After my previous posts, I wanted to setup a new server, using my new docker-compose setup and do it right this time.

SSH Keys

One of the security features I want to use, is to only allow login using SSH keys. Therefore I’m going to start generating some keys and then upload them to the server.

1

ssh-keygen -t rsa

This will ask you where to save the keys. I use the default location of `~/.ssh/id_rsa`. Next we enter a passphrase, this could be omittet if we want the key to be all we need to login. I don’t mind the extra security, so enter some password to pair the key with. This password is needed everytime you login with the key.

Setup

Cypht is one of the newer containers I’m running and I love it. I am tired of running multiple mail clients everywhere (Thunderbird at work, Outlook on Windows, Mail on Mac and so on). With Cypht I can log in to my to one webmail and see all my IMAP/POP mail accounts one place.

It is not too difficuelt to setup but one thing to keep in mind is to always save changes you make in the webinterface. By default everything is purged when you logout. This is not ideal for me, since I don’t want to have to setup everything again.

Setup

Wallabag is a very useful bookmark app, where I stop all my bookmarks. It has a simple iOS app (with extension) and a Firefox plugin. Wallabag uses sqlite to store its database, which makes it even easier to work with in docker.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

version: "3"
services:
  wallabag:
    container_name: wallabag
    image: wallabag/wallabag
    volumes:
      - ${PWD}/data:/var/www/wallabag/data
      - ${PWD}/images:/var/www/wallabag/web/assets/images
    environment:
      - SYMFONY__ENV__FOSUSER_REGISTRATION=false
      - SYMFONY__ENV__DOMAIN_NAME=https://wallabag.domain.com
      - SYMFONY__ENV__FOSUSER_CONFIRMATION=false
    labels:
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:wallabag.domain.com"
networks:
  default:
    external:
      name: webproxy

Since I just want this for myself, I disable user registration and I also don’t need user confirmation. Rest is pretty much the same as before.

Setup

Bookstack is one of the best selfhosted ‘wiki’ sites and it is dead easy to setup. Bookstack uses a mysql container to store the data and a webcontainer to have the site on. I like to keep my sql containers seperate and se we change the default port from `3306` to `3311`. This is just random, but i normally start my sql containers at `3310` and then work my way up.

Setup

I’ve been a big fan of Firefly III for some time now. I was a pain to setup the first time, so here is my ’easy’ way to set it up.

My docker compose file is about the same as the previous ones.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

version: "3"

services:
  firefly_iii_app:
    container_name: firefly_iii_app
    image: jc5x/firefly-iii:latest
    environment:
      - FF_DB_HOST=firefly_iii_db:3306
      - FF_DB_NAME=firefly_db
      - FF_DB_USER=firefly_db
      - FF_DB_PASSWORD=<dbpassword>
      - FF_APP_KEY=<32char key>
      - FF_APP_ENV=local
      - APP_URL=https://firefly.domain.com
      - TRUSTED_PROXIES=**
      - MAIL_DRIVER=smtp
      - MAIL_HOST=<email server>
      - MAIL_PORT=587
      - MAIL_FROM=firefly@domain.com
      - MAIL_USERNAME=firefly@domain.com
      - MAIL_PASSWORD=<password>
      - MAIL_ENCRYPTION=tls
    links:
      - firefly_iii_db
    volumes:
      - ${PWD}/export:/var/www/firefly-iii/storage/export
      - ${PWD}/upload:/var/www/firefly-iii/storage/upload
    labels:
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:firefly.domain.com"
      - "traefik.port=80"
  firefly_iii_db:
    container_name: firefly_iii_db
    image: mysql:latest
    ports:
      - 3310:3306
    environment:
      - MYSQL_DATABASE=firefly_db
      - MYSQL_USER=firefly_db
      - MYSQL_PASSWORD=<dbpassword>
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
    volumes:
      - ${PWD}/mysql:/var/lib/mysql
    labels:
      - "traefik.enable=false"

networks:
  default:
    external:
      name: webproxy

Nothing here should be new. We use a new mysql port, so we wont create conflicts when all our sql containers use port 3306. I don’t really want the sql container to be available from any subdomain, so we don’t need it to be traefik enabled.

Setup

From my previous post, I am using a docker folder structure like `/home/<username>/Docker/<container>` to store my data and docker-compose files. So first make the Portainer folder

1
2
3

cd ~/Docker
mkdir portainer && cd portainer
vi docker-compose.yml

Next we take the basic template from before and setup our Portainer container.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

version: "3"
services:
  portainer:
    container_name: portainer
    image: portainer/portainer
    command: -H unix:///var/run/docker.sock
    ports:
      - 9000:9000
    volumes:
      - ${PWD}/data:/data
    labels:
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:portainer.domain.com"
      - "traefik.port=9000"

So a few things I learned while setting up Portainer is that, in my last post, all my containers (traefik and whoami) were in the same docker-compose file. Therefore they used the same network interface. This isn’t true anymore as Portainer has its own file and we need to create a seperate network for all the containers to use together.