Initial commit - Talloires documentation
This commit is contained in:
182
docs/services/authelia.md
Normal file
182
docs/services/authelia.md
Normal file
@@ -0,0 +1,182 @@
|
||||
# Authelia - SSO
|
||||
|
||||
Authelia fournit l'authentification unique (SSO) pour tous les services Talloires.
|
||||
|
||||
## Accès
|
||||
|
||||
| Paramètre | Valeur |
|
||||
|-----------|--------|
|
||||
| URL | [auth.talloires.local](https://auth.talloires.local) |
|
||||
| Utilisateur | lionel |
|
||||
| Email | dflected@dflected.org |
|
||||
| 2FA | TOTP activé |
|
||||
|
||||
## Services protégés (forward_auth)
|
||||
|
||||
Ces services requièrent une authentification via Authelia avant d'accéder au backend :
|
||||
|
||||
| Service | URL |
|
||||
|---------|-----|
|
||||
| docs | docs.talloires.local |
|
||||
| portainer | portainer.talloires.local |
|
||||
| dockge | dockge.talloires.local |
|
||||
| transmission | transmission.talloires.local |
|
||||
| netdata | netdata.talloires.local |
|
||||
| homeassistant | homeassistant.talloires.local |
|
||||
| uptime | uptime.talloires.local |
|
||||
| cockpit | cockpit.talloires.local |
|
||||
| vikunja | vikunja.talloires.local |
|
||||
| hoarder | hoarder.talloires.local |
|
||||
| linkwarden | linkwarden.talloires.local |
|
||||
| languagetool | languagetool.talloires.local |
|
||||
| jellyfin | jellyfin.talloires.local |
|
||||
|
||||
## Services avec OAuth/OIDC
|
||||
|
||||
Ces services utilisent Authelia comme provider OpenID Connect :
|
||||
|
||||
### Gitea
|
||||
| Paramètre | Valeur |
|
||||
|-----------|--------|
|
||||
| Client ID | gitea |
|
||||
| Redirect URI | https://git.talloires.local/user/oauth2/Authelia/callback |
|
||||
| Scopes | openid, email, profile |
|
||||
|
||||
### Outline
|
||||
| Paramètre | Valeur |
|
||||
|-----------|--------|
|
||||
| Client ID | outline |
|
||||
| Redirect URI | https://outline.talloires.local/auth/oidc.callback |
|
||||
| Scopes | openid, offline_access, profile, email |
|
||||
|
||||
### Grafana (Header Auth)
|
||||
Grafana utilise l'authentification par header via Authelia (pas OIDC) :
|
||||
|
||||
| Header | Valeur |
|
||||
|--------|--------|
|
||||
| Remote-User | Utilisateur authentifié |
|
||||
| Remote-Email | Email de l'utilisateur |
|
||||
|
||||
## Configuration
|
||||
|
||||
### Fichiers
|
||||
| Fichier | Usage |
|
||||
|---------|-------|
|
||||
| ~/docker/authelia/config/configuration.yml | Config principale |
|
||||
| ~/docker/authelia/config/users_database.yml | Base utilisateurs |
|
||||
| ~/docker/authelia/config/oidc.key | Clé privée OIDC |
|
||||
|
||||
### SMTP (Proton Mail)
|
||||
| Paramètre | Valeur |
|
||||
|-----------|--------|
|
||||
| Serveur | smtp.protonmail.ch:465 |
|
||||
| Protocol | TLS implicite (submissions://) |
|
||||
| From | Talloires <dflected@dflected.org> |
|
||||
|
||||
### Buffers HTTP
|
||||
|
||||
Pour éviter l'erreur 431 (Request Header Fields Too Large), la config inclut :
|
||||
|
||||
```yaml
|
||||
server:
|
||||
buffers:
|
||||
read: 8192
|
||||
write: 8192
|
||||
```
|
||||
|
||||
## Intégration Caddy
|
||||
|
||||
### Snippet forward_auth
|
||||
```
|
||||
(authelia) {
|
||||
forward_auth authelia:9091 {
|
||||
uri /api/authz/forward-auth
|
||||
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Usage dans Caddyfile
|
||||
```
|
||||
monservice.talloires.local {
|
||||
import authelia
|
||||
reverse_proxy backend:port
|
||||
tls internal
|
||||
}
|
||||
```
|
||||
|
||||
### Bypass Authelia (accès ZeroTier)
|
||||
```
|
||||
monservice.talloires.1871.zt {
|
||||
# Pas de forward_auth = pas d'Authelia
|
||||
reverse_proxy backend:port
|
||||
tls internal
|
||||
}
|
||||
```
|
||||
|
||||
## Ajouter un client OIDC
|
||||
|
||||
1. Générer le hash du secret :
|
||||
```bash
|
||||
docker exec authelia authelia crypto hash generate pbkdf2 --password "mon-secret"
|
||||
```
|
||||
|
||||
2. Ajouter dans configuration.yml (section identity_providers.oidc.clients) :
|
||||
```yaml
|
||||
- client_id: nouveau_client
|
||||
client_name: Mon Service
|
||||
client_secret: "$pbkdf2-sha512$..."
|
||||
public: false
|
||||
authorization_policy: two_factor
|
||||
redirect_uris:
|
||||
- https://service.talloires.local/callback
|
||||
scopes:
|
||||
- openid
|
||||
- email
|
||||
- profile
|
||||
token_endpoint_auth_method: client_secret_post
|
||||
```
|
||||
|
||||
3. Redémarrer Authelia :
|
||||
```bash
|
||||
docker restart authelia
|
||||
```
|
||||
|
||||
## Commandes utiles
|
||||
|
||||
```bash
|
||||
# Logs
|
||||
docker logs authelia -f
|
||||
|
||||
# Générer un hash de mot de passe utilisateur
|
||||
docker exec authelia authelia crypto hash generate argon2 --password "motdepasse"
|
||||
|
||||
# Générer un hash pour OIDC client secret
|
||||
docker exec authelia authelia crypto hash generate pbkdf2 --password "secret"
|
||||
|
||||
# Valider la configuration
|
||||
docker exec authelia authelia validate-config
|
||||
```
|
||||
|
||||
## Dépannage
|
||||
|
||||
### Erreur 431 (Header Fields Too Large)
|
||||
Augmenter les buffers dans configuration.yml :
|
||||
```yaml
|
||||
server:
|
||||
buffers:
|
||||
read: 8192
|
||||
write: 8192
|
||||
```
|
||||
|
||||
### OIDC "invalid_client"
|
||||
Vérifier que le client_secret est hashé avec pbkdf2 (pas argon2).
|
||||
|
||||
### Cookies non persistants
|
||||
Vérifier que le domain est correct dans session :
|
||||
```yaml
|
||||
session:
|
||||
cookies:
|
||||
- domain: talloires.local
|
||||
authelia_url: https://auth.talloires.local
|
||||
```
|
||||
76
docs/services/backup.md
Normal file
76
docs/services/backup.md
Normal file
@@ -0,0 +1,76 @@
|
||||
# Backup
|
||||
|
||||
Sauvegarde automatique de Talloires vers Annecy (Synology NAS).
|
||||
|
||||
## Configuration
|
||||
|
||||
| Paramètre | Valeur |
|
||||
|-----------|--------|
|
||||
| Script | ~/backup-to-annecy.sh |
|
||||
| Destination | rsync-talloires@10.171.171.50:/volume1/Backups/talloires/ |
|
||||
| Méthode | tar over SSH (rsync SUID bloqué sur Synology DSM 7) |
|
||||
| Schedule | Cron quotidien à 3h00 |
|
||||
| Rétention | 7 derniers backups |
|
||||
| Log | ~/backup.log |
|
||||
|
||||
## Données sauvegardées
|
||||
|
||||
- ~/docker/ (toutes les configs Docker)
|
||||
|
||||
### Exclusions
|
||||
- *.log
|
||||
- */cache/*
|
||||
- */logs/*
|
||||
- */__pycache__/*
|
||||
|
||||
## Authentification SSH
|
||||
|
||||
- Clé privée (root): /root/.ssh/id_ed25519
|
||||
- Clé privée (lionel): ~/.ssh/id_ed25519
|
||||
- Utilisateur distant: rsync-talloires
|
||||
- Fingerprint: SHA256:CxpeBfvrBV/s+RNE49SwrY3WsG28Du3nyQ/2D9lApU8
|
||||
|
||||
## Commandes
|
||||
|
||||
### Lancer un backup manuel
|
||||
```bash
|
||||
~/backup-to-annecy.sh
|
||||
```
|
||||
|
||||
### Vérifier le log
|
||||
```bash
|
||||
cat ~/backup.log
|
||||
```
|
||||
|
||||
### Vérifier les backups sur Annecy
|
||||
```bash
|
||||
sudo ssh -i /root/.ssh/id_ed25519 rsync-talloires@10.171.171.50 "ls -lh /volume1/Backups/talloires/"
|
||||
```
|
||||
|
||||
### Restaurer un backup
|
||||
```bash
|
||||
# Sur Talloires
|
||||
sudo ssh -i /root/.ssh/id_ed25519 rsync-talloires@10.171.171.50 "cat /volume1/Backups/talloires/docker-backup-YYYYMMDD-HHMMSS.tar.gz" | sudo tar -xzf - -C /home/lionel/
|
||||
```
|
||||
|
||||
## Cron
|
||||
|
||||
```bash
|
||||
# Voir le cron
|
||||
sudo crontab -l
|
||||
|
||||
# Modifier
|
||||
sudo crontab -e
|
||||
```
|
||||
|
||||
Entrée actuelle :
|
||||
```
|
||||
0 3 * * * /home/lionel/backup-to-annecy.sh
|
||||
```
|
||||
|
||||
## Notes techniques
|
||||
|
||||
Le rsync classique ne fonctionne pas avec Synology DSM 7 car :
|
||||
- rsync est SUID root sur DSM
|
||||
- Les utilisateurs non-admin nont pas de shell par défaut
|
||||
- Solution: tar over SSH fonctionne parfaitement
|
||||
149
docs/services/overview.md
Normal file
149
docs/services/overview.md
Normal file
@@ -0,0 +1,149 @@
|
||||
# Vue ensemble des services
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
Client (Mac/iPhone)
|
||||
|
|
||||
| HTTPS (certificat Caddy CA)
|
||||
v
|
||||
[Caddy] :443
|
||||
|
|
||||
+-- forward_auth --> [Authelia] :9091
|
||||
| |
|
||||
| (si authentifié)
|
||||
| |
|
||||
+-------------------------+
|
||||
|
|
||||
v
|
||||
Services Docker
|
||||
```
|
||||
|
||||
## Services actifs (24 containers)
|
||||
|
||||
### 🎬 Média
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Jellyfin | jellyfin | 8096 | Streaming vidéo avec transcodage hardware (VideoCore) |
|
||||
| Transmission | transmission | 9091, 51413 | Client BitTorrent avec web UI |
|
||||
|
||||
### ✅ Productivité
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Vikunja | vikunja | 3456 | Gestion de tâches style Todoist/Trello avec CalDAV |
|
||||
| Outline | outline + outline-db + outline-redis | 3000 | Wiki collaboratif avec OIDC (PostgreSQL + Redis) |
|
||||
| Hoarder | hoarder | 3000 | Bookmarks intelligents avec tagging AI (Anthropic) |
|
||||
| Linkwarden | linkwarden + linkwarden-db | 3000 | Gestionnaire de bookmarks avancé avec archivage |
|
||||
| LanguageTool | languagetool | 8010 | Serveur de correction grammaticale (FR/EN/DE) |
|
||||
|
||||
### 🔧 Infrastructure
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Portainer | portainer | 9000 | Interface de gestion Docker |
|
||||
| Dockge | dockge | 5001 | Interface Docker Compose |
|
||||
| Gitea | gitea | 3000, 22 | Serveur Git avec SSO Authelia |
|
||||
| MkDocs | mkdocs | 8000 | Cette documentation |
|
||||
|
||||
### 📊 Monitoring
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Grafana | grafana | 3000 | Dashboards et visualisation (header auth via Authelia) |
|
||||
| Netdata | netdata | 19999 | Monitoring système temps réel |
|
||||
| Uptime Kuma | uptime-kuma | 3001 | Surveillance uptime des services |
|
||||
| Loki | loki | 3100 | Agrégation de logs |
|
||||
| Promtail | promtail | - | Collecte de logs pour Loki |
|
||||
| Syslog-ng | syslog-ng | 1514 | Collecte syslog centralisée |
|
||||
|
||||
### 🏠 Domotique
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Home Assistant | homeassistant | 8123 | Automatisation domotique (mode host network) |
|
||||
|
||||
### 🔐 Sécurité
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Authelia | authelia | 9091 | SSO, 2FA, OIDC provider |
|
||||
| CrowdSec | crowdsec | - | IDS/IPS collaboratif |
|
||||
| Caddy | caddy | 80, 443 | Reverse proxy avec TLS automatique |
|
||||
|
||||
### 🔄 Maintenance
|
||||
| Service | Container | Port | Description |
|
||||
|---------|-----------|------|-------------|
|
||||
| Watchtower | watchtower | 8080 | Mise à jour auto des containers (4h00) |
|
||||
|
||||
## Répertoires Docker
|
||||
|
||||
```
|
||||
~/docker/
|
||||
├── authelia/ # Config SSO
|
||||
├── caddy/ # Caddyfile + certificats
|
||||
├── crowdsec/ # Config IDS
|
||||
├── dockge/ # Stacks Dockge
|
||||
├── docs/ # MkDocs (cette doc)
|
||||
├── gitea/ # Config + data Gitea
|
||||
├── grafana/ # Dashboards
|
||||
├── homeassistant/ # Config HA
|
||||
├── languagetool/ # Config LT
|
||||
├── linkwarden/ # Config Linkwarden
|
||||
├── outline/ # Config Outline
|
||||
├── syslog-ng/ # Config syslog
|
||||
├── talloires/ # Stack principal (docker-compose.yml)
|
||||
├── uptime-kuma/ # Data Uptime Kuma
|
||||
├── vikunja/ # Config Vikunja
|
||||
└── zeronsd/ # DNS ZeroTier
|
||||
```
|
||||
|
||||
## Réseau
|
||||
|
||||
| Réseau | Plage | Usage |
|
||||
|--------|-------|-------|
|
||||
| ZeroTier | 10.144.0.0/16 | Accès distant |
|
||||
| Docker talloires_net | 172.20.0.0/16 | Inter-containers |
|
||||
| LAN physique | 10.171.171.0/24 | Réseau local |
|
||||
|
||||
### Adresses ZeroTier clés
|
||||
| Serveur | IP |
|
||||
|---------|-----|
|
||||
| Talloires (Pi5) | 10.144.221.22 |
|
||||
| Annecy (Synology) | 10.144.78.193 |
|
||||
| Olympou (Mac) | 10.144.46.46 |
|
||||
|
||||
## Stockage
|
||||
|
||||
| Mount | Source | Usage |
|
||||
|-------|--------|-------|
|
||||
| /mnt/mediaserver | USB SSD 4TB | Films, Séries, Downloads, Databases |
|
||||
| ~/docker | SD Card | Configs Docker légères |
|
||||
|
||||
### Structure USB (/mnt/mediaserver)
|
||||
```
|
||||
/mnt/mediaserver/
|
||||
├── databases/
|
||||
│ ├── languagetool/ngrams/ # N-grams FR/EN/DE (~8GB)
|
||||
│ └── outline/
|
||||
│ ├── data/ # Fichiers Outline
|
||||
│ ├── postgres/ # PostgreSQL Outline
|
||||
│ └── redis/ # Redis Outline
|
||||
├── downloads/ # Transmission
|
||||
├── movies/ # Films (Jellyfin)
|
||||
└── series/ # Séries (Jellyfin)
|
||||
```
|
||||
|
||||
## Backup
|
||||
|
||||
| Paramètre | Valeur |
|
||||
|-----------|--------|
|
||||
| Destination | Annecy (Synology) |
|
||||
| Schedule | 3h00 quotidien |
|
||||
| Rétention | 7 jours |
|
||||
| Méthode | tar over SSH |
|
||||
|
||||
Voir [Scripts de maintenance](../reference/scripts.md) pour les détails.
|
||||
|
||||
## Maintenance automatique
|
||||
|
||||
| Tâche | Schedule | Outil |
|
||||
|-------|----------|-------|
|
||||
| Mise à jour containers | 4h00 | Watchtower |
|
||||
| Backup vers Annecy | 3h00 | backup-to-annecy.sh (cron) |
|
||||
| Nettoyage images | Après update | docker image prune |
|
||||
Reference in New Issue
Block a user