Unified Monitoring Stack - Revision history

Wikisailor: /* =Securing the Admin Logon */

2026-02-25T00:26:20Z

=Securing the Admin Logon

← Older revision		Revision as of 00:26, 25 February 2026
Line 469:		Line 469:
	As can be noted in the YAML file there are two lines that look suspicious the new accounts and the admin token. These are left as they are for the initial setup but we will change them now. first the new accounts needs to be remedied so that if someone on the Internet stumbles across our vault they don't start filling our password manager with bogus junk. Obviously, we need to create our own account so we logon to <nowiki>https://vault.seaoffate.net</nowiki>. At the vault warden logon screen create the account/s as required. Once all of the accounts are created we can change the line in the environment "SIGNUPS_ALLOWED=true" to SIGNUPS_ALLOWED=false and restart the application. From this point on no new accounts can be created, while the logon screen does continue to show the option to do so it will not actually complete the new account creation process.		As can be noted in the YAML file there are two lines that look suspicious the new accounts and the admin token. These are left as they are for the initial setup but we will change them now. first the new accounts needs to be remedied so that if someone on the Internet stumbles across our vault they don't start filling our password manager with bogus junk. Obviously, we need to create our own account so we logon to <nowiki>https://vault.seaoffate.net</nowiki>. At the vault warden logon screen create the account/s as required. Once all of the accounts are created we can change the line in the environment "SIGNUPS_ALLOWED=true" to SIGNUPS_ALLOWED=false and restart the application. From this point on no new accounts can be created, while the logon screen does continue to show the option to do so it will not actually complete the new account creation process.

	====Securing the Admin Logon===		====Securing the Admin Logon====

	The next thing to address is the "ADMIN_TOKEN=yoursecret_change_this # Used for the /admin panel" line. The admin logon is accessed from the URL <nowiki>https://vault.seaoffate.net/admin</nowiki> and is be used to configure options for the Vault warden users. There is no username just a password. To avoid posting a password on the Dockge screen we use a password encryption routine supplied by the Vault warden application. to create a password follow these steps		The next thing to address is the "ADMIN_TOKEN=yoursecret_change_this # Used for the /admin panel" line. The admin logon is accessed from the URL <nowiki>https://vault.seaoffate.net/admin</nowiki> and is be used to configure options for the Vault warden users. There is no username just a password. To avoid posting a password on the Dockge screen we use a password encryption routine supplied by the Vault warden application. to create a password follow these steps

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:32:34Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:32, 23 February 2026
Line 507:		Line 507:
	# Configuration		# Configuration
	REMOTE_USER="nigel"		REMOTE_USER="nigel"
	REMOTE_HOST="mango.seaoffate.local" ~~# Mango~~		REMOTE_HOST="mango.seaoffate.local"
	REMOTE_DIR="/opt/dockge/stacks/vaultwarden/data"		REMOTE_DIR="/opt/dockge/stacks/vaultwarden/data"
	BACKUP_DIR="/home/nigel/backups/vaultwarden"		BACKUP_DIR="/home/nigel/backups/vaultwarden"
Line 517:		Line 517:
	echo "Starting Vaultwarden backup from Mango..."		echo "Starting Vaultwarden backup from Mango..."
	#		#
	# ~~Use rsync to pull the data folder.~~		# Sync files
	~~# --delete ensures if you delete a file on Mango, it eventually clears on Raisin~~
	~~# We exclude the 'attachments' folder if it's too big, but usually, it's fine.~~
	if rsync -avz -e ssh "$REMOTE_USER@$REMOTE_HOST:$REMOTE_DIR" "$BACKUP_DIR/latest/"; then		if rsync -avz -e ssh "$REMOTE_USER@$REMOTE_HOST:$REMOTE_DIR" "$BACKUP_DIR/latest/"; then
	echo "Files synced successfully."		echo "Files synced successfully."
			#
			# Create the timestamped archive
	tar -czf "$BACKUP_DIR/vault_backup_$TIMESTAMP.tar.gz" -C "$BACKUP_DIR/latest" .		tar -czf "$BACKUP_DIR/vault_backup_$TIMESTAMP.tar.gz" -C "$BACKUP_DIR/latest" .
			#
			# Delete files older than 30 days
			find "$BACKUP_DIR" -name "vault_backup_*.tar.gz" -mtime +30 -delete
			#
	echo "Backup complete: $BACKUP_DIR/vault_backup_$TIMESTAMP.tar.gz"		echo "Backup complete: $BACKUP_DIR/vault_backup_$TIMESTAMP.tar.gz"
	else		else

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:22:12Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:22, 23 February 2026
Line 500:		Line 500:
	* Create the backup script and file locations		* Create the backup script and file locations
	mkdir -p ~/scripts		mkdir -p ~/scripts
			mkdir -p ~/logs
	nano ~/scripts/backup-vault.sh		nano ~/scripts/backup-vault.sh
	* Copy the script to the file		* Copy the script to the file

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:20:41Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:20, 23 February 2026
Line 498:		Line 498:
	* If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine (just accept the defaults)		* If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine (just accept the defaults)
	ssh-keygen -t ed25519 -C "nigel@raisin"		ssh-keygen -t ed25519 -C "nigel@raisin"
	* Create the backup script		* Create the backup script and file locations
	mkdir -p ~/scripts		mkdir -p ~/scripts
	nano ~/scripts/backup-vault.sh		nano ~/scripts/backup-vault.sh

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:18:03Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:18, 23 February 2026
Line 537:		Line 537:
	sudo apt update && sudo apt install rsync -y		sudo apt update && sudo apt install rsync -y
	exit		exit
	* When back on raisin we need to add a new crontab ~~to run the script every night~~		* When back on raisin we need to add a new crontab (choose option 1 if asked)
	crontab -e		crontab -e
	* Add the line to the bottom of the list		* Add the line to the bottom of the list to run the script every morning at 03:00
	# Every ~~night~~ at 3:00 AM, pull the vault data from Mango		# Every morning at 3:00 AM, pull the vault data from Mango
	0 3 * * * /home/nigel/scripts/backup-vault.sh >> /home/nigel/logs/vault-backup.log 2>&1		0 3 * * * /home/nigel/scripts/backup-vault.sh >> /home/nigel/logs/vault-backup.log 2>&1
	* save & close, we can test the script with		* save & close, we can test the script with

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:13:05Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:13, 23 February 2026
Line 499:		Line 499:
	ssh-keygen -t ed25519 -C "nigel@raisin"		ssh-keygen -t ed25519 -C "nigel@raisin"
	* Create the backup script		* Create the backup script
	~~sudo~~ nano ~/scripts/backup-vault.sh		mkdir -p ~/scripts
			nano ~/scripts/backup-vault.sh
	* Copy the script to the file		* Copy the script to the file
	#!/bin/bash		#!/bin/bash

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:08:24Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:08, 23 February 2026
Line 496:		Line 496:
	* From the terminal of Raisin we need a passwordless logon to mango for the backup script to run		* From the terminal of Raisin we need a passwordless logon to mango for the backup script to run
	ssh-copy-id nigel@mango.seaoffate.local		ssh-copy-id nigel@mango.seaoffate.local
	* If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine		* If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine (just accept the defaults)
	ssh-keygen -t ed25519 -C "nigel@~~tayberry~~"		ssh-keygen -t ed25519 -C "nigel@raisin"
	* Create the backup script		* Create the backup script
	sudo nano ~/scripts/backup-vault.sh		sudo nano ~/scripts/backup-vault.sh

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:06:47Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:06, 23 February 2026
Line 496:		Line 496:
	* From the terminal of Raisin we need a passwordless logon to mango for the backup script to run		* From the terminal of Raisin we need a passwordless logon to mango for the backup script to run
	ssh-copy-id nigel@mango.seaoffate.local		ssh-copy-id nigel@mango.seaoffate.local
	** If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine		* If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine
	ssh-keygen -t ed25519 -C "nigel@tayberry"		ssh-keygen -t ed25519 -C "nigel@tayberry"
	* Create the backup script		* Create the backup script

Wikisailor: /* 🏛️Data Integrity & Backups */

2026-02-23T22:06:23Z

🏛️Data Integrity & Backups

← Older revision		Revision as of 22:06, 23 February 2026
Line 496:		Line 496:
	* From the terminal of Raisin we need a passwordless logon to mango for the backup script to run		* From the terminal of Raisin we need a passwordless logon to mango for the backup script to run
	ssh-copy-id nigel@mango.seaoffate.local		ssh-copy-id nigel@mango.seaoffate.local
			** If an error like "/usr/bin/ssh-copy-id: ERROR: No identities found" use the keygen routine
			ssh-keygen -t ed25519 -C "nigel@tayberry"
	* Create the backup script		* Create the backup script
	sudo nano ~/scripts/backup-vault.sh		sudo nano ~/scripts/backup-vault.sh

Wikisailor: /* 🔐 Vaultwarden Deployment on Mango */

2026-02-23T21:44:12Z

🔐 Vaultwarden Deployment on Mango

@@ Line 428: / Line 428: @@
 💡By enabling  ROCKET_TLS with the public SSL Cert from Letencypt, in the Vaultwarden container on Mango, the container itself is expecting an encrypted connection and connection requests from within our home lab, inside the Pfsense VLANs will also be over TLS and no matter how the lap is reconfigured all passwords will always be passed over an encrypted channel.
-=== Nginx Reverse Proxy Configuration (Raisin)===
+===🍇 Nginx Reverse Proxy Configuration (Raisin)===
 Raisin acts as the TLS gateway. It intercepts external requests and passes them to Mango over the internal network. '''''Note''' We will not allow any http access on port 80 and the default site config elsewhere would drop any clear text connection attempt if any of the firewalls were inadvertently left forwarding port 80 on to Raisin.''
@@ Line 463: / Line 463: @@
 💡 Why we use https for the proxy_pass
-Since we enabled ROCKET_TLS in the Vaultwarden container on Mango, the container itself is expecting an encrypted connection. By using proxy_pass https://..., Raisin and Mango will talk to each other over an encrypted link inside our network. With the current configuration both Raisin and Mango are physically on the same Proxmox host so very little chance that the communication could be intercepted. However, if at some point the VMs are moved it is be better to keep the channel encrypted end to end rather than as some sources suggest and pass the traffic via http on the backend.
+Since we enabled ROCKET_TLS in the Vaultwarden container on Mango, the container itself is expecting an encrypted connection. By using proxy_pass https://..., Raisin and Mango will talk to each other over an encrypted link inside our network. With the current configuration both Raisin and Mango are physically on the same Proxmox host so very little chance that the communication could be intercepted. However, if at some point the VMs are moved it is be better to keep the channel encrypted end to end rather than as some sources suggest and pass the traffic via http on the backend. It has been noted that most guides that setup services with docker have a tendency to treat security as an after thought or a luxury, even with applications such as this where passwords are being accessed, by terminating the https at the reverse proxy. While that will indeed satisy the Cloudflare "full strict" requirement for end to end SSL, it is a big cheat and security hole that should be recognised as such & avoided. We prefer to use the SSL end to end and use the public cert so we get no browser warnings from within the LAN or outside.