--- title: IT Tools description: Install IT Tools, a self-hosted collection of handy utilities for developers, converters, encoders, formatters, and more. --- :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60} [IT Tools](https://github.com/CorentinTh/it-tools) is a container exposing a web page that provides access to a wide range of development tools. ![IT Tools](/img/serveex/it-tools.png) ## Installation ::steps{level="3"} ### Deploy the stack Open Dockge, click on `compose`, name the stack `it-tools`, and paste the following: ```yaml [compose.yaml] --- services: it-tools: container_name: it-tools restart: unless-stopped image: corentinth/it-tools:latest ports: - 3222:80 ``` ::tip{icon=""} ✨ __Tip:__ Add the Watchtower label to each container to enable automatic updates. ```yaml [compose.yaml] services: it-tools: #... labels: - com.centurylinklabs.watchtower.enable=true ``` :: Deploy the container and visit `http://yourserverip:3222`. That’s it, your IT Tools web UI instance is up and running! ### Done ! :: ::caution __If it fails:__ check your firewall rules. :: ## Expose IT Tools with Swag You might want to access it remotely on all your devices. To do that, we'll expose IT Tools using Swag. ::note __Pre-requisite:__ We assume you’ve created a subdomain like `tools.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` set to `yourdomain.com`. Also, unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), make sure you’ve already forwarded port `443` from your router to port `443` on your server in the [NAT rules](/general/networking/nat). :: ::steps{level="3"} ### Add IT Tools' network to SWAG In Dockge, go to the SWAG stack and edit the compose file to add the IT Tools network: ```yaml [compose.yaml] --- services: swag: container_name: # ... # ... networks: # Connects the container to the custom network # ... - it-tools # Network name as defined in the IT Tools stack networks: # Defines the custom network # ... it-tools: # Network name as defined in the IT Tools stack name: it-tools_default # Actual name of the external network external: true # Indicates it's an external network ``` ::note We assume the IT Tools network is named `it-tools_default`. You can check connectivity by visiting the SWAG dashboard at http://yourserverip:81. :: ::note We also assume the SWAG network is named `swag_default`. :: Restart the stack by clicking "deploy" and wait for SWAG to be fully operational. ### Create the subdomain.conf file Inside the Swag folders, create the file `tools.subdomain.conf`. ::tip{icon=""} ✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands. :: ```bash [Terminal] sudo nano /docker/swag/config/nginx/proxy-confs/tools.subdomain.conf ``` Paste the configuration below: ```nginx [tools.subdomain.conf] ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name tools.*; include /config/nginx/ssl.conf; client_max_body_size 0; #if ($lan-ip = yes) { set $geo-whitelist yes; } #if ($geo-whitelist = no) { return 404; } if ($geo-blacklist = no) { return 404; } # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app it-tools; set $upstream_port 80; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. ### Done ! :: And that’s it! IT Tools is now exposed! ## Protecting IT Tools with TinyAuth Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `tools.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy): ```nginx [tools.subdomain.conf]{26-38,41-42} ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name tools.*; include /config/nginx/ssl.conf; client_max_body_size 0; #if ($lan-ip = yes) { set $geo-whitelist yes; } #if ($geo-whitelist = no) { return 404; } if ($geo-blacklist = no) { return 404; } # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location /tinyauth { internal; proxy_pass http://tinyauth:3000/api/auth/nginx; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Uri $request_uri; } location @tinyauth_login { return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri; } location / { auth_request /tinyauth; error_page 401 = @tinyauth_login; # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app it-tools; set $upstream_port 80; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` ::note The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached. :: ::tip{icon=""} ✨ __Tip:__ You can secure this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `tools.subdomain.conf` and uncommenting the lines `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don’t forget to [create an application and a provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy). ::