Ship homelab quick wins: Recyclarr, infra pins, jd.ginnoir.com, and LAN lockdown.
Deploy to valhalla / deploy (push) Has been cancelled
Deploy to valhalla / deploy (push) Has been cancelled
Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
This commit is contained in:
ginnoir
@@ -1,7 +1,7 @@
|
||||
# TB-002 — jd.ginnoir.com
|
||||
|
||||
**Status:** not started
|
||||
**Your call:** _(unset — talk first)_
|
||||
**Status:** done — 2026-06-11
|
||||
**Your call:** Do it
|
||||
|
||||
---
|
||||
|
||||
@@ -32,9 +32,9 @@
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Decision** | |
|
||||
| **Notes** | |
|
||||
| **Date** | |
|
||||
| **Decision** | Do it |
|
||||
| **Notes** | Caddy block added; bookmarks regenerated |
|
||||
| **Date** | 2026-06-11 |
|
||||
|
||||
---
|
||||
|
||||
@@ -52,7 +52,7 @@ Caddyfile
|
||||
|
||||
### Done when
|
||||
|
||||
- [ ] jd.ginnoir.com works on LAN
|
||||
- [ ] 403 from outside
|
||||
- [x] jd.ginnoir.com works on LAN
|
||||
- [x] 403 from outside
|
||||
|
||||
</details>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# TB-003 — Recyclarr
|
||||
|
||||
**Status:** not started
|
||||
**Your call:** _(unset — talk first)_
|
||||
**Status:** done — 2026-06-11 (deploy + first sync pending push)
|
||||
**Your call:** Do it
|
||||
|
||||
---
|
||||
|
||||
@@ -32,9 +32,9 @@
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Decision** | |
|
||||
| **Notes** | |
|
||||
| **Date** | |
|
||||
| **Decision** | Do it — WEB-1080p (Sonarr) + HD Bluray+WEB (Radarr) |
|
||||
| **Notes** | Config in stacks/media/recyclarr/; run `docker exec recyclarr recyclarr sync` after deploy |
|
||||
| **Date** | 2026-06-11 |
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# TB-004 — Pin infra image tags
|
||||
|
||||
**Status:** not started
|
||||
**Your call:** _(unset — talk first)_
|
||||
**Status:** done — 2026-06-11
|
||||
**Your call:** Do it
|
||||
|
||||
---
|
||||
|
||||
@@ -32,9 +32,9 @@
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Decision** | |
|
||||
| **Notes** | |
|
||||
| **Date** | |
|
||||
| **Decision** | Do it |
|
||||
| **Notes** | Pinned MariaDB 12.3, Redis 7-alpine, MinIO RELEASE.2025-09-07, Caddy 2.11.3, CouchDB 3.4, Vault digest; watchtower disabled on all |
|
||||
| **Date** | 2026-06-11 |
|
||||
|
||||
---
|
||||
|
||||
@@ -53,7 +53,7 @@ All compose files
|
||||
|
||||
### Done when
|
||||
|
||||
- [ ] No :latest on DB/Caddy/Vault/CouchDB/MinIO
|
||||
- [ ] Stacks still deploy clean
|
||||
- [x] No :latest on DB/Caddy/Vault/CouchDB/MinIO
|
||||
- [ ] Stacks still deploy clean (verify after push)
|
||||
|
||||
</details>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# TB-006 — Authentik SSO at the edge
|
||||
|
||||
**Status:** batch 1 deployed (2026-06-10) — admin sites live; batches 2–3 pending
|
||||
**Your call:** **Tweak → Do it** (2026-06-10)
|
||||
**Status:** batches 1–3 deployed (2026-06-11) — batch 4 deferred
|
||||
**Your call:** **Done for now** (2026-06-11) — batch 4 (romm, router UI) later
|
||||
|
||||
---
|
||||
|
||||
@@ -16,12 +16,12 @@
|
||||
|
||||
### Scope (decided 2026-06-10)
|
||||
|
||||
**In:** All Caddy-proxied sites with an app login UI → Caddy `forward_auth` to Authentik (or keep native OIDC where already wired, e.g. famapp).
|
||||
**In:** All Caddy-proxied sites with an app login UI → Authentik (native OIDC/OAuth where supported; else `forward_auth` + disable local auth).
|
||||
|
||||
**Out / untouched:**
|
||||
|
||||
- **Overseerr** (`requests.ginnoir.com`) — friends use Plex accounts; leave as-is.
|
||||
- **Webhook & API paths** — bypass `forward_auth` (Portainer webhooks already modeled; extend pattern per app).
|
||||
- **Webhook & API paths** — bypass `forward_auth` where still used (Portainer webhooks, Gitea `/api/*`, Vault `/v1/*`, etc.).
|
||||
- **Static / no login** — 5etools, pf2e, ffttsystems, romhacks wiki files, etc.
|
||||
|
||||
**Explicitly out (confirmed):**
|
||||
@@ -30,31 +30,13 @@
|
||||
- **Foundry / Foundry2** — players use Foundry accounts; no Authentik.
|
||||
- **Overseerr** — Plex login for friends.
|
||||
|
||||
**Public apps — Authentik for human login, bypass for machine/public traffic:**
|
||||
|
||||
| Site | Authentik on | Bypass (stay open) |
|
||||
|------|--------------|-------------------|
|
||||
| **files** (ownCloud) | Web UI / admin | Public share links (`/s/*`, `/index.php/s/*`); WebDAV if used by clients |
|
||||
| **freshrss** | Web UI | Feed cron is in-container (no bypass needed); Reader/Fever/Google API paths use API password |
|
||||
| **ntfy** | Web UI / account mgmt | Topic publish/subscribe (`POST`/`GET` topic paths, `/v1/*`); Vigilant + famapp push must keep working |
|
||||
| **resume** | Builder / dashboard / login | Public resume pages (e.g. `/ginnoir/resume`); MinIO object GETs on `storage.j-costa.com` if public |
|
||||
|
||||
### Your options
|
||||
|
||||
| Option | Meaning |
|
||||
|--------|---------|
|
||||
| **Do it** | We're doing this — I'll implement or walk you through it |
|
||||
| **Later** | Keep on the list, not now |
|
||||
| **Drop** | Remove from plan — totally fine |
|
||||
| **Tweak** | Change scope; tell me how |
|
||||
|
||||
### What we decided
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Decision** | Do it — batch 1 admin deployed; batches 2–3 pending |
|
||||
| **Notes** | Out: obsidian, foundry×2, overseerr. Batch 1: homarr native OIDC done; rest split native OAuth vs forward_auth+disable local auth (2026-06-11). Portainer needs one-time OAuth in UI; Plane needs god-mode OIDC. Push repo to persist. |
|
||||
| **Date** | 2026-06-10 (batch 1 deployed) |
|
||||
| **Decision** | Batches 1–3 done; batch 4 (romm, router UI) deferred — not now |
|
||||
| **Notes** | Batch 3 uses **native OIDC/OAuth** for ownCloud, FreshRSS, resume — not edge-only `forward_auth` (double-login). ntfy + `storage.j-costa.com` have **no Authentik**. Resume Postgres/MinIO restored from `htpc-download-box_*` safety-net volumes (2026-06-11). |
|
||||
| **Date** | 2026-06-11 (batch 3 complete) |
|
||||
|
||||
---
|
||||
|
||||
@@ -63,42 +45,49 @@
|
||||
|
||||
### Stack / files
|
||||
|
||||
Caddyfile + Authentik UI
|
||||
Caddyfile + Authentik UI + `stacks/authentik/scripts/`
|
||||
|
||||
### If we do it — rough steps
|
||||
### Rollout batches
|
||||
|
||||
1. Authentik embedded outpost + proxy provider(s) on `edge`
|
||||
2. Caddy `(authentik_auth)` snippet — `forward_auth authentik-server:9000` with trusted headers
|
||||
3. Roll out site-by-site; per-site `handle` bypasses for webhooks/API
|
||||
4. **Important:** `forward_auth` only gates the edge — apps still show their own login unless you add **native OIDC/OAuth** (famapp/homarr pattern) or disable local auth (e.g. code-server `--auth none`). Homarr switched to native OIDC 2026-06-11.
|
||||
5. **Batch 1 rest (2026-06-11):** BookStack/Gitea/MinIO/Portainer/Plane → native OAuth2 providers; code/uptime/kopia/registry-ui/dbx/vault → forward_auth with local auth disabled where possible. **Portainer:** one-time OAuth setup in Settings → Authentication (see `setup-batch1-oidc.py` output). **Plane:** god-mode at `/god-mode/authentication/oidc`.
|
||||
| Batch | Sites | Status |
|
||||
|-------|-------|--------|
|
||||
| 1 — Admin | portainer, code, registry-ui, vault, minio, homarr, uptime, backup/kopia, gitea, dbx, bookstack, plane | Deployed |
|
||||
| 2 — Media | sonarr, radarr, bazarr, prowlarr, tautulli, qbit, deluge, nzbget, whisparr, stash | Deployed |
|
||||
| 3 — Public + login | files, freshrss, ntfy, resume, storage.j-costa.com | Deployed (revised approach below) |
|
||||
| 4 — Other internal | romm, router UI | **Deferred** |
|
||||
| Skip | famapp (OIDC done), auth.ginnoir.com, overseerr, obsidian, foundry×2, static sites | — |
|
||||
|
||||
**Rollout batches**
|
||||
### Batch 3 — final approach (2026-06-11)
|
||||
|
||||
| Batch | Sites |
|
||||
|-------|-------|
|
||||
| 1 — Admin | portainer, code, registry-ui, vault, minio, homarr, uptime, backup/kopia, gitea, dbx, bookstack, plane |
|
||||
| 2 — Media | sonarr, radarr, bazarr, prowlarr, tautulli, qbit, deluge, nzbget, whisparr, stash |
|
||||
| 3 — Public + login | files, freshrss, ntfy, resume (with bypass tables above) |
|
||||
| 4 — Other internal | romm, router UI |
|
||||
| Skip | famapp (OIDC done), auth.ginnoir.com, overseerr, obsidian, foundry×2, static sites |
|
||||
| Site | Authentik method | Notes |
|
||||
|------|------------------|-------|
|
||||
| **files** (ownCloud) | Native OIDC | `setup-batch1-oidc.py` → `owncloud-web`; `oidc.config.php` via `scripts/apply-batch3-app-auth.sh`; Caddy `/.well-known/openid-configuration` rewrite |
|
||||
| **freshrss** | Native OIDC | Apache `mod_auth_openidc` (`OIDC_*` in notify stack); provider `freshrss` in Authentik — **Application must bind to OAuth2 provider**, not proxy |
|
||||
| **resume** | Native OAuth | `reactive-resume` provider; `OAUTH_*` in resume stack; `FLAG_DISABLE_EMAIL_AUTH=true` |
|
||||
| **ntfy** | **None** | Native ntfy login only; forward_auth breaks web UI |
|
||||
| **storage.j-costa.com** | **None** | Plain `reverse_proxy` — app writes to MinIO internally; public GETs for resume assets |
|
||||
|
||||
**Resume data restore:** bind mounts were empty after stack split; live data copied from `htpc-download-box_postgres_data` + `htpc-download-box_minio_data` via `scripts/restore-resume-data.sh`. After restore, run `scripts/fix-resume-oauth-link.sh` (email_verified) and `scripts/fix-resume-jwks.sh` if sessions loop (JWKS encrypted with old `AUTH_SECRET`).
|
||||
|
||||
**Ops scripts (batch 3):**
|
||||
|
||||
- `scripts/run-batch1-oidc.py` wrapper → `run-batch1-oidc.sh`
|
||||
- `scripts/run-forward-auth-admin.sh`
|
||||
- `scripts/apply-batch3-app-auth.sh` — ownCloud oidc.config.php + FreshRSS `http_auth` patch (superseded by FreshRSS native OIDC)
|
||||
- `scripts/restore-resume-data.sh`, `scripts/fix-resume-oauth-link.sh`, `scripts/fix-resume-jwks.sh`
|
||||
|
||||
### Done when
|
||||
|
||||
- [x] Batch 1 admin sites require Authentik before app UI loads (or native OAuth equivalent)
|
||||
- [x] Homarr native OIDC (no double login)
|
||||
- [x] BookStack, Gitea, MinIO console → native Authentik OAuth/OIDC
|
||||
- [x] code-server, uptime, kopia → forward_auth only (local auth disabled)
|
||||
- [x] registry-ui, dbx, vault → forward_auth at edge
|
||||
- [ ] Portainer OAuth configured in Settings → Authentication (provider created; UI step pending)
|
||||
- [ ] Plane OIDC configured in god-mode (provider created; UI step pending)
|
||||
- [x] Portainer git webhooks still work (bypass path)
|
||||
- [x] Gitea `/api/*` + `.git` and Vault `/v1/*` bypass forward_auth
|
||||
- [ ] Batch 2 media sites
|
||||
- [ ] Batch 3 public apps (ownCloud shares, FreshRSS, ntfy, resume)
|
||||
- [ ] ownCloud share links work without Authentik session
|
||||
- [ ] FreshRSS still refreshes feeds; Vigilant/famapp still publish to ntfy
|
||||
- [ ] Public resume pages still viewable without Authentik
|
||||
- [ ] Overseerr unchanged for Plex friends
|
||||
- [x] Batch 2 media sites — forward_auth + external/disabled local auth (Tautulli excepted)
|
||||
- [x] Batch 3 — ownCloud, FreshRSS, resume single Authentik login (native OIDC/OAuth)
|
||||
- [x] ntfy — native auth only; Vigilant/famapp push unchanged
|
||||
- [x] storage.j-costa.com — no Authentik; public resume assets work
|
||||
- [x] Public resume pages viewable without Authentik
|
||||
- [x] ownCloud share links work without Authentik session
|
||||
- [ ] Batch 4 — romm, router UI (deferred)
|
||||
- [ ] Portainer OAuth configured in Settings → Authentication (provider created; UI step optional)
|
||||
- [ ] Plane OIDC configured in god-mode (optional; forward_auth accepted)
|
||||
- [ ] Reap orphan `htpc-download-box_*` volumes after trusting bind mounts (TB-011)
|
||||
|
||||
</details>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# TB-033 — Public surface audit
|
||||
|
||||
**Status:** not started
|
||||
**Your call:** _(unset — talk first)_
|
||||
**Status:** done — audited 2026-06-11
|
||||
**Your call:** Do it (walkthrough complete; action items below)
|
||||
|
||||
---
|
||||
|
||||
@@ -32,9 +32,54 @@
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Decision** | |
|
||||
| **Notes** | |
|
||||
| **Date** | |
|
||||
| **Decision** | Do it — audit complete; fixes tracked below |
|
||||
| **Notes** | Obsidian locked down in TB-005. Auth gaps → TB-006 (other session). |
|
||||
| **Date** | 2026-06-11 |
|
||||
|
||||
---
|
||||
|
||||
## Audit results (2026-06-11)
|
||||
|
||||
Sites **without** `internal_only` — reachable from the public internet (Cloudflare → Caddy):
|
||||
|
||||
### Intentionally public ✓
|
||||
|
||||
| Site | Purpose |
|
||||
|------|---------|
|
||||
| foundry.ginnoir.com, foundry2.ginnoir.com | Foundry VTT for players |
|
||||
| 5etools.ginnoir.com, pf2e.ginnoir.com | Tabletop reference sites |
|
||||
| files.ginnoir.com | ownCloud (Authentik on admin UI) |
|
||||
| ffttsystems.ginnoir.com | Static site |
|
||||
| requests.ginnoir.com | Overseerr for friends |
|
||||
| ntfy.ginnoir.com | Push notifications (native auth) |
|
||||
| freshrss.ginnoir.com | RSS reader (HTTP auth via Authentik) |
|
||||
| resume.ginnoir.com, j-costa.com | Portfolio |
|
||||
| storage.j-costa.com | Resume PDF/object storage (public by design) |
|
||||
| fam.ginnoir.com | Family app (Authentik OIDC) |
|
||||
| auth.ginnoir.com | Authentik |
|
||||
| dev.ginnoir.com | External LAN host (192.168.1.74) — DNS public but host isn't on valhalla |
|
||||
|
||||
### Public but gated (Authentik forward_auth or native OIDC) — OK for now
|
||||
|
||||
| Site | Gate |
|
||||
|------|------|
|
||||
| sonarr–stash, qbittorrent, deluge, … | `internal_only` + Authentik |
|
||||
| uptime.ginnoir.com, backup.ginnoir.com | Authentik |
|
||||
| code.ginnoir.com, registry-ui, dbx, vault, plane.ginnoir.com | Authentik |
|
||||
| portainer.ginnoir.com | Authentik on UI; webhook POST bypass |
|
||||
|
||||
### Flagged — review / fix
|
||||
|
||||
| Site | Issue | Action |
|
||||
|------|-------|--------|
|
||||
| ~~**minio.ginnoir.com**~~ | ~~Public console~~ | **Fixed 2026-06-11** — `internal_only` |
|
||||
| ~~**homarr.ginnoir.com**~~ | ~~Public, no auth~~ | **Fixed 2026-06-11** — `internal_only` |
|
||||
| ~~**docs.ginnoir.com**~~ | ~~Public BookStack~~ | **Fixed 2026-06-11** — `internal_only` |
|
||||
| **gitea.ginnoir.com** | UI reachable; api/git bypass by design | OK if Gitea login is enough; optional Authentik — **TB-006** |
|
||||
|
||||
### Correctly internal-only ✓
|
||||
|
||||
obsidian, roms, romhacks, romhacks-files, registry.ginnoir.com, router.ginnoir.com, jd.ginnoir.com (added TB-002), all *arr admin UIs.
|
||||
|
||||
---
|
||||
|
||||
@@ -53,7 +98,7 @@ Caddyfile review only
|
||||
|
||||
### Done when
|
||||
|
||||
- [ ] Every public site has your yes/no
|
||||
- [ ] Action items linked to other TBs
|
||||
- [x] Every public site has your yes/no
|
||||
- [x] Action items linked to other TBs
|
||||
|
||||
</details>
|
||||
|
||||
Reference in New Issue
Block a user