# Runbook

## Daily checks

```bash
docker compose ps
docker compose logs --since 1h --tail 100
./verify.sh
```

## Common problems

**A service restarts in a loop.** Check its logs; usually a missing env var or
a volume permission issue.

**Port already in use.** Change the host side of the mapping in
`docker-compose.yml` and update `.env`.

**Caddy cannot get a certificate.** Ports 80 and 443 must be reachable from the
internet for the ACME challenge. Behind a NAT, use the DNS challenge instead.

**CrowdSec not blocking.** It needs to read your reverse proxy logs. Confirm the
log path in the acquisition config matches where Caddy or Traefik actually
writes.

**Keycloak slow to start.** It is a JVM application; 60-90 seconds on first boot
is normal.

## Scanning your stack

```bash
# secrets in a repository
gitleaks detect --source . -v

# vulnerabilities in an image
trivy image your-image:tag

# known exposures on your own hosts
nuclei -u https://your-host
```

Run these against your own systems only. Nuclei is a scanning tool; using it
against systems you do not own is both ineffective and illegal.

## Backup

```bash
docker run --rm -v rampart_authelia_data:/data -v "$PWD":/backup \
  alpine tar czf /backup/authelia-$(date +%F).tgz -C /data .
```

Stop the service before backing up.

## Services in this tier

- `caddy`
- `traefik`
- `uptimekuma`
- `crowdsec`
- `authelia`
- `keycloak`
- `vector`
- `headscale`