auto backup 2026-03-25_13:03:04

02_traefik/.env

@@ -0,0 +1,2 @@
+ADM_EMAIL=[email protected]
+CF_DNS_API_TOKEN=cfat_LJUOrlKgDJFmELY25VnrlQzrpqm9bpYhUTJyqQBy69400a1f

02_traefik/compose.yaml

@@ -13,14 +13,40 @@ services:
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
 
+      # ✅ Cloudflare DNS challenge
       - --certificatesresolvers.cloudflare.acme.dnschallenge=true
       - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
       - --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
       - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json
 
+      # ✅ Trust Cloudflare
       - --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
       - --entrypoints.websecure.forwardedHeaders.insecure=true
 
+    labels:
+      - traefik.enable=true
+
+      # =========================
+      # 🔐 AUTHENTIK FORWARD AUTH
+      # =========================
+      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
+      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
+      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
+
+      # =========================
+      # 🏠 LOCAL BYPASS (optionnel)
+      # =========================
+      - traefik.http.middlewares.local-ipwhitelist.ipwhitelist.sourcerange=10.0.0.0/8,192.168.0.0/16
+
+      # =========================
+      # 🔗 GLOBAL CHAIN
+      # =========================
+      # 👉 AVEC bypass LAN :
+      - traefik.http.middlewares.chain-auth.chain.middlewares=local-ipwhitelist,authentik
+
+      # 👉 SI tu veux FORCER auth partout (sans bypass LAN) :
+      # - traefik.http.middlewares.chain-auth.chain.middlewares=authentik
+
     ports:
       - 80:80
       - 443:443

03_auth/.env

@@ -0,0 +1,17 @@
+DENACCESS_POSTGRES_DB=authentik-luckyden-db
+DENACCESS_POSTGRES_USER=authentik-luckyden-admin
+DENACCESS_POSTGRES_PASSWORD=6OCBfxO4mL!8
+DENACCESS_AUTHENTIK_SECRET_KEY=qliGSpJEuJgEFSszeQgUVaEhVqISKbVZyWzmFzpmHGqWX0A1GkrBoL4ttkmRQ
+DENACCESS_AUTHENTIK_HOST=https://access.luckyden.org/
+
+AUTHENTIK_EMAIL__HOST=smtp.gmail.com
+AUTHENTIK_EMAIL__PORT=465
+AUTHENTIK_EMAIL__USERNAME=[email protected]
+AUTHENTIK_EMAIL__PASSWORD=hlbf dfyx geny iqjb
+AUTHENTIK_EMAIL__USE_TLS=false
+AUTHENTIK_EMAIL__USE_SSL=true
+AUTHENTIK_EMAIL__TIMEOUT=10
+AUTHENTIK_EMAIL__FROM=[email protected]
+
+AUTHENTIK_TOKEN=dUrxclY2eIQ5s93GhajjLpsnzgSj96Bz97eAuCTuitzDvHS1aCFUTkC1aUsf
+AUTHENTIK_HOST_BROWSER=https://access.luckyden.org

03_auth/docker-compose.yml

@@ -1,8 +1,8 @@
 services:
+
   postgresql:
     image: docker.io/library/postgres:16-alpine
     restart: unless-stopped
-
     healthcheck:
       test:
         - CMD-SHELL
@@ -11,28 +11,22 @@ services:
       interval: 30s
       retries: 5
       timeout: 5s
-
     volumes:
       - /home/docker/DenAccess/database:/var/lib/postgresql/data
-
     environment:
       - POSTGRES_PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
       - POSTGRES_USER=${DENACCESS_POSTGRES_USER}
       - POSTGRES_DB=${DENACCESS_POSTGRES_DB}
-
     env_file:
       - .env
-
     networks:
       tan-network:
         ipv4_address: 10.10.0.30
 
-
   redis:
     image: docker.io/library/redis:alpine
     command: --save 60 1 --loglevel warning
     restart: unless-stopped
-
     healthcheck:
       test:
         - CMD-SHELL
@@ -41,15 +35,12 @@ services:
       interval: 30s
       retries: 5
       timeout: 3s
-
     volumes:
       - /home/docker/DenAccess/redis:/data
-
     networks:
       tan-network:
         ipv4_address: 10.10.0.31
 
-
   server:
     image: ghcr.io/goauthentik/server:2025.10.2
     restart: unless-stopped
@@ -68,37 +59,29 @@ services:
       - AUTHENTIK_COOKIE__SECURE=true
       - AUTHENTIK_SESSION__COOKIE_SECURE=true
       - TRUSTED_PROXIES=10.10.0.20
-
     volumes:
       - /home/docker/DenAccess/media:/media
       - /home/docker/DenAccess/custom-templates:/templates
-
     env_file:
       - .env
-
     depends_on:
       - postgresql
       - redis
-
     networks:
       tan-network:
         ipv4_address: 10.10.0.32
-
     labels:
       - traefik.enable=true
-
       # ROUTER
-      - traefik.http.routers.authentik.rule=Host(`access.luckyden.org`)
+      - traefik.http.routers.authentik-server.rule=Host(`access.luckyden.org`)
-      - traefik.http.routers.authentik.entrypoints=websecure
+      - traefik.http.routers.authentik-server.entrypoints=websecure
-      - traefik.http.routers.authentik.tls=true
+      - traefik.http.routers.authentik-server.tls=true
-
+      - traefik.http.routers.authentik-server.priority=10
       # SERVICE (HTTP interne uniquement !)
-      - traefik.http.services.authentik.loadbalancer.server.port=9000
+      - traefik.http.services.authentik-server.loadbalancer.server.port=9000
-
       # HEADERS IMPORTANT (auth flows)
       - traefik.http.middlewares.authentik-headers.headers.customrequestheaders.X-Forwarded-Proto=https
-      - traefik.http.routers.authentik.middlewares=authentik-headers
+      - traefik.http.routers.authentik-server.middlewares=authentik-headers
-
 
   worker:
     image: ghcr.io/goauthentik/server:2025.10.2
@@ -130,11 +113,44 @@ services:
     depends_on:
       - postgresql
       - redis
+      - server
 
     networks:
       tan-network:
         ipv4_address: 10.10.0.33
 
+  authentik-proxy:
+    image: ghcr.io/goauthentik/proxy:2025.10.2
+    restart: unless-stopped
+    expose:
+      - 9000
+    environment:
+      AUTHENTIK_PROXY_SESSION_STORAGE: filesystem
+      AUTHENTIK_PROXY_SESSION_STORAGE_FILESYSTEM_PATH: /sessions
+      AUTHENTIK_HOST: http://server:9000
+      AUTHENTIK_INSECURE: "false"
+      AUTHENTIK_TOKEN: "${AUTHENTIK_TOKEN}"
+      AUTHENTIK_HOST_BROWSER: ${AUTHENTIK_HOST_BROWSER}
+    labels:
+      - traefik.enable=true
+      # ROUTE OUTPOST ✅
+      - traefik.http.routers.authentik-outpost.rule=Host(`access.luckyden.org`) && PathPrefix(`/outpost.goauthentik.io`)
+      - traefik.http.routers.authentik-outpost.entrypoints=websecure
+      - traefik.http.routers.authentik-outpost.tls=true
+      - traefik.http.services.authentik-outpost.loadbalancer.server.port=9000
+      - traefik.http.routers.authentik-outpost.priority=100
+      # ✅ LE MIDDLEWARE
+      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
+      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
+      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
+    volumes:
+      - /home/docker/DenAccess/proxy/sessions:/sessions
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.34
+    shm_size: 512m
+    depends_on:
+      - server
 
 networks:
   tan-network:

04_monitoring/.env

@@ -0,0 +1,17 @@
+DENHUB_ENC_KEY=e25536f36d47d0443f04b6d9ee1d63dcda684e70960b1f0a650b24a0c8809a69
+DENHUB_URL=https://dashboard.luckyden.org
+      
+TURBODEN_APP_KEY=base64:YJHR04kuQ/siVg24Cq0GwlXm0y1Ii0KIXua6dQzYM7c=
+TURBODEN_MAIL_USERNAME=[email protected]
+TURBODEN_MAIL_PASSWORD=hlbf dfyx geny iqjb
+TURBODEN_MAIL_FROM_ADDRESS=[email protected]
+TURBODEN_MAIL_FROM_NAME=TurboDen
+TURBODEN_SPEEDTEST_SERVERS=32565
+
+DIPDEN_POSTGRES_DB=guacamole_db
+DIPDEN_POSTGRES_USER=guacamole_user
+DIPDEN_POSTGRES_PASSWORD=db#tan2023
+DIPDEN_POSTGRESQL_HOST=guacamole_db
+DIPDEN_POSTGRESQL_DATABASE=guacamole_db
+DIPDEN_POSTGRESQL_USERNAME=guacamole_user
+DIPDEN_POSTGRESQL_PASSWORD=db#tan2023

04_monitoring/docker-compose.yml

@@ -27,6 +27,8 @@ services:
       - traefik.http.routers.dash.entrypoints=websecure
       - traefik.http.routers.dash.tls.certresolver=cloudflare
       - traefik.http.services.dash.loadbalancer.server.port=3002
+      - traefik.http.services.dash.loadbalancer.passhostheader=true
+      # - traefik.http.routers.dash.middlewares=authentik@docker
 
   homarr:
     restart: unless-stopped

06_media/.env

@@ -0,0 +1,3 @@
+JWT_SECRET=90bc954426a07802fb8d3efcf38413ac45f655e97abacd3efa258761d1838ceb
+COOKIE_SECRET=6a56c01f879cb7f35ace735ebad0d948c769372a2ef81a6a1481a6da13eee0f5
+DB_PASSWORD=tracearr

07_photo/.env

@@ -0,0 +1,7 @@
+PIXDEN_UPLOAD_LOCATION=/mnt/bindmounts/multimedia/Médias/Library
+PIXDEN_DB_DATA_LOCATION=/home/docker/PixDen/postgres
+PIXDEN_IMMICH_VERSION=release
+PIXDEN_DB_PASSWORD=6QFG4d3g5EGZE384gdegqSGDGGDSG3rteh4
+PIXDEN_DB_USERNAME=postgres
+PIXDEN_DB_DATABASE_NAME=immich
+PIXDEN_DB_HOSTNAME=database

09_repository/.env

@@ -0,0 +1,3 @@
+REPODEN_POSTGRES_USER=gitea_tan
+REPODEN_POSTGRES_PASSWORD=gitea#tan2023
+REPODEN_POSTGRES_DB=gitea

12_torrent/.env

@@ -0,0 +1,6 @@
+
+NEKO_USER_PASS=neko
+NEKO_ADMIN_PASS=Admin#tan2023
+
+RENDEN_SECRET_KEY=dSEllv6fUeLQz8eHWzWc4vWGd3rIc44YRjOyBwi0C4LMSV7aJZ5L
+RENDEN_API_KEY=tapi_e5RGZKJKQ

14_applications/.env

@@ -0,0 +1 @@
+# VARIABLE=value #comment

14_infra-assistant/.env

@@ -0,0 +1,17 @@
+# Grafana
+GRAFANA_URL=http://grafana:3000
+GRAFANA_TOKEN=changeme
+
+# Prometheus
+PROMETHEUS_URL=http://prometheus:9090
+
+# Mail
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USER=[email protected]
+SMTP_PASS=changeme
+MAIL_TO=[email protected]
+
+# LLM
+OLLAMA_URL=http://ollama:11434
+OLLAMA_MODEL=mistral:7b-instruct

15_llm/.env

@@ -0,0 +1 @@
+# VARIABLE=value #comment

18_openclaw/.env

@@ -0,0 +1,4 @@
+TZ=Europe/Paris
+OPENCLAW_BASE_URL=https://claw.luckyden.org
+DOCKER_HOST=tcp://socket-proxy:2375
+HOST=0.0.0.0

19_rackula/.env

@@ -0,0 +1,12 @@
+RACKULA_LISTEN_PORT=80
+RACKULA_API_PORT=3001
+RACKULA_API_WRITE_TOKEN=HkXTxFORHjF2jiOS1TZr1kU5bAsQl0k7
+RACKULA_AUTH_SESSION_SECRET=HVkbGtJcX5xyCAKlbODGzQ7aJsX4GKU3
+CORS_ORIGIN=https://rackula.luckyden.org
+RACKULA_AUTH_SESSION_COOKIE_SECURE=true
+
+RACKULA_AUTH_MODE=local
+RACKULA_AUTH_CSRF_PROTECTION=true
+
+RACKULA_LOCAL_USERNAME=admin_tan
+RACKULA_LOCAL_PASSWORD=Admin#tan2023

19_rackula/compose.yaml

@@ -0,0 +1,92 @@
+services:
+  rackula:
+    image: ghcr.io/rackulalives/rackula:persist
+    restart: unless-stopped
+
+    environment:
+      #- API_HOST=rackula-api
+      #- API_PORT=${RACKULA_API_PORT}
+      - RACKULA_LISTEN_PORT=${RACKULA_LISTEN_PORT}
+      - API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-}
+      - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE}
+      - TRUST_PROXY=true
+
+    depends_on:
+      - rackula-api
+
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+    read_only: false
+
+    tmpfs:
+      - /var/cache/nginx:size=10M
+      - /var/run:size=1M
+      - /tmp:size=5M
+      - /etc/nginx/conf.d:size=1M,uid=101,gid=101
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.190
+
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.rackula.rule=Host(`rackula.luckyden.org`)
+      - traefik.http.routers.rackula.entrypoints=websecure
+      - traefik.http.routers.rackula.tls.certresolver=cloudflare
+      - traefik.http.services.rackula.loadbalancer.server.port=80
+      - traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Proto=https
+      - traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Port=443
+      - traefik.http.routers.rackula.middlewares=rackula
+
+  rackula-api:
+    image: ghcr.io/rackulalives/rackula-api:latest
+    restart: unless-stopped
+
+    volumes:
+      - /home/docker/RackuDen/api/data:/data
+
+    environment:
+      - DATA_DIR=/data
+      - RACKULA_API_PORT=${RACKULA_API_PORT}
+      - CORS_ORIGIN=${CORS_ORIGIN}
+      - RACKULA_API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN}
+      - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE}
+      - RACKULA_LOCAL_USERNAME=${RACKULA_LOCAL_USERNAME}
+      - RACKULA_LOCAL_PASSWORD=${RACKULA_LOCAL_PASSWORD}
+      - ALLOW_INSECURE_CORS=false
+      - RACKULA_AUTH_SESSION_SECRET=${RACKULA_AUTH_SESSION_SECRET}
+      - RACKULA_AUTH_SESSION_COOKIE_SECURE=${RACKULA_AUTH_SESSION_COOKIE_SECURE}
+      - RACKULA_AUTH_CSRF_PROTECTION=${RACKULA_AUTH_CSRF_PROTECTION}
+
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+    read_only: false
+
+    tmpfs:
+      - /tmp:size=5M
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "5m"
+        max-file: "2"
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.191
+
+networks:
+  tan-network:
+    external: true