Merge branch 'feat-internal-ca' into prod

added native dns resolution for wg and ca urls, fixed a typo in the wg-easy labels which was breaking the web portal
added basic as the default certresolver for https entrypoint
2026-09-17 00:03:13 -05:00 · 2026-09-16 23:14:40 -05:00 · 2026-09-16 23:13:37 -05:00 · 2026-09-16 22:02:45 -05:00 · 2026-09-16 22:02:21 -05:00 · 2026-09-16 19:41:53 -05:00
14 changed files with 472 additions and 188 deletions
@@ -1,3 +1,9 @@
 gitea/data/*
-letsencrypt/acme.json
+letsencrypt/*
+./letsencrypt
 etc_wireguard/*
+matrix/synapse_data/*
+matrix/.env
+step-ca/*
+!step-ca/config
+!step-ca/templates
@@ -1,62 +1,105 @@
-# compose.yml
 # Primary compose file, used to manage the traefik and other network related modules
 # Other compose files to be run named and used my service
+
 services:
-  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
-    image: traefik:v3.6
-    container_name: traefik
-    restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
-      - "./letsencrypt:/letsencrypt"
-      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
-    networks:
-      - traefik
  wg-easy:
-    image: ghcr.io/wg-easy/wg-easy
-    container_name: wg-easy
+    image: ghcr.io/wg-easy/wg-easy:15
+    container_name: wireguard
    restart: unless-stopped
    volumes:
      - ./etc_wireguard:/etc/wireguard
    environment:
-      # Required settings
-      - WG_HOST=wg.riverrooks.dev
-      
-      # Optional settings
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_ALLOWED_IPS=10.8.0.0/24
-      
+      - PORT=51821
+      - INSECURE=true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
-
-    # Ports: We map the VPN port (UDP) directly to the host.
-    # The Web UI (51821) is handled by Traefik labels instead.
    ports:
+      - "80:80"
+      - "443:443"
      - "51820:51820/udp"
-
+      # - "9000:9000"
+      # - "53:53"
    networks:
-      - traefik
-
+      - backend
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
+    extra_hosts:
+      - "wg.dfnk:10.8.0.1"
+      - "ca.dfnk:10.8.0.1"
    labels:
-        # since by default containers are disabled, we need to enable them
      - "traefik.enable=true"
-        # Set a rule for which hostnames will connect
+      # - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+      - "traefik.http.services.wg-easy-svc.loadbalancer.server.url=http://127.0.0.1:51821"
+
+      # Configuration for public access with auth middleware
      - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-        # declare an antrypoint. Websecure is defined in the traefik.yml file
      - "traefik.http.routers.wg-easy.entrypoints=websecure"
-        # declare the certificate resolver. Also defined in traefik.yml file
-        - "traefik.http.routers.wg-easy.tls.certresolver=basic-letsencrypt"
-        # set the port which will be proxied to the address
-        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+      - "traefik.http.routers.wg-easy.tls.certresolver=basic"
+      - "traefik.http.routers.wg-easy.middlewares=auth"
+      - "traefik.http.routers.wg-easy.service=wg-easy-svc"
+      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$cnS8Mv7V$$djacpseKy6M4.XbgG4kgb1"
+
+      # configured for private access with no auth
+      - "traefik.http.routers.wg-easy-private.rule=Host(`wg.dfnk`)"
+      - "traefik.http.routers.wg-easy-private.entrypoints=websecure"
+      # No certresolver here, will mess with browsers
+      - "traefik.http.routers.wg-easy-private.tls=true"
+      - "traefik.http.routers.wg-easy-private.tls.certresolver=defenk"
+      - "traefik.http.routers.wg-easy-private.service=wg-easy-svc"
+
+  traefik: # This is the proxy for all other services. Using labels it dynamically secures reverse proxies to other containters
+    image: traefik:v3.6
+    container_name: traefik
+    restart: unless-stopped
+    network_mode: "service:wg-easy"
+    depends_on:
+      - wg-easy
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
+      - "./letsencrypt:/letsencrypt"
+      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
+      - "./dynamic.yml:/etc/traefik/dynamic.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
+      - "./step-ca/certs/root_ca.crt:/etc/traefik/certs/root_ca.crt:ro" #Maps traefik root cert to the one being used by step-ca
+    environment:
+      - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
+      - LEGO_DISABLE_CNAME_SUPPORT=true
+      - LEGO_CA_CERTIFICATES=/etc/traefik/certs/root_ca.crt
+  dns:
+    image: dockurr/dnsmasq
+    container_name: defenk-dns
+    volumes:
+      - ./dnsmasq.conf:/etc/dnsmasq.conf
+    restart: always
+    network_mode: "service:wg-easy"
+    depends_on:
+      - wg-easy
+  step-ca:
+    image: smallstep/step-ca:latest
+    container_name: defenk-step-ca
+    restart: unless-stopped
+    # ports:
+    #   - "9000:9000"
+    volumes:
+      - ./step-ca/:/home/step
+    environment:
+      - DOCKER_STEPCA_INIT_NAME=DEFENK CA
+      - DOCKER_STEPCA_INIT_DNS_NAMES=ca.dfnk
+      - DOCKER_STEPCA_INIT_PASSWORD_FILE=/home/step/password.txt
+    depends_on: 
+      - wg-easy
+    network_mode: "service:wg-easy"
+    # networks:
+    #   backend:
+    #     - ca.dfnk
+    #     - step-ca

 networks:
-  traefik:
-    external: true
+  # Backend network for docker containers to talk to eachother
+  backend:
+    name: backend
+    driver: bridge
@@ -0,0 +1,12 @@
+# Dont red host resolv.conf
+no-resolv
+
+# forward default traffic
+server=1.1.1.1
+server=8.8.8.8
+
+# Set custom addresses inside the container
+address=/.dfnk/10.8.0.1
+address=/proxmox.dfnk/10.8.0.2
+address=/media.dfnk/192.168.1.35
+address=/ca.dfnk/10.8.0.1
@@ -0,0 +1,50 @@
+http:
+  routers:
+    media-fallback-public:
+      rule: 'HostRegexp(`^[a-z0-9-]+\.riverrooks\.dev$`)'
+      priority: 1
+      entrypoints:
+        - websecure
+      service: remote-traefik-svc
+      tls:
+        certResolver: desecresolver # Here the VPS terminates TLS
+        domains:
+          - main: "riverrooks.dev"
+            sans:
+              - "*.riverrooks.dev"
+
+    proxmox-main:
+      rule: "Host(`prox.dfnk`)"
+      entrypoints: 
+        - "websecure"
+      service: "remote-proxmox-svc"
+      tls: {}
+
+    media-fallback-private:
+      rule: 'HostRegexp(`^[a-z0-9-]+\.dfnk$`)'
+      priority: 1
+      entrypoints:
+        - websecure
+      service: remote-traefik-svc
+      tls: {}
+
+    website-staging:
+      rule: "Host(`staging.dfnk`)"
+      entrypoints:
+        - websecure
+      service: local-staging
+      tls: {}
+
+  services:
+    remote-traefik-svc:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:80"
+    local-staging:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.0.3:8080"
+    remote-proxmox-svc:
+      loadBalancer:
+        servers:
+          - url: "http://10.8.0.2:8006"
@@ -0,0 +1,211 @@
+http:
+  routers:
+    traefik-dashboard:
+      rule: "Host(`traefik.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "api@internal"
+      tls: {}
+    proxmox-main:
+      rule: "Host(`prox.dfnk`)"
+      entrypoints: 
+        - "websecure"
+      service: "proxmox-main-service"
+      tls: {}
+    jellyfin-private:
+      rule: "Host(`watch.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls: {}
+    jellyfin-public:
+      rule: "Host(`watch.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "jellyfin-main-service"
+      tls:
+        certResolver: "basic"
+    homepage:
+      rule: "Host(`home.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "homepage-main-service"
+      tls: {}
+    qbittorrent:
+      rule: "Host(`tor.dfnk`)"
+      entrypoints:
+        - "websecure"
+      tls: {}
+      service: "qbittorrent-main-service"
+    seer:
+      rule: "Host(`seer.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "seer-main-service"
+      tls: {}
+    radarr:
+      rule: "Host(`radarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "radarr-main-service"
+      tls: {}
+    sonarr:
+      rule: "Host(`sonarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "sonarr-main-service"
+      tls: {}
+    lidarr:
+      rule: "Host(`lidarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "lidarr-main-service"
+      tls: {}
+    readarr:
+      rule: "Host(`readarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "readarr-main-service"
+      tls: {}
+    prowlarr:
+      rule: "Host(`prowlarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "prowlarr-main-service"
+      tls: {}
+    bazarr:
+      rule: "Host(`bazarr.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "bazarr-main-service"
+      tls: {}
+    dockge:
+      rule: "Host(`dockge.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "dockge-main-service"
+      tls: {}
+    uptime:
+      rule: "Host(`uptime.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "uptime-main-service"
+      tls: {}
+    files:
+      rule: "Host(`files.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "filebrowser-main-service"
+      tls: {}
+    truenas:
+      rule: "Host(`truenas.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "truenas-main-service"
+      tls: {}
+    soulseek:
+      rule: "Host(`slsk.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "soulseek-main-service"
+      tls: {}
+    navidrome:
+      rule: "Host(`music.dfnk`)"
+      entrypoints:
+        - "websecure"
+      service: "navidrome-main-service"
+      tls: {}
+    navidrome-public:
+      rule: "Host(`music.riverrooks.dev`)"
+      entrypoints:
+        - "websecure"
+      service: "navidrome-main-service"
+      tls:
+        certResolver: "basic"
+
+  services:
+    proxmox-main-service:
+      loadbalancer:
+        servers:
+          - url: "https://10.8.0.2:8006"
+        serversTransport: "insecure-backend"
+    jellyfin-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8096"
+    qbittorrent-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:8080"
+    homepage-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:3000"
+    radarr-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:7878"
+    seer-main-service:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.1.35:5055"
+    sonarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8989"
+    lidarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8686"
+        # serversTransport: "insecure-backend"
+    readarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8787"
+        # serversTransport: "insecure-backend"
+    bazarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:6767"
+        # serversTransport: "insecure-backend"
+    prowlarr-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:9696"
+        # serversTransport: "insecure-backend"
+    dockge-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:5001"
+        # serversTransport: "insecure-backend"
+    filebrowser-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:8085"
+        # serversTransport: "insecure-backend"
+    uptime-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:3002"
+    truenas-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.34"
+        # serversTransport: "insecure-backend"
+    soulseek-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:5030"
+    navidrome-main-service:
+      loadbalancer:
+        servers:
+          - url: "http://192.168.1.35:4533"
+
+  serversTransports:
+    insecure-backend:
+      insecureSkipVerify: true
+
+tls:
+  certificates:
+    - certFile: /letsencrypt/_wildcard.dfnk.pem
+      keyFile: /letsencrypt/_wildcard.dfnk-key.pem
@@ -1,33 +0,0 @@
-networks:
-
-  gitea:
-    external: false
-  traefik:
-    external: true
-
-services:
-  server:
-    image: docker.gitea.com/gitea:1.24.7
-    container_name: gitea
-    environment:
-      - USER_UID=1010
-      - USER_GID=1010
-    restart: always
-    networks:
-      - gitea
-      - traefik
-    volumes:
-      - ./data/:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "22:22"
-    labels:
-        - "traefik.enable=true"
-        - "traefik.http.routers.gitea.rule=Host(`git.riverrooks.dev`)"
-        - "traefik.http.routers.gitea.entrypoints=websecure"
-        - "traefik.http.routers.gitea.tls.certresolver=myresolver"
-        # Explicitly tell Traefik to send the web traffic to internal port 3000
-        - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-        # Tell Traefik to exclusively use the 'proxy' network to route traffic
-        - "traefik.docker.network=traefik"
@@ -0,0 +1,63 @@
+{
+	"root": "/home/step/certs/root_ca.crt",
+	"federatedRoots": null,
+	"crt": "/home/step/certs/intermediate_ca.crt",
+	"key": "/home/step/secrets/intermediate_ca_key",
+	"address": ":9000",
+	"insecureAddress": "",
+	"dnsNames": [
+		"ca.dfnk"
+	],
+	"logger": {
+		"format": "text"
+	},
+	"db": {
+		"type": "badgerv2",
+		"dataSource": "/home/step/db",
+		"badgerFileLoadingMode": ""
+	},
+	"authority": {
+		"provisioners": [
+			{
+				"type": "JWK",
+				"name": "admin",
+				"key": {
+					"use": "sig",
+					"kty": "EC",
+					"kid": "cP9nd7cP75Y5LAkc0Vu7VvyD2oag9WCkn8bOm7CR8_U",
+					"crv": "P-256",
+					"alg": "ES256",
+					"x": "qI9EW58PSUDnDQm7XYThkftUdWAqZxU2QqmfgE0SsXA",
+					"y": "pRQShqpmfG0jlAdAxIL93xj9pukGm0hpj4E2_9FxbKI"
+				},
+				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiYUY5RVNXNHFwX1VENnp2cXBGakszZyJ9.S2sjdhd5yZQT0h0Yx7H269OEM1qZS-XYtS6buFBEoFAvztUfgG4UUg.Dor8ZyZJ3PVLjgGM.I2j3wSx3Rmo45WnO07EWyZncV6Bw6vTV3niEopSxEaMiRGoSFIRRd1UtIcPaMOv-6-PmuCCRBdfd6dszk9MgzJm04QtERg150F6foBcjlcdAjsHh-2pwnVUYdC_QiHt0y1ovaRHXgMbGWAuhW0TKf0TFUQPMErv5czdeofl2tkQAXLu0YKqxKzT8cdhEyGzZHozKocveEE-4CEqYNHiEJOQ676yVEkdaDDLaAp-EpkJI6DJj87CjQRgSAZmYnVsVp9eO8lNpXkyEVXL3QsHXDLxhpN0IiuFlCRp6dqySuN-MKywt3VU4Jl7evwpXz_DjEus91vF3YXqnTaRQSJc.7XePzloYTpkkpq0Ybp1KxQ"
+			},
+			{
+				"type": "ACME",
+				"name": "acme",
+				"claims": {
+					"enableSSHCA": true,
+					"disableRenewal": false,
+					"allowRenewalAfterExpiry": false,
+					"disableSmallstepExtensions": false
+				},
+				"options": {
+					"x509": {},
+					"ssh": {}
+				}
+			}
+		],
+		"template": {},
+		"backdate": "1m0s"
+	},
+	"tls": {
+		"cipherSuites": [
+			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+		],
+		"minVersion": 1.2,
+		"maxVersion": 1.3,
+		"renegotiation": false
+	},
+	"commonName": "Step Online CA"
+}
@@ -0,0 +1,6 @@
+{
+	"ca-url": "https://ca.dfnk:9000",
+	"ca-config": "/home/step/config/ca.json",
+	"fingerprint": "7bf0757de0fb64f0c8864730135b9ba46d72e2ad5603ae488defa32de6c7515e",
+	"root": "/home/step/certs/root_ca.crt"
+}
@@ -1,5 +1,6 @@
 # traefik.yml
 # yml file to define traefik global settings. Individual containers get lables to define their own settings
+# Static config file loaded on boot, [[dynamic.yml]] has the dynamic config for container routing

 api:
  dashboard: true
@@ -11,6 +12,9 @@ providers:
    network: traefik
    # Do not expose every container automatically
    exposedByDefault: false
+  file:
+    filename: /etc/traefik/dynamic.yml
+    watch: true

 entryPoints:
  web:
@@ -23,11 +27,36 @@ entryPoints:
          scheme: https
  websecure:
    address: ":443"
+    http:
+      encodedCharacters:
+        allowEncodedSlash: true
+        allowEncodedHash: true  # This is crucial for Matrix room aliases!
+        tls:
+          certResolver: basic
+
+        # Declaring the user list

 certificatesResolvers:
-  myresolver:
+  basic:
    acme:
      email: web-admin@riverrooks.art
      storage: /letsencrypt/acme.json
      # Use the TLS challenge for domain verification
      tlsChallenge: {}
+  desecresolver:
+    # TODO fix desecresolver  and dns cert partitioning
+    acme:
+      email: web-admin@riverrooks.art
+      storage: /letsencrypt/acme.json
+      dnsChallenge:
+        provider: desec
+        delayBeforeCheck: 15
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"
+  defenk:
+    acme:
+      email: "admin-defenk@riverrooks.dev"
+      caServer: "https://ca.dfnk:9000/acme/acme/directory"
+      storage: "/letsencrypt/internal_acme.json"
+      tlsChallenge: {}
@@ -1,40 +0,0 @@
-services:
-  wg-easy:
-    image: ghcr.io/wg-easy/wg-easy
-    container_name: wg-easy
-    restart: unless-stopped
-    volumes:
-      - ./etc_wireguard:/etc/wireguard
-    environment:
-      # Required settings
-      - WG_HOST=wg.riverrooks.dev
-      
-      # Optional settings
-      - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=1.1.1.1
-      - WG_ALLOWED_IPS=10.8.0.0/24
-      
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    sysctls:
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv4.ip_forward=1
-
-    # Ports: We map the VPN port (UDP) directly to the host.
-    # The Web UI (51821) is handled by Traefik labels instead.
-    ports:
-      - "51820:51820/udp"
-
-    networks:
-      - traefik
-
-    labels:
-        - "traefik.enable=true"
-        - "traefik.http.routers.wg-easy.rule=Host(`wg.riverrooks.dev`)"
-        - "traefik.http.routers.wg-easy.entrypoints=websecure"
-        - "traefik.http.routers.wg-easy.tls.certresolver=myresolver"
-        - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
-networks:
-  traefik:
-    external: true
@@ -1,16 +1,20 @@
+# whoami.yml works as a nice tester to check if the network is exposed
 services:
  whoami:
      image: traefik/whoami
-      container_name: whoami
+      container_name: whoami-public
      restart: unless-stopped
      labels:
        - "traefik.enable=true"
-        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`) || Host(`10.8.0.1`)"
+        - "traefik.http.routers.whoami.rule=Host(`whoami.riverrooks.dev`) || Host(`whoami.riverrooks.art`)"
        - "traefik.http.routers.whoami.entrypoints=websecure"
-        - "traefik.http.routers.whoami.tls.certresolver=basic-letsencrypt"
+        - "traefik.http.routers.whoami.tls.certresolver=basic"
+
+        - "traefik.http.routers.whoami-private.rule=Host(`whoami.dfnk`)"
+        - "traefik.http.routers.whoami-private.entrypoints=websecure"
+        - "traefik.http.routers.whoami-private.tls=true"
      networks:
        - traefik
-
 networks:
  traefik:
    external: true
Author	SHA1	Message	Date
venus	61a3fcea66	Merge branch 'feat-internal-ca' into prod	2026-09-17 00:03:13 -05:00
venus	bc3c38ba3e	added native dns resolution for wg and ca urls, fixed a typo in the wg-easy labels which was breaking the web portal	2026-09-16 23:14:40 -05:00
venus	4a366db19a	added basic as the default certresolver for https entrypoint	2026-09-16 23:13:37 -05:00
venus	ca1a51e865	feat: added support for the step-ca DEFENK CA	2026-09-16 22:02:45 -05:00
venus	2197b5008a	service: step-ca; added custom CA to defenk network for ssl encryption	2026-09-16 22:02:21 -05:00
venus	b2df5636fe	stashing changes, trying some things out with the configuration of the ca server and which network to put it on	2026-09-16 19:41:53 -05:00
venus	83b62048c9	ignored step-ca files	2026-09-16 16:25:07 -05:00
venus	0069f9bf3c	trackimg some files in step-ca	2026-09-16 15:38:29 -05:00
venus	033c5b35b5	removed letsencrypt from git	2026-09-16 15:32:09 -05:00
venus	a627094a2f	stashing changes	2026-09-16 14:18:37 -05:00
venus	c59e29b483	updated compose file with step-ca unit	2026-09-16 12:38:55 -05:00
venus	d60a820ed9	added new step-ca operation volume to gitignore	2026-09-16 12:38:33 -05:00
venus	88794b0e97	fix: patched a service miscofiguration	2026-09-16 12:15:14 -05:00
venus	04de2e17c7	added routing for proxmox container	2026-08-07 18:36:32 -05:00
venus	6d2f2f2826	udpated traefik with fallback proxy to the datacenter	2026-07-31 12:04:24 -05:00
venus	ca6ff45de3	updated traefik config to proxy services and added some qol to the config	2026-07-22 21:09:43 -05:00
venus	2e34bfa561	letsencrypt added	2026-06-28 01:01:58 -05:00
venus	74d28f6812	config in a working state with backend proxy and public jellyfin access	2026-06-28 00:58:44 -05:00
venus	5638a1bab9	changed file perms	2026-06-27 21:07:05 -05:00
venus	561f362eb7	adding more dns support and networking	2026-06-27 20:54:48 -05:00
venus	bb60951020	proxmox connected and compose wg works, modified whoami for a private access path	2026-06-25 23:55:54 -05:00
venus	7401a5fabb	networking for private vpn access working with wg-easy. Cleaned up clutter	2026-06-25 22:58:19 -05:00
venus	1dd9756e6f	working on matrix setup	2026-06-06 23:08:36 -05:00
venus	810a063461	added matrix service, still in testing not prod ready	2026-06-02 03:11:42 -05:00
venus	be2668ce4c	traefik working	2026-05-29 16:17:16 -05:00
venus	4ac9e8e665	working on traefic and wg	2026-04-14 15:17:21 -05:00
venus	7ded14f95f	testing	2026-04-02 14:25:22 -05:00
venus	529bb27dc8	certs working with wg	2026-03-31 23:24:54 -05:00