tim/stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document all post-secret-change update procedures

Browse source 
Add a single quickstart table covering Cloudflare DDNS, Usenet, NZBgeek,
WireGuard, stack .env, and bootstrap; point secrets/.env.example and
AGENTS.md at the same workflow.
This commit is contained in:
tim 2026-07-22 19:48:56 -07:00
parent be8d21ab3d
commit 0108868a2c
3 changed files with 57 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

59
quickstart.md
View file

@ -148,33 +148,72 @@ Root folders: `/data/media/tv`, `/data/media/movies`, `/data/media/music` (hardl
**Prowlarr** — Add indexers. Apps: Sonarr `http://sonarr:8989`, Radarr `http://radarr:7878`, Lidarr `http://lidarr:8686` + each API key (*Settings → General*).
**Cloudflare DDNS** (`timothyjmiller/cloudflare-ddns`) — updates **devopshomelab.com** and subdomains to your **public IPv4** every 5 minutes.
### Secrets file
Path (not in git): **`/opt/stack/secrets/.env`**
Template: `secrets/.env.example`
Keys today: Usenet (NZBgeek / Newshosting / Tweaknews) + Cloudflare DDNS.
Sync from a laptop if you edit there:
```bash
# secrets/.env must include CLOUDFLAREAPIKEY, CLOUDFLAREDOMAIN, CLOUDFLARESUBDOMAINS
scp secrets/.env tim@192.168.8.123:/opt/stack/secrets/.env
ssh tim@192.168.8.123 'chmod 600 /opt/stack/secrets/.env'
```
---
### After changing secrets (apply changes)
Always edit **`secrets/.env`** first, then run only what you changed:
| What you changed | Commands (on ser5, `cd /opt/stack`) |
|------------------|-------------------------------------|
| **Cloudflare** token / domain / subdomains / proxied | `./scripts/render-cloudflare-ddns-env.sh` then `docker compose up -d cloudflare-ddns --force-recreate` then `docker logs cloudflare-ddns --tail 30` |
| **Usenet servers** (Newshosting / Tweaknews user, pass, host, ports) | `./scripts/configure-usenet.sh` then SABnzbd → Config → Servers → **Test** |
| **NZBgeek API key** | Prowlarr → Indexers → NZBgeek → paste new `NZBKEEPKEY` (not automated after first setup) |
| **WireGuard** peer / keys | Edit `wireguard/wg0.conf` (and `# EndpointHost = …`) then `docker compose up -d gluetun --force-recreate` and/or `./scripts/gluetun-endpoint-watch.sh` |
| **Stack `.env`** (ports, AI profile, demo login, etc.) | Edit `.env` then `docker compose up -d` (rebuild bonsai if `BONSAI_BACKEND` changed: `docker compose build bonsai && docker compose up -d bonsai`) |
| **Everything secret-driven (demo reset)** | Update `secrets/.env` + `.env` then `./scripts/bootstrap-stack.sh` (re-renders Cloudflare, reconfigures Usenet when flags allow) |
**Cloudflare one-liner after secret edit:**
```bash
cd /opt/stack
./scripts/render-cloudflare-ddns-env.sh
docker compose up -d cloudflare-ddns
docker compose up -d cloudflare-ddns --force-recreate
docker logs cloudflare-ddns --tail 30
```
Token needs **Zone → DNS → Edit**. `PROXIED=false` by default (DNS-only; better for VPN). Set `CLOUDFLARE_PROXIED=true` in secrets if you want orange-cloud for all names.
Needs: `CLOUDFLAREAPIKEY`, `CLOUDFLAREDOMAIN`, `CLOUDFLARESUBDOMAINS` (and optional `CLOUDFLARE_PROXIED`). Token: **Zone → DNS → Edit**. Default `PROXIED=false` (DNS-only; better for VPN).
**Usenet (NZBgeek + Newshosting + Tweaknews)**
Credentials live in **`secrets/.env`** (not git). Example keys: see `secrets/.env.example`.
**Usenet one-liner after secret edit:**
```bash
cd /opt/stack
./scripts/configure-usenet.sh
# then open http://192.168.8.123:8085 → Config → Servers → Test both green
```
Needs: Newshosting / Tweaknews vars (see `secrets/.env.example`; aliases like `TWEAKNEWSLOGIN` / `HNEWSHOSTINGPASS` are accepted).
**NZBgeek after secret edit:** UI only — Prowlarr → Indexers → NZBgeek → API key = `NZBKEEPKEY`.
---
**Usenet first-time setup** (in addition to secrets apply above):
```bash
# on ser5
cd /opt/stack && git pull
mkdir -p /storage/usenet/{incomplete,complete/{movies,tv,music}}
# copy secrets if needed: scp secrets/.env tim@stack:/opt/stack/secrets/
docker compose up -d sabnzbd
# open http://192.168.8.123:8085 once if first-run wizard appears, then:
./scripts/configure-usenet.sh
```
1. **SABnzbd** (http://host:8085) — Config → Servers: Newshosting `news.newshosting.com:563` SSL; Tweaknews `news.tweaknews.eu:563` SSL. Test both green.
1. **SABnzbd** (http://host:8085) — Config → Servers: Newshosting + Tweaknews SSL. Test both green.
Folders: incomplete `/data/usenet/incomplete`, complete `/data/usenet/complete` (categories `movies`/`tv`/`music`).
2. **Prowlarr** → Indexers → **NZBgeek** → API key from secrets (`NZBKEEPKEY` / `NZBGEEK_API_KEY`).
2. **Prowlarr** → Indexers → **NZBgeek** → API key from secrets (`NZBKEEPKEY`).
Download Clients → **SABnzbd** → host `sabnzbd`, port `8080`, API key from SABnzbd Config → General.
Sync download client to apps (or add SABnzbd in each *arr).
3. **Sonarr/Radarr/Lidarr** → Download Clients → SABnzbd: host `sabnzbd`, port `8080`, categories `tv` / `movies` / `music`.