# 4pfsec Home Lab by Nee
4pfsec Home Lab Documentation
## Introduction
I started Home-Lab-ing about 2 whole years ago on a Raspberry Pi which I got for my birthday. I'm now currently on a Dell PowerEdge R710 together with some networking and storage hardware! (Looking to expand :relaxed:)
This site documents My entire Home Lab and all the services I run :relaxed:! The site also contains some of my personal configs `(docker-compose.yml)` that I deploy in my lab! Hope this helps someone out there! Happy Home-Lab-ing!! 🥰
### Topology
### Infrastructure
#### Router
* **Nokia Beacon**
* **Cisco 1941 Series**
#### Access Point
* **Nokia Beacon Wifi**
* **CISCO Aironet 1250 Series**
#### Switch
* **Linksys LGS108 8-Port Business Desktop Gigabit Switch**
* **Cisco Catalyst 3750 v2 Series PoE-24**
#### Server
* **Dell PowerEdge R710**\
CPU\
\- 2 x Intel Xeon E5530\
RAM\
\- 64GB ECC RAM \[config = 8 x 8gb sticks]\
Storage\
\- 6 x 600gb SAS drives\
Extras\
\- Perc 6i RAID Controller\
\- iDrac remote management
# Ubuntu 20.04.3 LTS (with gnome)
## UbuntuSvr
Like many others, my go to choice of operating system is also a debian-based one. I started with Red Hat Enterprise Linux but for my home lab I didn't want to deal with any licensing issues that might restrict future security updates.
I was also running LTS CLI for a year but recently I've been running into issues and its been tough to debug them without wasting a ton of time. I felt that GUI with speed up my troubleshooting process. \[Manual networking really sucks on 20.04.3 or I'm just bad. (probably the latter)]
```
Guest OS Ubuntu Linux (64-bit)
Compatibility ESXi 6.5 virtual machine
VMware Tools Yes
CPUs 5
Memory 16 GB
Host name ubuntuSvr
```
# pfSense
Primary Network Firewall
## About
To segregate my Servers from my main network, I created another Virtual LAN. This was a more secure approach and also creates some kind of segregation in my home network. I also have custom firewall rules in place in order to restrict the systems from accessing my main network just in case someone were to get into one of those systems.
I also have an OpenVPN server setup in pfSense to enable me to access my machines when I'm not on prem. I'll write about how I did that soon!
## Setup Instructions
### Vswitch Configuration
To create a port group on VMware ESXI we first need to create a Virtual Switch as shown below.
### Port Group Configuration
Now that we have a virtual switch setup, we can setup the port group to assign our machines to.
### Pfsense VM Configuration
Now that we have the new port group created, we can add our Pfsense VM into the network to act as the gateway.
Now that the machine is connected to the LAN, we will be able to onboard the new LAN onto the FW.
Once the Interfaces is added, we have to configure the interface and set the IP range.
And once all that is done, check back at the terminal to confirm that you're LAN is successfully added as shown below.
# Nginx Proxy Manager
Reverse Proxy
## About
I use Nginx Proxy Manager as my primary reverse proxy. It helps me hide all my services behind one single port. I haven't had any issues with it over the 1.5 years that I've been using it. 10/10 Recommend!
## Docker-Compose
My personal Docker-Compose that I use on my production.
```
version: '3'
services:
app:
image: 'jc21/nginx-proxy-manager:latest'
restart: unless-stopped
ports:
- '80:80'
- '81:81'
- '443:443'
environment:
DB_MYSQL_HOST: "db"
DB_MYSQL_PORT: 3306
DB_MYSQL_USER: "npm"
DB_MYSQL_PASSWORD: "******"
DB_MYSQL_NAME: "npm"
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
db:
image: 'jc21/mariadb-aria:latest'
environment:
MYSQL_ROOT_PASSWORD: '******'
MYSQL_DATABASE: 'npm'
MYSQL_USER: 'npm'
MYSQL_PASSWORD: '******'
restart: unless-stopped
volumes:
- ./data/mysql:/var/lib/mysql
```
# Cloudflare
Content Delivery Network
## About
I used to leverage Digital Ocean's DNS service when I used to have droplets I was managing every month. Roughly a year ago, I switched over to Cloudflare mainly for their proxying feature which masks the end IP address. I've had no issues with Cloudflare ever since onboarding my domains or with Nginx Reverse Proxy acting up due to Cloudflare Proxying.
# Docker & Docker-Compose
## Docker
### Install
Prerequisites
```
apt-get install \
apt-transport-https \
ca-certificates \
curl \
gnupg-agent \
software-properties-common
```
Configure Docker apt repo
```
echo 'deb https://download.docker.com/linux/debian stretch stable' > /etc/apt/sources.list
```
Install
```
apt-get update
apt-get install docker.io docker-compose
```
### Creating a Docker Network
Creating a network allows us to throw all our containers into one network. Else, each container will have its own network.
```
docker network create --driver bridge containerz
```
### Verify
```
docker --version
```
# CIFS / SMB Shares
Mounting SMB Shares
## About
I have a couple SMB shares setup separately on my network and I mount those shares onto the server so I'd be able to manipulate and access those files without much effort and this is how I do that using `/etc/fstab`.
## Mounting
### Install cifs-utils
to be able to support SMB shares, the above package needs to be installed on the ubuntu machine.
```
sudo apt-get install cifs-utils
```
### Mkdir
Make a directory that you'd like to mount your files into.
```
mkdir nas
```
### Edit /etc/fstab
Here's the entry that I add to my `/etc/fstab`
```
//smb_server_ip/share_name /mount/directory cifs user=your_name,pass=your_pass 0 0
```
### Mount all
This command mounts all drives in the fstab file.
```
mount -a
```
### Verify
Running `tree` on the mounted directory will yield all files on the SMB share. You can use this to verify if the files are there.
```
tree directory/
```
# Homer
Dashboard
## About
A dead simple static HOMepage for your servER that keeps your services on hand, using a simple yaml configuration file. Takes slightly longer to setup compared to other dashboards but I personally like Homer a ton and have been using it for about a year. No complaints! I use git to keep my config files synced!
## Docker-Compose
```
version: '3.3'
services:
homer:
ports:
- '8880:8080'
volumes:
- '/location/to/homer/local/assets:/www/assets'
restart: always
image: 'b4bz/homer:latest'
user: "${UID}:${GID}"
```
# Navidrome
Music Streaming Server
## About
I've been using Navidrome ever since I started streaming music files and have been with it ever since. It's API is compatible with any subsonic player. So there are pretty amazing apps for it on both IOS and Android! No problem there. Awesome music streaming server.
## Docker-Compose
```
version: "3"
services:
navidrome:
image: deluan/navidrome:latest
restart: unless-stopped
ports:
- "4533:4533"
environment:
# Optional: put your config options customization here. Examples:
ND_SCANSCHEDULE: 1h
ND_LOGLEVEL: info
ND_BASEURL: ""
volumes:
- "./data:/data"
- "/location/of/music:/music:ro"
```
# Jellyfin
Media Streaming Server
## About
Jellyfin is my go to media streaming server. I've been using this for as long as I've been using the Music streaming server for. I have had close to no issues with this setup. If you have a spare GPU, it'll help with encoding. Other than that, it works perfectly fine for what it sets out to do!
(If your media were to exist on IMDB or TheMovieDB, jellyfin will automatically pull the data and fill in the blanks)
## Docker-Compose
```
version: "3.5"
services:
jellyfin:
image: jellyfin/jellyfin
container_name: jellyfin
user: 0:0
network_mode: "host"
volumes:
- /path/to/config:/config
- /path/to/cache:/cache
- /path/to/movies:/media
restart: "unless-stopped"
# Optional - alternative address used for autodiscovery
# environment:
# - JELLYFIN_PublishedServerUrl=http://example.com
```
# Deluge
BitTorrent Client
## About
Instead of needing an endpoint client (Laptop, phone) to be turned on while a torrent downloads, I leverage Deluge's BitTorrent Client and torrent on my server which runs 24/7. This not only saves space on my endpoint device, it also means that I don't have to be online while the download is going! I can just access Deluge via the web UI, execute the download and come back when its done!
## Docker-Compose
```
version: "2.1"
services:
deluge:
image: lscr.io/linuxserver/deluge
container_name: deluge
environment:
- PUID=0
- PGID=0
- TZ=Asia/Singapore
- DELUGE_LOGLEVEL=error #optional
volumes:
- /root/home_lab/deluge/config/:/config
- /root/wd_nas/movies/Downloads/:/downloads
ports:
- 8112:8112
- 6881:6881
- 6881:6881/udp
restart: unless-stopped
```
# File Browser
Web Based File Managing interface within a specified directory
## About
File Browser is another self hosted application I use to assist me in remotely accessing my files. I have a working directory which I pass through to the docker container. The container has a web UI which I then expose out to the WWW securely. With this I can download, modify and upload files onto the share. Pretty useful application especially when u want to share files/folders to friends and family.
## Docker-Compose
```
version: '3.3'
services:
filebrowser:
volumes:
- '/location/to/fs:/srv'
- '/location/to/filebrowser.db:/database/filebrowser.db'
- '/location/to/settings.json:/config/settings.json'
environment:
- PUID=0
- PGID=0
ports:
- '8080:80'
image: 'filebrowser/filebrowser'
```
# Pasty
Lightweight Code Pasting Server
## About
I was looking for an open source self-hosted alternative to something like paste bin. That's when I found [Pasty](https://github.com/lus/pasty). I've been using it for about 4 months now and its good at what it does! No complaints. One thing I like about it is that it sets a modification password and users will only be able to edit a created paste is by entering the password.
## Docker-Compose
```
version: '3.3'
services:
lus:
restart: unless-stopped
ports:
- '8080:8080'
container_name: pasty
environment:
- PASTY_AUTODELETE=true
image: 'ghcr.io/lus/pasty:latest'
```
# NextCloud
Own Cloud / File Storage
## About
I use NextCloud mainly to upload and access files which I deem as throwaway AKA not as important. More important files go straight to my NAS which is shared out via SMB. The NextCloud instance is used to share directories and files which looks nice to family and friends :joy:! Also, their IOS and Android app makes this a very solid self-hosted Cloud option!
## Installation
### Docker-Compose
```
version: '3.3'
services:
nextcloud:
ports:
- '8080:80'
image: nextcloud
```
I recommend setting up a VM solely for Next Cloud for stability reasons. I used to run this docker on a pi when I didn't have a full fledged server and it was surprisingly pretty solid! Do it at your own risk tho :warning:!
### Pre-Installed VM
If you're in a time crunch, you can simple get a preconfigured VM from [hanssonit](https://www.hanssonit.se/nextcloud-vm/) and deploy that into your infra! I've tested this option before and it works just as well or even better than the docker.
# Nord
VPN
## About
Lastly, any connection going out from the server will be going through a Virtual Private Network. I personally use Nord and their services. This connection will be used for things such as proxying while outside, torrenting, downloading and other tasks! (This was also another reason I needed a GUI!)
## Steps
### Install
```
sudo apt-get install openvpn
```
### Download & unzip .ovpn Files
```
sudo wget https://downloads.nordcdn.com/configs/archives/servers/ovpn.zip
sudo unzip ovpn.zip
sudo rm ovpn.zip
```
### Choose best Server
Head over [here](https://nordvpn.com/servers/tools/?_ga=2.262917772.1685204623.1653073001-1934237312.1644136896) to choose a server that's best for you!
### Connect
Get the service credentials that's on your NORD account dashboard and authenticate to connect.
