Compare commits
12 Commits
feature/tr
...
3ce92b7394
| Author | SHA1 | Date | |
|---|---|---|---|
| 3ce92b7394 | |||
| 4ad7bf0a38 | |||
| 6d9139408d | |||
| 6e17920cfd | |||
| 6b1a8b7d45 | |||
| 09b20f71fc | |||
| afbffb97e3 | |||
| 1c5959cafb | |||
| 73e40af91a | |||
| 461a0dc110 | |||
| 91873062c9 | |||
| 8a52e6894f |
27
.env.example
27
.env.example
@@ -36,9 +36,10 @@ TAILSCALE_TAGS=tag:nas
|
|||||||
# Enable Tailscale Funnel (public access) for HTTPS? Set to 'true' or 'false'. 'false' uses Serve (Tailnet only, recommended).
|
# Enable Tailscale Funnel (public access) for HTTPS? Set to 'true' or 'false'. 'false' uses Serve (Tailnet only, recommended).
|
||||||
ENABLE_FUNNEL_HTTPS=false
|
ENABLE_FUNNEL_HTTPS=false
|
||||||
|
|
||||||
# --- Primary Hostname ---
|
# --- Primary Application Hostname ---
|
||||||
# Primary hostname used by Traefik for routing. Derived from Tailscale settings by default.
|
# Primary hostname used by Traefik/Authelia. Derived from Tailscale settings by default.
|
||||||
HOSTNAME=${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}
|
# Renamed from HOSTNAME to avoid collision with host system environment variable.
|
||||||
|
APP_HOSTNAME=${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}
|
||||||
|
|
||||||
# --- Application Credentials ---
|
# --- Application Credentials ---
|
||||||
# qBittorrent Web UI Credentials (change default!)
|
# qBittorrent Web UI Credentials (change default!)
|
||||||
@@ -62,18 +63,16 @@ HOMEPAGE_VAR_WEATHER_UNIT=metric
|
|||||||
|
|
||||||
# --- Authelia Settings ---
|
# --- Authelia Settings ---
|
||||||
# Generate strong random secrets for these using tools like `openssl rand -hex 32`
|
# Generate strong random secrets for these using tools like `openssl rand -hex 32`
|
||||||
AUTHELIA_JWT_SECRET= # Example: your_strong_jwt_secret
|
# These are all REQUIRED for Authelia to function properly
|
||||||
AUTHELIA_SESSION_SECRET= # Example: your_strong_session_secret
|
AUTHELIA_JWT_SECRET= # Secret used for JWT tokens (password reset, etc)
|
||||||
AUTHELIA_STORAGE_ENCRYPTION_KEY= # Example: your_strong_storage_encryption_key
|
AUTHELIA_SESSION_SECRET= # Secret for encrypting session cookies
|
||||||
AUTHELIA_REDIS_PASSWORD= # Example: your_strong_redis_password
|
AUTHELIA_STORAGE_ENCRYPTION_KEY= # Secret for encrypting stored data
|
||||||
|
AUTHELIA_REDIS_PASSWORD= # Password for Redis session storage
|
||||||
|
|
||||||
# Google OIDC Provider Settings (Get from Google Cloud Console - https://console.cloud.google.com/apis/credentials)
|
# Note: The following variables are no longer needed with Authelia 4.38+ and the updated configuration
|
||||||
AUTHELIA_GOOGLE_OIDC_CLIENT_ID= # Example: your-google-client-id.apps.googleusercontent.com
|
# They are preserved for backward compatibility but will be automatically mapped to the new structure
|
||||||
AUTHELIA_GOOGLE_OIDC_CLIENT_SECRET= # Example: GOCSPX-your-google-client-secret
|
# AUTHELIA_SESSION_DOMAIN=${APP_HOSTNAME}
|
||||||
|
# AUTHELIA_DEFAULT_REDIRECT_URL=https://${APP_HOSTNAME}/home
|
||||||
# Authelia Session Configuration
|
|
||||||
AUTHELIA_SESSION_DOMAIN=${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}
|
|
||||||
AUTHELIA_DEFAULT_REDIRECT_URL=https://${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}/home
|
|
||||||
|
|
||||||
# --- API Keys & Integration Tokens (Optional - Mainly for Homepage Widgets) ---
|
# --- API Keys & Integration Tokens (Optional - Mainly for Homepage Widgets) ---
|
||||||
# Find API keys within each application's settings (usually Settings > General or Security)
|
# Find API keys within each application's settings (usually Settings > General or Security)
|
||||||
|
|||||||
2
.gitignore
vendored
2
.gitignore
vendored
@@ -1,6 +1,8 @@
|
|||||||
*.env
|
*.env
|
||||||
.idea
|
.idea
|
||||||
docker-compose.override.yml
|
docker-compose.override.yml
|
||||||
|
/authelia/*.yml
|
||||||
|
!/authelia/configuration.example.yml
|
||||||
/homepage/logs
|
/homepage/logs
|
||||||
/homepage/*.yaml
|
/homepage/*.yaml
|
||||||
/homepage/*.css
|
/homepage/*.css
|
||||||
|
|||||||
536
README.md
536
README.md
@@ -4,228 +4,355 @@ This project provides a comprehensive, self-hosted media and utility server setu
|
|||||||
|
|
||||||
The core idea is to manage media libraries (movies, TV shows, music), automate downloads securely, provide easy access via a dashboard, and enable remote access through Tailscale.
|
The core idea is to manage media libraries (movies, TV shows, music), automate downloads securely, provide easy access via a dashboard, and enable remote access through Tailscale.
|
||||||
|
|
||||||
|
## Table of Contents
|
||||||
|
|
||||||
|
- [Docker Compose NAS](#docker-compose-nas)
|
||||||
|
- [Table of Contents](#table-of-contents)
|
||||||
|
- [Architecture Overview](#architecture-overview)
|
||||||
|
- [Features](#features)
|
||||||
|
- [Prerequisites](#prerequisites)
|
||||||
|
- [Required Setup Steps](#required-setup-steps)
|
||||||
|
- [Quick Start Guide](#quick-start-guide)
|
||||||
|
- [Configuration (`.env` Variables)](#configuration-env-variables)
|
||||||
|
- [Core System \& Paths](#core-system--paths)
|
||||||
|
- [Networking \& Access (Tailscale)](#networking--access-tailscale)
|
||||||
|
- [Authentication (Authelia)](#authentication-authelia)
|
||||||
|
- [Service Credentials](#service-credentials)
|
||||||
|
- [Homepage Customization \& Widgets](#homepage-customization--widgets)
|
||||||
|
- [Optional Features \& Services](#optional-features--services)
|
||||||
|
- [Detailed Setup \& Usage](#detailed-setup--usage)
|
||||||
|
- [Authelia User Management](#authelia-user-management)
|
||||||
|
- [(Optional) VPN Configuration](#optional-vpn-configuration)
|
||||||
|
- [(Optional) Traefik DNS Challenge](#optional-traefik-dns-challenge)
|
||||||
|
- [Service Access](#service-access)
|
||||||
|
- [Optional Services](#optional-services)
|
||||||
|
- [Troubleshooting](#troubleshooting)
|
||||||
|
- [SELinux Socket Permissions (Docker)](#selinux-socket-permissions-docker)
|
||||||
|
- [Authelia v4.38+ Configuration](#authelia-v438-configuration)
|
||||||
|
- [Tailscale Issues](#tailscale-issues)
|
||||||
|
- [File Permissions](#file-permissions)
|
||||||
|
- [Advanced Topics](#advanced-topics)
|
||||||
|
|
||||||
|
## Architecture Overview
|
||||||
|
|
||||||
|
This stack uses a combination of key services for routing, access, and security:
|
||||||
|
|
||||||
|
* **[Tailscale](https://tailscale.com):** Provides a secure overlay network (WireGuard-based VPN) connecting your devices. It allows access to the NAS services from anywhere without opening firewall ports and handles HTTPS termination via its built-in `tailscale serve` or `tailscale funnel` features. All other services run within Tailscale's network namespace.
|
||||||
|
* **[Traefik](https://traefik.io):** Acts as a reverse proxy *within* the Tailscale network. It discovers services via Docker labels and routes incoming requests (from Tailscale) to the appropriate container based on paths (e.g., `/sonarr`, `/radarr`).
|
||||||
|
* **[Authelia](https://www.authelia.com):** Serves as the authentication gateway. Traefik forwards requests to Authelia for verification. If a user isn't logged in, they are redirected to the Authelia portal (`/`). Once authenticated, Authelia sets a session cookie (stored in Redis), and Traefik allows access to the requested service.
|
||||||
|
|
||||||
## Features
|
## Features
|
||||||
|
|
||||||
This stack includes:
|
This stack includes the following services, categorized for clarity:
|
||||||
|
|
||||||
* **Reverse Proxy & Service Discovery:** [Traefik](https://traefik.io) automatically routes traffic to services.
|
**Core Infrastructure:**
|
||||||
* **Media Management:**
|
* **Reverse Proxy:** [Traefik](https://traefik.io) - Manages internal routing and service discovery.
|
||||||
* [Sonarr](https://sonarr.tv): TV show management.
|
* **Secure Remote Access:** [Tailscale](https://tailscale.com) - Provides VPN access and HTTPS.
|
||||||
* [Radarr](https://radarr.video): Movie management.
|
* **Authentication:** [Authelia](https://www.authelia.com) & [Redis](https://redis.io) - Single sign-on portal and session management.
|
||||||
* [Lidarr](https://lidarr.audio) (Optional): Music management.
|
* **Dashboard:** [Homepage](https://gethomepage.dev) - Centralized access point (at `/home`).
|
||||||
* [Bazarr](https://www.bazarr.media/): Subtitle management.
|
|
||||||
* **Indexers & Downloads:**
|
**Media Management (\*Arr Suite):**
|
||||||
* [Prowlarr](https://github.com/Prowlarr/Prowlarr): Indexer management for *arr apps.
|
* [Sonarr](https://sonarr.tv): TV show management.
|
||||||
* [qBittorrent](https://www.qbittorrent.org): Bittorrent client (can be configured to run through a VPN).
|
* [Radarr](https://radarr.video): Movie management.
|
||||||
* [SABnzbd](https://sabnzbd.org/) (Optional): Usenet download client.
|
* [Lidarr](https://lidarr.audio) (Optional): Music management.
|
||||||
* **Media Server:** [Jellyfin](https://jellyfin.org) organizes and streams your media.
|
* [Bazarr](https://www.bazarr.media/): Subtitle management.
|
||||||
* **Request Management:** [Jellyseerr](https://github.com/FallenBagel/jellyseerr) allows users (including Jellyfin users) to request media.
|
* [Prowlarr](https://github.com/Prowlarr/Prowlarr): Indexer management for *arr apps.
|
||||||
* **Dashboard:** [Homepage](https://gethomepage.dev) provides a central dashboard to access all services.
|
|
||||||
* **Remote Access:** [Tailscale](https://tailscale.com) provides secure access to your services from anywhere without opening firewall ports. It handles HTTPS termination.
|
**Download Clients:**
|
||||||
* **Utilities:**
|
* [qBittorrent](https://www.qbittorrent.org): Bittorrent client.
|
||||||
* [Watchtower](https://containrrr.dev/watchtower/): Automatically updates running containers to the latest image.
|
* [SABnzbd](https://sabnzbd.org/) (Optional): Usenet download client.
|
||||||
* [Autoheal](https://github.com/willfarrell/docker-autoheal/): Monitors and restarts unhealthy containers.
|
|
||||||
* [Unpackerr](https://unpackerr.zip): Automatically extracts downloaded archives.
|
**Media Serving & Requests:**
|
||||||
* **Other Optional Services:** AdGuard Home, Calibre-Web, Decluttarr, Tandoor Recipes, Joplin Server, Home Assistant, Immich Photos (enable via profiles).
|
* [Jellyfin](https://jellyfin.org): Media server for streaming.
|
||||||
|
* [Jellyseerr](https://github.com/FallenBagel/jellyseerr): Media request management.
|
||||||
|
|
||||||
|
**Utilities:**
|
||||||
|
* [Watchtower](https://containrrr.dev/watchtower/): Automatic container updates.
|
||||||
|
* [Autoheal](https://github.com/willfarrell/docker-autoheal/): Automatic container restarts on failure.
|
||||||
|
* [Unpackerr](https://unpackerr.zip): Automated archive extraction.
|
||||||
|
|
||||||
|
**Optional Services (Enabled via Profiles):**
|
||||||
|
* [AdGuard Home](https://adguard.com/en/adguard-home/overview.html): Network-wide ad blocking.
|
||||||
|
* [Calibre-Web](https://github.com/janeczku/calibre-web): E-book library management.
|
||||||
|
* [Decluttarr](https://github.com/manimatter/decluttarr): Automated download cleanup.
|
||||||
|
* [Tandoor Recipes](https://docs.tandoor.dev/): Recipe management.
|
||||||
|
* [Joplin Server](https://joplinapp.org/): Note-taking synchronization server.
|
||||||
|
* [Home Assistant](https://www.home-assistant.io/): Home automation platform.
|
||||||
|
* [Immich](https://immich.app/): Self-hosted photo and video backup.
|
||||||
|
* [FlareSolverr](https://github.com/FlareSolverr/FlareSolverr): Bypasses Cloudflare challenges (e.g., for Prowlarr).
|
||||||
|
|
||||||
## Prerequisites
|
## Prerequisites
|
||||||
|
|
||||||
* **Linux Host:** Any recent Linux distribution capable of running Docker. Tested on Ubuntu Server 22.04.
|
* **Linux Host:** A system capable of running Docker (e.g., Ubuntu, Debian, Fedora).
|
||||||
* **Docker Engine:** Install the latest version of Docker Engine. [Official Installation Guide](https://docs.docker.com/engine/install/).
|
* **Docker & Docker Compose:** Latest versions installed. See [Docker Engine Install](https://docs.docker.com/engine/install/) and [Docker Compose Install](https://docs.docker.com/compose/install/).
|
||||||
* **Docker Compose V2:** Ensure you have Docker Compose V2 (usually installed as a Docker plugin, invoked via `docker compose`). [Official Installation Guide](https://docs.docker.com/compose/install/).
|
* **User Permissions:** Ability to run `docker` commands (user in `docker` group or use `sudo`).
|
||||||
* **User Permissions:** You'll need a user account that can run `docker` commands (usually by adding the user to the `docker` group) or run `docker compose` via `sudo`.
|
* **Basic Linux Knowledge:** Familiarity with command line, text editors, and file permissions.
|
||||||
* **SELinux (If Enabled):** If your host uses SELinux (e.g., Fedora, CentOS, RHEL), you might need additional host configuration. See the [Troubleshooting](#selinux-socket-permissions) section.
|
* **Tailscale Account:** Required for remote access. [Sign up here](https://tailscale.com/login).
|
||||||
|
* **(Optional) SELinux:** If enabled, see [Troubleshooting](#selinux-socket-permissions).
|
||||||
|
|
||||||
## Quick Start
|
## Required Setup Steps
|
||||||
|
|
||||||
1. **Clone the Repository:**
|
These steps are **mandatory** for a working installation. Without properly completing these, the stack will not function correctly.
|
||||||
|
|
||||||
|
1. **⚠️ Required: System User Information**
|
||||||
|
- Set `USER_ID` and `GROUP_ID` in `.env` (run `id -u` and `id -g` to get yours)
|
||||||
|
- Incorrect values will cause permission errors with mounted volumes
|
||||||
|
|
||||||
|
2. **⚠️ Required: Directory Paths**
|
||||||
|
- Set `CONFIG_ROOT` (where service configurations will be stored)
|
||||||
|
- Set `DATA_ROOT` (where your media libraries will be stored)
|
||||||
|
- Set `DOWNLOAD_ROOT` (must be on same filesystem as DATA_ROOT for hardlinks)
|
||||||
|
|
||||||
|
3. **⚠️ Required: Tailscale Configuration**
|
||||||
|
- Create a Tailscale account at [tailscale.com](https://tailscale.com)
|
||||||
|
- Generate an Auth Key in the [Tailscale Admin Console](https://login.tailscale.com/admin/settings/keys)
|
||||||
|
- Set `TAILSCALE_AUTHKEY` in `.env`
|
||||||
|
- Set `TAILSCALE_TAILNET_DOMAIN` to your Tailnet domain (e.g., `your-name.ts.net`)
|
||||||
|
|
||||||
|
4. **⚠️ Required: Security Credentials**
|
||||||
|
- Generate four strong random secrets using `openssl rand -hex 32`:
|
||||||
|
```bash
|
||||||
|
echo "AUTHELIA_JWT_SECRET=$(openssl rand -hex 32)"
|
||||||
|
echo "AUTHELIA_SESSION_SECRET=$(openssl rand -hex 32)"
|
||||||
|
echo "AUTHELIA_STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)"
|
||||||
|
echo "AUTHELIA_REDIS_PASSWORD=$(openssl rand -hex 32)"
|
||||||
|
```
|
||||||
|
- Add these to your `.env` file as shown
|
||||||
|
|
||||||
|
5. **⚠️ Required: Create Admin Password**
|
||||||
|
- Generate a password hash for Authelia:
|
||||||
|
```bash
|
||||||
|
docker run --rm authelia/authelia:latest authelia hash-password 'your_secure_password'
|
||||||
|
```
|
||||||
|
- Replace the example hash in `authelia/users_database.yml` with your generated hash
|
||||||
|
|
||||||
|
## Quick Start Guide
|
||||||
|
|
||||||
|
After completing all [Required Setup Steps](#required-setup-steps) above, follow these steps to get up and running:
|
||||||
|
|
||||||
|
1. **Clone Repository:**
|
||||||
```bash
|
```bash
|
||||||
git clone https://github.com/AdrienPoupa/docker-compose-nas.git
|
git clone https://github.com/AdrienPoupa/docker-compose-nas.git
|
||||||
cd docker-compose-nas
|
cd docker-compose-nas
|
||||||
```
|
```
|
||||||
|
|
||||||
2. **Create Configuration File:**
|
2. **Configure Environment:**
|
||||||
Copy the example environment file:
|
|
||||||
```bash
|
```bash
|
||||||
|
# Create an .env file from the example
|
||||||
cp .env.example .env
|
cp .env.example .env
|
||||||
|
|
||||||
|
# Edit the .env file and fill in ALL required values
|
||||||
|
nano .env
|
||||||
```
|
```
|
||||||
|
|
||||||
3. **Edit `.env` File:**
|
3. **Configure Authelia Admin:**
|
||||||
Open the `.env` file with a text editor and configure it according to your system and preferences. **This is the most crucial step.** See the detailed [Configuration (`.env` File)](#configuration-env-file) section below for explanations of each variable. Minimally, you **must** set `USER_ID`, `GROUP_ID`, `TIMEZONE`, `HOSTNAME`, and `TAILSCALE_AUTHKEY`.
|
|
||||||
|
|
||||||
4. **Start the Stack:**
|
|
||||||
Run Docker Compose (use `sudo` if your user isn't in the `docker` group):
|
|
||||||
```bash
|
```bash
|
||||||
|
# Generate a password hash
|
||||||
|
docker run --rm authelia/authelia:latest authelia hash-password 'your_secure_password'
|
||||||
|
|
||||||
|
# Edit the users_database.yml with the generated hash
|
||||||
|
nano authelia/users_database.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **Run the Setup Script:**
|
||||||
|
```bash
|
||||||
|
# Make the script executable
|
||||||
|
chmod +x ./update-setup.sh
|
||||||
|
|
||||||
|
# Run the setup tool
|
||||||
|
./update-setup.sh
|
||||||
|
```
|
||||||
|
This interactive script will guide you through:
|
||||||
|
- Updating your `.env` file while preserving existing values
|
||||||
|
- Configuring Authelia with your Tailscale domain settings
|
||||||
|
- Setting up service configurations and retrieving API keys
|
||||||
|
|
||||||
|
5. **Start the Stack:**
|
||||||
|
```bash
|
||||||
|
# Start containers
|
||||||
docker compose up -d
|
docker compose up -d
|
||||||
```
|
```
|
||||||
This will pull the necessary images and start all the core services in the background.
|
*(Wait for containers to download and start)*
|
||||||
|
|
||||||
5. **Run Initial Configuration Script:**
|
6. **Access Your NAS:**
|
||||||
This script helps configure base URLs and API keys within the running *arr applications based on your `.env` file.
|
- Open `https://<TAILSCALE_HOSTNAME>.<TAILSCALE_TAILNET_DOMAIN>/`
|
||||||
|
- Log in with username `admin` and the password you set
|
||||||
|
- After login, you'll land on the Homepage dashboard at `/home`
|
||||||
|
|
||||||
|
> ⚠️ **IMPORTANT:** If the stack fails to start, check the [Troubleshooting](#troubleshooting) section and verify you've properly completed all [Required Setup Steps](#required-setup-steps).
|
||||||
|
|
||||||
|
## Configuration (`.env` Variables)
|
||||||
|
|
||||||
|
This file controls essential settings. Copy `.env.example` to `.env` and modify the values. **Bold variables** are critical for initial setup.
|
||||||
|
|
||||||
|
#### Core System & Paths
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
| :----------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------- |
|
||||||
|
| **`USER_ID`** | Linux user ID for container permissions. Find with `id -u`. | `1000` |
|
||||||
|
| **`GROUP_ID`** | Linux group ID for container permissions. Find with `id -g`. | `1000` |
|
||||||
|
| **`TIMEZONE`** | Your local timezone (e.g., `America/New_York`, `Asia/Manila`). [List](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). | `America/New_York` |
|
||||||
|
| `CONFIG_ROOT` | Host base directory for service configurations. `.` = project subdirs. | `.` |
|
||||||
|
| `DATA_ROOT` | Host directory for media libraries (movies, TV, music, etc.). | `/mnt/data` |
|
||||||
|
| `DOWNLOAD_ROOT` | Host directory for downloads (in progress/completed). **Must be on same filesystem as `DATA_ROOT` for hardlinks.** | `/mnt/data/torrents` |
|
||||||
|
| `IMMICH_UPLOAD_LOCATION` | Host path for Immich uploads (if `immich` profile enabled). | `/mnt/data/photos` |
|
||||||
|
|
||||||
|
#### Networking & Access (Tailscale)
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
| :-------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------- |
|
||||||
|
| **`TAILSCALE_AUTHKEY`** | **Required.** Auth key from [Tailscale Admin Console](https://login.tailscale.com/admin/settings/keys). Use reusable or ephemeral. | *(None)* |
|
||||||
|
| **`TAILSCALE_TAILNET_DOMAIN`**| **Required.** Your unique Tailnet domain (e.g., `your-name.ts.net`). | `your-tailnet.ts.net` |
|
||||||
|
| `TAILSCALE_HOSTNAME` | Desired hostname for this NAS within Tailscale. | `tailscale-nas` |
|
||||||
|
| `TAILSCALE_TAGS` | Optional tags for the Tailscale node (e.g., `tag:nas`). | `tag:nas` |
|
||||||
|
| `ENABLE_FUNNEL_HTTPS` | Use Tailscale Funnel (`true` = public access via Tailscale domain) or Serve (`false` = Tailnet-only access, recommended). | `false` |
|
||||||
|
| `APP_HOSTNAME` | Primary hostname used by Traefik/Authelia. Defaults to Tailscale FQDN. Renamed from `HOSTNAME` to avoid host system conflicts. Can be overridden if using custom DNS. | `${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}` |
|
||||||
|
|
||||||
|
#### Authentication (Authelia)
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
| :---------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------- |
|
||||||
|
| **`AUTHELIA_JWT_SECRET`** | **Required.** Random secret for Authelia (used for password reset JWT). **Generate your own!** | *(None - Example in file)* |
|
||||||
|
| **`AUTHELIA_SESSION_SECRET`** | **Required.** Random secret for session cookies. **Generate your own!** | *(None - Example in file)* |
|
||||||
|
| **`AUTHELIA_STORAGE_ENCRYPTION_KEY`** | **Required.** Random secret for encrypting data at rest (e.g., SQLite DB). **Generate your own!** | *(None - Example in file)* |
|
||||||
|
| **`AUTHELIA_REDIS_PASSWORD`** | **Required.** Password for the Redis database (used for session storage). **Generate your own!** | *(None - Example in file)* |
|
||||||
|
| `AUTHELIA_SESSION_DOMAIN` | *Deprecated.* Domain for session cookies. Should match `APP_HOSTNAME`. (Handled within `authelia/configuration.yml` in v4.38+) | `${APP_HOSTNAME}` |
|
||||||
|
| `AUTHELIA_DEFAULT_REDIRECT_URL` | *Deprecated.* Where users land after login. (Handled within `authelia/configuration.yml` in v4.38+) | `https://${APP_HOSTNAME}/home` |
|
||||||
|
|
||||||
|
#### Service Credentials
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
| :----------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------- |
|
||||||
|
| `QBITTORRENT_USERNAME` | Username for qBittorrent Web UI. | `admin` |
|
||||||
|
| `QBITTORRENT_PASSWORD` | Password for qBittorrent Web UI. **Change default!** (May need to use temp password from logs on first run, then change in UI & `.env`). | `adminadmin` |
|
||||||
|
| `CALIBRE_USERNAME` | Username for Calibre-Web (if `calibre-web` profile enabled). | `admin` |
|
||||||
|
| `CALIBRE_PASSWORD` | Password for Calibre-Web (if `calibre-web` profile enabled). | `admin123` |
|
||||||
|
| `IMMICH_DB_PASSWORD` | Password for Immich's internal database (if `immich` profile enabled). | `postgres` |
|
||||||
|
| `ADGUARD_USERNAME` | Username for AdGuard Home (if `adguardhome` profile enabled). | *(None)* |
|
||||||
|
| `ADGUARD_PASSWORD` | Password for AdGuard Home (if `adguardhome` profile enabled). | *(None)* |
|
||||||
|
|
||||||
|
#### Homepage Customization & Widgets
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
| :------------------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------- |
|
||||||
|
| `HOMEPAGE_VAR_TITLE` | Title shown on the dashboard. | `Docker-Compose NAS` |
|
||||||
|
| `HOMEPAGE_VAR_SEARCH_PROVIDER` | Default search engine. [Options](https://gethomepage.dev/en/widgets/search/). | `google` |
|
||||||
|
| `HOMEPAGE_VAR_HEADER_STYLE` | Dashboard header style. [Options](https://gethomepage.dev/en/configs/settings/#header-style). | `boxed` |
|
||||||
|
| `HOMEPAGE_VAR_WEATHER_CITY` | City for weather widget. | *(None)* |
|
||||||
|
| `HOMEPAGE_VAR_WEATHER_LAT` | Latitude for weather widget. | *(None)* |
|
||||||
|
| `HOMEPAGE_VAR_WEATHER_LONG` | Longitude for weather widget. | *(None)* |
|
||||||
|
| `HOMEPAGE_VAR_WEATHER_UNIT` | Weather units (`metric` or `imperial`). | `metric` |
|
||||||
|
| `SONARR_API_KEY` | API Keys for various services, primarily used for Homepage widgets. Find keys in each app's settings. | *(None)* |
|
||||||
|
| `RADARR_API_KEY` | " | *(None)* |
|
||||||
|
| `LIDARR_API_KEY` | " (if `lidarr` profile enabled) | *(None)* |
|
||||||
|
| `BAZARR_API_KEY` | " | *(None)* |
|
||||||
|
| `PROWLARR_API_KEY` | " | *(None)* |
|
||||||
|
| `JELLYFIN_API_KEY` | " | *(None)* |
|
||||||
|
| `JELLYSEERR_API_KEY` | " | *(None)* |
|
||||||
|
| `SABNZBD_API_KEY` | " (if `sabnzbd` profile enabled) | *(None)* |
|
||||||
|
| `IMMICH_API_KEY` | " (if `immich` profile enabled) | *(None)* |
|
||||||
|
| `HOMEASSISTANT_ACCESS_TOKEN` | " (if `homeassistant` profile enabled) | *(None)* |
|
||||||
|
|
||||||
|
#### Optional Features & Services
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
| :---------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------- |
|
||||||
|
| `COMPOSE_PROFILES` | Comma-separated list of optional service profiles to enable (e.g., `lidarr,sabnzbd`). See [Optional Services](#optional-services). | *(None)* |
|
||||||
|
| `COMPOSE_PATH_SEPARATOR` | Path separator for `COMPOSE_FILE` (use `;` for Windows). | `:` |
|
||||||
|
| `COMPOSE_FILE` | Colon-separated list of compose files to use. Allows extending base config. | `docker-compose.yml:...` (See `.env.example`) |
|
||||||
|
| `DECLUTTARR_TEST_RUN` | Run Decluttarr in test mode (`True`/`False`)? (if `decluttarr` profile enabled). | `True` |
|
||||||
|
| `DECLUTTARR_...` | Other Decluttarr settings (see `.env.example`). | *(Varies)* |
|
||||||
|
| `PIA_USER` / `PIA_PASS` | Credentials for PIA VPN (if using default VPN setup for qBittorrent). | *(None)* |
|
||||||
|
| `PIA_LOCATION` | PIA server location (if using default VPN). [List](https://serverlist.piaservers.net/vpninfo/servers/v6). | `ca` |
|
||||||
|
| `PIA_LOCAL_NETWORK` | Your local network CIDR (e.g., `192.168.1.0/24`) to allow local access to VPN'd containers. | `192.168.0.0/16` |
|
||||||
|
| `DNS_CHALLENGE` | Enable Traefik DNS challenge for Let's Encrypt (`true`/`false`). **Not needed if using Tailscale for HTTPS.** | `true` |
|
||||||
|
| `DNS_CHALLENGE_PROVIDER` | Your DNS provider (e.g., `cloudflare`). [Providers](https://doc.traefik.io/traefik/https/acme/#providers). | `cloudflare` |
|
||||||
|
| `LETS_ENCRYPT_EMAIL` | Email for Let's Encrypt (if using DNS challenge). | *(None)* |
|
||||||
|
| `LETS_ENCRYPT_CA_SERVER` | Let's Encrypt server URL (if using DNS challenge). | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||||
|
| `CLOUDFLARE_...` / `PROVIDER_...` | DNS provider API credentials (if using DNS challenge). | *(None)* |
|
||||||
|
| `HOMEASSISTANT_HOSTNAME` | Specific hostname for Home Assistant (if `homeassistant` profile enabled). | *(None)* |
|
||||||
|
| `IMMICH_HOSTNAME` | Specific hostname for Immich (if `immich` profile enabled). | *(None)* |
|
||||||
|
| `ADGUARD_HOSTNAME` | Specific hostname for AdGuard Home (if `adguardhome` profile enabled). | *(None)* |
|
||||||
|
|
||||||
|
## Detailed Setup & Usage
|
||||||
|
|
||||||
|
### Authelia User Management
|
||||||
|
|
||||||
|
Authelia uses the `authelia/users_database.yml` file to manage users.
|
||||||
|
|
||||||
|
* **Setting the Initial Admin Password:**
|
||||||
|
1. As mentioned in the Quick Start, you **must** set a strong password for the default `admin` user.
|
||||||
|
2. Generate a hash using Docker (replace `'your_secure_password'`):
|
||||||
```bash
|
```bash
|
||||||
./update-config.sh
|
docker run --rm authelia/authelia:latest authelia hash-password 'your_secure_password'
|
||||||
```
|
```
|
||||||
*(Note: You might need to make it executable first: `chmod +x ./update-config.sh`)*
|
3. Copy the **entire output hash** (starting with `$argon2id...`).
|
||||||
|
4. Open `authelia/users_database.yml` and replace the example `password:` value under `admin:` with your generated hash.
|
||||||
|
5. Ensure the `admin` user belongs to the `admins` and `users` groups as shown in the example.
|
||||||
|
|
||||||
6. **Access Services:** Once Tailscale is connected, you should be able to access your services via `https://<TAILSCALE_HOSTNAME>.<your-tailnet-name>.ts.net/<service_path>` or `https://<TAILSCALE_IP>/<service_path>`. If you set up DNS for your `HOSTNAME`, you can use `https://<HOSTNAME>/<service_path>`. The main dashboard is at `/`.
|
* **Adding More Users:**
|
||||||
|
1. Generate a password hash for the new user as shown above.
|
||||||
|
2. Edit `authelia/users_database.yml`.
|
||||||
|
3. Add a new entry under `users:`, following the format of the `admin` user:
|
||||||
|
```yaml
|
||||||
|
users:
|
||||||
|
admin:
|
||||||
|
# ... (admin details) ...
|
||||||
|
newuser:
|
||||||
|
displayname: "New User Name"
|
||||||
|
password: "paste_generated_hash_here"
|
||||||
|
email: newuser@example.com
|
||||||
|
groups:
|
||||||
|
- users # Add to 'admins' group if needed
|
||||||
|
```
|
||||||
|
4. Save the file. Authelia should pick up the changes automatically (or restart the Authelia container: `docker compose restart authelia`).
|
||||||
|
|
||||||
## Configuration (`.env` File)
|
* **Enabling User Registration (Optional):**
|
||||||
|
1. Edit `authelia/configuration.yml`.
|
||||||
|
2. Find the commented-out `registration:` section near the bottom.
|
||||||
|
3. Uncomment it and set `enable: true`:
|
||||||
|
```yaml
|
||||||
|
# registration:
|
||||||
|
# enable: false # Set to true to enable registration form
|
||||||
|
```
|
||||||
|
becomes:
|
||||||
|
```yaml
|
||||||
|
registration:
|
||||||
|
enable: true
|
||||||
|
```
|
||||||
|
4. Save the file and restart Authelia (`docker compose restart authelia`).
|
||||||
|
5. A "Register" link will now appear on the Authelia login page.
|
||||||
|
|
||||||
This file controls all the essential settings for your Docker Compose stack. Copy `.env.example` to `.env` and edit the values.
|
* **Approving Registered Users:**
|
||||||
|
1. When a user registers (if enabled), their details are added to `authelia/users_database.yml` but marked as `disabled: true`.
|
||||||
|
2. To approve them, edit `authelia/users_database.yml`.
|
||||||
|
3. Find the new user's entry.
|
||||||
|
4. Change `disabled: true` to `disabled: false` (or simply remove the `disabled: true` line).
|
||||||
|
5. Save the file. The user should now be able to log in.
|
||||||
|
|
||||||
---
|
### (Optional) VPN Configuration
|
||||||
|
|
||||||
### **Core Settings (Required)**
|
*(Details about configuring the PIA VPN or other VPN setups could go here if needed.)*
|
||||||
|
|
||||||
These are fundamental for basic operation and permissions.
|
### (Optional) Traefik DNS Challenge
|
||||||
|
|
||||||
* `USER_ID`: The Linux user ID that the containers will run as. Find yours with `id -u`.
|
*(Details about setting up DNS provider credentials for Let's Encrypt could go here if needed.)*
|
||||||
* *Default:* `1000`
|
|
||||||
* `GROUP_ID`: The Linux group ID that the containers will run as. Find yours with `id -g`.
|
|
||||||
* *Default:* `1000`
|
|
||||||
* **Note:** Using the correct IDs is crucial for file permissions, especially for accessing media files on the host.
|
|
||||||
* `TIMEZONE`: Your local timezone (e.g., `America/New_York`, `Europe/London`, `Asia/Manila`). Find yours from [this list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones).
|
|
||||||
* *Default:* `America/New_York`
|
|
||||||
* `HOSTNAME`: **(Deprecated - Now derived)** The primary hostname used by Traefik for routing. This is now automatically constructed from `TAILSCALE_HOSTNAME` and `TAILSCALE_TAILNET_DOMAIN`. You generally don't need to set this directly unless overriding the default behavior.
|
|
||||||
* *Default:* `${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Host Paths (Required)**
|
|
||||||
|
|
||||||
Define where container data and configuration are stored on your host machine.
|
|
||||||
|
|
||||||
* `CONFIG_ROOT`: The base directory on your host where configuration files for each service will be stored. Using `.` stores them in subdirectories within the project folder.
|
|
||||||
* *Default:* `.`
|
|
||||||
* `DATA_ROOT`: The main directory on your host containing your media libraries (movies, TV shows, music, books).
|
|
||||||
* *Default:* `/mnt/data`
|
|
||||||
* `DOWNLOAD_ROOT`: The directory on your host where the download client (qBittorrent/SABnzbd) will store downloads in progress and completed files *before* they are imported by *arr apps.
|
|
||||||
* *Default:* `/mnt/data/torrents`
|
|
||||||
* **Hardlink Note:** For efficient storage (avoiding duplicate files), it's highly recommended that `DOWNLOAD_ROOT` is on the **same filesystem** as `DATA_ROOT` (e.g., `/mnt/data/torrents` is inside `/mnt/data`). This allows instant moves via hardlinks instead of slow copies.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Tailscale Access (Required)**
|
|
||||||
|
|
||||||
Controls secure remote access via Tailscale.
|
|
||||||
|
|
||||||
* `TAILSCALE_AUTHKEY`: **Required.** An authentication key from your Tailscale account. Generate one in the Tailscale Admin Console under Settings > Keys. You can use a reusable key or an ephemeral key (recommended for containers).
|
|
||||||
* *Default:* (None - **Must be set**)
|
|
||||||
* `TAILSCALE_HOSTNAME`: The desired hostname for this NAS within your Tailscale network.
|
|
||||||
* *Default:* `tailscale-nas`
|
|
||||||
* `TAILSCALE_TAILNET_DOMAIN`: **Required.** The domain of your Tailnet, including your Tailnet's unique name
|
|
||||||
* *Default:* `your-tailnet.ts.net` (**Must be set**)
|
|
||||||
* `TAILSCALE_TAGS`: Optional tags to apply to the Tailscale node (e.g., `tag:nas`).
|
|
||||||
* *Default:* `tag:nas`
|
|
||||||
* `ENABLE_FUNNEL_HTTPS`: Controls Tailscale's public accessibility.
|
|
||||||
* `true`: Enables Tailscale Funnel, making services accessible publicly via the Tailscale domain (`<TAILSCALE_HOSTNAME>.<your-tailnet-name>.ts.net`). Use with caution.
|
|
||||||
* `false`: Uses Tailscale Serve, making services accessible *only* to devices logged into your Tailnet. (Recommended)
|
|
||||||
* *Default:* `false`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Homepage Widgets (Optional)**
|
|
||||||
|
|
||||||
API keys needed *only* if you want to display real-time information from these services on the Homepage dashboard. Find the API keys within each application's settings (usually under Settings > General or Settings > Security).
|
|
||||||
|
|
||||||
* `SONARR_API_KEY`
|
|
||||||
* `RADARR_API_KEY`
|
|
||||||
* `LIDARR_API_KEY` (If Lidarr profile is enabled)
|
|
||||||
* `BAZARR_API_KEY`
|
|
||||||
* `PROWLARR_API_KEY`
|
|
||||||
* `JELLYFIN_API_KEY`
|
|
||||||
* `JELLYSEERR_API_KEY`
|
|
||||||
* `SABNZBD_API_KEY` (If SABnzbd profile is enabled)
|
|
||||||
* `ADGUARD_USERNAME` / `ADGUARD_PASSWORD` (If AdGuard Home profile is enabled)
|
|
||||||
* `CALIBRE_USERNAME` / `CALIBRE_PASSWORD` (If Calibre-Web profile is enabled)
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Homepage Customization (Optional)**
|
|
||||||
|
|
||||||
Control the appearance and behavior of the Homepage dashboard.
|
|
||||||
|
|
||||||
* `HOMEPAGE_VAR_TITLE`: Title shown on the dashboard.
|
|
||||||
* *Default:* `Docker-Compose NAS`
|
|
||||||
* `HOMEPAGE_VAR_SEARCH_PROVIDER`: Default search engine. [See options](https://gethomepage.dev/en/widgets/search/).
|
|
||||||
* *Default:* `google`
|
|
||||||
* `HOMEPAGE_VAR_HEADER_STYLE`: Dashboard header style. [See options](https://gethomepage.dev/en/configs/settings/#header-style).
|
|
||||||
* *Default:* `boxed`
|
|
||||||
* `HOMEPAGE_VAR_WEATHER_CITY`, `_LAT`, `_LONG`, `_UNIT`: Configure the weather widget.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Download Client Settings**
|
|
||||||
|
|
||||||
Credentials for included download clients.
|
|
||||||
|
|
||||||
* `QBITTORRENT_USERNAME`: Username for qBittorrent Web UI.
|
|
||||||
* *Default:* `admin`
|
|
||||||
* `QBITTORRENT_PASSWORD`: Password for qBittorrent Web UI.
|
|
||||||
* *Default:* `adminadmin`
|
|
||||||
* **Note:** On first run, qBittorrent might generate a temporary password shown in its logs (`docker compose logs qbittorrent`). Log in with that, change the password in qBittorrent settings, and update this `.env` variable accordingly.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **VPN Configuration (Example: PIA - Optional)**
|
|
||||||
|
|
||||||
These variables are specific to the example `thrnz/docker-wireguard-pia` VPN container used for qBittorrent in the default setup. If you use a different VPN provider or container, you'll need different variables. **If you don't use the VPN, you can ignore these.**
|
|
||||||
|
|
||||||
* `PIA_USER`: Private Internet Access username.
|
|
||||||
* `PIA_PASS`: Private Internet Access password.
|
|
||||||
* `PIA_LOCATION`: PIA server location code (e.g., `ca_montreal`, `us_east`). [See list](https://serverlist.piaservers.net/vpninfo/servers/v6).
|
|
||||||
* *Default:* `ca`
|
|
||||||
* `PIA_LOCAL_NETWORK`: Your local network CIDR (e.g., `192.168.1.0/24`). Allows local access to the qBittorrent UI when the VPN is active.
|
|
||||||
* *Default:* `192.168.0.0/16`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Traefik DNS Challenge (Optional)**
|
|
||||||
|
|
||||||
These settings are for enabling automatic HTTPS certificate generation via Let's Encrypt using the DNS-01 challenge method. **This is generally NOT needed** because Tailscale handles HTTPS termination by default in this setup. Only configure this if you have a specific reason to manage your own certificates via Traefik (e.g., accessing services without Tailscale).
|
|
||||||
|
|
||||||
* `DNS_CHALLENGE`: Set to `true` to enable DNS challenge.
|
|
||||||
* *Default:* `true` (Consider setting to `false` if using Tailscale for HTTPS)
|
|
||||||
* `DNS_CHALLENGE_PROVIDER`: Your DNS provider supported by Traefik/Lego (e.g., `cloudflare`, `godaddy`). [See providers](https://doc.traefik.io/traefik/https/acme/#providers).
|
|
||||||
* *Default:* `cloudflare`
|
|
||||||
* `LETS_ENCRYPT_EMAIL`: Your email address for Let's Encrypt notifications.
|
|
||||||
* `LETS_ENCRYPT_CA_SERVER`: Let's Encrypt server URL (use staging for testing).
|
|
||||||
* *Default:* `https://acme-v02.api.letsencrypt.org/directory` (Production)
|
|
||||||
* Provider-Specific Variables (e.g., `CLOUDFLARE_EMAIL`, `CLOUDFLARE_DNS_API_TOKEN`, `CLOUDFLARE_ZONE_API_TOKEN`): Credentials required by your chosen `DNS_CHALLENGE_PROVIDER`. Refer to Traefik documentation.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### **Compose Profiles & Files (Advanced)**
|
|
||||||
|
|
||||||
* `COMPOSE_PROFILES`: Comma-separated list of optional service profiles to enable (e.g., `lidarr,sabnzbd,adguardhome`). See [Optional Services](#optional-services).
|
|
||||||
* `COMPOSE_FILE`: Colon-separated list of compose files to use. Allows extending the base configuration.
|
|
||||||
* *Default:* `docker-compose.yml`
|
|
||||||
|
|
||||||
## Service Access
|
## Service Access
|
||||||
|
|
||||||
With the default Tailscale setup, services are securely accessible via HTTPS using your Tailscale node's name or IP, followed by the service path. Replace `<TAILSCALE_NODE>` with your Tailscale device name (e.g., `tailscale-nas.your-tailnet.ts.net`) or its Tailscale IP address.
|
With the default Tailscale setup and Authelia enabled, services are securely accessible via HTTPS using your Tailscale node's name or IP. Access requires authentication via Authelia.
|
||||||
|
|
||||||
* **Homepage:** `https://<TAILSCALE_NODE>/home`
|
* **Login Portal:** `https://<TAILSCALE_NODE>/` (Redirects unauthenticated users here)
|
||||||
* **Sonarr:** `https://<TAILSCALE_NODE>/sonarr`
|
* **Homepage Dashboard:** `https://<TAILSCALE_NODE>/home` (Accessible after login)
|
||||||
* **Radarr:** `https://<TAILSCALE_NODE>/radarr`
|
* **Sonarr:** `https://<TAILSCALE_NODE>/sonarr` (Requires login)
|
||||||
* **Lidarr:** `https://<TAILSCALE_NODE>/lidarr` (If profile enabled)
|
* **Radarr:** `https://<TAILSCALE_NODE>/radarr` (Requires login)
|
||||||
* **Bazarr:** `https://<TAILSCALE_NODE>/bazarr`
|
|
||||||
* **Jellyseerr:** `https://<TAILSCALE_NODE>/jellyseerr`
|
|
||||||
* **Prowlarr:** `https://<TAILSCALE_NODE>/prowlarr`
|
|
||||||
* **qBittorrent:** `https://<TAILSCALE_NODE>/qbittorrent`
|
* **qBittorrent:** `https://<TAILSCALE_NODE>/qbittorrent`
|
||||||
* **SABnzbd:** `https://<TAILSCALE_NODE>/sabnzbd` (If profile enabled)
|
|
||||||
* **Jellyfin:** `https://<TAILSCALE_NODE>/jellyfin`
|
* **Jellyfin:** `https://<TAILSCALE_NODE>/jellyfin`
|
||||||
* **Calibre-Web:** `https://<TAILSCALE_NODE>/calibre` (If profile enabled)
|
* ...and so on.
|
||||||
* **AdGuard Home:** `http://<TAILSCALE_NODE_IP>:3000` (If profile enabled, access via IP/port initially)
|
|
||||||
* **Tandoor Recipes:** `https://<TAILSCALE_NODE>/recipes` (If profile enabled)
|
|
||||||
* **Joplin Server:** `https://<TAILSCALE_NODE>/joplin` (If profile enabled)
|
|
||||||
* **Home Assistant:** `http://<TAILSCALE_NODE_IP>:8123` (If profile enabled, access via IP/port initially)
|
|
||||||
* **Immich:** `http://<TAILSCALE_NODE_IP>:2283` (If profile enabled, access via IP/port initially)
|
|
||||||
|
|
||||||
**Note:**
|
Replace `<TAILSCALE_NODE>` with your Tailscale device name (e.g., `tailscale-nas.your-tailnet.ts.net`) or its Tailscale IP address.
|
||||||
* `<TAILSCALE_NODE>` refers to the full Tailscale name (e.g., `tailscale-nas.your-tailnet.ts.net`).
|
|
||||||
* `<TAILSCALE_NODE_IP>` refers to the Tailscale IP address of the NAS.
|
If you configure DNS for your `APP_HOSTNAME` variable to point to the Tailscale IP, you can use `https://<APP_HOSTNAME>/<service_path>`.
|
||||||
* Some services (AdGuard, HA, Immich) might require initial setup via their direct IP and port before Tailscale/Traefik routing is fully effective or configured within the application. Authentication for most services will be handled by Authelia (configured later).
|
|
||||||
|
|
||||||
## Optional Services
|
## Optional Services
|
||||||
|
|
||||||
@@ -270,6 +397,45 @@ If you are running Docker on a host with SELinux enabled (like Fedora, CentOS, R
|
|||||||
```
|
```
|
||||||
This allows the specific actions that were being denied. You might need to repeat this if different denials appear after applying the first policy.
|
This allows the specific actions that were being denied. You might need to repeat this if different denials appear after applying the first policy.
|
||||||
|
|
||||||
|
### Authelia v4.38+ Configuration
|
||||||
|
|
||||||
|
Authelia v4.38+ introduces significant changes to its configuration structure, particularly for session domains and authentication flows. The setup in this repository has been carefully configured to work with these changes:
|
||||||
|
|
||||||
|
1. **Domain Configuration**:
|
||||||
|
- You must use your specific Tailnet domain (e.g., `example.ts.net`) for cookies, not just `ts.net`
|
||||||
|
- The domain `ts.net` is part of the [Public Suffix List](https://publicsuffix.org/), which means browsers restrict cookies on it for security reasons
|
||||||
|
- Authelia will refuse to start if you try to use a domain from this list
|
||||||
|
|
||||||
|
2. **Required Secret Variables**: You must set these four variables in your `.env` file:
|
||||||
|
- `AUTHELIA_JWT_SECRET`: Used for password reset tokens
|
||||||
|
- `AUTHELIA_SESSION_SECRET`: Used for session cookie encryption
|
||||||
|
- `AUTHELIA_STORAGE_ENCRYPTION_KEY`: Used for database encryption
|
||||||
|
- `AUTHELIA_REDIS_PASSWORD`: Used for Redis authentication
|
||||||
|
|
||||||
|
Generate strong random values for these with: `openssl rand -hex 32`
|
||||||
|
|
||||||
|
3. **Automatic Domain Setup**: The `update-setup.sh` script automatically:
|
||||||
|
- Uses your specific Tailnet domain (e.g., `example.ts.net`) from your `.env` file
|
||||||
|
- Configures cookie domains properly to avoid Public Suffix List issues
|
||||||
|
- Sets up proper access control rules for both your domain and its subdomains
|
||||||
|
|
||||||
|
4. **File Permissions**: The Authelia container runs with your user ID and group ID, preventing permission issues when managing the configuration files with git or other tools.
|
||||||
|
|
||||||
|
If you encounter any of these common errors, running the setup script should resolve them:
|
||||||
|
```
|
||||||
|
error: option 'domain' is not a valid cookie domain: the domain is part of the special public suffix list
|
||||||
|
error: option 'authelia_url' does not share a cookie scope with domain
|
||||||
|
error: can't be specified at the same time: option 'domain' and option 'cookies'
|
||||||
|
configuration key 'jwt_secret' is deprecated in 4.38.0
|
||||||
|
```
|
||||||
|
|
||||||
|
After making changes to the configuration, restart Authelia with:
|
||||||
|
```bash
|
||||||
|
docker compose restart authelia
|
||||||
|
```
|
||||||
|
|
||||||
|
See the [Authelia documentation](https://www.authelia.com/configuration/session/introduction/) for more details on the v4.38+ configuration structure.
|
||||||
|
|
||||||
### Tailscale Issues
|
### Tailscale Issues
|
||||||
|
|
||||||
* **Authentication:** Ensure your `TAILSCALE_AUTHKEY` in `.env` is valid and hasn't expired (especially if using ephemeral keys). Check the `tailscale` container logs (`docker compose logs tailscale`) for authentication errors.
|
* **Authentication:** Ensure your `TAILSCALE_AUTHKEY` in `.env` is valid and hasn't expired (especially if using ephemeral keys). Check the `tailscale` container logs (`docker compose logs tailscale`) for authentication errors.
|
||||||
|
|||||||
78
authelia/configuration.example.yml
Normal file
78
authelia/configuration.example.yml
Normal file
@@ -0,0 +1,78 @@
|
|||||||
|
# Authelia Configuration File v4.38+
|
||||||
|
# Documentation: https://www.authelia.com/configuration/
|
||||||
|
|
||||||
|
# Server settings
|
||||||
|
server:
|
||||||
|
address: 'tcp://0.0.0.0:9091'
|
||||||
|
|
||||||
|
# Logging configuration
|
||||||
|
log:
|
||||||
|
level: info
|
||||||
|
format: text
|
||||||
|
|
||||||
|
# Session configuration for v4.38+
|
||||||
|
session:
|
||||||
|
name: authelia_session
|
||||||
|
secret: ${AUTHELIA_SESSION_SECRET}
|
||||||
|
expiration: 1h
|
||||||
|
inactivity: 5m
|
||||||
|
redis:
|
||||||
|
host: redis
|
||||||
|
port: 6379
|
||||||
|
password: ${AUTHELIA_SESSION_REDIS_PASSWORD}
|
||||||
|
database_index: 0
|
||||||
|
cookies:
|
||||||
|
# Using your specific Tailscale domain (e.g. example.ts.net) not just ts.net
|
||||||
|
- domain: 'your-tailnet.ts.net'
|
||||||
|
authelia_url: 'https://tailscale-nas.your-tailnet.ts.net'
|
||||||
|
default_redirection_url: 'https://tailscale-nas.your-tailnet.ts.net/home'
|
||||||
|
same_site: lax
|
||||||
|
|
||||||
|
# Regulation (brute force protection)
|
||||||
|
regulation:
|
||||||
|
max_retries: 3
|
||||||
|
find_time: 2m
|
||||||
|
ban_time: 5m
|
||||||
|
|
||||||
|
# Storage (for user preferences, etc. - encrypted using storage key)
|
||||||
|
storage:
|
||||||
|
encryption_key: ${AUTHELIA_STORAGE_ENCRYPTION_KEY}
|
||||||
|
local:
|
||||||
|
path: /config/db.sqlite3
|
||||||
|
|
||||||
|
# Authentication backend (using file-based user database)
|
||||||
|
authentication_backend:
|
||||||
|
file:
|
||||||
|
path: /config/users_database.yml
|
||||||
|
password:
|
||||||
|
algorithm: argon2id
|
||||||
|
iterations: 1
|
||||||
|
memory: 1024
|
||||||
|
parallelism: 8
|
||||||
|
salt_length: 16
|
||||||
|
key_length: 32
|
||||||
|
|
||||||
|
# Access control rules
|
||||||
|
access_control:
|
||||||
|
default_policy: deny
|
||||||
|
rules:
|
||||||
|
# This will match any subdomain of your specific Tailscale domain
|
||||||
|
- domain: '*.your-tailnet.ts.net'
|
||||||
|
policy: one_factor
|
||||||
|
# Also match the main domain without subdomain
|
||||||
|
- domain: 'your-tailnet.ts.net'
|
||||||
|
policy: one_factor
|
||||||
|
|
||||||
|
# Notifier configuration
|
||||||
|
notifier:
|
||||||
|
filesystem:
|
||||||
|
filename: /config/notification.txt
|
||||||
|
|
||||||
|
# Identity Validation (includes JWT secret for password reset)
|
||||||
|
identity_validation:
|
||||||
|
reset_password:
|
||||||
|
jwt_secret: ${AUTHELIA_JWT_SECRET}
|
||||||
|
|
||||||
|
# Identity Providers
|
||||||
|
identity_providers:
|
||||||
|
oidc: null
|
||||||
39
authelia/users_database.yml
Normal file
39
authelia/users_database.yml
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
# Authelia User Database
|
||||||
|
# Documentation: https://www.authelia.com/configuration/security/authentication/file/
|
||||||
|
|
||||||
|
# To add users:
|
||||||
|
# 1. Generate a password hash:
|
||||||
|
# docker run authelia/authelia:latest authelia hash-password 'your_strong_password'
|
||||||
|
# 2. Add the user entry below.
|
||||||
|
#
|
||||||
|
# To approve registered users (if registration is enabled in configuration.yml):
|
||||||
|
# 1. New users will appear here, possibly commented out or with 'disabled: true'.
|
||||||
|
# 2. Uncomment the user or set 'disabled: false' to grant access.
|
||||||
|
|
||||||
|
users:
|
||||||
|
# First user is typically considered the admin in access rules
|
||||||
|
admin:
|
||||||
|
displayname: "Admin User"
|
||||||
|
# Replace this hash with one generated for your desired password!
|
||||||
|
password: "$argon2id$v=19$m=102400,t=1,p=8$PBf/L9l3s7LwN6jX/B3tVg$9+q3kL8VAbpWj9Gv9Z6uA5bA4zT1fB2fH3aD5c6b7e8" # Example hash for 'password'
|
||||||
|
email: admin@example.com
|
||||||
|
groups:
|
||||||
|
- admins
|
||||||
|
- users
|
||||||
|
|
||||||
|
# Example of a regular user
|
||||||
|
# user1:
|
||||||
|
# displayname: "Regular User"
|
||||||
|
# password: "..." # Generate hash
|
||||||
|
# email: user1@example.com
|
||||||
|
# groups:
|
||||||
|
# - users
|
||||||
|
|
||||||
|
# Example of a registered user waiting for approval (if registration enabled)
|
||||||
|
# newuser:
|
||||||
|
# disabled: true
|
||||||
|
# displayname: "New User"
|
||||||
|
# password: "..." # Hash generated during registration
|
||||||
|
# email: newuser@example.com
|
||||||
|
# groups:
|
||||||
|
# - users
|
||||||
@@ -25,6 +25,54 @@ services:
|
|||||||
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
||||||
interval: 30s
|
interval: 30s
|
||||||
retries: 10
|
retries: 10
|
||||||
|
redis:
|
||||||
|
image: redis:alpine
|
||||||
|
container_name: redis
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
- REDIS_PASSWORD=${AUTHELIA_REDIS_PASSWORD}
|
||||||
|
command: ["redis-server", "--requirepass", "$$REDIS_PASSWORD"] # Use $$ to escape $ for compose
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_ROOT:-.}/redis:/data:Z
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "redis-cli", "-a", "$$REDIS_PASSWORD", "ping"] # Use $$ to escape $ for compose
|
||||||
|
interval: 5s
|
||||||
|
timeout: 3s
|
||||||
|
retries: 5
|
||||||
|
authelia:
|
||||||
|
image: authelia/authelia:latest
|
||||||
|
container_name: authelia
|
||||||
|
restart: always
|
||||||
|
user: ${USER_ID}:${GROUP_ID}
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_ROOT:-.}/authelia:/config:Z
|
||||||
|
environment:
|
||||||
|
# Core secrets
|
||||||
|
- AUTHELIA_JWT_SECRET=${AUTHELIA_JWT_SECRET}
|
||||||
|
- AUTHELIA_SESSION_SECRET=${AUTHELIA_SESSION_SECRET}
|
||||||
|
- AUTHELIA_STORAGE_ENCRYPTION_KEY=${AUTHELIA_STORAGE_ENCRYPTION_KEY}
|
||||||
|
- AUTHELIA_SESSION_REDIS_PASSWORD=${AUTHELIA_REDIS_PASSWORD}
|
||||||
|
# Only environment variable needed for identity validation
|
||||||
|
- AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=${AUTHELIA_JWT_SECRET}
|
||||||
|
# Timezone
|
||||||
|
- TZ=${TIMEZONE}
|
||||||
|
labels:
|
||||||
|
- traefik.enable=true
|
||||||
|
# Rule for Authelia portal itself (handles internal paths like /api, /logout etc.)
|
||||||
|
- traefik.http.routers.authelia.rule=PathPrefix(`/`)
|
||||||
|
- traefik.http.routers.authelia.entrypoints=web
|
||||||
|
- traefik.http.routers.authelia.priority=100 # High priority to catch root path
|
||||||
|
- traefik.http.services.authelia.loadbalancer.server.port=9091
|
||||||
|
# Define the forwardAuth middleware
|
||||||
|
- traefik.http.middlewares.authelia-auth.forwardAuth.address=http://authelia:9091/api/verify?rd=https://${APP_HOSTNAME}/
|
||||||
|
- traefik.http.middlewares.authelia-auth.forwardAuth.trustForwardHeader=true
|
||||||
|
- traefik.http.middlewares.authelia-auth.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
|
||||||
|
# Homepage labels for Authelia itself
|
||||||
|
- homepage.group=Security
|
||||||
|
- homepage.name=Authelia
|
||||||
|
- homepage.icon=authelia.png
|
||||||
|
- homepage.href=https://${APP_HOSTNAME}/
|
||||||
|
- homepage.description=Authentication Portal
|
||||||
sonarr:
|
sonarr:
|
||||||
image: lscr.io/linuxserver/sonarr
|
image: lscr.io/linuxserver/sonarr
|
||||||
container_name: sonarr
|
container_name: sonarr
|
||||||
@@ -44,6 +92,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.sonarr.rule=PathPrefix(`/sonarr`)
|
- traefik.http.routers.sonarr.rule=PathPrefix(`/sonarr`)
|
||||||
- traefik.http.routers.sonarr.entrypoints=web
|
- traefik.http.routers.sonarr.entrypoints=web
|
||||||
|
- traefik.http.routers.sonarr.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.sonarr.loadbalancer.server.port=8989
|
- traefik.http.services.sonarr.loadbalancer.server.port=8989
|
||||||
- homepage.group=Media
|
- homepage.group=Media
|
||||||
- homepage.name=Sonarr
|
- homepage.name=Sonarr
|
||||||
@@ -73,6 +122,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.radarr.rule=PathPrefix(`/radarr`)
|
- traefik.http.routers.radarr.rule=PathPrefix(`/radarr`)
|
||||||
- traefik.http.routers.radarr.entrypoints=web
|
- traefik.http.routers.radarr.entrypoints=web
|
||||||
|
- traefik.http.routers.radarr.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.radarr.loadbalancer.server.port=7878
|
- traefik.http.services.radarr.loadbalancer.server.port=7878
|
||||||
- homepage.group=Media
|
- homepage.group=Media
|
||||||
- homepage.name=Radarr
|
- homepage.name=Radarr
|
||||||
@@ -102,6 +152,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.lidarr.rule=PathPrefix(`/lidarr`)
|
- traefik.http.routers.lidarr.rule=PathPrefix(`/lidarr`)
|
||||||
- traefik.http.routers.lidarr.entrypoints=web
|
- traefik.http.routers.lidarr.entrypoints=web
|
||||||
|
- traefik.http.routers.lidarr.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.lidarr.loadbalancer.server.port=8686
|
- traefik.http.services.lidarr.loadbalancer.server.port=8686
|
||||||
- homepage.group=Media
|
- homepage.group=Media
|
||||||
- homepage.name=Lidarr
|
- homepage.name=Lidarr
|
||||||
@@ -131,8 +182,9 @@ services:
|
|||||||
retries: 10
|
retries: 10
|
||||||
labels:
|
labels:
|
||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.bazarr.rule=Host(`${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}`) && PathPrefix(`/bazarr`)
|
- traefik.http.routers.bazarr.rule=PathPrefix(`/bazarr`)
|
||||||
- traefik.http.routers.bazarr.entrypoints=web
|
- traefik.http.routers.bazarr.entrypoints=web
|
||||||
|
- traefik.http.routers.bazarr.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.bazarr.loadbalancer.server.port=6767
|
- traefik.http.services.bazarr.loadbalancer.server.port=6767
|
||||||
- homepage.group=Download
|
- homepage.group=Download
|
||||||
- homepage.name=Bazarr
|
- homepage.name=Bazarr
|
||||||
@@ -168,7 +220,7 @@ services:
|
|||||||
- traefik.http.routers.jellyseerr.rule=PathPrefix(`/jellyseerr`)
|
- traefik.http.routers.jellyseerr.rule=PathPrefix(`/jellyseerr`)
|
||||||
- traefik.http.routers.jellyseerr.entrypoints=web
|
- traefik.http.routers.jellyseerr.entrypoints=web
|
||||||
- traefik.http.services.jellyseerr.loadbalancer.server.port=5055
|
- traefik.http.services.jellyseerr.loadbalancer.server.port=5055
|
||||||
- traefik.http.routers.jellyseerr.middlewares=jellyseerr-stripprefix,jellyseerr-rewrite,jellyseerr-rewriteHeaders
|
- traefik.http.routers.jellyseerr.middlewares=jellyseerr-stripprefix,jellyseerr-rewrite,jellyseerr-rewriteHeaders,authelia-auth@docker
|
||||||
- traefik.http.middlewares.jellyseerr-stripprefix.stripPrefix.prefixes=/jellyseerr
|
- traefik.http.middlewares.jellyseerr-stripprefix.stripPrefix.prefixes=/jellyseerr
|
||||||
- traefik.http.middlewares.jellyseerr-rewriteHeaders.plugin.rewriteHeaders.rewrites[0].header=location
|
- traefik.http.middlewares.jellyseerr-rewriteHeaders.plugin.rewriteHeaders.rewrites[0].header=location
|
||||||
- traefik.http.middlewares.jellyseerr-rewriteHeaders.plugin.rewriteHeaders.rewrites[0].regex=^/(.+)$
|
- traefik.http.middlewares.jellyseerr-rewriteHeaders.plugin.rewriteHeaders.rewrites[0].regex=^/(.+)$
|
||||||
@@ -241,6 +293,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.prowlarr.rule=PathPrefix(`/prowlarr`)
|
- traefik.http.routers.prowlarr.rule=PathPrefix(`/prowlarr`)
|
||||||
- traefik.http.routers.prowlarr.entrypoints=web
|
- traefik.http.routers.prowlarr.entrypoints=web
|
||||||
|
- traefik.http.routers.prowlarr.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.prowlarr.loadbalancer.server.port=9696
|
- traefik.http.services.prowlarr.loadbalancer.server.port=9696
|
||||||
- homepage.group=Download
|
- homepage.group=Download
|
||||||
- homepage.name=Prowlarr
|
- homepage.name=Prowlarr
|
||||||
@@ -264,6 +317,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.flaresolverr.rule=PathPrefix(`/flaresolverr`)
|
- traefik.http.routers.flaresolverr.rule=PathPrefix(`/flaresolverr`)
|
||||||
- traefik.http.routers.flaresolverr.entrypoints=web
|
- traefik.http.routers.flaresolverr.entrypoints=web
|
||||||
|
- traefik.http.routers.flaresolverr.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.flaresolverr.loadbalancer.server.port=8191
|
- traefik.http.services.flaresolverr.loadbalancer.server.port=8191
|
||||||
profiles:
|
profiles:
|
||||||
- flaresolverr
|
- flaresolverr
|
||||||
@@ -289,10 +343,10 @@ services:
|
|||||||
retries: 10
|
retries: 10
|
||||||
labels:
|
labels:
|
||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.qbittorrent.rule=Host(`${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}`) && PathPrefix(`/qbittorrent`)
|
- traefik.http.routers.qbittorrent.rule=PathPrefix(`/qbittorrent`)
|
||||||
- traefik.http.routers.qbittorrent.entrypoints=web
|
- traefik.http.routers.qbittorrent.entrypoints=web
|
||||||
- traefik.http.services.qbittorrent.loadbalancer.server.port=8080
|
- traefik.http.services.qbittorrent.loadbalancer.server.port=8080
|
||||||
- traefik.http.routers.qbittorrent.middlewares=qbittorrent-strip-slash,qbittorrent-stripprefix
|
- traefik.http.routers.qbittorrent.middlewares=qbittorrent-strip-slash,qbittorrent-stripprefix,authelia-auth@docker
|
||||||
# https://github.com/qbittorrent/qBittorrent/issues/5693#issuecomment-552146296
|
# https://github.com/qbittorrent/qBittorrent/issues/5693#issuecomment-552146296
|
||||||
- traefik.http.middlewares.qbittorrent-stripprefix.stripPrefix.prefixes=/qbittorrent
|
- traefik.http.middlewares.qbittorrent-stripprefix.stripPrefix.prefixes=/qbittorrent
|
||||||
# https://community.traefik.io/t/middleware-to-add-the-if-needed/1895/19
|
# https://community.traefik.io/t/middleware-to-add-the-if-needed/1895/19
|
||||||
@@ -340,6 +394,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.sabnzbd.rule=PathPrefix(`/sabnzbd`) # Simplified rule
|
- traefik.http.routers.sabnzbd.rule=PathPrefix(`/sabnzbd`) # Simplified rule
|
||||||
- traefik.http.routers.sabnzbd.entrypoints=web
|
- traefik.http.routers.sabnzbd.entrypoints=web
|
||||||
|
- traefik.http.routers.sabnzbd.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.sabnzbd.loadbalancer.server.port=8080
|
- traefik.http.services.sabnzbd.loadbalancer.server.port=8080
|
||||||
- homepage.group=Download
|
- homepage.group=Download
|
||||||
- homepage.name=Sabnzbd
|
- homepage.name=Sabnzbd
|
||||||
@@ -375,6 +430,7 @@ services:
|
|||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
- traefik.http.routers.jellyfin.rule=PathPrefix(`/jellyfin`)
|
- traefik.http.routers.jellyfin.rule=PathPrefix(`/jellyfin`)
|
||||||
- traefik.http.routers.jellyfin.entrypoints=web
|
- traefik.http.routers.jellyfin.entrypoints=web
|
||||||
|
- traefik.http.routers.jellyfin.middlewares=authelia-auth@docker
|
||||||
- traefik.http.services.jellyfin.loadbalancer.server.port=8096
|
- traefik.http.services.jellyfin.loadbalancer.server.port=8096
|
||||||
- homepage.group=Media
|
- homepage.group=Media
|
||||||
- homepage.name=Jellyfin
|
- homepage.name=Jellyfin
|
||||||
@@ -403,8 +459,8 @@ services:
|
|||||||
- traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Scheme=https
|
- traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Scheme=https
|
||||||
- traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Script-Name=/calibre
|
- traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Script-Name=/calibre
|
||||||
- traefik.http.middlewares.calibre-stripprefixregex.stripPrefixRegex.regex=/calibre
|
- traefik.http.middlewares.calibre-stripprefixregex.stripPrefixRegex.regex=/calibre
|
||||||
- traefik.http.routers.calibre.middlewares=calibre-headers,calibre-stripprefixregex
|
- traefik.http.routers.calibre.middlewares=calibre-headers,calibre-stripprefixregex,authelia-auth@docker
|
||||||
- traefik.http.routers.calibre.rule=Host(`${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}`) && PathPrefix(`/calibre`)
|
- traefik.http.routers.calibre.rule=PathPrefix(`/calibre`)
|
||||||
- traefik.http.routers.calibre.entrypoints=web
|
- traefik.http.routers.calibre.entrypoints=web
|
||||||
- traefik.http.services.calibre.loadbalancer.server.port=8083
|
- traefik.http.services.calibre.loadbalancer.server.port=8083
|
||||||
- homepage.group=Media
|
- homepage.group=Media
|
||||||
@@ -478,11 +534,18 @@ services:
|
|||||||
[sh, -c, "cp -n /app/config/tpl/*.yaml /app/config && node server.js"]
|
[sh, -c, "cp -n /app/config/tpl/*.yaml /app/config && node server.js"]
|
||||||
labels:
|
labels:
|
||||||
- traefik.enable=true
|
- traefik.enable=true
|
||||||
# Change path to /home and use specific Tailscale host
|
# Rule for homepage, now at /home, needs auth
|
||||||
- traefik.http.routers.homepage.rule=Host(`${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}`) && PathPrefix(`/home`)
|
- traefik.http.routers.homepage.rule=PathPrefix(`/home`)
|
||||||
- traefik.http.routers.homepage.entrypoints=web
|
- traefik.http.routers.homepage.entrypoints=web
|
||||||
# Authelia middleware will be added in a later commit
|
- traefik.http.routers.homepage.priority=10 # Lower priority than Authelia's root rule
|
||||||
- traefik.http.services.homepage.loadbalancer.server.port=3000
|
- traefik.http.middlewares.homepage-stripprefix.stripPrefix.prefixes=/home
|
||||||
|
- traefik.http.routers.homepage.middlewares=homepage-stripprefix,authelia-auth@docker
|
||||||
|
# Homepage's own labels for discovery (unchanged)
|
||||||
|
- homepage.group=Dashboard
|
||||||
|
- homepage.name=Homepage
|
||||||
|
- homepage.icon=homepage.png
|
||||||
|
- homepage.href=/home # Update link to new path
|
||||||
|
- homepage.description=Service Dashboard
|
||||||
watchtower:
|
watchtower:
|
||||||
image: ghcr.io/containrrr/watchtower:latest
|
image: ghcr.io/containrrr/watchtower:latest
|
||||||
container_name: watchtower
|
container_name: watchtower
|
||||||
|
|||||||
@@ -1,49 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# See https://stackoverflow.com/a/44864004 for the sed GNU/BSD compatible hack
|
|
||||||
|
|
||||||
function update_arr_config {
|
|
||||||
echo "Updating ${container} configuration..."
|
|
||||||
until [ -f "${CONFIG_ROOT:-.}"/"$container"/config.xml ]; do sleep 1; done
|
|
||||||
sed -i.bak "s/<UrlBase><\/UrlBase>/<UrlBase>\/$1<\/UrlBase>/" "${CONFIG_ROOT:-.}"/"$container"/config.xml && rm "${CONFIG_ROOT:-.}"/"$container"/config.xml.bak
|
|
||||||
CONTAINER_NAME_UPPER=$(echo "$container" | tr '[:lower:]' '[:upper:]')
|
|
||||||
sed -i.bak 's/^'"${CONTAINER_NAME_UPPER}"'_API_KEY=.*/'"${CONTAINER_NAME_UPPER}"'_API_KEY='"$(sed -n 's/.*<ApiKey>\(.*\)<\/ApiKey>.*/\1/p' "${CONFIG_ROOT:-.}"/"$container"/config.xml)"'/' .env && rm .env.bak
|
|
||||||
echo "Update of ${container} configuration complete, restarting..."
|
|
||||||
docker compose restart "$container"
|
|
||||||
}
|
|
||||||
|
|
||||||
function update_qbittorrent_config {
|
|
||||||
echo "Updating ${container} configuration..."
|
|
||||||
docker compose stop "$container"
|
|
||||||
until [ -f "${CONFIG_ROOT:-.}"/"$container"/qBittorrent/qBittorrent.conf ]; do sleep 1; done
|
|
||||||
sed -i.bak '/WebUI\\ServerDomains=*/a WebUI\\Password_PBKDF2="@ByteArray(ARQ77eY1NUZaQsuDHbIMCA==:0WMRkYTUWVT9wVvdDtHAjU9b3b7uB8NR1Gur2hmQCvCDpm39Q+PsJRJPaCU51dEiz+dTzh8qbPsL8WkFljQYFQ==)"' "${CONFIG_ROOT:-.}"/"$container"/qBittorrent/qBittorrent.conf && rm "${CONFIG_ROOT:-.}"/"$container"/qBittorrent/qBittorrent.conf.bak
|
|
||||||
echo "Update of ${container} configuration complete, restarting..."
|
|
||||||
docker compose start "$container"
|
|
||||||
}
|
|
||||||
|
|
||||||
function update_bazarr_config {
|
|
||||||
echo "Updating ${container} configuration..."
|
|
||||||
until [ -f "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml ]; do sleep 1; done
|
|
||||||
sed -i.bak "s/base_url: ''/base_url: '\/$container'/" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
|
||||||
sed -i.bak "s/use_radarr: false/use_radarr: true/" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
|
||||||
sed -i.bak "s/use_sonarr: false/use_sonarr: true/" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
|
||||||
until [ -f "${CONFIG_ROOT:-.}"/sonarr/config.xml ]; do sleep 1; done
|
|
||||||
SONARR_API_KEY=$(sed -n 's/.*<ApiKey>\(.*\)<\/ApiKey>.*/\1/p' "${CONFIG_ROOT:-.}"/sonarr/config.xml)
|
|
||||||
sed -i.bak "/sonarr:/,/^radarr:/ { s/apikey: .*/apikey: $SONARR_API_KEY/; s/base_url: .*/base_url: \/sonarr/; s/ip: .*/ip: sonarr/ }" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
|
||||||
until [ -f "${CONFIG_ROOT:-.}"/radarr/config.xml ]; do sleep 1; done
|
|
||||||
RADARR_API_KEY=$(sed -n 's/.*<ApiKey>\(.*\)<\/ApiKey>.*/\1/p' "${CONFIG_ROOT:-.}"/radarr/config.xml)
|
|
||||||
sed -i.bak "/radarr:/,/^sonarr:/ { s/apikey: .*/apikey: $RADARR_API_KEY/; s/base_url: .*/base_url: \/radarr/; s/ip: .*/ip: radarr/ }" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
|
||||||
sed -i.bak 's/^BAZARR_API_KEY=.*/BAZARR_API_KEY='"$(sed -n 's/.*apikey: \(.*\)*/\1/p' "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml | head -n 1)"'/' .env && rm .env.bak
|
|
||||||
echo "Update of ${container} configuration complete, restarting..."
|
|
||||||
docker compose restart "$container"
|
|
||||||
}
|
|
||||||
|
|
||||||
for container in $(docker ps --format '{{.Names}}'); do
|
|
||||||
if [[ "$container" =~ ^(radarr|sonarr|lidarr|prowlarr)$ ]]; then
|
|
||||||
update_arr_config "$container"
|
|
||||||
elif [[ "$container" =~ ^(bazarr)$ ]]; then
|
|
||||||
update_bazarr_config "$container"
|
|
||||||
elif [[ "$container" =~ ^(qbittorrent)$ ]]; then
|
|
||||||
update_qbittorrent_config "$container"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
404
update-setup.sh
Normal file
404
update-setup.sh
Normal file
@@ -0,0 +1,404 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Combined update script for docker-compose-nas
|
||||||
|
# - Updates .env file from .env.example while preserving values
|
||||||
|
# - Updates Authelia configuration from example file
|
||||||
|
# - Configures services with correct paths and API keys
|
||||||
|
# Created: April 26, 2025
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Color definitions
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[0;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
MAGENTA='\033[0;35m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m' # No Color
|
||||||
|
|
||||||
|
# Files
|
||||||
|
ENV_FILE=".env"
|
||||||
|
ENV_EXAMPLE=".env.example"
|
||||||
|
TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
|
||||||
|
ENV_BACKUP=".env.${TIMESTAMP}.bak"
|
||||||
|
AUTHELIA_CONFIG="authelia/configuration.yml"
|
||||||
|
AUTHELIA_CONFIG_EXAMPLE="authelia/configuration.example.yml"
|
||||||
|
AUTHELIA_CONFIG_BACKUP="authelia/configuration.${TIMESTAMP}.bak"
|
||||||
|
|
||||||
|
# Print section header
|
||||||
|
print_header() {
|
||||||
|
echo -e "\n${CYAN}${BOLD}$1${NC}"
|
||||||
|
echo -e "${CYAN}$(printf '=%.0s' $(seq 1 ${#1}))${NC}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check if a file exists
|
||||||
|
check_file() {
|
||||||
|
if [ ! -f "$1" ]; then
|
||||||
|
echo -e "${RED}Error: $1 doesn't exist${NC}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Function to create a backup
|
||||||
|
create_backup() {
|
||||||
|
echo -e "${BLUE}Creating backup of $1 as $2...${NC}"
|
||||||
|
cp "$1" "$2"
|
||||||
|
}
|
||||||
|
|
||||||
|
##################################################
|
||||||
|
# PART 1: Update .env file from .env.example
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
update_env_file() {
|
||||||
|
print_header "Environment File Update Tool"
|
||||||
|
|
||||||
|
# Check if files exist
|
||||||
|
if [ ! -f "$ENV_FILE" ]; then
|
||||||
|
echo -e "${RED}Error: $ENV_FILE doesn't exist${NC}"
|
||||||
|
echo -e "Creating a new $ENV_FILE from $ENV_EXAMPLE"
|
||||||
|
cp "$ENV_EXAMPLE" "$ENV_FILE"
|
||||||
|
echo -e "${GREEN}Done! Please review and fill in required values in $ENV_FILE${NC}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! check_file "$ENV_EXAMPLE"; then
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BLUE}This will update your $ENV_FILE based on the structure in $ENV_EXAMPLE${NC}"
|
||||||
|
echo -e "${BLUE}Your existing values will be preserved where possible${NC}"
|
||||||
|
echo -e "${BLUE}Backup will be created as: $ENV_BACKUP${NC}"
|
||||||
|
echo -e "${YELLOW}Continue? [y/N]:${NC}"
|
||||||
|
read -r answer
|
||||||
|
if [[ ! "$answer" =~ ^[Yy]$ ]]; then
|
||||||
|
echo -e "${RED}Environment update cancelled.${NC}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create backup of current .env
|
||||||
|
create_backup "$ENV_FILE" "$ENV_BACKUP"
|
||||||
|
|
||||||
|
# Store current env values
|
||||||
|
echo -e "${BLUE}Reading current environment values...${NC}"
|
||||||
|
declare -A current_values
|
||||||
|
declare -A current_keys_present
|
||||||
|
while IFS='=' read -r key value; do
|
||||||
|
# Skip comments and empty lines
|
||||||
|
if [[ ! "$key" =~ ^#.*$ ]] && [[ ! -z "$key" ]]; then
|
||||||
|
# Clean up any comments after the value
|
||||||
|
value=$(echo "$value" | sed 's/[[:space:]]*#.*$//')
|
||||||
|
# Trim leading/trailing whitespace
|
||||||
|
key=$(echo "$key" | xargs)
|
||||||
|
value=$(echo "$value" | xargs)
|
||||||
|
# Store in associative array if key is not empty
|
||||||
|
if [[ ! -z "$key" ]]; then
|
||||||
|
current_values["$key"]="$value"
|
||||||
|
# Track that this key existed in original file, regardless of value
|
||||||
|
current_keys_present["$key"]=1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done < "$ENV_FILE"
|
||||||
|
|
||||||
|
# Create new env file from example
|
||||||
|
echo -e "${BLUE}Creating new $ENV_FILE from $ENV_EXAMPLE...${NC}"
|
||||||
|
cp "$ENV_EXAMPLE" "$ENV_FILE.new"
|
||||||
|
|
||||||
|
# Track which keys from the current env have been used
|
||||||
|
declare -A used_keys
|
||||||
|
# Track new keys that need attention
|
||||||
|
new_keys=()
|
||||||
|
# Track keys with special warnings
|
||||||
|
special_keys=()
|
||||||
|
|
||||||
|
# Process the template and fill in values from current env
|
||||||
|
while IFS= read -r line; do
|
||||||
|
if [[ "$line" =~ ^([A-Za-z0-9_]+)=(.*)$ ]]; then
|
||||||
|
key="${BASH_REMATCH[1]}"
|
||||||
|
default_value="${BASH_REMATCH[2]}"
|
||||||
|
|
||||||
|
# Mark the key as used if it exists in the original file
|
||||||
|
if [[ -n "${current_keys_present[$key]}" ]]; then
|
||||||
|
used_keys["$key"]=1
|
||||||
|
|
||||||
|
# Replace the line with the current value if one exists
|
||||||
|
if [[ -n "${current_values[$key]}" ]]; then
|
||||||
|
sed -i "s|^$key=.*$|$key=${current_values[$key]}|" "$ENV_FILE.new"
|
||||||
|
fi
|
||||||
|
# If key doesn't exist in original file and has empty/placeholder value
|
||||||
|
elif [[ -z "$default_value" ]] || [[ "$default_value" == '""' ]] || [[ "$default_value" == "''" ]]; then
|
||||||
|
new_keys+=("$key")
|
||||||
|
|
||||||
|
# Special attention for Authelia keys
|
||||||
|
if [[ "$key" == AUTHELIA_*_SECRET* ]] || [[ "$key" == AUTHELIA_*_KEY* ]]; then
|
||||||
|
special_keys+=("$key")
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done < "$ENV_FILE.new"
|
||||||
|
|
||||||
|
# Create section for unused/deprecated keys at the bottom of the file
|
||||||
|
echo -e "\n\n# --- DEPRECATED OR UNUSED KEYS (Kept for Reference) ---" >> "$ENV_FILE.new"
|
||||||
|
echo -e "# Keys below were in your original .env but aren't in the current .env.example" >> "$ENV_FILE.new"
|
||||||
|
echo -e "# They may be deprecated or renamed. Review and remove if no longer needed\n" >> "$ENV_FILE.new"
|
||||||
|
|
||||||
|
unused_keys_count=0
|
||||||
|
for key in "${!current_values[@]}"; do
|
||||||
|
if [[ -z "${used_keys[$key]}" ]]; then
|
||||||
|
echo "$key=${current_values[$key]} # DEPRECATED/UNUSED - Review" >> "$ENV_FILE.new"
|
||||||
|
unused_keys_count=$((unused_keys_count + 1))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# Replace the old file with the new one
|
||||||
|
mv "$ENV_FILE.new" "$ENV_FILE"
|
||||||
|
|
||||||
|
# Generate summary
|
||||||
|
echo -e "\n${GREEN}${BOLD}Environment Update Complete!${NC}"
|
||||||
|
echo -e "${BLUE}Summary:${NC}"
|
||||||
|
echo -e " - ${CYAN}Original config backed up to: $ENV_BACKUP${NC}"
|
||||||
|
echo -e " - ${CYAN}Updated .env structure to match .env.example${NC}"
|
||||||
|
echo -e " - ${CYAN}Preserved ${#used_keys[@]} existing values${NC}"
|
||||||
|
|
||||||
|
if [[ $unused_keys_count -gt 0 ]]; then
|
||||||
|
echo -e " - ${YELLOW}Found $unused_keys_count deprecated/unused keys${NC}"
|
||||||
|
echo -e " ${YELLOW}These have been moved to the bottom of the file with warnings${NC}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ${#new_keys[@]} -gt 0 ]]; then
|
||||||
|
echo -e "\n${YELLOW}${BOLD}NEW KEYS NEEDING ATTENTION:${NC}"
|
||||||
|
echo -e "${YELLOW}The following keys are new and may need values set:${NC}"
|
||||||
|
for key in "${new_keys[@]}"; do
|
||||||
|
echo -e " - ${MAGENTA}$key${NC}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ${#special_keys[@]} -gt 0 ]]; then
|
||||||
|
echo -e "\n${RED}${BOLD}IMPORTANT SECURITY KEYS:${NC}"
|
||||||
|
echo -e "${RED}The following keys require secure values:${NC}"
|
||||||
|
for key in "${special_keys[@]}"; do
|
||||||
|
echo -e " - ${MAGENTA}$key${NC}"
|
||||||
|
|
||||||
|
# Specific advice for Authelia keys
|
||||||
|
if [[ "$key" == AUTHELIA_*_SECRET* ]] || [[ "$key" == AUTHELIA_*_KEY* ]]; then
|
||||||
|
echo -e " ${CYAN}Generate with: ${GREEN}openssl rand -hex 32${NC}"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "\n${BLUE}Review your updated $ENV_FILE file and adjust any values as needed.${NC}"
|
||||||
|
}
|
||||||
|
|
||||||
|
##################################################
|
||||||
|
# PART 2: Update Authelia configuration
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
update_authelia_config() {
|
||||||
|
print_header "Authelia Configuration Update Tool"
|
||||||
|
|
||||||
|
# Check if files exist
|
||||||
|
if ! check_file "$AUTHELIA_CONFIG_EXAMPLE"; then
|
||||||
|
echo -e "${RED}Error: Example configuration file doesn't exist${NC}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# If config file doesn't exist, create it from example
|
||||||
|
if [ ! -f "$AUTHELIA_CONFIG" ]; then
|
||||||
|
echo -e "${YELLOW}Authelia configuration file doesn't exist, creating from example...${NC}"
|
||||||
|
cp "$AUTHELIA_CONFIG_EXAMPLE" "$AUTHELIA_CONFIG"
|
||||||
|
echo -e "${GREEN}Created new Authelia configuration file.${NC}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BLUE}This will update your Authelia configuration based on the example file${NC}"
|
||||||
|
echo -e "${BLUE}Backup will be created as: $AUTHELIA_CONFIG_BACKUP${NC}"
|
||||||
|
echo -e "${YELLOW}Continue? [y/N]:${NC}"
|
||||||
|
read -r answer
|
||||||
|
if [[ ! "$answer" =~ ^[Yy]$ ]]; then
|
||||||
|
echo -e "${RED}Authelia config update cancelled.${NC}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create backup of current config
|
||||||
|
create_backup "$AUTHELIA_CONFIG" "$AUTHELIA_CONFIG_BACKUP"
|
||||||
|
|
||||||
|
# Copy the example file over the current one
|
||||||
|
cp "$AUTHELIA_CONFIG_EXAMPLE" "$AUTHELIA_CONFIG"
|
||||||
|
|
||||||
|
# Get the tailnet domain from .env for proper configuration
|
||||||
|
if [ -f "$ENV_FILE" ]; then
|
||||||
|
TAILNET_DOMAIN=$(grep -o "TAILSCALE_TAILNET_DOMAIN=.*" "$ENV_FILE" | cut -d'=' -f2 | tr -d '"' | tr -d "'")
|
||||||
|
TAILSCALE_HOSTNAME=$(grep -o "TAILSCALE_HOSTNAME=.*" "$ENV_FILE" | cut -d'=' -f2 | tr -d '"' | tr -d "'")
|
||||||
|
REDIS_PASSWORD=$(grep -o "AUTHELIA_REDIS_PASSWORD=.*" "$ENV_FILE" | cut -d'=' -f2 | tr -d '"' | tr -d "'")
|
||||||
|
|
||||||
|
if [ -n "$TAILNET_DOMAIN" ] && [ -n "$TAILSCALE_HOSTNAME" ]; then
|
||||||
|
# Use the full Tailnet domain (e.g., "example.ts.net") for cookies
|
||||||
|
# not just "ts.net" which is a public suffix and not allowed
|
||||||
|
|
||||||
|
# Replace domain placeholder with actual Tailnet domain
|
||||||
|
sed -i "s/domain: 'your-tailnet.ts.net'/domain: '$TAILNET_DOMAIN'/g" "$AUTHELIA_CONFIG"
|
||||||
|
|
||||||
|
# For access control rules, update both wildcards and direct domain
|
||||||
|
sed -i "s/domain: '\*.your-tailnet.ts.net'/domain: '\*.$TAILNET_DOMAIN'/g" "$AUTHELIA_CONFIG"
|
||||||
|
sed -i "s/domain: 'your-tailnet.ts.net'/domain: '$TAILNET_DOMAIN'/g" "$AUTHELIA_CONFIG"
|
||||||
|
|
||||||
|
# For URLs, use the full hostname
|
||||||
|
sed -i "s/https:\/\/tailscale-nas.your-tailnet.ts.net/https:\/\/$TAILSCALE_HOSTNAME.$TAILNET_DOMAIN/g" "$AUTHELIA_CONFIG"
|
||||||
|
|
||||||
|
# Ensure Redis password is set correctly
|
||||||
|
if [ -n "$REDIS_PASSWORD" ]; then
|
||||||
|
# Check if redis connection string exists in the config
|
||||||
|
if grep -q "redis:" "$AUTHELIA_CONFIG"; then
|
||||||
|
echo -e "${CYAN}Setting Redis password in Authelia configuration...${NC}"
|
||||||
|
# Make sure the Redis password in configuration matches the one in .env
|
||||||
|
sed -i "s/password: \${AUTHELIA_SESSION_REDIS_PASSWORD}/password: $REDIS_PASSWORD/g" "$AUTHELIA_CONFIG"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${GREEN}Configured Authelia with your Tailscale domain:${NC}"
|
||||||
|
echo -e "${CYAN} - Cookie domain: ${GREEN}$TAILNET_DOMAIN${NC}"
|
||||||
|
echo -e "${CYAN} - Access control for: ${GREEN}*.$TAILNET_DOMAIN and $TAILNET_DOMAIN${NC}"
|
||||||
|
echo -e "${CYAN} - Authelia URL: ${GREEN}https://$TAILSCALE_HOSTNAME.$TAILNET_DOMAIN${NC}"
|
||||||
|
echo -e "${CYAN} - Redis password: ${GREEN}Configured${NC}"
|
||||||
|
else
|
||||||
|
echo -e "${YELLOW}Warning: Could not find both TAILSCALE_HOSTNAME and TAILSCALE_TAILNET_DOMAIN in .env${NC}"
|
||||||
|
echo -e "${YELLOW}You may need to manually edit $AUTHELIA_CONFIG to set your domains correctly${NC}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${GREEN}${BOLD}Authelia Configuration Update Complete!${NC}"
|
||||||
|
echo -e "${BLUE}${BOLD}Note:${NC} Original config backed up to: $AUTHELIA_CONFIG_BACKUP"
|
||||||
|
}
|
||||||
|
|
||||||
|
##################################################
|
||||||
|
# PART 3: Update Service Configurations
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
update_arr_config() {
|
||||||
|
local container=$1
|
||||||
|
local path=$2
|
||||||
|
|
||||||
|
echo -e "${BLUE}Updating ${container} configuration...${NC}"
|
||||||
|
until [ -f "${CONFIG_ROOT:-.}"/"$container"/config.xml ]; do sleep 1; done
|
||||||
|
sed -i.bak "s/<UrlBase><\/UrlBase>/<UrlBase>\/$path<\/UrlBase>/" "${CONFIG_ROOT:-.}"/"$container"/config.xml && rm "${CONFIG_ROOT:-.}"/"$container"/config.xml.bak
|
||||||
|
|
||||||
|
CONTAINER_NAME_UPPER=$(echo "$container" | tr '[:lower:]' '[:upper:]')
|
||||||
|
sed -i.bak 's/^'"${CONTAINER_NAME_UPPER}"'_API_KEY=.*/'"${CONTAINER_NAME_UPPER}"'_API_KEY='"$(sed -n 's/.*<ApiKey>\(.*\)<\/ApiKey>.*/\1/p' "${CONFIG_ROOT:-.}"/"$container"/config.xml)"'/' .env && rm .env.bak
|
||||||
|
|
||||||
|
echo -e "${GREEN}Update of ${container} configuration complete, restarting...${NC}"
|
||||||
|
docker compose restart "$container"
|
||||||
|
}
|
||||||
|
|
||||||
|
update_qbittorrent_config() {
|
||||||
|
local container=$1
|
||||||
|
|
||||||
|
echo -e "${BLUE}Updating ${container} configuration...${NC}"
|
||||||
|
docker compose stop "$container"
|
||||||
|
until [ -f "${CONFIG_ROOT:-.}"/"$container"/qBittorrent/qBittorrent.conf ]; do sleep 1; done
|
||||||
|
sed -i.bak '/WebUI\\ServerDomains=*/a WebUI\\Password_PBKDF2="@ByteArray(ARQ77eY1NUZaQsuDHbIMCA==:0WMRkYTUWVT9wVvdDtHAjU9b3b7uB8NR1Gur2hmQCvCDpm39Q+PsJRJPaCU51dEiz+dTzh8qbPsL8WkFljQYFQ==)"' "${CONFIG_ROOT:-.}"/"$container"/qBittorrent/qBittorrent.conf && rm "${CONFIG_ROOT:-.}"/"$container"/qBittorrent/qBittorrent.conf.bak
|
||||||
|
|
||||||
|
echo -e "${GREEN}Update of ${container} configuration complete, restarting...${NC}"
|
||||||
|
docker compose start "$container"
|
||||||
|
}
|
||||||
|
|
||||||
|
update_bazarr_config() {
|
||||||
|
local container=$1
|
||||||
|
|
||||||
|
echo -e "${BLUE}Updating ${container} configuration...${NC}"
|
||||||
|
until [ -f "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml ]; do sleep 1; done
|
||||||
|
sed -i.bak "s/base_url: ''/base_url: '\/$container'/" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
||||||
|
sed -i.bak "s/use_radarr: false/use_radarr: true/" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
||||||
|
sed -i.bak "s/use_sonarr: false/use_sonarr: true/" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
||||||
|
|
||||||
|
until [ -f "${CONFIG_ROOT:-.}"/sonarr/config.xml ]; do sleep 1; done
|
||||||
|
SONARR_API_KEY=$(sed -n 's/.*<ApiKey>\(.*\)<\/ApiKey>.*/\1/p' "${CONFIG_ROOT:-.}"/sonarr/config.xml)
|
||||||
|
sed -i.bak "/sonarr:/,/^radarr:/ { s/apikey: .*/apikey: $SONARR_API_KEY/; s/base_url: .*/base_url: \/sonarr/; s/ip: .*/ip: sonarr/ }" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
||||||
|
|
||||||
|
until [ -f "${CONFIG_ROOT:-.}"/radarr/config.xml ]; do sleep 1; done
|
||||||
|
RADARR_API_KEY=$(sed -n 's/.*<ApiKey>\(.*\)<\/ApiKey>.*/\1/p' "${CONFIG_ROOT:-.}"/radarr/config.xml)
|
||||||
|
sed -i.bak "/radarr:/,/^sonarr:/ { s/apikey: .*/apikey: $RADARR_API_KEY/; s/base_url: .*/base_url: \/radarr/; s/ip: .*/ip: radarr/ }" "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml && rm "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml.bak
|
||||||
|
|
||||||
|
sed -i.bak 's/^BAZARR_API_KEY=.*/BAZARR_API_KEY='"$(sed -n 's/.*apikey: \(.*\)*/\1/p' "${CONFIG_ROOT:-.}"/"$container"/config/config/config.yaml | head -n 1)"'/' .env && rm .env.bak
|
||||||
|
|
||||||
|
echo -e "${GREEN}Update of ${container} configuration complete, restarting...${NC}"
|
||||||
|
docker compose restart "$container"
|
||||||
|
}
|
||||||
|
|
||||||
|
update_service_configs() {
|
||||||
|
print_header "Service Configuration Update Tool"
|
||||||
|
|
||||||
|
echo -e "${BLUE}This will update service configurations for running containers${NC}"
|
||||||
|
echo -e "${BLUE}It will set proper URL bases and extract API keys${NC}"
|
||||||
|
echo -e "${YELLOW}Continue? [y/N]:${NC}"
|
||||||
|
read -r answer
|
||||||
|
if [[ ! "$answer" =~ ^[Yy]$ ]]; then
|
||||||
|
echo -e "${RED}Service configuration update cancelled.${NC}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if Docker is running
|
||||||
|
if ! docker ps > /dev/null 2>&1; then
|
||||||
|
echo -e "${RED}Error: Docker is not running or you don't have permission to use it.${NC}"
|
||||||
|
echo -e "${YELLOW}Make sure Docker is running and you have proper permissions.${NC}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -e "${BLUE}Checking for running containers to update...${NC}"
|
||||||
|
for container in $(docker ps --format '{{.Names}}'); do
|
||||||
|
if [[ "$container" =~ ^(radarr|sonarr|lidarr|prowlarr)$ ]]; then
|
||||||
|
update_arr_config "$container" "$container"
|
||||||
|
elif [[ "$container" =~ ^(bazarr)$ ]]; then
|
||||||
|
update_bazarr_config "$container"
|
||||||
|
elif [[ "$container" =~ ^(qbittorrent)$ ]]; then
|
||||||
|
update_qbittorrent_config "$container"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e "\n${GREEN}${BOLD}Service Configuration Update Complete!${NC}"
|
||||||
|
}
|
||||||
|
|
||||||
|
##################################################
|
||||||
|
# MAIN SCRIPT
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
# Display main menu
|
||||||
|
print_header "Docker Compose NAS - Setup Tool"
|
||||||
|
echo -e "${BLUE}This tool will help you configure your Docker Compose NAS setup${NC}"
|
||||||
|
echo -e "${BLUE}Choose one or more options to run:${NC}"
|
||||||
|
echo -e " ${CYAN}1. ${NC}Update .env file from .env.example"
|
||||||
|
echo -e " ${CYAN}2. ${NC}Update Authelia configuration"
|
||||||
|
echo -e " ${CYAN}3. ${NC}Update service configurations"
|
||||||
|
echo -e " ${CYAN}4. ${NC}Run ALL updates"
|
||||||
|
echo -e " ${CYAN}q. ${NC}Quit"
|
||||||
|
echo
|
||||||
|
|
||||||
|
CHOICE="0"
|
||||||
|
while [[ "$CHOICE" != "q" ]]; do
|
||||||
|
echo -e "${YELLOW}Enter your choice [1-4 or q to quit]: ${NC}"
|
||||||
|
read -r CHOICE
|
||||||
|
|
||||||
|
case "$CHOICE" in
|
||||||
|
1) update_env_file ;;
|
||||||
|
2) update_authelia_config ;;
|
||||||
|
3) update_service_configs ;;
|
||||||
|
4)
|
||||||
|
update_env_file
|
||||||
|
update_authelia_config
|
||||||
|
update_service_configs
|
||||||
|
CHOICE="q" # Exit after running all
|
||||||
|
;;
|
||||||
|
q|Q)
|
||||||
|
echo -e "${GREEN}Exiting setup tool.${NC}"
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*) echo -e "${RED}Invalid choice. Please try again.${NC}" ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e "\n${GREEN}${BOLD}All updates completed!${NC}"
|
||||||
|
echo -e "${BLUE}Be sure to restart any services that were updated:${NC}"
|
||||||
|
echo -e " ${CYAN}docker compose restart${NC}"
|
||||||
|
echo -e "\n${BLUE}If you updated the Authelia configuration, restart Authelia:${NC}"
|
||||||
|
echo -e " ${CYAN}docker compose restart authelia${NC}"
|
||||||
Reference in New Issue
Block a user