Proxmox Infrastruktur - Vollstaendige Konfiguration
Enthaelt: - Docker Compose mit allen Services (Nextcloud, Vaultwarden, n8n, etc.) - nginx Reverse Proxy Konfiguration mit Rate Limiting - WireGuard VPN Template - Backup und Health-Check Scripts - Deployment Script - Ausfuehrliche Dokumentation und Troubleshooting Guide Services: - Isolierte Netzwerke pro Service - Resource Limits (CPU/Memory) - Health Checks - Logging Konfiguration Sicherheit: - .env Template ohne Secrets - Rate Limiting auf nginx - TLS 1.2+ only - Security Headers 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Martin Eckardt
275
docs/INSTALL.md
Normal file
275
docs/INSTALL.md
Normal file
@@ -0,0 +1,275 @@
|
||||
# Installationsanleitung
|
||||
|
||||
Detaillierte Anleitung zur Erstinstallation der Proxmox Infrastruktur.
|
||||
|
||||
## Voraussetzungen
|
||||
|
||||
### Hardware
|
||||
|
||||
- **CPU:** Min. 2 Cores (4 empfohlen)
|
||||
- **RAM:** Min. 4GB (8GB empfohlen)
|
||||
- **Speicher:** Min. 50GB SSD
|
||||
|
||||
### Software
|
||||
|
||||
- Proxmox VE 7.x/8.x oder Debian 11/12 / Ubuntu 22.04+
|
||||
- Docker CE (wird automatisch installiert)
|
||||
- WireGuard (fuer externen Zugriff)
|
||||
|
||||
### Netzwerk
|
||||
|
||||
- Statische IP oder DHCP-Reservierung
|
||||
- Zugriff auf Port 51820/UDP (WireGuard)
|
||||
- Domain/Subdomain (z.B. via DuckDNS)
|
||||
|
||||
---
|
||||
|
||||
## Teil 1: Proxmox Server vorbereiten
|
||||
|
||||
### 1.1 Docker installieren
|
||||
|
||||
```bash
|
||||
# System aktualisieren
|
||||
apt update && apt upgrade -y
|
||||
|
||||
# Docker installieren
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
|
||||
# Docker beim Boot starten
|
||||
systemctl enable docker
|
||||
systemctl start docker
|
||||
|
||||
# Pruefen
|
||||
docker --version
|
||||
docker compose version
|
||||
```
|
||||
|
||||
### 1.2 WireGuard installieren
|
||||
|
||||
```bash
|
||||
# WireGuard installieren
|
||||
apt install wireguard -y
|
||||
|
||||
# Keys generieren
|
||||
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
|
||||
|
||||
# Berechtigungen setzen
|
||||
chmod 600 /etc/wireguard/privatekey
|
||||
|
||||
# Keys anzeigen
|
||||
cat /etc/wireguard/privatekey
|
||||
cat /etc/wireguard/publickey
|
||||
```
|
||||
|
||||
### 1.3 WireGuard konfigurieren
|
||||
|
||||
```bash
|
||||
cat > /etc/wireguard/wg0.conf << 'EOF'
|
||||
[Interface]
|
||||
PrivateKey = <DEIN_PRIVATE_KEY>
|
||||
Address = 10.0.0.2/24
|
||||
|
||||
[Peer]
|
||||
PublicKey = <VPS_PUBLIC_KEY>
|
||||
Endpoint = <VPS_IP>:51820
|
||||
AllowedIPs = 10.0.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
# Aktivieren
|
||||
systemctl enable wg-quick@wg0
|
||||
systemctl start wg-quick@wg0
|
||||
|
||||
# Testen
|
||||
ping 10.0.0.1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 2: Repository klonen und konfigurieren
|
||||
|
||||
### 2.1 Repository klonen
|
||||
|
||||
```bash
|
||||
cd /opt
|
||||
git clone https://eckardt-git.duckdns.org/Martin/proxmox-infrastruktur.git
|
||||
cd proxmox-infrastruktur
|
||||
```
|
||||
|
||||
### 2.2 Environment-Variablen konfigurieren
|
||||
|
||||
```bash
|
||||
# Template kopieren
|
||||
cp docker/.env.template docker/.env
|
||||
|
||||
# Sichere Passwoerter generieren
|
||||
echo "NEXTCLOUD_DB_PASSWORD=$(openssl rand -hex 16)"
|
||||
echo "NEXTCLOUD_DB_ROOT_PASSWORD=$(openssl rand -hex 16)"
|
||||
echo "VAULTWARDEN_ADMIN_TOKEN=$(openssl rand -base64 48)"
|
||||
echo "N8N_PASSWORD=$(openssl rand -hex 16)"
|
||||
|
||||
# Datei bearbeiten und Passwoerter eintragen
|
||||
nano docker/.env
|
||||
```
|
||||
|
||||
### 2.3 Verzeichnisse erstellen
|
||||
|
||||
```bash
|
||||
# Alle Datenverzeichnisse erstellen
|
||||
mkdir -p /opt/docker/nextcloud/{data,db}
|
||||
mkdir -p /opt/docker/vaultwarden
|
||||
mkdir -p /opt/docker/n8n
|
||||
mkdir -p /opt/docker/audiobookshelf/{audiobooks,podcasts,config,metadata}
|
||||
mkdir -p /opt/docker/websites/{html,conf}
|
||||
mkdir -p /opt/docker/api
|
||||
mkdir -p /opt/docker/gitea
|
||||
mkdir -p /opt/backups
|
||||
mkdir -p /opt/scripts
|
||||
|
||||
# Berechtigungen setzen
|
||||
chown -R 1000:1000 /opt/docker/*
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 3: Services deployen
|
||||
|
||||
### 3.1 Docker Compose kopieren
|
||||
|
||||
```bash
|
||||
cp docker/docker-compose.yml /opt/docker/
|
||||
cp docker/.env /opt/docker/
|
||||
```
|
||||
|
||||
### 3.2 Container starten
|
||||
|
||||
```bash
|
||||
cd /opt/docker
|
||||
docker compose pull
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
### 3.3 Status pruefen
|
||||
|
||||
```bash
|
||||
docker compose ps
|
||||
docker compose logs -f
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 4: Services einrichten
|
||||
|
||||
### 4.1 Nextcloud
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:8081`
|
||||
2. Admin-Account erstellen
|
||||
3. Datenbank: MySQL/MariaDB
|
||||
- Host: `nextcloud-db`
|
||||
- Datenbank: `nextcloud`
|
||||
- User: `nextcloud`
|
||||
- Passwort: aus .env
|
||||
4. Installation abschliessen
|
||||
|
||||
### 4.2 Vaultwarden
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:8083`
|
||||
2. Account erstellen
|
||||
3. Admin-Panel: `http://<PROXMOX_IP>:8083/admin`
|
||||
- Token aus .env eingeben
|
||||
4. Einstellungen anpassen:
|
||||
- Registrierung deaktivieren
|
||||
- Invite only aktivieren
|
||||
|
||||
### 4.3 Gitea
|
||||
|
||||
Separates Repository: [proxmox-gitea](https://eckardt-git.duckdns.org/Martin/proxmox-gitea)
|
||||
|
||||
```bash
|
||||
cd /opt/docker/gitea
|
||||
# docker-compose.yml aus proxmox-gitea Repository
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:3000`
|
||||
2. Datenbank: SQLite3
|
||||
3. Admin-Account erstellen
|
||||
|
||||
### 4.4 n8n
|
||||
|
||||
1. Browser oeffnen: `http://<PROXMOX_IP>:5678`
|
||||
2. Login mit Credentials aus .env
|
||||
|
||||
---
|
||||
|
||||
## Teil 5: VPS Reverse Proxy (Optional)
|
||||
|
||||
Fuer externen Zugriff ueber das Internet.
|
||||
|
||||
### 5.1 WireGuard auf VPS
|
||||
|
||||
```bash
|
||||
# Auf Windows VPS mit WireGuard installiert
|
||||
# Config in C:\Program Files\WireGuard\wg0.conf
|
||||
|
||||
[Interface]
|
||||
PrivateKey = <VPS_PRIVATE_KEY>
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
|
||||
[Peer]
|
||||
PublicKey = <PROXMOX_PUBLIC_KEY>
|
||||
AllowedIPs = 10.0.0.2/32
|
||||
```
|
||||
|
||||
### 5.2 nginx auf VPS
|
||||
|
||||
```bash
|
||||
# nginx.conf aus configs/nginx/nginx.conf verwenden
|
||||
# Pfad auf Windows: C:\nginx\conf\nginx.conf
|
||||
```
|
||||
|
||||
### 5.3 SSL-Zertifikate
|
||||
|
||||
```cmd
|
||||
# win-acme fuer Let's Encrypt
|
||||
C:\winacme\wacs.exe --target manual --host eckardt-vault.duckdns.org --validation filesystem --webroot C:\nginx\html --store pemfiles --pemfilespath C:\nginx\ssl
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Teil 6: Automatisierung
|
||||
|
||||
### 6.1 Scripts installieren
|
||||
|
||||
```bash
|
||||
cp scripts/*.sh /opt/scripts/
|
||||
chmod +x /opt/scripts/*.sh
|
||||
```
|
||||
|
||||
### 6.2 Backup Cronjob
|
||||
|
||||
```bash
|
||||
# crontab -e
|
||||
0 3 * * * /opt/scripts/backup.sh all >> /var/log/backup.log 2>&1
|
||||
```
|
||||
|
||||
### 6.3 Health-Check Cronjob
|
||||
|
||||
```bash
|
||||
# crontab -e
|
||||
*/5 * * * * /opt/scripts/health-check.sh >> /var/log/health-check.log 2>&1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Fertig!
|
||||
|
||||
Nach der Installation sollten alle Services laufen:
|
||||
|
||||
```bash
|
||||
# Pruefen
|
||||
/opt/scripts/health-check.sh
|
||||
```
|
||||
|
||||
Bei Problemen: [TROUBLESHOOTING.md](TROUBLESHOOTING.md)
|
||||
Reference in New Issue
Block a user