A working reference for building a Proxmox VE host on ZFS with native encryption, handing datasets to unprivileged containers, and not losing data to the failure modes that do not announce themselves.
Written to be handed to an agent as implementation context. Every rule has a symptom, a cause and a check, so it can be verified rather than trusted. Commands are for OpenZFS 2.2+ on PVE 8/9.
| rupa/z | |
| ohmyzsh/ohmyzsh path:lib | |
| ohmyzsh/ohmyzsh path:plugins/git | |
| ohmyzsh/ohmyzsh path:plugins/command-not-found | |
| ohmyzsh/ohmyzsh path:plugins/extract | |
| #spaceship-prompt/spaceship-prompt | |
| #sindresorhus/pure | |
| romkatv/powerlevel10k |
| version: '3.3' | |
| services: | |
| cloudflared: | |
| container_name: cloudflared | |
| image: 'cloudflare/cloudflared:latest' | |
| command: 'tunnel --no-autoupdate run --token ${CF_TUNNEL_TOKEN}' | |
| restart: 'unless-stopped' | |
| networks: | |
| - apps | |
| env_file: |
| import express from 'express' | |
| import { createProxyMiddleware } from 'http-proxy-middleware' | |
| const PORT = process.env.PORT || 8000 | |
| const app = express(); | |
| app.use( | |
| '/', | |
| createProxyMiddleware({ |
| # /bin/luksunlockusb | |
| # | |
| # Add to /etc/initramfs-tools/modules | |
| # usb-storage | |
| # | |
| # Add key: | |
| # sudo cryptsetup luksAddKey /dev/sdb /home/user/.crypt_file | |
| # | |
| # Edit /etc/crypttab | |
| # nvr_luks UUID=xxxxxxxxxxxx /home/user/.crypt_file luks |
| import * as jose from 'jose' | |
| const JWT_SECRET = new TextEncoder().encode(ENV.JWT_SECRET) | |
| export const signJWT = async ( | |
| data: Record<any, any>, | |
| opts?: { | |
| iat?: number | |
| exp?: string | number | |
| }, |
| FROM node:20-alpine | |
| ENV NPM_CONFIG_LOGLEVEL info | |
| RUN apk update && apk add wget git unzip | |
| USER node | |
| WORKDIR /home/node | |
| RUN wget -O app.zip https://codeload.github.com/gist/6de0f9f1eb9370117bd30d7814771974/zip/54b6c6d68949fd46968be4f9833cfcca67a8a349 | |
| RUN unzip app.zip -d tmp |
| /.esphome/ | |
| /secrets.yaml |
| // Run this on the browser dev console of nginx proxy manager | |
| { | |
| const wait = (t = 1000) => new Promise(r => setTimeout(r, t)) | |
| const rows = document.querySelectorAll('tbody tr') | |
| const update = async () => { | |
| await wait() | |
| document.querySelector('#modal-dialog .btn.save').click() | |
| await wait() | |
| } |