Trez/rinoa-docker
4
0
Fork 0
Code Issues 1 Pull Requests 8 Actions Activity

Auto Merge of PR 29 - netbird-deployment-with-authelia-and-music-container-fixes

Browse Source 
Merged by Trez.One
This commit was merged in pull request #29.
This commit is contained in:
gitea-sonarqube-bot
2025-03-14 09:54:05 -04:00
parent 391844015a c37a84ee90
commit 32f187ee55
7 changed files with 407 additions and 307 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/pr-cloudflare-docker-deploy.yml
+51 -2
View File
@@ -25,6 +25,13 @@ jobs:
uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64' uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
name: 'tea' name: 'tea'
version: '0.9.2' version: '0.9.2'
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: PR Check'
notification_message: 'Checking for existing PR... 🔍'
- name: Check if open PR exists - name: Check if open PR exists
id: check-opened-pr-step id: check-opened-pr-step
continue-on-error: true continue-on-error: true
@@ -39,6 +46,13 @@ jobs:
pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}') pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
pr_index_new=$(expr ${pr_index_old} + 1) pr_index_new=$(expr ${pr_index_old} + 1)
tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Docker Compose, Ansible Configs.j2" tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Docker Compose, Ansible Configs.j2"
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: PR Check'
notification_message: 'PR Created 🎟️'
docker-compose-ansible-lints: docker-compose-ansible-lints:
name: Docker Compose & Ansible Lints name: Docker Compose & Ansible Lints
needs: [check-and-create-pr] needs: [check-and-create-pr]
@@ -65,6 +79,13 @@ jobs:
uses: cpanato/vault-installer@main uses: cpanato/vault-installer@main
- name: Install hvac - name: Install hvac
run: pip install hvac run: pip install hvac
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
notification_message: 'Starting Ansible dry run...'
- name: Ansible Playbook Dry Run - name: Ansible Playbook Dry Run
uses: dawidd6/action-ansible-playbook@v2 uses: dawidd6/action-ansible-playbook@v2
with: with:
@@ -82,7 +103,7 @@ jobs:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}' gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}' gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa' notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
notification_message: 'Ansible dry run completed successfully.' notification_message: 'Ansible dry run completed successfully; starting Docker Compose'
- name: Generate .env file for Docker Compose Dry Run - name: Generate .env file for Docker Compose Dry Run
run: | run: |
vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
@@ -149,7 +170,7 @@ jobs:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}' gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}' gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: Cloudflare Setup @ Rinoa' notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
notification_message: 'Starting Cloudflare setup' notification_message: 'Starting Cloudflare DNS setup...'
- name: Compare Subdomains - name: Compare Subdomains
id: compare-subdomains id: compare-subdomains
uses: LouisBrunner/diff-action@v2.2.0 uses: LouisBrunner/diff-action@v2.2.0
@@ -203,6 +224,13 @@ jobs:
# modified_services=${egrep '^ [a-z]' changes.yml | sed -e 's|^ ||g' -e 's|:||g' | sed ':a;N;$!ba;s/\n/ /g'} # modified_services=${egrep '^ [a-z]' changes.yml | sed -e 's|^ ||g' -e 's|:||g' | sed ':a;N;$!ba;s/\n/ /g'}
# echo "Modified services: $modified_services" # echo "Modified services: $modified_services"
# echo "modified_services=$modified_services" >> $GITHUB_OUTPUT # echo "modified_services=$modified_services" >> $GITHUB_OUTPUT
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: README Update'
notification_message: 'Updating README...'
- name: Generate service list - name: Generate service list
run: | run: |
yq '.services | to_entries | map({"service": .key, "image": .value.image})' docker-compose.yml > services.yml yq '.services | to_entries | map({"service": .key, "image": .value.image})' docker-compose.yml > services.yml
@@ -222,6 +250,13 @@ jobs:
with: with:
message: "chore: Update README" message: "chore: Update README"
add: "README.md" add: "README.md"
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: README Update'
notification_message: 'README updated'
pr-merge: pr-merge:
name: PR Merge name: PR Merge
needs: [regenerate-readme-modified-services] needs: [regenerate-readme-modified-services]
@@ -278,6 +313,13 @@ jobs:
uses: cpanato/vault-installer@main uses: cpanato/vault-installer@main
- name: Install hvac - name: Install hvac
run: pip install hvac run: pip install hvac
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
notification_message: 'Starting config deployment with Ansible.'
- name: Deploy Docker Configs via Ansible - name: Deploy Docker Configs via Ansible
uses: dawidd6/action-ansible-playbook@v2 uses: dawidd6/action-ansible-playbook@v2
with: with:
@@ -295,6 +337,13 @@ jobs:
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}' gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: Ansible Config Deployment @ Rinoa' notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
notification_message: 'Deployment completed successfully.' notification_message: 'Deployment completed successfully.'
- name: Gotify Notification
uses: eikendev/gotify-action@master
with:
gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
notification_message: 'Starting Docker Compose run...'
- name: Generate .env file for deployment - name: Generate .env file for deployment
run: | run: |
vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
.gitignore
+1
View File
@@ -1,3 +1,4 @@
**/.cache_ggshield **/.cache_ggshield
ansible/collections/ansible_collections/ ansible/collections/ansible_collections/
**/.env **/.env
**/netbird_openid-configuration.json.j2
README.md
+5
View File
@@ -94,6 +94,11 @@
| n8n | docker.n8n.io/n8nio/n8n | | n8n | docker.n8n.io/n8nio/n8n |
| navidrome | deluan/navidrome:latest | | navidrome | deluan/navidrome:latest |
| netalertx | jokobsk/netalertx:latest | | netalertx | jokobsk/netalertx:latest |
| netbird-dashboard | netbirdio/dashboard:latest |
| netbird-signal | netbirdio/signal:latest |
| netbird-relay | netbirdio/relay:latest |
| netbird-management | netbirdio/management:latest |
| netbird-coturn | coturn/coturn:latest |
| nextcloud | nextcloud/all-in-one:latest | | nextcloud | nextcloud/all-in-one:latest |
| ollama | ollama/ollama | | ollama | ollama/ollama |
| ombi | lscr.io/linuxserver/ombi:latest | | ombi | lscr.io/linuxserver/ombi:latest |
ansible/app-configs/authelia_configuration.yml.j2
+44 -7
View File
@@ -1,3 +1,7 @@
{% set vault_addr = 'https://vault.trez.wtf' %}
{% set secrets_path = 'rinoa-docker/env' %}
# yaml-language-server: $schema=https://www.authelia.com/schemas/latest/json-schema/configuration.json
--- ---
theme: auto theme: auto
default_2fa_method: "totp" default_2fa_method: "totp"
@@ -59,11 +63,11 @@ authentication_backend:
mail: mail mail: mail
display_name: displayName display_name: displayName
user: uid=authelia,ou=people,dc=trez,dc=wtf user: uid=authelia,ou=people,dc=trez,dc=wtf
password: '{{ env AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD }}' password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_AUTH_BIND_LDAP_PASSWORD'] }}'
refresh_interval: 5m refresh_interval: 5m
identity_validation: identity_validation:
reset_password: reset_password:
jwt_secret: '{{ env AUTHELIA_JWT_SECRET }}' jwt_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_JWT_SECRET'] }}'
password_policy: password_policy:
standard: standard:
enabled: true enabled: true
@@ -99,7 +103,7 @@ access_control:
- ['user:the.trezured.one'] - ['user:the.trezured.one']
session: session:
name: authelia_session name: authelia_session
secret: '{{ env AUTHELIA_SESSION_SECRET }}' secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_SESSION_SECRET'] }}'
expiration: 1h expiration: 1h
inactivity: 5m inactivity: 5m
remember_me: 1M remember_me: 1M
@@ -110,12 +114,12 @@ session:
host: redis host: redis
port: 6379 port: 6379
storage: storage:
encryption_key: '{{ env AUTHELIA_STORAGE_ENCRYPTION_KEY }}' encryption_key: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_ENCRYPTION_KEY'] }}'
postgres: postgres:
address: 'tcp://authelia-pg:5432' address: 'tcp://authelia-pg:5432'
database: authelia database: authelia
username: authelia username: authelia
password: '{{ env AUTHELIA_STORAGE_POSTGRES_PASSWORD }}' password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_POSTGRES_PASSWORD'] }}'
timeout: '5s' timeout: '5s'
regulation: regulation:
max_retries: 3 max_retries: 3
@@ -126,8 +130,8 @@ notifier:
smtp: smtp:
address: 'smtp://postal-smtp:25' address: 'smtp://postal-smtp:25'
timeout: '5s' timeout: '5s'
username: '{{ env AUTHELIA_NOTIFIER_SMTP_USERNAME }}' username: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}'
password: '{{ env AUTHELIA_NOTIFIER_SMTP_PASSWORD }}' password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}'
sender: "Authelia <noreply@trez.wtf>" sender: "Authelia <noreply@trez.wtf>"
identifier: 'localhost' identifier: 'localhost'
subject: "[Authelia] {title}" subject: "[Authelia] {title}"
@@ -135,3 +139,36 @@ notifier:
disable_require_tls: true disable_require_tls: true
disable_starttls: true disable_starttls: true
disable_html_emails: false disable_html_emails: false
identity_providers:
oidc:
hmac_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_OIDC_HMAC_SECRET'] }}'
jwks:
key_id: 'netbird'
key: |
{{ lookup("community.hashi_vault.vault_kv2_get", "env", engine_mount_point="rinoa-docker", url=vault_addr, token=vault_token_cleaned)["secret"]["AUTHELIA_OIDC_JWKS_KEY"] | replace("\\n", "\n") | indent(8) }}
certificate_chain: |
{{ lookup("community.hashi_vault.vault_kv2_get", "env", engine_mount_point="rinoa-docker", url=vault_addr, token=vault_token_cleaned)["secret"]["AUTHELIA_OIDC_JWKS_CERT_CHAIN"] | replace("\\n", "\n") | indent(8) }}
cors:
allowed_origins_from_client_redirect_uris: true
endpoints:
- 'userinfo'
- 'authorization'
- 'token'
- 'revocation'
- 'introspection'
clients:
- client_id: 'netbird'
client_name: 'NetBird'
client_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}'
public: false
authorization_policy: 'two_factor'
redirect_uris:
- 'https://vpn.trez.wtf/peers'
- 'https://vpn.trez.wtf/add-peers'
- 'http://localhost'
scopes:
- 'openid'
- 'email'
- 'profile'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
ansible/app-configs/multi-scrobbler_config.json.j2
+70 -30
View File
@@ -2,62 +2,102 @@
{% set secrets_path = 'rinoa-docker/env' %} {% set secrets_path = 'rinoa-docker/env' %}
{ {
"debugMode": false,
"disableWeb": false,
"sourceDefaults": { "sourceDefaults": {
"maxPollRetries": 0, // optional, default # of automatic polling restarts on error. can be overridden by property in individual config "logPayload": false,
"maxRequestRetries": 1, // optional, default # of http request retries a source can make before error is thrown. can be overridden by property in individual config "logFilterFailure": "warn",
"retryMultiplier": 1.5 // optional, default retry delay multiplier (retry attempt * multiplier = # of seconds to wait before retrying). can be overridden by property in individual config "logPlayerState": false,
"scrobbleThresholds": {
"duration": 30,
"percent": 20
},
"maxPollRetries": 1,
"maxRequestRetries": 1,
"retryMultiplier": 1.5
}, },
"clientDefaults": { "clientDefaults": {
"maxRequestRetries": 1, // optional, default # of http request retries a client can make before error is thrown. can be overridden by property in individual config "maxRequestRetries": 1,
"retryMultiplier": 1.5 // optional, default retry delay multiplier (retry attempt * multiplier = # of seconds to wait before retrying). can be overridden by property in individual config "retryMultiplier": 1.5
}, },
"sources": [
{
"type": "spotify",
"enable": true,
"clients": [],
"name": "Spotify",
"data": {
"clientId": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
"clientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
"redirectUri": "http://localhost:9078/callback"
}
},
{
"name": "Last.fm",
"enable": true,
"data": {
"apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
"secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
"redirectUri": "http://localhost:9078/lastfm/callback"
}
},
{
"name": "ListenBrainz",
"enable": true,
"data": {
"token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
"username": "Trez.One"
}
},
{
"name": "Navidrome",
"enable": true,
"data": {
"url": "http://navidrome:4533",
"user": "admin",
"password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NAVIDROME_PASSWORD'] }}"
}
}
],
"clients": [ "clients": [
{ {
"name": "Last.fm Client", "name": "Last.fm Client",
"enable": true, "enable": true,
"configureAs": "client",
"data": { "data": {
"apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}", "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
"secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}", "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
"redirectUri": "http://localhost:9078/lastfm/callback" "redirectUri": "http://localhost:9078/lastfm/callback"
} }
}, },
{
"name": "Last.fm Source",
"enable": true,
"configureAs": "source",
"data": {
"apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
"secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
"redirectUri": "http://localhost:9078/lastfm/callback"
}
},
{
"name": "Maloja",
"enable": true,
"data": {
"url": "http://maloja:42010",
"apiKey": "myMalojaKey"
}
},
{ {
"name": "ListenBrainz Client", "name": "ListenBrainz Client",
"enable": true, "enable": true,
"configureAs": "client",
"data": { "data": {
"token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}", "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
"username": "Trez.One" "username": "Trez.One"
} }
}, },
{ {
"name": "ListenBrainz Source", "type": "maloja",
"enable": true, "enable": true,
"configureAs": "source", "name": "Maloja",
"data": { "data": {
"token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}", "url": "http://maloja:42010",
"username": "Trez.One" "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_API_KEY'] }}"
}
}
],
"webhooks": [
{
"name": "Gotify",
"type": "gotify",
"url": "http://gotify:8070",
"token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MULTI_SCROBBLER_GOTIFY_TOKEN'] }}",
"priorities": {
"info": 5,
"warn": 7,
"error": 10
} }
} }
] ]
}
} }
ansible/app-configs/netbird_management.json.j2
+12 -42
View File
@@ -47,60 +47,30 @@
}, },
"HttpConfig": { "HttpConfig": {
"Address": "0.0.0.0:33073", "Address": "0.0.0.0:33073",
"AuthIssuer": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}", "AuthIssuer": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
"AuthAudience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}", "AuthAudience": "netbird",
"AuthKeysLocation": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/keys", "AuthKeysLocation": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/jwks.json",
"AuthUserIDClaim": "", "AuthUserIDClaim": "",
"CertFile": "", "CertFile": "",
"CertKey": "", "CertKey": "",
"IdpSignKeyRefreshEnabled": true, "IdpSignKeyRefreshEnabled": true,
"OIDCConfigEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/.well-known/openid-configuration" "OIDCConfigEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/.well-known/openid-configuration"
},
"IdpManagerConfig": {
"ManagerType": "zitadel",
"ClientConfig": {
"Issuer": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
"TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
"ClientID": "netbird",
"ClientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_SECRET'] }}",
"GrantType": "client_credentials"
},
"ExtraConfig": {
"ManagementEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/management/v1"
},
"Auth0ClientCredentials": null,
"AzureClientCredentials": null,
"KeycloakClientCredentials": null,
"ZitadelClientCredentials": null
},
"DeviceAuthorizationFlow": {
"Provider": "hosted",
"ProviderConfig": {
"Audience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
"AuthorizationEndpoint": "",
"Domain": "",
"ClientID": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
"ClientSecret": "",
"TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
"DeviceAuthEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/device_authorization",
"Scope": "openid",
"UseIDToken": false,
"RedirectURLs": null
}
}, },
"IdpManagerConfig": {},
"DeviceAuthorizationFlow": {},
"PKCEAuthorizationFlow": { "PKCEAuthorizationFlow": {
"ProviderConfig": { "ProviderConfig": {
"Audience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}", "Audience": "netbird",
"ClientID": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}", "ClientID": "netbird",
"ClientSecret": "", "ClientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}",
"Domain": "", "Domain": "",
"AuthorizationEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/authorize", "AuthorizationEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/api/oidc/authorization",
"TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token", "TokenEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/api/oidc/token",
"Scope": "openid profile email offline_access api", "Scope": "openid profile email offline_access api",
"RedirectURLs": [ "RedirectURLs": [
"http://localhost:53000" "http://localhost:53000"
], ],
"UseIDToken": false "UseIDToken": true
} }
} }
} }
docker-compose.yml
+194 -196
View File
@@ -202,9 +202,10 @@ services:
AUTHELIA_SESSION_SECRET: ${AUTHELIA_SESSION_SECRET} AUTHELIA_SESSION_SECRET: ${AUTHELIA_SESSION_SECRET}
AUTHELIA_STORAGE_ENCRYPTION_KEY: ${AUTHELIA_STORAGE_ENCRYPTION_KEY} AUTHELIA_STORAGE_ENCRYPTION_KEY: ${AUTHELIA_STORAGE_ENCRYPTION_KEY}
AUTHELIA_STORAGE_POSTGRES_PASSWORD: ${AUTHELIA_STORAGE_POSTGRES_PASSWORD} AUTHELIA_STORAGE_POSTGRES_PASSWORD: ${AUTHELIA_STORAGE_POSTGRES_PASSWORD}
# PGID: ${PGID} PGID: ${PGID}
# PUID: ${PUID} PUID: ${PUID}
TZ: ${TZ} TZ: ${TZ}
X_AUTHELIA_CONFIG_FILTERS: template
expose: expose:
- 9091 - 9091
image: authelia/authelia:master image: authelia/authelia:master
@@ -1268,77 +1269,77 @@ services:
restart: always restart: always
volumes: volumes:
- ${DOCKER_VOLUME_STORAGE}/backups/docker_volume_bkups:/archive - ${DOCKER_VOLUME_STORAGE}/backups/docker_volume_bkups:/archive
- authelia-pg-db:/data/authelia-pg-db:ro - authelia-pg-db:/backup/authelia-pg-db:ro
- bitmagnet-pg-db:/data/bitmagnet-pg-db:ro - bitmagnet-pg-db:/backup/bitmagnet-pg-db:ro
- bunkerweb-storage:/data/bunkerweb-storage:ro - bunkerweb-storage:/backup/bunkerweb-storage:ro
- castopod-media:/data/castopod-media:ro - castopod-media:/backup/castopod-media:ro
- crowdsec-config:/data/crowdsec-config:ro - crowdsec-config:/backup/crowdsec-config:ro
- crowdsec-db:/data/crowdsec-db:ro - crowdsec-db:/backup/crowdsec-db:ro
- dawarich_db_data:/data/dawarich_db_data:ro - dawarich_db_data:/backup/dawarich_db_data:ro
- dawarich_shared:/data/dawarich_shared:ro - dawarich_shared:/backup/dawarich_shared:ro
- dawarich_public:/data/dawarich_public:ro - dawarich_public:/backup/dawarich_public:ro
- dawarich_watched:/data/dawarich_watched:ro - dawarich_watched:/backup/dawarich_watched:ro
- dbgate-data:/data/dbgate-data:ro - dbgate-data:/backup/dbgate-data:ro
- docker-volume-bkup-data:/data/docker-volume-bkup-data:ro - docker-volume-bkup-data:/backup/docker-volume-bkup-data:ro
- fastenhealth-cache:/data/fastenhealth-cache:ro - fastenhealth-cache:/backup/fastenhealth-cache:ro
- fastenhealth-db:/data/fastenhealth-db:ro - fastenhealth-db:/backup/fastenhealth-db:ro
- filebeat_etc:/data/filebeat_etc:ro - filebeat_etc:/backup/filebeat_etc:ro
- filebeat_var:/data/filebeat_var:ro - filebeat_var:/backup/filebeat_var:ro
- gitea-pg-db:/data/gitea-pg-db:ro - gitea-pg-db:/backup/gitea-pg-db:ro
- hortusfox_app_backup:/data/hortusfox_app_backup:ro - hortusfox_app_backup:/backup/hortusfox_app_backup:ro
- hortusfox_app_images:/data/hortusfox_app_images:ro - hortusfox_app_images:/backup/hortusfox_app_images:ro
- hortusfox_app_logs:/data/hortusfox_app_logs:ro - hortusfox_app_logs:/backup/hortusfox_app_logs:ro
- hortusfox_app_migrate:/data/hortusfox_app_migrate:ro - hortusfox_app_migrate:/backup/hortusfox_app_migrate:ro
- hortusfox_app_themes:/data/hortusfox_app_themes:ro - hortusfox_app_themes:/backup/hortusfox_app_themes:ro
- hortusfox_db_data:/data/hortusfox_db_data:ro - hortusfox_db_data:/backup/hortusfox_db_data:ro
- immich-model-cache:/data/immich-model-cache:ro - immich-model-cache:/backup/immich-model-cache:ro
- influxdb2-data:/data/influxdb2-data:ro - influxdb2-data:/backup/influxdb2-data:ro
- influxdb2-config:/data/influxdb2-config:ro - influxdb2-config:/backup/influxdb2-config:ro
- invidious-postgres:/data/invidious-postgres:ro - invidious-postgres:/backup/invidious-postgres:ro
- invoice-ninja_cache:/data/invoice-ninja_cache:ro - invoice-ninja_cache:/backup/invoice-ninja_cache:ro
- invoice-ninja_public:/data/invoice-ninja_public:ro - invoice-ninja_public:/backup/invoice-ninja_public:ro
- invoice-ninja_storage:/data/invoice-ninja_storage:ro - invoice-ninja_storage:/backup/invoice-ninja_storage:ro
- jitsi-web-admin-theme:/data/jitsi-web-admin-theme:ro - jitsi-web-admin-theme:/backup/jitsi-web-admin-theme:ro
- jitsi-web-admin-upload:/data/jitsi-web-admin-upload:ro - jitsi-web-admin-upload:/backup/jitsi-web-admin-upload:ro
- joplin_data:/data/joplin_data:ro - joplin_data:/backup/joplin_data:ro
- librechat-pg-data:/data/librechat-pg-data:ro - librechat-pg-data:/backup/librechat-pg-data:ro
- libretranslate_models:/data/libretranslate_models:ro - libretranslate_models:/backup/libretranslate_models:ro
- lldap_data:/data/lldap_data:ro - lldap_data:/backup/lldap_data:ro
- mastodon-pg-db:/data/mastodon-pg-db:ro - mastodon-pg-db:/backup/mastodon-pg-db:ro
- mixpost-storage:/data/mixpost-storage:ro - mixpost-storage:/backup/mixpost-storage:ro
- mixpost-logs:/data/mixpost-logs:ro - mixpost-logs:/backup/mixpost-logs:ro
- mongodb_config:/data/mongodb_config:ro - mongodb_config:/backup/mongodb_config:ro
- mongodb_data:/data/mongodb_data:ro - mongodb_data:/backup/mongodb_data:ro
- n8n-data:/data/n8n-data:ro - n8n-data:/backup/n8n-data:ro
- netbird-mgmt:/data/netbird-mgmt:ro - netbird-mgmt:/backup/netbird-mgmt:ro
- netbird-signal:/data/netbird-signal:ro - netbird-signal:/backup/netbird-signal:ro
- netbird-letsencrypt:/data/netbird-letsencrypt:ro - netbird-letsencrypt:/backup/netbird-letsencrypt:ro
- nextcloud_aio_mastercontainer:/data/nextcloud_aio_mastercontainer:ro - nextcloud_aio_mastercontainer:/backup/nextcloud_aio_mastercontainer:ro
- ollama:/data/ollama:ro - ollama:/backup/ollama:ro
- open-webui:/data/open-webui:ro - open-webui:/backup/open-webui:ro
- paperless-ngx-data:/data/paperless-ngx-data:ro - paperless-ngx-data:/backup/paperless-ngx-data:ro
- paperless-ngx-media:/data/paperless-ngx-media:ro - paperless-ngx-media:/backup/paperless-ngx-media:ro
- paperless-ngx-pg:/data/paperless-ngx-pg:ro - paperless-ngx-pg:/backup/paperless-ngx-pg:ro
- peppermint-pg-data:/data/peppermint-pg-data:ro - peppermint-pg-data:/backup/peppermint-pg-data:ro
- pgbackweb-data:/data/pgbackweb-data:ro - pgbackweb-data:/backup/pgbackweb-data:ro
- plausible-db-data:/data/plausible-db-data:ro - plausible-db-data:/backup/plausible-db-data:ro
- plausible-event-data:/data/plausible-event-data:ro - plausible-event-data:/backup/plausible-event-data:ro
- plausible-event-logs:/data/plausible-event-logs:ro - plausible-event-logs:/backup/plausible-event-logs:ro
- portainer-data:/data/portainer-data:ro - portainer-data:/backup/portainer-data:ro
- reactive-resume-pg:/data/reactive-resume-pg:ro - reactive-resume-pg:/backup/reactive-resume-pg:ro
- semaphore_config:/data/semaphore_config:ro - semaphore_config:/backup/semaphore_config:ro
- semaphore_data:/data/semaphore_data:ro - semaphore_data:/backup/semaphore_data:ro
- semaphore_tmp:/data/semaphore_tmp:ro - semaphore_tmp:/backup/semaphore_tmp:ro
- sonarqube-data:/data/sonarqube-data:ro - sonarqube-data:/backup/sonarqube-data:ro
- sonarqube-db:/data/sonarqube-db:ro - sonarqube-db:/backup/sonarqube-db:ro
- sonarqube-db-data:/data/sonarqube-db-data:ro - sonarqube-db-data:/backup/sonarqube-db-data:ro
- sonarqube-extensions:/data/sonarqube-extensions:ro - sonarqube-extensions:/backup/sonarqube-extensions:ro
- sonarqube-logs:/data/sonarqube-logs:ro - sonarqube-logs:/backup/sonarqube-logs:ro
- sonarqube-temp:/data/sonarqube-temp:ro - sonarqube-temp:/backup/sonarqube-temp:ro
- tandoor-pg:/data/tandoor-pg:ro - tandoor-pg:/backup/tandoor-pg:ro
- unmanic-cache:/data/unmanic-cache:ro - unmanic-cache:/backup/unmanic-cache:ro
- wallos-db:/data/wallos-db:ro - wallos-db:/backup/wallos-db:ro
- wallos-logos:/data/wallos-logos:ro - wallos-logos:/backup/wallos-logos:ro
docuseal: docuseal:
container_name: docuseal container_name: docuseal
image: docuseal/docuseal:latest image: docuseal/docuseal:latest
@@ -1790,8 +1791,12 @@ services:
condition: service_started condition: service_started
required: true required: true
immich-pg-db: immich-pg-db:
condition: service_started condition: service_healthy
required: true required: true
immich-machine-learning:
condition: service_healthy
required: true
restart: true
environment: environment:
DB_DATABASE_NAME: immich DB_DATABASE_NAME: immich
DB_HOSTNAME: immich-pg-db DB_HOSTNAME: immich-pg-db
@@ -1835,10 +1840,6 @@ services:
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
immich-machine-learning: immich-machine-learning:
container_name: immich-machine-learning container_name: immich-machine-learning
depends_on:
immich-server:
condition: service_started
required: true
healthcheck: healthcheck:
disable: false disable: false
image: ghcr.io/immich-app/immich-machine-learning:release image: ghcr.io/immich-app/immich-machine-learning:release
@@ -3337,8 +3338,8 @@ services:
homepage.widget.type: navidrome homepage.widget.type: navidrome
homepage.widget.url: http://navidrome:4533 homepage.widget.url: http://navidrome:4533
homepage.widget.user: admin homepage.widget.user: admin
homepage.widget.token: e8a9e97b29aa963fa4729c633289d232 homepage.widget.token: ${NAVIDROME_HOMEPAGE_TOKEN}
homepage.widget.salt: v5Z93Z homepage.widget.salt: ${NAVIDROME_HOMEPAGE_SALT}
swag: enable swag: enable
swag_port: 4533 swag_port: 4533
swag_proto: http swag_proto: http
@@ -3383,123 +3384,121 @@ services:
target: /app/api target: /app/api
# (API: OPTION 2) use when debugging issues # (API: OPTION 2) use when debugging issues
# - ${DOCKER_VOLUME_CONFIG}/netalertx/api:/app/api # - ${DOCKER_VOLUME_CONFIG}/netalertx/api:/app/api
# netbird-dashboard: netbird-dashboard:
# container_name: netbird-dashboard container_name: netbird-dashboard
# environment: environment:
# # Endpoints # Endpoints
# NETBIRD_MGMT_API_ENDPOINT: https://netbird.${MY_TLD}:33073 NETBIRD_MGMT_API_ENDPOINT: https://vpn.${MY_TLD}
# NETBIRD_MGMT_GRPC_API_ENDPOINT: https://netbird.${MY_TLD}:33073 NETBIRD_MGMT_GRPC_API_ENDPOINT: https://vpn.${MY_TLD}
# # OIDC # OIDC
# AUTH_AUDIENCE: ${NETBIRD_ZITADEL_CLIENT_ID} AUTH_AUDIENCE: none
# AUTH_CLIENT_ID: ${NETBIRD_ZITADEL_CLIENT_ID} AUTH_CLIENT_ID: netbird
# AUTH_CLIENT_SECRET: ${NETBIRD_ZITADEL_CLIENT_SECRET} AUTH_CLIENT_SECRET: ${AUTHELIA_NETBIRD_CLIENT_SECRET}
# AUTH_AUTHORITY: https://id.${MY_TLD} AUTH_AUTHORITY: https://auth.${MY_TLD}
# USE_AUTH0: false USE_AUTH0: false
# AUTH_SUPPORTED_SCOPES: openid profile email offline_access api AUTH_SUPPORTED_SCOPES: openid profile email offline_access api
# AUTH_REDIRECT_URI: /auth AUTH_REDIRECT_URI: /peers
# AUTH_SILENT_REDIRECT_URI: /silent-auth AUTH_SILENT_REDIRECT_URI: /add-peers
# NETBIRD_TOKEN_SOURCE: accessToken NETBIRD_TOKEN_SOURCE: idToken
# # SSL # SSL
# NGINX_SSL_PORT: 443 NGINX_SSL_PORT: 443
# # Letsencrypt # Letsencrypt
# LETSENCRYPT_DOMAIN: LETSENCRYPT_DOMAIN:
# LETSENCRYPT_EMAIL: LETSENCRYPT_EMAIL:
# image: netbirdio/dashboard:latest image: netbirdio/dashboard:latest
# labels: labels:
# homepage.group: Privacy/Security homepage.group: Privacy/Security
# homepage.name: Netbird homepage.name: Netbird
# homepage.href: https://netbird.${MY_TLD} homepage.href: https://vpn.${MY_TLD}
# homepage.icon: netbird.svg homepage.icon: netbird.svg
# homepage.description: Peer-to-peer private network and centralized access control system homepage.description: Peer-to-peer private network and centralized access control system
# swag: enable swag: enable
# swag_proto: http swag_proto: http
# swag_port: 80 swag_port: 80
# swag_auth: authelia swag_auth: authelia
# swag_url: netbird.${MY_TLD} swag_url: vpn.${MY_TLD}
# swag_server_custom_directive: | swag_server_custom_directive: |
# location /signalexchange.SignalExchange/ { location /signalexchange.SignalExchange/ {
# grpc_pass grpc://netbird-signal:80; grpc_pass grpc://netbird-signal;
# #grpc_ssl_verify off; #grpc_ssl_verify off;
# grpc_read_timeout 1d; grpc_read_timeout 1d;
# grpc_send_timeout 1d; grpc_send_timeout 1d;
# grpc_socket_keepalive on; grpc_socket_keepalive on;
# } }
# # Proxy Management http endpoint # Proxy Management http endpoint
# location /api { location /api {
# proxy_pass http://netbird-management:443; proxy_pass http://netbird-management;
# } }
# # Proxy Management grpc endpoint # Proxy Management grpc endpoint
# location /management.ManagementService/ { location /management.ManagementService/ {
# grpc_pass grpc://netbird-management:443; grpc_pass grpc://netbird-management;
# #grpc_ssl_verify off; #grpc_ssl_verify off;
# grpc_read_timeout 1d; grpc_read_timeout 1d;
# grpc_send_timeout 1d; grpc_send_timeout 1d;
# grpc_socket_keepalive on; grpc_socket_keepalive on;
# } }
# swag.uptime-kuma.enabled: true swag.uptime-kuma.enabled: true
# swag.uptime-kuma.monitor.url: https://netbird.${MY_TLD} swag.uptime-kuma.monitor.url: https://vpn.${MY_TLD}
# ports: ports:
# - 32908:80 - 32908:80
# - 36610:443 - 36610:443
# restart: unless-stopped restart: unless-stopped
# volumes: volumes:
# - netbird-letsencrypt:/etc/letsencrypt/ - netbird-letsencrypt:/etc/letsencrypt/
# netbird-signal: netbird-signal:
# container_name: netbird-signal container_name: netbird-signal
# image: netbirdio/signal:latest image: netbirdio/signal:latest
# ports: ports:
# - 10001:80 - 10001:80
# restart: unless-stopped restart: unless-stopped
# volumes: volumes:
# - netbird-signal:/var/lib/netbird - netbird-signal:/var/lib/netbird
# netbird-relay: netbird-relay:
# container_name: netbird-relay image: netbirdio/relay:latest
# image: netbirdio/relay:latest restart: unless-stopped
# restart: unless-stopped environment:
# environment: NB_LOG_LEVEL: info
# NB_LOG_LEVEL: info NB_LISTEN_ADDRESS: :33080
# NB_LISTEN_ADDRESS: :33080 NB_EXPOSED_ADDRESS: vpn.${MY_TLD}:33080
# NB_EXPOSED_ADDRESS: netbird.${MY_TLD}:33080 # todo: change to a secure secret
# # todo: change to a secure secret NB_AUTH_SECRET: ${NETBIRD_RELAY_AUTH_SECRET}
# NB_AUTH_SECRET: ${NETBIRD_RELAY_AUTH_SECRET} ports:
# ports: - 33080:33080
# - 33080:33080 netbird-management:
# netbird-management: command: [
# command: [ "--port", "443",
# "--port", "443", "--log-file", "console",
# "--log-file", "console", "--log-level", "info",
# "--log-level", "info", "--disable-anonymous-metrics=false",
# "--disable-anonymous-metrics=false", "--single-account-mode-domain=vpn.${MY_TLD}",
# "--single-account-mode-domain=netbird.${MY_TLD}", "--dns-domain=vpn.trez.wtf"
# "--dns-domain=netbird.selfhosted" ]
# ] container_name: netbird-management
# container_name: netbird-management depends_on:
# depends_on: netbird-dashboard:
# netbird-dashboard: condition: service_started
# condition: service_started environment:
# environment: NETBIRD_STORE_ENGINE_POSTGRES_DSN:
# NETBIRD_STORE_ENGINE_POSTGRES_DSN: NETBIRD_STORE_ENGINE_MYSQL_DSN:
# NETBIRD_STORE_ENGINE_MYSQL_DSN: image: netbirdio/management:latest
# image: netbirdio/management:latest restart: unless-stopped
# restart: unless-stopped volumes:
# volumes: - netbird-mgmt:/var/lib/netbird
# - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro
# - netbird-letsencrypt:/etc/letsencrypt:ro - ${DOCKER_VOLUME_CONFIG}/netbird/management.json:/etc/netbird/management.json
# - ${DOCKER_VOLUME_CONFIG}/netbird/management.json:/etc/netbird/management.json ports:
# ports: - 33073:443 #API port
# - 23833:443 #API port netbird-coturn:
# netbird-coturn: command:
# command: - -c /etc/turnserver.conf
# - -c /etc/turnserver.conf container_name: netbird-coturn
# container_name: netbird-coturn image: coturn/coturn:latest
# image: coturn/coturn:latest restart: unless-stopped
# restart: unless-stopped #domainname: vpn.${MY_TLD} # only needed when TLS is enabled
# #domainname: netbird.${MY_TLD} # only needed when TLS is enabled volumes:
# volumes: - ${DOCKER_VOLUME_CONFIG}/netbird/turnserver.conf:/etc/turnserver.conf:ro
# - ${DOCKER_VOLUME_CONFIG}/netbird/turnserver.conf:/etc/turnserver.conf:ro
# - ${DOCKER_VOLUME_CONFIG}/netbird/privkey.pem:/etc/coturn/private/privkey.pem:ro # - ${DOCKER_VOLUME_CONFIG}/netbird/privkey.pem:/etc/coturn/private/privkey.pem:ro
# - ${DOCKER_VOLUME_CONFIG}/netbird/cert.pem:/etc/coturn/certs/cert.pem:ro # - ${DOCKER_VOLUME_CONFIG}/netbird/cert.pem:/etc/coturn/certs/cert.pem:ro
# network_mode: host
nextcloud: nextcloud:
container_name: nextcloud-aio-mastercontainer container_name: nextcloud-aio-mastercontainer
environment: environment:
@@ -4899,7 +4898,6 @@ services:
swag: swag:
condition: service_started condition: service_started
required: true required: true
restart: true
environment: environment:
PGID: ${PGID} PGID: ${PGID}
PUID: ${PUID} PUID: ${PUID}