Upload files to "authelia"

working

authelia/configuration.yml

@@ -21,7 +21,7 @@
 # certificates_directory: '/config/certificates/'
 
 ## The theme to display: light, dark, grey, auto.
-theme: 'dark'
+theme: 'grey'
 
 ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
 ## disabled. This setting must be a method that is enabled.
@@ -121,7 +121,7 @@ server:
 ##
 log:
   ## Level of verbosity for logs: info, debug, trace.
-  level: 'debug'
+  level: 'info'
 
   ## Format the logs are written as: json, text.
   format: 'text'
@@ -438,13 +438,13 @@ authentication_backend:
   ## This is the recommended Authentication Provider in production
   ## because it allows Authelia to offload the stateful operations
   ## onto the LDAP service.
-  ldap:
+  # ldap:
     ## The address of the directory server to connect to in the address common syntax.
     ## Format: [<scheme>://]<hostname>[:<port>].
     ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
     ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
     ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
-    # address: 'lldap_lldap:3890'
+    # address: 'ldaps://127.0.0.1:636'
 
     ## The LDAP implementation, this affects elements like the attribute utilized for resetting a password.
     ## Acceptable options are as follows:
@@ -457,19 +457,19 @@ authentication_backend:
     ## Depending on the option here certain other values in this section have a default value, notably all of the
     ## attribute mappings have a default value that this config overrides, you can read more about these default values
     ## at https://www.authelia.com/c/ldap#defaults
-    implementation: 'lldap'
+    # implementation: 'custom'
-    address: 'ldap://lldap_lldap:3890'
+
     ## The dial timeout for LDAP in the duration common syntax.
-    timeout: '10 seconds'
+    # timeout: '20 seconds'
 
     ## Use StartTLS with the LDAP connection.
     # start_tls: false
 
     ## TLS configuration.
-    tls:
+    # tls:
       ## The server subject name to check the servers certificate against during the validation process.
       ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      server_name: 'lldap_lldap'
+      # server_name: 'ldap.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -477,7 +477,7 @@ authentication_backend:
       ## It's important to note the public key should be added to the directory, not the private key.
       ## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
       ## important to the administrator.
-      skip_verify: true
+      # skip_verify: false
 
       ## Minimum TLS version for the connection.
       # minimum_version: 'TLS1.2'
@@ -518,7 +518,7 @@ authentication_backend:
 
     ## The distinguished name of the container searched for objects in the directory information tree.
     ## See also: additional_users_dn, additional_groups_dn.
-    base_dn: 'dc=johnsnexus,dc=click'
+    # base_dn: 'dc=example,dc=com'
 
     ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
     ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
@@ -536,7 +536,7 @@ authentication_backend:
     ##
     ## To allow sign in both with username and email, one can use a filter like
     ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
-    users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
+    # users_filter: '(&({username_attribute}={input})(objectClass=person))'
 
     ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
     ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
@@ -548,27 +548,27 @@ authentication_backend:
     ##
     ## If your groups use the `groupOfUniqueNames` structure use this instead:
     ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
-    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
+    # groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
 
     ## The group search mode to use. Options are 'filter' or 'memberof'. It's essential to read the docs if you wish to
     ## use 'memberof'. Also 'filter' is the best choice for most use cases.
-    group_search_mode: 'filter'
+    # group_search_mode: 'filter'
 
     ## Follow referrals returned by the server.
     ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
     # permit_referrals: false
 
     ## The username and password of the admin user.
-    user: 'UID=heimdall,OU=people,DC=johnsnexus,DC=click'
+    # user: 'cn=admin,dc=example,dc=com'
     ## Password can also be set using a secret: https://www.authelia.com/c/secrets
-    password: 'ragnarok'
+    # password: 'password'
 
     ## The attributes for users and objects from the directory server.
     # attributes:
 
       ## The distinguished name attribute if your directory server supports it. Users should read the docs before
       ## configuring. Only used for the 'memberof' group search mode.
-    # distinguished_name: 'Administrator'
+      # distinguished_name: ''
 
       ## The attribute holding the username of the user. This attribute is used to populate the username in the session
       ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP
@@ -606,21 +606,21 @@ authentication_backend:
   ##
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
-  # file:
+  file:
-    # path: '/config/users_database.yml'
+    path: '/config/users_database.yml'
-    # watch: false
+    watch: false
-    # search:
+    search:
-      # email: false
+      email: false
-      # case_insensitive: false
+      case_insensitive: false
-    # password:
+    password:
-      # algorithm: 'argon2'
+      algorithm: 'argon2'
-      # argon2:
+      argon2:
-        # variant: 'argon2id'
+        variant: 'argon2id'
-        # iterations: 3
+        iterations: 3
-        # memory: 65536
+        memory: 65536
-        # parallelism: 4
+        parallelism: 4
-        # key_length: 32
+        key_length: 32
-        # salt_length: 16
+        salt_length: 16
       # scrypt:
         # variant: 'scrypt'
         # iterations: 16
@@ -829,7 +829,7 @@ session:
       ##   - The above 'domain' option MUST either:
       ##      - Match the host portion of this URI.
       ##      - Match the suffix of the host portion when prefixed with '.'.
-      authelia_url: 'https://auth.home.johnsnexus.click'
+      authelia_url: 'https://auth.johnsnexus.click'
 
       ## Optional. The fully qualified URI used as the redirection location if the portal is accessed directly. Not
       ## configuring this option disables the automatic redirection behavior.

authelia/docker-compose.yml

@@ -5,9 +5,9 @@ services:
     image: authelia/authelia
     container_name: authelia
     volumes:
-      - /mnt/disk/authelia/config:/config
+      - /media/gv0/docker/authelia/config:/config
     networks:
-      - jda_net
+      - caddy_net
     security_opt:
       - no-new-privileges:true
     ports:
@@ -24,9 +24,9 @@ services:
     image: redis:alpine
     container_name: redis
     volumes:
-      - /mnt/disk/authelia/redis:/data
+      - /media/gv0/docker/redis:/data
     networks:
-      - jda_net
+      - caddy_net
     expose:
       - 6379
     restart: unless-stopped
@@ -35,5 +35,5 @@ services:
 
 
 networks:
-  jda_net:
+  caddy_net:
     external: true

authentik/docker-compose.yml

@@ -0,0 +1,64 @@
+services:
+  postgresql:
+    env_file:
+    - /media/gv0/docker/authentik/.env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+    volumes:
+    - /media/gv0/docker/authentik/postgres/database:/var/lib/postgresql/data
+  server:
+    command: server
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    env_file:
+    - /media/gv0/docker/authentik/.env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
+    ports:
+    - ${COMPOSE_PORT_HTTP:-9000}:9000
+    - ${COMPOSE_PORT_HTTPS:-9443}:9443
+    restart: unless-stopped
+    shm_size: 512mb
+    volumes:
+    - /media/gv0/docker/authentik/data:/data
+    - /media/gv0/docker/authentik/custom-templates:/templates
+  worker:
+    command: worker
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    env_file:
+    - /media/gv0/docker/authentik/.env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
+    restart: unless-stopped
+    shm_size: 512mb
+    user: root
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /media/gv0/docker/authentik/data:/data
+    - /media/gv0/docker/authentik/certs:/certs
+    - /media/gv0/docker/authentik/custom-templates:/templates

caddy/Caddyfile

@@ -2,7 +2,7 @@
 {
   # Global options, omly one such block at the head of the file
   servers {
-    trusted_proxies static 192.168.1.0/24 10.0.0.0/24 2a00:23c6::/32
+    trusted_proxies static 192.168.1.0/24 2a00:23c6::/32
           }
   # make admin available to all trusted nodes on the network
   admin :2019
@@ -11,15 +11,15 @@
 #
 
 #
-# For Authelia
+# For Authelis
 #
 (trusted_proxy_list) {
-       trusted_proxies 192.168.1.0/24 10.0.0.0/24 2a00:23c6::/32
+       trusted_proxies 192.168.1.0/24 2a00:23c6::/32
 }
 
 (secure_site) {
-     forward_auth {args[0]} 192.168.1.21:9091 {
+       forward_auth {args[0]} 192.168.1.1:9091 {
-         uri /api/verify?rd=https://auth.home.johnsnexus.click
+                uri /api/verify?rd=https://auth.johnsnexus.click
                 copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
                 import trusted_proxy_list
                 header_up Host {upstream_hostport}
@@ -37,7 +37,7 @@
 #
 (basic-auth) {
     basic_auth {
-      john.anderson $2a$10$4ka55bXqNBpoQcBDrJtd5OQje6Nt/HmvRNAGavqO03xq/Noth5xH.
+      john.anderson $2a$10$T.yetVs9CmektYsaU8RqYu37fVaFAsPDLf90lsDDfxLkaC.zWH3Oi
       mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny
       frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6
       chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK
@@ -55,33 +55,21 @@
       barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS
       janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW
     }
-#    respond "Welcome, {http.auth.user.id}" 200
 }  
 #
-# Authelia running on Production Cluster
+# Authelia from HOSTS
 #
-auth.home.johnsnexus.click {
+auth.johnsnexus.click {
-     reverse_proxy 192.168.1.21:9091 {
+     reverse_proxy 192.168.1.1:9091 {
          import trusted_proxy_list
      }
 }
 #
-# Portainer running on PROXMOX cluster
-#
-port.home.johnsnexus.click {
-    reverse_proxy https://192.168.1.240:9443 {
-        transport http {
-            tls
-            tls_insecure_skip_verify
-        }
-    }
-}
-#
 # Locally hosted site
 #
-testcaddy.home.johnsnexus.click {
+testcaddy.johnsnexus.click {
     root * /usr/share/caddy      # compose file points to this
-    php_fastcgi 192.168.1.11:80
+    php_fastcgi 192.168.1.1:80
     file_server
 }
 #
@@ -90,112 +78,58 @@ testcaddy.home.johnsnexus.click {
 sandancer.ddnsfree.com {
     root * /var/www/html
     file_server
-    reverse_proxy 192.168.1.243:8081
+#    reverse_proxy 192.168.1.1:8888
-#    reverse_proxy famhistweb_famhistweb
+    reverse_proxy famhistweb_famhistweb
 }
 #
-# Family History Web Site on virtual machine on PROXMOX cluster
+# PocketID OIDC security, come here from DYNU, running on OMEGA to access token device
-nginx.home.johnsnexus.click {
-    reverse_proxy 192.168.1.243:80
-}
-#
-famhist.home.johnsnexus.click {
-    root * /var/www/html
-    file_server
-    reverse_proxy 192.168.1.243:8081
-}
-#
-# PocketID OIDC security, come here from DYNU, running on PROXMOX cluster
 #
 https://hold.johnsnexus.click {
-    reverse_proxy 192.168.1.238:1411
+    reverse_proxy 192.168.1.5:1411
 }
 #
-# Test GHOST site on BETA 
+# Test GHOST site on ELITE cluster 
 #
-#ghost.johnsnexus.click {
+ghost.johnsnexus.click {
-#    root * /var/www/mymag
+    root * /var/www/mymag
-#    file_server
-#    reverse_proxy 192.168.1.9:2368
-#}
-#
-# Fanily History Web site on Production cluster system, come here via BIND9
-#
-nextfam.home.johnsnexus.click {
-#    import secure_site *
-#    root * /mnt/disk/NextFamilyWeb
     file_server
-    reverse_proxy 192.168.1.243:8082 { 
+    reverse_proxy 192.168.1.4:2368
+}
+#
+# Fanily History Web site on Production cluster system, come here via HOSTS file
+#
+nextfamhistweb.johnsnexus.click {
+#    import basic-auth
+    import secure_site *
+#    root * /usr/local/apache2/htdocs
+#    file_server
+    reverse_proxy nextfamhistweb_nextfamhistweb {
         import trusted_proxy_list
     }
 }
 #
-# Test web site on Production Cluster, come here via BIND9
+# Test web site on Production Cluster, come here via HOSTS file
+# an example of a non-secure site on a different domain
 #
-northweb.home.johnsnexus.click {
+http://northweb.johns.study {
-    import secure_site *
+    import basic-auth
+    root * /usr/local/apache2/htdocs
     file_server
-    reverse_proxy 192.168.1.243:8083
+    reverse_proxy testweb_testweb
 }
 #
-# Test version of paperless-ngx on OMEGA  come here via BIND9
+# Test version of paperless-ngx on Elite cluster, come here via HOSTS file
 #
 wastebin.johnsnexus.click {
     file_server
-    reverse_proxy 192.168.1.5:8600
+    reverse_proxy 192.168.1.4:8600
 }
 #
 # Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address
 #
-#pydiocells.johnsnexus.click {
+pydiocells.johnsnexus.click {
 #    tls tls@johnsnexus.click
-#    reverse_proxy 192.168.1.4:8888 {
+    reverse_proxy 192.168.1.4:8888 {
-#       transport http {
-#          tls
-#          tls_insecure_skip_verify
-#       }
-#    }
-#}
-#
-# NEXTCLOUDAIO on virtual node 22, via DYNU
-#
-amudanan.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.22:11000 
-}
-#
-#codeamud.johnsnexus.click {
-#    file_server
-#    reverse_proxy 192.168.1.26:9980 {
-#        header_up X-Forwarded-Proto {scheme}
-#    transport http {
-#        tls_insecure_skip_verify
-#        }
-#    }
-#}
-#
-# OWNCLOUD on vmnode21
-#
-mycloud.johnsnexus.click {
-    header Strict-Transport-Security max-age=15552000
-    file_server
-    reverse_proxy 192.168.1.21:8080
-}
-#
-code.johnsnexus.click {
-       file_server
-       reverse_proxy 192.168.1.21:9980 {
-       header_up X-Forwarded-Proto {scheme}
-#       transport http {
-#          tls_insecure_skip_verify
-#       }
-    }
-}
-#
-# Vaultwarden on PROXMOX Cluster
-#
-warden.johnsnexus.click {
-    reverse_proxy https://192.168.1.25:8000 {
        transport http {
           tls
           tls_insecure_skip_verify
@@ -203,6 +137,38 @@ warden.johnsnexus.click {
     }
 }
 #
+# Nextcloud AIO on NODE-16, was Beta (220 or 9)
+#
+https://amudanan.johnsnexus.click:443 {
+    header Strict-Transport-Security max-age=15552000
+    file_server
+    reverse_proxy http://192.168.1.16:11000 
+}
+#
+# OWNCLOUD on BEES swarm via DYNU
+#
+mycloud.johnsnexus.click {
+    header Strict-Transport-Security max-age=15552000
+    file_server
+    reverse_proxy 192.168.1.3:8080
+}
+#
+code.johnsnexus.click {
+       encode gzip
+       file_server
+       reverse_proxy https://192.168.1.3:9980 {
+       transport http {
+          tls_insecure_skip_verify
+       }
+    }
+}
+#
+# Vaultwarden on Production Cluster, come here via HOSTS
+#
+#warden.johnsnexus.click {
+#    reverse_proxy http://192.168.1.1:80
+#}
+#
 # SongKong on VALHALLA, come here via DYNU
 https://chord.johnsnexus.click {
     root * /music
@@ -212,56 +178,60 @@ https://chord.johnsnexus.click {
 ##
 # n8n running on DELTA, come here via DYNU
 #
-#donut.johnsnexus.click {
+donut.johnsnexus.click {
-#   reverse_proxy http://192.168.1.10:5678 {
+   reverse_proxy http://192.168.1.10:5678 {
-#       flush_interval -1
+       flush_interval -1
-#   }
+   }
-#}
+}
 #
-# CTiO magazine using NICEPAGE on PROXMOX Cluster
+# CTiO magazine using Ghost on production
-# two ways to access
 #
 ctio.johnsnexus.click {
     file_server
-    reverse_proxy 192.168.1.243:8084
+    reverse_proxy 192.168.1.1:2368
 }
 #
 #****************************************
 #
-# Needs SSL; 
+# Hoarder from hosts file, keep in extenal domain
+# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000
 #
-hoard.johnsnexus.click {
+hoarder.johnsnexus.click {
-    reverse_proxy 192.168.1.234:3000 
+     reverse_proxy 192.168.1.4:3200 
 }
 #
-# runs on virtual LXC
+# # although "prod" it runs on Elite Cluster
+grafana.johnsnexus.click {
+#     file_server
+     reverse_proxy 192.168.1.4:3030
+}
+# new gitea on elite cluster
+mygit.johnsnexus.click {
+     reverse_proxy 192.168.1.4:3000
+}
 #
-https://grafana.home.johnsnexus.click {
+# copy of mygit on the production cluster
+gitea.johnsnexus.click {
     file_server
-    reverse_proxy 192.168.1.236:3000
+    reverse_proxy 192.168.1.1:3000
 }
 #
-# runs on virtual node 21; not sure about additional line!
+gotify.johnsnexus.click {
-#
+     reverse_proxy 192.168.1.4:8111
-lldap.home.johnsnexus.click {
-    reverse_proxy 192.168.1.21:17170 {
-        header_up Host {http.request.host}
-    }
 }
 #
-# copy of mygit on the proxmox cluster
+# Portainer manageed on ELITE cluster, come here via HOSTS
-gitea.home.johnsnexus.click {
+# Use port 9000 not 9443
-    file_server
+portainer.johnsnexus.click {
-    reverse_proxy 192.168.1.235:3000
+     reverse_proxy 192.168.1.4:9000
 }
 #
-# now a virtual container on PROXMOX
+# Open Media Vault from HOSTS file
-gotify.home.johnsnexus.click {
+#
-    reverse_proxy 192.168.1.230:80
+omv.valhalla.johnsnexus.click {
+     reverse_proxy 192.168.1.7
 }
 #
-# New home assistant, running under docker on NODE-16 via wireless
+omv.paradise.johnsnexus.click {
-https://have.johnsnexus.click {
+     reverse_proxy 192.168.1.8
-    file_server
-    reverse_proxy 192.168.1.16:8123
 }

caddy/Caddyfile-01jun

@@ -0,0 +1,258 @@
+ Caddyfile on production cluster
+{
+  # Global options, omly one such block at the head of the file
+  servers {
+    trusted_proxies static 192.168.1.0/24 2a00:23c6::/32
+          }
+  # make admin available to all trusted nodes on the network
+  admin :2019
+  metrics
+}
+#
+
+#
+# For Authelis
+#
+(trusted_proxy_list) {
+       trusted_proxies 192.168.1.0/24 2a00:23c6::/32
+}
+
+(secure_site) {
+       forward_auth {args[0]} 192.168.1.1:9091 {
+                uri /api/verify?rd=https://auth.johnsnexus.click
+                copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+                import trusted_proxy_list
+                header_up Host {upstream_hostport}
+       }
+}
+#
+# it appears you need this to allow prometheus on a remote node to scrape the metrics
+:2019 {
+  handle {
+    metrics
+  }
+}
+#
+# Snippet for basic authorisation
+#
+(basic-auth) {
+   basic_auth {
+      john.anderson $2a$10$4ka55bXqNBpoQcBDrJtd5OQje6Nt/HmvRNAGavqO03xq/Noth5xH.
+      mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny
+      frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6
+      chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK
+      ruth.hoyos $2a$10$9z/3SajAWhxJfu6Xs1lbEeuPpZWUzcuBI/8n5hfv5FUqt11Uxo92S
+      sarah.anderson-beecham $2a$10$.8J1FMBwGDr8XSXCMWcn2ODxSW6txLEqSBHZmA6zQs8qQCDT2KbR2
+      fiona.green $2a$10$Nid0Lg6Wauwi/5BN4N2H5u8T6XumK4EE2MBxZaKXajxUAuUXPEvGO
+      helen.crichton $2a$10$zOcnxMCr62NtNK3YTaWbRuOclI/lC1Lkn1RidTOxkgBTgruQgfg9K
+      david.rawsthorne $2a$10$OIALdPjjQT6i5exUg8GtmOGk4BD4WmanmDhF7wCVH/IbpQQSt6PAS
+      peter.rawsthorne $2a$10$asUwJpdwc4QlGc8b1A1v7ukBCIQTlzm59uRnBH6AnWiK6NAECW03S
+      marilyn.pope $2a$10$6iD1J3FVmFbY7i02gQaF0eu1fY4ufUsXiXMyc1G9YfXbYKwuamjI2
+      alan.potts $2a$10$tzbIZwIuzcdrIzJICIS1oeadwoKyr3JqL2Ec9aB8Dj.MR4Q7lMcV.
+      kate.griffin $2a$10$9R57yOgGilEPZNwCbjWHeOu/ytTv4SLbW0P/plRnI.GqHe3w3IJjO
+      craig.johnson $2a$10$LQf3tK0ZHl63LHybpDfSdu1WT9OtcLeNZTfCwniPlmuqHiNF.yOq6
+      grant.johnson $2a$10$7XZ3aoQdL/fLex48t6hgi.p9Xt3yNJNIXJKflxChprwT5O9zPy2hG
+      barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS
+      janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW
+    }
+#    respond "Welcome, {http.auth.user.id}" 200
+}  
+#
+# Authelia from PIHOLE
+#
+auth.johnsnexus.click {
+     reverse_proxy 192.168.1.1:9091 {
+         import trusted_proxy_list
+     }
+}
+#
+# Locally hosted site
+#
+testcaddy.johnsnexus.click {
+    root * /usr/share/caddy      # compose file points to this
+    php_fastcgi 192.168.1.11:80
+    file_server
+}
+#
+# Family history web site via container on this cluster
+#
+sandancer.ddnsfree.com {
+    root * /var/www/html
+    file_server
+#    reverse_proxy 192.168.1.1:8888
+    reverse_proxy famhistweb_famhistweb
+}
+#
+# PocketID OIDC security, come here from DYNU, running on OMEGA to access token device
+#
+https://hold.johnsnexus.click {
+    reverse_proxy 192.168.1.5:1411
+}
+#
+# Test GHOST site on BETA 
+#
+#ghost.johnsnexus.click {
+#    root * /var/www/mymag
+#    file_server
+#    reverse_proxy 192.168.1.9:2368
+#}
+#
+# Fanily History Web site on Production cluster system, come here via BIND9
+#
+nextfamhistweb.johnsnexus.click {
+#    import basic-auth
+#    import secure_site *
+#    root * /usr/local/apache2/htdocs
+#    file_server
+    reverse_proxy nextfamhistweb_nextfamhistweb {
+        import trusted_proxy_list
+    }
+}
+#
+# Test web site on Production Cluster, come here via BIND9
+#
+northweb.johnsnexus.click {
+#    import secure_site *
+#    import basic-auth
+#    root * /usr/local/apache2/htdocs
+    file_server
+    reverse_proxy testweb_testweb
+}
+#
+# Test version of paperless-ngx on OMEGA  come here via BIND9
+#
+wastebin.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.5:8600
+}
+#
+# Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address
+#
+#pydiocells.johnsnexus.click {
+#    tls tls@johnsnexus.click
+#    reverse_proxy 192.168.1.4:8888 {
+#       transport http {
+#          tls
+#          tls_insecure_skip_verify
+#       }
+#    }
+#}
+#
+# NEXTCLOUDAIO on virtual node 22, via DYNU
+#
+amudanan.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.22:11000 
+}
+#
+#codeamud.johnsnexus.click {
+#    file_server
+#    reverse_proxy 192.168.1.26:9980 {
+#        header_up X-Forwarded-Proto {scheme}
+#    transport http {
+#        tls_insecure_skip_verify
+#        }
+#    }
+#}
+#
+# OWNCLOUD on vmnode21
+#
+mycloud.johnsnexus.click {
+    header Strict-Transport-Security max-age=15552000
+    file_server
+    reverse_proxy 192.168.1.21:8080
+}
+#
+code.johnsnexus.click {
+       file_server
+       reverse_proxy 192.168.1.21:9980 {
+       header_up X-Forwarded-Proto {scheme}
+#       transport http {
+#          tls_insecure_skip_verify
+#       }
+    }
+}
+#
+# TESTCLOUD/Nextcloud Alpine on ZETA
+#testcloud.johnsnexus.click {
+#    file_server
+#    reverse_proxy 192.168.1.26
+#}
+#
+# TESTCLOUD/nextcloud-alpine in a secure LXC on ZETA
+#
+testcloud.johnsnexus.click {
+    header Strict-Transport-Security max-age=15552000
+    file_server
+    reverse_proxy https://192.168.1.232:443 {
+        transport http {
+            tls_insecure_skip_verify
+            }
+    }
+}
+#
+# Vaultwarden on Production Cluster, come here via HOSTS
+#
+#warden.johnsnexus.click {
+#    reverse_proxy http://192.168.1.1:80
+#}
+#
+# SongKong on VALHALLA, come here via DYNU
+https://chord.johnsnexus.click {
+    root * /music
+    file_server
+    reverse_proxy http://192.168.1.7:4567
+}
+##
+# n8n running on DELTA, come here via DYNU
+#
+#donut.johnsnexus.click {
+#   reverse_proxy http://192.168.1.10:5678 {
+#       flush_interval -1
+#   }
+#}
+#
+# CTiO magazine using NICEPAGE on PROXMOX
+#
+ctio.johnsnexus.click {
+    file_server
+    reverse_proxy ctiomag_ctiomag
+}
+#
+#****************************************
+#
+# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000
+#
+hoarder.johnsnexus.click {
+     reverse_proxy 192.168.1.15:3200 
+}
+#
+#
+# runs on virtual node-15 in a docker container
+#
+grafana.johnsnexus.click {
+#     import basic-auth
+     reverse_proxy 192.168.1.15:3030
+}
+#
+# new gitea on Elite cluster
+#
+mygit.johnsnexus.click {
+     reverse_proxy 192.168.1.15:3000
+}
+#
+# copy of mygit on the production cluster
+gitea.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.1:3000
+}
+#
+# now a cirtual container on PROXMOX
+gotify.johnsnexus.click {
+     reverse_proxy 192.168.1.230:80
+}
+#
+# New home assistant, running under docker on NODE-16 via wireless
+https://have.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.16:8123

caddy/Caddyfile-latest

@@ -0,0 +1,248 @@
+# Caddyfile on production cluster
+{
+  # Global options, omly one such block at the head of the file
+  servers {
+    trusted_proxies static 192.168.1.0/24 2a00:23c6::/32
+          }
+  # make admin available to all trusted nodes on the network
+  admin :2019
+  metrics
+}
+#
+
+#
+# For Authelis
+#
+(trusted_proxy_list) {
+       trusted_proxies 192.168.1.0/24 2a00:23c6::/32
+}
+
+(secure_site) {
+       forward_auth {args[0]} 192.168.1.1:9091 {
+                uri /api/verify?rd=https://auth.johnsnexus.click
+                copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+                import trusted_proxy_list
+                header_up Host {upstream_hostport}
+       }
+}
+#
+# it appears you need this to allow prometheus on a remote node to scrape the metrics
+:2019 {
+  handle {
+    metrics
+  }
+}
+#
+# Snippet for basic authorisation
+#
+(basic-auth) {
+    basic_auth {
+      john.anderson $2a$10$T.yetVs9CmektYsaU8RqYu37fVaFAsPDLf90lsDDfxLkaC.zWH3Oi
+      mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny
+      frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6
+      chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK
+      ruth.hoyos $2a$10$9z/3SajAWhxJfu6Xs1lbEeuPpZWUzcuBI/8n5hfv5FUqt11Uxo92S
+      sarah.anderson-beecham $2a$10$.8J1FMBwGDr8XSXCMWcn2ODxSW6txLEqSBHZmA6zQs8qQCDT2KbR2
+      fiona.green $2a$10$Nid0Lg6Wauwi/5BN4N2H5u8T6XumK4EE2MBxZaKXajxUAuUXPEvGO
+      helen.crichton $2a$10$zOcnxMCr62NtNK3YTaWbRuOclI/lC1Lkn1RidTOxkgBTgruQgfg9K
+      david.rawsthorne $2a$10$OIALdPjjQT6i5exUg8GtmOGk4BD4WmanmDhF7wCVH/IbpQQSt6PAS
+      peter.rawsthorne $2a$10$asUwJpdwc4QlGc8b1A1v7ukBCIQTlzm59uRnBH6AnWiK6NAECW03S
+      marilyn.pope $2a$10$6iD1J3FVmFbY7i02gQaF0eu1fY4ufUsXiXMyc1G9YfXbYKwuamjI2
+      alan.potts $2a$10$tzbIZwIuzcdrIzJICIS1oeadwoKyr3JqL2Ec9aB8Dj.MR4Q7lMcV.
+      kate.griffin $2a$10$9R57yOgGilEPZNwCbjWHeOu/ytTv4SLbW0P/plRnI.GqHe3w3IJjO
+      craig.johnson $2a$10$LQf3tK0ZHl63LHybpDfSdu1WT9OtcLeNZTfCwniPlmuqHiNF.yOq6
+      grant.johnson $2a$10$7XZ3aoQdL/fLex48t6hgi.p9Xt3yNJNIXJKflxChprwT5O9zPy2hG
+      barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS
+      janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW
+    }
+#    respond "Welcome, {http.auth.user.id}" 200
+}  
+#
+# Authelia from PIHOLE
+#
+auth.johnsnexus.click {
+     reverse_proxy 192.168.1.1:9091 {
+         import trusted_proxy_list
+     }
+}
+#
+# Locally hosted site
+#
+testcaddy.johnsnexus.click {
+    root * /usr/share/caddy      # compose file points to this
+    php_fastcgi 192.168.1.1:80
+    file_server
+}
+#
+# Family history web site via container on this cluster
+#
+sandancer.ddnsfree.com {
+    root * /var/www/html
+    file_server
+#    reverse_proxy 192.168.1.1:8888
+    reverse_proxy famhistweb_famhistweb
+}
+#
+# PocketID OIDC security, come here from DYNU, running on OMEGA to access token device
+#
+https://hold.johnsnexus.click {
+    reverse_proxy 192.168.1.5:1411
+}
+#
+# Test GHOST site on BETA 
+#
+ghost.johnsnexus.click {
+    root * /var/www/mymag
+    file_server
+    reverse_proxy 192.168.1.9:2368
+}
+#
+# Fanily History Web site on Production cluster system, come here via BIND9
+#
+nextfamhistweb.johnsnexus.click {
+#    import basic-auth
+#    import secure_site *
+#    root * /usr/local/apache2/htdocs
+#    file_server
+    reverse_proxy nextfamhistweb_nextfamhistweb {
+        import trusted_proxy_list
+    }
+}
+#
+# Test web site on Production Cluster, come here via BIND9
+#
+northweb.johnsnexus.click {
+#    import secure_site *
+#    import basic-auth
+    root * /usr/local/apache2/htdocs
+    file_server
+    reverse_proxy testweb_testweb
+}
+#
+# Test version of paperless-ngx on OMEGA  come here via BIND9
+#
+wastebin.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.5:8600
+}
+#
+# Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address
+#
+#pydiocells.johnsnexus.click {
+#    tls tls@johnsnexus.click
+#    reverse_proxy 192.168.1.4:8888 {
+#       transport http {
+#          tls
+#          tls_insecure_skip_verify
+#       }
+#    }
+#}
+#
+# Owncloud on ELITE "cluster", via DYNU
+#
+amudanan.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.9:11000 
+}
+#
+codeamud.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.9:9980 {
+        header_up X-Forwarded-Proto {scheme}
+#    transport http {
+#        tls_insecure_skip_verify
+#        }
+    }
+}
+#
+# OWNCLOUD on DELTA come here via BIND9
+#
+mycloud.johnsnexus.click {
+    header Strict-Transport-Security max-age=15552000
+    file_server
+    reverse_proxy 192.168.1.10:8080
+}
+#
+code.johnsnexus.click {
+       file_server
+       reverse_proxy 192.168.1.10:9980 {
+       header_up X-Forwarded-Proto {scheme}
+#       transport http {
+#          tls_insecure_skip_verify
+#       }
+    }
+}
+#
+# TESTCLOUD/NEXTCLOUDAIO on ZETA come here via BIND9
+#
+testcloud.johnsnexus.click {
+    file_server
+    reverse_proxy http://192.168.1.20:11000
+}
+#
+# Vaultwarden on Production Cluster, come here via HOSTS
+#
+#warden.johnsnexus.click {
+#    reverse_proxy http://192.168.1.1:80
+#}
+#
+# SongKong on VALHALLA, come here via DYNU
+https://chord.johnsnexus.click {
+    root * /music
+    file_server
+    reverse_proxy http://192.168.1.7:4567
+}
+##
+# n8n running on DELTA, come here via DYNU
+#
+donut.johnsnexus.click {
+   reverse_proxy http://192.168.1.10:5678 {
+       flush_interval -1
+   }
+}
+#
+# CTiO magazine using Ghost on production
+#
+ctio.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.1:2368
+}
+#
+#****************************************
+#
+# Hoarder from PIHOLR
+# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000
+#
+hoarder.johnsnexus.click {
+     reverse_proxy 192.168.1.9:3200 
+}
+#
+#
+# although "prod" it runs on Elite Cluster
+#
+grafana.johnsnexus.click {
+#     file_server
+     reverse_proxy 192.168.1.9:3030
+}
+#
+# new gitea on Elite cluster
+#
+mygit.johnsnexus.click {
+     reverse_proxy 192.168.1.9:3000
+}
+#
+# copy of mygit on the production cluster
+gitea.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.1:3000
+}
+#
+gotify.johnsnexus.click {
+     reverse_proxy 192.168.1.9:8111
+}
+#
+# New home assistant, running unde docker on ZETA
+https://have.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.16:8123
+}

lldap/docker-compose.yml

@@ -1,19 +0,0 @@
-services:
-  lldap:
-    image: lldap/lldap:stable
-    container_name: lldap
-    ports:
-      - "3890:3890"   # LDAP port
-      - "17170:17170" # Web UI port
-    volumes:
-      - /mnt/disk/lldap/data:/data
-    environment:
-      LLDAP_JWT_SECRET: "/K{5T.'-zR,W*gg|xI,u-[/[5.1?HI-S"
-      LLDAP_LDAP_USER_PASS: "Password1"  # Change this!
-    restart: unless-stopped
-    networks:
-      - jda_net
-
-networks:
-  jda_net:
-    external: true

lldap/lldap_config.docker_template.toml

@@ -1,174 +0,0 @@
-## Default configuration for Docker.
-## All the values can be overridden through environment variables, prefixed
-## with "LLDAP_". For instance, "ldap_port" can be overridden with the
-## "LLDAP_LDAP_PORT" variable.
-
-## Tune the logging to be more verbose by setting this to be true.
-## You can set it with the LLDAP_VERBOSE environment variable.
-# verbose=false
-
-## The host address that the LDAP server will be bound to.
-## To enable IPv6 support, simply switch "ldap_host" to "::":
-## To only allow connections from localhost (if you want to restrict to local self-hosted services),
-## change it to "127.0.0.1" ("::1" in case of IPv6).
-## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
-## originating from outside the container.
-#ldap_host = "0.0.0.0"
-
-## The port on which to have the LDAP server.
-#ldap_port = 3890
-
-## The host address that the HTTP server will be bound to.
-## To enable IPv6 support, simply switch "http_host" to "::".
-## To only allow connections from localhost (if you want to restrict to local self-hosted services),
-## change it to "127.0.0.1" ("::1" in case of IPv6).
-## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
-## originating from outside the container.
-#http_host = "0.0.0.0"
-
-## The port on which to have the HTTP server, for user login and
-## administration.
-#http_port = 17170
-
-## The public URL of the server, for password reset links.
-#http_url = "http://localhost"
-
-## The path to the front-end assets (relative to the working directory).
-#assets_path = "./app"
-
-## Random secret for JWT signature.
-## This secret should be random, and should be shared with application
-## servers that need to consume the JWTs.
-## Changing this secret will invalidate all user sessions and require
-## them to re-login.
-## You should probably set it through the LLDAP_JWT_SECRET environment
-## variable from a secret ".env" file.
-## This can also be set from a file's contents by specifying the file path
-## in the LLDAP_JWT_SECRET_FILE environment variable
-## You can generate it with (on linux):
-## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''
-#jwt_secret = "REPLACE_WITH_RANDOM"
-
-## Base DN for LDAP.
-## This is usually your domain name, and is used as a
-## namespace for your users. The choice is arbitrary, but will be needed
-## to configure the LDAP integration with other services.
-## The sample value is for "example.com", but you can extend it with as
-## many "dc" as you want, and you don't actually need to own the domain
-## name.
-ldap_base_dn = "dc=johnsnexus,dc=click"
-
-## Admin username.
-## For the LDAP interface, a value of "admin" here will create the LDAP
-## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).
-## For the administration interface, this is the username.
-#ldap_user_dn = "admin"
-
-## Admin email.
-## Email for the admin account. It is only used when initially creating
-## the admin user, and can safely be omitted.
-#ldap_user_email = "admin@example.com"
-
-## Admin password.
-## Password for the admin account, both for the LDAP bind and for the
-## administration interface. It is only used when initially creating
-## the admin user.
-## It should be minimum 8 characters long.
-## You can set it with the LLDAP_LDAP_USER_PASS environment variable.
-## This can also be set from a file's contents by specifying the file path
-## in the LLDAP_LDAP_USER_PASS_FILE environment variable
-## Note: you can create another admin user for user administration, this
-## is just the default one.
-#ldap_user_pass = "REPLACE_WITH_PASSWORD"
-
-## Force reset of the admin password.
-## Break glass in case of emergency: if you lost the admin password, you
-## can set this to true to force a reset of the admin password to the value
-## of ldap_user_pass above.
-## Alternatively, you can set it to "always" to reset every time the server starts.
-# force_ldap_user_pass_reset = false
-
-## Database URL.
-## This encodes the type of database (SQlite, MySQL, or PostgreSQL)
-## , the path, the user, password, and sometimes the mode (when
-## relevant).
-## Note: SQlite should come with "?mode=rwc" to create the DB
-## if not present.
-## Example URLs:
-##  - "postgres://postgres-user:password@postgres-server/my-database"
-##  - "mysql://mysql-user:password@mysql-server/my-database"
-##
-## This can be overridden with the LLDAP_DATABASE_URL env variable.
-database_url = "sqlite:///data/users.db?mode=rwc"
-
-## Private key file.
-## Not recommended, use key_seed instead.
-## Contains the secret private key used to store the passwords safely.
-## Note that even with a database dump and the private key, an attacker
-## would still have to perform an (expensive) brute force attack to find
-## each password.
-## Randomly generated on first run if it doesn't exist.
-## Env variable: LLDAP_KEY_FILE
-#key_file = "/data/private_key"
-
-## Seed to generate the server private key, see key_file above.
-## This can be any random string, the recommendation is that it's at least 12
-## characters long.
-## Env variable: LLDAP_KEY_SEED
-key_seed = "RanD0m STR1ng"
-
-## Ignored attributes.
-## Some services will request attributes that are not present in LLDAP. When it
-## is the case, LLDAP will warn about the attribute being unknown. If you want
-## to ignore the attribute and the service works without, you can add it to this
-## list to silence the warning.
-#ignored_user_attributes = [ "sAMAccountName" ]
-#ignored_group_attributes = [ "mail", "userPrincipalName" ]
-
-## Options to configure SMTP parameters, to send password reset emails.
-## To set these options from environment variables, use the following format
-## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
-[smtp_options]
-## Whether to enabled password reset via email, from LLDAP.
-#enable_password_reset=true
-## The SMTP server.
-#server="smtp.gmail.com"
-## The SMTP port.
-#port=587
-## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
-#smtp_encryption = "TLS"
-## The SMTP user, usually your email address.
-#user="sender@gmail.com"
-## The SMTP password.
-#password="password"
-## The header field, optional: how the sender appears in the email. The first
-## is a free-form name, followed by an email between <>.
-#from="LLDAP Admin <sender@gmail.com>"
-## Same for reply-to, optional.
-#reply_to="Do not reply <noreply@localhost>"
-
-## Options to configure LDAPS.
-## To set these options from environment variables, use the following format
-## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
-[ldaps_options]
-## Whether to enable LDAPS.
-#enabled=true
-## Port on which to listen.
-#port=6360
-## Certificate file.
-#cert_file="/data/cert.pem"
-## Certificate key file.
-#key_file="/data/key.pem"
-
-## Options to configure the healthcheck command.
-## To set these options from environment variables, use the following format
-## (example with http_host): LLDAP_HEALTHCHECK_OPTIONS__HTTP_HOST
-[healthcheck_options]
-## The host address that the healthcheck should verify for the HTTP server.
-## If "http_host" is set to a specific IP address, this must be set to match if the built-in
-## healthcheck command is used.  Note: if this is an IPv6 address, it must be wrapped in [].
-#http_host = "localhost"
-## The host address that the healthcheck should verify for the LDAP server.
-## If "ldap_host" is set to a specific IP address, this must be set to match if the built-in
-## healthcheck command is used.
-#ldap_host = "localhost"

uptime-kuma/docker-compose.yml

@@ -2,10 +2,10 @@ services:
   uptime-kuma:
     image: louislam/uptime-kuma:2.2.1
     container_name: uptime-kuma
-#    deploy:
+    deploy:
-#      placement:
+      placement:
-#        constraints:
+        constraints:
-#          - node.labels.target != here
+          - node.labels.target != here
     restart: always
     ports:
       - "3010:3001"

vaultwarden/docker-compose.yml

@@ -1,19 +0,0 @@
-services:
-  vaultwarden:
-    image: vaultwarden/server:latest
-    container_name: vaultwarden
-    restart: unless-stopped
-    environment:
-      - DOMAIN=https://warden.johnsnexus.click
-      - SIGNUPS_ALLOWED=true # Set to false after creating your account
-    ports:
-      - 8080:80
-    volumes:
-      - /media/gv0/docker/vw-data:/data
-    networks:
-      - caddy_net
-
-networks:
-  caddy_net:
-    external: true
-