mates
444191d16d
- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower) - install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore - ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton - hermes-install: Hermes CLI setup on macOS - macos-setup: Brewfile + osx-defaults + fish-config - home-nas-tools: metadata index for NAS projects (no binaries) - docs: architecture, security, contributing - README, LICENSE (MIT), .gitignore
163 lines
8.4 KiB
Markdown
163 lines
8.4 KiB
Markdown
# 🏛 Architecture
|
||
|
||
> Jak je celá home infrastruktura poskládaná.
|
||
|
||
## 🎯 Přehled
|
||
|
||
Home lab běží na jednom fyzickém serveru (Ubuntu 22.04/24.04 LTS) s Docker.
|
||
Všechny služby jsou **containerizované**, za **Nginx Proxy Manager** (reverse proxy + HTTPS).
|
||
|
||
## 🌐 Vrstvy
|
||
|
||
```
|
||
┌─────────────────────────────────────────────────────────────┐
|
||
│ Layer 7: Aplikační služby │
|
||
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
|
||
│ │Nextcloud │ │Vaultwarden│ │ Gitea │ │ Jotty │ │
|
||
│ │ :11000 │ │ :2999 │ │ :3000/222│ │ :1122 │ │
|
||
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
|
||
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
|
||
│ │ Portainer│ │ Plex │ │Audiobook-│ │ Calibre │ │
|
||
│ │ :9000 │ │ :32400 │ │shelf:13378│ │-Web:8083 │ │
|
||
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
|
||
│ ... dalších 7 služeb (rustdesk, wikijs, speedtest, ...) │
|
||
└─────────────────────────────────────────────────────────────┘
|
||
▲
|
||
│ HTTPS
|
||
┌─────────────────────────────────────────────────────────────┐
|
||
│ Layer 4-7: Reverzní proxy + Let's Encrypt │
|
||
│ ┌──────────────────────────────────────────────────┐ │
|
||
│ │ Nginx Proxy Manager (:80, :443) │ │
|
||
│ │ - SSL terminace (Let's Encrypt) │ │
|
||
│ │ - HTTP → HTTPS redirect │ │
|
||
│ │ - Access Lists │ │
|
||
│ │ - Load balancing (volitelně) │ │
|
||
│ └──────────────────────────────────────────────────┘ │
|
||
└─────────────────────────────────────────────────────────────┘
|
||
▲
|
||
│ HTTP
|
||
┌─────────────────────────────────────────────────────────────┐
|
||
│ Layer 2-3: Docker bridge networks │
|
||
│ Každá služba má vlastní bridge: │
|
||
│ portainer_default, vaultwarden_default, gitea_default, ... │
|
||
│ Izolace: služby mezi sebou nekomunikují (default) │
|
||
│ Komunikace: přes reverzní proxy (NPM) │
|
||
└─────────────────────────────────────────────────────────────┘
|
||
▲
|
||
│ Docker API
|
||
┌─────────────────────────────────────────────────────────────┐
|
||
│ Layer 1: Fyzický server │
|
||
│ ┌──────────────────────────────────────────────────┐ │
|
||
│ │ Ubuntu 22.04/24.04 LTS │ │
|
||
│ │ - Docker CE 29.x │ │
|
||
│ │ - Portainer CE (UI pro Docker) │ │
|
||
│ │ - Watchtower (auto-update monitoring) │ │
|
||
│ │ - deploy user (UID 1000) │ │
|
||
│ │ - UFW firewall + fail2ban │ │
|
||
│ │ - SSH hardening │ │
|
||
│ └──────────────────────────────────────────────────┘ │
|
||
└─────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
## 🔌 Služby (detail)
|
||
|
||
| Služba | Port | Databáze | Volume | Backup |
|
||
|---|---|---|---|---|
|
||
| Portainer | 9000, 9443 | SQLite (interní) | `./data` | rsync |
|
||
| Nginx Proxy Manager | 80, 443, 81 | MariaDB | `./data`, `./letsencrypt` | rsync |
|
||
| Vaultwarden | 2999 | SQLite | `./data` | rsync (kritické!) |
|
||
| Nextcloud AIO | 11000 | MariaDB | `./data` | AIO Borg |
|
||
| Gitea | 3000, 222 | SQLite | `./gitea` | rsync |
|
||
| Jotty | 1122 | SQLite | `./data` | rsync |
|
||
| RustDesk | 21115-21119 | SQLite | `./data` | rsync |
|
||
| Audiobookshelf | 13378 | SQLite | `./data` + `./audiobooks` | rsync |
|
||
| Calibre-Web | 8083 | SQLite | `./data` + `./books` | rsync |
|
||
| Plex | 32400 | SQLite | `./data` + `./media` | rsync |
|
||
| Erugo | 61080 | SQLite | `./data` | rsync |
|
||
| Wiki.js | 9180 | MariaDB | `./data` | rsync |
|
||
| Speedtest | 8765 | SQLite | `./data` | rsync |
|
||
| Watchtower | – | – | – | – |
|
||
|
||
## 💾 Zálohovací schéma
|
||
|
||
```
|
||
┌────────────┐
|
||
│ Server │ rsync (denně, 03:00) → NAS /Volumes/Backups
|
||
│ /home/.../│
|
||
└────────────┘
|
||
│
|
||
▼
|
||
┌────────────┐
|
||
│ NAS │ Off-site sync (Backblaze B2, týdně)
|
||
│ /Backups/ │
|
||
└────────────┘
|
||
```
|
||
|
||
Viz `install-scripts/backup-all.sh` a `install-scripts/restore-all.sh`.
|
||
|
||
## 🔐 Bezpečnost
|
||
|
||
### Perimetrie
|
||
- **UFW** – default deny, povoleno: SSH, HTTP, HTTPS
|
||
- **fail2ban** – ban po 3 neúspěšných SSH pokusech
|
||
- **Cloudflare Tunnel** (volitelně) – přístup zvenčí bez veřejné IP
|
||
|
||
### Auth
|
||
- **SSH klíče** – hesla zakázána (`PasswordAuthentication no`)
|
||
- **2FA** – na všech web službách (Gitea, Vaultwarden, Nextcloud, …)
|
||
- **Vaultwarden** – single source of truth pro hesla
|
||
|
||
### Network
|
||
- **Bridge isolation** – služby spolu nekomunikují (default)
|
||
- **No host network** – kromě Plex (HW transkódování)
|
||
- **DNS-over-HTTPS** (volitelně)
|
||
|
||
## 🔄 Deployment workflow
|
||
|
||
```
|
||
Developer
|
||
│
|
||
├─→ git push (do Gitea)
|
||
│
|
||
├─→ Ansible (na server)
|
||
│ │
|
||
│ └─→ docker compose pull && up -d
|
||
│
|
||
└─→ Watchtower (auto, týdně)
|
||
└─→ image: pull, container: restart
|
||
```
|
||
|
||
Viz `ansible/playbooks/`.
|
||
|
||
## 📊 Monitoring
|
||
|
||
- **Watchtower** – Docker image notifikace (email/Telegram)
|
||
- **Speedtest Tracker** – internet speed
|
||
- **Nextcloud Talk** – interní chat
|
||
- **Portainer** – Docker container status
|
||
|
||
## 🛠 Maintenance
|
||
|
||
| Úkol | Jak často | Skript/Ansible |
|
||
|---|---|---|
|
||
| Backup | Denně 03:00 | `backup-all.sh` (cron) |
|
||
| Update OS | Týdně | `apt update && apt upgrade` |
|
||
| Update Docker image | Týdně (auto) | Watchtower |
|
||
| Cert renewal | Auto (Let's Encrypt 30d) | NPM interní |
|
||
| Health check | Denně | `docker ps` + alerting |
|
||
|
||
## 🔮 Roadmap
|
||
|
||
- **Kubernetes** – přechod z docker compose na k3s (1 server node, multi-workload)
|
||
- **GitOps** – ArgoCD pro plnou automatizaci
|
||
- **CI/CD** – Gitea Actions pro testování Ansible playbooks
|
||
- **Off-site backup** – Backblaze B2 s encryption
|
||
- **Monitoring stack** – Prometheus + Grafana + Loki
|
||
|
||
## 📚 Reference
|
||
|
||
- [Docker docs](https://docs.docker.com/)
|
||
- [Nginx Proxy Manager](https://nginxproxymanager.com/)
|
||
- [Ansible best practices](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html)
|
||
- [12-factor app](https://12factor.net/)
|