diff --git a/.vscode/homelab.json b/.vscode/homelab.json new file mode 100644 index 0000000..63c76eb --- /dev/null +++ b/.vscode/homelab.json @@ -0,0 +1,219 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "title": ".digital_hq", + "description": "My network's specification v0.1", + "type": "object", + "properties": { + "name": {"$ref": "#/$defs/name"}, + "domain": {"$ref": "#/$defs/domain"}, + "home_url": { + "description": "the first url to enter the network", + "$ref": "#/$defs/url" + }, + "regions": { + "type": "array", + "items": { + "$ref": "#/$defs/region" + } + }, + + "machines": { + "type": "array", + "items": { + "$ref": "#/$defs/machine" + }, + "minItems": 1 + }, + + "services": { + "type": "array", + "items": { + "$ref": "#/$defs/service" + }, + "minItems": 1 + }, + + "groups": { + "type": "array", + "items": { + "$ref": "#/$defs/group" + }, + "minItems": 3 + }, + + "users": { + "type": "array", + "items": { + "$ref": "#/$defs/user" + }, + "minItems": 1 + } + }, + + "$defs": { + "id": { + "type": "string", + "examples": ["cortex", "maurane", "postgres-shared"] + }, + + "ip": { + "type": "string", + "pattern": "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$" + }, + + "name": { + "type": "string", + "examples": ["Maurane", "AFFiNE", "Gaufre"] + }, + + "domain": { + "type": "string", + "pattern": "^[a-z]+\\.([a-z]*\\.)*[a-z]{2,10}" + }, + + "url": { + "type": "string", + "pattern": "^(https?|postgres)://[a-z0-9.-]+(\\.[a-z]{2,10})?(:[0-9]+)?(/.*)?$" + }, + + "email": { + "type": "string", + "pattern": "^[a-z0-9-\\.]+@[a-z]+\\.[a-z]{2,10}" + }, + + "service": { + "type": "object", + "properties": { + "id": {"$ref": "#/$defs/id"}, + "name": {"$ref": "#/$defs/name"}, + "machine_id": {"$ref": "#/$defs/id"}, + "ports": { + "type": "array", + "items": { + "type": "number", + "minimum": 1 + }, + "minItems": 1 + }, + "public_url": {"$ref": "#/$defs/url"}, + "internal_url": {"$ref": "#/$defs/url"}, + "status": { + "type": "string", + "enum": ["active", "inactive", "planned", "wip" , "tested", "broken"] + }, + "auth": { + "type": "string", + "enum": ["session cookie", "trusted headers", "oidc", "vpn", "internal", "none"] + }, + "installation_mode": { + "type": "string", + "enum": ["docker", "native"] + }, + "categories": { + "type": "array", + "items": { + "enum": ["ai", "auth", "automation", "backup", "caldav", "communication", "database", "dev", "experimental", "finance", "media", "monitoring", "network", "productivity", "storage"] + } + }, + "dependencies": { + "type": "array", + "items": {"$ref": "#/$defs/name"} + }, + "allowed_groups": { + "type": "array", + "items": {"$ref": "#/$defs/name"}, + "minItems": 1 + } + }, + "required": ["id", "name", "machine_id", "status", "allowed_groups"] + }, + + "machine": { + "type": "object", + "properties": { + "id": {"$ref": "#/$defs/id"}, + "name": {"$ref": "#/$defs/name"}, + "ip": { + "description": "private ip addresss of a server", + "$ref": "#/$defs/ip" + }, + "public_ip": { + "description": "public ip address of a server", + "$ref": "#/$defs/ip" + }, + "provider": { + "type": "string", + "enum": ["ovh", "hostinger", "aws", "hertzner"] + }, + "role": { + "type": "string" + }, + "domains": { + "type": "array", + "items": { + "type": "object", + "properties": { + "internal": { + "$ref": "#/$defs/domain" + }, + "external": { + "$ref": "#/$defs/domain" + } + }, + "minProperties": 1, + "maxProperties": 1, + "additionalProperties": false + }, + "contains": {"required": ["internal"]}, + "uniqueItems": true + } + }, + "required": ["id", "ip", "name", "domains"] + }, + + "region": { + "description": "sub part of the main digital hq land", + "type": "object", + "properties": { + "id": {"$ref": "#/$defs/id"}, + "region_type": {"type": "string"}, + "vn": {"type": "string"}, + "fr": {"type": "string"}, + "kre": {"type": "string"}, + "en": {"type": "string"} + }, + "required": ["id"] + }, + + "group": { + "type": "object", + "properties": { + "id": {"$ref": "#/$defs/id"}, + "name": {"$ref": "#/$defs/name"}, + "group_description": {"type": "string"}, + "region": {"$ref": "#/$defs/name"} + }, + "required": ["id", "name", "region"] + }, + + "user": { + "type": "object", + "properties": { + "id": {"$ref": "#/$defs/id"}, + "name": {"$ref": "#/$defs/name"}, + "nickname": {"$ref": "#/$defs/name"}, + "email": {"$ref": "#/$defs/email"}, + "groups": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + } + }, + "required": ["id", "name", "groups", "email"] + } + }, + + "additionalProperties": false +} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..212b1f1 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,6 @@ +{ + "yaml.schemas": { + "file:///home/maurane/Projets/homelab/.vscode/homelab.json": "file:///home/maurane/Projets/homelab/services.yml" + }, + "yaml.disableSchemaDetection": [], +} \ No newline at end of file diff --git a/authelia/configurations.yml b/authelia/configurations.yml new file mode 100644 index 0000000..33591c5 --- /dev/null +++ b/authelia/configurations.yml @@ -0,0 +1,95 @@ +# Stockage (fichier SQLite local) – suffisant pour commencer +storage: + local: + path: /config/db.sqlite3 + +# Base de données des utilisateurs (fichier) +authentication_backend: + file: + path: /config/users.yml + +# Accès par défaut (à ajuster selon tes besoins) +access_control: + default_policy: deny + rules: + - domain: "paperless.crenam.space" + policy: one_factor + - domain: "git.crenam.space" + policy: one_factor + - domain: "task.crenam.space" + policy: one_factor + - domain: "salon.home" + + +# Session et cookie +session: + cookies: + - name: authelia_session + domain: crenam.space + authelia_url: "https://auth.crenam.space" + default_redirection_url: "https://dashboard.crenam.space" + expiration: '16h' +# Notifications (par mail – on laisse vide pour le moment, pas de SMTP) +notifier: + filesystem: + filename: /config/notifications.yml + +# clients +# identity_providers: +## The other portions of the mandatory OpenID Connect 1.0 configuration go here. +## See: https://www.authelia.com/c/oidc + # oidc: + # jwks: + # - key: {{ secret "/secrets/private.pem" | mindent 10 "|" | msquote }} + # certificate_chain: {{ secret "/secrets/public.crt" | mindent 10 "|" | msquote }} + + # clients: +######################################### +# sso configuration for vikunja # +######################################### + # - client_id: 'vikunja' + # client_name: 'Vikunja' + # client_secret: '$pbkdf2-sha512$310000$hPnUYU6BCaRSZYulOiWXwA$5hsAJD494cyoQ/X9JlAbsMF//yGDg009lfDe2WhGQjl5JA> + # public: false + # authorization_policy: 'one_factor' + # require_pkce: false + # pkce_challenge_method: '' + # redirect_uris: + # - 'https://task.crenam.space/auth/openid/authelia' + # - 'https://task.crenam.space/login?redirectToProvider=authentik' + # scopes: + # - 'openid' + # - 'profile' + # - 'email' + # response_types: + # - 'code' + # grant_types: + # - 'authorization_code' + # access_token_signed_response_alg: 'none' + # userinfo_signed_response_alg: 'none' + # token_endpoint_auth_method: 'client_secret_post' + +######################################### +# config sso for gitea # +######################################### + # - client_id: 'gitea' + # client_name: 'Gitea' + # client_secret: '$pbkdf2-sha512$310000$pJR7colZSiWF7SWIfUsoqg$IGGqIZGVqcpXpzVCBgptZ3zBMqpFk4oaIKvOZPa1fn/GIg> + # public: false + # authorization_policy: 'one_factor' + # require_pkce: false + # pkce_challenge_method: '' + # redirect_uris: + # - 'https://git.crenam.space/user/oauth2/authelia/callback' + # scopes: + # - 'openid' + # - 'email' + # - 'profile' + # response_types: + # - 'code' + # grant_types: + # - 'authorization_code' + # access_token_signed_response_alg: 'none' + # userinfo_signed_response_alg: 'none' + # token_endpoint_auth_method: 'client_secret_basic' + diff --git a/firefly/.import.env b/firefly/.import.env new file mode 100644 index 0000000..5533277 --- /dev/null +++ b/firefly/.import.env @@ -0,0 +1,392 @@ +# Firefly Data Importer (FIDI) configuration file + +# Where is Firefly III? +# +# 1) Make sure you ADD http:// or https:// +# 2) Make sure you REMOVE any trailing slash from the end of the URL. +# 3) In case of Docker, refer to the internal IP of your Firefly III installation. +# +# Setting this value is not mandatory. But it is very useful. +# +# This variable can be set from a file if you append it with _FILE +# +FIREFLY_III_URL=http://app:8080 + +# +# Imagine Firefly III can be reached at "http://172.16.0.2:8082" (internal Docker network or something). +# But you have a fancy URL: "https://personal-finances.bill.microsoft.com/" +# +# In those cases, you can overrule the URL so when the data importer links back to Firefly III, it uses the correct URL. +# +# 1) Make sure you ADD http:// or https:// +# 2) Make sure you REMOVE any trailing slash from the end of the URL. +# +# IF YOU SET THIS VALUE, YOU MUST ALSO SET THE FIREFLY_III_URL +# +# This variable can be set from a file if you append it with _FILE +# +VANITY_URL=http://gaufre.home:8800 + +# +# Set your Firefly III Personal Access Token (OAuth) +# You can create a Personal Access Token on the /profile/oauth page: +# go to the "Remote access and tokens" page, then Personal Access Token and "Create new token". +# +# - Do not use the "command line token". That's the WRONG one. +# - Do not use "APP_KEY" value from your Firefly III installation. That's the WRONG one. +# +# Setting this value is not mandatory. Instructions will follow if you omit this field. +# +# This variable can be set from a file if you append it with _FILE +# +FIREFLY_III_ACCESS_TOKEN= # à faire une fois firefly lancé + +# +# You can also use a public client ID. This is available in Firefly III 5.4.0-alpha.3 and higher. +# This is a number (1, 2, 3). If you use the client ID, you can leave the access token empty and vice versa. +# +# This value is not mandatory to set. Instructions will follow if you omit this field. +# +# This variable can be set from a file if you append it with _FILE +# +FIREFLY_III_CLIENT_ID= + +# +# Lunch Flow +# +LUNCH_FLOW_API_KEY= + +# +# Unless you know what you are doing, please do not change this. +# +LUNCH_FLOW_API_URL=https://lunchflow.app/api/v1/ + +# +# Sophtron +# +SOPHTRON_USER_ID= +SOPHTRON_ACCESS_KEY= +SOPHTRON_SANDBOX=false + +# +# GoCardless information. +# The key and ID can be set from a file if you append it with _FILE +# +NORDIGEN_ID= +NORDIGEN_KEY= + +# +# If you want to use the GoCardless sandbox, set this to true. +# +NORDIGEN_SANDBOX=false + +# +# GoCardless has a rate limit in place. The data importer can wait it out, or exit. +# Valid values are "wait" or "exit" +# +RESPOND_TO_GOCARDLESS_LIMIT=wait + +# +# The data importer collects account details, which are currently unused. +# This is disabled, since it costs a lot of API calls. +# You can enable it if you want to. +# +GOCARDLESS_GET_ACCOUNT_DETAILS=false + +# +# The data importer also collects balances, which can be used for (manual) +# balance verification ("did the import go well?"). +# This is disabled by default, since it costs a lot of API calls. +# You can enable it if you want to. +# +GOCARDLESS_GET_BALANCE_DETAILS=false + +# +# Locale information. +# Set this to your locale. It is used during CSV imports to parse amounts. +# +FALLBACK_LOCALE=en_US + + +# +# Enable Banking +# +# The application ID and private key can be set from a file if you append it with _FILE +ENABLE_BANKING_APP_ID= +ENABLE_BANKING_PRIVATE_KEY= + +# +# If your bank requires a special "PSU-IP-Address" header, set the following variable +# to true instead of false. +# +ENABLE_BANKING_IMPORT_IP_HEADER=false + +# +# Your external IP must be filled in here. +# If you use "autodetect", the data importer will detect it for you. +# +# If you leave the default value it will NOT work. Either fill in your actual IP or set it to "autodetect" +# +# THE DATA IMPORTER WILL USE AN EXTERNAL SERVICE TO DO AUTO DETECTION (icanhazip.com). +# +ENABLE_BANKING_IMPORT_IP=127.0.0.1 + +# +# Spectre information +# +# The ID and secret can be set from a file if you append it with _FILE +SPECTRE_APP_ID= +SPECTRE_SECRET= + +# +# SimpleFIN settings +# + +# SimpleFIN Bridge Configuration +SIMPLEFIN_TOKEN= + +# +# Which demo environment to connect to. +# +SIMPLEFIN_DEMO_URL= +SIMPLEFIN_DEMO_TOKEN= + +# +# Connection settings. +# As a rule, if you need to set larger timeout values, it will not solve the issue. +# +SIMPLEFIN_CONNECTION_TIMEOUT=30 +SIMPLEFIN_REQUEST_TIMEOUT=60 +SIMPLEFIN_RETRY_ATTEMPTS=3 +# delay in seconds between retries +SIMPLEFIN_RETRY_DELAY= + +# +# Import size settings. +# +SIMPLEFIN_MAX_TRANSACTIONS=10000 +SIMPLEFIN_DEFAULT_DATE_RANGE=90 +SIMPLEFIN_ENABLE_CACHING=true +# In seconds +SIMPLEFIN_CACHE_DURATION=3600 + +# +# Smart expense matching settings. +# +SIMPLEFIN_SMART_EXPENSE_MATCHING=true +SIMPLEFIN_EXPENSE_MATCHING_THRESHOLD=0.7 +SIMPLEFIN_AUTO_CREATE_EXPENSE_ACCOUNTS=true + +# +# Transaction clustering settings. +# +SIMPLEFIN_ENABLE_TRANSACTION_CLUSTERING=true +SIMPLEFIN_CLUSTERING_SIMILARITY_THRESHOLD=0.7 + + +# +# Use cache. No need to do this. +# +USE_CACHE=true + +# +# If set to true, the data import will not complain about running into duplicates. +# This will give you cleaner import mails if you run regular imports. +# +# This means that the data importer will not import duplicates, but it will not complain about them either. +# +# This setting has no influence on the settings in your configuration(.json). +# +# Of course, if something goes wrong *because* the transaction is a duplicate you will +# NEVER know unless you start digging in your log files. So be careful with this. +# +IGNORE_DUPLICATE_ERRORS=false + +# +# If you set this to true, the importer will not complain about transactions that can't be found after they've +# been imported. This happens when rule on the Firefly III side deletes the transaction immediately after creating it. +# This can be useful when you have a rule that immediately deletes GoCardless' "pending" transactions. Setting this +# to true reduces some noise. +# +IGNORE_NOT_FOUND_TRANSACTIONS=false + +# +# Auto import settings. Due to security constraints, you MUST enable each feature individually. +# You must also set a secret. The secret is used for the web routes. +# +# The auto-import secret must be a string of at least 16 characters. +# Visit this page for inspiration: https://www.random.org/passwords/?num=1&len=16&format=html&rnd=new +# +# Submit it using ?secret=X +# +# This variable can be set from a file if you append it with _FILE +# +AUTO_IMPORT_SECRET=qtyrNFCbe4Jawyda + +# +# Is the /autoimport even endpoint enabled? +# By default it's disabled, and the secret alone will not enable it. +# +CAN_POST_AUTOIMPORT=true + +# +# Is the /autoupload endpoint enabled? +# By default it's disabled, and the secret alone will not enable it. +# +CAN_POST_FILES=true + +# +# Import directory white list. You need to set this before the auto importer will accept a directory to import from. +# +# This variable can be set from a file if you append it with _FILE +# +IMPORT_DIR_ALLOWLIST= + +# +# If you import from a directory, you can save a fallback configuration file in the directory. +# This file must be called "_fallback.json" and will be used when your CSV or CAMT.053 file is not accompanied +# by a configuration file. +# +# This fallback configuration will only be used if this variable is set to true. +# https://docs.firefly-iii.org/how-to/data-importer/advanced/post/#importing-a-local-directory +# +FALLBACK_IN_DIR=false + +# +# When you're running Firefly III under a (self-signed) certificate, +# the data importer may have trouble verifying the TLS connection. +# +# You have a few options to make sure the data importer can connect +# to Firefly III: +# - 'true': will verify all certificates. The most secure option and the default. +# - 'file.pem': refer to a file (you must provide it) to your custom root or intermediate certificates. +# - 'false': will verify NO certificates. Not very secure. +VERIFY_TLS_SECURITY=true + +# +# If you want, you can set a directory here where the data importer will look for import configurations. +# This is a separate setting from the /import directory that the auto-import uses. +# Setting this variable isn't necessary. The default value is "storage/configurations". +# +# This variable can be set from a file if you append it with _FILE +# +JSON_CONFIGURATION_DIR= # à voir plus tard + +# +# Time out when connecting with Firefly III. +# π*10 seconds is usually fine. +# +CONNECTION_TIMEOUT=31.41 + +# The following variables can be useful when debugging the application +APP_ENV=local +APP_DEBUG=false +LOG_CHANNEL=stack + +# +# If you turn this on, expect massive logs with lots of privacy sensitive data +# +LOG_RETURN_JSON=false + +# Log level. You can set this from least severe to most severe: +# debug, info, notice, warning, error, critical, alert, emergency +# If you set it to debug your logs will grow large, and fast. If you set it to emergency probably +# nothing will get logged, ever. +LOG_LEVEL=debug + +# TRUSTED_PROXIES is a useful variable when using Docker and/or a reverse proxy. +# Set it to ** and reverse proxies work just fine. +TRUSTED_PROXIES=** + +# +# Time zone +# +TZ=Europe/Paris + +# +# Email settings. +# The data importer can send you a message with all errors, warnings and messages +# after a successful import. This is disabled by default +# +ENABLE_MAIL_REPORT=false + +# +# Force Firefly III URL to be secure? +# +# +EXPECT_SECURE_URL=false + +# +# Use fake data instead of real data. I use this when developing. +# +FAKE_DATA=false + +# If enabled, define which mailer you want to use. +# Options include: smtp, mailgun, postmark, sendmail, log, array +# Amazon SES is not supported. +# log = drop mails in the logs instead of sending them +# array = debug mailer that does nothing. +MAIL_MAILER= + +# where to send the report? +# This variable can be set from a file if you append it with _FILE +MAIL_DESTINATION=noreply@example.com + +# other mail settings +# These variables can be set from a file if you append it with _FILE +MAIL_FROM_ADDRESS=admin@crenam.space +MAIL_HOST=smtp.mail.ovh.net +MAIL_PORT=587 +MAIL_USERNAME=admin@crenam.space +MAIL_PASSWORD=qjKKZZpuS3cYWtyFShgN +MAIL_ENCRYPTION=null + +# Extra settings depending on your mail configuration above. +# These variables can be set from a file if you append it with _FILE +MAILGUN_DOMAIN= +MAILGUN_SECRET= +MAILGUN_ENDPOINT= +POSTMARK_TOKEN= + +# +# You probably won't need to change these settings. +# +BROADCAST_DRIVER=log +CACHE_DRIVER=file +QUEUE_CONNECTION=sync +SESSION_DRIVER=file +SESSION_LIFETIME=120 +IS_EXTERNAL=false + +REDIS_HOST=redis +REDIS_PASSWORD=null +REDIS_PORT=6379 + +# always use quotes +REDIS_DB="0" +REDIS_CACHE_DB="1" + +# +# Use ASSET_URL when your data importer webpages are served from a URL with a subfolder path +# This pre-appends the subfolder path in front of URLs for browser-side assets such as CSS Files. +# Example: If your webserver (i.e. NGINX) is configured to serve the data importer webpages from +# http://localhost/ff3di, set ASSET_URL = /ff3di +# and it will pre-append that value to any requests for browser-side assets +# 1) Make sure you REMOVE any trailing slash from the end of the URL. +# +ASSET_URL= + +# The only tracker supported is Matomo. +# This is used on the public instance over at https://data-importer.firefly-iii.org +TRACKER_SITE_ID= +TRACKER_URL= + +APP_NAME=DataImporter + +# +# The APP_URL environment variable is NOT used anywhere. +# Don't bother setting it to fix your reverse proxy problems. It won't help. +# Don't open issues telling me it doesn't help because it's not supposed to. +# Laravel uses this to generate links on the command line, which is a feature the data importer does not use. +# +APP_URL=http://gaufre.home:8801 \ No newline at end of file diff --git a/firefly/docker-compose.yml b/firefly/docker-compose.yml new file mode 100644 index 0000000..73b9c89 --- /dev/null +++ b/firefly/docker-compose.yml @@ -0,0 +1,46 @@ +services: + app: + image: fireflyiii/core:latest + hostname: app + container_name: firefly_iii_core + restart: always + volumes: + - /srv/homelab/firefly/data:/var/www/html/storage/upload + env_file: .env + ports: + - "8800:8080" + cron: + # + # To make this work, set STATIC_CRON_TOKEN in your .env file or as an environment variable + # The STATIC_CRON_TOKEN must be *exactly* 32 characters long + # Use this URL for inspiration: https://www.random.org/strings/?num=1&len=32&digits=on&upperalpha=on&loweralpha=on&unique=on&format=html&rnd=new + # + image: alpine + restart: always + container_name: firefly_iii_cron + env_file: .env + command: ["sh", "-c", "apk add tzdata && \ + (ln -s /usr/share/zoneinfo/$$TZ /etc/localtime || true) && \ + echo \"0 3 * * * wget -qO- http://app:8080/api/v1/cron/$$STATIC_CRON_TOKEN;echo\" \ + | crontab - && \ + crond -f -L /dev/stdout"] + depends_on: + - app + + redis: + image: redis:7-alpine + container_name: firefly_iii_redis + restart: always + + importer: + image: fireflyiii/data-importer:latest + hostname: importer + restart: always + container_name: firefly_iii_importer + ports: + - '8801:8080' + depends_on: + - app + env_file: .importer.env + volumes: + - /mnt/freebox:/import diff --git a/prompt ia.md b/prompt ia.md new file mode 100644 index 0000000..df66c3c --- /dev/null +++ b/prompt ia.md @@ -0,0 +1,223 @@ +# prompt ia + +## contexte relationnel + +on se parle depuis plus d'un an maintenant. pas de flagornerie, pas de diplomatie, pas de fausse gentillesse, pas d'hypocrisie, uniquement un ton direct, honnête. + + + +## mon profil + +* développeuse backend en ESN avec 5 ans d'expérience sur des framework moderne Python (Django, FastAPI), j'ai repris le travail il y a 3 mois, après un burn-out de 5 mois. +* je ne suis pas en mission mais en intercontrat. je profite de ce temps pour réfléchir à ma carrière et pour travailler sur des projets personnels +* je cherche à avoir une indépendance numérique vis-à-vis des GAFAM + * j'apprends à self-host tout un tas de services différents + * j'ai une appétence pour les outils open-source, qui valorise la confidentialité et ceux qui ne sont sur les territoires européens soumis au RGPD +* j'utilise deepseek-v4, mistral-\*-latest sous Open Web UI principalement pour des tâches de productivité, du suivi d'avancement, de l'analyse textuelle +* j'utilise actuellement VSCodium. J'ai utilisé PyCharm pendant 6 ans. +* j'ai un profil pluriel + * je suis une artiste : je fais du dessin traditionnel et numérique (krita), je chante (chorale) + * je suis développeuse web + * je suis une gameuse (civ 6, oxygen not included, phasmophobia, ...) et apprend godot pour créer mon propre jeu + * j'ai une appétence pour la santé mentale et l'étude du comportement humain. Je suis de manière non officielle un DU en cyberpsychologie. + + + +### matériel & hébergement + +| Machine | Rôle | OS / Spécifications | +| -------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------- | +| **Cortex** (VPS OVH) | Le Cerveau (proxy, auth, BDD, services critiques) | Ubuntu 24.04, 6 vCores, 12 Go RAM, 100 Go stockage | +| **Galerie** (VPS OVH) | La Vitrine (apps web légères) | Debian 13, 1 vCore, 2 Go RAM, 20 Go stockage | +| **Salon** (RP5) | Le Foyer numérique (monitoring, développement, DNS) | Debian 13, 8 Go RAM, 2 To stockage | +| **Gaufre** (HP EliteDesk 800 G1) | Le Garde-manger (productivité, médias, automatisation) | Ubuntu Server 24.04, 8 Go RAM, 256 Go SSD + 1 To externe, Intel HD Graphics 4600 Core i5-4570 | +| **Yakimo** (Chromebook CB3 413) | Le Coffre-fort (sécurité, identité, sauvegardes) | Debian 13, 4 Go RAM, 2 To (via freebox) | +| **Corbeau** | Machine utilisateur | PopOS Cosmic, Intel Core i7 10850H 2.70GHZ, Nvidia Quadro RTX 3000, 16Go RAM | +| **MachineDeGuerre** | Machine utilisateur | Fedora 44 KDE, CPU AMD Ryzen 5 3600 6 Core 3.60 GHz, AMD RX 7600 XT, RAM 16 Go | + +### + +### noms de domaine + +* **crenam.space** (domaine racine) + + + +### organisation du travail quotidien + +* **Éviter la surcharge** : j'ai un historique de burn-out. On privilégie la régularité douce à l’intensité. +* **Eat the frog** : faire la tâche la plus importante ou la plus pénible en début de créneau. +* **Flexibilité** : ce planning est une trame, pas une prison. On l’adapte selon mon énergie et les urgences. + + + +#### Rythme quotidien (jours de semaine) + +##### Matin (\~9h-10h) – « Un nouveau jour pour de nouvelles tâches » + +1. **Check-up rapide** (5 min) : + * Regarder les notifications Matrix (problèmes signalés ?). + * Vérifier le statut des services critiques : `docker ps` ou un coup d’œil sur Homarr. + * Lire les éventuels e-mails ou alertes de backup. +2. **Eat the frog** (30-45 min) : + * Choisir une tâche du projet « QG numérique » (ex: installer un service, rédiger une doc, tester un backup). + * **Ne pas dépasser 1h** sur une tâche complexe. Fractionner. +3. **Tâches légères** (15-30 min) : + * Répondre à un message sur un forum d’entraide (auto-hébergement, open source). + * Trier les notifications AFFiNE ou les tâches en attente. +4. **Pause** (10-15 min) : s’éloigner de l’écran, respirer. + +##### Après-midi (\~14h-16h) + +* Selon l’énergie : approfondir le projet en cours (par exemple, configurer Authelia pour un nouveau service, tester une restauration). +* Ou : tâches administratives (mise à jour de la doc AFFiNE, schéma réseau). +* **Ne pas travailler après 18h** (sauf urgence vitale). + + + +##### Fin de journée (\~17h-18h) – « C’est tout pour aujourd’hui » + +* **Bilan** (5 min) : + * Qu’ai‑je accompli aujourd’hui ? + * Qu’est‑ce qui est bloqué ? + * Qu’est‑ce que je ferai demain (une seule tâche prioritaire) ? +* Noter dans AFFiNE la tâche du lendemain (avec le contexte « À faire »). + + + + + +#### Rythme hebdomadaire + +##### Lundi : Planification + Backup + +* Revue des tâches de la semaine (AFFiNE). +* Vérifier le rapport de backup du week-end (Borg). +* Lancer un backup manuel si un service critique a été modifié. + + + +##### Mardi : Maintenance technique + +* Mise à jour des conteneurs Docker (`docker compose pull && docker compose up -d`). +* Vérifier les logs (journald, Docker) pour des anomalies. +* Nettoyage des vieux conteneurs/images (`docker system prune -f`). + + + +##### Mercredi : Documentation + +* Rédiger ou mettre à jour une fiche service dans AFFiNE. +* Ajouter des captures d’écran ou des notes pour les procédures. +* Mettre à jour le schéma draw.io si des changements ont eu lieu. + + + +##### Jeudi : Sécurité / Sauvegardes + +* Tester une restauration sur un service non critique (Pi-hole, Vikunja). +* Vérifier l’intégrité des sauvegardes Borg (`borg check`). +* Mettre à jour les mots de passe ou les clés si nécessaire. + + + +##### Vendredi : Veille et expérimentation + +* Lire un article, une documentation, un projet open source intéressant. +* Tester un nouveau service dans un conteneur temporaire. +* Préparer le week-end (aucune tâche lourde). + + + +##### Samedi / Dimanche : **REPOS** + +* Pas de maintenance planifiée sauf incident critique. +* Possibilité de jouer, dessiner, chanter, ou simplement ne rien faire. + + + +#### Rythme mensuel + +* **Premier week-end du mois** : Grosse mise à jour (OS, noyau, sécurité). + * Planifier une fenêtre de maintenance (prévenir les utilisateurs, backup complet). + * Appliquer les mises à jour système (`apt update && apt upgrade`). + * Redémarrer les machines une par une (en vérifiant que tout remonte). +* **Deuxième semaine** : Audit des sauvegardes. + * Vérifier l’espace disque sur Yakimo et les backups externes. + * Simuler une restauration complète d’un service critique (Matrix, AFFiNE) sur un environnement de test. +* **Troisième semaine** : Revue de projet. + * Avancement du plan de carrière / formation. + * Réévaluer les priorités du homelab (dois‑je ajouter un service ? en supprimer un ?). +* **Dernière semaine** : Mise à jour de la documentation exhaustive. + * Relire et corriger la doc AFFiNE. + * Synchroniser les notes avec le schéma draw.io. + + + +### mails + +* j'ai une adresse e-mail pro crenam.space et des alias pour différents services (perso, commandes ...) hébergées chez mailbox.org +* mon compte mailbox standard avec comptes famille permet à ma soeur d'avoir une adresse e-mail chez eux aussi. +* l'objectif serait que ma famille puisse basculer chez mailbox avec moi. + + + +### services self-hosted + +| Service | Machine | Mode | Port | SSO ? | Exposé via reverse proxy ? | +| ---------------------- | ------------ | --------------------------------------------- | ------------------------------------------ | ------------------------------- | -------------------------- | +| **AFFiNE** | Cortex | Docker | 3010 | Oui (pas encore configuré) | Oui | +| **Firefly III** | Gaufre | Docker | 8800, 8801 | Oui si possible | Oui | +| **AliasVault** | Salon | Docker | 8008, 8443, 25, 587 | Non | Oui | +| **Gitea** | Salon | Docker | 3000 | Oui (à retester) | Non (VPN) | +| **Authelia** | Cortex | Docker | 9091 | Non | Oui | +| **Beszel ** | Salon | Docker | 8090 | Oui (pas encore configuré) | Non (VPN) | +| **Homarr** | Salon | Docker | 7575 | Oui (pas encore configuré) | Oui | +| **Borgbackup** | Yakimo | Natif | - | Non | Non | +| **Immich** | Gaufre | Docker | 2283 | Oui (pas encore configuré) | Oui | +| **jellyfin** | Salon/Gaufre | Docker | 8096, 7359 | Oui (pas encore configuré) | Oui | +| **Matrix** | Cortex | **Cluster k8s** (seule app restante dans k3s) | 80, 443, 30001, 30002 (valeurs par défaut) | Non | Oui | +| **Mealie** | Gaufre | Docker | 9925 | Oui (pas encore configuré) | Oui | +| **n8n** | Gaufre | Docker | 5678 | Non, VPN | Non (VPN) | +| **ntfy** | Salon | Docker | 810 | Non, VPN | Oui (https obligatoire) | +| **Open Web UI** | Cortex | Docker | 3000 | Oui (pas encore configuré) | Oui | +| **Paperless-ngx** | Salon | Docker | 8101 | X (prend authelia seamlessly) | Oui | +| **PostgreSQL partagé** | Cortex | Docker | 5432 | Non | Non | +| **Pi-hole principal** | Salon | Docker | 80 | Non (VPN) | Non | +| **Pi-hole secondaire** | Yakimo | X Pas encore installé | 80 | X (pas encore décidé) | Non | +| **Radicale** | Yakimo | Natif | 5232 | Non (revérifier) | Non | +| **Seafile** | Gaufre | Docker | 80, 8000, 8082 | Oui (pas encore configuré) | Non | +| **uptime kuma** | Salon | Docker | 3001 | Non (VPN) | Non | +| **Vikunja** | Gaufre | Docker | 3456 | Oui (pas encore configuré) | Oui | + + + +### outils utilisés + +* j'utilise AFFiNE au quotidien pour organiser mes tâches et prendre des notes sur mes différentes activités +* thunderbird pour mes mails, mes évènements et tâches (caldav) +* vikunja pour la gestion des tâches (besoin d'apprendre encore à l'utiliser rapidement) +* PyCharm pour les projets dev, Zed pour le code ou script léger ou rapide à modifier +* cinny comme client matrix desktop, commet sur android + * j'ai mis en place un bridge discord + * j'utilise discord en transition, le temps que mes proches acceptent d'utiliser matrix + * j'aimerais repasser de cinny/commet à element sur pc et android car leur dernière update a rendu l'app beaucoup plus accessible. Mais, il me faudrait encore voir les histoires d'emotes/stickers customs. +* f-droid à la place de playstore (quand je peux). Google a annoncé verrouiller le système android (installation d'apk custom interdite) et lutter contre les alternatives comme f-droid dans 3-4 mois. Il faudra réfléchir à ce problème ultérieurement + + + +## projets en cours + +* mettre en place un bridge whatsapp +* finir la première version du homelab. + * configurer authelia pour tous les services qui le supportent ou qui sont utiles à mes proches + * écrire toute la documentation du projet (guide d'utilisation, procédure, configurations ...) + * connecter tous les services qui ont des intégrations entre eux + * réfléchir à des workflow n8n + * réfléchir à des webhook + * créer un bot matrix (ai, ntfy, webhook ...) + * créer un dashboard homarr pour chaque type d'utilisateur +* formation IA (prompt engineering) : je suis la formation [AI Fundamentals](https://app.datacamp.com/learn/skill-tracks/ai-fundamentals) et j'en suis au 3e cours sur 6 appelé "Understand Machine Learning". +* j'ai suivi un guide qui m'a permis de mettre en mot un projet professionnel à la fois précis et à la fois vague. Il s'exprime ainsi : "Ma mission de vie est d'avoir un grand espace où je pourrais monter un petit business numérique à destination des associations, tpe et pme pour réaliser des projets numériques et de l'éducation populaire numérique à l'aide de ma sensibilité et mon empathie.". + + Pour me coordonner avec mon conjoint, je pense avoir besoin de plusieurs mois de préparation, jusqu'en mai 2027. Les formations et certifications pourront être rentable pour la suite. diff --git a/services.yml b/services.yml new file mode 100644 index 0000000..383a60d --- /dev/null +++ b/services.yml @@ -0,0 +1,560 @@ +name: homelab +domain: crenam.space +home_url: https://dashboard.crenam.space +regions: + - id: rooster_palace + en: rooster_palace + vn: điện kê + kre: palè kòk + fr: palais coq + region_type: sovereign + + - id: ambassadors_garden + en: ambassadors' garden + vn: vườn nam + kre: jadin anbasadè + fr: jardin des ambassadeurs + region_type: diplomatic + + - id: family_village + en: family village + vn: xã làng + kre: vilaj fanmi + fr: village familial + region_type: family + + - id: central_terminal + en: central terminal + region_type: tech + vn: phòng kỹ thuật + kre: sal ekipman + fr: le centre technique + + - id: playroom + en: playroom + kre: sal jé + fr: la salle de jeux + vn: phòng vui chơi + region_type: leisure + + - id: library + region_type: knowledge + en: library + kre: biblyotèk pèp + fr: bibliothèque + vn: thư viện + + - id: great-hall + region_type: lobby + kre: gwo sal + vn: sảnh lớn + fr: grand hall + en: great hall + +machines: + - id: cortex + name: cortex + ip: 192.168.27.69 + public_ip: 51.210.13.240 + provider: ovh + role: cerveau + domains: + - internal: cortex.home + - external: crenam.space + + - id: galerie + name: galerie + ip: 192.168.27.67 + public_ip: 37.187.32.116 + role: vitrine + domains: + - internal: galerie.home + + - id: salon + name: salon + ip: 192.168.1.15 + role: foyer + domains: + - internal: salon.home + + - id: gaufre + name: gaufre + ip: 192.168.1.30 + role: garde-manger + domains: + - internal: gaufre.home + + - id: yakimo + name: yakimo + ip: 192.168.1.20 + role: coffre-fort + domains: + - internal: yakimo.home + +services: + - id: affine + name: AFFiNE + machine_id: cortex + installation_mode: docker + auth: oidc + ports: + - 3010 + public_url: https://affine.crenam.space + internal_url: http://cortex.home:3010 + status: active + categories: + - productivity + dependencies: + - postgresql-shared + allowed_groups: + - nuji + - family + - friend + - admin + + - id: authelia + name: Authelia + machine_id: cortex + installation_mode: docker + ports: + - 9091 + public_url: https://auth.crenam.space + internal_url: http://cortex.home:9091 + status: inactive + categories: + - auth + allowed_groups: + - nuji + - family + - friend + - admin + + - id: aliasvault + name: Alias Vault + machine_id: salon + installation_mode: docker + auth: internal + ports: + - 8008 + - 8443 + - 25 + - 587 + public_url: https://aliasvault.crenam.space + internal_url: http://salon.home:8008 + status: active + categories: + - auth + allowed_groups: + - nuji + - family + - friend + - admin + + - id: beszel + name: beszel + machine_id: gaufre + auth: vpn + ports: + - 8090 + internal_url: http://gaufre.home:8090 + installation_mode: docker + status: active + categories: + - monitoring + allowed_groups: + - admin + + - id: borgbackup + name: Borg Backup + machine_id: yakimo + auth: none + installation_mode: native + status: active + categories: + - backup + allowed_groups: + - admin + + - id: firefly + name: firefly iii + machine_id: gaufre + installation_mode: docker + auth: vpn + ports: + - 8800 + - 8801 + internal_url: http://gaufre.home:8800 + status: active + categories: + - finance + allowed_groups: + - nuji + - admin + + - id: gitea + name: gitea + machine_id: salon + installation_mode: docker + auth: vpn + ports: + - 3000 + public_url: https://git.crenam.space + internal_url: http://salon.home:3000 + status: active + categories: + - dev + allowed_groups: + - nuji + - admin + + - id: homarr + name: homarr + machine_id: salon + auth: oidc + installation_mode: docker + ports: + - 7575 + public_url: https://dashboard.crenam.space + internal_url: http://salon.home:7575 + status: active + categories: + - monitoring + allowed_groups: + - nuji + - family + - friend + - admin + - guest + + - id: immich + name: immich + machine_id: gaufre + installation_mode: docker + auth: oidc + ports: + - 2283 + internal_url: http://gaufre.home:2283 + status: active + categories: + - media + allowed_groups: + - nuji + - family + - friend + - admin + + - id: jellyfin + name: jellyfin + machine_id: gaufre + installation_mode: docker + auth: oidc + ports: + - 8096 + - 7359 + internal_url: http://gaufre.home:8096 + status: active + categories: + - media + allowed_groups: + - nuji + - family + - friend + - admin + + - id: maurane + name: maurane's website + machine_id: galerie + installation_mode: native + ports: + - 8000 + internal_url: http://galerie.home:8000 + public_url: https://maurane.crenam.space + status: active + categories: + - media + - experimental + allowed_groups: + - guest + - nuji + - family + - friend + + - id: matrix + name: element server suite + machine_id: cortex + installation_mode: docker + auth: internal + ports: + - 80 + - 443 + - 30001 + - 30002 + internal_url: http://cortex.home:30001 + public_url: https://matrix.element.crenam.space + status: active + categories: + - communication + allowed_groups: + - nuji + - family + - friend + - admin + + - id: mealie + name: mealie + machine_id: gaufre + installation_mode: docker + auth: oidc + ports: + - 9925 + internal_url: http://gaufre.home:9925 + public_url: https://mealie.crenam.space + status: active + categories: + - storage + - productivity + allowed_groups: + - nuji + - family + - friend + - admin + + - id: n8n + name: n8n + machine_id: gaufre + installation_mode: docker + auth: vpn + ports: + - 5678 + internal_url: http://gaufre.home:5678 + status: active + categories: + - productivity + - automation + allowed_groups: + - nuji + - admin + + - id: ntfy + name: ntfy + machine_id: salon + installation_mode: docker + auth: vpn + ports: + - 810 + internal_url: http://salon.home:810 + status: active + categories: + - automation + allowed_groups: + - admin + + - id: openwebui + name: open web ui + auth: vpn # (oidc ?) + machine_id: cortex + installation_mode: docker + ports: + - 3000 + internal_url: http://cortex.home:3000 + public_url: https://llm.crenam.space + status: active + categories: + - ai + - productivity + allowed_groups: + - nuji + - admin + + - id: paperless + name: paperless-ngx + machine_id: salon + installation_mode: docker + auth: trusted headers + ports: + - 8101 + internal_url: http://salon.home:8101 + public_url: https://paperless.crenam.space + status: active + categories: + - storage + - productivity + allowed_groups: + - nuji + - admin + + - id: patience + name: patience + machine_id: galerie + installation_mode: native + ports: + - 8001 + internal_url: http://galerie.home:8001 + public_url: https://patience.crenam.space + status: active + categories: + - media + - experimental + - productivity + allowed_groups: + - guest + - nuji + - family + - friend + + - id: postgres-shared + name: PostgreSQL + machine_id: cortex + installation_mode: docker + auth: internal + ports: + - 5432 + internal_url: postgres://cortex.home:5432 + status: active + categories: + - database + allowed_groups: + - admin + + - id: pihole_main + name: pi-hole main + machine_id: salon + installation_mode: docker + auth: vpn + ports: + - 80 + internal_url: http://salon.home + status: active + categories: + - network + - monitoring + allowed_groups: + - admin + + - id: pihole_secondary + name: pi-hole secondary + machine_id: yakimo + installation_mode: native + auth: vpn + ports: + - 80 + internal_url: http://yakimo.home + status: planned + categories: + - network + - monitoring + allowed_groups: + - admin + + - id: radicale + name: radicale + machine_id: yakimo + installation_mode: native + auth: internal # how to sso + sharing collections ? + ports: + - 5232 + internal_url: http://yakimo.home:5232 + public_url: https://radicale.crenam.space + status: active + categories: + - caldav + - productivity + allowed_groups: + - admin + - nuji + - family + - friend + + - id: seafile + name: seafile + machine_id: gaufre + installation_mode: docker + auth: trusted headers + ports: + - 80 + - 8000 + - 8082 + internal_url: http://gaufre.home:80 + status: active + categories: + - storage + - media + allowed_groups: + - admin + - nuji + - friend + - family + + - id: uptime_kuma + name: uptime kuma + machine_id: salon + installation_mode: docker + auth: vpn + ports: + - 5232 + internal_url: http://salon.home:5232 + status: active + categories: + - monitoring + allowed_groups: + - admin + + - id: vikunja + name: vikunja + machine_id: gaufre + installation_mode: docker + auth: oidc + ports: + - 3456 + internal_url: http://gaufre.home:3456 + public_url: https://task.crenam.space + status: active + categories: + - productivity + allowed_groups: + - admin + - nuji + - family + - friend + +groups: + - id: admin + name: renn + group_description: Moi + region: central_terminal + + - id: nuji + name: nuji + group_description: couple fondateur + region: rooster_palace + + - id: family + name: làng fanmi + group_description: famille proche + region: family_village + + - id: friend + name: zanmi + group_description: amis de nuji + region: ambassadors_garden + + - id: guest + name: vakansyé + group_description: invités (accès limité) + region: great-hall + + +users: + - id: maurane + name: maurane + nickname: nuna + email: maurane.glaude@crenam.space + groups: + - admin + + - id: adrien + name: adrien + nickname: adri + email: adrien.ton@crenam.space + groups: + - nuji