Add caddy/Caddyfile

Convert to working on virtual node-21

authelia/configuration.yml

@@ -21,7 +21,7 @@
 # certificates_directory: '/config/certificates/'
 
 ## The theme to display: light, dark, grey, auto.
-theme: 'grey'
+theme: 'dark'
 
 ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
 ## disabled. This setting must be a method that is enabled.
@@ -121,7 +121,7 @@ server:
 ##
 log:
   ## Level of verbosity for logs: info, debug, trace.
-  level: 'info'
+  level: 'debug'
 
   ## Format the logs are written as: json, text.
   format: 'text'
@@ -438,13 +438,13 @@ authentication_backend:
   ## This is the recommended Authentication Provider in production
   ## because it allows Authelia to offload the stateful operations
   ## onto the LDAP service.
-  # ldap:
+  ldap:
     ## The address of the directory server to connect to in the address common syntax.
     ## Format: [<scheme>://]<hostname>[:<port>].
     ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
     ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
     ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
-    # address: 'ldaps://127.0.0.1:636'
+    # address: 'lldap_lldap:3890'
 
     ## The LDAP implementation, this affects elements like the attribute utilized for resetting a password.
     ## Acceptable options are as follows:
@@ -457,19 +457,19 @@ authentication_backend:
     ## Depending on the option here certain other values in this section have a default value, notably all of the
     ## attribute mappings have a default value that this config overrides, you can read more about these default values
     ## at https://www.authelia.com/c/ldap#defaults
-    # implementation: 'custom'
-
+    implementation: 'lldap'
+    address: 'ldap://lldap_lldap:3890'
     ## The dial timeout for LDAP in the duration common syntax.
-    # timeout: '20 seconds'
+    timeout: '10 seconds'
 
     ## Use StartTLS with the LDAP connection.
     # start_tls: false
 
     ## TLS configuration.
-    # tls:
+    tls:
       ## The server subject name to check the servers certificate against during the validation process.
       ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: 'ldap.example.com'
+      server_name: 'lldap_lldap'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -477,7 +477,7 @@ authentication_backend:
       ## It's important to note the public key should be added to the directory, not the private key.
       ## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
       ## important to the administrator.
-      # skip_verify: false
+      skip_verify: true
 
       ## Minimum TLS version for the connection.
       # minimum_version: 'TLS1.2'
@@ -518,7 +518,7 @@ authentication_backend:
 
     ## The distinguished name of the container searched for objects in the directory information tree.
     ## See also: additional_users_dn, additional_groups_dn.
-    # base_dn: 'dc=example,dc=com'
+    base_dn: 'dc=johnsnexus,dc=click'
 
     ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
     ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
@@ -536,7 +536,7 @@ authentication_backend:
     ##
     ## To allow sign in both with username and email, one can use a filter like
     ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
-    # users_filter: '(&({username_attribute}={input})(objectClass=person))'
+    users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
 
     ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
     ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
@@ -548,27 +548,27 @@ authentication_backend:
     ##
     ## If your groups use the `groupOfUniqueNames` structure use this instead:
     ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
-    # groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
 
     ## The group search mode to use. Options are 'filter' or 'memberof'. It's essential to read the docs if you wish to
     ## use 'memberof'. Also 'filter' is the best choice for most use cases.
-    # group_search_mode: 'filter'
+    group_search_mode: 'filter'
 
     ## Follow referrals returned by the server.
     ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
     # permit_referrals: false
 
     ## The username and password of the admin user.
-    # user: 'cn=admin,dc=example,dc=com'
+    user: 'UID=heimdall,OU=people,DC=johnsnexus,DC=click'
     ## Password can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: 'password'
+    password: 'ragnarok'
 
     ## The attributes for users and objects from the directory server.
     # attributes:
 
       ## The distinguished name attribute if your directory server supports it. Users should read the docs before
       ## configuring. Only used for the 'memberof' group search mode.
-      # distinguished_name: ''
+    # distinguished_name: 'Administrator'
 
       ## The attribute holding the username of the user. This attribute is used to populate the username in the session
       ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP
@@ -606,21 +606,21 @@ authentication_backend:
   ##
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
-  file:
-    path: '/config/users_database.yml'
-    watch: false
-    search:
-      email: false
-      case_insensitive: false
-    password:
-      algorithm: 'argon2'
-      argon2:
-        variant: 'argon2id'
-        iterations: 3
-        memory: 65536
-        parallelism: 4
-        key_length: 32
-        salt_length: 16
+  # file:
+    # path: '/config/users_database.yml'
+    # watch: false
+    # search:
+      # email: false
+      # case_insensitive: false
+    # password:
+      # algorithm: 'argon2'
+      # argon2:
+        # variant: 'argon2id'
+        # iterations: 3
+        # memory: 65536
+        # parallelism: 4
+        # key_length: 32
+        # salt_length: 16
       # scrypt:
         # variant: 'scrypt'
         # iterations: 16
@@ -829,7 +829,7 @@ session:
       ##   - The above 'domain' option MUST either:
       ##      - Match the host portion of this URI.
       ##      - Match the suffix of the host portion when prefixed with '.'.
-      authelia_url: 'https://auth.johnsnexus.click'
+      authelia_url: 'https://auth.home.johnsnexus.click'
 
       ## Optional. The fully qualified URI used as the redirection location if the portal is accessed directly. Not
       ## configuring this option disables the automatic redirection behavior.

authelia/docker-compose.yml

@@ -5,9 +5,9 @@ services:
     image: authelia/authelia
     container_name: authelia
     volumes:
-      - /media/gv0/docker/authelia/config:/config
+      - /mnt/disk/authelia/config:/config
     networks:
-      - caddy_net
+      - jda_net
     security_opt:
       - no-new-privileges:true
     ports:
@@ -24,9 +24,9 @@ services:
     image: redis:alpine
     container_name: redis
     volumes:
-      - /media/gv0/docker/redis:/data
+      - /mnt/disk/authelia/redis:/data
     networks:
-      - caddy_net
+      - jda_net
     expose:
       - 6379
     restart: unless-stopped
@@ -35,5 +35,5 @@ services:
 
 
 networks:
-  caddy_net:
+  jda_net:
     external: true

authentik/docker-compose.yml

@@ -1,64 +0,0 @@
-services:
-  postgresql:
-    env_file:
-    - /media/gv0/docker/authentik/.env
-    environment:
-      POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-    healthcheck:
-      interval: 30s
-      retries: 5
-      start_period: 20s
-      test:
-      - CMD-SHELL
-      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
-      timeout: 5s
-    image: docker.io/library/postgres:16-alpine
-    restart: unless-stopped
-    volumes:
-    - /media/gv0/docker/authentik/postgres/database:/var/lib/postgresql/data
-  server:
-    command: server
-    depends_on:
-      postgresql:
-        condition: service_healthy
-    env_file:
-    - /media/gv0/docker/authentik/.env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
-    ports:
-    - ${COMPOSE_PORT_HTTP:-9000}:9000
-    - ${COMPOSE_PORT_HTTPS:-9443}:9443
-    restart: unless-stopped
-    shm_size: 512mb
-    volumes:
-    - /media/gv0/docker/authentik/data:/data
-    - /media/gv0/docker/authentik/custom-templates:/templates
-  worker:
-    command: worker
-    depends_on:
-      postgresql:
-        condition: service_healthy
-    env_file:
-    - /media/gv0/docker/authentik/.env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
-    restart: unless-stopped
-    shm_size: 512mb
-    user: root
-    volumes:
-    - /var/run/docker.sock:/var/run/docker.sock
-    - /media/gv0/docker/authentik/data:/data
-    - /media/gv0/docker/authentik/certs:/certs
-    - /media/gv0/docker/authentik/custom-templates:/templates

caddy/Caddyfile

@@ -2,7 +2,7 @@
 {
   # Global options, omly one such block at the head of the file
   servers {
-    trusted_proxies static 192.168.1.0/24 2a00:23c6::/32
+    trusted_proxies static 192.168.1.0/24 10.0.0.0/24 2a00:23c6::/32
           }
   # make admin available to all trusted nodes on the network
   admin :2019
@@ -11,15 +11,15 @@
 #
 
 #
-# For Authelis
+# For Authelia
 #
 (trusted_proxy_list) {
-       trusted_proxies 192.168.1.0/24 2a00:23c6::/32
+       trusted_proxies 192.168.1.0/24 10.0.0.0/24 2a00:23c6::/32
 }
 
 (secure_site) {
-       forward_auth {args[0]} 192.168.1.1:9091 {
-                uri /api/verify?rd=https://auth.johnsnexus.click
+     forward_auth {args[0]} 192.168.1.21:9091 {
+         uri /api/verify?rd=https://auth.home.johnsnexus.click
          copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
          import trusted_proxy_list
          header_up Host {upstream_hostport}
@@ -37,7 +37,7 @@
 #
 (basic-auth) {
    basic_auth {
-      john.anderson $2a$10$T.yetVs9CmektYsaU8RqYu37fVaFAsPDLf90lsDDfxLkaC.zWH3Oi
+      john.anderson $2a$10$4ka55bXqNBpoQcBDrJtd5OQje6Nt/HmvRNAGavqO03xq/Noth5xH.
       mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny
       frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6
       chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK
@@ -55,21 +55,33 @@
       barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS
       janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW
     }
+#    respond "Welcome, {http.auth.user.id}" 200
 }  
 #
-# Authelia from HOSTS
+# Authelia running on Production Cluster
 #
-auth.johnsnexus.click {
-     reverse_proxy 192.168.1.1:9091 {
+auth.home.johnsnexus.click {
+     reverse_proxy 192.168.1.21:9091 {
          import trusted_proxy_list
      }
 }
 #
+# Portainer running on PROXMOX cluster
+#
+port.home.johnsnexus.click {
+    reverse_proxy https://192.168.1.240:9443 {
+        transport http {
+            tls
+            tls_insecure_skip_verify
+        }
+    }
+}
+#
 # Locally hosted site
 #
-testcaddy.johnsnexus.click {
+testcaddy.home.johnsnexus.click {
     root * /usr/share/caddy      # compose file points to this
-    php_fastcgi 192.168.1.1:80
+    php_fastcgi 192.168.1.11:80
     file_server
 }
 #
@@ -78,58 +90,112 @@ testcaddy.johnsnexus.click {
 sandancer.ddnsfree.com {
     root * /var/www/html
     file_server
-#    reverse_proxy 192.168.1.1:8888
-    reverse_proxy famhistweb_famhistweb
+    reverse_proxy 192.168.1.243:8081
+#    reverse_proxy famhistweb_famhistweb
 }
 #
-# PocketID OIDC security, come here from DYNU, running on OMEGA to access token device
+# Family History Web Site on virtual machine on PROXMOX cluster
+nginx.home.johnsnexus.click {
+    reverse_proxy 192.168.1.243:80
+}
+#
+famhist.home.johnsnexus.click {
+    root * /var/www/html
+    file_server
+    reverse_proxy 192.168.1.243:8081
+}
+#
+# PocketID OIDC security, come here from DYNU, running on PROXMOX cluster
 #
 https://hold.johnsnexus.click {
-    reverse_proxy 192.168.1.5:1411
+    reverse_proxy 192.168.1.238:1411
 }
 #
-# Test GHOST site on ELITE cluster 
+# Test GHOST site on BETA 
 #
-ghost.johnsnexus.click {
-    root * /var/www/mymag
-    file_server
-    reverse_proxy 192.168.1.4:2368
-}
-#
-# Fanily History Web site on Production cluster system, come here via HOSTS file
-#
-nextfamhistweb.johnsnexus.click {
-#    import basic-auth
-    import secure_site *
-#    root * /usr/local/apache2/htdocs
+#ghost.johnsnexus.click {
+#    root * /var/www/mymag
 #    file_server
-    reverse_proxy nextfamhistweb_nextfamhistweb {
+#    reverse_proxy 192.168.1.9:2368
+#}
+#
+# Fanily History Web site on Production cluster system, come here via BIND9
+#
+nextfam.home.johnsnexus.click {
+#    import secure_site *
+#    root * /mnt/disk/NextFamilyWeb
+    file_server
+    reverse_proxy 192.168.1.243:8082 { 
         import trusted_proxy_list
     }
 }
 #
-# Test web site on Production Cluster, come here via HOSTS file
-# an example of a non-secure site on a different domain
+# Test web site on Production Cluster, come here via BIND9
 #
-http://northweb.johns.study {
-    import basic-auth
-    root * /usr/local/apache2/htdocs
+northweb.home.johnsnexus.click {
+    import secure_site *
     file_server
-    reverse_proxy testweb_testweb
+    reverse_proxy 192.168.1.243:8083
 }
 #
-# Test version of paperless-ngx on Elite cluster, come here via HOSTS file
+# Test version of paperless-ngx on OMEGA  come here via BIND9
 #
 wastebin.johnsnexus.click {
     file_server
-    reverse_proxy 192.168.1.4:8600
+    reverse_proxy 192.168.1.5:8600
 }
 #
 # Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address
 #
-pydiocells.johnsnexus.click {
+#pydiocells.johnsnexus.click {
 #    tls tls@johnsnexus.click
-    reverse_proxy 192.168.1.4:8888 {
+#    reverse_proxy 192.168.1.4:8888 {
+#       transport http {
+#          tls
+#          tls_insecure_skip_verify
+#       }
+#    }
+#}
+#
+# NEXTCLOUDAIO on virtual node 22, via DYNU
+#
+amudanan.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.22:11000 
+}
+#
+#codeamud.johnsnexus.click {
+#    file_server
+#    reverse_proxy 192.168.1.26:9980 {
+#        header_up X-Forwarded-Proto {scheme}
+#    transport http {
+#        tls_insecure_skip_verify
+#        }
+#    }
+#}
+#
+# OWNCLOUD on vmnode21
+#
+mycloud.johnsnexus.click {
+    header Strict-Transport-Security max-age=15552000
+    file_server
+    reverse_proxy 192.168.1.21:8080
+}
+#
+code.johnsnexus.click {
+       file_server
+       reverse_proxy 192.168.1.21:9980 {
+       header_up X-Forwarded-Proto {scheme}
+#       transport http {
+#          tls_insecure_skip_verify
+#       }
+    }
+}
+#
+# Vaultwarden on PROXMOX Cluster
+#
+warden.johnsnexus.click {
+    reverse_proxy https://192.168.1.25:8000 {
         transport http {
             tls
             tls_insecure_skip_verify
@@ -137,38 +203,6 @@ pydiocells.johnsnexus.click {
     }
 }
 #
-# Nextcloud AIO on NODE-16, was Beta (220 or 9)
-#
-https://amudanan.johnsnexus.click:443 {
-    header Strict-Transport-Security max-age=15552000
-    file_server
-    reverse_proxy http://192.168.1.16:11000 
-}
-#
-# OWNCLOUD on BEES swarm via DYNU
-#
-mycloud.johnsnexus.click {
-    header Strict-Transport-Security max-age=15552000
-    file_server
-    reverse_proxy 192.168.1.3:8080
-}
-#
-code.johnsnexus.click {
-       encode gzip
-       file_server
-       reverse_proxy https://192.168.1.3:9980 {
-       transport http {
-          tls_insecure_skip_verify
-       }
-    }
-}
-#
-# Vaultwarden on Production Cluster, come here via HOSTS
-#
-#warden.johnsnexus.click {
-#    reverse_proxy http://192.168.1.1:80
-#}
-#
 # SongKong on VALHALLA, come here via DYNU
 https://chord.johnsnexus.click {
     root * /music
@@ -178,60 +212,56 @@ https://chord.johnsnexus.click {
 ##
 # n8n running on DELTA, come here via DYNU
 #
-donut.johnsnexus.click {
-   reverse_proxy http://192.168.1.10:5678 {
-       flush_interval -1
-   }
-}
+#donut.johnsnexus.click {
+#   reverse_proxy http://192.168.1.10:5678 {
+#       flush_interval -1
+#   }
+#}
 #
-# CTiO magazine using Ghost on production
+# CTiO magazine using NICEPAGE on PROXMOX Cluster
+# two ways to access
 #
 ctio.johnsnexus.click {
     file_server
-    reverse_proxy 192.168.1.1:2368
+    reverse_proxy 192.168.1.243:8084
 }
 #
 #****************************************
 #
-# Hoarder from hosts file, keep in extenal domain
-# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000
+# Needs SSL; 
 #
-hoarder.johnsnexus.click {
-     reverse_proxy 192.168.1.4:3200 
+hoard.johnsnexus.click {
+    reverse_proxy 192.168.1.234:3000 
 }
 #
-# # although "prod" it runs on Elite Cluster
-grafana.johnsnexus.click {
-#     file_server
-     reverse_proxy 192.168.1.4:3030
-}
-# new gitea on elite cluster
-mygit.johnsnexus.click {
-     reverse_proxy 192.168.1.4:3000
-}
+# runs on virtual LXC
 #
-# copy of mygit on the production cluster
-gitea.johnsnexus.click {
+https://grafana.home.johnsnexus.click {
     file_server
-    reverse_proxy 192.168.1.1:3000
+    reverse_proxy 192.168.1.236:3000
 }
 #
-gotify.johnsnexus.click {
-     reverse_proxy 192.168.1.4:8111
+# runs on virtual node 21; not sure about additional line!
+#
+lldap.home.johnsnexus.click {
+    reverse_proxy 192.168.1.21:17170 {
+        header_up Host {http.request.host}
+    }
 }
 #
-# Portainer manageed on ELITE cluster, come here via HOSTS
-# Use port 9000 not 9443
-portainer.johnsnexus.click {
-     reverse_proxy 192.168.1.4:9000
+# copy of mygit on the proxmox cluster
+gitea.home.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.235:3000
 }
 #
-# Open Media Vault from HOSTS file
-#
-omv.valhalla.johnsnexus.click {
-     reverse_proxy 192.168.1.7
+# now a virtual container on PROXMOX
+gotify.home.johnsnexus.click {
+    reverse_proxy 192.168.1.230:80
 }
 #
-omv.paradise.johnsnexus.click {
-     reverse_proxy 192.168.1.8
+# New home assistant, running under docker on NODE-16 via wireless
+https://have.johnsnexus.click {
+    file_server
+    reverse_proxy 192.168.1.16:8123
 }

caddy/Caddyfile-01jun

@@ -1,258 +0,0 @@
- Caddyfile on production cluster
-{
-  # Global options, omly one such block at the head of the file
-  servers {
-    trusted_proxies static 192.168.1.0/24 2a00:23c6::/32
-          }
-  # make admin available to all trusted nodes on the network
-  admin :2019
-  metrics
-}
-#
-
-#
-# For Authelis
-#
-(trusted_proxy_list) {
-       trusted_proxies 192.168.1.0/24 2a00:23c6::/32
-}
-
-(secure_site) {
-       forward_auth {args[0]} 192.168.1.1:9091 {
-                uri /api/verify?rd=https://auth.johnsnexus.click
-                copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
-                import trusted_proxy_list
-                header_up Host {upstream_hostport}
-       }
-}
-#
-# it appears you need this to allow prometheus on a remote node to scrape the metrics
-:2019 {
-  handle {
-    metrics
-  }
-}
-#
-# Snippet for basic authorisation
-#
-(basic-auth) {
-   basic_auth {
-      john.anderson $2a$10$4ka55bXqNBpoQcBDrJtd5OQje6Nt/HmvRNAGavqO03xq/Noth5xH.
-      mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny
-      frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6
-      chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK
-      ruth.hoyos $2a$10$9z/3SajAWhxJfu6Xs1lbEeuPpZWUzcuBI/8n5hfv5FUqt11Uxo92S
-      sarah.anderson-beecham $2a$10$.8J1FMBwGDr8XSXCMWcn2ODxSW6txLEqSBHZmA6zQs8qQCDT2KbR2
-      fiona.green $2a$10$Nid0Lg6Wauwi/5BN4N2H5u8T6XumK4EE2MBxZaKXajxUAuUXPEvGO
-      helen.crichton $2a$10$zOcnxMCr62NtNK3YTaWbRuOclI/lC1Lkn1RidTOxkgBTgruQgfg9K
-      david.rawsthorne $2a$10$OIALdPjjQT6i5exUg8GtmOGk4BD4WmanmDhF7wCVH/IbpQQSt6PAS
-      peter.rawsthorne $2a$10$asUwJpdwc4QlGc8b1A1v7ukBCIQTlzm59uRnBH6AnWiK6NAECW03S
-      marilyn.pope $2a$10$6iD1J3FVmFbY7i02gQaF0eu1fY4ufUsXiXMyc1G9YfXbYKwuamjI2
-      alan.potts $2a$10$tzbIZwIuzcdrIzJICIS1oeadwoKyr3JqL2Ec9aB8Dj.MR4Q7lMcV.
-      kate.griffin $2a$10$9R57yOgGilEPZNwCbjWHeOu/ytTv4SLbW0P/plRnI.GqHe3w3IJjO
-      craig.johnson $2a$10$LQf3tK0ZHl63LHybpDfSdu1WT9OtcLeNZTfCwniPlmuqHiNF.yOq6
-      grant.johnson $2a$10$7XZ3aoQdL/fLex48t6hgi.p9Xt3yNJNIXJKflxChprwT5O9zPy2hG
-      barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS
-      janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW
-    }
-#    respond "Welcome, {http.auth.user.id}" 200
-}  
-#
-# Authelia from PIHOLE
-#
-auth.johnsnexus.click {
-     reverse_proxy 192.168.1.1:9091 {
-         import trusted_proxy_list
-     }
-}
-#
-# Locally hosted site
-#
-testcaddy.johnsnexus.click {
-    root * /usr/share/caddy      # compose file points to this
-    php_fastcgi 192.168.1.11:80
-    file_server
-}
-#
-# Family history web site via container on this cluster
-#
-sandancer.ddnsfree.com {
-    root * /var/www/html
-    file_server
-#    reverse_proxy 192.168.1.1:8888
-    reverse_proxy famhistweb_famhistweb
-}
-#
-# PocketID OIDC security, come here from DYNU, running on OMEGA to access token device
-#
-https://hold.johnsnexus.click {
-    reverse_proxy 192.168.1.5:1411
-}
-#
-# Test GHOST site on BETA 
-#
-#ghost.johnsnexus.click {
-#    root * /var/www/mymag
-#    file_server
-#    reverse_proxy 192.168.1.9:2368
-#}
-#
-# Fanily History Web site on Production cluster system, come here via BIND9
-#
-nextfamhistweb.johnsnexus.click {
-#    import basic-auth
-#    import secure_site *
-#    root * /usr/local/apache2/htdocs
-#    file_server
-    reverse_proxy nextfamhistweb_nextfamhistweb {
-        import trusted_proxy_list
-    }
-}
-#
-# Test web site on Production Cluster, come here via BIND9
-#
-northweb.johnsnexus.click {
-#    import secure_site *
-#    import basic-auth
-#    root * /usr/local/apache2/htdocs
-    file_server
-    reverse_proxy testweb_testweb
-}
-#
-# Test version of paperless-ngx on OMEGA  come here via BIND9
-#
-wastebin.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.5:8600
-}
-#
-# Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address
-#
-#pydiocells.johnsnexus.click {
-#    tls tls@johnsnexus.click
-#    reverse_proxy 192.168.1.4:8888 {
-#       transport http {
-#          tls
-#          tls_insecure_skip_verify
-#       }
-#    }
-#}
-#
-# NEXTCLOUDAIO on virtual node 22, via DYNU
-#
-amudanan.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.22:11000 
-}
-#
-#codeamud.johnsnexus.click {
-#    file_server
-#    reverse_proxy 192.168.1.26:9980 {
-#        header_up X-Forwarded-Proto {scheme}
-#    transport http {
-#        tls_insecure_skip_verify
-#        }
-#    }
-#}
-#
-# OWNCLOUD on vmnode21
-#
-mycloud.johnsnexus.click {
-    header Strict-Transport-Security max-age=15552000
-    file_server
-    reverse_proxy 192.168.1.21:8080
-}
-#
-code.johnsnexus.click {
-       file_server
-       reverse_proxy 192.168.1.21:9980 {
-       header_up X-Forwarded-Proto {scheme}
-#       transport http {
-#          tls_insecure_skip_verify
-#       }
-    }
-}
-#
-# TESTCLOUD/Nextcloud Alpine on ZETA
-#testcloud.johnsnexus.click {
-#    file_server
-#    reverse_proxy 192.168.1.26
-#}
-#
-# TESTCLOUD/nextcloud-alpine in a secure LXC on ZETA
-#
-testcloud.johnsnexus.click {
-    header Strict-Transport-Security max-age=15552000
-    file_server
-    reverse_proxy https://192.168.1.232:443 {
-        transport http {
-            tls_insecure_skip_verify
-            }
-    }
-}
-#
-# Vaultwarden on Production Cluster, come here via HOSTS
-#
-#warden.johnsnexus.click {
-#    reverse_proxy http://192.168.1.1:80
-#}
-#
-# SongKong on VALHALLA, come here via DYNU
-https://chord.johnsnexus.click {
-    root * /music
-    file_server
-    reverse_proxy http://192.168.1.7:4567
-}
-##
-# n8n running on DELTA, come here via DYNU
-#
-#donut.johnsnexus.click {
-#   reverse_proxy http://192.168.1.10:5678 {
-#       flush_interval -1
-#   }
-#}
-#
-# CTiO magazine using NICEPAGE on PROXMOX
-#
-ctio.johnsnexus.click {
-    file_server
-    reverse_proxy ctiomag_ctiomag
-}
-#
-#****************************************
-#
-# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000
-#
-hoarder.johnsnexus.click {
-     reverse_proxy 192.168.1.15:3200 
-}
-#
-#
-# runs on virtual node-15 in a docker container
-#
-grafana.johnsnexus.click {
-#     import basic-auth
-     reverse_proxy 192.168.1.15:3030
-}
-#
-# new gitea on Elite cluster
-#
-mygit.johnsnexus.click {
-     reverse_proxy 192.168.1.15:3000
-}
-#
-# copy of mygit on the production cluster
-gitea.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.1:3000
-}
-#
-# now a cirtual container on PROXMOX
-gotify.johnsnexus.click {
-     reverse_proxy 192.168.1.230:80
-}
-#
-# New home assistant, running under docker on NODE-16 via wireless
-https://have.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.16:8123

caddy/Caddyfile-latest

@@ -1,248 +0,0 @@
-# Caddyfile on production cluster
-{
-  # Global options, omly one such block at the head of the file
-  servers {
-    trusted_proxies static 192.168.1.0/24 2a00:23c6::/32
-          }
-  # make admin available to all trusted nodes on the network
-  admin :2019
-  metrics
-}
-#
-
-#
-# For Authelis
-#
-(trusted_proxy_list) {
-       trusted_proxies 192.168.1.0/24 2a00:23c6::/32
-}
-
-(secure_site) {
-       forward_auth {args[0]} 192.168.1.1:9091 {
-                uri /api/verify?rd=https://auth.johnsnexus.click
-                copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
-                import trusted_proxy_list
-                header_up Host {upstream_hostport}
-       }
-}
-#
-# it appears you need this to allow prometheus on a remote node to scrape the metrics
-:2019 {
-  handle {
-    metrics
-  }
-}
-#
-# Snippet for basic authorisation
-#
-(basic-auth) {
-    basic_auth {
-      john.anderson $2a$10$T.yetVs9CmektYsaU8RqYu37fVaFAsPDLf90lsDDfxLkaC.zWH3Oi
-      mary.anderson $2a$10$UOuB5DpDcKRho0rRPDCmCeFlDSx/f6Bkwqpw8CEeQCbAGA0yULcny
-      frazer.anderson $2a$10$UleGw5O0BB18XtSenFSawudO.qKbNVMFU772XMP4cAAUbWzRo/zr6
-      chris.anderson $2a$10$1MeL9m8M7FW/k6/DW3HB1.rkijS3qao8RraNO/tJKN8OuRTCzc3fK
-      ruth.hoyos $2a$10$9z/3SajAWhxJfu6Xs1lbEeuPpZWUzcuBI/8n5hfv5FUqt11Uxo92S
-      sarah.anderson-beecham $2a$10$.8J1FMBwGDr8XSXCMWcn2ODxSW6txLEqSBHZmA6zQs8qQCDT2KbR2
-      fiona.green $2a$10$Nid0Lg6Wauwi/5BN4N2H5u8T6XumK4EE2MBxZaKXajxUAuUXPEvGO
-      helen.crichton $2a$10$zOcnxMCr62NtNK3YTaWbRuOclI/lC1Lkn1RidTOxkgBTgruQgfg9K
-      david.rawsthorne $2a$10$OIALdPjjQT6i5exUg8GtmOGk4BD4WmanmDhF7wCVH/IbpQQSt6PAS
-      peter.rawsthorne $2a$10$asUwJpdwc4QlGc8b1A1v7ukBCIQTlzm59uRnBH6AnWiK6NAECW03S
-      marilyn.pope $2a$10$6iD1J3FVmFbY7i02gQaF0eu1fY4ufUsXiXMyc1G9YfXbYKwuamjI2
-      alan.potts $2a$10$tzbIZwIuzcdrIzJICIS1oeadwoKyr3JqL2Ec9aB8Dj.MR4Q7lMcV.
-      kate.griffin $2a$10$9R57yOgGilEPZNwCbjWHeOu/ytTv4SLbW0P/plRnI.GqHe3w3IJjO
-      craig.johnson $2a$10$LQf3tK0ZHl63LHybpDfSdu1WT9OtcLeNZTfCwniPlmuqHiNF.yOq6
-      grant.johnson $2a$10$7XZ3aoQdL/fLex48t6hgi.p9Xt3yNJNIXJKflxChprwT5O9zPy2hG
-      barbara.wright $2a$10$Mlp0Y2wPzzomL1EnTInS2u18yv7ksMY.ATURzQz4luRRe2JwBMEJS
-      janet.kennedy $2a$10$/8VCpm68CLSF2zSL5sHtR.hzwJ.h3cX3r8XHogHbz8o7KIYPDHOVW
-    }
-#    respond "Welcome, {http.auth.user.id}" 200
-}  
-#
-# Authelia from PIHOLE
-#
-auth.johnsnexus.click {
-     reverse_proxy 192.168.1.1:9091 {
-         import trusted_proxy_list
-     }
-}
-#
-# Locally hosted site
-#
-testcaddy.johnsnexus.click {
-    root * /usr/share/caddy      # compose file points to this
-    php_fastcgi 192.168.1.1:80
-    file_server
-}
-#
-# Family history web site via container on this cluster
-#
-sandancer.ddnsfree.com {
-    root * /var/www/html
-    file_server
-#    reverse_proxy 192.168.1.1:8888
-    reverse_proxy famhistweb_famhistweb
-}
-#
-# PocketID OIDC security, come here from DYNU, running on OMEGA to access token device
-#
-https://hold.johnsnexus.click {
-    reverse_proxy 192.168.1.5:1411
-}
-#
-# Test GHOST site on BETA 
-#
-ghost.johnsnexus.click {
-    root * /var/www/mymag
-    file_server
-    reverse_proxy 192.168.1.9:2368
-}
-#
-# Fanily History Web site on Production cluster system, come here via BIND9
-#
-nextfamhistweb.johnsnexus.click {
-#    import basic-auth
-#    import secure_site *
-#    root * /usr/local/apache2/htdocs
-#    file_server
-    reverse_proxy nextfamhistweb_nextfamhistweb {
-        import trusted_proxy_list
-    }
-}
-#
-# Test web site on Production Cluster, come here via BIND9
-#
-northweb.johnsnexus.click {
-#    import secure_site *
-#    import basic-auth
-    root * /usr/local/apache2/htdocs
-    file_server
-    reverse_proxy testweb_testweb
-}
-#
-# Test version of paperless-ngx on OMEGA  come here via BIND9
-#
-wastebin.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.5:8600
-}
-#
-# Version of pydio cells on NODE-16 using SAMBA volume - DYNU public address
-#
-#pydiocells.johnsnexus.click {
-#    tls tls@johnsnexus.click
-#    reverse_proxy 192.168.1.4:8888 {
-#       transport http {
-#          tls
-#          tls_insecure_skip_verify
-#       }
-#    }
-#}
-#
-# Owncloud on ELITE "cluster", via DYNU
-#
-amudanan.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.9:11000 
-}
-#
-codeamud.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.9:9980 {
-        header_up X-Forwarded-Proto {scheme}
-#    transport http {
-#        tls_insecure_skip_verify
-#        }
-    }
-}
-#
-# OWNCLOUD on DELTA come here via BIND9
-#
-mycloud.johnsnexus.click {
-    header Strict-Transport-Security max-age=15552000
-    file_server
-    reverse_proxy 192.168.1.10:8080
-}
-#
-code.johnsnexus.click {
-       file_server
-       reverse_proxy 192.168.1.10:9980 {
-       header_up X-Forwarded-Proto {scheme}
-#       transport http {
-#          tls_insecure_skip_verify
-#       }
-    }
-}
-#
-# TESTCLOUD/NEXTCLOUDAIO on ZETA come here via BIND9
-#
-testcloud.johnsnexus.click {
-    file_server
-    reverse_proxy http://192.168.1.20:11000
-}
-#
-# Vaultwarden on Production Cluster, come here via HOSTS
-#
-#warden.johnsnexus.click {
-#    reverse_proxy http://192.168.1.1:80
-#}
-#
-# SongKong on VALHALLA, come here via DYNU
-https://chord.johnsnexus.click {
-    root * /music
-    file_server
-    reverse_proxy http://192.168.1.7:4567
-}
-##
-# n8n running on DELTA, come here via DYNU
-#
-donut.johnsnexus.click {
-   reverse_proxy http://192.168.1.10:5678 {
-       flush_interval -1
-   }
-}
-#
-# CTiO magazine using Ghost on production
-#
-ctio.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.1:2368
-}
-#
-#****************************************
-#
-# Hoarder from PIHOLR
-# Needs SSL; leave as explicit address; use 3200 as gitea uses 3000
-#
-hoarder.johnsnexus.click {
-     reverse_proxy 192.168.1.9:3200 
-}
-#
-#
-# although "prod" it runs on Elite Cluster
-#
-grafana.johnsnexus.click {
-#     file_server
-     reverse_proxy 192.168.1.9:3030
-}
-#
-# new gitea on Elite cluster
-#
-mygit.johnsnexus.click {
-     reverse_proxy 192.168.1.9:3000
-}
-#
-# copy of mygit on the production cluster
-gitea.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.1:3000
-}
-#
-gotify.johnsnexus.click {
-     reverse_proxy 192.168.1.9:8111
-}
-#
-# New home assistant, running unde docker on ZETA
-https://have.johnsnexus.click {
-    file_server
-    reverse_proxy 192.168.1.16:8123
-}

lldap/docker-compose.yml

@@ -0,0 +1,19 @@
+services:
+  lldap:
+    image: lldap/lldap:stable
+    container_name: lldap
+    ports:
+      - "3890:3890"   # LDAP port
+      - "17170:17170" # Web UI port
+    volumes:
+      - /mnt/disk/lldap/data:/data
+    environment:
+      LLDAP_JWT_SECRET: "/K{5T.'-zR,W*gg|xI,u-[/[5.1?HI-S"
+      LLDAP_LDAP_USER_PASS: "Password1"  # Change this!
+    restart: unless-stopped
+    networks:
+      - jda_net
+
+networks:
+  jda_net:
+    external: true

lldap/lldap_config.docker_template.toml

@@ -0,0 +1,174 @@
+## Default configuration for Docker.
+## All the values can be overridden through environment variables, prefixed
+## with "LLDAP_". For instance, "ldap_port" can be overridden with the
+## "LLDAP_LDAP_PORT" variable.
+
+## Tune the logging to be more verbose by setting this to be true.
+## You can set it with the LLDAP_VERBOSE environment variable.
+# verbose=false
+
+## The host address that the LDAP server will be bound to.
+## To enable IPv6 support, simply switch "ldap_host" to "::":
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+#ldap_host = "0.0.0.0"
+
+## The port on which to have the LDAP server.
+#ldap_port = 3890
+
+## The host address that the HTTP server will be bound to.
+## To enable IPv6 support, simply switch "http_host" to "::".
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+#http_host = "0.0.0.0"
+
+## The port on which to have the HTTP server, for user login and
+## administration.
+#http_port = 17170
+
+## The public URL of the server, for password reset links.
+#http_url = "http://localhost"
+
+## The path to the front-end assets (relative to the working directory).
+#assets_path = "./app"
+
+## Random secret for JWT signature.
+## This secret should be random, and should be shared with application
+## servers that need to consume the JWTs.
+## Changing this secret will invalidate all user sessions and require
+## them to re-login.
+## You should probably set it through the LLDAP_JWT_SECRET environment
+## variable from a secret ".env" file.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_JWT_SECRET_FILE environment variable
+## You can generate it with (on linux):
+## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''
+#jwt_secret = "REPLACE_WITH_RANDOM"
+
+## Base DN for LDAP.
+## This is usually your domain name, and is used as a
+## namespace for your users. The choice is arbitrary, but will be needed
+## to configure the LDAP integration with other services.
+## The sample value is for "example.com", but you can extend it with as
+## many "dc" as you want, and you don't actually need to own the domain
+## name.
+ldap_base_dn = "dc=johnsnexus,dc=click"
+
+## Admin username.
+## For the LDAP interface, a value of "admin" here will create the LDAP
+## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).
+## For the administration interface, this is the username.
+#ldap_user_dn = "admin"
+
+## Admin email.
+## Email for the admin account. It is only used when initially creating
+## the admin user, and can safely be omitted.
+#ldap_user_email = "admin@example.com"
+
+## Admin password.
+## Password for the admin account, both for the LDAP bind and for the
+## administration interface. It is only used when initially creating
+## the admin user.
+## It should be minimum 8 characters long.
+## You can set it with the LLDAP_LDAP_USER_PASS environment variable.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_LDAP_USER_PASS_FILE environment variable
+## Note: you can create another admin user for user administration, this
+## is just the default one.
+#ldap_user_pass = "REPLACE_WITH_PASSWORD"
+
+## Force reset of the admin password.
+## Break glass in case of emergency: if you lost the admin password, you
+## can set this to true to force a reset of the admin password to the value
+## of ldap_user_pass above.
+## Alternatively, you can set it to "always" to reset every time the server starts.
+# force_ldap_user_pass_reset = false
+
+## Database URL.
+## This encodes the type of database (SQlite, MySQL, or PostgreSQL)
+## , the path, the user, password, and sometimes the mode (when
+## relevant).
+## Note: SQlite should come with "?mode=rwc" to create the DB
+## if not present.
+## Example URLs:
+##  - "postgres://postgres-user:password@postgres-server/my-database"
+##  - "mysql://mysql-user:password@mysql-server/my-database"
+##
+## This can be overridden with the LLDAP_DATABASE_URL env variable.
+database_url = "sqlite:///data/users.db?mode=rwc"
+
+## Private key file.
+## Not recommended, use key_seed instead.
+## Contains the secret private key used to store the passwords safely.
+## Note that even with a database dump and the private key, an attacker
+## would still have to perform an (expensive) brute force attack to find
+## each password.
+## Randomly generated on first run if it doesn't exist.
+## Env variable: LLDAP_KEY_FILE
+#key_file = "/data/private_key"
+
+## Seed to generate the server private key, see key_file above.
+## This can be any random string, the recommendation is that it's at least 12
+## characters long.
+## Env variable: LLDAP_KEY_SEED
+key_seed = "RanD0m STR1ng"
+
+## Ignored attributes.
+## Some services will request attributes that are not present in LLDAP. When it
+## is the case, LLDAP will warn about the attribute being unknown. If you want
+## to ignore the attribute and the service works without, you can add it to this
+## list to silence the warning.
+#ignored_user_attributes = [ "sAMAccountName" ]
+#ignored_group_attributes = [ "mail", "userPrincipalName" ]
+
+## Options to configure SMTP parameters, to send password reset emails.
+## To set these options from environment variables, use the following format
+## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
+[smtp_options]
+## Whether to enabled password reset via email, from LLDAP.
+#enable_password_reset=true
+## The SMTP server.
+#server="smtp.gmail.com"
+## The SMTP port.
+#port=587
+## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
+#smtp_encryption = "TLS"
+## The SMTP user, usually your email address.
+#user="sender@gmail.com"
+## The SMTP password.
+#password="password"
+## The header field, optional: how the sender appears in the email. The first
+## is a free-form name, followed by an email between <>.
+#from="LLDAP Admin <sender@gmail.com>"
+## Same for reply-to, optional.
+#reply_to="Do not reply <noreply@localhost>"
+
+## Options to configure LDAPS.
+## To set these options from environment variables, use the following format
+## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
+[ldaps_options]
+## Whether to enable LDAPS.
+#enabled=true
+## Port on which to listen.
+#port=6360
+## Certificate file.
+#cert_file="/data/cert.pem"
+## Certificate key file.
+#key_file="/data/key.pem"
+
+## Options to configure the healthcheck command.
+## To set these options from environment variables, use the following format
+## (example with http_host): LLDAP_HEALTHCHECK_OPTIONS__HTTP_HOST
+[healthcheck_options]
+## The host address that the healthcheck should verify for the HTTP server.
+## If "http_host" is set to a specific IP address, this must be set to match if the built-in
+## healthcheck command is used.  Note: if this is an IPv6 address, it must be wrapped in [].
+#http_host = "localhost"
+## The host address that the healthcheck should verify for the LDAP server.
+## If "ldap_host" is set to a specific IP address, this must be set to match if the built-in
+## healthcheck command is used.
+#ldap_host = "localhost"

uptime-kuma/docker-compose.yml

@@ -2,10 +2,10 @@ services:
   uptime-kuma:
     image: louislam/uptime-kuma:2.2.1
     container_name: uptime-kuma
-    deploy:
-      placement:
-        constraints:
-          - node.labels.target != here
+#    deploy:
+#      placement:
+#        constraints:
+#          - node.labels.target != here
     restart: always
     ports:
       - "3010:3001"

vaultwarden/docker-compose.yml

@@ -0,0 +1,19 @@
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    container_name: vaultwarden
+    restart: unless-stopped
+    environment:
+      - DOMAIN=https://warden.johnsnexus.click
+      - SIGNUPS_ALLOWED=true # Set to false after creating your account
+    ports:
+      - 8080:80
+    volumes:
+      - /media/gv0/docker/vw-data:/data
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+