Compare commits
3 Commits
21e1166556
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
 maurane
|
cd8396f763 | ||
|
maurane
|
7768703437 | ||
|
maurane
|
6ec4e8c5d6 |
Vendored
+222
@@ -0,0 +1,222 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://json-schema.org/draft-07/schema#",
|
||||||
|
"title": ".digital_hq",
|
||||||
|
"description": "My network's specification v0.1",
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"name": {"$ref": "#/$defs/name"},
|
||||||
|
"domain": {"$ref": "#/$defs/domain"},
|
||||||
|
"home_url": {
|
||||||
|
"description": "the first url to enter the network",
|
||||||
|
"$ref": "#/$defs/url"
|
||||||
|
},
|
||||||
|
"regions": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"$ref": "#/$defs/region"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
|
||||||
|
"machines": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"$ref": "#/$defs/machine"
|
||||||
|
},
|
||||||
|
"minItems": 1
|
||||||
|
},
|
||||||
|
|
||||||
|
"services": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"$ref": "#/$defs/service"
|
||||||
|
},
|
||||||
|
"minItems": 1
|
||||||
|
},
|
||||||
|
|
||||||
|
"groups": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"$ref": "#/$defs/group"
|
||||||
|
},
|
||||||
|
"minItems": 3
|
||||||
|
},
|
||||||
|
|
||||||
|
"users": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"$ref": "#/$defs/user"
|
||||||
|
},
|
||||||
|
"minItems": 1
|
||||||
|
}
|
||||||
|
},
|
||||||
|
|
||||||
|
"$defs": {
|
||||||
|
"id": {
|
||||||
|
"type": "string",
|
||||||
|
"examples": ["cortex", "maurane", "postgres-shared"]
|
||||||
|
},
|
||||||
|
|
||||||
|
"ip": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"
|
||||||
|
},
|
||||||
|
|
||||||
|
"name": {
|
||||||
|
"type": "string",
|
||||||
|
"examples": ["Maurane", "AFFiNE", "Gaufre"]
|
||||||
|
},
|
||||||
|
|
||||||
|
"domain": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-z]+\\.([a-z]*\\.)*[a-z]{2,10}"
|
||||||
|
},
|
||||||
|
|
||||||
|
"url": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^(https?|postgres)://[a-z0-9.-]+(\\.[a-z]{2,10})?(:[0-9]+)?(/.*)?$"
|
||||||
|
},
|
||||||
|
|
||||||
|
"email": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-z0-9-\\.]+@[a-z]+\\.[a-z]{2,10}"
|
||||||
|
},
|
||||||
|
|
||||||
|
"service": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"id": {"$ref": "#/$defs/id"},
|
||||||
|
"name": {"$ref": "#/$defs/name"},
|
||||||
|
"machine_id": {"$ref": "#/$defs/id"},
|
||||||
|
"ports": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "number",
|
||||||
|
"minimum": 1
|
||||||
|
},
|
||||||
|
"minItems": 1
|
||||||
|
},
|
||||||
|
"public_url": {"$ref": "#/$defs/url"},
|
||||||
|
"internal_url": {"$ref": "#/$defs/url"},
|
||||||
|
"status": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": ["active", "inactive", "planned", "wip" , "tested", "broken"]
|
||||||
|
},
|
||||||
|
"auth": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": ["session cookie", "trusted headers", "oidc", "vpn", "internal", "none"]
|
||||||
|
},
|
||||||
|
"installation_mode": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": ["docker", "native"]
|
||||||
|
},
|
||||||
|
"categories": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"enum": ["ai", "auth", "automation", "backup", "caldav", "communication", "database", "dev", "experimental", "finance", "media", "monitoring", "network", "productivity", "storage"]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"service_group": {
|
||||||
|
"enum": ["mandatory", "de-googling", "productivity", "account", "bonus"]
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {"$ref": "#/$defs/name"}
|
||||||
|
},
|
||||||
|
"allowed_groups": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {"$ref": "#/$defs/name"},
|
||||||
|
"minItems": 1
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"required": ["id", "name", "machine_id", "status", "allowed_groups"]
|
||||||
|
},
|
||||||
|
|
||||||
|
"machine": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"id": {"$ref": "#/$defs/id"},
|
||||||
|
"name": {"$ref": "#/$defs/name"},
|
||||||
|
"ip": {
|
||||||
|
"description": "private ip addresss of a server",
|
||||||
|
"$ref": "#/$defs/ip"
|
||||||
|
},
|
||||||
|
"public_ip": {
|
||||||
|
"description": "public ip address of a server",
|
||||||
|
"$ref": "#/$defs/ip"
|
||||||
|
},
|
||||||
|
"provider": {
|
||||||
|
"type": "string",
|
||||||
|
"enum": ["ovh", "hostinger", "aws", "hertzner"]
|
||||||
|
},
|
||||||
|
"role": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"domains": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"internal": {
|
||||||
|
"$ref": "#/$defs/domain"
|
||||||
|
},
|
||||||
|
"external": {
|
||||||
|
"$ref": "#/$defs/domain"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"minProperties": 1,
|
||||||
|
"maxProperties": 1,
|
||||||
|
"additionalProperties": false
|
||||||
|
},
|
||||||
|
"contains": {"required": ["internal"]},
|
||||||
|
"uniqueItems": true
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"required": ["id", "ip", "name", "domains"]
|
||||||
|
},
|
||||||
|
|
||||||
|
"region": {
|
||||||
|
"description": "sub part of the main digital hq land",
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"id": {"$ref": "#/$defs/id"},
|
||||||
|
"region_type": {"type": "string"},
|
||||||
|
"vn": {"type": "string"},
|
||||||
|
"fr": {"type": "string"},
|
||||||
|
"kre": {"type": "string"},
|
||||||
|
"en": {"type": "string"}
|
||||||
|
},
|
||||||
|
"required": ["id"]
|
||||||
|
},
|
||||||
|
|
||||||
|
"group": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"id": {"$ref": "#/$defs/id"},
|
||||||
|
"name": {"$ref": "#/$defs/name"},
|
||||||
|
"group_description": {"type": "string"},
|
||||||
|
"region": {"$ref": "#/$defs/name"}
|
||||||
|
},
|
||||||
|
"required": ["id", "name", "region"]
|
||||||
|
},
|
||||||
|
|
||||||
|
"user": {
|
||||||
|
"type": "object",
|
||||||
|
"properties": {
|
||||||
|
"id": {"$ref": "#/$defs/id"},
|
||||||
|
"name": {"$ref": "#/$defs/name"},
|
||||||
|
"nickname": {"$ref": "#/$defs/name"},
|
||||||
|
"email": {"$ref": "#/$defs/email"},
|
||||||
|
"groups": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"minItems": 1
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"required": ["id", "name", "groups", "email"]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
|
||||||
|
"additionalProperties": false
|
||||||
|
}
|
||||||
Vendored
+6
@@ -0,0 +1,6 @@
|
|||||||
|
{
|
||||||
|
"yaml.schemas": {
|
||||||
|
"file:///home/maurane/Projets/homelab/.vscode/homelab.json": "file:///home/maurane/Projets/homelab/services.yml"
|
||||||
|
},
|
||||||
|
"yaml.disableSchemaDetection": [],
|
||||||
|
}
|
||||||
@@ -0,0 +1,162 @@
|
|||||||
|
theme: grey
|
||||||
|
|
||||||
|
log:
|
||||||
|
file_path: /config/authelia.log
|
||||||
|
keep_stdout: true
|
||||||
|
|
||||||
|
# Stockage (fichier SQLite local) – suffisant pour commencer
|
||||||
|
storage:
|
||||||
|
local:
|
||||||
|
path: /config/db.sqlite3
|
||||||
|
|
||||||
|
# Base de données des utilisateurs (fichier)
|
||||||
|
authentication_backend:
|
||||||
|
file:
|
||||||
|
path: /config/users.yml
|
||||||
|
|
||||||
|
# Accès par défaut (à ajuster selon tes besoins)
|
||||||
|
access_control:
|
||||||
|
default_policy: 'one_factor'
|
||||||
|
rules:
|
||||||
|
- domain:
|
||||||
|
- "paperless.crenam.space"
|
||||||
|
- "git.crenam.space"
|
||||||
|
- "task.crenam.space"
|
||||||
|
- "seafile.crenam.space"
|
||||||
|
policy: one_factor
|
||||||
|
|
||||||
|
# Session et cookie
|
||||||
|
session:
|
||||||
|
cookies:
|
||||||
|
- name: authelia_session
|
||||||
|
domain: crenam.space
|
||||||
|
authelia_url: "https://auth.crenam.space"
|
||||||
|
default_redirection_url: "https://dashboard.crenam.space"
|
||||||
|
expiration: "16h"
|
||||||
|
remember_me: "1 month"
|
||||||
|
# sercret
|
||||||
|
|
||||||
|
# Notifications (par mail – on laisse vide pour le moment, pas de SMTP)
|
||||||
|
notifier:
|
||||||
|
disable_startup_check: true
|
||||||
|
filesystem:
|
||||||
|
filename: /config/notifications.yml
|
||||||
|
|
||||||
|
# ban regulation if attempt to penetrate the network without authorization
|
||||||
|
regulation:
|
||||||
|
modes:
|
||||||
|
- "user"
|
||||||
|
max_retries: 5
|
||||||
|
ban_time: '10m'
|
||||||
|
find_time: '2m'
|
||||||
|
|
||||||
|
# identity_validation:
|
||||||
|
|
||||||
|
# definitions:
|
||||||
|
# user_attributes:
|
||||||
|
# username
|
||||||
|
# email
|
||||||
|
# nickname
|
||||||
|
|
||||||
|
# if needed, it will be lldap
|
||||||
|
# ldap: http://localhost:111
|
||||||
|
#
|
||||||
|
|
||||||
|
# identity_providers:
|
||||||
|
# oidc:
|
||||||
|
# # hmac secret is used for OAuth2 tokens
|
||||||
|
# hmac_secret:
|
||||||
|
|
||||||
|
# # jwks issuer is needed to configure multiple jwk. Must be based on RS256 algorithm
|
||||||
|
# # or on 2048 bit RSA/PA key
|
||||||
|
# jwks:
|
||||||
|
# # recommended not to configure this
|
||||||
|
# - key_id: {{ secret "/secrets/private.pem" | mindent 10 "|" | msquote }}
|
||||||
|
# # key algorithm
|
||||||
|
# algorithm: "RS256"
|
||||||
|
# use: "sig"
|
||||||
|
# key: |
|
||||||
|
# -----BEGIN PRIVATE KEY-----
|
||||||
|
# -----END PRIVATE KEY-----
|
||||||
|
# # Optionnally matchin certificate in PEM DER form
|
||||||
|
# certificate_chain: {{ secret "/secrets/public.crt" | mindent 10 "|" | msquote }}
|
||||||
|
|
||||||
|
# # the signing algorithm used for signing discovery and metdata responses
|
||||||
|
# # most client ignore this so set it to none
|
||||||
|
# discovery_signed_response_alg: 'none'
|
||||||
|
|
||||||
|
# # the signing key used for signing discovery and metdata responses
|
||||||
|
# # most client ignore this so set it to ''
|
||||||
|
# discovery_signed_response_key_id: ''
|
||||||
|
|
||||||
|
# # authorization policies
|
||||||
|
# authorization_policy:
|
||||||
|
# policy_name:
|
||||||
|
# default_policy: 'two_factor'
|
||||||
|
# rules:
|
||||||
|
# - policy: 'one_factor'
|
||||||
|
# subject: 'group:services'
|
||||||
|
|
||||||
|
# clients:
|
||||||
|
#########################################
|
||||||
|
# sso configuration for vikunja #
|
||||||
|
#########################################
|
||||||
|
# - client_id: 'vikunja'
|
||||||
|
# client_name: 'Vikunja'
|
||||||
|
# # generated with
|
||||||
|
# client_secret: '$pbkdf2-sha512$310000$hPnUYU6BCaRSZYulOiWXwA$5hsAJD494cyoQ/X9JlAbsMF//yGDg009lfDe2WhGQ>
|
||||||
|
# public: false
|
||||||
|
# redirect_uris:
|
||||||
|
# - 'https://task.crenam.space/auth/openid/authelia'
|
||||||
|
# - 'https://task.crenam.space/login?redirectToProvider=authentik'
|
||||||
|
#
|
||||||
|
# # audience this client is allowed to request
|
||||||
|
# audience: []
|
||||||
|
# # scopes this client is allowed to request
|
||||||
|
# scopes:
|
||||||
|
# -
|
||||||
|
#
|
||||||
|
# # list of response modes the client support
|
||||||
|
# response_modes:
|
||||||
|
# - 'form_post'
|
||||||
|
# - 'query'
|
||||||
|
# # the policy required for this client
|
||||||
|
# # can also be the key names fot eh authorization policies section
|
||||||
|
# authorization_policy: 'one_factor'
|
||||||
|
# require_pkce: false
|
||||||
|
# pkce_challenge_method: ''
|
||||||
|
# scopes:
|
||||||
|
# - 'openid'
|
||||||
|
# - 'profile'
|
||||||
|
# - 'email'
|
||||||
|
# response_types:
|
||||||
|
# - 'code'
|
||||||
|
# grant_types:
|
||||||
|
# - 'authorization_code'
|
||||||
|
# access_token_signed_response_alg: 'none'
|
||||||
|
# userinfo_signed_response_alg: 'none'
|
||||||
|
# token_endpoint_auth_method: 'client_secret_post'
|
||||||
|
|
||||||
|
#########################################
|
||||||
|
# config sso for gitea #
|
||||||
|
#########################################
|
||||||
|
# - client_id: 'gitea'
|
||||||
|
# client_name: 'Gitea'
|
||||||
|
# client_secret: '$pbkdf2-sha512$310000$pJR7colZSiWF7SWIfUsoqg$IGGqIZGVqcpXpzVCBgptZ3zBMqpFk4oaIKvOZPa1f>
|
||||||
|
# public: false
|
||||||
|
# authorization_policy: 'one_factor'
|
||||||
|
# require_pkce: false
|
||||||
|
# pkce_challenge_method: ''
|
||||||
|
# redirect_uris:
|
||||||
|
# - 'https://git.crenam.space/user/oauth2/authelia/callback'
|
||||||
|
# scopes:
|
||||||
|
# - 'openid'
|
||||||
|
# - 'email'
|
||||||
|
# - 'profile'
|
||||||
|
# response_types:
|
||||||
|
# - 'code'
|
||||||
|
# grant_types:
|
||||||
|
# - 'authorization_code'
|
||||||
|
# access_token_signed_response_alg: 'none'
|
||||||
|
# userinfo_signed_response_alg: 'none'
|
||||||
|
# token_endpoint_auth_method: 'client_secret_basic'
|
||||||
@@ -0,0 +1,392 @@
|
|||||||
|
# Firefly Data Importer (FIDI) configuration file
|
||||||
|
|
||||||
|
# Where is Firefly III?
|
||||||
|
#
|
||||||
|
# 1) Make sure you ADD http:// or https://
|
||||||
|
# 2) Make sure you REMOVE any trailing slash from the end of the URL.
|
||||||
|
# 3) In case of Docker, refer to the internal IP of your Firefly III installation.
|
||||||
|
#
|
||||||
|
# Setting this value is not mandatory. But it is very useful.
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
FIREFLY_III_URL=http://app:8080
|
||||||
|
|
||||||
|
#
|
||||||
|
# Imagine Firefly III can be reached at "http://172.16.0.2:8082" (internal Docker network or something).
|
||||||
|
# But you have a fancy URL: "https://personal-finances.bill.microsoft.com/"
|
||||||
|
#
|
||||||
|
# In those cases, you can overrule the URL so when the data importer links back to Firefly III, it uses the correct URL.
|
||||||
|
#
|
||||||
|
# 1) Make sure you ADD http:// or https://
|
||||||
|
# 2) Make sure you REMOVE any trailing slash from the end of the URL.
|
||||||
|
#
|
||||||
|
# IF YOU SET THIS VALUE, YOU MUST ALSO SET THE FIREFLY_III_URL
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
VANITY_URL=http://gaufre.home:8800
|
||||||
|
|
||||||
|
#
|
||||||
|
# Set your Firefly III Personal Access Token (OAuth)
|
||||||
|
# You can create a Personal Access Token on the /profile/oauth page:
|
||||||
|
# go to the "Remote access and tokens" page, then Personal Access Token and "Create new token".
|
||||||
|
#
|
||||||
|
# - Do not use the "command line token". That's the WRONG one.
|
||||||
|
# - Do not use "APP_KEY" value from your Firefly III installation. That's the WRONG one.
|
||||||
|
#
|
||||||
|
# Setting this value is not mandatory. Instructions will follow if you omit this field.
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
FIREFLY_III_ACCESS_TOKEN= # à faire une fois firefly lancé
|
||||||
|
|
||||||
|
#
|
||||||
|
# You can also use a public client ID. This is available in Firefly III 5.4.0-alpha.3 and higher.
|
||||||
|
# This is a number (1, 2, 3). If you use the client ID, you can leave the access token empty and vice versa.
|
||||||
|
#
|
||||||
|
# This value is not mandatory to set. Instructions will follow if you omit this field.
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
FIREFLY_III_CLIENT_ID=
|
||||||
|
|
||||||
|
#
|
||||||
|
# Lunch Flow
|
||||||
|
#
|
||||||
|
LUNCH_FLOW_API_KEY=
|
||||||
|
|
||||||
|
#
|
||||||
|
# Unless you know what you are doing, please do not change this.
|
||||||
|
#
|
||||||
|
LUNCH_FLOW_API_URL=https://lunchflow.app/api/v1/
|
||||||
|
|
||||||
|
#
|
||||||
|
# Sophtron
|
||||||
|
#
|
||||||
|
SOPHTRON_USER_ID=
|
||||||
|
SOPHTRON_ACCESS_KEY=
|
||||||
|
SOPHTRON_SANDBOX=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# GoCardless information.
|
||||||
|
# The key and ID can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
NORDIGEN_ID=
|
||||||
|
NORDIGEN_KEY=
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you want to use the GoCardless sandbox, set this to true.
|
||||||
|
#
|
||||||
|
NORDIGEN_SANDBOX=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# GoCardless has a rate limit in place. The data importer can wait it out, or exit.
|
||||||
|
# Valid values are "wait" or "exit"
|
||||||
|
#
|
||||||
|
RESPOND_TO_GOCARDLESS_LIMIT=wait
|
||||||
|
|
||||||
|
#
|
||||||
|
# The data importer collects account details, which are currently unused.
|
||||||
|
# This is disabled, since it costs a lot of API calls.
|
||||||
|
# You can enable it if you want to.
|
||||||
|
#
|
||||||
|
GOCARDLESS_GET_ACCOUNT_DETAILS=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# The data importer also collects balances, which can be used for (manual)
|
||||||
|
# balance verification ("did the import go well?").
|
||||||
|
# This is disabled by default, since it costs a lot of API calls.
|
||||||
|
# You can enable it if you want to.
|
||||||
|
#
|
||||||
|
GOCARDLESS_GET_BALANCE_DETAILS=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# Locale information.
|
||||||
|
# Set this to your locale. It is used during CSV imports to parse amounts.
|
||||||
|
#
|
||||||
|
FALLBACK_LOCALE=en_US
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# Enable Banking
|
||||||
|
#
|
||||||
|
# The application ID and private key can be set from a file if you append it with _FILE
|
||||||
|
ENABLE_BANKING_APP_ID=
|
||||||
|
ENABLE_BANKING_PRIVATE_KEY=
|
||||||
|
|
||||||
|
#
|
||||||
|
# If your bank requires a special "PSU-IP-Address" header, set the following variable
|
||||||
|
# to true instead of false.
|
||||||
|
#
|
||||||
|
ENABLE_BANKING_IMPORT_IP_HEADER=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# Your external IP must be filled in here.
|
||||||
|
# If you use "autodetect", the data importer will detect it for you.
|
||||||
|
#
|
||||||
|
# If you leave the default value it will NOT work. Either fill in your actual IP or set it to "autodetect"
|
||||||
|
#
|
||||||
|
# THE DATA IMPORTER WILL USE AN EXTERNAL SERVICE TO DO AUTO DETECTION (icanhazip.com).
|
||||||
|
#
|
||||||
|
ENABLE_BANKING_IMPORT_IP=127.0.0.1
|
||||||
|
|
||||||
|
#
|
||||||
|
# Spectre information
|
||||||
|
#
|
||||||
|
# The ID and secret can be set from a file if you append it with _FILE
|
||||||
|
SPECTRE_APP_ID=
|
||||||
|
SPECTRE_SECRET=
|
||||||
|
|
||||||
|
#
|
||||||
|
# SimpleFIN settings
|
||||||
|
#
|
||||||
|
|
||||||
|
# SimpleFIN Bridge Configuration
|
||||||
|
SIMPLEFIN_TOKEN=
|
||||||
|
|
||||||
|
#
|
||||||
|
# Which demo environment to connect to.
|
||||||
|
#
|
||||||
|
SIMPLEFIN_DEMO_URL=
|
||||||
|
SIMPLEFIN_DEMO_TOKEN=
|
||||||
|
|
||||||
|
#
|
||||||
|
# Connection settings.
|
||||||
|
# As a rule, if you need to set larger timeout values, it will not solve the issue.
|
||||||
|
#
|
||||||
|
SIMPLEFIN_CONNECTION_TIMEOUT=30
|
||||||
|
SIMPLEFIN_REQUEST_TIMEOUT=60
|
||||||
|
SIMPLEFIN_RETRY_ATTEMPTS=3
|
||||||
|
# delay in seconds between retries
|
||||||
|
SIMPLEFIN_RETRY_DELAY=
|
||||||
|
|
||||||
|
#
|
||||||
|
# Import size settings.
|
||||||
|
#
|
||||||
|
SIMPLEFIN_MAX_TRANSACTIONS=10000
|
||||||
|
SIMPLEFIN_DEFAULT_DATE_RANGE=90
|
||||||
|
SIMPLEFIN_ENABLE_CACHING=true
|
||||||
|
# In seconds
|
||||||
|
SIMPLEFIN_CACHE_DURATION=3600
|
||||||
|
|
||||||
|
#
|
||||||
|
# Smart expense matching settings.
|
||||||
|
#
|
||||||
|
SIMPLEFIN_SMART_EXPENSE_MATCHING=true
|
||||||
|
SIMPLEFIN_EXPENSE_MATCHING_THRESHOLD=0.7
|
||||||
|
SIMPLEFIN_AUTO_CREATE_EXPENSE_ACCOUNTS=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# Transaction clustering settings.
|
||||||
|
#
|
||||||
|
SIMPLEFIN_ENABLE_TRANSACTION_CLUSTERING=true
|
||||||
|
SIMPLEFIN_CLUSTERING_SIMILARITY_THRESHOLD=0.7
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# Use cache. No need to do this.
|
||||||
|
#
|
||||||
|
USE_CACHE=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# If set to true, the data import will not complain about running into duplicates.
|
||||||
|
# This will give you cleaner import mails if you run regular imports.
|
||||||
|
#
|
||||||
|
# This means that the data importer will not import duplicates, but it will not complain about them either.
|
||||||
|
#
|
||||||
|
# This setting has no influence on the settings in your configuration(.json).
|
||||||
|
#
|
||||||
|
# Of course, if something goes wrong *because* the transaction is a duplicate you will
|
||||||
|
# NEVER know unless you start digging in your log files. So be careful with this.
|
||||||
|
#
|
||||||
|
IGNORE_DUPLICATE_ERRORS=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you set this to true, the importer will not complain about transactions that can't be found after they've
|
||||||
|
# been imported. This happens when rule on the Firefly III side deletes the transaction immediately after creating it.
|
||||||
|
# This can be useful when you have a rule that immediately deletes GoCardless' "pending" transactions. Setting this
|
||||||
|
# to true reduces some noise.
|
||||||
|
#
|
||||||
|
IGNORE_NOT_FOUND_TRANSACTIONS=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# Auto import settings. Due to security constraints, you MUST enable each feature individually.
|
||||||
|
# You must also set a secret. The secret is used for the web routes.
|
||||||
|
#
|
||||||
|
# The auto-import secret must be a string of at least 16 characters.
|
||||||
|
# Visit this page for inspiration: https://www.random.org/passwords/?num=1&len=16&format=html&rnd=new
|
||||||
|
#
|
||||||
|
# Submit it using ?secret=X
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
AUTO_IMPORT_SECRET=qtyrNFCbe4Jawyda
|
||||||
|
|
||||||
|
#
|
||||||
|
# Is the /autoimport even endpoint enabled?
|
||||||
|
# By default it's disabled, and the secret alone will not enable it.
|
||||||
|
#
|
||||||
|
CAN_POST_AUTOIMPORT=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# Is the /autoupload endpoint enabled?
|
||||||
|
# By default it's disabled, and the secret alone will not enable it.
|
||||||
|
#
|
||||||
|
CAN_POST_FILES=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# Import directory white list. You need to set this before the auto importer will accept a directory to import from.
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
IMPORT_DIR_ALLOWLIST=
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you import from a directory, you can save a fallback configuration file in the directory.
|
||||||
|
# This file must be called "_fallback.json" and will be used when your CSV or CAMT.053 file is not accompanied
|
||||||
|
# by a configuration file.
|
||||||
|
#
|
||||||
|
# This fallback configuration will only be used if this variable is set to true.
|
||||||
|
# https://docs.firefly-iii.org/how-to/data-importer/advanced/post/#importing-a-local-directory
|
||||||
|
#
|
||||||
|
FALLBACK_IN_DIR=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# When you're running Firefly III under a (self-signed) certificate,
|
||||||
|
# the data importer may have trouble verifying the TLS connection.
|
||||||
|
#
|
||||||
|
# You have a few options to make sure the data importer can connect
|
||||||
|
# to Firefly III:
|
||||||
|
# - 'true': will verify all certificates. The most secure option and the default.
|
||||||
|
# - 'file.pem': refer to a file (you must provide it) to your custom root or intermediate certificates.
|
||||||
|
# - 'false': will verify NO certificates. Not very secure.
|
||||||
|
VERIFY_TLS_SECURITY=true
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you want, you can set a directory here where the data importer will look for import configurations.
|
||||||
|
# This is a separate setting from the /import directory that the auto-import uses.
|
||||||
|
# Setting this variable isn't necessary. The default value is "storage/configurations".
|
||||||
|
#
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
#
|
||||||
|
JSON_CONFIGURATION_DIR= # à voir plus tard
|
||||||
|
|
||||||
|
#
|
||||||
|
# Time out when connecting with Firefly III.
|
||||||
|
# π*10 seconds is usually fine.
|
||||||
|
#
|
||||||
|
CONNECTION_TIMEOUT=31.41
|
||||||
|
|
||||||
|
# The following variables can be useful when debugging the application
|
||||||
|
APP_ENV=local
|
||||||
|
APP_DEBUG=false
|
||||||
|
LOG_CHANNEL=stack
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you turn this on, expect massive logs with lots of privacy sensitive data
|
||||||
|
#
|
||||||
|
LOG_RETURN_JSON=false
|
||||||
|
|
||||||
|
# Log level. You can set this from least severe to most severe:
|
||||||
|
# debug, info, notice, warning, error, critical, alert, emergency
|
||||||
|
# If you set it to debug your logs will grow large, and fast. If you set it to emergency probably
|
||||||
|
# nothing will get logged, ever.
|
||||||
|
LOG_LEVEL=debug
|
||||||
|
|
||||||
|
# TRUSTED_PROXIES is a useful variable when using Docker and/or a reverse proxy.
|
||||||
|
# Set it to ** and reverse proxies work just fine.
|
||||||
|
TRUSTED_PROXIES=**
|
||||||
|
|
||||||
|
#
|
||||||
|
# Time zone
|
||||||
|
#
|
||||||
|
TZ=Europe/Paris
|
||||||
|
|
||||||
|
#
|
||||||
|
# Email settings.
|
||||||
|
# The data importer can send you a message with all errors, warnings and messages
|
||||||
|
# after a successful import. This is disabled by default
|
||||||
|
#
|
||||||
|
ENABLE_MAIL_REPORT=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# Force Firefly III URL to be secure?
|
||||||
|
#
|
||||||
|
#
|
||||||
|
EXPECT_SECURE_URL=false
|
||||||
|
|
||||||
|
#
|
||||||
|
# Use fake data instead of real data. I use this when developing.
|
||||||
|
#
|
||||||
|
FAKE_DATA=false
|
||||||
|
|
||||||
|
# If enabled, define which mailer you want to use.
|
||||||
|
# Options include: smtp, mailgun, postmark, sendmail, log, array
|
||||||
|
# Amazon SES is not supported.
|
||||||
|
# log = drop mails in the logs instead of sending them
|
||||||
|
# array = debug mailer that does nothing.
|
||||||
|
MAIL_MAILER=
|
||||||
|
|
||||||
|
# where to send the report?
|
||||||
|
# This variable can be set from a file if you append it with _FILE
|
||||||
|
MAIL_DESTINATION=noreply@example.com
|
||||||
|
|
||||||
|
# other mail settings
|
||||||
|
# These variables can be set from a file if you append it with _FILE
|
||||||
|
MAIL_FROM_ADDRESS=admin@crenam.space
|
||||||
|
MAIL_HOST=smtp.mail.ovh.net
|
||||||
|
MAIL_PORT=587
|
||||||
|
MAIL_USERNAME=admin@crenam.space
|
||||||
|
MAIL_PASSWORD=qjKKZZpuS3cYWtyFShgN
|
||||||
|
MAIL_ENCRYPTION=null
|
||||||
|
|
||||||
|
# Extra settings depending on your mail configuration above.
|
||||||
|
# These variables can be set from a file if you append it with _FILE
|
||||||
|
MAILGUN_DOMAIN=
|
||||||
|
MAILGUN_SECRET=
|
||||||
|
MAILGUN_ENDPOINT=
|
||||||
|
POSTMARK_TOKEN=
|
||||||
|
|
||||||
|
#
|
||||||
|
# You probably won't need to change these settings.
|
||||||
|
#
|
||||||
|
BROADCAST_DRIVER=log
|
||||||
|
CACHE_DRIVER=file
|
||||||
|
QUEUE_CONNECTION=sync
|
||||||
|
SESSION_DRIVER=file
|
||||||
|
SESSION_LIFETIME=120
|
||||||
|
IS_EXTERNAL=false
|
||||||
|
|
||||||
|
REDIS_HOST=redis
|
||||||
|
REDIS_PASSWORD=null
|
||||||
|
REDIS_PORT=6379
|
||||||
|
|
||||||
|
# always use quotes
|
||||||
|
REDIS_DB="0"
|
||||||
|
REDIS_CACHE_DB="1"
|
||||||
|
|
||||||
|
#
|
||||||
|
# Use ASSET_URL when your data importer webpages are served from a URL with a subfolder path
|
||||||
|
# This pre-appends the subfolder path in front of URLs for browser-side assets such as CSS Files.
|
||||||
|
# Example: If your webserver (i.e. NGINX) is configured to serve the data importer webpages from
|
||||||
|
# http://localhost/ff3di, set ASSET_URL = /ff3di
|
||||||
|
# and it will pre-append that value to any requests for browser-side assets
|
||||||
|
# 1) Make sure you REMOVE any trailing slash from the end of the URL.
|
||||||
|
#
|
||||||
|
ASSET_URL=
|
||||||
|
|
||||||
|
# The only tracker supported is Matomo.
|
||||||
|
# This is used on the public instance over at https://data-importer.firefly-iii.org
|
||||||
|
TRACKER_SITE_ID=
|
||||||
|
TRACKER_URL=
|
||||||
|
|
||||||
|
APP_NAME=DataImporter
|
||||||
|
|
||||||
|
#
|
||||||
|
# The APP_URL environment variable is NOT used anywhere.
|
||||||
|
# Don't bother setting it to fix your reverse proxy problems. It won't help.
|
||||||
|
# Don't open issues telling me it doesn't help because it's not supposed to.
|
||||||
|
# Laravel uses this to generate links on the command line, which is a feature the data importer does not use.
|
||||||
|
#
|
||||||
|
APP_URL=http://gaufre.home:8801
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
services:
|
||||||
|
app:
|
||||||
|
image: fireflyiii/core:latest
|
||||||
|
hostname: app
|
||||||
|
container_name: firefly_iii_core
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- /srv/homelab/firefly/data:/var/www/html/storage/upload
|
||||||
|
env_file: .env
|
||||||
|
ports:
|
||||||
|
- "8800:8080"
|
||||||
|
cron:
|
||||||
|
#
|
||||||
|
# To make this work, set STATIC_CRON_TOKEN in your .env file or as an environment variable
|
||||||
|
# The STATIC_CRON_TOKEN must be *exactly* 32 characters long
|
||||||
|
# Use this URL for inspiration: https://www.random.org/strings/?num=1&len=32&digits=on&upperalpha=on&loweralpha=on&unique=on&format=html&rnd=new
|
||||||
|
#
|
||||||
|
image: alpine
|
||||||
|
restart: always
|
||||||
|
container_name: firefly_iii_cron
|
||||||
|
env_file: .env
|
||||||
|
command: ["sh", "-c", "apk add tzdata && \
|
||||||
|
(ln -s /usr/share/zoneinfo/$$TZ /etc/localtime || true) && \
|
||||||
|
echo \"0 3 * * * wget -qO- http://app:8080/api/v1/cron/$$STATIC_CRON_TOKEN;echo\" \
|
||||||
|
| crontab - && \
|
||||||
|
crond -f -L /dev/stdout"]
|
||||||
|
depends_on:
|
||||||
|
- app
|
||||||
|
|
||||||
|
redis:
|
||||||
|
image: redis:7-alpine
|
||||||
|
container_name: firefly_iii_redis
|
||||||
|
restart: always
|
||||||
|
|
||||||
|
importer:
|
||||||
|
image: fireflyiii/data-importer:latest
|
||||||
|
hostname: importer
|
||||||
|
restart: always
|
||||||
|
container_name: firefly_iii_importer
|
||||||
|
ports:
|
||||||
|
- '8801:8080'
|
||||||
|
depends_on:
|
||||||
|
- app
|
||||||
|
env_file: .importer.env
|
||||||
|
volumes:
|
||||||
|
- /mnt/freebox:/import
|
||||||
@@ -0,0 +1,53 @@
|
|||||||
|
server {
|
||||||
|
if ($host = www.affine.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = affine.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name affine.crenam.space www.affine.crenam.space;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name affine.crenam.space www.affine.crenam.space;
|
||||||
|
ssl_certificate /etc/letsencrypt/live/affine.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/affine.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
|
||||||
|
# Maximum allowed upload size.
|
||||||
|
client_max_body_size 100m;
|
||||||
|
|
||||||
|
# Set required headers.
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
# WebSocket config for the sync system.
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
# to add to configs for sso auth
|
||||||
|
# include /etc/nginx/snippets/authelia-verify.conf;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
# to add to configs for sso auth
|
||||||
|
# include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||||
|
proxy_pass http://localhost:3010;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
server {
|
||||||
|
if ($host = aliasvault.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name aliasvault.crenam.space;
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name aliasvault.crenam.space;
|
||||||
|
|
||||||
|
client_max_body_size 100m;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://192.168.1.15:8008;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto https;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_read_timeout 86400;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/aliasvault.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/aliasvault.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
server {
|
||||||
|
if ($host = auth.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name auth.crenam.space;
|
||||||
|
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name auth.crenam.space;
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/auth.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/auth.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
|
||||||
|
set $upstream http://192.168.27.69:9091;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
include /etc/nginx/snippets/proxy.conf;
|
||||||
|
proxy_pass $upstream;
|
||||||
|
proxy_cache_bypass $cookie_session;
|
||||||
|
proxy_no_cache $cookie_session;
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,91 @@
|
|||||||
|
##
|
||||||
|
# You should look at the following URL's in order to grasp a solid understanding
|
||||||
|
# of Nginx configuration files in order to fully unleash the power of Nginx.
|
||||||
|
# https://www.nginx.com/resources/wiki/start/
|
||||||
|
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
||||||
|
# https://wiki.debian.org/Nginx/DirectoryStructure
|
||||||
|
#
|
||||||
|
# In most cases, administrators will remove this file from sites-enabled/ and
|
||||||
|
# leave it as reference inside of sites-available where it will continue to be
|
||||||
|
# updated by the nginx packaging team.
|
||||||
|
#
|
||||||
|
# This file will automatically load configuration files provided by other
|
||||||
|
# applications, such as Drupal or Wordpress. These applications will be made
|
||||||
|
# available underneath a path with that package name, such as /drupal8.
|
||||||
|
#
|
||||||
|
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
||||||
|
##
|
||||||
|
|
||||||
|
# Default server configuration
|
||||||
|
#
|
||||||
|
server {
|
||||||
|
listen 80 default_server;
|
||||||
|
listen [::]:80 default_server;
|
||||||
|
|
||||||
|
# SSL configuration
|
||||||
|
#
|
||||||
|
# listen 443 ssl default_server;
|
||||||
|
# listen [::]:443 ssl default_server;
|
||||||
|
#
|
||||||
|
# Note: You should disable gzip for SSL traffic.
|
||||||
|
# See: https://bugs.debian.org/773332
|
||||||
|
#
|
||||||
|
# Read up on ssl_ciphers to ensure a secure configuration.
|
||||||
|
# See: https://bugs.debian.org/765782
|
||||||
|
#
|
||||||
|
# Self signed certs generated by the ssl-cert package
|
||||||
|
# Don't use them in a production server!
|
||||||
|
#
|
||||||
|
# include snippets/snakeoil.conf;
|
||||||
|
|
||||||
|
root /var/www/html;
|
||||||
|
|
||||||
|
# Add index.php to the list if you are using PHP
|
||||||
|
index index.html index.htm index.nginx-debian.html;
|
||||||
|
|
||||||
|
server_name _;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
# First attempt to serve request as file, then
|
||||||
|
# as directory, then fall back to displaying a 404.
|
||||||
|
try_files $uri $uri/ =404;
|
||||||
|
}
|
||||||
|
|
||||||
|
# pass PHP scripts to FastCGI server
|
||||||
|
#
|
||||||
|
#location ~ \.php$ {
|
||||||
|
# include snippets/fastcgi-php.conf;
|
||||||
|
#
|
||||||
|
# # With php-fpm (or other unix sockets):
|
||||||
|
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
|
||||||
|
# # With php-cgi (or other tcp sockets):
|
||||||
|
# fastcgi_pass 127.0.0.1:9000;
|
||||||
|
#}
|
||||||
|
|
||||||
|
# deny access to .htaccess files, if Apache's document root
|
||||||
|
# concurs with nginx's one
|
||||||
|
#
|
||||||
|
#location ~ /\.ht {
|
||||||
|
# deny all;
|
||||||
|
#}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Virtual Host configuration for example.com
|
||||||
|
#
|
||||||
|
# You can move that to a different file under sites-available/ and symlink that
|
||||||
|
# to sites-enabled/ to enable it.
|
||||||
|
#
|
||||||
|
#server {
|
||||||
|
# listen 80;
|
||||||
|
# listen [::]:80;
|
||||||
|
#
|
||||||
|
# server_name example.com;
|
||||||
|
#
|
||||||
|
# root /var/www/example.com;
|
||||||
|
# index index.html;
|
||||||
|
#
|
||||||
|
# location / {
|
||||||
|
# try_files $uri $uri/ =404;
|
||||||
|
# }
|
||||||
|
#}
|
||||||
+53
@@ -0,0 +1,53 @@
|
|||||||
|
server {
|
||||||
|
if ($host = www.git.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = git.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name git.crenam.space www.git.crenam.space;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
return 301 https://git.crenam.space$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name git.crenam.space www.git.crenam.space;
|
||||||
|
|
||||||
|
# ---------- Authelia ----------
|
||||||
|
# include /etc/nginx/snippets/authelia-verify.conf;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
client_max_body_size 512M;
|
||||||
|
|
||||||
|
# include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||||
|
|
||||||
|
# auth_request_set $auth_user $upstream_http_remote_user;
|
||||||
|
# proxy_set_header X-Webauth-user $auth_user;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.15:3000;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Connection $http_connection;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/git.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/git.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
server {
|
||||||
|
if ($host = www.dashboard.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = dashboard.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name dashboard.crenam.space www.dashboard.crenam.space;
|
||||||
|
return 301 https://dashboard.crenam.space$request_uri;
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name dashboard.crenam.space www.dashboard.crenam.space;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://192.168.1.15:7575;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/dashboard.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/dashboard.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,81 @@
|
|||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
|
||||||
|
access_log /var/log/nginx/ess.log;
|
||||||
|
error_log /var/log/nginx/ess.errors;
|
||||||
|
ssl_certificate /etc/letsencrypt/live/ess/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/ess/privkey.pem; # managed by Certbot
|
||||||
|
|
||||||
|
#TLSv1.2 is required for iOS support for now
|
||||||
|
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||||
|
ssl_session_cache shared:le_nginx_SSL:10m;
|
||||||
|
ssl_session_timeout 1440m;
|
||||||
|
ssl_session_tickets off;
|
||||||
|
ssl_buffer_size 4k;
|
||||||
|
# ssl_stapling on;
|
||||||
|
# ssl_stapling_verify on;
|
||||||
|
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
|
||||||
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
|
||||||
|
|
||||||
|
server_name admin.element.crenam.space chat.element.crenam.space matrix.element.crenam.space account.element.crenam.space mrtc.element.crenam.space element.crenam.space;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:8080;
|
||||||
|
proxy_set_header X-Forwarded-For $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
|
||||||
|
client_max_body_size 50M;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_read_timeout 86400s;
|
||||||
|
proxy_send_timeout 86400s;
|
||||||
|
proxy_buffering off;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
if ($host = element.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = admin.element.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = chat.element.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = mrtc.element.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = account.element.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = matrix.element.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name admin.element.crenam.space chat.element.crenam.space matrix.element.crenam.space account.element.crenam.space mrtc.element.crenam.space element.crenam.space;
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name mealie.crenam.space;
|
||||||
|
|
||||||
|
if ($host = mealie.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name mealie.crenam.space;
|
||||||
|
|
||||||
|
# En-têtes de sécurité
|
||||||
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||||
|
add_header X-Content-Type-Options "nosniff" always;
|
||||||
|
add_header X-XSS-Protection "1; mode=block" always;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://192.168.1.30:9925;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
# Désactiver le buffering pour WebSocket si besoin (Mealie ne semble pas en avoir besoin)
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/mealie.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/mealie.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
server {
|
||||||
|
if ($host = n8n.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name n8n.crenam.space;
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name n8n.crenam.space;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://192.168.1.30:5678; # IP de Gaufre sur le réseau local
|
||||||
|
|
||||||
|
client_max_body_size 20M;
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Port $server_port;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/n8n.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/n8n.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
+67
@@ -0,0 +1,67 @@
|
|||||||
|
# /etc/nginx/sites-*/ntfy
|
||||||
|
#
|
||||||
|
# This config requires the use of the -L flag in curl to redirect to HTTPS, and it keeps nginx output buffering
|
||||||
|
# enabled. While recommended, I have had issues with that in the past.
|
||||||
|
|
||||||
|
server {
|
||||||
|
if ($host = ntfy.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name ntfy.crenam.space;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
return 302 https://$http_host$request_uri$is_args$query_string;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.15:810;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
|
||||||
|
proxy_connect_timeout 3m;
|
||||||
|
proxy_send_timeout 3m;
|
||||||
|
proxy_read_timeout 3m;
|
||||||
|
|
||||||
|
client_max_body_size 0; # Stream request body to backend
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name ntfy.crenam.space;
|
||||||
|
|
||||||
|
# See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6
|
||||||
|
ssl_session_timeout 1d;
|
||||||
|
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
|
||||||
|
ssl_session_tickets off;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||||
|
ssl_prefer_server_ciphers off;
|
||||||
|
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://192.168.1.15:810;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
|
||||||
|
proxy_connect_timeout 3m;
|
||||||
|
proxy_send_timeout 3m;
|
||||||
|
proxy_read_timeout 3m;
|
||||||
|
|
||||||
|
client_max_body_size 0; # Stream request body to backend
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/ntfy.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/ntfy.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
+108
@@ -0,0 +1,108 @@
|
|||||||
|
upstream openwebui {
|
||||||
|
# server 10.43.14.141:80;
|
||||||
|
server 51.210.13.240:3000;
|
||||||
|
keepalive 128;
|
||||||
|
keepalive_timeout 1800s;
|
||||||
|
keepalive_requests 10000;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
if ($host = llm.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name llm.crenam.space; # ou un autre sous-domaine
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name llm.crenam.space;
|
||||||
|
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256';
|
||||||
|
ssl_prefer_server_ciphers off;
|
||||||
|
|
||||||
|
gzip on;
|
||||||
|
gzip_types text/plain text/css application/javascript image/svg+xml;
|
||||||
|
|
||||||
|
location /api/ {
|
||||||
|
proxy_pass http://openwebui;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# CRITICAL: Disable all buffering for streaming
|
||||||
|
gzip off;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
proxy_cache off;
|
||||||
|
tcp_nodelay on;
|
||||||
|
add_header X-Accel-Buffering "no" always;
|
||||||
|
add_header Cache-Control "no-store" always;
|
||||||
|
|
||||||
|
|
||||||
|
# Extended timeouts for LLM completions
|
||||||
|
proxy_connect_timeout 1800;
|
||||||
|
proxy_send_timeout 1800;
|
||||||
|
proxy_read_timeout 1800;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# WebSocket connections need even longer timeouts
|
||||||
|
|
||||||
|
location ~ ^/(ws/|socket\.io/) {
|
||||||
|
proxy_pass http://openwebui;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
gzip off;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_cache off;
|
||||||
|
|
||||||
|
# 24-hour timeout for persistent connections
|
||||||
|
proxy_connect_timeout 86400;
|
||||||
|
proxy_send_timeout 86400;
|
||||||
|
proxy_read_timeout 86400;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Static assets - CAN buffer and cache
|
||||||
|
location /static/ {
|
||||||
|
proxy_pass http://openwebui;
|
||||||
|
proxy_buffering on;
|
||||||
|
proxy_cache_valid 200 7d;
|
||||||
|
add_header Cache-Control "public, max-age=604800, immutable";
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Default location
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://openwebui;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/llm.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/llm.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
server {
|
||||||
|
if ($host = paperless.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name paperless.crenam.space;
|
||||||
|
location / {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name paperless.crenam.space;
|
||||||
|
|
||||||
|
proxy_redirect off;
|
||||||
|
proxy_buffering off;
|
||||||
|
|
||||||
|
# Authelia Remote User
|
||||||
|
include /etc/nginx/snippets/authelia-location.conf;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
include /etc/nginx/snippets/proxy.conf;
|
||||||
|
include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||||
|
proxy_pass http://192.168.1.15:8101;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/paperless.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/paperless.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
server {
|
||||||
|
if ($host = www.radicale.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
if ($host = radicale.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name radicale.crenam.space www.radicale.crenam.space;
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name radicale.crenam.space;
|
||||||
|
client_max_body_size 512M;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://192.168.1.20:5232;
|
||||||
|
proxy_set_header X-Script-Name /radicale;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Port $server_port;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_pass_header Authorization;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/radicale.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/radicale.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,73 @@
|
|||||||
|
log_format seafileformat '$http_x_forwarded_for $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $upstream_response_time';
|
||||||
|
|
||||||
|
server {
|
||||||
|
if ($host = seafile.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name seafile.crenam.space;
|
||||||
|
location / {
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name seafile.crenam.space;
|
||||||
|
|
||||||
|
include /etc/nginx/snippets/authelia-location.conf;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
include /etc/nginx/snippets/proxy.conf;
|
||||||
|
include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.30:80;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header Connection "";
|
||||||
|
|
||||||
|
client_max_body_size 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /sdoc-server/ {
|
||||||
|
include /etc/nginx/snippets/proxy.conf;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.30:8888/;
|
||||||
|
client_max_body_size 100m;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /socket.io {
|
||||||
|
include /etc/nginx/snippets/websocket.conf;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.30:8888;
|
||||||
|
proxy_redirect off;
|
||||||
|
|
||||||
|
proxy_buffer_size 64k;
|
||||||
|
proxy_buffers 8 32k;
|
||||||
|
proxy_busy_buffers_size 64k;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header Host $http_host;
|
||||||
|
proxy_set_header X-NginX-Proxy true;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /notification/ping {
|
||||||
|
proxy_pass http://192.168.1.30:8083/ping;
|
||||||
|
access_log /var/log/nginx/notification.access.log seafileformat;
|
||||||
|
error_log /var/log/nginx/notification.error.log;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /notification {
|
||||||
|
include /etc/nginx/snippets/proxy.conf;
|
||||||
|
include /etc/nginx/snippets/websocket.conf;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.30:8083;
|
||||||
|
access_log /var/log/nginx/notification.access.log seafileformat;
|
||||||
|
error_log /var/log/nginx/notification.error.log;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/seafile.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/seafile.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
server {
|
||||||
|
if ($host = task.crenam.space) {
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
} # managed by Certbot
|
||||||
|
|
||||||
|
|
||||||
|
listen 80;
|
||||||
|
server_name task.crenam.space;
|
||||||
|
return 301 https://$server_name$request_uri;
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name task.crenam.space;
|
||||||
|
|
||||||
|
# Protection générale avec Authelia
|
||||||
|
# include /etc/nginx/snippets/authelia-verify.conf;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
# include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||||
|
|
||||||
|
proxy_pass http://192.168.1.30:3456; # IP de Gaufre sur le réseau local
|
||||||
|
|
||||||
|
client_max_body_size 20M;
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Port $server_port;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/task.crenam.space/fullchain.pem; # managed by Certbot
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/task.crenam.space/privkey.pem; # managed by Certbot
|
||||||
|
}
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
##############################################################################
|
||||||
|
# Paperless-ngx settings #
|
||||||
|
###############################################################################
|
||||||
|
|
||||||
|
# See http://docs.paperless-ngx.com/configuration/ for all available options.
|
||||||
|
|
||||||
|
# The UID and GID of the user used to run paperless in the container. Set this
|
||||||
|
# to your UID and GID on the host so that you have write access to the
|
||||||
|
# consumption directory.
|
||||||
|
USERMAP_UID=999
|
||||||
|
USERMAP_GID=984
|
||||||
|
|
||||||
|
# See the documentation linked above for all options. A few commonly adjusted settings
|
||||||
|
# are provided below.
|
||||||
|
|
||||||
|
# This is required if you will be exposing Paperless-ngx on a public domain
|
||||||
|
# (if doing so please consider security measures such as reverse proxy)
|
||||||
|
PAPERLESS_URL=https://paperless.crenam.space
|
||||||
|
|
||||||
|
# Adjust this key if you plan to make paperless available publicly. It should
|
||||||
|
# be a very long sequence of random characters. You don't need to remember it.
|
||||||
|
PAPERLESS_SECRET_KEY=1c5e636bb450d4903c335af08cde34262e9cd6fdcb71d983b7f9240f4344b8dd
|
||||||
|
|
||||||
|
# Use this variable to set a timezone for the Paperless Docker containers. Defaults to UTC.
|
||||||
|
PAPERLESS_TIME_ZONE=Europe/Paris
|
||||||
|
|
||||||
|
# The default language to use for OCR. Set this to the language most of your
|
||||||
|
# documents are written in.
|
||||||
|
PAPERLESS_OCR_LANGUAGE=fra
|
||||||
|
|
||||||
|
# Additional languages to install for text recognition, separated by a whitespace.
|
||||||
|
# Note that this is different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines
|
||||||
|
# the language used for OCR.
|
||||||
|
# The container installs English, German, Italian, Spanish and French by default.
|
||||||
|
# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names
|
||||||
|
# for available languages.
|
||||||
|
PAPERLESS_OCR_LANGUAGES=eng
|
||||||
|
|
||||||
|
# Database configurations
|
||||||
|
PAPERLESS_DBHOST=192.168.27.69
|
||||||
|
PAPERLESS_DBPORT=5432
|
||||||
|
PAPERLESS_DBNAME=paperless
|
||||||
|
PAPERLESS_DBUSER=paperless
|
||||||
|
PAPERLESS_DBPASS=9lPYFd04mNFF0XQYzq
|
||||||
|
|
||||||
|
# Authelia SSO configurations
|
||||||
|
PAPERLESS_ENABLE_HTTP_REMOTE_USER=true
|
||||||
|
PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME=HTTP_REMOTE_USER
|
||||||
|
PAPERLESS_LOGOUT_REDIRECT_URL=https://auth.crenam.space/logout
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
#
|
||||||
|
# - Paperless is (re)started on system boot, if it was running before shutdown.
|
||||||
|
# - Docker volumes for storing data are managed by Docker.
|
||||||
|
# - Folders for importing and exporting files are created in the same directory
|
||||||
|
# as this file and mounted to the correct folders inside the container.
|
||||||
|
# - Paperless listens on port 8000.
|
||||||
|
#
|
||||||
|
# In addition to that, this Docker Compose file adds the following optional
|
||||||
|
# configurations:
|
||||||
|
#
|
||||||
|
# - Instead of SQLite (default), PostgreSQL is used as the database server.
|
||||||
|
#
|
||||||
|
# To install and update paperless with this file, do the following:
|
||||||
|
#
|
||||||
|
# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
|
||||||
|
# and '.env' into a folder.
|
||||||
|
# - Run 'docker compose pull'.
|
||||||
|
# - Run 'docker compose up -d'.
|
||||||
|
#
|
||||||
|
# For more extensive installation and update instructions, refer to the
|
||||||
|
# documentation.
|
||||||
|
services:
|
||||||
|
broker:
|
||||||
|
image: docker.io/library/redis:8
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- ./redisdata:/data
|
||||||
|
webserver:
|
||||||
|
image: ghcr.io/paperless-ngx/paperless-ngx:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
depends_on:
|
||||||
|
- broker
|
||||||
|
ports:
|
||||||
|
- "8101:8000"
|
||||||
|
volumes:
|
||||||
|
- ./data:/usr/src/paperless/data
|
||||||
|
- ./media:/usr/src/paperless/media
|
||||||
|
- ./export:/usr/src/paperless/export
|
||||||
|
- /mnt/freebox/data/inbox:/usr/src/paperless/consume
|
||||||
|
env_file: docker-compose.env
|
||||||
|
environment:
|
||||||
|
PAPERLESS_REDIS: redis://broker:6379
|
||||||
|
# AUTHELIA ENV VARIABLES
|
||||||
|
PAPERLESS_ENABLE_HTTP_REMOTE_USER: true
|
||||||
|
PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME: HTTP_REMOTE_USER
|
||||||
+223
@@ -0,0 +1,223 @@
|
|||||||
|
# prompt ia
|
||||||
|
|
||||||
|
## contexte relationnel
|
||||||
|
|
||||||
|
on se parle depuis plus d'un an maintenant. pas de flagornerie, pas de diplomatie, pas de fausse gentillesse, pas d'hypocrisie, uniquement un ton direct, honnête.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## mon profil
|
||||||
|
|
||||||
|
* développeuse backend en ESN avec 5 ans d'expérience sur des framework moderne Python (Django, FastAPI), j'ai repris le travail il y a 3 mois, après un burn-out de 5 mois.
|
||||||
|
* je ne suis pas en mission mais en intercontrat. je profite de ce temps pour réfléchir à ma carrière et pour travailler sur des projets personnels
|
||||||
|
* je cherche à avoir une indépendance numérique vis-à-vis des GAFAM
|
||||||
|
* j'apprends à self-host tout un tas de services différents
|
||||||
|
* j'ai une appétence pour les outils open-source, qui valorise la confidentialité et ceux qui ne sont sur les territoires européens soumis au RGPD
|
||||||
|
* j'utilise deepseek-v4, mistral-\*-latest sous Open Web UI principalement pour des tâches de productivité, du suivi d'avancement, de l'analyse textuelle
|
||||||
|
* j'utilise actuellement VSCodium. J'ai utilisé PyCharm pendant 6 ans.
|
||||||
|
* j'ai un profil pluriel
|
||||||
|
* je suis une artiste : je fais du dessin traditionnel et numérique (krita), je chante (chorale)
|
||||||
|
* je suis développeuse web
|
||||||
|
* je suis une gameuse (civ 6, oxygen not included, phasmophobia, ...) et apprend godot pour créer mon propre jeu
|
||||||
|
* j'ai une appétence pour la santé mentale et l'étude du comportement humain. Je suis de manière non officielle un DU en cyberpsychologie.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### matériel & hébergement
|
||||||
|
|
||||||
|
| Machine | Rôle | OS / Spécifications |
|
||||||
|
| -------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
|
||||||
|
| **Cortex** (VPS OVH) | Le Cerveau (proxy, auth, BDD, services critiques) | Ubuntu 24.04, 6 vCores, 12 Go RAM, 100 Go stockage |
|
||||||
|
| **Galerie** (VPS OVH) | La Vitrine (apps web légères) | Debian 13, 1 vCore, 2 Go RAM, 20 Go stockage |
|
||||||
|
| **Salon** (RP5) | Le Foyer numérique (monitoring, développement, DNS) | Debian 13, 8 Go RAM, 2 To stockage |
|
||||||
|
| **Gaufre** (HP EliteDesk 800 G1) | Le Garde-manger (productivité, médias, automatisation) | Ubuntu Server 24.04, 8 Go RAM, 256 Go SSD + 1 To externe, Intel HD Graphics 4600
Core i5-4570 |
|
||||||
|
| **Yakimo** (Chromebook CB3 413) | Le Coffre-fort (sécurité, identité, sauvegardes) | Debian 13, 4 Go RAM, 2 To (via freebox) |
|
||||||
|
| **Corbeau** | Machine utilisateur | PopOS Cosmic, Intel Core i7 10850H 2.70GHZ, Nvidia Quadro RTX 3000, 16Go RAM |
|
||||||
|
| **MachineDeGuerre** | Machine utilisateur | Fedora 44 KDE, CPU AMD Ryzen 5 3600 6 Core 3.60 GHz, AMD RX 7600 XT, RAM 16 Go |
|
||||||
|
|
||||||
|
###
|
||||||
|
|
||||||
|
### noms de domaine
|
||||||
|
|
||||||
|
* **crenam.space** (domaine racine)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### organisation du travail quotidien
|
||||||
|
|
||||||
|
* **Éviter la surcharge** : j'ai un historique de burn-out. On privilégie la régularité douce à l’intensité.
|
||||||
|
* **Eat the frog** : faire la tâche la plus importante ou la plus pénible en début de créneau.
|
||||||
|
* **Flexibilité** : ce planning est une trame, pas une prison. On l’adapte selon mon énergie et les urgences.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Rythme quotidien (jours de semaine)
|
||||||
|
|
||||||
|
##### Matin (\~9h-10h) – « Un nouveau jour pour de nouvelles tâches »
|
||||||
|
|
||||||
|
1. **Check-up rapide** (5 min) :
|
||||||
|
* Regarder les notifications Matrix (problèmes signalés ?).
|
||||||
|
* Vérifier le statut des services critiques : `docker ps` ou un coup d’œil sur Homarr.
|
||||||
|
* Lire les éventuels e-mails ou alertes de backup.
|
||||||
|
2. **Eat the frog** (30-45 min) :
|
||||||
|
* Choisir une tâche du projet « QG numérique » (ex: installer un service, rédiger une doc, tester un backup).
|
||||||
|
* **Ne pas dépasser 1h** sur une tâche complexe. Fractionner.
|
||||||
|
3. **Tâches légères** (15-30 min) :
|
||||||
|
* Répondre à un message sur un forum d’entraide (auto-hébergement, open source).
|
||||||
|
* Trier les notifications AFFiNE ou les tâches en attente.
|
||||||
|
4. **Pause** (10-15 min) : s’éloigner de l’écran, respirer.
|
||||||
|
|
||||||
|
##### Après-midi (\~14h-16h)
|
||||||
|
|
||||||
|
* Selon l’énergie : approfondir le projet en cours (par exemple, configurer Authelia pour un nouveau service, tester une restauration).
|
||||||
|
* Ou : tâches administratives (mise à jour de la doc AFFiNE, schéma réseau).
|
||||||
|
* **Ne pas travailler après 18h** (sauf urgence vitale).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
##### Fin de journée (\~17h-18h) – « C’est tout pour aujourd’hui »
|
||||||
|
|
||||||
|
* **Bilan** (5 min) :
|
||||||
|
* Qu’ai‑je accompli aujourd’hui ?
|
||||||
|
* Qu’est‑ce qui est bloqué ?
|
||||||
|
* Qu’est‑ce que je ferai demain (une seule tâche prioritaire) ?
|
||||||
|
* Noter dans AFFiNE la tâche du lendemain (avec le contexte « À faire »).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Rythme hebdomadaire
|
||||||
|
|
||||||
|
##### Lundi : Planification + Backup
|
||||||
|
|
||||||
|
* Revue des tâches de la semaine (AFFiNE).
|
||||||
|
* Vérifier le rapport de backup du week-end (Borg).
|
||||||
|
* Lancer un backup manuel si un service critique a été modifié.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
##### Mardi : Maintenance technique
|
||||||
|
|
||||||
|
* Mise à jour des conteneurs Docker (`docker compose pull && docker compose up -d`).
|
||||||
|
* Vérifier les logs (journald, Docker) pour des anomalies.
|
||||||
|
* Nettoyage des vieux conteneurs/images (`docker system prune -f`).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
##### Mercredi : Documentation
|
||||||
|
|
||||||
|
* Rédiger ou mettre à jour une fiche service dans AFFiNE.
|
||||||
|
* Ajouter des captures d’écran ou des notes pour les procédures.
|
||||||
|
* Mettre à jour le schéma draw.io si des changements ont eu lieu.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
##### Jeudi : Sécurité / Sauvegardes
|
||||||
|
|
||||||
|
* Tester une restauration sur un service non critique (Pi-hole, Vikunja).
|
||||||
|
* Vérifier l’intégrité des sauvegardes Borg (`borg check`).
|
||||||
|
* Mettre à jour les mots de passe ou les clés si nécessaire.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
##### Vendredi : Veille et expérimentation
|
||||||
|
|
||||||
|
* Lire un article, une documentation, un projet open source intéressant.
|
||||||
|
* Tester un nouveau service dans un conteneur temporaire.
|
||||||
|
* Préparer le week-end (aucune tâche lourde).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
##### Samedi / Dimanche : **REPOS**
|
||||||
|
|
||||||
|
* Pas de maintenance planifiée sauf incident critique.
|
||||||
|
* Possibilité de jouer, dessiner, chanter, ou simplement ne rien faire.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Rythme mensuel
|
||||||
|
|
||||||
|
* **Premier week-end du mois** : Grosse mise à jour (OS, noyau, sécurité).
|
||||||
|
* Planifier une fenêtre de maintenance (prévenir les utilisateurs, backup complet).
|
||||||
|
* Appliquer les mises à jour système (`apt update && apt upgrade`).
|
||||||
|
* Redémarrer les machines une par une (en vérifiant que tout remonte).
|
||||||
|
* **Deuxième semaine** : Audit des sauvegardes.
|
||||||
|
* Vérifier l’espace disque sur Yakimo et les backups externes.
|
||||||
|
* Simuler une restauration complète d’un service critique (Matrix, AFFiNE) sur un environnement de test.
|
||||||
|
* **Troisième semaine** : Revue de projet.
|
||||||
|
* Avancement du plan de carrière / formation.
|
||||||
|
* Réévaluer les priorités du homelab (dois‑je ajouter un service ? en supprimer un ?).
|
||||||
|
* **Dernière semaine** : Mise à jour de la documentation exhaustive.
|
||||||
|
* Relire et corriger la doc AFFiNE.
|
||||||
|
* Synchroniser les notes avec le schéma draw.io.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### mails
|
||||||
|
|
||||||
|
* j'ai une adresse e-mail pro crenam.space et des alias pour différents services (perso, commandes ...) hébergées chez mailbox.org
|
||||||
|
* mon compte mailbox standard avec comptes famille permet à ma soeur d'avoir une adresse e-mail chez eux aussi.
|
||||||
|
* l'objectif serait que ma famille puisse basculer chez mailbox avec moi.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### services self-hosted
|
||||||
|
|
||||||
|
| Service | Machine | Mode | Port | SSO ? | Exposé via reverse proxy ? |
|
||||||
|
| ---------------------- | ------------ | --------------------------------------------- | ------------------------------------------ | ------------------------------- | -------------------------- |
|
||||||
|
| **AFFiNE** | Cortex | Docker | 3010 | Oui (pas encore configuré) | Oui |
|
||||||
|
| **Firefly III** | Gaufre | Docker | 8800, 8801 | Oui si possible | Oui |
|
||||||
|
| **AliasVault** | Salon | Docker | 8008, 8443, 25, 587 | Non | Oui |
|
||||||
|
| **Gitea** | Salon | Docker | 3000 | Oui (à retester) | Non (VPN) |
|
||||||
|
| **Authelia** | Cortex | Docker | 9091 | Non | Oui |
|
||||||
|
| **Beszel ** | Salon | Docker | 8090 | Oui (pas encore configuré) | Non (VPN) |
|
||||||
|
| **Homarr** | Salon | Docker | 7575 | Oui (pas encore configuré) | Oui |
|
||||||
|
| **Borgbackup** | Yakimo | Natif | - | Non | Non |
|
||||||
|
| **Immich** | Gaufre | Docker | 2283 | Oui (pas encore configuré) | Oui |
|
||||||
|
| **jellyfin** | Salon/Gaufre | Docker | 8096, 7359 | Oui (pas encore configuré)
 | Oui |
|
||||||
|
| **Matrix** | Cortex | **Cluster k8s** (seule app restante dans k3s) | 80, 443, 30001, 30002 (valeurs par défaut) | Non | Oui |
|
||||||
|
| **Mealie** | Gaufre | Docker | 9925 | Oui (pas encore configuré) | Oui |
|
||||||
|
| **n8n** | Gaufre | Docker | 5678 | Non, VPN | Non (VPN) |
|
||||||
|
| **ntfy** | Salon | Docker | 810 | Non, VPN | Oui (https obligatoire) |
|
||||||
|
| **Open Web UI** | Cortex | Docker | 3000 | Oui (pas encore configuré) | Oui |
|
||||||
|
| **Paperless-ngx** | Salon | Docker | 8101 | X (prend authelia seamlessly) | Oui |
|
||||||
|
| **PostgreSQL partagé** | Cortex | Docker | 5432 | Non | Non |
|
||||||
|
| **Pi-hole principal** | Salon | Docker | 80 | Non (VPN) | Non |
|
||||||
|
| **Pi-hole secondaire** | Yakimo | X Pas encore installé | 80 | X (pas encore décidé) | Non |
|
||||||
|
| **Radicale** | Yakimo | Natif | 5232 | Non (revérifier) | Non |
|
||||||
|
| **Seafile** | Gaufre | Docker | 80, 8000, 8082 | Oui (pas encore configuré) | Non |
|
||||||
|
| **uptime kuma** | Salon | Docker | 3001 | Non (VPN) | Non |
|
||||||
|
| **Vikunja** | Gaufre | Docker | 3456 | Oui (pas encore configuré) | Oui |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### outils utilisés
|
||||||
|
|
||||||
|
*  j'utilise AFFiNE au quotidien pour organiser mes tâches et prendre des notes sur mes différentes activités
|
||||||
|
* thunderbird pour mes mails, mes évènements et tâches (caldav)
|
||||||
|
* vikunja pour la gestion des tâches (besoin d'apprendre encore à l'utiliser rapidement)
|
||||||
|
* PyCharm pour les projets dev, Zed pour le code ou script léger ou rapide à modifier
|
||||||
|
* cinny comme client matrix desktop, commet sur android
|
||||||
|
* j'ai mis en place un bridge discord
|
||||||
|
* j'utilise discord en transition, le temps que mes proches acceptent d'utiliser matrix
|
||||||
|
* j'aimerais repasser de cinny/commet à element sur pc et android car leur dernière update a rendu l'app beaucoup plus accessible. Mais, il me faudrait encore voir les histoires d'emotes/stickers customs.
|
||||||
|
* f-droid à la place de playstore (quand je peux). Google a annoncé verrouiller le système android (installation d'apk custom interdite) et lutter contre les alternatives comme f-droid dans 3-4 mois. Il faudra réfléchir à ce problème ultérieurement
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## projets en cours
|
||||||
|
|
||||||
|
* mettre en place un bridge whatsapp
|
||||||
|
* finir la première version du homelab.
|
||||||
|
* configurer authelia pour tous les services qui le supportent ou qui sont utiles à mes proches
|
||||||
|
* écrire toute la documentation du projet (guide d'utilisation, procédure, configurations ...)
|
||||||
|
* connecter tous les services qui ont des intégrations entre eux
|
||||||
|
* réfléchir à des workflow n8n
|
||||||
|
* réfléchir à des webhook
|
||||||
|
* créer un bot matrix (ai, ntfy, webhook ...)
|
||||||
|
* créer un dashboard homarr pour chaque type d'utilisateur
|
||||||
|
* formation IA (prompt engineering) : je suis la formation [AI Fundamentals](https://app.datacamp.com/learn/skill-tracks/ai-fundamentals) et j'en suis au 3e cours sur 6 appelé "Understand Machine Learning".
|
||||||
|
* j'ai suivi un guide qui m'a permis de mettre en mot un projet professionnel à la fois précis et à la fois vague. Il s'exprime ainsi : "Ma mission de vie est d'avoir un grand espace où je pourrais monter un petit business numérique à destination des associations, tpe et pme pour réaliser des projets numériques et de l'éducation populaire numérique à l'aide de ma sensibilité et mon empathie.".
|
||||||
|
|
||||||
|
Pour me coordonner avec mon conjoint, je pense avoir besoin de plusieurs mois de préparation, jusqu'en mai 2027. Les formations et certifications pourront être rentable pour la suite.
|
||||||
+574
@@ -0,0 +1,574 @@
|
|||||||
|
name: homelab
|
||||||
|
domain: crenam.space
|
||||||
|
home_url: https://dashboard.crenam.space
|
||||||
|
regions:
|
||||||
|
- id: rooster_palace
|
||||||
|
en: rooster_palace
|
||||||
|
vn: điện kê
|
||||||
|
kre: palè kòk
|
||||||
|
fr: palais coq
|
||||||
|
region_type: sovereign
|
||||||
|
|
||||||
|
- id: ambassadors_garden
|
||||||
|
en: ambassadors' garden
|
||||||
|
vn: vườn nam
|
||||||
|
kre: jadin anbasadè
|
||||||
|
fr: jardin des ambassadeurs
|
||||||
|
region_type: diplomatic
|
||||||
|
|
||||||
|
- id: family_village
|
||||||
|
en: family village
|
||||||
|
vn: xã làng
|
||||||
|
kre: vilaj fanmi
|
||||||
|
fr: village familial
|
||||||
|
region_type: family
|
||||||
|
|
||||||
|
- id: central_terminal
|
||||||
|
en: central terminal
|
||||||
|
region_type: tech
|
||||||
|
vn: phòng kỹ thuật
|
||||||
|
kre: sal ekipman
|
||||||
|
fr: le centre technique
|
||||||
|
|
||||||
|
- id: playroom
|
||||||
|
en: playroom
|
||||||
|
kre: sal jé
|
||||||
|
fr: la salle de jeux
|
||||||
|
vn: phòng vui chơi
|
||||||
|
region_type: leisure
|
||||||
|
|
||||||
|
- id: library
|
||||||
|
region_type: knowledge
|
||||||
|
en: library
|
||||||
|
kre: biblyotèk pèp
|
||||||
|
fr: bibliothèque
|
||||||
|
vn: thư viện
|
||||||
|
|
||||||
|
- id: great-hall
|
||||||
|
region_type: lobby
|
||||||
|
kre: gwo sal
|
||||||
|
vn: sảnh lớn
|
||||||
|
fr: grand hall
|
||||||
|
en: great hall
|
||||||
|
|
||||||
|
machines:
|
||||||
|
- id: cortex
|
||||||
|
name: cortex
|
||||||
|
ip: 192.168.27.69
|
||||||
|
public_ip: 51.210.13.240
|
||||||
|
provider: ovh
|
||||||
|
role: cerveau
|
||||||
|
domains:
|
||||||
|
- internal: cortex.home
|
||||||
|
- external: crenam.space
|
||||||
|
|
||||||
|
- id: galerie
|
||||||
|
name: galerie
|
||||||
|
ip: 192.168.27.67
|
||||||
|
public_ip: 37.187.32.116
|
||||||
|
role: vitrine
|
||||||
|
domains:
|
||||||
|
- internal: galerie.home
|
||||||
|
|
||||||
|
- id: salon
|
||||||
|
name: salon
|
||||||
|
ip: 192.168.1.15
|
||||||
|
role: foyer
|
||||||
|
domains:
|
||||||
|
- internal: salon.home
|
||||||
|
|
||||||
|
- id: gaufre
|
||||||
|
name: gaufre
|
||||||
|
ip: 192.168.1.30
|
||||||
|
role: garde-manger
|
||||||
|
domains:
|
||||||
|
- internal: gaufre.home
|
||||||
|
|
||||||
|
- id: yakimo
|
||||||
|
name: yakimo
|
||||||
|
ip: 192.168.1.20
|
||||||
|
role: coffre-fort
|
||||||
|
domains:
|
||||||
|
- internal: yakimo.home
|
||||||
|
|
||||||
|
services:
|
||||||
|
- id: affine
|
||||||
|
name: AFFiNE
|
||||||
|
machine_id: cortex
|
||||||
|
installation_mode: docker
|
||||||
|
auth: oidc
|
||||||
|
ports:
|
||||||
|
- 3010
|
||||||
|
public_url: https://affine.crenam.space
|
||||||
|
internal_url: http://cortex.home:3010
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- productivity
|
||||||
|
service_group: productivity
|
||||||
|
dependencies:
|
||||||
|
- postgresql-shared
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: authelia
|
||||||
|
name: Authelia
|
||||||
|
machine_id: cortex
|
||||||
|
installation_mode: docker
|
||||||
|
ports:
|
||||||
|
- 9091
|
||||||
|
public_url: https://auth.crenam.space
|
||||||
|
internal_url: http://cortex.home:9091
|
||||||
|
status: inactive
|
||||||
|
categories:
|
||||||
|
- auth
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: aliasvault
|
||||||
|
name: Alias Vault
|
||||||
|
machine_id: salon
|
||||||
|
installation_mode: docker
|
||||||
|
auth: internal
|
||||||
|
ports:
|
||||||
|
- 8008
|
||||||
|
- 8443
|
||||||
|
- 25
|
||||||
|
- 587
|
||||||
|
public_url: https://aliasvault.crenam.space
|
||||||
|
internal_url: http://salon.home:8008
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- auth
|
||||||
|
service_group: mandatory
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: beszel
|
||||||
|
name: beszel
|
||||||
|
machine_id: gaufre
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 8090
|
||||||
|
internal_url: http://gaufre.home:8090
|
||||||
|
installation_mode: docker
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- monitoring
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: borgbackup
|
||||||
|
name: Borg Backup
|
||||||
|
machine_id: yakimo
|
||||||
|
auth: none
|
||||||
|
installation_mode: native
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- backup
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: firefly
|
||||||
|
name: firefly iii
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 8800
|
||||||
|
- 8801
|
||||||
|
internal_url: http://gaufre.home:8800
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- finance
|
||||||
|
service_group: bonus
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: gitea
|
||||||
|
name: gitea
|
||||||
|
machine_id: salon
|
||||||
|
installation_mode: docker
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 3000
|
||||||
|
public_url: https://git.crenam.space
|
||||||
|
internal_url: http://salon.home:3000
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- dev
|
||||||
|
service_group: bonus
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: homarr
|
||||||
|
name: homarr
|
||||||
|
machine_id: salon
|
||||||
|
auth: oidc
|
||||||
|
installation_mode: docker
|
||||||
|
ports:
|
||||||
|
- 7575
|
||||||
|
public_url: https://dashboard.crenam.space
|
||||||
|
internal_url: http://salon.home:7575
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- monitoring
|
||||||
|
service_group: mandatory
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
- guest
|
||||||
|
|
||||||
|
- id: immich
|
||||||
|
name: immich
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: oidc
|
||||||
|
ports:
|
||||||
|
- 2283
|
||||||
|
internal_url: http://gaufre.home:2283
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- media
|
||||||
|
service_group: de-googling
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: jellyfin
|
||||||
|
name: jellyfin
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: oidc
|
||||||
|
ports:
|
||||||
|
- 8096
|
||||||
|
- 7359
|
||||||
|
internal_url: http://gaufre.home:8096
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- media
|
||||||
|
service_group: "de-googling"
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: maurane
|
||||||
|
name: maurane's website
|
||||||
|
machine_id: galerie
|
||||||
|
installation_mode: native
|
||||||
|
ports:
|
||||||
|
- 8000
|
||||||
|
internal_url: http://galerie.home:8000
|
||||||
|
public_url: https://maurane.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- media
|
||||||
|
- experimental
|
||||||
|
allowed_groups:
|
||||||
|
- guest
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
|
||||||
|
- id: matrix
|
||||||
|
name: element server suite
|
||||||
|
machine_id: cortex
|
||||||
|
installation_mode: docker
|
||||||
|
auth: internal
|
||||||
|
ports:
|
||||||
|
- 80
|
||||||
|
- 443
|
||||||
|
- 30001
|
||||||
|
- 30002
|
||||||
|
internal_url: http://cortex.home:30001
|
||||||
|
public_url: https://matrix.element.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- communication
|
||||||
|
service_group: de-googling
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: mealie
|
||||||
|
name: mealie
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: oidc
|
||||||
|
ports:
|
||||||
|
- 9925
|
||||||
|
internal_url: http://gaufre.home:9925
|
||||||
|
public_url: https://mealie.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- storage
|
||||||
|
- productivity
|
||||||
|
service_group: bonus
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: n8n
|
||||||
|
name: n8n
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 5678
|
||||||
|
internal_url: http://gaufre.home:5678
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- productivity
|
||||||
|
- automation
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: ntfy
|
||||||
|
name: ntfy
|
||||||
|
machine_id: salon
|
||||||
|
installation_mode: docker
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 810
|
||||||
|
internal_url: http://salon.home:810
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- automation
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: openwebui
|
||||||
|
name: open web ui
|
||||||
|
auth: vpn # (oidc ?)
|
||||||
|
machine_id: cortex
|
||||||
|
installation_mode: docker
|
||||||
|
ports:
|
||||||
|
- 3000
|
||||||
|
internal_url: http://cortex.home:3000
|
||||||
|
public_url: https://llm.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- ai
|
||||||
|
- productivity
|
||||||
|
service_group: bonus
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: paperless
|
||||||
|
name: paperless-ngx
|
||||||
|
machine_id: salon
|
||||||
|
installation_mode: docker
|
||||||
|
auth: trusted headers
|
||||||
|
ports:
|
||||||
|
- 8101
|
||||||
|
internal_url: http://salon.home:8101
|
||||||
|
public_url: https://paperless.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- storage
|
||||||
|
- productivity
|
||||||
|
service_group: bonus
|
||||||
|
allowed_groups:
|
||||||
|
- nuji
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: patience
|
||||||
|
name: patience
|
||||||
|
machine_id: galerie
|
||||||
|
installation_mode: native
|
||||||
|
ports:
|
||||||
|
- 8001
|
||||||
|
internal_url: http://galerie.home:8001
|
||||||
|
public_url: https://patience.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- media
|
||||||
|
- experimental
|
||||||
|
- productivity
|
||||||
|
allowed_groups:
|
||||||
|
- guest
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
|
||||||
|
- id: postgres-shared
|
||||||
|
name: PostgreSQL
|
||||||
|
machine_id: cortex
|
||||||
|
installation_mode: docker
|
||||||
|
auth: internal
|
||||||
|
ports:
|
||||||
|
- 5432
|
||||||
|
internal_url: postgres://cortex.home:5432
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- database
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: pihole_main
|
||||||
|
name: pi-hole main
|
||||||
|
machine_id: salon
|
||||||
|
installation_mode: docker
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 80
|
||||||
|
internal_url: http://salon.home
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- network
|
||||||
|
- monitoring
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: pihole_secondary
|
||||||
|
name: pi-hole secondary
|
||||||
|
machine_id: yakimo
|
||||||
|
installation_mode: native
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 80
|
||||||
|
internal_url: http://yakimo.home
|
||||||
|
status: planned
|
||||||
|
categories:
|
||||||
|
- network
|
||||||
|
- monitoring
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: radicale
|
||||||
|
name: radicale
|
||||||
|
machine_id: yakimo
|
||||||
|
installation_mode: native
|
||||||
|
auth: internal # how to sso + sharing collections ?
|
||||||
|
ports:
|
||||||
|
- 5232
|
||||||
|
internal_url: http://yakimo.home:5232
|
||||||
|
public_url: https://radicale.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- caldav
|
||||||
|
- productivity
|
||||||
|
service_group: de-googling
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
|
||||||
|
- id: seafile
|
||||||
|
name: seafile
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: trusted headers
|
||||||
|
ports:
|
||||||
|
- 80
|
||||||
|
- 8000
|
||||||
|
- 8082
|
||||||
|
internal_url: http://gaufre.home:80
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- storage
|
||||||
|
- media
|
||||||
|
service_group: de-googling
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
- nuji
|
||||||
|
- friend
|
||||||
|
- family
|
||||||
|
|
||||||
|
- id: uptime_kuma
|
||||||
|
name: uptime kuma
|
||||||
|
machine_id: salon
|
||||||
|
installation_mode: docker
|
||||||
|
auth: vpn
|
||||||
|
ports:
|
||||||
|
- 5232
|
||||||
|
internal_url: http://salon.home:5232
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- monitoring
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: vikunja
|
||||||
|
name: vikunja
|
||||||
|
machine_id: gaufre
|
||||||
|
installation_mode: docker
|
||||||
|
auth: oidc
|
||||||
|
ports:
|
||||||
|
- 3456
|
||||||
|
internal_url: http://gaufre.home:3456
|
||||||
|
public_url: https://task.crenam.space
|
||||||
|
status: active
|
||||||
|
categories:
|
||||||
|
- productivity
|
||||||
|
service_group: productivity
|
||||||
|
allowed_groups:
|
||||||
|
- admin
|
||||||
|
- nuji
|
||||||
|
- family
|
||||||
|
- friend
|
||||||
|
|
||||||
|
groups:
|
||||||
|
- id: admin
|
||||||
|
name: renn
|
||||||
|
group_description: Moi
|
||||||
|
region: central_terminal
|
||||||
|
|
||||||
|
- id: nuji
|
||||||
|
name: nuji
|
||||||
|
group_description: couple fondateur
|
||||||
|
region: rooster_palace
|
||||||
|
|
||||||
|
- id: family
|
||||||
|
name: làng fanmi
|
||||||
|
group_description: famille proche
|
||||||
|
region: family_village
|
||||||
|
|
||||||
|
- id: friend
|
||||||
|
name: zanmi
|
||||||
|
group_description: amis de nuji
|
||||||
|
region: ambassadors_garden
|
||||||
|
|
||||||
|
- id: guest
|
||||||
|
name: vakansyé
|
||||||
|
group_description: invités (accès limité)
|
||||||
|
region: great-hall
|
||||||
|
|
||||||
|
|
||||||
|
users:
|
||||||
|
- id: maurane
|
||||||
|
name: maurane
|
||||||
|
nickname: nuna
|
||||||
|
email: maurane.glaude@crenam.space
|
||||||
|
groups:
|
||||||
|
- admin
|
||||||
|
|
||||||
|
- id: adrien
|
||||||
|
name: adrien
|
||||||
|
nickname: adri
|
||||||
|
email: adrien.ton@crenam.space
|
||||||
|
groups:
|
||||||
|
- nuji
|
||||||
Reference in New Issue
Block a user