Frank
ec03929d95
Grafana leaves the exempt-by-construction set: grafana.franksdank.cloud now terminates at the Anubis guard (anubis:8923) and authenticated traffic returns at the internal :8017 listener, where an @grafana Host handler proxies through to grafana:3000 with the outpost-proxy trust token (GRAFANA_PROXY_TOKEN = client_id_client_secret of the new 'grafana-proxy' ProxyProvider on the embedded outpost; created via ak shell before this route flip — provider-first ordering per the External Exposure Policy). The Grafana admin account is intentionally kept: auth.proxy in auto-upsert mode only creates non-admin users, so the local admin remains the only way to administer Grafana. The old edge-basicauth wrapper is retired (shared family password, no per-user audit trail). - Caddyfile: grafana vhost flipped to the guarded chain; @grafana handler added at the :8017 return listener. - compose.yaml: GF_AUTH_PROXY_ENABLED/HEADERS/TOKEN on the grafana service (auth_proxy trusted-proxy CIDRs left at the image default — the proxying Caddy container is not statically addressable on 10.89.0.0/24, so Grafana trusts any in-network source and relies on the token as the capability). - .env.example: GRAFANA_PROXY_TOKEN placeholder so test env_consistency keeps guarding the compose<->env contract.
64 lines
2.6 KiB
Bash
64 lines
2.6 KiB
Bash
# Dankclaw stack secrets and configuration.
|
|
# Copy to .env and fill real values. Never commit real secrets.
|
|
|
|
# SearXNG
|
|
SEARXNG_SECRET=changeme
|
|
SEARXNG_BASE_URL=http://search.franksdank.cloud/
|
|
|
|
# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
|
|
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
|
|
VPN_SERVICE_PROVIDER=protonvpn
|
|
VPN_TYPE=wireguard
|
|
WIREGUARD_PRIVATE_KEY=changeme
|
|
WIREGUARD_ADDRESSES=0.0.0.0/32
|
|
WIREGUARD_PUBLIC_KEY=changeme
|
|
WIREGUARD_ENDPOINT_IP=0.0.0.0
|
|
WIREGUARD_ENDPOINT_PORT=51820
|
|
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
|
|
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
|
|
|
|
# Gitea database
|
|
GITEA_DB_PASSWORD=changeme
|
|
|
|
# Grafana auth-proxy trust token. The outpost proxy provider 'grafana-proxy'
|
|
# forwards authenticated traffic to Grafana with Authorization: Bearer
|
|
# <client_id>_<client_secret>; the live .env must set this to that exact
|
|
# concatenation (provider created via ak shell on authentik-server).
|
|
GRAFANA_PROXY_TOKEN=changeme
|
|
|
|
# Caddy (the homelab's single reverse proxy, on this host)
|
|
# bcrypt hash (caddy hash-password). deploy.sh renders it into
|
|
# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
|
|
# CADDY_BASICAUTH_HASH: the shared family password, now used only by the
|
|
# pihole vhost (grafana moved behind the Authentik guard chain 2026-09-01).
|
|
# Username: dankuser.
|
|
CADDY_BASICAUTH_HASH=changeme
|
|
# (The homepage's per-user hashes were retired: the homepage and its /admin/
|
|
# page are now behind Authentik forward_auth, not basicauth.)
|
|
|
|
# Hermes -> Signal (signal-cli daemon on the host, port 8080)
|
|
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
|
|
SIGNAL_ACCOUNT=+15551234567
|
|
# Comma-separated E.164 numbers allowed to message the agent.
|
|
SIGNAL_ALLOWED_USERS=+15551234567
|
|
|
|
# Hermes web UI (Hermex server) login password. Required: the webui binds to
|
|
# loopback and is reached only through the SSH tunnel, but Hermex still signs
|
|
# in with this password. Set a strong value in the live .env.
|
|
HERMES_WEBUI_PASSWORD=changeme
|
|
|
|
# Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
|
|
# for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
|
|
# account-wide; rotate them here rather than in the dashboard.
|
|
# PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
|
|
PORKBUN_API_KEY=changeme
|
|
PORKBUN_API_SECRET_KEY=changeme
|
|
|
|
# Authentik (SSO / OIDC provider)
|
|
# AUTHENTIK_PG_PASS: the PostgreSQL password for authentik-postgres.
|
|
# Generate: openssl rand -base64 32
|
|
AUTHENTIK_PG_PASS=changeme
|
|
# AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
|
|
# Generate: openssl rand -base64 48
|
|
AUTHENTIK_SECRET_KEY=changeme
|