mediahost docker backup

add gite to shared proxy
add usb dev and NET privilige to HA
add immich image server
remove sonarr-en
add jackett indexer for ABB
add gluetun-proxy for general proxy
add blackbox exporter to check https sites
set node-exporter to network host to see interface traffic
decrease resolution of cadvisor to save RAM
add status and code SANs for nginx
add upstream block so sites are not redirecte to cloud...
add homeassistant config
add nginx exporter for prometheus

docker_compose/mediahost/nginx/conf.d/reverseProxy.conf

@@ -17,7 +17,8 @@ server {
         passwd.someoneslinux.selfhost.eu
         requests.someoneslinux.selfhost.eu
         torrent.someoneslinux.selfhost.eu
-        status.someoneslinux.selfhost.eu;    
+        status.someoneslinux.selfhost.eu    
+        code.someoneslinux.selfhost.eu;    
     #ssl_conf_command Groups X25519:secp256r1:secp384r1;
 #    ssl_conf_command Groups X25519:prime256v1:secp384r1;
     location /.well-known/acme-challenge/ {
@@ -27,12 +28,28 @@ server {
 
     location / {
         return 301 https://$host$request_uri;
+
+    }
+
+    listen 8080;
+    location /nginx_status {
+        stub_status;
+        allow 172.16.0.0/12;
+        deny all;
     }
 }
 
 # Common SSL settings
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers on;
+server {
+    listen 443 ssl default_server;
+    server_name _;
+
+    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
+    return 404;
+}
 
 ###################
 # NEXTCLOUD
@@ -51,6 +68,8 @@ server {
 
     location / {
         proxy_pass http://nextcloud:80;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto https;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -76,6 +95,8 @@ server {
 
     location / {
         proxy_pass http://jellyfin:8096;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -103,6 +124,8 @@ server {
 
     location / {
         proxy_pass http://audiobookshelf:80;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -112,40 +135,14 @@ server {
     }
 }
 
-###################
-# AUTHENTIK
-###################
-server {
-    listen 443 ssl;http2 on;
-    server_name login.someoneslinux.selfhost.eu;
-
-    add_header Content-Security-Policy "frame-ancestors 'self';" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
-    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
-
-    location / {
-        proxy_pass http://authentik-server-1:9000;
-        proxy_http_version 1.1;
-        
-        proxy_set_header X-Forwarded-Proto https;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}
-
 ####################
-## HOME ASSISTANT
+## AUTHENTIK
 ####################
 #server {
 #    listen 443 ssl;http2 on;
-#    server_name auto.someoneslinux.selfhost.eu;
+#    server_name login.someoneslinux.selfhost.eu;
 #
-#    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
+#    add_header Content-Security-Policy "frame-ancestors 'self';" always;
 #    add_header X-Frame-Options "SAMEORIGIN" always;
 #    add_header X-Content-Type-Options "nosniff" always;
 #    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -155,17 +152,45 @@ server {
 #    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
 #
 #    location / {
-#        proxy_pass http://192.168.0.4:8123;
+#        proxy_pass http://authentik-server-1:9000;
 #        proxy_http_version 1.1;
-#
-#        proxy_set_header Host $host;
-#        proxy_set_header Upgrade $http_upgrade;
-#        proxy_set_header Connection $connection_upgrade;
-#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+#        
 #        proxy_set_header X-Forwarded-Proto https;
+#        proxy_set_header X-Forwarded-Host $host;
+#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 #    }
 #}
 
+###################
+# HOME ASSISTANT
+###################
+server {
+    listen 443 ssl;http2 on;
+    server_name auto.someoneslinux.selfhost.eu;
+
+#    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
+
+    location / {
+        proxy_pass http://192.168.0.4:8123;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}
+
 ###################
 # NAVIDROME
 ###################
@@ -184,6 +209,8 @@ server {
     location / {
         proxy_pass http://navidrome:4533;
 
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto https;
         proxy_set_header X-Real-IP $remote_addr;
@@ -208,6 +235,8 @@ server {
 
     location / {
         proxy_pass http://vaultwarden:80;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
 
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Proto https;
@@ -216,6 +245,8 @@ server {
 
     location /notifications/hub {
         proxy_pass http://vaultwarden:3012;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Upgrade $http_upgrade;
@@ -240,6 +271,8 @@ server {
 
     location / {
         proxy_pass http://seerr:5055;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -268,6 +301,8 @@ server {
 
     location / {
         proxy_pass http://192.168.0.2:8080;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
  
         proxy_set_header Host $host;
@@ -275,6 +310,7 @@ server {
         proxy_set_header Connection $connection_upgrade;
         proxy_set_header X-Forwarded-Proto https;
     }
+
 }
 
 ###################
@@ -294,6 +330,8 @@ server {
 
     location / {
         proxy_pass http://grafana:3000;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
         proxy_http_version 1.1;
 
         proxy_set_header Host $host;
@@ -302,3 +340,33 @@ server {
         proxy_set_header X-Forwarded-Proto https;
     }
 }
+
+###################
+# GITEA
+###################
+server {
+    listen 443 ssl;http2 on;
+    server_name code.someoneslinux.selfhost.eu;
+
+    add_header Content-Security-Policy "frame-ancestors 'self';" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        # Do not try another upstream on errors
+        proxy_next_upstream off;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}

docker_compose/mediahost/nginx/docker-compose.yaml

@@ -3,11 +3,9 @@ services:
     image: nginx:stable
     container_name: nginx
     restart: unless-stopped
-
     ports:
       - "80:80"
       - "443:443"
-
     volumes:
       - ./conf.d:/etc/nginx/conf.d
       - ./certs:/etc/nginx/certs
@@ -15,8 +13,23 @@ services:
       # Access and error logs
       - ./logs:/var/log/nginx
     networks:
+      - default
       - shared-proxy-services
 
+  nginx-exporter:
+    image: nginx/nginx-prometheus-exporter:latest
+    container_name: nginx-exporter
+    restart: unless-stopped
+    command:
+      - --nginx.scrape-uri=http://nginx:8080/nginx_status
+    ports:
+      - "9113:9113"
+    depends_on:
+      - nginx
+    networks:
+      - default
+      - shared-proxy-services
+  
   crowdsec:
     image: crowdsecurity/crowdsec:latest
     container_name: crowdsec
@@ -29,7 +42,8 @@ services:
       - crowdsec-db:/var/lib/crowdsec/data
       - ./logs:/var/log/nginx:ro
       - /etc/localtime:/etc/localtime:ro
-
+    networks:
+      - default
 
   certbot:
     image: certbot/certbot:latest
@@ -41,7 +55,9 @@ services:
       - shared-proxy-services
 
 networks:
+  default:
   shared-proxy-services:
     external: true
+
 volumes:
   crowdsec-db: