diff --git a/.gitignore b/.gitignore index 57e4aff..80d2253 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,8 @@ +# Virtual environments +.kuma_venv/ +venv/ +.envs/ + # Environment and secrets .env .env.* @@ -276,6 +281,7 @@ side-agent/manifest/ # Claude Code session data and instructions .claude/ CLAUDE.md +QWEN.md # Gitea runtime data (sessions, SSH keys, databases) gitea/ diff --git a/.qwen/settings.json b/.qwen/settings.json new file mode 100644 index 0000000..9a52ef3 --- /dev/null +++ b/.qwen/settings.json @@ -0,0 +1,41 @@ +{ + "permissions": { + "allow": [ + "Bash(mkdir *)", + "Bash(docker compose up *)", + "Bash(sleep *)", + "Bash(curl *)", + "Bash(docker inspect *)", + "Bash(python3 *)", + "Bash(docker logs *)", + "Bash(docker cp *)", + "Bash(docker exec *)", + "Bash(import *)", + "Bash(kuma_url *)", + "Bash(token *)", + "Bash(as *)", + "Bash(1].strip)", + "Bash(break)", + "Bash(print)", + "Bash(exit)", + "Bash(monitors *)", + "Bash(])", + "Bash(sio *)", + "Bash(sio.connect)", + "Bash(r *)", + "Bash('loginbytoken', *)", + "Bash(else:)", + "Bash(sio.disconnect)", + "Bash(added *)", + "Bash(p *)", + "Bash(elif *)", + "Bash(try:)", + "Bash('add', *)", + "Bash(except *)", + "Bash(time.sleep)", + "Bash(pyeof)", + "Bash(docker ps *)" + ] + }, + "$version": 3 +} \ No newline at end of file diff --git a/.qwen/settings.json.orig b/.qwen/settings.json.orig new file mode 100644 index 0000000..9a9e4cc --- /dev/null +++ b/.qwen/settings.json.orig @@ -0,0 +1,7 @@ +{ + "permissions": { + "allow": [ + "Bash(mkdir *)" + ] + } +} \ No newline at end of file diff --git a/OPENCLAW_SETUP.md b/OPENCLAW_SETUP.md index 4f2752b..cb27de8 100644 --- a/OPENCLAW_SETUP.md +++ b/OPENCLAW_SETUP.md @@ -1,6 +1,6 @@ # OpenClaw Setup Guide -**OpenClaw**: Personal AI Assistant that executes actions (emails, calendar, shell commands, API integrations) +> Personal AI Assistant that executes actions - emails, calendar, shell commands, API integrations. ## Quick Setup @@ -13,11 +13,14 @@ nano ~/.openclaw_secrets ``` Fill in: -- `ANTHROPIC_API_KEY` - Claude API from Anthropic -- `OPENAI_API_KEY` - GPT-4 / Codex from OpenAI -- `GITHUB_TOKEN` - GitHub Copilot API access -- `TWILIO_*` - WhatsApp integration (optional) -- `TELEGRAM_*` - Telegram bot integration (optional) + +| Secret | Purpose | +|--------|---------| +| `ANTHROPIC_API_KEY` | Claude API from Anthropic | +| `OPENAI_API_KEY` | GPT-4 / Codex from OpenAI | +| `GITHUB_TOKEN` | GitHub Copilot API access | +| `TWILIO_*` | WhatsApp integration (optional) | +| `TELEGRAM_*` | Telegram bot integration (optional) | ### 2. Load Secrets @@ -31,73 +34,90 @@ Or they auto-load when you open a new shell (bashrc sources them). ```bash cd ~/mydocker -docker-compose up -d openclaw +docker compose up -d openclaw ``` -## Access OpenClaw +## Access ### Web UI -- **URL**: https://openclaw.sebson.space (via Traefik) -- **Port**: 3000 -- Interface for managing tasks, memory, integrations + +| Detail | Value | +|--------|-------| +| URL | https://openclaw.sebson.space (via Traefik) | +| Port | 3000 | +| Purpose | Task management, memory, integrations | ### CLI + ```bash # Helper function (auto-loaded) openclaw-cli "do something" # Or directly -docker-compose exec openclaw openclaw "command" +docker compose exec openclaw openclaw "command" ``` -### WhatsApp -Send message to configured Twilio number → OpenClaw responds and executes +### Telegram (Primary) -### Telegram -Send message to bot (if `TELEGRAM_BOT_TOKEN` configured) +- Enabled - requires `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` +- Bot responds to messages and executes actions + +### WhatsApp (Placeholder) + +- Disabled by default (can be enabled) +- Requires Twilio account + `TWILIO_*` variables +- Set `"enabled": true` in config to activate ### API -- **Endpoint**: http://localhost:3001 -- **Usage**: + +| Detail | Value | +|--------|-------| +| Internal | http://localhost:3007 (changed from 3001 to avoid Grafana conflict) | +| Via Traefik | https://api.openclaw.sebson.space (optional - requires DNS record) | + ```bash -curl -X POST http://localhost:3001/api/execute \ +curl -X POST http://localhost:3007/api/execute \ -H "Content-Type: application/json" \ -d '{"action":"email","to":"user@example.com","subject":"test"}' ``` +## Port Mapping + +| Host | Container | Purpose | +|------|-----------|---------| +| 3000 | 3000 | Web UI | +| 3007 | 3001 | API | + ## Bash Helpers Auto-added to `~/.bashrc`: -```bash -# Check which integrations are configured -openclaw-secrets - -# Start the service -openclaw-start - -# View logs -openclaw-logs - -# Execute command via CLI -openclaw-cli "send email to john@example.com saying hello" -``` +| Command | Description | +|---------|-------------| +| `openclaw-secrets` | Check which integrations are configured | +| `openclaw-start` | Start the service | +| `openclaw-logs` | View logs | +| `openclaw-cli "..."` | Execute command via CLI | ## Configuration -**File**: `/home/seba/mydocker/openclaw-config.json` +**File:** `/home/seba/mydocker/openclaw-config.json` Key settings: -- `ai.provider` - Default AI model (claude, gpt, copilot) -- `integrations` - Enable/disable services (WhatsApp, Telegram, Gmail, GitHub, etc.) -- `system.sandbox` - Run in sandbox mode (safe) -- `system.shellAccess` - Allow shell command execution -- `webUI.port` - Web interface port (3000) -- `api.port` - REST API port (3001) -## AI Models Priority +| Setting | Description | +|---------|-------------| +| `ai.provider` | Default AI model (claude, gpt, copilot) | +| `integrations` | Enable/disable services (WhatsApp, Telegram, Gmail, GitHub, etc.) | +| `system.sandbox` | Run in sandbox mode (safe) | +| `system.shellAccess` | Allow shell command execution | +| `webUI.port` | Web interface port (3000) | +| `api.port` | REST API port (3001 internally, mapped to 3007) | + +## AI Model Priority + +OpenClaw tries models in order: -OpenClaw tries in order: 1. **Claude** (Anthropic) - Recommended, most capable 2. **GPT-4** (OpenAI) - Alternative 3. **Copilot** (GitHub) - Code-focused @@ -106,26 +126,23 @@ Configure via `OPENCLAW_MODEL` env var or config file. ## Persistent Memory -- **Location**: `/data/memory` (Docker volume) -- **Survives restarts**: Yes -- **Clearable**: `docker-compose down` won't delete it +- **Location:** `/data/memory` (Docker volume) +- **Survives restarts:** Yes +- **Clearable:** `docker compose down` will NOT delete it -Memory stores: -- Your preferences -- Past conversations -- Learned patterns -- Custom skills +Stores: preferences, past conversations, learned patterns, custom skills. -## Security & Sandbox +## Security + +> **Important considerations:** -**⚠️ Important**: - OpenClaw runs with shell access (configurable via `system.shellAccess`) - Docker container is sandboxed from host -- API keys stored in environment (not in code) +- API keys stored in environment variables (not in code) - Config file mounted read-only **To disable shell access** (safer): -Edit `openclaw-config.json`: + ```json "system": { "shellAccess": false @@ -134,149 +151,92 @@ Edit `openclaw-config.json`: Then restart: ```bash -docker-compose restart openclaw +docker compose restart openclaw ``` -## Skills & Plugins +## Capabilities OpenClaw can: - Read/write files - Execute shell commands (if enabled) - Call APIs (50+ integrations) -- Send emails, messages +- Send emails and messages - Manage calendars -- **Write its own plugins** (with safe limits) +- Write its own plugins (with safe limits) ## Troubleshooting -### Check Secrets Are Loaded ```bash +# Check secrets are loaded openclaw-secrets -``` -### View Logs -```bash +# View logs openclaw-logs -``` -### Rebuild Image -```bash -docker-compose build --no-cache openclaw -``` +# Rebuild image +docker compose build --no-cache openclaw -### Full Reset (deletes memory) -```bash -docker-compose down openclaw +# Full reset (DELETES memory) +docker compose down openclaw docker volume rm mydocker_openclaw_memory -docker-compose up -d openclaw +docker compose up -d openclaw ``` ## Integration Examples -### Send Email (via Gmail) ```bash +# Send email openclaw-cli "send email to boss@company.com subject 'report' body 'attached is...'" -``` -### Check Calendar -```bash +# Check calendar openclaw-cli "what's on my calendar tomorrow" -``` -### Execute Command -```bash +# Execute command openclaw-cli "run git status in /home/seba/project" -``` -### GitHub Action -```bash +# GitHub action openclaw-cli "create pull request to close issue #123" -``` -## Environment Variables - -All OpenClaw settings via `.env`: -```bash -ANTHROPIC_API_KEY=sk-ant-... -OPENAI_API_KEY=sk-... -GITHUB_TOKEN=ghp_... -TWILIO_ACCOUNT_SID=AC... -TWILIO_AUTH_TOKEN=... -TELEGRAM_BOT_TOKEN=... +# Send Telegram message +openclaw-cli "send message to telegram: hello" ``` ## Docker Commands ```bash # Start -docker-compose up -d openclaw +docker compose up -d openclaw # Stop -docker-compose stop openclaw +docker compose stop openclaw # Restart -docker-compose restart openclaw +docker compose restart openclaw -# View logs -docker-compose logs -f openclaw +# Follow logs +docker compose logs -f openclaw # Shell access -docker-compose exec openclaw /bin/bash +docker compose exec openclaw /bin/bash # Delete service (keeps memory/config) -docker-compose down openclaw +docker compose down openclaw # Rebuild -docker-compose build --no-cache openclaw && docker-compose up -d openclaw +docker compose build --no-cache openclaw && docker compose up -d openclaw ``` -## Next Steps +## Quick Start Checklist -1. ✅ Add your API keys to `~/.openclaw_secrets` -2. ✅ Run `source ~/.openclaw_secrets` -3. ✅ Start service: `openclaw-start` -4. ✅ Access Web UI: https://openclaw.sebson.space -5. ✅ Try CLI: `openclaw-cli "hello"` -6. ✅ Set up WhatsApp/Telegram (optional) +1. Add API keys to `~/.openclaw_secrets` +2. Run `source ~/.openclaw_secrets` +3. Start service: `openclaw-start` +4. Access Web UI: https://openclaw.sebson.space +5. Try CLI: `openclaw-cli "hello"` +6. Set up Telegram (optional) -## Useful Resources +## Resources -- **GitHub**: https://github.com/openclaw/openclaw -- **Docs**: https://openclaw.ai/docs -- **API Docs**: https://openclaw.ai/api - -## Domeny - -### Web UI -- Domain: `openclaw.sebson.space` (dodane do DNS) -- Internal: `http://localhost:3000` -- Via Traefik: `https://openclaw.sebson.space` - -### API -- Internal: `http://localhost:3007` (changed from 3001 to avoid Grafana conflict) -- Via Traefik: `https://api.openclaw.sebson.space` (optional - requires DNS record) - -## Port Mapping - -``` -Host → Container -3000 → 3000 (Web UI) -3007 → 3001 (API) -``` - -## Komunikacja - -### Telegram ✅ (primary) -- Enabled -- Wymaga: `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` -- Bot will respond to messages and execute actions - -### WhatsApp (placeholder) -- Disabled (ale możesz włączyć) -- Wymaga: Twilio account + `TWILIO_*` variables -- Jeśli będziesz chcieć - wystarczy zmienić `"enabled": false` na `true` w config - -### CLI ✅ (always available) -```bash -openclaw-cli "send message to telegram: hello" -``` +- **GitHub:** https://github.com/openclaw/openclaw +- **Docs:** https://openclaw.ai/docs +- **API Docs:** https://openclaw.ai/api diff --git a/README.md b/README.md new file mode 100644 index 0000000..66d09c3 --- /dev/null +++ b/README.md @@ -0,0 +1,157 @@ +# MyDocker - Home Infrastructure Stack + +> Docker Compose based home infrastructure with 40+ services. Domain: **sebson.space** + +## Quick Start + +```bash +cd /home/seba/mydocker + +docker compose up -d # Start all services +docker compose down # Stop all +docker compose ps # Running containers +docker compose logs -f # Follow logs +docker compose restart # Restart single service + +./upgrade-container-by-name.sh # Upgrade service +./upgrade-container-by-name.sh prune # Upgrade + prune old images +./backup_db.sh # DB backup -> Google Drive +``` + +## Architecture Overview + +``` + Internet + | + [ Traefik v3.6.8 ] + TLS (Let's Encrypt ACME) + | + ┌─────────────────────┼─────────────────────┐ + | | | + [Public Services] [Monitoring Stack] [Security Layer] + | | | + Home Assistant Prometheus CrowdSec + Bitwarden Grafana traefik-bouncer + Immich VictoriaMetrics + Jellyfin Loki + Promtail + HA Dashboard cAdvisor + Brana Frontend Node Exporter + OpenClaw mktxp, ping-exporter + Smartctl Exporter +``` + +## Services by Category + +### Gateway & Security + +| Service | URL | Description | +|---------|-----|-------------| +| [Traefik](traefik/README.md) | https://traefik.sebson.space | Reverse proxy, TLS, geo-blocking | +| [CrowdSec](crowdsec/README.md) | local only | IPS, log analysis, Telegram alerts | +| [Bitwarden](bitwarden/README.md) | https://bward.sebson.space | Password manager (Vaultwarden + YubiKey 2FA) | + +### Home Automation & IoT + +| Service | URL | Description | +|---------|-----|-------------| +| [Home Assistant](homeassistant/README.md) | https://ha.sebson.space | Central automation engine | +| [ESPHome](esphome/README.md) | http://localhost:6052 | ESP8266/ESP32 firmware OTA | +| [Mosquitto](mosquitto/README.md) | 192.168.1.132:1883 | MQTT broker | +| [UniFi](unifi-config/README.md) | https://192.168.1.239:8443 | Network controller (MongoDB backend) | +| [Brana Frontend](brana-frontend/README.md) | https://brana.sebson.space | Gate control panel (mobile-first) | +| [HA Dashboard](ha-dashboard/README.md) | https://hadash.sebson.space | Flask ops dashboard | + +### Surveillance & Cameras + +| Service | URL | Description | +|---------|-----|-------------| +| [Frigate](frigate/README.md) | http://acemagic:5000 | NVR + AI object detection (Coral TPU) | +| [Camera LLM](camera-llm/README.md) | local API | LLM-powered camera memory (ChromaDB RAG) | +| [Timelapse](timelapse_service/README.md) | cron-based | Auto timelapse generation from camera frames | + +### Media & Storage + +| Service | URL | Description | +|---------|-----|-------------| +| [Jellyfin](jellyfin/README.md) | https://jfin.sebson.space | Media server (movies, series, music) | +| [Immich](immich/README.md) | https://immch.sebson.space | Self-hosted photo gallery (AI face recognition) | +| [Prowlarr](prowlarr/README.md) | http://localhost:9696 | Indexer manager (VPN-routed) | +| [Duplicati](duplicati/README.md) | http://localhost:8200 | Encrypted incremental backups | + +### Monitoring Stack + +``` +[Docker Containers] ──> Promtail ──> Loki ──> Grafana + | ^ + v | + cAdvisor ──> Prometheus ──> VictoriaMetrics + | | + Node Exporter ──────────┘ + mktxp (MikroTik) + ping-exporter + smartctl-exporter + PostgreSQL exporter +``` + +| Service | URL | Description | +|---------|-----|-------------| +| [Prometheus](prometheus/README.md) | https://prom.sebson.space | Metrics collection (30d retention) | +| [Grafana](grafana/README.md) | https://grafana.sebson.space | Dashboards + alerts (Telegram) | +| [Uptime Kuma](uptime-kuma/README.md) | https://kuma.sebson.space | External uptime monitoring + status page | +| [Loki](loki/README.md) | http://loki:3100 | Log aggregation (31d retention) | +| [Promtail](promtail/README.md) | port 9080 | Log shipper (Docker socket discovery) | +| [mktxp](mktxp/README.md) | http://localhost:49090 | MikroTik router metrics | +| [ping-exporter](pingexporter/README.md) | http://localhost:9427 | ICMP latency monitoring | + +### Custom Services + +| Service | Description | +|---------|-------------| +| [side-agent](side-agent/README.md) | Camera snapshot detector, container version checker, backup scheduler | +| [log-ingester](log-ingester/README.md) | RAG ingestion of Frigate/HA/Docker logs into ChromaDB | +| [OpenClaw](OPENCLAW_SETUP.md) | Personal AI assistant (CLI, Telegram, Web UI) | + +## Network Architecture + +### Host Network Services +These services run on `network_mode: host` for mDNS, Bluetooth, or device discovery: +- Home Assistant, ESPHome, Mosquitto, UniFi, Node Exporter, ping-exporter + +### VPN Namespace (Gluetun) +Services routed through NordVPN (Germany) via `network_mode: "service:gluetun"`: +- qBittorrent, Radarr, Prowlarr + +## Storage Layout + +| Mount | Capacity | Purpose | +|-------|----------|---------| +| `/media/seagata16t` | 16TB HDD | Immich photos, Jellyfin media, timelapses, camera archives | +| `/media/evo2t` | 2TB SSD | Frigate recordings, Duplicati backups, side-agent data | +| `/media/asustor` | NAS | rsync backup destination | +| `/media/wd1t` | 1TB | Secondary media storage | + +## Key Files + +| File | Purpose | +|------|---------| +| `docker-compose.yaml` | Single source of truth (2000+ lines) | +| `.env` | Secrets and environment variables | +| `./upgrade-container-by-name.sh` | Per-service container upgrade | +| `./backup_db.sh` | PostgreSQL backup to Google Drive via rclone | +| `./watchdog.sh` | Service health monitoring | +| `./truncate_logs.sh` | Log file size management | +| `side-agent/manifest/container_versions.yaml` | Tracked container versions | + +## Torrent Box (Subproject) + +Separate Makefile-managed stack in `./torrent-box-with-vpn/`: + +```bash +cd torrent-box-with-vpn +make start / stop / restart +make update_containers # pull + restart all +make generate_certificate +make backup +``` + +> The legacy `transmission-vpn` service in docker-compose is deprecated and replaced by this subproject. diff --git a/bitwarden/README.md b/bitwarden/README.md index 395b0fe..34059f5 100644 --- a/bitwarden/README.md +++ b/bitwarden/README.md @@ -1,52 +1,53 @@ # Bitwarden / Vaultwarden -Menedzer hasel oparty na Vaultwarden (kompatybilny z klientami Bitwarden). Backend PostgreSQL, uwierzytelnianie dwuetapowe przez YubiKey. +> Password manager compatible with all Bitwarden clients. PostgreSQL backend with YubiKey 2FA. -## URL / Dostep +## Access -- URL: https://bward.sebson.space -- Port wewnetrzny: 9989->80 -- Logowanie: email + haslo + YubiKey OTP +| Endpoint | Details | +|----------|---------| +| Public URL | https://bward.sebson.space | +| Internal Port | `9989 -> 80` | +| Login | Email + Password + YubiKey OTP | -## Konfiguracja +## Configuration -- Obraz: `vaultwarden/server` -- Baza danych: PostgreSQL na `postgres18:5432/bitwarden` -- 2FA: YubiKey (YUBICO_CLIENT_ID + YUBICO_SECRET_KEY z `.env`) -- Wlasny serwer weryfikacji Yubico: `bward.sebson.space/wsapi/2.0/verify` -- Konfiguracja przez zmienne srodowiskowe w `.env` +- **Image:** `vaultwarden/server` +- **Database:** PostgreSQL on `postgres18:5432` (database: `bitwarden`) +- **2FA:** YubiKey (`YUBICO_CLIENT_ID` + `YUBICO_SECRET_KEY` from `.env`) +- **Yubico verification:** self-hosted at `bward.sebson.space/wsapi/2.0/verify` -## Storage / Dane +## Storage -| Sciezka | Zawartosc | -|---------|-----------| -| `./bitwarden/attachments/` | zalaczniki do wpisow | -| `./bitwarden/sends/` | pliki Bitwarden Send | -| `./bitwarden/icon_cache/` | cache ikon stron | -| `./bitwarden/tmp/` | pliki tymczasowe | -| `./bitwarden/rsa_key.pem` | klucz prywatny RSA | -| `./bitwarden/rsa_key.pub.pem` | klucz publiczny RSA | +| Path | Contents | +|------|----------| +| `./bitwarden/attachments/` | Entry attachments | +| `./bitwarden/sends/` | Bitwarden Send files | +| `./bitwarden/icon_cache/` | Website icon cache | +| `./bitwarden/tmp/` | Temporary files | +| `./bitwarden/rsa_key.pem` | RSA private key | +| `./bitwarden/rsa_key.pub.pem` | RSA public key | -Dane haseł sa w bazie PostgreSQL (`bitwarden` DB na `postgres18`). +Password data itself is stored in PostgreSQL (`bitwarden` DB on `postgres18`). -## Powiazania +## Dependencies -- **postgres18** - glowna baza danych -- **Traefik** - reverse proxy, TLS -- **YubiKey** - sprzętowy klucz 2FA (serwer weryfikacji hostowany lokalnie) +- **postgres18** - primary database +- **Traefik** - reverse proxy with TLS +- **YubiKey** - hardware 2FA key (local verification server) -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f vaultwarden -# Backup bazy (przez ogolny skrypt) +# Database backup (via general script) ./backup_db.sh # Restart docker compose restart vaultwarden -# Eksport/import przez klientow Bitwarden CLI: +# Export/import via Bitwarden CLI bw export --format json ``` diff --git a/brana-frontend/README.md b/brana-frontend/README.md index db2e714..b8f9df0 100644 --- a/brana-frontend/README.md +++ b/brana-frontend/README.md @@ -1,38 +1,44 @@ -# brana-frontend +# Brana Frontend - Gate Control Panel -Customowy panel sterowania brama wjazdowa. Statyczna strona HTML serwowana przez nginx, komunikujaca sie bezposrednio z Home Assistant przez REST API. Zbudowana mobilnie (max-width 420px, dark mode). +> Static HTML page served by nginx, communicating directly with Home Assistant via REST API. Mobile-first design (max-width 420px, dark mode). -## URL / Dostep +## Access -- https://brana.sebson.space (port 9080 -> 80) +| Endpoint | Details | +|----------|---------| +| Public URL | https://brana.sebson.space | +| Internal Port | `9080 -> 80` | -## Co robi +## Features -- Wyswietla aktualny stan bramy (open/closed/unknown) z Home Assistant -- Przyciski: otworz brame, zamknij brame, stop -- Wywoluje serwisy HA przez `https://ha.sebson.space` (Content-Security-Policy zezwala tylko na ten host) -- Modal z polem na token HA (przechowywany w localStorage) -- Statusy: ready (zielony), processing (niebieski, animacja), error (czerwony) +- Displays current gate state (open/closed/unknown) from Home Assistant +- Action buttons: **open**, **close**, **stop** +- Calls HA services via `https://ha.sebson.space` (CSP allows only this host) +- Modal dialog for entering HA token (stored in localStorage) +- Status indicators: + - **Ready** - green + - **Processing** - blue (animated) + - **Error** - red -## Konfiguracja nginx +## Nginx Configuration -- Naglowki bezpieczenstwa: X-Frame-Options DENY, CSP, X-Content-Type-Options -- Real IP z naglowka X-Real-IP (trust 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - Traefik) -- Gzip dla assets +- Security headers: `X-Frame-Options DENY`, `Content-Security-Policy`, `X-Content-Type-Options` +- Real IP from `X-Real-IP` header (trusts `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` - Traefik ranges) +- Gzip compression for assets - `/health` - health check endpoint -## Przydatne komendy +## Useful Commands ```bash -# Logi nginx +# Follow nginx logs docker compose logs -f brana-frontend -# Weryfikacja configu nginx +# Validate nginx config docker exec brana-frontend nginx -t -# Przeladowanie nginx bez restartu +# Reload config without restart docker exec brana-frontend nginx -s reload -# Rebuild po zmianach w index.html +# Rebuild after changes to index.html docker compose build brana-frontend && docker compose up -d brana-frontend ``` diff --git a/camera-llm/README.md b/camera-llm/README.md index 8b14190..eaadaf4 100644 --- a/camera-llm/README.md +++ b/camera-llm/README.md @@ -1,62 +1,65 @@ -# camera-llm +# Camera LLM - AI Camera Memory -System pamieci kamer oparty na LLM. Dwa komponenty: `camera-memory` co sekunde pobiera klatki z kamer Frigate, opisuje je przez model wizyjny i zapisuje embeddingi do ChromaDB; `camera-api` udostepnia interfejs webowy i API do zadawania pytan o to co dzialo sie na kamerach. +> LLM-powered camera memory system. Captures frames from Frigate cameras, describes them with a vision model, stores embeddings in ChromaDB, and answers natural language questions about camera activity. -## Architektura +## Architecture ``` [Frigate /api//latest.jpg] | v -[camera-memory] --> moondream (opis klatki) --> nomic-embed-text (embedding) --> ChromaDB camera_frames +[camera-memory] -- moondream (frame description) --> nomic-embed-text (embedding) --> ChromaDB "camera_frames" | v -[camera-api] <-- uzytkownik pyta --> ChromaDB (semantic search) --> mistral (odpowiedz) --> wynik +[camera-api] <-- user asks question --> ChromaDB (semantic search) --> mistral (answer) --> result ``` -## Komponenty +## Components ### camera-memory -- Pobiera co INTERVAL sekund najnowsza klatke z kazdej kamery przez Frigate API -- Wysyla do modelu `moondream` prompt: "Describe briefly: people (gender, clothing, action), vehicles (color, type), animals, packages, unusual activity." -- Tworzy embedding przez `nomic-embed-text` i zapisuje w kolekcji `camera_frames` -- Co 3600 iteracji usuwa wpisy starsze niz RETENTION_HOURS (domyslnie 72h) +- Fetches the latest frame from each camera every `INTERVAL` seconds via Frigate API +- Sends to `moondream` vision model with prompt: *"Describe briefly: people (gender, clothing, action), vehicles (color, type), animals, packages, unusual activity."* +- Creates embedding via `nomic-embed-text` and stores in `camera_frames` collection +- Every 3600 iterations, removes entries older than `RETENTION_HOURS` (default: 72h) ### camera-api -- FastAPI + wbudowany HTML frontend (dark mode, PL) -- `GET /` - interfejs webowy do zadawania pytan po polsku -- `GET /ask?q=...` - odpowiedz przez RAG (ChromaDB + mistral), zwraca answer + sources -- `GET /recent?camera=&hours=1` - ostatnie obserwacje -- `GET /stats` - liczba zapisanych klatek -- `GET /health` - health check +- FastAPI + built-in HTML frontend (dark mode, Polish language) -## Konfiguracja (zmienne env) +| Endpoint | Description | +|----------|-------------| +| `GET /` | Web interface for asking questions (Polish) | +| `GET /ask?q=...` | RAG answer via ChromaDB + mistral, returns `answer` + `sources` | +| `GET /recent?camera=&hours=1` | Recent observations | +| `GET /stats` | Number of stored frames | +| `GET /health` | Health check | -| Zmienna | Domyslnie | Opis | -|---------|-----------|------| -| `FRIGATE_URL` | `http://frigate:5000` | Adres API Frigate | -| `OLLAMA_URL` | `http://ollama:11434` | Adres Ollama | -| `CHROMA_URL` | `http://chromadb:8000` | Adres ChromaDB | -| `CAMERAS` | `front_door` | Lista kamer oddzielona przecinkami | -| `INTERVAL` | `1` | Interwał pobierania klatek (sekundy) | -| `RETENTION_HOURS` | `72` | Czas retencji wpisow w ChromaDB | +## Environment Variables -## Przydatne komendy +| Variable | Default | Description | +|----------|---------|-------------| +| `FRIGATE_URL` | `http://frigate:5000` | Frigate API URL | +| `OLLAMA_URL` | `http://ollama:11434` | Ollama URL | +| `CHROMA_URL` | `http://chromadb:8000` | ChromaDB URL | +| `CAMERAS` | `front_door` | Comma-separated camera list | +| `INTERVAL` | `1` | Frame capture interval (seconds) | +| `RETENTION_HOURS` | `72` | Data retention in ChromaDB | + +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f camera-memory docker compose logs -f camera-api -# Ile klatek jest w pamieci +# Check how many frames are stored curl http://localhost:/stats -# Pytanie przez API -curl "http://localhost:/ask?q=czy+bylo+dzisiaj+czerwone+auto" +# Ask a question via API +curl "http://localhost:/ask?q=was+there+a+red+car+today" -# Ostatnie obserwacje z konkretnej kamery (ostatnia godzina) +# Recent observations from a specific camera (last hour) curl "http://localhost:/recent?camera=reolink_1&hours=1" # Rebuild diff --git a/crowdsec/README.md b/crowdsec/README.md index 4f8b4da..70e5f80 100644 --- a/crowdsec/README.md +++ b/crowdsec/README.md @@ -1,107 +1,98 @@ -# CrowdSec - dokumentacja +# CrowdSec - Intrusion Prevention System -## Jak działa +> Analyzes logs from multiple services and blocks malicious IPs via Traefik bouncer. Sends Telegram alerts on detections. -CrowdSec analizuje logi i blokuje złośliwe IP przez dwa komponenty: +## How It Works ``` -Logi → crowdsec (analiza) → decyzja BAN → traefik-bouncer (egzekucja) - → powiadomienie Telegram +Logs → crowdsec (analysis) → BAN decision → traefik-bouncer (enforcement) + → Telegram notification ``` -**traefik-bouncer** sprawdza każde żądanie przez Traefika pod CrowdSec API (`crowdsec:8080`). Jeśli IP ma aktywny ban - zwraca 403. +**traefik-bouncer** checks every request through Traefik against the CrowdSec API (`crowdsec:8080`). Returns `403` if the IP has an active ban. -## Telegram - jak działa +## Telegram Notifications -Powiadomienia idą przez plugin HTTP (`conf/notifications/http.yaml`), który wysyła POST do Telegram Bot API. +Notifications are sent via the HTTP plugin (`conf/notifications/http.yaml`) posting to the Telegram Bot API. -**Przepływ:** -1. CrowdSec wykrywa atak (np. brute-force SSH, skanowanie HTTP) -2. Profil w `conf/profiles.yaml` dopasowuje alert → przypisuje powiadomienie `http_default` -3. Plugin HTTP czeka 30s na grupowanie alertów, potem wysyła POST: +### Flow + +1. CrowdSec detects an attack (SSH brute-force, HTTP scanning, etc.) +2. Profile in `conf/profiles.yaml` matches the alert → assigns `http_default` notification +3. HTTP plugin waits 30s to group alerts, then sends POST: ``` POST https://api.telegram.org/bot/sendMessage { "chat_id": 5479795256, "parse_mode": "HTML", - "text": "🚨 CrowdSec Alert\n🔒 Scenariusz: ...\n🌍 IP: ...\n📊 Liczba zdarzeń: ..." + "text": "🚨 CrowdSec Alert\n🔒 Scenario: ...\n🌍 IP: ...\n📊 Event count: ..." } ``` -**Zmienne środowiskowe** (w `.env`): -``` -TELEGRAM_BOT_TOKEN=5580892376:AAHjXRq... -TELEGRAM_CHAT_ID=5479795256 -``` +Environment variables (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`) are configured in `docker-compose.yaml`. -Bot token i chat ID skonfigurowane w docker-compose.yaml i przekazywane do kontenera. Format wiadomości edytowalny w `conf/notifications/http.yaml`. +## Monitored Log Sources (`conf/acquis.yaml`) -## Monitorowane źródła logów (`conf/acquis.yaml`) - -| Źródło | Typ | Ścieżka/kontener | -|--------|-----|-----------------| +| Source | Type | Path/Container | +|--------|------|----------------| | SSH | syslog | `/var/log/auth.log` | | Traefik | traefik | `/var/log/traefik/access.log` | | Jellyfin | jellyfin | `/var/log/jellyfin/log_*.log` | -| Grafana | docker | kontener `grafana` | -| Bitwarden | Vaultwarden | kontener `bitwarden` | +| Grafana | docker | `grafana` container | +| Bitwarden | vaultwarden | `bitwarden` container | -## Aktywne kolekcje (scenarios + parsery) +## Active Collections (Scenarios + Parsers) -- `crowdsecurity/linux` + `sshd` - SSH brute-force -- `crowdsecurity/traefik` + `nginx` - HTTP ataki przez Traefik -- `crowdsecurity/http-cve` - znane CVE (log4j, Spring4Shell, etc.) -- `crowdsecurity/base-http-scenarios` - skanowanie, traversal, bad UA -- `crowdsecurity/home-assistant` - brute-force HA -- `crowdsecurity/whitelist-good-actors` - SEO boty, CDN -- `Dominic-Wagner/vaultwarden` - BF Bitwarden -- `LePresidente/grafana` + `jellyfin` - BF Grafana/Jellyfin +| Collection | Purpose | +|------------|---------| +| `crowdsecurity/linux` + `sshd` | SSH brute-force | +| `crowdsecurity/traefik` + `nginx` | HTTP attacks via Traefik | +| `crowdsecurity/http-cve` | Known CVEs (log4j, Spring4Shell, etc.) | +| `crowdsecurity/base-http-scenarios` | Scanning, path traversal, bad user agents | +| `crowdsecurity/home-assistant` | HA brute-force | +| `crowdsecurity/whitelist-good-actors` | SEO bots, CDNs | +| `Dominic-Wagner/vaultwarden` | Bitwarden brute-force | +| `LePresidente/grafana` + `jellyfin` | Grafana/Jellyfin brute-force | -## Whitelista (`conf/parsers/s02-enrich/my-whitelist.yaml`) +## Whitelist (Never Banned) -Nigdy nie banowane: -- `127.0.0.1` -- `192.168.1.0/24` (LAN) -- `10.13.13.0/24` (VPN WireGuard) -- `81.201.50.209` (domowy publiczny IP) -- `212.222.3.226` (IP z pracy) +| IP/Range | Description | +|----------|-------------| +| `127.0.0.1` | Localhost | +| `192.168.1.0/24` | LAN | +| `10.13.13.0/24` | WireGuard VPN | +| `81.201.50.209` | Home public IP | +| `212.222.3.226` | Work IP | -## Profile i decyzje (`conf/profiles.yaml`) +## Profiles & Decisions (`conf/profiles.yaml`) -Dwa profile: -- `default_ip_remediation` - ban IP na 4h -- `default_range_remediation` - ban całego /24 na 4h +| Profile | Action | Notification | +|---------|--------|--------------| +| `default_ip_remediation` | Ban IP for 4h | Telegram | +| `default_range_remediation` | Ban entire /24 for 4h | Telegram | -Oba wysyłają powiadomienie `http_default` (Telegram). - -## Przydatne komendy +## Useful Commands ```bash -# Skrypty w crowdsec/bin/ -./crowdsec/bin/alerts-list # lista alertów -./crowdsec/bin/decisions # aktywne bany -./crowdsec/bin/metrics # statystyki parsowania +# Helper scripts in crowdsec/bin/ +./crowdsec/bin/alerts-list # List recent alerts +./crowdsec/bin/decisions # Active bans +./crowdsec/bin/metrics # Parsing statistics -# Bezpośrednio +# Direct cscli commands docker exec crowdsec cscli alerts list docker exec crowdsec cscli decisions list -docker exec crowdsec cscli decisions delete --ip 1.2.3.4 # odbanuj IP -docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 24h # ręczny ban +docker exec crowdsec cscli decisions delete --ip 1.2.3.4 # Unban IP +docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 24h # Manual ban -# Test powiadomienia Telegram +# Test Telegram notification docker exec crowdsec cscli notifications test http_default -``` -## Ręczny ban IP - -```bash +# Manual ban with custom duration docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 168h --reason "manual" -``` -## Logi - -```bash +# Follow logs docker logs crowdsec --tail 100 -f docker logs traefik-bouncer --tail 50 ``` diff --git a/docker-compose.yaml b/docker-compose.yaml index 345780f..60e47e3 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -988,3 +988,16 @@ services: devices: - /dev/net/tun + uptime-kuma: + image: louislam/uptime-kuma + container_name: uptime-kuma + restart: unless-stopped + volumes: + - ${PWD}/uptime-kuma/data:/app/data + labels: + - "traefik.enable=true" + - "traefik.http.routers.uptime-kuma.rule=Host(`kuma.sebson.space`)" + - "traefik.http.routers.uptime-kuma.entrypoints=websecure" + - "traefik.http.routers.uptime-kuma.tls.certresolver=mytlschallenge" + - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001" + diff --git a/duplicati/README.md b/duplicati/README.md index dce6ce8..fe400a9 100644 --- a/duplicati/README.md +++ b/duplicati/README.md @@ -1,58 +1,57 @@ -# Duplicati +# Duplicati - Encrypted Backups -Narzedzie do tworzenia szyfrowanych, przyrostowych kopii zapasowych. Interfejs webowy dostepny przez przegladarke. +> Web-based incremental backup tool with AES-256 encryption. Local access only. -## URL / Dostep +## Access -- UI: http://localhost:8200 (brak publicznego dostępu przez Traefik) -- Dostep tylko z sieci lokalnej lub przez VPN/tunel +| Endpoint | Details | +|----------|---------| +| Web UI | http://localhost:8200 | +| Public access | None (LAN/VPN only) | -## Konfiguracja +## Configuration -- Port: 8200 -- Konfiguracja jobow backupu przechowywana w `./duplicati/config/` -- Harmonogram i ustawienia definiowane przez UI +- **Port:** 8200 +- **Job config:** stored in `./duplicati/config/` (SQLite database) +- Schedule and settings managed via the web UI -### Zrodla backupu +### Backup Sources -| Zrodlo | Opis | -|--------|------| -| `/home/seba` | katalog domowy | -| `/home/seba/mydocker` | caly stack Docker | -| `/home/seba/git.repos` | repozytoria git | +| Source | Description | +|--------|-------------| +| `/home/seba` | Home directory | +| `/home/seba/mydocker` | Entire Docker stack | +| `/home/seba/git.repos` | Git repositories | -### Cel backupu +### Backup Destinations -| Lokalizacja | Opis | -|-------------|------| -| `/media/evo2t/backups` | lokalny dysk SSD | -| `/media/seagata16t/` | 16TB dysk HDD | +| Location | Description | +|----------|-------------| +| `/media/evo2t/backups` | Local SSD disk | +| `/media/seagata16t/` | 16TB HDD | -## Storage / Dane +## Storage -| Sciezka | Zawartosc | -|---------|-----------| -| `./duplicati/config/` | konfiguracja jobow, baza SQLite | +| Path | Contents | +|------|----------| +| `./duplicati/config/` | Job configurations, SQLite database | -## Powiazania +All source directories are mounted read-only. Destination disks are read-write. -- Montuje wiele katalogow hosta jako read-only (zrodla) -- Montuje dyski docelowe jako read-write - -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f duplicati # Restart docker compose restart duplicati -# Przywrocenie pliku przez CLI (wewnatrz kontenera) +# Restore entire backup (inside container) docker exec -it duplicati dotnet /app/duplicati/Duplicati.CommandLine.dll restore \ "your-backup-path" --targetpath="/restore" -# Przywrocenie konkretnego pliku +# Restore a specific file docker exec -it duplicati dotnet /app/duplicati/Duplicati.CommandLine.dll restore \ "file://backup/path" --restore-path="/tmp/restore" --include="**/myfile.txt" ``` diff --git a/esphome/README.md b/esphome/README.md index ac5fd11..826e55d 100644 --- a/esphome/README.md +++ b/esphome/README.md @@ -1,59 +1,60 @@ -# ESPHome +# ESPHome - ESP Firmware Dashboard -Dashboard do kompilacji firmware i zarzadzania urzadzeniami ESP8266/ESP32. Udostepnia OTA (aktualizacje Over-the-Air) i integracje z Home Assistant przez API natywne. +> Web dashboard for compiling firmware and managing ESP8266/ESP32 devices. Provides OTA updates and native API integration with Home Assistant. -## URL / Dostep +## Access -- Dashboard: http://localhost:6052 (brak reverse proxy, dostep lokalny) -- Port: 6052 (host network) +| Endpoint | Details | +|----------|---------| +| Dashboard | http://localhost:6052 | +| Network | `network_mode: host` (required for OTA + mDNS discovery) | -## Konfiguracja +## Configuration -- Obraz: `esphome/esphome` -- Siec: `network_mode: host` (wymagane do OTA i odkrywania urzadzen przez mDNS) -- Pliki YAML urzadzen: `./esphome/*.yaml` -- Sekrety: `./esphome/secrets.yaml` +- **Image:** `esphome/esphome` +- **Device YAML:** `./esphome/*.yaml` +- **Secrets:** `./esphome/secrets.yaml` -## Urzadzenia +## Devices -| Plik YAML | Urzadzenie | Opis | -|-----------|-----------|------| -| `sonoff_mini_hall.yaml` | Sonoff Mini (ESP8266) | Oswietlenie gorne w przedpokoju (192.168.20.62) | -| `sonoff_mini_stefi.yaml` | Sonoff Mini | Oswietlenie w pokoju Stefi | -| `sonoff_mini_small_hall.yaml` | Sonoff Mini | Maly przedpokoj | -| `sonoff_mini_driveway` | Sonoff Mini | Oswietlenie podjazdu | -| `sonoff-mini-r2-1.yaml` | Sonoff Mini R2 | Przekaznik #1 | -| `sonoff-mini-r2-2.yaml` | Sonoff Mini R2 | Przekaznik #2 | -| `sonoff-mini-digestor.yaml` | Sonoff Mini | Okap kuchenny | -| `sonoff-mini-kitchen-led.yaml` | Sonoff Mini | Tasmowanie LED w kuchni | -| `sonofft13guk.yaml` | Sonoff T1 | Przelacznik dotykowy | -| `bathroom-shelly-1l-01.yaml` | Shelly 1L | Oswietlenie lazienki | -| `light_driveway.yaml` | ESP (custom) | Inteligentne oswietlenie podjazdu | -| `esp_mini_office.yaml` | ESP32 Mini | Biuro | -| `esp_woox_dining.yaml` | ESP Woox | Jadalnia | -| `esp_woox_fan.yaml` | ESP Woox | Wentylator | -| `lsmin-gat/` | LSMini | Brama | +| YAML File | Device | Description | +|-----------|--------|-------------| +| `sonoff_mini_hall.yaml` | Sonoff Mini (ESP8266) | Hallway ceiling light (192.168.20.62) | +| `sonoff_mini_stefi.yaml` | Sonoff Mini | Stefi's room light | +| `sonoff_mini_small_hall.yaml` | Sonoff Mini | Small hallway | +| `sonoff_mini_driveway.yaml` | Sonoff Mini | Driveway light | +| `sonoff-mini-r2-1.yaml` | Sonoff Mini R2 | Relay #1 | +| `sonoff-mini-r2-2.yaml` | Sonoff Mini R2 | Relay #2 | +| `sonoff-mini-digestor.yaml` | Sonoff Mini | Kitchen hood | +| `sonoff-mini-kitchen-led.yaml` | Sonoff Mini | Kitchen LED strip | +| `sonofft13guk.yaml` | Sonoff T1 | Touch switch | +| `bathroom-shelly-1l-01.yaml` | Shelly 1L | Bathroom light | +| `light_driveway.yaml` | ESP (custom) | Smart driveway lighting | +| `esp_mini_office.yaml` | ESP32 Mini | Office | +| `esp_woox_dining.yaml` | ESP Woox | Dining room | +| `esp_woox_fan.yaml` | ESP Woox | Fan | +| `lsmin-gat/` | LSMini | Gate | -Urzadzenia laczya sie przez WiFi IoT (VLAN 20, `wifi_ssid_iot`) z WPA2 oraz posiadaja fallback AP. +All devices connect via WiFi IoT network (VLAN 20, `wifi_ssid_iot`) with WPA2 and have a fallback AP. -## Architektura / Powiazania +## Architecture ``` ESPHome Dashboard - ├── kompiluje firmware i wgrywa OTA do urzadzen ESP - ├── urzadzenia ESP raportuja stany do Home Assistant przez API natywne - └── czesc urzadzen komunikuje sie rowniez przez MQTT (Mosquitto) + ├── Compiles firmware and flashes OTA to ESP devices + ├── Devices report states to Home Assistant via native API + └── Some devices also communicate via MQTT (Mosquitto) ``` -## Przydatne komendy +## Useful Commands ```bash -# Logi dashboardu +# Follow dashboard logs docker compose logs -f esphome # Restart docker compose restart esphome -# Kompilacja i wgranie firmware (z linii polecen, poza dashboardem) +# Compile and flash firmware from CLI docker compose exec esphome esphome run /config/sonoff_mini_hall.yaml ``` diff --git a/frigate/README.md b/frigate/README.md index 3aa4af1..31f1dd6 100644 --- a/frigate/README.md +++ b/frigate/README.md @@ -1,89 +1,90 @@ -# Frigate +# Frigate - AI-Powered NVR -System NVR (Network Video Recorder) z detekcja obiektow AI w czasie rzeczywistym. Obsluguje 8 kamer, wykrywa osoby, samochody, psy i koty, integruje sie z Home Assistant przez MQTT. +> Real-time object detection NVR system. 8 cameras, detects persons, cars, dogs and cats. Integrates with Home Assistant via MQTT. -## URL / Dostep +## Access -- UI: http://acemagic:5000 (dostep lokalny, brak Traefik) -- API: http://acemagic:5000/api/ -- go2rtc restream: http://acemagic:8554/ (RTSP) +| Endpoint | Details | +|----------|---------| +| Web UI | http://acemagic:5000 (local only, no Traefik) | +| API | http://acemagic:5000/api/ | +| go2rtc restream | http://acemagic:8554/ (RTSP) | -## Konfiguracja +## Configuration -- Wersja konfiguracji: `0.17-0` (config.yml) -- Limit RAM: 6 GB (`mem_limit: 6g`) -- Plik konfiguracyjny: `./frigate/config.yml` -- Nagrania: `/media/evo2t/frigate/` (szybkie SSD) -- Baza danych: `./frigate/frigate.db` (SQLite) +- **Config version:** `0.17-0` (`config.yml`) +- **RAM limit:** 6 GB +- **MQTT:** `192.168.1.132:1883` (Mosquitto), topic prefix `frigate` -### Akceleracja +### Hardware Acceleration -- **Detekcja AI**: Google Coral TPU USB (`device: usb`) -- **Dekodowanie wideo**: AMD GPU `radeonsi` przez VAAPI (hwaccel) -- **MQTT**: `192.168.1.132:1883` (Mosquitto), topic prefix `frigate` +| Component | Hardware | Purpose | +|-----------|----------|---------| +| Google Coral TPU | USB (`device: usb`) | AI object detection | +| AMD GPU `radeonsi` | VAAPI | Video decoding (hwaccel) | -## Kamery +## Cameras -| Nazwa | Model | IP | Sledzone obiekty | Strefy | -|-------|-------|-----|-----------------|--------| -| `frigate_reolink_1` | Reolink | 192.168.1.101 | person, car, dog | parking, driveway, r1_my-garden | -| `frigate_reolink_2` | Reolink | 192.168.1.62 | person, dog | my_sidewalk | -| `frigate_reolink_3` | Reolink | 192.168.1.150 | person, car, dog | terrace, kennel, my-garden | -| `frigate_reolink_4` | Reolink | 192.168.1.168 | person, car, dog | main_area, entrance | -| `frigate_reolink_5` | Reolink | 192.168.1.172 | person, dog | terrace | -| `frigate_hikvision_2` | Hikvision | 192.168.1.65 | person, car, dog | my-garden | -| `frigate_hikvision_4` | Hikvision (domofon) | 192.168.1.127 | person | street-left, robo, at-gate | -| `mercusys_mc200` | Mercusys (wew.) | 192.168.20.33 | person, cat | - | +| Name | Model | IP | Tracked Objects | Zones | +|------|-------|-----|-----------------|-------| +| `reolink_1` | Reolink | 192.168.1.101 | person, car, dog | parking, driveway, r1_my-garden | +| `reolink_2` | Reolink | 192.168.1.62 | person, dog | my_sidewalk | +| `reolink_3` | Reolink | 192.168.1.150 | person, car, dog | terrace, kennel, my-garden | +| `reolink_4` | Reolink | 192.168.1.168 | person, car, dog | main_area, entrance | +| `reolink_5` | Reolink | 192.168.1.172 | person, dog | terrace | +| `hikvision_2` | Hikvision | 192.168.1.65 | person, car, dog | my-garden | +| `hikvision_4` | Hikvision (intercom) | 192.168.1.127 | person | street-left, robo, at-gate | +| `mercusys_mc200` | Mercusys (indoor) | 192.168.20.33 | person, cat | - | -Wszystkie strumienie sa reroutowane przez wbudowany go2rtc (RTSP restream) w celu oszczednosci RAM - Frigate pobiera jeden strumien z go2rtc zamiast bezposrednio z kamery. +All streams are rerouted through built-in go2rtc (RTSP restream) to save RAM - Frigate pulls one stream from go2rtc instead of directly from each camera. -## Retencja nagran +## Retention -| Typ | Czas | -|-----|------| -| Snapshoty (osoby) | 3650 dni (10 lat) | -| Snapshoty (samochody) | 180 dni | -| Snapshoty (domyslnie) | 365 dni | -| Nagrania - alerty | 30 dni | -| Nagrania - detekcje | 90 dni | -| Nagrania ciagle (hikvision_4) | 90 dni | -| Nagrania z ruchem | 7 dni (tylko reolink_1) | +| Type | Duration | +|------|----------| +| Snapshots (persons) | 3650 days (10 years) | +| Snapshots (cars) | 180 days | +| Snapshots (default) | 365 days | +| Recordings - alerts | 30 days | +| Recordings - detections | 90 days | +| Continuous recordings (hikvision_4) | 90 days | +| Recordings with motion | 7 days (reolink_1 only) | -Jakosc snapshotow: 90%, z czystymi kopiami (`clean_copy: true`). +Snapshot quality: 90%, with clean copies (`clean_copy: true`). -## Architektura / Powiazania +## Architecture ``` -Kamery IP (RTSP) - └── go2rtc (restream wewnetrzny) - └── Frigate detekcja (Coral TPU, 640x360@7-10fps) - ├── MQTT -> Mosquitto -> Home Assistant (zdarzenia, binarki) - ├── nagrania -> /media/evo2t/frigate/ - └── snapshoty -> frigate.db + /media/evo2t/frigate/clips/ +Camera IP (RTSP) + └── go2rtc (internal restream) + └── Frigate detection (Coral TPU, 640x360 @ 7-10fps) + ├── MQTT → Mosquitto → Home Assistant (events, binary sensors) + ├── recordings → /media/evo2t/frigate/ + └── snapshots → frigate.db + /media/evo2t/frigate/clips/ ``` -## Klucze konfiguracji +## Key Configuration Details -- Detekcja: 640x360, 7-10 fps (sub-stream), stationary object suppression -- Wyszukiwanie semantyczne: wlaczone (model `small`) -- Birdseye: 1920x1080, tryb continuous -- Maski ruchu dla kazdej kamery (eliminacja falszywych alarow od cieni, znakow drogowych) +- Detection: 640x360, 7-10 fps (sub-stream), stationary object suppression +- Semantic search: enabled (model `small`) +- Birdseye: 1920x1080, continuous mode +- Motion masks per camera (eliminates false alarms from shadows, road signs) -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f frigate # Restart docker compose restart frigate -# Sprawdzenie zuzycia RAM przez Frigate +# Check RAM usage docker stats frigate --no-stream -# Podglad zdarzen MQTT z Frigate -mosquitto_sub -h 192.168.1.132 -u mosquitto -P -t 'frigate/#' -v +# Watch Frigate MQTT events +mosquitto_sub -h 192.168.1.132 -u mosquitto -P -t 'frigate/#' -v -# Czyszczenie starych nagran recznie (Frigate ma to automatyczne) -# Uzyj UI Frigate: http://acemagic:5000 -> Storage +# Clean old recordings manually (auto-handled by Frigate) +# Use UI: http://acemagic:5000 → Storage ``` diff --git a/grafana/README.md b/grafana/README.md index c69828d..136982d 100644 --- a/grafana/README.md +++ b/grafana/README.md @@ -1,59 +1,67 @@ -# Grafana +# Grafana - Monitoring Dashboards -Platforma do wizualizacji metryk i logów. Wyswietla dane z VictoriaMetrics (metryki) oraz Loki (logi). Wysyla alerty przez Telegram. +> Visualization platform for metrics (VictoriaMetrics) and logs (Loki). Sends alerts via Telegram. -## URL / Dostep +## Access -- Publiczny: https://grafana.sebson.space -- Lokalny: http://localhost:3001 -- Login: `seba` (haslo z `.env`: `GRAFANA_ADMIN_PASSWORD`) +| Endpoint | Details | +|----------|---------| +| Public URL | https://grafana.sebson.space | +| Internal | http://localhost:3001 | +| Login | `seba` (password in `.env`: `GRAFANA_ADMIN_PASSWORD`) | -## Konfiguracja +## Configuration -Provisioning automatyczny z `./etc/grafana/provisioning/`: +Automatically provisioned from `./etc/grafana/provisioning/`: -- `datasources/datasource.yaml` - 3 zrodla danych: - - **VictoriaMetrics** (domyslne) - `http://victoriametrics:8428`, uid: `prometheus` - - **Prometheus-Raw** - `http://prometheus:9090` z basic auth - - **Loki** - `http://loki:3100`, max 1000 linii -- `dashboards/` - preinstalowane dashboardy JSON: - - `home-assistant.json` - metryki Home Assistant - - `ping-monitoring.json` - monitoring dostepnosci sieci - - `node-exporter-*.json`, `node.exporter.server.metrics.json` - metryki hostow - - `traefik2.json` - metryki reverse proxy - - `system-monitoring-complete.json` - ogolny monitoring systemu - - `mazda.json`, `windows-wmi.json` - dodatkowe zrodla +### Data Sources -Plugin: `grafana-piechart-panel` +| Source | URL | UID | Notes | +|--------|-----|-----|-------| +| **VictoriaMetrics** (default) | `http://victoriametrics:8428` | `prometheus` | Long-term metrics | +| **Prometheus-Raw** | `http://prometheus:9090` | - | With basic auth | +| **Loki** | `http://loki:3100` | `loki` | Max 1000 lines per query | -Alerty Telegram: `GF_UNIFIED_ALERTING_ENABLED=true`, bot token i chat ID z `.env` (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`). +### Pre-installed Dashboards -## Co monitoruje / metryki +- `home-assistant.json` - HA entity metrics +- `ping-monitoring.json` - Network availability +- `node-exporter-*.json`, `node.exporter.server.metrics.json` - Host metrics +- `traefik2.json` - Reverse proxy metrics +- `system-monitoring-complete.json` - Overall system monitoring +- `mazda.json`, `windows-wmi.json` - Additional sources -Grafana sama w sobie nie zbiera metryk - wizualizuje dane z innych serwisow: -- Metryki systemowe hostow (CPU, RAM, dyski, siec) -- Metryki kontenerow Docker (cAdvisor) -- Metryki Home Assistant (encje, stany) -- Metryki Traefik (requesty, latencja) -- Logi kontenerow (przez Loki) -- Ping/dostepnosc urzadzen +**Plugin:** `grafana-piechart-panel` -## Powiazania z innymi serwisami +**Alerts:** Telegram via Grafana Unified Alerting (`GF_UNIFIED_ALERTING_ENABLED=true`). Bot token and chat ID from `.env`. -| Serwis | Rola | -|--------|------| -| VictoriaMetrics | glowne zrodlo danych (dlugoterminowe metryki) | -| Prometheus | zrodlo surowych metryk (krotkoterminowe) | -| Loki | zrodlo logow kontenerow | -| Alertmanager | opcjonalnie (alerty SA zarzadzane przez Grafana Unified Alerting) | +## Monitored Metrics -## Przydatne komendy +Grafana visualizes data from other services: + +- Host system metrics (CPU, RAM, disks, network) +- Docker container metrics (cAdvisor) +- Home Assistant metrics (entities, states) +- Traefik metrics (requests, latency) +- Container logs (via Loki) +- Ping / device availability + +## Dependencies + +| Service | Role | +|---------|------| +| VictoriaMetrics | Primary data source (long-term metrics) | +| Prometheus | Raw metrics source (short-term) | +| Loki | Container log source | +| Alertmanager | Optional (alerts managed by Grafana Unified Alerting) | + +## Useful Commands ```bash # Restart docker compose restart grafana -# Logi +# Follow logs docker compose logs -f grafana # Upgrade diff --git a/ha-dashboard/README.md b/ha-dashboard/README.md index 00ba58b..cfef2ee 100644 --- a/ha-dashboard/README.md +++ b/ha-dashboard/README.md @@ -1,71 +1,81 @@ -# HA Dashboard (Brana) +# HA Dashboard - Operations Panel -Niestandardowa aplikacja webowa Flask bedaca centralnym panelem operacyjnym dla calej infrastruktury domowej. Agreguje dane z Home Assistant, PostgreSQL, Docker i Crowdsec w jednym widoku. +> Custom Flask application serving as the central operations dashboard for the entire home infrastructure. Aggregates data from Home Assistant, PostgreSQL, Docker and CrowdSec into a single view. -## URL / Dostep +## Access -- Panel: https://hadash.sebson.space -- Port lokalny: 9081 -> 8080 -- Wymagane logowanie (rejestracja z zatwierdzeniem przez administratora) +| Endpoint | Details | +|----------|---------| +| Public URL | https://hadash.sebson.space | +| Internal Port | `9081 -> 8080` | +| Auth | Login required (registration with admin approval) | -## Konfiguracja +## Configuration -- Zbudowany lokalnie z `./ha-dashboard/Dockerfile` (Python 3.12-slim + Flask) -- Zaleznosci: `flask`, `psycopg2-binary`, `requests`, `docker` -- Zmienne srodowiskowe: `DB_HOST`, `DB_PORT`, `DB_USER`, `DB_PASS`, `HA_URL`, `HA_TOKEN`, `SECRET_KEY` -- Wolumeny: - - `/var/run/docker.sock` - dostep do Docker API (informacje o kontenerach, Crowdsec) - - `./backup.log` -> `/backup.log` - log backupow bazy danych - - `./ha-dashboard/auth/` -> `/auth/` - katalog uwierzytelnienia uzytkownikow - - `./homeassistant/config/` -> `/ha_config/` - dostep do rejestrow ZigBee i urzadzen HA +- Built locally from `./ha-dashboard/Dockerfile` (Python 3.12-slim + Flask) +- **Dependencies:** `flask`, `psycopg2-binary`, `requests`, `docker` +- **Environment:** `DB_HOST`, `DB_PORT`, `DB_USER`, `DB_PASS`, `HA_URL`, `HA_TOKEN`, `SECRET_KEY` -## Architektura / Powiazania +### Volumes + +| Mount | Container Path | Purpose | +|-------|---------------|---------| +| `/var/run/docker.sock` | - | Docker API access (container info, CrowdSec exec) | +| `./backup.log` | `/backup.log` | Database backup log | +| `./ha-dashboard/auth/` | `/auth/` | User authentication files | +| `./homeassistant/config/` | `/ha_config/` | HA device registry, ZigBee database | + +## Architecture ``` HA Dashboard (Flask) - ├── Home Assistant REST API - stany encji, automatyzacje, logbook - ├── PostgreSQL 18 - rozmiary baz homeassistant i bitwarden - ├── Docker socket - lista kontenerow, exec do crowdsec - ├── /ha_config/zigbee.db - baza ZigBee (ostatnia aktywnosc, LQI) - └── /backup.log - historia backupow PostgreSQL + ├── Home Assistant REST API - entity states, automations, logbook + ├── PostgreSQL 18 - homeassistant & bitwarden DB sizes + ├── Docker socket - container list, exec into crowdsec + ├── /ha_config/zigbee.db - ZigBee DB (last_seen, LQI) + └── /backup.log - PostgreSQL backup history ``` -## Dostepne widoki / API +## API Endpoints -| Endpoint | Opis | -|----------|------| -| `/` | Glowny dashboard (SPA) | -| `/api/overview` | Osoby w domu, otwarte okna/drzwi, temperatury, status Mazdy, backup | -| `/api/home` | Stan bramy, automatyzacje bramy, lista swiatel z jasnosciami | -| `/api/power` | Aktualne zuzycie energii (zacisk glowny, NAS, Shelly, Tasmota) | -| `/api/frigate` | Ostatnie 9 detekcji z kamer Frigate (obrazy przez proxy) | -| `/api/automations` | Statystyki automatyzacji HA, ostatnio uruchomione | -| `/api/containers` | Status wszystkich kontenerow Docker | -| `/api/crowdsec` | Aktywne bany i ostatnie alerty Crowdsec | -| `/api/db` | Rozmiary baz danych i top 10 tabel | -| `/api/bitwarden` | Statystyki Vaultwarden (liczba hasel wg typu) | -| `/api/zigbee` | Lista urzadzen ZigBee z last_seen, LQI i poziomem baterii | -| `/api/gate/events` | Historia otwarc bramy z bazy PostgreSQL | -| `/api/gate/logbook` | Logbook bramy i automatyzacji z HA API | -| `/api/scene/all_lights_off` | Wlaczenie sceny "wszystkie swiatla wylaczone" | -| `/api/toggle/` | Wylaczenie dowolnej encji HA | +| Endpoint | Description | +|----------|-------------| +| `/` | Main dashboard (SPA) | +| `/api/overview` | People at home, open windows/doors, temperatures, Mazda status, backup | +| `/api/home` | Gate state, gate automations, light list with brightness | +| `/api/power` | Current power consumption (main clamp, NAS, Shelly, Tasmota) | +| `/api/frigate` | Last 9 Frigate detections (images proxied) | +| `/api/automations` | HA automation stats, recently triggered | +| `/api/containers` | All Docker container statuses | +| `/api/crowdsec` | Active bans and recent alerts | +| `/api/db` | Database sizes and top 10 tables | +| `/api/bitwarden` | Vaultwarden stats (password count by type) | +| `/api/zigbee` | ZigBee devices with last_seen, LQI and battery level | +| `/api/gate/events` | Gate open events from PostgreSQL | +| `/api/gate/logbook` | Gate logbook and automations from HA API | +| `/api/scene/all_lights_off` | Trigger "all lights off" scene | +| `/api/toggle/` | Toggle any HA entity | -## System uwierzytelnienia +## Authentication -Dwuetapowy: uzytkownik rejestruje sie (`/register`), konto wymaga recznego zatwierdzenia przez administratora (stworzenie pliku w `auth/approved/`). Sesje Flask z kluczem `SECRET_KEY`. +Two-step: user registers at `/register`, account requires manual admin approval (creation of file at `auth/approved/`). Flask sessions keyed by `SECRET_KEY`. -## Przydatne komendy +### Approving a User ```bash -# Rebuild po zmianach kodu -docker compose build ha-dashboard && docker compose up -d ha-dashboard - -# Logi -docker compose logs -f ha-dashboard - -# Zatwierdzenie nowego uzytkownika +# Approve a pending user touch ./ha-dashboard/auth/approved/ -# Lista oczekujacych na zatwierdzenie +# List pending users ls ./ha-dashboard/auth/pending/ ``` + +## Useful Commands + +```bash +# Rebuild after code changes +docker compose build ha-dashboard && docker compose up -d ha-dashboard + +# Follow logs +docker compose logs -f ha-dashboard +``` diff --git a/ha-dashboard/templates/index.html b/ha-dashboard/templates/index.html index 5d3c38b..4229f59 100644 --- a/ha-dashboard/templates/index.html +++ b/ha-dashboard/templates/index.html @@ -313,6 +313,7 @@

🏠 HA Dashboard — sebson.space

+ 🟢 Uptime 🚭 Niepalenie 🚀 Ansible Refresh in 60s diff --git a/homeassistant/README.md b/homeassistant/README.md index 366ae22..337c0ee 100644 --- a/homeassistant/README.md +++ b/homeassistant/README.md @@ -1,80 +1,82 @@ -# Home Assistant +# Home Assistant - Home Automation -Centralny system automatyki domowej zarządzający ogrzewaniem, oświetleniem, bezpieczeństwem, czujnikami i urządzeniami IoT. +> Central home automation engine managing heating, lighting, security, sensors and IoT devices. -## URL / Dostep +## Access -- UI: https://ha.sebson.space -- Port lokalny: 8123 (host network) +| Endpoint | Details | +|----------|---------| +| Public URL | https://ha.sebson.space | +| Internal Port | 8123 (`network_mode: host`) | -## Konfiguracja +## Configuration -- Obraz: `homeassistant/home-assistant:stable` -- Siec: `network_mode: host` (wymagane do mDNS, Bluetooth, odkrywania urzadzen) -- ZigBee: `/dev/ttyACM0` (Sonoff ZBT-2 coordinator) -- Bluetooth: `/dev/vhci` -- Baza danych: PostgreSQL 18 (`postgres18:5432`, baza `homeassistant`) -- Glowny katalog konfiguracji: `./homeassistant/config/` -- TZ: `Europe/Prague` +- **Image:** `homeassistant/home-assistant:stable` +- **Network:** `network_mode: host` (required for mDNS, Bluetooth, device discovery) +- **ZigBee:** `/dev/ttyACM0` (Sonoff ZBT-2 coordinator) +- **Bluetooth:** `/dev/vhci` +- **Database:** PostgreSQL 18 (`postgres18:5432`, database: `homeassistant`) +- **Config directory:** `./homeassistant/config/` +- **Timezone:** `Europe/Prague` -## Architektura / Powiazania +## Architecture ``` Home Assistant - ├── PostgreSQL 18 - baza stanow i historii (zamiast SQLite) - ├── Mosquitto (MQTT) - komunikacja z ESPHome, Frigate, Tasmota, Shelly - ├── ESPHome - zarzadzanie urzadzeniami ESP8266/ESP32 - ├── Frigate - powiadomienia o detekcji obiektow z kamer - ├── ZigBee (ZBT-2) - czujniki Aqara, przelaczniki IKEA, Sonoff ZBMINI - └── Netatmo, Mazda API - zewnetrzne integracje (pogoda, samochod) + ├── PostgreSQL 18 - state & history database (replaces SQLite) + ├── Mosquitto (MQTT) - communication with ESPHome, Frigate, Tasmota, Shelly + ├── ESPHome - ESP8266/ESP32 device management + ├── Frigate - camera object detection notifications + ├── ZigBee (ZBT-2) - Aqara sensors, IKEA switches, Sonoff ZBMINI + └── Netatmo, Mazda API - external integrations (weather, car) ``` -## Skrypty pyscript (`config/pyscript/`) +## Pyscript Scripts (`config/pyscript/`) -Skrypty wykonywane bezposrednio w kontekscie HA (dostep do stanow encji, MQTT, uslug). +Scripts run directly in the HA context (access to entity states, MQTT, services). -| Plik | Opis | -|------|------| -| `house_manager.py` | Glowna logika sterowania ogrzewaniem - tryby dzienny/nocny/eco, harmonogramy, wiele klimatyzatorow | -| `vigilant_switch_manager.py` | Tryb "czujny" - wykrywa, czy ktos jest w domu na podstawie czujnikow ruchu i odleglosci GPS | -| `terrace_light_manager.py` | Sterowanie oswietleniem tarasu - wlacza po detekcji ruchu/osoby z Frigate, wylacza z timeoutem | -| `ikea_remote_entrance.py` | Obsluga pilota IKEA przy wejsciu - oswietlenie zewnetrzne, brama, Spotify | -| `domofon_manager.py` | Integracja z domotem Hikvision DS-KD8003Y - przelaczanie chipow RFID, tryb Stefi | -| `stefi_custody_days_calculator.py` | Oblicza i aktualizuje harmonogram opieki nad Stefi (naprzemienne tygodnie, swieta) | -| `stefi_custody_calendar_generator.py` | Generuje wydarzenia w kalendarzu Google dla harmonogramu opieki | -| `stefi_morning_wakeup_playbook.py` | Poranna rutyna budzenia Stefi - oswietlenie sceniczne + Spotify (warunkowo: szkola, swieta) | -| `stefi_lights_scening.py` | Automatyczne scenariusze oswietlenia w pokoju Stefi | -| `stefi_media_control.py` | Sterowanie odtwarzaczem Symfonisk w pokoju Stefi | -| `garage_charging_coordinator.py` | Harmonogram ladowania samochodow w garazu (co 3 dni, z progiem temperatury) | -| `kitchen_manager.py` | Automatyzacje swiatla w kuchni | -| `tv_manager.py` | Automatyzacje zwiazane z telewizorem | -| `attic_fan_manager.py` | Zarzadzanie wentylatorem na poddaszu | -| `christmas_lights_manager.py` | Sterowanie swiatecznym oswietleniem zewnetrznym | -| `driveway_lights_on_dark.py` | Oswietlenie podjazdu po zmroku | -| `set_outside_lights_timeouts.py` | Konfiguracja timeoutow dla swiatel zewnetrznych | -| `outside_lights_watchdog.py` | Watchdog - wylacza swiatla zewnetrzne jesli zostaly zapomniane | -| `small_hall_light_watchdog.py` | Watchdog oswietlenia malego przedpokoju | -| `late_lamps_off_office_n_living_room.py` | Wylacza lampy w biurze i salonie po poznej godzinie | -| `purifiers_lifecycle_manager.py` | Sledzenie zycia filtra w oczyszczaczach powietrza | -| `windows_monitor.py` | Monitorowanie otwartych okien, powiadomienia | -| `camera_snapshots.py` | Pobieranie snapshotow z kamer Frigate do HA | -| `camera_person_snapshots.py` | Snapshoty z detekcji osob z kamer | -| `camera_hik4_robo_snapshot.py` | Automatyczny snapshot z domofonu Hikvision przy detekcji w strefie "robo" | -| `low_battery_digest.py` | Raport urzadzen z niskim poziomem baterii (skan wszystkich sensor.battery_*) | -| `zombie_hunter.py.off` | (wylaczony) Skanowanie encji w stanie "unavailable" | +| Script | Description | +|--------|-------------| +| `house_manager.py` | Heating control - day/night/eco modes, schedules, multiple AC units | +| `vigilant_switch_manager.py` | "Vigilant" mode - detects occupancy via motion sensors and GPS distance | +| `terrace_light_manager.py` | Terrace lighting - triggers on Frigate person detection, auto-off with timeout | +| `ikea_remote_entrance.py` | IKEA remote at entrance - outdoor lights, gate, Spotify | +| `domofon_manager.py` | Hikvision DS-KD8003Y intercom integration - RFID chip management, Stefi mode | +| `stefi_custody_days_calculator.py` | Calculates Stefi custody schedule (alternating weeks, holidays) | +| `stefi_custody_calendar_generator.py` | Generates Google Calendar events for custody schedule | +| `stefi_morning_wakeup_playbook.py` | Stefi morning routine - scenic lighting + Spotify (conditional: school day, not holiday) | +| `stefi_lights_scening.py` | Automatic lighting scenes in Stefi's room | +| `stefi_media_control.py` | Symfonisk player control in Stefi's room | +| `garage_charging_coordinator.py` | Car charging scheduler in garage (every 3 days, with temperature threshold) | +| `kitchen_manager.py` | Kitchen lighting automations | +| `tv_manager.py` | TV-related automations | +| `attic_fan_manager.py` | Attic fan management | +| `christmas_lights_manager.py` | Outdoor Christmas lighting control | +| `driveway_lights_on_dark.py` | Driveway lights after dusk | +| `set_outside_lights_timeouts.py` | Configures outdoor light timeouts | +| `outside_lights_watchdog.py` | Watchdog - turns off forgotten outdoor lights | +| `small_hall_light_watchdog.py` | Small hallway light watchdog | +| `late_lamps_off_office_n_living_room.py` | Turns off office and living room lamps late at night | +| `purifiers_lifecycle_manager.py` | Air purifier filter lifetime tracking | +| `windows_monitor.py` | Open window monitoring, notifications | +| `camera_snapshots.py` | Fetches Frigate camera snapshots into HA | +| `camera_person_snapshots.py` | Person detection snapshots from cameras | +| `camera_hik4_robo_snapshot.py` | Auto snapshot from Hikvision intercom on "robo" zone detection | +| `low_battery_digest.py` | Low battery device report (scans all `sensor.battery_*`) | +| `zombie_hunter.py.off` | (disabled) Scans for "unavailable" entities | -## Przydatne komendy +## Useful Commands ```bash # Restart Home Assistant docker compose restart homeassistant -# Logi +# Follow logs docker compose logs -f homeassistant -# Sprawdzenie konfiguracji przed restartem +# Validate config before restart docker compose exec homeassistant ha core check -# Wejscie do shellu kontenera +# Enter container shell docker compose exec homeassistant bash ``` diff --git a/immich/README.md b/immich/README.md index 4b6f0a1..6f3d88c 100644 --- a/immich/README.md +++ b/immich/README.md @@ -1,54 +1,54 @@ -# Immich +# Immich - Self-Hosted Photo Gallery -Samohostowana galeria zdjęć i filmów z AI rozpoznawaniem twarzy, obiektów i wyszukiwaniem semantycznym. Alternatywa dla Google Photos. +> Photo and video gallery with AI-powered face recognition, object detection and semantic search. Alternative to Google Photos. -## URL / Dostęp +## Access -- Zewnętrzny: `https://immch.sebson.space` -- Lokalny: `http://192.168.1.132:2283` +| Endpoint | Details | +|----------|---------| +| Public URL | https://immch.sebson.space | +| Internal | http://192.168.1.132:2283 | -## Architektura +## Architecture -``` -immich-server - główny backend (API, UI) -immich-postgres - PostgreSQL 14 + vectorchord (wektory ML) -immich-redis - cache sesji i kolejek -immich-machine-learning - AI (CLIP embeddings, face recognition buffalo_l) -``` +| Component | Purpose | +|-----------|---------| +| `immich-server` | Main backend (API, UI) | +| `immich-postgres` | PostgreSQL 14 + vectorchord (ML vectors) | +| `immich-redis` | Session cache and job queue | +| `immich-machine-learning` | AI (CLIP embeddings, face recognition buffalo_l) | ## Storage -- Zdjęcia/wideo: `/media/seagata16t/immich/` -- Model cache ML: `./immich/model-cache/` -- Baza danych: `./immich/postgres/` +| Path | Contents | +|------|----------| +| `/media/seagata16t/immich/` | Photos and videos | +| `./immich/model-cache/` | ML model cache | +| `./immich/postgres/` | Database files | -## Limity zasobów +## Resource Limits -- `immich-server`: 6 GB RAM -- `immich-machine-learning`: 2 CPU, 3 GB RAM +| Component | Limit | +|-----------|-------| +| `immich-server` | 6 GB RAM | +| `immich-machine-learning` | 2 CPU, 3 GB RAM | -## Konfiguracja +## Notes -Zmienne środowiskowe w `.env` (wspólne z resztą stacku): -- `DB_PASSWORD` - hasło do immich_postgres -- `REDIS_*` - opcjonalne, domyślnie bez hasła +- Dedicated PostgreSQL instance (`immich_postgres`) - separate from the shared `postgres18` +- Dedicated Redis (`immich_redis`) - not shared with other services +- ML runs on CPU only (no GPU passthrough) -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker logs immich_server -f docker logs immich_machine_learning -f # Restart docker compose restart immich-server immich-machine-learning -# Rozmiar biblioteki +# Check library size du -sh /media/seagata16t/immich/ ``` - -## Uwagi - -- Własna baza PostgreSQL (immich_postgres) - oddzielna od postgres18 -- Redis (immich_redis) - dedykowany, nie współdzielony -- ML działa na CPU (brak GPU passthrough) diff --git a/jellyfin/README.md b/jellyfin/README.md index f2193e0..8d964a8 100644 --- a/jellyfin/README.md +++ b/jellyfin/README.md @@ -1,38 +1,40 @@ -# Jellyfin +# Jellyfin - Media Server -Serwer multimediow open-source. Strumieniuje filmy, seriale i muzyke z podlaczonych dyskow. +> Open-source media streaming server for movies, TV series and music from attached storage. -## URL / Dostep +## Access -- URL: https://jfin.sebson.space -- Port wewnetrzny: 8096 +| Endpoint | Details | +|----------|---------| +| Public URL | https://jfin.sebson.space | +| Internal Port | 8096 | -## Konfiguracja +## Configuration -- Konfiguracja w `./jellyfin/config/` -- PUID=1000, PGID=1000 (uprawnienia plikow) -- TZ=Europe/Prague +- **Config:** `./jellyfin/config/` +- **PUID/PGID:** 1000 (file permissions) +- **Timezone:** `Europe/Prague` -## Storage / Dane +## Storage -| Sciezka (host) | Montaz w kontenerze | Zawartosc | -|----------------|---------------------|-----------| -| `./jellyfin/config/` | `/config` | konfiguracja, baza metadanych | -| `/media/seagata16t/` | `/media/seagata16t` | 16TB - glowne media | -| `/media/wd1t/` | `/media/wd1t` | dysk pomocniczy | -| `/media/evo2t/` | `/media/evo2t` | SSD cache / dodatkowe media | -| `/media/asustor/` | `/media/asustor` | NAS - dodatkowe media | +| Host Path | Container Mount | Contents | +|-----------|-----------------|----------| +| `./jellyfin/config/` | `/config` | Configuration, metadata database | +| `/media/seagata16t/` | `/media/seagata16t` | 16TB - primary media | +| `/media/wd1t/` | `/media/wd1t` | Secondary disk | +| `/media/evo2t/` | `/media/evo2t` | SSD cache / additional media | +| `/media/asustor/` | `/media/asustor` | NAS - additional media | -## Powiazania +## Dependencies -- **Traefik** - reverse proxy, TLS -- **Prometheus** - mozliwe metryki przez plugin jellyfin-prometheus-exporter -- Wspoldzieli dostep do dyskow z Immich i qBittorrent +- **Traefik** - reverse proxy with TLS +- **Prometheus** - optional metrics via jellyfin-prometheus-exporter plugin +- Shares disk access with Immich and qBittorrent -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f jellyfin # Restart @@ -41,7 +43,7 @@ docker compose restart jellyfin # Upgrade ./upgrade-container-by-name.sh jellyfin -# Skanowanie biblioteki przez API +# Trigger library scan via API curl -X POST "http://localhost:8096/Library/Refresh" \ -H "X-Emby-Token: " ``` diff --git a/log-ingester/README.md b/log-ingester/README.md index cd7f33d..5faae05 100644 --- a/log-ingester/README.md +++ b/log-ingester/README.md @@ -1,8 +1,8 @@ -# log-ingester +# Log Ingester - RAG Data Pipeline -Customowy serwis RAG. Co 5 minut pobiera dane z czterech zrodel, tworzy embeddingi przez Ollama i zapisuje do ChromaDB. Udostepnia tez API wyszukiwania semantycznego dla Open WebUI. +> Custom RAG (Retrieval-Augmented Generation) service. Ingests data from four sources every 5 minutes, creates embeddings via Ollama, and stores them in ChromaDB. Provides semantic search API for Open WebUI. -## Architektura +## Architecture ``` [Frigate SQLite] --\ @@ -10,55 +10,57 @@ Customowy serwis RAG. Co 5 minut pobiera dane z czterech zrodel, tworzy embeddin [home-assistant.log] -/ [Docker logs] --/ -[Open WebUI Tool] --> [search_api.py] --> [ChromaDB] --> wyniki semantyczne +[Open WebUI Tool] --> [search_api.py] --> [ChromaDB] --> semantic results ``` -## Pliki +## Files -| Plik | Opis | -|------|------| -| `ingest.py` | Glowna petla ingestion, uruchamiana co INGEST_INTERVAL sekund | -| `search_api.py` | FastAPI do wyszukiwania semantycznego po kolekcjach | -| `openwebui_tool.py` | Tool plugin dla Open WebUI | -| `state/state.json` | Persystentny stan (ostatni przetworzony ID, pozycja w logu, timestamp) | +| File | Description | +|------|-------------| +| `ingest.py` | Main ingestion loop, runs every `INGEST_INTERVAL` seconds | +| `search_api.py` | FastAPI semantic search endpoint | +| `openwebui_tool.py` | Open WebUI tool plugin | +| `state/state.json` | Persistent state (last processed ID, log position, timestamp) | -## Konfiguracja (zmienne env) +## Environment Variables -| Zmienna | Domyslnie | Opis | -|---------|-----------|------| -| `CHROMA_HOST` | `chromadb` | Host ChromaDB | -| `CHROMA_PORT` | `8000` | Port ChromaDB | -| `OLLAMA_URL` | `http://ollama:11434` | URL Ollama | -| `FRIGATE_DB` | `/data/frigate/frigate.db` | Sciezka do bazy Frigate | -| `HA_LOG` | `/data/ha/home-assistant.log` | Sciezka do logu HA | -| `STATE_FILE` | `/data/state/state.json` | Plik stanu | -| `INGEST_INTERVAL` | `300` | Interwał w sekundach | -| `PG_HOST` | `postgres18` | Host PostgreSQL (HA recorder) | -| `PG_DB` | `homeassistant` | Baza HA | -| `PG_PASS` | - | Haslo PostgreSQL (wymagane) | +| Variable | Default | Description | +|----------|---------|-------------| +| `CHROMA_HOST` | `chromadb` | ChromaDB host | +| `CHROMA_PORT` | `8000` | ChromaDB port | +| `OLLAMA_URL` | `http://ollama:11434` | Ollama URL | +| `FRIGATE_DB` | `/data/frigate/frigate.db` | Frigate database path | +| `HA_LOG` | `/data/ha/home-assistant.log` | HA log file path | +| `STATE_FILE` | `/data/state/state.json` | State file path | +| `INGEST_INTERVAL` | `300` | Interval in seconds | +| `PG_HOST` | `postgres18` | PostgreSQL host (HA recorder) | +| `PG_DB` | `homeassistant` | HA database name | +| `PG_PASS` | - | PostgreSQL password (required) | -## Kolekcje ChromaDB +## ChromaDB Collections -- `frigate_events` - zdarzenia detekcji (label, camera, timestamp, score) -- `ha_history` - zmiany stanow encji HA (ostatnie 7 dni, okno kroczace) -- `ha_logs` - bloki 25 linii z home-assistant.log -- `docker_logs` - logi kontenerow: homeassistant, frigate, mosquitto, esphome, traefik, crowdsec, immich_server, ha-dashboard +| Collection | Contents | +|------------|----------| +| `frigate_events` | Detection events (label, camera, timestamp, score) | +| `ha_history` | HA entity state changes (rolling 7-day window) | +| `ha_logs` | 25-line blocks from home-assistant.log | +| `docker_logs` | Logs from: homeassistant, frigate, mosquitto, esphome, traefik, crowdsec, immich_server, ha-dashboard | -## Przydatne komendy +## Useful Commands ```bash -# Logi ingestion +# Follow ingestion logs docker compose logs -f log-ingester -# Stan przetworzonych danych +# Check processed state cat /home/seba/mydocker/log-ingester/state/state.json -# Test API wyszukiwania +# Test search API curl -X POST http://localhost:8765/search \ -H "Content-Type: application/json" \ - -d '{"query": "kto byl przy drzwiach wczoraj", "n_results": 5}' + -d '{"query": "who was at the door yesterday", "n_results": 5}' -# Statystyki kolekcji +# Collection statistics curl http://localhost:8765/stats # Rebuild diff --git a/loki/README.md b/loki/README.md index a0da19c..fe419df 100644 --- a/loki/README.md +++ b/loki/README.md @@ -1,53 +1,57 @@ -# Loki +# Loki - Log Aggregation -System agregacji logow (Grafana Loki). Przyjmuje logi od Promtail i udostepnia je Grafanie przez LogQL. +> Grafana Loki log aggregation system. Receives logs from Promtail and exposes them to Grafana via LogQL. -## URL / Dostep +## Access -- Wewnetrzny: http://loki:3100 (brak publicznego dostepu przez Traefik) -- Lokalny: http://localhost:3100 -- Brak uwierzytelniania (`auth_enabled: false`) +| Endpoint | Details | +|----------|---------| +| Internal | http://loki:3100 (no public Traefik access) | +| Local | http://localhost:3100 | +| Auth | None (`auth_enabled: false`) | -## Konfiguracja +## Configuration -Plik: `./loki/loki-config.yaml` +Config file: `./loki/loki-config.yaml` -Kluczowe parametry: -- Port HTTP: `3100` -- Backend storage: `tsdb` (schemat v13, od 2024-01-01) -- Dane na dysku: `./loki/data/` (wolumen Docker) - - Indeks: `/loki/index` - - Chunki: `/loki/chunks` - - Cache: `/loki/cache` - - WAL: `./loki/wal/` -- Retencja logow: **744h (31 dni)** -- Ingestion rate: max 10 MB/s (burst 20 MB/s) -- Kompakcja z usuwaniem: wlaczona (`retention_enabled: true`), opoznienie 2h +### Key Parameters -## Co monitoruje / metryki +| Parameter | Value | +|-----------|-------| +| HTTP Port | `3100` | +| Storage backend | `tsdb` (schema v13, from 2024-01-01) | +| Data location | `./loki/data/` (Docker volume) | +| Index | `/loki/index` | +| Chunks | `/loki/chunks` | +| Cache | `/loki/cache` | +| WAL | `./loki/wal/` | +| **Log retention** | **744h (31 days)** | +| Ingestion rate | max 10 MB/s (burst 20 MB/s) | +| Compaction + retention | enabled (`retention_enabled: true`), 2h delay | -Loki przechowuje logi - nie metryki. Zrodla logow: -- Wszystkie kontenery Docker (dostarczane przez Promtail przez Docker socket) +## Data Sources -Dostep do logow w Grafanie: datasource `Loki` (uid: `loki`), max 1000 linii na zapytanie. +Loki stores logs - not metrics. All Docker containers push logs via Promtail (Docker socket discovery). -## Powiazania z innymi serwisami +Access in Grafana: datasource `Loki` (uid: `loki`), max 1000 lines per query. -| Serwis | Rola | -|--------|------| -| Promtail | jedyny klient push (POST `/loki/api/v1/push`) | -| Grafana | odpytuje logi przez LogQL | +## Dependencies -## Przydatne komendy +| Service | Role | +|---------|------| +| Promtail | Only push client (POST `/loki/api/v1/push`) | +| Grafana | Queries logs via LogQL | + +## Useful Commands ```bash # Restart docker compose restart loki -# Logi +# Follow logs docker compose logs -f loki -# Sprawdz status/metryki Loki +# Check Loki status curl http://localhost:3100/ready curl http://localhost:3100/metrics | grep loki_ingester diff --git a/mktxp/README.md b/mktxp/README.md index deb98cf..774b716 100644 --- a/mktxp/README.md +++ b/mktxp/README.md @@ -1,80 +1,79 @@ -# mktxp (MikroTik Exporter) +# mktxp - MikroTik Prometheus Exporter -Eksporter Prometheus dla routera MikroTik. Laczy sie z routerem przez API RouterOS i udostepnia metryki do scrapowania przez Prometheus. +> Exporter for MikroTik RouterOS metrics. Connects via RouterOS API and exposes metrics for Prometheus scraping. -## URL / Dostep +## Access -- Metryki: http://localhost:49090/metrics (wewnetrzny, brak Traefik) -- Polaczenie z routerem: `192.168.1.1:8728` (RouterOS API, plaintext) +| Endpoint | Details | +|----------|---------| +| Metrics | http://localhost:49090/metrics (internal, no Traefik) | +| Router API | `192.168.1.1:8728` (RouterOS API, plaintext) | -## Konfiguracja +## Configuration -Pliki w `./mktxp/`: -- `mktxp.conf` - konfiguracja routerow (credentials, co zbierac) -- `_mktxp.conf` - parametry globalne exportera +Files in `./mktxp/`: -**Router MikroTik** (`mktxp.conf`): -- Host: `192.168.1.1`, port `8728` -- Uzytkownik API: `prometheus` (konto dedykowane na routerze) -- SSL: wylaczone (plaintext login) +| File | Purpose | +|------|---------| +| `mktxp.conf` | Router credentials, collection toggles | +| `_mktxp.conf` | Global exporter parameters | -Wlaczone zbieranie (`mktxp.conf`): -- `dhcp` + `dhcp_lease` - dzierzawy DHCP -- `connections` - aktywne polaczenia -- `interface` - statystyki interfejsow -- `monitor` - monitoring portu (ethernet) -- `public_ip` - publiczny adres IP -- `route` - tablice routingu -- `queue` - kolejki QoS -- `wireguard` + `wireguard_peers` - VPN WireGuard +### Router Connection -Parametry globalne (`_mktxp.conf`): -- Port nasluchiwania: `0.0.0.0:49090` -- Timeout: 8s, maks 5 watkow roboczych -- Test przepustowosci: wylaczony (`bandwidth = False`) -- Minimalny interwal: 5s, max czas scrape: 15s +- **Host:** `192.168.1.1`, port `8728` +- **API user:** `prometheus` (dedicated read-only account on router) +- **SSL:** disabled (plaintext login) -## Co monitoruje / metryki +### Enabled Collections -| Obszar | Przyklad metryk | -|--------|----------------| -| DHCP | liczba dzierzaw, aktywni klienci | -| Interfejsy | tx/rx bytes, pps, bledy, status linka | -| Polaczenia | aktywne sesje TCP/UDP | -| Routing | trasy statyczne i dynamiczne | -| QoS | kolejki, drop rate | -| WireGuard | status peerow, transfer, last handshake | -| IP publiczne | zewnetrzny adres IP routera | +| Collection | Metrics | +|------------|---------| +| `dhcp` + `dhcp_lease` | DHCP leases, active clients | +| `connections` | Active TCP/UDP connections | +| `interface` | Interface statistics (tx/rx bytes, pps, errors) | +| `monitor` | Ethernet port monitoring | +| `public_ip` | External IP address | +| `route` | Routing table | +| `queue` | QoS queues | +| `wireguard` + `wireguard_peers` | WireGuard VPN peers, transfer, last handshake | -## Powiazania z innymi serwisami +### Global Parameters (`_mktxp.conf`) -| Serwis | Rola | -|--------|------| -| MikroTik 192.168.1.1 | zrodlo danych (RouterOS API :8728) | -| Prometheus | scrapuje metryki z `:49090` co 30s | -| VictoriaMetrics | dlugoterminowe archiwum (przez Prometheus remote_write) | -| Grafana | wizualizacja metryk routera | +- Listen: `0.0.0.0:49090` +- Timeout: 8s, max 5 worker threads +- Bandwidth test: disabled +- Min interval: 5s, max scrape time: 15s -## Przydatne komendy +## Dependencies + +| Service | Role | +|---------|------| +| MikroTik 192.168.1.1 | Data source (RouterOS API :8728) | +| Prometheus | Scrapes metrics from `:49090` every 30s | +| VictoriaMetrics | Long-term archive (via Prometheus remote_write) | +| Grafana | Router metrics visualization | + +## Router Account Setup + +Create a read-only `prometheus` account on MikroTik: + +``` +/user add name=prometheus group=read password= +/ip service enable api +``` + +## Useful Commands ```bash # Restart docker compose restart mktxp -# Logi +# Follow logs docker compose logs -f mktxp -# Sprawdz metryki recznie +# Check metrics manually curl http://localhost:49090/metrics | grep mktxp_ # Upgrade ./upgrade-container-by-name.sh mktxp ``` - -## Konto na routerze - -Na MikroTik nalezy miec konto `prometheus` z minimalnym dostepem tylko do odczytu (grup API read). Konfiguracja w RouterOS: -``` -/user add name=prometheus group=read password=mktxp_monitor123 -/ip service enable api -``` diff --git a/mosquitto/README.md b/mosquitto/README.md index 3996631..53c9901 100644 --- a/mosquitto/README.md +++ b/mosquitto/README.md @@ -1,67 +1,72 @@ -# Mosquitto +# Mosquitto - MQTT Broker -Broker MQTT bedacy magistrala komunikacyjna dla calego systemu smart home - laczy Home Assistant, Frigate, urzadzenia Tasmota, Shelly i czujniki ESP. +> Central message bus for the smart home - connects Home Assistant, Frigate, Tasmota, Shelly and ESP devices. -## URL / Dostep +## Access -- MQTT: `192.168.1.132:1883` (TCP, wymaga uwierzytelnienia) -- WebSockets: `192.168.1.132:9001` -- Brak interfejsu webowego +| Endpoint | Details | +|----------|---------| +| MQTT TCP | `192.168.1.132:1883` (authentication required) | +| WebSockets | `192.168.1.132:9001` | +| Web UI | None (headless broker) | -## Konfiguracja +## Configuration -- Obraz: `eclipse-mosquitto:2` (seria 2.x; unikamy niejawnego `:latest`) -- Siec: `network_mode: host` -- Plik konfiguracyjny: `./mosquitto/config/mosquitto.conf` -- Hasla: `./mosquitto/config/mosquitto.passwd` (format bcrypt) -- Dane persystentne: `./mosquitto/data/` -- Logi: `./mosquitto/log/` +- **Image:** `eclipse-mosquitto:2` (pinned to 2.x series) +- **Network:** `network_mode: host` +- **Config:** `./mosquitto/config/mosquitto.conf` +- **Passwords:** `./mosquitto/config/mosquitto.passwd` (bcrypt format) +- **Data:** `./mosquitto/data/` +- **Logs:** `./mosquitto/log/` -Kluczowe ustawienia: -- `allow_anonymous false` - wymagane uwierzytelnienie -- `persistence false` - broker nie zapisuje retajnowanych wiadomości ani stanu na dysku (po restarcie znikają retained; dla typowego HA + czujników często OK) -- `persistence_location` wskazuje na volume `/mosquitto/data` (gdyby włączyć `persistence true`) -- Opcjonalne fragmenty konfiguracji: katalog `config/conf.d/*.conf` (ładowane przez `include_dir`) -- `persistent_client_expiration 3m` - klienci offline usuwani po 3 minutach -- `max_inflight_messages 40` -- Logowane tylko bledy, ostrzezenia i powiadomienia (nie kazde polaczenie) +### Key Settings -## Architektura / Powiazania +| Setting | Value | Notes | +|---------|-------|-------| +| `allow_anonymous` | `false` | Authentication mandatory | +| `persistence` | `false` | Retained messages cleared on restart - fine for typical HA sensor workloads | +| `persistent_client_expiration` | `3m` | Offline clients removed after 3 minutes | +| `max_inflight_messages` | `40` | | +| Log level | errors, warnings, notifications only | No per-connection logging | + +Optional config fragments can be placed in `config/conf.d/*.conf` (loaded via `include_dir`). + +## Architecture ``` -Mosquitto MQTT Broker (port 1883) - ├── Home Assistant - subskrybuje/publikuje stany urzadzen - ├── Frigate - publikuje zdarzenia detekcji (topic: frigate/#) - ├── ESPHome - niektore urzadzenia przez MQTT zamiast API natywnego - ├── Tasmota - inteligentne gniazdka, przelaczniki - └── Shelly - przekazniki, mierniki mocy +Mosquitto MQTT Broker (:1883) + ├── Home Assistant - subscribes/publishes device states + ├── Frigate - publishes detection events (topic: frigate/#) + ├── ESPHome - some devices via MQTT instead of native API + ├── Tasmota - smart plugs, switches + └── Shelly - relays, power meters ``` -## Zarzadzanie uzytkownikami +## User Management ```bash -# Dodanie nowego uzytkownika (wewnatrz kontenera) -docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd nowy_uzytkownik +# Add a new user (inside container) +docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd -# Zmiana hasla -docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd uzytkownik +# Change password +docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd -# Restart po zmianach +# Restart after changes docker compose restart mosquitto ``` -## Przydatne komendy +## Useful Commands ```bash -# Logi brokera +# Follow broker logs docker compose logs -f mosquitto -# Podsluchiwanie wszystkich wiadomosci (z hosta, wymaga mosquitto-clients) -mosquitto_sub -h 192.168.1.132 -u mosquitto -P -t '#' -v +# Subscribe to ALL topics (requires mosquitto-clients on host) +mosquitto_sub -h 192.168.1.132 -u mosquitto -P -t '#' -v -# Podsluchiwanie tylko zdarzen Frigate -mosquitto_sub -h 192.168.1.132 -u mosquitto -P -t 'frigate/#' -v +# Subscribe to Frigate events only +mosquitto_sub -h 192.168.1.132 -u mosquitto -P -t 'frigate/#' -v -# Testowe wyslanie wiadomosci -mosquitto_pub -h 192.168.1.132 -u mosquitto -P -t 'test/topic' -m 'hello' +# Publish a test message +mosquitto_pub -h 192.168.1.132 -u mosquitto -P -t 'test/topic' -m 'hello' ``` diff --git a/pingexporter/README.md b/pingexporter/README.md index 4e04a4f..9991be8 100644 --- a/pingexporter/README.md +++ b/pingexporter/README.md @@ -1,67 +1,73 @@ -# ping-exporter +# Ping Exporter - ICMP Network Monitor -Eksporter Prometheus mierzacy dostepnosc i latencje sieci przez ICMP ping. Generuje metryki RTT, packet loss i jitter dla skonfigurowanych hostow. +> Prometheus exporter measuring network availability and latency via ICMP ping. Tracks RTT, packet loss and jitter for configured hosts. -## URL / Dostep +## Access -- Metryki: http://localhost:9427/metrics (host network) -- Brak publicznego dostepu przez Traefik +| Endpoint | Details | +|----------|---------| +| Metrics | http://localhost:9427/metrics (`network_mode: host`) | +| Public access | None (no Traefik) | -## Konfiguracja +## Configuration -Plik: `./pingexporter/config/config.yml` +Config file: `./pingexporter/config/config.yml` -**Hosty docelowe:** +### Target Hosts -| Host | Typ | -|------|-----| -| 8.8.8.8 | Google DNS (internet) | -| 8.8.4.4 | Google DNS 2 (internet) | -| 4.2.2.1 | Level3 DNS (internet) | -| klfree.cz | zewnetrzny host (internet) | -| 192.168.1.1 | router MikroTik (LAN) | -| 192.168.1.132 | host glowny (acemagic) | -| 192.168.1.219 | inne urzadzenie LAN | +| Host | Type | +|------|------| +| `8.8.8.8` | Google DNS (internet) | +| `8.8.4.4` | Google DNS 2 (internet) | +| `4.2.2.1` | Level3 DNS (internet) | +| `klfree.cz` | External host (internet) | +| `192.168.1.1` | MikroTik router (LAN) | +| `192.168.1.132` | Main host (acemagic) | +| `192.168.1.219` | Other LAN device | -**Parametry pingu:** -- Interwal pomiaru: co **2s** -- Timeout: 3s -- Historia: ostatnie 60 pomiarow (2 minuty okna) -- Rozmiar pakietu ICMP: 120 bajtow -- IPv6: wylaczone +### Ping Parameters + +| Parameter | Value | +|-----------|-------| +| Measurement interval | Every **2s** | +| Timeout | 3s | +| History | Last 60 measurements (2-minute window) | +| ICMP packet size | 120 bytes | +| IPv6 | Disabled | + +### DNS -**DNS:** - Resolver: `1.1.1.1` (Cloudflare) -- Odswiezanie rekordow: co 2 min 15 s +- Record refresh: every 2 min 15 s -## Co monitoruje / metryki +## Metrics -| Metryka | Opis | -|---------|------| +| Metric | Description | +|--------|-------------| | `ping_rtt_seconds` | Round-trip time (min/mean/max/std) | | `ping_loss_ratio` | Packet loss (0.0 - 1.0) | -| `ping_up` | Host osiagalny (1/0) | +| `ping_up` | Host reachable (1/0) | -Pozwala wykryc: utrate polaczenia internetowego, degradacje jakosci lacza, problemy z konkretnym segmentem sieci LAN. +Useful for detecting: internet connection drops, link quality degradation, specific LAN segment issues. -## Powiazania z innymi serwisami +## Dependencies -| Serwis | Rola | -|--------|------| -| Prometheus | scrapuje `acemagic:9427` co 15s | -| VictoriaMetrics | dlugoterminowe archiwum | -| Grafana | dashboard `ping-monitoring.json` | +| Service | Role | +|---------|------| +| Prometheus | Scrapes `acemagic:9427` every 15s | +| VictoriaMetrics | Long-term archive | +| Grafana | `ping-monitoring.json` dashboard | -## Przydatne komendy +## Useful Commands ```bash # Restart docker compose restart ping-exporter -# Logi +# Follow logs docker compose logs -f ping-exporter -# Sprawdz metryki recznie +# Check metrics manually curl http://localhost:9427/metrics | grep ping_ # Upgrade diff --git a/prometheus/README.md b/prometheus/README.md index 6ccb55c..d5462fa 100644 --- a/prometheus/README.md +++ b/prometheus/README.md @@ -1,66 +1,72 @@ -# Prometheus +# Prometheus - Metrics Collection -System zbierania metryk (time-series database). Scrapuje eksportery co 15s, przechowuje dane 30 dni / max 20 GB, nastepnie zapisuje do VictoriaMetrics (remote_write) jako archiwum dlugoterminowe. +> Time-series database. Scrapes exporters every 15s, retains data for 30 days / 20 GB, then forwards to VictoriaMetrics via remote_write for long-term storage. -## URL / Dostep +## Access -- Publiczny: https://prom.sebson.space -- Lokalny: http://localhost:29090 -- Basic auth: uzytkownik `seba` (haslo z `.env`) +| Endpoint | Details | +|----------|---------| +| Public URL | https://prom.sebson.space | +| Internal | http://localhost:29090 | +| Auth | Basic auth, user `seba` (password in `.env`) | -## Konfiguracja +## Configuration -Pliki w `./prometheus/`: -- `prometheus.yml` - glowna konfiguracja scrapowania -- `web.yml` - basic auth (bcrypt hash hasla) -- `pinghosts.yaml` - hosty dla blackbox exportera (google.com, github.com) -- `hosts` - lokalne mapowania DNS dla scrapowanych hostow -- `storage/` - dane TSDB (retencja 30d) +Files in `./prometheus/`: -Parametry startu (z docker-compose): -- `--storage.tsdb.retention.time=30d` -- `--storage.tsdb.retention.size=20GB` -- `--web.config.file=/etc/prometheus/web.yml` +| File | Purpose | +|------|---------| +| `prometheus.yml` | Main scrape configuration | +| `web.yml` | Basic auth (bcrypt password hash) | +| `pinghosts.yaml` | Blackbox exporter targets (google.com, github.com) | +| `hosts` | Local DNS mappings for scraped hosts | +| `storage/` | TSDB data (30d retention) | -## Co monitoruje / metryki +### Startup Parameters -Skonfigurowane joby (`prometheus.yml`): +``` +--storage.tsdb.retention.time=30d +--storage.tsdb.retention.size=20GB +--web.config.file=/etc/prometheus/web.yml +``` -| Job | Cel | Interwal | -|-----|-----|---------| +## Scrape Jobs + +| Job | Target | Interval | +|-----|--------|----------| | `prometheus` | localhost:9090 (self-monitoring) | 5s | | `node-exporter` | acemagic, rpi4, sebas-macpro, asustor-lan1, mycloud, crowdsec:6060 | 15s | | `ping-exporter` | acemagic:9427 | 15s | -| `cadvisor` | cadvisor:8080 (kontenery Docker) | 15s | +| `cadvisor` | cadvisor:8080 (Docker containers) | 15s | | `home-assistant` | 192.168.1.132:8123/api/prometheus | 10s | | `traefik` | traefik:8080 | 5s | -| `pushgateway` | 192.168.1.132:9091 (metryki push z side-agent) | 5s | +| `pushgateway` | 192.168.1.132:9091 (side-agent push metrics) | 5s | | `postgres` | postgres-exporter:9187 | 15s | -| `smartctl` | smartctl-exporter:9633 (S.M.A.R.T. dyskow) | 15s | +| `smartctl` | smartctl-exporter:9633 (disk S.M.A.R.T.) | 15s | | `mktxp` | mktxp:49090 (MikroTik router) | 30s | | `wireguard` | 172.17.0.1:9586 | 15s | -Remote write: wszystkie metryki kopiowane do `http://victoriametrics:8428/api/v1/write`. +**Remote write:** all metrics replicated to `http://victoriametrics:8428/api/v1/write`. -## Powiazania z innymi serwisami +## Dependencies -| Serwis | Rola | -|--------|------| -| VictoriaMetrics | archiwum dlugoterminowe (remote_write) | -| Grafana | odczytuje metryki (jako `Prometheus-Raw`) | -| Alertmanager | odbiera alerty z Prometheus (`alertmanager:9093`) | -| Wszystkie eksportery | zrodla metryk (node, cadvisor, mktxp, smartctl, itd.) | +| Service | Role | +|---------|------| +| VictoriaMetrics | Long-term archive (remote_write) | +| Grafana | Reads metrics (as `Prometheus-Raw` source) | +| Alertmanager | Receives alerts (`alertmanager:9093`) | +| All exporters | Metric sources | -## Przydatne komendy +## Useful Commands ```bash # Restart docker compose restart prometheus -# Logi +# Follow logs docker compose logs -f prometheus -# Sprawdz aktywne targety +# Check active targets curl -s http://localhost:29090/api/v1/targets | jq '.data.activeTargets[] | {job: .labels.job, health: .health}' # Upgrade diff --git a/promtail/README.md b/promtail/README.md index 52595b0..424a079 100644 --- a/promtail/README.md +++ b/promtail/README.md @@ -1,54 +1,63 @@ -# Promtail +# Promtail - Log Shipper -Agent zbierajacy logi i wysylajacy je do Loki. Automatycznie odkrywa wszystkie kontenery Docker przez Docker socket i przekazuje ich stdout/stderr. +> Log collection agent that discovers Docker containers via the Docker socket and forwards stdout/stderr to Loki. -## URL / Dostep +## Access -- Wewnetrzny port HTTP: `9080` (health check, metryki) -- Brak publicznego dostepu -- Dostep do Docker socket: `unix:///var/run/docker.sock` +| Endpoint | Details | +|----------|---------| +| HTTP Port | `9080` (health check, metrics) | +| Public access | None | +| Docker socket | `unix:///var/run/docker.sock` | -## Konfiguracja +## Configuration -Plik: `./promtail/promtail-config.yaml` +Config file: `./promtail/promtail-config.yaml` -Kluczowe parametry: -- Port HTTP: `9080` -- Cel push: `http://loki:3100/loki/api/v1/push` -- Plik pozycji (checkpointing): `/tmp/positions.yaml` -- Odswiezanie listy kontenerow: co 5s +### Key Parameters -Scrape job `docker`: -- Odkrywa kontenery przez `docker_sd_configs` -- Label `container` - nazwa kontenera (bez `/`) -- Label `stream` - `stdout` lub `stderr` -- Parser `pipeline_stages: docker` - parsuje format logow Docker +| Parameter | Value | +|-----------|-------| +| HTTP Port | `9080` | +| Push target | `http://loki:3100/loki/api/v1/push` | +| Positions file | `/tmp/positions.yaml` (checkpointing) | +| Container refresh | Every 5s | -## Co monitoruje / metryki +### Scrape Job: `docker` -Zbiera logi ze wszystkich uruchomionych kontenerow Docker na hoscie. Kazdy log wzbogacony jest o: -- `container` - nazwa kontenera -- `stream` - typ strumienia -- Metadane z Docker (image, compose project, itd.) +- Discovers containers via `docker_sd_configs` +- Label `container` - container name (without leading `/`) +- Label `stream` - `stdout` or `stderr` +- Pipeline: `docker` parser for Docker log format -## Powiazania z innymi serwisami +## Data Collected -| Serwis | Rola | -|--------|------| -| Docker socket | zrodlo logow (service discovery + streaming) | -| Loki | cel push logow | -| Grafana | posrednio - Grafana odpytuje Loki | +Collects logs from all running Docker containers on the host. Each log entry is enriched with: -## Przydatne komendy +| Label | Description | +|-------|-------------| +| `container` | Container name | +| `stream` | Stream type (stdout/stderr) | +| Docker metadata | Image, compose project, etc. | + +## Dependencies + +| Service | Role | +|---------|------| +| Docker socket | Log source (service discovery + streaming) | +| Loki | Push destination | +| Grafana | Indirect - Grafana queries Loki | + +## Useful Commands ```bash # Restart docker compose restart promtail -# Logi (promtaila) +# Follow logs docker compose logs -f promtail -# Sprawdz status +# Check status curl http://localhost:9080/ready curl http://localhost:9080/targets diff --git a/prowlarr/Definitions/dasunerwartete-api.yml b/prowlarr/Definitions/dasunerwartete-api.yml index 5709b56..6a49057 100644 --- a/prowlarr/Definitions/dasunerwartete-api.yml +++ b/prowlarr/Definitions/dasunerwartete-api.yml @@ -10,9 +10,9 @@ links: caps: categorymappings: - - {id: 145, cat: Movies, desc: "Filme > DRG"} - {id: 28, cat: Movies/SD, desc: "Filme > SD"} - {id: 32, cat: Movies/HD, desc: "Filme > HD"} + - {id: 145, cat: Movies, desc: "Filme > DRG"} - {id: 114, cat: Movies/UHD, desc: "Filme > UHD"} - {id: 140, cat: Movies/BluRay, desc: "Filme > BluRay"} - {id: 143, cat: TV/Anime, desc: "Filme > Anime"} @@ -36,6 +36,7 @@ caps: - {id: 15, cat: TV/Documentary, desc: "Doku > SD"} - {id: 14, cat: TV/Documentary, desc: "Doku > HD"} - {id: 123, cat: TV/Documentary, desc: "Doku > Reihe"} + - {id: 153, cat: TV/Documentary, desc: "Doku > Dokus/UHD"} - {id: 126, cat: PC/Mobile-Other, desc: "Spiel > Mobil"} - {id: 17, cat: PC/Games, desc: "Spiel > PC"} - {id: 24, cat: Console, desc: "Spiel > Konsole"} @@ -51,9 +52,13 @@ caps: - {id: 142, cat: XXX/ImageSet, desc: "XXX > Pic´s"} - {id: 129, cat: Movies/SD, desc: "Internal > Film SD"} - {id: 128, cat: Movies/HD, desc: "Internal > Film HD"} + - {id: 152, cat: Movies/UHD, desc: "Internal > Film UHD"} - {id: 131, cat: TV/SD, desc: "Internal > Serien SD"} - {id: 130, cat: TV/HD, desc: "Internal > Serien HD"} - {id: 132, cat: Other, desc: "Internal > Sonstiges"} + - {id: 149, cat: Movies/UHD, desc: "Internal > Packs UHD"} + - {id: 150, cat: Movies/HD, desc: "Internal > Packs HD"} + - {id: 151, cat: Movies/SD, desc: "Internal > Packs SD"} modes: search: [q] diff --git a/prowlarr/Definitions/dasunerwartete.yml b/prowlarr/Definitions/dasunerwartete.yml index 04e2780..4119c68 100644 --- a/prowlarr/Definitions/dasunerwartete.yml +++ b/prowlarr/Definitions/dasunerwartete.yml @@ -10,9 +10,9 @@ links: caps: categorymappings: - - {id: 145, cat: Movies, desc: "Filme > DRG"} - {id: 28, cat: Movies/SD, desc: "Filme > SD"} - {id: 32, cat: Movies/HD, desc: "Filme > HD"} + - {id: 145, cat: Movies, desc: "Filme > DRG"} - {id: 114, cat: Movies/UHD, desc: "Filme > UHD"} - {id: 140, cat: Movies/BluRay, desc: "Filme > BluRay"} - {id: 143, cat: TV/Anime, desc: "Filme > Anime"} @@ -36,6 +36,7 @@ caps: - {id: 15, cat: TV/Documentary, desc: "Doku > SD"} - {id: 14, cat: TV/Documentary, desc: "Doku > HD"} - {id: 123, cat: TV/Documentary, desc: "Doku > Reihe"} + - {id: 153, cat: TV/Documentary, desc: "Doku > Dokus/UHD"} - {id: 126, cat: PC/Mobile-Other, desc: "Spiel > Mobil"} - {id: 17, cat: PC/Games, desc: "Spiel > PC"} - {id: 24, cat: Console, desc: "Spiel > Konsole"} @@ -51,9 +52,13 @@ caps: - {id: 142, cat: XXX/ImageSet, desc: "XXX > Pic´s"} - {id: 129, cat: Movies/SD, desc: "Internal > Film SD"} - {id: 128, cat: Movies/HD, desc: "Internal > Film HD"} + - {id: 152, cat: Movies/UHD, desc: "Internal > Film UHD"} - {id: 131, cat: TV/SD, desc: "Internal > Serien SD"} - {id: 130, cat: TV/HD, desc: "Internal > Serien HD"} - {id: 132, cat: Other, desc: "Internal > Sonstiges"} + - {id: 149, cat: Movies/UHD, desc: "Internal > Packs UHD"} + - {id: 150, cat: Movies/HD, desc: "Internal > Packs HD"} + - {id: 151, cat: Movies/SD, desc: "Internal > Packs SD"} modes: search: [q] diff --git a/prowlarr/README.md b/prowlarr/README.md index 75a059c..58b20fc 100644 --- a/prowlarr/README.md +++ b/prowlarr/README.md @@ -1,45 +1,45 @@ -# Prowlarr +# Prowlarr - Indexer Manager -Menedzer indekserow torrent/usenet. Agreguje zrodla i udostepnia je klientom (Radarr, Sonarr, qBittorrent). +> Torrent/Usenet indexer manager. Aggregates sources and shares them with clients (Radarr, Sonarr, qBittorrent). -## URL / Dostep +## Access -- URL: http://localhost:9696 (brak publicznego dostępu przez Traefik) -- Uwierzytelnienie: Forms (login/haslo) +| Endpoint | Details | +|----------|---------| +| Web UI | http://localhost:9696 (no public Traefik access) | +| Auth | Forms (login/password) | -## Konfiguracja +## Configuration -- Obraz: `linuxserver/prowlarr` -- Port: 9696 -- Branch: master -- API Key: przechowywany w `./prowlarr/config.xml` -- PUID=1000, PGID=1000 -- TZ=Europe/Prague +- **Image:** `linuxserver/prowlarr` +- **Port:** 9696 +- **Branch:** master +- **API Key:** stored in `./prowlarr/config.xml` +- **PUID/PGID:** 1000 +- **Timezone:** `Europe/Prague` -Konfiguracja serwisu: `./prowlarr/config.xml` +## Storage -## Storage / Dane +| Path | Contents | +|------|----------| +| `./prowlarr/` | Entire config directory mounted as `/config` | +| `./prowlarr/config.xml` | Main config (API key, port, auth) | +| `./prowlarr/prowlarr.db` | SQLite database with indexers | +| `./prowlarr/Definitions/` | Indexer definitions | +| `./prowlarr/Backups/` | Automatic config backups | +| `./prowlarr/logs/` | Application logs | -| Sciezka | Zawartosc | -|---------|-----------| -| `./prowlarr/` | caly katalog konfiguracyjny montowany jako `/config` | -| `./prowlarr/config.xml` | glowna konfiguracja (API key, port, auth) | -| `./prowlarr/prowlarr.db` | baza SQLite z indekserami | -| `./prowlarr/Definitions/` | definicje indekserow | -| `./prowlarr/Backups/` | automatyczne backupy konfiguracji | -| `./prowlarr/logs/` | logi aplikacji | +## Dependencies -## Powiazania +- **Radarr** - receives movie search results +- **Sonarr** - receives TV show search results +- **qBittorrent** (torrent-box-with-vpn) - download client +- Shares VPN network with qBittorrent via `network_mode: "service:gluetun"` -- **Radarr** - pobiera wyniki wyszukiwan filmow -- **Sonarr** - pobiera wyniki wyszukiwan seriali -- **qBittorrent** (torrent-box-with-vpn) - klient pobierania -- Dzieli siec VPN z qBittorrent: `network_mode: "service:gluetun"` - -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f prowlarr # Restart diff --git a/setup_kuma_monitors.py b/setup_kuma_monitors.py new file mode 100644 index 0000000..03142b2 --- /dev/null +++ b/setup_kuma_monitors.py @@ -0,0 +1,108 @@ +#!/usr/bin/env python3 +"""Add monitors to Uptime Kuma via Socket.IO. +Runs on the host, connects directly to Kuma container's IP. +Token read from .env - never exposed to chat.""" +import os +import sys +import time +import json +import subprocess + +try: + import socketio +except ImportError: + venv = os.path.join(os.path.dirname(__file__), ".kuma_venv") + if not os.path.exists(venv): + print("Creating virtual environment...") + subprocess.check_call([sys.executable, "-m", "venv", venv]) + pip = os.path.join(venv, "bin", "pip") + print("Installing python-socketio[client]...") + subprocess.check_call([pip, "install", "-q", "python-socketio[client]"]) + python = os.path.join(venv, "bin", "python") + os.execv(python, [python] + sys.argv) + +import socketio + +# Read token from .env +token = None +env_file = os.path.join(os.path.dirname(__file__), ".env") +with open(env_file) as f: + for line in f: + if line.startswith("UPTIME_KUMA_API_KEY="): + token = line.split("=", 1)[1].strip() + break + +if not token: + print("ERROR: UPTIME_KUMA_API_KEY not found in .env") + sys.exit(1) + +# Find Kuma's container IP +result = subprocess.run( + ["docker", "inspect", "uptime-kuma", "-f", "{{.NetworkSettings.Networks.mydocker_default.IPAddress}}"], + capture_output=True, text=True +) +kuma_ip = result.stdout.strip() +kuma_url = f"http://{kuma_ip}:3001" + +MONITORS = [ + {"name": "Traefik", "type": "https", "url": "https://traefik.sebson.space"}, + {"name": "Home Assistant", "type": "https", "url": "https://ha.sebson.space"}, + {"name": "Grafana", "type": "https", "url": "https://grafana.sebson.space"}, + {"name": "Bitwarden", "type": "https", "url": "https://bward.sebson.space"}, + {"name": "Immich", "type": "https", "url": "https://immch.sebson.space"}, + {"name": "Jellyfin", "type": "https", "url": "https://jfin.sebson.space"}, + {"name": "Prometheus", "type": "https", "url": "https://prom.sebson.space"}, + {"name": "HA Dashboard", "type": "https", "url": "https://hadash.sebson.space"}, + {"name": "Brana Frontend", "type": "https", "url": "https://brana.sebson.space"}, + {"name": "MikroTik", "type": "ping", "hostname": "192.168.1.1"}, + {"name": "Google DNS", "type": "ping", "hostname": "8.8.8.8"}, + {"name": "Frigate", "type": "http", "url": "http://acemagic:5000"}, + {"name": "Ollama", "type": "http", "url": "http://acemagic:11434"}, + {"name": "Gotify", "type": "http", "url": "http://acemagic:86"}, + {"name": "Dozzle", "type": "http", "url": "http://acemagic:8080"}, + {"name": "OpenSpeedTest", "type": "http", "url": "http://acemagic:3000"}, + {"name": "Gitea", "type": "http", "url": "http://acemagic:3002"}, + {"name": "PostgreSQL", "type": "tcp", "hostname": "acemagic", "port": 5432}, + {"name": "Mosquitto", "type": "tcp", "hostname": "acemagic", "port": 1883}, + {"name": "Redis", "type": "tcp", "hostname": "acemagic", "port": 6379}, +] + +sio = socketio.Client(logger=False, engineio_logger=False, reconnection=False) +print(f"Connecting to Kuma at {kuma_url}...") +sio.connect(kuma_url, wait_timeout=10) +print("Connected via Socket.IO") + +r = sio.call("loginByToken", {"token": token}, timeout=10) +if r.get("ok"): + print("API token accepted") +else: + print(f"Token rejected: {r}") + sio.disconnect() + sys.exit(1) + +print(f"Adding {len(MONITORS)} monitors...") +added = 0 +for m in MONITORS: + p = {"name": m["name"], "type": m["type"], "interval": 30, "maxretries": 3, "retryInterval": 15, "notificationIDList": {}, "upsideDown": False} + if m["type"] in ("https", "http"): + p["url"] = m["url"] + if m["type"] == "https": + p["expiryNotification"] = True + elif m["type"] == "ping": + p["hostname"] = m["hostname"] + elif m["type"] == "tcp": + p["hostname"] = m["hostname"] + p["port"] = m["port"] + try: + r = sio.call("add", p, timeout=10) + if r.get("ok") or "Successfully" in str(r.get("msg", "")): + print(f" OK {m['name']} (id={r.get('monitorID', '?')})") + added += 1 + else: + print(f" ? {m['name']} -> {r}") + except Exception as e: + print(f" FAIL {m['name']} -> {e}") + time.sleep(0.2) + +sio.disconnect() +print(f"\nDone. {added}/{len(MONITORS)} added.") diff --git a/side-agent/README.md b/side-agent/README.md index 23a7843..b7525e9 100644 --- a/side-agent/README.md +++ b/side-agent/README.md @@ -1,63 +1,63 @@ -# side-agent +# Side Agent - Custom Background Daemons -Customowy kontener z trzema daemonami uruchamianymi rownoczesnie. Ma dostep do docker.sock i montuje caly katalog /mydocker. Sluzy jako "klej" laczacy monitoring kamer, zarzadzanie kontenerami i harmonogram backupow. +> Custom container running three daemons simultaneously. Has Docker socket access and mounts the entire `/mydocker` directory. Acts as "glue" connecting camera monitoring, container management and backup scheduling. -## Daemony +## Daemons -### snapit.py +### snapit.py - Camera Snapshot Monitor -Monitoruje katalog z klipami Frigate (`/media/evo2t/frigate/clips`). Wykrywa nowe pliki JPG per kamera, kopiuje je jako plik notyfikacji dla Home Assistant i wysyla metryki gauge do Prometheus Pushgateway. +Monitors the Frigate clips directory (`/media/evo2t/frigate/clips`). Detects new JPG files per camera, copies them as notification files for Home Assistant, and pushes gauge metrics to Prometheus Pushgateway. -- Kamery: reolink_1-5, hikvision_2, hikvision_4 -- Wykrywane obiekty: person, car, dog, cat, animal -- Pushgateway: `http://:9091/metrics/job/camera_detection/camera/` -- Metryka `person_detected{camera="..."}` - licznik aktywnych detekcji, resetuje sie po 30s od ostatniego zdarzenia -- Archiwizacja klatek: `/hikvision/objects-detected///` +- **Cameras:** reolink_1-5, hikvision_2, hikvision_4 +- **Detected objects:** person, car, dog, cat, animal +- **Pushgateway:** `http://:9091/metrics/job/camera_detection/camera/` +- **Metric:** `person_detected{camera="..."}` - gauge of active detections, resets after 30s from last event +- **Archive:** frames archived to `/hikvision/objects-detected///` -### container_manager.py +### container_manager.py - Container Version Checker -Sprawdza co 3600s czy sa dostepne nowe wersje obrazow Docker dla wszystkich uruchomionych kontenerow (pomija lokalne buildy i obrazy bez taga). Aktualizuje manifest wersji. +Checks every 3600s for new Docker image versions across all running containers (skips local builds and SHA-referenced images). Updates the version manifest. -- Manifest: `./side-agent/manifest/container_versions.yaml` -- Pomija: obrazy z prefiksem `mydocker_`, `docker-`, obrazy referencjonowane po SHA +- **Manifest:** `./side-agent/manifest/container_versions.yaml` +- **Skips:** images prefixed with `mydocker_`, `docker-`, SHA-referenced images -### backup_scheduler.py +### backup_scheduler.py - NAS Backup Scheduler -Harmonogram rsync do NAS Asustor (`root@asustor-lan1`). Zastepuje crony z Ansible. +Schedules rsync to Asustor NAS (`root@asustor-lan1`). Replaces Ansible crons. -| Zadanie | Harmonogram | Zrodlo | Cel | -|---------|-------------|--------|-----| -| mydocker backup (rotacja 3 dni) | codziennie 07:33 | `/mydocker/` | `/volume1/data/rsyncs/mydocker_YYYYMMDD/` | -| myansible sync | codziennie 01:10 | `../git.repos/myansible/` | `/volume1/data/rsyncs/myansible/` | -| myansible -> gdrive | niedziele 01:15 | `../git.repos/myansible/` | `/volume1/data/google-drive-sync/...` | -| /etc/hosts | codziennie 01:15 | `/etc/hosts` | `/volume1/data/rsyncs/hosts` | -| valuable_scripts | codziennie 01:15 | `../valuable_scripts/` | `/volume1/data/rsyncs/valuable_scripts/` | +| Task | Schedule | Source | Destination | +|------|----------|--------|-------------| +| mydocker backup (3-day rotation) | Daily 07:33 | `/mydocker/` | `/volume1/data/rsyncs/mydocker_YYYYMMDD/` | +| myansible sync | Daily 01:10 | `../git.repos/myansible/` | `/volume1/data/rsyncs/myansible/` | +| myansible -> gdrive | Sundays 01:15 | `../git.repos/myansible/` | `/volume1/data/google-drive-sync/...` | +| /etc/hosts | Daily 01:15 | `/etc/hosts` | `/volume1/data/rsyncs/hosts` | +| valuable_scripts | Daily 01:15 | `../valuable_scripts/` | `/volume1/data/rsyncs/valuable_scripts/` | -## Wolumeny +## Volumes -``` -/var/run/docker.sock - dostep do Docker API -/home/seba/mydocker - montowany jako /mydocker -/media/evo2t/frigate/clips - zrodlo klipow Frigate (SOURCE_DIR) -/media/seagata16t/hikvision16t - archiwum detekcji (TARGET_DIR) -``` +| Host Mount | Container Mount | Purpose | +|------------|-----------------|---------| +| `/var/run/docker.sock` | - | Docker API access | +| `/home/seba/mydocker` | `/mydocker` | Full project directory | +| `/media/evo2t/frigate/clips` | - | Frigate clip source (`SOURCE_DIR`) | +| `/media/seagata16t/hikvision16t` | - | Detection archive (`TARGET_DIR`) | -## Przydatne komendy +## Useful Commands ```bash -# Logi wszystkich daemonow +# Follow all daemon logs docker compose logs -f side-agent -# Aktualny manifest wersji kontenerow +# View current container version manifest cat /home/seba/mydocker/side-agent/manifest/container_versions.yaml -# Reczny test backupu mydocker +# Manual test: mydocker backup docker exec side-agent python3 /app/backup_scheduler.py --test-mydocker -# Reczny test wszystkich backupow +# Manual test: all backups docker exec side-agent python3 /app/backup_scheduler.py --test-all -# Sprawdz metryki pushgateway +# Check pushgateway metrics curl http://192.168.1.132:9091/metrics | grep person_detected # Rebuild diff --git a/timelapse_service/README.md b/timelapse_service/README.md index 171f52c..9c77cd8 100644 --- a/timelapse_service/README.md +++ b/timelapse_service/README.md @@ -1,63 +1,63 @@ -# timelapse_service +# Timelapse Service - Camera Timelapse Generator -Customowy serwis generowania timelapsy z nagran kamer. Oparty na cronie i ffmpeg. Przetwarza zdjecia JPG nagrane przez kamery Hikvision/Reolink i tworzy pliki MP4 dla roznych okresow. +> Cron-based service generating timelapse videos from camera recordings. Processes Hikvision/Reolink JPG frames and creates MP4 files for various time periods. -## Jak dziala +## How It Works -1. Kamery zapisuja klatki JPG do `/media/seagata16t/hikvision16t///` -2. Cron w kontenerze uruchamia `timelapse_maker.py` z odpowiednim parametrem -3. Skrypt zbiera JPG, skleja przez ffmpeg (libx264, 1920x1080, 30fps) w MP4 -4. Wyniki trafiaja do `/media/seagata16t/all_timelapses/` -5. Co uruchomienie `today` usuwa katalogi JPG starsze niz 7 dni +1. Cameras save JPG frames to `/media/seagata16t/hikvision16t///` +2. Cron in container triggers `timelapse_maker.py` with the appropriate parameter +3. Script collects JPGs, stitches via ffmpeg (libx264, 1920x1080, 30fps) into MP4 +4. Results saved to `/media/seagata16t/all_timelapses/` +5. On each `today` run, deletes JPG directories older than 7 days -## Kamery +## Cameras reolink_1, reolink_2, reolink_3, reolink_4, reolink_5, hikvision_2, hikvision_4 -Przetwarzanie rownolegne: 2 procesy jednoczesnie (`Pool(processes=2)`). +Parallel processing: 2 concurrent processes (`Pool(processes=2)`). -## Harmonogram cron +## Cron Schedule -| Kiedy | Komenda | Opis | -|-------|---------|------| -| codziennie 23:59 | `timelapse_maker.py today` | Timelapse dzisiejszego dnia + czyszczenie starych JPG | -| co tydzien | `timelapse_maker.py week` | Timelapse tygodniowy (cel: 120s) | -| co miesiac | `timelapse_maker.py month` | Timelapse miesiac poprzedni (cel: 180s) | -| 31 grudnia 23:09 | `timelapse_maker.py year` | Timelapse roczny za miniony rok (cel: 300s) | +| When | Command | Description | +|------|---------|-------------| +| Daily 23:59 | `timelapse_maker.py today` | Today's timelapse + cleanup old JPGs | +| Weekly | `timelapse_maker.py week` | Weekly timelapse (target: 120s) | +| Monthly | `timelapse_maker.py month` | Previous month (target: 180s) | +| Dec 31 23:09 | `timelapse_maker.py year` | Previous year (target: 300s) | -Dla `week`, `month`, `year` - skrypt laczy dzienne MP4 i przyspiesza do docelowego czasu trwania. +For `week`, `month`, `year` - the script merges daily MP4s and speeds up to the target duration. -## Parametry CLI +## CLI Parameters ```bash -python3 timelapse_maker.py today # dzisiaj -python3 timelapse_maker.py 2025-01-15 # konkretna data -python3 timelapse_maker.py week # biezacy tydzien -python3 timelapse_maker.py month # poprzedni miesiac -python3 timelapse_maker.py year # poprzedni rok -python3 timelapse_maker.py today --cleanup # wymus czyszczenie JPG +python3 timelapse_maker.py today # Today +python3 timelapse_maker.py 2025-01-15 # Specific date +python3 timelapse_maker.py week # Current week +python3 timelapse_maker.py month # Previous month +python3 timelapse_maker.py year # Previous year +python3 timelapse_maker.py today --cleanup # Force JPG cleanup ``` -## Sciezki +## Paths -| Zrodlo JPG | `/media/seagata16t/hikvision16t///` | -|---|---| -| Wyniki MP4 | `/media/seagata16t/all_timelapses/timelapse__.mp4` | -| Logi cron | `/var/log/cron.log` wewnatrz kontenera | +| Source JPGs | `/media/seagata16t/hikvision16t///` | +|-------------|----------------------------------------------------------| +| Output MP4s | `/media/seagata16t/all_timelapses/timelapse__.mp4` | +| Cron logs | `/var/log/cron.log` inside container | -## Przydatne komendy +## Useful Commands ```bash -# Logi kontenera +# Follow container logs docker compose logs -f timelapse-service -# Reczne uruchomienie dla konkretnej daty +# Manual run for a specific date docker exec timelapse-service python3 /usr/src/app/timelapse_maker.py 2025-06-01 -# Reczne uruchomienie tygodniowego +# Manual weekly timelapse docker exec timelapse-service python3 /usr/src/app/timelapse_maker.py week -# Sprawdz logi cron wewnatrz kontenera +# Check cron logs inside container docker exec timelapse-service tail -100 /var/log/cron.log # Rebuild diff --git a/traefik/README.md b/traefik/README.md index 84ce654..3dabfb9 100644 --- a/traefik/README.md +++ b/traefik/README.md @@ -1,55 +1,59 @@ -# Traefik +# Traefik - Reverse Proxy -Reverse proxy dla wszystkich serwisów w stacku. Obsługuje routing HTTP/HTTPS, automatyczne certyfikaty TLS via Let's Encrypt (ACME) oraz middleware bezpieczenstwa. +> Single entry point for all services in the stack. Handles HTTP/HTTPS routing, automatic TLS certificates via Let's Encrypt (ACME), and security middleware. -## URL / Dostep +## Access -- Dashboard: https://traefik.sebson.space (basic auth: seba) -- Wejscie: port 80 (HTTP) i 443 (HTTPS) +| Endpoint | Details | +|----------|---------| +| Dashboard | https://traefik.sebson.space (basic auth: `seba`) | +| Entry points | Port 80 (HTTP) and 443 (HTTPS) | -## Konfiguracja +## Configuration -- Glowna konfiguracja statyczna: `./traefik/config/traefik.yml` -- Konfiguracja dynamiczna: `./traefik/config/dynamic_conf.yml` -- Certyfikaty ACME (Let's Encrypt): `./traefik/letsencrypt/acme.json` (chmod 600) -- ACME email: rewelacyjny.rower@gmail.com -- Serwisy rejestruja sie automatycznie przez Docker labels (`traefik.enable=true`) +- **Static config:** `./traefik/config/traefik.yml` +- **Dynamic config:** `./traefik/config/dynamic_conf.yml` +- **ACME certs:** `./traefik/letsencrypt/acme.json` (must be `chmod 600`) +- **ACME email:** rewelacyjny.rower@gmail.com +- Services auto-register via Docker labels (`traefik.enable=true`) ### Middleware -- `crowdsec@file` - integracja z CrowdSec (ForwardAuth do `traefik-bouncer:8080`) -- `my-geoblock` - blokada geograficzna, przepuszcza tylko CH (Szwajcaria) + lokalne +| Middleware | Purpose | +|------------|---------| +| `crowdsec@file` | CrowdSec integration (ForwardAuth to `traefik-bouncer:8080`) | +| `my-geoblock` | Geographic block - allows only Switzerland (CH) + local ranges | ### Plugin -- `geoblock` v0.2.8 (github.com/PascalMinder/geoblock) +- **geoblock** v0.2.8 ([github.com/PascalMinder/geoblock](https://github.com/PascalMinder/geoblock)) -## Storage / Dane +## Storage -| Sciezka | Zawartosc | -|---------|-----------| +| Path | Contents | +|------|----------| | `./traefik/config/` | traefik.yml, dynamic_conf.yml | -| `./traefik/letsencrypt/acme.json` | certyfikaty TLS | -| `./traefik/logs/access.log` | logi dostepu (czytane przez CrowdSec i Promtail) | +| `./traefik/letsencrypt/acme.json` | TLS certificates | +| `./traefik/logs/access.log` | Access logs (consumed by CrowdSec and Promtail) | -## Powiazania +## Dependencies -- **CrowdSec** - analizuje `access.log`, bouncer blokuje zle IP -- **Promtail** - pobiera `access.log` do Loki -- **Prometheus** - metryki wbudowane w Traefik -- Kazdy serwis z `traefik.enable=true` jest automatycznie rejestrowany +- **CrowdSec** - analyzes `access.log`, bouncer blocks bad IPs +- **Promtail** - ships `access.log` to Loki +- **Prometheus** - built-in Traefik metrics +- Every service with `traefik.enable=true` is auto-registered -## Przydatne komendy +## Useful Commands ```bash -# Logi Traefika +# Follow Traefik logs docker compose logs -f traefik -# Sprawdzenie certyfikatow (plik musi miec 600) +# Check certificate file permissions (must be 600) ls -la traefik/letsencrypt/acme.json -# Reload konfiguracji dynamicznej (bez restartu) -# Traefik wykrywa zmiany w dynamic_conf.yml automatycznie +# Dynamic config reload (no restart needed) +# Traefik auto-detects changes in dynamic_conf.yml # Restart docker compose restart traefik diff --git a/transmission-vpn/README.md b/transmission-vpn/README.md index 48247c9..fb5908a 100644 --- a/transmission-vpn/README.md +++ b/transmission-vpn/README.md @@ -1,50 +1,52 @@ -# Transmission VPN +# Transmission VPN - Legacy -Klient torrent Transmission tunelowany przez NordVPN (OpenVPN). +> Torrent client tunneled through NordVPN (OpenVPN). -> **LEGACY** - Ten kontener zostal zastapiony przez `torrent-box-with-vpn` (w katalogu `./torrent-box-with-vpn/`). Pozostawiony dla kompatybilnosci wstecznej. +> **DEPRECATED** - This service has been replaced by [`torrent-box-with-vpn`](../torrent-box-with-vpn/). Kept for backward compatibility only. -## URL / Dostep +## Access -- Web UI: http://localhost:9092 (port 9092->9091) -- Brak publicznego dostepu przez Traefik +| Endpoint | Details | +|----------|---------| +| Web UI | http://localhost:9092 (port mapping: 9092->9091) | +| Public access | None | -## Konfiguracja +## Configuration -- Obraz: `haugene/transmission-openvpn` -- VPN: NordVPN (OPENVPN_PROVIDER=NORDVPN), serwery DE (Niemcy) -- Dane dostepu VPN z `.env` (OPENVPN_USERNAME, OPENVPN_PASSWORD) -- Wymaga `NET_ADMIN` capability (tun/tap dla OpenVPN) +- **Image:** `haugene/transmission-openvpn` +- **VPN:** NordVPN (`OPENVPN_PROVIDER=NORDVPN`), DE (Germany) servers +- **Credentials:** from `.env` (`OPENVPN_USERNAME`, `OPENVPN_PASSWORD`) +- **Capability:** requires `NET_ADMIN` (tun/tap for OpenVPN) -## Storage / Dane +## Storage -| Sciezka | Zawartosc | -|---------|-----------| -| `./transmission-vpn/completed/` | ukonczane pobierania | -| `./transmission-vpn/incomplete/` | pobierania w toku | -| `./transmission-vpn/watch/` | katalog watch (automatyczne dodawanie .torrent) | -| `./transmission-vpn/music_downloads/` | pobrane pliki muzyczne | -| `./transmission-vpn/transmission-home/` | konfiguracja Transmission | -| `./transmission-vpn/shared/` | katalog wspolny | +| Path | Contents | +|------|----------| +| `./transmission-vpn/completed/` | Completed downloads | +| `./transmission-vpn/incomplete/` | In-progress downloads | +| `./transmission-vpn/watch/` | Watch folder (auto-add .torrent files) | +| `./transmission-vpn/music_downloads/` | Music downloads | +| `./transmission-vpn/transmission-home/` | Transmission configuration | +| `./transmission-vpn/shared/` | Shared directory | -## Powiazania +## Notes -- **NordVPN** - caly ruch routowany przez VPN (kill switch aktywny) -- Nowy stack: `./torrent-box-with-vpn/` (preferowany) +- All traffic is routed through VPN (kill switch active) +- The preferred replacement stack is in `./torrent-box-with-vpn/` -## Przydatne komendy +## Useful Commands ```bash -# Logi +# Follow logs docker compose logs -f transmission-vpn -# Sprawdzenie IP VPN (powinno pokazac DE) +# Verify VPN IP (should show Germany) docker exec transmission-vpn curl -s https://ipinfo.io/ip # Restart docker compose restart transmission-vpn -# Nowy preferowany stack +# Migrate to new stack cd /home/seba/mydocker/torrent-box-with-vpn make start ``` diff --git a/unifi-config/README.md b/unifi-config/README.md index e066fdf..47bf5ee 100644 --- a/unifi-config/README.md +++ b/unifi-config/README.md @@ -1,48 +1,50 @@ -# UniFi Controller +# UniFi Controller - Network Management -Kontroler sieci UniFi (Ubiquiti) do zarzadzania punktami dostepu i switchami. +> Ubiquiti UniFi network controller for managing access points and switches. -## URL / Dostep +## Access -- Panel: https://192.168.1.239:8443 (lokalna siec) -- Traefik proxy: skonfigurowane jako `unifi-svc` w `traefik.yml` -- Siec: `network_mode: host` (wymagane do device discovery / mDNS) +| Endpoint | Details | +|----------|---------| +| Panel | https://192.168.1.239:8443 (LAN only) | +| Traefik proxy | Configured as `unifi-svc` in `traefik.yml` | +| Network | `network_mode: host` (required for device discovery / mDNS) | -## Konfiguracja +## Configuration -- Obraz: `jacobalberty/unifi` -- Siec: host network (port 8443 HTTPS, 8080 HTTP, 3478/UDP STUN, 6789 speed test) -- Baza danych: MongoDB 7.0 na `localhost:27017` (kontener `unifi-db`) -- Konfiguracja przez zmienne w `.env` +- **Image:** `jacobalberty/unifi` +- **Network:** host network (ports: 8443 HTTPS, 8080 HTTP, 3478/UDP STUN, 6789 speed test) +- **Database:** MongoDB 7.0 on `localhost:27017` (container `unifi-db`) -## Storage / Dane +## Storage -| Sciezka | Zawartosc | -|---------|-----------| -| `./unifi-config/data/` | konfiguracja kontrolera, certyfikaty | -| `./unifi-config/log/` | logi aplikacji | -| `./unifi-config/run/` | pliki PID / runtime | +| Path | Contents | +|------|----------| +| `./unifi-config/data/` | Controller configuration, certificates | +| `./unifi-config/log/` | Application logs | +| `./unifi-config/run/` | PID / runtime files | -Baza MongoDB trzyma swoje dane w `./unifi-db/`. +MongoDB data stored in `./unifi-db/`. -## Powiazania +## Dependencies -- **unifi-db** - MongoDB 7.0, baza danych kontrolera -- **Traefik** - proxy do panelu (passHostHeader: false) -- Host network - wymagany do automatycznego wykrywania urzadzen w sieci LAN +- **unifi-db** - MongoDB 7.0, controller database +- **Traefik** - proxy to panel (passHostHeader: false) +- **Host network** - required for automatic LAN device discovery -## Przydatne komendy +## Useful Commands ```bash -# Logi kontrolera +# Follow controller logs docker compose logs -f unifi -# Logi MongoDB +# Follow MongoDB logs docker compose logs -f unifi-db # Restart docker compose restart unifi unifi-db -# Backup konfiguracji (przez panel: Settings > Backup) -# Lub reczne skopiowanie ./unifi-config/data/ +# Backup configuration +# Via panel: Settings > Backup +# Or manually copy ./unifi-config/data/ ``` diff --git a/uptime-kuma/README.md b/uptime-kuma/README.md new file mode 100644 index 0000000..0096486 --- /dev/null +++ b/uptime-kuma/README.md @@ -0,0 +1,57 @@ +# Uptime Kuma - Uptime Monitoring + +> Self-hosted uptime monitoring with status pages. Monitors HTTP(S), TCP, DNS, ICMP and more. Sends notifications on downtime. + +## Access + +| Endpoint | Details | +|----------|---------| +| Public URL | https://kuma.sebson.space | +| Internal Port | 3001 | +| Auth | Shared Traefik basic auth (same as Traefik dashboard / Prometheus) | + +## Configuration + +- **Image:** `louislam/uptime-kuma:1` +- **Data:** `./uptime-kuma/data/` (SQLite database, all config persisted) +- Setup done via web UI on first access + +## Features + +- Monitoring protocols: HTTP(s), TCP, Ping, DNS, Docker containers, and more +- Status pages with custom domains +- Notifications via Telegram, Gotify, email, webhook, and 40+ more +- 20-second check interval +- Certificate expiry monitoring +- Multi-language support + +## Typical Monitors to Add + +| Monitor | Type | Target | +|---------|------|--------| +| Traefik | HTTPS | https://traefik.sebson.space | +| Home Assistant | HTTPS | https://ha.sebson.space | +| Grafana | HTTPS | https://grafana.sebson.space | +| Bitwarden | HTTPS | https://bward.sebson.space | +| Immich | HTTPS | https://immch.sebson.space | +| Jellyfin | HTTPS | https://jfin.sebson.space | +| Prometheus | HTTPS | https://prom.sebson.space | +| HA Dashboard | HTTPS | https://hadash.sebson.space | +| MikroTik | Ping | 192.168.1.1 | +| Internet | Ping | 8.8.8.8 | + +## Useful Commands + +```bash +# Start +docker compose up -d uptime-kuma + +# Follow logs +docker compose logs -f uptime-kuma + +# Restart +docker compose restart uptime-kuma + +# Stop +docker compose stop uptime-kuma +``` diff --git a/uptime-kuma/data/.env_host b/uptime-kuma/data/.env_host new file mode 100644 index 0000000..e69de29