From 147434e20b52d7aecf179481906326ab99552f9a Mon Sep 17 00:00:00 2001 From: Mikkel Georgsen Date: Fri, 13 Feb 2026 01:35:00 +0000 Subject: [PATCH] feat: add nexus container (CT 117) and document Tailscale LXC setup - Create nexus LXC (Ubuntu 24.04, 4 cores, 4GB RAM, 40GB, 10.5.0.17) - Configure Tailscale with SSH on nexus (100.126.46.74) - Document standard Tailscale-on-LXC procedure in CLAUDE.md (TUN device, SSH port 2222, socket activation override) - Add Obsidian/CouchDB stack, Stalwart mail helper, and other doc updates - Add dns-services, obsidian, pve-homelab-kit, stalwart config dirs Co-Authored-By: Claude Opus 4.6 --- CLAUDE.md | 55 ++++++++++++++++++++++++++++++++++++- dns-services/credentials | 2 ++ homelab-documentation.md | 58 +++++++++++++++++++++++++++++++++++++--- obsidian/credentials | 7 +++++ pve-homelab-kit | 1 + stalwart/credentials | 3 +++ 6 files changed, 121 insertions(+), 5 deletions(-) create mode 100644 dns-services/credentials create mode 100644 obsidian/credentials create mode 160000 pve-homelab-kit create mode 100644 stalwart/credentials diff --git a/CLAUDE.md b/CLAUDE.md index 3969fdc..6804513 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -118,6 +118,24 @@ The `~/bin/kuma` script manages Uptime Kuma monitors: ~/bin/kuma resume # Resume monitor ``` +## Stalwart Mail Server + +The `~/bin/mail` script manages Stalwart Mail Server (VM 200, 65.108.14.164): +```bash +~/bin/mail list # List all mail accounts +~/bin/mail info # Show account details +~/bin/mail create [name] # Create new mail account +~/bin/mail delete # Delete mail account +~/bin/mail passwd # Change account password +~/bin/mail domains # List configured domains +~/bin/mail status # Show server status/version +``` + +**Active domain:** datalos.dk +**Admin UI:** https://mail.georgsen.dk +**Webmail:** https://webmail.georgsen.dk (Snappymail on Dockge) +**Credentials:** `~/homelab/stalwart/credentials` + ## Service Updates The `~/bin/updates` script checks for and applies updates across all homelab services: @@ -126,7 +144,7 @@ The `~/bin/updates` script checks for and applies updates across all homelab ser ~/bin/updates update [-y] # Update one or more services ``` -**Tracked services:** dragonfly, beszel, uptime-kuma, snappymail, dockge, npm, forgejo, dns, pbs +**Tracked services:** dragonfly, beszel, uptime-kuma, snappymail, stalwart, dockge, npm, forgejo, dns, pbs Checks Docker image versions (Dockge + NPM), LXC service binaries (Forgejo, Technitium DNS), and apt packages (PBS) against GitHub/Codeberg releases. @@ -230,6 +248,41 @@ ssh root@10.5.0.254 'pct exec -- setcap cap_net_raw+ep /bin/ping' Note: Must be re-applied after `iputils-ping` package upgrades. +**Tailscale on LXC containers:** + +When setting up Tailscale with `--ssh` on an unprivileged LXC container: + +1. Stop the container and add TUN device access to `/etc/pve/lxc/.conf` on the PVE host: + ``` + lxc.cgroup2.devices.allow: c 10:200 rwm + lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file + ``` + +2. Start the container, install and enable Tailscale: + ```bash + curl -fsSL https://tailscale.com/install.sh | sh + systemctl start tailscaled + tailscale up --ssh + ``` + +3. Move local SSH to port 2222 (Tailscale SSH takes port 22): + ```bash + # Update sshd_config + sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config + + # Override ssh.socket (Ubuntu 24.04 uses socket activation) + mkdir -p /etc/systemd/system/ssh.socket.d + cat > /etc/systemd/system/ssh.socket.d/override.conf << EOF + [Socket] + ListenStream= + ListenStream=2222 + EOF + systemctl daemon-reload + systemctl restart ssh.socket ssh.service + ``` + +After setup: local SSH via `ssh -p 2222 user@`, Tailscale SSH via `ssh user@`. + ## CRITICAL: Software Versions **NEVER use version numbers from training data.** Always fetch the latest version dynamically: diff --git a/dns-services/credentials b/dns-services/credentials new file mode 100644 index 0000000..f4d6885 --- /dev/null +++ b/dns-services/credentials @@ -0,0 +1,2 @@ +DNS_SERVICES_USER='msgeorgsen@gmail.com' +DNS_SERVICES_PASS='Vy7aWzQeS&pg3Du#MXcKQCi!' diff --git a/homelab-documentation.md b/homelab-documentation.md index 45bf38c..e9305ef 100644 --- a/homelab-documentation.md +++ b/homelab-documentation.md @@ -123,10 +123,11 @@ Saved with: `netfilter-persistent save` | Type | VM (KVM) | | IP | 65.108.14.164 (dedicated public IP) | | Bridge | vmbr0 (direct) | -| Software | Stalwart Mail Server | +| Software | Stalwart Mail Server 0.15.4 | +| Disk | 32GB | | Webmail | Snappymail (via dockge) | -**Current domains:** dataloes.dk (building reputation before adding more) +**Active domain:** datalos.dk **Planned domains:** georgsen.dk, microsux.dk, dataloes.dk @@ -154,6 +155,7 @@ Saved with: `netfilter-persistent save` | 114 | forgejo | 10.5.0.14 | Git server (Forgejo) | Running | | 115 | dns | 10.5.0.2 | DNS server (Technitium) | Running | | 116 | lisotex | 10.5.0.116 | lisotex.dk website | Running | +| 117 | nexus | 10.5.0.17 | Nexus (Tailscale SSH) | Running | | 120 | debate-builder | 10.5.0.171 | Debate builder app (KVM) | Running | | 1000 | tailscale | 10.5.0.134 + 10.9.1.10 | Tailscale relay | Running | @@ -189,6 +191,9 @@ cd /opt/npm && docker compose pull && docker compose up -d | status.georgsen.dk | http://10.5.0.10:3001 | Let's Encrypt | | webmail.georgsen.dk | http://10.5.0.10:8888 | Let's Encrypt | | dashboard.georgsen.dk | http://10.5.0.10:8090 | Let's Encrypt | +| obsidian.georgsen.dk | http://10.5.0.10:8280 | Let's Encrypt | +| obs.georgsen.dk | http://10.5.0.10:8280 | Let's Encrypt | +| obsidian-sync.georgsen.dk | http://10.5.0.10:5984 | Let's Encrypt | #### 101: Dockge @@ -248,6 +253,27 @@ services: command: ["--requirepass", "nUq/IfoIQJf/kouckKHRQOk7vV0NwCuI"] # Password: nUq/IfoIQJf/kouckKHRQOk7vV0NwCuI # Connect: redis-cli -h 10.5.0.10 -p 6379 -a 'nUq/IfoIQJf/kouckKHRQOk7vV0NwCuI' + +# Obsidian (web-based editor + LiveSync) +services: + obsidian: + image: lscr.io/linuxserver/obsidian:latest + container_name: obsidian + ports: + - 8280:3000 + - 8281:3001 + volumes: + - ./obsidian-config:/config + couchdb: + image: couchdb:latest + container_name: couchdb-livesync + ports: + - 5984:5984 + volumes: + - ./couchdb-data:/opt/couchdb/data + - ./couchdb-etc:/opt/couchdb/etc/local.d +# CouchDB credentials: ~/homelab/obsidian/credentials +# LiveSync database: obsidian-livesync ``` #### 105: Sentry (Defense Intelligence) @@ -424,6 +450,7 @@ Requires=mnt-synology.mount | xanderryzen | 100.71.118.78 | | | nvr01 | 100.118.17.103 | Exit node | | tailscalemg | 100.115.101.65 | Exit node | +| nexus | 100.126.46.74 | | **Tailscale config:** SSH enabled on all devices where possible @@ -457,6 +484,7 @@ Requires=mnt-synology.mount | dockge | 10.5.0.10 | | forgejo | 10.5.0.14 | | git | 10.5.0.14 | +| nexus | 10.5.0.17 | | mgmt | 10.5.0.108 | | postgresql01 | 10.5.0.109 | | pve-scripts | 10.5.0.110 | @@ -467,6 +495,9 @@ Requires=mnt-synology.mount | sentry | 10.5.0.168 | | debate-builder | 10.5.0.171 | | jukebox | 10.5.0.184 | +| obsidian | 10.5.0.10 | +| obs | 10.5.0.10 | +| obsidian-sync | 10.5.0.10 | --- @@ -520,6 +551,23 @@ chown -R mikkel:georgsen /home/mikkel/.ssh setcap cap_net_raw+ep /bin/ping ``` +### Tailscale in LXC Containers + +Unprivileged LXC containers need TUN device access for Tailscale. Add to the container config on the PVE host (`/etc/pve/lxc/.conf`): + +``` +lxc.cgroup2.devices.allow: c 10:200 rwm +lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file +``` + +Container must be stopped before adding these lines. Then inside the container: + +```bash +curl -fsSL https://tailscale.com/install.sh | sh +systemctl start tailscaled +tailscale up --ssh +``` + --- ## Projects @@ -560,7 +608,7 @@ Personal company website | ID | Name | IPs | Applied To | |----|------|-----|------------| -| 1 | home_only | 83.89.248.247 | dns.georgsen.dk, dockge.georgsen.dk, pbs.georgsen.dk | +| 1 | home_only | 83.89.248.247 | dns.georgsen.dk, dockge.georgsen.dk, pbs.georgsen.dk, obsidian.georgsen.dk, obs.georgsen.dk, obsidian-sync.georgsen.dk | ### Fail2ban @@ -616,6 +664,8 @@ Personal company website | Webmail | https://webmail.georgsen.dk | | JukeBox | https://jukebox.georgsen.dk | | Dashboard | https://dashboard.georgsen.dk or http://10.5.0.10:8090 | +| Obsidian | https://obsidian.georgsen.dk or http://10.5.0.10:8280 | +| Obsidian Sync | https://obsidian-sync.georgsen.dk or http://10.5.0.10:5984 | ### Important IPs @@ -743,4 +793,4 @@ Personal company website --- -*Last updated: 2026-01-28* +*Last updated: 2026-02-12* diff --git a/obsidian/credentials b/obsidian/credentials new file mode 100644 index 0000000..e1c30b1 --- /dev/null +++ b/obsidian/credentials @@ -0,0 +1,7 @@ +CouchDB LiveSync Credentials +============================= +URL: http://10.5.0.10:5984 +Public URL: https://obsidian-sync.georgsen.dk +Database: obsidian-livesync +Username: obsidian +Password: nmJdWsRCPY49lPWl4NVKuKeF diff --git a/pve-homelab-kit b/pve-homelab-kit new file mode 160000 index 0000000..96dc1eb --- /dev/null +++ b/pve-homelab-kit @@ -0,0 +1 @@ +Subproject commit 96dc1eb4994ef12ac538782f0da1aa736d7dfb27 diff --git a/stalwart/credentials b/stalwart/credentials new file mode 100644 index 0000000..83c6f2f --- /dev/null +++ b/stalwart/credentials @@ -0,0 +1,3 @@ +STALWART_URL=https://mail.georgsen.dk +STALWART_ADMIN_USER=admin +STALWART_ADMIN_PASS=NfDB1p7rxqVGH8nPTPmK