__ In Dockge's settings, you can disable Dockge's authentication to avoid double login. **Warning**: this means if the port is open on your local network, there will be no authentication at all.
::
### Done !
::
Now when accessing `https://dockge.mydomain.com`, you’ll be redirected to the Authentik login screen.
::note
Repeat this process for each app you want to protect (unless it has native integration with Authentik).
@@ -382,6 +401,7 @@ This container will forward requests to your main [Authentik](/serveex/advanced/
![auth-outpost](/img/serveex/auth-outpost.svg)
::steps{level="3"}
### Configuring Authentik
Create your [providers and applications](/serveex/advanced/authentik/#protecting-a-native-app) as shown earlier.
@@ -415,9 +435,9 @@ Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{val
On the list of created outposts, locate the new one and click _Show details_ at the end of the line. Carefully copy the access token.
### Configuring the Remote Machine
We assume you’ve already installed [Docker](/serveex/core/docker) and [SWAG](/serveex/core/swag) on this remote machine. Here's how to configure it:
We assume you’ve already installed [Docker](/serveex/core/docker) and [SWAG](/serveex/core/swag) on this remote machine.
### Create the stack folder
On your remote machine, use [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs) to create a stack named `authentik-outpost`.
@@ -432,6 +452,8 @@ sudo mkdir -P /docker/authentik-outpost
You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
::
### Create the compose file
Create the `compose.yaml` file or paste the configuration directly into Dockge if installed.
Via command line:
@@ -463,6 +485,8 @@ services:
AUTHENTIK_TOKEN: ${TOKEN}
```
### Add the outpost network to SWAG
Go to the SWAG stack on the remote machine (or edit directly using Dockge) and add the authentik-outpost network in the configuration file like this (see `networks` section):
```bash [Terminal]
@@ -492,6 +516,8 @@ Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ct
We assume the Dockge network name is `authentik-outpost_default`.
::
### Restart SWAG
If using [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs), restart SWAG.
Otherwise, via terminal:
@@ -501,6 +527,8 @@ cd /docker/swag/
sudo docker compose up -d
```
### Set your environment variables
Create (or fill using Dockge) the `.env` file in the `authentik-outpost` directory:
Via command line:
@@ -525,6 +553,8 @@ Fill in the values:
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Deploy the stack
If using Dockge, deploy the stack.
Otherwise, via terminal:
@@ -536,6 +566,8 @@ sudo docker compose up -d
The container is now running. You can verify its status from your Authentik instance admin panel under _Applications > Outposts_.
### Point SWAG at the outpost
Now, let’s configure SWAG.
Open the `authentik-server.conf` file:
@@ -553,6 +585,9 @@ proxy_pass http://$upstream_authentik:9000;
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
### Done !
::
Then configure the applications to protect as you did on your main server, whether they are [native](/serveex/advanced/authentik/#protecting-a-native-app) or protected via [reverse proxy](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
## Migrating an Authentik Database
content/en/3.serveex/2.core/2.docker.md
+29 -12
View File
@@ -20,7 +20,8 @@ Docker, to install deployable services in seconds and manage them with just a fe
![picture](/img/serveex/docker.svg)
## Install Docker
Add the Docker repositories and GPG key:
::steps{level="3"}
### Add the Docker repository and GPG key
```bash [Terminal]
# Add Docker's official GPG key:
@@ -35,22 +36,23 @@ echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docke
sudo apt-get update
```
Install the packages:
### Install the packages
```bash [Terminal]
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```
That's it!
### Done !
::
**More options:** [Install Docker for Debian 13](https://docs.docker.com/engine/install/debian/)
::note
From here on, we assume the stacks are installed in the `/docker` folder, created using the command:
```bash [Terminal]
sudo mkdir /docker
```
```bash [Terminal]
sudo mkdir /docker
```
::
## Install [Dockge](https://github.com/louislam/dockge) to manage and deploy containers
@@ -69,14 +71,15 @@ root
└── compose.yml
```
Create the stack folder:
::steps{level="4"}
#### Create the stack folder
```bash [Terminal]
cd /docker
sudo mkdir dockge
```
Then create the `compose.yml` file in this folder using `nano`:
#### Create the compose file
```bash [Terminal]
cd /docker/dockge
@@ -107,7 +110,7 @@ services:
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
To launch the container:
#### Launch the container
```bash [Terminal]
cd /docker/dockge
@@ -118,6 +121,9 @@ Then go to `http://yourserverip:3555` in your browser to access the login page.
More info on [Dockge and how to use it](https://github.com/louislam/dockge)
#### Done !
::
And there you go! Docker and a tool to easily manage your containers are ready!
## [Watchtower](https://watchtower.nickfedor.com/), to auto-update containers
@@ -125,6 +131,9 @@ Watchtower is a container that checks for updates and pulls new images automatic
### Configuration
::steps{level="4"}
#### Create the stack
- Open Dockge in your browser
- Click `compose`
- Name the stack `watchtower`
@@ -156,7 +165,9 @@ services:
- /var/run/docker.sock:/var/run/docker.sock
```
Then fill in the `.env` section in Dockge with the following:
#### Set your environment variables
Fill in the `.env` section in Dockge with the following:
```properties [.env]
SCHEDULE=
@@ -168,12 +179,18 @@ WH_URL=
| `SCHEDULE` | Cron format | `0 0 6 * * *` (every day at 6 AM) |
| `WH_URL` | Your Discord webhook URL - append `/slack` at the end | `https://yourdiscordserver/webhook/slack` |
#### Enable Watchtower on other containers
To have Watchtower monitor your other containers, add this to their `compose.yml`:
```yaml [compose.yaml]
labels:
- com.centurylinklabs.watchtower.enable=true
```
Then restart the modified stacks. And that's it! You now have a solid base to start deploying the services you want!
Then restart the modified stacks.
#### Done !
::
And that's it! You now have a solid base to start deploying the services you want!
content/en/3.serveex/2.core/3.swag.md
+38 -19
View File
@@ -5,17 +5,6 @@ description: Set up SWAG as a reverse proxy with automatic SSL, expose your serv
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
# SWAG
::note
🎯 __Objectives:__
- Install Swag
- Enable SSL
- Access the dashboard
- Configure regional blocking
- Expose Dockge
::
[Swag](https://docs.linuxserver.io/general/swag/) is the core of this homelab. It’s a powerful reverse proxy that allows you to expose services on the internet using domain names, handling SSL certificate issuance (for encrypted connections), request routing, and access security (via HTTP auth or SSO like Authelia or Authentik). All the necessary documentation is [available here](https://docs.linuxserver.io/general/swag).
@@ -55,6 +44,9 @@ root
└── .env
```
::steps{level="3"}
### Deploy the stack
Open Dockge in your browser, click on `compose`, name the stack `swag`, and copy the following config:
```yaml [compose.yaml]
@@ -111,6 +103,8 @@ services:
```
::
### Set your environment variables
Then in the `.env` file:
```properties [.env]
@@ -129,7 +123,9 @@ Fill out the variables as follows:
| `EMAIL` | Your email for generating the certificate | `your@email.com` |
| `PLUGIN` | Plugin for certificate generation, depends on your [DNS provider](https://docs.linuxserver.io/general/swag/) | `ovh`<br>`cloudflare` |
Assuming your DNS zone is managed by OVH, deploy the stack once. The logs will show a failure in creating the SSL certificate due to a missing `ovh.ini` configuration. Stop the stack.
### Configure the OVH DNS plugin
Assuming your DNS zone is managed by OVH (if not, please check for your [provider](https://github.com/linuxserver/docker-swag/tree/master/root/defaults/dns-conf)), deploy the stack once. The logs will show a failure in creating the SSL certificate due to a missing `ovh.ini` configuration. Stop the stack.
In CLI, go to the dns-conf folder and edit the `ovh.ini` file:
@@ -166,6 +162,8 @@ Note the 3 keys temporarily and enter them in `ovh.ini`. (In nano, just start ty
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
### Enable DBIP in nginx.conf
Now configure swag to access DBIP, the geolocation-based access control module. Open the `nginx.conf` file:
```bash [Terminal]
@@ -180,6 +178,9 @@ include /config/nginx/dbip.conf;
Restart the stack in Dockge. This time, the SSL certificate should be successfully generated! Check the logs to confirm the server is ready.
### Done !
::
## Dashboard
Access the dashboard locally by going to `http://yourserverip:81`
On the left, you'll see a list of currently "proxied" services (none yet). On the right, the list of banned IPs. Below, various indicators. For more details, [click here](https://www.linuxserver.io/blog/introducing-swag-dashboard).
@@ -193,13 +194,16 @@ In this example, we’ll configure it to block a list of countries known to be t
This configuration can be enabled or disabled per service (see the Dockge example below).
Open `dbip.conf`:
::steps{level="3"}
### Open dbip.conf
```bash [Terminal]
sudo nano /docker/swag/config/nginx/dbip.conf
```
Make your changes ([see documentation](https://github.com/linuxserver/docker-mods/tree/swag-dbip)), or use the following example:
### Make your changes
Refer to the [documentation](https://github.com/linuxserver/docker-mods/tree/swag-dbip), or use the following example:
```nginx [dbip.conf]
geoip2 /config/geoip2db/dbip-country-lite.mmdb {
@@ -245,7 +249,12 @@ geo $lan-ip {
}
```
Save and close the file. Restart the stack.
### Save and restart
Save and close the file, then restart the stack.
### Done !
::
In the domain config files (see next section), you can enable or disable the whitelist or blacklist ([see documentation here](https://www.forum-nas.fr/threads/tuto-installer-swag-en-docker-reverse-proxy.15057/)). In our case, the whitelist allows only French requests. The blacklist blocks only the listed countries. We'll use the blacklist, like so:
@@ -274,8 +283,8 @@ server {
}
```
## Exposing Dockge
::note
## (Optional) Exposing Dockge
::note{icon=""}
📋 __Prerequisite:__ <br/><br/>
We assume that you have created a subdomain like `dockge.mydomain.com` in your [DNS zone](/general/networking/dns), with a `CNAME` pointing to `mydomain.com`. Unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), we also assume you've forwarded port `443` from your router to the server's `443` in [your NAT rules](/general/networking/nat).
::
@@ -284,9 +293,12 @@ Now it's time to expose Dockge on the internet so you can access and manage your
::warning
Dockge does not support multi-factor authentication. Exposing it online could compromise all connected machines. Only do this if you're using an MFA solution like [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
Dockge does not support multi-factor authentication. Exposing it online could compromise all connected machines. Only do this if you're using an MFA solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
::
::steps{level="3"}
### Create the subdomain.conf file
Open the `dockge.subdomain.conf` file:
```bash [Terminal]
@@ -342,6 +354,8 @@ Save and exit. The configuration will update within a few seconds.
By default, SWAG doesn’t recognize the name "dockge". You’ll need to add Dockge’s network to SWAG’s `compose.yml`.
::
### Add Dockge's network to SWAG
Go to the SWAG stack, click `edit`, and modify the config file like this (note the `networks` section):
```yaml [compose.yaml]
@@ -367,8 +381,13 @@ We assume the Dockge network is named `dockge_default`. You can verify the setup
Redeploy the SWAG stack.
### Visit your new subdomain
Wait a moment, then visit `https://dockge.mydomain.com` in your browser. You should be redirected to Dockge. You can also check the service status from the dashboard (`http://yourserverip:81` on your local network).
### Done !
::
## Exposing Another Service with SWAG
SWAG includes templates for most known services, named `servicename.subdomain.conf.sample`. Just create the subdomain in your registrar's DNS zone (like OVH), point it to your main domain via a CNAME, then copy and rename the sample file:
@@ -379,7 +398,7 @@ sudo cp servicename.subdomain.conf.sample servicename.subdomain.conf
::caution
- __If the subdomain is not redirected properly__
__If the subdomain is not redirected properly__
- Open the file and verify the container name in `set $upstream_app containername;`{lang=nginx}
- Make sure you added the container's network in SWAG’s `compose.yml`
::
content/en/3.serveex/3.security/1.wireguard.md
+41 -17
View File
@@ -5,15 +5,6 @@ description: Install and configure WireGuard VPN to securely access your homelab
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
# Wireguard
::note
🎯 __Goals:__
- Install Wireguard
- Configure clients
- Access the secure network
::
## Introduction
Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.
@@ -72,6 +63,9 @@ root
└── .env
```
::steps{level="3"}
### Deploy the stack
Open Dockge, click **Compose**, and name the stack `wg_easy`.
Copy the following configuration:
@@ -145,25 +139,48 @@ Deploy the stack and access the local web UI at `http://server-ip:51821`.
If the deployment fails, check your firewall rules.
::
### Create your account
Once connected, follow the web UI instructions to:
- Create your admin account and password.
- Set the host field (use your public IP or domain name).
### Configure the tunnel
Then go to *Administrator → Admin Panel → Config*:
- Change `Allowed IPs` from `0.0.0.0/24` to `10.8.0.0/24` for **split tunneling**.
- Remove IPv6 (it often causes unnecessary issues).
### Done !
::
### Retrieve Configuration Files
To configure clients:
1. Access the web UI: `http://server-ip:51821`
2. Create a new client
3. Edit the client and add `10.8.0.0/24` to `Server Allowed IPs`
4. (Optional) Set `Persistent Keep Alive` to `25` if it’s a permanently connected client
5. Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)
::steps{level="4"}
#### Access the web UI
Go to `http://server-ip:51821`.
#### Create a new client
#### Edit the client
Add `10.8.0.0/24` to `Server Allowed IPs`.
#### (Optional) Set Persistent Keep Alive
Set it to `25` if it’s a permanently connected client.
#### Save and rename the file
Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)
#### Done !
::
## Client Server Setup
::note
@@ -182,7 +199,8 @@ root
└── compose.yaml
```
Create the folder:
::steps{level="3"}
### Create the folder
```bash [Terminal]
sudo mkdir -p /docker/wireguard/config/wg_confs
@@ -192,7 +210,7 @@ sudo mkdir -p /docker/wireguard/config/wg_confs
✨ **Tip:** You can use [File Browser](/serveex/files/file-browser) instead of the terminal to edit and upload files.
::
Create the `wg0.conf` file:
### Create the wg0.conf file
```bash [Terminal]
sudo nano /docker/wireguard/config/wg_confs/wg0.conf
@@ -207,6 +225,8 @@ sudo cp ~/wg0.conf /docker/wireguard/config/wg_confs
```
::
### Create the compose file
Create the `compose.yaml` file in `/docker/wireguard`:
```yaml [compose.yaml]
@@ -229,12 +249,16 @@ services:
restart: unless-stopped
```
Start the container:
### Start the container
```bash [Terminal]
cd /docker/wireguard
sudo docker compose up -d
```
### Done !
::
::note
Repeat this setup for each client.
content/en/3.serveex/3.security/2.cloudflare.md
+21 -23
View File
@@ -5,17 +5,6 @@ description: Use Cloudflare Tunnels and Zero Trust to expose homelab services wi
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
# Cloudflare Zero Trust
::note
🎯 __Goals:__
- Understand the concept of Cloudflare Tunnels
- Configure your Cloudflare account
- Configure SWAG
- Manage multiple tunnels
::
![cloudfare_tunnels](/img/serveex/cloudflared.svg)
## Introduction
@@ -34,8 +23,7 @@ Simply put, Cloudflare Tunnels allow you to:
Here we’ll explain how to integrate SWAG with Cloudflare tunnels.
::warning
- __Warning:__
__Warning:__
- Do not use Cloudflare tunnels to expose a mail server
- Do not use Cloudflare tunnels to expose a video service like Jellyfin. Unlike Plex, [Jellyfin has no cloud relay](/serveex/media/jellyfin) and is exposed directly through SWAG in this guide, so make sure it stays behind plain port forwarding rather than a Cloudflare tunnel
- Do not use Cloudflare tunnels for the BitTorrent protocol (if you followed [this guide](/serveex/media/qbittorrent), everything is fine)
@@ -50,7 +38,7 @@ If you only have one server to protect behind Cloudflare, you can delete all exi
If you have subdomains pointing to other servers, you can still define them in the DNS zone using A records.
If you have several servers and tunnels under one domain, [see here](http://192.168.7.80:8005/serveex/cloudflare/#gerer-plusieurs-tunnels-pour-plusieurs-serveurs).
If you have several servers and tunnels under one domain, [see here](#managing-multiple-tunnels-for-multiple-servers).
### API Key
@@ -85,7 +73,8 @@ SWAG supports two Docker Mods:
These two mods, merged into the SWAG container, require some configuration.
### Tunnel Configuration
::steps{level="3"}
### Configure the tunnel
Create a file `tunnelconfig.yml` to reference in your SWAG `compose.yaml`.
@@ -113,7 +102,7 @@ ingress:
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
### Cloudflare Real IP Configuration
### Configure Cloudflare Real IP
Now configure _Cloudflare Real IP_.
@@ -134,7 +123,7 @@ set_real_ip_from 127.0.0.1;
Save with :kbd{value="Ctrl+O"}, then :kbd{value="Enter"}, and exit with :kbd{value="Ctrl+X"}.
### Docker Compose
### Deploy the SWAG stack
In Dockge, edit your SWAG stack with this:
@@ -227,26 +216,35 @@ Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero
![dns](/img/serveex/cf-dns.png)
::
### Done !
::
## Managing Multiple Tunnels for Multiple Servers
By default, all subdomains of your domain are routed through the single tunnel. But if you have a second server, just change the tunnel name in that SWAG instance.
By default, all subdomains of your domain are routed through the single tunnel. But if you have a second server, just change the tunnel name in that SWAG instance, and redirect subdomains to the correct tunnel in your DNS zone.
In your DNS zone, redirect subdomains to the correct tunnel.
::steps{level="3"}
### Change the tunnel name
Go to _Networks > Tunnels_ in [Cloudflare Zero Trust](https://one.dash.cloudflare.com/).
In the second server's SWAG stack, set a different `TUNNEL_NAME` in the `.env` file, then redeploy.
Note the tunnel IDs:
### Find the tunnel IDs
Go to _Networks > Tunnels_ in [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and note the tunnel IDs:
![tunnels_id](/img/serveex/cf-tunnels-id.png)
Then in the [Cloudflare DNS dashboard](https://dash.cloudflare.com/), click your domain name.
### Add CNAME records
Click `Add Record` and add these two CNAME records (include `.cfargotunnel.com`):
In the [Cloudflare DNS dashboard](https://dash.cloudflare.com/), click your domain name, then `Add Record` and add these two CNAME records (include `.cfargotunnel.com`):
| Type | Name | Target |
|---------|--------------|----------------------------------------|
| `CNAME` | `subdomain1` | `yourtunnelid1.cfargotunnel.com` |
| `CNAME` | `subdomain2` | `yourtunnelid2.cfargotunnel.com` |
### Done !
::
If you have many subdomains, point them to the above reference subdomains.
This way, if a tunnel ID changes, you only update one DNS record.