Initial commit - Migration documentation 2026
This commit is contained in:
Lionel
58
docs/vault/config/caddy.md
Normal file
58
docs/vault/config/caddy.md
Normal file
@@ -0,0 +1,58 @@
|
||||
# Caddy - Reverse Proxy
|
||||
|
||||
## Configuration
|
||||
|
||||
Caddy gère le reverse proxy et les certificats SSL internes pour tous les services.
|
||||
|
||||
### Principes clés
|
||||
|
||||
1. **Domaines .local** : Utilisent Authelia pour l'authentification (réseau local)
|
||||
2. **Domaines .tailfd281f.ts.net** : Accès ZeroTier sans Authelia (services ont leur propre auth)
|
||||
3. **Certificats** : Auto-générés par Caddy (CA interne)
|
||||
|
||||
### Services sans Authelia
|
||||
|
||||
Ces services ont leur propre authentification :
|
||||
|
||||
- **Gitea** : OIDC via Authelia
|
||||
- **Outline** : OIDC via Authelia
|
||||
- **Linkwarden** : Auth intégrée
|
||||
- **Vikunja** : Auth intégrée
|
||||
- **Jellyfin** : Auth intégrée
|
||||
- **Home Assistant** : Auth intégrée
|
||||
|
||||
### Snippet Authelia
|
||||
|
||||
```caddyfile
|
||||
(authelia) {
|
||||
forward_auth authelia:9091 {
|
||||
uri /api/authz/forward-auth
|
||||
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### WebSocket Support
|
||||
|
||||
Pour Home Assistant et Dockge :
|
||||
|
||||
```caddyfile
|
||||
homeassistant.talloires.local {
|
||||
reverse_proxy homeassistant:8123 {
|
||||
header_up Host {host}
|
||||
}
|
||||
tls internal
|
||||
}
|
||||
```
|
||||
|
||||
### Problèmes connus
|
||||
|
||||
| Problème | Solution |
|
||||
|----------|----------|
|
||||
| Safari refuse certificats | Importer CA dans Trousseau macOS |
|
||||
| 400 Bad Request | Vérifier que le service n'a pas double auth |
|
||||
| Page blanche | Vérifier WebSocket headers |
|
||||
|
||||
### Fichier
|
||||
|
||||
`~/docker/caddy/Caddyfile`
|
||||
63
docs/vault/config/docker-stacks.md
Normal file
63
docs/vault/config/docker-stacks.md
Normal file
@@ -0,0 +1,63 @@
|
||||
# Docker Stacks
|
||||
|
||||
## Organisation
|
||||
|
||||
Les services sont organisés en stacks modulaires :
|
||||
|
||||
| Stack | Répertoire | Services |
|
||||
|-------|------------|----------|
|
||||
| Core | ~/docker/core | Caddy, Authelia, CrowdSec, Portainer, Dockge |
|
||||
| Monitoring | ~/docker/monitoring | Uptime Kuma, Netdata, Grafana, Loki, Promtail |
|
||||
| Media | ~/docker/media | Jellyfin, Transmission |
|
||||
| Productivity | ~/docker/productivity | Gitea, MkDocs, Vikunja, LanguageTool |
|
||||
| Homelab | ~/docker/homelab | Home Assistant, Watchtower |
|
||||
| Linkwarden | ~/docker/linkwarden | Linkwarden + PostgreSQL |
|
||||
| Outline | ~/docker/outline | Outline + PostgreSQL + Redis |
|
||||
|
||||
## Réseau
|
||||
|
||||
Tous les containers utilisent le réseau externe `talloires_net` :
|
||||
|
||||
```yaml
|
||||
networks:
|
||||
talloires_net:
|
||||
external: true
|
||||
```
|
||||
|
||||
## Volumes
|
||||
|
||||
### Volumes nommés (préfixés)
|
||||
|
||||
Attention lors des migrations : les volumes Docker sont préfixés par le nom du répertoire.
|
||||
|
||||
Exemple : `transmission_config` dans `~/docker/talloires` devient `talloires_transmission_config`.
|
||||
|
||||
**Solution** : Utiliser `external: true` pour les volumes existants :
|
||||
|
||||
```yaml
|
||||
volumes:
|
||||
talloires_transmission_config:
|
||||
external: true
|
||||
```
|
||||
|
||||
### Volumes bind mount
|
||||
|
||||
Préférer les bind mounts pour les données importantes :
|
||||
|
||||
```yaml
|
||||
volumes:
|
||||
- /home/lionel/docker/gitea:/data
|
||||
```
|
||||
|
||||
## Commandes utiles
|
||||
|
||||
```bash
|
||||
# Démarrer un stack
|
||||
cd ~/docker/media && docker compose up -d
|
||||
|
||||
# Voir les logs
|
||||
docker logs -f jellyfin
|
||||
|
||||
# Recréer un container
|
||||
docker compose up -d --force-recreate jellyfin
|
||||
```
|
||||
105
docs/vault/config/network.md
Normal file
105
docs/vault/config/network.md
Normal file
@@ -0,0 +1,105 @@
|
||||
# Architecture Réseau
|
||||
|
||||
## Vue d'ensemble
|
||||
|
||||
|
||||
|
||||
## Composants
|
||||
|
||||
### Tailscale
|
||||
|
||||
VPN mesh reliant tous les appareils de la famille.
|
||||
|
||||
| Machine | IP Tailscale | OS |
|
||||
|---------|--------------|-----|
|
||||
| talloires | 100.116.198.105 | Raspberry Pi 5 (Debian) |
|
||||
| annecy | 100.118.210.128 | Synology DS620slim |
|
||||
| olympou | 100.125.242.58 | macOS |
|
||||
| pentamodi | 100.78.237.78 | iOS |
|
||||
| perce | 100.69.7.78 | tvOS (Apple TV) |
|
||||
|
||||
**Tailnet:** tailfd281f.ts.net
|
||||
|
||||
### dnsmasq
|
||||
|
||||
Serveur DNS local sur Talloires, résout les domaines internes.
|
||||
|
||||
**Config:** `/etc/dnsmasq.d/tailscale.conf`
|
||||
|
||||
|
||||
|
||||
**Commandes:**
|
||||
|
||||
|
||||
|
||||
### cloudflared
|
||||
|
||||
Proxy DNS-over-HTTPS vers AdGuard DNS avec profil personnel.
|
||||
|
||||
**Config:** `/etc/cloudflared/config.yml`
|
||||
|
||||
|
||||
|
||||
**Commandes:**
|
||||
|
||||
|
||||
|
||||
## Configuration Tailscale Admin
|
||||
|
||||
Dans Tailscale Admin Console → DNS → Nameservers :
|
||||
|
||||
- **Global nameserver:** 100.116.198.105 (Talloires)
|
||||
- **Override local DNS:** activé
|
||||
|
||||
Cela force tous les appareils Tailscale à utiliser dnsmasq sur Talloires.
|
||||
|
||||
## Domaines
|
||||
|
||||
| Domaine | Usage |
|
||||
|---------|-------|
|
||||
| `*.talloires.local` | Services sur Talloires (recommandé) |
|
||||
| `*.talloires.tailfd281f.ts.net` | Alternative Tailscale |
|
||||
| `go` | Raccourcis Shlink |
|
||||
|
||||
## Dépannage
|
||||
|
||||
### Test résolution DNS
|
||||
|
||||
Server: 100.116.198.105
|
||||
Address: 100.116.198.105#53
|
||||
|
||||
Name: go
|
||||
Address: 100.116.198.105
|
||||
|
||||
Server: 100.116.198.105
|
||||
Address: 100.116.198.105#53
|
||||
|
||||
Name: docs.talloires.local
|
||||
Address: 100.116.198.105
|
||||
|
||||
Server: 100.116.198.105
|
||||
Address: 100.116.198.105#53
|
||||
|
||||
Non-authoritative answer:
|
||||
Name: google.com
|
||||
Address: 142.250.27.138
|
||||
Name: google.com
|
||||
Address: 142.250.27.100
|
||||
Name: google.com
|
||||
Address: 142.250.27.101
|
||||
Name: google.com
|
||||
Address: 142.250.27.102
|
||||
Name: google.com
|
||||
Address: 142.250.27.113
|
||||
Name: google.com
|
||||
Address: 142.250.27.139
|
||||
|
||||
### Services ne répondent pas
|
||||
|
||||
1. Vérifier que dnsmasq tourne: `sudo systemctl status dnsmasq`
|
||||
2. Vérifier que cloudflared tourne: `sudo systemctl status cloudflared-dns`
|
||||
3. Vérifier que Caddy tourne: `docker ps | grep caddy`
|
||||
|
||||
### Cache DNS
|
||||
|
||||
|
||||
74
docs/vault/config/troubleshooting.md
Normal file
74
docs/vault/config/troubleshooting.md
Normal file
@@ -0,0 +1,74 @@
|
||||
# Troubleshooting
|
||||
|
||||
## Problèmes connus
|
||||
|
||||
### Certificats SSL
|
||||
|
||||
**Symptôme** : Safari affiche "Can't establish secure connection"
|
||||
|
||||
**Cause** : CA Caddy non trusté par macOS
|
||||
|
||||
**Solution** :
|
||||
```bash
|
||||
# Exporter le CA
|
||||
ssh lionel@10.144.221.22 "docker exec caddy cat /data/caddy/pki/authorities/local/root.crt" > ~/Downloads/caddy-root-ca.crt
|
||||
|
||||
# Importer dans macOS
|
||||
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/Downloads/caddy-root-ca.crt
|
||||
```
|
||||
|
||||
### Gitea OAuth "500 Internal Server Error"
|
||||
|
||||
**Cause** : URL OAuth pointe vers hostname Docker interne
|
||||
|
||||
**Vérifier** :
|
||||
```bash
|
||||
docker exec gitea sqlite3 /data/gitea/gitea.db "SELECT cfg FROM login_source WHERE type=6;"
|
||||
```
|
||||
|
||||
**Corriger** :
|
||||
```bash
|
||||
docker exec gitea sqlite3 /data/gitea/gitea.db "UPDATE login_source SET cfg = REPLACE(cfg, 'http://authelia:9091', 'https://auth.talloires.local') WHERE type=6;"
|
||||
docker restart gitea
|
||||
```
|
||||
|
||||
### Container ne trouve pas l'URL externe
|
||||
|
||||
**Cause** : Container ne peut pas résoudre ou valider le certificat SSL
|
||||
|
||||
**Solution** : Monter le CA Caddy dans le container :
|
||||
```yaml
|
||||
volumes:
|
||||
- /home/lionel/docker/caddy-root-ca.crt:/etc/ssl/certs/caddy-root-ca.crt:ro
|
||||
environment:
|
||||
- SSL_CERT_FILE=/etc/ssl/certs/caddy-root-ca.crt
|
||||
```
|
||||
|
||||
### Outline "400 Bad Request"
|
||||
|
||||
**Cause** : Double authentification (Authelia + OIDC Outline)
|
||||
|
||||
**Solution** : Ne pas utiliser `import authelia` pour Outline dans Caddyfile
|
||||
|
||||
### Volumes disparus après migration
|
||||
|
||||
**Cause** : Nom du volume change avec le répertoire (préfixe)
|
||||
|
||||
**Solution** : Utiliser `external: true` ou lister les volumes existants :
|
||||
```bash
|
||||
docker volume ls | grep transmission
|
||||
```
|
||||
|
||||
### Home Assistant page blanche
|
||||
|
||||
**Cause** : WebSocket non supporté ou mauvais reverse proxy
|
||||
|
||||
**Vérifier** :
|
||||
```bash
|
||||
curl -s http://localhost:8123 | head -5
|
||||
```
|
||||
|
||||
**Solution** : Utiliser le nom du container, pas l'IP :
|
||||
```caddyfile
|
||||
reverse_proxy homeassistant:8123
|
||||
```
|
||||
Reference in New Issue
Block a user