@lamalibre/create-lamaste 4.0.0

package/vendor/docs/06-reference/installer-flags.md

@@ -0,0 +1,260 @@
+# Installer Flags
+
+> CLI flags, environment variables, and exit codes for `npx @lamalibre/create-lamaste@4.0.0`.
+
+## Usage
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 [flags]
+```
+
+The installer runs as root on a fresh Ubuntu 24.04 server. It is completely non-interactive by default — all configuration happens later through the browser-based onboarding wizard.
+
+## Flags
+
+| Flag            | Short | Description                                     |
+| --------------- | ----- | ----------------------------------------------- |
+| `--help`        | `-h`  | Print help message and exit                     |
+| `--yes`         | `-y`  | Skip the confirmation prompt                    |
+| `--skip-harden` |       | Skip OS hardening (swap, UFW, fail2ban, SSH)    |
+| `--dev`         |       | Allow private/non-routable IP addresses         |
+| `--force-full`  |       | Run full installation even on existing installs |
+| `--uninstall`   |       | Print manual removal guide and exit             |
+
+### `--help`, `-h`
+
+Prints a description of what the installer does, lists all flags, and exits with code 0. Does not modify anything on the system.
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --help
+```
+
+### `--yes`, `-y`
+
+Skips the interactive confirmation prompt that appears before installation begins. Useful for automated deployments or scripts where you cannot press Enter.
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --yes
+```
+
+Without this flag, the installer displays a banner listing all changes it will make and waits for the user to press Enter or Ctrl+C.
+
+### `--skip-harden`
+
+Skips all OS hardening tasks:
+
+- Swap file creation (1 GB)
+- UFW firewall configuration (ports 22, 443, 9292)
+- fail2ban installation and configuration
+- SSH hardening (disabling password authentication)
+
+Everything else (Node.js, nginx, mTLS, panel deployment) still runs.
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --skip-harden
+```
+
+Use this if you manage your own firewall rules, already have fail2ban configured, or are running on a platform that handles security at a different layer.
+
+### `--dev`
+
+Allows the installer to run on a machine with a private or non-routable IP address (e.g., `192.168.x.x`, `10.x.x.x`). By default, the installer requires a public IP.
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --dev
+```
+
+This is useful for:
+
+- Testing the installer in a local VM
+- Running on a server behind a NAT (where the public IP is not directly assigned to the interface)
+
+When `--dev` is active, the installer prints the detected IP with a note: `(dev mode — private IP accepted)`.
+
+### `--force-full`
+
+Forces the installer to run the complete installation pipeline, ignoring skip guards that would normally detect an existing installation. This is useful when an installation is in an inconsistent state and you want to ensure all components are fully deployed.
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --force-full
+```
+
+Use this if:
+
+- A previous installation was interrupted partway through
+- Components were manually removed and need to be reinstalled
+- You want to ensure every step runs regardless of existing state
+
+### `--uninstall`
+
+Prints a step-by-step guide for manually removing Lamaste from the server, then exits with code 0. Does not modify anything on the system.
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --uninstall
+```
+
+The printed guide first points to the automated removal, `sudo lamaste-server uninstall`, then covers:
+
+1. Stop and disable services (panel, gatekeeper, Chisel, Authelia) and remove their units
+2. Remove nginx configuration
+3. Remove Lamaste directories and binaries (`/etc/lamalibre/lamaste/`, `/opt/lamalibre/lamaste/`, `/var/www/lamaste/`, `/etc/authelia/`, `/var/log/authelia/`, `/usr/local/bin/{chisel,authelia}`, `/usr/local/sbin/lamaste-{priv,certbot,cert-info}`)
+4. Remove the service accounts (`lamaste`, `lamaste-authelia`, group `lamaste-chisel`)
+5. Remove sudoers rules
+6. Remove fail2ban configuration (optional)
+7. Revert SSH hardening (optional)
+8. Revert firewall changes (optional)
+9. Remove swap file (optional)
+10. Remove Let's Encrypt certificates (optional)
+
+See also: [Uninstalling](../05-operations/uninstalling.md) for the full documentation.
+
+## Environment Variables
+
+| Variable                   | Default                             | Description                                                                                                                                                      |
+| -------------------------- | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `LAMALIBRE_LAMASTE_CONFIG` | `/etc/lamalibre/lamaste/panel.json` | Override the panel config file path (lamalibre-lamaste-serverd)                                                                                                  |
+| `NODE_ENV`                 | —                                   | Set to `development` (or leave unset) to skip mTLS verification and use dev config path; set to `production` for production behavior (lamalibre-lamaste-serverd) |
+
+These environment variables affect the **panel server** at runtime, not the installer itself. They are listed here because they are the only environment-level configuration Lamaste uses.
+
+The installer sets these in the systemd service unit:
+
+```ini
+Environment=NODE_ENV=production
+Environment=CONFIG_FILE=/etc/lamalibre/lamaste/panel.json
+```
+
+> **Note:** The systemd unit sets `CONFIG_FILE`, but the panel server code reads `LAMALIBRE_LAMASTE_CONFIG`. The `CONFIG_FILE` variable is not used by the application. In production this has no effect because the code falls back to `/etc/lamalibre/lamaste/panel.json` when `LAMALIBRE_LAMASTE_CONFIG` is unset and `NODE_ENV=production`.
+
+## Exit Codes
+
+| Code | Meaning                                                            |
+| ---- | ------------------------------------------------------------------ |
+| 0    | Success (installation complete, or `--help`/`--uninstall` printed) |
+| 1    | Installation failed (error printed to stderr)                      |
+
+When the installer fails, it prints a boxed error message with the failure reason and a note that you can safely re-run the installer to retry:
+
+```
+  ┌─────────────────────────────────────────────┐
+  │  Lamaste installation failed.              │
+  │  <error message>                            │
+  │                                             │
+  │  You can safely re-run this installer       │
+  │  to retry.                                  │
+  └─────────────────────────────────────────────┘
+```
+
+## Requirements
+
+The installer checks these requirements at startup and fails with a descriptive error if any are not met:
+
+| Requirement                | Check                          |
+| -------------------------- | ------------------------------ |
+| Root access                | `process.getuid() === 0`       |
+| Ubuntu 24.04               | Reads `/etc/os-release`        |
+| Public IP (unless `--dev`) | Detects via network interfaces |
+
+## Installation Phases
+
+The installer runs in two sequential phases:
+
+**Phase 1: Environment checks**
+
+1. Verify root access
+2. Detect operating system (must be Ubuntu 24.04)
+3. Detect IP address (must be public unless `--dev`)
+
+**Phase 2: Installation tasks**
+
+1. Harden operating system (skipped with `--skip-harden`)
+   - Create 1 GB swap file
+   - Configure UFW firewall (ports 22, 443, 9292)
+   - Install and configure fail2ban
+   - Harden SSH configuration
+   - Install system dependencies (curl, openssl, nginx, certbot)
+2. Install Node.js 20 LTS
+3. Generate mTLS certificates (CA, client cert, PKCS12 bundle)
+4. Configure nginx (self-signed TLS, mTLS snippet, panel vhost on port 9292)
+5. Deploy Lamaste panel (system user, root-owned install directory, pinned Chisel + Authelia with their units and accounts, server, CLI, client, config, systemd, `lamaste-priv` and wrappers, sudoers)
+6. Deploy Gatekeeper
+
+## Idempotency
+
+The installer is designed to be re-run safely. Skip guards prevent duplicate work:
+
+| Component         | Skip Condition                                                               |
+| ----------------- | ---------------------------------------------------------------------------- |
+| Swap file         | Swap already active                                                          |
+| UFW firewall      | Already active with required ports                                           |
+| fail2ban          | Config exists and service is running                                         |
+| SSH hardening     | Settings already correct                                                     |
+| Node.js           | Already installed at expected version                                        |
+| mTLS certificates | `ca.key` and `client.p12` already exist                                      |
+| Panel config      | Existing `panel.json` is merged (preserves domain, email, onboarding status) |
+
+Components that are always redeployed on re-run:
+
+- Panel server files (`/opt/lamalibre/lamaste/lamaste-serverd/`)
+- Panel client files (`/opt/lamalibre/lamaste/lamaste-server-ui/`)
+- Systemd service unit
+- Sudoers rules
+- nginx vhost configuration
+
+## Examples
+
+**Fresh install on a new droplet:**
+
+```bash
+ssh root@203.0.113.42
+npx @lamalibre/create-lamaste@4.0.0
+```
+
+**Automated install (no confirmation prompt):**
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --yes
+```
+
+**Install without OS hardening:**
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --yes --skip-harden
+```
+
+**Test in a local VM:**
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --dev
+```
+
+**Update an existing installation:**
+
+```bash
+npx @lamalibre/create-lamaste@latest --yes
+```
+
+**View the uninstall guide:**
+
+```bash
+npx @lamalibre/create-lamaste@4.0.0 --uninstall
+```
+
+## Quick Reference
+
+| Flag            | Effect                                 |
+| --------------- | -------------------------------------- |
+| `--help` / `-h` | Print help, exit 0                     |
+| `--yes` / `-y`  | Skip confirmation                      |
+| `--skip-harden` | No swap, UFW, fail2ban, SSH hardening  |
+| `--dev`         | Allow private IPs                      |
+| `--force-full`  | Full install even on existing installs |
+| `--uninstall`   | Print removal guide, exit 0            |
+
+| Requirement | Value                           |
+| ----------- | ------------------------------- |
+| OS          | Ubuntu 24.04                    |
+| Access      | Root                            |
+| IP          | Public (or `--dev` for private) |
+| Exit 0      | Success                         |
+| Exit 1      | Failure                         |

package/vendor/docs/06-reference/ports-and-services.md

@@ -0,0 +1,244 @@
+# Ports and Services
+
+> Quick reference for port allocation, systemd units, file paths, log locations, and binary locations.
+
+## Port Allocation
+
+| Port | Binding     | Service                      | Protocol | Purpose                                                 |
+| ---- | ----------- | ---------------------------- | -------- | ------------------------------------------------------- |
+| 22   | `0.0.0.0`   | sshd                         | TCP      | SSH access (installer only, disposable)                 |
+| 80   | `0.0.0.0`   | nginx                        | TCP      | HTTP — `301` to HTTPS; Let's Encrypt HTTP-01 challenges |
+| 443  | `0.0.0.0`   | nginx                        | TCP      | HTTPS — domain-based access (panel, auth, tunnel, apps) |
+| 9292 | `0.0.0.0`   | nginx                        | TCP      | HTTPS — IP-based panel access (mTLS, self-signed cert)  |
+| 3100 | `127.0.0.1` | lamalibre-lamaste-serverd    | TCP      | Panel server (Fastify API + static files)               |
+| 9090 | `127.0.0.1` | chisel                       | TCP      | Chisel tunnel server (WebSocket)                        |
+| 9091 | `127.0.0.1` | authelia                     | TCP      | Authelia authentication server                          |
+| 9294 | `127.0.0.1` | lamalibre-lamaste-gatekeeper | TCP      | Tunnel authorization (auth_request target)              |
+
+**Key points:**
+
+- Only nginx listens on public interfaces (`0.0.0.0`)
+- All backend services bind to `127.0.0.1` — they are never directly accessible from the internet
+- Port 9292 is the emergency fallback — it works even if your domain is lost or DNS breaks
+- The UFW firewall only allows ports 22, 80, 443, and 9292. Port 80 serves Let's Encrypt HTTP-01 challenges and otherwise redirects every request to HTTPS (`lamalibre-lamaste-http-redirect`)
+
+### Reserved tunnel ports
+
+A tunnel's port is also a loopback port on the relay: its vhost proxies to `127.0.0.1:<port>`. The ports of Lamaste's own services can therefore never carry a tunnel:
+
+| Port | Service                 |
+| ---- | ----------------------- |
+| 3100 | Panel server            |
+| 9090 | Chisel server           |
+| 9091 | Authelia                |
+| 9292 | IP-based panel listener |
+| 9294 | Gatekeeper              |
+
+A tunnel on one of them would publish that internal service on a public hostname. For the panel that is an administrator takeover, not a leak: the panel trusts the client-certificate headers nginx sets. `RESERVED_TUNNEL_PORTS` in `@lamalibre/lamaste@4.0.0` is enforced by the request schema, inside the tunnel workflow, and again when the Chisel grants are rendered. Tunnel ports must also be 1024–65535.
+
+## Systemd Units
+
+| Unit Name                              | Type   | User                            | Description                                 |
+| -------------------------------------- | ------ | ------------------------------- | ------------------------------------------- |
+| `lamalibre-lamaste-serverd.service`    | simple | lamaste                         | Panel server (Fastify Node.js API)          |
+| `chisel.service`                       | simple | nobody (group `lamaste-chisel`) | Chisel tunnel server (reverse mode)         |
+| `authelia.service`                     | simple | lamaste-authelia                | Authelia authentication server              |
+| `lamalibre-lamaste-gatekeeper.service` | simple | lamaste                         | Gatekeeper tunnel authorization service     |
+| `nginx.service`                        | —      | root                            | nginx reverse proxy (system package)        |
+| `fail2ban.service`                     | —      | root                            | Intrusion prevention (system package)       |
+| `certbot.timer`                        | timer  | root                            | Automatic Let's Encrypt certificate renewal |
+
+### Common systemctl Commands
+
+| Command                         | Description                                   |
+| ------------------------------- | --------------------------------------------- |
+| `sudo systemctl status <unit>`  | Check service status and recent logs          |
+| `sudo systemctl start <unit>`   | Start a stopped service                       |
+| `sudo systemctl stop <unit>`    | Stop a running service                        |
+| `sudo systemctl restart <unit>` | Stop then start a service                     |
+| `sudo systemctl reload <unit>`  | Reload configuration without downtime (nginx) |
+| `sudo systemctl enable <unit>`  | Start automatically on boot                   |
+| `sudo systemctl disable <unit>` | Do not start on boot                          |
+
+### Service Unit Files
+
+| Unit                           | File Path                                                  |
+| ------------------------------ | ---------------------------------------------------------- |
+| `lamalibre-lamaste-serverd`    | `/etc/systemd/system/lamalibre-lamaste-serverd.service`    |
+| `chisel`                       | `/etc/systemd/system/chisel.service`                       |
+| `authelia`                     | `/etc/systemd/system/authelia.service`                     |
+| `lamalibre-lamaste-gatekeeper` | `/etc/systemd/system/lamalibre-lamaste-gatekeeper.service` |
+| `nginx`                        | `/lib/systemd/system/nginx.service` (system package)       |
+| `fail2ban`                     | `/lib/systemd/system/fail2ban.service` (system package)    |
+| `certbot.timer`                | `/lib/systemd/system/certbot.timer` (system package)       |
+
+### Service Startup Order
+
+```
+network.target
+    ├── nginx.service
+    ├── lamalibre-lamaste-serverd.service
+    ├── lamalibre-lamaste-gatekeeper.service
+    ├── chisel.service
+    ├── authelia.service
+    └── fail2ban.service
+```
+
+All services start after `network.target` and are independent of each other. If one service fails, the others continue running.
+
+The `chisel` and `authelia` units are written by `create-lamaste` (as root) and hardened (`NoNewPrivileges`, empty `CapabilityBoundingSet`, `ProtectSystem=strict`, `PrivateTmp`, `PrivateDevices`; Authelia also `UMask=027`, `ReadWritePaths=/etc/authelia /var/log/authelia` and `SystemCallFilter=@system-service`). `lamaste-authelia` is a system account with no login shell and no home directory, created by the installer. The panel runs as `lamaste` and can start, stop and restart these services through fixed sudoers lines, but never writes their units.
+
+On every start the panel reconciles Chisel in the background (server key, authfile; it also checks that the installed binary is the pinned release and logs an error if not). If the authfile cannot be established it stops and disables `chisel.service` (marker: `/etc/lamalibre/lamaste/chisel-failed-closed`) and retries with backoff (30 s up to 10 min), re-enabling it on success — see [Tunneling](../01-concepts/tunneling.md#startup-reconciliation).
+
+### Agent-side services
+
+Per agent label, on the agent machine (user-level, no root):
+
+| Linux (systemd user units)                          | macOS (LaunchAgents)                   | Purpose                                      |
+| --------------------------------------------------- | -------------------------------------- | -------------------------------------------- |
+| `lamalibre-lamaste-chisel-<label>.service`          | `com.lamalibre.lamaste.chisel-<label>` | Chisel client; stopped while no tunnels      |
+| `lamalibre-lamaste-sync-<label>.service` + `.timer` | `com.lamalibre.lamaste.sync-<label>`   | `lamaste-agent sync` every 30 s              |
+| `lamalibre-lamaste-panel-<label>.service`           | `com.lamalibre.lamaste.panel-<label>`  | Optional agent panel (`lamaste-agent panel`) |
+
+## Key File Paths
+
+### Configuration
+
+| Path                                                     | Description                                                                         |
+| -------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `/etc/lamalibre/lamaste/panel.json`                      | Panel server configuration                                                          |
+| `/etc/lamalibre/lamaste/tunnels.json`                    | Tunnel definitions                                                                  |
+| `/etc/lamalibre/lamaste/sites.json`                      | Static site definitions                                                             |
+| `/etc/lamalibre/lamaste/chisel-credentials.json`         | Per-agent Chisel credentials                                                        |
+| `/etc/lamalibre/lamaste/chisel-users`                    | Chisel authfile: per-agent credentials + port grants (0640, group `lamaste-chisel`) |
+| `/etc/lamalibre/lamaste/chisel-sentinel`                 | Sentinel Chisel user password                                                       |
+| `/etc/lamalibre/lamaste/ticket-scopes.json`              | Ticket scope registry (scopes, instances, assignments)                              |
+| `/etc/lamalibre/lamaste/tickets.json`                    | Ticket and session store                                                            |
+| `/etc/lamalibre/lamaste/groups.json`                     | Lamaste group definitions and membership                                            |
+| `/etc/lamalibre/lamaste/access-grants.json`              | Generic access grants (principal → resource)                                        |
+| `/etc/lamalibre/lamaste/gatekeeper.json`                 | Gatekeeper settings (cache TTL, logging)                                            |
+| `/etc/lamalibre/lamaste/access-request-log.json`         | Optional denied access log                                                          |
+| `/etc/authelia/configuration.yml`                        | Authelia server configuration                                                       |
+| `/etc/authelia/users.yml`                                | Authelia user database                                                              |
+| `/etc/authelia/.secrets.json`                            | Authelia secrets (JWT, session, encryption)                                         |
+| `/etc/nginx/snippets/lamalibre-lamaste-mtls.conf`        | mTLS configuration snippet                                                          |
+| `/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf` | Gatekeeper proxy_cache zone definition                                              |
+| `/etc/sudoers.d/lamaste`                                 | Sudo rules for lamaste user (fixed command lines, no wildcards)                     |
+| `/usr/local/sbin/lamaste-priv`                           | Root-owned helper: panel vhosts (allow-listed), Authelia TOTP, self-update          |
+| `/usr/local/sbin/lamaste-certbot`                        | Root-owned certbot wrapper (validated, fixed argv)                                  |
+| `/usr/local/sbin/lamaste-cert-info`                      | Root-owned read-only Let's Encrypt certificate queries                              |
+| `/etc/fail2ban/jail.d/lamaste.conf`                      | fail2ban jail configuration                                                         |
+| `/etc/sysctl.d/99-lamaste.conf`                          | Kernel parameter (swappiness)                                                       |
+
+### PKI Certificates
+
+| Path                                             | Description                                          |
+| ------------------------------------------------ | ---------------------------------------------------- |
+| `/etc/lamalibre/lamaste/pki/ca.key`              | Certificate Authority private key (4096-bit RSA)     |
+| `/etc/lamalibre/lamaste/pki/ca.crt`              | Certificate Authority certificate (10-year validity) |
+| `/etc/lamalibre/lamaste/pki/client.key`          | Client certificate private key (4096-bit RSA)        |
+| `/etc/lamalibre/lamaste/pki/client.crt`          | Client certificate (2-year validity, signed by CA)   |
+| `/etc/lamalibre/lamaste/pki/client.p12`          | PKCS12 bundle for browser import                     |
+| `/etc/lamalibre/lamaste/pki/.p12-password`       | Password for the PKCS12 bundle                       |
+| `/etc/lamalibre/lamaste/pki/self-signed.pem`     | Self-signed TLS cert for IP:9292 (10-year validity)  |
+| `/etc/lamalibre/lamaste/pki/self-signed-key.pem` | Self-signed TLS key for IP:9292                      |
+
+### Let's Encrypt Certificates
+
+| Path                                         | Description                       |
+| -------------------------------------------- | --------------------------------- |
+| `/etc/letsencrypt/live/<fqdn>/fullchain.pem` | Certificate chain                 |
+| `/etc/letsencrypt/live/<fqdn>/privkey.pem`   | Private key                       |
+| `/etc/letsencrypt/renewal/<fqdn>.conf`       | Auto-renewal configuration        |
+| `/etc/letsencrypt/accounts/`                 | Let's Encrypt account credentials |
+
+### nginx Vhosts
+
+| Path                                                           | Description                              |
+| -------------------------------------------------------------- | ---------------------------------------- |
+| `/etc/nginx/sites-available/lamalibre-lamaste-http-redirect`   | Port 80 catch-all, `301` to HTTPS        |
+| `/etc/nginx/sites-available/lamalibre-lamaste-panel-ip`        | IP:9292 panel vhost (mTLS, self-signed)  |
+| `/etc/nginx/sites-available/lamalibre-lamaste-panel-domain`    | Domain panel vhost (mTLS, Let's Encrypt) |
+| `/etc/nginx/sites-available/lamalibre-lamaste-auth`            | Authelia portal vhost                    |
+| `/etc/nginx/sites-available/lamalibre-lamaste-tunnel`          | Chisel WebSocket vhost                   |
+| `/etc/nginx/sites-available/lamalibre-lamaste-app-<subdomain>` | Per-tunnel app vhosts                    |
+| `/etc/nginx/sites-available/lamalibre-lamaste-site-<uuid>`     | Per-static-site vhosts                   |
+
+### Application Files
+
+| Path                                                      | Description               |
+| --------------------------------------------------------- | ------------------------- |
+| `/opt/lamalibre/lamaste/lamaste-serverd/`                 | Fastify backend (Node.js) |
+| `/opt/lamalibre/lamaste/lamaste-serverd/src/index.js`     | Server entry point        |
+| `/opt/lamalibre/lamaste/lamaste-serverd/package.json`     | Server dependencies       |
+| `/opt/lamalibre/lamaste/lamaste-server-ui/`               | React frontend            |
+| `/opt/lamalibre/lamaste/lamaste-server-ui/dist/`          | Built static assets       |
+| `/opt/lamalibre/lamaste/lamaste-server-ui/cert-help.html` | Certificate help page     |
+| `/var/www/lamaste/`                                       | Static site uploads       |
+
+## Log Locations
+
+| Service                      | Log Method      | View Command                                                 |
+| ---------------------------- | --------------- | ------------------------------------------------------------ |
+| lamalibre-lamaste-serverd    | journald        | `journalctl -u lamalibre-lamaste-serverd`                    |
+| lamalibre-lamaste-gatekeeper | journald        | `journalctl -u lamalibre-lamaste-gatekeeper`                 |
+| chisel                       | journald        | `journalctl -u chisel`                                       |
+| authelia                     | journald + file | `journalctl -u authelia` or `/var/log/authelia/authelia.log` |
+| nginx                        | file            | `/var/log/nginx/access.log` and `/var/log/nginx/error.log`   |
+| fail2ban                     | file            | `/var/log/fail2ban.log`                                      |
+| certbot                      | file            | `/var/log/letsencrypt/letsencrypt.log`                       |
+
+### Useful Log Commands
+
+| Command                                      | Description                    |
+| -------------------------------------------- | ------------------------------ |
+| `journalctl -u lamalibre-lamaste-serverd -f` | Follow panel logs in real time |
+| `journalctl -u chisel --since "1 hour ago"`  | Last hour of Chisel logs       |
+| `journalctl -u authelia -n 50`               | Last 50 Authelia log entries   |
+| `tail -f /var/log/nginx/error.log`           | Follow nginx error log         |
+| `tail -f /var/log/fail2ban.log`              | Follow fail2ban activity       |
+| `journalctl --disk-usage`                    | Check journal disk usage       |
+
+## Binary Locations
+
+| Binary   | Path                      | Source                                                                                      | Version Check        |
+| -------- | ------------------------- | ------------------------------------------------------------------------------------------- | -------------------- |
+| Chisel   | `/usr/local/bin/chisel`   | GitHub release 1.12.0, SHA-256 pinned, installed by `create-lamaste`                        | `chisel --version`   |
+| Authelia | `/usr/local/bin/authelia` | GitHub release 4.39.28, SHA-256 pinned, installed by `create-lamaste` (a newer one is kept) | `authelia --version` |
+| Node.js  | `/usr/bin/node`           | NodeSource repo                                                                             | `node --version`     |
+| npm      | `/usr/bin/npm`            | NodeSource repo                                                                             | `npm --version`      |
+| nginx    | `/usr/sbin/nginx`         | apt package                                                                                 | `nginx -v`           |
+| certbot  | `/usr/bin/certbot`        | apt package                                                                                 | `certbot --version`  |
+| openssl  | `/usr/bin/openssl`        | apt package                                                                                 | `openssl version`    |
+
+## Quick Reference
+
+**Check all service statuses at once:**
+
+```bash
+sudo systemctl status nginx chisel authelia lamalibre-lamaste-serverd lamalibre-lamaste-gatekeeper --no-pager
+```
+
+**Check which ports are listening:**
+
+```bash
+sudo ss -tlnp | grep -E ':(22|80|443|3100|9090|9091|9292|9294)\s'
+```
+
+**Check disk usage of Lamaste directories:**
+
+```bash
+sudo du -sh /etc/lamalibre/lamaste/ /opt/lamalibre/lamaste/ /var/www/lamaste/ /etc/authelia/ /etc/letsencrypt/ 2>/dev/null
+```
+
+**Check all Lamaste-related nginx sites:**
+
+```bash
+ls -la /etc/nginx/sites-enabled/lamaste-*
+```
+
+**Validate nginx configuration:**
+
+```bash
+sudo nginx -t
+```