1 VPS BACKUP SYSTEM: Pangolin Docker#

Manual Backup Verification — 2026-10-02#

• Triggered the existing backup script as vps-backup on VPSBackups LXC 102 (10.1.2.102) for RN-VPS (72.11.147.220); it completed successfully.
• The current script stops the Pangolin stack, creates the archive on the VPS, restarts the stack, transfers the archive to LXC 102, and applies retention on both hosts.
• Verified archive: /home/vps-backup/Backups/2026-10-02_08h27_PangolinBackup.tar.gz (313,781,104 bytes). The timestamp is the backup host’s local time.
• The archive passed gzip -t; its file listing contains docker-compose.yml, config/db/db.sqlite, and config/traefik/traefik.yaml. A restore test was not performed.
• All six Pangolin stack containers were running afterward; Pangolin and CrowdSec reported healthy. No component versions were changed.
• Documentation discrepancy: /mnt/VPSBackups does not currently exist on LXC 102. The older storage and live-mirror references below have not been revalidated; the verified archive destination is /home/vps-backup/Backups/.

Target VPS: 72.11.147.220
VPS Provider: RackNerd (RN-VPS)
Backup LXC: Proxmox 102
Retention: 28 Files (14 Days)

Pangolin Tunnel Setup Guide#

Current VPS and SSH Access (Verified 2026-08-12)#

The current Pangolin VPS is hosted by RackNerd:

• VPS hostname: RN-VPS
• VPS public IP: 72.11.147.220
• Operating system: Ubuntu
• SSH port: TCP 22
• Current home public IP: 208.96.219.86 (may change when the ISP address changes)

SSH access is restricted by multiple layers:

1. UFW: incoming traffic is denied by default; TCP port 22 is allowed only from the current home public IP.
2. Fail2ban: the sshd jail has the current home public IP in ignoreip, so it is not accidentally banned. The value must also be present persistently in /etc/fail2ban/jail.local.
3. CrowdSec: the Pangolin container can enforce decisions through the Ubuntu host firewall via the INPUT and DOCKER-USER iptables chains.

The backup LXC connects outbound to the VPS. It does not require an inbound connection from the VPS to the home network. If the ISP IP changes, update both UFW and Fail2ban before the next backup.

1. Pangolin Pre-Update Requirements#

Update Record — 2026-10-02#

• Target: RackNerd RN-VPS (72.11.147.220), stack /home/marc/docker-compose/pangolin.
• Used the successful pre-update backup on LXC 102: /home/vps-backup/Backups/2026-10-02_08h27_PangolinBackup.tar.gz; gzip integrity and database/configuration entries were verified.
• Updated Pangolin 1.21.1 → 1.22.2 → 1.23.0 → 1.24.0. Each stage passed Compose readiness checks and dashboard HTTP 200; final migrations completed successfully.
• Updated Gerbil to 1.5.2, Newt to 1.18.0, Traefik to v3.7.13, and pinned CrowdSec to v1.8.1. Rebuilt the custom GoAccess image from its existing inline Dockerfile with a fresh base image; verified GoAccess 1.12.
• Updated Badger to v1.7.0 and the CrowdSec Traefik plugin to v1.7.1 in the active config/traefik/traefik.yaml. Automatic Badger migration skipped the nonstandard filename; the explicit update is present.
• Retained docker-compose.yml.before-2026-10-02-update and config/traefik/traefik.yaml.before-2026-10-02-update on the VPS. Database rollback requires the pre-update backup, not just older images.
• Verification limitation: Homelab site is online, but RN VPS site is offline. The local Newt connector repeatedly receives HTTP 400 No newt found with that newtId. Testing the original Newt 1.15.0 produced the same rejection; restored 1.18.0. Its registration requires investigation without exposing credentials. No site registrations or credentials were changed. Full routed-resource functionality has not been verified.
• Follow-up resolved: after the user restarted using their 1p alias, Newt 1.18.0 logged Websocket connected at 12:45:09 UTC. Both RN VPS and Homelab sites were verified online and approved; all six stack containers were running, Pangolin and CrowdSec were healthy, and the dashboard returned HTTP 200. No credential values were inspected during this follow-up. Individual routed resources remain untested.

1.1. Backup Data#

Always backup your data before updating. Copy your config directory to a safe location to allow for a rollback if necessary.

Pi-hole Installation & High Availability Guide#

1. Basic Installation#

Documentation: Pi-hole Official Install

Deployment#

# Automated install script
curl -sSL [https://install.pi-hole.net](https://install.pi-hole.net) | bash

Password Management#

Save the password provided at the end of the installation.

# To change or reset the web interface password:
pihole setpassword
# Alternative:
pihole -a -p

Network Integration (UniFi)#

1. Go to UniFi Network App > Internet > [Your WAN/LAN].
2. Change DNS Server to your Pi-hole IP.

2. Synchronization (Multi-Instance)#

For Pi-hole Version 6#

Use Nebula Sync for v6 compatibility.

Proxmox - Configuration#

For fresh installations and initial server builds, please refer to the Proxmox - Initial Setup guide for automated provisioning steps.

1. Storage Management#

1.1 Storage: ZFS Pool Creation#

Create a simple mirrored or striped ZFS pool via CLI.

# Create a pool named 'Storage' using two disks
zpool create Storage sdb sdc

# The pool will now appear in Node > Storage > ZFS

1.2 Storage Specific Tests#

# Test SMB Share Throughput
dd if=/dev/zero of=/mnt/pve/HP1Storage/test.file bs=1M count=4000

# Test local-lvm Performance
dd if=/dev/zero of=/var/lib/vz/test.file bs=1M count=4000

2. Networking#

2.1 Add Second Network Bridge (Isolated VM Traffic)#

Use this for dedicated VM traffic on a specific physical port (e.g., eno6).

Proxmox VE Host Backup & Restore Guide#

This guide covers the automated backup and restoration process for all Proxmox VE nodes using the dedicated PVE-only scripts.

Proxmox VE 9 Network Interface Disconnection Warning

On fresh Proxmox VE 9 installations, interfaces are pinned automatically (e.g., nic0–nic5). Overwriting /etc/network/interfaces with a legacy backup containing older naming schemes (such as eno5, eno6, or eno49) will cause the network interfaces to fail on reboot, resulting in a total loss of Web UI and SSH access.

Proxmox Backup Server (PBS)#

1 Installation & Post-Install#

1.1 Post-Install Optimization#

Run this script to configure repositories and optimize settings:

bash -c "$(wget -qLO - [https://github.com/community-scripts/ProxmoxVE/raw/main/misc/post-pbs-install.sh](https://github.com/community-scripts/ProxmoxVE/raw/main/misc/post-pbs-install.sh))"

1.2 Install File Browser#

bash -c "$(wget -qLO - [https://github.com/tteck/Proxmox/raw/main/misc/filebrowser.sh](https://github.com/tteck/Proxmox/raw/main/misc/filebrowser.sh))"

2 Setup VM with SMB Datastore#

2.1 Create Mount Directory#

mkdir /mnt/HP1ProxmoxBackupServer

2.2 Configure Credentials#

nano /etc/samba/.smbcreds

File Content:

username=proxmox
password=private

2.3 Set Permissions#

Change permission to Read-Only by root:

chmod 400 /etc/samba/.smbcreds

2.4 Manual Mount Test#

mount -t cifs -o rw,vers=3.0,credentials=/etc/samba/.smbcreds,uid=34,gid=34 //10.1.1.225/HP1ProxmoxBackupServer /mnt/HP1ProxmoxBackupServer

2.5 Permanent Mount (fstab)#

nano /etc/fstab

Add line:

ser2net Zigbee USB Server Configuration#

This setup allows you to host a Zigbee USB dongle on one machine (e.g., MMDocker/Proxmox 230) and connect to it over the network from Home Assistant.

1. Installation#

Reference: Peter Kieser - ser2net and Zigbee Coordinator

# Install the software
apt-get update && apt-get install ser2net -y

# Verify version and status
ser2net -v
systemctl status ser2net

2. Identify USB Hardware#

# Locate the specific device ID (stable path)
ls -lah /dev/serial/by-id/

# Get detailed info for the specific port (if needed)
udevadm info -q all -a -n /dev/ttyUSB0

# SkyConnect
ls /dev/serial/by-id/usb-Nabu_Casa_SkyConnect_v1.0*

3. Configuration (Version 4.0+)#

Modern versions of ser2net use YAML configuration files.

Syncthing Installation & Configuration Guide#

1. #truenas TrueNAS Scale Installation#

Increase Inotify Limit#

For real-time file watching on large datasets, increase the inotify limit in the TrueNAS backend.

1. Go to System Settings > Advanced > Sysctl.
2. Add New Sysctl:
   • Variable: fs.inotify.max_user_watches
   • Value: 524288
   • Description: Increase inotify limit for Syncthing.
3. Verify persistence via Shell:

cat /proc/sys/fs/inotify/max_user_watches

App Deployment#

1. Apps > Settings > Advanced: Disable “Host Path Safety Check” (if using existing datasets).
2. Catalog: Search for and install the Syncthing Enterprise version.
3. Storage Configuration:
   • Type: Host Path
   • Host Path: /mnt/HP1-4TBSSD-Raid0/HP1Storage (or your specific data path).
   • Mount Path: HP1Storage
4. Access: Open the Web UI at http://[IP]:31000. Set an Admin password immediately.

2. Synology DSM Installation (via Docker)#

Increase Inotify Limit#

1. Connect via SSH and run:

echo "fs.inotify.max_user_watches=204800" | sudo tee -a /etc/sysctl.d/90-override.conf
echo 204800 | sudo tee /proc/sys/fs/inotify/max_user_watches

Identify User IDs (PUID/PGID)#

To avoid permission issues, run the container as your specific user.

Tailscale Installation & Subnet Routing Guide#

1. Proxmox LXC Container Preparation#

If you are installing Tailscale inside an LXC container, you must allow TUN device access from the Proxmox host.

Modify Container Config#

On the Proxmox host, edit the configuration file for the specific container (e.g., ID 119):

nano /etc/pve/lxc/119.conf

Add these lines to the bottom:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Reboot the container:

pct reboot 119

2. Installation by OS#

Debian 12 (Bookworm)#

curl -fsSL [https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg](https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg) | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL [https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list](https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list) | sudo tee /etc/apt/sources.list.d/tailscale.list
apt update && apt install tailscale -y

Ubuntu 24.04 (Noble)#

curl -fsSL [https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg](https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg) | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL [https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list](https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list) | sudo tee /etc/apt/sources.list.d/tailscale.list
apt update && apt install tailscale -y

Ubiquiti UDM-SE#

# Install the latest version of Tailscale UDM
curl -sSLq https://raw.github.com/SierraSoftworks/tailscale-udm/main/install.sh | sh

3. Subnet Router & Exit Node Setup#

Enable IP Forwarding#

This is required if you want this node to act as a bridge to your local network.