* Several updates 2022_07_14. See full commit log.

* Updated bash_aliases for Synology DSM 7, which uses SYSTEMD * changed traefik_forward_auth secrets example to align with 2022 Traefik forward Auth guide: https://www.smarthomebeginner.com/traefik-forward-auth-google-oauth-2022/ * After update to DSM 7.1 switch_ports scripts for 80 and 443 did not work (switch_ports.sh.example). Had to add a command to restart nginx. * Modified examples of traefik rules YML for non-docker apps. * Fixed: Wrong port was specified for qbittorrent behind traefik. Changed it to 8080. * Changed lidarr volumes to align with TRaSH guide. * Edited README. docker-compose-t2.yml * Moved my Plex that was running by iteself on a separate docker host on my home network to cloud server. * Typos and comments docker-compose-t2-synology.yml * Installed Adguard Home on Synology to replace my Pi-Hole on Raspberry Pi. This required adding a separate macvlan docker network (dockervlan). * Added Dashy for testing - potential replacement for heimdall. * Added back Traefik cert dumper to use the certs with AdGuard Home for DoH/DoT. * Replaced cf-ddns from oznu by qmcgaw/ddns-updater, which has a few nice features: discord notification (via shoutrrr), webUI for logs, etc.
ajp · Jul 14, 2022 · 7442900 · 7442900
1 parent f350de2
commit 7442900
Show file tree

Hide file tree

Showing 12 changed files with 207 additions and 49 deletions.
diff --git a/README.md b/README.md
@@ -39,7 +39,7 @@ Go step-by-step. If you bite too big of a piece, I guarantee you will choke.
 - [How to Install Docker and Docker Compose on Ubuntu 22.04 LTS](https://www.smarthomebeginner.com/install-docker-on-ubuntu-22-04/)
 - [How to Install Docker and Docker Compose on Ubuntu 20.04 LTS](https://www.smarthomebeginner.com/install-docker-on-ubuntu-20-04/)
 - [Cloudflare Settings for Traefik Docker: DDNS, CNAMEs, & Tweaks](https://www.smarthomebeginner.com/cloudflare-settings-for-traefik-docker/)
-- [Google OAuth 2 MFA Protection for Docker](https://www.smarthomebeginner.com/google-oauth-with-traefik-docker/)
+- [Google OAuth 2 MFA Protection for Docker](https://www.smarthomebeginner.com/traefik-forward-auth-google-oauth-2022/)
 - [Authelia MFA Protection for Docker](https://www.smarthomebeginner.com/docker-authelia-tutorial/)
 - [Traefik Docker Security Best Practices](https://www.smarthomebeginner.com/traefik-docker-security-best-practices/)
 - [Nextcloud Docker with Traefik Reverse Proxy for Beginners](https://www.smarthomebeginner.com/traefik-docker-nextcloud/)

diff --git a/appdata/traefik2/rules/cloudserver/app-adguard-home-authelia.yml.example b/appdata/traefik2/rules/cloudserver/app-adguard-home-authelia.yml.example
@@ -0,0 +1,18 @@
+http:
+  routers:
+    adguard-rtr:
+      rule: "Host(`ag.{{env "DOMAINNAME_CLOUD_SERVER"}}`)"
+      entryPoints:
+        - https
+      middlewares:
+        - chain-oauth
+      service: adguard-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+  services:
+    adguard-svc:
+      loadBalancer:
+        servers:
+          - url: "http://ADGUARD-CLOUD-SERVER-IP:80"
+
diff --git a/appdata/traefik2/rules/cloudserver/app-adguard-home-oauth.yml.example b/appdata/traefik2/rules/cloudserver/app-adguard-home-oauth.yml.example
@@ -0,0 +1,18 @@
+http:
+  routers:
+    adguard-rtr:
+      rule: "Host(`ag.{{env "DOMAINNAME_CLOUD_SERVER"}}`)"
+      entryPoints:
+        - https
+      middlewares:
+        - chain-oauth
+      service: adguard-svc
+      tls:
+        certResolver: dns-cloudflare
+        options: tls-opts@file
+  services:
+    adguard-svc:
+      loadBalancer:
+        servers:
+          - url: "http://ADGUARD-CLOUD-SERVER-IP:80"
+
diff --git a/.../rules/cloudserver/app-hassio.yml.example → ...loudserver/app-hassos-no-auth.yml.example b/.../rules/cloudserver/app-hassio.yml.example → ...loudserver/app-hassos-no-auth.yml.example
@@ -1,16 +1,16 @@
 http:
   routers:
-    hass-core-rtr:
-      rule: "Host(`hass.{{env "DOMAINNAME_CLOUD_SERVER"}}`)" 
+    hassos-rtr:
+      rule: "Host(`hassos.{{env "DOMAINNAME_CLOUD_SERVER"}}`)" 
       entryPoints:
         - https
       middlewares:
         - chain-no-auth
-      service: hass-core-svc
+      service: hassos-svc
       tls:
         certResolver: dns-cloudflare
   services:
-    hass-core-svc:
+    hassos-svc:
       loadBalancer:
         servers:
           - url: "http://192.168.5.90:8123"  # or whatever your external host's IP:port is 
diff --git a/.../rules/cloudserver/app-pihole.yml.example → .../cloudserver/app-pihole-oauth.yml.example b/.../rules/cloudserver/app-pihole.yml.example → .../cloudserver/app-pihole-oauth.yml.example
@@ -5,7 +5,7 @@ http:
       entryPoints:
         - https
       middlewares:
-        - chain-authelia
+        - chain-oauth
         - pihole-add-admin
       service: pihole-svc
       tls:

diff --git a/...2/rules/cloudserver/app-unifi.yml.example → ...loudserver/app-unifi-authelia.yml.example b/...2/rules/cloudserver/app-unifi.yml.example → ...loudserver/app-unifi-authelia.yml.example
diff --git a/docker-compose-t2-obsolete.yml b/docker-compose-t2-obsolete.yml
@@ -1904,15 +1904,3 @@ services:
       # Since cf-companion creates CNAMEs based on host rules, this a workaround for non-docker/external apps
       - "traefik.http.routers.cf-companion-rtr.rule=Host(`webmin.$DOMAINNAME2`) || Host(`shellh.$DOMAINNAME2`) || Host(`syno.$DOMAINNAME2`) || Host(`ibox.$DOMAINNAME2`) || Host(`synplex.$DOMAINNAME2`) || Host(`pirpi.$DOMAINNAME2`) || Host(`pidoc.$DOMAINNAME2` || Host(`stpc.$DOMAINNAME2`)"
 
-  # Traefik Certs Dumper - Extract LetsEncrypt Certificates - Traefik2 Compatible
-  certdumper:
-    <<: *common-keys-apps # See EXTENSION FIELDS at the top
-    container_name: traefik_certdumper
-    image: humenius/traefik-certs-dumper:latest
-    # command: --restart-containers container1,container2,container3
-    volumes:
-      - $DOCKERDIR/appdata/traefik2/acme:/traefik:ro
-      - $DOCKERDIR/shared/certs/$DOMAINNAME_CLOUD_SERVER:/output:rw
-      # - /var/run/docker.sock:/var/run/docker.sock:ro # Only needed if restarting containers (use Docker Socket Proxy instead)
-    environment:
-      DOMAIN: $DOMAINNAME_CLOUD_SERVER
diff --git a/docker-compose-t2-synology.yml b/docker-compose-t2-synology.yml
@@ -35,6 +35,16 @@ networks:
     ipam:
       config:
         - subnet: 192.168.91.0/24
+  dockervlan:
+    name: dockervlan
+    driver: macvlan
+    driver_opts:
+      parent: eth1 # using ifconfig
+    ipam:
+      config:
+        - subnet: "192.168.1.0/24"
+          ip_range: "192.168.1.25/32"
+          gateway: "192.168.1.1"
 
 ########################### SECRETS
 secrets:
@@ -206,7 +216,7 @@ services:
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
       # HTTP Routers
       - "traefik.http.routers.traefik-rtr.entrypoints=https"
-      - "traefik.http.routers.traefik-rtr.rule=Host(`$DOMAINNAME_HOME_SYNOLOGY`,`traefik.$DOMAINNAME_HOME_SYNOLOGY` )"
+      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME_HOME_SYNOLOGY` )"
       ## Services - API
       - "traefik.http.routers.traefik-rtr.service=api@internal"
       ## Healthcheck/ping
@@ -351,6 +361,37 @@ services:
       - "traefik.http.routers.autoindex-rtr.service=autoindex-svc"
       - "traefik.http.services.autoindex-svc.loadbalancer.server.port=80"
 
+  # Dashy - Application Dashboard
+  dashy:
+    <<: *common-keys-apps # See EXTENSION FIELDS at the top
+    container_name: dashy
+    image: lissy93/dashy
+    healthcheck:
+      test: ['CMD', 'node', '/app/services/healthcheck']
+      interval: 1m30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    ports:
+      - 4000:80
+    volumes:
+      - $DOCKERDIR/appdata/dashy/conf.yml:/app/public/conf.yml
+      - $DOCKERDIR/appdata/dashy:/app/public/item-icons
+    environment:
+      - NODE_ENV=production
+      - UID=$PUID
+      - GID=$PGID
+    labels:
+      - "traefik.enable=true"
+      ## HTTP Routers
+      - "traefik.http.routers.dashy-rtr.entrypoints=https"
+      - "traefik.http.routers.dashy-rtr.rule=Host(`$DOMAINNAME_HOME_SYNOLOGY`,`www.$DOMAINNAME_HOME_SYNOLOGY`)"
+      ## Middlewares
+      - "traefik.http.routers.dashy-rtr.middlewares=chain-oauth@file"
+      ## HTTP Services
+      - "traefik.http.routers.dashy-rtr.service=dashy-svc"
+      - "traefik.http.services.dashy-svc.loadbalancer.server.port=80"
+
   ############################# SMART HOME
 
   # Mosquitto - MQTT Broker
@@ -740,6 +781,28 @@ services:
       - "traefik.http.routers.vscode-rtr.service=vscode-svc"
       - "traefik.http.services.vscode-svc.loadbalancer.server.port=8443"
 
+  # AdGuard Home - DNS AdBlocking
+  adguardhome:
+    <<: *common-keys-core # See EXTENSION FIELDS at the top
+    container_name: adguardhome
+    image: adguard/adguardhome
+    networks:
+      dockervlan:
+        ipv4_address: 192.168.1.25 # IP address inside defined range
+    ports:
+      - 53/udp 
+      - 67/udp 
+      - 68/tcp 
+      - 68/udp 
+      - 80/tcp 
+      - 443/tcp 
+      - 853/tcp 
+      - 3000/tcp 
+    volumes:
+      - $DOCKERDIR/appdata/adguard/conf:/opt/adguardhome/conf 
+      - $DOCKERDIR/appdata/adguard/work:/opt/adguardhome/work 
+      - $DOCKERDIR/shared/certs/$DOMAINNAME_HOME_SYNOLOGY:/certs
+
   ############################# MAINTENANCE
 
   # Docker-GC - Automatic Docker Garbage Collection
@@ -764,18 +827,40 @@ services:
       TZ: $TZ
       DOCKER_HOST: tcp://socket-proxy:2375
 
+  # Traefik Certs Dumper - Extract LetsEncrypt Certificates - Traefik2 Compatible
+  certdumper:
+    <<: *common-keys-apps # See EXTENSION FIELDS at the top
+    container_name: traefik_certdumper
+    image: humenius/traefik-certs-dumper:latest
+    # command: --restart-containers container1,container2,container3
+    volumes:
+      - $DOCKERDIR/appdata/traefik2/acme:/traefik:ro
+      - $DOCKERDIR/shared/certs/$DOMAINNAME_HOME_SYNOLOGY:/output:rw
+      # - /var/run/docker.sock:/var/run/docker.sock:ro # Only needed if restarting containers (use Docker Socket Proxy instead)
+    environment:
+      DOMAIN: $DOMAINNAME_HOME_SYNOLOGY
+
   # Cloudflare DDNS - Dynamic DNS Updater
-  cf-ddns:
-    <<: *common-keys-core # See EXTENSION FIELDS at the top
-    container_name: cf-ddns
-    image: oznu/cloudflare-ddns:latest
+  ddns-updater:
+    image: qmcgaw/ddns-updater
+    container_name: ddns-updater
+    restart: always
+    network_mode: bridge
+    ports:
+      - 8000:8000/tcp
+    volumes:
+      - $DOCKERDIR/appdata/ddns-updater:/updater/data # Owned by UID 1000
     environment:
-      API_KEY_FILE: /run/secrets/cf_token
-      ZONE: $DOMAINNAME_HOME_SYNOLOGY
-      #SUBDOMAIN: home
-      PROXIED: "true"
-      RRTYPE: A
-      DELETE_ON_STOP: "false"
-      DNS_SERVER: 1.1.1.1
-    secrets: # not working
-      - cf_token
+      <<: *default-tz-puid-pgid
+      PERIOD: 1h
+      UPDATE_COOLDOWN_PERIOD: 5m
+      PUBLICIP_DNS_TIMEOUT: 3s
+      HTTP_TIMEOUT: 10s
+      # Web UI
+      LISTENING_PORT: 8000
+      # Backup
+      BACKUP_PERIOD: 72h15m # 0 to disable
+      BACKUP_DIRECTORY: /updater/data/backups
+      # Other
+      LOG_LEVEL: info
+      SHOUTRRR_ADDRESSES: $DISCORD_SHOUTRRR_ADDRESS
diff --git a/docker-compose-t2.yml b/docker-compose-t2.yml
@@ -302,7 +302,7 @@ services:
     image: thomseddon/traefik-forward-auth:latest
     # image: thomseddon/traefik-forward-auth:2.1-arm # Use this image with Raspberry Pi
     # Allow apps to bypass OAuth. Radarr example below will bypass OAuth if API key is present in the request (eg. from NZB360 mobile app).
-    # While this is one way, the recommended way is to bypass authentication using Traefik labels shown in some of the apps later.
+    # While this is one way, the recommended way is to bypass authentication using Traefik labels shown in some of the -Arr apps in this file.
     # command: --rule.radarr.action=allow --rule.radarr.rule="Headers(`X-Api-Key`, `$RADARR_API_KEY`)"
     # command: --rule.sabnzbd.action=allow --rule.sabnzbd.rule="HeadersRegexp(`X-Forwarded-Uri`, `$SABNZBD_API_KEY`)"
     environment:
@@ -311,7 +311,7 @@ services:
       - INSECURE_COOKIE=false
       - AUTH_HOST=oauth.$DOMAINNAME_CLOUD_SERVER
       - URL_PATH=/_oauth
-      - LOG_LEVEL=warn
+      - LOG_LEVEL=warn # set to trace while testing bypass rules
       - LOG_FORMAT=text
       - LIFETIME=86400 # 1 day
       - DEFAULT_ACTION=auth
@@ -614,7 +614,7 @@ services:
       - "traefik.http.routers.qbittorrent-rtr.middlewares=chain-oauth@file"
       ## HTTP Services
       - "traefik.http.routers.qbittorrent-rtr.service=qbittorrent-svc"
-      - "traefik.http.services.qbittorrent-svc.loadbalancer.server.port=8168"
+      - "traefik.http.services.qbittorrent-svc.loadbalancer.server.port=8080"
 
   # nzbget - Binary newsgrabber (NZB downloader)
   nzbget:
@@ -740,8 +740,7 @@ services:
       - $DOCKERDIR/appdata/lidarr:/config
       # Optional. See why MediaCover is mounted as volume https://github.com/htpcBeginner/docker-traefik/discussions/147
       - $DATADIR/temp/appdata/lidarr/MediaCover:/config/MediaCover
-      - $DATADIR/downloads:/data/downloads
-      - $DATADIR/local/music:/data/media/music
+      - $DATADIR:/data
       - "/etc/localtime:/etc/localtime:ro"
     environment:
       <<: *default-tz-puid-pgid
@@ -920,6 +919,52 @@ services:
       - "traefik.http.routers.jellyfin-rtr.service=jellyfin-svc"
       - "traefik.http.services.jellyfin-svc.loadbalancer.server.port=8096"
 
+  # Plex - Media Server
+  plexms:
+    <<: *common-keys-media # See EXTENSION FIELDS at the top
+    image: plexinc/pms-docker:plexpass
+    container_name: plexms
+    #devices:
+    #  - /dev/dri:/dev/dri # for harware transcoding
+    ports:
+      - "$PLEX_PORT:32400/tcp"
+      - "3005:3005/tcp"
+      - "8324:8324/tcp"
+      - "32469:32469/tcp"
+      - "1900:1900/udp" # conflicts with xTeVe
+      - "32410:32410/udp"
+      - "32412:32412/udp"
+      - "32413:32413/udp"
+      - "32414:32414/udp"
+      - "$PLEX_WEB_TOOLS_PORT:33400"
+    volumes:
+      - $DOCKERDIR/appdata/plexms:/config
+      - $DATADIR/downloads:/data/downloads
+      - $DATADIR/media:/data/media
+      - /dev/shm:/data/transcode # Offload transcoding to RAM if you have enough RAM
+      # Optional. See why the folders below are mounted as volumes https://github.com/htpcBeginner/docker-traefik/discussions/147
+      - $DATADIR/temp/appdata/plexms/Cache:/config/Library/Application Support/Plex Media Server/Cache
+      - $DATADIR/temp/appdata/plexms/Metadata:/config/Library/Application Support/Plex Media Server/Metadata
+      - $DATADIR/temp/appdata/plexms/Media:/config/Library/Application Support/Plex Media Server/Media
+    environment:
+      TZ: $TZ
+      HOSTNAME: "zPlex"
+      PLEX_CLAIM_FILE: /run/secrets/plex_claim
+      PLEX_UID: $PUID
+      PLEX_GID: $PGID
+    secrets:
+      - plex_claim
+    labels:
+      - "traefik.enable=true"
+      ## HTTP Routers
+      - "traefik.http.routers.plexms-rtr.entrypoints=https"
+      - "traefik.http.routers.plexms-rtr.rule=Host(`proxplex.$DOMAINNAME_CLOUD_SERVER`)"
+      ## Middlewares
+      - "traefik.http.routers.plexms-rtr.middlewares=chain-no-auth@file"
+      ## HTTP Servicesnoauth
+      - "traefik.http.routers.plexms-rtr.service=plexms-svc"
+      - "traefik.http.services.plexms-svc.loadbalancer.server.port=32400"
+
   ############################# MEDIA FILE MANAGEMENT
 
   # Bazarr - Subtitle Management

diff --git a/scripts/synology/switch_ports.sh.example b/scripts/synology/switch_ports.sh.example
@@ -14,6 +14,8 @@ HTTPS_PORT=444
 sed -i "s/^\( *listen .*\)80/\1$HTTP_PORT/" /usr/syno/share/nginx/*.mustache || { echo "Switching HTTP port to 81 failed." ; exit 1; }
 sed -i "s/^\( *listen .*\)443/\1$HTTPS_PORT/" /usr/syno/share/nginx/*.mustache || { echo "Switching HTTPS port to 444 failed." ; exit 1; }
 
+synosystemctl restart nginx
+
 # MYSQL/MARIADB
 # Disabled because I do not use the Synology MariaDB package. Instead, I use MariaDB on docker. See docker-compose-t2-synology.yml.
 #MYSQL_DEF_PORT=3307

diff --git a/secrets_example/traefik_forward_auth b/secrets_example/traefik_forward_auth
@@ -4,6 +4,6 @@
 
 providers.google.client-id=yourGOOGLEclientID
 providers.google.client-secret=yourCLIENTsecret
-secret=RANDOMcharacters
-whitelist=yourEMAILaddress
+secret=yourOAUTHsecret
+whitelist=yourEMAILaddress1
 whitelist=yourEMAILaddress2
diff --git a/shared/config/bash_aliases b/shared/config/bash_aliases
@@ -38,7 +38,10 @@ case $HOSTNAME in
     DSHB)
       alias dcrun2='sudo docker compose -f /home/$BA_USERNAME/docker/docker-compose-t2-web.yml'
       ;;
-    zSyn) 
+    DMS)
+      alias dcrun2='sudo docker compose -f /home/$BA_USERNAME/docker/docker-compose.yml'
+      ;;
+    zSyn|zsyn) 
       alias dcrun2='sudo docker-compose -f /volume1/docker/docker-compose-t2-synology.yml'
       ;;
     *)
@@ -253,15 +256,14 @@ alias ipi='ipconfig getifaddr en0' # internal ip
 alias header='curl -I' # get web server headers 
 
 # SYNOLOGY DSM COMMANDS
-alias servicelist='sudo synoservicecfg --list'
-alias servicestatus='sudo synoservice --status'
-alias servicestop='sudo synoservicecfg --stop'
-alias servicehstop='sudo synoservicecfg --hard-stop'
-alias servicestart='sudo synoservicecfg --start'
-alias servicehstart='sudo synoservicecfg --hard-start'
-alias servicerestart='sudo synoservice --restart'
-alias servicerestart2='sudo synoservicectl --restart'
-alias restartdocker='sudo synoservice --restart pkgctl-Docker'
+alias servicelist='sudo synoservicecfg --list' # does not work in DSM 7
+alias servicestatus='sudo synosystemctl status'
+alias servicestop='sudo synosystemctl stop'
+alias servicehstop='sudo synoservicecfg --hard-stop' # does not work in DSM 7
+alias servicestart='sudo synosystemctl start'
+alias servicehstart='sudo synoservicecfg --hard-start' # does not work in DSM 7
+alias servicerestart='sudo synosystemctl restart'
+alias restartdocker='sudo synosystemctl restart pkgctl-Docker'
 
 # MISCELLANEOUS
 alias wget='wget -c'