Proxmox Infrastruktur - Vollstaendige Konfiguration
Enthaelt: - Docker Compose mit allen Services (Nextcloud, Vaultwarden, n8n, etc.) - nginx Reverse Proxy Konfiguration mit Rate Limiting - WireGuard VPN Template - Backup und Health-Check Scripts - Deployment Script - Ausfuehrliche Dokumentation und Troubleshooting Guide Services: - Isolierte Netzwerke pro Service - Resource Limits (CPU/Memory) - Health Checks - Logging Konfiguration Sicherheit: - .env Template ohne Secrets - Rate Limiting auf nginx - TLS 1.2+ only - Security Headers 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Martin Eckardt
275
docs/INSTALL.md
Normal file
275
docs/INSTALL.md
Normal file
@@ -0,0 +1,275 @@
|
||||
# Installationsanleitung
|
||||
|
||||
Detaillierte Anleitung zur Erstinstallation der Proxmox Infrastruktur.
|
||||
|
||||
## Voraussetzungen
|
||||
|
||||
### Hardware
|
||||
|
||||
- **CPU:** Min. 2 Cores (4 empfohlen)
|
||||
- **RAM:** Min. 4GB (8GB empfohlen)
|
||||
- **Speicher:** Min. 50GB SSD
|
||||
|
||||
### Software
|
||||
|
||||
- Proxmox VE 7.x/8.x oder Debian 11/12 / Ubuntu 22.04+
|
||||
- Docker CE (wird automatisch installiert)
|
||||
- WireGuard (fuer externen Zugriff)
|
||||
|
||||
### Netzwerk
|
||||
|
||||
- Statische IP oder DHCP-Reservierung
|
||||
- Zugriff auf Port 51820/UDP (WireGuard)
|
||||
- Domain/Subdomain (z.B. via DuckDNS)
|
||||
|
||||
---
|
||||
|
||||
## Teil 1: Proxmox Server vorbereiten
|
||||
|
||||
### 1.1 Docker installieren
|
||||
|
||||
```bash
|
||||
# System aktualisieren
|
||||
apt update && apt upgrade -y
|
||||
|
||||
# Docker installieren
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
|
||||
# Docker beim Boot starten
|
||||
systemctl enable docker
|
||||
systemctl start docker
|
||||
|
||||
# Pruefen
|
||||
docker --version
|
||||
docker compose version
|
||||
```
|
||||
|
||||
### 1.2 WireGuard installieren
|
||||
|
||||
```bash
|
||||
# WireGuard installieren
|
||||
apt install wireguard -y
|
||||
|
||||
# Keys generieren
|
||||
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
|
||||
|
||||
# Berechtigungen setzen
|
||||
chmod 600 /etc/wireguard/privatekey
|
||||
|
||||
# Keys anzeigen
|
||||
cat /etc/wireguard/privatekey
|
||||
cat /etc/wireguard/publickey
|
||||
```
|
||||
|
||||
### 1.3 WireGuard konfigurieren
|
||||
|
||||
```bash
|
||||
cat > /etc/wireguard/wg0.conf << 'EOF'
|
||||
[Interface]
|
||||
PrivateKey = <DEIN_PRIVATE_KEY>
|
||||
Address = 10.0.0.2/24
|
||||
|
||||
[Peer]
|
||||
PublicKey = <VPS_PUBLIC_KEY>
|
||||
Endpoint = <VPS_IP>:51820
|
||||
AllowedIPs = 10.0.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
# Aktivieren
|
||||
systemctl enable wg-quick@wg0
|
||||
systemctl start wg-quick@wg0
|
||||
|
||||
# Testen
|
||||
ping 10.0.0.1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 2: Repository klonen und konfigurieren
|
||||
|
||||
### 2.1 Repository klonen
|
||||
|
||||
```bash
|
||||
cd /opt
|
||||
git clone https://eckardt-git.duckdns.org/Martin/proxmox-infrastruktur.git
|
||||
cd proxmox-infrastruktur
|
||||
```
|
||||
|
||||
### 2.2 Environment-Variablen konfigurieren
|
||||
|
||||
```bash
|
||||
# Template kopieren
|
||||
cp docker/.env.template docker/.env
|
||||
|
||||
# Sichere Passwoerter generieren
|
||||
echo "NEXTCLOUD_DB_PASSWORD=$(openssl rand -hex 16)"
|
||||
echo "NEXTCLOUD_DB_ROOT_PASSWORD=$(openssl rand -hex 16)"
|
||||
echo "VAULTWARDEN_ADMIN_TOKEN=$(openssl rand -base64 48)"
|
||||
echo "N8N_PASSWORD=$(openssl rand -hex 16)"
|
||||
|
||||
# Datei bearbeiten und Passwoerter eintragen
|
||||
nano docker/.env
|
||||
```
|
||||
|
||||
### 2.3 Verzeichnisse erstellen
|
||||
|
||||
```bash
|
||||
# Alle Datenverzeichnisse erstellen
|
||||
mkdir -p /opt/docker/nextcloud/{data,db}
|
||||
mkdir -p /opt/docker/vaultwarden
|
||||
mkdir -p /opt/docker/n8n
|
||||
mkdir -p /opt/docker/audiobookshelf/{audiobooks,podcasts,config,metadata}
|
||||
mkdir -p /opt/docker/websites/{html,conf}
|
||||
mkdir -p /opt/docker/api
|
||||
mkdir -p /opt/docker/gitea
|
||||
mkdir -p /opt/backups
|
||||
mkdir -p /opt/scripts
|
||||
|
||||
# Berechtigungen setzen
|
||||
chown -R 1000:1000 /opt/docker/*
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 3: Services deployen
|
||||
|
||||
### 3.1 Docker Compose kopieren
|
||||
|
||||
```bash
|
||||
cp docker/docker-compose.yml /opt/docker/
|
||||
cp docker/.env /opt/docker/
|
||||
```
|
||||
|
||||
### 3.2 Container starten
|
||||
|
||||
```bash
|
||||
cd /opt/docker
|
||||
docker compose pull
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
### 3.3 Status pruefen
|
||||
|
||||
```bash
|
||||
docker compose ps
|
||||
docker compose logs -f
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 4: Services einrichten
|
||||
|
||||
### 4.1 Nextcloud
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:8081`
|
||||
2. Admin-Account erstellen
|
||||
3. Datenbank: MySQL/MariaDB
|
||||
- Host: `nextcloud-db`
|
||||
- Datenbank: `nextcloud`
|
||||
- User: `nextcloud`
|
||||
- Passwort: aus .env
|
||||
4. Installation abschliessen
|
||||
|
||||
### 4.2 Vaultwarden
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:8083`
|
||||
2. Account erstellen
|
||||
3. Admin-Panel: `http://<PROXMOX_IP>:8083/admin`
|
||||
- Token aus .env eingeben
|
||||
4. Einstellungen anpassen:
|
||||
- Registrierung deaktivieren
|
||||
- Invite only aktivieren
|
||||
|
||||
### 4.3 Gitea
|
||||
|
||||
Separates Repository: [proxmox-gitea](https://eckardt-git.duckdns.org/Martin/proxmox-gitea)
|
||||
|
||||
```bash
|
||||
cd /opt/docker/gitea
|
||||
# docker-compose.yml aus proxmox-gitea Repository
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:3000`
|
||||
2. Datenbank: SQLite3
|
||||
3. Admin-Account erstellen
|
||||
|
||||
### 4.4 n8n
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:5678`
|
||||
2. Login mit Credentials aus .env
|
||||
|
||||
---
|
||||
|
||||
## Teil 5: VPS Reverse Proxy (Optional)
|
||||
|
||||
Fuer externen Zugriff ueber das Internet.
|
||||
|
||||
### 5.1 WireGuard auf VPS
|
||||
|
||||
```bash
|
||||
# Auf Windows VPS mit WireGuard installiert
|
||||
# Config in C:\Program Files\WireGuard\wg0.conf
|
||||
|
||||
[Interface]
|
||||
PrivateKey = <VPS_PRIVATE_KEY>
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
|
||||
[Peer]
|
||||
PublicKey = <PROXMOX_PUBLIC_KEY>
|
||||
AllowedIPs = 10.0.0.2/32
|
||||
```
|
||||
|
||||
### 5.2 nginx auf VPS
|
||||
|
||||
```bash
|
||||
# nginx.conf aus configs/nginx/nginx.conf verwenden
|
||||
# Pfad auf Windows: C:\nginx\conf\nginx.conf
|
||||
```
|
||||
|
||||
### 5.3 SSL-Zertifikate
|
||||
|
||||
```cmd
|
||||
# win-acme fuer Let's Encrypt
|
||||
C:\winacme\wacs.exe --target manual --host eckardt-vault.duckdns.org --validation filesystem --webroot C:\nginx\html --store pemfiles --pemfilespath C:\nginx\ssl
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 6: Automatisierung
|
||||
|
||||
### 6.1 Scripts installieren
|
||||
|
||||
```bash
|
||||
cp scripts/*.sh /opt/scripts/
|
||||
chmod +x /opt/scripts/*.sh
|
||||
```
|
||||
|
||||
### 6.2 Backup Cronjob
|
||||
|
||||
```bash
|
||||
# crontab -e
|
||||
0 3 * * * /opt/scripts/backup.sh all >> /var/log/backup.log 2>&1
|
||||
```
|
||||
|
||||
### 6.3 Health-Check Cronjob
|
||||
|
||||
```bash
|
||||
# crontab -e
|
||||
*/5 * * * * /opt/scripts/health-check.sh >> /var/log/health-check.log 2>&1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Fertig!
|
||||
|
||||
Nach der Installation sollten alle Services laufen:
|
||||
|
||||
```bash
|
||||
# Pruefen
|
||||
/opt/scripts/health-check.sh
|
||||
```
|
||||
|
||||
Bei Problemen: [TROUBLESHOOTING.md](TROUBLESHOOTING.md)
|
||||
351
docs/TROUBLESHOOTING.md
Normal file
351
docs/TROUBLESHOOTING.md
Normal file
@@ -0,0 +1,351 @@
|
||||
# Troubleshooting Guide
|
||||
|
||||
## Inhaltsverzeichnis
|
||||
|
||||
1. [Container Probleme](#1-container-probleme)
|
||||
2. [Netzwerk Probleme](#2-netzwerk-probleme)
|
||||
3. [SSL/Zertifikat Probleme](#3-sslzertifikat-probleme)
|
||||
4. [Service-spezifische Probleme](#4-service-spezifische-probleme)
|
||||
5. [Backup/Restore Probleme](#5-backuprestore-probleme)
|
||||
6. [Performance Probleme](#6-performance-probleme)
|
||||
|
||||
---
|
||||
|
||||
## 1. Container Probleme
|
||||
|
||||
### Container startet nicht
|
||||
|
||||
**Symptom:** `docker compose up -d` laeuft, aber Container ist nicht aktiv
|
||||
|
||||
```bash
|
||||
# Status pruefen
|
||||
docker compose ps
|
||||
|
||||
# Logs anzeigen
|
||||
docker logs <container-name>
|
||||
|
||||
# Detaillierte Infos
|
||||
docker inspect <container-name>
|
||||
```
|
||||
|
||||
**Haeufige Ursachen:**
|
||||
|
||||
1. **Port bereits belegt**
|
||||
```bash
|
||||
# Port pruefen
|
||||
netstat -tulpn | grep <port>
|
||||
|
||||
# Prozess beenden oder Port aendern
|
||||
```
|
||||
|
||||
2. **Volume-Berechtigungen**
|
||||
```bash
|
||||
# Berechtigungen korrigieren
|
||||
chown -R 1000:1000 /opt/docker/<service>
|
||||
chmod -R 755 /opt/docker/<service>
|
||||
```
|
||||
|
||||
3. **Fehlende .env Datei**
|
||||
```bash
|
||||
# Pruefen ob .env existiert
|
||||
ls -la /opt/docker/.env
|
||||
|
||||
# Aus Template erstellen
|
||||
cp docker/.env.template docker/.env
|
||||
```
|
||||
|
||||
### "Permission denied" auf Proxmox
|
||||
|
||||
**Symptom:** `socketpair() failed (13: Permission denied)`
|
||||
|
||||
**Loesung:** security_opt in docker-compose.yml:
|
||||
```yaml
|
||||
security_opt:
|
||||
- apparmor=unconfined
|
||||
- seccomp=unconfined
|
||||
```
|
||||
|
||||
### Container restarts staendig
|
||||
|
||||
**Symptom:** Container Status zeigt "Restarting"
|
||||
|
||||
```bash
|
||||
# Exit-Code pruefen
|
||||
docker inspect --format='{{.State.ExitCode}}' <container>
|
||||
|
||||
# Letzten Fehler anzeigen
|
||||
docker logs --tail 50 <container>
|
||||
|
||||
# Health-Check deaktivieren zum Debuggen
|
||||
docker compose up -d --no-healthcheck <service>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. Netzwerk Probleme
|
||||
|
||||
### WireGuard Tunnel nicht verbunden
|
||||
|
||||
**Symptom:** Keine Verbindung zu 10.0.0.x Adressen
|
||||
|
||||
```bash
|
||||
# WireGuard Status
|
||||
wg show wg0
|
||||
|
||||
# Interface pruefen
|
||||
ip addr show wg0
|
||||
|
||||
# Tunnel neu starten
|
||||
systemctl restart wg-quick@wg0
|
||||
|
||||
# Logs pruefen
|
||||
journalctl -u wg-quick@wg0 -n 50
|
||||
```
|
||||
|
||||
**Checkliste:**
|
||||
- [ ] PrivateKey/PublicKey korrekt?
|
||||
- [ ] Endpoint IP:Port erreichbar?
|
||||
- [ ] Firewall-Regeln auf VPS?
|
||||
- [ ] PersistentKeepalive gesetzt?
|
||||
|
||||
### Service nicht extern erreichbar
|
||||
|
||||
```bash
|
||||
# 1. Container laeuft?
|
||||
docker ps | grep <service>
|
||||
|
||||
# 2. Port offen auf Proxmox?
|
||||
curl http://localhost:<port>
|
||||
|
||||
# 3. WireGuard Tunnel aktiv?
|
||||
ping 10.0.0.1 # VPS von Proxmox
|
||||
|
||||
# 4. nginx Config auf VPS testen
|
||||
cd C:\nginx && nginx.exe -t
|
||||
|
||||
# 5. nginx neu laden
|
||||
net stop nginx && net start nginx
|
||||
```
|
||||
|
||||
### DNS-Probleme
|
||||
|
||||
```bash
|
||||
# DuckDNS IP pruefen
|
||||
nslookup eckardt-vault.duckdns.org
|
||||
|
||||
# Eigene externe IP pruefen
|
||||
curl ifconfig.me
|
||||
|
||||
# DuckDNS manuell aktualisieren
|
||||
curl "https://www.duckdns.org/update?domains=eckardt-vault&token=<TOKEN>&ip="
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. SSL/Zertifikat Probleme
|
||||
|
||||
### Zertifikat abgelaufen
|
||||
|
||||
**Auf Windows VPS:**
|
||||
```cmd
|
||||
# Zertifikat erneuern
|
||||
cd C:\winacme
|
||||
wacs.exe --renew --force
|
||||
|
||||
# nginx neu laden
|
||||
net stop nginx && net start nginx
|
||||
```
|
||||
|
||||
### Let's Encrypt Rate Limit
|
||||
|
||||
**Symptom:** "too many certificates already issued"
|
||||
|
||||
**Loesung:**
|
||||
- 5 Zertifikate pro Domain pro Woche
|
||||
- Warten oder Subdomain aendern
|
||||
- Staging-Umgebung zum Testen nutzen
|
||||
|
||||
### Mixed Content Warnung
|
||||
|
||||
**Symptom:** Browser zeigt "unsichere Inhalte"
|
||||
|
||||
**Loesung:** Alle Services muessen HTTPS nutzen
|
||||
```nginx
|
||||
# In nginx.conf
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. Service-spezifische Probleme
|
||||
|
||||
### Nextcloud
|
||||
|
||||
**"Maintenance mode is enabled"**
|
||||
```bash
|
||||
docker exec nextcloud php occ maintenance:mode --off
|
||||
```
|
||||
|
||||
**Datei-Upload schlaegt fehl**
|
||||
```bash
|
||||
# PHP Limits anpassen
|
||||
docker exec nextcloud bash -c 'echo "upload_max_filesize=10G" >> /usr/local/etc/php/conf.d/uploads.ini'
|
||||
docker exec nextcloud bash -c 'echo "post_max_size=10G" >> /usr/local/etc/php/conf.d/uploads.ini'
|
||||
docker restart nextcloud
|
||||
```
|
||||
|
||||
**"Trusted Domain" Fehler**
|
||||
```bash
|
||||
docker exec nextcloud php occ config:system:set trusted_domains 1 --value=eckardt-cloud.duckdns.org
|
||||
```
|
||||
|
||||
### Vaultwarden
|
||||
|
||||
**Admin-Seite nicht erreichbar**
|
||||
```bash
|
||||
# Admin-Token pruefen
|
||||
docker logs vaultwarden | grep -i admin
|
||||
|
||||
# URL: /admin mit Token aus .env
|
||||
```
|
||||
|
||||
**Sync-Fehler in Clients**
|
||||
```bash
|
||||
# Verbindung testen
|
||||
curl -v https://eckardt-vault.duckdns.org/vault/api/alive
|
||||
```
|
||||
|
||||
### Gitea
|
||||
|
||||
**SSH Clone funktioniert nicht**
|
||||
```bash
|
||||
# SSH-Verbindung testen
|
||||
ssh -T -p 2222 git@192.168.178.111
|
||||
|
||||
# Authorized Keys pruefen
|
||||
docker exec gitea cat /data/git/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
**"Unable to find user" nach Restart**
|
||||
```bash
|
||||
# Gitea User pruefen
|
||||
docker exec gitea gitea admin user list
|
||||
```
|
||||
|
||||
### n8n
|
||||
|
||||
**Webhooks funktionieren nicht**
|
||||
```bash
|
||||
# Webhook-URL pruefen
|
||||
# Muss WEBHOOK_URL in .env auf externe URL zeigen
|
||||
docker logs n8n | grep -i webhook
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Backup/Restore Probleme
|
||||
|
||||
### Backup schlaegt fehl
|
||||
|
||||
```bash
|
||||
# Berechtigungen pruefen
|
||||
ls -la /opt/backups/
|
||||
|
||||
# Speicherplatz pruefen
|
||||
df -h /opt/backups/
|
||||
|
||||
# Manuell testen
|
||||
/opt/scripts/backup.sh nextcloud
|
||||
```
|
||||
|
||||
### Restore durchfuehren
|
||||
|
||||
```bash
|
||||
# Container stoppen
|
||||
docker compose stop <service>
|
||||
|
||||
# Altes Volume loeschen
|
||||
rm -rf /opt/docker/<service>/*
|
||||
|
||||
# Backup entpacken
|
||||
tar -xzf /opt/backups/<service>_YYYYMMDD.tar.gz -C /opt/docker/<service>/
|
||||
|
||||
# Container starten
|
||||
docker compose up -d <service>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Performance Probleme
|
||||
|
||||
### Hohe CPU-Last
|
||||
|
||||
```bash
|
||||
# Top Prozesse
|
||||
docker stats --no-stream
|
||||
|
||||
# Ressourcen-Limits pruefen
|
||||
docker inspect --format='{{.HostConfig.NanoCpus}}' <container>
|
||||
```
|
||||
|
||||
### Speicher voll
|
||||
|
||||
```bash
|
||||
# Docker Cleanup
|
||||
docker system prune -a --volumes
|
||||
|
||||
# Alte Logs loeschen
|
||||
truncate -s 0 /var/lib/docker/containers/*/*-json.log
|
||||
|
||||
# Alte Backups loeschen
|
||||
find /opt/backups -mtime +30 -delete
|
||||
```
|
||||
|
||||
### Langsame Antwortzeiten
|
||||
|
||||
```bash
|
||||
# Netzwerk-Latenz testen
|
||||
ping -c 10 10.0.0.2
|
||||
|
||||
# Container-Ressourcen
|
||||
docker stats <container>
|
||||
|
||||
# Disk I/O
|
||||
iostat -x 1 5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Diagnose-Befehle Uebersicht
|
||||
|
||||
```bash
|
||||
# Alle Container Status
|
||||
docker compose ps
|
||||
|
||||
# Alle Logs (live)
|
||||
docker compose logs -f
|
||||
|
||||
# Ressourcen-Nutzung
|
||||
docker stats
|
||||
|
||||
# Netzwerke anzeigen
|
||||
docker network ls
|
||||
|
||||
# Volumes anzeigen
|
||||
docker volume ls
|
||||
|
||||
# System-Info
|
||||
docker system df
|
||||
|
||||
# Health-Check ausfuehren
|
||||
/opt/scripts/health-check.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Kontakt / Hilfe
|
||||
|
||||
- **Gitea Issues:** https://eckardt-git.duckdns.org/Martin/proxmox-infrastruktur/issues
|
||||
- **Docker Docs:** https://docs.docker.com/
|
||||
- **Nextcloud Docs:** https://docs.nextcloud.com/
|
||||
- **Vaultwarden Wiki:** https://github.com/dani-garcia/vaultwarden/wiki
|
||||
Reference in New Issue
Block a user