# 02 - OVH [ns3024499.ip-149-202-72.eu]

- tailscale
- webmin
- docker
- custom scripts

# 1. Vendor Setup

# 2. Initial Login

\[root user/secure/user defaults\]

Once the server is deployed, a number of configuration steps are followed to ensure

- base install pre-installed packages are appropriate
- base install is configured for secure remote access for root user
- templating of the /etc/skel user for 
    - pre-configure ssl access and keys
    - pre-configure login script
    - pre-configure sudo access and groups

# 3. System Defaults

- creation of basic folder structure
- installation of components required for folder merging via FUSE
- post-reboot tasks and disk mount automation /etc/fstab

# 4. Core System Packages Config

- SSH Config
- Tailscale
- fail2ban
- UFW

\+ custom scripts for automation

# Custom Scripts /usr/local/bin

<table border="1" id="bkmrk-filename-description" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 19.0703%;"></col><col style="width: 36.9368%;"></col><col style="width: 43.9928%;"></col></colgroup><tbody><tr><td>filename</td><td>description</td><td>code</td></tr><tr><td><div style="color: #cccccc; background-color: #1f1f1f; font-family: Menlo, Monaco, 'Courier New', monospace; font-weight: normal; font-size: 12px; line-height: 18px; white-space: pre;"><div>`<span style="color: #dcdcaa;">./pipe-response</span>`</div></div></td><td>  
</td><td>`#!/bin/bash`  
`echo "$1 $2 $3" > /var/run/exec`  
`cat /var/run/response`</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr></tbody></table>

<div id="bkmrk-%7C-script-name-%7C-desc" style="color: #cccccc; background-color: #1f1f1f; font-family: Menlo, Monaco, 'Courier New', monospace; font-weight: normal; font-size: 12px; line-height: 18px; white-space: pre;"><div><span style="color: #d4d4d4;">|</span><span style="color: #cccccc;"> </span><span style="color: #dcdcaa;">Script</span><span style="color: #cccccc;"> </span><span style="color: #ce9178;">Name</span><span style="color: #cccccc;"> </span><span style="color: #d4d4d4;">|</span><span style="color: #cccccc;"> </span><span style="color: #dcdcaa;">Description</span><span style="color: #cccccc;"> </span><span style="color: #d4d4d4;">|</span><span style="color: #cccccc;"> </span><span style="color: #dcdcaa;">Code</span><span style="color: #cccccc;"> </span><span style="color: #d4d4d4;">|</span></div><div><span style="color: #d4d4d4;">|</span><span style="color: #dcdcaa;">---------------</span><span style="color: #d4d4d4;">|</span><span style="color: #dcdcaa;">-------------</span><span style="color: #d4d4d4;">|</span><span style="color: #dcdcaa;">---------------------------------------------</span><span style="color: #d4d4d4;">|</span></div><div><span style="color: #d4d4d4;">||</span><span style="color: #cccccc;"> </span><span style="color: #d4d4d4;">|</span><span style="color: #cccccc;"> </span><span style="color: #d4d4d4;">|</span></div><div><span style="color: #dcdcaa;">./backup-compose-services.sh</span></div><div><span style="color: #dcdcaa;">./chmode-safe-downloads.sh</span></div><div><span style="color: #dcdcaa;">./ntfy.sh</span></div><div><span style="color: #dcdcaa;">./chmode-safe-media-downloads.sh</span></div><div><span style="color: #dcdcaa;">./create-docker-dev</span></div><div><span style="color: #dcdcaa;">./create-container-user.sh</span></div><div><span style="color: #dcdcaa;">./create-container-user.sh</span></div><div><span style="color: #dcdcaa;">./validate-pem.sh</span></div><div><span style="color: #dcdcaa;">./clear-logs.sh</span></div><div><span style="color: #dcdcaa;">./wipe</span></div><div><span style="color: #dcdcaa;">./docker-latest-images.sh</span></div><div><span style="color: #dcdcaa;">./earliest-file-tampstamp-to-parent-folder</span></div><div><span style="color: #dcdcaa;">./extract-ips.sh</span></div><div><span style="color: #dcdcaa;">./backup-compose-configs.sh</span></div><div><span style="color: #dcdcaa;">./uplog</span></div><div><span style="color: #dcdcaa;">./count-subdir-files.sh</span></div><div><span style="color: #dcdcaa;">./conf-zip</span></div><div><span style="color: #dcdcaa;">./commit-configs</span></div><div><span style="color: #dcdcaa;">./whois-ip.sh</span></div><div><span style="color: #dcdcaa;">./gh\_repo\_init</span></div><div><span style="color: #dcdcaa;">./renew-pknw1-ssl.sh</span></div><div><span style="color: #dcdcaa;">./ffmpeg-wbem.sh</span></div><div><span style="color: #dcdcaa;">./bashbar</span></div><div><span style="color: #dcdcaa;">./slickslice</span></div><div><span style="color: #dcdcaa;">./plex-db-repair-tool.sh</span></div><div><span style="color: #dcdcaa;">./auto\_shutdown\_containers</span></div><div><span style="color: #dcdcaa;">./renew-int-ssl.sh</span></div><div><span style="color: #dcdcaa;">./youtube\_links</span></div><div><span style="color: #dcdcaa;">./setReleaseDate</span></div><div><span style="color: #dcdcaa;">./pk-check-squid.sh</span></div><div><span style="color: #dcdcaa;">./make-release-year-playlists.sh</span></div><div><span style="color: #dcdcaa;">./renew-internal-ssl.sh</span></div><div><span style="color: #dcdcaa;">./mkv2mp4.sh</span></div><div><span style="color: #dcdcaa;">./iptables-allowip.sh</span></div><div><span style="color: #dcdcaa;">./lazy</span></div><div><span style="color: #dcdcaa;">./folder-backup</span></div><div><span style="color: #dcdcaa;">./create-dev-repo</span></div><div><span style="color: #dcdcaa;">./movies-compile-latest-movies.sh</span></div><div><span style="color: #dcdcaa;">./archive</span></div><div><span style="color: #dcdcaa;">./link-portainer</span></div><div><span style="color: #dcdcaa;">./auto\_shutdown\_webservice</span></div><div><span style="color: #dcdcaa;">./pipe-exec</span></div><div><span style="color: #dcdcaa;">./launch-venv.sh</span></div><div><span style="color: #dcdcaa;">./ytdl</span></div><div><span style="color: #dcdcaa;">./list\_portainer\_templates</span></div><div><span style="color: #dcdcaa;">./init\_repo</span></div><div><span style="color: #dcdcaa;">./mkv2mp4</span></div><div><span style="color: #dcdcaa;">./renew-tailscale-ssl.sh</span></div><div><span style="color: #dcdcaa;">./docker-image-prune-3months.sh</span></div><div><span style="color: #dcdcaa;">./get\_feature.sh</span></div><div><span style="color: #dcdcaa;">./renew-plex-ssl.sh</span></div><div><span style="color: #dcdcaa;">./launch\_portainer\_stack</span></div><div><span style="color: #dcdcaa;">./merge-iptv-xml.sh</span></div><div><span style="color: #dcdcaa;">./update-epg-xml.sh</span></div><div><span style="color: #dcdcaa;">./ddocker</span></div><div><span style="color: #dcdcaa;">./webhook-listen.sh</span></div><div><span style="color: #dcdcaa;">./ban-ip-port.sh</span></div><div><span style="color: #dcdcaa;">./squid</span></div><div><span style="color: #dcdcaa;">./wait-for-ssh.sh</span></div><div><span style="color: #dcdcaa;">./chmod-safe.sh</span></div><div><span style="color: #dcdcaa;">./webhook-processor.sh</span></div>  
</div>

# 5. Core Application Services

- docker
- XRDP

# Tailscale VPN

Tailscale VPN from [https://tailscale.com/](https://tailscale.com/)

- [ ] configures a host interface `tailscale0`
- [ ] installs auto-start for tailscale daemon `/etc/systemd/system/multi-user.target.wants/tailscaled.service`
- [ ] starts service at boot allocating IP address 100.100.69.2 to the tailscale0 nic
- [ ] attaches tailscale0 nic to the shared VPN 
    - [ ] makes accessible 100.100.69.X addresses
    - [ ] makes the HOST available as an exit node

configured to use account <pkswansea@outlook.com> via the admin console via [https://login.tailscale.com/admin](https://login.tailscale.com/admin)

<table border="1" id="bkmrk-the-server-ssh-servi" style="border-collapse: collapse; width: 104.762%;"><colgroup><col style="width: 16.8057%;"></col><col style="width: 35.7544%;"></col><col style="width: 47.4398%;"></col></colgroup><tbody><tr><td>[![pngtree-banner-with-important-icon-vector-picture-image_7826342-244127159.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/lT9pngtree-banner-with-important-icon-vector-picture-image-7826342-244127159.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/lT9pngtree-banner-with-important-icon-vector-picture-image-7826342-244127159.png)</td><td>The server **SSH service** running on port 69 isonly exposed on the tailscale0 interface via the IP 100.100.69.2 once the daemon has started via `/etc/systemd/system/ssh-after-tailscale.service and can only be accessed when connected to a valid VPN client`

</td><td>`#!/bin/bash`  
`while ! ip addr show tailscale0 | grep -q "inet "; `

`do`  
`    sleep 10`  
`done`  
`systemctl start ssh`

</td></tr></tbody></table>

# Webmin

Webmin from [https://webmin.com/](https://webmin.com/)

- [ ] installed onto host system via 3rd party apt repository
- [ ] installs and auto-configured for start at boot-time
- [ ] OOB installation listens on all interfaces https://&lt;ip&gt;:10000 
    - [ ] post install modify the /etc/webmin./miniserv.conf
    - [ ] we will only listen on internally accessible networks
    - [ ] we will disable SSL
    - [ ] we will reverse proxy via nginx proxy manager https to http:10000

<div id="bkmrk-notable-changes-for-" style="color: #cccccc; background-color: #1f1f1f; font-family: Menlo, Monaco, 'Courier New', monospace; font-weight: normal; font-size: 12px; line-height: 18px; white-space: pre;"><div><span style="color: #569cd6;">Notable changes for /etc/webmin/miniserv.conf</span></div><div>  
</div><div><span style="color: #569cd6;">port</span><span style="color: #cccccc;">=10000</span></div><div><span style="color: #569cd6;">sockets</span><span style="color: #cccccc;">=172.22.20.1:\*</span></div><div><span style="color: #569cd6;">ssl</span><span style="color: #cccccc;">=0</span></div><div><span style="color: #569cd6;">no\_ssl2</span><span style="color: #cccccc;">=1</span></div><div><span style="color: #569cd6;">bind</span><span style="color: #cccccc;">=172.22.22.1</span></div><div><span style="color: #569cd6;">ipv6</span><span style="color: #cccccc;">=0</span></div><div><span style="color: #569cd6;">no\_tls1\_1</span><span style="color: #cccccc;">=1</span></div><div><span style="color: #569cd6;">webprefixnoredir</span><span style="color: #cccccc;">=1</span></div><div><span style="color: #569cd6;">no\_tls1</span><span style="color: #cccccc;">=1</span></div><div><span style="color: #569cd6;">no\_ssl3</span><span style="color: #cccccc;">=1</span></div></div>#### Installation Steps

1. ##### install webmin repo
    
    ```
    wget -O - https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh | sudo bash
    ```
2. ##### update repo
    
    ```
    sudo apt update
    ```
3. ##### install webmin package
    
    ```
    sudo apt install -y webmin
    ```
4. ##### start and verify service
    
    ```
    sudo systemctl status webmin
    sudo netstat -anp|grep 10000 | grep LISTEN | awk '{print $4}' | awk '{print "https://"$1}'
    ```
5. ##### access initial webmin UI and login as root[![Screenshot 2025-06-23 at 21.07.46.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-07-46.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-07-46.png)

<details id="bkmrk-installation-cli-com"><summary>Installation CLI commands copy &amp; Paste</summary>

```
wget -O - https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh | sudo bash
sudo apt update
sudo apt install -yq webmin
sudo systemctl status webmin
sudo netstat -anp|grep 10000 | grep LISTEN | awk '{print $4}' | awk '{print "http://"$1}' | xargs -n1 open
```

</details>#### Update OOB installation

We can update via the webmin UI to change a minimal set of options to use Webmin behind a local IP which we access via https proxy through the nginx proxy

For the following configuration to be enabled, follow the setup steps below

[![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/image.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/image.png)

##### Pre-Setup Requirements

- [ ] Docker installed on HOST
- [ ] Docker networks configured on HOST
- [ ] Nginx Proxy Manager container setup as per [The NGINX Proxy Manager Install Guide](https://bookstack.notflix.pknw1.co.uk/books/core-system/page/nginx-proxy-manager-000080443 "NGINX Proxy Manager [0.0.0.0:80/443]")
- [ ] Access from your local machine to the server Tailscale IP address via Tailscale VPN

##### NGINX Proxy Host Configuration

Your NGINX Docker compose file should be setup to listen on your VPN (Tailscsale) Server IP Address

\- 100.100.69.2:80:80  
\- 100.100.69.2:443:443  
\- 100.100.69.2:81:81

We now setup an inbound host to listen on HTTP and HTTPS, setting the Domain Name and then rourting traffic to one of the internal IP addresses that Webmin is listening on

Next you want to request an SSL certificate or use the wildcard cert that should be available; ensure to **enable Force SSL** so all conections are secure; as a final check, we setup the advanced nginx config to check source IP ranges - if the address is not local or VPN, it is denied

<table border="1" id="bkmrk--1" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col></colgroup><tbody><tr><td>[![Screenshot 2025-06-23 at 21.57.23.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-57-23.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-57-23.png)</td><td>[![Screenshot 2025-06-23 at 21.57.44.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-57-44.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-57-44.png)</td><td>[![Screenshot 2025-06-23 at 21.57.51.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-57-51.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-57-51.png)</td></tr></tbody></table>

##### Post Install Configuration (WebUI)

<table border="1" id="bkmrk-open-console-login-a" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 22.3215%;"></col><col style="width: 77.7977%;"></col></colgroup><tbody><tr><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td></tr><tr><td>- [ ] Open Console
- [ ] Login as root

</td><td>##### [![Screenshot 2025-06-23 at 21.07.46.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-07-46.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-07-46.png)

</td></tr><tr><td>**Post Login Error**

</td><td>When loading using only the proxied address (https://webmin.admin.tld.com) it may redirect to [https://webmin.admin.tld.co.uk:10000 ](https://webmin.admin.tld.com:1000)- which will cause an error (as we should have blocked access externally to 10000) - simply remove the port from the URL and hit enter to load the page

[![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/wryimage.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/wryimage.png)

</td></tr><tr><td>- [ ] Open the Webmin Config Page

</td><td>[![Screenshot 2025-06-23 at 21.17.38.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-17-38.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-17-38.png)</td></tr><tr><td>- [ ] update IPs
- [ ] leave internal IP
- [ ] remove external

- [ ] modify listen ports as required (only change if there are conflicts)

</td><td>[![Screenshot 2025-06-23 at 21.10.48.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-10-48.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-10-48.png)</td></tr><tr><td>- [ ] disable SSL as the NGINX proxy will receive the SSL connection and terminate it using HTTP internally (optional but easier)
- [ ] Setup SSL Certs if you use SSL - use your \*.admin wildcard SSL cert

</td><td>[![Screenshot 2025-06-23 at 21.10.16.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-10-16.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-10-16.png)</td></tr><tr><td>- [ ] Update the approved referer DNS names

</td><td>[![Screenshot 2025-06-23 at 21.18.04.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/scaled-1680-/screenshot-2025-06-23-at-21-18-04.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2025-06/screenshot-2025-06-23-at-21-18-04.png)</td></tr><tr><td>  
</td><td>  
</td></tr></tbody></table>

# Docker

### Docker Config

<details id="bkmrk-configure-docker-for"><summary>Configure Docker for rootless running</summary>

`/etc/docker/daemon.json `

```
# /etc/docker/daemon.json 
{
  "userns-remap": "docker"
}
```

`/etc/subuid`

```
docker:231072:65536
```

`/etc/subgid`

```
docker:231072:65536
```

`docker_setup_rootless_system.sh`

```
#!/bin/bash

cat << EOF > /tmp/daemon.json
{
  "userns-remap": "docker"
}
EOF

cat << EOF > /tmp/subuid
docker:231072:65536
EOF


cat << EOF > /tmp/subgid
docker:231072:65536
EOF

```

`docker_setup_rootless_folders.sh`

```
#!/bin/bash



cat << EOF > /tmp/daemon.json
{
  "userns-remap": "docker"
}
EOF

cat << EOF > /tmp/subuid
docker:231072:65536
EOF


cat << EOF > /tmp/subgid
docker:231072:65536
EOF

```

</details>### Docker Networks Docker 

```
docker network create --ipv6=false --subnet=172.22.20.0/24 proxy
docker network create --ipv6=false --subnet=172.22.21.0/24 admin
```

core ("docker\_automation" "caddy" "internal-proxy" "tinyauth" "proxymanager-admin" ".git" "lldap" "proxymanager" "squid")  
   
frontend ("metube" "sso-registration" ".git" "jellyfin-10.10.7" "jellyseerr" "jellyfin-preview" "ytdlp-music")  
   
backend ("radarr" "sonarr" "notflix-reddit-webhook" "utorrent" "flaresolverr" ".git" "jackett")  
   
user-apps ("filebrowser" "iso-user-dashboard" "uptime-kuma" "aliasvault" "offlineu" "iso-urls" "iso-info-dashboard" ".git" "bookstack")  
   
admin-apps ("portainer" "dockman" "caddyui" "admin-apps-dashboard" "glances")

# APT Sources

# Tailscale APT Sources

```
#/bin/bash -e
GPG_URL=https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).noarmor.gpg
GPG_KEYFILE=/usr/share/keyrings/tailscale-archive-keyring.gpg
APT_URL=https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).tailscale-keyring.list
APT_LIST=/etc/apt/sources.list.d/tailscale.list


which lsb_release || apt install -yq lsb-release
echo [ -f ${GPG_KEYFILE} ] || curl -fsSL ${GPG_URL} | sudo tee ${GPG_KEYFILE} >/dev/null
echo curl -fsSL ${APT_URL} | sudo tee ${APT_LIST}
```

# Docker APT Sources

```
#!/bin/bash -e

for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove -y $pkg; done

sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /usr/share/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /usr/share/keyrings/docker.asc
sudo chmod a+r /usr/share/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

# Docker Apps

# Resources

<table border="1" id="bkmrk-ports-cpu-mem-ulimit" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 26.6969%;"></col><col style="width: 16.6855%;"></col><col style="width: 19.5459%;"></col><col style="width: 15.6234%;"></col><col style="width: 21.5615%;"></col></colgroup><tbody><tr><td>  
</td><td>ports</td><td>CPU</td><td>MEM</td><td>ulimits</td></tr><tr><td>**api.notflix.pknw1.co.uk**</td><td>  
</td><td>2</td><td>2GB</td><td>  
</td></tr><tr><td>**caddy**</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>**dockmon**</td><td>  
</td><td>1</td><td>2048M</td><td>  
</td></tr><tr><td>**internal\_proxy**</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>**lldap**</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>**npm-blocker**</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>**pihole**</td><td>  
</td><td>2</td><td>1000M</td><td>  
</td></tr><tr><td>**proxymanager**</td><td>  
</td><td>  
</td><td>  
</td><td>65535/65535</td></tr><tr><td>**proxymanager-admin**</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>**squid**</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td><td>  
</td><td>  
</td></tr></tbody></table>