selfhosted - GitLite

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #typescript #llm #machine-learning #cli #vue #awesome-list #security #mcp #openai #open-source

selfhosted

(★ 383)

docker compose + traefik + tailscale

File Explorer

Download Latest Version (.zip)

- - cfapi.png
  - pihole-advanced.png
  - pihole-dns.png
  - router-dhcp.png
  - router-dnsmasq.png
  - router-system.png
- config.boot
- edgerouter-backups.md
- lan-only-routes.md
- pihole-dnsmasq.md
- ubuntu-expand-lvm.md
- wildcard-certs.md
- wireguard-question.md
- - rules-fail2ban.yml
- - .env.example
- authconfig.ini
- mdadm.conf
- sshd_config
- traefik-logrotate.conf
- unbound.conf
.drone.yml
.env.example
.gitignore
docker-compose.yml
logrotate.service
logrotate.timer
media-4tb.mount
media-primary.mount
media-secondary.mount
media-wildy.mount
README.md
unifi.docker-compose.yaml
wildy.compose.yml

# Installation Guide

1. Get the code

git clone https://github.com/subdavis/selfhosted

Downloads the entire project code from GitHub to your computer.

cd selfhosted

Moves into the project folder you just downloaded.

2. Docker

Easy Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Docker Desktop Needed to build and run containers. Install it and keep it running in the background.

You may need to disable ubuntu's default dns service and remove resolf.conf [read more](https://www.smarthomebeginner.com/run-pihole-in-docker-on-ubuntu-with-reverse-proxy/).

Type this command into your terminal and run it.

With `systemd-resolved` disabled, `/etc/resolv.conf` must be a real file pointing at a proper upstream DNS server — **not** `127.0.0.1`/AdGuard. Docker's embedded DNS resolver on user-defined networks (127.0.0.11) reads the host's resolv.conf at daemon start to find upstreams; if it can't reach an upstream, every container's DNS breaks. Pointing at AdGuard creates a chicken-and-egg: AdGuard can't start without Docker DNS, and Docker DNS can't resolve anything without AdGuard.

Type this command into your terminal and run it.

* [Docker IPV6](https://docs.docker.com/config/daemon/ipv6/)

Type this command into your terminal and run it.

✅ Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.

Pulled directly from this repo's README.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# docker selfhosted services

> with docker-compose and traefik

![Uptime Robot ratio (30 days)](https://img.shields.io/uptimerobot/ratio/m784171038-19b52e00f52a8d916ba46346)
[![Build Status](https://drone.subdavis.com/api/badges/subdavis/selfhosted/status.svg)](https://drone.subdavis.com/subdavis/selfhosted)

This repo contains my production docker services accessible from anywhere over HTTPS using [traefik](https://traefik.io).  These services (and others) run on a single server.  **It used to be [rootless-mode](https://docs.docker.com/engine/security/rootless/)** but slirp4net was too slow and too much of the docker advanced configuration (permissions flags, mostly) were missing.

* Jellyfin
* Navidrome
* Linkding
* Miniflux
* Sonarr, Radarr, Prowlarr
* Calibre Web
* Kobo book downloader (kobodl)
* Paperless-ngx document management
* Transmission torrent server
* AdGuard Home DNS
* Drone CI and runner
* Backrest (restic)
* Watchtower
* Cloudflare DNS Automation
* Dozzle

# Documentation

I've also written some intermediate to advanced generic usage docs for traefik, docker, pihole, and home networking.  These articles are generally applicable, but some may be more useful than others.

* [Configuring Wildcard Certs for Traefik](docs/wildcard-certs.md)
* [LAN-only Traefik Routing with ACME SSL](docs/lan-only-routes.md)
* [Configuring PiHole with dnsmasq](docs/pihole-dnsmasq.md)
* [EdgeRouter Backups over SSH (SCP)](docs/edgerouter-backups.md)
* [Expand LVM to fill remaining disk](docs/ubuntu-expand-lvm.md)

More great documentation.

* https://www.smarthomebeginner.com/traefik-2-docker-tutorial/
* https://github.com/isaacrlevin/HomeNetworkSetup
* https://github.com/htpcBeginner/docker-traefik

## Prerequisites

* A recent version of ubuntu server with `Docker CE` installed (see below)
* A router or firewall capable of dnsmasq. I use a Ubiquiti EdgeRouter X.
* A domain name.
* A cloudflare account.

### Home network prep

* You need to make sure that ports 80 and 443 are port-forwarded through your router to whatever host this will be on.
* Your server should be assigned a static private IP by DNS.  `ifconfig` will list your interfaces.
* Refer to the [docker-pi-hole](https://github.com/pi-hole/docker-pi-hole) docs and [my docs](docs/pihole-dnsmasq.md) for further network setup related to that service.  Even though I use AdGuard Home, those docs are relevant.

### DNS Configuration

**UPDATE**: This is now done automatically with [Docker Traefik Cloudflare Companion](https://github.com/tiredofit/docker-traefik-cloudflare-companion).  Instructions below are left as an explanation of how this works.

In this setup, each container's service will serve from a different subdomain of your Cloudflare hosted zone dyndns subdomain.

* Create an `A` record for `core.mydomain.com` to point to your public IP.
* For each service, you'll need to create CNAME records for each `service.mydomain.com` to point to `core.mydomain.com` because all of your services are running on the same host but the host needs to be able to do virtual host routing based on domain name.
* Your services will be publically available on `https://servicename.mydomain.com`.

### Dynamic DNS (recommended)

Resolving the IP address of your home network is annoying because most DNS providers change your IP every now and again.  Services like No-IP combat this, but they aren't the most reliable.  However, setting DNS programatically is pretty easy with Cloudflare API.

* Follow the instructions in [Configuring Wildcard Certs for Traefik](docs/wildcard-certs.md) to get this part set up.
* You'll need to modify `.env` with your domain info, ACME email, and cloudflare API tokens.

## Installation

1. start with ubuntu lts
1. [Enable Unattended Upgrades](https://help.ubuntu.com/community/AutomaticSecurityUpdates)
1. clone this repo
1. Sign into any private docker registries
1. install [docker](https://docs.docker.com/engine/install/)
  a [Understanding UID remapping](https://medium.com/@tonistiigi/experimenting-with-rootless-docker-416c9ad8c0d6)
  a. ignore the env exports it says to set, see below
1. make sure `UsePAM yes` is set in `/etc/ssh/sshd_config` [read more](https://superuser.com/questions/1561076/systemctl-use-failed-to-connect-to-bus-no-such-file-or-directory-debian-9)

```bash
cd selfhosted
cp .env.example .env # edit this
mkdir etc/secrets # And then put service-account.json in here for workflow-explorer

# make mount points
mkdir /media/local /media/primary /media/secondary

# install mounts
systemctl link media-primary.mount
systemctl link media-secondary.mount

# install logrotate
systenctl --user link $HOME/selfhosted/logrotate.timer
systenctl --user link $HOME/selfhosted/logrotate.service
systemctl --user enable logrotate.timer --now

# enable traefik logrotate
cp etc/traefik-logrotate.conf /etc/logrotate.d/traefik

# Create workflow-explorer config and edit
cp etc/workflow-explorer/.env.example etc/workflow-explorer/.env

# Add to .profile
# export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
nano .profile
```

[Set up docker daemon.json](https://forums.docker.com/t/rootless-docker-ip-range-conflicts/103341).  Otherwise, you may end up with subnet ranges inside your containers that overlap with the real LAN and make hosts unreachable.

``` json
{
    "default-address-pools": [
        {"base":"172.16.0.0/16","size":24},
        {"base":"172.20.0.0/16","size":24}
    ]
}
```

### Sysctl customizations

```bash
# Allow containers to bind privileged ports (e.g. 80, 443)
echo 'net.ipv4.ip_unprivileged_port_start=0' | sudo tee -a /etc/sysctl.d/99-sysctl.conf

# Increase max_map_count for Jellyfin/Elasticsearch
echo 'vm.max_map_count=262144' | sudo tee -a /etc/sysctl.d/99-sysctl.conf

sudo sysctl --system
```

Edit `/lib/systemd/system/user@.service` to include dependencies on mounts

```conf
[Unit]
Requires=user-runtime-dir@%i.service media-primary.mount media-secondary.mount
```

## Automatic deployments and drone

* Create a github api app. Follow drone setup instructions.
* Make sure the user filtering config is set correctly so other users can't log in
* Add secrets `ssh_key`, `ssh_host`, `ssh_user` for your deploy user.
* Open `drone.yourdomain.com` and finish configuring your repo.

## Adguard DNS

You may need to disable ubuntu's default dns service and remove resolf.conf [read more](https://www.smarthomebeginner.com/run-pihole-in-docker-on-ubuntu-with-reverse-proxy/).

After disabling `systemd-resolved.service`, I ususally set a different DNS server in `/etc/resolv.conf` so that DNS doesn't break when I screw up the stack.

`systemd-resolve --help` is your friend.

### Static `/etc/resolv.conf` (required)

With `systemd-resolved` disabled, `/etc/resolv.conf` must be a real file pointing at a proper upstream DNS server — **not** `127.0.0.1`/AdGuard. Docker's embedded DNS resolver on user-defined networks (127.0.0.11) reads the host's resolv.conf at daemon start to find upstreams; if it can't reach an upstream, every container's DNS breaks. Pointing at AdGuard creates a chicken-and-egg: AdGuard can't start without Docker DNS, and Docker DNS can't resolve anything without AdGuard.

An Ubuntu release upgrade (e.g. 22 → 24) will re-symlink `/etc/resolv.conf` to `stub-resolv.conf` even though `systemd-resolved` is disabled, leaving a dangling symlink and breaking container DNS. Fix:

```bash
sudo rm /etc/resolv.conf
sudo tee /etc/resolv.conf <<'EOF'
nameserver 1.1.1.1
nameserver 8.8.8.8
EOF
sudo chattr +i /etc/resolv.conf   # prevents future upgrades from clobbering it
sudo systemctl restart docker      # re-read upstream DNS
```

[Also disable AdGuardHome's Rate Limiting](https://nikokultalahti.com/2025/04/09/fixing-server-misbehaving-error-in/) because miniflux will trigger it and throw `server misbehaving` errors.

## Tailscale as Exit Node

I've switched to tailscale. In Tailscale DNS admin settings, I set the exit node's Tailnet IPv4 address as the DNS server. There should be no need to modify firewall rules on the exit node.

```bash
tailscale up --advertise-connector --accept-dns=false --advertise-exit-node --advertise-routes=192.168.48.0/20,63.231.151.187/32 --ssh
# Will prompt setup for UDP GRO forwarding
# https://tailscale.com/s/ethtool-config-udp-gro
```

Troubleshooting: I've had issues with outdated clients not resolving DNS properly when connected to the exit node that were fixed by updating to the latest version.

### Archived: WireGurad and subnet docs

* use `wg-quick` for simplicity
* May need to [install or symlink resolvconf](https://superuser.com/questions/1500691/usr-bin-wg-quick-line-31-resolvconf-command-not-found-wireguard-debian)
* Need to avoid [overlapping subnets](https://www.reddit.com/r/WireGuard/comments/bp01ci/connecting_to_services_through_vpn_when_the/).
* Set MTU down to 1280 for issues with cellular networks, on BOTH sides of the connection.
  * Update: As of September 19, had to drop to 1250 for TMobile LTE to work....

* My subnet is `192.168.48.0/20`
* The mask is `255.255.240.0`
* The default LAN will be `192.168.52.0`
* The gateway is `192.168.52.1`

```
Gateway: 11000000.10101000.0011 | 0100.00000001
Mask:    11111111.11111111.1111 | 0000.00000000
```

* The upper 4 bits will be used for VLANs (16).
* The lower 8 shoud belong to a single VLAN.

Using wireguard:

```bash
sudo systemctl enable wg-quick@peerN --now
```

I have aliases `wgup` and `wgdown` for this in my `.bashrc`.

## IPv6

Some references I encountered while rolling out ipv6.

[My full edgerouter config](docs/config.boot)

* [Docker IPV6](https://docs.docker.com/config/daemon/ipv6/)
* [Kernel modules lazy-load ip6tables](https://github.com/moby/moby/issues/33605#issuecomment-307361421)
  * `SYS_MODULE` capability doesn't seemt to do it. issuing an `ip6tables` dummy rule worked
* [IPv6 Firewall Rules](https://community.ui.com/questions/Can-someone-let-us-know-the-added-default-IPv6-firewall-rule-mentioned-in-the-new-Edge-OS-2-01/9683f591-6cd2-4677-83c9-e90d2b7c3fbe)
* Must [Block LAN to WLAN Multicast and Broadcast Data for ipv6 over wifi](https://community.ui.com/questions/IPv6-for-UniFi-WiFi/fa7109bb-c33f-4af4-9d98-dc82f0e31d99)
* [You might have to disable some firewall stuff on the upstream ISP gateway](https://community.ui.com/questions/Allow-HTTPs-over-IPv6-in-firewall-Edgemax/c5f00707-4476-4b1b-91d4-7391f73aafa6)
* [Disable ISP IPv6 DNS](https://kazoo.ga/dhcpv6-pd-for-native-ipv6/#)
  * `no-dns` in `interface` config for `rdnss`
* I have not been able to get wireguard to route ipv6 traffic under slirp4netns (rootlesss).  As a result, it is not possible to connect to wireguard via an ipv6 endpoint.  Wireguard for ios prefers ipv4, but the desktop client prefers ipv6.  Recommend creating an ipv4-only DNS record such as `wireguard4.domain.com` to force ipv4.

## Other useful nonsense

```bash
# set own IP, delete set
ifconfig eth0 192.168.1.5 netmask 255.255.255.0 up
ifconfig en1 delete 192.168.1.5
```