Compare commits
17 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 forust
|
5dfa9c879b
|
||
|
forust
|
3c5702a0fb | ||
|
forust
|
dd0ca27f4f | ||
|
forust
|
7f7d0de090 | ||
|
forust
|
bee3f16cb2 | ||
|
forust
|
303d23968d
|
||
|
forust
|
b7ecf88052
|
||
|
forust
|
5068591b8b
|
||
|
forust
|
8e57f21e44
|
||
|
forust
|
073d9ff569
|
||
|
forust
|
c6d00e525b | ||
|
forust
|
539994a145
|
||
|
forust
|
95f0afbbee
|
||
|
forust
|
9f86bd1142
|
||
|
forust
|
af9668e8e6 | ||
|
forust
|
53b71a33ad
|
||
|
forust
|
bf72007b14
|
@@ -30,7 +30,7 @@ services:
|
||||
- "traefik.http.routers.adguard-local.middlewares=security-headers@file"
|
||||
- "traefik.http.routers.adguard-local.tls=true"
|
||||
# Dev Router
|
||||
- "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) Host(`dns.gigaforust.internal`)"
|
||||
- "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)"
|
||||
- "traefik.http.routers.adguard-dev.entrypoints=websecure"
|
||||
- "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
|
||||
- "traefik.http.routers.adguard-dev.tls=true"
|
||||
|
||||
@@ -13,6 +13,7 @@ services:
|
||||
environment:
|
||||
- CMK_PASSWORD=${CMK_PASSWORD:-password}
|
||||
- CMK_SITE_ID=cmk
|
||||
- TZ=${TZ:-Etc/UTC}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=proxy"
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
FROM nginx:alpine
|
||||
RUN rm -rf /usr/share/nginx/html/*
|
||||
COPY html /usr/share/nginx/html
|
||||
EXPOSE 80
|
||||
CMD ["nginx", "-g", "daemon off;"]
|
||||
@@ -0,0 +1,20 @@
|
||||
services:
|
||||
errorpage:
|
||||
build: .
|
||||
container_name: error-pages
|
||||
restart: unless-stopped
|
||||
# ports:
|
||||
# - 1234:80
|
||||
networks:
|
||||
- proxy
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=proxy"
|
||||
- "traefik.http.services.errorpage.loadbalancer.server.port=80"
|
||||
# Error handler middleware
|
||||
- "traefik.http.middlewares.error-pages.errors.status=400-599"
|
||||
- "traefik.http.middlewares.error-pages.errors.service=errorpage"
|
||||
- "traefik.http.middlewares.error-pages.errors.query=/{status}.html"
|
||||
networks:
|
||||
proxy:
|
||||
external: true
|
||||
@@ -0,0 +1,40 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>403 // Forbidden</title>
|
||||
<script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
|
||||
<link rel="stylesheet" href="style.css">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div class="container">
|
||||
<header>
|
||||
<h1 class="glitch" data-text="403">403</h1>
|
||||
<p class="subtitle">> Forbidden / Access Denied.</p>
|
||||
</header>
|
||||
|
||||
<hr>
|
||||
|
||||
<section id="message">
|
||||
<h2>./error_message</h2>
|
||||
<p>You do not have permission to access this resource.</p>
|
||||
<br>
|
||||
<p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> if you believe this is an
|
||||
error.</p>
|
||||
</section>
|
||||
|
||||
<footer>
|
||||
<p>root@error:~$ sudo access_resource</p>
|
||||
<p>User is not in the sudoers file. This incident will be reported.</p>
|
||||
<p>© XRock - Just Signal.</p>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,39 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>404 // Not Found</title>
|
||||
<script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
|
||||
<link rel="stylesheet" href="style.css">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div class="container">
|
||||
<header>
|
||||
<h1 class="glitch" data-text="404">404</h1>
|
||||
<p class="subtitle">> Page Not Found / Lost in the Void.</p>
|
||||
</header>
|
||||
|
||||
<hr>
|
||||
|
||||
<section id="message">
|
||||
<h2>./error_message</h2>
|
||||
<p>The page you are looking for does not exist or has been moved.</p>
|
||||
<br>
|
||||
<p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> if you believe this is an error.</p>
|
||||
</section>
|
||||
|
||||
<footer>
|
||||
<p>root@error:~$ ping target</p>
|
||||
<p>Destination Host Unreachable</p>
|
||||
<p>© XRock - Just Signal.</p>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,39 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>500 // Server Error</title>
|
||||
<script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
|
||||
<link rel="stylesheet" href="style.css">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div class="container">
|
||||
<header>
|
||||
<h1 class="glitch" data-text="500">500</h1>
|
||||
<p class="subtitle">> Internal Server Error / System Failure.</p>
|
||||
</header>
|
||||
|
||||
<hr>
|
||||
|
||||
<section id="message">
|
||||
<h2>./error_message</h2>
|
||||
<p>Something went wrong on our end. We are working to fix it.</p>
|
||||
<br>
|
||||
<p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
|
||||
</section>
|
||||
|
||||
<footer>
|
||||
<p>root@error:~$ systemctl status service</p>
|
||||
<p>Active: failed (Result: core-dump)</p>
|
||||
<p>© XRock - Just Signal.</p>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,39 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>502 // Bad Gateway</title>
|
||||
<script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
|
||||
<link rel="stylesheet" href="style.css">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div class="container">
|
||||
<header>
|
||||
<h1 class="glitch" data-text="502">502</h1>
|
||||
<p class="subtitle">> Bad Gateway / System Failure.</p>
|
||||
</header>
|
||||
|
||||
<hr>
|
||||
|
||||
<section id="message">
|
||||
<h2>./error_message</h2>
|
||||
<p>The server received an invalid response from the upstream server.</p>
|
||||
<br>
|
||||
<p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
|
||||
</section>
|
||||
|
||||
<footer>
|
||||
<p>root@error:~$ curl -I upstream_host</p>
|
||||
<p>HTTP/1.1 502 Bad Gateway</p>
|
||||
<p>© XRock - Just Signal.</p>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,39 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>503 // Service Unavailable</title>
|
||||
<script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
|
||||
<link rel="stylesheet" href="style.css">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div class="container">
|
||||
<header>
|
||||
<h1 class="glitch" data-text="503">503</h1>
|
||||
<p class="subtitle">> Service Unavailable / System Failure.</p>
|
||||
</header>
|
||||
|
||||
<hr>
|
||||
|
||||
<section id="message">
|
||||
<h2>./error_message</h2>
|
||||
<p>The server is currently unable to handle the request due to maintenance or overload.</p>
|
||||
<br>
|
||||
<p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
|
||||
</section>
|
||||
|
||||
<footer>
|
||||
<p>root@error:~$ systemctl start service</p>
|
||||
<p>Job for service failed because the control process exited with error code.</p>
|
||||
<p>© XRock - Just Signal.</p>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,39 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>504 // Gateway Timeout</title>
|
||||
<script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
|
||||
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
|
||||
<link rel="stylesheet" href="style.css">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
<div class="container">
|
||||
<header>
|
||||
<h1 class="glitch" data-text="504">504</h1>
|
||||
<p class="subtitle">> Gateway Timeout / System Failure.</p>
|
||||
</header>
|
||||
|
||||
<hr>
|
||||
|
||||
<section id="message">
|
||||
<h2>./error_message</h2>
|
||||
<p>The server did not receive a timely response from the upstream server.</p>
|
||||
<br>
|
||||
<p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
|
||||
</section>
|
||||
|
||||
<footer>
|
||||
<p>root@error:~$ timeout 30s curl upstream</p>
|
||||
<p>curl: (28) Operation timed out after 30001 milliseconds with 0 bytes received</p>
|
||||
<p>© XRock - Just Signal.</p>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -0,0 +1,167 @@
|
||||
/* hidden in a plain sight? */
|
||||
:root {
|
||||
--bg-color: #050505;
|
||||
--text-color: #e0e0e0;
|
||||
--accent: #ffffff;
|
||||
--dim: #666666;
|
||||
--font-mono: 'Courier New', Courier, monospace;
|
||||
}
|
||||
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
}
|
||||
|
||||
body {
|
||||
background-color: var(--bg-color);
|
||||
color: var(--text-color);
|
||||
font-family: var(--font-mono);
|
||||
line-height: 1.6;
|
||||
font-size: 16px;
|
||||
padding: 2rem;
|
||||
}
|
||||
|
||||
a {
|
||||
color: var(--text-color);
|
||||
text-decoration: none;
|
||||
border-bottom: 1px solid var(--dim);
|
||||
transition: all 0.2s;
|
||||
}
|
||||
|
||||
a:hover {
|
||||
background-color: var(--text-color);
|
||||
color: var(--bg-color);
|
||||
border-color: var(--text-color);
|
||||
}
|
||||
|
||||
.container {
|
||||
max-width: 800px;
|
||||
margin: 0 auto;
|
||||
}
|
||||
|
||||
/* TEXT */
|
||||
h1 {
|
||||
font-size: 2.5rem;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: -2px;
|
||||
margin-bottom: 0.5rem;
|
||||
}
|
||||
|
||||
h2 {
|
||||
font-size: 1.2rem;
|
||||
margin-bottom: 1.5rem;
|
||||
border-bottom: 1px solid var(--dim);
|
||||
display: inline-block;
|
||||
padding-right: 20px;
|
||||
}
|
||||
|
||||
.subtitle {
|
||||
color: var(--dim);
|
||||
margin-bottom: 2rem;
|
||||
}
|
||||
|
||||
hr {
|
||||
border: 0;
|
||||
border-top: 1px dashed var(--dim);
|
||||
margin: 2rem 0;
|
||||
}
|
||||
|
||||
.comment {
|
||||
color: var(--dim);
|
||||
font-size: 0.9rem;
|
||||
margin-left: 10px;
|
||||
}
|
||||
|
||||
/* SECTIONS */
|
||||
section {
|
||||
margin-bottom: 3rem;
|
||||
}
|
||||
|
||||
/* LISTS */
|
||||
ul {
|
||||
list-style: none;
|
||||
}
|
||||
|
||||
.link-list li {
|
||||
margin-bottom: 0.8rem;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 15px;
|
||||
}
|
||||
|
||||
/* STACK GRID */
|
||||
.grid-2 {
|
||||
display: grid;
|
||||
grid-template-columns: 1fr 1fr;
|
||||
gap: 2rem;
|
||||
}
|
||||
|
||||
.skill-item {
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
margin-bottom: 0.5rem;
|
||||
}
|
||||
|
||||
.level {
|
||||
font-weight: bold;
|
||||
}
|
||||
|
||||
.special .level {
|
||||
color: var(--text-color);
|
||||
text-shadow: 1px 0 0 red, -1px 0 0 blue;
|
||||
}
|
||||
|
||||
/* my dudes */
|
||||
.team-grid {
|
||||
display: flex;
|
||||
gap: 2rem;
|
||||
flex-wrap: wrap;
|
||||
margin-top: 1rem;
|
||||
}
|
||||
|
||||
.member {
|
||||
text-align: center;
|
||||
width: 100px;
|
||||
}
|
||||
|
||||
.avatar {
|
||||
width: 80px;
|
||||
height: 80px;
|
||||
background-color: #222;
|
||||
border: 2px solid var(--text-color);
|
||||
margin: 0 auto 10px auto;
|
||||
background-size: cover;
|
||||
}
|
||||
|
||||
/* if no avatar added: */
|
||||
.placeholder::before {
|
||||
content: "?";
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
height: 100%;
|
||||
font-size: 2rem;
|
||||
color: var(--dim);
|
||||
}
|
||||
|
||||
/* REPOS */
|
||||
.repo-list li {
|
||||
margin-bottom: 1rem;
|
||||
}
|
||||
|
||||
/* FOOTER */
|
||||
footer {
|
||||
text-align: center;
|
||||
color: var(--dim);
|
||||
font-size: 0.8rem;
|
||||
/* flag{why-are-you-here?} */
|
||||
margin-top: 4rem;
|
||||
}
|
||||
/* SMTH RESPONSIVE */
|
||||
@media (max-width: 600px) {
|
||||
.grid-2 {
|
||||
grid-template-columns: 1fr;
|
||||
gap: 0;
|
||||
}
|
||||
}
|
||||
+22
-24
@@ -1,14 +1,16 @@
|
||||
services:
|
||||
server:
|
||||
headscale:
|
||||
image: headscale/headscale:latest
|
||||
restart: unless-stopped
|
||||
container_name: headscale-server
|
||||
command: serve
|
||||
networks:
|
||||
- proxy
|
||||
volumes:
|
||||
- ./config:/etc/headscale
|
||||
- ./config/headscale.yaml:/etc/headscale/config.yaml
|
||||
- data:/var/lib/headscale
|
||||
labels:
|
||||
- "me.tale.headplane.target: headscale"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=proxy"
|
||||
- "traefik.http.services.headscale.loadbalancer.server.port=8080"
|
||||
@@ -47,33 +49,29 @@ services:
|
||||
- "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
|
||||
- "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
|
||||
- "traefik.http.routers.headscale-metrics-dev.tls=true"
|
||||
web:
|
||||
image: goodieshq/headscale-admin:latest
|
||||
headplane:
|
||||
image: ghcr.io/tale/headplane:latest
|
||||
container_name: headplane
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "treafik.docker.network=proxy"
|
||||
- "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
|
||||
|
||||
# Prod Router
|
||||
- "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
|
||||
- "traefik.http.routers.headscale-ui.entrypoints=websecure"
|
||||
- "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
|
||||
- "traefik.http.routers.headscale-ui.tls=true"
|
||||
# Local Router
|
||||
- "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
|
||||
- "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
|
||||
- "traefik.http.routers.headscale-ui-local.middlewares=security-chain@file"
|
||||
- "traefik.http.routers.headscale-ui-local.tls=true"
|
||||
# Dev Router
|
||||
- "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
|
||||
- "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
|
||||
- "traefik.http.routers.headscale-ui-dev.middlewares=security-chain@file"
|
||||
- "traefik.http.routers.headscale-ui-dev.tls=true"
|
||||
ports:
|
||||
- '3000:3000'
|
||||
volumes:
|
||||
- ./config/headplane.yaml:/etc/headplane/config.yaml
|
||||
- ./config/headscale.yaml:/etc/headscale/config.yaml
|
||||
- headplane-data:/var/lib/headplane
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- proxy
|
||||
healthcheck:
|
||||
test: [ "CMD", "/bin/hp_healthcheck" ]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
start_period: 5s
|
||||
retries: 3
|
||||
volumes:
|
||||
data:
|
||||
headplane-data:
|
||||
name: headplane_data
|
||||
networks:
|
||||
proxy:
|
||||
external: true
|
||||
|
||||
@@ -0,0 +1,221 @@
|
||||
# Configuration for the Headplane server and web application
|
||||
server:
|
||||
# These are the default values, change them as needed
|
||||
host: "0.0.0.0"
|
||||
port: 3000
|
||||
# Should not include the dashboard prefix (/admin) portion.
|
||||
# # Prod server_url
|
||||
# base_url: https://hs.forust.xyz
|
||||
# # Local base_url
|
||||
# base_url: https://hs.workstation.internal
|
||||
# # Dev base_url
|
||||
# base_url: https://hs.gigaforust.internal
|
||||
|
||||
# You may provide `cookie_secret_path` instead to read a value from disk.
|
||||
# See https://headplane.net/configuration/#sensitive-values
|
||||
cookie_secret: "<change_me_to_something_secure!>"
|
||||
|
||||
# Whether cookies should be marked as Secure
|
||||
# * Should be false if running without HTTPs
|
||||
# * Should be true if running behind a reverse proxy with HTTPs
|
||||
cookie_secure: true
|
||||
# The maximum age of the session cookie in seconds
|
||||
cookie_max_age: 86400 # 1 day in seconds
|
||||
|
||||
# This is not required, but if you want to restrict the cookie
|
||||
# to a specific domain, set it here. Otherwise leave it commented out.
|
||||
# This may not work as expected if not using a reverse proxy.
|
||||
# cookie_domain: ""
|
||||
|
||||
# The path to persist Headplane specific data. All data going forward
|
||||
# is stored in this directory, including the internal database and
|
||||
# any cache related files.
|
||||
data_path: "/var/lib/headplane"
|
||||
|
||||
# The info secret is optional and allows access to certain debug endpoints
|
||||
# that may expose sensitive information about your Headplane instance.
|
||||
#
|
||||
# As of now, this protects the /api/info endpoint which exposes details about
|
||||
# the Headplane and Headscale versions in use. In the future, more endpoints
|
||||
# may be protected by this secret.
|
||||
#
|
||||
# If not set, these endpoints will be disabled.
|
||||
# info_secret: "<change_me_to_something_secure!>"
|
||||
|
||||
# Headscale specific settings to allow Headplane to talk
|
||||
# to Headscale and access deep integration features
|
||||
headscale:
|
||||
# The URL to your Headscale instance
|
||||
# (All API requests are routed through this URL)
|
||||
# (THIS IS NOT the gRPC endpoint, but the HTTP endpoint)
|
||||
#
|
||||
# IMPORTANT: If you are using TLS this MUST be set to `https://`
|
||||
url: "http://headscale-server:8080"
|
||||
|
||||
# If you use the TLS configuration in Headscale, and you are not using
|
||||
# Let's Encrypt for your certificate, pass in the path to the certificate.
|
||||
# (This has no effect if `url` does not start with `https://`)
|
||||
# tls_cert_path: "/var/lib/headplane/tls.crt"
|
||||
|
||||
# Optional, public URL if its different from the `headscale.url`
|
||||
# This affects certain parts of the web UI which shows Headscale's URL
|
||||
public_url: "https://headscale.example.com"
|
||||
|
||||
# Path to the Headscale configuration file
|
||||
# This is optional, but HIGHLY recommended for the best experience
|
||||
# If this is read only, Headplane will show your configuration settings
|
||||
# in the Web UI, but they cannot be changed.
|
||||
config_path: "/etc/headscale/config.yaml"
|
||||
|
||||
# Whether the Headscale configuration should be strictly validated
|
||||
# when reading from `config_path`. If true, Headplane will not interact
|
||||
# with Headscale if there are any issues with the configuration file.
|
||||
#
|
||||
# This is recommended to be true for production deployments to, however it
|
||||
# may not work if you are using a version of Headscale that has configuration
|
||||
# options unknown to Headplane.
|
||||
config_strict: true
|
||||
|
||||
# If you are using `dns.extra_records_path` in your Headscale
|
||||
# configuration, you need to set this to the path for Headplane
|
||||
# to be able to read the DNS records.
|
||||
#
|
||||
# Pass it in if using Docker and ensure that the file is both
|
||||
# readable and writable to the Headplane process.
|
||||
# When using this, Headplane will no longer need to automatically
|
||||
# restart Headscale for DNS record changes.
|
||||
# dns_records_path: "/var/lib/headscale/extra_records.json"
|
||||
|
||||
# Integration configurations for Headplane to interact with Headscale
|
||||
integration:
|
||||
# The Headplane agent allows retrieving information about nodes
|
||||
# This allows the UI to display version, OS, and connectivity data
|
||||
# You will see the Headplane agent in your Tailnet as a node when
|
||||
# it connects.
|
||||
agent:
|
||||
enabled: false
|
||||
|
||||
# To connect to your Tailnet, you need to generate a pre-auth key
|
||||
# This can be done via the web UI or through the `headscale` CLI.
|
||||
pre_authkey: "<your-preauth-key>"
|
||||
|
||||
# Optionally change the name of the agent in the Tailnet.
|
||||
# host_name: "headplane-agent"
|
||||
|
||||
# Configure different caching settings. By default, the agent will store
|
||||
# caches in the path below for a maximum of 1 minute. If you want data
|
||||
# to update faster, reduce the TTL, but this will increase the frequency
|
||||
# of requests to Headscale.
|
||||
# cache_ttl: 60
|
||||
# cache_path: /var/lib/headplane/agent_cache.json
|
||||
|
||||
# The work_dir represents where the agent will store its data to be able
|
||||
# to automatically reauthenticate with your Tailnet. It needs to be
|
||||
# writable by the user running the Headplane process.
|
||||
#
|
||||
# If using Docker, it is best to leave this as the default.
|
||||
# work_dir: "/var/lib/headplane/agent"
|
||||
|
||||
# Only one of these should be enabled at a time or you will get errors
|
||||
# This does not include the agent integration (above), which can be enabled
|
||||
# at the same time as any of these and is recommended for the best experience.
|
||||
docker:
|
||||
enabled: true
|
||||
|
||||
# By default we check for the presence of a container label (see the docs)
|
||||
# to determine the container to signal when changes are made to DNS settings.
|
||||
container_label: "me.tale.headplane.target=headscale"
|
||||
|
||||
# HOWEVER, you can fallback to a container name if you desire, but this is
|
||||
# not recommended as its brittle and doesn't work with orchestrators that
|
||||
# automatically assign container names.
|
||||
#
|
||||
# If `container_name` is set, it will override any label checks.
|
||||
# container_name: "headscale-server"
|
||||
|
||||
# The path to the Docker socket (do not change this if you are unsure)
|
||||
# Docker socket paths must start with unix:// or tcp:// and at the moment
|
||||
# https connections are not supported.
|
||||
socket: "unix:///var/run/docker.sock"
|
||||
|
||||
# Please refer to docs/integration/Kubernetes.md for more information
|
||||
# on how to configure the Kubernetes integration. There are requirements in
|
||||
# order to allow Headscale to be controlled by Headplane in a cluster.
|
||||
kubernetes:
|
||||
enabled: false
|
||||
# Validates the manifest for the Pod to ensure all of the criteria
|
||||
# are set correctly. Turn this off if you are having issues with
|
||||
# shareProcessNamespace not being validated correctly.
|
||||
validate_manifest: true
|
||||
# This should be the name of the Pod running Headscale and Headplane.
|
||||
# If this isn't static you should be using the Kubernetes Downward API
|
||||
# to set this value (refer to docs/Integrated-Mode.md for more info).
|
||||
pod_name: "headscale"
|
||||
|
||||
# Proc is the "Native" integration that only works when Headscale and
|
||||
# Headplane are running outside of a container. There is no configuration,
|
||||
# but you need to ensure that the Headplane process can terminate the
|
||||
# Headscale process.
|
||||
#
|
||||
# (If they are both running under systemd as sudo, this will work).
|
||||
proc:
|
||||
enabled: false
|
||||
|
||||
# OIDC Configuration for simpler authentication
|
||||
# (This is optional, but recommended for the best experience)
|
||||
# oidc:
|
||||
# The OIDC issuer URL
|
||||
# issuer: "https://accounts.google.com"
|
||||
|
||||
# If you are using OIDC, you need to generate an API key
|
||||
# that can be used to authenticate other sessions when signing in.
|
||||
#
|
||||
# This can be done with `headscale apikeys create --expiration 999d`
|
||||
# headscale_api_key: "<your-headscale-api-key>"
|
||||
|
||||
# If your OIDC provider does not support discovery (does not have the URL at
|
||||
# `/.well-known/openid-configuration`), you need to manually set endpoints.
|
||||
# This also works to override endpoints if you so desire or if your OIDC
|
||||
# discovery is missing certain endpoints (ie GitHub).
|
||||
# For some typical providers, see https://headplane.net/features/sso.
|
||||
# authorization_endpoint: ""
|
||||
# token_endpoint: ""
|
||||
# userinfo_endpoint: ""
|
||||
|
||||
# The authentication method to use when communicating with the token endpoint.
|
||||
# This is fully optional and Headplane will attempt to auto-detect the best
|
||||
# method and fall back to `client_secret_basic` if unsure.
|
||||
# token_endpoint_auth_method: "client_secret_post"
|
||||
|
||||
# The client ID for the OIDC client
|
||||
# For the best experience please ensure this is *identical* to the client_id
|
||||
# you are using for Headscale. because
|
||||
# client_id: "your-client-id"
|
||||
|
||||
# The client secret for the OIDC client
|
||||
# You may also provide `client_secret_path` instead to read a value from disk.
|
||||
# See https://headplane.net/configuration/#sensitive-values
|
||||
# client_secret: "<your-client-secret>"
|
||||
|
||||
# Whether to use PKCE when authenticating users. This is recommended as it
|
||||
# adds an extra layer of security to the authentication process. Enabling this
|
||||
# means your OIDC provider must support PKCE and it must be enabled on the
|
||||
# client.
|
||||
# use_pkce: true
|
||||
|
||||
# If you want to disable traditional login via Headscale API keys
|
||||
# disable_api_key_login: false
|
||||
|
||||
# By default profile pictures are pulled from the OIDC provider when
|
||||
# we go to fetch the userinfo endpoint. Optionally, this can be set to
|
||||
# "oidc" or "gravatar" as of 0.6.1.
|
||||
# profile_picture_source: "gravatar"
|
||||
|
||||
# The scopes to request when authenticating users. The default is below.
|
||||
# scope: "openid email profile"
|
||||
|
||||
# Extra query parameters can be passed to the authorization endpoint
|
||||
# by setting them here. This is useful for providers that require any kind
|
||||
# of custom hinting.
|
||||
# extra_params:
|
||||
# prompt: "select_account" # Example: force account selection on Google
|
||||
@@ -0,0 +1,54 @@
|
||||
# Resolved: Overlay FS failure (and so containers)
|
||||
|
||||
15-12-2025 03:02 AM EET: Degraded control panels' performances, following by full cascade docker failure
|
||||
|
||||
15-12-2025 04:36 AM EET: Identified: Services are terminated due to server software (Overlay FS) + hardware issues (HDD).
|
||||
|
||||
15-12-2025 08:45 PM EET: Restored NextCloud service with few tweaks to lower I/O
|
||||
|
||||
---
|
||||
|
||||
16-12-2025 08:34 PM EET: Ordered new HDD, ETA 22nd of December - 2nd of January
|
||||
|
||||
---
|
||||
|
||||
17-12-2025 02:47 AM EET: To avoid additional I/O into kuma's database, disabled uptime monitoring for non-critical services, such as:
|
||||
|
||||
- Game servers
|
||||
- Gitea (no public projects being hosted yet)
|
||||
- Landings
|
||||
- Cloud services
|
||||
- PenPot
|
||||
- Auth provider
|
||||
- Secondary management tools
|
||||
- Chernuha's non-important infrastructure
|
||||
|
||||
These can be identified by seeing ">2m ago" under monitor's heartbeats.
|
||||
|
||||
---
|
||||
|
||||
09-01-2026 02:32 PM EET: NextCloud's frontend files are corrupted due to the unknown issue. All user data is integrity-verified. To prevent user data corruption, NextCloud service will be restored after new hardware will be available.
|
||||
|
||||
---
|
||||
|
||||
14-01-2026 08:42 PM EET: After planned updating and restarting server, critical firmware software were corrupted because of physical degradation of the disk. Server inaccessible in any way
|
||||
|
||||
---
|
||||
|
||||
15-01-2026 11:30 AM EET: A new NAS-Grade HDD (Seagate IronWolf Pro) was ordered. ETA 16-01-2026 EET Before 12:00 PM
|
||||
|
||||
---
|
||||
|
||||
16-01-2026 12:47 AM EET: New server system is installed, data backed up. Experiencing docker memory leak.
|
||||
|
||||
---
|
||||
|
||||
17-01-2026 01:27 PM EET: All services except NextCloud and Satisfactory server are online.
|
||||
|
||||
17-01-2026 03:48 PM EET: Nextcloud is online. Satisfactory will be provided on-demand. Monitoring status
|
||||
|
||||
---
|
||||
|
||||
##### Status: All services are online
|
||||
|
||||
**Solution: moving all infrastructure onto new NAS-Grade HDD with fresh OS install**
|
||||
@@ -0,0 +1,3 @@
|
||||
KENER_SECRET_KEY=your_secret_key_here
|
||||
ORIGIN=http://localhost:3000
|
||||
TZ=Etc/UTC
|
||||
@@ -0,0 +1,39 @@
|
||||
services:
|
||||
kener:
|
||||
image: rajnandan1/kener:latest
|
||||
container_name: kener
|
||||
restart: unless-stopped
|
||||
# ports:
|
||||
# - 3000:3000/tcp
|
||||
environment:
|
||||
- KENER_SECRET_KEY=${KENER_SECRET_KEY?Kener requires a secret key}
|
||||
- ORIGIN=${ORIGIN:-http://localhost:3000}
|
||||
- TZ:${TZ:-Etc/UTC}
|
||||
volumes:
|
||||
- db:/app/database
|
||||
- uploads:/app/uploads
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=proxy"
|
||||
- "traefik.http.services.kener.loadbalancer.server.port=3000"
|
||||
|
||||
# Prod Router
|
||||
- "traefik.http.routers.kener.rule=Host(`status.forust.xyz`)"
|
||||
- "traefik.http.routers.kener.entrypoints=websecure"
|
||||
- "traefik.http.routers.kener.tls=true"
|
||||
# Local Router
|
||||
- "traefik.http.routers.kener-local.rule=Host(`status.workstation.internal`)"
|
||||
- "traefik.http.routers.kener-local.entrypoints=websecure"
|
||||
- "traefik.http.routers.kener-local.tls=true"
|
||||
# Dev Router
|
||||
- "traefik.http.routers.kener-dev.rule=Host(`status.gigaforust.internal`)"
|
||||
- "traefik.http.routers.kener-dev.entrypoints=websecure"
|
||||
- "traefik.http.routers.kener-dev.tls=true"
|
||||
networks:
|
||||
- proxy
|
||||
volumes:
|
||||
db:
|
||||
uploads:
|
||||
networks:
|
||||
proxy:
|
||||
external: true
|
||||
+1
-1
@@ -23,7 +23,7 @@ services:
|
||||
- "traefik.http.routers.metube.middlewares=security-chain@file"
|
||||
- "traefik.http.routers.metube.tls=true"
|
||||
# Local Router
|
||||
- "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`))"
|
||||
- "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`)"
|
||||
- "traefik.http.routers.metube-local.entrypoints=websecure"
|
||||
- "traefik.http.routers.metube-local.middlewares=security-headers@file"
|
||||
- "traefik.http.routers.metube-local.tls=true"
|
||||
|
||||
@@ -17,10 +17,11 @@ services:
|
||||
|
||||
# EntryPoints
|
||||
- "--entryPoints.web.address=:80"
|
||||
- "--entryPoints.websecure.address=:443"
|
||||
- "--entryPoints.websecure.http.tls=true"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
|
||||
# - "--entryPoints.web.http.middlewares=error-pages@docker"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.scheme=https"
|
||||
- "--entryPoints.websecure.address=:443"
|
||||
- "--entryPoints.websecure.http.middlewares=error-pages@docker"
|
||||
- "--entryPoints.websecure.http.tls=true"
|
||||
- "--entryPoints.ssh.address=:2221"
|
||||
|
||||
# Let's Encrypt
|
||||
@@ -34,7 +35,6 @@ services:
|
||||
# Cloudflare
|
||||
- "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
|
||||
|
||||
# # Logging
|
||||
# - "--log.level=INFO"
|
||||
# - "--log.filePath=/var/log/traefik/traefik.log"
|
||||
@@ -59,7 +59,7 @@ services:
|
||||
# Dev Router
|
||||
- "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
|
||||
- "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
|
||||
- "traefik.http.routers.traefik-dashboard-dev.middlewares=security-chain@file"
|
||||
- "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file"
|
||||
- "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
|
||||
- "traefik.http.routers.traefik-dashboard-dev.tls=true"
|
||||
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
tls:
|
||||
certificates:
|
||||
# Cloudflare Origin CA *.forust.xyz
|
||||
- certFile: /certs/cloudflare.pem
|
||||
keyFile: /certs/cloudflare.key
|
||||
# - certFile: /certs/cloudflare.pem
|
||||
# keyFile: /certs/cloudflare.key
|
||||
- certFile: /certs/xdfnx.pem
|
||||
keyFile: /certs/xdfnx.key
|
||||
stores:
|
||||
|
||||
Reference in New Issue
Block a user