Initial commit: VPS tutorial complet (105 etapes)

2026-04-08 16:15:11 +02:00
commit acbe11489c
18 changed files with 1848 additions and 0 deletions
--- a/10-services-docker.md
+++ b/10-services-docker.md
@@ -0,0 +1,93 @@
+# 10. Services Docker
+
+## Wireguard (VPN)
+
+1. DNS A `wireguard` -> `<IP>`
+2. Sous-domaine ISPConfig avec proxy vers `http://localhost:51821/`
+3. Ouvrir port 51820/udp dans firewall ISPConfig
+
+4. Generer le hash du mot de passe :
+```bash
+docker run --rm python:3-alpine sh -c "pip install bcrypt -q && python3 -c \"import bcrypt; print(bcrypt.hashpw(b'<MOT_DE_PASSE>', bcrypt.gensalt()).decode())\""
+```
+
+5. Installer (en une ligne, remplacer le hash) :
+```bash
+docker run -d --name=wg-easy -e LANG=fr -e WG_HOST=<IP> -e "PASSWORD_HASH=<HASH_BCRYPT>" -e PORT=51821 -e WG_PORT=51820 -v /etc/wg-easy:/etc/wireguard -p 51820:51820/udp -p 51821:51821/tcp --cap-add=NET_ADMIN --cap-add=SYS_MODULE --sysctl="net.ipv4.conf.all.src_valid_mark=1" --sysctl="net.ipv4.ip_forward=1" --restart unless-stopped ghcr.io/wg-easy/wg-easy
+```
+
+> **Piege :** Les versions recentes de wg-easy exigent `PASSWORD_HASH` (bcrypt) au lieu de `PASSWORD`.
+
+## Vaultwarden (gestionnaire de mots de passe)
+
+1. DNS A `vaultwarden` -> `<IP>`
+2. Sous-domaine ISPConfig avec proxy vers `http://localhost:1280/`
+
+3. Generer le hash admin :
+```bash
+echo -n "<MOT_DE_PASSE>" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1
+```
+
+4. Installer (echapper les `$` du hash avec `\$`) :
+```bash
+docker volume create vaultwarden_data
+docker run -d -p 1280:80 --name=vaultwarden --restart=always -v vaultwarden_data:/data:rw -e ROCKET_ENV=staging -e ROCKET_PORT=80 -e ROCKET_WORKERS=10 -e SMTP_HOST=127.0.0.1 -e SMTP_FROM=vaultwarden@<DOMAINE> -e SMTP_PORT=25 -e SMTP_SECURITY=off -e WEBSOCKET_ENABLED=true -e "ADMIN_TOKEN=<HASH_ARGON2>" -e SIGNUPS_ALLOWED=false -e DOMAIN=https://vaultwarden.<DOMAINE> vaultwarden/server:latest
+```
+
+5. Activer temporairement les inscriptions via `/admin`, creer son compte, desactiver.
+
+## Heimdall (dashboard)
+
+1. DNS A `heimdall` -> `<IP>`
+2. Sous-domaine ISPConfig avec proxy HTTPS vers `https://localhost:1281/`
+
+```apache
+SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
+SSLProxyEngine On
+ProxyPreserveHost    On
+SSLProxyVerify none
+SSLProxyCheckPeerCN off
+SSLProxyCheckPeerName off
+SSLProxyCheckPeerExpire off
+
+ProxyPass / https://localhost:1281/
+ProxyPassReverse / https://localhost:1281/
+```
+
+3. Installer :
+```bash
+docker volume create heimdall_data
+docker run -d -p 1281:443 --name=heimdall --restart=always -v heimdall_data:/config:rw -e PGID=1000 -e PUID=1000 linuxserver/heimdall
+```
+
+## Guacamole (bureau a distance)
+
+1. DNS A `guacamole` -> `<IP>`
+2. Creer base de donnees `guacamole` dans ISPConfig
+3. Sous-domaine ISPConfig avec proxy :
+
+```apache
+ProxyPass /guacamole http://localhost:8085/guacamole
+ProxyPassReverse /guacamole http://localhost:8085/guacamole
+RedirectMatch ^/$ https://guacamole.<DOMAINE>/guacamole
+```
+
+4. Installer :
+```bash
+docker run -d --name guacamole-guacd --restart=always guacamole/guacd
+docker run -d --name guacamole-web --restart=always --link guacamole-guacd:guacd -e MYSQL_HOSTNAME=172.17.0.1 -e MYSQL_PORT=3306 -e MYSQL_DATABASE=<DB_NAME> -e MYSQL_USER=<DB_USER> -e MYSQL_PASSWORD=<DB_PASS> -p 8085:8080 guacamole/guacamole
+```
+
+5. Importer le schema :
+```bash
+docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --mysql | mysql -u root <DB_NAME>
+```
+
+6. Autoriser l'acces depuis Docker :
+```bash
+mysql -u root -e "GRANT ALL PRIVILEGES ON <DB_NAME>.* TO '<DB_USER>'@'172.17.0.%' IDENTIFIED BY '<DB_PASS>'; FLUSH PRIVILEGES;"
+```
+
+7. Login par defaut : `guacadmin` / `guacadmin` — creer un admin et supprimer guacadmin.
+
+> **Piege :** Tomcat 10 natif est incompatible avec Guacamole 1.5.5. Utiliser Docker a la place.