From 20c9257aa8f71ed9426eecb024e2e282540cf6ca Mon Sep 17 00:00:00 2001 From: Theo Date: Tue, 21 Jul 2026 01:46:28 +0200 Subject: [PATCH] deploy: authentik LXC203 + traefik auth.peis.fr routing --- INSTRUCTIONS.md | 16 +++++-- projet-authent/.env | 5 ++ projet-authent/.secrets | 3 ++ projet-authent/authentik-secrets.md | 9 ++++ projet-authent/docker-compose.yml | 73 +++++++++++++++++++++++++++++ projet-authent/readme.md | 62 ++++++++++++++++++++++++ status-monitor/app.py | 11 +++-- status-monitor/deploy.sh | 36 ++++---------- traefik-config/config/dynamic.yml | 36 ++++++++++++++ 9 files changed, 217 insertions(+), 34 deletions(-) create mode 100644 projet-authent/.env create mode 100644 projet-authent/.secrets create mode 100644 projet-authent/authentik-secrets.md create mode 100644 projet-authent/docker-compose.yml create mode 100644 projet-authent/readme.md diff --git a/INSTRUCTIONS.md b/INSTRUCTIONS.md index b3bf47b..b7777c0 100755 --- a/INSTRUCTIONS.md +++ b/INSTRUCTIONS.md @@ -1,4 +1,14 @@ -# INSTRUCTIONS POUR VIBE +# INSTRUCTIONS POUR AGENTS + +## 📋 Sommaire des agents + +- **[AGENT_devops.md](AGENT_devops.md)** : OpĂ©rations quotidiennes (Status Monitor, commandes SSH, corrections courantes) +- **[AGENT_MAJ_traefik_GIT_inventaire.md](AGENT_MAJ_traefik_GIT_inventaire.md)** : Synchronisation Traefik/GIT (procĂ©dure dĂ©taillĂ©e) +- **[AGENT-creation-lxc-proxmox.md](AGENT-creation-lxc-proxmox.md)** : CrĂ©ation de containers LXC sur Proxmox +- **[AGENT-TRAEFIK-https-homelab-infomaniak.md](AGENT-TRAEFIK-https-homelab-infomaniak.md)** : Configuration HTTPS/Traefik avec Let's Encrypt +- **[AGENT_Transfert_de_certificat_viaCT200.md](AGENT_Transfert_de_certificat_viaCT200.md)** : Transfert de certificats via CT200 comme bastion + +--- ## RÈGLES ABSOLUES @@ -6,7 +16,7 @@ cd ~/homelab-config git pull -2. TOUJOURS travailler depuis ~/homelab-config (WSL) Tu as WSL d'installĂ© avec ubuntu. utilise le pour cloner git... +2. TOUJOURS travailler depuis ~/homelab-config (WSL) - Tu as WSL d'installĂ© avec ubuntu. utilise le pour cloner git... 3. JAMAIS toucher aux fichiers locaux sur C:/Users/theo/.vibe/Proxmox/inventair/ @@ -36,4 +46,4 @@ --- CrĂ©Ă© par : Theo -Pour : Mistral Vibe +Pour : Mistral Vibe et autres agents diff --git a/projet-authent/.env b/projet-authent/.env new file mode 100644 index 0000000..d3d8807 --- /dev/null +++ b/projet-authent/.env @@ -0,0 +1,5 @@ +PG_USER=authentik +PG_DB=authentik +PG_PASS=XCYbxE3+7LmL6pv++F31IVNiHSPNHyAC +AUTHENTIK_SECRET_KEY=EcJRrU3zmqKzt37gZgViQw4+SydEdPtg29rXCEScQVVFbI1nNROOdh+rQuWCqtic +AUTHENTIK_ERROR_REPORTING__ENABLED=false diff --git a/projet-authent/.secrets b/projet-authent/.secrets new file mode 100644 index 0000000..662be18 --- /dev/null +++ b/projet-authent/.secrets @@ -0,0 +1,3 @@ +ROOT_PASS= +PG_PASS= +AUTH_KEY= diff --git a/projet-authent/authentik-secrets.md b/projet-authent/authentik-secrets.md new file mode 100644 index 0000000..e870f59 --- /dev/null +++ b/projet-authent/authentik-secrets.md @@ -0,0 +1,9 @@ +# Secrets Authentik + +GĂ©nĂ©rĂ©s le 2026-07-21T01:03:29+02:00 + +- root CT203 : rj6cuKjHTP2WUHFE +- PG_PASS : XCYbxE3+7LmL6pv++F31IVNiHSPNHyAC +- AUTHENTIK_SECRET_KEY : EcJRrU3zmqKzt37gZgViQw4+SydEdPtg29rXCEScQVVFbI1nNROOdh+rQuWCqtic +- Authentik admin (akadmin) : PLytRPLmwa1+eemjKfAy +- Gateway CT203 : 192.168.0.254 diff --git a/projet-authent/docker-compose.yml b/projet-authent/docker-compose.yml new file mode 100644 index 0000000..f423b57 --- /dev/null +++ b/projet-authent/docker-compose.yml @@ -0,0 +1,73 @@ +version: '3.8' + +services: + postgresql: + image: docker.io/library/postgres:16-alpine + container_name: authentik-postgresql + restart: unless-stopped + healthcheck: + test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] + start_period: 20s + interval: 30s + retries: 5 + timeout: 5s + volumes: + - ./database:/var/lib/postgresql/data + environment: + POSTGRES_PASSWORD: ${PG_PASS} + POSTGRES_USER: ${PG_USER} + POSTGRES_DB: ${PG_DB} + + redis: + image: docker.io/library/redis:alpine + container_name: authentik-redis + restart: unless-stopped + healthcheck: + test: ["CMD-SHELL", "redis-cli ping | grep PONG"] + start_period: 20s + interval: 30s + retries: 5 + timeout: 3s + volumes: + - ./redis:/data + + server: + image: ghcr.io/goauthentik/server:2024.8.3 + container_name: authentik-server + restart: unless-stopped + command: server + environment: + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY} + AUTHENTIK_REDIS__HOST: redis + AUTHENTIK_POSTGRESQL__HOST: postgresql + AUTHENTIK_POSTGRESQL__USER: ${PG_USER} + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + volumes: + - ./media:/media + - ./custom-templates:/templates + ports: + - "9000:9000" + depends_on: + - postgresql + - redis + + worker: + image: ghcr.io/goauthentik/server:2024.8.3 + container_name: authentik-worker + restart: unless-stopped + command: worker + environment: + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY} + AUTHENTIK_REDIS__HOST: redis + AUTHENTIK_POSTGRESQL__HOST: postgresql + AUTHENTIK_POSTGRESQL__USER: ${PG_USER} + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + volumes: + - ./media:/media + - ./certs:/certs + - ./custom-templates:/templates + depends_on: + - postgresql + - redis diff --git a/projet-authent/readme.md b/projet-authent/readme.md new file mode 100644 index 0000000..55637be --- /dev/null +++ b/projet-authent/readme.md @@ -0,0 +1,62 @@ +# DĂ©ploiement Authentik - Projet Authent + +## Statut du 21/07/2026 + +DĂ©ploiement d'Authentik sur un LXC Proxmox `203` sur `prox2`. + +## Infos clĂ©s + +- **Container LXC** : `203` sur `prox2` (`192.168.0.95`) +- **IP du CT203** : `192.168.0.203/24` +- **Gateway** : `192.168.0.254` (corrigĂ©e, n'Ă©tait pas `192.168.0.1`) +- **DNS** : `192.168.0.92` (AdGuard) +- **Hostname** : `Authentik` +- **Domaine Authentik** : `https://auth.peis.fr` +- **Application cible** : `https://status.peis.fr` (Status Monitor) +- **Fichier des secrets** : `authentik-secrets.md` (mots de passe, clĂ©s) + +## Ce qui a Ă©tĂ© fait + +1. Suppression du LXC `203` existant. +2. RecrĂ©ation propre du LXC `203` sur `prox2` avec les paramĂštres demandĂ©s. +3. Configuration SSH par clĂ© (`id_ed25519`) depuis WSL. +4. Activation de `nesting=1` et `keyctl=1`. +5. Correction de la gateway : `192.168.0.1` → `192.168.0.254` (rĂ©cupĂ©rĂ©e depuis `vmbr0` de `prox2`). +6. Installation de Docker et Docker Compose dans le LXC. +7. DĂ©ploiement d'Authentik `2024.8.3` avec PostgreSQL et Redis via `docker-compose.yml`. +8. Correction des permissions du volume `/opt/authentik/media` (`chown 1000:1000`). +9. Configuration Traefik pour exposer `auth.peis.fr` (`dynamic.yml` sur `ct200`). +10. CrĂ©ation du compte admin `akadmin` et du provider/application `Status Monitor` dans Authentik. + +## VĂ©rifications actuelles + +| URL | RĂ©sultat | +|-----|----------| +| `https://auth.peis.fr` | `302` → page de login Authentik accessible | +| `https://status.peis.fr` | `200` → service restaurĂ© | + +## ProblĂšme restant + +Le `forwardAuth` pour protĂ©ger `status.peis.fr` a Ă©tĂ© configurĂ© dans Traefik, mais l'`outpost` intĂ©grĂ© d'Authentik retourne `404` sur `/outpost.goauthentik.io/auth/traefik`. + +Le middleware a donc Ă©tĂ© dĂ©sactivĂ© temporairement dans `traefik-config/config/dynamic.yml` pour ne pas casser `status.peis.fr`. + +## À faire demain + +1. Se connecter Ă  `https://auth.peis.fr` avec `akadmin`. +2. VĂ©rifier dans l'UI Authentik : + - **Applications** → `Status Monitor` existe et est associĂ©e au provider `status-monitor` + - **Outposts** → `authentik Embedded Outpost` contient bien le provider `status-monitor` +3. Tester directement l'URL de l'outpost : + `curl -H "X-Forwarded-Host: status.peis.fr" -H "X-Forwarded-Proto: https" http://192.168.0.203:9000/outpost.goauthentik.io/auth/traefik` +4. Si l'outpost rĂ©pond correctement (401 ou 302), rĂ©activer le middleware dans `traefik-config/config/dynamic.yml` : + - DĂ©commenter les lignes `middlewares: - "authentik-forwardauth"` sous `status-monitor` + - Copier `dynamic.yml` sur `ct200:/opt/traefik/config/dynamic.yml` + - `docker restart traefik-proxy` sur `ct200` + +## Fichiers importants + +- `authentik-secrets.md` : mots de passe gĂ©nĂ©rĂ©s +- `.env` : variables d'environnement Authentik +- `docker-compose.yml` : stack Authentik +- `../traefik-config/config/dynamic.yml` : configuration Traefik diff --git a/status-monitor/app.py b/status-monitor/app.py index 6c26a92..88d1eb8 100755 --- a/status-monitor/app.py +++ b/status-monitor/app.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""Homelab Status Monitor v1.1.0""" +"""Homelab Status Monitor v1.1.1""" import socket import ssl @@ -9,7 +9,7 @@ import threading from datetime import datetime from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer -VERSION = "1.1.0" +VERSION = "1.1.1" # Service configuration: name, type (ssh/http/https), host, port, url (for http/https), insecure (for https) SERVICES = { @@ -37,6 +37,9 @@ SERVICES = { "ct201-status": {"name": "Status Monitor", "type": "ssh", "host": "192.168.0.201", "port": 22}, "ct201-status-http": {"name": "Status Monitor Web", "type": "http", "host": "192.168.0.201", "port": 80, "url": "/"}, + "ct202-gitea": {"name": "Gitea", "type": "ssh", "host": "192.168.0.202", "port": 22}, + "ct202-gitea-http": {"name": "Gitea Web", "type": "http", "host": "192.168.0.202", "port": 3000, "url": "/"}, + # VM "vm100-ha": {"name": "Home Assistant", "type": "ssh", "host": "192.168.0.43", "port": 22}, "vm100-ha-http": {"name": "Home Assistant Web", "type": "http", "host": "192.168.0.43", "port": 8123, "url": "/"}, @@ -245,7 +248,7 @@ def generate_html(): function setGlobalLoad(b) { refreshInProgress = b; var elem = document.getElementById("global-loading"); - elem.innerHTML = b ? '' : ''; + elem.innerHTML = b ? '' : ''; } function render() { @@ -262,7 +265,7 @@ def generate_html(): const pi = c.url ? c.host + ":" + c.port + c.url : c.host + ":" + c.port; h += "
"; - h += ""; + h += ""; h += "
" + c.name + "
" + c.type + "
"; h += "" + s.replace(/_/g, " ") + ""; h += "
" + pi + "
"; diff --git a/status-monitor/deploy.sh b/status-monitor/deploy.sh index ccf8d02..1c244cb 100755 --- a/status-monitor/deploy.sh +++ b/status-monitor/deploy.sh @@ -4,37 +4,19 @@ set -e +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_DIR="$(dirname "$SCRIPT_DIR")" + echo "[DEPLOY] DĂ©but du dĂ©ploiement depuis Git..." -# Se connecte Ă  CT201 via rebond CT200 et dĂ©ploye -ssh -J root@192.168.0.100 root@192.168.0.201 << 'ENDSSH' -cd /opt/status-monitor +echo "[DEPLOY] Transfert des fichiers vers CT201..." +scp -J root@192.168.0.100 -i ~/.ssh/id_ed25519 "$SCRIPT_DIR/app.py" root@192.168.0.201:/tmp/app.py -echo "[DEPLOY] Mise Ă  jour depuis Git..." -if [ ! -d "homelab-config" ]; then - git clone https://VisualPCI:3N14E7GWVSgi3K@git.peis.fr/VisualPCI/homelab-config.git - echo "[DEPLOY] DĂ©pĂŽt clonĂ©" -else - cd homelab-config - git pull - echo "[DEPLOY] DĂ©pĂŽt mis Ă  jour" - cd .. -fi - -echo "[DEPLOY] Copie des fichiers..." -cp -f homelab-config/status-monitor/app.py . - -# Copier le service systemd si prĂ©sent -if [ -f "homelab-config/status-monitor/status-monitor.service" ]; then - cp -f homelab-config/status-monitor/status-monitor.service /etc/systemd/system/ - systemctl daemon-reload - echo "[DEPLOY] Service systemd mis Ă  jour" -fi - -echo "[DEPLOY] RedĂ©marrage du service..." +echo "[DEPLOY] Installation sur CT201..." +ssh -J root@192.168.0.100 -i ~/.ssh/id_ed25519 root@192.168.0.201 << 'ENDSSH' +mv /tmp/app.py /opt/status-monitor/app.py systemctl restart status-monitor - -echo "[DEPLOY] ✅ DĂ©ploiement terminĂ© !" +echo "[DEPLOY] ✅ DĂ©ploiement terminĂ© sur CT201 !" ENDSSH echo "[DEPLOY] DĂ©ploiement terminĂ© avec succĂšs !" diff --git a/traefik-config/config/dynamic.yml b/traefik-config/config/dynamic.yml index ffde5ba..27366fc 100755 --- a/traefik-config/config/dynamic.yml +++ b/traefik-config/config/dynamic.yml @@ -27,6 +27,8 @@ http: tls: certResolver: "letsencrypt" service: status-monitor + # middlewares: + # - "authentik-forwardauth" # TODO: reactiver apres validation UI Authentik git-server: rule: "Host(`git.peis.fr`)" @@ -36,6 +38,25 @@ http: certResolver: "letsencrypt" service: git-server + authentik: + rule: "Host(`auth.peis.fr`)" + entryPoints: + - "websecure" + tls: + certResolver: "letsencrypt" + service: authentik + middlewares: + - "security-headers" + + authentik-outpost: + rule: "Host(`auth.peis.fr`) && PathPrefix(`/outpost.goauthentik.io/`)" + entryPoints: + - "websecure" + tls: + certResolver: "letsencrypt" + service: authentik + priority: 150 + services: homeassistant: loadBalancer: @@ -52,11 +73,26 @@ http: servers: - url: "http://192.168.0.202:3000" + authentik: + loadBalancer: + servers: + - url: "http://192.168.0.203:9000" + middlewares: auth: basicAuth: users: - "admin:$apr1$xnK9sM6u$q81sJuvBe5R3rfefqDLuk1" + authentik-forwardauth: + forwardAuth: + address: "http://192.168.0.203:9000/outpost.goauthentik.io/auth/traefik" + trustForwardHeader: true + authResponseHeaders: + - X-Forwarded-User + - X-Forwarded-Groups + - X-Forwarded-Email + - X-Forwarded-Preferred-Username + - X-Forwarded-User-Id security-headers: headers: frameDeny: true