diff --git a/docker/.env.example b/docker/.env.example index 406e802..d31d77b 100644 --- a/docker/.env.example +++ b/docker/.env.example @@ -7,3 +7,5 @@ DOCMOST_DB_PASSWORD=change_me_secure_db_password DOCMOST_SECRET=change_me_super_secret_key PAPERLESS_DB_PASSWORD=change_me_secure_db_password PAPERLESS_SECRET=change_me_super_secret_key +FREESCOUT_DB_PASSWORD=change_me_secure_db_password +FREESCOUT_ROOT_PASSWORD=change_me_secure_root_password diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 36dfeef..729dbc9 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -12,6 +12,8 @@ volumes: homepage_config: authentik_db: authentik_redis: + authentik_media: + authentik_certs: simplelogin_data: simplelogin_postgres: simplelogin_redis: @@ -29,6 +31,9 @@ volumes: paperless_redis: calibre_data: uptime_kuma: + freescout_data: + freescout_db: + freescout_redis: services: # ========================================== @@ -58,7 +63,6 @@ services: - PUID=1000 - PGID=1000 - HOMEPAGE_ALLOWED_HOSTS=* - networks: - proxy-net - internal-net @@ -67,7 +71,70 @@ services: - /var/run/docker.sock:/var/run/docker.sock:ro # ========================================== - # 3. EMAIL ALIAS SERVICE (SimpleLogin) + # 3. AUTHENTICATION / SSO (Authentik) + # ========================================== + authentik-db: + image: postgres:15-alpine + restart: unless-stopped + environment: + - POSTGRES_DB=authentik + - POSTGRES_USER=authentik + - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password} + networks: + - internal-net + volumes: + - authentik_db:/var/lib/postgresql/data + + authentik-redis: + image: redis:7-alpine + restart: unless-stopped + networks: + - internal-net + + authentik-server: + image: ghcr.io/goauthentik/server:2024.12.3 + restart: unless-stopped + command: server + environment: + - AUTHENTIK_REDIS__HOST=authentik-redis + - AUTHENTIK_POSTGRESQL__HOST=authentik-db + - AUTHENTIK_POSTGRESQL__USER=authentik + - AUTHENTIK_POSTGRESQL__NAME=authentik + - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password} + - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key} + networks: + - proxy-net + - internal-net + volumes: + - authentik_media:/media + - authentik_certs:/certs + depends_on: + - authentik-db + - authentik-redis + + authentik-worker: + image: ghcr.io/goauthentik/server:2024.12.3 + restart: unless-stopped + command: worker + environment: + - AUTHENTIK_REDIS__HOST=authentik-redis + - AUTHENTIK_POSTGRESQL__HOST=authentik-db + - AUTHENTIK_POSTGRESQL__USER=authentik + - AUTHENTIK_POSTGRESQL__NAME=authentik + - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password} + - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key} + networks: + - proxy-net + - internal-net + volumes: + - authentik_media:/media + - authentik_certs:/certs + depends_on: + - authentik-db + - authentik-redis + + # ========================================== + # 4. EMAIL ALIAS SERVICE (SimpleLogin) # ========================================== simplelogin-app: image: simplelogin/app:latest @@ -106,7 +173,7 @@ services: - internal-net # ========================================== - # 4. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora) + # 5. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora) # ========================================== nextcloud: image: nextcloud:apache @@ -150,7 +217,7 @@ services: - MKNOD # ========================================== - # 5. GIT & CI/CD (Forgejo) + # 6. GIT & CI/CD (Forgejo) # ========================================== forgejo: image: codeberg.org/forgejo/forgejo:10 @@ -167,7 +234,7 @@ services: - "222:22" # SSH port mapping # ========================================== - # 6. KNOWLEDGE BASE & WIKI (Docmost) + # 7. KNOWLEDGE BASE & WIKI (Docmost) # ========================================== docmost: image: docmost/docmost:latest @@ -205,7 +272,7 @@ services: - internal-net # ========================================== - # 7. DOCUMENT ARCHIVING (Paperless-ngx) + # 8. DOCUMENT ARCHIVING (Paperless-ngx) # ========================================== paperless-webserver: image: ghcr.io/paperless-ngx/paperless-ngx:latest @@ -247,7 +314,7 @@ services: - internal-net # ========================================== - # 8. E-BOOK LIBRARY (Calibre-Web) + # 9. E-BOOK LIBRARY (Calibre-Web) # ========================================== calibre-web: image: lscr.io/linuxserver/calibre-web:latest @@ -265,13 +332,43 @@ services: - /srv/company/books:/books # ========================================== - # 9. MONITORING (Uptime Kuma) + # 11. HELP DESK (FreeScout) # ========================================== - uptime-kuma: - image: louislam/uptime-kuma:1 + freescout: + image: tiredofit/freescout:latest restart: unless-stopped + environment: + - DB_TYPE=mysql + - DB_HOST=freescout-db + - DB_NAME=freescout + - DB_USER=freescout + - DB_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password} + - SITE_URL=https://support.techarmor.pl + - APP_ENV=production networks: - proxy-net - internal-net volumes: - - uptime_kuma:/app/data + - freescout_data:/data + depends_on: + - freescout-db + - freescout-redis + + freescout-db: + image: mariadb:10.11 + restart: unless-stopped + environment: + - MYSQL_DATABASE=freescout + - MYSQL_USER=freescout + - MYSQL_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password} + - MYSQL_ROOT_PASSWORD=${FREESCOUT_ROOT_PASSWORD:-root_password} + networks: + - internal-net + volumes: + - freescout_db:/var/lib/mysql + + freescout-redis: + image: redis:7-alpine + restart: unless-stopped + networks: + - internal-net diff --git a/docker/homepage/services.yaml b/docker/homepage/services.yaml index 0709b3e..a4646e0 100644 --- a/docker/homepage/services.yaml +++ b/docker/homepage/services.yaml @@ -32,3 +32,7 @@ icon: uptime-kuma.png href: https://status.techarmor.pl description: System health & uptime + - Help Desk: + icon: freescout.png + href: https://support.techarmor.pl + description: Support tickets & communication diff --git a/terraform/main.tf b/terraform/main.tf index d0e1d65..b51337a 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -1,3 +1,14 @@ +# Authentik SSO & Identity Provider +resource "nginxproxymanager_proxy_host" "auth" { + domain_names = ["auth.${var.domain}"] + forward_host = "authentik-server" + forward_port = 9000 + forward_scheme = "http" + enabled = true + block_exploits = true + allow_websocket_upgrade = true +} + # Central Dashboard resource "nginxproxymanager_proxy_host" "dashboard" { domain_names = ["dashboard.${var.domain}"] diff --git a/terraform/terraform.tfstate b/terraform/terraform.tfstate index 2774d07..5821e33 100644 --- a/terraform/terraform.tfstate +++ b/terraform/terraform.tfstate @@ -1,10 +1,50 @@ { "version": 4, "terraform_version": "1.11.0", - "serial": 11, + "serial": 24, "lineage": "8e77a2a6-a8be-5186-4b43-950cf5faa83a", "outputs": {}, "resources": [ + { + "mode": "managed", + "type": "nginxproxymanager_proxy_host", + "name": "auth", + "provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "access_list_id": null, + "advanced_config": "", + "allow_websocket_upgrade": true, + "block_exploits": true, + "caching_enabled": false, + "certificate_id": null, + "created_on": "2026-08-27 06:07:25", + "domain_names": [ + "auth.techarmor.pl" + ], + "enabled": true, + "forward_host": "authentik-server", + "forward_port": 9000, + "forward_scheme": "http", + "hsts_enabled": false, + "hsts_subdomains": false, + "http2_support": false, + "id": 13, + "locations": [], + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, + "modified_on": "2026-08-27 06:07:25", + "owner_user_id": 1, + "ssl_forced": false + }, + "sensitive_attributes": [] + } + ] + }, { "mode": "managed", "type": "nginxproxymanager_proxy_host", @@ -33,7 +73,10 @@ "http2_support": false, "id": 10, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -70,7 +113,10 @@ "http2_support": false, "id": 6, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -79,6 +125,47 @@ } ] }, + { + "mode": "managed", + "type": "nginxproxymanager_proxy_host", + "name": "dashboard", + "provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "access_list_id": null, + "advanced_config": "", + "allow_websocket_upgrade": true, + "block_exploits": true, + "caching_enabled": false, + "certificate_id": null, + "created_on": "2026-08-26 20:39:14", + "domain_names": [ + "dashboard.techarmor.pl", + "techarmor.pl" + ], + "enabled": true, + "forward_host": "homepage", + "forward_port": 3000, + "forward_scheme": "http", + "hsts_enabled": false, + "hsts_subdomains": false, + "http2_support": false, + "id": 3, + "locations": [], + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, + "modified_on": "2026-08-27 07:55:03", + "owner_user_id": 1, + "ssl_forced": false + }, + "sensitive_attributes": [] + } + ] + }, { "mode": "managed", "type": "nginxproxymanager_proxy_host", @@ -107,7 +194,10 @@ "http2_support": false, "id": 9, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -144,7 +234,10 @@ "http2_support": false, "id": 7, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -181,7 +274,10 @@ "http2_support": false, "id": 8, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -218,7 +314,10 @@ "http2_support": false, "id": 11, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -227,6 +326,46 @@ } ] }, + { + "mode": "managed", + "type": "nginxproxymanager_proxy_host", + "name": "status", + "provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]", + "instances": [ + { + "schema_version": 0, + "attributes": { + "access_list_id": null, + "advanced_config": "", + "allow_websocket_upgrade": true, + "block_exploits": false, + "caching_enabled": false, + "certificate_id": null, + "created_on": "2026-08-26 21:17:47", + "domain_names": [ + "status.techarmor.pl" + ], + "enabled": true, + "forward_host": "uptime-kuma", + "forward_port": 3001, + "forward_scheme": "http", + "hsts_enabled": false, + "hsts_subdomains": false, + "http2_support": false, + "id": 4, + "locations": [], + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, + "modified_on": "2026-08-27 00:06:00", + "owner_user_id": 1, + "ssl_forced": false + }, + "sensitive_attributes": [] + } + ] + }, { "mode": "managed", "type": "nginxproxymanager_proxy_host", @@ -255,7 +394,10 @@ "http2_support": false, "id": 12, "locations": [], - "meta": null, + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false @@ -292,8 +434,11 @@ "http2_support": false, "id": 5, "locations": [], - "meta": null, - "modified_on": "2026-08-27 00:02:02", + "meta": { + "nginx_err": null, + "nginx_online": "true" + }, + "modified_on": "2026-08-27 00:02:03", "owner_user_id": 1, "ssl_forced": false },