Skip to content

Commit dec3f67

Browse files
Pandagan-85Pandagan-85
committed
feat: move media to external storage, add VPN privacy guide
 Media files (Video/Fumetti) moved to /mnt/nextcloud-data/media/ as External Storage, excluding them from Borg backup. Reduced backup size from ~65GB to ~2GB and disk usage from 95% to 28%. Added Mullvad + Tailscale coexistence guide with nftables for Fedora and Android/GrapheneOS.
1 parent 84ea756 commit dec3f67

4 files changed

Lines changed: 200 additions & 10 deletions

File tree

‎.env.example‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -96,18 +96,18 @@ PROMETHEUS_RETENTION_DAYS=30
9696
# ==============================================================================
9797

9898
# Komga accessible via Tailscale: https://YOUR_TAILSCALE_HOSTNAME:25600
99-
# Library files are read from Nextcloud user's files directory
100-
# Path: /mnt/nextcloud-data/nextcloud-data/${NEXTCLOUD_USER}/files/${KOMGA_LIBRARY_PATH}
101-
KOMGA_LIBRARY_PATH=Documents/Fumetti # Path inside Nextcloud files
99+
# Library files are stored in /mnt/nextcloud-data/media/ (External Storage)
100+
# This keeps them outside the Nextcloud datadir to exclude them from Borg backup
101+
KOMGA_LIBRARY_PATH=/mnt/nextcloud-data/media/Fumetti
102102

103103
# ==============================================================================
104104
# JELLYFIN CONFIGURATION (Media Server)
105105
# ==============================================================================
106106

107107
# Jellyfin accessible via Tailscale: https://YOUR_TAILSCALE_HOSTNAME:8096
108-
# Video files are read from Nextcloud user's files directory
109-
# Path: /mnt/nextcloud-data/nextcloud-data/${NEXTCLOUD_USER}/files/${JELLYFIN_LIBRARY_PATH}
110-
JELLYFIN_LIBRARY_PATH=Documents/Video # Path inside Nextcloud files
108+
# Video files are stored in /mnt/nextcloud-data/media/ (External Storage)
109+
# This keeps them outside the Nextcloud datadir to exclude them from Borg backup
110+
JELLYFIN_LIBRARY_PATH=/mnt/nextcloud-data/media/Video
111111
JELLYFIN_PUBLISHED_URL=https://YOUR_TAILSCALE_HOSTNAME:8096
112112

113113
# ==============================================================================

‎docker/docker-compose.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ services:
4545
# Borg backup location
4646
- BORG_BACKUP_HOST_LOCATION=/mnt/nextcloud-data/borg-backups
4747

48+
# Mount media directory for Nextcloud External Storage
49+
# Video and Fumetti are stored outside the datadir to exclude them from Borg backup
50+
- NEXTCLOUD_MOUNT=/mnt/nextcloud-data/media
51+
4852
volumes:
4953
# Main data directory - stores all Nextcloud AIO data
5054
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
@@ -101,8 +105,8 @@ services:
101105
- "127.0.0.1:25600:25600"
102106

103107
volumes:
104-
# Library files from Nextcloud user directory (read-only)
105-
- /mnt/nextcloud-data/nextcloud-data/${NEXTCLOUD_USER}/files/${KOMGA_LIBRARY_PATH}:/data:ro
108+
# Library files from external media directory (excluded from Borg backup)
109+
- /mnt/nextcloud-data/media/Fumetti:/data:ro
106110
# Komga config and database
107111
- komga_config:/config
108112

@@ -126,8 +130,8 @@ services:
126130
- "127.0.0.1:8096:8096"
127131

128132
volumes:
129-
# Video files from Nextcloud user directory (read-only)
130-
- /mnt/nextcloud-data/nextcloud-data/${NEXTCLOUD_USER}/files/${JELLYFIN_LIBRARY_PATH}:/media:ro
133+
# Video files from external media directory (excluded from Borg backup)
134+
- /mnt/nextcloud-data/media/Video:/media:ro
131135
# Jellyfin config (persistent)
132136
- jellyfin_config:/config
133137

‎docs/06-BACKUP-RESTORE.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ Guida completa per backup e disaster recovery di Nextcloud AIO.
4747

4848
❌ **Escluso**:
4949

50+
- **Video** e **Fumetti** (media libraries per Jellyfin/Komga) - spostati in `/mnt/nextcloud-data/media/` come External Storage, fuori dal datadir di Nextcloud
5051
- External storage (se configurato)
5152
- Container images (si riscaricano)
5253
- Logs temporanei

‎docs/11-VPN-PRIVACY-SETUP.md‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
# VPN & Privacy Setup - Mullvad + Tailscale
2+
3+
Guida per configurare Mullvad VPN e Tailscale in coesistenza su Fedora Linux, e gestire la privacy DNS su Android/GrapheneOS.
4+
5+
## Panoramica
6+
7+
| Piattaforma | Setup | Costo |
8+
|---|---|---|
9+
| **Fedora Linux** | Mullvad + Tailscale insieme (nftables) | Mullvad 5 EUR/mese |
10+
| **Android / GrapheneOS** | Switch manuale tra le due app | - |
11+
12+
- **Mullvad**: privacy navigazione (nasconde IP e DNS dall'ISP)
13+
- **Tailscale**: accesso ai servizi privati (Jellyfin, Komga, Grafana) via MagicDNS
14+
15+
---
16+
17+
## Fedora Linux
18+
19+
### 1. Installa Mullvad
20+
21+
```bash
22+
sudo dnf config-manager addrepo --from-repofile=https://repository.mullvad.net/rpm/stable/mullvad.repo
23+
sudo dnf install mullvad-vpn
24+
25+
# Per l'icona nel system tray (GNOME)
26+
sudo dnf install libappindicator-gtk3
27+
```
28+
29+
### 2. Login e connessione
30+
31+
```bash
32+
mullvad account login TUO_ACCOUNT_NUMBER
33+
mullvad connect
34+
mullvad status
35+
```
36+
37+
### 3. Regole nftables per coesistenza con Tailscale
38+
39+
Mullvad blocca tutto il traffico che non passa dal suo tunnel. Queste regole escludono il traffico Tailscale (subnet `100.64.0.0/10`) dal tunnel Mullvad, permettendo a entrambi di funzionare.
40+
41+
Crea il file `/etc/nftables/mullvad_tailscale.conf`:
42+
43+
```
44+
table inet mullvad_tailscale {
45+
chain output {
46+
type route hook output priority -100; policy accept;
47+
ip daddr 100.64.0.0/10 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
48+
}
49+
chain input {
50+
type filter hook input priority -100; policy accept;
51+
ip saddr 100.64.0.0/10 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
52+
}
53+
}
54+
```
55+
56+
Carica e rendi permanente:
57+
58+
```bash
59+
sudo nft -f /etc/nftables/mullvad_tailscale.conf
60+
echo 'include "/etc/nftables/mullvad_tailscale.conf"' | sudo tee -a /etc/nftables.conf
61+
sudo systemctl enable --now nftables
62+
```
63+
64+
### 4. Permetti traffico LAN
65+
66+
```bash
67+
mullvad lan set allow
68+
```
69+
70+
### 5. Verifica
71+
72+
```bash
73+
# Mullvad funziona?
74+
curl https://am.i.mullvad.net/connected
75+
76+
# Tailscale funziona attraverso Mullvad?
77+
tailscale ping <nome-server>
78+
79+
# Jellyfin raggiungibile?
80+
curl -k https://<tailscale-hostname>:8096
81+
```
82+
83+
---
84+
85+
## Configurazione DNS su Tailscale (Admin Console)
86+
87+
Impostazioni nella pagina **DNS** della Tailscale Admin Console:
88+
89+
- **MagicDNS**: attivo (risolve i nomi `.ts.net`)
90+
- **Global nameservers**: nessuno (ci pensa Mullvad per la navigazione)
91+
- **Override DNS servers**: OFF
92+
93+
### Importante
94+
95+
Non impostare DNS manuali (es. 1.1.1.1) direttamente sui device. Con questa configurazione:
96+
97+
- **Mullvad attivo** -> Mullvad gestisce i DNS (suoi server privati)
98+
- **Tailscale attivo** -> MagicDNS risolve `.ts.net`, il router gestisce il resto
99+
- **Entrambi attivi (Fedora)** -> Mullvad per internet, MagicDNS per `.ts.net`
100+
101+
---
102+
103+
## Android / GrapheneOS
104+
105+
Android permette una sola VPN attiva alla volta. Non si possono usare Mullvad e Tailscale contemporaneamente.
106+
107+
### Setup
108+
109+
1. Installa **Mullvad VPN** dal Play Store / F-Droid / sito Mullvad
110+
2. Installa **Tailscale** dal Play Store / F-Droid
111+
3. **Non attivare** DNS personalizzato su Mullvad (i suoi DNS di default sono gia privati)
112+
113+
### Utilizzo
114+
115+
- **Navigazione con privacy** -> attiva Mullvad
116+
- **Accesso a Jellyfin / Komga / Grafana** -> attiva Tailscale
117+
118+
### Servizi accessibili via Tailscale
119+
120+
| Servizio | URL |
121+
|---|---|
122+
| Jellyfin | `https://<tailscale-hostname>:8096` |
123+
| Komga | `https://<tailscale-hostname>:25600` |
124+
| Grafana | `https://<tailscale-hostname>:3000` |
125+
| AIO Admin | `https://<tailscale-hostname>:8443` |
126+
127+
---
128+
129+
## Ripristino DNS su Fedora (se necessario)
130+
131+
Se hai impostato DNS manuali e vuoi tornare ad automatico:
132+
133+
```bash
134+
# Vedi connessione attiva
135+
nmcli -t -f NAME connection show --active
136+
137+
# Rimuovi DNS manuali
138+
nmcli connection modify "NOME_CONNESSIONE" ipv4.dns "" ipv4.ignore-auto-dns no
139+
nmcli connection up "NOME_CONNESSIONE"
140+
141+
# Verifica
142+
resolvectl status | grep -A2 "DNS Server"
143+
```
144+
145+
---
146+
147+
## Troubleshooting
148+
149+
### Mullvad connesso ma nessuna navigazione
150+
151+
```bash
152+
mullvad lan set allow
153+
mullvad reconnect
154+
```
155+
156+
### Tailscale non raggiungibile con Mullvad attivo
157+
158+
Verifica che le regole nftables siano caricate:
159+
160+
```bash
161+
sudo nft list table inet mullvad_tailscale
162+
```
163+
164+
Se non ci sono, ricaricale:
165+
166+
```bash
167+
sudo nft -f /etc/nftables/mullvad_tailscale.conf
168+
```
169+
170+
### Cambiare server Mullvad
171+
172+
```bash
173+
mullvad relay set location it mil # Italia, Milano
174+
mullvad relay set location de ber # Germania, Berlino
175+
mullvad reconnect
176+
```
177+
178+
### Stato completo
179+
180+
```bash
181+
mullvad status
182+
tailscale status
183+
resolvectl status | grep -A2 "DNS Server"
184+
sudo nft list ruleset | grep mullvad_tailscale
185+
```

0 commit comments

Comments
 (0)