=Voir le nombre MAX de VF supportées=
root@proxmox:~# cat /sys/class/net/enp8s0f1np1/device/sriov_totalvfs
=Voir combien de VF sont actives actuellement=
root@proxmox:~# cat /sys/class/net/enp8s0f1np1/device/sriov_numvfs
=Créer des VF temporaire=
Exemple : créer 4 VF
root@proxmox:~# echo 4 > /sys/class/net/enp8s0f1np1/device/sriov_numvfs
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Il est recommandé de ne pas créer plus de VF que nécessaire.
}}
=Créer des VF=
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Exemple avec 4 VF.
}}
{{Méta bandeau
| niveau = modéré
| icône = modéré
| texte = Il est préférable d'utiliser [[#Créer_des_VF_avec_adresses_MAC_fixes|le service de création de VF avec MAC adress assignées]] pour plus de stabiliter.
}}
On crée un service :
root@proxmoxve:~# vi /etc/systemd/system/sriov-x710.service
Contenu :
[Unit]
Description=Enable SR-IOV on Intel X710
After=systemd-modules-load.service
Before=pve-guests.service

[Service]
Type=oneshot
ExecStart=/bin/sh -c 'echo 4 > /sys/class/net/enp8s0f1np1/device/sriov_numvfs'
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Puis on active le service ;
systemctl daemon-reload
systemctl enable sriov-x710
systemctl start sriov-x710

=Créer des VF avec adresses MAC fixes=
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Permet d'éviter les problèmes de VF sans adresses MAC au reboot des VM etc..
}}

On crée un service :
root@proxmoxve:~# vi /etc/systemd/system/sriov-x710.service
Contenu :
[Unit]
Description=Enable SR-IOV on Intel X710 (fixed VF MACs)
After=systemd-modules-load.service
Before=pve-guests.service

[Service]
Type=oneshot
ExecStart=/bin/bash -c 'set -e; \
DEV=enp8s0f1np1; \
for i in {1..20}; do [ -e /sys/class/net/$DEV ] && break; sleep 0.2; done; \
echo 0 > /sys/class/net/$DEV/device/sriov_numvfs; \
sleep 1; \
echo 4 > /sys/class/net/$DEV/device/sriov_numvfs; \
sleep 1; \
ip link set $DEV vf 0 mac 02:00:00:10:01:00; \
ip link set $DEV vf 1 mac 02:00:00:10:01:01; \
ip link set $DEV vf 2 mac 02:00:00:10:01:02; \
ip link set $DEV vf 3 mac 02:00:00:10:01:03'
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Puis on active le service ;
systemctl daemon-reload
systemctl enable sriov-x710
systemctl start sriov-x710
= Hookscript pour permettre au VF de communiquer entre elle =
[https://github.com/jdlayman/pve-hookscript-sriov Source github]
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Certaines cartes réseaux (exemple la Intel x710) empêchent les cartes réseaux virtuelles de communiquer avec les VF sur le même "bridge" réseau, ce script permet de contourner le problème en inscrivant les MAC adress sur le "bridge".
}}
== Installation du script ==
# mkdir -p /var/lib/vz/snippets
# wget -O /var/lib/vz/snippets/bridgefix.sh https://raw.githubusercontent.com/jdlayman/pve-hookscript-sriov/master/bridgefix.sh
# chmod 755 /var/lib/vz/snippets/bridgefix.sh

{| class="mw-collapsible mw-collapsed"
| '''Contenu du script'''
|-
|
<pre>
#!/bin/bash

# Hook script for PVE guests (hookscript config option)
# You can set this via pct/qm with
# pct set <vmid> -hookscript <volume-id>
# qm set <vmid> -hookscript <volume-id>
# where <volume-id> has to be an executable file in the snippets folder
# of any storage with directories e.g.:
# for KVM: qm set 100 -hookscript local:snippets/pf-bridge-fdb.sh
# or
# for CT: pct set 100 -hookscript local:snippets/pf-bridge-fdb.sh

#
# Modified from ctr's hookscript to add bridged CT and VM MAC addresses to the upstream PF interface.
# https://forum.proxmox.com/threads/communication-issue-between-sriov-vm-vf-and-ct-on-pf-bridge.68638/#post-435959
#

USAGE="Usage: $0 vmid phase"

if [ "$#" -ne "2" ]; then
echo "$USAGE"
exit 1
fi

echo "GUEST HOOK: $0 $*"

# First argument is the vmid

vmid=$1
if [[ $1 == ?(-)+([:digit:]) ]]; then
echo "$USAGE"
exit 1
fi

# Second argument is the phase

phase=$2
case "${phase}" in
pre-start|post-start|pre-stop|post-stop) : ;;
*) echo "got unknown phase ${phase}"; exit 1 ;;
esac

function fixup_bridge_fdb {
OPERATION=$1
# Lookup Proxmox config for by vmid
CONFFILE=$(find /etc/pve -type f -name ${vmid}.conf)
if [ -f "${CONFFILE}" ]; then
# get defined networks
NETWORKS=$(egrep "^net" ${CONFFILE}| fgrep bridge= | awk '{print $2}')
#echo $NETWORKS
for i in ${NETWORKS}; do
#echo $i
declare macaddr=""
declare bridge=""
declare vlan=""
IFS=\, read -a NETWORK <<<"$i"
# get attributes for current network
for item in "${NETWORK[@]}"; do
IFS=\= read -a kv <<<"$item"
case "${kv[0]}" in
tag) vlan=${kv[1]};;
bridge) bridge=${kv[1]};;
virtio) macaddr=${kv[1]};;
hwaddr) macaddr=${kv[1]};;
vmxnet3) macaddr=${kv[1]};;
esac
done
# special processing needed if member of vlan
if [ ! -z "${vlan}" ]; then
vlancheck=${vlan}
else
vlancheck="checking"
fi
# lookup member interfaces of defined bridge interface
bridgeinterfaces=$(ls -1 /sys/class/net/${bridge}/brif/ 2>/dev/null)
# for every member interface, if it is an SR-IOV PF then ...
#echo $bridgeinterfaces
for memberint in ${bridgeinterfaces}; do
if [ -d "/sys/class/net/${memberint}/bonding" ]; then
# find interfaces that are bonded
IFS=' ' read -a bondedints <<< $(cat /sys/class/net/${memberint}/bonding/slaves 2>/dev/null)
for bondedint in ${bondedints[@]}; do
#echo $bondedint
if [ -L "/sys/class/net/${bondedint}/device/virtfn0" ]; then
# echo $memberint
subint="${bondedint}"
# check if entry in fdb and only execute when needed
present=$(bridge fdb show dev ${subint} | fgrep -i ${macaddr})
if [[ -z $present && $OPERATION == "add" ]] || [[ -n $present && $OPERATION == "del" ]]; then
echo bridge fdb ${OPERATION} ${macaddr} dev ${subint}
bridge fdb ${OPERATION} ${macaddr} dev ${subint}
fi
fi
done
fi
# only proceed if memberinterface is PF with VF
if [ -L "/sys/class/net/${memberint}/device/virtfn0" ]; then
# echo $memberint
subint="${memberint}"
## check if a vf is on the vlan
#vf=$(ip link show dev ${memberint} 2>/dev/null |awk -v vlan="${vlancheck}" '{ if( $6 ~ vlan) print $2}')
#if [ ! -z "${vf}" ]; then
# if [ ! -z "${vlan}" ]; then
# subint="${memberint}.${vlan}"
# else
# subint="${memberint}"
# fi
#fi
# check if entry in fdb and only execute when needed
present=$(bridge fdb show dev ${subint} | fgrep -i ${macaddr})
if [[ -z $present && $OPERATION == "add" ]] || [[ -n $present && $OPERATION == "del" ]]; then
echo bridge fdb ${OPERATION} ${macaddr} dev ${subint}
bridge fdb ${OPERATION} ${macaddr} dev ${subint}
fi
fi
done
done
else
echo "VM or CT does not exist, aborting"
fi
}

case "${phase}" in
pre-start) echo "${vmid} is starting, doing bridge fdb setup." && fixup_bridge_fdb add ;;
post-stop) echo "${vmid} stopped. Doing bridge fdb cleanup." && fixup_bridge_fdb del ;;
esac

exit 0
</pre>
|}

NIC SR-IOV

2026-04-11T12:29:17Z

Admin : /* Créer des VF */

WireGuard LXC Alpine Linux

2026-04-04T13:45:39Z

Admin : /* Importation ancienne configuration */

{{Barre de progression|100|largeur=400px|hauteur=10|couleur1 = green|texte=Testé et approuvé}}

{{Méta bandeau
| niveau = information
| icône = loupe
| texte = A noter qu'il existe une version Docker tout en un (VPN + GUI de gestion) beaucoup plus simple à mettre en place, mais avec surcouche réseau d'un conteneur, nommé [https://github.com/wg-easy/wg-easy wg-easy] (non testé).
}}

= LXC Alpine 3.12 =
== Installation de WireGuard Server ==
Avec un téléphone android connecté !!! :

[[File:Capture_ressource_WG_AlpineLXC.PNG|Incroyablement économe !]]

On autorise le routage :
lxcalpine:~# echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
lxcalpine:~# sysctl -p

net.ipv4.ip_forward = 1

lxcalpine:~# rc-update add sysctl default

Puis on install :

lxcalpine:~# apk update && apk upgrade
lxcalpine:~# apk add wireguard-tools
== Configuration de WireGuard Server ==
On génère la configuration sur [https://www.wireguardconfig.com/ '''wireguardconfig''']

<code># vi /etc/wireguard/wg0.conf</code>
<pre>[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = *****************************************
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 10.0.0.3/32

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 10.0.0.4/32
</pre>

<code># vi /etc/wireguard/client1.conf</code>

[Interface]
Address = 10.0.0.2/24
ListenPort = 51820
PrivateKey = *****************************************

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = myserver.dyndns.org:51820

{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Opération à répéter pour chaque client..
}}
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Allowed IP modifié pour ne pas rediriger tout le traffic et perdre l'accès a son réseau local..
}}
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Allowed IP peut aussi être modifié pour ne rediriger que les paquets a destination du réseau distant et conserver Internet localement sans passer par le serveur distant, exemple : "'''AllowedIPs = 192.168.2.0/24'''"
}}

== Test du service ==
<code>lxcalpine:~# wg-quick up wg0</code>
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

lxcalpine:~# wg

interface: wg0
public key: *****************************************
private key: (hidden)
listening port: 51820

peer: *****************************************
preshared key: (hidden)
allowed ips: 10.0.0.2/32

peer: *****************************************
preshared key: (hidden)
allowed ips: 10.0.0.3/32

peer: *****************************************
preshared key: (hidden)
allowed ips: 10.0.0.4/32

Fin du test :
lxcalpine:~# wg-quick down wg0

[#] ip link delete dev wg0
[#] iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

== Création du script init.d pour lancer le service ==

[https://gist.github.com/r0v/48e18c9584d4b5ecb96f593dec9a938c '''source''']

lxcalpine:~# vi /etc/init.d/wireguard

#!/sbin/openrc-run

depend() {
need localmount
need net
}

start() {
ebegin "Starting wireguard"
/usr/bin/wg-quick up wg0
eend $?
}

stop() {
ebegin "Stopping wireguard"
/usr/bin/wg-quick down wg0
eend $?
}

On active le script immédiatement et au redémarrage :
lxcalpine:~# chmod +x /etc/init.d/wireguard
lxcalpine:~# rc-update add wireguard default
lxcalpine:~# service wireguard start
On peut [[#Test_du_service|tester]] avec "wg", rebooter pour vérifier etc...

== (Optionnel) QR Code ==

lxcalpine:~# apk add libqrencode

Exemple :
lxcalpine:~# qrencode -t ansiutf8 < /etc/wireguard/client1.conf

voila!
== Ajout d'un utilisateur ==
On crée les clefs de cryptage pour le nouvel utilisateur dans le repertoir "tmp" :
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Remplacer nom_utilisateur par le nom souhaité.
}}
# cd /tmp/
# umask 077
# name="nom_utilisateur"
# wg genkey | tee "${name}.key" | wg pubkey > "${name}.pub"
# wg genpsk > "${name}.psk"
On peuple le fichier de configuration de WireGuard avec le nouvel utilisateur :
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Remplacer 10.0.0.5/32 par une adresse VPN libre.
}}
# echo "" >> /etc/wireguard/wg0.conf
# echo "[Peer]" >> /etc/wireguard/wg0.conf
# echo "PublicKey = $(cat "${name}.pub")" >> /etc/wireguard/wg0.conf
# echo "PresharedKey = $(cat "${name}.psk")" >> /etc/wireguard/wg0.conf
# echo "AllowedIPs = 10.0.0.5/32" >> /etc/wireguard/wg0.conf
Ensuite on peuple le fichier de configuration utilisateur, il faut d'abord récupérer la clef pubique du serveur (ici en bleu) :
# wg

interface: wg0
public key: MaClEfPubLiQUe=
private key: (hidden)
...
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = 10.0.0.5/24 adresse VPN libre sélectionner dans le fichier utilisateur ci-dessus / 192.168.1.0/24 l'adresse du serveur cible à atteindre (différentes configuration possible [[#Configuration_de_WireGuard_Server|voir la configuration serveur)]]
}}
# echo "[Interface]" > "/etc/wireguard/${name}.conf"
# echo "Address = 10.0.0.5/24" >> "/etc/wireguard/${name}.conf"
# echo "ListenPort = 51820" >> "/etc/wireguard/${name}.conf"
# echo "PrivateKey = $(cat "${name}.key")" >> "/etc/wireguard/${name}.conf"
# echo "" >> "/etc/wireguard/${name}.conf"
# echo "[Peer]" >> "/etc/wireguard/${name}.conf"
# echo "PublicKey = MaClEfPubLiQUe=" >> "/etc/wireguard/${name}.conf"
# echo "PresharedKey = $(cat "${name}.psk")" >> "/etc/wireguard/${name}.conf"
# echo "AllowedIPs = 192.168.1.0/24" >> "/etc/wireguard/${name}.conf"
# echo "Endpoint = monserveurvpn.exemple.net:51820" >> "/etc/wireguard/${name}.conf"
Enfin on redémarre le service pour appliquer les changement :
# service wireguard restart
= wireguard-ui =
[https://github.com/ngoduykhanh/wireguard-ui Source github]
== Installation ==
On récupère le programme :
# mkdir -p /opt/wgui
# cd /opt/wgui
# <nowiki>https://</nowiki>github.com/ngoduykhanh/wireguard-ui/releases/download/v0.6.2/wireguard-ui-v0.6.2-linux-amd64.tar.gz
# tar -xzf wireguard-ui-v0.6.2-linux-amd64.tar.gz
# rm wireguard-ui-v0.6.2-linux-amd64.tar.gz
On peut tester le fonctionnement du serveur en lançant le bin :
# /opt/wgui/wireguard-ui
Le serveur web sera accessible sur le port 5000, avec l'utilisateur "admin" et mot de passe "admin" par défault (penser à changer le mot de passe immédiatement).
== Création des scripts RC ==
=== (Optionnel) Script pour surveillé wg0.conf ===
On crée le script exécutable :
# vi /usr/local/bin/wgui

#!/bin/sh
wg-quick down wg0
wg-quick up wg0

# chmod +x /usr/local/bin/wgui
Puis le script RC pour l'utiliser :
# vi /etc/init.d/wgui

#!/sbin/openrc-run

command=/sbin/inotifyd
command_args="/usr/local/bin/wgui /etc/wireguard/wg0.conf:w"
pidfile=/run/${RC_SVCNAME}.pid
command_background=yes

# chmod +x /etc/init.d/wgui
Enfin on inscrit le script RC au système :
# rc-service wgui start
# rc-update add wgui default
=== Script RC pour lancer le GUI automatiquement ===
# vi /etc/init.d/wireguard-ui

#!/sbin/openrc-run

name="wireguard-ui"
directory="/opt/wgui"
command="/opt/wgui/wireguard-ui"
command_background="yes"
pidfile="/run/${RC_SVCNAME}.pid"

depend() {
need net
}

# chmod +x /etc/init.d/wireguard-ui
# rc-update add wireguard-ui default
# rc-service wireguard-ui start
# reboot
== Importation ancienne configuration ==
"wireguard-ui" est un projet fonctionnel mais dont le développement est abandonné/lent. L'interface web n'est pas prévu pour lire une ancienne configuation, si vous ne démarrez pas votre VPN avec la GUI (donc en partant de 0) il faudra modifier des fichiers .json à la main dans "/opt/wgui/db/"

A noter qu'un utilisateur à créé [https://github.com/ngoduykhanh/wireguard-ui/issues/485 un script d'import automatisé] (non testé).

Certains paramètres pourront être recréé via la GUI, d'autres devront être modifié à la main (pensez a sauvegarder votre wg0.conf et fichiers clients), exemples :
* Les clefs du serveur se trouvent dans "/opt/wgui/db/server/keypair.json"
* il est possible de recréer les utilisateur via la GUI, mais si vous spécifiez la "PublicKey" et "PresharedKey" alors il faudra renseigner la "private_key" dans "/opt/wgui/db/clients/client.json
== vhost nginx ==
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Voir [[Nginx_ReverseProxy_LXC_Alpine_Linux|Reverse Proxy Nginx]]
}}

server {
listen 80;
listen [::]:80;
server_name wireguard.exemple.net;
# return 404;
return 301 <nowiki>https://</nowiki>$host$request_uri;
}

server {
server_name wireguard.exemple.net;
error_page 403 <nowiki>https://</nowiki>wireguard.exemple.net;

location / {
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
#proxy_set_header X-Forwarded-Host $host;
#proxy_set_header X-Forwarded-Port $server_port;
proxy_pass http://IP_SERVEUR_WEB:5000;
# proxy_pass <nowiki>https://</nowiki>IP_SERVEUR_WEB:PORT; #Alternatif pour redirection sur https
#proxy_buffering off; #activer pour désactiver le "buffering"
}

listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot

ssl_certificate /etc/letsencrypt/live/wireguard.exemple.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/wireguard.exemple.net/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
ssl_trusted_certificate /etc/letsencrypt/live/wireguard.exemple.net/chain.pem;
#ssl_stapling on;
#ssl_stapling_verify on;

server_tokens off;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";

}

Nginx ReverseProxy LXC Alpine Linux

2026-04-04T13:21:52Z

Admin : /* Création d'un "vhost" sécurisé */

Installation d'un reverse proxy Nginx avec Certbot. Le container servira de point d'entrée pour les requêtes HTTP (port:80) et HTTPS (port:443) pour les rediriger sur les serveurs idoines en HTTPS uniquement. Certbot permettra de créer des certificat SSL reconnu par les navigateurs comme sécurisé.

= Installation =
On installe les paquets de base :
# apk update && apk upgrade
# apk add nginx certbot certbot-nginx
On modifie la configuration de Nginx pour la rapprocher du standard des distributions type Debian :
{{Méta bandeau
| niveau = information
| icône = important
| texte = Optionnel, sinon utiliser silmplement le répertoire "'''/etc/nginx/conf.d/'''" (Alpine 3.12) ou "'''/etc/nginx/http.d/'''" (Alpine 3.13)
}}
# mkdir /etc/nginx/sites-available && mkdir /etc/nginx/sites-enabled
On modifie le fichier de configuration de Nginx en ajoutant la ligne suivante :
# vi /etc/nginx/nginx.conf
----
* Alpine Linux 3.12 :
...
# Includes virtual hosts configs.
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
...
* Alpine Linux 3.13 :
...
# Includes virtual hosts configs.
include /etc/nginx/http.d/*.conf;
include /etc/nginx/sites-enabled/*;
...
{{Méta bandeau
| niveau = modéré
| icône = important
| texte = Voir [[UpgradeAlpine#NGINX|'''ce lien''']]
}}
----
On supprime le site par défaut :
* Alpine Linux 3.12 :
# rm /etc/nginx/conf.d/default.conf
* Alpine Linux 3.13 :
# rm /etc/nginx/http.d/default.conf
On active le serveur :
# rc-update add nginx default
# service nginx start

=Création d'un "vhost" sécurisé=
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Exemple avec "'''site.exemple.net'''"
}}
==Création du certificat==
# certbot certonly --nginx --agree-tos --email moncourriel@exemple.net -d site.exemple.net

==Création du vhost==
On crée le fichier de configuration dans "/etc/nginx/site-availables"
# vi /etc/nginx/sites-available/exemple.conf

server {
listen 80;
listen [::]:80;
server_name site.exemple.net;
# return 404;
return 301 <nowiki>https://</nowiki>$host$request_uri;
}

server {
server_name site.exemple.net;
error_page 403 https://site.exemple.net;

location / {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_pass http://IP_SERVEUR_WEB:PORT;
# proxy_pass https://IP_SERVEUR_WEB:PORT; #Alternatif pour redirection sur https
#proxy_buffering off; #activer pour désactiver le "buffering"
}

listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot

ssl_certificate /etc/letsencrypt/live/site.exemple.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/site.exemple.net/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
ssl_trusted_certificate /etc/letsencrypt/live/site.exemple.net/chain.pem;
#ssl_stapling on;
#ssl_stapling_verify on;

server_tokens off;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";

}

== Test et activation ==
On crée un lien symbolique du fichier de configuration dans le répertoire des site actifs :
# ln -s /etc/nginx/sites-available/exemple.conf /etc/nginx/sites-enabled/
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Ainsi pour désactiver et conserver le fichier de configuration d'un site on ne supprime que le lien symbolique et on recharge Nginx.
}}
{{Méta bandeau
| niveau = modéré
| icône = important
| texte = Toujours utiliser les chemins complets pour la création des liens symboliques.
}}
On test la configuration :
# nginx -t
On recharge la configuration pour activation :
# service nginx reload
On peut aussi utiliser la commande suivante :
# nginx -s reload

= Renouvellement certificat "Let's Encrypt" =
== Ligne de commande ==
La commande suivante renouvellera tous les certificats avec une période de validité inférieur à 30 jours :
# certbot renew
== Automatisation via la crontab ==
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Dans cet exemple la commande est lancée tous les premiers du mois à 4h00 avec la date et la sortie texte dans le fichier "/var/log/letsencrypt/crontupdate.log".
}}
# crontab -e

...
0 4 1 * * /bin/date > /var/log/letsencrypt/crontupdate.log && /usr/bin/certbot renew >> /var/log/letsencrypt/crontupdate.log

On peut également recevoir le résultat par mail :
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Voir [[Postfix#Alpine_Linux|installation d'un relais local Postfix]].
}}
...
MAILTO=root
0 4 1 * * /bin/date > /var/log/letsencrypt/crontupdate.log && /usr/bin/certbot renew >> /var/log/letsencrypt/crontupdate.log

= Révocation certificat "Let's Encrypt" =
# certbot revoke --cert-name site.exemple.net

...
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you like to delete the certificate(s) you just revoked, along with all
earlier and later versions of the certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es (recommended)/(N)o: '''Y'''

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificate(s) are selected for deletion:

* site.exemple.net

Are you sure you want to delete the above certificate(s)?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: '''Y'''

WireGuard LXC Alpine Linux

2026-04-04T12:59:57Z

Admin : /* Création des scripts RC */

WireGuard LXC Alpine Linux

2026-04-04T11:49:25Z

Admin : /* Script RC pour lancer le GUI automatiquement */

WireGuard LXC Alpine Linux

2026-04-04T11:33:17Z

Admin : /* wireguard-ui */

{{Barre de progression|100|largeur=400px|hauteur=10|couleur1 = green|texte=Testé et approuvé}}

{{Méta bandeau
| niveau = information
| icône = loupe
| texte = A noter qu'il existe une version Docker tout en un (VPN + GUI de gestion) beaucoup plus simple à mettre en place, mais avec surcouche réseau d'un conteneur, nommé [https://github.com/wg-easy/wg-easy wg-easy] (non testé).
}}

= LXC Alpine 3.12 =
== Installation de WireGuard Server ==
Avec un téléphone android connecté !!! :

[[File:Capture_ressource_WG_AlpineLXC.PNG|Incroyablement économe !]]

On autorise le routage :
lxcalpine:~# echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
lxcalpine:~# sysctl -p

net.ipv4.ip_forward = 1

lxcalpine:~# rc-update add sysctl default

Puis on install :

lxcalpine:~# apk update && apk upgrade
lxcalpine:~# apk add wireguard-tools
== Configuration de WireGuard Server ==
On génère la configuration sur [https://www.wireguardconfig.com/ '''wireguardconfig''']

<code># vi /etc/wireguard/wg0.conf</code>
<pre>[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = *****************************************
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 10.0.0.3/32

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 10.0.0.4/32
</pre>

<code># vi /etc/wireguard/client1.conf</code>

[Interface]
Address = 10.0.0.2/24
ListenPort = 51820
PrivateKey = *****************************************

[Peer]
PublicKey = *****************************************
PresharedKey = *****************************************
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = myserver.dyndns.org:51820

{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Opération à répéter pour chaque client..
}}
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Allowed IP modifié pour ne pas rediriger tout le traffic et perdre l'accès a son réseau local..
}}
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Allowed IP peut aussi être modifié pour ne rediriger que les paquets a destination du réseau distant et conserver Internet localement sans passer par le serveur distant, exemple : "'''AllowedIPs = 192.168.2.0/24'''"
}}

== Test du service ==
<code>lxcalpine:~# wg-quick up wg0</code>
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

lxcalpine:~# wg

interface: wg0
public key: *****************************************
private key: (hidden)
listening port: 51820

peer: *****************************************
preshared key: (hidden)
allowed ips: 10.0.0.2/32

peer: *****************************************
preshared key: (hidden)
allowed ips: 10.0.0.3/32

peer: *****************************************
preshared key: (hidden)
allowed ips: 10.0.0.4/32

Fin du test :
lxcalpine:~# wg-quick down wg0

[#] ip link delete dev wg0
[#] iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

== Création du script init.d pour lancer le service ==

[https://gist.github.com/r0v/48e18c9584d4b5ecb96f593dec9a938c '''source''']

lxcalpine:~# vi /etc/init.d/wireguard

#!/sbin/openrc-run

depend() {
need localmount
need net
}

start() {
ebegin "Starting wireguard"
/usr/bin/wg-quick up wg0
eend $?
}

stop() {
ebegin "Stopping wireguard"
/usr/bin/wg-quick down wg0
eend $?
}

On active le script immédiatement et au redémarrage :
lxcalpine:~# chmod +x /etc/init.d/wireguard
lxcalpine:~# rc-update add wireguard default
lxcalpine:~# service wireguard start
On peut [[#Test_du_service|tester]] avec "wg", rebooter pour vérifier etc...

== (Optionnel) QR Code ==

lxcalpine:~# apk add libqrencode

Exemple :
lxcalpine:~# qrencode -t ansiutf8 < /etc/wireguard/client1.conf

voila!
== Ajout d'un utilisateur ==
On crée les clefs de cryptage pour le nouvel utilisateur dans le repertoir "tmp" :
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Remplacer nom_utilisateur par le nom souhaité.
}}
# cd /tmp/
# umask 077
# name="nom_utilisateur"
# wg genkey | tee "${name}.key" | wg pubkey > "${name}.pub"
# wg genpsk > "${name}.psk"
On peuple le fichier de configuration de WireGuard avec le nouvel utilisateur :
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Remplacer 10.0.0.5/32 par une adresse VPN libre.
}}
# echo "" >> /etc/wireguard/wg0.conf
# echo "[Peer]" >> /etc/wireguard/wg0.conf
# echo "PublicKey = $(cat "${name}.pub")" >> /etc/wireguard/wg0.conf
# echo "PresharedKey = $(cat "${name}.psk")" >> /etc/wireguard/wg0.conf
# echo "AllowedIPs = 10.0.0.5/32" >> /etc/wireguard/wg0.conf
Ensuite on peuple le fichier de configuration utilisateur, il faut d'abord récupérer la clef pubique du serveur (ici en bleu) :
# wg

interface: wg0
public key: MaClEfPubLiQUe=
private key: (hidden)
...
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = 10.0.0.5/24 adresse VPN libre sélectionner dans le fichier utilisateur ci-dessus / 192.168.1.0/24 l'adresse du serveur cible à atteindre (différentes configuration possible [[#Configuration_de_WireGuard_Server|voir la configuration serveur)]]
}}
# echo "[Interface]" > "/etc/wireguard/${name}.conf"
# echo "Address = 10.0.0.5/24" >> "/etc/wireguard/${name}.conf"
# echo "ListenPort = 51820" >> "/etc/wireguard/${name}.conf"
# echo "PrivateKey = $(cat "${name}.key")" >> "/etc/wireguard/${name}.conf"
# echo "" >> "/etc/wireguard/${name}.conf"
# echo "[Peer]" >> "/etc/wireguard/${name}.conf"
# echo "PublicKey = MaClEfPubLiQUe=" >> "/etc/wireguard/${name}.conf"
# echo "PresharedKey = $(cat "${name}.psk")" >> "/etc/wireguard/${name}.conf"
# echo "AllowedIPs = 192.168.1.0/24" >> "/etc/wireguard/${name}.conf"
# echo "Endpoint = monserveurvpn.exemple.net:51820" >> "/etc/wireguard/${name}.conf"
Enfin on redémarre le service pour appliquer les changement :
# service wireguard restart
= wireguard-ui =
[https://github.com/ngoduykhanh/wireguard-ui Source github]
== Installation ==
On récupère le programme :
# mkdir -p /opt/wgui
# cd /opt/wgui
# <nowiki>https://</nowiki>github.com/ngoduykhanh/wireguard-ui/releases/download/v0.6.2/wireguard-ui-v0.6.2-linux-amd64.tar.gz
# tar -xzf wireguard-ui-v0.6.2-linux-amd64.tar.gz
# rm wireguard-ui-v0.6.2-linux-amd64.tar.gz
On peut tester le fonctionnement du serveur en lançant le bin :
# /opt/wgui/wireguard-ui
Le serveur web sera accessible sur le port 5000, avec l'utilisateur "admin" et mot de passe "admin" par défault (penser à changer le mot de passe immédiatement).
== Création des scripts RC ==
=== (Optionnel) Script pour surveillé wg0.conf ===
On crée le script exécutable :
# vi /usr/local/bin/wgui

#!/bin/sh
wg-quick down wg0
wg-quick up wg0

# chmod +x /usr/local/bin/wgui
Puis le script RC pour l'utiliser :
# vi /etc/init.d/wgui

#!/sbin/openrc-run

command=/sbin/inotifyd
command_args="/usr/local/bin/wgui /etc/wireguard/wg0.conf:w"
pidfile=/run/${RC_SVCNAME}.pid
command_background=yes

# chmod +x /etc/init.d/wgui
Enfin on inscrit le script RC au système :
# rc-service wgui start
# rc-update add wgui default
=== Script RC pour lancer le GUI automatiquement ===
# vi /etc/init.d/wireguard-ui

#!/sbin/openrc-run

name="wireguard-ui"
command="/opt/wgui/wireguard-ui"
command_background="yes"
pidfile="/run/${RC_SVCNAME}.pid"

depend() {
need net
}

# chmod +x /etc/init.d/wireguard-ui
# rc-update add wireguard-ui default
# rc-service wireguard-ui start
# reboot

= Prérequis =
* Alpine LXC avec Nesting et keyctl activé (Docker).
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = En cas d'utilisation d'autre service de rétrogaming comme [[Gowstream|Games On Whales]] il peut être préférable de les regrouper sur une même machine pour le partage les ressources de "scraping".
}}
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Sans les droits d'écritures sur les dossiers certaines fonctions de gestion de ROMM ne pourront pas fonctionner (suppression / import..)..
}}
Ressource confortable :
* 2 CPU
* 2Gb de RAM
* 16GB de Disque
Il est recommandé d'organiser les fichiers de la façon suivante :
/roms/{platform}/
/bios/{platform}/
Il est également nécessaire d'utiliser des noms de dossier reconnu par ROMM, exemple :
roms/
nes
snes
n64
gb
gbc
gba
genesis
segacd
sega32
neogeomvs
neo-geo-pocket
tg16
pcenginecd
wonderswan
wonderswan-color

== Metadata ==
Afin d'obtenir les jaquettes etc il est recommandé de :
* créer un compte chez [https://www.screenscraper.fr/membreinscription.php screenscraper]
* créer une clef API chez [https://www.steamgriddb.com/profile/preferences/api steamgriddb]
* créer une application "twitch developers" (nécessite un mobile) pour certaines focntions, suivre [https://docs.romm.app/4.5.0/Getting-Started/Metadata-Providers/#igdb ce tutoriel].

= Installation =
# apk update && apk upgrade
# apk add docker docker-cli-compose
# rc-update add docker default
# rc-service docker start
# mkdir -p /opt/romm /opt/romm/config /opt/romm/data /opt/romm/assets
# cd /opt/romm
Fichier de configuration du conteneur :
# vi docker-compose.yml

version: "3.8"

volumes:
mysql_data:
romm_resources:
romm_redis_data:

services:
romm:
image: ghcr.io/rommapp/romm:latest
container_name: romm
restart: unless-stopped
environment:
- TZ=Europe/Madrid

# Database (MariaDB)
- DB_HOST=romm-db
- DB_NAME=romm
- DB_USER=romm-user
- DB_PASSWD=CHANGE_MOI_ROMM_MARIADB_PASSWORD # mot de passe de "romm-user", identique plus bas!!

# Required auth secret (IMPORTANT)
- ROMM_AUTH_SECRET_KEY=CHANGE_MOI_AUTH_SECRET_KEY

# Metadata providers (optionnel mais recommandé)
- SCREENSCRAPER_USER=ton_user
- SCREENSCRAPER_PASSWORD=ton_mdp
# - RETROACHIEVEMENTS_API_KEY=ta_cle
- STEAMGRIDDB_API_KEY=ta_cle
- HASHEOUS_API_ENABLED=true
- IGDB_CLIENT_ID=idapplitwitch
- IGDB_CLIENT_SECRET=motdepassapplitwitch

- SCAN_TIMEOUT=86400 # timeout de 24h
- SCAN_WORKERS=4 # limite IGBD

volumes:
# Cache / ressources / jobs
#- romm_resources:/romm/resources
- /mnt/Emulation/resources:/romm/resources:rw # stockage images, manuels etc..
- romm_redis_data:/redis-data

# Ta bibliothèque ROM (lecture seule)
- /mnt/Emulation/roms:/romm/library/roms:rw # ro pour read-only
- /mnt/Emulation/bios:/romm/library/bios:rw

# Assets RomM (écriture)
- /opt/romm/assets:/romm/assets

# Config (config.yml)
- /opt/romm/config:/romm/config:rw

ports:
- "8080:8080"

depends_on:
romm-db:
condition: service_healthy

romm-db:
image: mariadb:11
container_name: romm-db
restart: unless-stopped
environment:
- MARIADB_ROOT_PASSWORD=CHANGE_MOI_ROOT_PASSWORD
- MARIADB_DATABASE=romm
- MARIADB_USER=romm-user
- MARIADB_PASSWORD=CHANGE_MOI_ROMM_MARIADB_PASSWORD # mot de passe de "romm-user", identique plus haut!!
volumes:
- mysql_data:/var/lib/mysql
healthcheck:
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
start_period: 30s
interval: 10s
timeout: 5s
retries: 10
Fichier de configuration de ROMM :
# vi /opt/romm/config/config.yml

filesystem:
roms: /romm/library/roms
bios: /romm/library/bios

scan:
export_gamelist: true # optionnel
priority:
metadata:
- "ss"
- "hasheous"

artwork:
- "ss"
- "steamgriddb"

region:
- "eu"
- "us"
- "jp"

language:
- "fr"
- "en"
- "es"

media:
- box2d
- screenshot
- marquee
- fanart
- manual
- title_screen
- bezel

emulatorjs:
debug: false
cache_limit: null
disable_batch_bootup: false
disable_auto_unload: false

netplay:
enabled: true
ice_servers:
- urls: "stun:stun.l.google.com:19302"
- urls: "stun:stun1.l.google.com:19302"
- urls: "stun:stun2.l.google.com:19302"
- urls: "turn:openrelay.metered.ca:80"
username: "openrelayproject"
credential: "openrelayproject"
- urls: "turn:openrelay.metered.ca:443"
username: "openrelayproject"
credential: "openrelayproject"

# docker compose up -d

= vhost nginx =
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Voir [[Nginx_ReverseProxy_LXC_Alpine_Linux|Reverse Proxy Nginx]]
}}

server {
listen 80;
listen [::]:80;
server_name site.example.net;

# Force HTTPS
return 301 <nowiki>https://</nowiki>$host$request_uri;
}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name site.example.net;

# Uploads (RomM peut être "gros")
client_max_body_size 0;

# TLS (Certbot)
ssl_certificate /etc/letsencrypt/live/site.example.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/site.example.net/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

# HSTS (optionnel)
add_header Strict-Transport-Security "max-age=31536000" always;

# Sécurité / info
server_tokens off;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;

location / {
# WebSocket + keep-alive
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

# Headers reverse-proxy
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;

# Timeouts (scans/transferts longs)
proxy_read_timeout 3600;
proxy_send_timeout 3600;

# Backend RomM
proxy_pass <nowiki>http://</nowiki>IP_SERVEUR_WEB:8080;

# Optionnel: si tu as des soucis de buffering
# proxy_buffering off;
}
}
= convertir les gamelist.xml en metadata.txt =
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = Penser à exclure "'''metadata.pegasus.txt'''" des fichiers à scanner dans ROMM.}}
Pour passer de ROMM à Pegasus : [https://pegasus-frontend.org/tools/convert/ lien] (déconseillé)

Mais le convertisseur officiel ne convertie pas les assets et il faut rajouter à la main les collections etc, on peut utiliser un script local plus optimisé :

# vi /mnt/Media/Media/Emulation/gamelist_to_pegasus.py

#!/usr/bin/env python3

import sys
import xml.etree.ElementTree as ET
from pathlib import Path

ROOT = Path("/mnt/Media/Media/Emulation/roms")
if len(sys.argv) > 1:
ROOT = Path(sys.argv[1])

ADD_LAUNCH = True
RETROARCH = "retroarch --fullscreen"
CORE_DIR = "/home/retro/.config/retroarch/cores"

def clean(text):
if text is None:
return ""
return text.replace("\r", " ").replace("\n", " ").strip()

def collection_info_from_dir(dirname: str):
slug = dirname.strip().lower()

mapping = {
"arcade": ("Arcade", "arcade"),
"neogeo": ("Neo Geo", "neogeo"),
"neogeoaes": ("Neo Geo AES", "neogeo"),
"neogeomvs": ("Neo Geo MVS", "neogeo"),
"neo-geo-cd": ("Neo Geo CD", "neo-geo-cd"),
"neo-geo-pocket": ("Neo Geo Pocket", "ngp"),
"neo-geo-pocket-color": ("Neo Geo Pocket Color", "ngpc"),
"genesis": ("Sega Mega Drive/Genesis", "megadrive"),
"megadrive": ("Sega Mega Drive/Genesis", "megadrive"),
"segacd": ("Sega CD", "segacd"),
"segacd32": ("Sega CD 32X", "segacd32"),
"sega32": ("Sega 32X", "sega32x"),
"sms": ("Sega Master System/Mark III", "mastersystem"),
"mastersystem": ("Sega Master System/Mark III", "sms"),
"gamegear": ("Sega Game Gear", "gamegear"),
"sg1000": ("SG-1000", "sg-1000"),
"sc3000": ("SC-3000", "sc-3000"),
"tg16": ("TurboGrafx-16/PC Engine", "tg16"),
"pcengine": ("TurboGrafx-16/PC Engine", "tg16"),
"pcenginecd": ("Turbografx-16/PC Engine CD", "tg-cd"),
"pcecd": ("Turbografx-16/PC Engine CD", "tg-cd"),
"turbografx-cd": ("Turbografx-16/PC Engine CD", "tg-cd"),
"supergrafx": ("PC Engine SuperGrafx", "supergrafx"),
"nes": ("Nintendo Entertainment System", "nes"),
"snes": ("Super Nintendo Entertainment System", "snes"),
"sfam": ("Super Famicom", "sfam"),
"gb": ("Game Boy", "gb"),
"gbc": ("Game Boy Color", "gbc"),
"gba": ("Game Boy Advance", "gba"),
"psx": ("PlayStation", "psx"),
"ps1": ("PlayStation", "psx"),
"saturn": ("Sega Saturn", "saturn"),
"dc": ("Dreamcast", "dreamcast"),
"n64": ("Nintendo 64", "n64"),
"nds": ("Nintendo DS", "nds"),
"ngc": ("Nintendo GameCube", "gamecube"),
"wii": ("Wii", "wii"),
"lynx": ("Atari Lynx", "atarilynx"),
"jaguar": ("Atari Jaguar", "atarijaguar"),
"atari-jaguar-cd": ("Atari Jaguar CD", "atarijaguarcd"),
"wonderswan": ("WonderSwan", "wonderswan"),
"wonderswan-color": ("WonderSwan Color", "wonderswancolor"),
"msx": ("MSX", "msx"),
"msx2": ("MSX2", "msx2"),
"amiga": ("Amiga", "amiga"),
"amiga-cd32": ("Amiga CD32", "amiga-cd32"),
"scummvm": ("ScummVM", "scummvm"),
"3do": ("3DO Interactive Multiplayer", "3do"),
"psp": ("PlayStation Portable", "psp"),
"psvita": ("PlayStation Vita", "psvita"),
"vectrex": ("Vectrex", "vectrex"),
"virtualboy": ("Virtual Boy", "virtualboy"),
"zxs": ("ZX Spectrum", "zxs"),
"c64": ("Commodore C64/128/MAX", "c64"),
"c128": ("Commodore 128", "c128"),
"vic-20": ("Commodore VIC-20", "vic-20"),
"colecovision": ("ColecoVision", "colecovision"),
"atari2600": ("Atari 2600", "atari2600"),
"atari5200": ("Atari 5200", "atari5200"),
"atari7800": ("Atari 7800", "atari7800"),
"g-and-w": ("Game & Watch", "gameandwatch"),
}

if slug in mapping:
return mapping[slug]

return slug.replace("-", " ").replace("_", " ").title(), slug

def launch_for_shortname(shortname: str):
launches = {
<nowiki># arcade / neo geo
"arcade": f'{RETROARCH} -L {CORE_DIR}/fbneo_libretro.so "{{file.path}}"',
"neogeo": f'{RETROARCH} -L {CORE_DIR}/fbneo_libretro.so "{{file.path}}"',
"neogeoaes": f'{RETROARCH} -L {CORE_DIR}/fbneo_libretro.so "{{file.path}}"',
"neogeomvs": f'{RETROARCH} -L {CORE_DIR}/fbneo_libretro.so "{{file.path}}"',
"ngp": f'{RETROARCH} -L {CORE_DIR}/mednafen_ngp_libretro.so "{{file.path}}"',
"ngpc": f'{RETROARCH} -L {CORE_DIR}/mednafen_ngp_libretro.so "{{file.path}}"',

# sega
"megadrive": f'{RETROARCH} -L {CORE_DIR}/genesis_plus_gx_libretro.so "{{file.path}}"',
"segacd": f'{RETROARCH} -L {CORE_DIR}/genesis_plus_gx_libretro.so "{{file.path}}"',
"segacd32x": f'{RETROARCH} -L {CORE_DIR}/picodrive_libretro.so "{{file.path}}"',
"sega32x": f'{RETROARCH} -L {CORE_DIR}/picodrive_libretro.so "{{file.path}}"',
"mastersystem": f'{RETROARCH} -L {CORE_DIR}/genesis_plus_gx_libretro.so "{{file.path}}"',
"gamegear": f'{RETROARCH} -L {CORE_DIR}/genesis_plus_gx_libretro.so "{{file.path}}"',
"sg-1000": f'{RETROARCH} -L {CORE_DIR}/genesis_plus_gx_libretro.so "{{file.path}}"',
"sc-3000": f'{RETROARCH} -L {CORE_DIR}/genesis_plus_gx_libretro.so "{{file.path}}"',

# NEC
"tg16": f'{RETROARCH} -L {CORE_DIR}/mednafen_pce_fast_libretro.so "{{file.path}}"',
"tg-cd": f'{RETROARCH} -L {CORE_DIR}/mednafen_pce_fast_libretro.so "{{file.path}}"',
"supergrafx": f'{RETROARCH} -L {CORE_DIR}/mednafen_pce_fast_libretro.so "{{file.path}}"',

# Nintendo
"nes": f'{RETROARCH} -L {CORE_DIR}/nestopia_libretro.so "{{file.path}}"',
"snes": f'{RETROARCH} -L {CORE_DIR}/snes9x_libretro.so "{{file.path}}"',
"sfam": f'{RETROARCH} -L {CORE_DIR}/snes9x_libretro.so "{{file.path}}"',
"gb": f'{RETROARCH} -L {CORE_DIR}/gambatte_libretro.so "{{file.path}}"',
"gbc": f'{RETROARCH} -L {CORE_DIR}/gambatte_libretro.so "{{file.path}}"',
"gba": f'{RETROARCH} -L {CORE_DIR}/mgba_libretro.so "{{file.path}}"',
"n64": f'{RETROARCH} -L {CORE_DIR}/mupen64plus_next_libretro.so "{{file.path}}"',
"nds": f'{RETROARCH} -L {CORE_DIR}/melondsds_libretro.so "{{file.path}}"',
"gamecube": f'/Applications/dolphin-emu.AppImage --appimage-extract-and-run -b -e "{{file.path}}"',
"wii": f'/Applications/dolphin-emu.AppImage --appimage-extract-and-run -b -e "{{file.path}}"',
"virtualboy": f'{RETROARCH} -L {CORE_DIR}/mednafen_vb_libretro.so "{{file.path}}"',
#"gameandwatch": f'{RETROARCH} -L {CORE_DIR}/gw_libretro.so "{{file.path}}"', # version gw
"gameandwatch": f'{RETROARCH} -L {CORE_DIR}/mame_libretro.so "{{file.path}}"', # version mame

# Sony
"psx": f'{RETROARCH} -L {CORE_DIR}/pcsx_rearmed_libretro.so "{{file.path}}"',
"psp": f'/opt/emulator/ppsspp/PPSSPP-v1.20.3-anylinux-x86_64.AppImage "{{file.path}}"',

# Sega Saturn / Dreamcast
"saturn": f'{RETROARCH} -L {CORE_DIR}/mednafen_saturn_libretro.so "{{file.path}}"',
"dreamcast": f'{RETROARCH} -L {CORE_DIR}/flycast_libretro.so "{{file.path}}"',

# Atari
"atarilynx": f'{RETROARCH} -L {CORE_DIR}/mednafen_lynx_libretro.so "{{file.path}}"',
#"atarijaguar": f'{RETROARCH} -L {CORE_DIR}/virtualjaguar_libretro.so "{{file.path}}"',
#"atarijaguarcd": f'{RETROARCH} -L {CORE_DIR}/virtualjaguar_libretro.so "{{file.path}}"',
"atarijaguar": f'/opt/emulator/bigpemu/bigpemu "{{file.path}}"', # installation manuelle bigpemu
"atarijaguarcd": f'/opt/emulator/bigpemu/bigpemu "{{file.path}}"', # installation manuelle bigpemu
"atari2600": f'{RETROARCH} -L {CORE_DIR}/stella_libretro.so "{{file.path}}"',
"atari5200": f'{RETROARCH} -L {CORE_DIR}/a5200_libretro.so "{{file.path}}"',
"atari7800": f'{RETROARCH} -L {CORE_DIR}/prosystem_libretro.so "{{file.path}}"',

# others
"wonderswan": f'{RETROARCH} -L {CORE_DIR}/mednafen_wswan_libretro.so "{{file.path}}"',
"wonderswancolor": f'{RETROARCH} -L {CORE_DIR}/mednafen_wswan_libretro.so "{{file.path}}"',
"msx": f'{RETROARCH} -L {CORE_DIR}/fmsx_libretro.so "{{file.path}}"',
"msx2": f'{RETROARCH} -L {CORE_DIR}/fmsx_libretro.so "{{file.path}}"',
"amiga": f'{RETROARCH} -L {CORE_DIR}/puae_libretro.so "{{file.path}}"',
"amiga-cd32": f'{RETROARCH} -L {CORE_DIR}/puae_libretro.so "{{file.path}}"',
"scummvm": f'{RETROARCH} -L {CORE_DIR}/scummvm_libretro.so "{{file.path}}"',
"vectrex": f'{RETROARCH} -L {CORE_DIR}/vecx_libretro.so "{{file.path}}"',
"colecovision": f'{RETROARCH} -L {CORE_DIR}/gearcoleco_libretro.so "{{file.path}}"',
"c64": f'{RETROARCH} -L {CORE_DIR}/vice_x64_libretro.so "{{file.path}}"',
"c128": f'{RETROARCH} -L {CORE_DIR}/vice_x128_libretro.so "{{file.path}}"',
"vic-20": f'{RETROARCH} -L {CORE_DIR}/vice_xvic_libretro.so "{{file.path}}"',</nowiki>
}
return launches.get(shortname)

def detect_extensions(games):
exts = set()
for game in games:
path = clean(game.findtext("path"))
if path:
suffix = Path(path).suffix.lower().lstrip(".")
if suffix:
exts.add(suffix)
return sorted(exts)

def write_line(out, key, value):
value = clean(value)
if value:
out.write(f"{key}: {value}\n")

def convert_gamelist(gamelist_path: Path):
romdir = gamelist_path.parent
dirname = romdir.name
out_path = romdir / "metadata.pegasus.txt"

try:
tree = ET.parse(gamelist_path)
root = tree.getroot()
except Exception as e:
print(f"[ERR] {gamelist_path}: {e}")
return

games = root.findall("game")
if not games:
print(f"[WARN] {gamelist_path}: no <game> entries")
return

collection, shortname = collection_info_from_dir(dirname)
exts = detect_extensions(games)

with out_path.open("w", encoding="utf-8") as out:
out.write(f"collection: {collection}\n")
out.write(f"shortname: {shortname}\n")
if exts:
out.write(f"extensions: {' '.join(exts)}\n")

if ADD_LAUNCH:
launch = launch_for_shortname(shortname)
if launch:
out.write(f"launch: {launch}\n")

out.write("\n")

for game in games:
name = clean(game.findtext("name"))
path = clean(game.findtext("path"))
if not path:
continue

# IMPORTANT: on garde le chemin relatif, comme quand ça marchait
if path.startswith("./"):
path = path[2:]

out.write(f"game: {name or Path(path).stem}\n")
out.write(f"file: {path}\n")

write_line(out, "description", game.findtext("desc"))
write_line(out, "developer", game.findtext("developer"))
write_line(out, "publisher", game.findtext("publisher"))
write_line(out, "genre", game.findtext("genre"))

releasedate = clean(game.findtext("releasedate"))
if releasedate:
if len(releasedate) >= 8 and releasedate[:8].isdigit():
rd = releasedate[:8]
out.write(f"release: {rd[:4]}-{rd[4:6]}-{rd[6:8]}\n")
else:
out.write(f"release: {releasedate}\n")

rating = clean(game.findtext("rating"))
if rating:
out.write(f"rating: {rating}\n")

thumbnail = clean(game.findtext("thumbnail"))
image = clean(game.findtext("image"))
screenshot = clean(game.findtext("screenshot"))
fanart = clean(game.findtext("fanart"))
video = clean(game.findtext("video"))

if thumbnail:
out.write(f"assets.box_front: {thumbnail}\n")
elif image:
out.write(f"assets.box_front: {image}\n")

if screenshot:
out.write(f"assets.screenshot: {screenshot}\n")
if fanart:
out.write(f"assets.background: {fanart}\n")

# On garde la vidéo, mais si GameOS spam avec YouTube, commente ces 2 lignes
if video:
out.write(f"assets.video: {video}\n")

out.write("\n")

print(f"[OK] {gamelist_path} -> {out_path} ({len(games)} games)")

def main():
gamelists = list(ROOT.rglob("gamelist.xml"))
if not gamelists:
print(f"[WARN] No gamelist.xml found under {ROOT}")
return

for gamelist in sorted(gamelists):
convert_gamelist(gamelist)

if __name__ == "__main__":
main()

# chmod +x /mnt/Media/Media/Emulation/gamelist_to_pegasus.py
Pour l'exécuter :
# python3 /mnt/Media/Media/Emulation/gamelist_to_pegasus.py

Il faudra penser à télécharger le launcher associé si nécessaire dans le Retroarch de Pegasus (Main Menu -> Online Updater -> -> Update Core Info Files -> Core Downloader)

= Fichiers .m3u =
Afin de gérer les jeu utilisant plusieurs CD/DVD il est nécessaire de creer un fichier liste .m3u :

Pour les fichiers .CHD ou .RVZ :
# cd /mes/roms/plateforme/
Coller la commande suivante :

#!/usr/bin/env bash

unset groups counts seen_files
declare -A groups
declare -A counts
declare -A seen_files

for file in *.chd *.rvz; do
[ -e "$file" ] || continue

name="${file%.*}"

# Enlever uniquement le suffixe disque en fin de nom
base="$(printf '%s\n' "$name" | sed -E '
<nowiki>s/[[:space:]]*-[[:space:]]*(disc|disk|cd)[[:space:]]*[0-9]+$//I
s/[[:space:]]*$(disc|disk|cd)[[:space:]]*[0-9]+$$//I
s/[[:space:]]+(disc|disk|cd)[[:space:]]*[0-9]+$//I
s/(disc|disk|cd)[[:space:]]*[0-9]+$//I</nowiki>
')"

[ "$base" != "$name" ] || continue

group="$base"

key="$group"$'\t'"$file"
[ -n "${seen_files["$key"]}" ] && continue
seen_files["$key"]=1

groups["$group"]+="$file"$'\n'
((counts["$group"]++))
done

for group in "${!groups[@]}"; do
[ "${counts["$group"]}" -ge 2 ] || continue
printf '%s' "${groups["$group"]}" | sed '/^$/d' | sort -V > "$group.m3u"
done
= Convertir bin et cue dans une archive 7z/zip en fichier CHD =
Si nécessaire il faut installer les outils de MAME pour avoir chdman :
# apt install mame-tools
Si nécessaire installer les outils pour gérer les archives 7z :
# apt install p7zip-full
Puis on créé le script (à placer dans le dossier contenant les archives .7z/zip :
# cd /mon/dossier/
# vi convertchd.sh

#!/usr/bin/env bash

shopt -s nullglob

for f in *.7z *.zip; do
[ -e "$f" ] || continue

name="${f%.*}"
tmpdir="$(mktemp -d)"

echo "==> Extraction de : $f"

case "${f##*.}" in
7z)
if ! 7z x -y "$f" -o"$tmpdir" >/dev/null; then
echo "Erreur extraction : $f"
rm -rf "$tmpdir"
continue
fi
;;
zip)
if ! unzip -q "$f" -d "$tmpdir"; then
echo "Erreur extraction : $f"
rm -rf "$tmpdir"
continue
fi
;;
*)
echo "Extension non supportée : $f"
rm -rf "$tmpdir"
continue
;;
esac

cue="$(find "$tmpdir" -type f -iname "*.cue" | head -n 1)"

if [ -z "$cue" ]; then
echo "Aucun .cue trouvé dans : $f"
rm -rf "$tmpdir"
continue
fi

echo "==> Conversion en CHD : $name.chd"
if chdman createcd -i "$cue" -o "${name}.chd"; then
echo "OK : ${name}.chd"
rm -f -- "$f"
else
echo "Erreur conversion : $f"
fi

rm -rf "$tmpdir"
done

# chmod +x convertchd.sh
Puis il suffit de lancer le script :
# ./convertchd.sh
= trier les roms par langues, régions.. (à revérifier/tester) =
# apt update && apt upgrade
# apt install git python3 pip python3.13-venv python3-pip
# mkdir /opt/triederoms
# cd /opt/triederoms
# python3 -m venv retool-env
# source retool-env/bin/activate
# python -m pip install --upgrade pip
# pip install alive-progress darkdetect lxml psutil pyside6 strictyaml validators
# git clone https://github.com/unexpectedpanda/retool.git
# cd retool
# source ../retool-env/bin/activate
On organise le trie avec pour exemple :
# nano config/user-config.yaml

---
config version: 2.4.0

# If the -l option is used, only include titles with the following languages.
language order:
- French
- English

region order:
- France
- Europe
- World
- USA
- Japan

video order:
- PAL
- PAL 60Hz
- NTSC
- MPAL
- SECAM

list prefix:

list suffix:

exclude:

include:

filters:
On récupère le ficher .dat correspondant à la plateforme à trier [http://redump.org/downloads/ à cette adresse] puis on lance le trie :
# python retool.py maplateforme.dat --exclude a B d D m M o P r u v --output .

Gowstream

2026-03-21T15:59:20Z

Admin : /* Montage utile pour Pegasus */

Gowstream

2026-03-21T15:58:58Z

Admin : /* Montage utile pour Pegasus */

= LXC Debian =
[https://games-on-whales.github.io/wolf/stable/user/quickstart.html Source]
== Prérequis ==
* LXC avec Privilèges et Nesting
== Installation ==
=== Virtual devices support ===
[https://games-on-whales.github.io/wolf/stable/user/quickstart.html#_virtual_devices_support Source]

Depuis le serveur :
# vi /etc/udev/rules.d/85-wolf-virtual-inputs.rules

# Allows Wolf to acces /dev/uinput (only needed for joypad support)
KERNEL=="uinput", SUBSYSTEM=="misc", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput", TAG+="uaccess"

# Allows Wolf to access /dev/uhid (only needed for DualSense emulation)
KERNEL=="uhid", GROUP="input", MODE="0660", TAG+="uaccess"

# Joypads
KERNEL=="hidraw*", ATTRS{name}=="Wolf PS5 (virtual) pad", GROUP="input", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf X-Box One (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf PS5 (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf gamepad (virtual) motion sensors", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf Nintendo (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"

On redémarre le serveur ou l'on charge la configuration avec la commande :
# udevadm control --reload-rules && udevadm trigger
== NVidia ==
Après création du conteneur, depuis le serveur :
# vi /etc/pve/lxc/100.conf

...
dev0: /dev/uinput
dev1: /dev/uhid
dev2: /dev/nvidia0
dev3: /dev/nvidiactl
dev4: /dev/nvidia-modeset
dev5: /dev/nvidia-uvm
dev6: /dev/nvidia-uvm-tools
dev7: /dev/nvidia-caps/nvidia-cap1
dev8: /dev/nvidia-caps/nvidia-cap2
lxc.cgroup2.devices.allow: a
lxc.cap.drop:
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry: /run/udev mnt/udev none bind,optional,create=dir
lxc.mount.entry: /dev mnt/dev none bind,optional,create=dir
On démarre le LXC, ensuite depuis le LXC :
# apt update && apt upgrade
On installe le pilote NVidia ([https://lugwiki.stcgrupo.es/index.php?title=GPU_Passthrough référence]), exemple :
# bash /opt/nvidia-driver/NVIDIA-Linux-x86_64-590.48.01.run --no-kernel-module
# bash /opt/nvidia-driver/nvidia-patch/patch.sh
# bash /opt/nvidia-driver/nvidia-patch/patch-fbc.sh
On installe docker et docker-compose :
# apt install docker.io docker-compose-plugin curl
On install le docker NVidia :
# cd /opt/
# curl <nowiki>https://</nowiki>raw.githubusercontent.com/games-on-whales/gow/master/images/nvidia-driver/Dockerfile | docker build -t gow/nvidia-driver:latest -f - --build-arg NV_VERSION=$(cat /sys/module/nvidia/version) .
# docker create --rm --mount source=nvidia-driver-vol,destination=/usr/nvidia gow/nvidia-driver:latest sh
On installe le conteneur de GOW :
# mkdir /opt/gow
# cd /opt/gow/
# vi docker-compose.yml

version: "3"
services:
wolf:
image: ghcr.io/games-on-whales/wolf:stable
environment:
- NVIDIA_DRIVER_VOLUME_NAME=nvidia-driver-vol
#- WOLF_RENDER_NODE=/dev/dri/renderD12X ##pour multiGPU
volumes:
- /etc/wolf/:/etc/wolf:rw
- /var/run/docker.sock:/var/run/docker.sock:rw
- /mnt/udev:/run/udev:rw
- /mnt/dev:/dev:rw
- nvidia-driver-vol:/usr/nvidia:rw
devices:
- /dev/dri
- /dev/uinput
- /dev/uhid
- /dev/nvidia-uvm
- /dev/nvidia-uvm-tools
- /dev/nvidia-caps/nvidia-cap1
- /dev/nvidia-caps/nvidia-cap2
- /dev/nvidiactl
- /dev/nvidia0
- /dev/nvidia-modeset
device_cgroup_rules:
- 'c 13:* rmw'
network_mode: host
restart: unless-stopped

volumes:
nvidia-driver-vol:
external: true

# docker compose up -d

= Autoriser client =
Lors de la première tentative de connexion d'un client il faut rentrer le pin dans un lien web pour l'autoriser, depuis le LXC :
# docker ps
Exemple :
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c5e43d2fc724 ghcr.io/games-on-whales/pulseaudio:master "/entrypoint.sh" 29 minutes ago Up 29 minutes 4713/tcp WolfPulseAudio
c581ab5d8827 ghcr.io/games-on-whales/wolf:stable "/entrypoint.sh" 29 minutes ago Up 29 minutes opt-wolf-1

# docker logs opt-wolf-1

...
... Insert pin at <nowiki>http://</nowiki>192.168.1.123:47989/pin/#EXEMPLE
...
= Configuration =
Par défaut :
WOLF_CFG_FILE=/etc/wolf/cfg/config.toml

# vi /etc/wolf/cfg/config.toml
== Monter un dossier dans une app ==
Exemple avec Pegasus : ([https://games-on-whales.github.io/wildlife/apps/pegasus/ source])
# vi /etc/wolf/cfg/config.toml
Modifier :

<nowiki>[[profiles.apps]]</nowiki>
icon_png_path = '<nowiki>https://</nowiki>games-on-whales.github.io/wildlife/apps/pegasus/assets/icon.png'
start_virtual_compositor = true
title = 'Pegasus'

[profiles.apps.runner]
base_create_json = '''{
"HostConfig": {
"IpcMode": "host",
"CapAdd": ["NET_RAW", "MKNOD", "NET_ADMIN", "SYS_ADMIN", "SYS_NICE"],
"Privileged": false,
"DeviceCgroupRules": ["c 13:* rmw", "c 244:* rmw"]
}
}
'''
devices = []
env = [ 'RUN_SWAY=1', 'GOW_REQUIRED_DEVICES=/dev/input/event* /dev/dri/* /dev/nvidia*' ]
image = 'ghcr.io/games-on-whales/pegasus:edge'
mounts = []
name = 'WolfPegasus'
ports = []
type = 'docker'
Par, exemple :

...
devices = []
env = [ 'RUN_SWAY=1', 'GOW_REQUIRED_DEVICES=/dev/input/event* /dev/dri/* /dev/nvidia*' ]
image = 'ghcr.io/games-on-whales/pegasus:edge'
mounts = [
"/mnt/Emulation/resources:/assets/romm/resources:ro",# exemple de compatibilite avec assets ROMM
"/mnt/Emulation/bios/retroarchbioses:/home/retro/bioses:ro",# pack de bios pour retroarch
"/mnt/Emulation/roms:/ROMs:ro"# roms dans le dossier par default, a ajouter dans le menu de Pegasus pour certains dossiers..
]
name = 'WolfPegasus'
ports = []
...

On redémarre le conteneur :
# docker restart opt-wolf-1
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = A noter que contrairement à ROMM Retroarch réclame d'avoir tous les bios dans le même dossier.
}}

== Montage utile pour Pegasus ==
Installer des bin d'émulateur :
"/opt/emulator:/opt/emulator:rw",
Artwork pour Game and Watch (mame) ( exemple avec "") :
# mkdir -p /mnt/Emulation/bios/retroarchbioses/mame
# ln -s /mnt/Emulation/roms/g-and-w_artwork /mnt/Emulation/bios/retroarchbioses/mame/artwork

= Importer un thème dans Pegasus =
# cd /etc/wolf/profile-data/user/WolfPegasus/.config/pegasus-frontend/themes/
Exemple avec "gameOS" (normalement déjà présent..) :
# wget <nowiki>https://</nowiki>github.com/PlayingKarrde/gameOS/archive/master.zip
# unzip master.zip
= convertir les gamelist.xml en metadata.txt =
Voir [[ROMM#convertir_les_gamelist.xml_en_metadata.txt|ce lien]]

= Moonlight Wev Stream =
[https://github.com/MrCreativ3001/moonlight-web-stream Source]
== Docker ==
[https://github.com/MrCreativ3001/moonlight-web-stream/blob/master/docker/README.md Source]
# mkdir /opt/moonlightwebstream
# cd /opt/moonlightwebstream
# vi docker-compose.yml

services:
moonlight-web:
image: mrcreativ3001/moonlight-web-stream:latest
container_name: moonlight-web
restart: unless-stopped
ports:
- "8080:8080"
- "40000-40100:40000-40100/udp"
volumes:
- /opt/moonlightwebstream/server:/moonlight-web/server

# docker compose up -d
== Configuration ==
# vi /opt/moonlightwebstream/server/config.json
=== Auhtentification ===
Au minimum renseigner les champs suivant :
...
"username": "un_utilisateur",
"credential": "un_mot_de_passe"
...
== vhost ==
server {
listen 443 ssl http2;
server_name moonlight.tondomaine.com;

ssl_certificate /etc/letsencrypt/live/moonlight.tondomaine.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/moonlight.tondomaine.com/privkey.pem;

location /api/host/stream {
proxy_pass http://192.168.123:8080/api/host/stream;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 86400;
}

location / {
proxy_pass http://192.168.1.123:8080/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 86400;
}
}

Gowstream

2026-03-21T15:24:04Z

Admin : /* Montage utile pour Pegasus */

= LXC Debian =
[https://games-on-whales.github.io/wolf/stable/user/quickstart.html Source]
== Prérequis ==
* LXC avec Privilèges et Nesting
== Installation ==
=== Virtual devices support ===
[https://games-on-whales.github.io/wolf/stable/user/quickstart.html#_virtual_devices_support Source]

Depuis le serveur :
# vi /etc/udev/rules.d/85-wolf-virtual-inputs.rules

# Allows Wolf to acces /dev/uinput (only needed for joypad support)
KERNEL=="uinput", SUBSYSTEM=="misc", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput", TAG+="uaccess"

# Allows Wolf to access /dev/uhid (only needed for DualSense emulation)
KERNEL=="uhid", GROUP="input", MODE="0660", TAG+="uaccess"

# Joypads
KERNEL=="hidraw*", ATTRS{name}=="Wolf PS5 (virtual) pad", GROUP="input", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf X-Box One (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf PS5 (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf gamepad (virtual) motion sensors", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf Nintendo (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"

On redémarre le serveur ou l'on charge la configuration avec la commande :
# udevadm control --reload-rules && udevadm trigger
== NVidia ==
Après création du conteneur, depuis le serveur :
# vi /etc/pve/lxc/100.conf

...
dev0: /dev/uinput
dev1: /dev/uhid
dev2: /dev/nvidia0
dev3: /dev/nvidiactl
dev4: /dev/nvidia-modeset
dev5: /dev/nvidia-uvm
dev6: /dev/nvidia-uvm-tools
dev7: /dev/nvidia-caps/nvidia-cap1
dev8: /dev/nvidia-caps/nvidia-cap2
lxc.cgroup2.devices.allow: a
lxc.cap.drop:
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry: /run/udev mnt/udev none bind,optional,create=dir
lxc.mount.entry: /dev mnt/dev none bind,optional,create=dir
On démarre le LXC, ensuite depuis le LXC :
# apt update && apt upgrade
On installe le pilote NVidia ([https://lugwiki.stcgrupo.es/index.php?title=GPU_Passthrough référence]), exemple :
# bash /opt/nvidia-driver/NVIDIA-Linux-x86_64-590.48.01.run --no-kernel-module
# bash /opt/nvidia-driver/nvidia-patch/patch.sh
# bash /opt/nvidia-driver/nvidia-patch/patch-fbc.sh
On installe docker et docker-compose :
# apt install docker.io docker-compose-plugin curl
On install le docker NVidia :
# cd /opt/
# curl <nowiki>https://</nowiki>raw.githubusercontent.com/games-on-whales/gow/master/images/nvidia-driver/Dockerfile | docker build -t gow/nvidia-driver:latest -f - --build-arg NV_VERSION=$(cat /sys/module/nvidia/version) .
# docker create --rm --mount source=nvidia-driver-vol,destination=/usr/nvidia gow/nvidia-driver:latest sh
On installe le conteneur de GOW :
# mkdir /opt/gow
# cd /opt/gow/
# vi docker-compose.yml

version: "3"
services:
wolf:
image: ghcr.io/games-on-whales/wolf:stable
environment:
- NVIDIA_DRIVER_VOLUME_NAME=nvidia-driver-vol
#- WOLF_RENDER_NODE=/dev/dri/renderD12X ##pour multiGPU
volumes:
- /etc/wolf/:/etc/wolf:rw
- /var/run/docker.sock:/var/run/docker.sock:rw
- /mnt/udev:/run/udev:rw
- /mnt/dev:/dev:rw
- nvidia-driver-vol:/usr/nvidia:rw
devices:
- /dev/dri
- /dev/uinput
- /dev/uhid
- /dev/nvidia-uvm
- /dev/nvidia-uvm-tools
- /dev/nvidia-caps/nvidia-cap1
- /dev/nvidia-caps/nvidia-cap2
- /dev/nvidiactl
- /dev/nvidia0
- /dev/nvidia-modeset
device_cgroup_rules:
- 'c 13:* rmw'
network_mode: host
restart: unless-stopped

volumes:
nvidia-driver-vol:
external: true

# docker compose up -d

= Autoriser client =
Lors de la première tentative de connexion d'un client il faut rentrer le pin dans un lien web pour l'autoriser, depuis le LXC :
# docker ps
Exemple :
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c5e43d2fc724 ghcr.io/games-on-whales/pulseaudio:master "/entrypoint.sh" 29 minutes ago Up 29 minutes 4713/tcp WolfPulseAudio
c581ab5d8827 ghcr.io/games-on-whales/wolf:stable "/entrypoint.sh" 29 minutes ago Up 29 minutes opt-wolf-1

# docker logs opt-wolf-1

...
... Insert pin at <nowiki>http://</nowiki>192.168.1.123:47989/pin/#EXEMPLE
...
= Configuration =
Par défaut :
WOLF_CFG_FILE=/etc/wolf/cfg/config.toml

# vi /etc/wolf/cfg/config.toml
== Monter un dossier dans une app ==
Exemple avec Pegasus : ([https://games-on-whales.github.io/wildlife/apps/pegasus/ source])
# vi /etc/wolf/cfg/config.toml
Modifier :

<nowiki>[[profiles.apps]]</nowiki>
icon_png_path = '<nowiki>https://</nowiki>games-on-whales.github.io/wildlife/apps/pegasus/assets/icon.png'
start_virtual_compositor = true
title = 'Pegasus'

[profiles.apps.runner]
base_create_json = '''{
"HostConfig": {
"IpcMode": "host",
"CapAdd": ["NET_RAW", "MKNOD", "NET_ADMIN", "SYS_ADMIN", "SYS_NICE"],
"Privileged": false,
"DeviceCgroupRules": ["c 13:* rmw", "c 244:* rmw"]
}
}
'''
devices = []
env = [ 'RUN_SWAY=1', 'GOW_REQUIRED_DEVICES=/dev/input/event* /dev/dri/* /dev/nvidia*' ]
image = 'ghcr.io/games-on-whales/pegasus:edge'
mounts = []
name = 'WolfPegasus'
ports = []
type = 'docker'
Par, exemple :

...
devices = []
env = [ 'RUN_SWAY=1', 'GOW_REQUIRED_DEVICES=/dev/input/event* /dev/dri/* /dev/nvidia*' ]
image = 'ghcr.io/games-on-whales/pegasus:edge'
mounts = [
"/mnt/Emulation/resources:/assets/romm/resources:ro",# exemple de compatibilite avec assets ROMM
"/mnt/Emulation/bios/retroarchbioses:/home/retro/bioses:ro",# pack de bios pour retroarch
"/mnt/Emulation/roms:/ROMs:ro"# roms dans le dossier par default, a ajouter dans le menu de Pegasus pour certains dossiers..
]
name = 'WolfPegasus'
ports = []
...

On redémarre le conteneur :
# docker restart opt-wolf-1
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = A noter que contrairement à ROMM Retroarch réclame d'avoir tous les bios dans le même dossier.
}}

== Montage utile pour Pegasus ==
Installer des bin d'émulateur :
"/opt/emulator:/opt/emulator:rw",
Artwork pour Game ans Watch (mame) :
"/mnt/Emulation/roms/g-and-w_artwork:/home/retro/bioses/mame/artwork:ro",

= Importer un thème dans Pegasus =
# cd /etc/wolf/profile-data/user/WolfPegasus/.config/pegasus-frontend/themes/
Exemple avec "gameOS" (normalement déjà présent..) :
# wget <nowiki>https://</nowiki>github.com/PlayingKarrde/gameOS/archive/master.zip
# unzip master.zip
= convertir les gamelist.xml en metadata.txt =
Voir [[ROMM#convertir_les_gamelist.xml_en_metadata.txt|ce lien]]

= Moonlight Wev Stream =
[https://github.com/MrCreativ3001/moonlight-web-stream Source]
== Docker ==
[https://github.com/MrCreativ3001/moonlight-web-stream/blob/master/docker/README.md Source]
# mkdir /opt/moonlightwebstream
# cd /opt/moonlightwebstream
# vi docker-compose.yml

services:
moonlight-web:
image: mrcreativ3001/moonlight-web-stream:latest
container_name: moonlight-web
restart: unless-stopped
ports:
- "8080:8080"
- "40000-40100:40000-40100/udp"
volumes:
- /opt/moonlightwebstream/server:/moonlight-web/server

# docker compose up -d
== Configuration ==
# vi /opt/moonlightwebstream/server/config.json
=== Auhtentification ===
Au minimum renseigner les champs suivant :
...
"username": "un_utilisateur",
"credential": "un_mot_de_passe"
...
== vhost ==
server {
listen 443 ssl http2;
server_name moonlight.tondomaine.com;

ssl_certificate /etc/letsencrypt/live/moonlight.tondomaine.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/moonlight.tondomaine.com/privkey.pem;

location /api/host/stream {
proxy_pass http://192.168.123:8080/api/host/stream;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 86400;
}

location / {
proxy_pass http://192.168.1.123:8080/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 86400;
}
}

Gowstream

2026-03-21T15:23:14Z

Admin : /* Monter un dossier dans une app */

= LXC Debian =
[https://games-on-whales.github.io/wolf/stable/user/quickstart.html Source]
== Prérequis ==
* LXC avec Privilèges et Nesting
== Installation ==
=== Virtual devices support ===
[https://games-on-whales.github.io/wolf/stable/user/quickstart.html#_virtual_devices_support Source]

Depuis le serveur :
# vi /etc/udev/rules.d/85-wolf-virtual-inputs.rules

# Allows Wolf to acces /dev/uinput (only needed for joypad support)
KERNEL=="uinput", SUBSYSTEM=="misc", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput", TAG+="uaccess"

# Allows Wolf to access /dev/uhid (only needed for DualSense emulation)
KERNEL=="uhid", GROUP="input", MODE="0660", TAG+="uaccess"

# Joypads
KERNEL=="hidraw*", ATTRS{name}=="Wolf PS5 (virtual) pad", GROUP="input", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf X-Box One (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf PS5 (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf gamepad (virtual) motion sensors", MODE="0660", ENV{ID_SEAT}="seat9"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf Nintendo (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"

On redémarre le serveur ou l'on charge la configuration avec la commande :
# udevadm control --reload-rules && udevadm trigger
== NVidia ==
Après création du conteneur, depuis le serveur :
# vi /etc/pve/lxc/100.conf

...
dev0: /dev/uinput
dev1: /dev/uhid
dev2: /dev/nvidia0
dev3: /dev/nvidiactl
dev4: /dev/nvidia-modeset
dev5: /dev/nvidia-uvm
dev6: /dev/nvidia-uvm-tools
dev7: /dev/nvidia-caps/nvidia-cap1
dev8: /dev/nvidia-caps/nvidia-cap2
lxc.cgroup2.devices.allow: a
lxc.cap.drop:
lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry: /run/udev mnt/udev none bind,optional,create=dir
lxc.mount.entry: /dev mnt/dev none bind,optional,create=dir
On démarre le LXC, ensuite depuis le LXC :
# apt update && apt upgrade
On installe le pilote NVidia ([https://lugwiki.stcgrupo.es/index.php?title=GPU_Passthrough référence]), exemple :
# bash /opt/nvidia-driver/NVIDIA-Linux-x86_64-590.48.01.run --no-kernel-module
# bash /opt/nvidia-driver/nvidia-patch/patch.sh
# bash /opt/nvidia-driver/nvidia-patch/patch-fbc.sh
On installe docker et docker-compose :
# apt install docker.io docker-compose-plugin curl
On install le docker NVidia :
# cd /opt/
# curl <nowiki>https://</nowiki>raw.githubusercontent.com/games-on-whales/gow/master/images/nvidia-driver/Dockerfile | docker build -t gow/nvidia-driver:latest -f - --build-arg NV_VERSION=$(cat /sys/module/nvidia/version) .
# docker create --rm --mount source=nvidia-driver-vol,destination=/usr/nvidia gow/nvidia-driver:latest sh
On installe le conteneur de GOW :
# mkdir /opt/gow
# cd /opt/gow/
# vi docker-compose.yml

version: "3"
services:
wolf:
image: ghcr.io/games-on-whales/wolf:stable
environment:
- NVIDIA_DRIVER_VOLUME_NAME=nvidia-driver-vol
#- WOLF_RENDER_NODE=/dev/dri/renderD12X ##pour multiGPU
volumes:
- /etc/wolf/:/etc/wolf:rw
- /var/run/docker.sock:/var/run/docker.sock:rw
- /mnt/udev:/run/udev:rw
- /mnt/dev:/dev:rw
- nvidia-driver-vol:/usr/nvidia:rw
devices:
- /dev/dri
- /dev/uinput
- /dev/uhid
- /dev/nvidia-uvm
- /dev/nvidia-uvm-tools
- /dev/nvidia-caps/nvidia-cap1
- /dev/nvidia-caps/nvidia-cap2
- /dev/nvidiactl
- /dev/nvidia0
- /dev/nvidia-modeset
device_cgroup_rules:
- 'c 13:* rmw'
network_mode: host
restart: unless-stopped

volumes:
nvidia-driver-vol:
external: true

# docker compose up -d

= Autoriser client =
Lors de la première tentative de connexion d'un client il faut rentrer le pin dans un lien web pour l'autoriser, depuis le LXC :
# docker ps
Exemple :
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c5e43d2fc724 ghcr.io/games-on-whales/pulseaudio:master "/entrypoint.sh" 29 minutes ago Up 29 minutes 4713/tcp WolfPulseAudio
c581ab5d8827 ghcr.io/games-on-whales/wolf:stable "/entrypoint.sh" 29 minutes ago Up 29 minutes opt-wolf-1

# docker logs opt-wolf-1

...
... Insert pin at <nowiki>http://</nowiki>192.168.1.123:47989/pin/#EXEMPLE
...
= Configuration =
Par défaut :
WOLF_CFG_FILE=/etc/wolf/cfg/config.toml

# vi /etc/wolf/cfg/config.toml
== Monter un dossier dans une app ==
Exemple avec Pegasus : ([https://games-on-whales.github.io/wildlife/apps/pegasus/ source])
# vi /etc/wolf/cfg/config.toml
Modifier :

<nowiki>[[profiles.apps]]</nowiki>
icon_png_path = '<nowiki>https://</nowiki>games-on-whales.github.io/wildlife/apps/pegasus/assets/icon.png'
start_virtual_compositor = true
title = 'Pegasus'

[profiles.apps.runner]
base_create_json = '''{
"HostConfig": {
"IpcMode": "host",
"CapAdd": ["NET_RAW", "MKNOD", "NET_ADMIN", "SYS_ADMIN", "SYS_NICE"],
"Privileged": false,
"DeviceCgroupRules": ["c 13:* rmw", "c 244:* rmw"]
}
}
'''
devices = []
env = [ 'RUN_SWAY=1', 'GOW_REQUIRED_DEVICES=/dev/input/event* /dev/dri/* /dev/nvidia*' ]
image = 'ghcr.io/games-on-whales/pegasus:edge'
mounts = []
name = 'WolfPegasus'
ports = []
type = 'docker'
Par, exemple :

...
devices = []
env = [ 'RUN_SWAY=1', 'GOW_REQUIRED_DEVICES=/dev/input/event* /dev/dri/* /dev/nvidia*' ]
image = 'ghcr.io/games-on-whales/pegasus:edge'
mounts = [
"/mnt/Emulation/resources:/assets/romm/resources:ro",# exemple de compatibilite avec assets ROMM
"/mnt/Emulation/bios/retroarchbioses:/home/retro/bioses:ro",# pack de bios pour retroarch
"/mnt/Emulation/roms:/ROMs:ro"# roms dans le dossier par default, a ajouter dans le menu de Pegasus pour certains dossiers..
]
name = 'WolfPegasus'
ports = []
...

On redémarre le conteneur :
# docker restart opt-wolf-1
{{Méta bandeau
| niveau = information
| icône = loupe
| texte = A noter que contrairement à ROMM Retroarch réclame d'avoir tous les bios dans le même dossier.
}}

== Montage utile pour Pegasus ==
Installer des bin d'émulateur :
"/opt/emulator:/opt/emulator:rw",

= Importer un thème dans Pegasus =
# cd /etc/wolf/profile-data/user/WolfPegasus/.config/pegasus-frontend/themes/
Exemple avec "gameOS" (normalement déjà présent..) :
# wget <nowiki>https://</nowiki>github.com/PlayingKarrde/gameOS/archive/master.zip
# unzip master.zip
= convertir les gamelist.xml en metadata.txt =
Voir [[ROMM#convertir_les_gamelist.xml_en_metadata.txt|ce lien]]

= Moonlight Wev Stream =
[https://github.com/MrCreativ3001/moonlight-web-stream Source]
== Docker ==
[https://github.com/MrCreativ3001/moonlight-web-stream/blob/master/docker/README.md Source]
# mkdir /opt/moonlightwebstream
# cd /opt/moonlightwebstream
# vi docker-compose.yml

services:
moonlight-web:
image: mrcreativ3001/moonlight-web-stream:latest
container_name: moonlight-web
restart: unless-stopped
ports:
- "8080:8080"
- "40000-40100:40000-40100/udp"
volumes:
- /opt/moonlightwebstream/server:/moonlight-web/server

# docker compose up -d
== Configuration ==
# vi /opt/moonlightwebstream/server/config.json
=== Auhtentification ===
Au minimum renseigner les champs suivant :
...
"username": "un_utilisateur",
"credential": "un_mot_de_passe"
...
== vhost ==
server {
listen 443 ssl http2;
server_name moonlight.tondomaine.com;

ssl_certificate /etc/letsencrypt/live/moonlight.tondomaine.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/moonlight.tondomaine.com/privkey.pem;

location /api/host/stream {
proxy_pass http://192.168.123:8080/api/host/stream;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 86400;
}

location / {
proxy_pass http://192.168.1.123:8080/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 86400;
}
}