Initial commit: Vollständige Homelab-Dokumentation (Stand 2026-04-15)
- Proxmox Host pve-braetter (Hardware, Storage, Bridges) - 14x LXC Container (CT 100-303) vollständig dokumentiert - 8x VMs (103-201) vollständig dokumentiert - Netzwerk-Übersicht mit komplettem IP-Belegungsplan - Dienste-Übersicht aller Web-Interfaces, DBs, Monitoring - PostgreSQL 16 HA Cluster (Patroni/etcd) detailliert
This commit is contained in:
54
README.md
Normal file
54
README.md
Normal file
@@ -0,0 +1,54 @@
|
|||||||
|
# Homelab Dokumentation — braetter.local
|
||||||
|
|
||||||
|
Vollständige Dokumentation der Homelab-Infrastruktur von Nicolay Brätter.
|
||||||
|
|
||||||
|
**Stand:** 2026-04-15
|
||||||
|
**Proxmox Host:** pve-braetter.braetter.local (192.168.0.48)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Inhaltsverzeichnis
|
||||||
|
|
||||||
|
- [Netzwerk-Übersicht](network/README.md)
|
||||||
|
- [Proxmox Host](proxmox/pve-braetter.md)
|
||||||
|
- [LXC Container](lxc/)
|
||||||
|
- [Virtuelle Maschinen](vms/)
|
||||||
|
- [Dienste-Übersicht](services/README.md)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schnellübersicht aller Systeme
|
||||||
|
|
||||||
|
### Proxmox Host
|
||||||
|
| System | IP | Rolle |
|
||||||
|
|--------|----|-------|
|
||||||
|
| pve-braetter | 192.168.0.48 | Proxmox VE 9.1.6 Hypervisor |
|
||||||
|
|
||||||
|
### LXC Container
|
||||||
|
| VMID | Hostname | IP | Status | Dienst |
|
||||||
|
|------|----------|----|--------|--------|
|
||||||
|
| 100 | patchmon | 192.168.0.78 | running | Patch-Monitoring (nginx/postgres/redis) |
|
||||||
|
| 101 | nginxproxymanager | 192.168.0.79 | running | Nginx Proxy Manager |
|
||||||
|
| 102 | octoprint | 192.168.0.80 | running | OctoPrint 3D-Drucker |
|
||||||
|
| 109 | notes.braetter.local | 192.168.0.92 | running | Notes Manager (Flask/Gunicorn/nginx) |
|
||||||
|
| 202 | logserver | 192.168.0.241 | running | Log-Server / Syslog / Fail2ban |
|
||||||
|
| 207 | ids-monitor | 192.168.0.85 | running | IDS: Suricata + Loki + Grafana |
|
||||||
|
| 208 | netbox.braetter.local | 192.168.0.86 | stopped | NetBox 4.2.6 IPAM/DCIM |
|
||||||
|
| 209 | authentik.braetter.local | 192.168.0.87 | stopped | authentik 2026.2.2 SSO/IdP |
|
||||||
|
| 210 | wazuh.braetter.local | 192.168.0.88 | stopped | Wazuh 4.12.0 SIEM |
|
||||||
|
| 211 | aqualog.braetter.local | 192.168.0.246 | running | Aquarium Logbuch (React/Node/nginx) |
|
||||||
|
| 300 | sql1 | 192.168.0.220 | running | PostgreSQL 16 HA Leader (Patroni/etcd) |
|
||||||
|
| 301 | sql2 | 192.168.0.221 | running | PostgreSQL 16 HA Replica |
|
||||||
|
| 302 | sql3 | 192.168.0.222 | running | PostgreSQL 16 HA Replica |
|
||||||
|
|
||||||
|
### Virtuelle Maschinen
|
||||||
|
| VMID | Name | IP | Status | Dienst |
|
||||||
|
|------|------|----|--------|--------|
|
||||||
|
| 103 | dns | 192.168.0.202 | running | Technitium DNS Server |
|
||||||
|
| 104 | DSL-Kiosk | DHCP | running | Kiosk-System |
|
||||||
|
| 105 | navidrome | 192.168.0.98 | running | Navidrome Musik-Streaming |
|
||||||
|
| 106 | paperless | 192.168.0.89 | running | Paperless-NGX Dokumentenmanagement |
|
||||||
|
| 107 | vaultwarden | 192.168.0.90 | running | Vaultwarden Passwort-Manager |
|
||||||
|
| 108 | workfs | 192.168.0.91 | running | Samba Dateiserver |
|
||||||
|
| 200 | outline | 192.168.0.240 | running | Outline Knowledge Base |
|
||||||
|
| 201 | ovpn-gw | 192.168.0.175 | running | OpenVPN/Pritunl Gateway |
|
||||||
35
lxc/CT100-patchmon.md
Normal file
35
lxc/CT100-patchmon.md
Normal file
@@ -0,0 +1,35 @@
|
|||||||
|
# CT 100 — patchmon
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 100 |
|
||||||
|
| Hostname | patchmon |
|
||||||
|
| IP | 192.168.0.78/24 (DHCP) |
|
||||||
|
| OS | Debian GNU/Linux 13 (trixie) |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | Container:100/vm-100-disk-0.raw, 4 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| nginx | 3000 (extern), 3001 | Webserver / Reverse Proxy für PatchMon |
|
||||||
|
| patchmon-server | 3001 | PatchMon Backend-Service |
|
||||||
|
| postgresql@17 | 5432 (lokal) | PostgreSQL 17 Datenbank |
|
||||||
|
| redis-server | 6379 (lokal) | Redis Cache |
|
||||||
|
| postfix | 25 (lokal) | Mailversand |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **PatchMon UI:** http://192.168.0.78:3000
|
||||||
|
- **SSH:** `ssh claude@192.168.0.78`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
PatchMon ist ein selbst entwickeltes Patch-Monitoring-System zur Überwachung von Software-Updates und Sicherheits-Patches im gesamten Netzwerk. Es verwendet PostgreSQL 17 als Datenbank und Redis als Cache.
|
||||||
46
lxc/CT101-nginxproxymanager.md
Normal file
46
lxc/CT101-nginxproxymanager.md
Normal file
@@ -0,0 +1,46 @@
|
|||||||
|
# CT 101 — nginxproxymanager
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 101 |
|
||||||
|
| Hostname | nginxproxymanager |
|
||||||
|
| IP | 192.168.0.79/24 (DHCP) |
|
||||||
|
| OS | Debian GNU/Linux 12 (bookworm) |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | Container:101/vm-101-disk-0.raw, 8 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| openresty (nginx) | 80, 443 | Reverse Proxy (HTTP/HTTPS) |
|
||||||
|
| npm | 3000 | NPM Backend-API |
|
||||||
|
| npm Admin UI | 81 | Nginx Proxy Manager Weboberfläche |
|
||||||
|
| postfix | 25 (lokal) | Mailversand |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **NPM Admin:** http://192.168.0.79:81
|
||||||
|
- **SSH:** `ssh claude@192.168.0.79`
|
||||||
|
|
||||||
|
## Konfiguration
|
||||||
|
|
||||||
|
- Proxy-Hosts: `/data/nginx/proxy_host/`
|
||||||
|
- SSL-Zertifikate: `/data/custom_ssl/`
|
||||||
|
- Datenbank: `/data/database.sqlite`
|
||||||
|
|
||||||
|
## Konfigurierte Proxy-Hosts (Auszug)
|
||||||
|
|
||||||
|
| Domain | Ziel | Conf |
|
||||||
|
|--------|------|------|
|
||||||
|
| notes.braetter-int.de | http://192.168.0.92 | 22.conf |
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Nginx Proxy Manager als zentraler Reverse Proxy für alle extern erreichbaren Dienste. Verwaltet SSL-Zertifikate und HTTP/HTTPS-Weiterleitungen.
|
||||||
32
lxc/CT102-octoprint.md
Normal file
32
lxc/CT102-octoprint.md
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
# CT 102 — octoprint
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 102 |
|
||||||
|
| Hostname | octoprint |
|
||||||
|
| IP | 192.168.0.80/24 |
|
||||||
|
| OS | Debian GNU/Linux 13 (trixie) |
|
||||||
|
| CPU | 1 vCore |
|
||||||
|
| RAM | 1024 MB |
|
||||||
|
| Disk | Container:102/vm-102-disk-0.raw, 4 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| octoprint | 5000 | OctoPrint Web-UI |
|
||||||
|
| postfix | 25 (lokal) | Mailversand |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **OctoPrint Web:** http://192.168.0.80:5000
|
||||||
|
- **SSH:** `ssh claude@192.168.0.80`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
OctoPrint ist eine webbasierte Oberfläche zur Steuerung und Überwachung von 3D-Druckern. Läuft als eigener Service unter dem octoprint-User.
|
||||||
63
lxc/CT109-notes.md
Normal file
63
lxc/CT109-notes.md
Normal file
@@ -0,0 +1,63 @@
|
|||||||
|
# CT 109 — notes.braetter.local
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 109 |
|
||||||
|
| Hostname | notes.braetter.local |
|
||||||
|
| IP | 192.168.0.92/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | osdisk:109/vm-109-disk-0.raw, 150 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| nginx | 80 | Reverse Proxy zu Gunicorn |
|
||||||
|
| notesmanager (gunicorn) | 5000 (lokal) | Flask Python App |
|
||||||
|
| postfix | 25 (lokal) | Mailversand |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Notes Web:** http://notes.braetter-int.de (extern) / http://192.168.0.92 (intern)
|
||||||
|
- **SSH:** `ssh nicolay@192.168.0.92` (Passwort: N17b011975)
|
||||||
|
|
||||||
|
## Anwendung
|
||||||
|
|
||||||
|
- **Framework:** Python 3 / Flask
|
||||||
|
- **WSGI:** Gunicorn (3 Worker)
|
||||||
|
- **Webserver:** Nginx als Reverse Proxy
|
||||||
|
- **Pfad:** `/opt/notesmanager/`
|
||||||
|
- **Systemd:** `notesmanager.service`
|
||||||
|
|
||||||
|
### Anwendungs-Struktur
|
||||||
|
|
||||||
|
```
|
||||||
|
/opt/notesmanager/
|
||||||
|
├── app/
|
||||||
|
│ ├── __init__.py # Flask App Factory
|
||||||
|
│ ├── models.py # SQLAlchemy Models
|
||||||
|
│ ├── routes.py # Routen
|
||||||
|
│ ├── static/ # CSS, JS
|
||||||
|
│ └── templates/ # Jinja2 Templates
|
||||||
|
├── deploy/
|
||||||
|
│ ├── notesmanager.nginx # Nginx-Config
|
||||||
|
│ └── notesmanager.service # Systemd-Service
|
||||||
|
├── requirements.txt
|
||||||
|
├── run.py
|
||||||
|
└── gunicorn.conf.py
|
||||||
|
```
|
||||||
|
|
||||||
|
### Datenbank
|
||||||
|
|
||||||
|
SQLite — `instance/` Verzeichnis
|
||||||
|
|
||||||
|
## Gitea Repository
|
||||||
|
|
||||||
|
http://gitea.braetter.local/braetter/noteapp
|
||||||
58
lxc/CT202-logserver.md
Normal file
58
lxc/CT202-logserver.md
Normal file
@@ -0,0 +1,58 @@
|
|||||||
|
# CT 202 — logserver
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 202 |
|
||||||
|
| Hostname | logserver |
|
||||||
|
| IP | 192.168.0.241/24 |
|
||||||
|
| OS | Debian GNU/Linux 13 (trixie) |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | nasstorage:202/vm-202-disk-0.raw, 1000 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| rsyslog / syslog | 514 UDP/TCP | Zentrale Log-Sammlung |
|
||||||
|
| promtail | 9080 | Log-Shipper zu IDS-Monitor/Loki |
|
||||||
|
| fail2ban | - | Brute-Force-Schutz |
|
||||||
|
| avahi-daemon | - | mDNS Discovery |
|
||||||
|
| postfix | - | Mailversand für Alarme |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **SSH:** `ssh claude@192.168.0.241`
|
||||||
|
|
||||||
|
## Automatisierungs-Skripte (cron.daily)
|
||||||
|
|
||||||
|
| Skript | Funktion |
|
||||||
|
|--------|---------|
|
||||||
|
| `anomalie_check.sh` | Erkennt Anomalien in Logs, IP-Lookup via ipinfo.io, Alarm-Mail |
|
||||||
|
| `dienst_watchdog.sh` | Überwacht kritische Dienste, Neustart bei Ausfall |
|
||||||
|
| `security_audit.sh` | Täglicher Sicherheits-Audit |
|
||||||
|
| `smarthome_scan.sh` | Scannt SmartHome-Geräte |
|
||||||
|
| `parse_nmap.sh` | Parst NMAP-Scan-Ergebnisse |
|
||||||
|
| `mail_fix.py` | Postfix-Reparatur-Skript |
|
||||||
|
| `trauer_report.py` | Pentest-Report-Generator (www.trauer.de) |
|
||||||
|
|
||||||
|
**Pfad:** `/home/claude/scripts/`
|
||||||
|
|
||||||
|
## Log-Eingang (rsyslog)
|
||||||
|
|
||||||
|
Alle LXC/VMs senden Logs per syslog-Protokoll an Port 514.
|
||||||
|
|
||||||
|
## Alarm-Mails
|
||||||
|
|
||||||
|
`anomalie_check.sh` sendet bei Auffälligkeiten E-Mails mit:
|
||||||
|
- Angreifer-IP
|
||||||
|
- IP-Lookup: Land, Stadt, ASN/Org, Hostname (via ipinfo.io)
|
||||||
|
- Gescannte Pfade / HTTP-Methoden
|
||||||
|
- Anzahl der Versuche
|
||||||
|
- HTTP-Status-Codes
|
||||||
|
- Bei SSH: Versuchte Benutzernamen
|
||||||
42
lxc/CT207-ids-monitor.md
Normal file
42
lxc/CT207-ids-monitor.md
Normal file
@@ -0,0 +1,42 @@
|
|||||||
|
# CT 207 — ids-monitor
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 207 |
|
||||||
|
| Hostname | ids-monitor |
|
||||||
|
| IP | 192.168.0.85/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 3072 MB |
|
||||||
|
| Disk | osdisk:207/vm-207-disk-0.raw, 20 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| suricata | - | IDS/IPS Netzwerk-Analyse |
|
||||||
|
| loki | 3100, 9096 | Log-Aggregation |
|
||||||
|
| grafana-server | 3000 | Dashboards / Visualisierung |
|
||||||
|
| promtail | 9080, 39471 | Log-Shipper |
|
||||||
|
| fail2ban | - | Brute-Force-Schutz |
|
||||||
|
| postfix | 25 (lokal) | Mailversand |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Grafana:** http://192.168.0.85:3000
|
||||||
|
- **Loki API:** http://192.168.0.85:3100
|
||||||
|
- **SSH:** `ssh claude@192.168.0.85`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Zentrales IDS/SIEM-System:
|
||||||
|
|
||||||
|
- **Suricata** analysiert den Netzwerktraffic auf bekannte Angriffsmuster (Signaturen)
|
||||||
|
- **Loki** sammelt Logs aus dem gesamten Netz (inkl. Logserver via Promtail)
|
||||||
|
- **Grafana** visualisiert die gesammelten Daten in Dashboards
|
||||||
|
- **Promtail** shippt lokale Logs an Loki und empfängt Logs vom Logserver (192.168.0.241)
|
||||||
38
lxc/CT208-netbox.md
Normal file
38
lxc/CT208-netbox.md
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
# CT 208 — netbox.braetter.local
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 208 |
|
||||||
|
| Hostname | netbox.braetter.local |
|
||||||
|
| IP | 192.168.0.86/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | osdisk:208/vm-208-disk-0.raw, 40 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | stopped |
|
||||||
|
|
||||||
|
## Anwendung
|
||||||
|
|
||||||
|
- **NetBox Version:** 4.2.6
|
||||||
|
- **Installation:** Nativ (kein Docker)
|
||||||
|
- **Funktion:** IPAM (IP Address Management) + DCIM (Data Center Infrastructure Management)
|
||||||
|
- **Eingerichtet:** 2026-04-09
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **NetBox Web:** http://192.168.0.86 (wenn gestartet)
|
||||||
|
- **SSH:** `ssh nicolay@192.168.0.86`
|
||||||
|
|
||||||
|
## Starten
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo pct start 208
|
||||||
|
```
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
NetBox dient zur vollständigen Dokumentation der Netzwerk-Infrastruktur: IP-Adressen, VLANs, Geräte, Racks, Kabel und Verbindungen.
|
||||||
38
lxc/CT209-authentik.md
Normal file
38
lxc/CT209-authentik.md
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
# CT 209 — authentik.braetter.local
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 209 |
|
||||||
|
| Hostname | authentik.braetter.local |
|
||||||
|
| IP | 192.168.0.87/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 3072 MB |
|
||||||
|
| Disk | osdisk:209/vm-209-disk-0.raw, 40 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | stopped |
|
||||||
|
|
||||||
|
## Anwendung
|
||||||
|
|
||||||
|
- **authentik Version:** 2026.2.2
|
||||||
|
- **Installation:** Docker Compose
|
||||||
|
- **Funktion:** Single Sign-On (SSO) / Identity Provider (IdP)
|
||||||
|
- **Eingerichtet:** 2026-04-09
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **authentik Web:** http://192.168.0.87 (wenn gestartet)
|
||||||
|
- **SSH:** `ssh nicolay@192.168.0.87`
|
||||||
|
|
||||||
|
## Starten
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo pct start 209
|
||||||
|
```
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
authentik ist ein selbst-gehosteter Identity Provider für SSO-Integration in interne Dienste. Unterstützt OIDC, SAML, LDAP und OAuth2.
|
||||||
42
lxc/CT210-wazuh.md
Normal file
42
lxc/CT210-wazuh.md
Normal file
@@ -0,0 +1,42 @@
|
|||||||
|
# CT 210 — wazuh.braetter.local
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 210 |
|
||||||
|
| Hostname | wazuh.braetter.local |
|
||||||
|
| IP | 192.168.0.88/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 4 vCores |
|
||||||
|
| RAM | 6144 MB |
|
||||||
|
| Disk | osdisk:210/vm-210-disk-0.raw, 80 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | stopped |
|
||||||
|
|
||||||
|
## Anwendung
|
||||||
|
|
||||||
|
- **Wazuh Version:** 4.12.0
|
||||||
|
- **Installation:** Docker Compose
|
||||||
|
- **Funktion:** SIEM, HIDS, Log-Analyse, Compliance
|
||||||
|
- **Eingerichtet:** 2026-04-09
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Wazuh Dashboard:** https://192.168.0.88 (wenn gestartet)
|
||||||
|
- **SSH:** `ssh nicolay@192.168.0.88`
|
||||||
|
|
||||||
|
## Wazuh Agents
|
||||||
|
|
||||||
|
Folgende Systeme senden Daten an Wazuh:
|
||||||
|
- vaultwarden (192.168.0.90) — wazuh-agent.service
|
||||||
|
- workfs (192.168.0.91) — wazuh-agent.service
|
||||||
|
- outline (192.168.0.240) — wazuh-agent.service
|
||||||
|
- ovpn-gw (192.168.0.175) — wazuh-agent.service
|
||||||
|
|
||||||
|
## Starten
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo pct start 210
|
||||||
|
```
|
||||||
41
lxc/CT211-aqualog.md
Normal file
41
lxc/CT211-aqualog.md
Normal file
@@ -0,0 +1,41 @@
|
|||||||
|
# CT 211 — aqualog.braetter.local
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 211 |
|
||||||
|
| Hostname | aqualog.braetter.local |
|
||||||
|
| IP | 192.168.0.246/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 4 vCores |
|
||||||
|
| RAM | 8192 MB |
|
||||||
|
| Disk | osdisk:211/vm-211-disk-0.raw, 150 GB |
|
||||||
|
| Bridge | vmbr0 |
|
||||||
|
| Autostart | nein |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| nginx | 80 | Webserver / Reverse Proxy |
|
||||||
|
| aquarium-api (node) | 3001 (lokal) | Node.js/Express Backend |
|
||||||
|
| postfix | 25 (lokal) | Mailversand |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Aquarium Logbuch:** http://192.168.0.246
|
||||||
|
- **SSH:** `ssh nicolay@192.168.0.246`
|
||||||
|
|
||||||
|
## Anwendung
|
||||||
|
|
||||||
|
- **Frontend:** React 18 + Vite
|
||||||
|
- **Backend:** Node.js / Express
|
||||||
|
- **Webserver:** Nginx (Port 80, dient React-Build + Proxy zu API)
|
||||||
|
- **App-Pfad:** `/var/www/aquarium/` (Frontend-Build), Backend als Systemd-Service
|
||||||
|
- **Systemd:** `aquarium-api.service`
|
||||||
|
|
||||||
|
## Gitea Repository
|
||||||
|
|
||||||
|
http://gitea.braetter.local/braetter/aqualog
|
||||||
150
lxc/CT300-303-postgresql-ha.md
Normal file
150
lxc/CT300-303-postgresql-ha.md
Normal file
@@ -0,0 +1,150 @@
|
|||||||
|
# CT 300–302 — PostgreSQL 16 HA Cluster + CT 303 pgAdmin
|
||||||
|
|
||||||
|
## Cluster-Übersicht
|
||||||
|
|
||||||
|
| VMID | Hostname | IP | Rolle | Status |
|
||||||
|
|------|----------|----|-------|--------|
|
||||||
|
| 300 | sql1 | 192.168.0.220 | Leader (Primary) | running |
|
||||||
|
| 301 | sql2 | 192.168.0.221 | Replica (Streaming) | running |
|
||||||
|
| 302 | sql3 | 192.168.0.222 | Replica (Streaming) | running |
|
||||||
|
| 303 | pgadmin | 192.168.0.223 | pgAdmin4 Web | running |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## CT 300 — sql1 (Leader)
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 300 |
|
||||||
|
| IP | 192.168.0.220/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | osdisk:300/vm-300-disk-0.raw, 20 GB |
|
||||||
|
| Autostart | nein |
|
||||||
|
|
||||||
|
## CT 301 — sql2 (Replica)
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 301 |
|
||||||
|
| IP | 192.168.0.221/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | osdisk:301/vm-301-disk-0.raw, 20 GB |
|
||||||
|
| Autostart | nein |
|
||||||
|
|
||||||
|
## CT 302 — sql3 (Replica)
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 302 |
|
||||||
|
| IP | 192.168.0.222/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | osdisk:302/vm-302-disk-0.raw, 20 GB |
|
||||||
|
| Autostart | nein |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Dienste (alle DB-Nodes)
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| postgresql 16 | 5432 | Datenbank |
|
||||||
|
| patroni | 8008 | HA-Manager REST API |
|
||||||
|
| etcd | 2379 (client), 2380 (peer) | Distributed Key-Value Store (DCS) |
|
||||||
|
| apache2 | 80 | Nur sql1: pgAdmin4 Webserver |
|
||||||
|
|
||||||
|
## Patroni Konfiguration
|
||||||
|
|
||||||
|
- **Scope:** pg-cluster
|
||||||
|
- **Namespace:** /db/
|
||||||
|
- **Datenverzeichnis:** `/var/lib/postgresql/16/patroni`
|
||||||
|
- **Config:** `/etc/patroni/patroni.yml`
|
||||||
|
- **Systemd:** `patroni.service`
|
||||||
|
|
||||||
|
## etcd Konfiguration
|
||||||
|
|
||||||
|
- **Cluster-Token:** pg-etcd-cluster
|
||||||
|
- **Config:** `/etc/default/etcd`
|
||||||
|
- **Datenverzeichnis:** `/var/lib/etcd/default`
|
||||||
|
|
||||||
|
## Datenbanken & Benutzer
|
||||||
|
|
||||||
|
| Datenbank | Eigentümer |
|
||||||
|
|-----------|-----------|
|
||||||
|
| nicolay | nicolay |
|
||||||
|
| testdb | nicolay |
|
||||||
|
| postgres | postgres |
|
||||||
|
|
||||||
|
| Benutzer | Passwort | Rechte |
|
||||||
|
|----------|----------|--------|
|
||||||
|
| nicolay | N17b011975 | Login |
|
||||||
|
| postgres | postgres_pass | Superuser |
|
||||||
|
| replicator | replicator_pass | Replikation |
|
||||||
|
| admin | admin | createdb, createrole |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# PostgreSQL (immer Leader)
|
||||||
|
psql -h 192.168.0.220 -U nicolay -d nicolay
|
||||||
|
|
||||||
|
# Cluster-Status
|
||||||
|
pct exec 300 -- /usr/local/bin/patronictl -c /etc/patroni/patroni.yml list
|
||||||
|
|
||||||
|
# Patroni REST API
|
||||||
|
curl http://192.168.0.220:8008/leader
|
||||||
|
curl http://192.168.0.221:8008/replica
|
||||||
|
|
||||||
|
# etcd
|
||||||
|
etcdctl --endpoints=http://192.168.0.220:2379 endpoint health
|
||||||
|
```
|
||||||
|
|
||||||
|
## Manueller Failover
|
||||||
|
|
||||||
|
```bash
|
||||||
|
pct exec 300 -- /usr/local/bin/patronictl -c /etc/patroni/patroni.yml failover pg-cluster
|
||||||
|
```
|
||||||
|
|
||||||
|
## Verhalten bei Ausfall
|
||||||
|
|
||||||
|
| Szenario | Verhalten |
|
||||||
|
|----------|-----------|
|
||||||
|
| sql1 fällt aus | Patroni wählt sql2 oder sql3 als neuen Leader (30–60s) |
|
||||||
|
| sql2 oder sql3 fällt aus | Kein Ausfall, Leader läuft weiter |
|
||||||
|
| 2 Nodes fallen aus | Kein Quorum → Cluster read-only |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## CT 303 — pgadmin
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 303 |
|
||||||
|
| Hostname | pgadmin |
|
||||||
|
| IP | 192.168.0.223/24 |
|
||||||
|
| OS | Ubuntu 24.04 LTS |
|
||||||
|
| CPU | 2 vCores |
|
||||||
|
| RAM | 1024 MB |
|
||||||
|
| Disk | osdisk:303/vm-303-disk-0.raw, 10 GB |
|
||||||
|
| Autostart | nein |
|
||||||
|
|
||||||
|
### pgAdmin4 Zugriff
|
||||||
|
|
||||||
|
- **URL:** http://192.168.0.223/pgadmin4/
|
||||||
|
- **Login:** nicolay.braetter@googlemail.com / N17b011975
|
||||||
|
- **Vorkonfigurierte Server:** sql1, sql2, sql3 (alle als "pg-cluster" Gruppe)
|
||||||
|
|
||||||
|
### Hinweis Redundanz
|
||||||
|
|
||||||
|
pgAdmin läuft auf einem **separaten** LXC, unabhängig von den Datenbank-Nodes. Bei Ausfall von sql1 bleibt pgAdmin erreichbar. Die Server-Verbindungen in pgAdmin zeigen direkt auf die jeweiligen Node-IPs.
|
||||||
|
|
||||||
|
## Install-Script
|
||||||
|
|
||||||
|
Vollständiges Installations-Script für den kompletten Cluster:
|
||||||
|
`/home/claude/postgres-ha-install.sh` auf pve-braetter
|
||||||
|
Gitea: (kein separates Repo — im aqualog-Repo enthalten)
|
||||||
18
lxc/README.md
Normal file
18
lxc/README.md
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
# LXC Container
|
||||||
|
|
||||||
|
| VMID | Hostname | IP | OS | Status | Doku |
|
||||||
|
|------|----------|----|-----|--------|------|
|
||||||
|
| 100 | patchmon | 192.168.0.78 | Debian 13 | running | [CT100-patchmon.md](CT100-patchmon.md) |
|
||||||
|
| 101 | nginxproxymanager | 192.168.0.79 | Debian 12 | running | [CT101-nginxproxymanager.md](CT101-nginxproxymanager.md) |
|
||||||
|
| 102 | octoprint | 192.168.0.80 | Debian 13 | running | [CT102-octoprint.md](CT102-octoprint.md) |
|
||||||
|
| 109 | notes.braetter.local | 192.168.0.92 | Ubuntu 24.04 | running | [CT109-notes.md](CT109-notes.md) |
|
||||||
|
| 202 | logserver | 192.168.0.241 | Debian 13 | running | [CT202-logserver.md](CT202-logserver.md) |
|
||||||
|
| 207 | ids-monitor | 192.168.0.85 | Ubuntu 24.04 | running | [CT207-ids-monitor.md](CT207-ids-monitor.md) |
|
||||||
|
| 208 | netbox.braetter.local | 192.168.0.86 | Ubuntu 24.04 | stopped | [CT208-netbox.md](CT208-netbox.md) |
|
||||||
|
| 209 | authentik.braetter.local | 192.168.0.87 | Ubuntu 24.04 | stopped | [CT209-authentik.md](CT209-authentik.md) |
|
||||||
|
| 210 | wazuh.braetter.local | 192.168.0.88 | Ubuntu 24.04 | stopped | [CT210-wazuh.md](CT210-wazuh.md) |
|
||||||
|
| 211 | aqualog.braetter.local | 192.168.0.246 | Ubuntu 24.04 | running | [CT211-aqualog.md](CT211-aqualog.md) |
|
||||||
|
| 300 | sql1 | 192.168.0.220 | Ubuntu 24.04 | running | [CT300-303-postgresql-ha.md](CT300-303-postgresql-ha.md) |
|
||||||
|
| 301 | sql2 | 192.168.0.221 | Ubuntu 24.04 | running | [CT300-303-postgresql-ha.md](CT300-303-postgresql-ha.md) |
|
||||||
|
| 302 | sql3 | 192.168.0.222 | Ubuntu 24.04 | running | [CT300-303-postgresql-ha.md](CT300-303-postgresql-ha.md) |
|
||||||
|
| 303 | pgadmin | 192.168.0.223 | Ubuntu 24.04 | running | [CT300-303-postgresql-ha.md](CT300-303-postgresql-ha.md) |
|
||||||
73
network/README.md
Normal file
73
network/README.md
Normal file
@@ -0,0 +1,73 @@
|
|||||||
|
# Netzwerk-Dokumentation
|
||||||
|
|
||||||
|
## Subnetz
|
||||||
|
|
||||||
|
**192.168.0.0/24**
|
||||||
|
Gateway: 192.168.0.1 (Router)
|
||||||
|
DNS: 192.168.0.202 (Technitium DNS)
|
||||||
|
DNS-Fallback: 192.168.0.1
|
||||||
|
|
||||||
|
## IP-Belegungsplan
|
||||||
|
|
||||||
|
| IP | System | Typ | Dienst |
|
||||||
|
|----|--------|-----|--------|
|
||||||
|
| 192.168.0.1 | Router | Physisch | Gateway / DHCP |
|
||||||
|
| 192.168.0.20 | Unbekannt | Physisch | - |
|
||||||
|
| 192.168.0.31 | Physisch | Physisch | - |
|
||||||
|
| 192.168.0.47 | WD MyCloud | NAS | SMB-Share (Musik) |
|
||||||
|
| 192.168.0.48 | pve-braetter | Physisch | Proxmox Hypervisor |
|
||||||
|
| 192.168.0.49 | Physisch | Physisch | - |
|
||||||
|
| 192.168.0.73 | mac-nico | MacOS | Arbeitsrechner |
|
||||||
|
| 192.168.0.78 | patchmon (CT 100) | LXC | Patch-Monitoring |
|
||||||
|
| 192.168.0.79 | nginxproxymanager (CT 101) | LXC | Reverse Proxy |
|
||||||
|
| 192.168.0.80 | octoprint (CT 102) | LXC | 3D-Drucker |
|
||||||
|
| 192.168.0.85 | ids-monitor (CT 207) | LXC | IDS/SIEM |
|
||||||
|
| 192.168.0.86 | netbox (CT 208) | LXC | IPAM/DCIM |
|
||||||
|
| 192.168.0.87 | authentik (CT 209) | LXC | SSO/IdP |
|
||||||
|
| 192.168.0.88 | wazuh (CT 210) | LXC | SIEM |
|
||||||
|
| 192.168.0.89 | paperless (VM 106) | VM | Dokumentenmanagement |
|
||||||
|
| 192.168.0.90 | vaultwarden (VM 107) | VM | Passwort-Manager |
|
||||||
|
| 192.168.0.91 | workfs (VM 108) | VM | Samba Dateiserver |
|
||||||
|
| 192.168.0.92 | notes (CT 109) | LXC | Notes Manager |
|
||||||
|
| 192.168.0.98 | navidrome (VM 105) | VM | Musik-Streaming |
|
||||||
|
| 192.168.0.148 | gaming-nico | Physisch | Gaming-PC |
|
||||||
|
| 192.168.0.175 | ovpn-gw (VM 201) | VM | VPN Gateway |
|
||||||
|
| 192.168.0.202 | dns (VM 103) | VM | DNS Server |
|
||||||
|
| 192.168.0.220 | sql1 (CT 300) | LXC | PostgreSQL Leader |
|
||||||
|
| 192.168.0.221 | sql2 (CT 301) | LXC | PostgreSQL Replica |
|
||||||
|
| 192.168.0.222 | sql3 (CT 302) | LXC | PostgreSQL Replica |
|
||||||
|
| 192.168.0.240 | outline (VM 200) | VM | Knowledge Base |
|
||||||
|
| 192.168.0.241 | logserver (CT 202) | LXC | Syslog / Monitoring |
|
||||||
|
| 192.168.0.245 | openclaw (CT 206) | LXC | OpenClaw Gateway |
|
||||||
|
| 192.168.0.246 | aqualog (CT 211) | LXC | Aquarium Logbuch |
|
||||||
|
|
||||||
|
## DNS (Technitium DNS — 192.168.0.202)
|
||||||
|
|
||||||
|
- **Web-UI:** http://192.168.0.202:5380
|
||||||
|
- Interne Domain: `braetter.local`
|
||||||
|
- Externe Domain: `braetter-int.de`
|
||||||
|
|
||||||
|
## Reverse Proxy (Nginx Proxy Manager — 192.168.0.79)
|
||||||
|
|
||||||
|
| Externe Domain | Ziel | Port |
|
||||||
|
|---------------|------|------|
|
||||||
|
| notes.braetter-int.de | 192.168.0.92 | 80 |
|
||||||
|
| (weitere über NPM-UI verwaltbar) | | |
|
||||||
|
|
||||||
|
- **NPM Admin:** http://192.168.0.79:81
|
||||||
|
|
||||||
|
## VPN (Pritunl — 192.168.0.175)
|
||||||
|
|
||||||
|
| Tunnel | Subnetz | Verwendung |
|
||||||
|
|--------|---------|-----------|
|
||||||
|
| tun0 | 10.11.99.0/24 | VPN Clients |
|
||||||
|
| tun1 | 10.11.120.0/24 | Site-to-Site |
|
||||||
|
|
||||||
|
- **Pritunl Web:** https://192.168.0.175
|
||||||
|
- OpenVPN Configs in `/etc/openvpn/`
|
||||||
|
|
||||||
|
## Gitea (lokale Code-Verwaltung)
|
||||||
|
|
||||||
|
- **URL:** http://gitea.braetter.local
|
||||||
|
- **User:** braetter
|
||||||
|
- Repositories: aqualog, noteapp, homelabdoku, ...
|
||||||
45
proxmox/pve-braetter.md
Normal file
45
proxmox/pve-braetter.md
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
# Proxmox Host: pve-braetter
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| Hostname | pve-braetter.braetter.local |
|
||||||
|
| IP | 192.168.0.48/24 |
|
||||||
|
| Proxmox Version | 9.1.6 (pve-manager/9.1.6/71482d1833ded40a) |
|
||||||
|
| Kernel | 6.17.13-1-pve |
|
||||||
|
| CPU | AMD Ryzen 5 1400 Quad-Core, 8 Threads (4C/8T), max 3200 MHz |
|
||||||
|
| RAM | 32 GB DDR4 |
|
||||||
|
| Swap | 8 GB |
|
||||||
|
|
||||||
|
## Storage
|
||||||
|
|
||||||
|
| Storage-Name | Gerät | Größe | Typ | Verwendung |
|
||||||
|
|-------------|-------|-------|-----|-----------|
|
||||||
|
| osdisk | /dev/sde (WDC WD5000LPCX) | 466 GB HDD | LVM | CT-Rootdisks, VMs |
|
||||||
|
| Container | /dev/sdb (Samsung SSD 840 EVO 250GB) | 229 GB SSD | Dir | LXC Container |
|
||||||
|
| Isos | /dev/sdd (WDC WD1600BEVT) | 149 GB HDD | Dir | ISO-Images, CT-Templates |
|
||||||
|
| data | /dev/sdc (WDC WD1600BEVT) | 149 GB HDD | Dir | VM-Disks |
|
||||||
|
| nasstorage | /dev/sdf (WDC WD40NDZW) | 3,6 TB HDD | Dir | Große Disks (Navidrome, Paperless, DNS, WorkFS) |
|
||||||
|
| wdm | //192.168.0.47/nicolay/Musik | 3,6 TB | SMB | Musik-Share (WD MyCloud, 192.168.0.47) |
|
||||||
|
| local | /dev/sda (CT250MX500SSD1) | 233 GB SSD | LVM | Proxmox Root, Outline |
|
||||||
|
|
||||||
|
## Netzwerk-Bridges
|
||||||
|
|
||||||
|
| Bridge | Subnetz | Verwendung |
|
||||||
|
|--------|---------|-----------|
|
||||||
|
| vmbr0 | 192.168.0.0/24 | Produktionsnetz (alle VMs/CTs) |
|
||||||
|
| vmbr1 | 10.11.202.0/24 | Internes Netz 1 |
|
||||||
|
| vmbr2 | 10.22.202.0/24 | Internes Netz 2 |
|
||||||
|
|
||||||
|
## Webinterface
|
||||||
|
|
||||||
|
- **URL:** https://192.168.0.48:8006
|
||||||
|
- **Zugang:** root / lokales Passwort
|
||||||
|
|
||||||
|
## Backup / Wartung
|
||||||
|
|
||||||
|
- Storage: nasstorage (/mnt/pve/nasstorage)
|
||||||
|
- CT-Templates: `/mnt/pve/Isos/template/cache/`
|
||||||
|
- `ubuntu-24.04-standard_24.04-2_amd64.tar.zst`
|
||||||
|
- `ubuntu-24.04-standard_24.04-1_amd64.tar.zst`
|
||||||
77
services/README.md
Normal file
77
services/README.md
Normal file
@@ -0,0 +1,77 @@
|
|||||||
|
# Dienste-Übersicht
|
||||||
|
|
||||||
|
Alle erreichbaren Web-Interfaces und Dienste im Überblick.
|
||||||
|
|
||||||
|
## Web-Interfaces
|
||||||
|
|
||||||
|
| Dienst | URL | System | Zugangsdaten |
|
||||||
|
|--------|-----|--------|-------------|
|
||||||
|
| Proxmox VE | https://192.168.0.48:8006 | pve-braetter | root |
|
||||||
|
| Nginx Proxy Manager | http://192.168.0.79:81 | CT 101 | NPM-Admin |
|
||||||
|
| OctoPrint | http://192.168.0.80:5000 | CT 102 | lokal |
|
||||||
|
| Notes Manager | http://192.168.0.92 | CT 109 | lokal |
|
||||||
|
| Notes Manager (extern) | http://notes.braetter-int.de | CT 109 | lokal |
|
||||||
|
| IDS Grafana | http://192.168.0.85:3000 | CT 207 | lokal |
|
||||||
|
| NetBox | http://192.168.0.86 | CT 208 (stopped) | lokal |
|
||||||
|
| authentik | http://192.168.0.87 | CT 209 (stopped) | lokal |
|
||||||
|
| Wazuh Dashboard | https://192.168.0.88 | CT 210 (stopped) | lokal |
|
||||||
|
| Aquarium Logbuch | http://192.168.0.246 | CT 211 | - |
|
||||||
|
| pgAdmin4 | http://192.168.0.223/pgadmin4/ | CT 303 | nicolay.braetter@googlemail.com |
|
||||||
|
| PatchMon | http://192.168.0.78:3000 | CT 100 | lokal |
|
||||||
|
| Technitium DNS | http://192.168.0.202:5380 | VM 103 | lokal |
|
||||||
|
| Navidrome | http://192.168.0.98:4533 | VM 105 | lokal |
|
||||||
|
| Paperless-NGX | http://192.168.0.89:8000 | VM 106 | lokal |
|
||||||
|
| Vaultwarden | http://192.168.0.90:8080 | VM 107 | Bitwarden-App |
|
||||||
|
| Outline | http://192.168.0.240 | VM 200 | lokal |
|
||||||
|
| Pritunl VPN | https://192.168.0.175 | VM 201 | lokal |
|
||||||
|
| Gitea | http://gitea.braetter.local | extern | nicolay.braetter@icloud.com |
|
||||||
|
|
||||||
|
## Datenbanken
|
||||||
|
|
||||||
|
| System | Typ | Version | Host | Port |
|
||||||
|
|--------|-----|---------|------|------|
|
||||||
|
| SQL-Cluster (Primary) | PostgreSQL 16 | 16 | 192.168.0.220 | 5432 |
|
||||||
|
| SQL-Cluster (Replica) | PostgreSQL 16 | 16 | 192.168.0.221 | 5432 |
|
||||||
|
| SQL-Cluster (Replica) | PostgreSQL 16 | 16 | 192.168.0.222 | 5432 |
|
||||||
|
| Paperless | PostgreSQL 16 | 16 | 192.168.0.89 (lokal) | 5432 |
|
||||||
|
| PatchMon | PostgreSQL 17 | 17 | 192.168.0.78 (lokal) | 5432 |
|
||||||
|
| Outline | MariaDB 10.11 | 10.11 | 192.168.0.240 (lokal) | 3306 |
|
||||||
|
| Pritunl | MongoDB | - | 192.168.0.175 (lokal) | 27017 |
|
||||||
|
|
||||||
|
## Monitoring-Dienste
|
||||||
|
|
||||||
|
| Dienst | System | URL | Funktion |
|
||||||
|
|--------|--------|-----|---------|
|
||||||
|
| Grafana | CT 207 (ids-monitor) | http://192.168.0.85:3000 | Dashboards |
|
||||||
|
| Loki | CT 207 (ids-monitor) | http://192.168.0.85:3100 | Log-Aggregation |
|
||||||
|
| Suricata | CT 207 (ids-monitor) | - | IDS/IPS |
|
||||||
|
| Wazuh | CT 210 (wazuh) | https://192.168.0.88 | SIEM/HIDS |
|
||||||
|
| PatchMon | CT 100 (patchmon) | http://192.168.0.78:3000 | Patch-Monitoring |
|
||||||
|
| Fail2Ban | CT 202 (logserver) | - | Brute-Force-Schutz |
|
||||||
|
| Promtail | CT 202, CT 207, VM 201 | - | Log-Shipper |
|
||||||
|
|
||||||
|
## Sicherheits-Infrastruktur
|
||||||
|
|
||||||
|
| Komponente | System | Beschreibung |
|
||||||
|
|------------|--------|-------------|
|
||||||
|
| Nginx Proxy Manager | CT 101 | Reverse Proxy, SSL-Terminierung |
|
||||||
|
| Fail2Ban | CT 202 | Automatisches IP-Blocking |
|
||||||
|
| Wazuh Agents | VM 107, VM 108, VM 200, VM 201 | HIDS auf kritischen Systemen |
|
||||||
|
| Suricata IDS | CT 207 | Netzwerk-Angriffserkennung |
|
||||||
|
| anomalie_check.sh | CT 202 | Tägliche Log-Analyse mit IP-Lookup |
|
||||||
|
| authentik SSO | CT 209 (stopped) | Zentrales Identity Management |
|
||||||
|
|
||||||
|
## Datei-Shares
|
||||||
|
|
||||||
|
| Share | Protokoll | Host | Beschreibung |
|
||||||
|
|-------|-----------|------|-------------|
|
||||||
|
| \\192.168.0.91 | SMB/Samba | VM 108 | Arbeitsfreigaben |
|
||||||
|
| \\192.168.0.47\nicolay\Musik | SMB | WD MyCloud NAS | Musik-Bibliothek (3 TB) |
|
||||||
|
|
||||||
|
## Gitea Repositories
|
||||||
|
|
||||||
|
| Repo | URL | Inhalt |
|
||||||
|
|------|-----|--------|
|
||||||
|
| aqualog | http://gitea.braetter.local/braetter/aqualog | Aquarium Logbuch React/Node App |
|
||||||
|
| noteapp | http://gitea.braetter.local/braetter/noteapp | Notes Manager Flask App |
|
||||||
|
| homelabdoku | http://gitea.braetter.local/braetter/homelabdoku | Diese Dokumentation |
|
||||||
12
vms/README.md
Normal file
12
vms/README.md
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
# Virtuelle Maschinen
|
||||||
|
|
||||||
|
| VMID | Name | IP | OS | Status | Doku |
|
||||||
|
|------|------|----|----|--------|------|
|
||||||
|
| 103 | dns | 192.168.0.202 | Ubuntu 24.04 | running | [VM103-dns.md](VM103-dns.md) |
|
||||||
|
| 104 | DSL-Kiosk | DHCP | Linux | running | [VM104-dsl-kiosk.md](VM104-dsl-kiosk.md) |
|
||||||
|
| 105 | navidrome | 192.168.0.98 | Ubuntu 24.04 | running | [VM105-navidrome.md](VM105-navidrome.md) |
|
||||||
|
| 106 | paperless | 192.168.0.89 | Ubuntu 24.04 | running | [VM106-paperless.md](VM106-paperless.md) |
|
||||||
|
| 107 | vaultwarden | 192.168.0.90 | Ubuntu 24.04 | running | [VM107-vaultwarden.md](VM107-vaultwarden.md) |
|
||||||
|
| 108 | workfs | 192.168.0.91 | Ubuntu 24.04 | running | [VM108-workfs.md](VM108-workfs.md) |
|
||||||
|
| 200 | outline | 192.168.0.240 | Ubuntu 24.04 | running | [VM200-outline.md](VM200-outline.md) |
|
||||||
|
| 201 | ovpn-gw | 192.168.0.175 | Ubuntu 24.04 | running | [VM201-ovpn-gw.md](VM201-ovpn-gw.md) |
|
||||||
39
vms/VM103-dns.md
Normal file
39
vms/VM103-dns.md
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
# VM 103 — dns
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 103 |
|
||||||
|
| Name | dns |
|
||||||
|
| IP | 192.168.0.202/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 2 vCores (x86-64-v3) |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | nasstorage:103/vm-103-disk-0.qcow2, 200 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| Technitium DNS | 53 (UDP/TCP) | DNS-Auflösung |
|
||||||
|
| Technitium Web-UI | 5380 | DNS-Verwaltungsoberfläche |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **DNS Web-UI:** http://192.168.0.202:5380
|
||||||
|
- **SSH:** `ssh claude@192.168.0.202`
|
||||||
|
|
||||||
|
## Konfiguration
|
||||||
|
|
||||||
|
- Interne Domain: `braetter.local`
|
||||||
|
- Weiterleitungen für externe Domains an öffentliche DNS-Server
|
||||||
|
- Alle Homelab-Systeme nutzen 192.168.0.202 als primären DNS
|
||||||
|
- Fallback: 192.168.0.1 (Router)
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Technitium DNS Server als interner Resolver. Löst alle `*.braetter.local` Hostnamen auf und bietet DNS-over-HTTPS/TLS sowie Blocking-Listen.
|
||||||
20
vms/VM104-dsl-kiosk.md
Normal file
20
vms/VM104-dsl-kiosk.md
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
# VM 104 — DSL-Kiosk
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 104 |
|
||||||
|
| Name | DSL-Kiosk |
|
||||||
|
| IP | DHCP |
|
||||||
|
| OS | Linux |
|
||||||
|
| CPU | 2 vCores (x86-64-v2-AES) |
|
||||||
|
| RAM | 4096 MB |
|
||||||
|
| Disk | osdisk:104/vm-104-disk-1.qcow2, 80 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Kiosk-System für DSL-Zugang. Dediziertes VM für Kiosk-Betrieb (Touch-/Vollbild-Modus).
|
||||||
36
vms/VM105-navidrome.md
Normal file
36
vms/VM105-navidrome.md
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
# VM 105 — navidrome
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 105 |
|
||||||
|
| Name | navidrome |
|
||||||
|
| IP | 192.168.0.98/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 4 vCores (x86-64-v3) |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | nasstorage:105/vm-105-disk-0.qcow2, 200 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| navidrome | 4533 | Musik-Streaming Web-UI + API |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Navidrome:** http://192.168.0.98:4533
|
||||||
|
- **SSH:** `ssh claude@192.168.0.98`
|
||||||
|
|
||||||
|
## Musik-Bibliothek
|
||||||
|
|
||||||
|
- Quelle: NAS-Share `//192.168.0.47/nicolay/Musik` (WD MyCloud, 3 TB)
|
||||||
|
- Eingebunden per SMB auf Proxmox Host: `/mnt/pve/wdm`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Navidrome ist ein selbst-gehosteter Musik-Streaming-Server (Subsonic-API-kompatibel). Unterstützt alle gängigen Subsonic-Clients (DSub, Symfonium, etc.).
|
||||||
36
vms/VM106-paperless.md
Normal file
36
vms/VM106-paperless.md
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
# VM 106 — paperless
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 106 |
|
||||||
|
| Name | paperless |
|
||||||
|
| IP | 192.168.0.89/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 4 vCores (x86-64-v3) |
|
||||||
|
| RAM | 3072 MB |
|
||||||
|
| Disk | nasstorage:106/vm-106-disk-0.qcow2, 1000 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| paperless-webserver | 8000 | Paperless-NGX Web-UI |
|
||||||
|
| paperless-consumer | - | Dokument-Eingangs-Worker |
|
||||||
|
| paperless-scheduler | - | Celery Beat Scheduler |
|
||||||
|
| paperless-task-queue | - | Celery Worker |
|
||||||
|
| postgresql@16 | 5432 (lokal) | PostgreSQL 16 Datenbank |
|
||||||
|
| redis-server | 6379 (lokal) | Redis Task-Queue |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Paperless Web:** http://192.168.0.89:8000
|
||||||
|
- **SSH:** `ssh claude@192.168.0.89`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Paperless-NGX ist ein selbst-gehostetes Dokumentenmanagement-System (DMS). Scannt, indexiert und archiviert alle eingehenden Dokumente mit OCR. Unterstützt Tags, Korrespondenten, Dokumenttypen und Volltextsuche.
|
||||||
32
vms/VM107-vaultwarden.md
Normal file
32
vms/VM107-vaultwarden.md
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
# VM 107 — vaultwarden
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 107 |
|
||||||
|
| Name | vaultwarden |
|
||||||
|
| IP | 192.168.0.90/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 4 vCores (x86-64-v3) |
|
||||||
|
| RAM | 1024 MB |
|
||||||
|
| Disk | nasstorage:107/vm-107-disk-0.qcow2, 100 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| vaultwarden | 8080 | Bitwarden-kompatibler Passwort-Manager |
|
||||||
|
| wazuh-agent | - | Sicherheits-Monitoring |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Vaultwarden Web:** http://192.168.0.90:8080
|
||||||
|
- **SSH:** `ssh claude@192.168.0.90`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Vaultwarden ist eine selbst-gehostete, inoffizielle Bitwarden-Server-Implementierung in Rust. Bietet vollständige Kompatibilität mit allen offiziellen Bitwarden-Clients (Browser-Extension, Mobile Apps, Desktop). Wazuh-Agent für HIDS-Monitoring aktiv.
|
||||||
37
vms/VM108-workfs.md
Normal file
37
vms/VM108-workfs.md
Normal file
@@ -0,0 +1,37 @@
|
|||||||
|
# VM 108 — workfs
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 108 |
|
||||||
|
| Name | workfs |
|
||||||
|
| IP | 192.168.0.91/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 4 vCores (x86-64-v3) |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | nasstorage:108/vm-108-disk-0.qcow2, 1000 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| smbd (Samba) | 445, 139 | SMB/CIFS Dateifreigabe |
|
||||||
|
| nmbd (Samba) | - | NetBIOS Name Service |
|
||||||
|
| wazuh-agent | - | Sicherheits-Monitoring |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **SMB-Share:** `\\192.168.0.91\` (Windows) / `smb://192.168.0.91/` (Mac/Linux)
|
||||||
|
- **SSH:** `ssh claude@192.168.0.91`
|
||||||
|
|
||||||
|
## Samba-Shares
|
||||||
|
|
||||||
|
Shares in `/etc/samba/smb.conf` konfiguriert. 1 TB Disk auf nasstorage.
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Dedizierter Dateiserver mit Samba für Windows-kompatible Netzwerkfreigaben. Primär für Arbeits- und Projekt-Dateien genutzt. Wazuh-Agent für HIDS-Monitoring aktiv.
|
||||||
35
vms/VM200-outline.md
Normal file
35
vms/VM200-outline.md
Normal file
@@ -0,0 +1,35 @@
|
|||||||
|
# VM 200 — outline
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 200 |
|
||||||
|
| Name | outline |
|
||||||
|
| IP | 192.168.0.240/24 |
|
||||||
|
| OS | Ubuntu 24.04.3 LTS |
|
||||||
|
| CPU | 2 vCores (qemu64) |
|
||||||
|
| RAM | 1024 MB |
|
||||||
|
| Disk | local-lvm:vm-200-disk-1, 150 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| outline / nginx | 80, 8000 | Outline Knowledge Base |
|
||||||
|
| outline | 9443 | HTTPS |
|
||||||
|
| mariadb | 3306 (lokal) | MariaDB 10.11.13 Datenbank |
|
||||||
|
| docker | - | Container Runtime |
|
||||||
|
| wazuh-agent | - | Sicherheits-Monitoring |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Outline Web:** http://192.168.0.240 (HTTP) / https://192.168.0.240:9443
|
||||||
|
- **SSH:** `ssh claude@192.168.0.240`
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Outline ist eine selbst-gehostete Knowledge Base / Wiki-Software. Unterstützt kollaboratives Schreiben, Dokument-Strukturen und Team-Workspaces. MariaDB als Backend-Datenbank, läuft teilweise in Docker. Wazuh-Agent aktiv.
|
||||||
58
vms/VM201-ovpn-gw.md
Normal file
58
vms/VM201-ovpn-gw.md
Normal file
@@ -0,0 +1,58 @@
|
|||||||
|
# VM 201 — ovpn-gw
|
||||||
|
|
||||||
|
## Systemdaten
|
||||||
|
|
||||||
|
| Eigenschaft | Wert |
|
||||||
|
|-------------|------|
|
||||||
|
| VMID | 201 |
|
||||||
|
| Name | ovpn-gw |
|
||||||
|
| IP | 192.168.0.175/24 |
|
||||||
|
| OS | Ubuntu 24.04.4 LTS |
|
||||||
|
| CPU | 4 vCores (host) |
|
||||||
|
| RAM | 2048 MB |
|
||||||
|
| Disk | osdisk:201/vm-201-disk-1.raw, 120 GB |
|
||||||
|
| Bridge | vmbr0, Firewall aktiv |
|
||||||
|
| Autostart | ja |
|
||||||
|
| Status | running |
|
||||||
|
|
||||||
|
## Dienste
|
||||||
|
|
||||||
|
| Dienst | Port | Beschreibung |
|
||||||
|
|--------|------|-------------|
|
||||||
|
| pritunl | 80, 443 | VPN Web-UI + VPN-Server |
|
||||||
|
| pritunl-web | - | Pritunl Backend |
|
||||||
|
| mongod | 27017 (lokal) | MongoDB (Pritunl-Datenbank) |
|
||||||
|
| node_exporter | 9100 | Prometheus Metriken |
|
||||||
|
| snmpd | - | SNMP |
|
||||||
|
| patchmon-agent | 3001 | PatchMon Monitoring-Agent |
|
||||||
|
| check-mk-agent | 6556 | CheckMK Monitoring |
|
||||||
|
| cmk-agent-ctl | - | CheckMK Controller |
|
||||||
|
| wazuh-agent | - | HIDS |
|
||||||
|
| promtail | 9080 | Log-Shipper |
|
||||||
|
| postfix | - | Mailversand |
|
||||||
|
|
||||||
|
## Netzwerk-Interfaces
|
||||||
|
|
||||||
|
| Interface | IP | Beschreibung |
|
||||||
|
|-----------|----|-------------|
|
||||||
|
| ens18 | 192.168.0.175 | LAN |
|
||||||
|
| tun0 | 10.11.99.5/24 | VPN-Tunnel 1 (Roadwarrior) |
|
||||||
|
| tun1 | 10.11.120.2/24 | VPN-Tunnel 2 (Site-to-Site) |
|
||||||
|
|
||||||
|
## Zugriff
|
||||||
|
|
||||||
|
- **Pritunl Web:** https://192.168.0.175
|
||||||
|
- **SSH:** `ssh claude@192.168.0.175`
|
||||||
|
|
||||||
|
## VPN Konfigurationen (/etc/openvpn/)
|
||||||
|
|
||||||
|
| Datei | Beschreibung |
|
||||||
|
|-------|-------------|
|
||||||
|
| `adbooker.conf` | adbooker VPN |
|
||||||
|
| `family.conf` | Family VPN |
|
||||||
|
| `ab_utm_vrsmedia_de_roadwarrior_*` | VRS Media Roadwarrior |
|
||||||
|
| `utm_family_fmdtc_de_roadwarrior_*` | Family FMDTC Roadwarrior |
|
||||||
|
|
||||||
|
## Beschreibung
|
||||||
|
|
||||||
|
Zentrales VPN-Gateway mit Pritunl als Verwaltungsoberfläche für OpenVPN. Verbindet externe Clients mit dem Heimnetz und stellt Site-to-Site-Tunnel bereit. Umfangreiches Monitoring (CheckMK, Wazuh, PatchMon, Prometheus).
|
||||||
Reference in New Issue
Block a user