Homelab, car and music enthusiast located in Victoria, Australia
UTC+10
Contact me at
{% columns fullWidth="false" %} {% column %} {% endcolumn %} {% column %} {% endcolumn %} {% column valign="bottom" %} {% endcolumn %} {% endcolumns %} ***You can view the AGG website here
#### Documentation I have documented and standardized as much as I can in my homelab, which you can view in the tabs to the left. I'm a strong advocate for quality documentation as its a great way to learn but also *to not forget*. I have publicized as much of my Homelabs production configuration as I can, such as my compose files.Portfolio | Instagram | Lomography
#### **Music** I have played guitar since I was a young child and spend most of my musical effort on learning 2000's metalcore, such as Killswitch Engage. ***| Integration | Host | Purpose |
|---|---|---|
| NFTables | Any server with a port forward | Add malicious IPs to firewall blocklists |
| SSH | All servers | Monitors for bruteforce login attempts |
| Cloudflare | Lungo, Cola, Mocha, Latte | Provide malicious IP's with Captcha requests before accessing agamersgrind.com, agamersgrind.dev, xfgn.dev and lattemedia.tv |
| UptimaKuma | Cola | Monitors for brute force login attempts |
| AdGuard | Americano, Espresso | Monitors for brute force login attempts |
| Wireguard | Cappuccino | Monitors for bruteforce login attempts |
| Pterodactyl Wings | Cocoa, Mocha | Monitors for bruteforce login attempts |
| Wordpress - AGG | Cocoa | Monitors for bruteforce login attempts |
| Kasm | Latte | Monitors for bruteforce login attempts |
| Proxmox | Macaroni | Monitors for bruteforce login attempts |
| DSM | Fettuccine | Monitors for bruteforce login attempts |
| Component | Model |
|---|---|
| Case | Silverstone Alta G1M White (Planned PowerMac G4 swap) |
| Motherboard | MSI B660M Pro |
| CPU | Intel i5 13500 |
| CPU Cooler | Noctua NH-U9 |
| RAM | 4x32GB Vengeance LP, 3200mhz |
| GPU | Quadro P4000 |
| Power Supply | Corsair 600w SFX |
| Storage | 2x NVME 2TB SDD 2x SATA 4TB HDD 1x SATA 128GB SSD |
| Other | HomeAssistant SkyConnect dongle ZWave Dongle |
| Name | Type | Drives | Purpose |
|---|---|---|---|
| SSDRAID | ZFS, MIRROR | 2x 2TB NVME | VM Disk storage |
| HDD-MIRROR | ZFS, MIRROR | 2x 4TB HDD | Backup storage |
| Component | Model |
|---|---|
| Manufacturer | Synology |
| Model | DS918+ |
| CPU | Intel Celeron J3455 |
| RAM | 8GB |
| Storage | 4x 8TB Seagate Ironwolf Pro's |
| Component | Model |
|---|---|
| Manufacturer | Dell |
| Model | Wyse 5070 |
| CPU | Intel J5005 |
| RAM | 4GB SODIMM |
| Storage | 1x 16GB SATA NGFF |
| Time Required | 1 Hour |
| Difficulty | Easy |
| Required Knowledge | SSH |
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
echo \
"deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
"$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin
| Time Required | 30 minutes |
| Difficulty | Easy |
| Required Knowledge | Portainer, SSH, Docker Compose |
| Time Required | 30 Minutes |
| Difficulty | Low - Moderate |
| Required Knowledge | Portainer, Docker compose |
| Time Required | 1 - 2 Hours |
| Difficulty | Low |
| Required Knowledge | Docker, Docker Compose, GitHub |
You can expire the credential if you want, though this may break Portainer
the 'home page' of a pull request
this pull request will replace the red line with the green line
Take note of the OS/ARCH as well - you can see that tag 2.12.5 contains both AMD64 and ARM64 containers, meaning this compose file can be used on both ARM and x86 machines.
| Total Time Required | 1 Hour |
| Difficulty | Moderate |
| Required Knowledge | Docker, Docker Compose, Reverse Proxies, DNS, Dockflare |
Further testing has confirmed the panel will ONLY talk to DB's on 3306
You can create multiple node machines and load balance your servers, our scale outwards in the future
As you can see, Wings and Panel communicate via Cloudflare, over the internet. This is not great but OK for a homelab
| Time Required | 15 Minutes |
| Difficulty | Easy |
| Time Required | 20 Minutes |
| Difficulty | Moderate |
ufw allow 2022
I would also recommend changing the upload_limit to '1024'
| Time Required | 10 minutes |
| Difficulty | Low |
| Time Required | Unknown |
| Difficulty | Moderate |
| Total Time Required | 2 Hours |
| Difficulty | Easy - Moderate |
| Required Knowledge | Docker Compose, DNS, Cloudflare Zero Trust, Linux Servers |
| Container | Function | |
|---|---|---|
| Node / Wings | The software that hosts and manages game servers. You can connect multiple Wings nodes to a singular panel | |
| Panel / Pelican | The front-end UI, used to manage multiple nodes | |
| Dockflare | Dockflare is a IaC solution for managing Cloudflare Tunnel routes using Docker labels. If you are using Dockflare elsewhere in your homelab, I would highly advise changing the label prefix as you may experience issues with this compose file taking over other Dockflare tunnels | |
| Cloudflare Tunnel | The "bridge" between your internal network and Cloudflare servers. Web apps are tunnelled through this, allowing a public address to reach an internal resource. Access is secured with CF Zero Trust The tunnel is created by Dockflare outside of the compose file - you will need to manually delete it if you delete the compose stack | |
| Crowdsec Engine | Crowdsec is a crowdsourced cyber security tool. It monitors the Wings SFTP logs for brute force attempts adds the IP address to a 4 hour blocklist. It also adds known bad IPs to your Cloudflare firewall, forcing them to do a Captcha before accessing anything. | |
| Crowdsec Blocklist | This container will add some of Crowdsec Paid blocklists to your engine for free https://github.com/wolffcatskyy/crowdsec-blocklist-import | |
| Firewall Bouncer | This is the 'bridge' between the Crowdsec Engine container and the firewall on your machine | |
| Cloudflare Bouncer | This is the 'bridge' between Crowdsec Engine and your Cloudflare Security Rules |
| Data | Example | Explaination |
|---|---|---|
| Domain | example.com | The main domain hosting your game servers |
| Subdomain for Panel | panel | the subdomain your panel will be hosted on, eg panel.example.com |
| Subdomain for node | node1 * | The address your wings node will be available at. The panel will communicate with this address to manage it |
| Subdomain for game servers and SFTP | play *** | The DNS address that players will use to join your servers, eg play.example.com This uses a Cloudflare dynamic DNS container, so the IP is automatically updated. |
| Game server port range | 6600-6700 * | A port range that your players will join |
| Internal port range | 8600-8700 ** | A port range that internal services are hosted on |
| From email address | noreply@example.com | The email address that will send panel alerts from, eg password reset link |
| SFTP Port | 2022 * | The SFTP port admins can use to upload content to their servers. This is required due to the 100MB upload limit applied to Cloudflare tunnels |
| Account | Cloudflare Tunnel | Edit |
| Account | Account Filter Lists | Edit |
| Account | Firewall Access Rules | Edit |
| Account | Account Settings | Read |
| Account | Access: Apps and Policies | Edit |
| User | User Details | Read |
| Zone | DNS | Read |
| Zone | Firewall Services | Edit |
| Zone | Zone | Edit |
| Field | Data |
|---|---|
| Rule Name | Block Bots |
| Expression | (cf.client.bot) |
| Choose action | Managed Challenge |
| Place at | First |
| Field | Data |
|---|---|
| Rule Name | Challenge Threat Score |
| Expression | (cf.threat_score gt 10) |
| Choose action | Managed Challenge |
| Place at | Custom - after 'Block Bots' |
| Field | Data |
|---|---|
| Rule Name | Challenge Threat Score |
| Expression | (cf.threat_score gt 50) |
| Choose action | Block |
| Place at | Custom - after 'Challenge Threat Score' |
This is the IP range of the Pelican management network, which contains the Cloudflare tunnel container.
This resolves some upload failure errors
The domain your players will join
SFTP does not have the 99mb upload limit
____
__ Pelican _____/___/_______ _______ ______
\_____\ \/\/ / / / __ / ___/
\___\ / / / / /_/ /___ /
\___/\___/___/___/___/___ /______/
/_______/ 1.0.0-beta21
Copyright © 2018 - 2026 Dane Everitt & Contributors
Website: https://pelican.dev
Source: https://github.com/pelican-dev/wings
License: https://github.com/pelican-dev/wings/blob/main/LICENSE
This software is made available under the terms of the MIT license.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
INFO: [Jan 17 10:43:55.736] loading configuration from file config_file=/etc/pelican/config.yml
INFO: [Jan 17 10:43:55.745] configured wings with system timezone timezone=Australia/Melbourne
INFO: [Jan 17 10:43:55.746] configured system user successfully gid=988 uid=988 username=pelican
INFO: [Jan 17 10:43:55.748] fetching list of servers from API
the domain players will use to join your server. If defaults, play.yourdomain.com
This address:port will be shown to anyone with access to the panel
| Difficulty to configure | Difficulty to manage | Impact of cyber breach | Impact of database corruption | |
|---|---|---|---|---|
| Shared Database | 2 | 1 | 3 | 3 |
| Per Node | 4 | 3 | 1 | 1 |
| Panel Database | 2 | 1 | 5 | 5 |
Do not use one of your play / join ports. Doing so will expose your DB to the internet, which increases the risk of the db being breached or taken offline.
| Host | DNS name or IP of the wings node running the database container |
| Port | The port selected during creation |
| Display name | Whatever you want - I would suggest the hostname / DNS name of the server |
| Linked nodes | Set this to any Wings nodes you want to talk to this DB. These nodes need to be able to reach the hostname / IP in the host field |
| Data | Example |
|---|---|
| Public Hostname | maps.yourdomain.com |
| Service | http://yourservername:3333 |
| Access Policy | Bypass |
| Data | Example |
|---|---|
| Public Hostname | admin.yourdomain.com |
| Service | http://yourservername:1234 |
| Access Policy |
|
Stolen from Crowdsec's website
| Crowdsec Engine | The crowdsec engine is the processor and central logging unit that watches your log files and what is occuring on your server. It tells the bouncer what to do The engine also reports your data back to the Crowdsec UI to manage there if you enable this |
| Crowdsec Bouncer | The bouncer takes action, eg blocking an IP, and requires a connection to the engine to function. |
This key can be saved to your password vault as it rarely changes
services:
init-crowdsec:
image: alpine:latest
volumes:
- crowdsec:/etc/crowdsec
command: >
sh -c "apk add --no-cache wget ca-certificates &&
mkdir -p /etc/crowdsec/acquisitions.d &&
wget -qO /etc/crowdsec/acquis.yaml https://raw.githubusercontent.com/trentnbauer/HomelabPublic/main/crowdsec/unifi.yaml"
This malicious IP from Turkmenistan is "very noisey", which means it shows up in a lot of other peoples Crowdsec instances.
| Total Time Required | 20 minutes |
| Difficulty | Easy |
| Required Knowledge | Crowdsec, UniFi |
time="2026-04-25T12:43:59+10:00" level=info msg="(blocklist/blocklist-import) external/blocklist (AbuseIPDB) for 1000/1000 decisions : 24h ban on Ip 137.184.107.118" module=db
time="2026-04-25T12:43:59+10:00" level=info msg="(blocklist/blocklist-import) external/blocklist (AbuseIPDB) for 999/1000 decisions : 24h ban on Ip 137.184.105.225" module=db
time="2026-04-25T12:43:59+10:00" level=info msg="(blocklist/blocklist-import) external/blocklist (AbuseIPDB) for 998/1000 decisions : 24h ban on Ip 137.184.76.231" module=db
time="2026-04-25T12:43:59+10:00" level=info msg="(blocklist/blocklist-import) external/blocklist (AbuseIPDB) for 997/1000 decisions : 24h ban on Ip 137.184.76.120" module=db
time="2026-04-25T12:43:59+10:00" level=info msg="(blocklist/blocklist-import) external/blocklist (AbuseIPDB) for 996/1000 decisions : 24h ban on Ip 137.184.64.22" module=db
| Total Time Required | 10 minutes |
| Difficulty | Easy |
| Required Knowledge | Crowdsec, Docker Compose |
| Total Time Required | 15 minutes |
| Difficulty | Easy |
| Required Knowledge | Crowdsec, Docker Compose |
| Total Time Required | 15 minutes |
| Difficulty | Easy |
| Required Knowledge | Crowdsec, Cloudflare |
| Account | Account Filter Lists | Edit |
| Account | Firewall Access Rules | Edit |
| Zone | Zone | Read |
| Zone | Firewall Services | Edit |
| Field | Data |
|---|---|
| Rule Name | Block Bots |
| Expression | (cf.client.bot) |
| Choose action | Managed Challenge |
| Place at | First |
| Field | Data |
|---|---|
| Rule Name | Challenge Threat Score |
| Expression | (cf.threat_score gt 10) |
| Choose action | Managed Challenge |
| Place at | Custom - after 'Block Bots' |
| Field | Data |
|---|---|
| Rule Name | Challenge Threat Score |
| Expression | (cf.threat_score gt 50) |
| Choose action | Block |
| Place at | Custom - after 'Challenge Threat Score' |
mode: nftables
update_frequency: 300s
log_mode: file
log_dir: /var/log/
log_level: info
log_compression: true
log_max_size: 100
log_max_backups: 3
log_max_age: 30
api_url: http://127.0.0.1:8080/
api_key: $APIKeyFromStep1
insecure_skip_verify: false
disable_ipv6: false
deny_action: DROP
deny_log: false
supported_decisions_types:
- ban
#to change log prefix
#deny_log_prefix: "crowdsec: "
#to change the blacklists name
blacklists_ipv4: crowdsec-blacklists
blacklists_ipv6: crowdsec6-blacklists
#type of ipset to use
ipset_type: nethash
#if present, insert rule in those chains
iptables_chains:
- INPUT
# - FORWARD
# - DOCKER-USER
## nftables
nftables:
ipv4:
enabled: true
set-only: false
table: crowdsec
chain: crowdsec-chain
priority: -10
ipv6:
enabled: true
set-only: false
table: crowdsec6
chain: crowdsec6-chain
priority: -10
nftables_hooks:
- input
- forward
# packet filter
pf:
# an empty string disables the anchor
anchor_name: ""
prometheus:
enabled: false
listen_addr: 127.0.0.1
listen_port: 60601
You can limit the API key to certain domains here but you can also do it in the Crowdsec config file
| Total Time Required | 15 minutes |
| Difficulty | Easy |
| Required Knowledge | Crowdsec, Cloudflare |
| Time Required | 1 Hour |
| Difficulty | Easy |
| Required Knowledge | SSH, Docker Compose, YAML |
| Time Required | 15 Minutes |
| Difficulty | Easy |
| Required Knowledge | Proxmox, machine boot order |