Docker Setups

Feel free to use these setups as inspiration for your own servers (i.e. create a fork). If you have any questions or ideas, open an issue or message me at mail@chris.besch.com.

Run ansible-galaxy collection install community.docker on host.

Users

• freeman: user with passwordless sudo rights
• apprun: user in docker group, runs applications
• root: disabled

Install Procedure Hetzner

• Create new server
• add new host to inventory to hetzner group
• add ssh config for server
• ssh root@[server ip]
• ansible-playbook -i production.yml playbook/prepare_server.yml -l amd64hetzner11
• ansible-playbook -i production.yml playbook/install_server.yml -l amd64hetzner11
• ansible-playbook -i production.yml playbook/update_server.yml -l amd64hetzner11
• Possibly run ansible-playbook -i production.yml playbook/down_container.yml if you don't have a proper backup to load
• create backup tar on old server, copy over untar in /home/apprun/app using sudo tar --same-owner -xvf file.tar
• ansible-playbook -i production.yml playbook/install_container.yml

Install Procedure server PC

• put debian live-installation on USB stick
• enable root user with simple password
• create user chris with simple password
• userdel chris
• apt update && apt install -y curl python3 sudo
• curl -L -o ~/.ssh/authorized_keys chris-besch.com/ssh && chmod 600 ~/.ssh/authorized_keys
• ip a: get ip address
• add new host to inventory
• ssh root@[server ip]
• ansible-playbook -i production.yml playbook/prepare_server.yml
• ansible-playbook -i production.yml playbook/install_server.yml
• ansible-playbook -i production.yml playbook/update_server.yml
• ansible-playbook -i production.yml playbook/install_container.yml

Install Procedure Raspberry Pi

• install raspbery pi imager
• install Raspberry Pi OS Lite with
  • username: pi
  • password: raspberry
  • no wifi
  • locale: timezone Etc/UTC, keyboard: gb
  • ssh settings: chris.pub key
• add new host to inventory to raspberry group
• ssh pi@[server ip]
• ansible-playbook -i production.yml playbook/prepare_server.yml
• ansible-playbook -i production.yml playbook/install_server.yml
• ansible-playbook -i production.yml playbook/update_server.yml
• Possibly run ansible-playbook -i production.yml playbook/down_container.yml if you don't have a proper backup to load
• create backup tar on old server, copy over untar in /home/apprun/app using sudo tar --same-owner -xvf file.tar
• ansible-playbook -i production.yml playbook/install_container.yml

Maintenance Procedure

• run forgejo_git_backup
• update https://github.com/ankitects/anki/tree/main/docs/syncserver:
  • git clone --depth 1 https://github.com/ankitects/anki && cd anki/docs/syncserver
  • sudo docker build --no-cache --build-arg ANKI_VERSION=25.09 -t chrisbesch/anki_sync_server:25.09 . && sudo docker push chrisbesch/anki_sync_server:25.09
• check last
• check df -h
• ansible-playbook -i production.yml playbook/down_container.yml -l amd64hetzner10
• enable external hetzner box access and ssh
• sudo tar -cvf /home/apprun/box/borg/amd64hetzner10_backup_2026_01_31.tar /home/apprun/app
• rsync --dry-run --delete --exclude selchris_music --exclude jonas_music -avP u370909@u370909.your-storagebox.de:/home/nextcloud_lfs/ /home/chris/files/backup/server/nextcloud_lfs/ (remove --dry-run)
• rsync --dry-run --delete -avP u370909@u370909.your-storagebox.de:/home/forgejo_box/ /home/chris/files/backup/server/forgejo_box/ (remove --dry-run)
• rsync --dry-run --delete -avP apprun@nextcloud.chris-besch.com:/home/apprun/box/images/backups/ /home/chris/files/images/immich/backups/
• rsync --dry-run --delete -avP apprun@nextcloud.chris-besch.com:/home/apprun/box/images/library/ /home/chris/files/images/immich/library/
• bump versions from renovate PRs
• update immich monorepo dependencies by checking the instructions in docker_immich/templates/docker-compose.yml.j2
• rsync --dry-run -avP u370909@u370909.your-storagebox.de:/home/docker_backup/amd64hetzner10_backup_2026_01_31.tar /home/chris/files/backup/server/amd64hetzner10_backup_2026_01_31.tar
• maybe delete old backup on server and locally
• check archive integrity sha1sum amd64hetzner10_backup_2024_08_05.tar
• disable external box access and ssh
• ansible-playbook -i production.yml playbook/update_server.yml -l amd64hetzner10
• ansible-playbook -i production.yml playbook/pull_container.yml -l amd64hetzner10
• docker exec -ti --user www-data NCFrontend /var/www/html/occ upgrade
• docker exec -ti --user www-data NCFrontend /var/www/html/occ db:add-missing-indices
• docker exec -ti --user www-data NCFrontend /var/www/html/occ maintenance:repair --include-expensive
• check https://nextcloud.chris-besch.com/settings/admin/overview
• check https://nextcloud.chris-besch.com/settings/admin
• update apps at https://nextcloud.chris-besch.com/settings/apps/installed
• docker system prune -a
• check df -h
• (copy password files (and other relevant stuff) to files drive)
• create backup on external hard drive rsync -aHvh --delete --info=progress2 /home/chris/files /backup/destination/
• run renovate docker kill -s HUP forgejo-Renovate-1

Upgrade Postgresql for Tandoor

1. sudo cp -r /home/chris/docker_data/tandoor/ /home/chris/tandoor.bak
2. docker exec -t TDDatabase_chris_tandoor pg_dumpall -U tandoor > /home/chris/dump
3. shut down docker containers
4. remove other container from docker-compose.yaml, update to new postgres version and mount /home/chris/dump to /dump
5. sudo rm -r /home/chris/docker_data/tandoor/td_postgres
6. start container
7. docker exec -t -i TDDatabase_chris_tandoor /bin/sh and then psql -U tandoor tandoordb < /dump in container with
8. cp /home/chris/tandoor.bak/td_postgres/{pg_hba.conf,postgresql.conf} /home/chris/docker_data/tandoor/td_postgres/
9. stop containers
10. reset docker-compose.yaml and set new postgres/tandoor version
11. start container

• from here

Resolve Locked Nextcloud Files

1. docker exec -ti --user www-data NCFrontend_chris_nextcloud /var/www/html/occ maintenance:mode --on
2. docker exec -it NCDatabase_chris_nextcloud bash
3. mariadb -u nextcloud -p -D NC -e "DELETE FROM oc_file_locks WHERE 1"
4. docker exec -ti --user www-data NCFrontend_chris_nextcloud /var/www/html/occ maintenance:mode --off

• https://zedt.eu/tech/linux/how-to-clean-up-nextcloud-stale-locked-files/

Other Nextcloud Commands

• sudo docker exec -ti --user www-data NCFrontend_chris_nextcloud /var/www/html/occ files:scan --all
• sudo docker exec -ti --user www-data NCFrontend_chris_nextcloud /var/www/html/occ trashbin:cleanup --all-users

Attach to Minecraft Console

• docker attach Minecraft
• Ctrl-p Ctrl-q to detach

Node-Red

• configure ansible/playbook/roles/docker_node_red/files/configuration.yaml mqtt server
• mkdir /home/apprun/app/node_red/node_red_data
• sudo chown 1000:1000 /home/apprun/app/node_red/node_red_data
• set password: https://nodered.org/docs/user-guide/runtime/securing-node-red#http-node-security
• set mosquitto passwords for all consumers in ansible/playbook/roles/docker_node_red/files/mosquitto_passwords.txt

OpenVPN

• tutorial for openvpn-install: https://linuxdevel.github.io/openvpn/installation.html#step-5-install-openvpn
• https://github.com/angristan/openvpn-install
• config sample: https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf
• OpenVPN bridge mode setup: https://openvpn.net/community-docs/ethernet-bridging.html
• easy-rsa: https://github.com/OpenVPN/easy-rsa/blob/master/README.quickstart.md

sudo apt update && sudo apt install -y bridge-utils && \
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && \
chmod +x ./openvpn-install.sh && \
sudo ./openvpn-install.sh install -i

IPv4
[leave ip]
IPv4 only
10.67.69.0
1194
UDP
/etc/resolv.conf
n[o multi device]
1500
peer fingerprint
[no custom encryption]
linus
[leave time]
passwordless

sudo ./openvpn-install.sh client add chris && \
sudo systemctl stop openvpn && \
sudo cp /usr/share/doc/openvpn/examples/sample-scripts/bridge-start /etc/openvpn/bridge-start && \
sudo cp /usr/share/doc/openvpn/examples/sample-scripts/bridge-stop /etc/openvpn/bridge-stop && \
sudo vi /etc/openvpn/bridge-start

eth="eth0"
eth_ip="46.225.211.134"
eth_netmask="255.255.255.255"
eth_broadcast="46.225.211.134"
# remove everything that does anything to eth0

vi chris.ovpn # replace `dev tun` with `dev tap`
vi linus.ovpn # replace `dev tun` with `dev tap`
sudo vi /etc/openvpn/server/server.conf

dev tap0
server-bridge 10.67.69.0 255.255.255.0 10.67.69.50 10.67.69.100

sudo /etc/openvpn/bridge-start