223 lines
5.0 KiB
Markdown
223 lines
5.0 KiB
Markdown
---
|
||
navigation: true
|
||
title: SWAG
|
||
main:
|
||
fluid: false
|
||
---
|
||
:ellipsis{left=0px width=40rem top=10rem blur=140px}
|
||
# SWAG
|
||
|
||
::alert{type="info"}
|
||
🎯 __Goals:__
|
||
- Install Swag
|
||
- Enable SSL
|
||
- Access the dashboard
|
||
- Configure regional blocking
|
||
- Expose Dockge
|
||
::
|
||
|
||
[Swag](https://docs.linuxserver.io/general/swag/) is the core of this homelab. It is a powerful reverse proxy that allows you to expose services on the internet via domain names, handling SSL certificates, request routing, and access security. Full documentation is [available here](https://docs.linuxserver.io/general/swag).
|
||
|
||
::alert{type="warning"}
|
||
:::list{type="warning"}
|
||
- SWAG is only useful if you plan to expose your services on the internet (e.g., `https://service.mydomain.com`). If you prefer to use a VPN instead, skip to [this section](/serveex/securite/wireguard).
|
||
:::
|
||
::
|
||
|
||
Below is an example for exposing Dockge. We'll install SWAG, the dbip mod for geo-blocking, and the dashboard mod for managing SWAG, fail2ban, and geolocation.
|
||
|
||
**What is a reverse proxy and how it works for us:**
|
||
|
||
|
||
|
||
## Installation
|
||
---
|
||
|
||
::alert{type="info" icon="exclamation-circle"}
|
||
:::list{type="info"}
|
||
- This tutorial assumes you have a domain name pointing to your server, and a NAT rule forwarding port `443` to your server. Example domain: `mydomain.com`.
|
||
:::
|
||
::
|
||
|
||
File structure we'll edit:
|
||
|
||
```console
|
||
root
|
||
└── docker
|
||
└── swag
|
||
├── config
|
||
│ ├── dns-conf
|
||
│ │ └── ovh.ini
|
||
│ └── nginx
|
||
│ ├── dbip.conf
|
||
│ ├── nginx.conf
|
||
│ └── proxy-confs
|
||
│ └── dockge.subdomain.conf
|
||
├── compose.yml
|
||
└── .env
|
||
```
|
||
|
||
Open Dockge, click `compose`, name the stack `swag`, and paste this config:
|
||
|
||
```yaml
|
||
services:
|
||
swag:
|
||
image: lscr.io/linuxserver/swag:latest
|
||
container_name: swag
|
||
cap_add:
|
||
- NET_ADMIN
|
||
env_file:
|
||
- .env
|
||
environment:
|
||
- TZ=Europe/Paris
|
||
- URL=${DOMAIN}
|
||
- EXTRA_DOMAINS=${DOMAINS}
|
||
- SUBDOMAINS=wildcard # couvre les sous-domaines
|
||
- VALIDATION=dns
|
||
- DNSPLUGIN=${PLUGIN}
|
||
- EMAIL=${EMAIL}
|
||
- DOCKER_MODS=linuxserver/mods:swag-dbip|linuxserver/mods:swag-dashboard|linuxserver/mods:swag-auto-reload
|
||
volumes:
|
||
- /docker/swag/config:/config
|
||
ports:
|
||
- 80:80
|
||
- 443:443
|
||
- 81:81 # Nécessaire pour le dashboard
|
||
restart: unless-stopped
|
||
networks:
|
||
- swag
|
||
|
||
networks:
|
||
swag:
|
||
name: swag_default
|
||
|
||
```
|
||
|
||
::alert{type="success"}
|
||
✨ __Tip:__
|
||
Add a watchtower label to auto-update containers:
|
||
|
||
```yaml
|
||
services:
|
||
swag:
|
||
#...
|
||
labels:
|
||
- com.centurylinklabs.watchtower.enable=true
|
||
```
|
||
::
|
||
|
||
In your `.env`:
|
||
|
||
```properties
|
||
DOMAIN=
|
||
DOMAINS=
|
||
EMAIL=
|
||
PLUGIN=
|
||
```
|
||
|
||
Fill in the values:
|
||
|
||
| Property | Value | Examples |
|
||
|-----------|-------|----------|
|
||
| DOMAIN | Your main domain | mydomain.com |
|
||
| DOMAINS | Other domains (if any) | seconddomain.com |
|
||
| EMAIL | Your email for SSL | you@email.com |
|
||
| PLUGIN | Your DNS provider's plugin | ovh, cloudflare |
|
||
|
||
Edit `ovh.ini`:
|
||
|
||
```shell
|
||
sudo vi /docker/swag/config/dns-conf/ovh.ini
|
||
```
|
||
|
||
```properties
|
||
dns_ovh_endpoint = ovh-eu
|
||
dns_ovh_application_key =
|
||
dns_ovh_application_secret =
|
||
dns_ovh_consumer_key =
|
||
```
|
||
|
||
Generate your token [here](https://www.ovh.com/auth/?onsuccess=https%3A%2F%2Fwww.ovh.com%2Fauth%2Fapi%2FcreateToken). Required permissions:
|
||
|
||
* GET /domain/zone/*
|
||
* PUT /domain/zone/*
|
||
* POST /domain/zone/*
|
||
* DELETE /domain/zone/*
|
||
|
||
Now configure dbip:
|
||
|
||
```shell
|
||
sudo vi /docker/swag/config/nginx/nginx.conf
|
||
```
|
||
|
||
Add this under `http`:
|
||
|
||
```nginx
|
||
include /config/nginx/dbip.conf
|
||
```
|
||
|
||
Restart the stack.
|
||
|
||
## Dashboard
|
||
---
|
||
Access the dashboard at `http://yourserverip:81`. Details [here](https://www.linuxserver.io/blog/introducing-swag-dashboard).
|
||
|
||
## DBIP
|
||
---
|
||
Geo-block config example:
|
||
|
||
```nginx
|
||
# ... (Same geo-block nginx example as before)
|
||
```
|
||
|
||
## Exposing Dockge
|
||
---
|
||
::alert{type="info"}
|
||
📋 __Prerequisites:__ A subdomain `dockge.mydomain.com` with CNAME pointing to `mydomain.com`, and NAT port 443 properly configured.
|
||
::
|
||
|
||
::alert{type="warning"}
|
||
:::list{type="warning"}
|
||
- Dockge lacks MFA. Only expose it with MFA (e.g., Authentik). Otherwise, use VPN.
|
||
:::
|
||
::
|
||
|
||
Configure `dockge.subdomain.conf` as:
|
||
|
||
```nginx
|
||
# ... (Same nginx reverse proxy config)
|
||
```
|
||
|
||
Edit SWAG’s `compose.yml` to add Dockge's network:
|
||
|
||
```yaml
|
||
services:
|
||
swag:
|
||
# ...
|
||
networks:
|
||
- dockge
|
||
|
||
networks:
|
||
dockge:
|
||
name: dockge_default
|
||
external: true
|
||
```
|
||
|
||
Redeploy SWAG. Access Dockge via `https://dockge.mydomain.com`.
|
||
|
||
## Exposing Other Services
|
||
---
|
||
SWAG includes many sample confs: `service.subdomain.conf.sample`. Duplicate and configure them:
|
||
|
||
```shell
|
||
cd /docker/swag/config/proxy-confs
|
||
sudo cp service.subdomain.conf.sample service.subdomain.conf
|
||
```
|
||
|
||
::alert{type="danger"}
|
||
:::list{type="danger"}
|
||
- __If subdomain isn’t routing correctly:__
|
||
:::
|
||
- Check container name in `set $upstream_app ...;`
|
||
- Ensure the service’s network is added to SWAG’s `compose.yml`
|
||
:: |