From 414cbded952e2a52b1b0b528e880614b86de72aa Mon Sep 17 00:00:00 2001 From: wserr Date: Sun, 6 Oct 2024 13:12:09 +0200 Subject: [PATCH] initial --- configurations/otel/collector-config.yaml | 19 +++++ configurations/traefik/traefik.1.7.10.toml | 99 +++++++++++++--------- home-server/.env | 21 +---- home-server/docker-compose.yml | 75 +++++++++------- home-server/envs/local.env | 16 ++++ home-server/envs/production.env | 18 ++++ home-server/{ => envs}/readme.md | 9 ++ home-server/install-docker.sh | 27 ++++++ 8 files changed, 196 insertions(+), 88 deletions(-) create mode 100644 configurations/otel/collector-config.yaml create mode 100644 home-server/envs/local.env create mode 100644 home-server/envs/production.env rename home-server/{ => envs}/readme.md (66%) create mode 100755 home-server/install-docker.sh diff --git a/configurations/otel/collector-config.yaml b/configurations/otel/collector-config.yaml new file mode 100644 index 0000000..3060b1a --- /dev/null +++ b/configurations/otel/collector-config.yaml @@ -0,0 +1,19 @@ +receivers: + otlp: + protocols: + grpc: + endpoint: 0.0.0.0:4317 + http: + endpoint: 0.0.0.0:4318 + +exporters: + debug: + verbosity: detailed + +service: + extensions: [] + pipelines: + traces: + receivers: [otlp] + processors: [] + exporters: [debug] diff --git a/configurations/traefik/traefik.1.7.10.toml b/configurations/traefik/traefik.1.7.10.toml index fb9f202..efe886b 100644 --- a/configurations/traefik/traefik.1.7.10.toml +++ b/configurations/traefik/traefik.1.7.10.toml @@ -1,55 +1,74 @@ -defaultEntryPoints = ["http"] - [entryPoints] - [entryPoints.whoami] - address = ":8088" - [entryPoints.homeassistant] - address = ":8089" - [entryPoints.syncthing] - address = ":8090" - [entryPoints.grafana] - address = ":8091" - [entryPoints.influxdb] - address = ":8092" + [entryPoints.http] + address = ":80" + + [entryPoints.https] + address = ":443" + [entryPoints.https.tls] + [[entryPoints.https.tls.certificates]] + certFile = "/var/lib/certificates/cert.pem" + keyFile = "/var/lib/certificates/key.pem" [file] - [backends] [backends.whoami] [backends.whoami.servers.server1] - url = "http://localhost:2001" - [backends.homeassistant] - [backends.homeassistant.servers.server1] - url = "http://10.55.8.3:8123/" - [backends.syncthing] - [backends.syncthing.servers.server1] - url = "http://10.55.8.3:8384/" + url = "http://whoami:2001" + [backends.grafana] [backends.grafana.servers.server1] - url = "http://10.55.8.3:3000/" + url = "http://grafana:3000" + + [backends.syncthing] + [backends.syncthing.servers.server1] + url = "http://syncthing:8384" + + [backends.homeassistant] + [backends.homeassistant.servers.server1] + url = "http://homeassistant:8123" + [backends.influxdb] [backends.influxdb.servers.server1] - url = "http://10.55.8.3:8086/" + url = "http://influxdb:8086" [frontends] - [frontends.whoami] - entryPoints = ["whoami"] - backend = "whoami" + [frontends.whoami] + backend = "whoami" + [frontends.whoami.routes.path] + rule = "Path:/whoami;ReplacePathRegex: ^/whoami(.*) /$1" - [frontends.homeassistant] - entryPoints = ["homeassistant"] - backend = "homeassistant" + [frontends.grafana] + backend = "grafana" + [frontends.grafana.routes.path] + rule = "Path:/grafana;ReplacePathRegex: ^/grafana(.*) /$1" - [frontends.syncthing] - entryPoints = ["syncthing"] - backend = "syncthing" + [frontends.syncthing] + backend = "syncthing" + [frontends.syncthing.routes.path] + rule = "Path:/syncthing;ReplacePathRegex: ^/syncthing(.*) /$1" - [frontends.grafana] - entryPoints = ["grafana"] - backend = "grafana" - passHostHeader = true - - [frontends.influxdb] - entryPoints = ["influxdb"] - backend = "influxdb" - passHostHeader = true + [frontends.syncthing-referrer] + backend = "syncthing" + [frontends.syncthing-referrer.routes.referrer] + rule = "HeadersRegexp: Referer, /*.syncthing" + + [frontends.homeassistant] + backend = "homeassistant" + [frontends.homeassistant.routes.path] + rule = "Path:/homeassistant;ReplacePathRegex: ^/homeassistant(.*) /$1" + + [frontends.influxdb] + backend = "influxdb" + [frontends.influxdb.routes.path] + rule = "Path:/influxdb;ReplacePathRegex: ^/influxdb(.*) /$1" + + [frontends.influxdb-referrer] + backend = "influxdb" + [frontends.influxdb-referrer.routes.referrer] + rule = "HeadersRegexp: Referer, /*.influxdb" + + +[tracing] + [tracing.otlp.http] + endpoint = "http://otel-collector:4318" + insecure = true diff --git a/home-server/.env b/home-server/.env index 1ee58ec..618eb1a 100644 --- a/home-server/.env +++ b/home-server/.env @@ -1,19 +1,4 @@ -# General settings -INTERNAL_IP: 0.0.0.0 +REPO_DIR=/home/pi/repos/homeAutomation -# Maria DB settings -# For testing purposes only. Please create a .env.mariadb to overwrite these variables -MARIADB_ROOT_PASSWORD=testing - -MARIADB_DATABASE=homeassistant -MARIADB_USER=homeassistant_user -MARIADB_PASSWORD=homeassistant_pw - -GF_SECURITY_ADMIN_USER=test -GF_SECURITY_ADMIN_PASSWORD=test -GF_USERS_ALLOW_SIGN_UP=false - -DOCKER_INFLUXDB_INIT_USERNAME=homeassistant -DOCKER_INFLUXDB_INIT_PASSWORD=homeassistant -DOCKER_INFLUXDB_INIT_ORG=homeassistant -DOCKER_INFLUXDB_INIT_BUCKET=homeassistant +# Make sure docker user has read/write access on this folder +STORAGE_DIR=/tmp diff --git a/home-server/docker-compose.yml b/home-server/docker-compose.yml index d979682..cce7026 100644 --- a/home-server/docker-compose.yml +++ b/home-server/docker-compose.yml @@ -1,26 +1,36 @@ -version: "3.9" services: + whoami: + restart: unless-stopped + image: traefik/whoami + command: + - --port=2001 + traefik: + restart: unless-stopped + image: "traefik:1.7.10" + volumes: + - ${REPO_DIR}/configurations/traefik/traefik.1.7.10.toml:/etc/traefik/traefik.toml + - ${STORAGE_DIR}/certificates:/var/lib/certificates + ports: + - 80:80 + - 443:443 db: image: mariadb:latest restart: unless-stopped ports: - - ${INTERNAL_IP}:3306:3306 + - 3306:3306 env_file: - - .env - - .env.production + - envs/local.env + - envs/production.env volumes: - - /home/willem/mariadb:/var/lib/mysql + - ${STORAGE_DIR}/mariadb:/var/lib/mysql homeassistant: image: "ghcr.io/home-assistant/home-assistant:stable" - ports: - - ${INTERNAL_IP}:8123:8123 volumes: - - /home/willem/homeassistant:/config - - /home/willem/repos/homeAutomation/configurations/home-assistant/configuration.production.yaml:/config/configuration.yaml + - ${STORAGE_DIR}/homeassistant:/config restart: unless-stopped env_file: - - .env - - .env.production + - envs/local.env + - envs/production.env syncthing: image: lscr.io/linuxserver/syncthing:latest container_name: syncthing @@ -29,12 +39,11 @@ services: - PGID=1000 - TZ=Europe/London volumes: - - /home/willem/syncthing:/data1 + - ${STORAGE_DIR}/syncthing:/data1 ports: - - ${INTERNAL_IP}:8384:8384 - - ${INTERNAL_IP}:22000:22000/tcp - - ${INTERNAL_IP}:22000:22000/udp - - ${INTERNAL_IP}:21027:21027/udp + - 22000:22000/tcp + - 22000:22000/udp + - 21027:21027/udp restart: unless-stopped node-exporter: image: prom/node-exporter:latest @@ -50,14 +59,14 @@ services: - '--path.sysfs=/host/sys' - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)' ports: - - ${INTERNAL_IP}:9100:9100 + - 9100:9100 prometheus: image: prom/prometheus:latest container_name: prometheus restart: unless-stopped volumes: - - /home/willem/repos/homeAutomation/configurations/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml - - /home/willem/prometheus:/prometheus + - ${REPO_DIR}/configurations/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml + - ${STORAGE_DIR}/prometheus:/prometheus command: - '--config.file=/etc/prometheus/prometheus.yml' - '--storage.tsdb.path=/prometheus' @@ -65,31 +74,37 @@ services: - '--web.console.templates=/etc/prometheus/consoles' - '--web.enable-lifecycle' ports: - - ${INTERNAL_IP}:9090:9090 + - 9090:9090 grafana: image: grafana/grafana:latest - ports: - - ${INTERNAL_IP}:3000:3000 volumes: - - /home/willem/grafana:/var/lib/grafana + - ${STORAGE_DIR}/grafana:/var/lib/grafana env_file: - - .env - - .env.production + - envs/local.env + - envs/production.env influxdb: container_name: influxdb image: influxdb restart: unless-stopped - ports: - - ${INTERNAL_IP}:8086:8086/tcp # So we can access the WebUI environment: - TZ=Europe/Brussels - DOCKER_INFLUXDB_INIT_MODE=setup env_file: - - .env.production + - envs/local.env + - envs/production.env volumes: - - /home/willem/influxdb/data:/var/lib/influxdb2 - - /home/willem/influxdb/config/:/etc/influxdb2 + - ${STORAGE_DIR}/influxdb/data:/var/lib/influxdb2 + - ${STORAGE_DIR}/influxdb/config/:/etc/influxdb2 ulimits: nofile: soft: 32768 hard: 32768 + otel-collector: + container_name: otel-collector + image: otel/opentelemetry-collector-contrib:0.111.0 + restart: unless-stopped + volumes: + - ${REPO_DIR}/configurations/otel/collector-config.yaml:/etc/otelcol-contrib/config.yaml +# Only enable if external services present +# ports: +# - 4317:4317 # OTLP gRPC receiver diff --git a/home-server/envs/local.env b/home-server/envs/local.env new file mode 100644 index 0000000..bb93fe1 --- /dev/null +++ b/home-server/envs/local.env @@ -0,0 +1,16 @@ +# Maria DB settings +# For testing purposes only. Please create a .env.mariadb to overwrite these variables +MARIADB_ROOT_PASSWORD=testing + +MARIADB_DATABASE=homeassistant +MARIADB_USER=homeassistant_user +MARIADB_PASSWORD=homeassistant_pw + +GF_SECURITY_ADMIN_USER=test +GF_SECURITY_ADMIN_PASSWORD=test +GF_USERS_ALLOW_SIGN_UP=false + +DOCKER_INFLUXDB_INIT_USERNAME=homeassistant +DOCKER_INFLUXDB_INIT_PASSWORD=homeassistant +DOCKER_INFLUXDB_INIT_ORG=homeassistant +DOCKER_INFLUXDB_INIT_BUCKET=homeassistant diff --git a/home-server/envs/production.env b/home-server/envs/production.env new file mode 100644 index 0000000..932c21c --- /dev/null +++ b/home-server/envs/production.env @@ -0,0 +1,18 @@ +# Maria DB settings +# For testing purposes only. Please create a .env.mariadb to overwrite these variables +MARIADB_ROOT_PASSWORD=c8gcablGDuJH2tnbAXjPiQ== + +MARIADB_DATABASE=homeassistant +MARIADB_USER=homeassistant_user +MARIADB_PASSWORD=gyxxny8gO6bzczw+ULuALA== + +GF_SECURITY_ADMIN_USER=admin +GF_SECURITY_ADMIN_PASSWORD=QCpuH3Fnet7g9ywlRQ1Gtw== +GF_USERS_ALLOW_SIGN_UP=false + +DOCKER_INFLUXDB_INIT_USERNAME=homeassistant +DOCKER_INFLUXDB_INIT_PASSWORD=IEOUjgdbI3XjJnmqQOPkHw== +DOCKER_INFLUXDB_INIT_ORG=homeassistant +DOCKER_INFLUXDB_INIT_BUCKET=homeassistant + +REPO_DIR=/home/pi/repos/homeAutomation diff --git a/home-server/readme.md b/home-server/envs/readme.md similarity index 66% rename from home-server/readme.md rename to home-server/envs/readme.md index 66d284c..d46ff96 100644 --- a/home-server/readme.md +++ b/home-server/envs/readme.md @@ -35,3 +35,12 @@ docker compose rm db - Start the VPN client automatically after reboot +## Generate self signed certificates + +https://stackoverflow.com/questions/10175812/how-to-generate-a-self-signed-ssl-certificate-using-openssl + +> non-interactive and 10 years expiration + +```bash +openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes -subj "/C=homeassistant/ST=Belgium/L=Deerlijk/O=Willem/OU=Willem/CN=willem" -subj '/CN=homeassistant.com' +``` diff --git a/home-server/install-docker.sh b/home-server/install-docker.sh new file mode 100755 index 0000000..509ae58 --- /dev/null +++ b/home-server/install-docker.sh @@ -0,0 +1,27 @@ +#!/usr/bin/sh + +# See https://docs.docker.com/engine/install/debian/ +# + # Add Docker's official GPG key: +sudo apt-get update +sudo apt-get install ca-certificates curl +sudo install -m 0755 -d /etc/apt/keyrings +sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc +sudo chmod a+r /etc/apt/keyrings/docker.asc + +# Add the repository to Apt sources: +echo \ + "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \ + $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \ + sudo tee /etc/apt/sources.list.d/docker.list > /dev/null +sudo apt-get update + +sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin + +sudo groupadd docker +sudo usermod -aG docker $USER + +newgrp docker + +# Verify: +# docker run hello-world