Convert Nextcloud and Pingvin to steps

content/en/3.serveex/6.cloud/1.immich.md

@@ -5,11 +5,6 @@ description: Install Immich, a self-hosted alternative to Google Photos and iClo
 
 
 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
-# Immich
-
-::note
-🎯 __Goals:__ Install [Immich](https://immich.app/docs/overview/introduction) to manage your photos across all your devices.
-::
 
 [Immich](https://immich.app/docs/overview/introduction) is a self-hosted photo and video management solution that replaces cloud services like Google Photos or iCloud. It offers powerful features like face recognition and geolocation.
 

content/en/3.serveex/6.cloud/2.nextcloud.md

@@ -5,11 +5,6 @@ description: Install Nextcloud to self-host your files, photos, and calendar, a
 
 
 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
-# Nextcloud
-
-::note
-🎯 __Goals:__ Install [Nextcloud](https://nextcloud.com/) to manage your photos and files across all your devices.
-::
 
 [Nextcloud](https://nextcloud.com/) is a self-hosted solution that allows you to access and synchronize your data across all your devices. It also includes collaboration features, calendar, and more. It’s a great alternative to services like Google Drive, iCloud, or OneDrive.
 
@@ -34,6 +29,9 @@ tree:
 ---
 ::
 
+::steps{level="3"}
+### Deploy the stack
+
 Open Dockge, click on `compose`, name the stack `nextcloud` and paste the following:
 
 ```yaml [compose.yaml]
@@ -59,6 +57,8 @@ services:
 If you’re using a NAS or network-shared drive via [Samba](/general/networking/samba), replace `/docker/nextcloud/data` with the path to your shared folder.
 ::
 
+### Set your environment variables
+
 Find your `PUID` and `GUID` by running the following command:
 
 ```bash [Terminal]
@@ -75,6 +75,9 @@ PORT=4545
 
 Deploy the stack and visit `http://yourserverip:4545` to complete the setup.
 
+### Done !
+::
+
 ::caution
 
 __If it fails:__ check your firewall rules.
@@ -88,6 +91,9 @@ The goal of this setup is to access Nextcloud remotely from all your devices. We
 We assume you have a subdomain `nextcloud.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). And unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router must be forwarded to port `443` on your server using [NAT rules](/general/networking/nat).
 ::
 
+::steps{level="3"}
+### Add Nextcloud's network to SWAG
+
 In Dockge, go to your SWAG stack and edit the compose to add Nextcloud's network:
 
 ```yaml [compose.yaml]
@@ -114,6 +120,8 @@ We assume the Nextcloud network is named `nextcloud_default`. You can confirm co
 
 Redeploy the stack and wait for SWAG to become fully operational.
 
+### Configure trusted proxies
+
 In Nextcloud’s files, edit the `config.php` file:
 
 ::tip{icon=""}
@@ -144,6 +152,8 @@ array (
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
+### Create the subdomain.conf file
+
 In Swag’s folders, create the file `nextcloud.subdomain.conf`:
 
 ```bash [Terminal]
@@ -186,6 +196,9 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
+### Done !
+::
+
 That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
 
 ## Protecting Nextcloud with Pocket ID

content/en/3.serveex/7.files/2.pingvin.md

@@ -5,20 +5,16 @@ description: Install Pingvin Share, a self-hosted file sharing platform to send
 
 
 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
-# Pingvin
-
-::note
-🎯 __Objectives:__
-
-- Install Pingvin
-- Expose Pingvin
-::
 
 [Pingvin](https://github.com/stonith404/pingvin-share) is a tool for quickly sharing files, similar to WeTransfer. Its many sharing options (password, expiration time, custom link, etc.) make it the ideal tool for sharing files quickly. Pingvin can also create _upload requests_, i.e. a shareable link you can send to someone so they can upload their files for you to retrieve.
 
 ![picture](/img/serveex/pingvin.png)
 
 ## Installation
+
+::steps{level="3"}
+### Deploy the stack
+
 Open Dockge, click `compose`, name the stack `pingvin`, then copy-paste this:
 
 ```yaml [compose.yaml]
@@ -70,6 +66,9 @@ From here on, we assume the network name for Swag is `swag_default`.
 
 Deploy the container and go to `http://yourserverip:3600`. That's it! Your Pingvin web UI instance is up and running!
 
+### Done !
+::
+
 ::caution
 
 __If it fails:__ check your firewall rules.
@@ -83,6 +82,9 @@ The whole point of a solution like this is being able to access it remotely, fro
 We assume you have the subdomain `pingvin.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
 ::
 
+::steps{level="3"}
+### Add Pingvin's network to SWAG
+
 In Dockge, go to the SWAG stack and edit the compose file to add the pingvin network:
 
 ```yaml [compose.yaml]
@@ -109,6 +111,8 @@ From here on, we assume the pingvin network name is `pingvin_default`. You can v
 
 Redeploy the stack by clicking "deploy" and wait for SWAG to be fully up.
 
+### Create the subdomain.conf file
+
 In the Swag folders, create the `pingvin.subdomain.conf` file.
 
 ::tip{icon=""}
@@ -175,6 +179,9 @@ server {
 
 Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
 
+### Done !
+::
+
 That's it, you've exposed Pingvin!
 
 ## Protecting Pingvin with Pocket ID
@@ -204,28 +211,45 @@ In Pingvin, go to _Administration > Configuration > Social Login_ and fill in:
 
 That's it! From now on, when you log in to Pingvin, an "Open ID" button will be available below the login form.
 
-::tip{icon=""}
+::::tip{icon=""}
 ✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
 
-1. In your Authentik admin area, create an OAuth2/OpenID provider.
+:::collapsible{name="the Authentik setup steps"}
+::steps{level="4"}
+#### Create an OAuth2/OpenID provider
 
-2. Fill in each section as follows, replacing `mydomain.com` with your own domain. Copy the `Client ID` and `Client Secret` fields somewhere safe.
+In your Authentik admin area, create an OAuth2/OpenID provider.
+
+#### Configure the provider
+
+Fill in each section as follows, replacing `mydomain.com` with your own domain. Copy the `Client ID` and `Client Secret` fields somewhere safe.
 
 ![picture](/img/serveex/pingvin-auth1.png)
 ![picture](/img/serveex/pingvin-auth2.png)
 ![picture](/img/serveex/pingvin-auth3.png)
 
-3. Save and create a `pingvin` application as follows.
+#### Create the application
+
+Save and create a `pingvin` application as follows.
 
 ![picture](/img/serveex/pingvin-auth4.png)
 
-4. Save and go to your list of outposts. Add the pingvin provider to your outpost.
+#### Add the provider to your outpost
 
-5. Leave Authentik, and go to Pingvin's admin interface.
+Save and go to your list of outposts. Add the pingvin provider to your outpost.
+
+#### Configure Pingvin's OAuth settings
+
+Leave Authentik, and go to Pingvin's admin interface. In the _"OAuth"_ section, fill in the following fields:
 
-6. In the _"OAuth"_ section, fill in the following fields:
 - `OpenID discovery URI` with `https://pingvin.mydomain.com/application/o/pingvin/.well-known/openid-configuration` (don't forget to replace `mydomain.com` with your own domain)
 - `OpenID username claim` with `preferred_username`
 - `OpenID client ID` with the ID you copied in step 2.
 - `OpenID client secret` with the token you copied in step 2.
+
+#### Done !
 ::
+
+:::
+
+::::

content/en/3.serveex/9.apps/2.vaultwarden.md

@@ -5,11 +5,6 @@ description: Install Vaultwarden, a self-hosted Bitwarden-compatible password ma
 
 
 :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
-# Vaultwarden
-
-::note
-🎯 __Goals:__ Install [Vaultwarden](https://github.com/dani-garcia/vaultwarden) to manage your passwords across all your devices (a replacement for Google or Apple password managers).
-::
 
 ![Vaultwarden](/img/serveex/vaultwarden.png)
 
@@ -107,8 +102,8 @@ __If it fails:__ check your firewall rules.
 ## Exposing Vaultwarden with SWAG
 The main benefit of Vaultwarden is being able to access it remotely from any device. We'll expose it through [SWAG](/serveex/core/swag).
 
-::note
+::note{icon=""}
-✨ __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
+📋 __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, go to the SWAG stack and edit the compose file to add the Vaultwarden network:
@@ -293,12 +288,22 @@ Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will pro
 See the [Vaultwarden SSO wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for the full list of options, including per-organization enforcement and master password policies.
 ::
 
-::tip{icon=""}
+::::tip{icon=""}
 ✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
 
-1. In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim).
+:::collapsible{name="the Authentik setup steps"}
-2. Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping.
+::steps{level="4"}
-3. Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`:
+#### Create a scope mapping for the email claim
+
+In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim).
+
+#### Create the application and provider
+
+Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping.
+
+#### Set Vaultwarden's environment variables
+
+Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`:
 
 ```properties [.env]
 SSO_AUTHORITY=https://authentik.yourdomain.com/application/o/<slug>/
@@ -306,4 +311,10 @@ SSO_CLIENT_ID=
 SSO_CLIENT_SECRET=
 SSO_SCOPES=email profile offline_access
 ```
+
+#### Done !
 ::
+
+:::
+
+::::