[{"data":1,"prerenderedAt":749},["ShallowReactive",2],{"navigation_docs_fr":3,"-fr-self-hosting-security-and-networking":123,"-fr-self-hosting-security-and-networking-surround":744},[4,36,107],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":35},"Démarrage","i-lucide-rocket","\u002Ffr\u002Fgetting-started","fr\u002F1.getting-started",[10,15,20,25,30],{"title":11,"path":12,"stem":13,"icon":14},"Qu'est-ce que Chronicler","\u002Ffr\u002Fgetting-started\u002Fwhat-is-chronicler","fr\u002F1.getting-started\u002F1.what-is-chronicler","i-lucide-help-circle",{"title":16,"path":17,"stem":18,"icon":19},"Installer l'application","\u002Ffr\u002Fgetting-started\u002Finstall-the-app","fr\u002F1.getting-started\u002F2.install-the-app","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Démarrage rapide Cloud","\u002Ffr\u002Fgetting-started\u002Fcloud-quickstart","fr\u002F1.getting-started\u002F3.cloud-quickstart","i-lucide-cloud",{"title":26,"path":27,"stem":28,"icon":29},"Votre première conversation","\u002Ffr\u002Fgetting-started\u002Fyour-first-chat","fr\u002F1.getting-started\u002F4.your-first-chat","i-lucide-messages-square",{"title":31,"path":32,"stem":33,"icon":34},"Gérer les utilisateurs","\u002Ffr\u002Fgetting-started\u002Fmanaging-users","fr\u002F1.getting-started\u002F5.managing-users","i-lucide-users",false,{"title":37,"icon":38,"path":39,"stem":40,"children":41,"page":35},"Auto-hébergement","i-lucide-server","\u002Ffr\u002Fself-hosting","fr\u002F2.self-hosting",[42,47,52,57,62,67,72,77,82,87,92,97,102],{"title":43,"path":44,"stem":45,"icon":46},"Vue d'ensemble","\u002Ffr\u002Fself-hosting\u002Foverview","fr\u002F2.self-hosting\u002F1.overview","i-lucide-layout-dashboard",{"title":48,"path":49,"stem":50,"icon":51},"Sauvegardes et restauration","\u002Ffr\u002Fself-hosting\u002Fbackups","fr\u002F2.self-hosting\u002F10.backups","i-lucide-database-backup",{"title":53,"path":54,"stem":55,"icon":56},"Mises à jour","\u002Ffr\u002Fself-hosting\u002Fupdating","fr\u002F2.self-hosting\u002F11.updating","i-lucide-refresh-cw",{"title":58,"path":59,"stem":60,"icon":61},"Sécurité et réseau","\u002Ffr\u002Fself-hosting\u002Fsecurity-and-networking","fr\u002F2.self-hosting\u002F12.security-and-networking","i-lucide-shield",{"title":63,"path":64,"stem":65,"icon":66},"Dépannage","\u002Ffr\u002Fself-hosting\u002Ftroubleshooting","fr\u002F2.self-hosting\u002F13.troubleshooting","i-lucide-life-buoy",{"title":68,"path":69,"stem":70,"icon":71},"Prérequis","\u002Ffr\u002Fself-hosting\u002Frequirements","fr\u002F2.self-hosting\u002F2.requirements","i-lucide-cpu",{"title":73,"path":74,"stem":75,"icon":76},"Démarrage rapide (guidé)","\u002Ffr\u002Fself-hosting\u002Fquick-start","fr\u002F2.self-hosting\u002F3.quick-start","i-lucide-wand-2",{"title":78,"path":79,"stem":80,"icon":81},"Installation manuelle","\u002Ffr\u002Fself-hosting\u002Fmanual-install","fr\u002F2.self-hosting\u002F4.manual-install","i-lucide-terminal",{"title":83,"path":84,"stem":85,"icon":86},"Accélération GPU","\u002Ffr\u002Fself-hosting\u002Fgpu-acceleration","fr\u002F2.self-hosting\u002F5.gpu-acceleration","i-lucide-zap",{"title":88,"path":89,"stem":90,"icon":91},"Performances et mémoire","\u002Ffr\u002Fself-hosting\u002Fperformance-and-memory","fr\u002F2.self-hosting\u002F6.performance-and-memory","i-lucide-gauge",{"title":93,"path":94,"stem":95,"icon":96},"Référence de configuration","\u002Ffr\u002Fself-hosting\u002Fconfiguration-reference","fr\u002F2.self-hosting\u002F7.configuration-reference","i-lucide-sliders-horizontal",{"title":98,"path":99,"stem":100,"icon":101},"Modèles","\u002Ffr\u002Fself-hosting\u002Fmodels","fr\u002F2.self-hosting\u002F8.models","i-lucide-brain",{"title":103,"path":104,"stem":105,"icon":106},"Licence et activation","\u002Ffr\u002Fself-hosting\u002Flicensing","fr\u002F2.self-hosting\u002F9.licensing","i-lucide-key-round",{"title":108,"icon":109,"path":110,"stem":111,"children":112,"page":35},"Référence","i-lucide-book-open","\u002Ffr\u002Freference","fr\u002F3.reference",[113,118],{"title":114,"path":115,"stem":116,"icon":117},"Comment ça marche","\u002Ffr\u002Freference\u002Fhow-it-works","fr\u002F3.reference\u002F1.how-it-works","i-lucide-workflow",{"title":119,"path":120,"stem":121,"icon":122},"Données et confidentialité","\u002Ffr\u002Freference\u002Fdata-and-privacy","fr\u002F3.reference\u002F2.data-and-privacy","i-lucide-lock",{"id":124,"title":58,"body":125,"description":735,"extension":736,"links":737,"meta":738,"navigation":739,"path":59,"seo":740,"stem":60,"__hash__":743},"docs_fr\u002Ffr\u002F2.self-hosting\u002F12.security-and-networking.md",{"type":126,"value":127,"toc":725},"minimark",[128,133,199,209,248,252,264,271,275,281,326,337,341,345,348,518,529,532,554,560,564,568,625,631,635,655,659,665,669,721],[129,130,132],"h2",{"id":131},"ce-qui-est-exposé","Ce qui est exposé",[134,135,136,152],"table",{},[137,138,139],"thead",{},[140,141,142,146,149],"tr",{},[143,144,145],"th",{},"Port",[143,147,148],{},"Service",[143,150,151],{},"Qui doit y accéder",[153,154,155,170,183],"tbody",{},[140,156,157,164,167],{},[158,159,160],"td",{},[161,162,163],"code",{},"8410",[158,165,166],{},"API backend",[158,168,169],{},"Tous les postes qui utilisent Chronicler",[140,171,172,177,180],{},[158,173,174],{},[161,175,176],{},"11434",[158,178,179],{},"Runtime du modèle",[158,181,182],{},"Rien en dehors du serveur",[140,184,185,190,193],{},[158,186,187],{},[161,188,189],{},"5432",[158,191,192],{},"Base de données",[158,194,195,196],{},"Rien — lié à ",[161,197,198],{},"127.0.0.1",[200,201,202,203,205,206,208],"p",{},"Seul ",[161,204,163],{}," doit être joignable. Si le fichier compose que vous utilisez publie\n",[161,207,176],{}," plus largement que souhaité, restreignez-le comme Postgres :",[210,211,217],"pre",{"className":212,"code":213,"filename":214,"language":215,"meta":216,"style":216},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","    ports:\n      - \"127.0.0.1:11434:11434\"\n","docker-compose.yml","yaml","",[161,218,219,232],{"__ignoreMap":216},[220,221,224,228],"span",{"class":222,"line":223},"line",1,[220,225,227],{"class":226},"swJcz","    ports",[220,229,231],{"class":230},"sMK4o",":\n",[220,233,235,238,241,245],{"class":222,"line":234},2,[220,236,237],{"class":230},"      -",[220,239,240],{"class":230}," \"",[220,242,244],{"class":243},"sfazB","127.0.0.1:11434:11434",[220,246,247],{"class":230},"\"\n",[129,249,251],{"id":250},"sapproprier-le-serveur-tout-de-suite","S'approprier le serveur tout de suite",[200,253,254,255,259,260,263],{},"Un serveur sans utilisateur propose ",[256,257,258],"strong",{},"Créer votre compte administrateur"," au\npremier qui l'atteint. Entre ",[161,261,262],{},"docker compose up -d"," et la création de ce compte,\nquiconque atteint le port 8410 peut le prendre.",[200,265,266,267,270],{},"Donc : démarrez la pile et créez l'administrateur ",[256,268,269],{},"dans la foulée",", depuis un\nposte de confiance, avant d'ouvrir le port plus largement.",[129,272,274],{"id":273},"sur-un-réseau-local","Sur un réseau local",[200,276,277,278,280],{},"Quand le serveur et ses utilisateurs sont sur le même réseau de confiance, du\nHTTP simple sur ",[161,279,163],{}," est généralement accepté : le trafic ne sort pas du\nbâtiment. Restreignez-le au sous-réseau au niveau du pare-feu :",[210,282,287],{"className":283,"code":284,"filename":285,"language":286,"meta":216,"style":216},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Linux, ufw — n'autoriser que le sous-réseau du bureau\nsudo ufw allow from 192.168.1.0\u002F24 to any port 8410\n","Terminal","bash",[161,288,289,295],{"__ignoreMap":216},[220,290,291],{"class":222,"line":223},[220,292,294],{"class":293},"sHwdD","# Linux, ufw — n'autoriser que le sous-réseau du bureau\n",[220,296,297,301,304,307,310,313,316,319,322],{"class":222,"line":234},[220,298,300],{"class":299},"sBMFI","sudo",[220,302,303],{"class":243}," ufw",[220,305,306],{"class":243}," allow",[220,308,309],{"class":243}," from",[220,311,312],{"class":243}," 192.168.1.0\u002F24",[220,314,315],{"class":243}," to",[220,317,318],{"class":243}," any",[220,320,321],{"class":243}," port",[220,323,325],{"class":324},"sbssI"," 8410\n",[200,327,328,329,332,333,336],{},"Les collègues pointent alors ",[256,330,331],{},"Paramètres → Connexion → Local"," vers\n",[161,334,335],{},"http:\u002F\u002F192.168.1.50:8410",".",[129,338,340],{"id":339},"sur-internet-utilisez-https","Sur Internet : utilisez HTTPS",[342,343,344],"caution",{},"Ne publiez pas le port 8410 directement sur Internet. Les connexions et le\ncontenu des documents circuleraient en clair.",[200,346,347],{},"Placez un reverse proxy devant. Chronicler ne fournit ni proxy ni certificats :\ncela reste votre choix.",[349,350,351,463],"code-group",{},[210,352,356],{"className":353,"code":354,"filename":355,"language":355,"meta":216,"style":216},"language-nginx shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","server {\n    listen 443 ssl;\n    server_name chronicler.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fletsencrypt\u002Flive\u002Fchronicler.example.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fchronicler.example.com\u002Fprivkey.pem;\n\n    client_max_body_size 512M;   # imports\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:8410;\n        proxy_set_header Host              $host;\n        proxy_set_header X-Real-IP         $remote_addr;\n        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_read_timeout 600s;     # une réponse sur processeur peut durer\n    }\n}\n","nginx",[161,357,358,363,368,374,381,387,393,398,404,409,415,421,427,433,439,445,451,457],{"__ignoreMap":216},[220,359,360],{"class":222,"line":223},[220,361,362],{},"server {\n",[220,364,365],{"class":222,"line":234},[220,366,367],{},"    listen 443 ssl;\n",[220,369,371],{"class":222,"line":370},3,[220,372,373],{},"    server_name chronicler.example.com;\n",[220,375,377],{"class":222,"line":376},4,[220,378,380],{"emptyLinePlaceholder":379},true,"\n",[220,382,384],{"class":222,"line":383},5,[220,385,386],{},"    ssl_certificate     \u002Fetc\u002Fletsencrypt\u002Flive\u002Fchronicler.example.com\u002Ffullchain.pem;\n",[220,388,390],{"class":222,"line":389},6,[220,391,392],{},"    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fchronicler.example.com\u002Fprivkey.pem;\n",[220,394,396],{"class":222,"line":395},7,[220,397,380],{"emptyLinePlaceholder":379},[220,399,401],{"class":222,"line":400},8,[220,402,403],{},"    client_max_body_size 512M;   # imports\n",[220,405,407],{"class":222,"line":406},9,[220,408,380],{"emptyLinePlaceholder":379},[220,410,412],{"class":222,"line":411},10,[220,413,414],{},"    location \u002F {\n",[220,416,418],{"class":222,"line":417},11,[220,419,420],{},"        proxy_pass http:\u002F\u002F127.0.0.1:8410;\n",[220,422,424],{"class":222,"line":423},12,[220,425,426],{},"        proxy_set_header Host              $host;\n",[220,428,430],{"class":222,"line":429},13,[220,431,432],{},"        proxy_set_header X-Real-IP         $remote_addr;\n",[220,434,436],{"class":222,"line":435},14,[220,437,438],{},"        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n",[220,440,442],{"class":222,"line":441},15,[220,443,444],{},"        proxy_set_header X-Forwarded-Proto $scheme;\n",[220,446,448],{"class":222,"line":447},16,[220,449,450],{},"        proxy_read_timeout 600s;     # une réponse sur processeur peut durer\n",[220,452,454],{"class":222,"line":453},17,[220,455,456],{},"    }\n",[220,458,460],{"class":222,"line":459},18,[220,461,462],{},"}\n",[210,464,469],{"className":465,"code":466,"filename":467,"language":468,"meta":216,"style":216},"language-caddy shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","chronicler.example.com {\n    reverse_proxy 127.0.0.1:8410 {\n        transport http {\n            read_timeout 600s\n        }\n    }\n    request_body {\n        max_size 512MB\n    }\n}\n","Caddyfile","caddy",[161,470,471,476,481,486,491,496,500,505,510,514],{"__ignoreMap":216},[220,472,473],{"class":222,"line":223},[220,474,475],{},"chronicler.example.com {\n",[220,477,478],{"class":222,"line":234},[220,479,480],{},"    reverse_proxy 127.0.0.1:8410 {\n",[220,482,483],{"class":222,"line":370},[220,484,485],{},"        transport http {\n",[220,487,488],{"class":222,"line":376},[220,489,490],{},"            read_timeout 600s\n",[220,492,493],{"class":222,"line":383},[220,494,495],{},"        }\n",[220,497,498],{"class":222,"line":389},[220,499,456],{},[220,501,502],{"class":222,"line":395},[220,503,504],{},"    request_body {\n",[220,506,507],{"class":222,"line":400},[220,508,509],{},"        max_size 512MB\n",[220,511,512],{"class":222,"line":406},[220,513,456],{},[220,515,516],{"class":222,"line":411},[220,517,462],{},[200,519,520,521,524,525,528],{},"Deux réglages comptent et s'oublient facilement : une ",[256,522,523],{},"taille de corps\ngénéreuse"," (les documents sont volumineux) et un ",[256,526,527],{},"délai de lecture long"," (une\nréponse générée sur processeur peut prendre des minutes ; les 60 secondes\nhabituelles la couperaient).",[200,530,531],{},"Liez ensuite le backend à la boucle locale, pour que le proxy soit le seul\nchemin d'entrée :",[210,533,535],{"className":212,"code":534,"filename":214,"language":215,"meta":216,"style":216},"    ports:\n      - \"127.0.0.1:8410:8410\"\n",[161,536,537,543],{"__ignoreMap":216},[220,538,539,541],{"class":222,"line":223},[220,540,227],{"class":226},[220,542,231],{"class":230},[220,544,545,547,549,552],{"class":222,"line":234},[220,546,237],{"class":230},[220,548,240],{"class":230},[220,550,551],{"class":243},"127.0.0.1:8410:8410",[220,553,247],{"class":230},[200,555,556,557,336],{},"Les utilisateurs saisissent ",[161,558,559],{},"https:\u002F\u002Fchronicler.example.com",[561,562,563],"tip",{},"Un VPN est souvent la meilleure réponse. Si tout le monde se connecte déjà au\nréseau de l'entreprise à distance, gardez Chronicler sur le réseau local et ne\npubliez rien.",[129,565,567],{"id":566},"les-secrets-à-protéger","Les secrets à protéger",[134,569,570,583],{},[137,571,572],{},[140,573,574,577,580],{},[143,575,576],{},"Quoi",[143,578,579],{},"Où",[143,581,582],{},"Pourquoi",[153,584,585,600,614],{},[140,586,587,592,597],{},[158,588,589],{},[161,590,591],{},"POSTGRES_PASSWORD",[158,593,594],{},[161,595,596],{},".env",[158,598,599],{},"La seule clé de votre volume de base. Le perdre rend les données illisibles ; le divulguer donne tout à qui atteint la base.",[140,601,602,605,611],{},[158,603,604],{},"Archives de sauvegarde",[158,606,607,610],{},[161,608,609],{},"backend_uploads",", et votre dossier externe",[158,612,613],{},"Une copie complète de la base. À protéger comme la base elle-même.",[140,615,616,619,622],{},[158,617,618],{},"Clé de licence",[158,620,621],{},"Console d'administration",[158,623,624],{},"Liée à une installation, mais elle reste la vôtre.",[200,626,627,628,630],{},"La clé de signature du serveur est générée au premier démarrage et conservée dans\nle volume ",[161,629,609],{},". Vous n'y touchez jamais ; ne supprimez simplement pas\nce volume.",[129,632,634],{"id":633},"comptes","Comptes",[636,637,638,646,649,652],"ul",{},[639,640,641,642,645],"li",{},"Personne ne peut s'inscrire seul. Les administrateurs créent les comptes\n(",[643,644,31],"a",{"href":32},").",[639,647,648],{},"Les nouveaux comptes reçoivent un mot de passe à usage unique, affiché une\nfois, et doivent en choisir un à la première connexion.",[639,650,651],{},"Suspendez les comptes des personnes qui partent : la suspension conserve leurs\ndocuments, la suppression non.",[639,653,654],{},"Gardez peu d'administrateurs. Un administrateur peut restaurer une sauvegarde,\ndonc lire l'ensemble des données.",[129,656,658],{"id":657},"rester-à-jour","Rester à jour",[200,660,661,662,664],{},"Mettez à jour tous les mois (",[643,663,53],{"href":54},"),\nmaintenez Docker à jour et appliquez les correctifs du système hôte. La pile est\nréduite — quatre conteneurs, aucun greffon, aucune extension — et c'est\nvolontaire.",[129,666,668],{"id":667},"une-courte-liste-de-contrôle","Une courte liste de contrôle",[636,670,673,682,688,694,703,709,715],{"className":671},[672],"contains-task-list",[639,674,677,681],{"className":675},[676],"task-list-item",[678,679],"input",{"disabled":379,"type":680},"checkbox"," Compte administrateur créé juste après le premier démarrage",[639,683,685,687],{"className":684},[676],[678,686],{"disabled":379,"type":680}," Port 8410 restreint au réseau qui en a besoin",[639,689,691,693],{"className":690},[676],[678,692],{"disabled":379,"type":680}," HTTPS devant s'il est joignable hors du réseau local",[639,695,697,699,700,702],{"className":696},[676],[678,698],{"disabled":379,"type":680}," ",[161,701,596],{}," sauvegardé en lieu sûr, ailleurs que sur le serveur",[639,704,706,708],{"className":705},[676],[678,707],{"disabled":379,"type":680}," Sauvegardes planifiées activées, avec copie externe",[639,710,712,714],{"className":711},[676],[678,713],{"disabled":379,"type":680}," Une restauration répétée au moins une fois",[639,716,718,720],{"className":717},[676],[678,719],{"disabled":379,"type":680}," Nombre d'administrateurs réduit au minimum",[722,723,724],"style",{},"html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":216,"searchDepth":234,"depth":234,"links":726},[727,728,729,730,731,732,733,734],{"id":131,"depth":234,"text":132},{"id":250,"depth":234,"text":251},{"id":273,"depth":234,"text":274},{"id":339,"depth":234,"text":340},{"id":566,"depth":234,"text":567},{"id":633,"depth":234,"text":634},{"id":657,"depth":234,"text":658},{"id":667,"depth":234,"text":668},"Laisser entrer vos collègues sans laisser entrer tout le monde.","md",null,{},{"icon":61},{"title":741,"description":742},"Sécurité et réseau de Chronicler auto-hébergé","Exposer le backend Chronicler sans risque, ajouter HTTPS et protéger la base et les sauvegardes.","MklbkijQnFJ-oTnc4EdjK_zadmotq0JysgcA7sBQ0Og",[745,747],{"title":53,"path":54,"stem":55,"description":746,"icon":56,"children":-1},"L'application et le serveur se mettent à jour séparément. Voici comment.",{"title":63,"path":64,"stem":65,"description":748,"icon":66,"children":-1},"Les pannes que l'on rencontre vraiment, et ce qui les corrige.",1785092111872]