From 0108868a2c1712b8f15434eb62cdb4894a6cef64 Mon Sep 17 00:00:00 2001 From: tim Date: Wed, 22 Jul 2026 19:48:56 -0700 Subject: [PATCH] Document all post-secret-change update procedures Add a single quickstart table covering Cloudflare DDNS, Usenet, NZBgeek, WireGuard, stack .env, and bootstrap; point secrets/.env.example and AGENTS.md at the same workflow. --- AGENTS.md | 1 + quickstart.md | 59 ++++++++++++++++++++++++++++++++++++-------- secrets/.env.example | 7 ++++++ 3 files changed, 57 insertions(+), 10 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 8fe9930..c6e4e06 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,3 +8,4 @@ - Prefer SSH push (`GIT_SSH_COMMAND` with `~/.ssh/id_ed25519` if needed). - Server checkout: `/opt/stack` is the same repo (`git pull` on ser5). Ansible uses `stack_deploy_method: git`. - Prefer **`.env`** for config (see `.env.example`). Demo creds: `DEMO_USER=tim` `DEMO_PASS=asdfasdf`. Fresh host: `./scripts/bootstrap-stack.sh`. +- Secrets live in `secrets/.env` (gitignored). After edits: see **quickstart.md → After changing secrets** (Usenet → `configure-usenet.sh`; Cloudflare → `render-cloudflare-ddns-env.sh` + recreate container; NZBgeek → Prowlarr UI; WireGuard → `wg0.conf` + gluetun recreate/watch). diff --git a/quickstart.md b/quickstart.md index 270750a..652f8a6 100644 --- a/quickstart.md +++ b/quickstart.md @@ -148,33 +148,72 @@ Root folders: `/data/media/tv`, `/data/media/movies`, `/data/media/music` (hardl **Prowlarr** — Add indexers. Apps: Sonarr `http://sonarr:8989`, Radarr `http://radarr:7878`, Lidarr `http://lidarr:8686` + each API key (*Settings → General*). -**Cloudflare DDNS** (`timothyjmiller/cloudflare-ddns`) — updates **devopshomelab.com** and subdomains to your **public IPv4** every 5 minutes. +### Secrets file + +Path (not in git): **`/opt/stack/secrets/.env`** +Template: `secrets/.env.example` +Keys today: Usenet (NZBgeek / Newshosting / Tweaknews) + Cloudflare DDNS. + +Sync from a laptop if you edit there: ```bash -# secrets/.env must include CLOUDFLAREAPIKEY, CLOUDFLAREDOMAIN, CLOUDFLARESUBDOMAINS +scp secrets/.env tim@192.168.8.123:/opt/stack/secrets/.env +ssh tim@192.168.8.123 'chmod 600 /opt/stack/secrets/.env' +``` + +--- + +### After changing secrets (apply changes) + +Always edit **`secrets/.env`** first, then run only what you changed: + +| What you changed | Commands (on ser5, `cd /opt/stack`) | +|------------------|-------------------------------------| +| **Cloudflare** token / domain / subdomains / proxied | `./scripts/render-cloudflare-ddns-env.sh` then `docker compose up -d cloudflare-ddns --force-recreate` then `docker logs cloudflare-ddns --tail 30` | +| **Usenet servers** (Newshosting / Tweaknews user, pass, host, ports) | `./scripts/configure-usenet.sh` then SABnzbd → Config → Servers → **Test** | +| **NZBgeek API key** | Prowlarr → Indexers → NZBgeek → paste new `NZBKEEPKEY` (not automated after first setup) | +| **WireGuard** peer / keys | Edit `wireguard/wg0.conf` (and `# EndpointHost = …`) then `docker compose up -d gluetun --force-recreate` and/or `./scripts/gluetun-endpoint-watch.sh` | +| **Stack `.env`** (ports, AI profile, demo login, etc.) | Edit `.env` then `docker compose up -d` (rebuild bonsai if `BONSAI_BACKEND` changed: `docker compose build bonsai && docker compose up -d bonsai`) | +| **Everything secret-driven (demo reset)** | Update `secrets/.env` + `.env` then `./scripts/bootstrap-stack.sh` (re-renders Cloudflare, reconfigures Usenet when flags allow) | + +**Cloudflare one-liner after secret edit:** + +```bash +cd /opt/stack ./scripts/render-cloudflare-ddns-env.sh -docker compose up -d cloudflare-ddns +docker compose up -d cloudflare-ddns --force-recreate docker logs cloudflare-ddns --tail 30 ``` -Token needs **Zone → DNS → Edit**. `PROXIED=false` by default (DNS-only; better for VPN). Set `CLOUDFLARE_PROXIED=true` in secrets if you want orange-cloud for all names. +Needs: `CLOUDFLAREAPIKEY`, `CLOUDFLAREDOMAIN`, `CLOUDFLARESUBDOMAINS` (and optional `CLOUDFLARE_PROXIED`). Token: **Zone → DNS → Edit**. Default `PROXIED=false` (DNS-only; better for VPN). -**Usenet (NZBgeek + Newshosting + Tweaknews)** -Credentials live in **`secrets/.env`** (not git). Example keys: see `secrets/.env.example`. +**Usenet one-liner after secret edit:** + +```bash +cd /opt/stack +./scripts/configure-usenet.sh +# then open http://192.168.8.123:8085 → Config → Servers → Test both green +``` + +Needs: Newshosting / Tweaknews vars (see `secrets/.env.example`; aliases like `TWEAKNEWSLOGIN` / `HNEWSHOSTINGPASS` are accepted). + +**NZBgeek after secret edit:** UI only — Prowlarr → Indexers → NZBgeek → API key = `NZBKEEPKEY`. + +--- + +**Usenet first-time setup** (in addition to secrets apply above): ```bash -# on ser5 cd /opt/stack && git pull mkdir -p /storage/usenet/{incomplete,complete/{movies,tv,music}} -# copy secrets if needed: scp secrets/.env tim@stack:/opt/stack/secrets/ docker compose up -d sabnzbd # open http://192.168.8.123:8085 once if first-run wizard appears, then: ./scripts/configure-usenet.sh ``` -1. **SABnzbd** (http://host:8085) — Config → Servers: Newshosting `news.newshosting.com:563` SSL; Tweaknews `news.tweaknews.eu:563` SSL. Test both green. +1. **SABnzbd** (http://host:8085) — Config → Servers: Newshosting + Tweaknews SSL. Test both green. Folders: incomplete `/data/usenet/incomplete`, complete `/data/usenet/complete` (categories `movies`/`tv`/`music`). -2. **Prowlarr** → Indexers → **NZBgeek** → API key from secrets (`NZBKEEPKEY` / `NZBGEEK_API_KEY`). +2. **Prowlarr** → Indexers → **NZBgeek** → API key from secrets (`NZBKEEPKEY`). Download Clients → **SABnzbd** → host `sabnzbd`, port `8080`, API key from SABnzbd Config → General. Sync download client to apps (or add SABnzbd in each *arr). 3. **Sonarr/Radarr/Lidarr** → Download Clients → SABnzbd: host `sabnzbd`, port `8080`, categories `tv` / `movies` / `music`. diff --git a/secrets/.env.example b/secrets/.env.example index e8f0a48..2a05222 100644 --- a/secrets/.env.example +++ b/secrets/.env.example @@ -1,4 +1,11 @@ # Copy to secrets/.env and fill in. NEVER commit secrets/.env +# +# After editing secrets on the server: +# Usenet: ./scripts/configure-usenet.sh +# Cloudflare: ./scripts/render-cloudflare-ddns-env.sh +# docker compose up -d cloudflare-ddns --force-recreate +# Full table: see quickstart.md → "After changing secrets" +# # scripts/configure-usenet.sh accepts these names (and a few aliases). # --- NZBgeek (Prowlarr indexer) ---