From 649c121fd25ec6209cd385197d8ac9773a78ca1d Mon Sep 17 00:00:00 2001 From: cjones Date: Sun, 12 Apr 2026 10:48:53 -0400 Subject: [PATCH 01/11] Add lambdesktop.objectbrokers.com to Unbound views. --- devices/teal/config/usr/local/etc/unbound/unbound.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/teal/config/usr/local/etc/unbound/unbound.conf b/devices/teal/config/usr/local/etc/unbound/unbound.conf index 59362e5..d3a101c 100644 --- a/devices/teal/config/usr/local/etc/unbound/unbound.conf +++ b/devices/teal/config/usr/local/etc/unbound/unbound.conf @@ -57,6 +57,7 @@ view: local-data: "portainer.objectbrokers.com. A 192.168.88.231" local-data: "jellyfin.objectbrokers.com. A 192.168.88.231" local-data: "vaultwarden.objectbrokers.com. A 192.168.88.231" + local-data: "lambdesktop.objectbrokers.com. A 192.168.88.187" view: name: "tailnet" @@ -70,6 +71,7 @@ view: local-data: "portainer.objectbrokers.com. A 100.81.165.11" local-data: "jellyfin.objectbrokers.com. A 100.81.165.11" local-data: "vaultwarden.objectbrokers.com. A 100.81.165.11" + local-data: "lambdesktop.objectbrokers.com. A 100.95.22.24" remote-control: control-enable: yes From d67305f87a04df7b9c9ea32376dce68dd7114a94 Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Sun, 12 Apr 2026 10:51:30 -0400 Subject: [PATCH 02/11] Add lambdesktop.objectbrokers.com to Unbound views. --- devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf b/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf index 59362e5..d3a101c 100644 --- a/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf +++ b/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf @@ -57,6 +57,7 @@ view: local-data: "portainer.objectbrokers.com. A 192.168.88.231" local-data: "jellyfin.objectbrokers.com. A 192.168.88.231" local-data: "vaultwarden.objectbrokers.com. A 192.168.88.231" + local-data: "lambdesktop.objectbrokers.com. A 192.168.88.187" view: name: "tailnet" @@ -70,6 +71,7 @@ view: local-data: "portainer.objectbrokers.com. A 100.81.165.11" local-data: "jellyfin.objectbrokers.com. A 100.81.165.11" local-data: "vaultwarden.objectbrokers.com. A 100.81.165.11" + local-data: "lambdesktop.objectbrokers.com. A 100.95.22.24" remote-control: control-enable: yes From d765d8513e188aecef23e888c5a1bd7059f2ca4b Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Fri, 17 Apr 2026 12:43:19 -0400 Subject: [PATCH 03/11] reset gitea token --- another.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 another.md diff --git a/another.md b/another.md new file mode 100644 index 0000000..e36db06 --- /dev/null +++ b/another.md @@ -0,0 +1,6 @@ +This Git repository records the configuration of the Jones family network, and the system configurations of the devices and services that make up the network. + +Directories defined at this level include: +* devices - System configurations of the devices owned by the family and connected to the network +* services - Configuration of services available on the network +* network - Topology and design of the network itself From 4bf3776253d843998a199c2d085e9330e82e1d60 Mon Sep 17 00:00:00 2001 From: cjones Date: Fri, 17 Apr 2026 13:28:28 -0400 Subject: [PATCH 04/11] still trying to fix GCM --- yetanother.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 yetanother.md diff --git a/yetanother.md b/yetanother.md new file mode 100644 index 0000000..e36db06 --- /dev/null +++ b/yetanother.md @@ -0,0 +1,6 @@ +This Git repository records the configuration of the Jones family network, and the system configurations of the devices and services that make up the network. + +Directories defined at this level include: +* devices - System configurations of the devices owned by the family and connected to the network +* services - Configuration of services available on the network +* network - Topology and design of the network itself From f1aa9639f5b01a5f0d83d6d359fd4c65b4e66287 Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Fri, 17 Apr 2026 23:33:24 -0400 Subject: [PATCH 05/11] Complete documentation of the Nextcloud upgrade process --- services/nextcloud/upgrading.md | 34 +++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/services/nextcloud/upgrading.md b/services/nextcloud/upgrading.md index 4033d07..a17e721 100644 --- a/services/nextcloud/upgrading.md +++ b/services/nextcloud/upgrading.md @@ -1,16 +1,30 @@ -Steps to upgrade Nextcloud from one version to another. +Steps to upgrade Nextcloud from one major version to the next. -1. Put the Nextcloud instance into maintenance mode - docker exec --user www-data nextcloud-app-1 php occ maintenance:mode --on +1. Put the Nextcloud instance into maintenance mode + docker exec --user www-data nextcloud-app-1 php occ maintenance:mode --on - Note that 'docker exec' is used to run commands within the Nextcloud docker container; and '--user www-data' is used to run as the user that owns all of the Nextcloud files. + Note that 'docker exec' is used to run commands within the Nextcloud docker container; and '--user www-data' is used to run as the user that owns all of the Nextcloud files. +2. Back up the Nextcloud container's files to a location outside the container's mounted volume. 'rsync' is recommended: -2. Back up the Nextcloud container's files to a location outside the container's mounted volume. 'rsync' is recommended: + rsync -Aavx /mnt/storage/appdata/nextcloud/www/ / - rsync -Aavx /mnt/storage/appdata/nextcloud/www/ / + rsync should be run as root. rsync with these options should preserve file ownership & permissions. + +3. Back up MariaDB database: - rsync should be run as root. rsync with these options should preserve file ownership & permissions + docker exec nextcloud-db-container-name mysqldump --single-transaction -h localhost -u nextcloud_user -pnextcloud_password nextcloud_db_name > nextcloud-sqlbkp_$(date +"%Y%m%d").bak +4. Alternatively, if the Nextcloud files and database are stored in a ZFS dataset, take a ZFS snapshot of the relevant dataset(s). -3. Back up MariaDB database: - - docker exec nextcloud-db-container-name mysqldump --single-transaction -h localhost -u nextcloud_user -pnextcloud_password nextcloud_db_name > nextcloud-sqlbkp_$(date +"%Y%m%d").bak +5. Bring the Nextcloud instance down: + sudo docker compose down +6. Edit the compose.yaml file and change the tag on the Nextcloud image to the next major version number. +7. Pull the next version of the Nextcloud image: + sudo docker compose pull +8. Bring up the Nextcloud instance: + sudo docker compose up -d +9. Wait a minute or so and bring up the Nextcloud web client in your browser. Open the Administrative Settings Overview page and check for any issues. +10. If the Overview page recommends any occ commands: + * Put the instance into maintenance mode : docker exec -u www-data nextcloud-app-1 php occ maintenance:mode --on + * Run the occ commands recommended (for example, docker exec -u www-data nextcloud-app-1 php occ db:add-missing-indices) + * Take the instance out of maintenance mode: docker exec -u www-data nextcloud-app-1 php occ maintenance:mode --off + \ No newline at end of file From 15ee31660ba82ddd96f66a97dd9d57b3f3753c8c Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Sat, 18 Apr 2026 15:22:47 -0400 Subject: [PATCH 06/11] Add overall policy for software upgrades. Revise upgrade notes for Nextcloud. --- services/nextcloud/upgrading.md | 38 +++++++++++---------------------- services/upgrades.md | 30 ++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 25 deletions(-) create mode 100644 services/upgrades.md diff --git a/services/nextcloud/upgrading.md b/services/nextcloud/upgrading.md index a17e721..05449f9 100644 --- a/services/nextcloud/upgrading.md +++ b/services/nextcloud/upgrading.md @@ -1,30 +1,18 @@ Steps to upgrade Nextcloud from one major version to the next. -1. Put the Nextcloud instance into maintenance mode - docker exec --user www-data nextcloud-app-1 php occ maintenance:mode --on - - Note that 'docker exec' is used to run commands within the Nextcloud docker container; and '--user www-data' is used to run as the user that owns all of the Nextcloud files. -2. Back up the Nextcloud container's files to a location outside the container's mounted volume. 'rsync' is recommended: - - rsync -Aavx /mnt/storage/appdata/nextcloud/www/ / - - rsync should be run as root. rsync with these options should preserve file ownership & permissions. - -3. Back up MariaDB database: - - docker exec nextcloud-db-container-name mysqldump --single-transaction -h localhost -u nextcloud_user -pnextcloud_password nextcloud_db_name > nextcloud-sqlbkp_$(date +"%Y%m%d").bak -4. Alternatively, if the Nextcloud files and database are stored in a ZFS dataset, take a ZFS snapshot of the relevant dataset(s). - -5. Bring the Nextcloud instance down: +1. Bring the Nextcloud instance down: sudo docker compose down -6. Edit the compose.yaml file and change the tag on the Nextcloud image to the next major version number. -7. Pull the next version of the Nextcloud image: +2. Take a ZFS snapshot of the tank/appdata/data/nextcloud-data and tank/appdata/databases/nextcloud-db dataset(s). +3. Edit the compose.yaml file and change the tag on the Nextcloud image to the next major version number. +4. Pull the next version of the Nextcloud image: sudo docker compose pull -8. Bring up the Nextcloud instance: +5. Bring up the Nextcloud instance: sudo docker compose up -d -9. Wait a minute or so and bring up the Nextcloud web client in your browser. Open the Administrative Settings Overview page and check for any issues. -10. If the Overview page recommends any occ commands: - * Put the instance into maintenance mode : docker exec -u www-data nextcloud-app-1 php occ maintenance:mode --on - * Run the occ commands recommended (for example, docker exec -u www-data nextcloud-app-1 php occ db:add-missing-indices) - * Take the instance out of maintenance mode: docker exec -u www-data nextcloud-app-1 php occ maintenance:mode --off - \ No newline at end of file +6. Wait a minute or so and bring up the Nextcloud web client in your browser. Open the Administrative Settings Overview page and check for any issues. +8. If the Overview page recommends any occ commands: + + * Put the instance into maintenance mode : docker exec -u www-data nextcloud-app-1 php occ maintenance:mode --on + * Run the occ commands recommended (for example, docker exec -u www-data nextcloud-app-1 php occ db:add-missing-indices) + * Take the instance out of maintenance mode: docker exec -u www-data nextcloud-app-1 php occ maintenance:mode --off + + Note that 'docker exec' is used to run commands within the Nextcloud docker container; and '--user www-data' is used to run as the user that owns all of the Nextcloud files. diff --git a/services/upgrades.md b/services/upgrades.md new file mode 100644 index 0000000..06ad88e --- /dev/null +++ b/services/upgrades.md @@ -0,0 +1,30 @@ +# Upgrade Cadence For OS And Services + +The overall policy for software upgrades is to keep up with the most recent stable release of any operating system or service running on any of our devices. When a new major version of a service is released, we can upgrade right away (especially if the project or vendor has earned a reputation for stability); or it is acceptable to wait for a point release (or simply the passage of a month or so) to avoid breakage. + +For operating systems, we rely on the update facility of the OS vendor to provide timely updates, especially for security vulnerabilities. + +## Notes for specific software + +### Operating Systems + +* **Microsoft Windows**. Microsoft doesn't allow much leeway here. To ensure security and full support on our Windows client devices, we let Windows Update handle this according to the normal Microsoft schedule. +* **Ubuntu**. All Unbuntu servers are currently on version 24.04 LTS. When Canonical provides an update (particularly for security issues) it should be applied in a reasonably timely fashion. When a major LTS version is available (e.g. 26.04), we will wait for a point release before upgrading to the next point release. +* **Fedora**. Fedora is currently running only on a client device. When a major release is available, we will wait for a point release in the interest of stability, and then upgrade at our leisure. We should not, however, allow Fedora to be more than one major version behind. Check Fedora release status quarterly. +* **Raspbian**. Currently only one device (raspberrygrove) is running Raspbian (Buster). Rather than upgrade to Raspberry Pi OS Trixie, we will install Ubuntu on this device, probably after Ubuntu 26.04 LTS is available has been installed on our other Ubuntu servers. From then on, raspberrygrove will follow the same upgrade cadence as other Ubuntu servers. +* **Android and iOS**. Like Microsoft, Google and Apple keep a tight rein on this. We will let the OS vendors drive the upgrade cadence for mobile clients. + +### Local Services + +For Docker-based services (and anything else that is installed to our ZFS pool), take a ZFS snapshot of the relevant dataset(s) before doing the upgrade. For Docker containers specifically, first bring the service down before taking the snapshot. Don't rely on the regular snapshots scheduled by Sanoid; snapshots taken while a Docker instance is running may not be consistent, if a database is involved. +* **caddy**. Upgrade to major releases only. +* **gitea**. Upgrade to major releases only. +* **immich**. Immich have a history of rapid development and breaking changes. Even though the project has now released a "stable" version, we will continue to be cautious. Experience with Immich has shown that upgrading each minor release one by one, with a ZFS snapshot to roll back to, is the best practice. +* **jellyfin**. Upgrade to major releases only. +* **nextcloud**. Upgrade to major releases only. +* **portainer**. Upgrade to major releases only. +* **sanoid**. Upgrade to major releases only. +* **tailscale**. As a key part of the "network operating system", it's worth keeping Tailscale continuously up to date. Tailscale have earned a reputation for quality and stability. Therefore we will monitor the Tailscale admin console and ensure that all devices are up to date at least monthly. +* **unbound**. Upgrade to major releases only. +* **vaultwarden**. Upgrade for both major and minor releases. Password managers are a high-value target, so being up to date with security fixes is particularly important. +* **zfs**. ZFS is provided by Canonical and is effectively part of the OS. We will upgrade ZFS as part of the OS upgrade process for Ubuntu. (Subject to change, of course, if ZFS is installed on a non-Ubuntu device.) From fbf79f6ad6c5e4e7417dfbaa1c2d3199ba2ea5e5 Mon Sep 17 00:00:00 2001 From: cjones Date: Sat, 18 Apr 2026 17:41:10 -0400 Subject: [PATCH 07/11] Cleaning up from GCM credentials configuration. --- another.md | 6 ------ yetanother.md | 6 ------ 2 files changed, 12 deletions(-) delete mode 100644 another.md delete mode 100644 yetanother.md diff --git a/another.md b/another.md deleted file mode 100644 index e36db06..0000000 --- a/another.md +++ /dev/null @@ -1,6 +0,0 @@ -This Git repository records the configuration of the Jones family network, and the system configurations of the devices and services that make up the network. - -Directories defined at this level include: -* devices - System configurations of the devices owned by the family and connected to the network -* services - Configuration of services available on the network -* network - Topology and design of the network itself diff --git a/yetanother.md b/yetanother.md deleted file mode 100644 index e36db06..0000000 --- a/yetanother.md +++ /dev/null @@ -1,6 +0,0 @@ -This Git repository records the configuration of the Jones family network, and the system configurations of the devices and services that make up the network. - -Directories defined at this level include: -* devices - System configurations of the devices owned by the family and connected to the network -* services - Configuration of services available on the network -* network - Topology and design of the network itself From cf23313e0ba539d09c59c7d5e192c144bed44307 Mon Sep 17 00:00:00 2001 From: cjones Date: Thu, 4 Jun 2026 17:41:59 -0400 Subject: [PATCH 08/11] Configure unbound to support running behind keepalived --- devices/teal/config/usr/local/etc/unbound/unbound.conf | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/devices/teal/config/usr/local/etc/unbound/unbound.conf b/devices/teal/config/usr/local/etc/unbound/unbound.conf index d3a101c..a0a1c74 100644 --- a/devices/teal/config/usr/local/etc/unbound/unbound.conf +++ b/devices/teal/config/usr/local/etc/unbound/unbound.conf @@ -15,7 +15,13 @@ prefetch: yes serve-expired: yes # the interface that is used to connect to the network (this will listen to all interfaces) - interface: 0.0.0.0 + # interface: 0.0.0.0 + interface: 192.168.88.231 + interface: 192.168.88.8 + interface: 127.0.0.1 + interface: 100.81.165.11 + so-reuseport: yes + ip-freebind: yes # interface: ::0 private-address: 192.168.0.0/16 private-address: 100.64.0.0/10 @@ -58,6 +64,7 @@ view: local-data: "jellyfin.objectbrokers.com. A 192.168.88.231" local-data: "vaultwarden.objectbrokers.com. A 192.168.88.231" local-data: "lambdesktop.objectbrokers.com. A 192.168.88.187" + local-data: "beszel.objectbrokers.com. A 192.168.88.231" view: name: "tailnet" @@ -72,6 +79,7 @@ view: local-data: "jellyfin.objectbrokers.com. A 100.81.165.11" local-data: "vaultwarden.objectbrokers.com. A 100.81.165.11" local-data: "lambdesktop.objectbrokers.com. A 100.95.22.24" + local-data: "beszel.objectbrokers.com. A 100.81.165.11" remote-control: control-enable: yes From b238d5382558b0799ea793f1057a17115d690faa Mon Sep 17 00:00:00 2001 From: cjones Date: Sat, 6 Jun 2026 11:07:24 -0400 Subject: [PATCH 09/11] Add access-control-view directive so that queries on localhost use the lan view. --- devices/teal/config/usr/local/etc/unbound/unbound.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/devices/teal/config/usr/local/etc/unbound/unbound.conf b/devices/teal/config/usr/local/etc/unbound/unbound.conf index a0a1c74..1bf4e2f 100644 --- a/devices/teal/config/usr/local/etc/unbound/unbound.conf +++ b/devices/teal/config/usr/local/etc/unbound/unbound.conf @@ -37,6 +37,7 @@ access-control-view: 192.168.88.0/24 lan access-control-view: 100.64.0.0/10 tailnet + access-control-view: 127.0.0.0/8 lan do-ip4: yes do-ip6: no From c7524136c548ea829d78756d024bc909ab39b451 Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Sat, 6 Jun 2026 11:19:35 -0400 Subject: [PATCH 10/11] Add access-control-view directive so that queries on localhost use the lan view. --- .../config/usr/local/etc/unbound/unbound.conf | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf b/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf index d3a101c..7fd4310 100644 --- a/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf +++ b/devices/cranberrypi/config/usr/local/etc/unbound/unbound.conf @@ -15,7 +15,13 @@ prefetch: yes serve-expired: yes # the interface that is used to connect to the network (this will listen to all interfaces) - interface: 0.0.0.0 + # interface: 0.0.0.0 + interface: 192.168.88.92 + interface: 192.168.88.8 + interface: 127.0.0.1 + interface: 100.90.20.83 + so-reuseport: yes + ip-freebind: yes # interface: ::0 private-address: 192.168.0.0/16 private-address: 100.64.0.0/10 @@ -31,6 +37,7 @@ access-control-view: 192.168.88.0/24 lan access-control-view: 100.64.0.0/10 tailnet + access-control-view: 127.0.0.0/8 lan do-ip4: yes do-ip6: no @@ -58,6 +65,7 @@ view: local-data: "jellyfin.objectbrokers.com. A 192.168.88.231" local-data: "vaultwarden.objectbrokers.com. A 192.168.88.231" local-data: "lambdesktop.objectbrokers.com. A 192.168.88.187" + local-data: "beszel.objectbrokers.com. A 192.168.88.231" view: name: "tailnet" @@ -72,6 +80,7 @@ view: local-data: "jellyfin.objectbrokers.com. A 100.81.165.11" local-data: "vaultwarden.objectbrokers.com. A 100.81.165.11" local-data: "lambdesktop.objectbrokers.com. A 100.95.22.24" + local-data: "beszel.objectbrokers.com. A 100.81.165.11" remote-control: control-enable: yes From 6ddc5bad1bbbacc7f6b7493a64b674b8ebb026ed Mon Sep 17 00:00:00 2001 From: cjones Date: Fri, 11 Sep 2026 17:10:20 -0400 Subject: [PATCH 11/11] Update to match Caddyfile in production on Teal. --- devices/teal/config/etc/caddy/Caddyfile | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/devices/teal/config/etc/caddy/Caddyfile b/devices/teal/config/etc/caddy/Caddyfile index 76e827a..f5d67fb 100644 --- a/devices/teal/config/etc/caddy/Caddyfile +++ b/devices/teal/config/etc/caddy/Caddyfile @@ -20,11 +20,11 @@ portainer.objectbrokers.com { } jellyfin.objectbrokers.com { - reverse_proxy :8096 + reverse_proxy 127.0.0.1:8096 } nextcloud.objectbrokers.com { - reverse_proxy :8080 + reverse_proxy :8083 } photo.objectbrokers.com { @@ -58,3 +58,8 @@ vaultwarden.objectbrokers.com { gitea.objectbrokers.com { reverse_proxy :3000 } + +beszel.objectbrokers.com { + reverse_proxy :8090 +} +