앱 on 대충어쩌고저쩌고샬라샬라

ansible

Wed, 31 Dec 2025 00:00:00 +0000

작성 중

kubernetes

Wed, 31 Dec 2025 00:00:00 +0000

작성 중

rabbitmq

Wed, 31 Dec 2025 00:00:00 +0000

작성 중

redis

Wed, 31 Dec 2025 00:00:00 +0000

작성 중

esportshelper (deprecated)

Mon, 15 Dec 2025 00:00:00 +0000

Deprecated

lolesports.com 로그인 페이지 변경에 대응하지 못함

지원 종료. 2024-02 이후 업데이트 없음 ¹

 graph LR
 subgraph gvp6nx1a
 A[https://lolesports.com/] <-- https --> B
 B[esportshelper] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/esportshelper/docker-compose.yml

services:
 esportshelper:
 image: e7hnr8ov/esportshelper:alpine
 container_name: esportshelper
 networks:
 - dev
 ports:
 - 3000/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 - PUID=1000
 - PGID=1000
 volumes:
 - /opt/esportshelper/config:/config:rw
 - /opt/esportshelper/config.yaml:/esportshelper/config.yaml:rw
 - /opt/esportshelper/data:/esportshelper/dropsHistory:rw
 shm_size: 2gb
 restart: unless-stopped
networks:
 dev:
 external: true

sudo docker cp esportshelper:/esportshelper/config.yaml /opt/esportshelper/ && \
sudo chown dev:dev -R /opt/esportshelper

config.yaml

vi /opt/esportshelper/config.yaml

### 필수 입력 사항
username: "f*******" # 필수, 계정 번호
password: "o***********************" # 필수, 비밀번호
### 선택사항
delay: 600 # 각 검사의 시간 간격(초)(기본값은 600초)(각 감지 시간은 설정한 지연의 0.8-1.5배 사이에서 무작위로 변동됩니다)
headless: False # True로 설정하면 프로그램이 백그라운드에서 실행되고, 그렇지 않으면 브라우저 창이 열립니다(기본값은 False).
language: "en_US" # 이제 "zh_CN", "zh_TW", "en_US" 언어를 지원합니다. 중국어 간체, 중국어 번체 및 영어.
nickName: "" # 닉네임, 비어 있으면 기본값은 사용자 이름입니다(개인 정보 보호 강화).
onlyWatchMatches: ["lcs","lla","lpl","lck","ljl-japan","lco","lec","cblol-brazil","pcs","tft_esports","worlds" ,"wqs"] # 감시 전용 경쟁 영역 이름, 소문자.
disWatchMatches: ["prime","lfl","liga","hitpoint","series","nlc","nationals","academy","qualifiers","legends","challengers","league" ] # 대회지역 이름을 보고 싶지 않다면 여기에 추가하면 됩니다. (참고로 소문자입니다.)
maxRunHours: -1 # 음수 값은 항상 실행됨을 의미하고 양수 값은 실행 시간을 의미하며 기본값은 -1입니다.
maxStream: 4 # 기본값은 동시에 시청할 수 있는 최대 게임 수인 4이며, 그 수를 초과하면 시청하지 않습니다.
mode: "safe" # 모드 선택, safe는 안전 모드, Normal은 일반 모드, 기본값은 safe를 참조하세요.
exportDrops: True # 기본값은 False입니다. 경력 드롭 세부 정보 파일을 내보내야 하는지 여부는 스크립트가 열릴 때만 생성됩니다.
briefLogLength: 10 #간단한 로그 정보 개수 기본값은 10입니다.
proxy: "" # 프록시 주소, 선택사항, 일반 사용자는 자신이 무엇을 하고 있는지 알지 못하는 한 입력할 필요가 없습니다. 예: "양말://127.0.0.1:20173"
connectorDropsUrl: "https://discord.com/api/webhooks/1******************/t***************-*****************-*********************************" # (DingTalk, Discord, Job Warning, Enterprise WeChat, Feishu 지원) 구체적인 구성 방법은 여기에 있습니다 https://github.com/Yudaotor/EsportsHelper/wiki/%E6%80% 8E%E4 %B9%88%E9%85%8D%E7%BD%AE%E6%8E%89%E8%90%BD%E6%8F%90%E9%86%92%3F
platForm: "linux" #플랫폼을 사용하세요. 기본값은 Windows입니다. Linux를 사용해야 하는 경우 여기에서 구성하세요.
closeStream: False # 스트림 저장 모드, 기본값은 False, 라이브 방송실의 비디오 스트림을 닫습니다(위험이 존재하며 Riot에서 감지할 수 있음).
desktopNotify: False # 시스템 오른쪽 하단에 팝업 메시지가 표시됩니다. 기본값은 False입니다.
sleepPeriod: ["0-0"] # 수면 기간, (기본값은 비어 있음) 형식은 "시작 시간 - 종료 시간"입니다. 수면 기간 동안에는 보기 웹페이지가 닫히고 이후에는 잠이 다시 열렸습니다. 간격은 왼쪽이 닫혀 있고 오른쪽이 열려 있습니다.
ignoreBroadCast: True # 생방송 방에 미리 입장하려면 False로 설정하고, 항상 방송되는 특정 경쟁 지역(예: TFT)에서 생방송을 지원합니다.
userDataDir: "" # xxxxx가 자신의 컴퓨터 이름으로 변경되는 예는 https를 참조하세요. //github.com/Yudaotor/EsportsHelper/wiki/%E6%80%8E%E4%B9%88%E4%BD%BF%E7%94%A8%E6%9C%AC%E5%9C%B0%E6 %B5%8F %E8%A7%88%E5%99%A8%E7%BC%93%E5%AD%98-%E5%85%8D%E8%B4%A6%E5%AF%86%E7% 99%BB% E5%BD%95
chromePath: "" # Google Chrome 사용자 정의 경로
countDrops: True # 드롭 수를 확인할지 여부
notifyType: "all" # 푸시 정보 유형을 필터링합니다. "all"은 모든 정보를 푸시하고, "error"는 오류 정보만 푸시하고, "drops"는 드롭 정보만 푸시합니다.
autoSleep: True # (권장) 자동으로 잠자기 여부, 기본값은 True
debug: False # 디버그 모드를 활성화할지 여부. 활성화된 후 예외가 발생하면 스크린샷이 사진 폴더로 이동됩니다. 기본값은 False입니다.
arm64: True # Linux ARM64에서 Chromium 사용을 지원하려면 platformForm: "linux"를 구성하고 "/home/USERNAME/.local/share/unDetected_chromedriver/chromedriver" 경로에 chromedriver가 있어야 합니다. 자세한 내용은 다음을 참조하세요. https:/ /github.com/Yudaotor/EsportsHelper/wiki/The-Way-Using-Chromium-on-ARM64
isDockerized: True # Docker에서 실행할 때만 True로 구성되며 기본값은 False입니다.

webhook 구성

디스코드 webhook

freshrss

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 A1[websites] -- rss --> B[freshrss]
 B -- google-api --> C[rss-client]

container 구성

docker-compose.yml

vi /opt/freshrss/docker-compose.yml

services:
 freshrss:
 image: linuxserver/freshrss:latest
 container_name: freshrss
 networks:
 - dev
 ports:
 - 80/tcp
 user: 0:0
 environment:
 - PUID=911
 - PGID=911
 - TZ=Asia/Seoul
 volumes:
 - /opt/freshrss/data:/config:rw
 - /opt/freshrss/config/logrotate_nginx.conf:/etc/logrotate.d/nginx:ro
 - /opt/freshrss/config/logrotate_php-fpm.conf:/etc/logrotate.d/php-fpm:ro
 restart: unless-stopped
networks:
 dev:
 external: true

구성

proxy url 구성

g4f

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 A[api] <-- https --> B
 subgraph gvp6nx1a
 B[g4f] <-- proxy --> C[authelia]
 C <-- proxy --> C1[nginx]
 end
 C1 <-- https --> D[client]
 B <---> E1[ai_tel_bot.py]
 E1 <---> F[telegram-bot]

container 구성

docker-compose.yml (arm)

vi /opt/g4f/docker-compose.yml

services:
 g4f:
 image: hlohaus789/g4f:latest-armv7
 container_name: g4f
 networks:
 - dev
 ports:
 - 8080/tcp
 - 1337:1337/tcp
 - 7900/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/g4f/har_and_cookies:/app/har_and_cookies:rw
 - /opt/g4f/generated_images:/app/generated_images:rw
 shm_size: 2gb
 restart: unless-stopped
networks:
 dev:
 external: true

proxy 구성

authelia 구성

gitea

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A <-- proxy --> C1[nginx]
 B1[ssh-key] -- ssh-keygen --> A[gitea]
 B2[gpg-key] -- gpg --> A
 end
 C[client] <-- ssh --> A
 C1 <-- https --> C

container 구성

docker-compose.yml

vi /opt/gitea/docker-compose.yml

services:
 gitea:
 image: gitea/gitea:latest
 container_name: gitea
 networks:
 - dev
 ports:
 - 61257:22/tcp
 - 3000/tcp
 user: 0:0
 environment:
 - USER_UID=1000
 - USER_GID=1000
 volumes:
 - /opt/gitea/data:/data:rw
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 restart: unless-stopped
networks:
 dev:
 external: true

key

gitea 전용의 ssh와 gpg키를 github 구성과 동일하게 생성

guacamole

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A[guacamole] <-- proxy --> C1[nginx]
 B2[ssh-servers] <-- tcp --> A
 end
 C1 <-- https --> C[client]

container 구성

docker-compose.yml

vi /opt/guacamole/docker-compose.yml

services:
 guacamole:
 image: flcontainers/guacamole:latest
 container_name: guacamole
 networks:
 - dev
 ports:
 - 8080/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 - EXTENSIONS=auth-totp
 volumes:
 - /opt/guacamole/config:/config:rw
 - /etc/localtime:/etc/localtime:ro
 restart: unless-stopped
networks:
 dev:
 external: true

proxy 구성

vi /opt/nginx/config/sites-available/guacamole.conf

...
 location / {
 if ($allowed_country = no) {
 return 403;
 }
 include /etc/nginx/conf.d/include/proxy.conf;
 proxy_pass http://guacamole:8080;
 proxy_buffering off;
 proxy_request_buffering off;
 }
...

Troubleshooting

초기 계정

hugo

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[dev-server] <-- proxy --> C[nginx]
 end
 C1[prod-server] <-- https --> D[client]
 C2[github-action] --- C3[contents/<br/>security-properties]
 C <-- https --> D
 B -- git --> C2
 B -- ssh --> C3
 C3 -- ssh --> C1

container 구성

docker-compose.yml

배포 폴더 /opt/hugo/data/public/
개발 서버이며 여기서 편집 후 운영 적용
서버 시작 시 배포 폴더 초기화
실시간 새로고침
baseURL 옵션은 운영 서버 URL 적용 (sitemap.xml 생성에 관여)
environment 옵션 production만 googleanalytics 적용

vi /opt/hugo/docker-compose.yml

services:
 hugo:
 image: hugomods/hugo:exts
 container_name: hugo
 networks:
 - dev
 ports:
 - 1313/tcp
 user: 1000:1000
 volumes:
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 - /opt/hugo/data:/src:rw
 command: hugo server --cleanDestinationDir --poll 700ms --disableFastRender --noHTTPCache --environment production --minify --baseURL https://dntco43u.github.io --appendPort=false
 restart: unless-stopped
networks:
 dev:
 external: true

docsy 테마 ¹

템플릿은 exts 모듈이 적용된 docsy-example 테마
폴더 구조 변경. 기존 구조가 2-depth(/content/blog/)인데 1-depth(/content/)로 바꾸고 blog로만 사용
/content/search.md는 삭제. 1-depth 구조에서 노출을 막으려면 이것저것 수정해야 하므로
이미지 중앙 정렬 스타일 추가 ²

sudo rm -rf /opt/hugo/data && \
docker run --rm -it \
-p1313/tcp \
-v /opt/hugo/data:/src:rw \
hugomods/hugo:exts \
/bin/sh

hugo mod graph && \
cd / && git clone --depth 1 https://github.com/google/docsy-example.git src && \
cd /src && npm install && \
hugo --minify && \
exit

sudo chown dev:dev -R /opt/hugo/data/ && \
sed -i 's/enableGitInfo: true/enableGitInfo: false/' /opt/hugo/data/hugo.yaml && \
grep "enableGitInfo" /opt/hugo/data/hugo.yaml && \
rm /opt/hugo/data/LICENSE && \
rm /opt/hugo/data/*.md && \
rm /opt/hugo/data/{Dockerfile,docker-compose.yaml} && \
find /opt/hugo/data/ -name ".git*" -exec rm -rf {} \;

vi /opt/hugo/data/hugo.yaml

...
module:
 hugoVersion:
 extended: true
 min: 0.146.0
 imports:
 - path: github.com/google/docsy
 disable: false
...

vi /opt/hugo/data/assets/scss/_styles_project.scss

...
img[src$='#center'] {
 display: block;
 margin: 1.0rem auto;
 max-width: 100%;
 height: auto;
}

giscus 댓글 ³

테마 템플릿의 구성이 구 버전이라면 새 버전에 맞게 폴더 구조 변경 /layouts/partials/ -> /layouts/_partials/ ⁴
댓글을 비활성화하고 싶다면 markdown 파라미터에 no_comment: true 추가

mv /opt/hugo/data/layouts/partials /opt/hugo/data/layouts/_partials && \
vi /opt/hugo/data/layouts/_partials/disqus-comment.html

{{ if not .Params.no_comment }}
<style type="text/css">
 .giscus, .giscus-frame { width: 90%; }
 .container-fluid { height: auto; }
</style>
<div class="page-blank">
 <div class="giscus"></div>
 <script src="https://giscus.app/client.js"
 data-repo="{{site.Params.comments.giscus.repo}}"
 data-repo-id="{{site.Params.comments.giscus.repo_id}}"
 data-category="{{site.Params.comments.giscus.category}}"
 data-category-id="{{site.Params.comments.giscus.category_id}}"
 data-mapping="{{site.Params.comments.giscus.mapping}}"
 data-strict="{{site.Params.comments.giscus.reactions_enabled}}"
 data-reactions-enabled="{{site.Params.comments.giscus.reactions_enabled}}"
 data-emit-metadata="0"
 data-input-position="{{site.Params.comments.giscus.data_input_position}}"
 data-theme="{{site.Params.comments.giscus.theme}}"
 data-lang="{{site.Params.comments.giscus.data_lang}}"
 crossorigin="anonymous"
 async>
</script>
<noscript>Please enable JavaScript to view the <a href="https://giscus.app/">comments powered by Giscus.</a></noscript>
</div>
{{ end }}

vi /opt/hugo/data/hugo.yaml

...
params:
 comments:
 provider: giscus
 giscus:
 repo: dntco43u/dntco43u.github.io
 repo_id: R***********
 category: General
 category_id: D*******************
 mapping: pathname
 reactions_enabled: 0
 data_input_position: bottom
 # theme: light
 theme: catppuccin_frappe
 data_lang: en
services:
 disqus:
 shortname: giscus

기타

vi /opt/hugo/data/hugo.yaml

...
imaging:
 quality: 100
...
outputs:
 section: [HTML, RSS]
...
services:
 googleAnalytics:
 ID: G-G********* #https://dntco43u.github.io
...
# 제목 파스칼 케이스 변환 금지
titleCaseStyle: none

# prod-server 캐시
caches:
 images:
 dir: :cacheDir/images
...

favicon

/opt/hugo/data/static/favicons/favicon.ico

host 구성

deploy_hugo.sh ⁵

vi /home/dev/.local/bin/deploy_hugo.sh

#!/bin/bash
# hugo clean -> build -> publsh

source /home/dev/.bashrc
source /home/dev/.local/bin/utils.sh

container_name=hugo
hugo_env=$(docker exec -it $container_name hugo version)
hugo_version=$(echo "$hugo_env" | grep -o "hugo v[0-9.]*" | grep -o "[0-9.]*")
if echo "$hugo_env" | grep -q "+extended"; then
 hugo_extended=true
else
 hugo_extended=false
fi

rm -rf /opt/$container_name/data/public/*
cd /opt/$container_name && docker compose rm -f -s && docker compose up -d && docker exec -it $container_name date +"%Z"
sudo tail -fn0 /var/lib/docker/containers/"$(docker inspect --format="{{.Id}}" $container_name)/local-logs/container.log" | \
# 정적 파일 생성까지 대기
while read -r line; do
 echo "$line"
 if [[ "$line" == *"Web Server is available"* ]]; then
 break
 fi
done

# prod-server에서 참조하도록 dev-server 기준의 .env를 생성
echo "HUGO_VERSION=$hugo_version" > /opt/$container_name/data/.env
echo "HUGO_EXTENDED=$hugo_extended" >> /opt/$container_name/data/.env
cat /opt/$container_name/data/.env

# github pages는 속도를 위해 history 항상 삭제
cd /opt/$container_name/data/public || exit
#git rm -r --cached .
rm -rf .git && git init
git remote add origin git@github.com:dntco43u/dntco43u.github.io.git
git add . && git commit -m "update #$HOSTNAME" && git push -u -f origin main

github 구성

deploy-hugo.yml

Repository secrets	Remarks
secrets.GVP6NX1A_KEY	개발 서버 ssh 키
secrets.GVP6NX1A_ADDR	개발 서버 ssh 주소
secrets.GVP6NX1A_PORT	개발 서버 ssh 포트

vi /opt/hugo/data/public/.github/workflows/deploy-hugo.yml

name: deploy-hugo
on:
 push:
 branches:
 - main
 pull_request:
jobs:
 build:
 runs-on: ubuntu-latest
 concurrency:
 group: ${{ github.workflow }}-${{ github.ref }}
 steps:
 - name: Debug host
 run: dig +short txt ch whoami.cloudflare @1.1.1.1 | sed 's/"//g'
 - name: Set SSH key
 uses: shimataro/ssh-key-action@v2
 with:
 key: ${{ secrets.GVP6NX1A_KEY }}
 name: id_ed25519
 known_hosts: 'placeholder'
 - name: Adding known hosts
 run: ssh-keyscan -H -t ed25519 -p ${{ secrets.GVP6NX1A_PORT }} ${{ secrets.GVP6NX1A_ADDR }} >> ~/.ssh/known_hosts
 - name: Debug SSH
 run: |
 ssh -Q key
 ls -alh ~/.ssh
 ssh -T -p ${{ secrets.GVP6NX1A_PORT }} dev@${{ secrets.GVP6NX1A_ADDR }} -i ~/.ssh/id_ed25519
 - name: Get artifacts from dev-server
 run: |
 rsync \
 -avz \
 --delete \
 --exclude=".git/" \
 -e "ssh -p ${{ secrets.GVP6NX1A_PORT }} -i ~/.ssh/id_ed25519" \
 dev@${{ secrets.GVP6NX1A_ADDR }}:/opt/hugo/data/ \
 ./
 - name: Debug rsync
 run: |
 rsync -V
 sudo apt-get update -y && sudo apt-get install -y tree && sudo tree -L 2 -f
 - name: Set .env
 run: |
 . ./.env
 echo "HUGO_VERSION=${HUGO_VERSION}" >> $GITHUB_ENV
 echo "HUGO_EXTENDED=${HUGO_EXTENDED}" >> $GITHUB_ENV
 - name: Setup hugo
 uses: peaceiris/actions-hugo@v3
 with:
 hugo-version: '${{ env.HUGO_VERSION }}'
 extended: '${{ env.HUGO_EXTENDED }}'
 - name: Install Node.js dependencies
 run: |
 hugo mod graph
 [[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true
 - name: Restore cache
 id: cache-restore
 uses: actions/cache/restore@v4
 with:
 path: ${{ runner.temp }}/hugo_cache
 key: hugo-${{ github.run_id }}
 restore-keys:
 hugo-
 - name: Build hugo
 env:
 TZ: 'Asia/Seoul'
 run: |
 hugo \
 --gc \
 --minify \
 --environment production \
 --baseURL "https://dntco43u.github.io" \
 --cacheDir "${{ runner.temp }}/hugo_cache"
 - name: Save cache
 id: cache-save
 uses: actions/cache/save@v4
 with:
 path: ${{ runner.temp }}/hugo_cache
 key: ${{ steps.cache-restore.outputs.cache-primary-key }}
 - name: Upload pages
 uses: actions/upload-pages-artifact@v3
 with:
 path: ./public
 deploy:
 needs: build
 runs-on: ubuntu-latest
 permissions:
 pages: write
 id-token: write
 environment:
 name: github-pages
 url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Deploy pages
 id: deployment
 uses: actions/deploy-pages@v4

SEO

Troubleshooting

posts.md 파일명에 /와 _의 대체로 -사용 ⁶

jackett

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[jackett] <-- proxy --> C[nginx]
 B <-- https/api --> E[qbittorrent]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/jackett/docker-compose.yml

services:
 jackett:
 image: lscr.io/linuxserver/jackett:latest
 container_name: jackett
 networks:
 - dev
 ports:
 - 9117/tcp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - AUTO_UPDATE=true
 - TZ=Asia/Seoul
 volumes:
 - /opt/jackett:/config:rw
 - /opt/qbittorrent/watched:/downloads:rw
 restart: unless-stopped
networks:
 dev:
 external: true

host 구성

logrotate

sudo vi /etc/logrotate.d/jackett

/opt/jackett/Jackett/log.txt
/opt/jackett/Jackett/updater.txt {
 daily
 rotate 7
 missingok
 notifempty
 dateext
 dateyesterday
 dateformat -%Y%m%d
 nocompress
 create 0664 dev dev
 sharedscripts
 postrotate
 docker restart jackett >/dev/null 2>&1 || true
 endscript
}

jellyfin

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 A1[googledrive] <-- mount --> B[jellyfin]
 subgraph cloud
 B <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/jellyfin/docker-compose.yml

services:
 jellyfin:
 image: jellyfin/jellyfin:latest
 container_name: jellyfin
 networks:
 - dev
 ports:
 - 8096/tcp
 - 8920/tcp
 user: 0:0
 environment:
 - JELLYFIN_PublishedServerUrl=https://je.gvp6nx1a.duckdns.org
 - TZ=Asia/Seoul
 volumes:
 - /opt/jellyfin/config:/config:rw
 - /opt/jellyfin/cache:/cache:rw
 - /home/dev/videos:/mnt/gvp6nx1a:rw
 - /mnt/ce9dbqya-gdrive/videos:/mnt/ce9dbqya:rw
 devices:
 - /dev/dri:/dev/dri
 privileged: true
 restart: unless-stopped
networks:
 dev:
 external: true

Transcoding

vaapi 구성 확인

kavita

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 A1[webdrives] <---> B[kavita]
 subgraph cloud
 B <---> C[nginx]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/kavita/docker-compose.yml

services:
 kavita:
 image: lscr.io/linuxserver/kavita:latest
 container_name: kavita
 networks:
 - dev
 ports:
 - 5000/tcp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - TZ=Asia/Seoul
 volumes:
 - /opt/kavita/config:/config:rw
 - /mnt/ce9dbqya-gdrive/documents:/ce9dbqya:rw
 - /mnt/mgujomtd-gdrive/documents:/mgujomtd:rw
 - /mnt/wagimgxc-gdrive/documents:/wagimgxc:rw
 - /mnt/tsdfsvkx-gdrive/documents:/tsdfsvkx:rw
 - /mnt/aqn8dtkh-gdrive/documents:/aqn8dtkh:rw
 - /mnt/gvp6nx1a-alist/ndgzbj1c@teambition/documents:/ndgzbj1c:rw
 restart: unless-stopped
networks:
 dev:
 external: true

라이브러리 구조 ¹

폴더 구조

loki

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 A13[promtail] -- https --> A7[loki]
 subgraph gvp6nx1a
 A33[promtail] -- http --> A7[loki]
 A7 <-- http --> B1[grafana]
 end
 A7 <-- https --> B2[grafana]

container 구성

docker-compose.yml

vi /opt/loki/docker-compose.yml

services:
 loki:
 image: grafana/loki:latest
 container_name: loki
 networks:
 - dev
 ports:
 - 3100/tcp
 user: 0:0
 volumes:
 - /opt/loki/config:/etc/loki:ro
 - /opt/loki/data:/loki:rw
 command:
 - --config.file=/etc/loki/local-config.yaml
 restart: unless-stopped
networks:
 dev:
 external: true

local-config.yaml

s3에 적재하는 구성

navidrome

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 A1[webdrives] <---> B[navidrome]
 subgraph cloud
 B <---> C[nginx]
 end
 C <-- https --> D[client]

.env

vi /opt/navidrome/.env

ND_SPOTIFY_ID=e*******************************
ND_SPOTIFY_SECRET=5*******************************

docker-compose.yml

vi /opt/navidrome/docker-compose.yml

services:
 navidrome:
 image: deluan/navidrome:latest
 container_name: navidrome
 networks:
 - dev
 ports:
 - 4533/tcp
 user: 1000:1000
 environment:
 - ND_MUSICFOLDER=/music
 - ND_SCANSCHEDULE=24h
 - ND_LOGLEVEL=info
 - ND_SCANNER_EXTRACTOR=ffmpeg
 - ND_SPOTIFY_ID=$ND_SPOTIFY_ID
 - ND_SPOTIFY_SECRET=$ND_SPOTIFY_SECRET
 - ND_SCANNER_PURGEMISSING=always
 volumes:
 - /opt/navidrome/data:/data:rw
 - /mnt/uodacgt6-gdrive/music:/music/uodacgt6:ro
 - /mnt/pc9xqpnh-gdrive/music:/music/pc9xqpnh:ro
 - /mnt/dwecl0ir-gdrive/music:/music/dwecl0ir:ro
 - /mnt/zckmxa4g-gdrive/music:/music/zckmxa4g:ro
 - /mnt/wly1zcl7-onedrive/music:/music/wly1zcl7:ro
 - /mnt/tamg9wel-teldrive/music:/music/tamg9wel:ro
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 restart: unless-stopped
networks:
 dev:
 external: true

pgsql-exporter

Mon, 15 Dec 2025 00:00:00 +0000

 graph TB
 subgraph gvp6nx1a
 A2[postgres] -- tcp --> A4[postgres-exporter]
 A4 -- http --> A3[prometheus]
 end

container 구성

.env

vi /opt/pgsql-exporter/.env

DATA_SOURCE_NAME=postgresql://postgres:a***************************************************************@host.docker.internal:5432/postgres?sslmode=disable

docker-compose.yml

network bridge 구성이어도 host를 허용하도록 구성

vi /opt/pgsql-exporter/docker-compose.yml

services:
 pgsql-exporter:
 image: quay.io/prometheuscommunity/postgres-exporter:latest
 container_name: pgsql-exporter
 networks:
 - dev
 ports:
 - 9187/tcp
 extra_hosts:
 - "host.docker.internal:host-gateway"
 user: 1000:1000
 environment:
 - DATA_SOURCE_NAME=$DATA_SOURCE_NAME
 volumes:
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 - /opt/pgsql-exporter/config/postgres_exporter.yml:/postgres_exporter.yml:rw
 restart: unless-stopped
networks:
 dev:
 external: true

privatebin

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B1[authelia] <-- proxy --> C[nginx]
 B[privatebin] <-- proxy --> B1
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/privatebin/docker-compose.yml

services:
 privatebin:
 image: privatebin/fs:latest
 container_name: privatebin
 networks:
 - dev
 ports:
 - 8080/tcp
 user: 65534:82
 environment:
 - TZ=Asia/Seoul
 - PHP_TZ=Asia/Seoul
 volumes:
 - /opt/privatebin/config:/srv/cfg:rw
 - /opt/privatebin/data:/srv/data:rw
 - /opt/privatebin/tmp:/tmp:rw
 - /opt/privatebin/run:/run:rw
 - /opt/privatebin/nginx_tmp:/var/lib/nginx/tmp:rw
 read_only: true
 restart: unless-stopped
networks:
 dev:
 external: true

proxy 구성

authelia 구성

prometheus

Mon, 15 Dec 2025 00:00:00 +0000

 graph TB
 subgraph gvp6nx1a
 A2[postgresql] -- tcp --> B[grafana]
 A3[prometheus] -- http --> B
 A4[postgres-exporter] -- http --> A3
 A2 -- tcp --> A4
 E2[node-exporter] -- http --> A3
 end
 E3[node-exporter] -- https --> A3

container 구성

docker-compose.yml

vi /opt/prometheus/docker-compose.yml

services:
 prometheus:
 image: prom/prometheus:latest
 container_name: prometheus
 networks:
 - dev
 ports:
 - 9090/tcp
 user: 0:0
 volumes:
 - /opt/prometheus/config:/etc/prometheus:rw
 - /opt/prometheus/data:/prometheus:rw
 command:
 - --config.file=/etc/prometheus/prometheus.yml
 - --web.config.file=/etc/prometheus/web.yml
 - --storage.tsdb.path=/prometheus
 - --storage.tsdb.retention.time=7d
 restart: unless-stopped
networks:
 dev:
 external: true

일반 구성

file service discovery 구성

selenium

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A1[python] --- B
 B[selenium] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

.env

vi /opt/python/.env

WEBDRIVER_URL=http://selenium:4444/wd/hub

docker-compose.yml

vi /opt/selenium/docker-compose.yml

services:
 selenium:
 image: seleniarm/standalone-chromium:latest
 container_name: selenium
 networks:
 - dev
 ports:
 - 4444/tcp
 - 5900/tcp
 - 7900/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/selenium/config/passwd:/home/seluser/.vnc/passwd:ro
 - /home/dev/downloads/selenium:/home/seluser/files:rw
 privileged: true
 shm_size: 2gb
 restart: unless-stopped
networks:
 dev:
 external: true

passwd

docker exec -it selenium x11vnc -storepasswd P*************************************************************** /home/seluser/.vnc/passwd

proxy 구성

vi /opt/nginx/config/sites-available/selenium.conf

...
 location / {
 if ($allowed_country = no) {
 return 403;
 }
 include /etc/nginx/conf.d/include/proxy.conf;
 proxy_pass http://selenium:7900;
 proxy_buffering off;
 proxy_request_buffering off;
 }
...

uptime-kuma

Mon, 15 Dec 2025 00:00:00 +0000

 graph TB
 A0[duckdns] <-- dns --> B[uptime-kuma]
 subgraph cloud
 A1[ec4mrjp5] <-- https --> B
 A2[m7jrgve9] <-- https --> B
 A3[gvp6nx1a] <-- http --> B
 A1 <-- tcp --> B
 A2 <-- tcp --> B
 A3 <-- tcp --> B
 end
 A4[agq3mbw2] <-- https --> B
 A4 <-- tcp --> B
 subgraph home-lab
 A5[sj9n7air] <-- http --> A4
 A5[sj9n7air] <-- tcp --> A4
 end
 A10[eiyzti2t] <-- https --> B
 A10[eiyzti2t] <-- tcp --> B

container 구성

docker-compose.yml

vi /opt/uptime-kuma/docker-compose.yml

services:
 uptime-kuma:
 image: louislam/uptime-kuma:latest
 container_name: uptime-kuma
 networks:
 - dev
 ports:
 - 3001/tcp
 extra_hosts:
 - "host.docker.internal:host-gateway"
 user: 0:0
 volumes:
 - /opt/uptime-kuma/data:/app/data:rw
 - /var/run/docker.sock:/var/run/docker.sock:ro
 #- /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 restart: unless-stopped
networks:
 dev:
 external: true

데모 페이지

webtop

Mon, 15 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[webtop] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/webtop/docker-compose.yml

services:
 webtop:
 image: raindev11/webtop:latest
 container_name: webtop
 networks:
 - dev
 ports:
 - 3000/tcp
 - 3001/tcp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - TZ=Asia/Seoul
 - START_DOCKER=false
 - DRINODE=/dev/dri/renderD128
 volumes:
 - /opt/webtop/config:/config:rw
 - /var/run/docker.sock:/var/run/docker.sock:ro
 security_opt:
 - seccomp:unconfined
 shm_size: 2gb
 devices:
 - /dev/dri:/dev/dri
 privileged: true
 restart: unless-stopped
networks:
 dev:
 external: true

proxy 구성

authelia 구성

archivebox

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[archivebox] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

.env

vi /opt/archivebox/.env

ADMIN_USERNAME=dev
ADMIN_PASSWORD=k***************************************************************

docker-compose.yml

vi /opt/archivebox/docker-compose.yml

services:
 archivebox:
 image: archivebox/archivebox:sha-5c1a14e
 container_name: archivebox
 networks:
 - dev
 ports:
 - 8000/tcp
 user: 0:0
 environment:
 - ALLOWED_HOSTS=*
 - MEDIA_MAX_SIZE=750m
 - ADMIN_USERNAME=$ADMIN_USERNAME
 - ADMIN_PASSWORD=$ADMIN_PASSWORD
 - TZ=Asia/Seoul
 volumes:
 - /opt/archivebox/data:/data:rw
 restart: unless-stopped
networks:
 dev:
 external: true

설치

cd /opt/archivebox/ && docker compose run archivebox init

host 구성

logrotate

sudo vi /etc/logrotate.d/archivebox

/opt/archivebox/data/logs/*.log {
 daily
 rotate 7
 missingok
 notifempty
 dateext
 dateyesterday
 dateformat -%Y%m%d
 create 0664 999 999
 sharedscripts
 postrotate
 docker restart archivebox >/dev/null 2>&1 || true
 endscript
}

Troubleshooting

PermissionError: [Errno 13] Permission denied: ‘/data/logs/errors.log’

authelia

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B1[apps] <-- proxy --> B
 C[nginx] -- login --> B[authelia]
 C -- login --> D1[apps]
 end
 F[client] -- https --> C

container 구성

docker-compose.yml

vi /opt/authelia/docker-compose.yml

services:
 authelia:
 image: authelia/authelia:latest
 container_name: authelia
 networks:
 - dev
 ports:
 - 9091/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/authelia/config:/config:rw
 restart: unless-stopped
networks:
 dev:
 external: true

configuration.yml

app	url	admiin 접근	guest 접근	login 페이지
privatebin	pb.gvp6nx1a.duckdns.org	O	X	X
webtop	wb.gvp6nx1a.duckdns.org	O	O	X
esportshlper	es.gvp6nx1a.duckdns.org	O	O	X
g4f	g4.gvp6nx1a.duckdns.org	O	O	X
authelia	au.gvp6nx1a.duckdns.org	O	O	O

vi /opt/authelia/config/configuration.yml

server:
 address: 'tcp://:9091/authelia'
log:
 level: 'info'
identity_validation:
 reset_password:
 jwt_secret: 'p***************************************************************'
default_redirection_url: 'https://au.gvp6nx1a.duckdns.org/'
duo_api:
 hostname: 'gvp6nx1a.duckdns.org'
 integration_key: 'c***************************************************************'
 secret_key: 'b***************************************************************'
authentication_backend:
 password_reset:
 disable: false
 file:
 path: '/config/users_database.yml'
 password:
 algorithm: 'argon2id'
 iterations: 3
 memory: 65536
 parallelism: 4
 key_length: 32
 salt_length: 16
access_control:
 default_policy: 'deny'
 rules:
 - domain_regex: '^(pb).gvp6nx1a.duckdns.org'
 subject: 'group:guests'
 policy: 'one_factor'
 - domain_regex: '^(wb|es|g4).gvp6nx1a.duckdns.org'
 subject: 'group:admins'
 policy: 'one_factor'
 - domain: 'au.gvp6nx1a.duckdns.org'
 policy: 'bypass'
session:
 name: 'authelia_session'
 secret: 'K***************************************************************'
 expiration: '1h'
 inactivity: '5m'
 remember_me: '1M'
 domain: 'gvp6nx1a.duckdns.org'
regulation:
 max_retries: 3
 find_time: '2m'
 ban_time: '5m'
storage:
 encryption_key: 'E***************************************************************'
 local:
 path: '/config/db.sqlite3'
notifier:
 disable_startup_check: false
 smtp:
 host: 'smtp.mail.yahoo.com'
 port: 465
 timeout: '5 seconds'
 username: 'x*******@yahoo.com'
 password: '****************'
 sender: 'Authelia <x*******-********@yahoo.com>'
 identifier: 'localhost'
 subject: '[Authelia] {title}'
 startup_check_address: 'x*******-********@yahoo.com'
 disable_require_tls: false
 disable_html_emails: false
 tls:
 skip_verify: false
 minimum_version: 'TLS1.2'

users_database.yml

암호 hash 생성

dashy

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph cloud
 A1[ec4mrjp5] <-- https --> B[dashy]
 A2[m7jrgve9] <-- https --> B
 A3[gvp6nx1a] <-- http --> B
 end
 A4[agq3mbw2] <-- https --> B
 subgraph home-lab
 A5[sj9n7air] <-- http --> A4
 end
 B <-- https --> A6[client]

container 구성

docker-compose.yml

vi /opt/dashy/docker-compose.yml

services:
 dashy:
 image: lissy93/dashy:latest
 container_name: dashy
 networks:
 - dev
 ports:
 - 8080/tcp
 user: 0:0
 environment:
 - UID=1000
 - GID=1000
 - MODE_ENV=production
 - TZ=Asia/Seoul
 volumes:
 - /opt/dashy/config/conf.yml:/app/user-data/conf.yml:rw
 - /opt/dashy/item-icons:/app/user-data/item-icons:rw
 restart: unless-stopped
networks:
 dev:
 external: true

암호 구성

로그인 암호 sha256 hash 생성 후 구성에 저장

dozzle

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A[docker.sock] --> B
 B[dozzle] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/dozzle/docker-compose.yml

services:
 dozzle:
 image: amir20/dozzle:latest
 container_name: dozzle
 networks:
 - dev
 ports:
 - 8080/tcp
 user: 0:0
 environment:
 - DOZZLE_AUTH_PROVIDER=simple
 - TZ=Asia/Seoul
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /opt/dozzle/config:/data:rw
 command:
 - --filter=
 - --level=INFO
 - --no-analytics
 restart: unless-stopped
networks:
 dev:
 external: true

users.yml

암호 구성 yml 생성

node-exporter

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A1[host] --> E2
 E2[node-exporter] -- http --> A3[prometheus]
 end
 A2[host] --> E3
 E3[node-exporter] -- https --> A3

container 구성

docker-compose.yml

수집 데이터에 접근하기 위해 host 모드로 구성

vi /opt/node-exporter/docker-compose.yml

services:
 node-exporter:
 image: prom/node-exporter:latest
 container_name: node-exporter
 network_mode: host
 pid: host
 user: 1000:1000
 volumes:
 - /:/rootfs:ro
 - /proc:/rootfs/proc:ro
 - /sys:/rootfs/sys:ro
 - /run/udev/data:/run/udev/data:ro
 - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:ro
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 - /opt/node-exporter/config/web.yml:/etc/web.yml:rw
 command:
 - --web.config.file=/etc/web.yml
 - --path.rootfs=/rootfs
 - --path.procfs=/rootfs/proc
 - --path.sysfs=/rootfs/sys
 - --collector.filesystem.mount-points-exclude=^/(rootfs/)?(dev|etc|proc|run|sys)($$|/)
 - --collector.processes
 - --collector.systemd
 - --collector.interrupts
 restart: unless-stopped

web.yml

http basic auth 구성

portainer

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A1[docker.sock] ---> B
 B[portainer] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

docker-compose.yml

vi /opt/portainer/docker-compose.yml

services:
 portainer:
 image: portainer/portainer-ce:alpine
 container_name: portainer
 networks:
 - dev
 ports:
 - 8000/tcp
 - 9443/tcp
 user: 0:0
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 - /opt/portainer/data:/data:rw
 restart: unless-stopped
networks:
 dev:
 external: true

promtail

Sun, 14 Dec 2025 00:00:00 +0000

 graph TB
 subgraph ec4mrjp5
 B13[sshd] -- log --> A13[promtail]
 B12[selinux] -- log --> A13
 B11[nginx] -- log --> A13
 end
 A13 <-- https --> A7[loki]
 subgraph m7jrgve9
 B23[sshd] -- log --> A23[promtail]
 B22[selinux] -- log --> A23
 B21[nginx] -- log --> A23
 end
 A23 <-- https --> A7[loki]
 subgraph gvp6nx1a
 B33[sshd] -- log --> A33[promtail]
 B32[selinux] -- log --> A33
 B31[nginx] -- log --> A33
 A33 <-- http --> A7[loki]
 end

container 구성

.env

vi /opt/promtail/.env

LOKI_URL=http://loki:3100/loki/api/v1/push
LOKI_USERNAME=dev
LOKI_PASSWORD=a***************************************************************

docker-compose.yml

vi /opt/promtail/docker-compose.yml

services:
 promtail:
 image: grafana/promtail:latest
 container_name: promtail
 networks:
 - dev
 ports:
 - 9080/tcp
 user: 0:0
 environment:
 - LOKI_URL=$LOKI_URL
 - LOKI_USERNAME=$LOKI_USERNAME
 - LOKI_PASSWORD=$LOKI_PASSWORD
 - TZ=Asia/Seoul
 volumes:
 - /var/log/secure:/var/log/secure:ro
 - /var/log/audit/audit.log:/var/log/audit/audit.log:ro
 - /opt/promtail/config:/etc/promtail:ro
 - /opt/nginx/log:/var/log/nginx:ro
 command:
 - --config.file=/etc/promtail/config.yml
 - --config.expand-env=true
 restart: unless-stopped
networks:
 dev:
 external: true

config.yml

수집할 로그 구성

xray

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph 443/tcp
 A[client] -- https 차단 --- B[firewall]
 A1[client] <-- vless+ws 우회 --> B
 end
 B <-- vless+ws 우회 --> G[nginx-proxy]
 G <--> I[xray]
 I <-- https 요청/응답 --> L[internet]

container 구성

docker-compose.yml

vi /opt/xray/docker-compose.yml

services:
 xray:
 image: teddysun/xray:1.7.5
 container_name: xray
 networks:
 - dev
 ports:
 - 9000/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/xray/config:/etc/xray:rw
 - /opt/.acme/*.$HOSTNAME.duckdns.org_ecc/fullchain.cer:/etc/ssl/*.$HOSTNAME.duckdns.org/fullchain.pem:ro
 - /opt/.acme/*.$HOSTNAME.duckdns.org_ecc/*.$HOSTNAME.duckdns.org.key:/etc/ssl/*.$HOSTNAME.duckdns.org/privkey.pem:ro
 restart: unless-stopped
networks:
 dev:
 external: true

vless-websocket-tls (서버)

vi /opt/xray/config/config.json

{
 "log":{
 "loglevel":"warning"
 },
 "inbounds":[
 {
 "port":9000,
 "protocol":"vless",
 "settings":{
 "clients":[
 {
 "id":"5*******-****-****-****-************",
 "flow":"xtls-rprx-direct"
 }
 ],
 "decryption":"none",
 "fallbacks":[]
 },
 "streamSettings":{
 "network":"ws",
 "security":"tls",
 "tlsSettings":{
 "serverName":"xr.gvp6nx1a.duckdns.org",
 "certificates":[
 {
 "certificateFile":"/etc/ssl/*.gvp6nx1a.duckdns.org/fullchain.pem",
 "keyFile":"/etc/ssl/*.gvp6nx1a.duckdns.org/privkey.pem"
 }
 ]
 },
 "wsSettings":{
 "path":"/w*******",
 "headers":{}
 }
 },
 "tag":"inbound",
 "sniffing":{
 "enabled":true,
 "destOverride":[
 "http",
 "tls"
 ]
 }
 }
 ],
 "outbounds":[
 {
 "protocol":"freedom"
 }
 ]
}

vless-websocket-tls (클라이언트)

vi $USERPROFILE/AppData/Local/qv2ray/connections/maellhfkxqke.qv2ray.json

{
 "outbounds": [
 {
 "protocol": "vless",
 "settings": {
 "vnext": [
 {
 "address": "xr.gvp6nx1a.duckdns.org",
 "port": 443,
 "users": [
 {
 "encryption": "none",
 "id": "5*******-****-****-****-************"
 }
 ]
 }
 ]
 },
 "streamSettings": {
 "network": "ws",
 "security": "tls",
 "tlsSettings": {
 "disableSystemRoot": false,
 "serverName": "xr.gvp6nx1a.duckdns.org"
 },
 "wsSettings": {
 "path": "/w*******"
 },
 "xtlsSettings": {
 "disableSystemRoot": false
 }
 }
 }
 ]
}

proxy 구성

vi /opt/nginx/config/sites-available/xray.conf

...
 location /w******* {
 if ($allowed_country = no) {
 return 403;
 }
 include /etc/nginx/conf.d/include/proxy.conf;
 proxy_pass https://xray:9000;

 keepalive_timeout 65;
 client_max_body_size 0;
 }
...

테스트

dns 누출 확인

fail2ban

Tue, 09 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 A1[sshd] -- log --> B[fail2ban]
 A2[vsftpd] -- log --> B
 A1[sshd] <-- 22/tcp --> A3
 A2[vsftpd] <-- 21/tcp --> A3
 end
 B -- ip/port bsn/unban --> A3[iptables]
 B -- https --> C[telegram]
 A3 <-- 6****/tcp --> D1[client]

host 구성

설치

sudo dnf -y update && sudo dnf install -y fail2ban whois

jail.local

sudo vi /etc/fail2ban/jail.local

[INCLUDES]
before = paths-fedora.conf

[DEFAULT]
ignoreip = 192.168.192.1 2**.**.**.* 1**.***.**.* 1**.***.**.** 1**.***.**.**
ignorecommand =
bantime = 1h
findtime = 1h
maxretry = 10
maxmatches = %(maxretry)s
backend = auto
usedns = warn
logencoding = auto
enabled = false
mode = normal
filter = %(__name__)s[mode=%(mode)s]
blocktype = DROP

destemail = x*******-********@yahoo.com
sender = x*******-********@yahoo.com
mta = sendmail
protocol = tcp
chain = <known/chain>
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s
banaction = iptables-multiport
banaction_allports = iptables-allports
action = %(action_local)s
action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(action_)s
 %(mta)s-whois[sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mwl = %(action_)s
 %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
action_xarf = %(action_)s
 xarf-login-attack[service =%(__name__)s, sender="%(sender)s", logpath="%(logpath)s", port="%(port)s"]
action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
 %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
action_blocklist_de = blocklist_de[email="%(sender)s", service="%(__name__)s", apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]
action_abuseipdb = abuseipdb
action_local = iptables-multiport[chain="%(chain)s", protocol="%(protocol)s", port="%(port)s", blocktype="%(blocktype)s"]
 telegram

telegram.local

sudo vi /etc/fail2ban/action.d/telegram.local

[Definition]
actionstart =
actionstop =
actioncheck =
actionban = /home/dev/.local/bin/notify_fail2ban.sh actionban <name> <ip>
actionunban = /home/dev/.local/bin/notify_fail2ban.sh actionunban <name> <ip>

11-sshd.local

sudo vi /etc/fail2ban/jail.d/11-sshd.local

[sshd]
filter = sshd[mode=aggressive]
logpath = %(syslog_authpriv)s
action = %(action_local)s
chain = INPUT
protocol = tcp
port = 22
maxretry = 1
enabled = true

12-vsftpd.local

sudo vi /etc/fail2ban/jail.d/12-vsftpd.local

[vsftpd]
filter = vsftpd
logpath = %(vsftpd_log)s
action = %(action_local)s
chain = INPUT
protocol = tcp
port = 21,6****:6****
maxretry = 1
enabled = true

구성 적용

sudo fail2ban-server restart && \
sudo fail2ban-client restart && \
sudo systemctl restart fail2ban && sudo systemctl status fail2ban && \
sudo systemctl list-units --type service

sudo fail2ban-client status sshd;
sudo fail2ban-client status vsftpd

logrotate

sudo vi /etc/logrotate.d/fail2ban

/var/log/fail2ban.log {
 daily
 rotate 7
 missingok
 notifempty
 dateext
 dateyesterday
 dateformat -%Y%m%d
 sharedscripts
 postrotate
 /usr/bin/fail2ban-client flushlogs >/dev/null || true
 endscript
}

밴 등록/취소 ¹

sudo fail2ban-client set sshd banip 1.1.1.1;
sudo fail2ban-client set sshd unbanip 1.1.1.1;
sudo fail2ban-client set vsftpd banip 1.1.1.1;
sudo fail2ban-client set vsftpd unbanip 1.1.1.1

vi /home/dev/.local/bin/notify_fail2ban.sh

#!/bin/sh
# fail2ban 알림

. /home/dev/.bashrc
. /home/dev/.local/bin/utils.sh
log_file=/home/dev/.local/log/$(basename "$0" | sed 's/.sh//').log
msg_file=/home/dev/.local/log/$(basename "$0" | sed 's/.sh//').tmp

action="$1"
name="$2"
ip="$3"
{ if [ "$action" = "actionstart" ]; then
 echo ["$name"] started
 fi
 if [ "$action" = "actionstop" ]; then
 echo ["$name"] stopped
 fi
 if [ "$action" = "actionban" ]; then
 echo ["$name"] Ban "$ip"
 whois "$ip" | grep -iE "^(address|country)" \
 | sed -E 's/^(country|address)(.*:)( +)(.*)/\1: \4/gI'
 fi
 if [ "$action" = "actionunban" ]; then
 echo ["$name"] Unban "$ip"
 fi
} > "$log_file"
cp "$log_file" "$msg_file"
send_tel_msg "$TEL_BOT_KEY" "$TEL_CHAT_ID" "$msg_file"
rm "$msg_file"

jdownloader

Tue, 09 Dec 2025 00:00:00 +0000

 graph LR
 A1[my.jdownloader.org] <-- tcp/api --> B[jdownloader]
 A1 <-- https --> D[client]

host 구성

포트 개방

sudo firewall-cmd --permanent --add-forward-port=port=6****:proto=tcp:toport=3129 && \
sudo firewall-cmd --reload && \
sudo firewall-cmd --list-all

container 구성

.env

vi /opt/jdownloader/.env

JD_EMAIL=x*******-********@yahoo.com
JD_PASSWORD=y***************************************************************

docker-compose.yml

vi /opt/jdownloader/docker-compose.yml

services:
 jdownloader:
 image: antlafarge/jdownloader:alpine
 container_name: jdownloader
 networks:
 - dev
 ports:
 - 3129:3129/tcp
 user: 1000:1000
 environment:
 - UID=1000
 - GID=1000
 - JD_DEVICENAME=$HOSTNAME
 - JD_EMAIL=$JD_EMAIL
 - JD_PASSWORD=$JD_PASSWORD
 volumes:
 - /etc/timezone:/etc/timezone:ro
 - /etc/localtime:/etc/localtime:ro
 - /opt/jdownloader/config:/jdownloader/cfg:rw
 - /opt/jdownloader/config/org.jdownloader.extensions.eventscripter.EventScripterExtension.scripts.json:/jdownloader/cfg/org.jdownloader.extensions.eventscripter.EventScripterExtension.scripts.json:ro
 - /home/dev/downloads:/jdownloader/downloads:rw
 restart: unless-stopped
networks:
 dev:
 external: true

org.jdownloader.api.myjdownloader.MyJDownloaderSettings.json

포트 구성

qbittorrent

Tue, 09 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B1[jackett] <-- https/api --> B
 B[qbittorrent] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

.env

vi /opt/qbittorrent/.env

TEL_BOT_KEY=6*********************************************
TEL_CHAT_ID=1*********

docker-compose.yml

vi /opt/qbittorrent/docker-compose.yml

services:
 qbittorrent:
 image: lscr.io/linuxserver/qbittorrent:latest
 container_name: qbittorrent
 networks:
 - dev
 ports:
 - 8080/tcp
 - 6881:6881
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - UMASK=022
 - TZ=Asia/Seoul
 - WEBUI_PORT=8080
 - TORRENTING_PORT=6881
 - TEL_BOT_KEY=$TEL_BOT_KEY
 - TEL_CHAT_ID=$TEL_CHAT_ID
 volumes:
 - /opt/qbittorrent/config:/config:rw
 - /opt/qbittorrent/watched:/watched:rw
 - /home/dev/videos:/videos:rw
 - /home/dev/.local/bin/utils.sh:/config/utils.sh:ro
 - /home/dev/downloads:/downloads:rw
 - /home/dev/videos:/videos:rw
 restart: unless-stopped
networks:
 dev:
 external: true

jackett plugin

vi /opt/qbittorrent/config/qBittorrent/nova3/engines/jackett.json

{
 "api_key": "s*******************************",
 "thread_count": 20,
 "tracker_first": false,
 "url": "https://ja.gvp6nx1a.duckdns.org"
}

완료 시 ¹

vi /opt/qbittorrent/config/qbittorrent_complete.sh

#!/bin/bash
# qbittorrent 다운로드 알림

source /config/utils.sh
log_file=/tmp/$(basename "$0" | sed 's/.sh//').log
msg_file=/tmp/$(basename "$0" | sed 's/.sh//').tmp

gib=$(awk 'BEGIN {printf "%.2f", '"$2"' / (1024 * 1024 * 1024)}')

echo "$1, $gib GiB download completed" > "$log_file"
cp "$log_file" "$msg_file"
send_tel_msg "$TEL_BOT_KEY" "$TEL_CHAT_ID" "$msg_file"
rm "$msg_file"

#do not download 폴더, 파일 삭제
find "/downloads/watched" -type d -name ".unwanted" | sed 's/\/.unwanted/"/' | sed 's/^/"/g' | xargs rm -rf
find "/downloads/watched" -type f -name "*.\!qB"
find "/downloads/complete" -type d -name ".unwanted" | sed 's/\/.unwanted/"/' | sed 's/^/"/g' | xargs rm -rf
find "/downloads/complete" -type f -name "*.\!qB"

host 구성

포트 개방

sudo firewall-cmd --permanent --add-forward-port=port=6****:proto={tcp,udp}:toport=6881 && \
sudo firewall-cmd --reload && \
sudo firewall-cmd --list-all

crond ²

vi ~/.local/bin/update_ipfilter.sh

#!/bin/bash
# ipfilter.dat 데이터베이스 갱신

source /home/dev/.bashrc
source /home/dev/.local/bin/utils.sh
log_file=/home/dev/.local/log/$(basename "$0" | sed 's/.sh//').log
msg_file=/home/dev/.local/log/$(basename "$0" | sed 's/.sh//').tmp

{ curl http://upd.emule-security.org/ipfilter.zip \
 -o /opt/qbittorrent/config/ipfilter.zip
 7z e /opt/qbittorrent/config/ipfilter.zip \
 -o/opt/qbittorrent/config
 mv /opt/qbittorrent/config/guarding.p2p \
 /opt/qbittorrent/config/ipfilter.dat
 rm /opt/qbittorrent/config/ipfilter.zip
} > "$log_file"
show_file_stat /opt/qbittorrent/config/ipfilter.dat > "$msg_file"
send_tel_msg "$TEL_BOT_KEY" "$TEL_CHAT_ID" "$msg_file"
rm "$msg_file"

docker restart qbittorrent && \
grep "IP filter" /opt/qbittorrent/config/qBittorrent/data/logs/qbittorrent.log

Troubleshooting

libtorrent v2.0 메모리 누수

slskd

Tue, 09 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[slskd] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

host 구성

포트 개방

sudo firewall-cmd --permanent --add-forward-port=port=6****:proto=tcp:toport=2234 && \
sudo firewall-cmd --reload && \
sudo firewall-cmd --list-all

container 구성

docker-compose.yml

vi /opt/slskd/docker-compose.yml

services:
 slskd:
 image: slskd/slskd:latest
 container_name: slskd
 networks:
 - dev
 ports:
 - 5030/tcp
 - 2234:6****/tcp
 user: 1000:1000
 environment:
 - SLSKD_REMOTE_CONFIGURATION=true
 - TZ=Asia/Seoul
 volumes:
 - /opt/slskd/config:/app:rw
 - /home/dev/downloads:/downloads:rw
 - /mnt/pc9xqpnh-gdrive/music:/music:rw
 restart: unless-stopped
networks:
 dev:
 external: true

teldrive

Tue, 09 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[teldrive] <-- proxy --> C[nginx]
 end
 C <-- https --> D[client]

container 구성

.env

vi /opt/teldrive/.env

POSTGRES_USER=teldrive
POSTGRES_PASSWORD=X***************************************************************

docker-compose.yml

vi /opt/teldrive/docker-compose.yml

services:
 teldrive:
 image: ghcr.io/tgdrive/teldrive:latest
 container_name: teldrive
 networks:
 - dev
 ports:
 - 59314:8080/tcp
 user: 1000:1000
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/teldrive/config/config.toml:/config.toml:rw
 - /opt/teldrive/config/storage.db:/storage.db:rw
 restart: unless-stopped
 depends_on:
 - teldrive_db
 teldrive_db:
 image: groonga/pgroonga:latest-alpine-17
 container_name: teldrive_db
 networks:
 - dev
 user: 1000:1000
 environment:
 - POSTGRES_DB=postgres
 - POSTGRES_USER=$POSTGRES_USER
 - POSTGRES_PASSWORD=$POSTGRES_PASSWORD
 - TZ=Asia/Seoul
 volumes:
 - /opt/teldrive/data:/var/lib/postgresql/data
 restart: unless-stopped
networks:
 dev:
 external: true

config.toml

vi /opt/teldrive/config/config.toml

[db]
data-source = "postgres://teldrive:X***************************************************************@teldrive_db/postgres"

[jwt]
secret = "7***************************************************************"

[tg]
app-id = 2*******
app-hash = "f*******************************"
rate = 50 #ban 되지 않기 위한 속도 제한
rate-burst = 20
rate-limit = true

[tg.stream]
multi-threads = 6
stream-buffers = 20

[tg.uploads]
encryption-key = "b***************************************************************"

db 초기화

sudo rm -rf /opt/teldrive/data/*

proxy 구성

vi /opt/nginx/config/conf.d/include/proxy.conf

proxy_http_version 1.1;

# Proxy SSL
proxy_ssl_server_name on;

# Proxy headers
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Forwarded $proxy_add_forwarded;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header Connection "";

# Proxy timeouts
proxy_connect_timeout 180s;
proxy_send_timeout 180s;
proxy_read_timeout 180s;
...

vi /opt/nginx/config/sites-available/teldrive.conf

...
 location / {
 if ($allowed_country = no) {
 return 403;
 }
 include /etc/nginx/conf.d/include/proxy.conf;
 # webdav 공통
 proxy_buffering off;
 proxy_request_buffering off;
 client_max_body_size 0;
 keepalive_timeout 180s;
 proxy_pass http://teldrive:8080;
 }
...

Troubleshooting

봇 추가 시 속도 하락 (2025-10)

alist (deprecated)

Mon, 08 Dec 2025 00:00:00 +0000

Deprecated

teambition 트래픽 정책 변경과 보안 이슈가 잦음

teambition -> teldrive 마이그레이션 완료 후 삭제할 것

 graph LR
 A1[webdrives] -- mount --- B[alist]
 subgraph gvp6nx1a
 B <-- proxy --> C[nginx]
 end
 C <-- https --> D[rclone]

container 구성

docker-compose.yml

vi /opt/alist/docker-compose.yml

services:
 alist:
 image: xhofe/alist:v3.27.0 #보안 이슈로 롤백 https://singingdalong.blogspot.com/2025/06/Alist-project-issue-8649.html#gsc.tab=0
 container_name: alist
 networks:
 - dev
 ports:
 - 5244:5244/tcp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - UMASK=022
 - TZ=Asia/Seoul
 volumes:
 - /opt/alist/config:/opt/alist/data:rw
 restart: unless-stopped
networks:
 dev:
 external: true

config.json

로그 생성 차단

immich

Mon, 08 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B[immich] <-- proxy --> C[nginx]
 G[immich-go] <-- api --> B
 G1[vsftpd] --- G
 end
 C <-- https --> D[client]
 F1[rclone] -- tcp --> G1

container 구성

.env

vi /opt/immich/.env

TZ=Asia/Seoul
IMMICH_VERSION=release
DB_PASSWORD=postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

docker-compose.yml

vi /opt/immich/docker-compose.yml

services:
services:
 immich-server:
 image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
 container_name: immich
 networks:
 - dev
 ports:
 - 2283:2283/tcp
 environment:
 - TZ=Asia/Seoul
 - DB_HOSTNAME=immich-postgres
 - REDIS_HOSTNAME=immich-redis 
 volumes:
 - /opt/immich/data:/data:rw
 restart: unless-stopped
 depends_on:
 - immich-redis
 - immich-postgres
 immich-machine-learning:
 image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
 container_name: immich-machine-learning
 networks:
 - dev
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/immich/cache:/cache:rw
 restart: unless-stopped
 immich-redis:
 image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
 container_name: immich-redis
 networks:
 - dev
 environment:
 - TZ=Asia/Seoul
 restart: unless-stopped
 immich-postgres:
 image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:c44be5f2871c59362966d71eab4268170eb6f5653c0e6170184e72b38ffdf107
 container_name: immich-postgres
 networks:
 - dev
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 - POSTGRES_PASSWORD=${DB_PASSWORD}
 - POSTGRES_USER=${DB_USERNAME}
 - POSTGRES_DB=${DB_DATABASE_NAME}
 - POSTGRES_INITDB_ARGS='--data-checksums'
 volumes:
 - /opt/immich/db_data:/var/lib/postgresql/data
 shm_size: 128mb
 restart: unless-stopped
networks:
 dev:
 external: true

db 초기화

sudo rm -rf /opt/immich/db_data && sudo mkdir /opt/immich/db_data

host 구성

immich-go

로컬 폴더에서 immich 서버로 벌크 업로드

netbootxyz

Mon, 08 Dec 2025 00:00:00 +0000

 graph LR
 A1 -- tftp --> A2[client]
 subgraph agq3mbw2
 B[netbootxyz] -- tftp --> A1[dhcp]
 subgraph sj9n7air
 B <-- proxy --> C[nginx]
 end
 end
 C <-- https --> D[client]

host 구성

포트 개방

tftp: 69번 포트
dhcp: 67번 포트(server, relay agent), 68번 포트(client) ¹

cat /usr/lib/firewalld/services/dhcp.xml | grep port && \
cat /usr/lib/firewalld/services/tftp.xml | grep port
 <port protocol="udp" port="67"/>
 <port protocol="udp" port="69"/>

sudo firewall-cmd --permanent --add-port=69/udp && \
sudo firewall-cmd --permanent --add-port=8080/tcp && \
sudo firewall-cmd --permanent --remove-port=16000/tcp && \
sudo firewall-cmd --permanent --remove-port=10809/tcp && \
sudo firewall-cmd --permanent --remove-port=67/udp && \
sudo firewall-cmd --reload && \
sudo firewall-cmd --list-all

selinux

sudo setsebool -P tftp_anon_write 1 && \
sudo setsebool -P tftp_home_dir 1 && \
getsebool -a | grep tftp

container 구성

docker-compose.yml

vi /opt/netbootxyz/docker-compose.yml

services:
 netbootxyz:
 image: lscr.io/linuxserver/netbootxyz:latest
 container_name: netbootxyz
 networks:
 - dev
 ports:
 - 69:69/udp
 - 3000:3000/tcp
 - 8080:80/tcp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - TZ=Asia/Seoul
 - PORT_RANGE=30000:30010
 - NGINX_PORT=80
 - WEB_APP_PORT=3000
 volumes:
 - /opt/netbootxyz/config:/config:rw
 - /opt/netbootxyz/assets:/assets:rw
 restart: unless-stopped
networks:
 dev:
 external: true

boot.cfg

vi /opt/netbootxyz/config/menus/local/boot.cfg

...
# set location of custom netboot.xyz live assets
#set live_endpoint https://github.com/netbootxyz
set live_endpoint http://sj9n7air:8080

######################################
# Media Locations for Licensed Distros
######################################
set rhel_base_url
set win_base_url ${live_endpoint}/custom/releases/download/windows11
set github_user dntco43u
...

menu.ipxe

멀티 부팅 ²

앱 on 대충어쩌고저쩌고샬라샬라

ansible

kubernetes

rabbitmq

redis

esportshelper (deprecated)

container 구성

docker-compose.yml

config.yaml

webhook 구성

freshrss

container 구성

docker-compose.yml

구성

g4f

container 구성

docker-compose.yml (arm)

proxy 구성

gitea

container 구성

docker-compose.yml

key

guacamole

container 구성

docker-compose.yml

proxy 구성

Troubleshooting

hugo

container 구성

docker-compose.yml

docsy 테마 1

giscus 댓글 3

기타

favicon

host 구성

deploy_hugo.sh 5

github 구성

deploy-hugo.yml

SEO

Troubleshooting

jackett

container 구성

docker-compose.yml

host 구성

logrotate

jellyfin

container 구성

docker-compose.yml

Transcoding

kavita

container 구성

docker-compose.yml

라이브러리 구조 1

loki

container 구성

docker-compose.yml

local-config.yaml

navidrome

.env

docker-compose.yml

pgsql-exporter

container 구성

.env

docker-compose.yml

privatebin

container 구성

docker-compose.yml

proxy 구성

prometheus

container 구성

docker-compose.yml

일반 구성

selenium

container 구성

.env

docker-compose.yml

passwd

proxy 구성

uptime-kuma

container 구성

docsy 테마 ¹

giscus 댓글 ³

deploy_hugo.sh ⁵

라이브러리 구조 ¹

밴 등록/취소 ¹

완료 시 ¹