nginx on 대충어쩌고저쩌고샬라샬라

authelia

Sun, 14 Dec 2025 00:00:00 +0000

 graph LR
 subgraph gvp6nx1a
 B1[apps] <-- proxy --> B
 C[nginx] -- login --> B[authelia]
 C -- login --> D1[apps]
 end
 F[client] -- https --> C

container 구성

docker-compose.yml

vi /opt/authelia/docker-compose.yml

services:
 authelia:
 image: authelia/authelia:latest
 container_name: authelia
 networks:
 - dev
 ports:
 - 9091/tcp
 user: 0:0
 environment:
 - TZ=Asia/Seoul
 volumes:
 - /opt/authelia/config:/config:rw
 restart: unless-stopped
networks:
 dev:
 external: true

configuration.yml

app	url	admiin 접근	guest 접근	login 페이지
privatebin	pb.gvp6nx1a.duckdns.org	O	X	X
webtop	wb.gvp6nx1a.duckdns.org	O	O	X
esportshlper	es.gvp6nx1a.duckdns.org	O	O	X
g4f	g4.gvp6nx1a.duckdns.org	O	O	X
authelia	au.gvp6nx1a.duckdns.org	O	O	O

vi /opt/authelia/config/configuration.yml

server:
 address: 'tcp://:9091/authelia'
log:
 level: 'info'
identity_validation:
 reset_password:
 jwt_secret: 'p***************************************************************'
default_redirection_url: 'https://au.gvp6nx1a.duckdns.org/'
duo_api:
 hostname: 'gvp6nx1a.duckdns.org'
 integration_key: 'c***************************************************************'
 secret_key: 'b***************************************************************'
authentication_backend:
 password_reset:
 disable: false
 file:
 path: '/config/users_database.yml'
 password:
 algorithm: 'argon2id'
 iterations: 3
 memory: 65536
 parallelism: 4
 key_length: 32
 salt_length: 16
access_control:
 default_policy: 'deny'
 rules:
 - domain_regex: '^(pb).gvp6nx1a.duckdns.org'
 subject: 'group:guests'
 policy: 'one_factor'
 - domain_regex: '^(wb|es|g4).gvp6nx1a.duckdns.org'
 subject: 'group:admins'
 policy: 'one_factor'
 - domain: 'au.gvp6nx1a.duckdns.org'
 policy: 'bypass'
session:
 name: 'authelia_session'
 secret: 'K***************************************************************'
 expiration: '1h'
 inactivity: '5m'
 remember_me: '1M'
 domain: 'gvp6nx1a.duckdns.org'
regulation:
 max_retries: 3
 find_time: '2m'
 ban_time: '5m'
storage:
 encryption_key: 'E***************************************************************'
 local:
 path: '/config/db.sqlite3'
notifier:
 disable_startup_check: false
 smtp:
 host: 'smtp.mail.yahoo.com'
 port: 465
 timeout: '5 seconds'
 username: 'x*******@yahoo.com'
 password: '****************'
 sender: 'Authelia <x*******-********@yahoo.com>'
 identifier: 'localhost'
 subject: '[Authelia] {title}'
 startup_check_address: 'x*******-********@yahoo.com'
 disable_require_tls: false
 disable_html_emails: false
 tls:
 skip_verify: false
 minimum_version: 'TLS1.2'

users_database.yml

암호 hash 생성

alist (deprecated)

Mon, 08 Dec 2025 00:00:00 +0000

Deprecated

teambition 트래픽 정책 변경과 보안 이슈가 잦음

teambition -> teldrive 마이그레이션 완료 후 삭제할 것

 graph LR
 A1[webdrives] -- mount --- B[alist]
 subgraph gvp6nx1a
 B <-- proxy --> C[nginx]
 end
 C <-- https --> D[rclone]

container 구성

docker-compose.yml

vi /opt/alist/docker-compose.yml

services:
 alist:
 image: xhofe/alist:v3.27.0 #보안 이슈로 롤백 https://singingdalong.blogspot.com/2025/06/Alist-project-issue-8649.html#gsc.tab=0
 container_name: alist
 networks:
 - dev
 ports:
 - 5244:5244/tcp
 user: 0:0
 environment:
 - PUID=1000
 - PGID=1000
 - UMASK=022
 - TZ=Asia/Seoul
 volumes:
 - /opt/alist/config:/opt/alist/data:rw
 restart: unless-stopped
networks:
 dev:
 external: true

config.json

로그 생성 차단

nginx

Mon, 08 Dec 2025 00:00:00 +0000

 graph LR
 A5[server] <-- https --> B[nginx]
 subgraph gvp6nx1a
 A1[apps] <-- http --> B[nginx]
 A2[geoip] -- country-code --> B
 B -- log --> A3[promtail]
 A3 -- http --> A7[loki]
 A4[acme.sh] -- ssl-cert --> B
 end
 A7 <-- https --> E[server]
 A6[zerossl] -- dns-api --> A4
 B <-- https --> C1[client]

container 구성

Dockerfile

vi /opt/nginx/Dockerfile

FROM nginx:alpine-slim AS builder
RUN apk update && \
 apk add --no-cache --virtual .build-deps \
 gcc \
 geoip-dev \
 git \
 libc-dev \
 libmaxminddb \
 libmaxminddb-dev \
 make \
 openssl-dev \
 pcre-dev \
 python3-dev \
 py3-pip \
 zlib-dev && \
 rm -rf /var/cache/apk/*
WORKDIR /usr/local
RUN git clone https://github.com/leev/ngx_http_geoip2_module.git --depth=1
RUN wget http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz && \
 mkdir -p /usr/src && \
 tar -zxC /usr/src -f nginx-${NGINX_VERSION}.tar.gz
RUN CONFARGS=$(nginx -V 2>&1 | sed -n -e 's/^.*arguments: //p') \
 cd /usr/src/nginx-$NGINX_VERSION && \
 ./configure --with-compat $CONFARGS \
 --add-dynamic-module=/usr/local/ngx_http_geoip2_module/ && \
 make && \
 make modules && \
 make install && \
 mkdir -p /usr/local/nginx/modules/
FROM nginx:alpine-slim
COPY --from=builder /usr/local/nginx/modules/ngx_http_geoip2_module.so /usr/lib/nginx/modules/ngx_http_geoip2_module.so
RUN apk update && \
 apk add --no-cache \
 libmaxminddb \
 openssl && \
 rm -rf /var/cache/apk/*

docker build -t e7hnr8ov/nginx:alpine /opt/nginx

docker-compose.yml

network bridge 구성이어도 host를 허용하도록 구성