admin_tan/infra
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auto backup 2026-03-25_13:03:04

Browse Source
This commit is contained in:
tan-docker
2026-03-25 13:03:04 +01:00
parent 9486478e25
commit 7f7cacc7ff
16 changed files with 251 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
02_traefik/.env
+2
View File
@@ -0,0 +1,2 @@
ADM_EMAIL=[email protected]
CF_DNS_API_TOKEN=cfat_LJUOrlKgDJFmELY25VnrlQzrpqm9bpYhUTJyqQBy69400a1f
02_traefik/compose.yaml
+26
View File
@@ -13,14 +13,40 @@ services:
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
# ✅ Cloudflare DNS challenge
- --certificatesresolvers.cloudflare.acme.dnschallenge=true
- --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
- --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
- --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json
# ✅ Trust Cloudflare
- --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
- --entrypoints.websecure.forwardedHeaders.insecure=true
labels:
- traefik.enable=true
# =========================
# 🔐 AUTHENTIK FORWARD AUTH
# =========================
- traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
- traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
- traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
# =========================
# 🏠 LOCAL BYPASS (optionnel)
# =========================
- traefik.http.middlewares.local-ipwhitelist.ipwhitelist.sourcerange=10.0.0.0/8,192.168.0.0/16
# =========================
# 🔗 GLOBAL CHAIN
# =========================
# 👉 AVEC bypass LAN :
- traefik.http.middlewares.chain-auth.chain.middlewares=local-ipwhitelist,authentik
# 👉 SI tu veux FORCER auth partout (sans bypass LAN) :
# - traefik.http.middlewares.chain-auth.chain.middlewares=authentik
ports:
- 80:80
- 443:443
03_auth/.env
+17
View File
@@ -0,0 +1,17 @@
DENACCESS_POSTGRES_DB=authentik-luckyden-db
DENACCESS_POSTGRES_USER=authentik-luckyden-admin
DENACCESS_POSTGRES_PASSWORD=6OCBfxO4mL!8
DENACCESS_AUTHENTIK_SECRET_KEY=qliGSpJEuJgEFSszeQgUVaEhVqISKbVZyWzmFzpmHGqWX0A1GkrBoL4ttkmRQ
DENACCESS_AUTHENTIK_HOST=https://access.luckyden.org/
AUTHENTIK_EMAIL__HOST=smtp.gmail.com
AUTHENTIK_EMAIL__PORT=465
AUTHENTIK_EMAIL__USERNAME=[email protected]
AUTHENTIK_EMAIL__PASSWORD=hlbf dfyx geny iqjb
AUTHENTIK_EMAIL__USE_TLS=false
AUTHENTIK_EMAIL__USE_SSL=true
AUTHENTIK_EMAIL__TIMEOUT=10
AUTHENTIK_EMAIL__FROM=[email protected]
AUTHENTIK_TOKEN=dUrxclY2eIQ5s93GhajjLpsnzgSj96Bz97eAuCTuitzDvHS1aCFUTkC1aUsf
AUTHENTIK_HOST_BROWSER=https://access.luckyden.org
03_auth/docker-compose.yml
+40 -24
View File
@@ -1,8 +1,8 @@
services:
postgresql:
image: docker.io/library/postgres:16-alpine
restart: unless-stopped
healthcheck:
test:
- CMD-SHELL
@@ -11,28 +11,22 @@ services:
interval: 30s
retries: 5
timeout: 5s
volumes:
- /home/docker/DenAccess/database:/var/lib/postgresql/data
environment:
- POSTGRES_PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
- POSTGRES_USER=${DENACCESS_POSTGRES_USER}
- POSTGRES_DB=${DENACCESS_POSTGRES_DB}
env_file:
- .env
networks:
tan-network:
ipv4_address: 10.10.0.30
redis:
image: docker.io/library/redis:alpine
command: --save 60 1 --loglevel warning
restart: unless-stopped
healthcheck:
test:
- CMD-SHELL
@@ -41,15 +35,12 @@ services:
interval: 30s
retries: 5
timeout: 3s
volumes:
- /home/docker/DenAccess/redis:/data
networks:
tan-network:
ipv4_address: 10.10.0.31
server:
image: ghcr.io/goauthentik/server:2025.10.2
restart: unless-stopped
@@ -68,37 +59,29 @@ services:
- AUTHENTIK_COOKIE__SECURE=true
- AUTHENTIK_SESSION__COOKIE_SECURE=true
- TRUSTED_PROXIES=10.10.0.20
volumes:
- /home/docker/DenAccess/media:/media
- /home/docker/DenAccess/custom-templates:/templates
env_file:
- .env
depends_on:
- postgresql
- redis
networks:
tan-network:
ipv4_address: 10.10.0.32
labels:
- traefik.enable=true
# ROUTER
- traefik.http.routers.authentik.rule=Host(`access.luckyden.org`)
- traefik.http.routers.authentik.entrypoints=websecure
- traefik.http.routers.authentik.tls=true
- traefik.http.routers.authentik-server.rule=Host(`access.luckyden.org`)
- traefik.http.routers.authentik-server.entrypoints=websecure
- traefik.http.routers.authentik-server.tls=true
- traefik.http.routers.authentik-server.priority=10
# SERVICE (HTTP interne uniquement !)
- traefik.http.services.authentik.loadbalancer.server.port=9000
- traefik.http.services.authentik-server.loadbalancer.server.port=9000
# HEADERS IMPORTANT (auth flows)
- traefik.http.middlewares.authentik-headers.headers.customrequestheaders.X-Forwarded-Proto=https
- traefik.http.routers.authentik.middlewares=authentik-headers
- traefik.http.routers.authentik-server.middlewares=authentik-headers
worker:
image: ghcr.io/goauthentik/server:2025.10.2
@@ -130,11 +113,44 @@ services:
depends_on:
- postgresql
- redis
- server
networks:
tan-network:
ipv4_address: 10.10.0.33
authentik-proxy:
image: ghcr.io/goauthentik/proxy:2025.10.2
restart: unless-stopped
expose:
- 9000
environment:
AUTHENTIK_PROXY_SESSION_STORAGE: filesystem
AUTHENTIK_PROXY_SESSION_STORAGE_FILESYSTEM_PATH: /sessions
AUTHENTIK_HOST: http://server:9000
AUTHENTIK_INSECURE: "false"
AUTHENTIK_TOKEN: "${AUTHENTIK_TOKEN}"
AUTHENTIK_HOST_BROWSER: ${AUTHENTIK_HOST_BROWSER}
labels:
- traefik.enable=true
# ROUTE OUTPOST ✅
- traefik.http.routers.authentik-outpost.rule=Host(`access.luckyden.org`) && PathPrefix(`/outpost.goauthentik.io`)
- traefik.http.routers.authentik-outpost.entrypoints=websecure
- traefik.http.routers.authentik-outpost.tls=true
- traefik.http.services.authentik-outpost.loadbalancer.server.port=9000
- traefik.http.routers.authentik-outpost.priority=100
# ✅ LE MIDDLEWARE
- traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
- traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
- traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
volumes:
- /home/docker/DenAccess/proxy/sessions:/sessions
networks:
tan-network:
ipv4_address: 10.10.0.34
shm_size: 512m
depends_on:
- server
networks:
tan-network:
04_monitoring/.env
+17
View File
@@ -0,0 +1,17 @@
DENHUB_ENC_KEY=e25536f36d47d0443f04b6d9ee1d63dcda684e70960b1f0a650b24a0c8809a69
DENHUB_URL=https://dashboard.luckyden.org
TURBODEN_APP_KEY=base64:YJHR04kuQ/siVg24Cq0GwlXm0y1Ii0KIXua6dQzYM7c=
TURBODEN_MAIL_USERNAME=[email protected]
TURBODEN_MAIL_PASSWORD=hlbf dfyx geny iqjb
TURBODEN_MAIL_FROM_ADDRESS=[email protected]
TURBODEN_MAIL_FROM_NAME=TurboDen
TURBODEN_SPEEDTEST_SERVERS=32565
DIPDEN_POSTGRES_DB=guacamole_db
DIPDEN_POSTGRES_USER=guacamole_user
DIPDEN_POSTGRES_PASSWORD=db#tan2023
DIPDEN_POSTGRESQL_HOST=guacamole_db
DIPDEN_POSTGRESQL_DATABASE=guacamole_db
DIPDEN_POSTGRESQL_USERNAME=guacamole_user
DIPDEN_POSTGRESQL_PASSWORD=db#tan2023
04_monitoring/docker-compose.yml
+2
View File
@@ -27,6 +27,8 @@ services:
- traefik.http.routers.dash.entrypoints=websecure
- traefik.http.routers.dash.tls.certresolver=cloudflare
- traefik.http.services.dash.loadbalancer.server.port=3002
- traefik.http.services.dash.loadbalancer.passhostheader=true
# - traefik.http.routers.dash.middlewares=authentik@docker
homarr:
restart: unless-stopped
06_media/.env
+3
View File
@@ -0,0 +1,3 @@
JWT_SECRET=90bc954426a07802fb8d3efcf38413ac45f655e97abacd3efa258761d1838ceb
COOKIE_SECRET=6a56c01f879cb7f35ace735ebad0d948c769372a2ef81a6a1481a6da13eee0f5
DB_PASSWORD=tracearr
07_photo/.env
+7
View File
@@ -0,0 +1,7 @@
PIXDEN_UPLOAD_LOCATION=/mnt/bindmounts/multimedia/Médias/Library
PIXDEN_DB_DATA_LOCATION=/home/docker/PixDen/postgres
PIXDEN_IMMICH_VERSION=release
PIXDEN_DB_PASSWORD=6QFG4d3g5EGZE384gdegqSGDGGDSG3rteh4
PIXDEN_DB_USERNAME=postgres
PIXDEN_DB_DATABASE_NAME=immich
PIXDEN_DB_HOSTNAME=database
09_repository/.env
+3
View File
@@ -0,0 +1,3 @@
REPODEN_POSTGRES_USER=gitea_tan
REPODEN_POSTGRES_PASSWORD=gitea#tan2023
REPODEN_POSTGRES_DB=gitea
12_torrent/.env
+6
View File
@@ -0,0 +1,6 @@
NEKO_USER_PASS=neko
NEKO_ADMIN_PASS=Admin#tan2023
RENDEN_SECRET_KEY=dSEllv6fUeLQz8eHWzWc4vWGd3rIc44YRjOyBwi0C4LMSV7aJZ5L
RENDEN_API_KEY=tapi_e5RGZKJKQ
14_applications/.env
+1
View File
@@ -0,0 +1 @@
# VARIABLE=value #comment
14_infra-assistant/.env
+17
View File
@@ -0,0 +1,17 @@
# Grafana
GRAFANA_URL=http://grafana:3000
GRAFANA_TOKEN=changeme
# Prometheus
PROMETHEUS_URL=http://prometheus:9090
# Mail
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USER=[email protected]
SMTP_PASS=changeme
MAIL_TO=[email protected]
# LLM
OLLAMA_URL=http://ollama:11434
OLLAMA_MODEL=mistral:7b-instruct
15_llm/.env
+1
View File
@@ -0,0 +1 @@
# VARIABLE=value #comment
18_openclaw/.env
+4
View File
@@ -0,0 +1,4 @@
TZ=Europe/Paris
OPENCLAW_BASE_URL=https://claw.luckyden.org
DOCKER_HOST=tcp://socket-proxy:2375
HOST=0.0.0.0
19_rackula/.env
+12
View File
@@ -0,0 +1,12 @@
RACKULA_LISTEN_PORT=80
RACKULA_API_PORT=3001
RACKULA_API_WRITE_TOKEN=HkXTxFORHjF2jiOS1TZr1kU5bAsQl0k7
RACKULA_AUTH_SESSION_SECRET=HVkbGtJcX5xyCAKlbODGzQ7aJsX4GKU3
CORS_ORIGIN=https://rackula.luckyden.org
RACKULA_AUTH_SESSION_COOKIE_SECURE=true
RACKULA_AUTH_MODE=local
RACKULA_AUTH_CSRF_PROTECTION=true
RACKULA_LOCAL_USERNAME=admin_tan
RACKULA_LOCAL_PASSWORD=Admin#tan2023
19_rackula/compose.yaml
+92
View File
@@ -0,0 +1,92 @@
services:
rackula:
image: ghcr.io/rackulalives/rackula:persist
restart: unless-stopped
environment:
#- API_HOST=rackula-api
#- API_PORT=${RACKULA_API_PORT}
- RACKULA_LISTEN_PORT=${RACKULA_LISTEN_PORT}
- API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-}
- RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE}
- TRUST_PROXY=true
depends_on:
- rackula-api
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
read_only: false
tmpfs:
- /var/cache/nginx:size=10M
- /var/run:size=1M
- /tmp:size=5M
- /etc/nginx/conf.d:size=1M,uid=101,gid=101
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
networks:
tan-network:
ipv4_address: 10.10.0.190
labels:
- traefik.enable=true
- traefik.http.routers.rackula.rule=Host(`rackula.luckyden.org`)
- traefik.http.routers.rackula.entrypoints=websecure
- traefik.http.routers.rackula.tls.certresolver=cloudflare
- traefik.http.services.rackula.loadbalancer.server.port=80
- traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Proto=https
- traefik.http.middlewares.rackula.headers.customrequestheaders.X-Forwarded-Port=443
- traefik.http.routers.rackula.middlewares=rackula
rackula-api:
image: ghcr.io/rackulalives/rackula-api:latest
restart: unless-stopped
volumes:
- /home/docker/RackuDen/api/data:/data
environment:
- DATA_DIR=/data
- RACKULA_API_PORT=${RACKULA_API_PORT}
- CORS_ORIGIN=${CORS_ORIGIN}
- RACKULA_API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN}
- RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE}
- RACKULA_LOCAL_USERNAME=${RACKULA_LOCAL_USERNAME}
- RACKULA_LOCAL_PASSWORD=${RACKULA_LOCAL_PASSWORD}
- ALLOW_INSECURE_CORS=false
- RACKULA_AUTH_SESSION_SECRET=${RACKULA_AUTH_SESSION_SECRET}
- RACKULA_AUTH_SESSION_COOKIE_SECURE=${RACKULA_AUTH_SESSION_COOKIE_SECURE}
- RACKULA_AUTH_CSRF_PROTECTION=${RACKULA_AUTH_CSRF_PROTECTION}
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
read_only: false
tmpfs:
- /tmp:size=5M
logging:
driver: json-file
options:
max-size: "5m"
max-file: "2"
networks:
tan-network:
ipv4_address: 10.10.0.191
networks:
tan-network:
external: true