rufusking/infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update server_nas16.md

Browse source
This commit is contained in:
rufusking 2026-07-26 22:14:54 -04:00
parent 48d1219bd3
commit 21bc176d01
1 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
server_nas16.md
View file

@ -4,7 +4,7 @@ Hostname: **NAS16**
IP Address: **192.168.150.40** IP Address: **192.168.150.40**
VLAN: **50 — Lab / Servers** VLAN: **50 — Lab / Servers**
Last Updated: 2026-06-24 Last Updated: 2026-07-26
--- ---
@ -13,7 +13,7 @@ NAS16 is the **dedicated LAMP stack and database server** for the KingDezigns ne
It runs **OpenMediaVault (OMV)** as its base OS, which manages nginx as the web GUI frontend. It runs **OpenMediaVault (OMV)** as its base OS, which manages nginx as the web GUI frontend.
It provides backend services, web hosting, and database support for internal applications, development environments, and externally accessible virtual host websites. It provides backend services, web hosting, and database support for internal applications, development environments, and externally accessible virtual host websites.
In addition to its LAMP role, NAS16 hosts the **CrowdSec external notification system** — a pair of scripts that poll the CrowdSec LAPI on HAS and deliver split email alerts based on ban origin. In addition to its LAMP role, NAS16 hosts the **CrowdSec external notification system** — a pair of scripts that poll the CrowdSec LAPI on HAS and deliver split email alerts based on ban origin — and, as of 2026-07-26, **Forgejo**, the self-hosted Git server for the KingDezigns network.
This system is designed for: This system is designed for:
- Web application hosting (internal and external) - Web application hosting (internal and external)
@ -22,6 +22,7 @@ This system is designed for:
- Lightweight administrative tools (Webmin via OMV) - Lightweight administrative tools (Webmin via OMV)
- External virtual host websites proxied through HAS (NPM) - External virtual host websites proxied through HAS (NPM)
- CrowdSec email notification delivery (local attack alerts + CAPI daily digest) - CrowdSec email notification delivery (local attack alerts + CAPI daily digest)
- Self-hosted Git version control for network-wide scripts and project files (Forgejo)
NAS16 operates entirely within VLAN 50 and benefits from the strict containment rules that prevent lateral movement into trusted networks. NAS16 operates entirely within VLAN 50 and benefits from the strict containment rules that prevent lateral movement into trusted networks.
@ -166,6 +167,22 @@ Port 8080 must be exposed on HAS's host network interface. Configured in the Cro
--- ---
## 🔧 Forgejo — Self-Hosted Git Server (added 2026-07-26)
NAS16 hosts **Forgejo**, the self-hosted Git server providing version control and a web UI for editing/browsing scripts and project files across the KingDezigns network. Chosen for placement on NAS16 specifically because it has the most spare RAM/CPU headroom of any host in the fleet — the same reasoning previously used to place the CrowdSec notifier scripts here instead of on HAS.
- **Container:** `forgejo` (Docker, image `codeberg.org/forgejo/forgejo:10`), Compose-managed via OMV
- **Web UI:** `http://192.168.150.40:3000` internally, public at `https://forgejo.kingdezigns.com/` (proxied via NPM on HAS, Force SSL)
- **SSH git access:** `ssh://git@192.168.150.40:2222/...` — LAN-only, no external port-forward configured
- **Database:** SQLite — no separate DB container
- **Data path:** `/opt/forgejo/data` (bind-mounted, not a Docker volume) — folded into the existing `nas16-backup.sh` scheduled backup job
- **Organizations:** `NAS08`, `NAS16`, `PLEX32` — one repo per org (`<hostname>-scripts`), mirroring the `07 - Projects/<HOST>` folder structure on NAS16's own NFS share
- **Registration:** disabled — accounts are admin-created only
Full configuration, troubleshooting history, and operational details are documented separately in `server_forgejo.md`.
---
## 🗂️ Shared Permissions — NFS + rsync Backup ## 🗂️ Shared Permissions — NFS + rsync Backup
NAS16 receives rsync backups from NAS08 via `nas08_to_nas16_sync.sh` every 2 days. To ensure rsync can write files on the destination without errors, NAS16 uses the same `ncshare` group configuration as NAS08. NAS16 receives rsync backups from NAS08 via `nas08_to_nas16_sync.sh` every 2 days. To ensure rsync can write files on the destination without errors, NAS16 uses the same `ncshare` group configuration as NAS08.
@ -335,6 +352,7 @@ This ensures internal VLAN 50 devices (including HAS) are never banned regardles
- CAPI cloud ban digest sent daily at midnight — single Python call handles 10,000+ decisions efficiently. - CAPI cloud ban digest sent daily at midnight — single Python call handles 10,000+ decisions efficiently.
- CrowdSec API key stored in Vaultwarden under `CrowdSec NAS16-notifier`. - CrowdSec API key stored in Vaultwarden under `CrowdSec NAS16-notifier`.
- **Gotcha:** when piping data into `python3 -` with a heredoc, the heredoc replaces stdin — pass data as an inline variable instead. - **Gotcha:** when piping data into `python3 -` with a heredoc, the heredoc replaces stdin — pass data as an inline variable instead.
- **Forgejo (added 2026-07-26):** Self-hosted Git server, Docker container `forgejo`, public at `https://forgejo.kingdezigns.com/` via NPM, SSH git access LAN-only on port 2222, SQLite DB, data at `/opt/forgejo/data` (folded into `nas16-backup.sh`). Hosts version control for `07 - Projects/NAS08`, `/NAS16`, `/PLEX32` — one Forgejo org per host, one `<hostname>-scripts` repo per org. See `server_forgejo.md` for full detail.
- **Shared permissions:** `ncshare` group (GID 1001) shared by `www-data` and `rufusking` — must match NAS08 GID for rsync compatibility. - **Shared permissions:** `ncshare` group (GID 1001) shared by `www-data` and `rufusking` — must match NAS08 GID for rsync compatibility.
- Default ACLs on `/export/kingdezignsnas-16/Public` ensure all rsync-written files inherit `ncshare` group permissions. - Default ACLs on `/export/kingdezignsnas-16/Public` ensure all rsync-written files inherit `ncshare` group permissions.
- **NAS08→NAS16 sync script self-heals destination permissions on every run** — checks for `www-data:ncshare` ownership, runs `chown`/`chmod`/`setfacl` automatically if wrong. Flagged in email subject and body if it fires. - **NAS08→NAS16 sync script self-heals destination permissions on every run** — checks for `www-data:ncshare` ownership, runs `chown`/`chmod`/`setfacl` automatically if wrong. Flagged in email subject and body if it fires.