Add EZ-Homelab Enhanced Setup System
- Complete modular bash-based setup system replacing Python TUI - Phase 1-4 implementation: Core Infrastructure, Configuration Management, Deployment Engine, Service Orchestration & Management - 9 production-ready scripts: preflight.sh, setup.sh, pre-deployment-wizard.sh, localize.sh, generalize.sh, validate.sh, deploy.sh, service.sh, monitor.sh, backup.sh, update.sh - Shared libraries: common.sh (utilities), ui.sh (text interface) - Template-based configuration system with environment variable substitution - Comprehensive documentation: PRD, standards, and quick reference guides - Automated backup, monitoring, and update management capabilities - Cross-platform compatibility with robust error handling and logging
This commit is contained in:
Kelin
87
docker-compose/core/authelia/configuration.yml.template
Normal file
87
docker-compose/core/authelia/configuration.yml.template
Normal file
@@ -0,0 +1,87 @@
|
||||
# Authelia Configuration
|
||||
# Copy to /opt/stacks/authelia/configuration.yml
|
||||
# IMPORTANT: Replace '${DOMAIN}' with your actual DuckDNS domain
|
||||
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: 9091
|
||||
|
||||
log:
|
||||
level: info
|
||||
|
||||
theme: dark
|
||||
|
||||
jwt_secret: ${AUTHELIA_JWT_SECRET}
|
||||
|
||||
default_redirection_url: https://auth.${DOMAIN}
|
||||
|
||||
totp:
|
||||
issuer: ${DOMAIN}
|
||||
period: 30
|
||||
skew: 1
|
||||
|
||||
authentication_backend:
|
||||
file:
|
||||
path: /config/users_database.yml
|
||||
password:
|
||||
algorithm: argon2id
|
||||
iterations: 1
|
||||
key_length: 32
|
||||
salt_length: 16
|
||||
memory: 1024
|
||||
parallelism: 8
|
||||
|
||||
access_control:
|
||||
default_policy: deny
|
||||
|
||||
rules:
|
||||
# Bypass Authelia for Jellyfin (allow app access)
|
||||
- domain: jellyfin.${DOMAIN}
|
||||
policy: bypass
|
||||
|
||||
# Bypass for Plex (allow app access)
|
||||
- domain: plex.${DOMAIN}
|
||||
policy: bypass
|
||||
|
||||
# Bypass for Home Assistant (has its own auth)
|
||||
- domain: ha.${DOMAIN}
|
||||
policy: bypass
|
||||
|
||||
# Bypass for development services (they have their own auth or setup)
|
||||
- domain: pgadmin.${DOMAIN}
|
||||
policy: bypass
|
||||
- domain: gitlab.${DOMAIN}
|
||||
policy: bypass
|
||||
|
||||
# Protected: All other services require authentication
|
||||
- domain: "*.${DOMAIN}"
|
||||
policy: one_factor
|
||||
|
||||
# Two-factor for admin services (optional)
|
||||
# - domain:
|
||||
# - "admin.${DOMAIN}"
|
||||
# - "portainer.${DOMAIN}"
|
||||
# policy: two_factor
|
||||
|
||||
session:
|
||||
name: authelia_session
|
||||
secret: ${AUTHELIA_SESSION_SECRET}
|
||||
expiration: 24h # Session expires after 24 hours
|
||||
inactivity: 24h # Session expires after 24 hours of inactivity
|
||||
remember_me_duration: 1M
|
||||
domain: ${DOMAIN}
|
||||
|
||||
regulation:
|
||||
max_retries: 3
|
||||
find_time: 2m
|
||||
ban_time: 5m
|
||||
|
||||
storage:
|
||||
encryption_key: ${AUTHELIA_STORAGE_ENCRYPTION_KEY}
|
||||
local:
|
||||
path: /data/db.sqlite3
|
||||
|
||||
notifier:
|
||||
# File-based notifications (for development/testing)
|
||||
filesystem:
|
||||
filename: /data/notification.txt
|
||||
12
docker-compose/core/authelia/users_database.yml.template
Normal file
12
docker-compose/core/authelia/users_database.yml.template
Normal file
@@ -0,0 +1,12 @@
|
||||
###############################################################
|
||||
# Users Database #
|
||||
###############################################################
|
||||
|
||||
users:
|
||||
kelin:
|
||||
displayname: "Admin User"
|
||||
password: "$argon2id$v=19$m=65536,t=3,p=4$a+3pIrywP/li9wy9J6UkMA$+3THyJiAnS/gNYnLaYtlsRCaYfgnnxsUyGZ4D3xGnUg"
|
||||
email: ${DEFAULT_EMAIL}
|
||||
groups:
|
||||
- admins
|
||||
- users
|
||||
139
docker-compose/core/docker-compose.yml.template
Normal file
139
docker-compose/core/docker-compose.yml.template
Normal file
@@ -0,0 +1,139 @@
|
||||
# Core Infrastructure Services
|
||||
# These services form the foundation of the homelab and should always be running
|
||||
# Place in /opt/stacks/core/docker-compose.yml
|
||||
|
||||
# RESTART POLICY GUIDE:
|
||||
# - unless-stopped: Core infrastructure services that should always run
|
||||
# - no: Services with Sablier lazy loading (start on-demand)
|
||||
# - See individual service comments for specific reasoning
|
||||
|
||||
services:
|
||||
|
||||
duckdns:
|
||||
# Dynamic DNS service - must always run to maintain domain resolution
|
||||
image: lscr.io/linuxserver/duckdns:latest
|
||||
container_name: duckdns
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- SUBDOMAINS=${DUCKDNS_SUBDOMAINS}
|
||||
- TOKEN=${DUCKDNS_TOKEN}
|
||||
volumes:
|
||||
- ./duckdns/config:/config
|
||||
networks:
|
||||
- traefik-network
|
||||
|
||||
traefik:
|
||||
# Reverse proxy and SSL termination - core routing service, must always run
|
||||
image: traefik:v3
|
||||
container_name: traefik
|
||||
restart: unless-stopped
|
||||
command: ["--configFile=/config/traefik.yml"]
|
||||
environment:
|
||||
- DUCKDNS_TOKEN=${DUCKDNS_TOKEN}
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
- 8080:8080
|
||||
volumes:
|
||||
- ./traefik/config:/config
|
||||
- ./traefik/letsencrypt:/letsencrypt
|
||||
- ./traefik/dynamic:/dynamic
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- traefik-network
|
||||
labels:
|
||||
# TRAEFIK CONFIGURATION
|
||||
# ==========================================
|
||||
# Service metadata
|
||||
- "homelab.category=core"
|
||||
- "homelab.description=Reverse proxy and SSL termination"
|
||||
# Traefik reverse proxy (comment/uncomment to disable/enable)
|
||||
# If Traefik is on a remote server: these labels are NOT USED;
|
||||
# configure external yml files in /traefik/dynamic folder instead.
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN}`)"
|
||||
- "traefik.http.routers.traefik.entrypoints=websecure"
|
||||
- "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.traefik.middlewares=authelia@docker"
|
||||
- "traefik.http.services.traefik.loadbalancer.server.port=8080"
|
||||
|
||||
authelia:
|
||||
# Single sign-on authentication service - must always run for user authentication
|
||||
image: authelia/authelia:latest
|
||||
container_name: authelia
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
ports:
|
||||
- "9091:9091"
|
||||
volumes:
|
||||
- ./authelia/config:/config
|
||||
- ./authelia/secrets:/secrets
|
||||
networks:
|
||||
- traefik-network
|
||||
depends_on:
|
||||
- traefik
|
||||
labels:
|
||||
# TRAEFIK CONFIGURATION
|
||||
# ==========================================
|
||||
# Service metadata
|
||||
- "homelab.category=core"
|
||||
- "homelab.description=Single sign-on authentication"
|
||||
# Traefik reverse proxy (comment/uncomment to disable/enable)
|
||||
# If Traefik is on a remote server: these labels are NOT USED;
|
||||
# configure external yml files in /traefik/dynamic folder instead.
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.authelia.rule=Host(`auth.${DOMAIN}`)"
|
||||
- "traefik.http.routers.authelia.entrypoints=websecure"
|
||||
- "traefik.http.routers.authelia.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.authelia.service=authelia"
|
||||
- "traefik.http.services.authelia.loadbalancer.server.port=9091"
|
||||
# Authelia forward auth middleware configuration
|
||||
- "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}/"
|
||||
- "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=X-Secret"
|
||||
- "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
|
||||
|
||||
# Sablier - Lazy loading service for Docker containers
|
||||
# Controls startup/shutdown of lazy-loaded services, must always run
|
||||
# REQUIREMENTS FOR DOCKER API ACCESS:
|
||||
# 1. Docker daemon must be configured to listen on TCP port 2376 with TLS
|
||||
# 2. DOCKER_HOST environment variable must point to accessible Docker API endpoint
|
||||
# 3. Firewall must allow TCP connections to Docker API port (2376)
|
||||
# 4. TLS certificates must be mounted and environment variables set
|
||||
# 5. Ensure dockerproxy service is running and accessible
|
||||
sablier-service:
|
||||
image: sablierapp/sablier:latest
|
||||
container_name: sablier-service
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-network
|
||||
environment:
|
||||
- SABLIER_PROVIDER=docker
|
||||
- SABLIER_DOCKER_API_VERSION=1.51
|
||||
- SABLIER_DOCKER_NETWORK=traefik-network
|
||||
- SABLIER_LOG_LEVEL=debug
|
||||
- DOCKER_HOST=tcp://${SERVER_IP}:2376
|
||||
- DOCKER_TLS_VERIFY=1
|
||||
- DOCKER_CERT_PATH=/certs
|
||||
volumes:
|
||||
- ./shared-ca:/certs:ro
|
||||
ports:
|
||||
- 10000:10000
|
||||
labels:
|
||||
# Service metadata
|
||||
- "homelab.category=core"
|
||||
- "homelab.description=Lazy loading service for Docker containers"
|
||||
|
||||
networks:
|
||||
traefik-network:
|
||||
external: true
|
||||
|
||||
x-dockge:
|
||||
urls:
|
||||
- https://auth.${DOMAIN}
|
||||
- http://${SERVER_IP}:9091
|
||||
- https://traefik.${DOMAIN}
|
||||
- http://${SERVER_IP}:8080
|
||||
Reference in New Issue
Block a user