Fixed deprecated path in qbittorent.md

Docus doesn't generate canonical links or og:url natively. A plugin
now injects rel=canonical and og:url per route using nuxt-site-config's
withSiteUrl, which reads site.url from nuxt.config.ts.

README.md

@@ -2,7 +2,6 @@
 <img src="https://git.djeex.fr/Djeex/DjeexLab/raw/branch/main/docs/files/img/global/lab.svg" align="center" width="700">
 
 [![docu.djeex.fr](https://img.shields.io/badge/Docu·djeex-00b0f0?style=for-the-badge&logoColor=white&logo=materialformkdocs)](https://docu.djeex.fr/) 
-[![](https://dcbadge.limes.pink/api/server/jvhardware)](https://discord.gg/jvhardware) 
 [![Uptime-Kuma](https://stats.djeex.fr/api/badge/23/status?style=for-the-badge)](https://docu.djeex.fr/) 
 </p>
 
@@ -17,19 +16,19 @@ This repository contains everything you need to edit pages, apply your changes,
 
 Install dependencies:
 
-```bash
+```sh
 npm install
 ```
 
 ## Development Environment (port 3000)
 
-```bash
+```sh
 npm run dev
 ```
 
 ## Generate Static Pages
 
-```bash
+```sh
 npm run generate
 ```
 
@@ -39,6 +38,6 @@ The HTML files will be generated in the `.output/public` folder and are ready to
 
 If you'd like to immediately see the result of your static site build, you can launch a preview server:
 
-```bash
+```sh
 npm run preview
 ```

app.config.ts

@@ -24,8 +24,8 @@ export default defineAppConfig({
   
   docus: {
     title: 'Docudjeex',
-    description: 'La doc de mes expériences',
+    description: 'Homelab documentation',
-    url: 'http://docus.dev',
+    url: 'https://docu.djeex.fr',
     image: '/img/social.png',
     socials: {
       github:'',
@@ -39,11 +39,11 @@ export default defineAppConfig({
         icon: 'cib:gitea',
         href: 'https://git.djeex.fr/Djeex/docudjeex',
       },
-      Discord: {
+      Github: {
-        label: 'Discord',
+        label: 'Github',
-        icon: 'cbi:discord',
+        icon:'cib:github', 
-        href: 'https://discord.gg/jvhardware',
+        href: 'https://github.com/Djeex',
-      },
+      }
     },
     github: {
       baseUrl:'https://git.djeex.fr',

assets/css/extra.css

@@ -49,6 +49,18 @@
     max-width: var(--elements-container-maxWidth);
 }
 
+.has-parent-icon .icon {
+    color: #ADA9A4;
+}
+
+.has-parent-icon.active .icon {
+    color: var(--color-primary-500) !important;
+}
+
+.card:hover{
+    color:#00304a;
+}
+
 p img {
     border-radius:7px;
 }
@@ -56,4 +68,20 @@ p img {
     .card-grid {
         padding-bottom: 80px !important;
     }
+}
+
+.prose-code.highlight-sh code .line {
+    padding-inline-start: 0 !important;
+}
+
+.prose-code.highlight-sh code .line:before {
+    display:none !important;
+}
+
+.prose-code.highlight-bash code .line {
+    padding-inline-start: 0 !important;
+}
+
+.prose-code.highlight-bash code .line:before {
+    display:none !important;
 }

content/0.index.md

@@ -1,5 +1,6 @@
 ---
 title: Home
+description: Homelab documentation by Djeex — self-hosting guides for Debian, Docker, networking, storage, and more.
 navigation: false
 layout: page
 main:
@@ -22,29 +23,14 @@ secondary:
 Welcome to docu[·]{style="color: #1ad6ff"}djeex
 
 #description
-Docs, more docs. Tips and experiments. You'll find, among other things:
+Docs, more docs. Tips and experiments. Build your homelab and your own NAS.
 
 #extra
-  ::list
+![](/img/global/docudjeex-home.svg)  
-  - **Debian installation** for your server
-  - **Docker** to deploy your services
-  - **VPN** to access your private network
-  - **Reverse proxy** and **Zero Trust** to expose your services
-  - **SSO** and **Multi-factor** authentication to secure your public services
-  - **Cloud** and **media tools** to access and sync your files and media
-  - _(coming soon)_ **Build your own NAS** from scratch to store your data
-  - _(coming soon)_ **Backup 3-2-1**
-  ::
-
 #support
-  ::terminal
+::card{icon=cib:gitea style="color:#1ad6ff;"}
-  ---
+#title
-  content:
+__git.djeex.fr__
-  - ssh user@serveex -p 22
+#description
-  - cd /docker
+[Check my nonsense projects](https://git.djeex.fr)
-  - sudo docker compose up -d
+::
-  - sudo rm -rf * /
-  - Sud.. shit shiiit shiiiiit !!!
-  ---
-  ::
-::

content/1.about/1.welcome.md

@@ -1,5 +1,7 @@
 ---
-title: About
+icon: lucide:home
+title: Welcome
+description: Introduction to Docudjeex — a personal homelab documentation site covering self-hosted services, Debian, and Docker infrastructure.
 main:
   fluid: false
 ---
@@ -8,9 +10,8 @@ main:
 # docu[·]{style="color: #1ad6ff"}what?
 
 __Docu[·]{style="color: #1ad6ff"}djeex__ is a site containing the documentation of my personal servers, originally created to easily keep track of my configurations and commands.  
-My infrastructure is built around the Debian 12 + Docker combo, making exporting and deployment simpler.  
+My infrastructure is built around the Debian 13 + Docker combo, making exporting and deployment simpler.  
 Special thanks to __Nipah__, __Xenio__, and others for their patience and support. Most of this content comes directly from them.  
-Join us on [Discord](https://discord.gg/jvhardware)!
 
 ## About the documentation
 

content/2.general/1.networking/1.nat.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: NAT & DHCP
+description: Learn how NAT, port forwarding, and DHCP work on a home router. Configure fixed IP leases and understand how to expose local services.
 main:
   fluid: false
 ---
@@ -26,7 +27,7 @@ When it receives data through a port, your router forwards that data to the mach
 
 Your router has over 65,000 ports available.
 
-Some programs and applications are designed to use specific ports. For example, when your network sends data from an HTML page, the router receives it through port 80 (non-secure) or port 443 (secure via SSL).  
+Some programs and applications are designed to use specific ports. For example, when your network sends data from an HTML page, the router receives it through port 80 (non-secure) or port `443` (secure via SSL).  
 
 So, your router acts as a data dispatcher between the internet and your local machines.
 

content/2.general/1.networking/2.dns.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: DNS Zone
+description: Understand how DNS works, how to read and edit a DNS zone, and how to configure domain names for your self-hosted services.
 main:
   fluid: false
 ---
@@ -55,7 +56,7 @@ So, if you want to point `mydomain.com` to your server, you can do it by adding
 - __Warning:__ If your server is hosted at home:
 :::
 - Your public IP is the one assigned to your home router. Make sure it's static, or configure [DDNS](https://aws.amazon.com/fr/what-is/dynamic-dns/).
-- Make sure you've [set up port 443 forwarding to your server's listening port](/general/nat).
+- Make sure you've [set up port 443 forwarding to your server's listening port](/general/networking/nat).
 ::
 
 If you're adding a subdomain that should also point to your server, use a `CNAME` record pointing to `mydomain.com`.

content/2.general/1.networking/3.samba.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Samba
+description: Set up Samba on Debian to share folders over your local network and access them from Windows, macOS, or Linux.
 main:
   fluid: false
 ---
@@ -29,14 +30,14 @@ There are many tutorials for setting up Samba on Windows or on NAS systems like
 
 ### Install Samba Server
 
-```shell
+```sh
 sudo apt update && sudo apt upgrade
 sudo apt install samba smbclient cifs-utils
 ```
 
 ### Create the `/video` Folder
 
-```shell
+```sh
 sudo mkdir /video
 ```
 
@@ -44,10 +45,11 @@ sudo mkdir /video
 
 Now, edit the file `/etc/samba/smb.conf`.
 
-✨ **Tip:** You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
+::alert{type="success"}
-\::
+✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
+::
 
-```shell
+```sh
 sudo vim /etc/samba/smb.conf
 ```
 
@@ -75,47 +77,47 @@ Since we're using a secured share, we need to create a user and group to access
 
 Create the group:
 
-```shell
+```sh
 sudo groupadd smbshare
 ```
 
 Give the group control over the `/video` folder:
 
-```shell
+```sh
 sudo chgrp -R smbshare /video
 ```
 
 Set inherited permissions:
 
-```shell
+```sh
 sudo chmod 2775 /video
 ```
 
 Now add a no-login user — this user cannot log into the server but can access Samba.
 
-```shell
+```sh
 sudo useradd -M -s /sbin/nologin sambauser
 ```
 
 Add the user to the `smbshare` group:
 
-```shell
+```sh
 sudo usermod -aG smbshare sambauser
 ```
 
 Set a Samba password:
 
-```shell
+```sh
 sudo smbpasswd -a sambauser
 ```
 
 Enable the Samba account:
 
-```shell
+```sh
 sudo smbpasswd -e sambauser
 ```
 
-```shell
+```sh
 sudo ufw allow from remote-ip to any app Samba
 ::
 ```
@@ -128,7 +130,7 @@ sudo ufw allow from remote-ip to any app Samba
 
 ### Install Required Packages
 
-```shell
+```sh
 sudo apt update && sudo apt upgrade
 sudo apt install cifs-utils
 ```
@@ -137,7 +139,7 @@ sudo apt install cifs-utils
 
 We will create a folder on our local machine where the remote `/video` folder will be mounted — e.g., `/mnt/video`.
 
-```shell
+```sh
 sudo mkdir /mnt/video
 ```
 
@@ -147,7 +149,7 @@ To avoid typing our username and password every time, create a `.credentials` fi
 
 Create it in the `/smb` folder:
 
-```shell
+```sh
 sudo mkdir /smb
 sudo vi /smb/.credentials
 ```
@@ -166,7 +168,7 @@ Press `Esc`, then `:x` and `Enter` to save and exit.
 
 Set proper file permissions:
 
-```shell
+```sh
 sudo chmod 600 /smb/.credentials
 ```
 
@@ -174,7 +176,7 @@ sudo chmod 600 /smb/.credentials
 
 Now mount the folder:
 
-```shell
+```sh
 sudo mount -t cifs -o credentials=/smb/.credentials //remote-ip/video /mnt/video
 ```
 
@@ -182,7 +184,7 @@ Replace `remote-ip` with your `remote-machine`'s IP address.
 
 Verify the mount:
 
-```shell
+```sh
 sudo mount -t cifs
 ```
 
@@ -196,25 +198,25 @@ By default, shares aren't auto-mounted after reboot. To automate this, edit the
 
 First, back it up:
 
-```shell
+```sh
 sudo cp /etc/fstab /etc/fstab.bak
 ```
 
 Then add the mount configuration line:
 
-```shell
+```sh
 sudo echo //remote-ip/video    /mnt/video  cifs   _netdev,nofail,credentials=/smb/.credentials,x-systemd.automount,x-systemd.device-timeout=15 0 0 >> /etc/fstab
 ```
 
 Reboot the machine:
 
-```shell
+```sh
 sudo reboot
 ```
 
 After rebooting, verify the mount:
 
-```shell
+```sh
 sudo mount -t cifs
 ```
 
@@ -222,6 +224,6 @@ And done!
 
 ### Unmount the Shared Folder
 
-```shell
+```sh
 sudo umount -t cifs /mnt/video
 ```

content/2.general/1.networking/_dir.yml

@@ -0,0 +1,2 @@
+navigation.title: Networking
+icon: lucide:network

content/2.general/2.storage/1.raid.md

@@ -0,0 +1,112 @@
+---
+navigation: true
+title: RAID
+description: Understand RAID concepts — hardware vs software, RAID levels, and how to set up redundant disk arrays for your homelab.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+# RAID
+
+_Redundant Array of Independent Disks_
+
+In computing, RAID (Redundant Array of Independent Disks) is a system that allows multiple hard drives to be combined to improve performance and/or reliability. It works by restructuring and distributing data blocks across the drives.
+
+Originally, RAID systems were hardware-based, meaning a dedicated controller (a specific chip) managed data distribution and RAID operations. Today, most RAID systems (or their equivalents) are software-based. In fact, many software technologies can create RAID-like systems with features not available in hardware RAID, such as automatic repair (data scrubbing), snapshots, and more.
+
+## Different Types of RAID
+
+There are several types of RAID, each offering its own pros and cons. In general, RAID impacts the following five factors:
+
+- Number of drives
+- Total storage capacity
+- Read speed
+- Write speed
+- Fault tolerance (resistance to hardware failure)
+
+::alert{type="warning"}
+:::list{type="warning"}
+  - RAID is not a backup system but a service continuity system! It only allows hot-swapping of drives without interrupting your server or restoring from backup. You still need an external backup system.
+::
+
+### No RAID
+---
+
+<div style="display: flex; align-items: center;">
+  <img src="/img/global/no-raid.svg" alt="Image" style="max-width: 30%; max-height:230px; margin-right: 20px;">
+  <ul>
+    <li>Just your disks, without RAID. Data is stored disk by disk.</li>
+    <li>If you lose a disk, only its data is lost.</li>
+    <li>Total capacity is the sum of all disks.</li>
+</div>
+
+Use your disks without RAID when you're not afraid of data loss and can tolerate service interruptions between failure and backup restoration.
+
+### RAID 0
+---
+
+<div style="display: flex; align-items: center;">
+  <img src="/img/global/raid0.svg" alt="Image" style="max-width: 30%; max-height:230px; margin-right: 20px;">
+  <ul>
+    <li>OS sees 1 drive.</li>
+    <li>Data is striped across all disks.</li>
+    <li>If you lose one disk, you lose all data.</li>
+    <li>High read and write performance (multiplied by number of disks).</li>
+    <li>Total capacity is the sum of all disks.</li>
+    <li>Minimum of 2 disks required.</li>
+</div>
+
+Use RAID 0 when you prioritize performance and are not concerned about data loss. Ideal for temporary, high-speed storage (video editing, AI workloads, etc). Not suitable for long-term storage, as one failure means total data loss.
+
+### RAID 1
+---
+
+<div style="display: flex; align-items: center;">
+  <img src="/img/global/raid1.svg" alt="Image" style="max-width: 30%; max-height:230px; margin-right: 20px;">
+  <ul>
+    <li>OS sees 1 drive.</li>
+    <li>All disks contain identical data.</li>
+    <li>You can lose all but one disk.</li>
+    <li>Improved read speed (scales with number of disks).</li>
+    <li>Total capacity is equal to one disk (e.g., 2×10TB = 10TB).</li>
+    <li>Minimum of 2 disks required.</li>
+</div>
+
+Use RAID 1 for strong redundancy. Each disk contains all data, so performance remains unaffected during a failure. Once failed disks are replaced, data is quickly restored. However, usable storage is limited to one disk’s capacity, making it an expensive solution.
+
+::alert{type="success"}
+✨ __Tip:__ You can combine RAID 1 with other RAID types to create mirrored arrays.
+::
+
+### RAID 5
+---
+<p align="center">
+  <img src="/img/global/raid5.svg" alt="Image" style="max-width: 40%; margin-right: 20px;">
+</p>
+
+- OS sees 1 drive.
+- Data is striped with parity blocks for redundancy.
+- You can lose 1 disk and recover data.
+- Improved read speed (scales with number of disks).
+- Total capacity is the sum of all disks minus one (e.g., 3×10TB = 20TB).
+- Minimum of 3 disks (4 recommended to reduce capacity loss).
+
+Use RAID 5 when you want reliable storage with 3 to 5 disks and minimal space loss. It tolerates one disk failure but may have degraded performance during recovery, which can take days.
+
+### RAID 6
+---
+<p align="center">
+  <img src="/img/global/raid6.svg" alt="Image" style="max-width: 50%; margin-right: 20px;">
+</p>
+
+- OS sees 1 drive.
+- Data is striped with dual parity blocks.
+- You can lose 2 disks and still recover data.
+- Improved read speed (scales with number of disks).
+- Total capacity is the sum of all disks minus two (e.g., 4×10TB = 20TB).
+- Minimum of 4 disks (6 recommended to minimize space loss).
+
+Use RAID 6 in similar situations as RAID 5, especially with 6 or more disks. More disks mean higher failure risk. RAID 6 offers peace of mind by tolerating two simultaneous failures.
+
+## Software RAID
+(coming soon)

content/2.general/2.storage/2.zfs.md

@@ -0,0 +1,77 @@
+---
+navigation: true
+title: ZFS
+description: Introduction to ZFS — a combined file system and volume manager with snapshots, checksums, and built-in redundancy for reliable homelab storage.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+# ZFS
+
+::alert{type="info"}
+🎯 __Objectives:__
+- Understand what ZFS is and why it's useful
+::
+
+ZFS is widely used in the world of servers, NAS systems (like FreeNAS / TrueNAS), virtualization, and even by tech-savvy individuals who want reliable storage. It is both a _file system_ (like NTFS for Windows, EXT4, FAT32, etc.) and a _volume manager_ (similar to LVM).
+
+To put it simply:  
+- A **volume manager** organizes physical storage (like one or more hard drives).  
+- A **file system** organizes how data blocks are written, read, and deleted within those volumes.
+
+ZFS goes far beyond traditional file systems in terms of performance and features.  
+Here’s what we’re most interested in:
+- Its __snapshot management__ features, allowing you to quickly roll back in case of issues.
+- Its support for disk groupings and [__RAID-like structures__](/general/storage/raid) (Z-Mirror, RAIDZ1, RAIDZ2, RAIDZ3).
+- Its __automatic recovery of corrupted data__ (through scrubbing).
+- Its performance, enhanced by RAM caching (ZFS ARC).
+- Its robust error notifications and monitoring.
+
+## Structure
+---
+![](/img/global/zfs.svg)
+
+ZFS has a unique structure:
+
+- **vdev** (virtual device): a group of physical or virtual disks.
+- **zpool**: a collection of vdevs configured as a single storage pool. A zpool can contain multiple vdevs, but a vdev belongs to only one zpool.
+- **dataset**: a logical data container within a zpool. Each dataset can have its own settings (compression, quotas, permissions, etc.).
+
+There are several dataset types:
+- **file system**: a standard ZFS filesystem, mounted without storage quotas.
+- **zvol**: a "virtual disk" with a defined size, which you can format and partition as if it were a physical disk.
+- **snapshot**: a frozen-in-time version of another dataset. Snapshots can be created manually or through backup tools. They can be mounted to browse data as it was at the snapshot time.
+
+## Why ZFS over others?
+---
+### Data Integrity
+
+ZFS continuously checks that your stored data hasn't become corrupted. Every block of data is associated with a checksum, allowing ZFS to detect even the smallest alteration. If corruption is found and a healthy copy exists elsewhere, ZFS can repair the data automatically.
+
+### Built-in RAID
+
+ZFS includes its own volume management system (vdevs). You can build a zpool using multiple disks—similar to traditional [RAID](/general/storage/raid) setups—but with more flexibility. For example:
+- **Z-mirror** → equivalent to RAID 1
+- **RAIDZ1** → equivalent to RAID 5 (tolerates 1 disk failure)
+- **RAIDZ2** → equivalent to RAID 6 (tolerates 2 disk failures)
+- **RAIDZ3** → tolerates up to 3 disk failures
+
+ZFS handles all this natively—no external RAID software needed.
+
+::alert{type="info"}
+:::list{type="info"}
+- Check out the [article on RAID](/general/storage/raid) to find the right solution for your needs.
+:::
+::
+
+### Snapshots and Clones
+
+ZFS allows you to create snapshots—instantaneous images of a dataset's state. Snapshots take up minimal space and can be scheduled frequently. You can also create clones: writable copies of snapshots.
+
+### Compression and Deduplication
+
+ZFS can compress data on the fly (transparently to the user), saving disk space. It also supports deduplication (removing duplicate data), though this feature requires a lot of memory and is not recommended for all use cases.
+
+---
+
+Now you know why ZFS is *the* file system to deploy on your NAS.

content/2.general/2.storage/_dir.yml

@@ -0,0 +1,2 @@
+navigation.title: Storage
+icon: lucide:hard-drive

content/2.general/3.hardware/1.basics.md

@@ -0,0 +1,170 @@
+---
+navigation: true
+title: The Basics
+description: Overview of server hardware fundamentals — CPUs, RAM, storage, and form factors to understand before building your homelab.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+# Server Basics
+
+::alert{type="info"}
+🎯 __Objectives:__
+- Understand the fundamentals of server hardware
+::
+
+![hardware](/img/global/hardware.svg)
+
+
+A __server__ is essentially a computer dedicated to specific tasks, designed to remain accessible at all times. Structurally, it's not much different from a regular computer. Depending on its intended use, some components may vary. This article serves as a reference to help you understand the essential components of a server and how their roles adapt based on your needs.
+
+## Motherboard
+---
+The __motherboard__ is the foundation of your machine. It's the component that connects all others together. It enables communication between components and interaction with peripherals (keyboard, mouse, etc.). Choose it based on your I/O (Input/Output) needs like USB ports, network ports, speed, etc., and ensure compatibility with the components you plan to install.
+
+Key components connected to the motherboard:
+- CPU
+- RAM
+- Storage (HDD and/or SSD)
+- Optional dedicated GPU
+
+Common consumer motherboard formats:
+- E-ATX: largest
+- ATX: standard
+- Micro-ATX: smaller
+- Mini-ITX: smallest
+
+Larger boards generally offer more ports and features. Pre-built systems might use proprietary formats.
+
+## CPU
+---
+<div style="display: flex; align-items: center;">
+  <img src="/img/global/cpu.svg" alt="Image" style="max-width: 25%; max-height:230px; margin-right: 20px;">
+  <p>The <strong>CPU</strong> (Central Processing Unit) is the computer's calculator. It processes most software tasks. Modern CPUs have multiple cores, often with virtual threads, to better handle workloads. They need to be cooled using either an active cooler (with a fan) or a passive one (fanless), depending on power consumption (watts). Choose your CPU based on how you plan to use the server.</p>
+</div>
+
+::alert{type="warning"}
+:::list{type="warning"}
+- __Caution:__ Ensure third-party coolers are compatible with the CPU socket and always apply thermal paste before installing the cooler.
+:::
+::
+
+Consider:
+- Number of cores (more cores = better multitasking)
+- Clock speed in GHz
+- Power consumption in Watts
+
+For low-power home servers or NAS (non-intensive computing), consider Intel N100/150 (4 cores) or N305/N355 (8 cores)—efficient and low power (ideal for 24/7 uptime).
+
+## RAM
+---
+
+<p align="center">
+  <img src="/img/global/ram.svg" alt="Image" style="max-width: 65%;">
+</p>
+
+__RAM__ (Random Access Memory) is fast, temporary memory used by the CPU (and iGPU if applicable) for quick access during execution. It clears periodically and when the machine powers down. Better RAM = better CPU performance.
+
+Comes as sticks installed on the motherboard. Varies by format and generation (currently DDR5).
+
+## GPU
+---
+
+The __GPU__ (Graphics Processing Unit) handles graphical, video, and sometimes AI-related processing. Its main theoretical use is to display the image on your screen. In servers, it's useful for media centers (e.g. [Plex](/serveex/media/plex)) and for accelerating AI tasks like facial recognition or photo indexing (e.g. [Immich](/serveex/cloud/immich)).
+
+Depending on the required performance, one can choose between a dedicated GPU with its own VRAM (a graphics card connected to a PCIe slot on the motherboard), or an iGPU—an integrated GPU built into the CPU (such as the N100/N150 or N305/N355), which uses the system’s shared RAM.
+
+### HDD(s)
+---
+
+<p align="center">
+  <img src="/img/global/hdd.svg" alt="Image" style="max-width: 50%; margin-right: 20px;">
+</p>
+
+An __HDD__ (Hard Disk Drive), or hard drive, is a component used to store data. It was once the standard storage device in computers. HDDs consist of one or more stacked platters and read/write heads—somewhat like a vinyl record player.
+
+Today, HDDs can store enormous amounts of data (up to 30TB, or 30,000 gigabytes, for consumer models), but their read and write speeds are limited due to their mechanical nature. They are also bulky and heavy.
+
+Generally, HDDs are best suited for storing data that doesn’t require frequent access or fast write speeds, such as media files (videos, photos), cloud drives, or archived data. They perform well in these scenarios and, most importantly, are significantly cheaper than SSDs for the same amount of storage.
+
+::alert{type="success"}
+✨ __Tip:__ Use multiple HDDs in [RAID](/general/storage/raid) to enhance performance and redundancy.
+::
+
+Comes in 3.5" and 2.5" formats; servers usually favor the more reliable 3.5".
+
+### SSD(s)
+---
+
+<p align="center">
+  <img src="/img/global/nvme.svg" alt="Image" style="max-width: 50%; margin-right: 20px;">
+</p>
+
+An __SSD__ (Solid State Drive) is a small circuit board with memory chips soldered onto it, used to store information. Unlike RAM, these chips retain data even when not powered, meaning the information is preserved after a reboot. SSDs are generally used as the main storage medium for your server.
+
+Unlike HDDs, SSDs have no moving parts, are highly compact, and most importantly, are extremely fast—offering speeds of several gigabytes per second for high-performance models.
+
+SSDs come in various formats, but today the preferred choice is the M.2 NVMe version, as it is the smallest, fastest, and has become the standard on modern motherboards.
+
+However, SSDs are significantly more expensive than hard drives for the same storage capacity. Typically, the operating system (OS) is installed on the SSD to ensure fast performance. In a server environment, it's also ideal to store [Docker containers](/serveex/core/docker) and databases on the SSD. More broadly, any data that needs to be accessed frequently and quickly—such as websites, applications, or processing workloads—should be stored on an SSD.
+
+### Network Card
+---
+
+A __network card__ allows your machine to communicate with your network (including the internet). It consists of a controller chip and one or more network ports. These ports—often Ethernet ports—can come in different physical formats and support various data transfer standards:
+
+- __RJ45 Gigabit Ethernet (10/100/1000):__ The standard RJ45 connector, supporting speeds from 10 Mbps (0.125 MB/s) up to 1000 Mbps (125 MB/s).
+- __RJ45 2.5G:__ Same connector type, supporting up to 2.5 Gbps (2,500 Mbps or 312.5 MB/s).
+- __RJ45 5G:__ Same connector, supporting up to 5 Gbps (625 MB/s).
+- __RJ45 10G Base-T:__ Same RJ45 format, supporting up to 10 Gbps (1.25 GB/s).
+- __SFP 1G:__ SFP port, commonly used for fiber optic connections, supporting speeds up to 1 Gbps.
+- __SFP+ 10G:__ An enhanced version of the SFP port, also used for fiber optics, supporting up to 10 Gbps.
+
+::alert{type="warning"}
+:::list{type="warning"}
+- __Caution:__ Match network gear (router, switch, cables) to your desired speed. For most uses, CAT5E cables are enough; use CAT6A beyond 10 Gbps. Fiber requires additional care (simplex, duplex, transceivers...).
+:::
+::
+
+The network card is usually built directly into the motherboard, but you can also use dedicated network cards, for example via USB or a PCIe expansion slot.
+
+In general, for a server setup, it's recommended to have at least two Ethernet ports to ensure redundancy in case one connection fails.
+
+### Input/Output Ports
+---
+
+__I/O__ ports allow communication with external devices (displays, keyboard, mouse, network...). Motherboards typically offer:
+- Ethernet ports
+- USB ports (varied types/speeds)
+- Video ports
+- Audio jacks
+
+Choose a motherboard and expansions based on your I/O needs.
+
+### Power Supply
+---
+
+The __power supply unit__ (PSU) is the component that provides electrical power to your machine’s components. It connects to the wall via a power cord and has several output cables that plug into the motherboard and various peripherals, such as hard drives or dedicated graphics cards.
+
+A power supply is defined by several key characteristics:
+
+- Wattage (its total power output),
+- Modularity (whether the cables are fixed or detachable),
+- Efficiency (measured as a percentage). For example, a 500W PSU with 80% efficiency will actually draw 625W from the wall to deliver 500W to the system.
+
+Another important factor is the form factor. There are several standard sizes, from ATX L (for larger cases) to SFX (for compact builds). There are also specialized models for rack-mounted servers, which are typically flat and space-efficient.
+
+To choose the right PSU, a common rule of thumb is to estimate your system’s power needs based on usage, and then double that value. This is because most power supplies operate at optimal efficiency around 50% of their maximum load.
+
+### Case
+---
+
+<div style="display: flex; align-items: center;">
+  <img src="/img/global/case.svg" alt="Image" style="max-width: 25%; max-height:230px; margin-right: 20px;">
+  <p>The <strong>case</strong> is also an essential component of your machine. It plays a key role in cooling, through its fans and airflow design, and it determines the form factor compatibility for your motherboard, power supply, and any dedicated GPU you may install.
+</p>
+</div>
+
+Additionally, the case dictates how many HDDs you can install and what formats they support. Some cases are rack-mountable, meaning they can be installed in server racks (server cabinets).
+
+Choose your case carefully based on your specific needs and the hardware you plan to use.

content/2.general/3.hardware/2.network.md

@@ -0,0 +1,133 @@
+---
+navigation: true
+title: Network
+description: Overview of networking hardware for homelabs — switches, NICs, cables, and how to connect your servers efficiently.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+# Network
+
+::alert{type="info"}
+🎯 __Objectives:__
+- Understand the basics of networking hardware
+::
+
+![hardware](/img/global/hardware-networking.svg)
+
+A computer network cannot exist without the hardware required to build it. Hardware determines the size of the network, communication speeds, and its overall performance. In this article, we will focus on the simplest types of networks, typically found in home environments.
+
+## The Router
+---
+The __router__ is the central hub of your network. It directs __packets__—the blocks of data that travel across your network—from the sender to the appropriate recipient. It manages the routing of data both within your local network and to/from external networks. In short, it enables devices to communicate with each other and with the internet.
+
+Everyone has a router at home—it's the __internet box__ provided by your ISP (Internet Service Provider).
+
+In general, a router consists of:
+- a WAN (Wide Area Network) port that receives data from the internet (or from a higher-level network). For example, it could be a port for a fiber optic connection from your ISP, or an SFP+/RJ45 port for a third-party router.
+- a switch, i.e., a hub with several __LAN__ (Local Area Network) ports allowing multiple devices to connect to your network. These ports can be RJ45 or SFP/SFP+.
+- sometimes a built-in WiFi transmitter/receiver.
+
+A router may also include _firewall_ capabilities, allowing you to restrict traffic from specific devices, as well as _[NAT (Network Address Translation)](/general/networking/nat)_ for port forwarding. It generally includes a _[DHCP (Dynamic Host Configuration Protocol)](/general/networking/nat#dhcp)_ server to automatically assign _IP addresses_ to devices connected to the network.
+
+The router directly affects communication speeds between devices. The WAN port limits the maximum internet speed you can receive from your ISP. For example, if your subscription offers 5 Gb/s, you’ll need a WAN port that supports at least 5 Gb/s. Likewise, internal device-to-device communication is limited by the speed of the switch. If your devices communicate at 5 Gb/s, the router’s switch must have 5 Gb/s ports. If you're using WiFi 7 equipment and want to enjoy its full speed, your router must support it as well. If you’re using a separate WiFi access point, make sure its network port matches or exceeds the speed of the WiFi it broadcasts—and that the router supports it too.
+
+Internet speed, number of devices, WiFi speed, and internal network speed—these are the four key factors to consider when choosing an internet box or buying your own router.
+
+::alert{type="success"}
+✨ __Tip:__
+You can easily use a third-party router to manage your network if your ISP’s internet box supports _bridge mode_. In France, only the provider Free offers this option. It is technically possible with other providers that do not support bridge mode, but it can be quite difficult and may prevent you from using all the features a third-party router provides.
+::
+
+## The Switch
+---
+
+The __switch__, or network switch, is a device that allows multiple devices to connect to the network. It acts as a literal hub, connecting directly to the router or to another switch upstream. It helps avoid overloading the switch ports on your router or relocating devices to another room without running a cable from each one back to the router. Another common use case is to segment multiple networks that are managed by the same router.
+
+There are generally two types of switches:
+- **Unmanaged switches**, the most common. These are plug-and-play: you just plug them in and everything works automatically.
+- **Managed switches**. These offer a configuration interface (via command line or web UI), allowing you to fine-tune routing rules under the control of the router. They are powerful for creating virtual networks between your devices, but usually require more setup time and are less convenient than simple unmanaged switches.
+
+::alert{type="warning"}
+:::list{type="warning"}
+- __Warning:__ Make sure to use a switch with ports that match the speeds supported by your network devices.
+:::
+::
+
+## Cables
+---
+
+Cables are essential components of your network. Depending on their type and category, they can limit the bandwidth between devices, so they must be chosen to match your network's specifications. They also need to be compatible with your devices' ports.
+
+Here’s a quick reference of the most common cable and port standards:
+
+- **RJ45 Gigabit Ethernet 10/100/1000**: The standard RJ45 connector, supporting speeds from 10 Mbps (0.125 MB/s) to 1000 Mbps (125 MB/s)
+- **RJ45 2.5G**: Same connector, supporting speeds up to 2.5 Gbps (312.5 MB/s)
+- **RJ45 5G**: Same connector, supporting speeds up to 5 Gbps (625 MB/s)
+- **RJ45 10GBase-T**: Same connector, supporting speeds up to 10 Gbps (1.25 GB/s)
+- **SFP 1G**: SFP port, typically used for fiber optics, supporting up to 1 Gbps
+- **SFP+ 10G**: Enhanced SFP port, also for fiber, supporting up to 10 Gbps
+
+### Ethernet Cables
+
+These copper cables usually use the standard `RJ45` connector. It's the most common network connector found on routers and switches.
+
+Ethernet cables are divided into categories that define their maximum speed based on distance:
+
+| Speed     | Cable Type | Max Distance |
+|-----------|------------|--------------|
+| 10 Gb/s   | CAT 6A     | 100 m        |
+|           | CAT 6      | 55 m         |
+|           | CAT 5e     | 30 m         |
+| 5 Gb/s    | CAT 6      | 100 m        |
+|           | CAT 5e     | 30 m         |
+| 2.5 Gb/s  | CAT 5e     | 100 m        |
+| 1 Gb/s    | CAT 5e     | 100 m        |
+| 100 Mb/s  | CAT 5      | 100 m        |
+
+Some of these cables are flat, round, shielded (requiring grounding), etc. Choose based on your setup. What matters is that, for example, if you want to connect a device with a 2.5 Gb/s RJ45 port to a 2.5 Gb/s router, you’ll need at least a `CAT 5e` cable.
+
+On the other hand, if your device is limited to 100 Mb/s, a simple `CAT 5` cable will suffice.
+
+Nowadays, in new buildings, it is standard practice to install `CAT 6A` cables inside walls. This way, wall ports are ready to support 10 Gb/s over 100 meters.
+
+---
+
+### Optical Cables
+
+Very thin but fragile, optical cables are increasingly appearing in home networks. It often starts with the fiber cable connecting your ISP’s outlet to your box/router. They have several advantages:
+- Extremely compact
+- Zero electrical consumption (unlike copper, which loses energy as heat)
+- No electromagnetic radiation (no shielding needed, no signal interference)
+- Very high speeds over long distances
+
+For local networking, it's important to understand that several types of fiber cables exist. Their performance depends on both distance and compatibility with the appropriate `transceiver`. Fiber cables connect to your devices' SFP+ ports via a small device called a transceiver, which converts electrical signals to light (and vice versa).
+
+For local networks, the recommended standard is a **multimode OM3 fiber with LC connectors**, paired with a **10G LC SFP+ transceiver**. This setup allows 10 Gb/s connections and is compatible with most devices featuring SFP+ ports.
+
+::alert{type="warning"}
+:::list{type="warning"}
+- __Warning:__ Make sure to use transceivers that are compatible with your devices (routers, switches, or other hardware). There is no universal standard yet, and manufacturers usually specify which brands are supported.
+:::
+::
+
+---
+
+### DAC Cables
+
+These are copper cables with integrated `transceivers`. They allow two SFP/SFP+ ports to communicate over short distances without using fragile fiber or RJ45 adapters. However, they consume more energy due to natural copper loss, which is non-negligible.
+
+---
+
+### SFP+ Transceivers
+
+These let you connect different types of cables to your SFP/SFP+ ports. Variants are available for:
+- Fiber optic
+- DAC
+- RJ45
+
+::alert{type="warning"}
+:::list{type="warning"}
+- RJ45 transceivers consume a lot of energy due to copper signal loss and can generate significant heat. Low-power models (under 2W) exist and are generally rated for longer cables (e.g., 80m instead of 30m). Surprisingly, these are preferred over short-distance models because they generate less heat and consume less energy—making them more compatible with sensitive devices. Using the wrong type can cause network degradation or even outages.
+:::
+::

content/2.general/3.hardware/3.prolonas.md

@@ -0,0 +1,83 @@
+---
+navigation: true  
+title: The ProloNAS
+description: Build a capable home server on a budget using an Intel N100 mini PC — a practical guide to getting started with self-hosting for under $130.
+fluid: false  
+---
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+# The ProloNAS
+
+When you decide to dive into the adventure of running your own home server, the same questions usually come up: _“Where should I start?”_, _“Isn’t it expensive?”_. And often, people either give up or end up buying a proprietary NAS that they’ll throw away a year later once they realize it only brings headaches and wasted money.
+
+A server isn’t a piece of furniture. It’s simply any computer capable of running Linux.That’s why mini PCs powered by **Intel N100** processors are so popular: for around $100–130 on Chinese platforms, you can get a machine that runs **24/7** for years, capable of handling everything you’d expect from a home server or personal cloud without sacrificing performance.
+
+It’s **objectively inexpensive**, and anyone with a bit of curiosity can get started.
+
+A mini PC for $100 + a USB dock for $50 that holds multiple hard drives = a complete platform for $150, versus **$350–1200** for branded NAS systems.
+
+That’s all a **ProloNAS** is. It’s then up to you to scale your storage capacity according to your needs.
+
+
+![](/img/global/prolonas.svg)
+
+
+## Example Hardware
+
+- Mini PC — **Note: choose 16 GB / 512 GB**: [Aliexpress](https://fr.aliexpress.com/item/1005008477986765.html)  
+- DAS (Direct Attached Storage) — **Note: select “EU plug”**: [Aliexpress](https://fr.aliexpress.com/item/1005007933987260.html)  
+- More refined alternative with a fan: [Amazon](https://www.amazon.fr/Boîtier-Disque-Ventilateur-Supportant-Capacité/dp/B0DD3GSSCX)
+
+> *These are not affiliate links — buy wherever you prefer.*
+
+
+## Why a NAS?
+
+A **NAS** (Network Attached Storage) is a machine centered around storage, designed to be shared over a network.The idea is to have a **reliable and secure** storage space that serves as the backbone for your personal services and apps such as a self-hosted cloud like [Nextcloud](/serveex/cloud/nextcloud), a photo sync tool like [Immich](/serveex/cloud/immich), or a media server like [Plex](/serveex/media/plex). You can also store camera footage, backups, or even development projects on it.
+
+### But why not just use a mini PC with an external hard drive?
+
+Sure, a simple mini PC with 1–2 TB of storage will do for most people.And your movie collection might fit on an external drive of a few extra terabytes. But that’s **neither reliable nor scalable** a single shock or hardware failure could permanently destroy your data.
+
+A real NAS is built around **storage reliability**. It uses redundancy strategies like [RAID](/general/storage/raid) to protect against drive failure, and snapshot systems like [ZFS](/general/storage/zfs) to guard against corruption.
+
+In short, a NAS lets you **host everything yourself** that you currently entrust to third parties while maintaining control, reliability, and data safety.
+
+
+## The Problem with Consumer NAS Systems
+
+Many brands offer “ready-to-use” NAS platforms: Synology, QNAP, Ugreen, and others. They promise simplicity and sleek web interfaces, but the reality is quite different.
+
+### First, the price.
+
+$350 is the starting price for a 2-bay NAS (without drives) from Synology. For that, you get a 2019 processor, no SSD slot for the OS, and a measly 2 GB of RAM.
+
+Now, compare that to the **ProloNAS**: an N100 (4 cores), 16 GB RAM, a 512 GB SSD for $100–130, plus a 4-bay DAS for $55. That’s **half the price** of a 2-bay Synology, and **a quarter of the price** of a 4-bay one.
+
+### Locked-Down Operating Systems
+
+“Yeah, but at least with a Synology, you plug it in and everything just works.”
+
+One year.  
+That’s how long it took before I threw away my Synology and realized I should have started with a **ProloNAS** (which later became a full-fledged server).
+
+Manufacturers ship heavily customized Linux-based OSes: ancient kernels, limited app repositories, and complete dependence on their proprietary tools. As a result, you can’t fully tailor your NAS to your needs, and many Docker containers simply won’t run because the kernel is too old.
+
+### Total Vendor Lock-In
+
+“I’m fine with the built-in apps.”  
+Yeah, I thought so too… until my needs exploded: media center, password manager, Git hosting, strong authentication, web hosting, and more.
+
+Why stay stuck with half-baked proprietary tools when you can rely on **open-source projects** that are regularly updated and interoperable?
+
+And what happens when the manufacturer decides to drop support or limit hardware compatibility? It’s already happened, Synology made certain drives **incompatible** unless they were “certified” by them. They even **disabled hardware transcoding** on their NAS units: [see here](https://www.cachem.fr/synology-desactive-transcodage-materiel-nas/).
+
+In short, you have **no control** over a product that isn’t open, nor truly yours.
+
+## OK, but how do I turn my Mini PC Serveex into a ProloNAS?
+
+As mentioned earlier: by adding a **DAS (drive hub)** and setting up a redundant storage system with [RAID](/general/storage/raid) and [ZFS](/general/storage/zfs), you can transform your mini PC into a robust and scalable NAS.
+
+Enjoy !
+

content/2.general/3.hardware/_dir.yml

@@ -0,0 +1,2 @@
+navigation.title: Hardware
+icon: lucide:server

content/2.general/_dir.yml

@@ -1,3 +1,3 @@
 icon: noto:open-book
 navigation.title: General
-navigation.redirect: /general/nat
+navigation.redirect: /general/networking/nat

content/3.serveex/1.introduction.md

@@ -1,14 +1,15 @@
 ---
+icon: lucide:bookmark
 navigation: true
 title: Introduction
+description: Introduction to Serveex — a personal homelab project to self-host everyday services using Debian and Docker, replacing Google, Apple, and Netflix.
 main:
   fluid: false
 ---
 :ellipsis{left=0px width=40rem top=10rem blur=140px}
 ## A Home Lab by a Beginner, for Beginners
 
-<p align="center">
+![](/img/serveex/serveex-server.svg)  
-<img src="/img/serveex/serveex.svg" align="center" width="700">
 
 **Serveex** is primarily a personal project aimed at hosting as many everyday services as possible at home, without relying on proprietary platforms (Google, Apple, Netflix, etc.). The goal was to experiment, learn, and document every step along the way. This is purely a scientific project and is not intended for production use.
 
@@ -18,11 +19,14 @@ A big thanks to **Nipah** for sharing his infinite knowledge and, above all, for
 **Prerequisites:**
 :::list{type="primary"}
 - Have [an online VPS](https://www.it-connect.fr/les-serveurs-prives-virtuels-vps-pour-les-debutants/) or a local machine: ideally a mini PC (you can find N100 models for around €100), but it also works on a laptop or [a virtual machine](https://openclassrooms.com/fr/courses/2035806-virtualisez-votre-architecture-et-vos-environnements-de-travail/6313946-installez-virtualbox). The [Freebox Delta/Ultra offer virtual machines](https://next.ink/3493/machines-virtuelles-et-freebox-delta-comment-heberger-votre-premiere-page-web/).
-- Know how to configure [NAT rules on a router and assign DHCP leases](/general/nat)
+- Know how to configure [NAT rules on a router and assign DHCP leases](/general/networking/nat)
-- Know how to configure the [DNS zone of a domain name](/general/dns)
+- Know how to configure the [DNS zone of a domain name](/general/networking/dns)
 :::
 ::
 
+<p align="center">
+<img src="/img/serveex/serveex.svg" align="center" width="700">
+
 The goal is to be easily deployable and easy to migrate, so here is its structure:
 
 ::card-grid{grid-template-columns="repeat(2, minmax(0, 1fr));"}
@@ -38,7 +42,7 @@ The Core of the Server
   #title
   __Operating System__
   #description
-  [Install and configure Debian 12](/serveex/core/installation)
+  [Install and configure Debian 13](/serveex/core/installation)
   ::
  
   ::card{icon=logos:docker-icon}

content/3.serveex/2.core/1.installation.md

@@ -1,34 +1,35 @@
 ---
 navigation: true
-title: Debian 12
+title: Debian 13
+description: Step-by-step guide to install Debian 13 on a home server and set up SSH access, essential packages, and a ready-to-use base system.
 main:
   fluid: false
 ---
 :ellipsis{left=0px width=40rem top=10rem blur=140px}
-# Debian 12
+# Debian 13
 ::alert{type="info"}
-🎯 __Goal:__ Install Debian 12 and the main dependencies to have a ready-to-use OS, accessible via SSH.
+🎯 __Goal:__ Install Debian 13 and the main dependencies to have a ready-to-use OS, accessible via SSH.
 ::
 
 ![picture](/img/serveex/server.svg)
 
 ## Installation
 ---
-1. [BIOS Setup](https://www.debian.org/releases/stable/i386/ch03s06.fr.html#bios-setup)
+1. [BIOS Setup]((https://www.debian.org/releases/stable/i386/ch03s06.en.html#bios-setup)
-2. [Download Debian Image](https://www.debian.org/download.fr.html)
+2. [Download Debian Image](https://www.debian.org/download.en.html)
 3. [Create Bootable USB (Rufus)](https://dev.to/devops2808/how-to-create-bootable-usb-installer-for-debian-12-4f66)
 4. [Install Debian and Set Up SSH](https://www.howtoforge.com/tutorial/debian-minimal-server/)
 5. Install sudo and add a user to the sudo group for administrative privileges.
     Log in as root:
-    ```shell
+    ```sh
     su -
     ```
     Enter your password, then type:
-    ```shell
+    ```sh
     apt install sudo
     ```
     Add the user to the sudo group:
-    ```shell
+    ```sh
     adduser <username> sudo
     ```
 
@@ -42,10 +43,10 @@ main:
 ## Must-Have CLI Apps
 ---
 Some essential apps you’ll likely need at some point, so might as well install them early:
-```shell
+```sh
 sudo apt update
 sudo apt upgrade
-sudo apt install vim btop ranger git duf neofetch samba cifs-utils tree unzip ufw
+sudo apt install vim btop ranger git duf neofetch samba cifs-utils tree unzip
 ```
 
 Additionally:
@@ -60,12 +61,12 @@ Additionally:
 - [Firewalld](https://linuxcapable.com/how-to-install-firewalld-on-debian-linux/)
 
 ### Samba Sharing (Access a Remote Network Disk)
-- [Create and Access a Samba Share](/general/samba)
+- [Create and Access a Samba Share](/general/networking/samba)
 
 
 ### File Transfer via rsync
 
-```shell
+```sh
 sudo rsync -avhHSP /source /destination
 ```
 ::alert{type="info" icon="exclamation-circle"}

content/3.serveex/2.core/2.docker.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Docker
+description: Install Docker and Dockge on Debian to deploy and manage self-hosted services with simple container stacks.
 main:
   fluid: false
 ---
@@ -22,7 +23,7 @@ Docker, to install deployable services in seconds and manage them with just a fe
 ---
 Add the Docker repositories and GPG key:
 
-```shell
+```sh
 # Add Docker's official GPG key:
 sudo apt-get update
 sudo apt-get install ca-certificates curl
@@ -37,19 +38,19 @@ sudo apt-get update
 
 Install the packages:
 
-```shell
+```sh
 sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 ```
 
 That's it!
 
-**More options:** [Install Docker for Debian 12](https://docs.docker.com/engine/install/debian/)
+**More options:** [Install Docker for Debian 13](https://docs.docker.com/engine/install/debian/)
 
 ::alert{type="info" icon="exclamation-circle"}
 :::list{type="info"}
 - From here on, we assume the stacks are installed in the `/docker` folder, created using the command:
 :::
-    ```shell
+    ```sh
     sudo mkdir /docker
 ::
 
@@ -63,7 +64,7 @@ That's it!
 
 File structure we will create:
 
-```console
+```sh
 root
 └── docker
     └── dockge    
@@ -72,14 +73,14 @@ root
 
 Create the stack folder:
 
-```shell
+```sh
 cd /docker
 sudo mkdir dockge
 ```
 
 Then create the `compose.yml` file in this folder using `vim`:
 
-```shell
+```sh
 cd /docker/dockge
 sudo vi compose.yml
 ```
@@ -107,7 +108,7 @@ Press `Esc` and type `:x` to save and exit.
 
 To launch the container:
 
-```shell
+```sh
 cd /docker/dockge
 sudo docker compose up -d
 ```
@@ -118,7 +119,7 @@ More info on [Dockge and how to use it](https://github.com/louislam/dockge)
 
 And there you go — Docker and a tool to easily manage your containers are ready!
 
-## [Watchtower](https://github.com/containrrr/watchtower?tab=readme-ov-file), to auto-update containers
+## [Watchtower](https://watchtower.nickfedor.com/), to auto-update containers
 ---
 Watchtower is a container that checks for updates and pulls new images automatically, just by adding a label in your containers’ `compose.yml` files.
 
@@ -134,7 +135,7 @@ Watchtower is a container that checks for updates and pulls new images automatic
 services:
   watchtower:
     container_name: watchtower
-    image: containrrr/watchtower:latest
+    image: ghcr.io/nicholas-fedor/watchtower:latest
     restart: unless-stopped
     env_file:
       - .env

content/3.serveex/2.core/3.swag.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: SWAG
+description: Set up SWAG as a reverse proxy with automatic SSL, expose your services securely, and configure geo-blocking on your homelab.
 main:
   fluid: false
 ---
@@ -41,7 +42,7 @@ Below is an example exposing Dockge. We will install SWAG along with the dbip mo
 
 File structure to be modified:
 
-```console
+```sh
 root
 └── docker
     └── swag
@@ -133,7 +134,7 @@ In CLI, go to the dns-conf folder and edit the `ovh.ini` file:
 You can use [File Browser](/serveex/files/file-browser) to browse and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/dns-conf/ovh.ini
 ```
 
@@ -163,7 +164,7 @@ Save and exit the file.
 
 Now configure swag to access DBIP, the geolocation-based access control module. Open the `nginx.conf` file:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/nginx.conf
 ```
 
@@ -193,7 +194,7 @@ This configuration can be enabled or disabled per service (see the Dockge exampl
 
 Open `dbip.conf`:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/dbip.conf
 ```
 
@@ -265,7 +266,7 @@ server {
 ---
 ::alert{type="info"}
 📋 __Prerequisite:__ <br/><br/>
-We assume that you have created a subdomain like `dockge.mydomain.com` in your [DNS zone](/general/dns), with a `CNAME` pointing to `mydomain.com` and — unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare) — that you've forwarded port `443` from your router to the server's `443` in [your NAT rules](/general/nat).
+We assume that you have created a subdomain like `dockge.mydomain.com` in your [DNS zone](/general/networking/dns), with a `CNAME` pointing to `mydomain.com` and — unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare) — that you've forwarded port `443` from your router to the server's `443` in [your NAT rules](/general/networking/nat).
 ::
 
 Now it's time to expose Dockge on the internet so you can access and manage your containers remotely. We assume you've set up the subdomain `dockge.mydomain.com` with a `CNAME` pointing to `mydomain.com`.
@@ -278,7 +279,7 @@ Now it's time to expose Dockge on the internet so you can access and manage your
 
 Open the `dockge.subdomain.conf` file:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/dockge.subdomain.conf
 ```
 
@@ -363,7 +364,7 @@ Wait a moment, then visit `https://dockge.mydomain.com` in your browser — you
 ---
 SWAG includes templates for most known services, named `servicename.subdomain.conf.sample`. Just create the subdomain in your registrar's DNS zone (like OVH), point it to your main domain via a CNAME, then copy and rename the sample file:
 
-```shell
+```sh
 cd /docker/swag/config/proxy-confs
 sudo cp servicename.subdomain.conf.sample servicename.subdomain.conf
 ```

content/3.serveex/2.core/_dir.yml

@@ -1 +1,2 @@
 navigation.title: Server core
+icon: lucide:server-cog

content/3.serveex/3.security/1.wireguard.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Wireguard
+description: Install and configure WireGuard VPN to securely access your homelab from anywhere and connect all your devices to your private network.
 main:
   fluid: false
 ---
@@ -47,23 +48,23 @@ You *can* allow VPN clients to share access to their local networks, but we won
 
 So only VPN-connected devices can communicate with each other on the VPN, not with other local devices outside the VPN.
 
-## Server Side
+## Server Setup
 ---
 ::alert{type="info"}
-📋 __Checklist:__
+📋 **Pre-flight Checklist:**
-- Ensure port `51820 UDP` is available and properly forwarded through your router to the server (`Source 51820 UDP -> Destination 51820 UDP -> Server`).
+- Ensure port `51820 UDP` is free on your server and correctly forwarded from your router (`51820 UDP -> Server`).  
-- Ensure port `51821 TCP` is available for the web UI.
+- Ensure port `51821 TCP` is free for the web UI.
 ::
 
 ::alert{type="warning"}
 :::list{type="warning"}
-- __Warning:__ This guide uses version `14` of [wg-easy](https://wg-easy.github.io/wg-easy/latest/). Version `15` introduces breaking changes incompatible with this configuration.
+- __Warning__: If your IP is not static, use a Dynamic DNS service ([DynDNS](https://en.wikipedia.org/wiki/Dynamic_DNS)). If your ISP uses [CGNAT](https://en.wikipedia.org/wiki/Carrier-grade_NAT), you’ll need to use an external VPS and connect your local server as a client.
 :::
 ::
 
-Folder structure:
+### Folder Structure
 
-```console
+```sh
 root
 └── docker
     └── wg-easy
@@ -73,106 +74,100 @@ root
         └── .env
 ```
 
-The container runs in `HOST` mode, meaning it uses the host’s network stack directly.
+Open Dockge, click **Compose**, and name the stack `wg_easy`.
 
-Open Dockge, click `compose`, and name the stack `wg_easy`.
+Copy the following configuration:
-
-Paste the following configuration:
 
 ```yaml
 ---
-volumes:
-  etc_wireguard:
 services:
   wg-easy:
-    network_mode: host
-    env_file:
-      - .env
     environment:
-      - LANG=en
+      - INSECURE=true
-      - WG_HOST=${HOST}
+    image: ghcr.io/wg-easy/wg-easy:15
-      - PASSWORD_HASH=${PW}
-      - WG_DEFAULT_ADDRESS=${ADDRESS}
-      - WG_HIDE_KEYS=never
-      - WG_ALLOWED_IPS=${IPS}
-      - WG_DEFAULT_DNS=
-      - UI_TRAFFIC_STATS=true
-      - UI_CHART_TYPE=1
-    image: ghcr.io/wg-easy/wg-easy:14
     container_name: wg-easy
+    networks:
+      wg:
+        ipv4_address: 10.42.42.42
+        ipv6_address: fdcc:ad94:bacf:61a3::2a
     volumes:
-      - /docker/wg_easy/config/etc_wireguard:/etc/wireguard
+      - ./etc_wireguard:/etc/wireguard
+      - /lib/modules:/lib/modules:ro
+    ports:
+      - "51820:51820/udp"
+      - "51821:51821/tcp"
     restart: unless-stopped
     cap_add:
       - NET_ADMIN
       - SYS_MODULE
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv6.conf.all.disable_ipv6=0
+      - net.ipv6.conf.all.forwarding=1
+      - net.ipv6.conf.default.forwarding=1
+
+networks:
+  wg:
+    driver: bridge
+    enable_ipv6: true
+    ipam:
+      driver: default
+      config:
+        - subnet: 10.42.42.0/24
+        - subnet: fdcc:ad94:bacf:61a3::/64
 ```
 
 ::alert{type="success"}
-✨ __Tip:__ Add the Watchtower label to enable automatic updates
+✨ **Tip:**
+- You can customize WireGuard and web UI ports.
+- Add a Watchtower label for automatic updates:
 
 ```yaml
-services
+services:
   wg-easy:
-    #...
+    # ...
     labels:
       - com.centurylinklabs.watchtower.enable=true
 ```
 ::
 
-In `.env`:
+Deploy the stack and access the local web UI at `http://server-ip:51821`.
-
-```properties
-HOST=
-PW=
-ADDRESS=
-IPS=
-```
-
-| Variable     | Description | Example |
-|--------------|-------------|---------|
-| `HOST`       | Domain name of the host | `mydomain.com` |
-| `PW`         | Bcrypt password hash, [generate here](https://bcrypt-generator.com/). **NOTE:** Double the `$` characters | `$$2a$$12$$FF6T4QqSP9Ho` |
-| `ADDRESS`    | VPN DHCP address range, the `x` must remain, others can vary | `10.8.0.x` |
-| `IPS`        | IPs routed by clients through the VPN. Use `10.8.0.0/24` to only route VPN traffic. To include local LAN, add `192.168.0.0/16` separated by commas. | `10.8.0.0/24` |
-
-Deploy the stack.
-
-### Enable Forwarding on Host
-
-To allow communication between VPN clients, enable:
-
-```shell
-sudo sysctl net.ipv4.ip_forward=1
-sudo sysctl net.ipv4.conf.all.src_valid_mark=1
-```
-
-### Retrieve Configuration Files
-
-To configure clients, download the config files from the server:
-
-- Visit `http://your-server-ip:51821`
-- Create a client
-- Download the config file
-- Rename it to `wg0.conf`
 
 ::alert{type="danger"}
 :::list{type="danger"}
-- If it fails, check firewall rules.
+- If the deployment fails, check your firewall rules.
 :::
 ::
 
-## On the Client Server
+Once connected, follow the web UI instructions to:
+- Create your admin account and password.
+- Set the host field (use your public IP or domain name).
+
+Then go to *Administrator → Admin Panel → Config*:
+- Change `Allowed IPs` from `0.0.0.0/24` to `10.8.0.0/24` for **split tunneling**.
+- Remove IPv6 (it often causes unnecessary issues).
+
+### Retrieve Configuration Files
+
+To configure clients:
+1. Access the web UI: `http://server-ip:51821`
+2. Create a new client
+3. Edit the client and add `10.8.0.0/24` to `Server Allowed IPs`
+4. (Optional) Set `Persistent Keep Alive` to `25` if it’s a permanently connected client
+5. Save, download, and rename the file to `wg0.conf` (or `wg1.conf`, etc.)
+
+## Client Server Setup
 ---
 ::alert{type="info"}
 :::list{type="info"}
-- Assumes the client is a Linux server with Docker installed
+- We assume the client server runs Linux with Docker installed.
 :::
 ::
 
-Folder structure:
+### Folder Structure
 
-```console
+```sh
 root
 └── docker
     └── wireguard
@@ -181,33 +176,32 @@ root
         └── compose.yaml
 ```
 
-Create the folder `/docker/wireguard/config/wg_confs`:
+Create the folder:
 
-::alert{type="success"}
+```sh
-✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to browse and edit files without terminal
-::
-
-```shell
 sudo mkdir -p /docker/wireguard/config/wg_confs
 ```
 
-Copy the `wg0.conf` file downloaded earlier:
+::alert{type="success"}
+✨ **Tip:** You can use [File Browser](/serveex/files/file-browser) instead of the terminal to edit and upload files.
+::
+
+Create the `wg0.conf` file:
+
+```sh
+sudo vi /docker/wireguard/config/wg_confs/wg0.conf
+```
+
+Enter insert mode (`i`), paste the downloaded configuration, then save (`Esc` → `:x`).
 
 ::alert{type="success"}
-✨ __Tip:__ Easiest way is to transfer the file via SFTP to `/home/youruser`, then move it:
+✨ **Alternative method:** Transfer the file via SFTP and move it:
-
+```sh
-```shell
 sudo cp ~/wg0.conf /docker/wireguard/config/wg_confs
 ```
 ::
 
-Create `compose.yaml` in `/docker/wireguard`:
+Create the `compose.yaml` file in `/docker/wireguard`:
-
-```shell
-sudo vi /docker/wireguard/compose.yaml
-```
-
-Press `i` to enter insert mode and paste:
 
 ```yaml
 services:
@@ -217,43 +211,39 @@ services:
     network_mode: host
     cap_add:
       - NET_ADMIN
-      - SYS_MODULE #optional
+      - SYS_MODULE
     environment:
       - TZ=Europe/Paris
     volumes:
       - /docker/wireguard/config:/config
-      - /lib/modules:/lib/modules #optional
+      - /lib/modules:/lib/modules
     restart: unless-stopped
 ```
 
-Press `Esc` then type `:x` to save and exit.
-
 Start the container:
-
+```sh
-```shell
 cd /docker/wireguard
 sudo docker compose up -d
 ```
 
-::alert{type="info" icon="exclamation-circle"}
+::alert{type="info"}
 :::list{type="info"}
-- Repeat for each client
+- Repeat this setup for each client.
 :::
 ::
 
 ## Other Devices
 ---
-- **Phone:** Install Wireguard and scan the QR code from the web UI (`http://your-server-ip:51821`)
+- **Mobile:** Install WireGuard and scan the QR code via the web UI (`http://server-ip:51821`)
-- **PC:** Install the Wireguard client and import the config file
+- **Desktop:** Install the WireGuard client and import the downloaded config file.
 
 ::alert{type="warning"}
 :::list{type="warning"}
-- __Warning:__ If a client device is on the same LAN as the server, edit `wg0.conf` and change the endpoint to the local server IP:
+- **Note:** If the client machine is on the same local network as the server, edit the `wg0.conf` file to use the local server IP:
-
+`Endpoint = server-local-ip:51820`
-`Endpoint = your-server-ip:51820`
 :::
 ::
 
-And this is the result:
+And here’s the final setup overview:
 
 ![picture](/img/serveex/wireguard.svg)

content/3.serveex/3.security/2.authentik.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Authentik
+description: Install Authentik as a self-hosted identity provider — configure MFA and protect your services with SSO and reverse proxy authentication.
 main:
   fluid: false
 ---
@@ -39,7 +40,7 @@ Both modes can be configured on a per-application basis.
 ## Installation
 ---
 Folder structure:
-```console
+```sh
 root
 └── docker
     └── authentik
@@ -53,13 +54,13 @@ root
 
 Create the folders:
 
-```shell
+```sh
 sudo mkdir -p /docker/authentik/media /docker/authentik/certs /docker/authentik/custom-template /docker/authentik/ssh
 ```
 
-Navigate to the `authentik` folder and generate a password and secret key to include in the `.env` file:
+Navigate to the `authentik` folder via `cd /docker/authentik` and generate a password and secret key to include in the `.env` file:
 
-```shell
+```sh
 sudo echo "PG_PASS=$(openssl rand 36 | base64)" >> .env
 sudo echo "AUTHENTIK_SECRET_KEY=$(openssl rand 60 | base64)" >> .env
 ```
@@ -68,19 +69,19 @@ sudo echo "AUTHENTIK_SECRET_KEY=$(openssl rand 60 | base64)" >> .env
 :::list{type="info"}
 - To generate the keys, we created the folders ahead of deployment using Dockge. Dockge will prevent you from creating a stack with the same name in these folders unless a `compose.yml` file exists. So, create an empty `compose.yml` so it appears as an inactive stack:
 :::
-    ```shell
+    ```sh
     sudo vi /docker/authentik/compose.yml
 ::
 
 Open Dockge and search for "authentik" in the inactive stacks.
-Name the stack `authentik` and paste the following configuration, replacing `{AUTHENTIK_TAG:-2024.2.3}`{lang=properties} with [the latest version of Authentik](https://version-2024-6.goauthentik.io/docs/releases). 
+Name the stack `authentik` and paste the following configuration, replacing `{AUTHENTIK_TAG:-2026.2}`{lang=properties} with [the latest version of Authentik](https://goauthentik.io/docs/releases). 
 
 ```yaml
 ---
 services:
 
   postgresql:
-    image: docker.io/library/postgres:12-alpine
+    image: docker.io/library/postgres:16-alpine
     container_name: authentik-postgresql
     restart: unless-stopped
     healthcheck:
@@ -117,7 +118,7 @@ services:
       - redis:/data
   
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.2.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2}
     container_name: authentik-server
     restart: unless-stopped
     command: server
@@ -130,7 +131,6 @@ services:
     volumes:
       - ./media:/media
       - ./custom-templates:/templates
-      - ./auth.css:/web/dist/custom.css
       - ./ssh:/authentik/.ssh
     env_file:
       - .env
@@ -142,7 +142,7 @@ services:
       - redis
 
   worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.2.3}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2}
     container_name: authentik-worker
     restart: unless-stopped
     command: worker
@@ -164,7 +164,6 @@ services:
       - ./media:/media
       - ./certs:/certs
       - ./custom-templates:/templates
-      - ./auth.css:/web/dist/custom.css
       - ./ssh:/authentik/.ssh
     env_file:
       - .env
@@ -197,7 +196,7 @@ To use Authentik outside your local network, you must expose it.
 
 ::alert{type="info"}
 📋 __Prerequisites:__  <br/><br/>
-We assume you have already created a subdomain like `auth.mydomain.com` in your [DNS zone](/general/dns), with a CNAME pointing to `mydomain.com`. Also, unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), you must have already forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/nat).
+We assume you have already created a subdomain like `auth.mydomain.com` in your [DNS zone](/general/networking/dns), with a CNAME pointing to `mydomain.com`. Also, unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), you must have already forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/networking/nat).
 ::
 
 Open the `authentik-server.conf` file:
@@ -207,7 +206,7 @@ Open the `authentik-server.conf` file:
 You can use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/authentik-server.conf
 ```
 
@@ -222,7 +221,7 @@ If not, press `i` to enter edit mode, make the necessary changes, then save and
 
 Create the `auth.subdomain.conf` file:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/auth.subdomain.conf
 ```
 
@@ -337,7 +336,7 @@ Why do this when Dockge already has authentication? Because Dockge uses weak HTT
 
 Edit the file `dockge.mydomain.com`:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/dockge.subdomain.conf
 ```
 
@@ -419,7 +418,7 @@ On your remote machine, use [Dockge](/serveex/core/docker/#installer-dockge-pour
 
 If you haven’t installed [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs), create a folder `/docker/authentik-outpost`, or directly via command line:
 
-```shell
+```sh
 sudo mkdir -P /docker/authentik-outpost
 ```
 
@@ -432,7 +431,7 @@ Create the `compose.yaml` file or paste the configuration directly into Dockge i
 
 Via command line:
 
-```shell
+```sh
 sudo vi /docker/authentik-outpost/compose.yaml
 ```
 Enter edit mode by pressing `i` and paste the following configuration, updating the version in `{AUTHENTIK_TAG:proxy:2024.2.3}`{lang=properties} to match your Authentik server version.
@@ -459,7 +458,7 @@ services:
 
 Go to the SWAG stack on the remote machine (or edit directly using Dockge) and add the authentik-outpost network in the configuration file like this (see `networks` section):
 
-```shell
+```sh
 sudo vi /docker/swag/compose.yaml
 ```
 
@@ -490,7 +489,7 @@ If using [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déploye
 
 Otherwise, via terminal:
 
-```shell
+```sh
 cd /docker/swag/
 sudo docker compose up -d
 ```
@@ -499,7 +498,7 @@ Create (or fill using Dockge) the `.env` file in the `authentik-outpost` directo
 
 Via command line:
 
-```shell
+```sh
 sudo vi /docker/authentik-outpost/.env
 ```
 
@@ -523,7 +522,7 @@ If using Dockge, deploy the stack.
 
 Otherwise, via terminal:
 
-```shell
+```sh
 cd /docker/authentik-outpost/
 sudo docker compose up -d
 ```
@@ -534,7 +533,7 @@ Now, let’s configure SWAG.
 
 Open the `authentik-server.conf` file:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/authentik-server.conf
 ```
 
@@ -553,24 +552,24 @@ Then configure the applications to protect as you did on your main server, wheth
 ---
 On the source machine, dump the database:
 
-```shell
+```sh
 sudo docker exec authentik-postgres pg_dump -U authentik -F t authentik > /path/to/mydb.tar
 ```
 
 Then transfer it to the target machine. On the target machine, copy the file into the Docker container:
 
-```shell
+```sh
 cp /path/to/mydb.tar authentik-postgres:/path/to/wherever
 ```
 
 (Optional) Purge existing tables:
 
-```shell
+```sh
 sudo docker exec -i authentik-postgres psql -U authentik -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE pg_stat_activity.datname = 'authentik' AND pid <> pg_backend_pid();" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "DROP DATABASE IF EXISTS authentik;" && sudo docker exec -i authentik-postgres psql -U authentik -d postgres -c "CREATE DATABASE authentik;"
 ```
 
 Restore the database:
 
-```shell
+```sh
 sudo docker exec authentik-postgresql pg_restore -U authentik -d authentik /path/to/wherever/mydb.tar
 ```

content/3.serveex/3.security/3.cloudflare.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Cloudflare Zero Trust
+description: Use Cloudflare Tunnels and Zero Trust to expose homelab services without opening ports — configure SWAG and manage multiple tunnels.
 main:
   fluid: false
 ---
@@ -46,7 +47,7 @@ Here we’ll explain how to integrate SWAG with Cloudflare tunnels.
 ---
 ### DNS Zone
 
-First, you need to set Cloudflare as your [DNS zone](/general/dns) manager. If you bought your domain from Cloudflare, that’s already done. Otherwise, check with your registrar how to add external DNS servers. Cloudflare provides [step-by-step documentation](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/) on how to configure a DNS Zone, whether your domain is external or registered with Cloudflare.
+First, you need to set Cloudflare as your [DNS zone](/general/networking/dns) manager. If you bought your domain from Cloudflare, that’s already done. Otherwise, check with your registrar how to add external DNS servers. Cloudflare provides [step-by-step documentation](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/) on how to configure a DNS Zone, whether your domain is external or registered with Cloudflare.
 
 If you only have one server to protect behind Cloudflare, you can delete all existing DNS records. By default, your domain and all its subdomains will be redirected to the tunnel.
 
@@ -97,7 +98,7 @@ Create a file `tunnelconfig.yml` to reference in your SWAG `compose.yaml`.
 ✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using the terminal.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/tunnelconfig.yml
 ```
 
@@ -120,7 +121,7 @@ Now configure _Cloudflare Real IP_.
 
 Open the `nginx.conf` file:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/nginx.conf
 ```
 
@@ -214,10 +215,10 @@ TUNNEL_PW=
 
 Once done, deploy the stack. Check the logs—you should reach `server ready`.
 
-Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero Trust](https://one.dash.cloudflare.com/). By default, all subdomains will be routed through the tunnel—no need to define them [in your DNS zone](/general/dns).
+Then confirm your tunnel appears under _Networks > Tunnels_ in [Cloudflare Zero Trust](https://one.dash.cloudflare.com/). By default, all subdomains will be routed through the tunnel—no need to define them [in your DNS zone](/general/networking/dns).
 
 ::alert{type="success"}
-✨ __Tip:__ If you want to expose a service without a tunnel, just define an A record [in your DNS zone](/general/dns). If resolution fails, disable the proxy function for that record—e.g., for `sub.mondomaine.fr`.
+✨ __Tip:__ If you want to expose a service without a tunnel, just define an A record [in your DNS zone](/general/networking/dns). If resolution fails, disable the proxy function for that record—e.g., for `sub.mondomaine.fr`.
 ![dns](/img/serveex/cf-dns.png)
 ::
 

content/3.serveex/3.security/_dir.yml

@@ -1 +1,2 @@
 navigation.title: Security
+icon: lucide:shield

content/3.serveex/4.monitoring/1.uptime-kuma.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Uptime-Kuma
+description: Install Uptime-Kuma to monitor your self-hosted services uptime, set up alerts, and optionally protect the dashboard with Authentik.
 main:
   fluid: false
 ---
@@ -22,7 +23,7 @@ main:
 ---
 Folder structure
 
-```console
+```sh
 root
 └── docker
     └── uptime-kuma
@@ -36,7 +37,7 @@ Open Dockge, click on `compose`, name the stack `uptime-kuma`, then copy and pas
 ---
 services:
   uptime-kuma:
-    image: louislam/uptime-kuma:1
+    image: louislam/uptime-kuma:2-slim
     container_name: uptime-kuma
     volumes:
       - /docker/uptime-kuma/uptime-kuma-data:/app/data
@@ -68,7 +69,7 @@ You can now access the tool via `http://yourserverip:3200`.
 ::alert{type="info"}
 📋 __Before you begin:__ 
 <br/><br/>
-We assume you have the subdomain `stats.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/dns). And of course, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` of your router should point to port `443` of your server via [NAT rules](/general/nat).
+We assume you have the subdomain `stats.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` of your router should point to port `443` of your server via [NAT rules](/general/networking/nat).
 ::
 
 ::alert{type="warning"}
@@ -84,7 +85,7 @@ In the Swag folders, create the `stats.subdomain.conf` file.
 you can use [File Browser](/serveex/files/file-browser) to browse and edit your files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/stats.subdomain.conf
 ```
 Enter insert mode with `i` and paste the following config:

content/3.serveex/4.monitoring/2.dozzle.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Dozzle
+description: Install Dozzle to monitor Docker container logs in real time from a clean web interface, exposed via SWAG.
 main:
   fluid: false
 ---
@@ -21,7 +22,7 @@ main:
 ---
 Folder structure
 
-```console
+```sh
 root
 └── docker
     └── dozzle
@@ -41,11 +42,9 @@ services:
     env_file:
       - .env
     environment:
-      - DOZZLE_AUTH_PROVIDER=simple
       - DOZZLE_HOSTNAME=${DOMAIN}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - /docker/dozzle/data:/data
 ```
 
 ::alert{type="success"}
@@ -65,7 +64,7 @@ Fill in your domain name in the `.env` file, for example:
 DOMAIN=dozzle.mydomain.com
 ```
 
-Deploy the container and go to `http://yourserverip:9135`. Voilà, your Dozzle web UI is up and running!
+Deploy the container. Go to `http://yourserverip:9135`. Voilà, your Dozzle web UI is up and running!
 
 ## Exposing Dozzle with Swag
 ---
@@ -81,7 +80,7 @@ You may want to access Dozzle remotely and on all your devices. To do so, we’l
 ::alert{type="info"}
 📋 __Before you begin:__
 <br/><br/>
-We assume you have created a subdomain like `dozzle.mydomain.com` in your [DNS zone](/general/dns) with a `CNAME` pointing to `mydomain.com` and that, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you’ve redirected port `443` from your router to port `443` on your server in your [NAT rules](/general/nat).
+We assume you have created a subdomain like `dozzle.mydomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `mydomain.com` and that, [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you’ve redirected port `443` from your router to port `443` on your server in your [NAT rules](/general/networking/nat).
 ::
 
 Go to Dockge and edit the SWAG compose file to add Dozzle’s network:
@@ -116,7 +115,7 @@ In the Swag folder, create the `dozzle.subdomain.conf` file.
 ✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to browse and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/dozzle.subdomain.conf
 ```
 Enter edit mode by pressing `i` and paste the configuration below:

content/3.serveex/4.monitoring/3.speedtest-tracker.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Speedtest Tracker
+description: Install Speedtest Tracker to automatically measure and log your internet connection speed over time, exposed with SWAG.
 main:
   fluid: false
 ---
@@ -27,7 +28,7 @@ main:
 
 File structure:
 
-```console
+```sh
 root
 └── docker
     └── speedtest-tracker
@@ -37,7 +38,7 @@ root
 
 In a terminal, generate a key using the following command:
 
-```shell
+```sh
 echo -n 'base64:'; openssl rand -base64 32;
 ```
 
@@ -53,7 +54,7 @@ services:
         restart: unless-stopped
         container_name: speedtest-tracker
         ports:
-            - ${PORT}$:80
+            - ${PORT}:80
         environment:
             - PUID=${PUID}
             - PGID=${GUID}
@@ -67,7 +68,7 @@ services:
 
 Find your `PUID` and `GUID` by running the following command:
 
-```shell
+```sh
 id yourusername
 ```
 
@@ -75,7 +76,7 @@ In the `.env` file, set the variable `API_KEY` with the key you generated and ad
 
 ```properties
 SCHEDULE=15 */6 * * * # every 6 hours
-KEY=base64:zihejehkj8_nzhY/OjeieR= # your key
+API_KEY=base64:zihejehkj8_nzhY/OjeieR= # your key
 PUID=1000
 GUID=1000
 PORT=3225 # port to access the web UI
@@ -91,7 +92,7 @@ Deploy the container and go to `http://yourserverip:3225`. Log in with the accou
 ---
 ::alert{type="info"}
 📋 **Prerequisites:**  
-We assume that you've already created a subdomain like `speedtest.yourdomain.com` in your [DNS zone](/general/dns) with a `CNAME` pointing to `yourdomain.com`, and [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), you've also forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/nat).
+We assume that you've already created a subdomain like `speedtest.yourdomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `yourdomain.com`, and [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), you've also forwarded port `443` from your router to port `443` of your server in your [NAT rules](/general/networking/nat).
 ::
 
 Now we want to expose Speedtest Tracker to the internet so you can access it remotely. We assume you've set up the DNS `CNAME` for `speedtest.yourdomain.com` pointing to `yourdomain.com`.
@@ -104,7 +105,7 @@ Now we want to expose Speedtest Tracker to the internet so you can access it rem
 
 Open the `speedtest.subdomain.conf` file:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/speedtest.subdomain.conf
 ```
 

content/3.serveex/4.monitoring/4.beszel.md

@@ -1,6 +1,7 @@
 --- 
 navigation: true
 title: Beszel
+description: Install Beszel to monitor server CPU, RAM, disk, and network metrics — including remote servers — with a lightweight web dashboard.
 main:
   fluid: false
 ---
@@ -26,7 +27,7 @@ Beszel includes a hub with a web UI and an agent that collects data from your se
 
 Folder structure
 
-```console
+```sh
 root
 └── docker
     └── beszel
@@ -44,7 +45,7 @@ services:
     container_name: beszel
     restart: unless-stopped
     ports:
-      - ${PORT}$:8090
+      - ${PORT}:8090
     volumes:
       - ./data:/beszel_data
       - ./socket:/beszel_socket
@@ -156,7 +157,7 @@ If you want to access Beszel remotely from all your devices, expose it using Swa
 ::alert{type="info"}
 📋 __Prerequisite:__
 <br/><br/>
-You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME` pointing to `mydomain.com`, and—unless you're using Cloudflare Zero Trust—you must have forwarded port `443` on your router to your server’s `443` port via [NAT rules](/general/nat).
+You must have created a DNS subdomain like `beszel.mydomain.com` with a `CNAME` pointing to `mydomain.com`, and—unless you're using Cloudflare Zero Trust—you must have forwarded port `443` on your router to your server’s `443` port via [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, edit Swag's compose file and add Beszel’s network:
@@ -191,7 +192,7 @@ In Swag’s config folders, create `beszel.subdomain.conf`.
 ✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to browse and edit files instead of terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/beszel.subdomain.conf
 ```
 

content/3.serveex/4.monitoring/5.upsnap.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: UpSnap
+description: Install UpSnap to remotely wake up machines on your local network via Wake-on-LAN, exposed with SWAG.
 main:
   fluid: false
 ---
@@ -22,7 +23,7 @@ main:
 
 Folder structure
 
-```console
+```sh
 root
 └── docker
     └── upsnap
@@ -94,7 +95,7 @@ You may want to access it remotely from all your devices. To do so, we'll expose
 ::alert{type="info"}
 📋 __Beforehand:__
 <br/><br/>
-We assume you've created a subdomain in your [DNS zone](/general/dns), such as `upsnap.yourdomain.com` with a `CNAME` to `yourdomain.com`. Also, unless you're using Cloudflare Zero Trust, you should have already forwarded port `443` from your router to port `443` on your server in your [NAT rules](/general/nat).
+We assume you've created a subdomain in your [DNS zone](/general/networking/dns), such as `upsnap.yourdomain.com` with a `CNAME` to `yourdomain.com`. Also, unless you're using Cloudflare Zero Trust, you should have already forwarded port `443` from your router to port `443` on your server in your [NAT rules](/general/networking/nat).
 ::
 
 Go to Dockge, and edit the SWAG compose by adding the UpSnap network:
@@ -129,7 +130,7 @@ In the Swag folders, create the file `upsnap.subdomain.conf`.
 ✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate your files and edit documents instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/upsnap.subdomain.conf
 ```
 Enter edit mode by pressing `i`, and paste the following configuration:

content/3.serveex/4.monitoring/_dir.yml

@@ -1 +1,2 @@
 navigation.title: Monitoring
+icon: lucide:chart-no-axes-column

content/3.serveex/5.media/1.plex.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Plex
+description: Install Plex Media Server with Tautulli on your homelab to stream movies and TV shows from anywhere on all your devices.
 main:
   fluid: false
 ---
@@ -34,7 +35,7 @@ We'll also install [Tautulli](https://docs.linuxserver.io/images/docker-tautulli
 ## Install Plex
 ---
 Folder structure:
-```console
+```sh
 root
 ├── docker
 │   ├── plex      
@@ -114,7 +115,7 @@ services:
 
 Find your PUID and GUID by running:
 
-```shell
+```sh
 id username
 ```
 
@@ -144,7 +145,7 @@ Then go to the _Remote Access_ section and manually select a port (we’ll use `
 
 ![picture](/img/serveex/plex-port.png)
 
-- On your router, forward TCP port `1234` to port `32400` for your server’s IP using [NAT rules](/general/nat).
+- On your router, forward TCP port `1234` to port `32400` for your server’s IP using [NAT rules](/general/networking/nat).
 - Once done, return to Plex to verify that remote access is functional.
 
 ::alert{type="danger"}
@@ -163,7 +164,7 @@ Simply add your media to `/media/movies` and `/media/tvseries` on your server. Y
 
 ::alert{type="info"}
 :::list{type="info"}
-- If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the [Samba mount guide](/general/samba) so Plex can access it.
+- If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the [Samba mount guide](/general/networking/samba) so Plex can access it.
 :::
 ::
 
@@ -175,7 +176,7 @@ However, you may want to expose Tautulli so you can view stats from a simple URL
 
 ::alert{type="info"}
 :::list{type="info"}
-- We assume you have the subdomain `tautulli.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/dns). And of course, [unless you use Cloudflare Zero Trust](/serveex/security/cloudflare), your box's port `443` must be forwarded to your server's port `443` in [NAT rules](/general/nat).
+- We assume you have the subdomain `tautulli.mydomain.com` with a `CNAME` pointing to `mydomain.com` in your [DNS zone](/general/networking/dns). And of course, [unless you use Cloudflare Zero Trust](/serveex/security/cloudflare), your box's port `443` must be forwarded to your server's port `443` in [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -211,7 +212,7 @@ Copy and rename the file `tautulli.subdomain.conf.sample` to `tautulli.subdomain
 ✨ **Tip:** Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo cp /docker/swag/config/nginx/proxy-confs/tautulli.subdomain.conf.sample /docker/swag/config/nginx/proxy-confs/tautulli.subdomain.conf
 sudo vi /docker/swag/config/nginx/proxy-confs/tautulli.subdomain.conf
 ```

content/3.serveex/5.media/2.qbittorrent.md

@@ -1,6 +1,7 @@
 --- 
 navigation: true
 title: Qbittorrent
+description: Install qBittorrent with Gluetun and ProtonVPN to download torrents securely behind a VPN on your self-hosted server.
 main:
   fluid: false
 ---
@@ -13,7 +14,7 @@ main:
 - Securely connect to the BitTorrent network using Gluetun and Proton VPN
 ::
 
-![Picture](https://github.com/VueTorrent/VueTorrent/blob/master/public/screenshots/screenshot-desktop-dark-mode.jpeg?raw=true)
+![Picture](/img/serveex/qbit-vue.jpeg)
 
 To safely download your favorite media, we'll build a system using:
 
@@ -31,7 +32,7 @@ Here’s the system we’ll set up:
 ---
 Folder structure
 
-```console
+```sh
 root
 ├── docker
 │   └── seedbox
@@ -59,11 +60,11 @@ Open Dockge, click on `compose`, and name the stack `seedbox`. Paste the followi
 
 services:
   qbit:
-    image: ghcr.io/linuxserver/qbittorrent:latest
+    image: ghcr.io/linuxserver/qbittorrent:libtorrentv1
     container_name: qbittorrent
     restart: unless-stopped
     network_mode: service:gluetun
-    mem_limit: 1g
+    mem_limit: 4g
     environment:
       - DOCKER_MODS=ghcr.io/gabe565/linuxserver-mod-vuetorrent|ghcr.io/t-anc/gsp-qbittorent-gluetun-sync-port-mod:main
       - TZ=Europe/Paris
@@ -80,10 +81,10 @@ services:
       - gluetun
 
   gluetun:
-    image: qmcgaw/gluetun:v3.40
+    image: qmcgaw/gluetun:v3.41.3
     container_name: gluetun
     restart: unless-stopped
-    mem_limit: 1g
+    mem_limit: 4g
     volumes:
       - /docker/gluetun/config.toml:/gluetun/auth/config.toml:ro
     devices:
@@ -128,19 +129,19 @@ We now need to allow the mod to fetch info from Gluetun, which only allows encry
 
 Open a terminal to generate the authentication key:
 
-```shell
+```sh
 sudo docker run --rm qmcgaw/gluetun genkey
 ```
 
 Note the key, then create the `/docker/gluetun` folder:
 
-```shell
+```sh
 sudo mkdir /docker/gluetun
 ```
 
 Create the `config.toml` file:
 
-```shell
+```sh
 sudo vi /docker/gluetun/config.toml
 ```
 
@@ -149,7 +150,7 @@ Press `i` to edit and enter:
 ```toml
 [[roles]]
 name = "t-anc/GSP-Qbittorent-Gluetun-sync-port-mod"
-routes = ["GET /v1/openvpn/portforwarded"]
+routes = ["GET /v1/portforward"]
 auth = "apikey"
 apikey = "your_key_here" # key you just generated
 ```
@@ -217,7 +218,7 @@ To start downloads from outside your home, without a VPN, you can expose the Qbi
 
 ::alert{type="info"}
 :::list{type="info"}
-- We assume you have the subdomain `seedbox.mydomain.com` with a `CNAME` pointing to `mydomain.com` in [DNS zone](/general/dns). And that port `443` on your router is forwarded to your server in [NAT rules](/general/nat), unless you’re using Cloudflare Zero Trust.
+- We assume you have the subdomain `seedbox.mydomain.com` with a `CNAME` pointing to `mydomain.com` in [DNS zone](/general/networking/dns). And that port `443` on your router is forwarded to your server in [NAT rules](/general/networking/nat), unless you’re using Cloudflare Zero Trust.
 :::
 ::
 
@@ -253,7 +254,7 @@ Now create/edit `seedbox.subdomain.conf`.
 ✨ __Terminal-free tip:__ use [File Browser](/serveex/files/file-browser) to edit files instead of using the terminal.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/seedbox.subdomain.conf
 ```
 

content/3.serveex/5.media/3.servarr.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Automation
+description: Automate media downloads with the Servarr stack — Radarr, Sonarr, Bazarr, Prowlarr, and Overseerr for movies and TV shows.
 main:
   fluid: false
 ---
@@ -29,7 +30,7 @@ We’ll start by deploying the stack and then proceed to configure each app and
 
 Folder structure:
 
-```console
+```sh
 root
 ├── docker
 │   ├── plex      
@@ -49,11 +50,20 @@ root
 │   └── overseerr
 │       └── config
 └── media
+    ├── downloads
     ├── tvseries
     ├── movies
     └── library
 ```
 
+::alert{type="warning"}
+:::list{type="warning"}
+- __Warning:__ Make sure to follow this file structure carefully, especially the `media` folder. This folder must be mounted **exactly the same way** in both the _Qbittorrent_ compose file (`/your/path/media:/media`) and the _arr_ applications.  
+If not, the _arr_ apps may not recognize the path provided by Qbittorrent and will fail to create _hardlinks_.  
+Without hardlinks, the _arr_ apps will copy the files instead—**doubling the space used** on your storage.
+:::
+::
+
 Open Docker and your `plex` stack. Modify the compose file as follows:
 ```yaml
 ---
@@ -151,8 +161,11 @@ services:
   bazarr:
     image: lscr.io/linuxserver/bazarr:latest
     container_name: bazarr
-    environment: null
+    restart: unless-stopped
-    restart: unless-stopped - PUID=1000 - PGID=1000 - TZ=Europe/Paris
+    environment:
+      - PUID=1000 
+      - PGID=1000
+      - TZ=Europe/Paris
     volumes:
       - /docker/bazarr/config:/config
       - ${MEDIA_PATH}:/media
@@ -291,7 +304,7 @@ In *Settings > Apps*, add Radarr and Sonarr with the following details:
 ---
 Bazarr is an app that automatically searches for the correct subtitles in your preferred languages for all the movies and TV shows added by Radarr and Sonarr.
 
-Go to `http://yourserverip:9696`.
+Go to `http://yourserverip:6767`.
 
 ::alert{type="danger"}
 :::list{type="danger"}
@@ -385,7 +398,7 @@ It can be useful to expose Overseerr if you want to send requests from outside y
 
 ::alert{type="info"}
 :::list{type="info"}
-- We assume you have the subdomain `films.mydomain.com` with a `CNAME` pointing to `films.fr` in your [DNS zone](/general/dns). And that [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/nat).
+- We assume you have the subdomain `films.mydomain.com` with a `CNAME` pointing to `films.fr` in your [DNS zone](/general/networking/dns). And that [unless you’re using Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -421,7 +434,7 @@ Create and edit the file `films.subdomain.conf`:
 ✨ __Tip:__ you can use [File Browser](/serveex/files/file-browser) to browse and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/films.subdomain.conf
 ```
 

content/3.serveex/5.media/_dir.yml

@@ -1 +1,2 @@
 navigation.title: Media & Seedbox
+icon: lucide:list-video

content/3.serveex/6.cloud/1.immich.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Immich
+description: Install Immich, a self-hosted alternative to Google Photos and iCloud with face recognition, geolocation, and multi-device sync.
 main:
   fluid: false
 ---
@@ -19,7 +20,7 @@ main:
 ---
 Folder structure
 
-```console
+```sh
 root
 └── docker
     └── immich
@@ -40,7 +41,7 @@ Configure the `.env` file by copying the latest version [from here](https://gith
 
 ::alert{type="info"}
 :::list{type="info"}
-- If you're using a NAS or a network-shared drive via [Samba](/general/samba/) to store your data, replace the value of `UPLOAD_LOCATION`{lang=properties} with the path to your shared folder.
+- If you're using a NAS or a network-shared drive via [Samba](/general/networking/samba/) to store your data, replace the value of `UPLOAD_LOCATION`{lang=properties} with the path to your shared folder.
 :::
 ::
 
@@ -59,7 +60,7 @@ The main benefit of this setup is being able to access Immich remotely on all yo
 ::alert{type="info"}
 📋 __Before you begin:__ 
 <br/><br/>
-We assume that you have a subdomain `immich.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/dns). Also, unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/nat).
+We assume that you have a subdomain `immich.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). Also, unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure port `443` on your router is forwarded to port `443` on your server via [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, open the SWAG stack and edit the compose file to add Immich's network:
@@ -96,7 +97,7 @@ In the SWAG folders, create a file named `immich.subdomain.conf`.
 :::
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/immich.subdomain.conf
 ```
 Press `i` to enter insert mode, then paste the following configuration:

content/3.serveex/6.cloud/2.nextcloud.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Nextcloud
+description: Install Nextcloud to self-host your files, photos, and calendar — a privacy-friendly alternative to Google Drive, OneDrive, and iCloud.
 main:
   fluid: false
 ---
@@ -25,7 +26,7 @@ main:
 
 File structure:
 
-```console
+```sh
 root
 └── docker
     └── nextcloud
@@ -57,13 +58,13 @@ services:
 
 ::alert{type="info"}
 :::list{type="info"}
-- If you’re using a NAS or network-shared drive via [Samba](/general/samba), replace `/docker/nextcloud/data` with the path to your shared folder.
+- If you’re using a NAS or network-shared drive via [Samba](/general/networking/samba), replace `/docker/nextcloud/data` with the path to your shared folder.
 :::
 ::
 
 Find your `PUID` and `GUID` by running the following command:
 
-```shell
+```sh
 id username
 ```
 
@@ -89,7 +90,7 @@ The goal of this setup is to access Nextcloud remotely from all your devices. We
 
 ::alert{type="info"}
 :::list{type="info"}
-- We assume you have a subdomain `nextcloud.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/dns). And unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router must be forwarded to port `443` on your server using [NAT rules](/general/nat).
+- We assume you have a subdomain `nextcloud.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). And unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router must be forwarded to port `443` on your server using [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -125,7 +126,7 @@ In Nextcloud’s files, edit the `config.php` file:
 ✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/nextcloud/config/www/nextcloud/config/config.php
 ```
 
@@ -151,7 +152,7 @@ Press `Esc`, then save and exit by typing `:x` and hitting Enter.
 
 In Swag’s folders, create the file `nextcloud.subdomain.conf`:
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/nextcloud.subdomain.conf
 ```
 

content/3.serveex/6.cloud/_dir.yml

@@ -1 +1,2 @@
 navigation.title: Cloud Drive & Photos
+icon: lucide:cloud-upload

content/3.serveex/7.files/1.file-browser.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: File Browser
+description: Install File Browser to browse and manage your server files from a web interface, exposed securely with SWAG.
 main:
   fluid: false
 ---
@@ -27,9 +28,8 @@ services:
   filebrowser:
     container_name: filebrowser
     volumes:
-      - /:/srv
       - /docker/filebrowser/config:/config/
-      # - /path/to/your/folders:/yourfolders
+      - /path/to/your/folders:/yourfolders #add your folders to browse as /docker:/docker for exemple
     ports:
       - 8010:80
     image: filebrowser/filebrowser:s6
@@ -67,7 +67,7 @@ You may want to access File Browser remotely from all your devices. To do that,
 
 ::alert{type="info"}
 :::list{type="info"}
-- __Pre-requisite:__ We assume you've already created a subdomain like `files.yourdomain.com` in your [DNS zone](/general/dns) pointing to `yourdomain.com` with a `CNAME`, and—unless you're using Cloudflare Zero Trust—have already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/nat).
+- __Pre-requisite:__ We assume you've already created a subdomain like `files.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`, and—unless you're using Cloudflare Zero Trust—have already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -99,7 +99,7 @@ Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.
 
 In the Swag folders, create the file `files.subdomain.conf`.
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/files.subdomain.conf
 ```
 

content/3.serveex/7.files/2.pingvin.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Pingvin
+description: Install Pingvin Share, a self-hosted file sharing platform to send files securely without relying on WeTransfer or Google Drive.
 main:
   fluid: false
 ---
@@ -81,7 +82,7 @@ Tout l'intérêt d'une telle solution, c'est de pouvoir y accéder à distance e
 ::alert{type="info"}
 📋 __Au préalable :__ 
 <br/><br/>
-Nous partons du principe que vous avez le sous-domaine `pingvin.mondomaine.fr` avec un `CNAME` qui pointe vers `mondomaine.fr` dans votre [zone DNS](/general/dns). Et que bien sûr, [à moins que vous utilisiez Cloudflare Zero Trust](/serveex/security/cloudflare), le port `443` de votre box pointe bien sur le port `443` de votre serveur via [les règles NAT](/general/nat).
+Nous partons du principe que vous avez le sous-domaine `pingvin.mondomaine.fr` avec un `CNAME` qui pointe vers `mondomaine.fr` dans votre [zone DNS](/general/networking/dns). Et que bien sûr, [à moins que vous utilisiez Cloudflare Zero Trust](/serveex/security/cloudflare), le port `443` de votre box pointe bien sur le port `443` de votre serveur via [les règles NAT](/general/networking/nat).
 ::
 
 Dans Dockge, rendez-vous dans la stack de SWAG et éditez le compose en ajoutant le réseau de pingvin :
@@ -118,7 +119,7 @@ Dans les dossiers de Swag, créez le fichier `pingvin.subdomain.conf`.
 :::
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/pingvin.subdomain.conf
 ```
 Entrez en modification avec la touche `i` et collez la configuration ci-dessous :

content/3.serveex/7.files/_dir.yml

@@ -1 +1,2 @@
-navigation.title: File & share
+navigation.title: File & share
+icon: lucide:folder-tree

content/3.serveex/8.development/1.code-server.md

@@ -1,6 +1,7 @@
 --- 
 navigation: true
 title: Code-Server
+description: Install code-server to run VS Code in your browser from your homelab — mount folders and expose it securely with SWAG.
 main:
   fluid: false
 ---
@@ -28,7 +29,7 @@ main:
 
 Folder structure
 
-```console
+```sh
 root
 ├── docker
 │   └── code-server
@@ -71,13 +72,13 @@ services:
 
 Choose a password and generate its hash:
 
-```shell
+```sh
 echo -n "yourpassword" | npx argon2-cli -e
 ```
 
 Save the result carefully. Find your PUID and GUID with:
 
-```shell
+```sh
 id yourusername
 ```
 
@@ -122,7 +123,7 @@ The whole point of such a solution is to access it remotely from any device. To
 
 ::alert{type="info"}
 :::list{type="info"}
-- __Preliminary:__ We assume you’ve created a subdomain like `code.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/dns), and—unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare)—that you’ve forwarded port `443` from your router to port `443` on your server using [NAT rules](/general/nat).
+- __Preliminary:__ We assume you’ve created a subdomain like `code.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns), and—unless you're using [Cloudflare Zero Trust](/serveex/security/cloudflare)—that you’ve forwarded port `443` from your router to port `443` on your server using [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -158,7 +159,7 @@ Inside the Swag config folders, create the file `code.subdomain.conf`.
 ✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/code.subdomain.conf
 ```
 

content/3.serveex/8.development/2.gitea.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Gitea
+description: Install Gitea, a lightweight self-hosted Git service to manage your code repositories privately on your own server.
 main:
   fluid: false
 ---
@@ -21,7 +22,7 @@ main:
 ---
 Folder structure
 
-```console
+```sh
 root
 └── docker
     └── gitea
@@ -74,7 +75,7 @@ The benefit of this setup is being able to access it remotely from any of your d
 
 ::alert{type="info"}
 :::list{type="info"}
-- __Prerequisite:__ We assume you have created a subdomain such as `gitea.yourdomain.com` in your [DNS zone](/general/dns) with `CNAME` pointing to `yourdomain.com`, and [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you have already forwarded port `443` from your router to your server’s port `443` in the [NAT rules](/general/nat).
+- __Prerequisite:__ We assume you have created a subdomain such as `gitea.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` pointing to `yourdomain.com`, and [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you have already forwarded port `443` from your router to your server’s port `443` in the [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -110,7 +111,7 @@ Inside the Swag folders, create the file `gitea.subdomain.conf`.
 ✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/gitea.subdomain.conf
 ```
 Press `i` to enter edit mode and paste the configuration below:
@@ -176,7 +177,7 @@ Press `Esc`, then save and exit by typing `:x` and hitting `Enter`.
 
 Now open the `app.ini` file from the container's file system:
 
-```shell
+```sh
 sudo vi /docker/gitea/data/gitea/conf/app.ini
 ```
 

content/3.serveex/8.development/3.it-tools.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: IT Tools
+description: Install IT Tools, a self-hosted collection of handy utilities for developers — converters, encoders, formatters, and more.
 main:
   fluid: false
 ---
@@ -58,7 +59,7 @@ You might want to access it remotely on all your devices. To do that, we'll expo
 
 ::alert{type="info"}
 :::list{type="info"}
-- __Pre-requisite:__ We assume you’ve created a subdomain like `tools.yourdomain.com` in your [DNS zone](/general/dns) with `CNAME` set to `yourdomain.com`. Also, unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure you’ve already forwarded port `443` from your router to port `443` on your server in the [NAT rules](/general/nat).
+- __Pre-requisite:__ We assume you’ve created a subdomain like `tools.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` set to `yourdomain.com`. Also, unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure you’ve already forwarded port `443` from your router to port `443` on your server in the [NAT rules](/general/networking/nat).
 :::
 ::
 
@@ -100,7 +101,7 @@ Inside the Swag folders, create the file `tools.subdomain.conf`.
 ✨ __Tip:__ You can use [File Browser](/serveex/files/file-browser) to navigate and edit your files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/tools.subdomain.conf
 ```
 

content/3.serveex/8.development/_dir.yml

@@ -1 +1,2 @@
-navigation.title: Developpement
+navigation.title: Developpement
+icon: lucide:code-xml

content/3.serveex/9.apps/1.adguard.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Adguard Home
+description: Install AdGuard Home for network-wide ad and tracker blocking with DNS-over-HTTPS, client management, and custom filtering rules.
 main:
   fluid: false
 ---
@@ -40,7 +41,7 @@ This is how ads and malicious domains are blocked—Adguard blocks only the bad
 ---
 Folder structure:
 
-```console
+```sh
 root
 └── docker
     └── adguard
@@ -58,7 +59,7 @@ root
 
 Open Dockge and click `compose`
 
-Name the stack `adguard` and paste the configuration below:
+Name the stack `adguardhome` and paste the configuration below:
 
 ```yaml
 ---
@@ -104,7 +105,7 @@ To make AdGuard usable from outside your home network, you need to expose it.
 
 ::alert{type="info"}
 :::list{type="info"}
-- __Prerequisites:__ We assume you've created a subdomain like `adguard.mydomain.com` in your [DNS zone](/general/dns) with a `CNAME` pointing to `mydomain.com`, and that you’ve already forwarded port `443` from your router to port `443` on your server in your [NAT rules](/general/nat). Also forward port `53` and port `853` to your server. These ports are used to route DNS requests.
+- __Prerequisites:__ We assume you've created a subdomain like `adguard.mydomain.com` in your [DNS zone](/general/networking/dns) with a `CNAME` pointing to `mydomain.com`, and that you’ve already forwarded port `443` from your router to port `443` on your server in your [NAT rules](/general/networking/nat). Also forward port `53` and port `853` to your server. These ports are used to route DNS requests.
 :::
 ::
 
@@ -147,7 +148,7 @@ Create and open the file `adguard.subdomain.conf`
 You can use [File Browser](/serveex/files/file-browser) to browse and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/adguard.subdomain.conf
 ```
 

content/3.serveex/9.apps/2.vaultwarden.md

@@ -1,6 +1,7 @@
 ---
 navigation: true
 title: Vaultwarden
+description: Install Vaultwarden, a self-hosted Bitwarden-compatible password manager to replace Google or Apple password managers across all your devices.
 main:
   fluid: false
 ---
@@ -21,7 +22,7 @@ Vaultwarden is a fork of [Bitwarden](https://bitwarden.com/fr-fr/help/).
 ---
 Folder structure:
 
-```console
+```sh
 root
 └── docker
     └── vaultwarden
@@ -75,8 +76,8 @@ services:
 
 Next, generate a password hash to put in the `TOKEN` variable in `.env`:
 
-```shell
+```sh
-echo -n "yourpassword" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4
+echo -n 'yourpassword' | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4
 ```
 
 Copy the result securely.
@@ -108,7 +109,7 @@ Recently, Vaultwarden requires SSL to be accessed, which prevents access via a l
 The main benefit of Vaultwarden is being able to access it remotely from any device. We'll expose it through [SWAG](/serveex/core/swag).
 
 ::alert{type="info"}
-✨ __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/nat).
+✨ __Before you start:__ Make sure you've created a DNS subdomain like `vault.yourdomain.com` with `CNAME` pointing to `yourdomain.com` and (unless using Cloudflare Zero Trust) that you've forwarded port `443` from your router to your server's `443` via [NAT rules](/general/networking/nat).
 ::
 
 In Dockge, go to the SWAG stack and edit the compose file to add the Vaultwarden network:
@@ -143,7 +144,7 @@ In SWAG's config folder, create the file `vault.subdomain.conf`:
 ✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
 ::
 
-```shell
+```sh
 sudo vi /docker/swag/config/nginx/proxy-confs/vault.subdomain.conf
 ```
 
@@ -235,7 +236,7 @@ server {
 
 Press `Esc`, then type `:x` and press `Enter` to save and exit.
 
-And there you go — Vaultwarden is now exposed! Visit `vault.yourdomain.com` to access the admin panel and create your account. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
+And there you go — Vaultwarden is now exposed! Visit `https://vault.yourdomain.com/admin` to access the admin panel and paste the password you specified when generatique the `ADMIN_TOKEN`. For more information, see the [Bitwarden documentation](https://bitwarden.com/help/).
 
 Don't forget to install Bitwarden browser extensions (they work with Vaultwarden) for [Chrome](https://chromewebstore.google.com/detail/gestionnaire-de-mots-de-p/nngceckbapebfimnlniiiahkandclblb) and [Firefox](https://addons.mozilla.org/fr/firefox/addon/bitwarden-password-manager/), as well as [iOS](https://apps.apple.com/fr/app/bitwarden/id1137397744) and [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden&hl=fr) apps to sync your passwords.
 

content/3.serveex/9.apps/_dir.yml

@@ -1 +1,2 @@
 navigation.title: Useful Apps
+icon: lucide:award

content/4.Stockeex/1.introduction.md

@@ -1,17 +0,0 @@
----
-navigation: true
-title: Introduction
-layout: page
-main:
-  fluid: false
----
-:ellipsis{left=0px width=40rem top=10rem blur=140px}
-
-  ::terminal{style="margin-top:80px;"}
-  ---
-  content:
-  - sudo systemctl status stockeex
-  - server is busy, come back later...
-
-  ---
-  ::

content/4.stockeex/1.introduction.md

@@ -0,0 +1,24 @@
+---
+icon: lucide:bookmark
+navigation: true
+title: Introduction
+description: Introduction to Stockeex — a personal project for stock and inventory management. Documentation coming soon.
+main:
+  fluid: false
+---
+# Stockeex
+
+  ::terminal{style="margin-top:80px;"}
+  ---
+  content:
+  - sudo systemctl status stockeex-article
+  - currently writing, come back later...
+  ---
+  ::
+
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+<div align="center">
+  <img src="/img/stockeex/stockeex-raid.svg" alt="Image" style="max-width: 60%;">
+</div>
+

content/5.nonsense/1.python/1.nvidia-stock-bot.md

@@ -0,0 +1,40 @@
+---
+navigation: true
+title: Nvidia Stock Bot
+description: A Python bot that monitors GPU stock availability in real time and sends Discord alerts — built during the RTX 5000 series launch shortage.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+# 🤖 Nvidia Stock Bot
+---
+
+For the past four years, the electronics hardware shortage has been relentless. Graphics cards are no exception. In 2020, I had to wait two months to get my RTX 3080. To manage it, I joined [JV Hardware](https://discord.gg/gxffg3GA96), where a small group of geeks had set up a bot that pinged users when GPUs became available.
+
+Four years later and with 5,000 members on the server, the RTX 5000 series is being released. Yet, no working stock bot seems to exist. Not to mention a certain “influencer” who charges users for access to a bot that doesn’t even work. He manually copies alerts from other servers like ours, which have already solved the issue.
+
+Anyway, eager to get an RTX 5090 for my AI-dedicated machine, I decided it was time to dive into Python—with a little help from ChatGPT. Along with another member, KevOut, who helped guide me through the APIs and initial architecture, I ended up building a clean and functional bot that sends different kinds of Discord alerts—all deployable in a simple Docker container.
+
+After many setbacks, I went from this:
+
+![Nvidia Stock Bot Old](/img/nonsense/nvidia-stock-bot-old-en.svg)
+
+To this:
+
+![Nvidia Stock bot](/img/nonsense/nvidia-stock-bot-en.svg)
+
+And more recently :
+
+![Nvidia Stock bot](/img/nonsense/nvidia-stock-bot-en-v4.svg)
+
+And I was also lucky enough to be referenced in the famous [selfhost newsletter](https://selfh.st/weekly/2025-07-11/) !
+
+More info directly on the repo:
+
+::card
+#title
+  🐋 __Nvidia Stock Bot__
+#description
+  [Nvidia GPU stock alert bot](https://git.djeex.fr/Djeex/nvidia-stock-bot)
+::

content/5.nonsense/1.python/2. adguard-cidre.md

@@ -1,41 +1,13 @@
 ---
 navigation: true
-title: Python Scripts
+title: Adguard CIDRE
+description: A Python script to sync AdGuard Home CIDR allowlists automatically, securing your self-hosted DNS server exposed to the internet.
 main:
   fluid: false
 ---
 :ellipsis{left=0px width=40rem top=10rem blur=140px}
-# Python Scripts
 
-My messy Python creations
+# 🤖 Adguard CIDRE Sync
-
-## 🤖 Nvidia Stock Bot
----
-
-For the past four years, the electronics hardware shortage has been relentless. Graphics cards are no exception. In 2020, I had to wait two months to get my RTX 3080. To manage it, I joined [JV Hardware](https://discord.gg/gxffg3GA96), where a small group of geeks had set up a bot that pinged users when GPUs became available.
-
-Four years later and with 5,000 members on the server, the RTX 5000 series is being released. Yet, no working stock bot seems to exist. Not to mention a certain “influencer” who charges users for access to a bot that doesn’t even work. He manually copies alerts from other servers like ours, which have already solved the issue.
-
-Anyway, eager to get an RTX 5090 for my AI-dedicated machine, I decided it was time to dive into Python—with a little help from ChatGPT. Along with another member, KevOut, who helped guide me through the APIs and initial architecture, I ended up building a clean and functional bot that sends different kinds of Discord alerts—all deployable in a simple Docker container.
-
-After many setbacks, I went from this:
-
-![Nvidia Stock Bot Old](https://git.djeex.fr/Djeex/nvidia-stock-bot/raw/commit/88c09ff4cffd96cbf0852ec785f9fbf2130c23b2/assets/img/nvbot.png)
-
-To this:
-
-![Nvidia Stock bot](https://git.djeex.fr/Djeex/nvidia-stock-bot/raw/branch/main/assets/img/nvbot_schematics.png)
-
-More info directly on the repo:
-
-::card
-#title
-  🐋 __Nvidia Stock Bot__
-#description
-  [Nvidia GPU stock alert bot](https://git.djeex.fr/Djeex/nvidia-stock-bot)
-::
-
-## 🤖 Adguard CIDRE Sync
 ---
 
 Adguard Home is a fantastic solution for DNS-level ad blocking and rewriting requests—perfect for removing ISP DNS trackers or intrusive ads.

content/5.nonsense/1.python/3.lumeex.md

@@ -0,0 +1,69 @@
+---
+navigation: true
+title: Lumeex
+description: Lumeex is a static photo gallery site generator built with Python — minimalist, lightweight, and fully customizable without a CMS.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+<div align="center">
+  <img src="https://git.djeex.fr/Djeex/lumeex/raw/branch/main/illustration/logo.svg" alt="Lumeex Screenshot" width="300"/>
+</div>
+<p/>
+<div align="center">
+<p>Yet another minimalist, lightweight photo gallery static site generator.</p>
+</div>
+</p>
+<div align="center">
+  <img src="https://git.djeex.fr/Djeex/lumeex/raw/branch/main/illustration/lumeex.png" alt="Lumeex Screenshot" />
+</div>
+
+---
+
+Amateur photographer that I am, I spent several weeks looking for a framework with a photo gallery that could outshine Instagram. I wanted something that showcased the photos rather than the author, and that made every visit unique by loading the images in random order—while still allowing filtering and sorting by tag or combinations of tags.
+
+In the end, I found nothing that did exactly what I wanted. And when something came close, it was always through heavy, bloated CMS platforms. So I decided to make a static site by hand, the old-school way, with Notepad++. Being fairly comfortable with HTML/CSS and a bit of JavaScript, I quickly came up with something nice during my vacation, between beach sessions. After all, a good craftsman should have good tools—and there’s no better tool than one you make yourself.
+
+Then I thought it might be a good idea to automate certain tasks—like generating favicon formats, resizing and converting images, creating the gallery automatically instead of entering everything by hand, and generating `robots.txt` and `sitemap` files… so I turned back to Python.
+
+Eventually, after getting good results, I figured I might as well go all the way: build a complete framework for generating a static site photo gallery, where all you need to do is fill in your site’s information in a config file and tweak the visuals a bit—without touching the code.
+
+That’s how **Lum[eex]{style="color: #1ad6ff"}** was born.
+
+<div align="center">
+  <img src="https://git.djeex.fr/Djeex/lumeex/raw/branch/main/illustration/lumeex-webui.png" alt="Lumeex Screenshot" />
+</div>
+
+---
+
+::card-grid{grid-template-columns="repeat(2, minmax(0, 1fr));"}
+#title
+Et voilà!
+
+#root
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+#default
+ 
+  ::card{icon=noto:open-book}
+  #title
+  __Documentation__
+  #description
+  [Check out the doc](https://lumeex.djeex.fr)
+  ::
+ 
+  ::card{icon=simple-icons:gitea style="color: #9ee773;"}
+  #title
+  __Repository__
+  #description
+  [See the repo](https://git.djeex.fr/Djeex/lumeex)
+  ::
+
+  ::card{icon=fluent-color:design-ideas-48}
+  #title
+  __Demo__
+  #description
+  [Explore the demo](https://modern.djeex.fr)
+  ::
+::

content/5.nonsense/1.python/4.instameex.md

@@ -0,0 +1,58 @@
+---
+navigation: true
+title: Instameex
+description: Instameex is a Docker-based tool to merge SDR and HDR photo exports into a proper gain-map JPEG ready for Instagram HDR upload.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+<div align="center">
+  <img src="https://git.djeex.fr/Djeex/instameex/raw/branch/main/src/assets/img/logo-long.svg" alt="Lumeex Screenshot" width="300"/>
+</div>
+<p/>
+<div align="center">
+<p>Mix your SDR and HDR exports into an Instagram-ready HDR photo.</p>
+</div>
+</p>
+<div align="center">
+  <img src="https://git.djeex.fr/Djeex/instameex/raw/branch/main/illustration/instameex-illustration.png" width="640" alt="Instameex Screenshot" />
+</div>
+---
+
+Nothing is more frustrating than Instagram's HDR handling. It compresses and destroys gain maps, and the slightest change in aspect ratio or size simply strips HDR out entirely. As for Lightroom, its "SDR preview" system is frankly unacceptable, it makes it impossible to get consistent results. Until now, posting on Instagram meant choosing between decent SDR with broken HDR, or the other way around.
+
+Why not simply edit your SDR file to perfection on one side, your HDR file on the other, and then recalculate a gain map from those two perfect files?
+A few pioneers have already gone down that road, notably with an [Adobe Lightroom Classic](https://github.com/karachungen/lightroom-plugin-export-hdr) plugin. Judge me if you want, but I only use Lightroom CC, which does not support plugins.
+
+I drew inspiration from a [fork of the original project](https://github.com/kostis-kounadis/instagram-hdr-assembler), the one that eventually became the LrC plugin, to build a frontend that can be easily deployed with Docker. Let's be honest: it was also a great excuse to put my Claude Code subscription to the test. And I have to say, watching it spin up its own environments, run end-to-end tests, self-correct its code, and write detailed summaries is genuinely impressive. I still reviewed everything myself, don't worry. I also learned a great deal about HDR fundamentals, gain maps, HLG/PQ tone curves, color spaces, and more.
+
+In short, here is what my workflow now looks like for posting on Instagram:
+
+![Instameex workflow](/img/nonsense/instameex-workflow.svg)
+
+Allow me to introduce **Instam[eex]{style="color: #1ad6ff"}**
+
+---
+::card-grid{grid-template-columns="repeat(2, minmax(0, 1fr));"}
+#title
+And here is the result
+
+#root
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+#default
+  ::card
+  #title
+  🐋 __Instameex__
+  #description
+  [Open the repository](https://git.djeex.fr/Djeex/instameex)
+  ::
+ 
+  ::card
+  #title
+  🌍 __Online version__
+  #description
+  [Convert online](https://instameex.djeex.fr)
+  ::
+::

content/5.nonsense/1.python/_dir.yml

@@ -0,0 +1,2 @@
+navigation.title: Python
+icon: lucide:file-code-2

content/5.nonsense/2.bash/1.servarr-duplicates.md

@@ -1,15 +1,12 @@
 ---
 navigation: true
-title: Bash Scripts
+title: Servarr corrector
+description: A bash script to detect and fix duplicate media files in Sonarr and Radarr libraries by replacing copies with hardlinks to reclaim disk space.
 main:
   fluid: false
 ---
 :ellipsis{left=0px width=40rem top=10rem blur=140px}
-# Bash Scripts
+# Servarr duplicates corrector
-
-A few random scripts that saved my life.
-
-## Detecting Duplicates and Replacing Them with Hardlinks
 ---
 
 Six months after downloading terabytes of media, I realized that Sonarr and Radarr were copying them into my Plex library instead of creating hardlinks. This happens due to a counterintuitive mechanism: if you mount multiple folders in Sonarr/Radarr, it sees them as different filesystems and thus cannot create hardlinks. That’s why you should mount only one parent folder containing all child folders (like `downloads`, `movies`, `tvseries` inside a `media` parent folder).
@@ -18,7 +15,7 @@ So I restructured my directories, manually updated every path in Qbittorrent, Pl
 
 My directory structure:
 
-```console
+```sh
 .
 └── media
     ├── seedbox
@@ -46,7 +43,7 @@ Spare you the endless Q&A with ChatGPT—I was disappointed. Qwen3 was much clea
 
 To test, I first asked for a script that only lists and compares:
 
-```bash
+```sh
 #!/bin/bash
 
 # Create an associative array to store duplicates
@@ -92,7 +89,7 @@ Again, ChatGPT disappointed. Despite my requests, it created hardlinks *before*
 
 Quick stopover to Qwen3, RTX 5090 in overdrive, and bam—much better result. Yes, it kept ChatGPT-style emojis, but here it is:
 
-```bash
+```sh
 #!/bin/bash
 
 echo "🔍 Step 1: Indexing original files in /media/seedbox..."
@@ -143,5 +140,3 @@ So, in conclusion, I:
 - Learned never to blindly copy-paste a ChatGPT script without understanding and dry-running it
 - Learned that Qwen on a RTX 5090 is more coherent than ChatGPT-4o on server farms (not even mentioning “normal” ChatGPT)
 - Learned that even with 100TB of storage, monitoring it would’ve alerted me much earlier to the 12TB of duplicates lying around
-
-Catch you next time for more exciting adventures.

content/5.nonsense/2.bash/2.luks- backup.md

@@ -0,0 +1,89 @@
+---
+navigation: true
+title: LUKS Backup
+description: A bash script to automatically dump LUKS headers from all encrypted disks, identify them by serial number, and store them in an encrypted archive.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+# Backup of LUKS Headers for Encrypted Disks/Volumes
+---
+
+I recently realized that having just the password is not enough to unlock a LUKS volume after a failure or corruption. I learned how to dump the LUKS headers from disks/volumes and to use the serial numbers along with partition names to accurately identify which header corresponds to which disk/partition (I have 10 of them!).
+
+After struggling to do this manually, I asked Qwen3 (an LLM running on my RTX 5090) to create a script that automates the listing and identification of disks, dumps the headers, and stores them in an encrypted archive ready to be backed up on my backup server.
+
+This script:
+* Lists and identifies disks with their serial numbers
+* Lists partitions
+* Dumps headers into a secured folder under `/root`
+* Creates a temporary archive
+* Prompts for a password
+* Encrypts the archive with that password
+* Deletes the unencrypted archive
+
+```sh
+#!/bin/bash
+
+# Directory where LUKS headers will be backed up
+DEST="/root/luks-headers-backup"
+mkdir -p "$DEST"
+
+echo "🔍 Searching for LUKS containers on all partitions..."
+
+# Loop through all possible disk partitions (including NVMe and SATA)
+for part in /dev/sd? /dev/sd?? /dev/nvme?n?p?; do
+    # Skip if the device doesn't exist
+    if [ ! -b "$part" ]; then
+        continue
+    fi
+
+    # Check if the partition is a LUKS encrypted volume
+    if cryptsetup isLuks "$part"; then
+        # Find the parent disk device (e.g. nvme0n1p4 → nvme0n1)
+        disk=$(lsblk -no pkname "$part" | head -n 1)
+        full_disk="/dev/$disk"
+
+        # Get the serial number of the parent disk
+        SERIAL=$(udevadm info --query=all --name="$full_disk" | grep ID_SERIAL= | cut -d= -f2)
+        if [ -z "$SERIAL" ]; then
+            SERIAL="unknown"
+        fi
+
+        # Extract the partition name (e.g. nvme0n1p4)
+        PART_NAME=$(basename "$part")
+
+        # Build the output filename with partition name and disk serial
+        OUTPUT="$DEST/luks-header-${PART_NAME}__${SERIAL}.img"
+
+        echo "🔐 Backing up LUKS header of $part (Serial: $SERIAL)..."
+
+        # Backup the LUKS header to the output file
+        cryptsetup luksHeaderBackup "$part" --header-backup-file "$OUTPUT"
+        if [[ $? -eq 0 ]]; then
+            echo "✅ Backup successful → $OUTPUT"
+        else
+            echo "❌ Backup failed for $part"
+        fi
+    fi
+done
+
+# Create a timestamped compressed tar archive of all header backups
+ARCHIVE_NAME="/root/luks-headers-$(date +%Y%m%d_%H%M%S).tar.gz"
+echo "📦 Creating archive $ARCHIVE_NAME..."
+tar -czf "$ARCHIVE_NAME" -C "$DEST" .
+
+# Encrypt the archive symmetrically using GPG with AES256 cipher
+echo "🔐 Encrypting the archive with GPG..."
+gpg --symmetric --cipher-algo AES256 "$ARCHIVE_NAME"
+if [[ $? -eq 0 ]]; then
+    echo "✅ Encrypted archive created: ${ARCHIVE_NAME}.gpg"
+    # Remove the unencrypted archive for security
+    rm -f "$ARCHIVE_NAME"
+else
+    echo "❌ Encryption failed"
+fi
+```
+
+**Don’t forget to back up `/etc/fstab` and `/etc/crypttab` as well!**

content/5.nonsense/2.bash/3.socat-proxy.md

@@ -0,0 +1,89 @@
+---
+navigation: true
+title: Socat Proxy
+description: Use socat to proxy the Docker socket through Docker Socket Proxy, allowing Beszel to collect container stats without exposing the full Docker socket.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+# Socat Proxy
+---
+
+This project addresses a common use case:
+
+- I have [Beszel](https://beszel.dev/), a monitoring container running in host mode, which requires access to the Docker socket to collect container statistics.
+- To avoid exposing the Docker socket fully to Beszel, I use [Docker Socket Proxy](https://github.com/Tecnativa/docker-socket-proxy), a container that sits between the Docker socket and the consuming container. It filters requests by setting appropriate permissions, preventing full exposure of the Docker socket.
+
+The problem arises when **Beszel** runs in host mode. In that case, it must connect directly to **Docker Socket Proxy** on a host port, meaning the proxy’s port is exposed. This allows any container or application on the host to access it and use the Docker socket.
+
+This is where [Socat Proxy](https://git.djeex.fr/Djeex/socat-proxy) comes in. It is a container that:
+
+- Creates a UNIX socket
+- Listens on this socket
+- Forwards requests to Docker Socket Proxy and back
+- Replaces the real Docker socket by exposing the proxy socket in the target container via a bind mount (in this case, Beszel)
+
+With this setup, Docker Socket Proxy communicates with Socat Proxy in their isolated bridge network, while the UNIX socket bind-mounted on the host has restricted permissions, preventing access from other containers or applications.
+
+In short:
+
+![](/img/nonsense/socat-proxy.svg)
+
+For example, with Beszel, the configuration would look like this:
+
+```yaml
+services:
+  socat-proxy:
+    image: git.djeex.fr/djeex/socat-proxy:latest
+    container_name: socat-proxy-beszel
+    environment:
+      - TARGET_HOST=${TARGET_HOST}
+      - TARGET_PORT=${TARGET_PORT}
+      - UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
+      - HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
+      - UNIX_SOCKET_NAME=${UNIX_SOCKET_NAME}
+    volumes:
+      - ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}
+    restart: unless-stopped
+    depends_on:
+      - ${TARGET_HOST}
+
+  socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: ${TARGET_HOST}
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - CONTAINERS=1
+      - INFO=1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
+
+  beszel-agent:
+    image: henrygd/beszel-agent:latest
+    container_name: beszel-agent
+    restart: unless-stopped
+    network_mode: host
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+      - ${HOST_SOCKET_PATH}/${UNIX_SOCKET_NAME}:/var/run/docker.sock:ro
+    environment:
+      - #... your Beszel environment variables
+    depends_on:
+      - socat-proxy
+```
+
+More information is available on the repository:
+
+::card
+#title
+  🐋 **Socat Proxy**
+#description
+[A lightweight bind-mount socket proxy](https://git.djeex.fr/Djeex/socat-proxy)
+::

content/5.nonsense/2.bash/4.hotdisk.md

@@ -0,0 +1,52 @@
+---
+navigation: true
+title: HotDisk
+description: A bash script that monitors hard drive temperatures and automatically shuts down the server when disks stay above a safe threshold for too long.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+# HotDisk
+---
+
+When you have a NAS with several drives sitting in a laundry room, temperatures can quickly rise.  
+Hard drives are very sensitive to heat and can suffer serious damage if they exceed a certain temperature threshold for too long.  
+After a particularly hot summer that caused a few cold sweats while monitoring my drives’ temperatures, I started looking for a way to automatically shut down the server when disk temperatures stay above their safe limit for an extended period.
+
+Since I couldn’t find a convincing solution, I decided to build my own.
+
+- The script reads SMART temperature data from all SATA drives every minute.  
+- It counts the number of consecutive minutes the temperature stays above or below the threshold.  
+- It sends Discord notifications if the threshold is exceeded or when the temperature cools down.  
+- It triggers a system shutdown if the temperature stays above the limit for the configured duration.  
+- It logs all temperatures and counter states, and automatically rotates log files.
+
+While I was at it, I also added an installation script that installs the main script, makes it executable, creates a systemd service and timer, and enables them automatically.  
+The installer also lets you configure various parameters:
+
+| Variable              | Description                                                                 | Default Value                                 |
+|-----------------------|------------------------------------------------------------------------------|-----------------------------------------------|
+| `MAX_TEMP`            | Maximum allowed temperature (°C) before the shutdown countdown starts        | `60`                                          |
+| `HOT_DURATION`        | Consecutive minutes above `MAX_TEMP` before shutdown                        | `5`                                           |
+| `COOL_RESET_DURATION` | Consecutive minutes below `MAX_TEMP` to reset all counters                  | `5`                                           |
+| `LOG_FILE`            | Path to the main log file                                                   | `/var/log/hdd_temp_monitor.log`               |
+| `LOG_ROTATE_COUNT`    | Number of log files to keep                                                 | `7`                                           |
+| `LOG_ROTATE_PERIOD`   | Log rotation period (`daily` or `weekly`)                                   | `daily`                                       |
+| `DISCORD_WEBHOOK`     | Discord webhook URL for notifications                                       | _Required_                                   |
+
+It also runs another script that configures **logrotate** with the parameters defined above.  
+Finally, the installer can even be executed directly via a simple `curl` command followed by one last setup script — perfect for the laziest of us.
+
+I also had to handle several tricky cases: running as root without sudo, using sudo directly, running as a non-sudo user, missing dependencies, permission issues, file creation errors, disk data reading errors, and more.  
+
+Concurrent access to the status file also had to be managed carefully.
+
+More details are available directly on the repository:
+
+::card
+#title
+📜 __HotDisk__
+#description
+[Keep your drives cool!](https://git.djeex.fr/Djeex/hotdisk)
+::

content/5.nonsense/2.bash/5.backrest-docker-stop.md

@@ -0,0 +1,118 @@
+---
+navigation: true
+title: Backrest Docker Stop
+description: A bash script that stops Docker containers before a Backrest backup runs and restarts them after — ensuring safe database backups without complex dumps.
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+
+# Backrest Docker Stop
+---
+
+[Backrest](https://github.com/garethgeorge/backrest) is a fantastic backup tool. In the case of [Serveex](https://docu.djeex.fr/serveex/introduction), most of the data that needs to be backed up consists of containers, and those containers often include databases.  
+
+The problem? You can’t safely back up a database while it’s running. There are plenty of complex solutions involving database dumps, but often the simplest method is to stop the containers, perform the backup, and then restart them.
+
+**Backrest** doesn’t natively provide this functionality, but it does allow the execution of custom scripts triggered by events, for example, at the start and end of a backup plan. Our goal is to stop the containers whose databases need to be backed up when the backup plan starts, and restart them when the backup plan finishes.To achieve this, we’ll need a small Bash script and a secure connection between Backrest and the Docker socket, to enable the following sequence:
+
+- The backup plan starts  
+- The event triggers the execution of a custom script  
+- The script contacts Docker and retrieves a list of containers labeled `backrest.backup.stop=true`  
+- It stops those containers  
+- The backup plan completes  
+- The event triggers another custom script  
+- The script contacts Docker again, retrieves the same list, and restarts those containers  
+
+
+## Securely Connecting Backrest and Docker
+
+To allow **Backrest** to communicate securely with Docker, we’ll use [Docker Socket Proxy](https://github.com/linuxserver/docker-socket-proxy).  
+This avoids exposing the full Docker socket and grants only the necessary permissions.  
+Here’s an example Docker stack:
+
+```yaml
+---
+services:
+  backrest:
+    image: garethgeorge/backrest:latest
+    container_name: backrest
+    hostname: backrest
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+      - ...  # your volumes
+    environment:
+      - ...  # your environment variables
+      - DOCKER_HOST=tcp://socket-proxy-backrest:2375
+    restart: unless-stopped
+    ports:
+      - ...  # your ports
+    depends_on:
+      - socket-proxy
+
+  socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: socket-proxy-backrest
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - CONTAINERS=1
+      - ALLOW_START=1
+      - ALLOW_STOP=1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
+```
+
+With this setup, Backrest can communicate with Docker safely and securely.
+
+
+## The Scripts
+
+Below are the scripts to use for **Backrest**’s *start* and *end* backup events.
+
+::code-group
+```sh [Stop]
+#!/usr/bin/env bash
+
+BACKUP_LABEL="backrest.backup.stop=true"
+BACKUP_CONTAINERS=$(docker ps -aqf "label=$BACKUP_LABEL")
+for BC in $BACKUP_CONTAINERS
+do
+    docker stop "$BC"
+done
+sleep 10
+```
+
+```sh [Start]
+#!/usr/bin/env bash
+
+BACKUP_LABEL="backrest.backup.stop=true"
+BACKUP_CONTAINERS=$(docker ps -aqf "label=$BACKUP_LABEL")
+for BC in $BACKUP_CONTAINERS
+do
+    docker start "$BC"
+done
+sleep 10
+```
+::
+
+
+## The Label
+
+Once the scripts are in place and configured for the proper **Backrest** hooks, you just need to add the label `backrest.backup.stop=true` to the `compose.yaml` files of the containers that should stop and restart during backups:
+
+```yaml
+services:
+  your_service:
+    ...
+    labels:
+      - backrest.backup.stop=true
+```
+
+And that’s it!  
+At the next backup, all containers with the correct label will automatically stop during the backup and restart once it’s finished.

content/5.nonsense/2.bash/_dir.yml

@@ -0,0 +1,2 @@
+navigation.title: Bash
+icon: lucide:file-terminal

content/Recycled/1.deprecated/1.wireguard-14.md

@@ -0,0 +1,258 @@
+---
+navigation: true
+title: Wireguard 14
+main:
+  fluid: false
+---
+:ellipsis{left=0px width=40rem top=10rem blur=140px}
+# Wireguard
+
+::alert{type="info"}
+🎯 __Goals:__
+  - Install Wireguard
+  - Configure clients
+  - Access the secure network
+::
+
+## Introduction
+---
+Using a VPN allows remote access to a server’s local resources without exposing them to the internet. It’s a clean and secure way to access services like SSH without exposing the port publicly. With a VPN, you can securely connect to your network from anywhere and make devices on different networks communicate.
+
+Here we will use [Wireguard](https://www.wireguard.com/), a secure and high-performance VPN server, using containers:
+
+- [wg-easy](https://github.com/wg-easy/wg-easy) as the server, providing a very simple web UI to manage connections and download config files (including QR codes for phones)
+- [Wireguard](https://docs.linuxserver.io/images/docker-wireguard/?h=wireguard) as the client for Linux systems
+
+Clients are also available for Windows, macOS, iOS, and Android.
+
+The concept:
+
+- On the internet, anyone can reach any internet box and thus any exposed server.
+- Your server is on your local network. It is accessible only locally unless services are explicitly exposed (as we did with Dockge). To access non-exposed resources, you must be on the same local network.
+- We want to securely access these unexposed services (like SSH) from anywhere.
+- We also want to connect services between servers, like linking two Dockge instances securely.
+
+To achieve this, we’ll create a **Virtual Private Network** (VPN), i.e., a secure tunnel that only connected machines can use. They’ll appear to be on the same private network.
+
+Additionally, you can add your phone, laptop, or other devices to the VPN and securely access your server resources wherever you are.
+
+![picture](/img/serveex/vpn.svg)
+
+In this diagram, machine 1 is part of two networks:
+
+- Its local network (devices behind the same router, e.g. `192.168.x.x` – machines 1 and 2)
+- The VPN network (VPN devices with a second IP, e.g. `10.8.x.x` – machines 1 and 4)
+
+You *can* allow VPN clients to share access to their local networks, but we won’t do that here for security and subnet conflict reasons (e.g., if two remote machines use the same local IP like `192.168.1.1`).
+
+So only VPN-connected devices can communicate with each other on the VPN, not with other local devices outside the VPN.
+
+## Server Side
+---
+::alert{type="info"}
+📋 __Checklist:__
+- Ensure port `51820 UDP` is available and properly forwarded through your router to the server (`Source 51820 UDP -> Destination 51820 UDP -> Server`).
+- Ensure port `51821 TCP` is available for the web UI.
+::
+
+::alert{type="warning"}
+:::list{type="warning"}
+- __Warning:__ This guide uses version `14` of [wg-easy](https://wg-easy.github.io/wg-easy/latest/). Version `15` introduces breaking changes incompatible with this configuration.
+:::
+::
+
+Folder structure:
+
+```sh
+root
+└── docker
+    └── wg-easy
+        ├── config
+        │   └── etc_wireguard
+        ├── compose.yaml
+        └── .env
+```
+
+The container runs in `HOST` mode, meaning it uses the host’s network stack directly.
+
+Open Dockge, click `compose`, and name the stack `wg_easy`.
+
+Paste the following configuration:
+
+```yaml
+---
+services:
+  wg-easy:
+    network_mode: host
+    env_file:
+      - .env
+    environment:
+      - LANG=en
+      - WG_HOST=${HOST}
+      - PASSWORD_HASH=${PW}
+      - WG_DEFAULT_ADDRESS=${ADDRESS}
+      - WG_HIDE_KEYS=never
+      - WG_ALLOWED_IPS=${IPS}
+      - WG_DEFAULT_DNS=
+      - UI_TRAFFIC_STATS=true
+      - UI_CHART_TYPE=1
+    image: ghcr.io/wg-easy/wg-easy:14
+    container_name: wg-easy
+    volumes:
+      - /docker/wg_easy/config/etc_wireguard:/etc/wireguard
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+```
+
+::alert{type="success"}
+✨ __Tip:__
+- You can also specify your own wireguard port with `WG_PORT`
+- Add the Watchtower label to enable automatic updates
+
+```yaml
+services
+  wg-easy:
+    #...
+    labels:
+      - com.centurylinklabs.watchtower.enable=true
+```
+::
+
+In `.env`:
+
+```properties
+HOST=
+PW=
+ADDRESS=
+IPS=
+```
+
+| Variable     | Description | Example |
+|--------------|-------------|---------|
+| `HOST`       | IP of public access of your host (router ISP's IP if it's at home) | `80.75.137.27` |
+| `PW`         | Bcrypt password hash, [generate here](https://bcrypt-generator.com/). **NOTE:** Double the `$` characters | `$$2a$$12$$FF6T4QqSP9Ho` |
+| `ADDRESS`    | VPN DHCP address range, the `x` must remain, others can vary | `10.8.0.x` |
+| `IPS`        | IPs routed by clients through the VPN. Use `10.8.0.0/24` to only route VPN traffic. To include local LAN, add `192.168.0.0/16` separated by commas. | `10.8.0.0/24` |
+
+Deploy the stack.
+
+### Enable Forwarding on Host
+
+To allow communication between VPN clients, enable:
+
+```sh
+sudo sysctl net.ipv4.ip_forward=1
+sudo sysctl net.ipv4.conf.all.src_valid_mark=1
+```
+
+### Retrieve Configuration Files
+
+To configure clients, download the config files from the server:
+
+- Visit `http://your-server-ip:51821`
+- Create a client
+- Download the config file
+- Rename it to `wg0.conf`
+
+::alert{type="danger"}
+:::list{type="danger"}
+- If it fails, check firewall rules.
+:::
+::
+
+## On the Client Server
+---
+::alert{type="info"}
+:::list{type="info"}
+- Assumes the client is a Linux server with Docker installed
+:::
+::
+
+Folder structure:
+
+```sh
+root
+└── docker
+    └── wireguard
+        └── config
+        │   └── wg_confs
+        └── compose.yaml
+```
+
+Create the folder `/docker/wireguard/config/wg_confs`:
+
+::alert{type="success"}
+✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to browse and edit files without terminal
+::
+
+```sh
+sudo mkdir -p /docker/wireguard/config/wg_confs
+```
+
+Copy the `wg0.conf` file downloaded earlier:
+
+::alert{type="success"}
+✨ __Tip:__ Easiest way is to transfer the file via SFTP to `/home/youruser`, then move it:
+
+```sh
+sudo cp ~/wg0.conf /docker/wireguard/config/wg_confs
+```
+::
+
+Create `compose.yaml` in `/docker/wireguard`:
+
+```sh
+sudo vi /docker/wireguard/compose.yaml
+```
+
+Press `i` to enter insert mode and paste:
+
+```yaml
+services:
+  wireguard:
+    image: lscr.io/linuxserver/wireguard:latest
+    container_name: wireguard
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE #optional
+    environment:
+      - TZ=Europe/Paris
+    volumes:
+      - /docker/wireguard/config:/config
+      - /lib/modules:/lib/modules #optional
+    restart: unless-stopped
+```
+
+Press `Esc` then type `:x` to save and exit.
+
+Start the container:
+
+```sh
+cd /docker/wireguard
+sudo docker compose up -d
+```
+
+::alert{type="info"}
+:::list{type="info"}
+- Repeat for each client
+:::
+::
+
+## Other Devices
+---
+- **Phone:** Install Wireguard and scan the QR code from the web UI (`http://your-server-ip:51821`)
+- **PC:** Install the Wireguard client and import the config file
+
+::alert{type="warning"}
+:::list{type="warning"}
+- __Warning:__ If a client device is on the same LAN as the server, edit `wg0.conf` and change the endpoint to the local server IP:
+`Endpoint = your-server-ip:51820`
+:::
+::
+
+And this is the result:
+
+![picture](/img/serveex/wireguard.svg)

content/Recycled/1.deprecated/_dir.yaml

@@ -0,0 +1,2 @@
+icon: lucide:trash-2
+navigation.title: Deprecated

content/Recycled/_dir.yml

@@ -0,0 +1,2 @@
+icon: noto:recycling-symbol
+navigation.title: Recycled

nuxt.config.ts

@@ -2,6 +2,7 @@ export default defineNuxtConfig({
   // https://github.com/nuxt-themes/docus
   css: ['~/assets/css/extra.css'],
   extends: ['@nuxt-themes/docus'],
+  modules: ['@nuxtjs/sitemap'],
   devtools: { enabled: false },
   colorMode: { 
     preference: 'dark',
@@ -37,10 +38,19 @@ export default defineNuxtConfig({
         { rel: 'manifest', href: '/img/favicon/site.webmanifest' }
       ],
       meta: [
-        { name: 'darkreader-lock' },
+        { name: 'darkreader-lock', content: 'true' },
       ]
     }
   },
 
+  site: {
+    url: 'https://docu.djeex.fr'
+  },
+
+  sitemap: {
+    autoLastmod: true,
+    urls: ['https://docu.djeex.fr']
+  },
+
   compatibilityDate: '2024-10-24'
 })

package.json

@@ -15,8 +15,9 @@
     "@nuxt/eslint-config": "^0.6.1",
     "@nuxt/icon": "^1.7.5",
     "@nuxtjs/plausible": "^1.0.3",
+    "@nuxtjs/sitemap": "6.1.5",
     "@types/node": "^22.9.0",
     "eslint": "^9.14.0",
-    "nuxt": "^3.14.159"
+    "nuxt": "^3.21.11"
   }
 }

plugins/canonical.ts

@@ -0,0 +1,13 @@
+export default defineNuxtPlugin(() => {
+  const route = useRoute()
+  const canonicalUrl = withSiteUrl(computed(() => route.path), { canonical: true })
+
+  useHead({
+    link: [
+      { rel: 'canonical', href: canonicalUrl }
+    ],
+    meta: [
+      { property: 'og:url', content: canonicalUrl }
+    ]
+  })
+})