diff --git a/02_traefik/.env b/02_traefik/.env new file mode 100644 index 0000000..21d483f --- /dev/null +++ b/02_traefik/.env @@ -0,0 +1,2 @@ +ADM_EMAIL=lacour.anthony14@gmail.com +CF_DNS_API_TOKEN=cfat_LJUOrlKgDJFmELY25VnrlQzrpqm9bpYhUTJyqQBy69400a1f diff --git a/02_traefik/compose.yaml b/02_traefik/compose.yaml index adad41b..8ed7a33 100644 --- a/02_traefik/compose.yaml +++ b/02_traefik/compose.yaml @@ -13,14 +13,40 @@ services: - --entrypoints.web.address=:80 - --entrypoints.websecure.address=:443 + # βœ… Cloudflare DNS challenge - --certificatesresolvers.cloudflare.acme.dnschallenge=true - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare - --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL} - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json + # βœ… Trust Cloudflare - --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22 - --entrypoints.websecure.forwardedHeaders.insecure=true - + + labels: + - traefik.enable=true + + # ========================= + # πŸ” AUTHENTIK FORWARD AUTH + # ========================= + - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik + - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true + - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid + + # ========================= + # 🏠 LOCAL BYPASS (optionnel) + # ========================= + - traefik.http.middlewares.local-ipwhitelist.ipwhitelist.sourcerange=10.0.0.0/8,192.168.0.0/16 + + # ========================= + # πŸ”— GLOBAL CHAIN + # ========================= + # πŸ‘‰ AVEC bypass LAN : + - traefik.http.middlewares.chain-auth.chain.middlewares=local-ipwhitelist,authentik + + # πŸ‘‰ SI tu veux FORCER auth partout (sans bypass LAN) : + # - traefik.http.middlewares.chain-auth.chain.middlewares=authentik + ports: - 80:80 - 443:443 diff --git a/03_auth/.env b/03_auth/.env new file mode 100644 index 0000000..3e43195 --- /dev/null +++ b/03_auth/.env @@ -0,0 +1,17 @@ +DENACCESS_POSTGRES_DB=authentik-luckyden-db +DENACCESS_POSTGRES_USER=authentik-luckyden-admin +DENACCESS_POSTGRES_PASSWORD=6OCBfxO4mL!8 +DENACCESS_AUTHENTIK_SECRET_KEY=qliGSpJEuJgEFSszeQgUVaEhVqISKbVZyWzmFzpmHGqWX0A1GkrBoL4ttkmRQ +DENACCESS_AUTHENTIK_HOST=https://access.luckyden.org/ + +AUTHENTIK_EMAIL__HOST=smtp.gmail.com +AUTHENTIK_EMAIL__PORT=465 +AUTHENTIK_EMAIL__USERNAME=lacour.anthony14@gmail.com +AUTHENTIK_EMAIL__PASSWORD=hlbf dfyx geny iqjb +AUTHENTIK_EMAIL__USE_TLS=false +AUTHENTIK_EMAIL__USE_SSL=true +AUTHENTIK_EMAIL__TIMEOUT=10 +AUTHENTIK_EMAIL__FROM=denaccess@gmail.com + +AUTHENTIK_TOKEN=dUrxclY2eIQ5s93GhajjLpsnzgSj96Bz97eAuCTuitzDvHS1aCFUTkC1aUsf +AUTHENTIK_HOST_BROWSER=https://access.luckyden.org diff --git a/03_auth/docker-compose.yml b/03_auth/docker-compose.yml index 98eb3be..fa2229a 100644 --- a/03_auth/docker-compose.yml +++ b/03_auth/docker-compose.yml @@ -1,8 +1,8 @@ services: + postgresql: image: docker.io/library/postgres:16-alpine restart: unless-stopped - healthcheck: test: - CMD-SHELL @@ -11,28 +11,22 @@ services: interval: 30s retries: 5 timeout: 5s - volumes: - /home/docker/DenAccess/database:/var/lib/postgresql/data - environment: - POSTGRES_PASSWORD=${DENACCESS_POSTGRES_PASSWORD} - POSTGRES_USER=${DENACCESS_POSTGRES_USER} - POSTGRES_DB=${DENACCESS_POSTGRES_DB} - env_file: - .env - networks: tan-network: ipv4_address: 10.10.0.30 - redis: image: docker.io/library/redis:alpine command: --save 60 1 --loglevel warning restart: unless-stopped - healthcheck: test: - CMD-SHELL @@ -41,15 +35,12 @@ services: interval: 30s retries: 5 timeout: 3s - volumes: - /home/docker/DenAccess/redis:/data - networks: tan-network: ipv4_address: 10.10.0.31 - server: image: ghcr.io/goauthentik/server:2025.10.2 restart: unless-stopped @@ -68,37 +59,29 @@ services: - AUTHENTIK_COOKIE__SECURE=true - AUTHENTIK_SESSION__COOKIE_SECURE=true - TRUSTED_PROXIES=10.10.0.20 - volumes: - /home/docker/DenAccess/media:/media - /home/docker/DenAccess/custom-templates:/templates - env_file: - .env - depends_on: - postgresql - redis - networks: tan-network: ipv4_address: 10.10.0.32 - labels: - traefik.enable=true - # ROUTER - - traefik.http.routers.authentik.rule=Host(`access.luckyden.org`) - - traefik.http.routers.authentik.entrypoints=websecure - - traefik.http.routers.authentik.tls=true - + - traefik.http.routers.authentik-server.rule=Host(`access.luckyden.org`) + - traefik.http.routers.authentik-server.entrypoints=websecure + - traefik.http.routers.authentik-server.tls=true + - traefik.http.routers.authentik-server.priority=10 # SERVICE (HTTP interne uniquement !) - - traefik.http.services.authentik.loadbalancer.server.port=9000 - + - traefik.http.services.authentik-server.loadbalancer.server.port=9000 # HEADERS IMPORTANT (auth flows) - traefik.http.middlewares.authentik-headers.headers.customrequestheaders.X-Forwarded-Proto=https - - traefik.http.routers.authentik.middlewares=authentik-headers - + - traefik.http.routers.authentik-server.middlewares=authentik-headers worker: image: ghcr.io/goauthentik/server:2025.10.2 @@ -130,11 +113,44 @@ services: depends_on: - postgresql - redis + - server networks: tan-network: ipv4_address: 10.10.0.33 + authentik-proxy: + image: ghcr.io/goauthentik/proxy:2025.10.2 + restart: unless-stopped + expose: + - 9000 + environment: + AUTHENTIK_PROXY_SESSION_STORAGE: filesystem + AUTHENTIK_PROXY_SESSION_STORAGE_FILESYSTEM_PATH: /sessions + AUTHENTIK_HOST: http://server:9000 + AUTHENTIK_INSECURE: "false" + AUTHENTIK_TOKEN: "${AUTHENTIK_TOKEN}" + AUTHENTIK_HOST_BROWSER: ${AUTHENTIK_HOST_BROWSER} + labels: + - traefik.enable=true + # ROUTE OUTPOST βœ… + - traefik.http.routers.authentik-outpost.rule=Host(`access.luckyden.org`) && PathPrefix(`/outpost.goauthentik.io`) + - traefik.http.routers.authentik-outpost.entrypoints=websecure + - traefik.http.routers.authentik-outpost.tls=true + - traefik.http.services.authentik-outpost.loadbalancer.server.port=9000 + - traefik.http.routers.authentik-outpost.priority=100 + # βœ… LE MIDDLEWARE + - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik + - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true + - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid + volumes: + - /home/docker/DenAccess/proxy/sessions:/sessions + networks: + tan-network: + ipv4_address: 10.10.0.34 + shm_size: 512m + depends_on: + - server networks: tan-network: diff --git a/04_monitoring/.env b/04_monitoring/.env new file mode 100644 index 0000000..2f1c4e9 --- /dev/null +++ b/04_monitoring/.env @@ -0,0 +1,17 @@ +DENHUB_ENC_KEY=e25536f36d47d0443f04b6d9ee1d63dcda684e70960b1f0a650b24a0c8809a69 +DENHUB_URL=https://dashboard.luckyden.org + +TURBODEN_APP_KEY=base64:YJHR04kuQ/siVg24Cq0GwlXm0y1Ii0KIXua6dQzYM7c= +TURBODEN_MAIL_USERNAME=lacour.anthony14@gmail.com +TURBODEN_MAIL_PASSWORD=hlbf dfyx geny iqjb +TURBODEN_MAIL_FROM_ADDRESS=turboden@gmail.com +TURBODEN_MAIL_FROM_NAME=TurboDen +TURBODEN_SPEEDTEST_SERVERS=32565 + +DIPDEN_POSTGRES_DB=guacamole_db +DIPDEN_POSTGRES_USER=guacamole_user +DIPDEN_POSTGRES_PASSWORD=db#tan2023 +DIPDEN_POSTGRESQL_HOST=guacamole_db +DIPDEN_POSTGRESQL_DATABASE=guacamole_db +DIPDEN_POSTGRESQL_USERNAME=guacamole_user +DIPDEN_POSTGRESQL_PASSWORD=db#tan2023 diff --git a/04_monitoring/docker-compose.yml b/04_monitoring/docker-compose.yml index ec2dee1..765076a 100644 --- a/04_monitoring/docker-compose.yml +++ b/04_monitoring/docker-compose.yml @@ -27,6 +27,8 @@ services: - traefik.http.routers.dash.entrypoints=websecure - traefik.http.routers.dash.tls.certresolver=cloudflare - traefik.http.services.dash.loadbalancer.server.port=3002 + - traefik.http.services.dash.loadbalancer.passhostheader=true + # - traefik.http.routers.dash.middlewares=authentik@docker homarr: restart: unless-stopped diff --git a/06_media/.env b/06_media/.env new file mode 100644 index 0000000..660a4a1 --- /dev/null +++ b/06_media/.env @@ -0,0 +1,3 @@ +JWT_SECRET=90bc954426a07802fb8d3efcf38413ac45f655e97abacd3efa258761d1838ceb +COOKIE_SECRET=6a56c01f879cb7f35ace735ebad0d948c769372a2ef81a6a1481a6da13eee0f5 +DB_PASSWORD=tracearr diff --git a/07_photo/.env b/07_photo/.env new file mode 100644 index 0000000..db5f217 --- /dev/null +++ b/07_photo/.env @@ -0,0 +1,7 @@ +PIXDEN_UPLOAD_LOCATION=/mnt/bindmounts/multimedia/MΓ©dias/Library +PIXDEN_DB_DATA_LOCATION=/home/docker/PixDen/postgres +PIXDEN_IMMICH_VERSION=release +PIXDEN_DB_PASSWORD=6QFG4d3g5EGZE384gdegqSGDGGDSG3rteh4 +PIXDEN_DB_USERNAME=postgres +PIXDEN_DB_DATABASE_NAME=immich +PIXDEN_DB_HOSTNAME=database diff --git a/09_repository/.env b/09_repository/.env new file mode 100644 index 0000000..36eee24 --- /dev/null +++ b/09_repository/.env @@ -0,0 +1,3 @@ +REPODEN_POSTGRES_USER=gitea_tan +REPODEN_POSTGRES_PASSWORD=gitea#tan2023 +REPODEN_POSTGRES_DB=gitea diff --git a/12_torrent/.env b/12_torrent/.env new file mode 100644 index 0000000..cce7e7c --- /dev/null +++ b/12_torrent/.env @@ -0,0 +1,6 @@ + +NEKO_USER_PASS=neko +NEKO_ADMIN_PASS=Admin#tan2023 + +RENDEN_SECRET_KEY=dSEllv6fUeLQz8eHWzWc4vWGd3rIc44YRjOyBwi0C4LMSV7aJZ5L +RENDEN_API_KEY=tapi_e5RGZKJKQ diff --git a/14_applications/.env b/14_applications/.env new file mode 100644 index 0000000..a03b9f0 --- /dev/null +++ b/14_applications/.env @@ -0,0 +1 @@ +# VARIABLE=value #comment diff --git a/14_infra-assistant/.env b/14_infra-assistant/.env new file mode 100644 index 0000000..26b6f1c --- /dev/null +++ b/14_infra-assistant/.env @@ -0,0 +1,17 @@ +# Grafana +GRAFANA_URL=http://grafana:3000 +GRAFANA_TOKEN=changeme + +# Prometheus +PROMETHEUS_URL=http://prometheus:9090 + +# Mail +SMTP_HOST=smtp.example.com +SMTP_PORT=587 +SMTP_USER=alert@example.com +SMTP_PASS=changeme +MAIL_TO=you@example.com + +# LLM +OLLAMA_URL=http://ollama:11434 +OLLAMA_MODEL=mistral:7b-instruct diff --git a/15_llm/.env b/15_llm/.env new file mode 100644 index 0000000..a03b9f0 --- /dev/null +++ b/15_llm/.env @@ -0,0 +1 @@ +# VARIABLE=value #comment diff --git a/18_openclaw/.env b/18_openclaw/.env new file mode 100644 index 0000000..940d397 --- /dev/null +++ b/18_openclaw/.env @@ -0,0 +1,4 @@ +TZ=Europe/Paris +OPENCLAW_BASE_URL=https://claw.luckyden.org +DOCKER_HOST=tcp://socket-proxy:2375 +HOST=0.0.0.0 diff --git a/19_rackula/.env b/19_rackula/.env new file mode 100644 index 0000000..72787d8 --- /dev/null +++ b/19_rackula/.env @@ -0,0 +1,12 @@ +RACKULA_LISTEN_PORT=80 +RACKULA_API_PORT=3001 +RACKULA_API_WRITE_TOKEN=HkXTxFORHjF2jiOS1TZr1kU5bAsQl0k7 +RACKULA_AUTH_SESSION_SECRET=HVkbGtJcX5xyCAKlbODGzQ7aJsX4GKU3 +CORS_ORIGIN=https://rackula.luckyden.org +RACKULA_AUTH_SESSION_COOKIE_SECURE=true + +RACKULA_AUTH_MODE=local +RACKULA_AUTH_CSRF_PROTECTION=true + +RACKULA_LOCAL_USERNAME=admin_tan +RACKULA_LOCAL_PASSWORD=Admin#tan2023 diff --git a/19_rackula/compose.yaml b/19_rackula/compose.yaml new file mode 100644 index 0000000..3f50d47 --- /dev/null +++ b/19_rackula/compose.yaml @@ -0,0 +1,92 @@ +services: + rackula: + image: ghcr.io/rackulalives/rackula:persist + restart: unless-stopped + + environment: + #- API_HOST=rackula-api + #- API_PORT=${RACKULA_API_PORT} + - RACKULA_LISTEN_PORT=${RACKULA_LISTEN_PORT} + - API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-} + - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE} + - TRUST_PROXY=true + + depends_on: + - rackula-api + + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + + read_only: false + + tmpfs: + - /var/cache/nginx:size=10M + - /var/run:size=1M + - /tmp:size=5M + - /etc/nginx/conf.d:size=1M,uid=101,gid=101 + + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + + networks: + tan-network: + ipv4_address: 10.10.0.190 + + labels: + - traefik.enable=true + - traefik.http.routers.rackula.rule=Host(`rackula.luckyden.org`) + - traefik.http.routers.rackula.entrypoints=websecure + - traefik.http.routers.rackula.tls.certresolver=cloudflare + - traefik.http.services.rackula.loadbalancer.server.port=80 + - traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Proto=https + - traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Port=443 + - traefik.http.routers.rackula.middlewares=rackula + + rackula-api: + image: ghcr.io/rackulalives/rackula-api:latest + restart: unless-stopped + + volumes: + - /home/docker/RackuDen/api/data:/data + + environment: + - DATA_DIR=/data + - RACKULA_API_PORT=${RACKULA_API_PORT} + - CORS_ORIGIN=${CORS_ORIGIN} + - RACKULA_API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN} + - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE} + - RACKULA_LOCAL_USERNAME=${RACKULA_LOCAL_USERNAME} + - RACKULA_LOCAL_PASSWORD=${RACKULA_LOCAL_PASSWORD} + - ALLOW_INSECURE_CORS=false + - RACKULA_AUTH_SESSION_SECRET=${RACKULA_AUTH_SESSION_SECRET} + - RACKULA_AUTH_SESSION_COOKIE_SECURE=${RACKULA_AUTH_SESSION_COOKIE_SECURE} + - RACKULA_AUTH_CSRF_PROTECTION=${RACKULA_AUTH_CSRF_PROTECTION} + + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + + read_only: false + + tmpfs: + - /tmp:size=5M + + logging: + driver: json-file + options: + max-size: "5m" + max-file: "2" + + networks: + tan-network: + ipv4_address: 10.10.0.191 + +networks: + tan-network: + external: true