jerkovicl · April 7, 2020 17:04 · Apr 7, 2020 · Apr 7, 2020 · Apr 7, 2020 · Mar 14, 2020
diff --git a/docker_setup.md b/docker_setup.md
@@ -236,7 +236,7 @@ sudo apt full-upgrade
 
 * install script to use:  
 ```
-curl -vsL https://gist.githubusercontent.com/jerkovicl/b5c6fb29ccc016cf0c43991405aa4f59/raw/7c52a742b66b18e57ba23d9b9f63be6ebef17c31/home_server_docker_setup.sh | sudo bash -s
+curl -vsL https://gist.githubusercontent.com/jerkovicl/b5c6fb29ccc016cf0c43991405aa4f59/raw/923f58fe82d5f9a01e781ee6d9f8909da8fc6b17/home_server_docker_setup.sh | sudo bash -s
 ```
 * usefull aliases
 ```

diff --git a/docker_setup.md b/docker_setup.md
@@ -230,6 +230,8 @@ sudo apt full-upgrade
 
 * [10 Docker image security best practices](https://snyk.io/blog/10-docker-image-security-best-practices/)
 
+* [Docker - Lesser known tips](https://offby2.com/posts/001-docker-lesser-known-tips/)
+
 * [Check the security of your private Nextcloud server](https://scan.nextcloud.com/Check the security of your private Nextcloud server)
 
 * install script to use:  

diff --git a/docker_setup.md b/docker_setup.md
@@ -182,6 +182,14 @@ docker system prune
 docker image prune
 docker volume prune
 
+# WARNING! This will remove:
+#        - all stopped containers
+#        - all networks not used by at least one container
+#        - all volumes not used by at least one container
+#        - all images without at least one container associated to them
+#        - all build cache
+docker system prune -a --volumes
+
 // validate docker compose file
 docker-compose -f docker-compose.yml config
 

diff --git a/docker_setup.md b/docker_setup.md
@@ -195,7 +195,12 @@ usermod -aG sudo username
 chmod +x script.sh
 
 // set folder permissions
- sudo chown username:usergroup path-to-folder
+sudo chown username:usergroup path-to-folder
+
+// fix home directory folder permissions
+DIR=/home/user
+find $DIR -type d -not -path "$DIR/.ssh" -print0 | xargs -0 chmod 0775
+find $DIR -type f -not -path "$DIR/.ssh/*" -print0 | xargs -0 chmod 0664
 
 // fully update packages including dependencies
 sudo apt full-upgrade

diff --git a/traefik_docker_setup.sh b/traefik_docker_setup.sh
@@ -1,34 +0,0 @@
-#!/bin/bash
-
-# sudo -i
-#sudo su
-# install dependencies
-add-apt-repository universe
-apt-get update
-apt-get install -y apparmor-utils apt-transport-https avahi-daemon ca-certificates curl dbus jq network-manager socat software-properties-common
-# install docker
-curl -sSL https://get.docker.com | sh
-# install docker-compose
-curl -L "https://github.com/docker/compose/releases/download/1.24.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-# set permissions
-chmod +x /usr/local/bin/docker-compose
-# add user to docker group
-usermod -aG docker ${USER}
-# refresh group membership without logging , enter pass
-#su - ${USER}
-newgrp docker
-# docker and traefik folders setup
-mkdir -p ~/docker/shared/ && touch ~/docker/shared/.htpasswd
-# extra config for docker-gc image
-curl -vL https://raw.githubusercontent.com/clockworksoul/docker-gc-cron/master/compose/docker-gc-exclude -o ~/docker/shared/docker-gc-exclude
-setfacl -Rdm g:docker:rwx ~/docker
-chmod -R 775 ~/docker
-mkdir -p ~/docker/traefik/acme && touch ~/docker/traefik/acme/acme.json
-chmod 600 ~/docker/traefik/acme/acme.json
-touch ~/docker/traefik/traefik.toml
-touch ~/docker/traefik/rules.toml
-
-# create Traefix docker network
-docker network create traefik_proxy
-# install hassio
-curl -sL "https://raw.githubusercontent.com/home-assistant/hassio-installer/master/hassio_install.sh" | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -194,6 +194,9 @@ usermod -aG sudo username
 // make script executable, add #!/bin/bash at top of script
 chmod +x script.sh
 
+// set folder permissions
+ sudo chown username:usergroup path-to-folder
+
 // fully update packages including dependencies
 sudo apt full-upgrade
 ```

diff --git a/docker_setup.md b/docker_setup.md
@@ -193,6 +193,9 @@ usermod -aG sudo username
 
 // make script executable, add #!/bin/bash at top of script
 chmod +x script.sh
+
+// fully update packages including dependencies
+sudo apt full-upgrade
 ```
 * Docker bench for security
 [here](https://github.com/docker/docker-bench-security)

diff --git a/docker_setup.md b/docker_setup.md
@@ -226,4 +226,7 @@ dup() {
 ddown() {
   docker-compose -f /home/$USER/docker/$1.yml -p $1 down
 }
+fsize() {
+  du -h $1
+}
 ```
diff --git a/docker_setup.md b/docker_setup.md
@@ -157,6 +157,7 @@ exposedbydefault = false
 ```
 // Check logs for status  
 docker-compose logs -tf --tail="50" traefik
+docker-compose logs --no-color --tail=1000 CONTAINER_NAME > logs.txt
 
 // check container stats
 docker stats traefik

diff --git a/docker_setup.md b/docker_setup.md
@@ -214,7 +214,7 @@ chmod +x script.sh
 
 * install script to use:  
 ```
-curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s
+curl -vsL https://gist.githubusercontent.com/jerkovicl/b5c6fb29ccc016cf0c43991405aa4f59/raw/7c52a742b66b18e57ba23d9b9f63be6ebef17c31/home_server_docker_setup.sh | sudo bash -s
 ```
 * usefull aliases
 ```

diff --git a/docker_setup.md b/docker_setup.md
@@ -210,6 +210,8 @@ chmod +x script.sh
 
 * [10 Docker image security best practices](https://snyk.io/blog/10-docker-image-security-best-practices/)
 
+* [Check the security of your private Nextcloud server](https://scan.nextcloud.com/Check the security of your private Nextcloud server)
+
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -208,6 +208,8 @@ chmod +x script.sh
 
 * [Security Audit](https://secalerts.co/security-audit)
 
+* [10 Docker image security best practices](https://snyk.io/blog/10-docker-image-security-best-practices/)
+
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -158,6 +158,9 @@ exposedbydefault = false
 // Check logs for status  
 docker-compose logs -tf --tail="50" traefik
 
+// check container stats
+docker stats traefik
+
 // starting containers
 docker-compose -f ~/docker/docker-compose.yml up -d
 

diff --git a/docker_setup.md b/docker_setup.md
@@ -203,6 +203,8 @@ chmod +x script.sh
 
 * [Security Headers - Test your site](https://securityheaders.com/)
 
+* [Security Audit](https://secalerts.co/security-audit)
+
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -28,6 +28,7 @@ AUTH_CLIENT_ID=sdadsad // google client id
 AUTH_CLIENT_SECRET=sdasd // google client secret
 KEYCLOAK_USER=username
 KEYCLOAK_PASSWORD=password
+SLACK_WEBHOOK_URL=dada
 ```
 
 * PUID and PGID – the user ID of the linux user, who we want to run the home server apps as, and group ID of docker. 

diff --git a/docker_setup.md b/docker_setup.md
@@ -200,6 +200,8 @@ chmod +x script.sh
 
 * [Script to setup Traefik reverse-proxy in Docker with Compose](https://github.com/Starttoaster/docker-traefik)
 
+* [Security Headers - Test your site](https://securityheaders.com/)
+
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -196,9 +196,21 @@ chmod +x script.sh
 
 * [Handy docker compose cheatsheet](https://jstobigdata.com/docker-compose-cheatsheet/)
 
+* [A curated list of Docker resources and projects](https://awesome-docker.netlify.com/)
+
 * [Script to setup Traefik reverse-proxy in Docker with Compose](https://github.com/Starttoaster/docker-traefik)
 
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s
+```
+* usefull aliases
+```
+dup() {
+  docker-compose -f /home/$USER/docker/$1.yml -p $1 up -d
+}
+
+ddown() {
+  docker-compose -f /home/$USER/docker/$1.yml -p $1 down
+}
 ```
diff --git a/docker_setup.md b/docker_setup.md
@@ -24,6 +24,10 @@ DOMAINNAME=example.com
 CLOUDFLARE_EMAIL=email@example.com
 CLOUDFLARE_API_KEY=XXXXXXXXXXXX // Global API key
 PLEX_CLAIM=claim-YYYYYYYYY // get from plex.tv/claim
+AUTH_CLIENT_ID=sdadsad // google client id
+AUTH_CLIENT_SECRET=sdasd // google client secret
+KEYCLOAK_USER=username
+KEYCLOAK_PASSWORD=password
 ```
 
 * PUID and PGID – the user ID of the linux user, who we want to run the home server apps as, and group ID of docker. 

diff --git a/docker_setup.md b/docker_setup.md
@@ -79,8 +79,8 @@ defaultEntryPoints = ["https", "http"]
   [entryPoints.https]
   address = ":443"
     [entryPoints.https.tls]
-    MinVersion = "VersionTLS12"
-    CipherSuites = ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"]
+    minVersion = "VersionTLS12"
+    cipherSuites = ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"]
   [entryPoints.monitor]
   address = ":8081"
 

diff --git a/docker_setup.md b/docker_setup.md
@@ -79,6 +79,10 @@ defaultEntryPoints = ["https", "http"]
   [entryPoints.https]
   address = ":443"
     [entryPoints.https.tls]
+    MinVersion = "VersionTLS12"
+    CipherSuites = ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"]
+  [entryPoints.monitor]
+  address = ":8081"
 
 [file]
   watch = true

diff --git a/docker_setup.md b/docker_setup.md
@@ -177,6 +177,7 @@ sudo netstat -tulpn | grep LISTEN
 
 // add non root user to sudo group
 usermod -aG sudo username
+
 // make script executable, add #!/bin/bash at top of script
 chmod +x script.sh
 ```

diff --git a/docker_setup.md b/docker_setup.md
@@ -169,6 +169,9 @@ docker system prune
 docker image prune
 docker volume prune
 
+// validate docker compose file
+docker-compose -f docker-compose.yml config
+
 // check all running ports
 sudo netstat -tulpn | grep LISTEN
 

diff --git a/docker_setup.md b/docker_setup.md
@@ -180,11 +180,9 @@ chmod +x script.sh
 * Docker bench for security
 [here](https://github.com/docker/docker-bench-security)
 
-* Turn docker run command to docker compose snippet:
-[Composerize](https://Composerize.com)
+* [Turn docker run command to docker compose snippet](https://Composerize.com)
 
-* Handy docker compose cheatsheet
-[Cheatsheet](https://jstobigdata.com/docker-compose-cheatsheet/)
+* [Handy docker compose cheatsheet](https://jstobigdata.com/docker-compose-cheatsheet/)
 
 * [Script to setup Traefik reverse-proxy in Docker with Compose](https://github.com/Starttoaster/docker-traefik)
 

diff --git a/docker_setup.md b/docker_setup.md
@@ -183,6 +183,11 @@ chmod +x script.sh
 * Turn docker run command to docker compose snippet:
 [Composerize](https://Composerize.com)
 
+* Handy docker compose cheatsheet
+[Cheatsheet](https://jstobigdata.com/docker-compose-cheatsheet/)
+
+* [Script to setup Traefik reverse-proxy in Docker with Compose](https://github.com/Starttoaster/docker-traefik)
+
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -178,7 +178,11 @@ usermod -aG sudo username
 chmod +x script.sh
 ```
 * Docker bench for security
-> https://github.com/docker/docker-bench-security
+[here](https://github.com/docker/docker-bench-security)
+
+* Turn docker run command to docker compose snippet:
+[Composerize](https://Composerize.com)
+
 * install script to use:  
 ```
 curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s

diff --git a/docker_setup.md b/docker_setup.md
@@ -180,4 +180,6 @@ chmod +x script.sh
 * Docker bench for security
 > https://github.com/docker/docker-bench-security
 * install script to use:  
-`curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s`
+```
+curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s
+```
diff --git a/docker_setup.md b/docker_setup.md
@@ -179,5 +179,5 @@ chmod +x script.sh
 ```
 * Docker bench for security
 > https://github.com/docker/docker-bench-security
-* install script to use:
-``
+* install script to use:  
+`curl -vsL https://gist.githubusercontent.com/jerkovicl/c31d1a0323f2e9104e4fae8eadf9c7f7/raw/3d5dc9040219b4095f75ada40e5ae31aa6503400/traefik_docker_setup.sh | bash -s`
diff --git a/docker_setup.md b/docker_setup.md
@@ -179,3 +179,5 @@ chmod +x script.sh
 ```
 * Docker bench for security
 > https://github.com/docker/docker-bench-security
+* install script to use:
+``
No results found