SWAG, Let’s Encrypt and Web GUI

You have to navigate to the config folder and create a file in nginx/proxy-confs. I didn't externalize omv itself or I would share my file, but for a bunch of apps there are samples there. Maybe copy one of those and customize it for omv. You need to restart swag after.

I've made a proxy-conf to use with my SWAG in SUBDOMAIN mode. You'll have to edit it to fit your IP/port/servername.

Go to the folder of the "proxy-confs" (/path-to-swag/nginx/proxy-confs/) and create a file named:

nano omv.subdomain.conf.sample and copy/paste the following code but be sure to edit it with the IP and Port you have assigned

to OMV:

# Conf Sample to be used by SWAG Reverse Proxy for access via HTTPS to OpenMediaVault.yourdomain.url
# Example: 'h**ps://omv.yoursubdomain.duckdns.org/'
# If 2 or more instances of OMV are running on the same network, it is necessary to create a .conf
# to each one, with different names and pointing to the proper IPs.

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name omv.*; # note: Set this with a unique name IF running 2 or more OMV servers eg: omvraspi.*

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth, fill in ldap details in ldap.conf
    #include /config/nginx/ldap.conf;

    # enable for Authelia
    #include /config/nginx/authelia-server.conf;

#
    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable the next two lines for ldap auth
        #auth_request /auth;
        #error_page 401 =200 /login;

        # enable for Authelia
        #include /config/nginx/authelia-location.conf;

        include /config/nginx/proxy.conf;
        resolver 127.0.0.11 valid=30s;
        set $upstream_app 192.168.1.200; # note: edit with the LAN IP of your OpenMediaVault server.
        set $upstream_port 35000;      # note: same port used on the server for OpenMediaVault. Here is port:35000
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
        access_log off;

    }

}

Now save the file and rename it to cp omv.subdomain.conf.sample omv.subdomain.conf and just restart SWAG with docker restart swag

After this, just go to a browser and you'll access via "https://omv.yourdomainurl"

KM0201 Care to test this one?!?

Maybe this is a useful if you want to juggle different networks in a compose file:

Zitat von Morlan

Inspired by this thread I continued a project, which I had on my list for some time now. I wanted to put all my docker containers into a single docker-compose file. Just for inspiration these are my docker-compose.yml and my .env. All I need to do is run a docker-compose up -d in the folder containing both files.

Code: .env

UID=1000
GID=100
TZ=Europe/Berlin
APPDIR=/srv/dev-disk-by-label-ssd/appdata
BACKUPDIR=/srv/dev-disk-by-label-ssd/backup
SYNCDIR=/srv/dev-disk-by-label-ssd/sync
RESTART=unless-stopped

Code: docker-compose.yml

version: "2.3"

services:
#################################
#PIHOLE
#
#
    pihole:
        container_name: pihole
        image: pihole/pihole:latest
        ports:
            - "53:53/tcp"
            - "53:53/udp"
            - "67:67/udp"
            - "80:80/tcp"
            - "443:443/tcp"
        environment:
            TZ: '${TZ}'
            WEBPASSWORD: 'myPW'
            ServerIP: '192.168.188.201'
            IPv6: 'false'
            DNS1: '1.1.1.1'
            DNS2: 'no'
        volumes:
            - ${APPDIR}/pihole:/etc/pihole/
            - ${APPDIR}/pihole/dnsmasq:/etc/dnsmasq.d/
        dns:
            - 127.0.0.1
#        cap_add:
#        - NET_ADMIN
        restart: ${RESTART}
        networks:
            pihole:
                ipv4_address: 192.168.188.201
#################################
#BITWARDEN
#
#
    bitwarden:
        image: bitwardenrs/server:raspberry
        container_name: bitwarden
        volumes:
            - ${APPDIR}/bitwarden:/data
            - ${APPDIR}/letsencrypt/log/bitwarden:/log #Logfile is mounted to swag container for fail2ban
        environment:
            WEBSOCKET_ENABLED: 'true' # Required to use websockets
            ADMIN_TOKEN: 'mytoken'
            LOG_FILE: 'log/bitwarden.log'
            LOG_LEVEL: 'warn'
            EXTENDED_LOGGING: 'true'
            TZ: '${TZ}'
        restart: ${RESTART}
        networks:
            my-net:
    bw_backup:
        image: bruceforce/bw_backup:rpi3
        container_name: bw_backup
        restart: ${RESTART}
        depends_on:
            - bitwarden
        volumes:
            - ${APPDIR}/bitwarden:/data/
            - /etc/timezone:/etc/timezone:ro
            - /etc/localtime:/etc/localtime:ro
            - ${BACKUPDIR}/bitwarden:/backup_folder/    #This is where the db-backup is stored
        environment:
            - DB_FILE=/data/db.sqlite3
            - BACKUP_FILE=/backup_folder/backup.sqlite3
            - CRON_TIME=30 2 * * *
            - TIMESTAMP=true
            - DELETE_AFTER=30
            - UID=0
            - GID=0
            - TZ=${TZ}
        network_mode: "none"
#################################
#LETSENCRYPT - SWAG
#
#
    swag:
        image: linuxserver/swag
        container_name: swag
        cap_add:
            - NET_ADMIN
        environment:
            - PUID=${UID}
            - PGID=${GID} 
            - TZ=${TZ} 
            - URL=mydomain
            - SUBDOMAINS=mysubdomains
            - VALIDATION=http
            - EMAIL=myemail
        volumes:
            - ${APPDIR}/letsencrypt:/config
        ports:
            - 450:443
            - 90:80
        restart: ${RESTART}
        networks:
            my-net:
#################################
#NEXTCLOUDPI
#
#
    nextcloudpi:
        image: ownyourbits/nextcloudpi-armhf
        command: "url_of_my_ncp"
        container_name: nextcloudpi        
        ports:
            - "4443:4443"
        volumes:
            - ${APPDIR}/nextcloudpi:/data
            - /etc/localtime:/etc/localtime:ro
            - ${SYNCDIR}:/mnt/sync     #This folder is mounted as an external storage
            - ${BACKUPDIR}/calcardbackup:/ccb   #Backups of my calendar and contacts via calcardbackup
            - ${BACKUPDIR}/ncp_backup:/ncp_backup  #Location where the ncp-backups are stored
        restart: ${RESTART}
        networks:
            my-net:
#################################
#RESILIO_SYNC
#
#
    resilio-sync:
        image: linuxserver/resilio-sync
        container_name: resilio-sync
        environment:
            - PUID=33
            - PGID=33
            - TZ=${TZ}
            - UMASK_SET=000
        volumes:
            - ${APPDIR}/resilio-sync:/config
            - ${APPDIR}/resilio-sync/downloads:/downloads
            - ${SYNCDIR}:/sync
        ports:
            - 8888:8888
            - 55555:55555
        logging:
            options:
                max-size: "50m"
                max-file: "1"
        restart: ${RESTART}
        network_mode: "bridge"
#################################
#PORTAINER
#
#
    portainer:
        image: portainer/portainer
        container_name: portainer
        command: -H unix:///var/run/docker.sock
        restart: always
        ports:
            - 9000:9000
            - 8000:8000
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - ${APPDIR}/portainer:/data
networks:    
    pihole:   
        driver: macvlan
        driver_opts:
            parent: enx001e063676f8
        ipam:
            driver: default
            config:
                - subnet: 192.168.188.0/24
                  gateway: 192.168.188.1
                  ip-range: 192.168.188.201/32
    my-net:
        name: my-net

Alles anzeigen

Zitat von KM0201

Ended up just moving those compose files to my nextcloud stack, deleted the old containers and redeployed...

This was the way I had when I run everything in just one OMV: one single YML launching all services in order to have SWAG proxying those services.

But there's really no need to have any issues with the network or lack of communication between containers, if you edit the confs. (Of course, linuxserver did a excellent job with the proxy-confs and what is done here is just for specific cases)

Zitat von KM0201

After all this time, I'm finally getting a complete handle on this reverse proxy....

Now I actually understand what I'm doing. (Although the OMV one didn't work, used port 35000 and modified it with my IP, then forwarded 35000 to my server in my router and set up the CNAME.. would fail authentication)... but I've set up like 7-8 random things w/ zero issue. Most I don't even need reverse proxied, I just did it to try it.

I should had explain a bit better why I created the "conf" and the real use of it:

My previously case scenario was:

1 RPi4 with OMV and Wireguard (let's call it by server name "omv1") with dockerized "SWAG/Nextcloud/MariaDB/Redis/Motioneye/Bitwarden".

Wireguard was my previously way to access the LAN and manipulate it (it still is for SSH).

Those services were accessed via WEB with the pre-made "*.subdomain.conf" from SWAG. ("motioneye.subdomain.conf" was created by me from a "trilium.subdomain..." after some tips from macom )

Since all services were on the same server (and same YML), it was easy and flawless to run without any need of editing files.

With this setup, only 2 ports needed to be open on the router (the one's for SWAG) and nothing else. (well 3 ports counting wireguard)

But after a while, I created a new NAS and the situation changed as my current scenario:

1 RPi4 omv1 became OMV/Wireguard with only dockerized Motioneye (this was/is on an IP 192.168.1.86 )

1 RPi4 omv2 became a NAS with the migrated services from the previous server (became IP 192.168.1.200)

With this, I lost the reverse-proxy to "Motioneye". But that's when I decided to edit the conf on omv2 to point to the omv1 and see how it would work (these are the lines on the conf that matter) :

    server_name motioneye.*; # NOTE: This is what will became the sub.subdomain.url
.......
        set $upstream_app 192.168.1.86; # NOTE: Edit with the LAN IP of where your service is running. Was "motioneye" 
        set $upstream_port 8765;      # NOTE: Same port used on the service you want. Here is port:8765
        set $upstream_proto http; # NOTE: This is originally from "Trillium". Maybe can be changed to "https"

Restarted SWAG on omv2 and presto, I had again motioneye access via https://motioneye.mysubdomain.url

One problem solved: SWAG running on a server on LAN but also reversing services in another server on the same LAN.

After seeing people asking for access to OMV with https, I set my noodle to HOW this would be possible with SWAG since OMV is NOT on docker and on a complete diferent nginx.

Since I always changed the OMV port to something on the 5 digits area (hence the port:35000) I decided to just edit it as on post #3.

And, as explained, I now have 2 omv, so I created 2 equal confs (with different names) pointing each one to the proper IP/port to access the OMVs.

And it's working, I have https access to each of them without any need of opening more ports via WEB. (or wireguarding)

Honestly, there was no need (to me, due to wireguard) for this but, just to see how would it go,

Just for completeness. You don’t need the resolver line in your conf file. This line is needed for the docker dns resolution. But since you are hard coding the ip, it’s not necessary.

This is a good resource for the swag container https://docs.linuxserver.io/general/swag

Zitat von Morlan

Just for completeness. You don’t need the resolver line in your conf file. This line is needed for the docker dns resolution. But since you are hard coding the ip, it’s not necessary.

You're absolutely right.

I can clean it better but, was just testing it without changing too much of the original 😉