bb2b5b5e22
Three workflows that connect the services from episodes 1 to 7: a Forgejo push becomes a phone notification, an Uptime Kuma outage writes and closes its own incident page in Outline, and a nightly schedule writes one ops digest. The point of the episode is the split between webhooks and the editor. Caddy publishes only the webhook path prefixes under the n8n host and answers an empty 404 for everything else, so the editor stays reachable over the mesh from episode 5 and never gets a login page on the open internet. Also in here: - n8n pinned to a version instead of :latest, after episode 7 showed that every restore is otherwise an upgrade - the 2.x environment that actually matters, including the file access restriction pointed at one directory rather than the root - the Forgejo allowed host list, without which a webhook to a private address is silently dropped - fixed subnets for both docker networks, after a restore handed them out in the other order and quietly broke the mesh route - a note on the encryption key: it decrypts every stored credential, it lives in the n8n volume, and a backup without it restores a hub that cannot log in Claude-Session: https://claude.ai/code/session_01Md8yhBKp5e7xMmCyxoEgdm
72 lines
3.1 KiB
Text
72 lines
3.1 KiB
Text
# ~$ selfhostedops — copy me: cp .env.example .env
|
|
# Generate secrets with: openssl rand -hex 32
|
|
|
|
# Your base domain. Services live at git.* wiki.* vault.* status.* ntfy.* vpn.*
|
|
# DNS: one wildcard A (and AAAA) record *.ops.example.com -> your server IP
|
|
DOMAIN=ops.example.com
|
|
|
|
# Let's Encrypt notifications + expiry mails
|
|
ACME_EMAIL=you@example.com
|
|
|
|
TZ=Europe/Berlin
|
|
|
|
# --- Outline ---
|
|
OUTLINE_PG_PASSWORD=CHANGE_ME_openssl_rand_hex_32
|
|
OUTLINE_SECRET_KEY=CHANGE_ME_openssl_rand_hex_32
|
|
OUTLINE_UTILS_SECRET=CHANGE_ME_openssl_rand_hex_32
|
|
# From Forgejo: Site Administration -> Applications -> OAuth2
|
|
# Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback
|
|
OUTLINE_OIDC_CLIENT_ID=
|
|
OUTLINE_OIDC_CLIENT_SECRET=
|
|
|
|
# --- Vaultwarden ---
|
|
# Admin panel token (argon2 hash recommended, plain string works to start)
|
|
VAULTWARDEN_ADMIN_TOKEN=CHANGE_ME_openssl_rand_hex_32
|
|
# Flip to false once your team has signed up:
|
|
VAULTWARDEN_SIGNUPS_ALLOWED=true
|
|
# Single sign-on against your own Forgejo (episode 4).
|
|
# From Forgejo: Site Administration -> Applications -> OAuth2 Application
|
|
# Redirect URI must be EXACTLY: https://vault.<DOMAIN>/identity/connect/oidc-signin
|
|
VAULTWARDEN_SSO_CLIENT_ID=
|
|
VAULTWARDEN_SSO_CLIENT_SECRET=
|
|
|
|
# --- wg-easy (optional, --profile vpn) ---
|
|
# Generate with: docker run --rm ghcr.io/wg-easy/wg-easy wgpw 'yourpassword'
|
|
WGEASY_PASSWORD_HASH=
|
|
|
|
# --- CI (episode 2, optional: docker compose --profile ci up -d) ---
|
|
# One shared secret registers the runner declaratively. Generate it with:
|
|
# openssl rand -hex 20
|
|
# Then derive the UUID Forgejo will know it by:
|
|
# python3 -c 'import uuid,sys;print(uuid.UUID(bytes=sys.argv[1][:16].encode()))' <secret>
|
|
# And register it on the Forgejo side:
|
|
# docker compose exec -u git forgejo forgejo forgejo-cli actions register \
|
|
# --name box-runner --labels docker --secret <secret>
|
|
# A registration token copied from the web UI does NOT work here.
|
|
RUNNER_SECRET=
|
|
RUNNER_UUID=
|
|
|
|
|
|
# --- ntfy push notifications (episode 6) ---
|
|
# No secrets here: ntfy keeps its users in its own database. Create them once:
|
|
# docker compose exec -e NTFY_PASSWORD=<pw> ntfy ntfy user add --role=user kuma
|
|
# docker compose exec ntfy ntfy access kuma alerts write-only
|
|
# See monitoring/README.md for the full walkthrough.
|
|
|
|
# --- n8n automation (episode 8) ---
|
|
# No variables needed here either: the workflows keep their credentials inside
|
|
# n8n, encrypted with the key in /home/node/.n8n/config. That file is inside the
|
|
# n8n_data volume and therefore inside the nightly backup from episode 7.
|
|
#
|
|
# If you would rather pin the key yourself (recommended once more than one
|
|
# person can restore this box), uncomment the line below and put the same value
|
|
# in your password manager. It wins over the file, and the file is then never
|
|
# written. Changing it later makes every existing credential undecryptable.
|
|
# openssl rand -base64 24
|
|
# N8N_ENCRYPTION_KEY=
|
|
#
|
|
# The ntfy user the workflows publish as:
|
|
# docker compose exec -e NTFY_PASSWORD=<pw> ntfy ntfy user add --role=user n8n
|
|
# docker compose exec ntfy ntfy access n8n alerts write-only
|
|
# docker compose exec ntfy ntfy access n8n deploys write-only
|
|
# See automation/README.md for the rest.
|