docudjeex/content/en/3.serveex/8.development/3.it-tools.md

title, description

title	description
IT Tools	Install IT Tools, a self-hosted collection of handy utilities for developers, converters, encoders, formatters, and more.

:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

IT Tools

::note 🎯 Goals:

• Install IT Tools
• Expose IT Tools with Swag ::

IT Tools is a container exposing a web page that provides access to a wide range of development tools.

Installation

Open Dockge, click on compose, name the stack it-tools, and paste the following:

---
services:
  it-tools:
    container_name: it-tools
    restart: unless-stopped
    image: corentinth/it-tools:latest
    ports:
      - 3222:80

::tip{icon=""} ✨ Tip: Add the Watchtower label to each container to enable automatic updates.

```yaml [compose.yaml]
services:
  it-tools:
    #...
    labels:

      - com.centurylinklabs.watchtower.enable=true
```

::

Deploy the container and visit http://yourserverip:3222. That’s it, your IT Tools web UI instance is up and running!

::caution

If it fails: check your firewall rules. ::

Expose IT Tools with Swag

You might want to access it remotely on all your devices. To do that, we'll expose IT Tools using Swag.

::note

Pre-requisite: We assume you’ve created a subdomain like tools.yourdomain.com in your DNS zone with CNAME set to yourdomain.com. Also, unless you’re using Cloudflare Zero Trust, make sure you’ve already forwarded port 443 from your router to port 443 on your server in the NAT rules. ::

In Dockge, go to the SWAG stack and edit the compose file to add the IT Tools network:

---
services:
  swag:
     container_name: # ...
      # ...
     networks:              # Connects the container to the custom network 
      # ...           
      - it-tools            # Network name as defined in the IT Tools stack
    
networks:                   # Defines the custom network
  # ...
  it-tools:                 # Network name as defined in the IT Tools stack
    name: it-tools_default  # Actual name of the external network
    external: true          # Indicates it's an external network

::note

We assume the IT Tools network is named it-tools_default. You can check connectivity by visiting the SWAG dashboard at http://yourserverip:81. ::

::note

We also assume the SWAG network is named swag_default. ::

Restart the stack by clicking "deploy" and wait for SWAG to be fully operational.

Inside the Swag folders, create the file tools.subdomain.conf.

::tip{icon=""} ✨ Tip: You can use File Browser Quantum to navigate and edit your files instead of using terminal commands. ::

sudo nano /docker/swag/config/nginx/proxy-confs/tools.subdomain.conf

Paste the configuration below:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name tools.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app it-tools;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

And that’s it! IT Tools is now exposed!

Protecting IT Tools with TinyAuth

Add TinyAuth's forward-auth check directly to tools.subdomain.conf, the same way as the TinyAuth guide:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name tools.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    #if ($lan-ip = yes) { set $geo-whitelist yes; }
    #if ($geo-whitelist = no) { return 404; }
    if ($geo-blacklist = no) { return 404; }

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location /tinyauth {
        internal;
        proxy_pass http://tinyauth:3000/api/auth/nginx;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
    }

    location @tinyauth_login {
        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
    }

    location / {
        auth_request /tinyauth;
        error_page 401 = @tinyauth_login;

        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app it-tools;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

::note

The location /tinyauth block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (tinyauth here). This should already be set up from exposing TinyAuth itself. If you run into an error, double-check SWAG's compose file still has that network attached. ::

::tip{icon=""} ✨ Tip: You can secure this app with Authentik instead of TinyAuth by opening tools.subdomain.conf and uncommenting the lines include /config/nginx/authentik-server.conf; and include /config/nginx/authentik-location.conf;. Don’t forget to create an application and a provider in Authentik. ::