<!-- Docker Java -->
<dependency>
    <groupId>com.github.docker-java</groupId>
    <artifactId>docker-java</artifactId>
    <version>3.3.6</version>
</dependency>
<dependency>
    <groupId>com.github.docker-java</groupId>
    <artifactId>docker-java-transport-zerodep</artifactId>
    <version>3.3.6</version>
</dependency>

Connect to unix://localhost:2375 failed

@Configuration
public class DockerConfig {

    @Value("${docker.host:unix:///var/run/docker.sock}")
    private String dockerHost;

    @Bean
    public DockerClient dockerClient() {
        DockerClientConfig config = DefaultDockerClientConfig.createDefaultConfigBuilder()
                .withDockerHost(dockerHost)
                .build();

        DockerHttpClient httpClient = new ZerodepDockerHttpClient.Builder()
                .dockerHost(config.getDockerHost())
                .sslConfig(config.getSSLConfig())
                .build();

        return DockerClientImpl.getInstance(config, httpClient);
    }
}

docker.host=unix:///var/run/docker.sock

public List<ContainerSummaryDto> listContainers(boolean all) {
    return dockerClient.listContainersCmd()
            .withShowAll(all)
            .exec()
            .stream()
            .map(this::toDto)
            .toList();
}

public Flux<String> streamLogs(String containerId, int tail) {
    return Flux.create(sink -> {
        dockerClient.logContainerCmd(containerId)
                .withStdOut(true)
                .withStdErr(true)
                .withFollowStream(true)
                .withTail(tail)
                .withTimestamps(true)
                .exec(new ResultCallback.Adapter<>() {
                    @Override
                    public void onNext(Frame frame) {
                        sink.next(new String(frame.getPayload()).stripTrailing());
                    }

                    @Override
                    public void onError(Throwable throwable) {
                        sink.error(throwable);
                    }

                    @Override
                    public void onComplete() {
                        sink.complete();
                    }
                });
    });
}

@GetMapping(value = "/{id}/logs", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
public Flux<ServerSentEvent<String>> streamLogs(@PathVariable String id,
                                                 @RequestParam(defaultValue = "100") int tail) {
    return containerService.streamLogs(id, tail)
            .map(line -> ServerSentEvent.<String>builder().data(line).build());
}

src/
  api.js               # API 호출 함수
  App.js               # 루트 컴포넌트 (목록 + 폴링)
  App.css              # 전체 스타일 (다크 테마)
  components/
    ContainerCard.js   # 카드 UI + 액션 버튼
    LogViewer.js       # SSE 실시간 로그 모달

const POLL_INTERVAL = 5000;

export default function App() {
  const [containers, setContainers] = useState([]);
  const [logTarget, setLogTarget] = useState(null);

  const load = useCallback(async () => {
    const data = await fetchContainers();
    setContainers(data);
  }, []);

  useEffect(() => {
    load();
    const timer = setInterval(load, POLL_INTERVAL);
    return () => clearInterval(timer);
  }, [load]);
  // ...
}

const STATE_META = {
  running: { label: 'Running', color: '#22c55e' },
  exited:  { label: 'Exited',  color: '#ef4444' },
  paused:  { label: 'Paused',  color: '#f59e0b' },
  created: { label: 'Created', color: '#6b7280' },
  dead:    { label: 'Dead',    color: '#991b1b' },
};

useEffect(() => {
  const es = new EventSource(getLogUrl(containerId));

  es.onopen = () => setConnected(true);

  es.onmessage = (e) => {
    setLines((prev) => {
      const next = [...prev, e.data];
      // 메모리 관리: 최대 2000줄 유지
      return next.length > 2000 ? next.slice(-2000) : next;
    });
  };

  es.onerror = () => {
    setConnected(false);
    setError('Connection lost.');
    es.close();
  };

  return () => es.close(); // 모달 닫으면 SSE 연결 종료
}, [containerId]);

FROM eclipse-temurin:17-jdk AS builder
WORKDIR /app
COPY .mvn/ .mvn/
COPY mvnw pom.xml ./
RUN ./mvnw dependency:go-offline -q
COPY src/ src/
RUN ./mvnw package -DskipTests -q

FROM eclipse-temurin:17-jre
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar
ENTRYPOINT ["java", "-jar", "app.jar"]

FROM node:20-alpine AS build
WORKDIR /app
COPY package.json package-lock.json* ./
RUN npm ci --silent
COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=build /app/build /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

server {
    listen 80;
    root /usr/share/nginx/html;
    index index.html;

    location /api/ {
        proxy_pass http://100.109.108.36:28080;
        proxy_http_version 1.1;
        proxy_set_header Connection '';
        proxy_buffering off;       # SSE 필수 설정
        proxy_cache off;
        chunked_transfer_encoding on;
    }

    location / {
        try_files $uri $uri/ /index.html;  # SPA 라우팅
    }
}

# 로컬에서 이미지 빌드
docker build -t dashboard-front ./frontend
docker build -t dashboard-back ./backend

# tar로 저장
docker save dashboard-front | gzip > dashboard-front.tar.gz
docker save dashboard-back | gzip > dashboard-back.tar.gz

# 서버로 전송
scp dashboard-front.tar.gz dashboard-back.tar.gz user@홈서버IP:~/dashboard/

# 서버에서 로드 & 실행
ssh user@홈서버IP
cd ~/dashboard
docker load < dashboard-front.tar.gz
docker load < dashboard-back.tar.gz
docker compose up -d

services:
  dashboard-back:
    image: dashboard-back
    container_name: dashboard-back
    ports:
      - "28080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

  dashboard-front:
    image: dashboard-front
    container_name: dashboard-front
    ports:
      - "23000:80"
    restart: unless-stopped

sudo apt install tlp tlp-rdw -y
sudo tlp start

sudo tlp-stat -s

--- TLP 1.6.1 --------------------------------------------
+++ TLP Status
State          = enabled
Mode           = AC
Power source   = AC

sudo vi /etc/tlp.conf

CPU_SCALING_GOVERNOR_ON_AC=powersave
CPU_ENERGY_PERF_POLICY_ON_AC=balance_power
CPU_BOOST_ON_AC=0
PLATFORM_PROFILE_ON_AC=balanced

sudo tlp start

sudo apt install thinkfan -y

echo "options thinkpad_acpi fan_control=1" | sudo tee /etc/modprobe.d/thinkpad_acpi.conf
sudo modprobe -r thinkpad_acpi
sudo modprobe thinkpad_acpi fan_control=1

find /sys/devices -name "temp*_input" 2>/dev/null

/sys/devices/platform/thinkpad_hwmon/hwmon/hwmon4/temp1_input

sudo vi /etc/thinkfan.conf

sensors:
  - hwmon: /sys/devices/platform/thinkpad_hwmon/hwmon/hwmon4/temp1_input

fans:
  - tpacpi: /proc/acpi/ibm/fan

levels:
  - [0, 0, 55]
  - [1, 50, 60]
  - [2, 55, 65]
  - [3, 60, 70]
  - [4, 65, 75]
  - [5, 70, 80]
  - [7, 75, 255]

sudo systemctl enable thinkfan
sudo systemctl start thinkfan
sudo systemctl status thinkfan

sudo systemctl is-enabled tlp
sudo systemctl is-enabled thinkfan
# 둘 다 "enabled" 출력되면 정상

sudo sysctl vm.swappiness=10

echo "vm.swappiness=10" | sudo tee -a /etc/sysctl.conf

cat /proc/sys/vm/swappiness
# 10

sudo swapoff -a && sudo swapon -a

sudo mkdir -p /backup
sudo chown your-username:your-username /backup

cannot create /backup/immich_db_20260329.sql: Permission denied

mkdir ~/backup_script
vi ~/backup_script/postgres_immich_backup.sh

#!/bin/bash

BACKUP_DIR="/backup"
DATE=$(date +%Y%m%d)

mkdir -p $BACKUP_DIR

# DB 덤프 백업
echo "pg_dump 시작..."
docker exec immich_postgres pg_dumpall -U postgres > $BACKUP_DIR/immich_db_$DATE.sql

# 7일치만 보관 (오래된 것 삭제)
find $BACKUP_DIR -name "immich_db_*.sql" -mtime +7 -delete

echo "백업 완료: $DATE"

chmod +x ~/backup_script/postgres_immich_backup.sh

sh ~/backup_script/postgres_immich_backup.sh

pg_dump 시작...
백업 완료: 20260329

ls -lh /backup/

crontab -e

0 3 * * * /home/your-username/backup_script/postgres_immich_backup.sh >> /backup/backup.log 2>&1

crontab -l

find $BACKUP_DIR -name "immich_db_*.sql" -mtime +7 -delete

# 라이브러리 rsync (외장하드 마운트 후 추가)
rsync -av --delete /mnt/data/immich/photos/ /mnt/backup/immich/photos/

certbot certonly --nginx -d yourdomain.com

NET::ERR_CERT_COMMON_NAME_INVALID
연결이 비공개로 설정되어 있지 않습니다.

Missing command line flag or config entry for this setting:
You have an existing certificate that contains a portion of the domains you requested.
It contains these names: yourdomain.com
You requested these names for the new certificate: yourdomain.com, photo.yourdomain.com
Do you want to expand and replace this existing certificate with the new certificate?
(You can set this with the --expand flag)

#!/bin/bash
DOMAIN="yourdomain.com"
EMAIL="your@email.com"
SSL_DIR="/ssl"

certbot certonly --nginx \
  --non-interactive \
  --agree-tos \
  --expand \
  --email $EMAIL \
  -d $DOMAIN \
  -d photo.$DOMAIN \
  -d files.$DOMAIN \
  -d vault.$DOMAIN \
  --config-dir $SSL_DIR \
  --work-dir $SSL_DIR/work \
  --logs-dir $SSL_DIR/logs

if [ $? -ne 0 ]; then
    echo "인증서 발급 실패"
    exit 1
fi

echo "인증서 발급 성공"
nginx -t && systemctl restart nginx

certbot certificates --config-dir /ssl

crontab -e

0 3 1 */2 * certbot renew --config-dir /ssl --work-dir /ssl/work --logs-dir /ssl/logs && nginx -s reload

sudo grep "Failed password" /var/log/auth.log | tail -20

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban

sudo vi /etc/fail2ban/jail.local

[DEFAULT]
# 차단에서 제외할 IP (내 Tailscale IP 등)
ignoreip = 127.0.0.1/8 ::1

# 차단 지속 시간: 기본 10분 → 1시간
bantime = 3600

# 몇 초 동안 실패 횟수를 카운트할지
findtime = 600

# 몇 번 실패하면 차단할지
maxretry = 5

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

sudo systemctl restart fail2ban

[recidive]
enabled = true
logpath = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime = 604800   ; 7일
findtime = 86400   ; 1일
maxretry = 3       ; 하루에 3번 차단되면 7일 차단

[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log

[nginx-botsearch]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 2

# 전체 jail 상태
sudo fail2ban-client status

# SSH jail 상세
sudo fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 3
|  |- Total failed:     1284
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 12
   |- Total banned:     87
   `- Banned IP list:   185.156.73.233 139.19.117.130 ...

sudo tail -f /var/log/fail2ban.log

2026-03-29 22:48:33 INFO [sshd] Ban 193.46.255.86
2026-03-29 22:52:33 INFO [sshd] Ban 185.156.73.233
2026-03-29 23:01:15 INFO [sshd] Ban 139.19.117.130

# 수동 차단
sudo fail2ban-client set sshd banip 1.2.3.4

# 차단 해제 (내 IP 실수로 차단됐을 때)
sudo fail2ban-client set sshd unbanip 1.2.3.4

mkdir ~/monitoring && cd ~/monitoring

services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    ports:
      - "19090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "13000:3000"
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=your_password_here
      - GF_SERVER_ROOT_URL=http://100.109.108.36:13000

volumes:
  prometheus_data:
  grafana_data:

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'thinkpad'
    static_configs:
      - targets: ['100.109.108.36:19100']
        labels:
          instance: 'thinkpad-homeserver'

  - job_name: 'oci'
    static_configs:
      - targets: ['<OCI_Tailscale_IP>:19100']
        labels:
          instance: 'oci-server'

tailscale ip -4

wget https://github.com/prometheus/node_exporter/releases/download/v1.8.2/node_exporter-1.8.2.linux-amd64.tar.gz
tar xf node_exporter-1.8.2.linux-amd64.tar.gz
sudo cp node_exporter-1.8.2.linux-amd64/node_exporter /usr/local/bin/
sudo chmod +x /usr/local/bin/node_exporter

sudo tee /etc/systemd/system/node_exporter.service << 'EOF'
[Unit]
Description=Node Exporter
After=network.target

[Service]
Type=simple
User=nobody
ExecStart=/usr/local/bin/node_exporter --web.listen-address=":19100"
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable node_exporter
sudo systemctl start node_exporter

sudo systemctl status node_exporter
# active (running) 이 뜨면 성공

sudo ufw allow in on tailscale0 to any port 19100
sudo ufw deny 19100

cd ~/monitoring
docker compose up -d
docker compose ps

sudo vi /etc/systemd/system/node_exporter.service

ExecStart=/usr/local/bin/node_exporter --web.listen-address=":19100" --collector.powersupplyclass

sudo systemctl daemon-reload
sudo systemctl restart node_exporter

curl http://localhost:19100/metrics | grep power_supply

mkdir -p ~/portainer && cd ~/portainer

services:
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    restart: always
    ports:
      - "19000:9000"
      - "18000:8000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data

volumes:
  portainer_data:

docker compose up -d

mkdir -p ~/vaultwarden && cd ~/vaultwarden

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    ports:
      - "11000:80"
    volumes:
      - vaultwarden_data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=true

volumes:
  vaultwarden_data:

docker compose up -d

sudo vi /etc/nginx/sites-available/vault.yourdomain.com

server {
    listen 80;
    server_name vault.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name vault.yourdomain.com;

    ssl_certificate     /ssl/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /ssl/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://100.109.108.36:11000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

sudo ln -s /etc/nginx/sites-available/vault.yourdomain.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

environment:
  - SIGNUPS_ALLOWED=false

docker compose up -d

mkdir ~/immich && cd ~/immich

wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env

vi .env

UPLOAD_LOCATION=/mnt/data/immich/photos
DB_DATA_LOCATION=/home/your-username/immich-db

docker compose up -d

unknown shorthand flag: 'd' in -d

sudo apt install ca-certificates curl gnupg -y
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update
sudo apt install docker-compose-plugin -y

ERROR: The Compose file './docker-compose.yml' is invalid because:
'name' does not match any of the regexes: '^x-'

sudo apt remove docker-compose -y
sudo apt install docker-compose-plugin -y

E: Unable to locate package docker-compose-plugin

docker logs immich_postgres

FATAL:  data directory "/var/lib/postgresql/data" has wrong ownership
HINT:  The server must be started by the user that owns the data directory.

docker compose down
mkdir -p ~/immich-db
vi .env

DB_DATA_LOCATION=/home/your-username/immich-db

docker compose up -d

docker compose ps

server {
    listen 80;
    server_name photo.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name photo.yourdomain.com;

    ssl_certificate     /ssl/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /ssl/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # Immich는 대용량 파일 업로드가 있으므로 크기 제한 해제
    client_max_body_size 0;

    location / {
        proxy_pass http://100.109.108.36:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 웹소켓 지원 (Immich 실시간 업로드에 필요)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

lsblk

sudo blkid /dev/nvme1n1p2

sudo apt install ntfs-3g -y
sudo mkdir /mnt/data
sudo mount /dev/nvme1n1p2 /mnt/data

sudo umount /mnt/data
sudo ntfsfix /dev/nvme1n1p2
sudo mount /dev/nvme1n1p2 /mnt/data

ln -s /mnt/data ~/data

sudo apt install samba -y

sudo smbpasswd -a your-username

sudo vi /etc/samba/smb.conf

[data]
   path = /mnt/data
   browseable = yes
   read only = no
   valid users = your-username

sudo systemctl restart smbd

# Docker 공식 레포 추가
sudo apt install ca-certificates curl gnupg -y
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y

sudo usermod -aG docker $USER
# 재로그인 후 적용

docker run -d \
  --name filebrowser \
  --restart always \
  -v /mnt/data:/srv \
  -p 9090:80 \
  filebrowser/filebrowser

docker logs filebrowser

server {
    listen 80;
    server_name files.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name files.yourdomain.com;

    ssl_certificate     /ssl/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /ssl/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://100.109.108.36:9090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

sudo ln -s /etc/nginx/sites-available/files.yourdomain.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

curl -fsSL https://tailscale.com/install.sh | sh

sudo tailscale up

To authenticate, visit:
    https://login.tailscale.com/a/xxxxxxxxxxxxxxx

tailscale ip -4

ssh username@100.109.108.36