Simplifying renovate.json (switching over to presets).

2025-09-21 14:51:48 -04:00
23 changed files with 2103 additions and 692 deletions
@@ -1,88 +0,0 @@
-name: List of Services README Generation
-
-on:
-  schedule:
-    - cron: 30 */2 * * *
-  workflow_dispatch:
-
-env:
-  HC_VAULT_VERSION: "1.21.4"
-
-jobs:
-  readme-services:
-   name: Generate Services List
-   runs-on: ubuntu-latest
-   steps:
-    - name: Checkout
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      with:
-        ref: 'main'
-        submodules: true
-
-    - name: Install yq
-      uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
-
-    - name: Generate .env from Hashicorp Vault
-      uses: https://git.trez.wtf/Trez/hc-vault-env@main
-      with:
-        HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
-        HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-        HC_VAULT_AUTH: token
-        HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-        HC_VAULT_SECRETS_PATH: rinoa-docker/env
-
-    - name: Find docker-compose YAML files
-      id: find-compose-files
-      run: |
-        COMPOSE_FILES=$(find . -type f -name "docker-compose*.yml" \
-        -a ! -name "*windows*" \
-        -a ! -name "*gui*" \
-        -a ! -name "*macos*" \
-        -a ! -name "*hivemind*" \
-        -a ! -name "*server*" \
-        | sort)
-
-        echo "compose_files<<EOF" >> "$GITHUB_OUTPUT"
-        echo "$COMPOSE_FILES" >> "$GITHUB_OUTPUT"
-        echo "EOF" >> "$GITHUB_OUTPUT"
-
-        echo "Found Compose files:"
-        echo "$COMPOSE_FILES"
-
-    - name: Generate combined service list
-      run: |
-        echo "Processing combined Compose files:"
-        echo "${{ steps.find-compose-files.outputs.compose_files }}"
-
-        docker_compose_args=""
-        while IFS= read -r f; do
-          [ -z "$f" ] && continue
-          docker_compose_args="$docker_compose_args -f $f"
-        done <<< "${{ steps.find-compose-files.outputs.compose_files }}"
-
-        echo "Running: docker compose --env-file .env $docker_compose_args config"
-        docker compose --env-file .env $docker_compose_args config > combined_compose.yml
-
-        echo "Extracting services..."
-        yq eval -o=json '.services | to_entries | map({"service": .key, "image": (.value.image | sub("@sha256:.*$"; "") // "N/A")})' combined_compose.yml > temp_services.json
-
-        jq -s add temp_services.json | jq 'unique_by(.service)' > services.json
-
-    - name: Generate Markdown Table
-      uses: gazab/create-markdown-table@6686233d7008e8d8b9d4bbdbfd1fb1ae510019f0 # v1.0.7
-      id: service-table
-      with:
-        file: ./services.json
-
-    - name: Regenerate README
-      run: |
-        echo "# List of Services" > README.md
-        echo -e "\n\n" >> README.md
-        echo "${{ steps.service-table.outputs.table }}" >> README.md
-
-    - name: Add/Commit README.md
-      id: commit-readme
-      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
-      with:
-        message: "chore: Update README"
-        add: "README.md"
@@ -0,0 +1,29 @@
+name: Sync Compose Directory
+
+on:
+  schedule:
+    # Runs at 2:00 UTC every day; adjust as needed
+    - cron: "0 2 * * *"
+  workflow_dispatch:  # allows manual trigger
+
+jobs:
+  sync-compose:
+    runs-on: ubuntu-latest
+    steps:
+      # Step 1: Checkout the repo
+      - name: Checkout benedikta-ovos
+        uses: actions/checkout@v3
+
+      - name: Sync compose from ovos-docker
+        run: |
+          # Make the sync script executable
+          chmod +x ./update-sync-ovos-compose.sh
+          # Run the script
+          ./update-sync-ovos-compose.sh
+
+      - name: Commit & push changes
+        uses: EndBug/add-and-commit@v9
+        with:
+          add: "compose"
+          message: "Update compose/ from ovos-docker:dev"
+          push: true
@@ -4,13 +4,15 @@ on:
  workflow_dispatch:
  push:
    branches-ignore:
-      - "main"
+      - 'main'
    paths:
-      - "**/docker-compose.yml"
+      - 'docker-compose.misc.yml'
+      - 'compose/docker-compose*.yml'
+      - '**/pr-docker-deploy.yml'

 env:
-  HC_VAULT_VERSION: "1.21.4"
-  TEA_VERSION: "0.14.0"
+  HC_VAULT_VERSION: '1.20.0'
+  TEA_VERSION: '0.10.1'

 jobs:
  check-and-create-pr:
@@ -19,33 +21,55 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
        with:
          fetch-depth: 1

-      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+      - name: Cache tea CLI
+        id: cache-tea
+        uses: actions/cache@v4
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: PR Check @ Lunafreya"
-          notification_message: "Checking for existing PR... 🔍"
+          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
+          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}

-      - name: PR Check/Creation
-        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
+      - name: Install tea
+        uses: supplypike/setup-bin@v4
        with:
-          url: ${{ secrets.TREZ_GITEA_URL }}
-          token: ${{ secrets.BOT_GITEA_TOKEN }}
-          pr-label: docker-compose,manual
-          assignee: ${{ github.actor }}
+          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
+          name: tea
+          version: ${{ env.TEA_VERSION }}

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: PR Check @ Lunafreya"
-          notification_message: "PR Check done 🎟️"
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: PR Check'
+          notification_message: 'Checking for existing PR... 🔍'
+
+      - name: Check if open PR exists
+        id: check-opened-pr-step
+        continue-on-error: true
+        run: |
+          tea login add --name gitea-rinoa --url "${{ secrets.BDIKTA_GITEA_URL }}" --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
+          pr_exists=$(tea pr list --repo ${{ github.repository }} --state open --fields index,title,head | egrep '\[DOCKER\].*${{ github.ref_name }}' | tail -1 | wc -l)
+          echo "exists=$pr_exists" >> $GITHUB_OUTPUT
+
+      - name: Create PR
+        if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
+        run: |
+          tea login default gitea-rinoa
+          pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
+          pr_index_new=$(expr ${pr_index_old} + 1)
+          tea pr c -r ${{ github.repository }} -t "[DOCKER] Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Docker Compose"
+
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: PR Check'
+          notification_message: 'PR Created 🎟️'

  generate-service-list:
    name: Generate list of added/modified/deleted services
@@ -54,51 +78,90 @@ jobs:
    outputs:
      svc_deploy_list: ${{ steps.detect_services.outputs.docker_svc_list }}
    steps:
+
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4

      - name: Fetch base branch
        run: |
          git fetch origin ${{ github.event.pull_request.base.ref }}

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: Services TBD"
-          notification_message: "Generating list of services to deploy..."
-
-      - name: Save both versions of docker-compose.yml
-        run: |
-          git show origin/main:docker-compose.yml > docker-compose-main.yml || touch docker-compose-main.yml
-          cp docker-compose.yml docker-compose-head.yml
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Services TBD'
+          notification_message: 'Generating list of services to deploy...'

      - name: Detect added, deleted, and modified services
        id: detect_services
        run: |
          echo "Getting services from main and ${{ github.ref_name }}"
-          yq '.services | keys | .[]' docker-compose-main.yml | sort > services_main.txt
-          yq '.services | keys | .[]' docker-compose-head.yml | sort > services_head.txt
+
+          # Dynamically find all docker-compose YAML files (root + compose folder)
+          COMPOSE_FILES=($(find . -maxdepth 2 -type f -name 'docker-compose*.yml' | sort))
+
+          echo "Found Compose files:"
+          printf '%s\n' "${COMPOSE_FILES[@]}"
+
+          # Temp files to store all services
+          touch services_main_all.txt services_head_all.txt
+
+          for f in "${COMPOSE_FILES[@]}"; do
+            echo "Processing $f"
+
+            # Create a safe filename by replacing slashes with underscores
+            safe_f=$(echo "$f" | sed 's|[./]|_|g')
+
+            # Fetch main version
+            git show origin/main:"$f" > "main_${safe_f}" 2>/dev/null || touch "main_${safe_f}"
+            cp "$f" "head_${safe_f}"
+
+            # Extract services and append to global list
+            yq '.services | keys | .[]' "main_${safe_f}" >> services_main_all.txt 2>/dev/null || true
+            yq '.services | keys | .[]' "head_${safe_f}" >> services_head_all.txt 2>/dev/null || true
+          done
+
+          # Sort and deduplicate
+          sort -u services_main_all.txt -o services_main_all.txt
+          sort -u services_head_all.txt -o services_head_all.txt

          echo "Creating list of modified services..."
          touch service_changes.txt

-          comm -13 services_main.txt services_head.txt | while read service; do
+          # Added services
+          comm -13 services_main_all.txt services_head_all.txt | while read service; do
            echo "$service: added" >> service_changes.txt
          done

-          comm -12 services_main.txt services_head.txt | while read service; do
-            yq ".services[\"$service\"]" docker-compose-main.yml > tmp_main.yml
-            yq ".services[\"$service\"]" docker-compose-head.yml > tmp_head.yml
-            if ! diff -q tmp_main.yml tmp_head.yml > /dev/null; then
+          # Modified services (parallelized)
+          comm -12 services_main_all.txt services_head_all.txt | xargs -n1 -P4 -I{} bash -c '
+            service="{}"
+            modified=0
+            for f in "${COMPOSE_FILES[@]}"; do
+              safe_f=$(echo "$f" | sed "s|[./]|_|g")
+              yq ".services[\"$service\"]" "main_${safe_f}" > tmp_main.yml 2>/dev/null || continue
+              yq ".services[\"$service\"]" "head_${safe_f}" > tmp_head.yml 2>/dev/null || continue
+              if ! diff -q tmp_main.yml tmp_head.yml > /dev/null; then
+                modified=1
+                break
+              fi
+            done
+            if [[ $modified -eq 1 ]]; then
              echo "$service: modified" >> service_changes.txt
            fi
-          done
+          '

          echo "Detected service changes:"
          cat service_changes.txt

+          if [[ -z $(cat service_changes.txt) ]]; then
+            echo "watchtower" > service_changes.txt
+            echo "Placeholder:"
+            cat service_changes.txt
+          fi
+
          mod_svcs=$(cut -d':' -f1 service_changes.txt | sort | uniq | tr '\n' ' ' | sed 's/ *$//')
          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
          echo "$mod_svcs" >> "$GITHUB_OUTPUT"
@@ -115,7 +178,7 @@ jobs:
    outputs:
      compose_file_list: ${{ steps.compose_file_list.outputs.compose_list }}
    env:
-      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
      VAULT_NAMESPACE: ""
      REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
@@ -123,41 +186,40 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4

-      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        env:
-          DOCKER_HOST: tcp://192.168.1.250:2375
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+      - name: Show Docker‑related env vars
+        run: |
+          env | grep '^DOCKER_' || true

-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        env:
-          DOCKER_HOST: tcp://192.168.1.250:2375
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USER }}
-          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+      - name: Login to Gitea Container Registry
+        run: |
+          docker login -u gitea-sonarqube-bot -p ${REGISTRY_PASSWORD} git.trez.wtf

-      - name: Login to Private Gitea Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        env:
-          DOCKER_HOST: tcp://192.168.1.250:2375
+      - name: Cache Vault install
+        id: cache-vault
+        uses: actions/cache@v4
        with:
-          registry: git.trez.wtf
-          username: ${{ secrets.BOT_GITEA_USER }}
-          password: ${{ secrets.BOT_GITEA_PASSWORD }}
+          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
+          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+
+      - name: Install Vault (only if not cached)
+        if: steps.cache-vault.outputs.cache-hit != 'true'
+        uses: cpanato/vault-installer@main
+        with:
+          version: ${{ env.HC_VAULT_VERSION }}

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: Docker Compose Dry Run @ Lunafreya"
-          notification_message: "Starting Docker Compose dry run..."
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Dry Run @ Benedikta'
+          notification_message: 'Starting Docker Compose dry run...'
+
+      - name: Generate .env file for Docker Compose
+        run: |
+          vault kv get -format=json benedikta-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env

      - name: Get list of Compose files
        id: compose_file_list
@@ -173,35 +235,29 @@ jobs:
          echo "compose_list=$compose_list" >> "$GITHUB_OUTPUT"
          echo "Compose files: $compose_list"

-      - name: Generate .env from Hashicorp Vault
-        uses: https://git.trez.wtf/Trez/hc-vault-env@main
-        with:
-          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
-          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-          HC_VAULT_AUTH: token
-          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-          HC_VAULT_SECRETS_PATH: benedikta-docker/env
-
      - name: Docker Compose Dry Run
-        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
+        uses: cssnr/stack-deploy-action@v1.4.0
        with:
          mode: compose
          file: ${{ steps.compose_file_list.outputs.compose_list }}
-          name: "benedikta"
+          name: 'ovosmisc'
          host: 192.168.1.250
-          user: charish
-          ssh_key: ${{ secrets.RUNNER_SSH_PRIVATE_KEY }}
+          user: ovos
+          ssh_key: ${{ secrets.BDIKTA_GITEA_PRIVATE_SSH_KEY }}
          args: --remove-orphans --dry-run ${{ needs.generate-service-list.outputs.svc_deploy_list }}
-          env_file: ".env"
+          env_file: '.env'
+          registry_host: 'docker.io'
+          registry_user: ${{ secrets.DOCKER_HUB_USER }}
+          registry_pass: ${{ secrets.DOCKER_HUB_PASSWORD }}
          summary: true

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: Docker Compose Dry Run @ Lunafreya"
-          notification_message: "Docker Compose dry run completed successfully."
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Dry Run @ Benedikta'
+          notification_message: 'Docker Compose dry run completed successfully.'

  pr-merge:
    name: PR Merge
@@ -209,17 +265,17 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4

      - name: Cache tea CLI
        id: cache-tea
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@v4
        with:
          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}

      - name: Install tea
-        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
+        uses: supplypike/setup-bin@v4
        with:
          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
          name: tea
@@ -228,7 +284,7 @@ jobs:
      - name: PR Merge
        id: pr_merge
        run: |
-          tea login add --name gitea-rinoa --url ${{ secrets.TREZ_GITEA_URL }} --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
+          tea login add --name gitea-rinoa --url ${{ secrets.BDIKTA_GITEA_URL }} --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
          tea login default gitea-rinoa
          echo "Merging PR..."
          pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
@@ -236,90 +292,78 @@ jobs:
          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: PR Merge Successful"
-          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: PR Merge Successful'
+          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'

  docker-compose-deploy:
    name: Docker Compose Deployment
    runs-on: ubuntu-latest
    needs: [generate-service-list, docker-compose-dry-run, pr-merge]
    env:
-      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
      REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
        with:
          ref: main

-      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        continue-on-error: true
-        env:
-          DOCKER_HOST: tcp://192.168.1.250:2375
+      - name: Cache Vault install
+        id: cache-vault
+        uses: actions/cache@v4
        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
+          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}

-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        continue-on-error: true
-        env:
-          DOCKER_HOST: tcp://192.168.1.250:2375
+      - name: Install Vault (only if not cached)
+        if: steps.cache-vault.outputs.cache-hit != 'true'
+        uses: cpanato/vault-installer@main
        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USER }}
-          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+          version: ${{ env.HC_VAULT_VERSION }}

-      - name: Login to Private Gitea Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        continue-on-error: true
-        env:
-          DOCKER_HOST: tcp://192.168.1.250:2375
-        with:
-          registry: git.trez.wtf
-          username: ${{ secrets.BOT_GITEA_USER }}
-          password: ${{ secrets.BOT_GITEA_PASSWORD }}
+      - name: Login to Gitea Container Registry
+        run: |
+          docker login -u gitea-sonarqube-bot -p ${REGISTRY_PASSWORD} git.trez.wtf

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: Docker Compose Deployment @ Lunafreya"
-          notification_message: "Starting Docker Compose run..."
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Deployment @ Benedikta'
+          notification_message: 'Starting Docker Compose run...'

-      - name: Generate .env from Hashicorp Vault
-        uses: https://git.trez.wtf/Trez/hc-vault-env@main
-        with:
-          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
-          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-          HC_VAULT_AUTH: token
-          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-          HC_VAULT_SECRETS_PATH: benedikta-docker/env
+      - name: Generate .env file for deployment
+        run: |
+           vault kv get -format=json benedikta-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
+           echo ${DOCKER_SVC_LIST}
+           echo ${COMPOSE_FILE_LIST}

      - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
+        uses: cssnr/stack-deploy-action@v1.4.0
        with:
          mode: compose
          file: ${{ needs.docker-compose-dry-run.outputs.compose_file_list }}
-          name: "benedikta"
+          name: 'ovosmisc'
          host: 192.168.1.250
-          user: charish
-          ssh_key: ${{ secrets.RUNNER_SSH_PRIVATE_KEY }}
+          user: ovos
+          ssh_key: ${{ secrets.BDIKTA_GITEA_PRIVATE_SSH_KEY }}
          args: --remove-orphans ${{ needs.generate-service-list.outputs.svc_deploy_list }}
-          env_file: ".env"
+          env_file: '.env'
+          # registry_host: 'ghcr.io'
+          # registry_user: TrezOne
+          # registry_pass: ${{ secrets.GHCR_LOGIN_TOKEN }}
          summary: true

      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: Docker Compose Deployment @ Lunafreya"
-          notification_message: "Deployment completed successfully."
+          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Deployment @ Benedikta'
+          notification_message: 'Deployment completed successfully.'
@@ -1,133 +0,0 @@
-name: Renovate PR Deployment
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-    paths:
-      - "**/docker-compose*.yml"
-
-env:
-  VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-  VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-  HC_VAULT_VERSION: "1.21.4"
-
-jobs:
-  deploy:
-    name: Renovate PR Deployment
-    if: |
-      github.event.pull_request.merged == true &&
-      github.event.pull_request.user.login == 'renovate-bot'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-        with:
-          fetch-depth: 0
-
-      - name: Save docker-compose.yml after merge (new)
-        run: |
-          git show origin/main:docker-compose.yml > docker-compose-new.yml
-
-      - name: Detect services with image tag/digest changes
-        id: detect_services
-        run: |
-          set -euo pipefail
-
-          echo "Flattening docker-compose files..."
-          yq eval '... comments=""' docker-compose-old.yml > docker-compose-old-flat.yml
-          yq eval '... comments=""' docker-compose-new.yml > docker-compose-new-flat.yml
-
-          echo "Getting service names..."
-          yq eval '.services | keys | .[]' docker-compose-old-flat.yml | sort > services_old.txt
-          yq eval '.services | keys | .[]' docker-compose-new-flat.yml | sort > services_new.txt
-
-          echo "Checking for image changes..."
-          : > service_changes.txt
-
-          comm -12 services_old.txt services_new.txt | while read service; do
-            old_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-old-flat.yml)
-            new_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-new-flat.yml)
-
-            if [ "$old_image" != "$new_image" ]; then
-              echo "$service" >> service_changes.txt
-            fi
-          done
-
-          echo "Detected services with changed images:"
-          cat service_changes.txt || true
-
-          # Prepare multiline output for GitHub Actions
-          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
-          sort -u service_changes.txt >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
-      - name: List of Services for (Re)Deployment
-        run: |
-          echo -e "${{ steps.services.outputs.docker_svc_list }}"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        env:
-          DOCKER_HOST: tcp://192.168.1.252:2375
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        env:
-          DOCKER_HOST: tcp://192.168.1.252:2375
-        with:
-          registry: ghcr.io
-          username: ${{ secrets.GHCR_USER }}
-          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
-
-      - name: Login to Private Gitea Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        env:
-          DOCKER_HOST: tcp://192.168.1.252:2375
-        with:
-          registry: git.trez.wtf
-          username: ${{ secrets.BOT_GITEA_USER }}
-          password: ${{ secrets.BOT_GITEA_PASSWORD }}
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
-        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Lunafreya"
-          notification_message: "Starting Docker Compose run..."
-
-      - name: Generate .env from Hashicorp Vault
-        uses: https://git.trez.wtf/Trez/hc-vault-env@main
-        with:
-          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
-          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-          HC_VAULT_AUTH: token
-          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-          HC_VAULT_SECRETS_PATH: benedikta-docker/env
-
-      - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
-        with:
-          mode: compose
-          file: ${{ steps.compose_file_list.outputs.compose_list }}
-          name: "benedikta"
-          host: 192.168.1.250
-          user: charish
-          ssh_key: ${{ secrets.RUNNER_SSH_PRIVATE_KEY }}
-          args: --remove-orphans ${{ steps.services.outputs.docker_svc_list }}
-          env_file: ".env"
-          summary: true
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
-        with:
-          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
-          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
-          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Lunafreya"
-          notification_message: "Deployment completed successfully."
@@ -1,65 +0,0 @@
-name: Renovate
-
-on:
-  schedule:
-    - cron: "0/30 * * * *"
-  workflow_dispatch:
-
-env:
-  RENOVATE_VERSION: "42.50.3"
-
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Renovate Run
-        env:
-          DOCKER_HOST: tcp://dockerproxy:2375
-          RENOVATE_PLATFORM: gitea
-          RENOVATE_ENDPOINT: https://git.trez.wtf/api/v1
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_BOT_TOKEN }}
-          LOG_LEVEL: ${{ vars.RENOVATE_LOG_LEVEL }}
-          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
-          RENOVATE_CONFIG_FILE: renovate.json
-          RENOVATE_REPOSITORIES: trez/benedikta-ovos
-          RENOVATE_HOST_RULES: |
-            [
-              {
-                "description": "Docker Hub authentication",
-                "hostType": "docker",
-                "matchHost": "docker.io",
-                "username": "${{ secrets.DOCKERHUB_USER }}",
-                "password": "${{ secrets.DOCKERHUB_PASSWORD }}"
-              },
-              {
-                "description": "GitHub Container Registry (GHCR)",
-                "hostType": "docker",
-                "matchHost": "ghcr.io",
-                "username": "${{ secrets.GHCR_USER }}",
-                "password": "${{ secrets.GHCR_LOGIN_TOKEN }}"
-              },
-              {
-                "description": "Self-hosted Gitea Docker Registry",
-                "hostType": "docker",
-                "matchHost": "git.trez.wtf",
-                "username": "${{ secrets.BOT_GITEA_USER }}",
-                "password": "${{ secrets.BOT_GITEA_PASSWORD }}"
-              }
-            ]
-        run: |
-          docker run --rm \
-            -e RENOVATE_PLATFORM \
-            -e RENOVATE_ENDPOINT \
-            -e RENOVATE_TOKEN \
-            -e LOG_LEVEL \
-            -e RENOVATE_GITHUB_COM_TOKEN \
-            -e RENOVATE_CONFIG_FILE \
-            -e RENOVATE_REPOSITORIES \
-            -e RENOVATE_HOST_RULES \
-            --volumes-from ${{ env.JOB_CONTAINER_NAME }} \
-            -w ${GITHUB_WORKSPACE} \
-            renovate/renovate:${{ env.RENOVATE_VERSION }}-full
@@ -1,2 +1 @@
 **/.env
-**/.cache_ggshield
@@ -1,15 +0,0 @@
-# List of Services
-
-
-
-| Service | Image |
-| --- | --- |
-| beszel-agent | henrygd/beszel-agent:latest |
-| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
-| faster-whisper | lscr.io/linuxserver/faster-whisper:latest |
-| linux-voice-assistant | ghcr.io/ohf-voice/linux-voice-assistant:1.1.11 |
-| lva-fix-permissions | ghcr.io/ohf-voice/linux-voice-assistant:latest |
-| piper | lscr.io/linuxserver/piper:latest |
-| portainer-agent | portainer/agent:latest |
-| signoz-logspout | pavanputhra/logspout-signoz |
-
@@ -0,0 +1,53 @@
+# OpenVoiceOS Docker Compose Environment Configuration for Raspberry Pi
+# Optimized for Raspberry Pi hardware with Docker best practices
+
+# User and Group Configuration (defined first to avoid circular references)
+OVOS_USER=ovos
+HIVEMIND_USER=hivemind
+
+# Display and Graphics Configuration
+DISPLAY=:0
+WAYLAND_DISPLAY=wayland-0
+XDG_RUNTIME_DIR=/run/user/1000
+
+# Qt/GUI Configuration for Raspberry Pi
+QT_QPA_PLATFORM=eglfs
+QT_QPA_EGLFS_INTEGRATION=eglfs_kms
+QT_QPA_EGLFS_KMS_CONFIG=/home/ovos/.config/mycroft/ovos-eglfs.json
+
+# Raspberry Pi specific Group IDs
+GPIO_GID=997
+I2C_GID=994
+INPUT_GID=102
+RENDER_GID=106
+SPI_GID=995
+VIDEO_GID=44
+
+# Directory Configuration
+OVOS_CONFIG_FOLDER=/home/ovos/ovos/config
+OVOS_CONFIG_PHAL_FOLDER=/home/ovos/ovos/config/phal
+OVOS_PERSONA_FOLDER=/home/ovos/ovos/config/persona
+OVOS_SHARE_FOLDER=/home/ovos/ovos/share
+TMP_FOLDER=/home/ovos/ovos/tmp
+
+HIVEMIND_CONFIG_FOLDER=/home/hivemind/hivemind/config
+HIVEMIND_CONFIG_PHAL_FOLDER=/home/hivemind/hivemind/config/phal
+HIVEMIND_SHARE_FOLDER=/home/hivemind/hivemind/share
+
+# Docker Configuration
+VERSION=alpha
+PULL_POLICY=always
+
+# Audio Configuration (Raspberry Pi specific)
+PULSE_SERVER=unix:/run/user/1000/pulse/native
+PULSE_COOKIE=/home/ovos/.config/pulse/cookie
+
+# Timezone Configuration
+TZ=America/Montreal
+
+# Resource Management (Raspberry Pi optimized)
+# These can be overridden in compose files for specific services
+DEFAULT_MEMORY_LIMIT=256M
+DEFAULT_MEMORY_RESERVATION=64M
+CORE_MEMORY_LIMIT=512M
+CORE_MEMORY_RESERVATION=128M
@@ -0,0 +1,120 @@
+# OpenVoiceOS Docker Compose Environment Configuration
+# Optimized version with improved defaults and documentation
+# Copy this file to .env and modify the values as needed
+
+# =============================================================================
+# USER AND GROUP CONFIGURATION
+# =============================================================================
+# Primary users (defined first to avoid circular references)
+OVOS_USER=ovos
+HIVEMIND_USER=hivemind
+
+# =============================================================================
+# DISPLAY AND GRAPHICS CONFIGURATION
+# =============================================================================
+# X11 Display configuration
+DISPLAY=:0
+WAYLAND_DISPLAY=wayland-0
+XDG_RUNTIME_DIR=/run/user/1000
+
+# Qt/GUI Configuration
+QT_QPA_PLATFORM=eglfs
+QT_QPA_EGLFS_INTEGRATION=eglfs_kms
+QT_QPA_EGLFS_KMS_CONFIG=/home/ovos/.config/mycroft/ovos-eglfs.json
+
+# =============================================================================
+# SYSTEM GROUP CONFIGURATION
+# =============================================================================
+
+# System Group IDs (adjust based on your system)
+# Use: getent group <groupname> | cut -d: -f3
+INPUT_GID=102
+RENDER_GID=106
+VIDEO_GID=44
+
+# Raspberry Pi specific Group IDs (only used on Pi)
+GPIO_GID=997
+I2C_GID=994
+SPI_GID=995
+
+# =============================================================================
+# DIRECTORY CONFIGURATION
+# =============================================================================
+# OVOS directories
+OVOS_CONFIG_FOLDER=/home/ovos/ovos/config
+OVOS_CONFIG_PHAL_FOLDER=/home/ovos/ovos/config/phal
+OVOS_PERSONA_FOLDER=/home/ovos/ovos/config/persona
+OVOS_SHARE_FOLDER=/home/ovos/ovos/share
+TMP_FOLDER=/home/ovos/ovos/tmp
+
+# Hivemind directories
+HIVEMIND_CONFIG_FOLDER=/home/hivemind/hivemind/config
+HIVEMIND_CONFIG_PHAL_FOLDER=/home/hivemind/hivemind/config/phal
+HIVEMIND_SHARE_FOLDER=/home/hivemind/hivemind/share
+
+# =============================================================================
+# DOCKER CONFIGURATION
+# =============================================================================
+# Image version and pull policy
+VERSION=alpha
+PULL_POLICY=always
+
+# =============================================================================
+# SYSTEM CONFIGURATION
+# =============================================================================
+# Timezone configuration
+TZ=UTC
+
+# =============================================================================
+# PLATFORM-SPECIFIC OVERRIDES
+# =============================================================================
+# Uncomment and modify based on your platform:
+
+# For macOS:
+# PULSE_SERVER=docker.for.mac.host.internal
+
+# For Windows WSL:
+# PULSE_SERVER=/mnt/wslg/PulseServer
+# XDG_RUNTIME_DIR=/mnt/wslg
+
+# For standard Linux:
+# PULSE_SERVER=unix:/run/user/1000/pulse/native
+
+# =============================================================================
+# RESOURCE LIMITS (Optional - uncomment to override defaults)
+# =============================================================================
+# Memory limits for different service types
+# CORE_MEMORY_LIMIT=1G
+# STANDARD_MEMORY_LIMIT=512M
+# LIGHT_MEMORY_LIMIT=256M
+
+# CPU limits
+# CORE_CPU_LIMIT=1.0
+# STANDARD_CPU_LIMIT=0.5
+
+# =============================================================================
+# ADVANCED CONFIGURATION
+# =============================================================================
+# Health check intervals (uncomment to override defaults)
+# HEALTH_CHECK_INTERVAL=30s
+# HEALTH_CHECK_TIMEOUT=10s
+# HEALTH_CHECK_RETRIES=3
+
+# Logging configuration
+# LOG_MAX_SIZE=200m
+# LOG_MAX_FILES=1
+
+# =============================================================================
+# SECURITY CONFIGURATION
+# =============================================================================
+# Set to 'true' to enable additional security features
+# ENABLE_APPARMOR=false
+# ENABLE_SECCOMP=false
+
+# =============================================================================
+# DEVELOPMENT CONFIGURATION
+# =============================================================================
+# Development mode settings (uncomment for development)
+# DEV_MODE=false
+# DEBUG_LOGGING=false
+# ENABLE_PROFILING=false
@@ -0,0 +1,211 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-gui-environment: &gui-environment
+  <<: *common-environment
+  DBUS_SESSION_BUS_ADDRESS: unix:path=${XDG_RUNTIME_DIR}/bus
+  DISPLAY: ${DISPLAY}
+  PULSE_SERVER: unix:${XDG_RUNTIME_DIR}/pulse/native
+  PULSE_COOKIE: /home/${OVOS_USER}/.config/pulse/cookie
+  QML2_IMPORT_PATH: /usr/lib/qml
+  QT_QPA_PLATFORM: ${QT_QPA_PLATFORM}
+  QT_QPA_EGLFS_HIDECURSOR: 1
+  QT_QPA_EGLFS_KMS_ATOMIC: 1
+  QT_QPA_EGLFS_INTEGRATION: ${QT_QPA_EGLFS_INTEGRATION}
+  QT_QPA_EGLFS_KMS_CONFIG: ${QT_QPA_EGLFS_KMS_CONFIG}
+  QT_QPA_PLATFORMTHEME: qt5ct
+  QT_PLUGIN_PATH: /usr/lib/qt/plugins:/usr/lib/plugins:/usr/lib/plugins/kf5
+  QT_FILE_SELECTORS: ovos
+  QT_FONT_DPI: 120
+  QT_IM_MODULE: qtvirtualkeyboard
+  QT_QUICK_CONTROLS_STYLE: OpenVoiceStyle
+  WAYLAND_DISPLAY: ${WAYLAND_DISPLAY}
+  XDG_CURRENT_DESKTOP: kde
+  XDG_RUNTIME_DIR: ${XDG_RUNTIME_DIR}
+
+x-resource-limits: &resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 512M
+      reservations:
+        memory: 128M
+
+x-gui-resource-limits: &gui-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 1G
+        cpus: "1.0"
+      reservations:
+        memory: 256M
+        cpus: "0.25"
+
+x-skill-resource-limits: &skill-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+volumes:
+  ovos_gui_files:
+    name: ovos_gui_files
+    driver: local
+
+services:
+  ovos_gui_websocket:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_gui_websocket
+    hostname: ovos_gui_websocket
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-gui-websocket:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_gui_files:/home/${OVOS_USER}/.cache/ovos_gui_file_server
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "ovos-gui-service"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+  ovos_gui:
+    <<: [*podman, *gui-resource-limits]
+    container_name: ovos_gui
+    hostname: ovos_gui
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-gui-shell:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *gui-environment
+    network_mode: host
+    devices:
+      - /dev/input
+      - /dev/dri
+      - /dev/snd
+    group_add:
+      - ${INPUT_GID}
+      - ${RENDER_GID}
+      - ${VIDEO_GID}
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}:${XDG_RUNTIME_DIR}:ro
+      - ${XDG_RUNTIME_DIR}/bus:${XDG_RUNTIME_DIR}/bus:ro
+      - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+      - ${OVOS_SHARE_FOLDER}:/home/${OVOS_USER}/.local/share/mycroft
+      - ovos_gui_files:/home/${OVOS_USER}/.cache/gui_files
+      - /run/udev/data:/run/udev/data:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      # ovos_gui_websocket:
+      #   condition: service_started
+      ovos_phal:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "ovos-shell"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+  ########################
+  # Uncomment this service if you want to use the original GUI
+  # without the Open Voice OS Shell layer
+  ########################
+  # ovos_gui_original:
+  #   <<: [*podman, *gui-resource-limits]
+  #   container_name: ovos_gui_original
+  #   hostname: ovos_gui_original
+  #   restart: unless-stopped
+  #   image: docker.io/smartgic/ovos-gui-original:${VERSION}
+  #   logging: *default-logging
+  #   pull_policy: ${PULL_POLICY:-always}
+  #   environment:
+  #     <<: *gui-environment
+  #     DISPLAY: :0
+  #   network_mode: host
+  #   devices:
+  #     - /dev/input
+  #     - /dev/dri
+  #     - /dev/snd
+  #   group_add:
+  #     - ${INPUT_GID}
+  #     - ${RENDER_GID}
+  #     - ${VIDEO_GID}
+  #   volumes:
+  #     - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+  #     - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+  #     - ${TMP_FOLDER}:/tmp/mycroft
+  #     - ${XDG_RUNTIME_DIR}:${XDG_RUNTIME_DIR}:ro
+  #     - ${XDG_RUNTIME_DIR}/bus:${XDG_RUNTIME_DIR}/bus:ro
+  #     - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+  #     - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+  #     - ${OVOS_SHARE_FOLDER}:/home/${OVOS_USER}/.local/share/mycroft
+  #     - /run/udev/data:/run/udev/data:ro
+  #   depends_on:
+  #     ovos_messagebus:
+  #       condition: service_started
+  #     ovos_gui_websocket:
+  #       condition: service_started
+  #     ovos_phal:
+  #       condition: service_started
+  #   healthcheck:
+  #     test: ["CMD", "pgrep", "-f", "ovos-gui"]
+  #     interval: 30s
+  #     timeout: 10s
+  #     retries: 3
+  #     start_period: 30s
+
+  ovos_skill_homescreen:
+    <<: [*podman, *skill-resource-limits]
+    container_name: ovos_skill_homescreen
+    hostname: ovos_skill_homescreen
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-skill-homescreen:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_core:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "skill-ovos-homescreen"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
@@ -0,0 +1,63 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-light-resource-limits: &light-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+x-hivemind-base: &hivemind-base
+  <<: [*podman, *light-resource-limits]
+  restart: unless-stopped
+  logging: *default-logging
+  pull_policy: ${PULL_POLICY:-always}
+  tty: true
+  environment:
+    <<: *common-environment
+  network_mode: host
+  volumes:
+    - ${HIVEMIND_CONFIG_FOLDER}:/home/${HIVEMIND_USER}/.config/hivemind:z
+    - ${HIVEMIND_SHARE_FOLDER}:/home/${HIVEMIND_USER}/.local/share/hivemind:z
+  healthcheck:
+    interval: 30s
+    timeout: 10s
+    retries: 3
+    start_period: 15s
+
+services:
+  hivemind_listener:
+    <<: *hivemind-base
+    container_name: hivemind_listener
+    hostname: hivemind_listener
+    image: docker.io/smartgic/hivemind-listener:${VERSION}
+    depends_on:
+      ovos_core:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "hivemind-listener"]
+
+  hivemind_cli:
+    <<: *hivemind-base
+    container_name: hivemind_cli
+    hostname: hivemind_cli
+    image: docker.io/smartgic/hivemind-cli:${VERSION}
+    depends_on:
+      hivemind_listener:
+        condition: service_started
@@ -0,0 +1,237 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-audio-environment: &audio-environment
+  <<: *common-environment
+  PULSE_SERVER: ${PULSE_SERVER:-docker.for.mac.host.internal}
+  PULSE_COOKIE: /home/${OVOS_USER}/.config/pulse/cookie
+
+x-resource-limits: &resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 512M
+      reservations:
+        memory: 128M
+
+x-core-resource-limits: &core-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 1G
+        cpus: "1.0"
+      reservations:
+        memory: 256M
+        cpus: "0.25"
+
+volumes:
+  ovos_models:
+    name: ovos_models
+    driver: local
+  ovos_vosk:
+    name: ovos_vosk
+    driver: local
+  ovos_listener_records:
+    name: ovos_listener_records
+    driver: local
+  ovos_tts_cache:
+    name: ovos_tts_cache
+    driver: local
+  ovos_nltk:
+    name: ovos_nltk
+    driver: local
+  ovos_local_state:
+    name: ovos_local_state
+    driver: local
+
+services:
+  ovos_messagebus:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_messagebus
+    hostname: ovos_messagebus
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-messagebus:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+
+  ovos_phal:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_phal
+    hostname: ovos_phal
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-phal:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    privileged: true
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+
+  ovos_phal_admin:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_phal_admin
+    hostname: ovos_phal_admin
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-phal-admin:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    privileged: true
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /dev:/dev:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+
+  ovos_listener:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_listener
+    hostname: ovos_listener
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-listener:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_listener_records:/home/${OVOS_USER}/.local/share/mycroft/listener
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_models:/home/${OVOS_USER}/.local/share/precise-lite
+      - ovos_vosk:/home/${OVOS_USER}/.local/share/vosk
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_plugin_ggwave:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_plugin_ggwave
+    hostname: ovos_plugin_ggwave
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-plugin-ggwave:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "ggwave"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+  ovos_audio:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_audio
+    hostname: ovos_audio
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-audio:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_tts_cache:/home/${OVOS_USER}/.cache/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_core:
+    <<: [*podman, *core-resource-limits]
+    container_name: ovos_core
+    hostname: ovos_core
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-core:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${OVOS_PERSONA_FOLDER}:/home/${OVOS_USER}/.config/ovos_persona
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_nltk:/home/${OVOS_USER}/nltk_data
+      - ${OVOS_SHARE_FOLDER}:/home/${OVOS_USER}/.local/share/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_cli:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_cli
+    hostname: ovos_cli
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-cli:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
@@ -0,0 +1,15 @@
+---
+services:
+  ovos_gui:
+    healthcheck:
+      disable: true
+    devices:
+      - /dev/vchiq
+
+  ovos_gui_websocket:
+    healthcheck:
+      disable: true
+
+  ovos_skill_homescreen:
+    healthcheck:
+      disable: true
@@ -0,0 +1,81 @@
+---
+# Raspberry Pi specific overrides with optimized resource limits for ARM hardware
+
+x-pi-resource-limits: &pi-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+x-pi-core-resource-limits: &pi-core-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 512M
+        cpus: "0.8"
+      reservations:
+        memory: 128M
+        cpus: "0.2"
+
+x-pi-light-resource-limits: &pi-light-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 128M
+      reservations:
+        memory: 32M
+
+services:
+  ovos_messagebus:
+    <<: *pi-resource-limits
+    healthcheck:
+      disable: true
+
+  ovos_phal:
+    <<: *pi-resource-limits
+    healthcheck:
+      disable: true
+    group_add:
+      - "${GPIO_GID}"
+      - "${I2C_GID}"
+      - "${SPI_GID}"
+
+  ovos_phal_admin:
+    <<: *pi-light-resource-limits
+    healthcheck:
+      disable: true
+    group_add:
+      - "${GPIO_GID}"
+      - "${I2C_GID}"
+      - "${SPI_GID}"
+
+  ovos_listener:
+    <<: *pi-resource-limits
+    healthcheck:
+      disable: true
+
+  ovos_plugin_ggwave:
+    <<: *pi-resource-limits
+    healthcheck:
+      disable: true
+
+  ovos_audio:
+    <<: *pi-resource-limits
+    healthcheck:
+      disable: true
+
+  ovos_core:
+    <<: *pi-core-resource-limits
+    healthcheck:
+      disable: true
+    group_add:
+      - "${GPIO_GID}"
+      - "${I2C_GID}"
+      - "${SPI_GID}"
+
+  ovos_cli:
+    <<: *pi-light-resource-limits
+    healthcheck:
+      disable: true
@@ -0,0 +1,151 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-resource-limits: &resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 512M
+      reservations:
+        memory: 128M
+
+x-core-resource-limits: &core-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 1G
+        cpus: "1.0"
+      reservations:
+        memory: 256M
+        cpus: "0.25"
+
+x-light-resource-limits: &light-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+volumes:
+  ovos_nltk:
+    name: ovos_nltk
+    driver: local
+  ovos_local_state:
+    name: ovos_local_state
+    driver: local
+
+services:
+  ovos_messagebus:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_messagebus
+    hostname: ovos_messagebus
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-messagebus:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "python3",
+          "-c",
+          "import socket; s=socket.socket(); s.connect(('localhost', 8181)); s.close()",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  ovos_core:
+    <<: [*podman, *core-resource-limits]
+    container_name: ovos_core
+    hostname: ovos_core
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-core:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${OVOS_PERSONA_FOLDER}:/home/${OVOS_USER}/.config/ovos_persona
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_nltk:/home/${OVOS_USER}/nltk_data
+      - ${OVOS_SHARE_FOLDER}:/home/${OVOS_USER}/.local/share/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "ovos-core"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+  hivemind_listener:
+    <<: [*podman, *light-resource-limits]
+    container_name: hivemind_listener
+    hostname: hivemind_listener
+    restart: unless-stopped
+    image: docker.io/smartgic/hivemind-listener:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    tty: true
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${HIVEMIND_CONFIG_FOLDER}:/home/${HIVEMIND_USER}/.config/hivemind:z
+      - ${HIVEMIND_SHARE_FOLDER}:/home/${HIVEMIND_USER}/.local/share/hivemind:z
+    depends_on:
+      ovos_core:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "hivemind-listener"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+  hivemind_cli:
+    <<: [*podman, *light-resource-limits]
+    container_name: hivemind_cli
+    hostname: hivemind_cli
+    restart: unless-stopped
+    image: docker.io/smartgic/hivemind-cli:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    tty: true
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${HIVEMIND_CONFIG_FOLDER}:/home/${HIVEMIND_USER}/.config/hivemind:z
+      - ${HIVEMIND_SHARE_FOLDER}:/home/${HIVEMIND_USER}/.local/share/hivemind:z
+    depends_on:
+      hivemind_listener:
+        condition: service_started
@@ -0,0 +1,87 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-skill-resource-limits: &skill-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+x-skill-base: &skill-base
+  <<: [*podman, *skill-resource-limits]
+  restart: unless-stopped
+  logging: *default-logging
+  pull_policy: ${PULL_POLICY:-always}
+  environment:
+    <<: *common-environment
+  network_mode: host
+  volumes:
+    - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+    - ${TMP_FOLDER}:/tmp/mycroft
+  depends_on:
+    ovos_core:
+      condition: service_started
+
+volumes:
+  ovos_nltk:
+    name: ovos_nltk
+    driver: local
+
+services:
+  ovos_skill_wolfie:
+    <<: *skill-base
+    container_name: ovos_skill_wolfie
+    hostname: ovos_skill_wolfie
+    image: docker.io/smartgic/ovos-skill-wolfie:${VERSION}
+
+  ovos_skill_jokes:
+    <<: *skill-base
+    container_name: ovos_skill_jokes
+    hostname: ovos_skill_jokes
+    image: docker.io/smartgic/ovos-skill-jokes:${VERSION}
+
+  ovos_skill_easter_eggs:
+    <<: *skill-base
+    container_name: ovos_skill_easter_eggs
+    hostname: ovos_skill_easter_eggs
+    image: docker.io/smartgic/ovos-skill-easter-eggs:${VERSION}
+
+  ovos_skill_parrot:
+    <<: *skill-base
+    container_name: ovos_skill_parrot
+    hostname: ovos_skill_parrot
+    image: docker.io/smartgic/ovos-skill-parrot:${VERSION}
+
+  ovos_skill_randomness:
+    <<: *skill-base
+    container_name: ovos_skill_randomness
+    hostname: ovos_skill_randomness
+    image: docker.io/smartgic/ovos-skill-randomness:${VERSION}
+
+  ovos_skill_camera:
+    <<: *skill-base
+    container_name: ovos_skill_camera
+    hostname: ovos_skill_camera
+    image: docker.io/smartgic/ovos-skill-camera:${VERSION}
+
+  ovos_skill_wikihow:
+    <<: *skill-base
+    container_name: ovos_skill_wikihow
+    hostname: ovos_skill_wikihow
+    image: docker.io/smartgic/ovos-skill-wikihow:${VERSION}
@@ -0,0 +1,119 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-skill-resource-limits: &skill-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+x-skill-base: &skill-base
+  <<: [*podman, *skill-resource-limits]
+  restart: unless-stopped
+  logging: *default-logging
+  pull_policy: ${PULL_POLICY:-always}
+  environment:
+    <<: *common-environment
+  network_mode: host
+  volumes:
+    - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+    - ${TMP_FOLDER}:/tmp/mycroft
+  depends_on:
+    ovos_core:
+      condition: service_started
+
+volumes:
+  ovos_nltk:
+    name: ovos_nltk
+    driver: local
+
+services:
+  ovos_skill_wikipedia:
+    <<: *skill-base
+    container_name: ovos_skill_wikipedia
+    hostname: ovos_skill_wikipedia
+    image: docker.io/smartgic/ovos-skill-wikipedia:${VERSION}
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_nltk:/home/${OVOS_USER}/nltk_data
+      - ${TMP_FOLDER}:/tmp/mycroft
+
+  ovos_skill_weather:
+    <<: *skill-base
+    container_name: ovos_skill_weather
+    hostname: ovos_skill_weather
+    image: docker.io/smartgic/ovos-skill-weather:${VERSION}
+
+  ovos_skill_volume:
+    <<: *skill-base
+    container_name: ovos_skill_volume
+    hostname: ovos_skill_volume
+    image: docker.io/smartgic/ovos-skill-volume:${VERSION}
+
+  ovos_skill_date_time:
+    <<: *skill-base
+    container_name: ovos_skill_date_time
+    hostname: ovos_skill_date_time
+    image: docker.io/smartgic/ovos-skill-date-time:${VERSION}
+
+  ovos_skill_personal:
+    <<: *skill-base
+    container_name: ovos_skill_personal
+    hostname: ovos_skill_personal
+    image: docker.io/smartgic/ovos-skill-personal:${VERSION}
+
+  ovos_skill_fallback_unknown:
+    <<: *skill-base
+    container_name: ovos_skill_fallback_unknown
+    hostname: ovos_skill_fallback_unknown
+    image: docker.io/smartgic/ovos-skill-fallback-unknown:${VERSION}
+
+  ovos_skill_hello_world:
+    <<: *skill-base
+    container_name: ovos_skill_hello_world
+    hostname: ovos_skill_hello_world
+    image: docker.io/smartgic/ovos-skill-hello-world:${VERSION}
+
+  ovos_skill_alerts:
+    <<: *skill-base
+    container_name: ovos_skill_alerts
+    hostname: ovos_skill_alerts
+    image: docker.io/smartgic/ovos-skill-alerts:${VERSION}
+
+  ovos_skill_ggwave:
+    <<: *skill-base
+    container_name: ovos_skill_ggwave
+    hostname: ovos_skill_ggwave
+    image: docker.io/smartgic/ovos-skill-ggwave:${VERSION}
+
+  ovos_skill_duckduckgo:
+    <<: *skill-base
+    container_name: ovos_skill_duckduckgo
+    hostname: ovos_skill_duckduckgo
+    image: docker.io/smartgic/ovos-skill-duckduckgo:${VERSION}
+
+  ovos_skill_wordnet:
+    <<: *skill-base
+    container_name: ovos_skill_wordnet
+    hostname: ovos_skill_wordnet
+    image: docker.io/smartgic/ovos-skill-wordnet:${VERSION}
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_nltk:/home/${OVOS_USER}/nltk_data
+      - ${TMP_FOLDER}:/tmp/mycroft
@@ -0,0 +1,239 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-audio-environment: &audio-environment
+  <<: *common-environment
+  PULSE_SERVER: ${PULSE_SERVER:-/mnt/wslg/PulseServer}
+
+x-resource-limits: &resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 512M
+      reservations:
+        memory: 128M
+
+x-core-resource-limits: &core-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 1G
+        cpus: "1.0"
+      reservations:
+        memory: 256M
+        cpus: "0.25"
+
+volumes:
+  ovos_models:
+    name: ovos_models
+    driver: local
+  ovos_vosk:
+    name: ovos_vosk
+    driver: local
+  ovos_listener_records:
+    name: ovos_listener_records
+    driver: local
+  ovos_tts_cache:
+    name: ovos_tts_cache
+    driver: local
+  ovos_nltk:
+    name: ovos_nltk
+    driver: local
+  ovos_local_state:
+    name: ovos_local_state
+    driver: local
+
+services:
+  ovos_messagebus:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_messagebus
+    hostname: ovos_messagebus
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-messagebus:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+
+  ovos_phal:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_phal
+    hostname: ovos_phal
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-phal:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    privileged: true
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /mnt/wslg/:/mnt/wslg/
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+
+  ovos_phal_admin:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_phal_admin
+    hostname: ovos_phal_admin
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-phal-admin:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    privileged: true
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /sys:/sys:ro
+      - /dev:/dev:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+
+  ovos_listener:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_listener
+    hostname: ovos_listener
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-listener:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_listener_records:/home/${OVOS_USER}/.local/share/mycroft/listener
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_models:/home/${OVOS_USER}/.local/share/precise-lite
+      - ovos_vosk:/home/${OVOS_USER}/.local/share/vosk
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /mnt/wslg/:/mnt/wslg/
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_plugin_ggwave:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_plugin_ggwave
+    hostname: ovos_plugin_ggwave
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-plugin-ggwave:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /mnt/wslg/:/mnt/wslg/
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "ggwave"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+  ovos_audio:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_audio
+    hostname: ovos_audio
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-audio:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+      DBUS_SESSION_BUS_ADDRESS: unix:path=${XDG_RUNTIME_DIR}/bus
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_tts_cache:/home/${OVOS_USER}/.cache/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}/bus:${XDG_RUNTIME_DIR}/bus:ro
+      - /mnt/wslg/:/mnt/wslg/
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_core:
+    <<: [*podman, *core-resource-limits]
+    container_name: ovos_core
+    hostname: ovos_core
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-core:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${OVOS_PERSONA_FOLDER}:/home/${OVOS_USER}/.config/ovos_persona
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_nltk:/home/${OVOS_USER}/nltk_data
+      - ${OVOS_SHARE_FOLDER}:/home/${OVOS_USER}/.local/share/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /mnt/wslg/:/mnt/wslg/
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_cli:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_cli
+    hostname: ovos_cli
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-cli:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
@@ -0,0 +1,279 @@
+---
+x-podman: &podman
+  userns_mode: keep-id
+  security_opt:
+    - "label=disable"
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    mode: non-blocking
+    max-buffer-size: 4m
+    max-size: "200m"
+    max-file: "1"
+
+x-common-environment: &common-environment
+  TZ: ${TZ:-UTC}
+
+x-audio-environment: &audio-environment
+  <<: *common-environment
+  PULSE_SERVER: unix:${XDG_RUNTIME_DIR}/pulse/native
+  PULSE_COOKIE: /home/${OVOS_USER}/.config/pulse/cookie
+  XDG_RUNTIME_DIR: ${XDG_RUNTIME_DIR}
+
+x-resource-limits: &resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 512M
+      reservations:
+        memory: 128M
+
+x-core-resource-limits: &core-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 1G
+        cpus: "1.0"
+      reservations:
+        memory: 256M
+        cpus: "0.25"
+
+x-skill-resource-limits: &skill-resource-limits
+  deploy:
+    resources:
+      limits:
+        memory: 256M
+      reservations:
+        memory: 64M
+
+volumes:
+  ovos_models:
+    name: ovos_models
+    driver: local
+  ovos_vosk:
+    name: ovos_vosk
+    driver: local
+  ovos_listener_records:
+    name: ovos_listener_records
+    driver: local
+  ovos_tts_cache:
+    name: ovos_tts_cache
+    driver: local
+  ovos_nltk:
+    name: ovos_nltk
+    driver: local
+  ovos_local_state:
+    name: ovos_local_state
+    driver: local
+
+services:
+  ovos_messagebus:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_messagebus
+    hostname: ovos_messagebus
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-messagebus:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+
+  ovos_phal:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_phal
+    hostname: ovos_phal
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-phal:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    # Use specific capabilities instead of privileged mode where possible
+    cap_add:
+      - SYS_ADMIN
+      - DAC_OVERRIDE
+    # Only use privileged if absolutely necessary for hardware access
+    privileged: true
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${OVOS_CONFIG_PHAL_FOLDER}:/home/${OVOS_USER}/.config/OpenVoiceOS
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+
+  ovos_phal_admin:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_phal_admin
+    hostname: ovos_phal_admin
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-phal-admin:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    # Use specific capabilities instead of privileged mode where possible
+    cap_add:
+      - SYS_ADMIN
+      - DAC_OVERRIDE
+    # Only use privileged if absolutely necessary for hardware access
+    privileged: true
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${OVOS_CONFIG_PHAL_FOLDER}:/home/${OVOS_USER}/.config/OpenVoiceOS
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - /sys:/sys:ro
+      - /dev:/dev:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+
+  ovos_listener:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_listener
+    hostname: ovos_listener
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-listener:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    devices:
+      - /dev/snd
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ovos_listener_records:/home/${OVOS_USER}/.local/share/mycroft/listener
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_models:/home/${OVOS_USER}/.local/share/precise-lite
+      - ovos_vosk:/home/${OVOS_USER}/.local/share/vosk
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_plugin_ggwave:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_plugin_ggwave
+    hostname: ovos_plugin_ggwave
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-plugin-ggwave:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    devices:
+      - /dev/snd
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft:ro
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "ggwave"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+  ovos_audio:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_audio
+    hostname: ovos_audio
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-audio:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+      DBUS_SESSION_BUS_ADDRESS: unix:path=${XDG_RUNTIME_DIR}/bus
+    network_mode: host
+    devices:
+      - /dev/snd
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_tts_cache:/home/${OVOS_USER}/.cache/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}/bus:${XDG_RUNTIME_DIR}/bus:ro
+      - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_core:
+    <<: [*podman, *core-resource-limits]
+    container_name: ovos_core
+    hostname: ovos_core
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-core:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *audio-environment
+    network_mode: host
+    devices:
+      - /dev/snd
+    volumes:
+      - ~/.config/pulse/cookie:/home/${OVOS_USER}/.config/pulse/cookie:ro
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ${OVOS_PERSONA_FOLDER}:/home/${OVOS_USER}/.config/ovos_persona
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ovos_nltk:/home/${OVOS_USER}/nltk_data
+      - ${OVOS_SHARE_FOLDER}:/home/${OVOS_USER}/.local/share/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+      - ${XDG_RUNTIME_DIR}/pipewire-0:${XDG_RUNTIME_DIR}/pipewire-0:ro
+      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse:ro
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
+      ovos_phal:
+        condition: service_started
+
+  ovos_cli:
+    <<: [*podman, *resource-limits]
+    container_name: ovos_cli
+    hostname: ovos_cli
+    restart: unless-stopped
+    image: docker.io/smartgic/ovos-cli:${VERSION}
+    logging: *default-logging
+    pull_policy: ${PULL_POLICY:-always}
+    environment:
+      <<: *common-environment
+    network_mode: host
+    volumes:
+      - ${OVOS_CONFIG_FOLDER}:/home/${OVOS_USER}/.config/mycroft
+      - ovos_local_state:/home/${OVOS_USER}/.local/state/mycroft
+      - ${TMP_FOLDER}:/tmp/mycroft
+    depends_on:
+      ovos_messagebus:
+        condition: service_started
@@ -0,0 +1,177 @@
+name: ovosmisc
+
+x-watchtower-monitor: &watchtower-monitor
+  labels:
+    com.centurylinklabs.watchtower.monitor-only: true
+services:
+  beszel-agent:
+    container_name: beszel-agent
+    environment:
+      LISTEN: 45876
+      KEY: '${BESZEL_RIKKU_AGENT_KEY}'
+      TOKEN: ${BESZEL_BENEDIKTA_TOKEN}
+      HUB_URL: http://192.168.1.254:22220
+    expose:
+      - 45876
+    image: henrygd/beszel-agent:latest
+    network_mode: host
+    restart: unless-stopped
+    volumes:
+      - beszel-agent-data:/var/lib/beszel-agent
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /dev/mmcblk0:/extra-filesystems/dev/mmcblk0:ro
+  docker-socket-proxy:
+    container_name: dockerproxy
+    environment:
+      AUTH: 0
+      BUILD: 0
+      COMMIT: 0
+      CONFIGS: 0
+      CONTAINERS: 1
+      DISTRIBUTION: 0
+      EVENTS: 0
+      EXEC: 0
+      GPRC: 0
+      IMAGES: 1
+      INFO: 1
+      NETWORKS: 1
+      NODES: 0
+      POST: 0
+      PLUGINS: 0
+      SERVICES: 0
+      SESSION: 0
+      SYSTEM: 0
+      TASKS: 0
+      VOLUMES: 0
+      LOG_LEVEL: debug
+    image: ghcr.io/tecnativa/docker-socket-proxy:latest
+    ports:
+      - 2375:2375
+    privileged: true
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+  ovos_audio:
+    <<: *watchtower-monitor
+  ovos_cli:
+    <<: *watchtower-monitor
+  ovos_core:
+    <<: *watchtower-monitor
+  ovos_listener:
+    <<: *watchtower-monitor
+  ovos_messagebus:
+    <<: *watchtower-monitor
+  ovos_phal:
+    <<: *watchtower-monitor
+  ovos_phal_admin:
+    <<: *watchtower-monitor
+  ovos_plugin_ggwave:
+    <<: *watchtower-monitor
+  ovos_skill_alerts:
+    <<: *watchtower-monitor
+  ovos_skill_camera:
+    <<: *watchtower-monitor
+  ovos_skill_date_time:
+    <<: *watchtower-monitor
+  ovos_skill_duckduckgo:
+    <<: *watchtower-monitor
+  ovos_skill_easter_eggs:
+    <<: *watchtower-monitor
+  ovos_skill_fallback_unknown:
+    <<: *watchtower-monitor
+  ovos_skill_ggwave:
+    <<: *watchtower-monitor
+  ovos_skill_hello_world:
+    <<: *watchtower-monitor
+  ovos_skill_jokes:
+    <<: *watchtower-monitor
+  ovos_skill_parrot:
+    <<: *watchtower-monitor
+  ovos_skill_personal:
+    <<: *watchtower-monitor
+  ovos_skill_randomness:
+    <<: *watchtower-monitor
+  ovos_skill_volume:
+    <<: *watchtower-monitor
+  ovos_skill_weather:
+    <<: *watchtower-monitor
+  ovos_skill_wikihow:
+    <<: *watchtower-monitor
+  ovos_skill_wikipedia:
+    <<: *watchtower-monitor
+  ovos_skill_wolfie:
+    <<: *watchtower-monitor
+  ovos_skill_wordnet:
+    <<: *watchtower-monitor
+  portainer-agent:
+    container_name: portainer_agent
+    image: portainer/agent:latest
+    volumes:
+      - /:/host
+      - /var/lib/docker/volumes:/var/lib/docker/volumes
+      - /var/run/docker.sock:/var/run/docker.sock
+    restart: always
+    ports:
+      - 9001:9001
+  portracker:
+    cap_add:
+      - SYS_PTRACE
+      - SYS_ADMIN
+    container_name: portracker
+    environment:
+      DATABASE_PATH: /data/portracker.db
+      DEBUG: false
+      DOCKER_HOST: tcp://dockerproxy:2375
+      PORT: 4999
+    image: mostafawahied/portracker:latest
+    pid: "host"
+    ports:
+      - 4999:4999
+    restart: unless-stopped
+    security_opt:
+      - apparmor:unconfined
+    volumes:
+      - portracker-data:/data
+  signoz-logspout:
+    command: signoz://192.168.1.254:8082
+    container_name: signoz-logspout
+    environment:
+      ENV: prod
+      SIGNOZ_LOG_ENDPOINT: http://192.168.1.254:8082
+    image: pavanputhra/logspout-signoz
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+  watchtower:
+    container_name: watchtower
+    environment:
+      REPO_PASS:
+      REPO_USER:
+      TZ: ${TZ}
+      WATCHTOWER_CLEANUP: true
+      WATCHTOWER_INCLUDE_STOPPED: false
+      WATCHTOWER_MONITOR_ONLY: false
+      WATCHTOWER_NOTIFICATIONS: gotify
+      WATCHTOWER_NOTIFICATIONS_LEVEL: info
+      WATCHTOWER_NOTIFICATION_TEMPLATE: '{{range .}}{{.Message}}{{println}}{{end}}'
+      WATCHTOWER_NOTIFICATION_URL:
+      WATCHTOWER_SCHEDULE: 0 0 4 * * *
+      WATCHTOWER_TIMEOUT: 30s
+      WATCHTOWER_HTTP_API_METRICS: true
+      WATCHTOWER_HTTP_API_TOKEN: ${WATCHTOWER_HTTP_API_TOKEN}
+      WATCHTOWER_NOTIFICATION_GOTIFY_URL: ${WATCHTOWER_NOTIFICATION_GOTIFY_URL}
+      WATCHTOWER_NOTIFICATION_GOTIFY_TOKEN: ${WATCHTOWER_NOTIFICATION_GOTIFY_TOKEN}
+      WATCHTOWER_NOTIFICATION_GOTIFY_TLS_SKIP_VERIFY: true
+    expose:
+      - 8080
+    hostname: Benedikta
+    image: ghcr.io/containrrr/watchtower:latest
+    restart: unless-stopped
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+volumes:
+  beszel-agent-data:
+    name: beszel-agent-data
+  portracker-data:
+    name: portracker-data
@@ -1,238 +0,0 @@
-name: benedikta
-x-lva-env: &lva-env
-  environment:
-    # Linux-Voice-Assistant - Docker Environment Configuration
-    # Copy this file to .env and customize for your setup by 'cp .env.example .env'
-
-    ### Enable debug mode (optional):
-    ENABLE_DEBUG: "1"
-
-    ### List audio devices (optional):
-    # if enabled normal startup is disabled
-    # LIST_DEVICES="1"
-
-    ### User ID:
-    # This is used to set the correct permissions for the accessing the audio device and accessing the PulseAudio socket
-    LVA_USER_ID: 1000
-    LVA_USER_GROUP: 1000
-
-    ### Name for the client (optional):
-    CLIENT_NAME: "benedikta"
-
-    ### PulseAudio socket path on the host:
-    # PulseAudio Server:    /run/user/1000/pulse
-    # Pipewire Server:      /run/user/1000/pulse/native
-    LVA_PULSE_SERVER: unix:/run/user/1000/pulse/native
-    LVA_XDG_RUNTIME_DIR: /run/user/1000
-    PULSE_SERVER: unix:/run/user/1000/pulse/native
-    XDG_RUNTIME_DIR: "/run/user/1000"
-
-    ### Path to the preferences file (optional):
-    # PREFERENCES_FILE="/app/configuration/preferences.json"
-
-    ### Network interface (optional):
-    # NETWORK_INTERFACE="eth0"
-
-    ### IP-Address for the api (optional):
-    # HOST="0.0.0.0"
-
-    ### Port for the api (optional):
-    # PORT="6053"
-
-    ### Audio input device (optional):
-    # AUDIO_INPUT_DEVICE="default"
-
-    ### Audio output device (optional):
-    # AUDIO_OUTPUT_DEVICE="default"
-
-    ### Enable thinking sound (optional):
-    ENABLE_THINKING_SOUND: "1"
-
-    ### Wake word directory (optional):
-    # path for custom files in docker is for example "app/wakewords/custom"
-    # WAKE_WORD_DIR="app/wakewords"
-
-    ### Wake model (optional):
-    WAKE_MODEL: "hey_luna"
-    ### Stop model (optional):
-    # STOP_MODEL="stop"
-
-    ### Refactory seconds (optional):
-    # REFACTORY_SECONDS="2"
-
-    ### Sound files (optional):
-    # path for custom files in docker is for example "sounds/custom/your_soundfile.flac"
-    # WAKEUP_SOUND="sounds/wake_word_triggered.flac"
-    # TIMER_FINISHED_SOUND="sounds/timer_finished.flac"
-    # PROCESSING_SOUND="sounds/processing.wav"
-    # MUTE_SOUND="sounds/mute_switch_on.flac"
-    # UNMUTE_SOUND="sounds/mute_switch_off.flac"
-services:
-  beszel-agent:
-    container_name: beszel-agent
-    environment:
-      LISTEN: 45876
-      KEY: ${BESZEL_BENEDIKTA_AGENT_KEY}
-      TOKEN: ${BESZEL_BENEDIKTA_TOKEN}
-      HUB_URL: http://192.168.1.254:22220
-    expose:
-      - 45876
-    image: henrygd/beszel-agent:latest@sha256:8874e2c53f9de5e063a6a80d6b617e20fa593ac5dc4eb4c6ce1f912f510f38f8
-    network_mode: host
-    restart: unless-stopped
-    volumes:
-      - beszel-agent-data:/var/lib/beszel-agent
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - /dev/mmcblk0:/extra-filesystems/dev/mmcblk0:ro
-  docker-socket-proxy:
-    container_name: dockerproxy
-    environment:
-      AUTH: 1
-      BUILD: 1
-      COMMIT: 1
-      CONFIGS: 1
-      CONTAINERS: 1
-      DISTRIBUTION: 1
-      EVENTS: 1
-      EXEC: 1
-      GPRC: 1
-      IMAGES: 1
-      INFO: 1
-      NETWORKS: 1
-      NODES: 1
-      POST: 1
-      PLUGINS: 1
-      SERVICES: 1
-      SESSION: 1
-      SYSTEM: 1
-      TASKS: 1
-      VOLUMES: 1
-      LOG_LEVEL: debug
-    image: ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:1f3a6f303320723d199d2316a3e82b2e2685d86c275d5e3deeaf182573b47476
-    ports:
-      - 2375:2375
-    privileged: true
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-  faster-whisper:
-    container_name: faster-whisper
-    environment:
-      PUID: ${PUID}
-      PGID: ${PGID}
-      TZ: ${TZ}
-      WHISPER_MODEL: large
-      LOCAL_ONLY: #optional
-      WHISPER_BEAM: 1 #optional
-      WHISPER_LANG: en #optional
-    image: lscr.io/linuxserver/faster-whisper:latest@sha256:4c8de34e0876bbc59fc30cb8b29dbe4597b4f46c3effd3ee58aca8e56f39e924
-    ports:
-      - "10300:10300"
-    restart: unless-stopped
-    volumes:
-      - ${BENEDIKTA_DOCKER_DIR}/faster-whisper/:/config
-  linux-voice-assistant:
-    container_name: linux-voice-assistant
-    image: ghcr.io/ohf-voice/linux-voice-assistant:1.1.11@sha256:87ff162d33e68e520bc8a67177b2ba9b626b288d00debc20f3f467b4c9387b2c
-    restart: unless-stopped
-    network_mode: "host"
-    user: "${PUID}:${PGID}"
-    group_add:
-      - audio
-    environment:
-      ENABLE_DEBUG: 1
-      ENABLE_THINKING_SOUND: 1
-      WAKE_MODEL: "hey_luna"
-      # Pulseaudio
-      PULSE_SERVER: ${LVA_PULSE_SERVER}
-      PULSE_COOKIE: /run/user/1000/pulse/cookie
-      XDG_RUNTIME_DIR: ${LVA_XDG_RUNTIME_DIR}
-      # Priority for audio process
-      AUDIO_INPUT_DEVICE: alsa_input.platform-soc_107c000000_sound.stereo-fallback
-      AUDIO_OUTPUT_DEVICE: pipewire/alsa_output.platform-soc_107c000000_sound.stereo-fallback
-    cap_add:
-      - SYS_NICE
-    volumes:
-      # Wakeword data and configuration
-      - lva_wakeword_data:/app/local
-      - lva_wakeword_custom:/app/wakewords/custom
-      - lva_configuration:/app/configuration
-      # Time and zone
-      - /etc/localtime:/etc/localtime:ro
-      - /etc/timezone:/etc/timezone:ro
-      # Pulseaudio
-      - ${LVA_XDG_RUNTIME_DIR}:${LVA_XDG_RUNTIME_DIR}
-    depends_on:
-      - lva-fix-permissions
-    # Health check for process
-    healthcheck:
-      test: [ "CMD", "pgrep", "-f", "linux_voice_assistant" ]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 90s
-  lva-fix-permissions:
-    container_name: lva-fix-permissions
-    image: "ghcr.io/ohf-voice/linux-voice-assistant:latest@sha256:cd04acd204c647da2\
-      663704c694f963d6a3c59e2815ddfcd83aa6114d41e36d5"
-    entrypoint: []
-    command: "chown -R ${PUID}:${PGID} /app/local /app/configuration
-      /app/wakewords/custom /app/sounds/custom"
-    <<: *lva-env
-    group_add:
-      - audio
-    volumes:
-      # Wakeword data and configuration
-      - lva_wakeword_data:/app/local
-      - lva_wakeword_custom:/app/wakewords/custom
-      - lva_configuration:/app/configuration
-      - ${BENEDIKTA_DOCKER_DIR}/linux-voice-assistant/sounds/custom:/app/sounds/custom
-    restart: "no"
-  piper:
-    container_name: piper
-    environment:
-      PUID: ${PUID}
-      PGID: ${PGID}
-      TZ: ${TZ}
-      PIPER_VOICE: en_GB-jenny_dioco-medium
-      LOCAL_ONLY: #optional
-      PIPER_LENGTH: 1.0 #optional
-      PIPER_NOISE: 0.667 #optional
-      PIPER_NOISEW: 0.333 #optional
-      PIPER_SPEAKER: 0 #optional
-      NO_STREAMING: #optional
-    image: lscr.io/linuxserver/piper:latest@sha256:98416835a07afc152b05f54faa4da4fc299cbed0cd940b0df603ba2e10125447
-    ports:
-      - 10200:10200
-    restart: unless-stopped
-    volumes:
-      - ${BENEDIKTA_DOCKER_DIR}/piper/:/config
-  portainer-agent:
-    container_name: portainer_agent
-    image: portainer/agent:latest@sha256:236246fc09b3e7e9269aad53e57ec71f27b7e114a2b6b70d4fd98c117ccc36d8
-    volumes:
-      - /:/host
-      - /var/lib/docker/volumes:/var/lib/docker/volumes
-      - /var/run/docker.sock:/var/run/docker.sock
-    restart: always
-    ports:
-      - 9001:9001
-  signoz-logspout:
-    command: signoz://192.168.1.254:8082
-    container_name: signoz-logspout
-    environment:
-      ENV: prod
-      SIGNOZ_LOG_ENDPOINT: http://192.168.1.254:8082
-    image: pavanputhra/logspout-signoz@sha256:6da8ce12279a5262de8b2d5c083ce82d4c878c4eab702b4d328afe147ed7553b
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-volumes:
-  beszel-agent-data:
-    name: beszel-agent-data
-  lva_wakeword_data:
-    name: lva_wakeword_data
-  lva_wakeword_custom:
-    name: lva_wakeword_custom
-  lva_configuration:
-    name: lva_configuration
@@ -1,7 +1,7 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["local>trez/renovate-config"],
-  "git-submodules": {
-    "enabled": true
-  }
-}
+  "extends": [
+    "config:recommended",
+    "local>trez/renovate-config"
+  ]
+}
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Config
+OVOS_DOCKER_DIR="../ovos-docker"
+OVOS_REMOTE="ovos-docker-local"
+SPLIT_BRANCH="compose-split"
+PREFIX="compose"
+
+# Clone ovos-docker if missing
+if [ ! -d "$OVOS_DOCKER_DIR/.git" ]; then
+    echo "Cloning ovos-docker..."
+    git clone https://github.com/OpenVoiceOS/ovos-docker.git "$OVOS_DOCKER_DIR"
+fi
+
+# Update ovos-docker
+echo "Updating ovos-docker..."
+cd "$OVOS_DOCKER_DIR"
+git fetch origin
+git checkout dev
+git pull origin dev
+
+# Create split branch
+echo "Splitting compose/ directory..."
+git branch -D "$SPLIT_BRANCH" 2>/dev/null || true
+git subtree split --prefix=$PREFIX origin/dev -b "$SPLIT_BRANCH"
+
+# Go back to benedikta-ovos
+cd - >/dev/null
+
+# Add remote if not exists
+if ! git remote | grep -q "$OVOS_REMOTE"; then
+    git remote add "$OVOS_REMOTE" "$OVOS_DOCKER_DIR"
+fi
+git fetch "$OVOS_REMOTE"
+
+# Check if compose/ already exists in benedikta-ovos
+if [ ! -d "$PREFIX" ]; then
+    echo "Adding compose/ for the first time..."
+    git subtree add --prefix=$PREFIX "$OVOS_REMOTE" "$SPLIT_BRANCH" --squash
+else
+    echo "Updating existing compose/ directory..."
+    git subtree pull --prefix=$PREFIX "$OVOS_REMOTE" "$SPLIT_BRANCH" --squash
+fi
+
+echo "✅ compose/ is synced with ovos-docker:dev"