383 lines
7.8 KiB
Markdown
383 lines
7.8 KiB
Markdown
# Infrastructure Talloires v2.0
|
|
|
|
Documentation de l'infrastructure réseau, VPN, DNS, et backups.
|
|
|
|
---
|
|
|
|
## 🖥️ Serveurs
|
|
|
|
### Talloires (Production)
|
|
- **Type**: Raspberry Pi 5 (8GB RAM)
|
|
- **OS**: Raspberry Pi OS (Debian 12)
|
|
- **IP Tailscale**: `100.116.198.105`
|
|
- **Hostname**: `talloires.tailfd281f.ts.net`
|
|
- **Rôle**: Serveur principal (Docker)
|
|
|
|
### Annecy (Storage)
|
|
- **Type**: Synology DS620slim
|
|
- **OS**: DSM 7.x
|
|
- **IP Tailscale**: `100.69.227.96`
|
|
- **Hostname**: `annecy.tailfd281f.ts.net`
|
|
- **Rôle**: NAS, Backups
|
|
|
|
### Theseus (Network)
|
|
- **Type**: UniFi Dream Router 7
|
|
- **Rôle**: Gateway, Firewall, DHCP
|
|
|
|
---
|
|
|
|
## 🐳 Outils Docker Management
|
|
|
|
### 🎨 Arcane - Web UI
|
|
|
|
**URL**: [go/arcane](https://go/arcane)
|
|
**License**: BSD-3-Clause
|
|
**Status**: ✅ Opérationnel
|
|
|
|
**Fonctionnalités:**
|
|
- Gestion containers, images, volumes, networks
|
|
- Docker Compose templates & projects
|
|
- Monitoring temps réel (CPU/RAM)
|
|
- Interface moderne & responsive
|
|
- Multi-serveurs (via agents)
|
|
|
|
**Usage:**
|
|
```bash
|
|
# Accès web
|
|
https://go/arcane
|
|
|
|
# Credentials par défaut
|
|
Username: arcane
|
|
Password: arcane-admin
|
|
```
|
|
|
|
**Alternative à:** Portainer (proprietary), Dockge (unstable)
|
|
|
|
---
|
|
|
|
### 📋 Dozzle - Logs Viewer
|
|
|
|
**URL**: [go/logs](https://go/logs)
|
|
**License**: MIT
|
|
**Status**: ✅ Opérationnel
|
|
|
|
**Fonctionnalités:**
|
|
- Real-time log streaming
|
|
- Multi-container view
|
|
- Search & filter
|
|
- Ultra-léger (~30 MB RAM)
|
|
- Aucune base de données
|
|
|
|
**Usage:**
|
|
```bash
|
|
# Accès web
|
|
https://go/logs
|
|
|
|
# Pas d'authentification requise (Tailscale VPN only)
|
|
```
|
|
|
|
**Use cases:** Debug, troubleshooting, monitoring logs
|
|
|
|
---
|
|
|
|
### ⚡ Lazydocker - Terminal UI
|
|
|
|
**License**: MIT
|
|
**Status**: ✅ Installé sur Talloires & Annecy
|
|
**Version**: 0.24.3
|
|
|
|
**Installation:**
|
|
```bash
|
|
# Talloires
|
|
lazydocker --version
|
|
# Location: /usr/local/bin/lazydocker
|
|
|
|
# Annecy (Synology)
|
|
~/.local/bin/lazydocker --version
|
|
```
|
|
|
|
**Fonctionnalités:**
|
|
- TUI (Terminal User Interface)
|
|
- Stats en temps réel (CPU/RAM)
|
|
- Logs interactifs
|
|
- Actions rapides (start/stop/restart)
|
|
- Fonctionne via SSH
|
|
|
|
**Usage:**
|
|
```bash
|
|
# Sur Talloires
|
|
ssh lionel@talloires.local
|
|
lazydocker
|
|
|
|
# Sur Annecy
|
|
ssh lionel@100.69.227.96
|
|
~/.local/bin/lazydocker
|
|
```
|
|
|
|
**Navigation:**
|
|
- `↑/↓`: Sélection
|
|
- `Enter`: Actions
|
|
- `l`: Logs
|
|
- `e`: Exec shell
|
|
- `q`: Quitter
|
|
|
|
---
|
|
|
|
### 📊 Comparaison Outils
|
|
|
|
| Feature | Arcane | Dozzle | Lazydocker |
|
|
|---------|--------|--------|------------|
|
|
| **Type** | Web UI | Web UI | TUI |
|
|
| **Containers** | ✅ Full mgmt | ❌ View only | ✅ Full mgmt |
|
|
| **Logs** | ✅ | ✅ | ✅ |
|
|
| **Compose** | ✅ Templates | ❌ | ✅ View |
|
|
| **Stats** | ✅ | ❌ | ✅ |
|
|
| **Remote** | ✅ Multi-host | ❌ Single | ❌ Single |
|
|
| **SSH** | ❌ | ❌ | ✅ Works |
|
|
| **RAM** | ~100 MB | ~30 MB | ~50 MB |
|
|
|
|
**Recommandations:**
|
|
- **Arcane**: Gestion quotidienne, templates, multi-serveurs
|
|
- **Dozzle**: Quick log inspection, debugging
|
|
- **Lazydocker**: SSH access, TUI lovers, remote management
|
|
|
|
---
|
|
|
|
## 🌐 Réseau
|
|
|
|
### Tailscale VPN
|
|
- **Type**: WireGuard mesh VPN
|
|
- **MagicDNS**: Désactivé (dnsmasq preferred)
|
|
- **Subnet**: `100.64.0.0/10`
|
|
|
|
### DNS Local (dnsmasq)
|
|
**Config**: `/etc/dnsmasq.d/tailscale.conf`
|
|
|
|
```
|
|
# Machines
|
|
address=/talloires.local/100.116.198.105
|
|
address=/annecy.local/100.69.227.96
|
|
|
|
# Wildcards
|
|
address=/.talloires.local/100.116.198.105
|
|
|
|
# Go-links
|
|
address=/go/100.116.198.105
|
|
|
|
# Upstream DNS
|
|
server=127.0.0.1#5053
|
|
```
|
|
|
|
### AdGuard DNS (DoH)
|
|
- **Port**: 5053
|
|
- **Upstream**: AdGuard DNS-over-HTTPS
|
|
- **Config**: `cloudflared` tunnel
|
|
|
|
---
|
|
|
|
## 🔐 VPN Tunnel (ProtonVPN)
|
|
|
|
### Configuration WireGuard
|
|
- **Server**: Luxembourg (LU#44)
|
|
- **Public IP**: 5.253.204.190
|
|
- **Endpoint**: 5.253.204.162:51820
|
|
- **Config**: `/home/lionel/talloires-v2/transmission/wireguard/wg0.conf`
|
|
|
|
### Kill-Switch
|
|
Transmission utilise `network_mode: service:wireguard` → Impossible de leak l'IP réelle.
|
|
|
|
### Monitoring VPN
|
|
- Vérification automatique IP publique
|
|
- Alertes Telegram si VPN down (<30s)
|
|
- Health checks Docker
|
|
|
|
---
|
|
|
|
## 💾 Backups
|
|
|
|
### Structure NFS
|
|
```
|
|
/mnt/annecy/talloires/
|
|
├── migration-v2/ # Backups migration
|
|
│ ├── jellyfin-config-*.tar.gz # 2.3 GB
|
|
│ ├── gitea-data-*.tar.gz # Repos Git
|
|
│ ├── mkdocs-v1-archive-*.tar.gz # 12 KB
|
|
│ └── critical-configs-*.tar.gz # 3.5 KB
|
|
└── daily/ # Backups quotidiens (TODO)
|
|
```
|
|
|
|
### NFS Mount
|
|
```bash
|
|
sudo mount -t nfs 100.69.227.96:/volume1/talloires /mnt/annecy -o rw,hard,intr,rsize=8192,wsize=8192
|
|
```
|
|
|
|
**Fstab**:
|
|
```
|
|
100.69.227.96:/volume1/talloires /mnt/annecy nfs rw,hard,intr,rsize=8192,wsize=8192 0 0
|
|
```
|
|
|
|
### Backup Automatique (Cron)
|
|
TODO: Mettre à jour cron pour v2.0 structure.
|
|
|
|
---
|
|
|
|
## 🔒 Sécurité
|
|
|
|
### Firewall (UFW)
|
|
```bash
|
|
sudo ufw status
|
|
```
|
|
|
|
Ports ouverts:
|
|
- 80, 443: HTTP/HTTPS (Caddy)
|
|
- 2222: SSH Gitea
|
|
- 8096: Jellyfin (direct access)
|
|
- 22: SSH (Tailscale only)
|
|
|
|
### Certificats HTTPS
|
|
- **CA**: Caddy Local Authority
|
|
- **Cert**: `/data/caddy/pki/authorities/local/root.crt`
|
|
- **Installation**: Importer dans macOS Keychain → Always Trust
|
|
|
|
### Accès
|
|
- Tailscale VPN uniquement
|
|
- Pas d'exposition Internet directe
|
|
- SSH keys only (no password)
|
|
|
|
---
|
|
|
|
## 📊 Monitoring
|
|
|
|
### Stack Monitoring
|
|
|
|
**Netdata** - System metrics
|
|
- **URL**: `https://go/net`
|
|
- **Métriques**: CPU, RAM, Disk, Network, Docker
|
|
- **Alertes**: À configurer (optionnel)
|
|
|
|
**Arcane** - Docker monitoring
|
|
- **URL**: `https://go/arcane`
|
|
- **Métriques**: Containers stats (CPU/RAM)
|
|
- **Features**: Dashboard, projects, logs
|
|
|
|
**Dozzle** - Logs viewer
|
|
- **URL**: `https://go/logs`
|
|
- **Features**: Real-time logs, search, filter
|
|
|
|
**Lazydocker** - Terminal monitoring
|
|
```bash
|
|
ssh lionel@talloires.local
|
|
lazydocker
|
|
```
|
|
|
|
### Docker Health Checks
|
|
Tous les containers ont des health checks configurés.
|
|
|
|
### Logs
|
|
```bash
|
|
# CLI
|
|
docker logs <container>
|
|
docker logs <container> --follow
|
|
docker logs <container> --tail 100
|
|
|
|
# Web UI (Dozzle)
|
|
https://go/logs
|
|
|
|
# TUI (Lazydocker)
|
|
lazydocker
|
|
```
|
|
|
|
---
|
|
|
|
## 🛠️ Maintenance
|
|
|
|
### Docker Management
|
|
|
|
**Via Arcane (Web):**
|
|
```
|
|
https://go/arcane
|
|
→ Containers → Start/Stop/Restart
|
|
→ Images → Pull/Delete
|
|
→ Projects → Manage Compose stacks
|
|
```
|
|
|
|
**Via Lazydocker (TUI):**
|
|
```bash
|
|
ssh lionel@talloires.local
|
|
lazydocker
|
|
# Navigate avec arrows, Enter pour actions
|
|
```
|
|
|
|
**Via CLI:**
|
|
```bash
|
|
# Update containers
|
|
cd /home/lionel/talloires-v2/core
|
|
docker compose pull
|
|
docker compose up -d
|
|
|
|
# Restart service
|
|
docker restart <container>
|
|
|
|
# View logs
|
|
docker logs <container> --tail 100
|
|
```
|
|
|
|
### Backup Manuel
|
|
```bash
|
|
# Jellyfin
|
|
tar -czf /mnt/annecy/talloires/manual/jellyfin-$(date +%Y%m%d).tar.gz \\
|
|
/home/lionel/talloires-v2/jellyfin/config
|
|
|
|
# Gitea
|
|
tar -czf /mnt/annecy/talloires/manual/gitea-$(date +%Y%m%d).tar.gz \\
|
|
/home/lionel/talloires-v2/gitea/
|
|
|
|
# Arcane database
|
|
tar -czf /mnt/annecy/talloires/manual/arcane-$(date +%Y%m%d).tar.gz \\
|
|
/home/lionel/talloires-v2/docker-mgmt/arcane-data
|
|
```
|
|
|
|
### Restart Services
|
|
```bash
|
|
docker restart <container>
|
|
docker compose restart
|
|
```
|
|
|
|
---
|
|
|
|
## 📁 Fichiers de Configuration
|
|
|
|
### Docker Management
|
|
```
|
|
/home/lionel/talloires-v2/docker-mgmt/
|
|
├── docker-compose.yml # Arcane + Dozzle
|
|
└── arcane-data/ # Arcane database
|
|
```
|
|
|
|
### Caddy
|
|
```
|
|
/home/lionel/talloires-v2/caddy/
|
|
├── Caddyfile # Reverse proxy config
|
|
└── Caddyfile.backup-* # Backups automatiques
|
|
```
|
|
|
|
### Services
|
|
```
|
|
/home/lionel/talloires-v2/
|
|
├── core/ # Caddy, Shlink
|
|
├── jellyfin/ # Media server
|
|
├── transmission/ # BitTorrent + WireGuard
|
|
├── gitea/ # Git hosting
|
|
├── homeassistant/ # Domotique
|
|
├── mkdocs/ # Documentation
|
|
├── netdata/ # Monitoring
|
|
├── signal-api/ # Notifications
|
|
└── docker-mgmt/ # Arcane + Dozzle
|
|
```
|
|
|
|
---
|
|
|
|
*Voir [Services](../services/overview.md) pour configuration applicative.*
|
|
|
|
*Dernière mise à jour: 31 décembre 2025*
|