🔧 Renovate: Update (major) percona/mongodb_exporter Docker tag to v2

Reviewed-on: #921

.gitea/workflows/compose-services-readme.yml

@@ -0,0 +1,42 @@
+name: List of Services README Generation
+
+on:
+  schedule:
+    - cron: 30 */2 * * *
+  workflow_dispatch:
+
+jobs:
+  readme-services:
+   name: Generate Services List
+   runs-on: ubuntu-latest
+   steps:
+    - name: Checkout
+      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      with:
+        ref: 'main'
+
+    - name: Install yq
+      uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
+
+    - name: Generate service list
+      run: |
+        yq 'explode(.) | .services | to_entries | map({"service": .key, "image": .value.image, "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
+
+    - name: Generate Markdown Table
+      uses: gazab/create-markdown-table@6686233d7008e8d8b9d4bbdbfd1fb1ae510019f0 # v1.0.7
+      id: service-table
+      with:
+        file: ./services.yml
+
+    - name: Regenerate README
+      run: |
+        echo "# List of Services" > README.md
+        echo -e "\n\n" >> README.md
+        echo "${{ steps.service-table.outputs.table }}" >> README.md
+
+    - name: Add/Commit README.md
+      id: commit-readme
+      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
+      with:
+        message: "chore: Update README"
+        add: "README.md"

.gitea/workflows/pr-ansible-config-deployment.yaml

@@ -1,193 +0,0 @@
-name: Gitea Branch PR & Ansible Deployment
-on:
-  workflow_dispatch:
-  push:
-    branches-ignore:
-      - 'main'
-    paths:
-      - '**.j2'
-      - 'ansible/**.yml'
-jobs:
-  check-and-create-pr:
-    if: github.ref != 'refs/heads/main'
-    name: Check and Create PR
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/tea/0.9.2/x64
-          key: tea-${{ runner.os }}-0.9.2
-      - name: Install tea
-        uses: supplypike/setup-bin@v4
-        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'Checking for existing PR... 🔍'
-      - name: Check if open PR exists
-        id: check-opened-pr-step
-        continue-on-error: true
-        run: |
-          tea login add --name gitea-rinoa --url "${{ secrets.RINOA_GITEA_URL }}" --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
-          pr_exists=$(tea pr list --repo ${{ github.repository }} --state open --fields index,title,head | egrep ${{ github.ref_name }} | tail -1 | wc -l)
-          echo "exists=$pr_exists" >> $GITHUB_OUTPUT
-      - name: Create PR
-        if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
-        run: |
-          tea login default gitea-rinoa
-          pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
-          pr_index_new=$(expr ${pr_index_old} + 1)
-          tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Ansible Configs.j2"
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'PR Created 🎟️'
-  ansible-linting:
-    name: Docker Compose & Ansible Lints
-    needs: [check-and-create-pr]
-    runs-on: ubuntu-latest
-    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
-      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      VAULT_NAMESPACE: ""
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Fetch base branch
-        run: |
-          git fetch origin ${{ github.event.pull_request.base.ref }}
-      - name: Cache Ansible Galaxy Collections
-        uses: actions/cache@v3
-        with:
-          path: ansible/collections
-          key: ${{ runner.os }}-ansible-${{ hashFiles('./ansible/collections/requirements.yml') }}
-          restore-keys: |
-            ${{ runner.os }}-ansible-
-      - name: Install Ansible
-        uses: alex-oleshkevich/setup-ansible@v1.0.1
-        with:
-          version: "11.0.0"
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
-      - name: Install hvac
-        run: pip install hvac
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
-          notification_message: 'Starting Ansible dry run...'
-      - name: Ansible Playbook Dry Run
-        uses: arillso/action.playbook@0.1.0
-        with:
-          check: true
-          galaxy_collections_path: ansible/collections
-          galaxy_requirements_file: ansible/collections/requirements.yml
-          inventory: ansible/inventory/hosts.yml
-          playbook: ansible/docker_config_deploy.yml
-          private_key: ${{ secrets.RINOA_ANSIBLE_PRIVATE_KEY }}
-          vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
-          verbose: 0
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Docker Compose dry run completed successfully.'
-  pr-merge:
-    name: PR Merge
-    needs: [regenerate-readme-modified-services]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install tea
-        uses: supplypike/setup-bin@v4
-        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
-      - name: PR Merge
-        id: pr_merge
-        run: |
-          tea login add --name gitea-rinoa --url ${{ secrets.RINOA_GITEA_URL }} --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
-          tea login default gitea-rinoa
-          echo "Merging PR..."
-          pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
-          tea pr m --repo ${{ github.repository }} --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" --message "Merged by ${{ github.actor }}" ${pr_index}
-          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Merge Successful'
-          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
-  ansible-config-deploy:
-    name: Ansible Config Deployment
-    runs-on: ubuntu-latest
-    needs: [pr-merge]
-    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
-      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      DOCKER_HOST: tcp://dockerproxy:2375
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: main
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/vault/1.18.0/x64
-          key: vault-${{ runner.os }}-1.18.0
-      - name: Install Ansible
-        uses: alex-oleshkevich/setup-ansible@v1.0.1
-        with:
-          version: "11.0.0"
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
-      - name: Install hvac
-        run: pip install hvac
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
-          notification_message: 'Starting config deployment with Ansible...'
-      - name: Ansible Playbook Config Deploy
-        uses: arillso/action.playbook@0.1.0
-        with:
-          check: false
-          galaxy_collections_path: ansible/collections
-          galaxy_requirements_file: ansible/collections/requirements.yml
-          inventory: ansible/inventory/hosts.yml
-          playbook: ansible/docker_config_deploy.yml
-          private_key: ${{ secrets.RINOA_ANSIBLE_PRIVATE_KEY }}
-          vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
-          notification_message: 'Deployment completed successfully.'

.gitea/workflows/pr-cloudflare-docker-deploy.yml

@@ -1,102 +1,104 @@
 name: Gitea Branch PR, Cloudflare DNS, README generation, & Docker Deployment
+
 on:
   workflow_dispatch:
   push:
     branches-ignore:
-      - 'main'
+      - "main"
+      - "renovate/**"
     paths:
-      - '**/docker-compose.yml'
-      - '**/pr-cloudflare-docker-deploy.yml'
-      - '!ansible/**.yml'
+      - "**/docker-compose.yml"
+
+env:
+  FLARECTL_VERSION: "0.116.0"
+  HC_VAULT_VERSION: "1.21.0"
+  TEA_VERSION: "0.10.1"
+
 jobs:
   check-and-create-pr:
-    if: github.ref != 'refs/heads/main'
     name: Check and Create PR
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 1
-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/tea/0.9.2/x64
-          key: tea-${{ runner.os }}-0.9.2
-      - name: Install tea
-        uses: supplypike/setup-bin@v4
-        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
+
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'Checking for existing PR... 🔍'
-      - name: Check if open PR exists
-        id: check-opened-pr-step
-        continue-on-error: true
-        run: |
-          tea login add --name gitea-rinoa --url "${{ secrets.RINOA_GITEA_URL }}" --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
-          pr_exists=$(tea pr list --repo ${{ github.repository }} --state open --fields index,title,head | egrep ${{ github.ref_name }} | tail -1 | wc -l)
-          echo "exists=$pr_exists" >> $GITHUB_OUTPUT
-      - name: Create PR
-        if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
-        run: |
-          tea login default gitea-rinoa
-          pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
-          pr_index_new=$(expr ${pr_index_old} + 1)
-          tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Docker Compose"
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "Checking for existing PR... 🔍"
+
+      - name: PR Check/Creation
+        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
+        with:
+          url: ${{ secrets.TREZ_GITEA_URL }}
+          token: ${{ secrets.BOT_GITEA_TOKEN }}
+          pr-label: docker-compose,manual
+          assignee: ${{ github.actor }}
+
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'PR Created 🎟️'
-  docker-compose-dry-run:
-    name: Docker Compose Dry Run
-    needs: [check-and-create-pr]
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "PR Check done 🎟️"
+
+  generate-service-list:
+    name: Generate list of added/modified/deleted services
     runs-on: ubuntu-latest
-    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
-      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      VAULT_NAMESPACE: ""
-      RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
+    needs: [check-and-create-pr]
     outputs:
-      svc_deploy_list: ${{ steps.modded_svcs.outputs.rinoa_svcs }}
+      svc_deploy_list: ${{ steps.detect_services.outputs.docker_svc_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
       - name: Fetch base branch
         run: |
           git fetch origin ${{ github.event.pull_request.base.ref }}
-      - name: Login to Gitea Container Registry
-        run: |
-          docker login -u gitea-sonarqube-bot -p ${RINOA_REGISTRY_PASSWORD} git.trez.wtf
+
+      - name: Gotify Notification
+        uses: https://git.trez.wtf/Trez/gotify-action@main
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Services TBD"
+          notification_message: "Generating list of services to deploy..."
+
       - name: Save both versions of docker-compose.yml
         run: |
           git show origin/main:docker-compose.yml > docker-compose-main.yml || touch docker-compose-main.yml
           cp docker-compose.yml docker-compose-head.yml
+
       - name: Detect added, deleted, and modified services
         id: detect_services
         run: |
+          set +e  # prevent failure on non-zero exit codes
+
           echo "Getting services from main and ${{ github.ref_name }}"
           yq '.services | keys | .[]' docker-compose-main.yml | sort > services_main.txt
           yq '.services | keys | .[]' docker-compose-head.yml | sort > services_head.txt
 
-          echo "Creating list of modified services..."
+          echo "Creating list of service changes..."
           touch service_changes.txt
 
-          comm -13 services_main.txt services_head.txt | while read service; do
-            echo "$service: added" >> service_changes.txt
+          # Detect newly added services
+          comm -13 services_main.txt services_head.txt 2>/dev/null | while read service; do
+            [ -n "$service" ] && echo "$service: added" >> service_changes.txt
           done
 
-          comm -12 services_main.txt services_head.txt | while read service; do
+          # Detect removed services
+          comm -23 services_main.txt services_head.txt 2>/dev/null | while read service; do
+            [ -n "$service" ] && echo "$service: removed" >> service_changes.txt
+          done
+
+          # Detect modified services
+          comm -12 services_main.txt services_head.txt 2>/dev/null | while read service; do
             yq ".services[\"$service\"]" docker-compose-main.yml > tmp_main.yml
             yq ".services[\"$service\"]" docker-compose-head.yml > tmp_head.yml
             if ! diff -q tmp_main.yml tmp_head.yml > /dev/null; then
@@ -105,108 +107,203 @@ jobs:
           done
 
           echo "Detected service changes:"
-          cat service_changes.txt
+          cat service_changes.txt || echo "None"
+
+          # Separate categories safely
+          added_svcs=$(grep -E ': added' service_changes.txt 2>/dev/null | cut -d':' -f1 | sort | uniq)
+          modified_svcs=$(grep -E ': modified' service_changes.txt 2>/dev/null | cut -d':' -f1 | sort | uniq)
+          removed_svcs=$(grep -E ': removed' service_changes.txt 2>/dev/null | cut -d':' -f1 | sort | uniq)
+
+          # Gather list of modified/added services
+          mod_svcs=$( (echo "$added_svcs"; echo "$modified_svcs") | tr ' ' '\n' | sort -u | grep -v '^$' || true)
+
+          if [ -z "$mod_svcs" ]; then
+            echo "No modified or added services detected."
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+          else
+            echo "Modified/added services:"
+            echo "$mod_svcs"
+
+            # Include direct dependencies (only if head file exists)
+            if [ -f docker-compose-head.yml ]; then
+              echo "Resolving direct dependencies..."
+              deps_list=""
+              for svc in $mod_svcs; do
+                deps=$(yq -r ".services[\"$svc\"].depends_on | keys | .[]" docker-compose-head.yml 2>/dev/null || true)
+                if [ -n "$deps" ]; then
+                  echo "$svc depends on:"
+                  echo "$deps"
+                  deps_list="$deps_list $deps"
+                fi
+              done
+
+              all_svcs=$( (echo "$mod_svcs"; echo "$deps_list") | tr ' ' '\n' | sort -u)
+            else
+              all_svcs="$mod_svcs"
+            fi
+
+            echo "Final service list (including direct dependencies):"
+            echo "$all_svcs"
+
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "$all_svcs" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Output removed services separately
+          echo "Removed services:"
+          echo "${removed_svcs:-None}"
+          echo "removed_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$removed_svcs" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+          # Always exit cleanly
+          exit 0
+
+  docker-compose-dry-run:
+    name: Docker Compose Dry Run
+    needs: [generate-service-list]
+    runs-on: ubuntu-latest
+    env:
+      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+      VAULT_NAMESPACE: ""
+      RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
+      DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
 
-          svc_list=$(paste -sd '|' service_changes.txt)
-          echo "classified_services=$svc_list" >> "$GITHUB_OUTPUT"
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Starting Docker Compose dry run...'
-      - name: Cache .env Files
-        uses: actions/cache@v4
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Dry Run @ Rinoa"
+          notification_message: "Starting Docker Compose dry run..."
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
         with:
-          path: .env
-          key: ${{ runner.os }}-env-${{ hashFiles('docker-compose.yml') }}
-      - name: Generate modified services list & .env file for Docker Compose Dry Run
-        id: modded_svcs
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Check services
+        env:
+          DSLIST: ${{ env.DOCKER_SVC_LIST }}
         run: |
-          mod_svcs=$(echo "${{ steps.detect_services.outputs.classified_services }}" | sed -e 's/|//g' -e 's/: \(add\|modifi\|delet\)ed/ /g')
-          echo ${mod_svcs}
-          vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
-          echo "rinoa_svcs=${mod_svcs}" >> "$GITHUB_OUTPUT"
-      - name: Testing service list output
-        run: |
-          echo ${{ steps.modded_svcs.outputs.rinoa_svcs }}
-      - name: Docker Compose Dry Run
-        timeout-minutes: 360
+          if [ -z ${DSLIST} ]; then
+            echo "DOCKER_SVC_LIST=" >> $GITHUB_ENV
+          else
+            echo "${DLIST}"
+          fi
+
+      - name: Pre-pull/build service images in parallel
         continue-on-error: true
-        uses: chaplyk/docker-compose-remote-action@v1.1
-        with:
-          ssh_host: 192.168.1.254
-          ssh_port: 22
-          ssh_user: gitea-deploy
-          ssh_key: ${{ secrets.RINOA_GITEA_PRIVATE_SSH_KEY }}
-          service: ${{ steps.modded_svcs.outputs.rinoa_svcs }}
-          compose_file: docker-compose.yml
-          pull: false
-          build: false
-          options: -d --remove-orphans
+        uses: https://git.trez.wtf/Trez/docker-select-image-pull@main
         env:
           DOCKER_HOST: tcp://dockerproxy:2375
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Docker Compose dry run completed successfully.'
+          services: ${{ env.DOCKER_SVC_LIST }}
+          compose_profile: "rinoa-apps"
+
+      - name: Docker Compose Dry Run
+        uses: hoverkraft-tech/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.1
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: |
+            ${{ needs.generate-service-list.outputs.svc_deploy_list }}
+          up-flags: -d --remove-orphans --dry-run
+          compose-flags: --dry-run --profile rinoa-apps
+          services-log-level: debug
+
+      - name: Gotify Notification
+        uses: https://git.trez.wtf/Trez/gotify-action@main
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Dry Run @ Rinoa"
+          notification_message: "Docker Compose dry run completed successfully."
+
   cloudflare-dns-setup:
     name: Cloudflare DNS Setup
-    needs: [docker-compose-ansible-lints]
+    needs: [docker-compose-dry-run]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 1
-      - name: Cache flarectl CLI
-        uses: actions/cache@v4
-        with:
-          path: ~/.flarectl
-          key: flarectl-${{ runner.os }}-${{ hashFiles('workflow-config.yml') }}
+
       - name: Install flarectl
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
         with:
-          uri: 'https://github.com/cloudflare/cloudflare-go/releases/download/v0.113.0/flarectl_0.113.0_linux_amd64.tar.gz'
-          name: 'flarectl'
-          version: '0.113.0'
-      - name: Cache Subdomain Files
-        uses: actions/cache@v4
-        with:
-          path: |
-            compose_subdomains.txt
-            cloudflare_subdomains.txt
-          key: ${{ runner.os }}-subdomains-${{ hashFiles('docker-compose.yml') }}
+          uri: https://github.com/cloudflare/cloudflare-go/releases/download/v${{ env.FLARECTL_VERSION }}/flarectl_${{ env.FLARECTL_VERSION }}_linux_amd64.tar.gz
+          name: flarectl
+          version: ${{ env.FLARECTL_VERSION }}
+
       - name: Grab Subdomains from Docker Compose & Cloudflare
         id: grab-subdomains
         env:
           CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
           CF_API_EMAIL: ${{ secrets.CF_API_EMAIL }}
         run: |
-          yq '.services[].labels.swag_url' docker-compose.yml | egrep -v 'null' | sed -e 's|"||g' | awk -F'.' '{print $1}' | sort > compose_subdomains.txt
-          flarectl --json dns list --zone "trez.wtf" --type=CNAME --content "trez.wtf" | jq '.[].Name' | sed -e 's|"||g' | awk -F"." '{print $1}' | sort > cloudflare_subdomains.txt
+          yq -r '.services[].labels.swag_url' docker-compose.yml | \
+            egrep -v 'null' | \
+            awk -F'.' '{print $1}' | \
+            sort > compose_subdomains.txt
+
+          flarectl --json dns list \
+            --zone "trez.wtf" \
+            --type=CNAME \
+            --content "trez.wtf" \
+            | jq -r '.[].Name' | awk -F"." '{print $1}' | \
+            sort > cloudflare_subdomains.txt
+
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
-          notification_message: 'Starting Cloudflare DNS setup...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Cloudflare Setup @ Rinoa"
+          notification_message: "Starting Cloudflare DNS setup..."
+
       - name: Compare Subdomains
         id: compare-subdomains
-        uses: LouisBrunner/diff-action@v2.2.0
+        uses: LouisBrunner/diff-action@9ea7b75986aa27143ad4928974c98a5a1bd92170 # v2.2.0
         with:
           old: compose_subdomains.txt
           new: cloudflare_subdomains.txt
           mode: addition
           tolerance: mixed-better
           output: domain_compare.txt
+
       - name: Create Subdomains
         if: steps.compare-subdomains.outputs.output != ''
         continue-on-error: true
@@ -218,144 +315,152 @@ jobs:
             echo "Creating $subdomain.trez.wtf..."
             flarectl dns create --zone "trez.wtf" --name "${subdomain}" --type=CNAME --content "trez.wtf" --proxy true
           done
+
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
-          notification_message: 'Cloudflare DNS setup completed successfully.'
-  regenerate-readme-modified-services:
-    name: Update README & Generate List of Modified Services
-    runs-on: ubuntu-latest
-    needs: [cloudflare-dns-setup]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install yq
-        uses: dcarbone/install-yq-action@v1
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: README Update'
-          notification_message: 'Updating README...'
-      - name: Generate service list
-        run: |
-          yq '.services | to_entries | map({"service": .key, "image": .value.image})' docker-compose.yml > services.yml
-      - name: Generate Markdown Table
-        uses: gazab/create-markdown-table@v1
-        id: service-table
-        with:
-          file: ./services.yml
-      - name: Regenerate README
-        run: |
-          echo "# List of Services" > README.md
-          echo -e "\n\n" >> README.md
-          echo "${{ steps.service-table.outputs.table }}" >> README.md
-      - name: Add/Commit README.md
-        id: commit-readme
-        uses: EndBug/add-and-commit@v9
-        with:
-          message: "chore: Update README"
-          add: "README.md"
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: README Update'
-          notification_message: 'README updated'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Cloudflare Setup @ Rinoa"
+          notification_message: "Cloudflare DNS setup completed successfully."
+
   pr-merge:
     name: PR Merge
-    needs: [regenerate-readme-modified-services]
+    needs: [generate-service-list, docker-compose-dry-run]
+    if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
       - name: Install tea
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
         with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
+          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
+          name: tea
+          version: ${{ env.TEA_VERSION }}
+
       - name: PR Merge
         id: pr_merge
         run: |
-          tea login add --name gitea-rinoa --url ${{ secrets.RINOA_GITEA_URL }} --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
+          tea login add \
+            --name gitea-rinoa \
+            --url "${{ secrets.TREZ_GITEA_URL }}" \
+            --user gitea-sonarqube-bot \
+            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
+            --token ${{ secrets.BOT_GITEA_TOKEN }}
+
           tea login default gitea-rinoa
+
           echo "Merging PR..."
-          pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
-          tea pr m --repo ${{ github.repository }} --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" --message "Merged by ${{ github.actor }}" ${pr_index}
+
+          pr_index=$(tea pr ls \
+            --repo ${{ github.repository }} \
+            --state open --fields index,title,head,state \
+            --output csv | \
+            egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
+
+          tea pr m \
+            --repo ${{ github.repository }} \
+            --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" \
+            --message "Merged by ${{ github.actor }}" ${pr_index}
+
           echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
+
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Merge Successful'
-          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Merge Successful"
+          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."
+
   docker-compose-deploy:
     name: Docker Compose Deployment
     runs-on: ubuntu-latest
-    needs: [docker-compose-dry-run, pr-merge]
+    needs: [generate-service-list, docker-compose-dry-run, pr-merge]
     env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
       DOCKER_HOST: tcp://dockerproxy:2375
       RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
-      DOCKER_SVC_LIST: ${{ needs.docker-compose-dry-run.outputs.svc_deploy_list }}
+      DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: main
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
-          path: /opt/hostedtoolcache/vault/1.18.0/x64
-          key: vault-${{ runner.os }}-1.18.0
-      - name: Install Ansible
-        uses: alex-oleshkevich/setup-ansible@v1.0.1
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
-          version: "11.0.0"
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
-      - name: Login to Gitea Container Registry
-        run: |
-          docker login -u gitea-sonarqube-bot -p ${RINOA_REGISTRY_PASSWORD} git.trez.wtf
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
+
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: https://git.trez.wtf/Trez/gotify-action@main
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
-          notification_message: 'Starting Docker Compose run...'
-      - name: Generate .env file for deployment
-        run: |
-           vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
-      - name: Docker Compose Dry Run
-        timeout-minutes: 360
-        continue-on-error: true
-        uses: chaplyk/docker-compose-remote-action@v1.1
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Deployment @ Rinoa"
+          notification_message: "Starting Docker Compose run..."
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Pre-pull/build service images in parallel
+        uses: https://git.trez.wtf/Trez/docker-select-image-pull@main
         env:
           DOCKER_HOST: tcp://dockerproxy:2375
         with:
-          ssh_host: 192.168.1.254
-          ssh_port: 22
-          ssh_user: gitea-deploy
-          ssh_key: ${{ secrets.RINOA_GITEA_PRIVATE_SSH_KEY }}
-          service: ${DOCKER_SVC_LIST}
-          compose_file: docker-compose.yml
-          pull: false
-          build: false
-          options: -d --remove-orphans
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+          services: ${{ env.DOCKER_SVC_LIST }}
+          compose_profile: "rinoa-apps"
+
+      - name: Docker Compose Deployment
+        uses: hoverkraft-tech/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.1
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
-          notification_message: 'Deployment completed successfully.'
+          services: |
+            ${{ needs.generate-service-list.outputs.svc_deploy_list }}
+          up-flags: -d --remove-orphans
+          down-flags: --dry-run
+          compose-flags: --profile rinoa-apps
+          services-log-level: debug
+
+      - name: Docker Compose Healthcheck
+        uses: jaracogmbh/docker-compose-health-check-action@973fbdccf7c8e396b652d3501984c8e530a9fa80 # v1.0.0
+        with:
+          max-retries: 30
+          retry-interval: 10
+          compose-file: "docker-compose.yml"
+          skip-exited: "true"
+          skip-no-healthcheck: "true"
+
+      - name: Gotify Notification
+        uses: https://git.trez.wtf/Trez/gotify-action@main
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Deployment @ Rinoa"
+          notification_message: "Deployment completed successfully."

.gitea/workflows/renovate-pr-deploy.yml

@@ -0,0 +1,172 @@
+name: Renovate Image Tag Deployment
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+    paths:
+      - "**/docker-compose.yml"
+
+env:
+  HC_VAULT_VERSION: "1.21.0"
+  VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+  VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+
+jobs:
+  deploy:
+    name: Renovate PR Deployment
+    if: |
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.user.login == 'renovate-bot'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout full repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0 # required so we can access main^1
+
+      - name: Save docker-compose.yml before merge (old)
+        run: |
+          git fetch origin main
+          if git ls-tree -r origin/main^1 --name-only | grep -q '^docker-compose.yml$'; then
+            git show origin/main^1:docker-compose.yml > docker-compose-old.yml
+          else
+            echo "services: {}" > docker-compose-old.yml
+          fi
+
+      - name: Save docker-compose.yml after merge (new)
+        run: |
+          git show origin/main:docker-compose.yml > docker-compose-new.yml
+
+      - name: Detect services with image tag/digest changes
+        id: detect_services
+        run: |
+          set -euo pipefail
+
+          echo "Flattening docker-compose files..."
+          yq eval '... comments=""' docker-compose-old.yml > docker-compose-old-flat.yml
+          yq eval '... comments=""' docker-compose-new.yml > docker-compose-new-flat.yml
+
+          echo "Getting service names..."
+          yq eval '.services | keys | .[]' docker-compose-old-flat.yml | sort > services_old.txt
+          yq eval '.services | keys | .[]' docker-compose-new-flat.yml | sort > services_new.txt
+
+          echo "Checking for image changes..."
+          : > service_changes.txt
+
+          comm -12 services_old.txt services_new.txt | while read service; do
+            old_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-old-flat.yml)
+            new_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-new-flat.yml)
+
+            if [ "$old_image" != "$new_image" ]; then
+              echo "$service" >> service_changes.txt
+            fi
+          done
+
+          echo "Detected services with changed images:"
+          cat service_changes.txt || echo "None"
+
+          changed_svcs=$(sort -u service_changes.txt | xargs || true)
+          if [ -z "$changed_svcs" ]; then
+            echo "No image tag/digest changes detected."
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Collecting direct dependencies..."
+          deps_list=""
+          for svc in $changed_svcs; do
+            deps=$(yq -r ".services[\"$svc\"].depends_on | keys | .[]" docker-compose-new-flat.yml 2>/dev/null || true)
+            if [ -n "$deps" ]; then
+              echo "$svc depends on:"
+              echo "$deps"
+              deps_list="$deps_list $deps"
+            fi
+          done
+
+          # Combine changed services and their dependencies, deduplicate
+          all_svcs=$( (echo "$changed_svcs"; echo "$deps_list") | tr ' ' '\n' | sort -u )
+
+          echo "Final service list (including direct dependencies):"
+          echo "$all_svcs"
+
+          # Prepare multiline output for GitHub Actions
+          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$all_svcs" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Stop if no image changes
+        if: steps.detect_services.outputs.docker_svc_list == ''
+        run: |
+          echo "No image tag/digest changes detected. Exiting."
+          exit 1
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
+
+      - name: Gotify Notification (Start)
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Rinoa"
+          notification_message: "Starting Docker Compose run..."
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Docker Compose Deployment
+        uses: hoverkraft-tech/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.1
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: |
+            ${{ steps.detect_services.outputs.docker_svc_list }}
+          up-flags: -d --remove-orphans
+          down-flags: --dry-run
+          services-log-level: debug
+
+      - name: Docker Compose Healthcheck
+        id: health
+        uses: jaracogmbh/docker-compose-health-check-action@973fbdccf7c8e396b652d3501984c8e530a9fa80 # v1.0.0
+        with:
+          max-retries: 30
+          retry-interval: 10
+          compose-file: "docker-compose.yml"
+          skip-exited: "true"
+          skip-no-healthcheck: "true"
+
+      - name: Gotify Notification (Finish)
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Rinoa"
+          notification_message: "Deployment completed successfully."

.gitea/workflows/renovate.yml

@@ -0,0 +1,65 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0/30 * * * *"
+  workflow_dispatch:
+
+env:
+  RENOVATE_VERSION: "41.168.6"
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Renovate Run
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: https://git.trez.wtf/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_BOT_TOKEN }}
+          LOG_LEVEL: ${{ vars.RENOVATE_LOG_LEVEL }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_REPOSITORIES: trez/rinoa-docker
+          RENOVATE_HOST_RULES: |
+            [
+              {
+                "description": "Docker Hub authentication",
+                "hostType": "docker",
+                "matchHost": "docker.io",
+                "username": "${{ secrets.DOCKERHUB_USER }}",
+                "password": "${{ secrets.DOCKERHUB_PASSWORD }}"
+              },
+              {
+                "description": "GitHub Container Registry (GHCR)",
+                "hostType": "docker",
+                "matchHost": "ghcr.io",
+                "username": "${{ secrets.GHCR_USER }}",
+                "password": "${{ secrets.GHCR_LOGIN_TOKEN }}"
+              },
+              {
+                "description": "Self-hosted Gitea Docker Registry",
+                "hostType": "docker",
+                "matchHost": "git.trez.wtf",
+                "username": "${{ secrets.BOT_GITEA_USER }}",
+                "password": "${{ secrets.BOT_GITEA_PASSWORD }}"
+              }
+            ]
+        run: |
+          docker run --rm \
+            -e RENOVATE_PLATFORM \
+            -e RENOVATE_ENDPOINT \
+            -e RENOVATE_TOKEN \
+            -e LOG_LEVEL \
+            -e RENOVATE_GITHUB_COM_TOKEN \
+            -e RENOVATE_CONFIG_FILE \
+            -e RENOVATE_REPOSITORIES \
+            -e RENOVATE_HOST_RULES \
+            --volumes-from ${{ env.JOB_CONTAINER_NAME }} \
+            -w ${GITHUB_WORKSPACE} \
+            renovate/renovate:${{ env.RENOVATE_VERSION }}-full

.gitea/workflows/vault-auto-unseal-flow.yml

@@ -1,28 +0,0 @@
-name: Auto-Unseal for Vault
-on:
-  schedule:
-    - cron: "30 2 * * *"
-jobs:
-  auto-unseal:
-    name: Unseal Vault
-    runs-on: ubuntu-latest
-    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
-      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      VAULT_SHARDS: |
-        ${{ secrets.VAULT_UNSEAL_SHARDS }}
-      VAULT_NAMESPACE: ""
-    steps:
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/vault/1.18.0/x64
-          key: vault-${{ runner.os }}-1.18.0
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
-      - name: Unseal Vault
-        run: |
-          for vault_shard in $(echo ${VAULT_SHARDS}); do
-            vault operator unseal -address=${VAULT_ADDR} -non-interactive "${vault_shard}"
-          done

.gitignore

@@ -1,4 +1,2 @@
 **/.cache_ggshield
-ansible/collections/ansible_collections/
-**/.env
-**/netbird_openid-configuration.json.j2
+**/.env

README.md

@@ -2,159 +2,196 @@
 
 
 
-| Service | Image |
-| --- | --- |
-| actual_server | docker.io/actualbudget/actual-server:latest |
-| adguard | adguard/adguardhome:latest |
-| apprise-api | lscr.io/linuxserver/apprise-api:latest |
-| archivebox | archivebox/archivebox:latest |
-| audiobookshelf | ghcr.io/advplyr/audiobookshelf:latest |
-| authelia | authelia/authelia:master |
-| authelia-pg | postgres:16-alpine |
-| bazarr | lscr.io/linuxserver/bazarr:latest |
-| beszel | henrygd/beszel:latest |
-| beszel-agent | henrygd/beszel-agent:latest |
-| bitwarden | vaultwarden/server:latest |
-| bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.98 |
-| browserless | ghcr.io/browserless/chromium:latest |
-| bytestash | ghcr.io/jordan-dalby/bytestash:latest |
-| castopod | castopod/castopod:latest |
-| cloudflareddns | ghcr.io/hotio/cloudflareddns:latest |
-| convertx | ghcr.io/c4illin/convertx |
-| cronicle | elestio/cronicle:latest |
-| crowdsec | crowdsecurity/crowdsec:latest |
-| crowdsec-dashboard | metabase/metabase |
-| cyber-chef | mpepping/cyberchef:latest |
-| czkawka | jlesage/czkawka |
-| dawarich-app | freikin/dawarich:latest |
-| dawarich-pg-db | postgis/postgis:17-3.5-alpine |
-| dawarich-sidekiq | freikin/dawarich:latest |
-| dead-man-hand | ghcr.io/bkupidura/dead-man-hand:latest |
-| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
-| dockflare | alplat/dockflare:stable |
-| duplicati | lscr.io/linuxserver/duplicati:latest |
-| excalidraw | excalidraw/excalidraw:latest |
-| explo | ghcr.io/lumepart/explo:latest |
-| fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main |
-| flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest |
-| freescout | tiredofit/freescout:latest |
-| ghost | ghost:latest |
-| gitea | gitea/gitea:1.23.1 |
-| gitea-db | postgres:14 |
-| gitea-runner | gitea/act_runner:latest |
-| gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0 |
-| gluetun | qmcgaw/gluetun:latest |
-| gotify | gotify/server |
-| graylog | graylog/graylog:6.1 |
-| graylog-datanode | graylog/graylog-datanode:6.1 |
-| guacamole | flcontainers/guacamole:latest |
-| homepage | ghcr.io/gethomepage/homepage:latest |
-| hugo | hugomods/hugo:exts-0.145.0 |
-| immich-server | ghcr.io/immich-app/immich-server:release |
-| immich-machine-learning | ghcr.io/immich-app/immich-machine-learning:release |
-| immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1 |
-| immich-public-proxy | alangrainger/immich-public-proxy:latest |
-| immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest |
-| influxdb2 | influxdb:2-alpine |
-| invidious | quay.io/invidious/invidious:latest |
-| invidious-sig-helper | quay.io/invidious/inv-sig-helper:latest |
-| invidious-db | docker.io/library/postgres:14 |
-| invoice-ninja | invoiceninja/invoiceninja-debian:5 |
-| invoice-ninja_proxy | nginx |
-| it-tools | ghcr.io/corentinth/it-tools:latest |
-| jellyfin | jellyfin/jellyfin |
-| jitsi-etherpad | etherpad/etherpad:1.8.6 |
-| jitsi-jibri | jitsi/jibri:stable |
-| jitsi-jicofo | jitsi/jicofo:stable |
-| jitsi-jigasi | jitsi/jigasi:stable |
-| jitsi-jvb | jitsi/jvb:stable |
-| jitsi-prosody | jitsi/prosody:stable |
-| jitsi-web | jitsi/web:stable |
-| joplin-db | postgres:17-alpine |
-| joplin | joplin/server:latest |
-| languagetool | elestio/languagetool:latest |
-| librechat-api | ghcr.io/danny-avila/librechat-dev:latest |
-| librechat-vectordb | ankane/pgvector:latest |
-| librechat-rag-api | ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest |
-| libretranslate | libretranslate/libretranslate |
-| lidarr | lscr.io/linuxserver/lidarr:latest |
-| lidify | thewicklowwolf/lidify:latest |
-| linkstack | linkstackorg/linkstack:latest |
-| lldap | lldap/lldap:stable |
-| loggifly | ghcr.io/clemcer/loggifly:latest |
-| maloja | krateng/maloja:latest |
-| manyfold | lscr.io/linuxserver/manyfold:latest |
-| mariadb | linuxserver/mariadb |
-| mastodon | lscr.io/linuxserver/mastodon:latest |
-| mastodon-pg-db | postgres:17-alpine |
-| maxun-backend | getmaxun/maxun-backend:latest |
-| maxun-frontend | getmaxun/maxun-frontend:latest |
-| maxun-pg-db | postgres:13-alpine |
-| meilisearch | getmeili/meilisearch:v1.12.3 |
-| minio | minio/minio:RELEASE.2025-04-22T22-12-26Z |
-| mixpost | inovector/mixpost:latest |
-| mongodb | bitnami/mongodb:7.0 |
-| multi-scrobbler | foxxmd/multi-scrobbler |
-| n8n | docker.n8n.io/n8nio/n8n |
-| navidrome | deluan/navidrome:latest |
-| netalertx | jokobsk/netalertx:latest |
-| nextcloud | nextcloud/all-in-one:latest |
-| ollama | ollama/ollama |
-| ombi | lscr.io/linuxserver/ombi:latest |
-| omni-tools | iib0011/omni-tools:latest |
-| omnipoly | kweg/omnipoly:latest |
-| paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest |
-| pgbackweb | eduardolat/pgbackweb:latest |
-| pgbackweb-db | postgres:16-alpine |
-| plantuml-server | plantuml/plantuml-server:jetty |
-| portainer | portainer/portainer-ce:alpine |
-| portnote-web | haedlessdev/portnote:latest |
-| portnote-agent | haedlessdev/portnote-agent:latest |
-| portnote-pg-db | postgres:17-alpine |
-| postal-smtp | ghcr.io/postalserver/postal:latest |
-| postal-web | ghcr.io/postalserver/postal:latest |
-| postal-worker | ghcr.io/postalserver/postal:latest |
-| prowlarr | lscr.io/linuxserver/prowlarr:latest |
-| qbittorrentvpn | ghcr.io/binhex/arch-qbittorrentvpn:latest |
-| radarec | thewicklowwolf/radarec:latest |
-| radarr | lscr.io/linuxserver/radarr:latest |
-| reactive-resume | amruthpillai/reactive-resume:latest |
-| reactive-resume-pg | postgres:16-alpine |
-| readarr | lscr.io/linuxserver/readarr:develop |
-| redis | redis:alpine |
-| redlib | quay.io/redlib/redlib:latest |
-| rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest |
-| romm | rommapp/romm:latest |
-| sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest |
-| sablier | sablierapp/sablier:latest |
-| scrutiny | ghcr.io/analogj/scrutiny:master-omnibus |
-| searxng | searxng/searxng:latest |
-| semaphore | semaphoreui/semaphore:v2.12.14 |
-| signoz-init-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |
-| signoz-zookeeper-1 | bitnami/zookeeper:3.7.1 |
-| signoz-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |
-| signoz-app | signoz/signoz:v0.86.2 |
-| signoz-otel-collector | signoz/signoz-otel-collector:v0.111.42 |
-| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.111.42 |
-| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.111.42 |
-| sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts |
-| sonarqube-pg-db | postgres:17-alpine |
-| sonarr | lscr.io/linuxserver/sonarr:latest |
-| sonashow | thewicklowwolf/sonashow:latest |
-| speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest |
-| stable-diffusion-download | git.trez.wtf/trez.one/stable-diffusion-download:v9.0.0 |
-| stable-diffusion-webui | git.trez.wtf/trez.one/stable-diffusion-ui:v9.0.1 |
-| stirling-pdf | docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest |
-| swag | lscr.io/linuxserver/swag:latest |
-| tandoor | vabene1111/recipes |
-| tandoor-pg | postgres:16-alpine |
-| unmanic | josh5/unmanic:latest |
-| uptimekuma | louislam/uptime-kuma:latest |
-| vault | hashicorp/vault:latest |
-| wallabag | wallabag/wallabag |
-| wallos | bellamy/wallos:latest |
-| watchtower | ghcr.io/containrrr/watchtower:latest |
-| web-check | lissy93/web-check |
-| whodb | clidey/whodb |
-| youtubedl | nbr23/youtube-dl-server:latest |
+| Service | Image | Description |
+| --- | --- | --- |
+| 13ft | ghcr.io/wasi-master/13ft:latest@sha256:563ce7794a7173250c25c9162495bf2f510dd714067d74363c9ab2bd0e5a994f | Web interface for blocking ads and paywalls |
+| actual_server | docker.io/actualbudget/actual-server:latest@sha256:8f72d73e68958566850325c1f9fe780a4477340979969bd6979649dc519723ab | Privacy-focused app for managing finances |
+| adguard | adguard/adguardhome:v0.107.69@sha256:8a4107ec812023842ccab9e04600c5d39d3be6b15e907c34a36339c184c8fccf | Ad-blocking/DNS |
+| apcupsd-cgi | bnhf/apcupsd-cgi:latest@sha256:e8733930739719aca608fd97aecfb0aa5f53aaf7681bf4bbccd49dbf67132bf8 | Web interface for apcupsd |
+| apprise-api | lscr.io/linuxserver/apprise-api:latest@sha256:21295ffabb1e93ac751662160aaa514c6d7f6acc8dfcbe956c9fb32384d51be6 | Multi-channel notification API |
+| archivebox | archivebox/archivebox:latest@sha256:fdf2936192aa1e909b0c3f286f60174efa24078555be4b6b90a07f2cef1d4909 | Open-source and self-hosted web archiving |
+| asciinema | ghcr.io/asciinema/asciinema-server:latest@sha256:fad89accd5cedb366cd9213ed90e02c4f3c069458771122a9065bc7ffb2e93e1 | Platform for hosting and sharing terminal session recordings |
+| asciinema-pg-db | postgres:14-alpine@sha256:cb54bb67c0fca8b439f18c1daadb315ad67de1faf8c387988c63080d15a54145 |  |
+| audiobookshelf | ghcr.io/advplyr/audiobookshelf:latest@sha256:6fbd7dc95d53c6e168ce69e760b87c334e3b9ba88bf7b8531ed5a116d5d6da03 | Podcasts, eBooks, & Audiobooks |
+| audiomuse-ai-flask | ghcr.io/neptunehub/audiomuse-ai:0.7.7-beta@sha256:8ed854bad65eab0807e9ac999346fb32745f22c7daada5bb7df54ded83c14e49 | Platform for hosting and sharing terminal session recordings |
+| audiomuse-ai-pg | postgres:15-alpine@sha256:64583b3cb4f2010277bdd9749456de78e5c36f8956466ba14b0b96922e510950 |  |
+| audiomuse-ai-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| audiomuse-ai-worker | ghcr.io/neptunehub/audiomuse-ai:0.7.7-beta@sha256:8ed854bad65eab0807e9ac999346fb32745f22c7daada5bb7df54ded83c14e49 |  |
+| authelia | authelia/authelia:master@sha256:e5de2a44aec4e3eb0c19d755e1bb3436e24f00c267d0b1a0725b211e02cdc9fe | Authentication/authorization server with MFA & SSO |
+| authelia-pg | postgres:16-alpine@sha256:029660641a0cfc575b14f336ba448fb8a75fd595d42e1fa316b9fb4378742297 |  |
+| authelia-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| backrest | garethgeorge/backrest:latest@sha256:1308397161321b3c5aeca8acc6bf26eccb990df385f2532d3ce0eaa8b483dedf | Data backup |
+| bazarr | lscr.io/linuxserver/bazarr:latest@sha256:a42fef2a5ffa1dca8714e12892ba0b8de5c6c513f1bcdb1ffe4143e715cffb45 | Subtitle automation for TV shows/movies |
+| beszel | henrygd/beszel:latest@sha256:37858df37c29cc532d9af103b90a4f2645bc7555f6a291ed3f15c9096a00731e | Lightweight server monitoring hub |
+| beszel-agent | henrygd/beszel-agent:latest@sha256:0598b9af65a48422f634d2f636b5f44a17397798e7c74cee6a8c5f4a1e78ef2c |  |
+| bitwarden | vaultwarden/server:latest@sha256:84fd8a47f58d79a1ad824c27be0a9492750c0fa5216b35c749863093bfa3c3d7 | Credential/Information Vault |
+| bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.158@sha256:44810dc5cf9c78135d20dfd60e0999e2db0dfc5fd56dc7e45e8844d1b57c54bd |  |
+| browserless | ghcr.io/browserless/chromium:latest@sha256:3c467f68e3b588b89faa6d27556a798121defc46509100386cd100248599fd3f |  |
+| bytestash | ghcr.io/jordan-dalby/bytestash:latest@sha256:9c17b5510ca45c976fe23b0d4705ad416aa58d4bf756a70e03ef1f08cf7801fd | Code Gists/Snippets |
+| changedetection | ghcr.io/dgtlmoon/changedetection.io@sha256:f67668a25429725de212becbdb5d8d783d715b4c99b94da7222a6035ba9f74f6 | Page change monitoring with alerts |
+| changedetection-chrome | dgtlmoon/sockpuppetbrowser:latest@sha256:9f2df6791a4cd9b2c3138cb62b5a8de7f27953cab84729fe09d28cbd341a8973 |  |
+| chrome | gcr.io/zenika-hub/alpine-chrome:123@sha256:e38563d4475a3d791e986500a2e4125c9afd13798067138881cf770b1f6f3980 |  |
+| clipcascade | sathvikrao/clipcascade:latest@sha256:0f7aadec03af6b22a157466ade3ed1730dfd3b390d2989e55c0180e1d12d736f | Online file converter |
+| cloudflareddns | ghcr.io/hotio/cloudflareddns:latest@sha256:b64687779bbe0dcd41f9854129ce8fa9d6c5f009e1992a79bed97c85fe253eaf |  |
+| convertx | ghcr.io/c4illin/convertx@sha256:53f2c04ebe63fdfb4d812ee66b78a5db9360c729f3defe3dcc864256ff91a7cb | Online file converter |
+| crowdsec | crowdsecurity/crowdsec:latest@sha256:4beb1633cf4f41bb6f9e64d065d151d3aa5e3aa7082d5c3061a243037db0d890 |  |
+| crowdsec-dashboard | metabase/metabase@sha256:b5ef4e436896b5c21a12fac18debe2b583d10dd34d2cb47d807e2da67d264224 | Real-time & crowdsourced protection against aggressive IPs |
+| cyber-chef | mpepping/cyberchef:latest@sha256:1772a04fd261f971da89cf6212147afe55a37b4a93421db928a78e01de3d65ea | Web app for encryption, encoding, compression, and data analysis |
+| czkawka | jlesage/czkawka@sha256:03109f40d1bc41ebe24c2fd3ee81429950338591bbb64c4cf39ec6160fee75a4 | Smart file management |
+| dagu | ghcr.io/dagu-org/dagu:alpine@sha256:29948c23d404d032022401ddadc17f1ab1564c3a2c073ed244958384340f97ec | Cron alternative with a web UI |
+| dawarich-app | freikin/dawarich:latest@sha256:7219a71e00f53168028796e17289c22ac734f61bd0457ab55f106dae039214a8 | Self-hosted alternative to Google Location History |
+| dawarich-pg-db | postgis/postgis:17-3.5-alpine@sha256:470d7569e6aa821a503eac1f1c3e9851582281db9c1b2fa239ddcc01624fa19a |  |
+| dawarich-sidekiq | freikin/dawarich:latest@sha256:7219a71e00f53168028796e17289c22ac734f61bd0457ab55f106dae039214a8 |  |
+| dawarich-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| dead-man-hand | ghcr.io/bkupidura/dead-man-hand:latest@sha256:31905f19678f60d55ecdfa63dad009c07e2055cb5db0c608c8cab5de4467050e |  |
+| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:3400c429c5f9e1b21d62130fb93b16e2e772d4fb7695bd52fc2b743800b9fe9e |  |
+| dockflare | alplat/dockflare:stable@sha256:d5d77c1caeb3a82467499371dd5e7c9ab7c2c03c527d4f1465062b755aa7c8ca | Cloudflare Tunnel controller |
+| dockpeek | ghcr.io/dockpeek/dockpeek:v1.7.1@sha256:f7113905cbf041ce1a71b0dc32f92710d3e55ae6625b4f7994abe8fa9f79a72b | Real-time port monitoring and discovery |
+| duplicati | lscr.io/linuxserver/duplicati:latest@sha256:8c9bf31dac0b40a30c0c9fae5496654e43a42ac34b9fe751432a5267f38e301f | Data backup |
+| excalidraw | excalidraw/excalidraw:latest@sha256:71b9c25d8bfb47c051015456ef9b64700d53934eeb0e691db5c6522bb265c362 | Virtual whiteboard for sketching hand-drawn like diagrams |
+| explo | ghcr.io/lumepart/explo:latest@sha256:4d8870ea033cb27e078772e60c4ca7b92f8c3ece062de8ceaec047e46e79f1df |  |
+| fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main@sha256:ed5353eb49d0dbd3e3e30aeb1b71d430a35aebe6823637dcd3dca7aa9b7fa3c3 | Open-source, self-hosted, personal/family electronic medical record aggregator |
+| flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest@sha256:06c76759d062c185d8ac0b48f302258645b8d99db86109a3d6dce3209d93de51 |  |
+| garage | dxflrs/garage:v2.1.0@sha256:4c9b34c113e61358466e83fd6e7d66e6d18657ede14b776eb78a93ee8da7cf6a |  |
+| garage-webui | khairul169/garage-webui:latest@sha256:17c793551873155065bf9a022dabcde874de808a1f26e648d4b82e168806439c | S3-compatible storage backend |
+| ghost | ghost:latest@sha256:2489eb1ef94f459d7c84f4d0fe4dc5a8ae42950339c1224f0e89d3bdbccf0cbc | Personal blog |
+| gitea | gitea/gitea:1.25.1@sha256:b3aee0f6fa4ff3271180a2388bb796be5cced8828685b968a310d70e881fcbb3 | Private Code Repo |
+| gitea-db | postgres:14@sha256:50abf1998eacf0a5926bc9f3d50b686f52959ff99acef7841e4ac39f3577b987 |  |
+| gitea-runner | gitea/act_runner:latest@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944 |  |
+| gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0@sha256:18dd43b470d9a470e27d5999dd7dcbb44423d5c4466ae56dd7c1722f23115673 |  |
+| gitignore-io | guog/gitignore.io:latest@sha256:27b0bc3e9eb81adaee39fb6f77169ea9cbef164bcab049d29bcab68d154013ad | .gitignore generator |
+| gluetun | qmcgaw/gluetun:latest@sha256:74eeabaec71a3cca40f4eb9d02a9137945a4a3c1da697fc4a92088e625ba784c |  |
+| gotify | gotify/server@sha256:2ae0e4e689f183137c8247884382fcb174d5a72253ce1897e7e5267090093fc8 | Notification System |
+| guacamole | flcontainers/guacamole:latest@sha256:81a420f386ef8cbb4697208e13ea90f6a10a54619981241bed672e4a41b5f77f | Client-less remote desktop gateway |
+| homepage | ghcr.io/gethomepage/homepage:latest@sha256:e7fc26f914cf5e7dcd6c566e24ca218addb879aa76478ad4a553b1f9ae48b1d7 |  |
+| hugo | hugomods/hugo:exts@sha256:86b9a9ee8915be9cd5e9b555082352ab502daebf12c0bdae0a513f5340586496 | Static site |
+| immich-server | ghcr.io/immich-app/immich-server:release@sha256:4504d794123c3f5410cc45bbc61e4d7dbcacec1e1b0cd2e599691430c94e5849 | High performance self-hosted photo and video management solution |
+| immich-machine-learning | ghcr.io/immich-app/immich-machine-learning:release@sha256:bf339cbb44af6c2ef25d9128e1da51b2bec0cfd524846a83e3017c21bd71ddb4 |  |
+| immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1@sha256:9172feae86a211bc502db4ec2d3309a57329060b031d91796d39f45d1d698ef3 |  |
+| immich-public-proxy | alangrainger/immich-public-proxy:latest@sha256:9b0bfb05897fffdcec83ebb8a06b8e962a023d54ba2fa6ca7031d1d179849cbe | Immich Proxy for public sharing |
+| immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest@sha256:2abdc8a73cd7438006e16f7a9b50f51ca6806332f8855404375e8bbdd5b024f7 |  |
+| immich-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| influxdb2 | influxdb:2-alpine@sha256:b4dbe25bb8f8be38f9cf5a12cbca453318a1ad3475954e9d37c38f6e5bc5006b | Scalable datastore for metrics, events, and real-time analytics |
+| invidious | quay.io/invidious/invidious:latest@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06 | Alternative YouTube frontend (privacy-focused, ad-blocking) |
+| invidious-companion | quay.io/invidious/invidious-companion:latest@sha256:4f589b8eedf3c2d49de4a256ee018d7e4ff54fcce683f9005a31dbb7d1bf870f |  |
+| invidious-db | docker.io/library/postgres:14@sha256:962ffbe9f6418387643411b127c1db27465e5a23b9a8849bfaf45fa6323963ce |  |
+| it-tools | ghcr.io/corentinth/it-tools:latest@sha256:8b8128748339583ca951af03dfe02a9a4d7363f61a216226fc28030731a5a61f | Useful tools for developers and people working in IT |
+| jellyfin | jellyfin/jellyfin@sha256:d43a8878689311f841a1967f899f54db56877bf6b426fd7ff870ac1a6fd1dce4 | Movie/TV Streaming |
+| jitsi-etherpad | etherpad/etherpad:1.9.7@sha256:d1d6a772dd49e2d920fda874cdae2d4a43f24ba5713a1e330b6342fbab3eb5ec |  |
+| jitsi-jibri | jitsi/jibri:stable |  |
+| jitsi-jicofo | jitsi/jicofo:stable |  |
+| jitsi-jigasi | jitsi/jigasi:stable |  |
+| jitsi-jvb | jitsi/jvb:stable |  |
+| jitsi-prosody | jitsi/prosody:stable |  |
+| jitsi-web | jitsi/web:stable | Web Conferencing |
+| joplin-db | postgres:17-alpine@sha256:ef257d85f76e48da1c64832459b59fcaba1a4dac97bf5d7450c77753542eee94 |  |
+| joplin | joplin/server:latest@sha256:95b67dc6a4e77a974ac2bcc86818cbbfe5495e7b62d06a66f848a877878dce53 | Open-source note taking & to-do |
+| karakeep | ghcr.io/karakeep-app/karakeep:release@sha256:abd7d6b11b1b8fa3593d1971f886a74850ba8d6a99291218b150207d5a60378e | Self-hosted bookmark-everything app with a touch of AI for data hoarders |
+| languagetool | elestio/languagetool:latest@sha256:85a32bdef9e7d87125977a201bfe7aa4310e67cab8abfa370157a9fc67cda4cd |  |
+| libretranslate | libretranslate/libretranslate@sha256:c057e7fb60731a768406e6630909ce6fb5127b594109966b3b2fd90f9eccdac1 | Open-source machine translation API |
+| lidarr | lscr.io/linuxserver/lidarr:latest@sha256:1d49ebdfaae525d9e1e4ad5b7fa1753e364da44ac1b5e6acae241a2173ac09a4 | Music Automation |
+| lidify | thewicklowwolf/lidify:latest@sha256:958eaddeef8195470b974ee03512d9a5c31ad2af3167f7824448fb026fa9c94a | Music Discovery a la Last.fm, Spotify, Pandora, etc. |
+| linkstack | linkstackorg/linkstack:latest@sha256:abd691b4293b020a317de8794737671e0315159efcb868e8a4124d6f0611f7ae | Personal profile |
+| lldap | lldap/lldap:stable@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d | LDAP made easy |
+| loggifly | ghcr.io/clemcer/loggifly:latest@sha256:6faa4d4964994a9213494f879b58085acc04cafa2927cadfde98657676dfd199 |  |
+| maloja | krateng/maloja:latest@sha256:4ecea26058d2ca5168a8d53820279942d28f0606664cea6425f42371d5d88f95 | Simple self-hosted music scrobble database to create personal listening statistics |
+| manyfold | lscr.io/linuxserver/manyfold:latest@sha256:ad4e5f03c811c37eb740f1748c44a8a2a935d8c55f3adf72aaa7b71e8c9e5ccb | Self-hosted digital asset manager for 3D print files |
+| manyfold-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| mariadb | linuxserver/mariadb@sha256:195b6be2d3e2dd0744a54ba2542a136c572b3375bc7f019e37a505da5da3022b |  |
+| mastodon | lscr.io/linuxserver/mastodon:latest@sha256:99d16a9b2982e3f9cd3406a142e9b5f1293bd81dec27d0e37fbccaaf526f2b4e | Open-source social network |
+| mastodon-pg-db | postgres:17-alpine@sha256:ef257d85f76e48da1c64832459b59fcaba1a4dac97bf5d7450c77753542eee94 |  |
+| mastodon-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| maxun-backend | getmaxun/maxun-backend:latest@sha256:d9c5f3036d2bccde7387cd3ab06f6cb9f23fb9f8094a9bf83eb194683724430e |  |
+| maxun-frontend | getmaxun/maxun-frontend:latest@sha256:fd6f977affa245a2b7d93ffada7c9a5d36657b1948d2374914d6a71e0df63dd6 | No-code web data extraction platform |
+| maxun-pg-db | postgres:17-alpine@sha256:ef257d85f76e48da1c64832459b59fcaba1a4dac97bf5d7450c77753542eee94 |  |
+| maxun-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| meilisearch | getmeili/meilisearch:v1.24@sha256:d991eb07331e9d1f9cec7bc0f9523fd5d51aee3b223d997e0e66206361952056 |  |
+| meme-search-pro | ghcr.io/neonwatty/meme_search_pro:latest@sha256:bf3c20a6a0407ffa594d3e2fe8611073c0499659c90f44a28decd5e701e9e1f6 | Meme search engine built with Python and Ruby |
+| meme-search-pro-img2txt-gen | ghcr.io/neonwatty/image_to_text_generator:latest@sha256:e8445afab38e2eae1fcb95101dd26cf66708ef72127b291cab748050b4700cb8 |  |
+| meme-search-db | pgvector/pgvector:pg17@sha256:9ae02a756ba16a2d69dd78058e25915e36e189bb36ddf01ceae86390d7ed786a |  |
+| mini-qr | ghcr.io/lyqht/mini-qr:latest@sha256:babe90594f88cb3e8463a7622b1aac46defff7ef5c8d991299c5df4ca8514f66 | Scan and generate customized QR codes easily |
+| minio | minio/minio:RELEASE.2025-04-22T22-12-26Z@sha256:a1ea29fa28355559ef137d71fc570e508a214ec84ff8083e39bc5428980b015e | S3-compatible storage backend |
+| mixpost | inovector/mixpost:latest@sha256:088a0eed84289e9a408294acea969c1eebf80dff803d165629fe20c3442b0f8c | Multi-channel social media manager |
+| mixpost-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| mgob | stefanprodan/mgob@sha256:d089c6d105d7d0f9db5222786cb93d85b1bf61e28b21ad717cea90f92570c8f3 | Headless Automated MongoDB Backups |
+| mongodb | mongo:7@sha256:a814f930db8c4514f5fe5dc3e489f58637fb7ee32a7b9bb0b7064d3274e90b8e |  |
+| mongodb-exporter | percona/mongodb_exporter:0.47.1@sha256:8ba5d6e25fe7e30912f10b01a9e16e14c6c3af05f36dcaed0659690d70dc1670 |  |
+| multi-scrobbler | foxxmd/multi-scrobbler@sha256:e1e4832256f5fca895dc3e2f377abfb1476230eb6b30da97fbc32840f21d1e7f | JS App for scrobbling/recording play history from/to multiple sources |
+| n8n | docker.n8n.io/n8nio/n8n@sha256:cf74d4ebe7dca858c390ee317b9a4f554ea57f0444b2d760f6d69e4f18d5d312 | Extendable workflow automation tool to easily automate tasks |
+| navidrome | deluan/navidrome:latest@sha256:2ae037d464de9f802d047165a13b1c9dc2bdbb14920a317ae4aef1233adc0a3c | Music Streaming |
+| netalertx | jokobsk/netalertx:latest@sha256:9304e29cd71bf9ddc9f33d6a7ddb3d71bab71815e077ab330f86bcc081598a79 | Network Monitoring |
+| nextcloud | nextcloud/all-in-one:latest@sha256:090f59bbef2c6753b2ac58163d3bece84b15af19d9d83d02c33da83080cb6400 | Private Cloud |
+| nocodb | nocodb/nocodb:latest@sha256:8fd57018accf775fb5390392910e4b0ef6bb154f17c5732b478eb76c40ee8d1e | Turn any SQL-based database into a smart spreadsheet |
+| nocodb-pg-db | postgres:16-alpine@sha256:029660641a0cfc575b14f336ba448fb8a75fd595d42e1fa316b9fb4378742297 |  |
+| nocodb-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| ollama | ollama/ollama:latest@sha256:889ae74bdb4aa541044574d3e5e5dedde3c682c8b7918b6792aa031e7dfc8f06 |  |
+| ombi | lscr.io/linuxserver/ombi:latest@sha256:701c9801649b2245335b9a99f1dd05d34d1718f1f52bfc021483d1712c83d915 | Media Requests |
+| omnitools | iib0011/omni-tools:latest@sha256:66027051e7fcf25ca898f3ddddb1e7a7a6682fea4985ca4b96444a7b9d5a984c | Tools for common tasks |
+| omnipoly | kweg/omnipoly:latest@sha256:fa133d5ac6534ee45e393fab85ad61098a0826351724996e0d29ba61033dde7d | Open-source language translation with LanguageTool, LibreTranslate, & Ollama |
+| open-webui | ghcr.io/open-webui/open-webui:main@sha256:d6ab9bce3030f5b58e59144a7db9fe3012b39c94d27bc2979e98e6d6dc2161da | User-friendly and extensible AI interface |
+| open-webui-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest@sha256:7ec0797af256194f6e117d1b7ed3ef91ad31b4a14bf3092abdee6bb74f6b3656 | Document indexer & archiver with OCR |
+| paperless-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| pgbackweb | eduardolat/pgbackweb:latest@sha256:56358e7adff53250ec0b43cf2764e723e45872fa2b92b9608fdddfeebaafbed7 | Backups for PostgreSQL |
+| pgbackweb-db | postgres:17-alpine@sha256:ef257d85f76e48da1c64832459b59fcaba1a4dac97bf5d7450c77753542eee94 |  |
+| planka | ghcr.io/plankanban/planka:2.0.0-rc.3@sha256:5a2a69ec7159a2f9c6679c31698e4b5b17ccf254d5bfc6e9be43e411b6de0c3d | Kanban board |
+| planka-pg-db | postgres:16-alpine@sha256:029660641a0cfc575b14f336ba448fb8a75fd595d42e1fa316b9fb4378742297 |  |
+| plant-it | msdeluise/plant-it-server:latest@sha256:23ddf8660087d6b9f5dbdca2ca09817b84db45cb2d9d6e2e0176e70f514629e7 | 🪴 Self-hosted, open source gardening companion app |
+| plant-it-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| plantuml-server | plantuml/plantuml-server:jetty@sha256:d672e1faf68d9f455d162502bf69edde5d8b0fbe25cf2d01ded9611156dab3ef | Textual diagram generator for UML & other visualizations. |
+| portainer | portainer/portainer-ce:alpine@sha256:adcb33ce6a1debd31918a215ebfd08bca84259b907466d93cea63bd538d20f02 | Service delivery platform for containerized applications |
+| portchecker-web | ghcr.io/dsgnr/portcheckerio-web:latest@sha256:8bea203e8785541c0acac7860de9f70849b05806e0c6db1d83dfc1b8407a6077 | Service delivery platform for containerized applications |
+| portchecker-api | ghcr.io/dsgnr/portcheckerio-api:latest@sha256:7783796d791c3e10aedba9d5f7fc2b934bb0e7afa75bc89054b70b886ed39e5c |  |
+| postal-smtp | ghcr.io/postalserver/postal:latest@sha256:ff9a42deeda9b236ac36df012dab843b14726da8f3c2464c18c371f23107d986 |  |
+| postal-web | ghcr.io/postalserver/postal:latest@sha256:ff9a42deeda9b236ac36df012dab843b14726da8f3c2464c18c371f23107d986 | OSS Mail delivery platform |
+| postal-worker | ghcr.io/postalserver/postal:latest@sha256:ff9a42deeda9b236ac36df012dab843b14726da8f3c2464c18c371f23107d986 |  |
+| protonmail-bridge | shenxn/protonmail-bridge@sha256:3717b4441130675dc9131196de9f9c5287d2ea21b138d83b0486429e1737638a |  |
+| prowlarr | lscr.io/linuxserver/prowlarr:latest@sha256:643220338204525524db787ff38a607261597f49d1f550694acdb3e908e2b43e | Index aggregator |
+| qbit-manage | ghcr.io/stuffanthings/qbit_manage:latest@sha256:64f749b97604d607747fc8b790821cf0317d8107385ea111afe1ed1c9d1d5b11 |  |
+| qbittorrentvpn | ghcr.io/binhex/arch-qbittorrentvpn:latest@sha256:e6556875ffa483ff603c0ed76c0c10122efad1edee2d9f5e4a94244accd5b3a3 | Fast and stable torrent client |
+| radarec | thewicklowwolf/radarec:latest@sha256:df726f35e3a1ef2f0cd482a6cf993bac8782804efd38ee8004c8694f7e8f526e | Movie discovery based on library/tastes |
+| radarr | lscr.io/linuxserver/radarr:latest@sha256:c984533510abe0219a70e80d15bd0d212b7df21baa0913759c4ce6cc9092240b | Movie Automation |
+| reactive-resume | amruthpillai/reactive-resume:latest@sha256:f1b27f567b2a1b57fb6b2a81f7b9cec0af577b6be945820c1599a0a8b6b91f8b | Open-source resume builder |
+| reactive-resume-pg | postgres:16-alpine@sha256:029660641a0cfc575b14f336ba448fb8a75fd595d42e1fa316b9fb4378742297 |  |
+| readarr | lscr.io/linuxserver/readarr:develop@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb | eBook/Audiobook Automation |
+| redlib | quay.io/redlib/redlib:latest@sha256:25dbb5466ebd22e58277d4aa54897899b044f02f7219ca3054784aecc0be34e1 | Redlib is a private front-end like Invidious but for Reddit |
+| rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest | Fully customizable communications platform with high standards of data protection |
+| romm | rommapp/romm:latest@sha256:1895c339b3c7ca62d52f809f5e4c747d78fc8291ea5ee88b3b57df84acf33449 | Beautiful, powerful, self-hosted ROM manager |
+| romm-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest@sha256:411ed4ba589529960690c08de64fb2791c76d37d9a4278a99d30d7d32fc701f5 | NZB Downloader over VPN |
+| sablier | sablierapp/sablier:latest@sha256:4d4096b59a6e1496bd3106c1a90a7fdd161aafb73d58539b8c749c69380dedae |  |
+| scraparr | ghcr.io/thecfu/scraparr:2@sha256:cfe07f005aa6e93221dd0bb540600aaa51ea1215968595806863f9df3dc3b26c |  |
+| scrutiny | ghcr.io/analogj/scrutiny:master-omnibus@sha256:e5638d8580adba40f7c03464cde8420866188b9e48cddb9fc3866ec3243163d5 | WebUI for smartd S.M.A.R.T monitoring |
+| searxng | searxng/searxng:latest@sha256:e479206b72bc16054000c06d04574bc93f4abe1adbaa6432037bd806c0acabed | Anonymized Meta-Search Engine |
+| searxng-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| semaphore-ui | semaphoreui/semaphore:v2.16.37@sha256:8785cb97da895b3770c4c197fe42717b71ac226e47df6dea9373934ae6ecde37 | Modern UI for Ansible, Terraform, OpenTofu, PowerShell and other DevOps tools |
+| signoz-app | signoz/signoz:v0.96.1@sha256:e2cded000c87adb0366c9ae4f292e034515458552d151879195071ba4f078b4e | Logs, metrics, and traces in a single pane |
+| signoz-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
+| signoz-init-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
+| signoz-logspout | pavanputhra/logspout-signoz@sha256:6da8ce12279a5262de8b2d5c083ce82d4c878c4eab702b4d328afe147ed7553b |  |
+| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.8@sha256:1beda534e337767597c3fdc83fcca8593a98b6db89bc34032e8fec7c58b7c900 |  |
+| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.8@sha256:eb20e69025373e0d9749d3a88e34d74654ea4c03be694eebdb5b76a6cbeadfdc |  |
+| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.8@sha256:eb20e69025373e0d9749d3a88e34d74654ea4c03be694eebdb5b76a6cbeadfdc |  |
+| signoz-zookeeper-1 | signoz/zookeeper:3.7.1@sha256:fcc4a3288154ccaa3bdb5ae6dc10180c084d29a8a6a26b62ac8e30a8940dc2e6 |  |
+| sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts@sha256:70b055c294a2a751357ee65d5d55139c93f87faed436d0075034da38b2edafa1 | Code/DevOps quality/security |
+| sonarqube-pg-db | postgres:17-alpine@sha256:ef257d85f76e48da1c64832459b59fcaba1a4dac97bf5d7450c77753542eee94 |  |
+| sonarr | lscr.io/linuxserver/sonarr:latest@sha256:4b8a853b76337cd5de5f69961e23b7d0792ce7bf0a8be083dd7202ef670bfc34 | TV Show Automation |
+| sonashow | thewicklowwolf/sonashow:latest@sha256:4b40df407bf31577668bfb3191e007ac78c349d81bfde7463ec8433d417ebd3d | TV show discovery based on library/tastes |
+| soularr | mrusse08/soularr:latest@sha256:71a0b9e5a522d76bb0ffdb6d720d681fde22417b3a5acc9ecae61c89d05d8afc |  |
+| soularr-dashboard | ghcr.io/mrusse/soularr:main@sha256:61181c5809845d2c49c8c3c182c0280c5c91069cd2e5d7c341ddd8bfa2c01598 | Dashboard for monitoring Soularr |
+| soulseek | slskd/slskd@sha256:239ccb871fa1a624aa8ad4f11a712b4ec6c7a2ff570bf5800abae2cf91030834 | Modern client-server application for the Soulseek file-sharing network. |
+| speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest@sha256:689627263cf0e38d50d5b9067e926ecbe90049753ab2aeab48bebcef2d2d9b63 | Self-hosted internet performance tracking |
+| stable-diffusion-webui | ghcr.io/neggles/sd-webui-docker:latest@sha256:1795fe796e1dad0d8d3baa9ef7c38a255b69c0878b76869feecc617bfd015e53 |  |
+| stirling-pdf | docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest@sha256:bfe2b8dd378c4f3d5fc1d2fc7649a357d0916b3a713022aa70ac3f08d6302cbc | PDF Operations |
+| swag | lscr.io/linuxserver/swag:latest@sha256:fab0cdf1f5be08e6d9c4f24a9cd321bd0a60a3e09d5ca991cf761561eaf467c6 | SWAG Dashboard for proxies |
+| tandoor | vabene1111/recipes@sha256:af6bd76e703d644748a93d581da05c25159d742b94b2da9eddadaaec93555858 | Recipes, cookbooks, meal-planning, & grocery lists |
+| tandoor-pg | postgres:16-alpine@sha256:029660641a0cfc575b14f336ba448fb8a75fd595d42e1fa316b9fb4378742297 |  |
+| unmanic | josh5/unmanic:latest@sha256:80a76023a5d32a4afefb4cf0bd1712674b46174283216b5b1760b3f8135fc56d | Library Optimizer |
+| uptimekuma | louislam/uptime-kuma:latest@sha256:431fee3be822b04861cf0e35daf4beef6b7cb37391c5f26c3ad6e12ce280fe18 | HTTP Endpoint Monitoring |
+| vault | hashicorp/vault:latest@sha256:62dd55c9ccbdc0af0a9269e87481a64650258907434d5ddb5e795e2eb2ac5780 | HashiCorp Vault for secrets, key/value stores, etc. |
+| wallos | bellamy/wallos:latest@sha256:1277c83dc626853ac14658c1b0aaf003e1bced213c37370d149fdd9622b5747f | Subscription Tracking |
+| web-check | lissy93/web-check@sha256:f2d1dc726958c1d79ac459cac84eb26eb4f203a4d27447f336695a8c1884f1e3 | Site scanner for attack vectors, architecture, security configs, and more |
+| whodb | clidey/whodb@sha256:9bdd46c7d37c2cf6aa57a689749eb28acd5ea6b63519c58d59cb25a1ee8f57ae | Lightweight next-gen database explorer |
+| wizarr | ghcr.io/wizarrrr/wizarr@sha256:f2eabe36fcbdb4e8c50fc98b4fe9aa1a00dfcd4411d3ea3f10cf619cf3d83341 | User invitation management system for Jellyfin, Plex, and Emby |
+| youtubedl | nbr23/youtube-dl-server:latest@sha256:a5274ded39024da2fe8c3116747e9b906a867ffea8307a6cd4220215f1dfefed | YouTube Downloader |
 

ansible/.gitignore

@@ -1,167 +0,0 @@
-.logs/*
-*.retry
-*.vault
-# https://raw.githubusercontent.com/github/gitignore/main/Python.gitignore
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-.cache_ggshield
-# Ansible Vault Password Files
-*.pass
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py,cover
-.hypothesis/
-.pytest_cache/
-cover/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-.pybuilder/
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# IPython
-profile_default/
-ipython_config.py
-
-# pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-# .python-version
-
-# pipenv
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
-#   However, in case of collaboration, if having platform-specific dependencies or dependencies
-#   having no cross-platform support, pipenv may install dependencies that don't work, or not
-#   install all needed dependencies.
-#Pipfile.lock
-
-# poetry
-#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-#poetry.lock
-
-# pdm
-#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#pdm.lock
-#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
-#   in version control.
-#   https://pdm.fming.dev/#use-with-ide
-.pdm.toml
-
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
-__pypackages__/
-
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/
-.dmypy.json
-dmypy.json
-
-# Pyre type checker
-.pyre/
-
-# pytype static type analyzer
-.pytype/
-
-# Cython debug symbols
-cython_debug/
-
-# PyCharm
-#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
-#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
-#  and can be added to the global gitignore or merged into this file.  For a more nuclear
-#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/

ansible/README.md

@@ -1,45 +0,0 @@
-# Rinoa Docker_configs Ansible Project
-
-## Included content/ Directory Structure
-
-The directory structure follows best practices recommended by the Ansible community. Feel free to customize this template according to your specific project requirements.
-
-```
- ansible-project/
- |── .devcontainer/
- |    └── docker/
- |        └── devcontainer.json
- |    └── podman/
- |        └── devcontainer.json
- |    └── devcontainer.json
- |── .github/
- |    └── workflows/
- |        └── tests.yml
- |    └── ansible-code-bot.yml
- |── .vscode/
- |    └── extensions.json
- |── collections/
- |   └── requirements.yml
- |   └── ansible_collections/
- |       └── project_org/
- |           └── project_repo/
- |               └── README.md
- |               └── roles/sample_role/
- |                         └── README.md
- |                         └── tasks/main.yml
- |── inventory/
- |   └── groups_vars/
- |   └── host_vars/
- |   └── hosts.yml
- |── ansible-navigator.yml
- |── ansible.cfg
- |── devfile.yaml
- |── linux_playbook.yml
- |── network_playbook.yml
- |── README.md
- |── site.yml
-```
-
-## Compatible with Ansible-lint
-
-Tested with ansible-lint >=24.2.0 releases and the current development version of ansible-core.

ansible/ansible.cfg

@@ -1,25 +0,0 @@
-[defaults]
-# Specify the inventory file
-inventory = inventory/hosts.yml
-
-collections_path = ./collections
-# Set the logging verbosity level
-verbosity = 2
-
-# Set the default user for SSH connections
-remote_user = charish
-
-# Define the default become method
-become_method = sudo
-
-host_key_checking = false
-
-[persistent_connection]
-# Controls how long the persistent connection will remain idle before it is destroyed
-connect_timeout=30
-
-# Controls the amount of time to wait for response from remote device before timing out persistent connection
-command_timeout=30
-
-[hashi_vault_collection]
-auth_method = token

ansible/app-configs/AdGuardHome.yaml.j2

@@ -1,199 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-http:
-  pprof:
-    port: 6060
-    enabled: false
-  address: 0.0.0.0:8008
-  session_ttl: 720h
-users:
-  - name: admin
-    password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['ADGUARD_BCRYPT'] }}
-auth_attempts: 5
-block_auth_min: 15
-http_proxy: ""
-language: ""
-theme: auto
-dns:
-  bind_hosts:
-    - 0.0.0.0
-  port: 53
-  anonymize_client_ip: false
-  ratelimit: 20
-  ratelimit_subnet_len_ipv4: 24
-  ratelimit_subnet_len_ipv6: 56
-  ratelimit_whitelist: []
-  refuse_any: true
-  upstream_dns:
-    - 94.140.14.14
-    - 94.140.15.15
-    - https://dns.adguard-dns.com/dns-query
-    - tls://dns.adguard-dns.com
-    - quic://dns.adguard-dns.com
-    - 1.1.1.1
-    - 1.0.0.1
-    - 1.1.1.2
-    - 1.0.0.2
-    - 185.228.168.9
-    - 185.228.169.9
-    - 76.76.2.3
-    - tls://getdnsapi.net
-    - 185.49.141.37
-    - tls://dot.seby.io
-  upstream_dns_file: ""
-  bootstrap_dns:
-    - 9.9.9.10
-    - 149.112.112.10
-    - 2620:fe::10
-    - 2620:fe::fe:10
-  fallback_dns: []
-  upstream_mode: load_balance
-  fastest_timeout: 1s
-  allowed_clients: []
-  disallowed_clients: []
-  blocked_hosts:
-    - version.bind
-    - id.server
-    - hostname.bind
-  trusted_proxies:
-    - 127.0.0.0/8
-    - ::1/128
-  cache_size: 4194304
-  cache_ttl_min: 0
-  cache_ttl_max: 0
-  cache_optimistic: false
-  bogus_nxdomain: []
-  aaaa_disabled: false
-  enable_dnssec: false
-  edns_client_subnet:
-    custom_ip: ""
-    enabled: false
-    use_custom: false
-  max_goroutines: 300
-  handle_ddr: true
-  ipset: []
-  ipset_file: ""
-  bootstrap_prefer_ipv6: false
-  upstream_timeout: 10s
-  private_networks: []
-  use_private_ptr_resolvers: false
-  local_ptr_upstreams: []
-  use_dns64: false
-  dns64_prefixes: []
-  serve_http3: false
-  use_http3_upstreams: false
-  serve_plain_dns: true
-  hostsfile_enabled: true
-  pending_requests:
-    enabled: true
-tls:
-  enabled: true
-  server_name: ""
-  force_https: false
-  port_https: 446
-  port_dns_over_tls: 853
-  port_dns_over_quic: 853
-  port_dnscrypt: 0
-  dnscrypt_config_file: ""
-  allow_unencrypted_doh: false
-  certificate_chain: ""
-  private_key: ""
-  certificate_path: /opt/adguardhome/certs/live/trez.wtf/priv-fullchain-bundle.pem
-  private_key_path: /opt/adguardhome/certs/live/trez.wtf/priv-fullchain-bundle.pem
-  strict_sni_check: false
-querylog:
-  dir_path: ""
-  ignored: []
-  interval: 2160h
-  size_memory: 1000
-  enabled: true
-  file_enabled: true
-statistics:
-  dir_path: ""
-  ignored: []
-  interval: 24h
-  enabled: true
-filters:
-  - enabled: true
-    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
-    name: AdGuard DNS filter
-    id: 1
-  - enabled: false
-    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
-    name: AdAway Default Blocklist
-    id: 2
-whitelist_filters: []
-user_rules: []
-dhcp:
-  enabled: false
-  interface_name: ""
-  local_domain_name: lan
-  dhcpv4:
-    gateway_ip: 192.168.1.1
-    subnet_mask: 255.255.255.0
-    range_start: 192.168.1.2
-    range_end: 192.168.1.240
-    lease_duration: 86400
-    icmp_timeout_msec: 1000
-    options: []
-  dhcpv6:
-    range_start: ""
-    lease_duration: 86400
-    ra_slaac_only: false
-    ra_allow_slaac: false
-filtering:
-  blocking_ipv4: ""
-  blocking_ipv6: ""
-  blocked_services:
-    schedule:
-      time_zone: America/New_York
-    ids: []
-  protection_disabled_until: null
-  safe_search:
-    enabled: false
-    bing: true
-    duckduckgo: true
-    ecosia: true
-    google: true
-    pixabay: true
-    yandex: true
-    youtube: true
-  blocking_mode: default
-  parental_block_host: family-block.dns.adguard.com
-  safebrowsing_block_host: standard-block.dns.adguard.com
-  rewrites: []
-  safe_fs_patterns:
-    - /opt/adguardhome/work/userfilters/*
-  safebrowsing_cache_size: 1048576
-  safesearch_cache_size: 1048576
-  parental_cache_size: 1048576
-  cache_time: 30
-  filters_update_interval: 24
-  blocked_response_ttl: 10
-  filtering_enabled: true
-  parental_enabled: false
-  safebrowsing_enabled: false
-  protection_enabled: true
-clients:
-  runtime_sources:
-    whois: true
-    arp: true
-    rdns: true
-    dhcp: true
-    hosts: true
-  persistent: []
-log:
-  enabled: true
-  file: ""
-  max_backups: 0
-  max_size: 100
-  max_age: 3
-  compress: false
-  local_time: false
-  verbose: false
-os:
-  group: ""
-  user: ""
-  rlimit_nofile: 0
-schema_version: 29

ansible/app-configs/adguardhome/AdGuardHome.yaml.j2

@@ -1,199 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-http:
-  pprof:
-    port: 6060
-    enabled: false
-  address: 0.0.0.0:8008
-  session_ttl: 720h
-users:
-  - name: admin
-    password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['ADGUARD_BCRYPT'] }}
-auth_attempts: 5
-block_auth_min: 15
-http_proxy: ""
-language: ""
-theme: auto
-dns:
-  bind_hosts:
-    - 0.0.0.0
-  port: 53
-  anonymize_client_ip: false
-  ratelimit: 20
-  ratelimit_subnet_len_ipv4: 24
-  ratelimit_subnet_len_ipv6: 56
-  ratelimit_whitelist: []
-  refuse_any: true
-  upstream_dns:
-    - 94.140.14.14
-    - 94.140.15.15
-    - https://dns.adguard-dns.com/dns-query
-    - tls://dns.adguard-dns.com
-    - quic://dns.adguard-dns.com
-    - 1.1.1.1
-    - 1.0.0.1
-    - 1.1.1.2
-    - 1.0.0.2
-    - 185.228.168.9
-    - 185.228.169.9
-    - 76.76.2.3
-    - tls://getdnsapi.net
-    - 185.49.141.37
-    - tls://dot.seby.io
-  upstream_dns_file: ""
-  bootstrap_dns:
-    - 9.9.9.10
-    - 149.112.112.10
-    - 2620:fe::10
-    - 2620:fe::fe:10
-  fallback_dns: []
-  upstream_mode: load_balance
-  fastest_timeout: 1s
-  allowed_clients: []
-  disallowed_clients: []
-  blocked_hosts:
-    - version.bind
-    - id.server
-    - hostname.bind
-  trusted_proxies:
-    - 127.0.0.0/8
-    - ::1/128
-  cache_size: 4194304
-  cache_ttl_min: 0
-  cache_ttl_max: 0
-  cache_optimistic: false
-  bogus_nxdomain: []
-  aaaa_disabled: false
-  enable_dnssec: false
-  edns_client_subnet:
-    custom_ip: ""
-    enabled: false
-    use_custom: false
-  max_goroutines: 300
-  handle_ddr: true
-  ipset: []
-  ipset_file: ""
-  bootstrap_prefer_ipv6: false
-  upstream_timeout: 10s
-  private_networks: []
-  use_private_ptr_resolvers: false
-  local_ptr_upstreams: []
-  use_dns64: false
-  dns64_prefixes: []
-  serve_http3: false
-  use_http3_upstreams: false
-  serve_plain_dns: true
-  hostsfile_enabled: true
-  pending_requests:
-    enabled: true
-tls:
-  enabled: true
-  server_name: ""
-  force_https: false
-  port_https: 446
-  port_dns_over_tls: 853
-  port_dns_over_quic: 853
-  port_dnscrypt: 0
-  dnscrypt_config_file: ""
-  allow_unencrypted_doh: false
-  certificate_chain: ""
-  private_key: ""
-  certificate_path: /opt/adguardhome/certs/live/trez.wtf/priv-fullchain-bundle.pem
-  private_key_path: /opt/adguardhome/certs/live/trez.wtf/priv-fullchain-bundle.pem
-  strict_sni_check: false
-querylog:
-  dir_path: ""
-  ignored: []
-  interval: 2160h
-  size_memory: 1000
-  enabled: true
-  file_enabled: true
-statistics:
-  dir_path: ""
-  ignored: []
-  interval: 24h
-  enabled: true
-filters:
-  - enabled: true
-    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
-    name: AdGuard DNS filter
-    id: 1
-  - enabled: false
-    url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
-    name: AdAway Default Blocklist
-    id: 2
-whitelist_filters: []
-user_rules: []
-dhcp:
-  enabled: false
-  interface_name: ""
-  local_domain_name: lan
-  dhcpv4:
-    gateway_ip: 192.168.1.1
-    subnet_mask: 255.255.255.0
-    range_start: 192.168.1.2
-    range_end: 192.168.1.240
-    lease_duration: 86400
-    icmp_timeout_msec: 1000
-    options: []
-  dhcpv6:
-    range_start: ""
-    lease_duration: 86400
-    ra_slaac_only: false
-    ra_allow_slaac: false
-filtering:
-  blocking_ipv4: ""
-  blocking_ipv6: ""
-  blocked_services:
-    schedule:
-      time_zone: America/New_York
-    ids: []
-  protection_disabled_until: null
-  safe_search:
-    enabled: false
-    bing: true
-    duckduckgo: true
-    ecosia: true
-    google: true
-    pixabay: true
-    yandex: true
-    youtube: true
-  blocking_mode: default
-  parental_block_host: family-block.dns.adguard.com
-  safebrowsing_block_host: standard-block.dns.adguard.com
-  rewrites: []
-  safe_fs_patterns:
-    - /opt/adguardhome/work/userfilters/*
-  safebrowsing_cache_size: 1048576
-  safesearch_cache_size: 1048576
-  parental_cache_size: 1048576
-  cache_time: 30
-  filters_update_interval: 24
-  blocked_response_ttl: 10
-  filtering_enabled: true
-  parental_enabled: false
-  safebrowsing_enabled: false
-  protection_enabled: true
-clients:
-  runtime_sources:
-    whois: true
-    arp: true
-    rdns: true
-    dhcp: true
-    hosts: true
-  persistent: []
-log:
-  enabled: true
-  file: ""
-  max_backups: 0
-  max_size: 100
-  max_age: 3
-  compress: false
-  local_time: false
-  verbose: false
-os:
-  group: ""
-  user: ""
-  rlimit_nofile: 0
-schema_version: 29

ansible/app-configs/apprise/apprise.yml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-urls:
-  - gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}
-  - mailto://{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}@trez.wtf25?smtp=postal-smtp&from=noreply@trez.wtf

ansible/app-configs/apprise_apprise.yml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-urls:
-  - gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}
-  - mailto://{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}@trez.wtf25?smtp=postal-smtp&from=noreply@trez.wtf

ansible/app-configs/authelia/configuration.yml.j2

@@ -1,172 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-# yaml-language-server: $schema=https://www.authelia.com/schemas/latest/json-schema/configuration.json
----
-theme: auto
-default_2fa_method: "totp"
-server:
-  address: '0.0.0.0:9091'
-  endpoints:
-    enable_pprof: false
-    enable_expvars: false
-  disable_healthcheck: false
-  tls:
-    key: ""
-    certificate: ""
-    client_certificates: []
-  headers:
-    csp_template: ""
-log:
-  level: debug
-telemetry:
-  metrics:
-    enabled: true
-    address: tcp://0.0.0.0:9959
-totp:
-  disable: false
-  issuer: authelia.com
-  algorithm: sha256
-  digits: 6
-  period: 30
-  skew: 1
-  secret_size: 32
-webauthn:
-  disable: false
-  timeout: 60s
-  display_name: Authelia
-  attestation_conveyance_preference: indirect
-  selection_criteria:
-    user_verification: preferred
-ntp:
-  address: "time.cloudflare.com:123"
-  version: 4
-  max_desync: 3s
-  disable_startup_check: false
-  disable_failure: false
-authentication_backend:
-  password_reset:
-    disable: false
-    custom_url: ""
-  ldap:
-    implementation: custom
-    address: ldap://lldap:3890
-    timeout: 5s
-    start_tls: false
-    base_dn: dc=trez,dc=wtf
-    additional_users_dn: ou=people
-    users_filter: "(&({username_attribute}={input})(objectClass=person))"
-    additional_groups_dn: ou=groups
-    groups_filter: "(member={dn})"
-    attributes:
-      username: uid
-      group_name: cn
-      mail: mail
-      display_name: displayName
-    user: uid=authelia,ou=people,dc=trez,dc=wtf
-    password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_AUTH_BIND_LDAP_PASSWORD'] }}'
-  refresh_interval: 5m
-identity_validation:
-  reset_password:
-    jwt_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_JWT_SECRET'] }}'
-password_policy:
-  standard:
-    enabled: true
-    min_length: 8
-    max_length: 0
-    require_uppercase: true
-    require_lowercase: true
-    require_number: true
-    require_special: false
-  zxcvbn:
-    enabled: false
-    min_score: 3
-access_control:
-  default_policy: deny
-  networks:
-    - name: 'internal'
-      networks:
-        - '172.17.0.0/16'
-        - '172.18.0.0/16'
-        - '192.168.1.0/24'
-  rules:
-    - domain_regex:
-      - '^trez.wtf$'
-      - ^www.trez.wtf$''
-      policy: bypass
-    - domain: '*.trez.wtf'
-      policy: bypass
-      networks:
-        - 'internal'
-    - domain: '*.trez.wtf'
-      policy: one_factor
-      subject:
-      - ['user:the.trezured.one']
-session:
-  name: authelia_session
-  secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_SESSION_SECRET'] }}'
-  expiration: 1h
-  inactivity: 5m
-  remember_me: 1M
-  cookies:
-    - domain: 'trez.wtf'
-      authelia_url: 'https://auth.trez.wtf'
-  redis:
-    host: redis
-    port: 6379
-storage:
-  encryption_key: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_ENCRYPTION_KEY'] }}'
-  postgres:
-    address: 'tcp://authelia-pg:5432'
-    database: authelia
-    username: authelia
-    password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_POSTGRES_PASSWORD'] }}'
-    timeout: '5s'
-regulation:
-  max_retries: 3
-  find_time: 2m
-  ban_time: 5m
-notifier:
-  disable_startup_check: true
-  smtp:
-    address: 'smtp://postal-smtp:25'
-    timeout: '5s'
-    username: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}'
-    password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}'
-    sender: "Authelia <noreply@trez.wtf>"
-    identifier: 'localhost'
-    subject: "[Authelia] {title}"
-    startup_check_address: 'test@authelia.com'
-    disable_require_tls: true
-    disable_starttls: true
-    disable_html_emails: false
-identity_providers:
-  oidc:
-    hmac_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_OIDC_HMAC_SECRET'] }}'
-    jwks:
-      - key: |
-          {{ lookup("community.hashi_vault.vault_kv2_get", "env", engine_mount_point="rinoa-docker", url=vault_addr, token=vault_token_cleaned)["secret"]["AUTHELIA_OIDC_JWKS_KEY"] | replace("\\n", "\n") | indent(10) }}
-    cors:
-      allowed_origins_from_client_redirect_uris: true
-      endpoints:
-        - 'userinfo'
-        - 'authorization'
-        - 'token'
-        - 'revocation'
-        - 'introspection'
-    clients:
-      - client_id: 'netbird'
-        client_name: 'NetBird'
-        client_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}'
-        public: false
-        authorization_policy: 'two_factor'
-        redirect_uris:
-          - 'https://vpn.trez.wtf/peers'
-          - 'https://vpn.trez.wtf/add-peers'
-          - 'http://localhost'
-        scopes:
-          - 'openid'
-          - 'email'
-          - 'profile'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'

ansible/app-configs/authelia_configuration.yml.j2

@@ -1,172 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-# yaml-language-server: $schema=https://www.authelia.com/schemas/latest/json-schema/configuration.json
----
-theme: auto
-default_2fa_method: "totp"
-server:
-  address: '0.0.0.0:9091'
-  endpoints:
-    enable_pprof: false
-    enable_expvars: false
-  disable_healthcheck: false
-  tls:
-    key: ""
-    certificate: ""
-    client_certificates: []
-  headers:
-    csp_template: ""
-log:
-  level: debug
-telemetry:
-  metrics:
-    enabled: true
-    address: tcp://0.0.0.0:9959
-totp:
-  disable: false
-  issuer: authelia.com
-  algorithm: sha256
-  digits: 6
-  period: 30
-  skew: 1
-  secret_size: 32
-webauthn:
-  disable: false
-  timeout: 60s
-  display_name: Authelia
-  attestation_conveyance_preference: indirect
-  selection_criteria:
-    user_verification: preferred
-ntp:
-  address: "time.cloudflare.com:123"
-  version: 4
-  max_desync: 3s
-  disable_startup_check: false
-  disable_failure: false
-authentication_backend:
-  password_reset:
-    disable: false
-    custom_url: ""
-  ldap:
-    implementation: custom
-    address: ldap://lldap:3890
-    timeout: 5s
-    start_tls: false
-    base_dn: dc=trez,dc=wtf
-    additional_users_dn: ou=people
-    users_filter: "(&({username_attribute}={input})(objectClass=person))"
-    additional_groups_dn: ou=groups
-    groups_filter: "(member={dn})"
-    attributes:
-      username: uid
-      group_name: cn
-      mail: mail
-      display_name: displayName
-    user: uid=authelia,ou=people,dc=trez,dc=wtf
-    password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_AUTH_BIND_LDAP_PASSWORD'] }}'
-  refresh_interval: 5m
-identity_validation:
-  reset_password:
-    jwt_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_JWT_SECRET'] }}'
-password_policy:
-  standard:
-    enabled: true
-    min_length: 8
-    max_length: 0
-    require_uppercase: true
-    require_lowercase: true
-    require_number: true
-    require_special: false
-  zxcvbn:
-    enabled: false
-    min_score: 3
-access_control:
-  default_policy: deny
-  networks:
-    - name: 'internal'
-      networks:
-        - '172.17.0.0/16'
-        - '172.18.0.0/16'
-        - '192.168.1.0/24'
-  rules:
-    - domain_regex:
-      - '^trez.wtf$'
-      - ^www.trez.wtf$''
-      policy: bypass
-    - domain: '*.trez.wtf'
-      policy: bypass
-      networks:
-        - 'internal'
-    - domain: '*.trez.wtf'
-      policy: one_factor
-      subject:
-      - ['user:the.trezured.one']
-session:
-  name: authelia_session
-  secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_SESSION_SECRET'] }}'
-  expiration: 1h
-  inactivity: 5m
-  remember_me: 1M
-  cookies:
-    - domain: 'trez.wtf'
-      authelia_url: 'https://auth.trez.wtf'
-  redis:
-    host: redis
-    port: 6379
-storage:
-  encryption_key: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_ENCRYPTION_KEY'] }}'
-  postgres:
-    address: 'tcp://authelia-pg:5432'
-    database: authelia
-    username: authelia
-    password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_STORAGE_POSTGRES_PASSWORD'] }}'
-    timeout: '5s'
-regulation:
-  max_retries: 3
-  find_time: 2m
-  ban_time: 5m
-notifier:
-  disable_startup_check: true
-  smtp:
-    address: 'smtp://postal-smtp:25'
-    timeout: '5s'
-    username: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}'
-    password: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}'
-    sender: "Authelia <noreply@trez.wtf>"
-    identifier: 'localhost'
-    subject: "[Authelia] {title}"
-    startup_check_address: 'test@authelia.com'
-    disable_require_tls: true
-    disable_starttls: true
-    disable_html_emails: false
-identity_providers:
-  oidc:
-    hmac_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_OIDC_HMAC_SECRET'] }}'
-    jwks:
-      - key: |
-          {{ lookup("community.hashi_vault.vault_kv2_get", "env", engine_mount_point="rinoa-docker", url=vault_addr, token=vault_token_cleaned)["secret"]["AUTHELIA_OIDC_JWKS_KEY"] | replace("\\n", "\n") | indent(10) }}
-    cors:
-      allowed_origins_from_client_redirect_uris: true
-      endpoints:
-        - 'userinfo'
-        - 'authorization'
-        - 'token'
-        - 'revocation'
-        - 'introspection'
-    clients:
-      - client_id: 'netbird'
-        client_name: 'NetBird'
-        client_secret: '{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}'
-        public: false
-        authorization_policy: 'two_factor'
-        redirect_uris:
-          - 'https://vpn.trez.wtf/peers'
-          - 'https://vpn.trez.wtf/add-peers'
-          - 'http://localhost'
-        scopes:
-          - 'openid'
-          - 'email'
-          - 'profile'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'

ansible/app-configs/cloudflared/config.yml.j2

@@ -1,16 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-tunnel: 52bdee6e-8ccb-47be-ba9e-f8010b905e41
-credentials-file: /etc/cloudflared/52bdee6e-8ccb-47be-ba9e-f8010b905e41.json
-warp-routing:
-  enabled: true
-
-ingress:
-  - hostname: git-ssh.trez.wtf
-    service: ssh://gitea:22
-  - hostname: gist-ssh.trez.wtf
-    service: ssh://gitea-opengist:2222
-  - hostname: ssh.trez.wtf
-    service: ssh://192.168.1.254:22
-  - service: http_status:404  # Default for unmatched requests

ansible/app-configs/cloudflared_config.yml.j2

@@ -1,16 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-tunnel: 52bdee6e-8ccb-47be-ba9e-f8010b905e41
-credentials-file: /etc/cloudflared/52bdee6e-8ccb-47be-ba9e-f8010b905e41.json
-warp-routing:
-  enabled: true
-
-ingress:
-  - hostname: git-ssh.trez.wtf
-    service: ssh://gitea:22
-  - hostname: gist-ssh.trez.wtf
-    service: ssh://gitea-opengist:2222
-  - hostname: ssh.trez.wtf
-    service: ssh://192.168.1.254:22
-  - service: http_status:404  # Default for unmatched requests

ansible/app-configs/crowdsec/acquis.yaml.j2

@@ -1,15 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
-source: journalctl
-journalctl_filter: 
-  - "--directory=/var/log/host/"
-labels:
-  type: syslog
----
-filenames:
-  - /var/log/swag/*
-labels:
-  type: nginx
----

ansible/app-configs/crowdsec/config.yaml.j2

@@ -1,49 +0,0 @@
-common:
-  daemonize: false
-  log_media: stdout
-  log_level: info
-  log_dir: /var/log/
-config_paths:
-  config_dir: /etc/crowdsec/
-  data_dir: /var/lib/crowdsec/data/
-  simulation_path: /etc/crowdsec/simulation.yaml
-  hub_dir: /etc/crowdsec/hub/
-  index_path: /etc/crowdsec/hub/.index.json
-  notification_dir: /etc/crowdsec/notifications/
-  plugin_dir: /usr/local/lib/crowdsec/plugins/
-crowdsec_service:
-  acquisition_path: /etc/crowdsec/acquis.yaml
-  acquisition_dir: /etc/crowdsec/acquis.d
-  parser_routines: 1
-plugin_config:
-  user: nobody
-  group: nobody
-cscli:
-  output: human
-db_config:
-  log_level: info
-  type: sqlite
-  db_path: /var/lib/crowdsec/data/crowdsec.db
-  flush:
-    max_items: 5000
-    max_age: 7d
-  use_wal: false
-api:
-  client:
-    insecure_skip_verify: false
-    credentials_path: /etc/crowdsec/local_api_credentials.yaml
-  server:
-    log_level: info
-    listen_uri: 0.0.0.0:8080
-    profiles_path: /etc/crowdsec/profiles.yaml
-    trusted_ips: # IP ranges, or IPs which can have admin API access
-      - 127.0.0.1
-      - ::1
-    online_client: # Central API credentials (to push signals and receive bad IPs)
-      credentials_path: /etc/crowdsec/online_api_credentials.yaml
-    enable: true
-prometheus:
-  enabled: true
-  level: full
-  listen_addr: 0.0.0.0
-  listen_port: 6060

ansible/app-configs/crowdsec/local-api-credentials.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-url: http://0.0.0.0:8080
-login: localhost
-password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_LOCAL_API_KEY'] }}

ansible/app-configs/crowdsec/online-api-credentials.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-url: https://api.crowdsec.net/
-login: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_ONLINE_PASSWORD'] }}
-password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_ONLINE_PASSWORD'] }}

ansible/app-configs/crowdsec/profiles.yaml.j2

@@ -1,17 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-name: default_ip_remediation
-#debug: true
-filters:
- - Alert.Remediation == true && Alert.GetScope() == "Ip"
-decisions:
- - type: ban
-   duration: 4h
-#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
-# notifications:
-#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
-#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
-#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
-#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
-on_success: break

ansible/app-configs/crowdsec_acquis.yaml.j2

@@ -1,15 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
-source: journalctl
-journalctl_filter: 
-  - "--directory=/var/log/host/"
-labels:
-  type: syslog
----
-filenames:
-  - /var/log/swag/*
-labels:
-  type: nginx
----

ansible/app-configs/crowdsec_config.yaml.j2

@@ -1,49 +0,0 @@
-common:
-  daemonize: false
-  log_media: stdout
-  log_level: info
-  log_dir: /var/log/
-config_paths:
-  config_dir: /etc/crowdsec/
-  data_dir: /var/lib/crowdsec/data/
-  simulation_path: /etc/crowdsec/simulation.yaml
-  hub_dir: /etc/crowdsec/hub/
-  index_path: /etc/crowdsec/hub/.index.json
-  notification_dir: /etc/crowdsec/notifications/
-  plugin_dir: /usr/local/lib/crowdsec/plugins/
-crowdsec_service:
-  acquisition_path: /etc/crowdsec/acquis.yaml
-  acquisition_dir: /etc/crowdsec/acquis.d
-  parser_routines: 1
-plugin_config:
-  user: nobody
-  group: nobody
-cscli:
-  output: human
-db_config:
-  log_level: info
-  type: sqlite
-  db_path: /var/lib/crowdsec/data/crowdsec.db
-  flush:
-    max_items: 5000
-    max_age: 7d
-  use_wal: false
-api:
-  client:
-    insecure_skip_verify: false
-    credentials_path: /etc/crowdsec/local_api_credentials.yaml
-  server:
-    log_level: info
-    listen_uri: 0.0.0.0:8080
-    profiles_path: /etc/crowdsec/profiles.yaml
-    trusted_ips: # IP ranges, or IPs which can have admin API access
-      - 127.0.0.1
-      - ::1
-    online_client: # Central API credentials (to push signals and receive bad IPs)
-      credentials_path: /etc/crowdsec/online_api_credentials.yaml
-    enable: true
-prometheus:
-  enabled: true
-  level: full
-  listen_addr: 0.0.0.0
-  listen_port: 6060

ansible/app-configs/crowdsec_local-api-credentials.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-url: http://0.0.0.0:8080
-login: localhost
-password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_LOCAL_API_KEY'] }}

ansible/app-configs/crowdsec_online-api-credentials.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-url: https://api.crowdsec.net/
-login: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_ONLINE_PASSWORD'] }}
-password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_ONLINE_PASSWORD'] }}

ansible/app-configs/crowdsec_profiles.yaml.j2

@@ -1,17 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-name: default_ip_remediation
-#debug: true
-filters:
- - Alert.Remediation == true && Alert.GetScope() == "Ip"
-decisions:
- - type: ban
-   duration: 4h
-#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
-# notifications:
-#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
-#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
-#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
-#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
-on_success: break

ansible/app-configs/ghost/ghost_config.production.json.j2

@@ -1,42 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-  "url": "blog.trez.wtf",
-  "database": {
-    "client": "mysql",
-    "connection": {
-      "host"     : "mariadb",
-      "port"     : 3306,
-      "user"     : "ghost",
-      "password" : "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GHOST_DB_PASSWORD'] }}",
-      "database" : "ghost_db"
-    }
-  },
-  "mail": {
-    "from": "'Ghost @ Rinoa' <noreply@trez.wtf>",
-    "transport": "SMTP",
-    "options": {
-      "host": "postal-smtp",
-      "port": 25,
-      "secure": false,
-      "auth": {
-        "user": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}",
-        "pass": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}"
-      }
-    }
-  },
-  "paths": {
-    "contentPath": "content/"
-  },
-  "privacy": {
-    "useGravatar": true
-  },
-  "logging": {
-    "level": "info",
-    "rotation": {
-      "enabled": true
-    },
-    "transports": ["file"]
-  }
-}

ansible/app-configs/ghost_config.production.json.j2

@@ -1,42 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-  "url": "blog.trez.wtf",
-  "database": {
-    "client": "mysql",
-    "connection": {
-      "host"     : "mariadb",
-      "port"     : 3306,
-      "user"     : "ghost",
-      "password" : "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GHOST_DB_PASSWORD'] }}",
-      "database" : "ghost_db"
-    }
-  },
-  "mail": {
-    "from": "'Ghost @ Rinoa' <noreply@trez.wtf>",
-    "transport": "SMTP",
-    "options": {
-      "host": "postal-smtp",
-      "port": 25,
-      "secure": false,
-      "auth": {
-        "user": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}",
-        "pass": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}"
-      }
-    }
-  },
-  "paths": {
-    "contentPath": "content/"
-  },
-  "privacy": {
-    "useGravatar": true
-  },
-  "logging": {
-    "level": "info",
-    "rotation": {
-      "enabled": true
-    },
-    "transports": ["file"]
-  }
-}

ansible/app-configs/gitea/act-runner/config.yaml.j2

@@ -1,101 +0,0 @@
-# Example configuration file, it's safe to copy this as the default config file without any modification.
-
-# You don't have to copy this file to your instance,
-# just run `./act_runner generate-config > config.yaml` to generate a config file.
-
-log:
-  # The level of logging, can be trace, debug, info, warn, error, fatal
-  level: info
-
-runner:
-  # Where to store the registration result.
-  file: .runner
-  # Execute how many tasks concurrently at the same time.
-  capacity: 3
-  # Extra environment variables to run jobs.
-#   envs:
-#     A_TEST_ENV_NAME_1: a_test_env_value_1
-#     A_TEST_ENV_NAME_2: a_test_env_value_2
-  # Extra environment variables to run jobs from a file.
-  # It will be ignored if it's empty or the file doesn't exist.
-#   env_file: .env
-  # The timeout for a job to be finished.
-  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
-  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
-  timeout: 3h
-  # The timeout for the runner to wait for running jobs to finish when shutting down.
-  # Any running jobs that haven't finished after this timeout will be cancelled.
-  shutdown_timeout: 0s
-  # Whether skip verifying the TLS certificate of the Gitea instance.
-  insecure: false
-  # The timeout for fetching the job from the Gitea instance.
-  fetch_timeout: 5s
-  # The interval for fetching the job from the Gitea instance.
-  fetch_interval: 2s
-  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
-  # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
-  # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
-  # If it's empty when registering, it will ask for inputting labels.
-  # If it's empty when execute `daemon`, will use labels in `.runner` file.
-  labels:
-    - "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
-    - "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
-    - "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
-
-cache:
-  # Enable cache server to use actions/cache.
-  enabled: true
-  # The directory to store the cache data.
-  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
-  dir: ""
-  # The host of the cache server.
-  # It's not for the address to listen, but the address to connect from job containers.
-  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
-  host: "192.168.1.254"
-  # The port of the cache server.
-  # 0 means to use a random available port.
-  port: 63604
-  # The external cache server URL. Valid only when enable is true.
-  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
-  # The URL should generally end with "/".
-  external_server: ""
-
-container:
-  # Specifies the network to which the container will connect.
-  # Could be host, bridge or the name of a custom network.
-  # If it's empty, act_runner will create a network automatically.
-  network: "compose_default"
-  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
-  privileged: false
-  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-  options:
-  # The parent directory of a job's working directory.
-  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
-  # If the path starts with '/', the '/' will be trimmed.
-  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
-  # If it's empty, /workspace will be used.
-  workdir_parent:
-  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
-  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
-  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
-  # valid_volumes:
-  #   - data
-  #   - /src/*.json
-  # If you want to allow any volume, please use the following configuration:
-  # valid_volumes:
-  #   - '**'
-  valid_volumes: []
-  # overrides the docker client host with the specified one.
-  # If it's empty, act_runner will find an available docker host automatically.
-  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
-  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
-  docker_host: ""
-  # Pull docker image(s) even if already present
-  force_pull: false
-  # Rebuild docker image(s) even if already present
-  force_rebuild: false
-
-host:
-  # The parent directory of a job's working directory.
-  # If it's empty, $HOME/.cache/act/ will be used.
-  workdir_parent:

ansible/app-configs/gitea/app.ini.j2

@@ -1,125 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-APP_NAME = Gitea: Git with a cup of tea
-RUN_MODE = prod
-RUN_USER = git
-WORK_PATH = /data/gitea
-
-[repository]
-ROOT = /data/git/repositories
-DEFAULT_PRIVATE = last
-EMABLE_PUSH_CREATE_USER = true
-
-[repository.local]
-LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
-
-[repository.upload]
-TEMP_PATH = /data/gitea/uploads
-
-[server]
-APP_DATA_PATH = /data/gitea
-DOMAIN = git.trez.wtf
-SSH_DOMAIN = git-ssh.trez.wtf
-HTTP_PORT = 3000
-ROOT_URL = https://git.trez.wtf/
-DISABLE_SSH = false
-SSH_PORT = 22
-SSH_LISTEN_PORT = 22
-LFS_START_SERVER = true
-LFS_JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_LFS_JWT_SECRET'] }}
-OFFLINE_MODE = true
-
-[database]
-PATH = /data/gitea/gitea.db
-DB_TYPE = postgres
-HOST = gitea-db:5432
-NAME = gitea
-USER = gitea
-PASSWD = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_PG_DB_PASSWORD'] }}
-LOG_SQL = false
-SCHEMA =
-SSL_MODE = disable
-
-[indexer]
-ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
-REPO_INDEXER_ENABLED = true
-REPO_INDEXER_PATH = indexers/repos.bleve
-MAX_FILE_SIZE = 1048576
-REPO_INDEXER_INCLUDE =
-REPO_INDEXER_EXCLUDE = resources/bin/**
-
-[session]
-PROVIDER_CONFIG = /data/gitea/sessions
-PROVIDER = file
-
-[picture]
-AVATAR_UPLOAD_PATH = /data/gitea/avatars
-REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
-
-[attachment]
-PATH = /data/gitea/attachments
-
-[log]
-MODE = console
-LEVEL = info
-ROOT_PATH = root
-
-[security]
-INSTALL_LOCK = true
-SECRET_KEY =
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
-INTERNAL_TOKEN = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_INTERNAL_TOKEN'] }}
-PASSWORD_HASH_ALGO = pbkdf2
-
-[service]
-DISABLE_REGISTRATION = false
-REQUIRE_SIGNIN_VIEW = false
-REGISTER_EMAIL_CONFIRM = true
-ENABLE_NOTIFY_MAIL = true
-ALLOW_ONLY_EXTERNAL_REGISTRATION = false
-ENABLE_CAPTCHA = true
-DEFAULT_KEEP_EMAIL_PRIVATE = true
-DEFAULT_ALLOW_CREATE_ORGANIZATION = false
-DEFAULT_ENABLE_TIMETRACKING = false
-NO_REPLY_ADDRESS = noreply@trez.wtf
-
-[lfs]
-PATH = /data/git/lfs
-
-[mailer]
-PASSWD = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}
-PROTOCOL = smtp
-ENABLED = true
-FROM = '"Gitea" <noreply@trez.wtf>'
-SMTP_PORT = 25
-USER = rinoa/postal-smtp
-SMTP_ADDR = postal-smtp
-IS_TLS_ENABLED = faLse
-
-[openid]
-ENABLE_OPENID_SIGNIN = true
-ENABLE_OPENID_SIGNUP = true
-
-[cron.update_checker]
-ENABLED = false
-
-[repository.pull-request]
-DEFAULT_MERGE_STYLE = merge
-
-[repository.signing]
-DEFAULT_TRUST_MODEL = committer
-
-[oauth2]
-JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_OAUTH2_JWT_SECRET'] }}
-
-[ui]
-THEMES =
-
-[actions]
-ENABLED = true
-
-[webhook]
-ALLOWED_HOST_LIST = private,104.21.1.234,172.67.152.146
-SKIP_TLS_VERIFY = true

ansible/app-configs/gitea/gitea-sonarqube-bot/config.yaml.j2

@@ -1,81 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-# Gitea related configuration. Necessary for adding/updating comments on repository pull requests
-gitea:
-  # Endpoint of your Gitea instance. Must be expandable by '/api/v1' to form the API base path as shown in Swagger UI.
-  url: https://git.trez.wtf
-
-  # Created access token for the user that shall be used as bot account.
-  # User needs "Read project" permissions with access to "Pull Requests"
-  token:
-    value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}"
-    # # or path to file containing the plain text secret
-    # file: /path/to/gitea/token
-
-  # If the sent webhook has a signature header, the bot validates the request payload. If the value does not match, the
-  # request will be ignored.
-  # The bot looks for `X-Gitea-Signature` header containing the sha256 hmac hash of the plain text secret. If the header
-  # exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be validated.
-  webhook:
-    secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_WEBHOOK_SECRET'] }}"
-    # # or path to file containing the plain text secret
-    # secretFile: /path/to/gitea/webhook/secret
-
-  # Pull Request status check settings.
-  statusCheck:
-    # Configure the label/name of the PR status check.
-    name: "gitea-sonarqube-bot"
-
-# SonarQube related configuration. Necessary for requesting data from the API and processing the webhook.
-sonarqube:
-  # Endpoint of your SonarQube instance. Must be expandable by '/api' to form the API base path.
-  url: https://sqube.trez.wtf
-
-  # Created access token for the user that shall be used as bot account.
-  # User needs "Browse on project" permissions
-  token:
-    value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_TOKEN'] }}"
-    # # or path to file containing the plain text secret
-    # file: /path/to/sonarqube/token
-
-  # If the sent webhook has a signature header, the bot validates the request payload. If the value does not match, the
-  # request will be ignored.
-  # The bot looks for `X-Sonar-Webhook-HMAC-SHA256` header containing the sha256 hmac hash of the plain text secret.
-  # If the header exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be
-  # validated.
-  webhook:
-    secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_WEBHOOK_SECRET'] }}"
-    # # or path to file containing the plain text secret
-    # secretFile: /path/to/sonarqube/webhook/secret
-
-  # Some useful metrics depend on the edition in use. There are various ones like code_smells, vulnerabilities, bugs, etc.
-  # By default, the bot will extract "bugs,vulnerabilities,code_smells"
-  # Setting this option you can extend that default list by your own metrics.
-  # additionalMetrics: []
-  # - "new_security_hotspots"
-
-# List of project mappings to take care of. Webhooks for other projects will be ignored.
-# At least one must be configured. Otherwise, all webhooks (no matter which source) because the bot cannot map on its own.
-projects:
-  - sonarqube:
-      key: rinoa-docker
-    # A repository specification contains the owner name and the repository name itself. The owner can be the name of a
-    # real account or an organization in which the repository is located.
-    gitea:
-      owner: Trez.One
-      name: rinoa-docker
-
-# Define pull request names from SonarScanner analysis. Default pattern matches the Jenkins Gitea plugin schema.
-namingPattern:
-  # Regular expression that MUST HAVE exactly ONE GROUP that matches the integer part of the PR.
-  # That integer part is identical to the pull request ID in Gitea.
-  regex: "^.*$"
-
-  # Valid Go format string. It MUST have one integer placeholder which will be replaced by the pull request ID.
-  # See: https://pkg.go.dev/fmt#hdr-Printing
-  template: "%s"
-
-  # Example for integer-only names
-  # # regex: "^(\\d+)$"
-  # # template: "%d"

ansible/app-configs/gitea_act-runner_config.yaml.j2

@@ -1,101 +0,0 @@
-# Example configuration file, it's safe to copy this as the default config file without any modification.
-
-# You don't have to copy this file to your instance,
-# just run `./act_runner generate-config > config.yaml` to generate a config file.
-
-log:
-  # The level of logging, can be trace, debug, info, warn, error, fatal
-  level: info
-
-runner:
-  # Where to store the registration result.
-  file: .runner
-  # Execute how many tasks concurrently at the same time.
-  capacity: 3
-  # Extra environment variables to run jobs.
-#   envs:
-#     A_TEST_ENV_NAME_1: a_test_env_value_1
-#     A_TEST_ENV_NAME_2: a_test_env_value_2
-  # Extra environment variables to run jobs from a file.
-  # It will be ignored if it's empty or the file doesn't exist.
-#   env_file: .env
-  # The timeout for a job to be finished.
-  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
-  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
-  timeout: 3h
-  # The timeout for the runner to wait for running jobs to finish when shutting down.
-  # Any running jobs that haven't finished after this timeout will be cancelled.
-  shutdown_timeout: 0s
-  # Whether skip verifying the TLS certificate of the Gitea instance.
-  insecure: false
-  # The timeout for fetching the job from the Gitea instance.
-  fetch_timeout: 5s
-  # The interval for fetching the job from the Gitea instance.
-  fetch_interval: 2s
-  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
-  # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
-  # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
-  # If it's empty when registering, it will ask for inputting labels.
-  # If it's empty when execute `daemon`, will use labels in `.runner` file.
-  labels:
-    - "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
-    - "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
-    - "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
-
-cache:
-  # Enable cache server to use actions/cache.
-  enabled: true
-  # The directory to store the cache data.
-  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
-  dir: ""
-  # The host of the cache server.
-  # It's not for the address to listen, but the address to connect from job containers.
-  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
-  host: "192.168.1.254"
-  # The port of the cache server.
-  # 0 means to use a random available port.
-  port: 63604
-  # The external cache server URL. Valid only when enable is true.
-  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
-  # The URL should generally end with "/".
-  external_server: ""
-
-container:
-  # Specifies the network to which the container will connect.
-  # Could be host, bridge or the name of a custom network.
-  # If it's empty, act_runner will create a network automatically.
-  network: "compose_default"
-  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
-  privileged: false
-  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-  options:
-  # The parent directory of a job's working directory.
-  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
-  # If the path starts with '/', the '/' will be trimmed.
-  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
-  # If it's empty, /workspace will be used.
-  workdir_parent:
-  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
-  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
-  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
-  # valid_volumes:
-  #   - data
-  #   - /src/*.json
-  # If you want to allow any volume, please use the following configuration:
-  # valid_volumes:
-  #   - '**'
-  valid_volumes: []
-  # overrides the docker client host with the specified one.
-  # If it's empty, act_runner will find an available docker host automatically.
-  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
-  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
-  docker_host: ""
-  # Pull docker image(s) even if already present
-  force_pull: false
-  # Rebuild docker image(s) even if already present
-  force_rebuild: false
-
-host:
-  # The parent directory of a job's working directory.
-  # If it's empty, $HOME/.cache/act/ will be used.
-  workdir_parent:

ansible/app-configs/gitea_app.ini.j2

@@ -1,125 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-APP_NAME = Gitea: Git with a cup of tea
-RUN_MODE = prod
-RUN_USER = git
-WORK_PATH = /data/gitea
-
-[repository]
-ROOT = /data/git/repositories
-DEFAULT_PRIVATE = last
-EMABLE_PUSH_CREATE_USER = true
-
-[repository.local]
-LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
-
-[repository.upload]
-TEMP_PATH = /data/gitea/uploads
-
-[server]
-APP_DATA_PATH = /data/gitea
-DOMAIN = git.trez.wtf
-SSH_DOMAIN = git-ssh.trez.wtf
-HTTP_PORT = 3000
-ROOT_URL = https://git.trez.wtf/
-DISABLE_SSH = false
-SSH_PORT = 22
-SSH_LISTEN_PORT = 22
-LFS_START_SERVER = true
-LFS_JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_LFS_JWT_SECRET'] }}
-OFFLINE_MODE = true
-
-[database]
-PATH = /data/gitea/gitea.db
-DB_TYPE = postgres
-HOST = gitea-db:5432
-NAME = gitea
-USER = gitea
-PASSWD = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_PG_DB_PASSWORD'] }}
-LOG_SQL = false
-SCHEMA =
-SSL_MODE = disable
-
-[indexer]
-ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
-REPO_INDEXER_ENABLED = true
-REPO_INDEXER_PATH = indexers/repos.bleve
-MAX_FILE_SIZE = 1048576
-REPO_INDEXER_INCLUDE =
-REPO_INDEXER_EXCLUDE = resources/bin/**
-
-[session]
-PROVIDER_CONFIG = /data/gitea/sessions
-PROVIDER = file
-
-[picture]
-AVATAR_UPLOAD_PATH = /data/gitea/avatars
-REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
-
-[attachment]
-PATH = /data/gitea/attachments
-
-[log]
-MODE = console
-LEVEL = info
-ROOT_PATH = root
-
-[security]
-INSTALL_LOCK = true
-SECRET_KEY =
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
-INTERNAL_TOKEN = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_INTERNAL_TOKEN'] }}
-PASSWORD_HASH_ALGO = pbkdf2
-
-[service]
-DISABLE_REGISTRATION = false
-REQUIRE_SIGNIN_VIEW = false
-REGISTER_EMAIL_CONFIRM = true
-ENABLE_NOTIFY_MAIL = true
-ALLOW_ONLY_EXTERNAL_REGISTRATION = false
-ENABLE_CAPTCHA = true
-DEFAULT_KEEP_EMAIL_PRIVATE = true
-DEFAULT_ALLOW_CREATE_ORGANIZATION = false
-DEFAULT_ENABLE_TIMETRACKING = false
-NO_REPLY_ADDRESS = noreply@trez.wtf
-
-[lfs]
-PATH = /data/git/lfs
-
-[mailer]
-PASSWD = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}
-PROTOCOL = smtp
-ENABLED = true
-FROM = '"Gitea" <noreply@trez.wtf>'
-SMTP_PORT = 25
-USER = rinoa/postal-smtp
-SMTP_ADDR = postal-smtp
-IS_TLS_ENABLED = faLse
-
-[openid]
-ENABLE_OPENID_SIGNIN = true
-ENABLE_OPENID_SIGNUP = true
-
-[cron.update_checker]
-ENABLED = false
-
-[repository.pull-request]
-DEFAULT_MERGE_STYLE = merge
-
-[repository.signing]
-DEFAULT_TRUST_MODEL = committer
-
-[oauth2]
-JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_OAUTH2_JWT_SECRET'] }}
-
-[ui]
-THEMES =
-
-[actions]
-ENABLED = true
-
-[webhook]
-ALLOWED_HOST_LIST = private,104.21.1.234,172.67.152.146
-SKIP_TLS_VERIFY = true

ansible/app-configs/gitea_gitea-sonarqube-bot_config.yaml.j2

@@ -1,81 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-# Gitea related configuration. Necessary for adding/updating comments on repository pull requests
-gitea:
-  # Endpoint of your Gitea instance. Must be expandable by '/api/v1' to form the API base path as shown in Swagger UI.
-  url: https://git.trez.wtf
-
-  # Created access token for the user that shall be used as bot account.
-  # User needs "Read project" permissions with access to "Pull Requests"
-  token:
-    value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}"
-    # # or path to file containing the plain text secret
-    # file: /path/to/gitea/token
-
-  # If the sent webhook has a signature header, the bot validates the request payload. If the value does not match, the
-  # request will be ignored.
-  # The bot looks for `X-Gitea-Signature` header containing the sha256 hmac hash of the plain text secret. If the header
-  # exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be validated.
-  webhook:
-    secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_WEBHOOK_SECRET'] }}"
-    # # or path to file containing the plain text secret
-    # secretFile: /path/to/gitea/webhook/secret
-
-  # Pull Request status check settings.
-  statusCheck:
-    # Configure the label/name of the PR status check.
-    name: "gitea-sonarqube-bot"
-
-# SonarQube related configuration. Necessary for requesting data from the API and processing the webhook.
-sonarqube:
-  # Endpoint of your SonarQube instance. Must be expandable by '/api' to form the API base path.
-  url: https://sqube.trez.wtf
-
-  # Created access token for the user that shall be used as bot account.
-  # User needs "Browse on project" permissions
-  token:
-    value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_TOKEN'] }}"
-    # # or path to file containing the plain text secret
-    # file: /path/to/sonarqube/token
-
-  # If the sent webhook has a signature header, the bot validates the request payload. If the value does not match, the
-  # request will be ignored.
-  # The bot looks for `X-Sonar-Webhook-HMAC-SHA256` header containing the sha256 hmac hash of the plain text secret.
-  # If the header exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be
-  # validated.
-  webhook:
-    secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_WEBHOOK_SECRET'] }}"
-    # # or path to file containing the plain text secret
-    # secretFile: /path/to/sonarqube/webhook/secret
-
-  # Some useful metrics depend on the edition in use. There are various ones like code_smells, vulnerabilities, bugs, etc.
-  # By default, the bot will extract "bugs,vulnerabilities,code_smells"
-  # Setting this option you can extend that default list by your own metrics.
-  # additionalMetrics: []
-  # - "new_security_hotspots"
-
-# List of project mappings to take care of. Webhooks for other projects will be ignored.
-# At least one must be configured. Otherwise, all webhooks (no matter which source) because the bot cannot map on its own.
-projects:
-  - sonarqube:
-      key: rinoa-docker
-    # A repository specification contains the owner name and the repository name itself. The owner can be the name of a
-    # real account or an organization in which the repository is located.
-    gitea:
-      owner: Trez.One
-      name: rinoa-docker
-
-# Define pull request names from SonarScanner analysis. Default pattern matches the Jenkins Gitea plugin schema.
-namingPattern:
-  # Regular expression that MUST HAVE exactly ONE GROUP that matches the integer part of the PR.
-  # That integer part is identical to the pull request ID in Gitea.
-  regex: "^.*$"
-
-  # Valid Go format string. It MUST have one integer placeholder which will be replaced by the pull request ID.
-  # See: https://pkg.go.dev/fmt#hdr-Printing
-  template: "%s"
-
-  # Example for integer-only names
-  # # regex: "^(\\d+)$"
-  # # template: "%d"

ansible/app-configs/grafana/alloy/alloy_config.alloy

@@ -1,404 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Agent globals
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-local.file "endpoints" {
-    // The endpoints file is used to define the endpoints, credentials and options
-    // for the Agent export to.
-    filename = "/etc/alloy/endpoints.json"
-}
-
-discovery.docker "rinoadocker" {
-        host = env("DOCKER_HOST")
-}
-
-tracing {
-    write_to = [otelcol.exporter.otlp.tempo.input]
-}
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Metrics
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-prometheus.remote_write "mimir" {
-  endpoint {
-    url = json_path(local.file.endpoints.content, ".metrics.url")[0]
-    basic_auth {
-        username = json_path(local.file.endpoints.content, ".metrics.basicAuth.username")[0]
-        password = json_path(local.file.endpoints.content, ".metrics.basicAuth.password")[0]
-    }
-  }
-}
-
-prometheus.scrape "prometheus" {
-        targets = [{
-                __address__ = "localhost:12345",
-        }]
-        forward_to = [prometheus.remote_write.mimir.receiver]
-        job_name   = "prometheus"
-}
-
-prometheus.exporter.unix "rinoa" {
-        procfs_path = "/host/proc"
-        sysfs_path  = "/host/sys"
-        rootfs_path = "/rootfs"
-}
-
-prometheus.scrape "rinoa" {
-        targets    = prometheus.exporter.unix.rinoa.targets
-        forward_to = [prometheus.remote_write.mimir.receiver]
-        job_name   = "rinoa_host"
-}
-
-prometheus.exporter.cadvisor "docker" {
-        docker_host      = env("DOCKER_HOST")
-        storage_duration = "5m"
-}
-
-prometheus.scrape "docker" {
-        targets    = prometheus.exporter.cadvisor.docker.targets
-        forward_to = [prometheus.remote_write.mimir.receiver]
-        job_name   = "docker_stats"
-}
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Logging
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-loki.write "loki" {
-        endpoint {
-                url = json_path(local.file.endpoints.content, ".logs.url")[0]
-                basic_auth {
-                        username = json_path(local.file.endpoints.content, ".logs.basicAuth.username")[0]
-                        password = json_path(local.file.endpoints.content, ".logs.basicAuth.password")[0]
-                }
-        }
-        external_labels = {}
-}
-
-loki.source.journal "hostjournal" {
-        forward_to = [loki.write.loki.receiver]
-        max_age = "24h"
-        path = "/rootfs/var/log/journal/"
-        labels = {
-                job = "host-journal",
-        }
-}
-
-local.file_match "system" {
-        path_targets = [{
-                __address__ = "localhost",
-                __path__    = "/rootfs/var/log/*log",
-                job         = "varlogs",
-        }]
-}
-
-loki.source.file "system" {
-        targets    = local.file_match.system.targets
-        forward_to = [loki.write.loki.receiver]
-}
-
-loki.source.docker "containers" {
-        host       = env("DOCKER_HOST")
-        targets    = discovery.docker.rinoadocker.targets
-        forward_to = [loki.write.loki.receiver]
-        labels     = {
-                job = "containerlogs",
-        }
-}
-
-loki.process "containers" {
-        forward_to = [loki.write.loki.receiver]
-        // stage.docker {}
-        stage.json {
-		expressions = {
-			attrs  = "",
-			output = "log",
-			stream = "stream",
-		}
-	}
-
-	stage.json {
-		expressions = {
-			tag = "",
-		}
-		source = "attrs"
-	}
-
-	stage.regex {
-		expression = "(?P<image_name>(?:[^|]*[^|])).(?P<container_name>(?:[^|]*[^|])).(?P<image_id>(?:[^|]*[^|])).(?P<container_id>(?:[^|]*[^|]))"
-		source     = "tag"
-	}
-
-	stage.timestamp {
-		source = "time"
-		format = "RFC3339Nano"
-	}
-
-	stage.labels {
-		values = {
-			container_id   = null,
-			container_name = null,
-			image_id       = null,
-			image_name     = null,
-			stream         = null,
-			tag            = null,
-		}
-	}
-
-	stage.output {
-		source = "output"
-	}
-}
-
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Traces
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-beyla.ebpf "rinoadocker" {
-    open_port = "80-65535"
-    routes {
-        unmatched = "heauristic"
-    }
-    output {
-        traces = [
-            otelcol.connector.servicegraph.tracemetrics.input,
-            otelcol.connector.spanmetrics.tracemetrics.input,
-            otelcol.processor.batch.default.input,
-            otelcol.connector.spanlogs.autologging.input,
-        ]
-    }
-}
-
-prometheus.scrape "beyla" { 
-    targets = beyla.ebpf.rinoadocker.targets
-    forward_to = [prometheus.remote_write.mimir.receiver]
-}
-
-otelcol.auth.headers "tempo" {
-    header {
-        key = "Authorization"
-        value = join(["Basic ", json_path(local.file.endpoints.content, ".traces.basicAuthToken")[0]], "")
-    }
-}
-
-otelcol.processor.batch "default" {
-    // Wait until we've received 16K of data.
-    send_batch_size = 16384
-    send_batch_max_size = 16384
-    // Or until 2 seconds have elapsed.
-    timeout = "2s"
-    // When the Agent has enough batched data, send it to the OpenTelemetry exporter named 'tempo'.
-    output {
-        traces = [otelcol.exporter.otlp.tempo.input]
-    }
-}
-
-otelcol.exporter.otlp "tempo" {
-    // Define the client for exporting.
-    client {
-        // Authentication block.
-        auth = otelcol.auth.headers.tempo.handler
-
-        // Send to the locally running Tempo instance, on port 4317 (OTLP gRPC).
-        endpoint = json_path(local.file.endpoints.content, ".traces.url")[0]
-
-        // Configure TLS settings for communicating with the endpoint.
-        tls {
-            // The connection is insecure.
-            insecure = json_path(local.file.endpoints.content, ".traces.tls.insecure")[0]
-            // Do not verify TLS certificates when connecting.
-            insecure_skip_verify = json_path(local.file.endpoints.content, ".traces.tls.insecureSkipVerify")[0]
-        }
-    }
-}
-
-otelcol.connector.spanlogs "autologging" {
-    // We only want to output a line for each root span (ie. every single trace), and not for every
-    // process or span (outputting a line for every span would be extremely verbose).
-    spans = false
-    roots = true
-    processes = false
-    // We want to ensure that the following three span attributes are included in the log line, if
-    // present.
-    span_attributes = [ "http.method", "http.target", "http.status_code" ]
-
-    // Overrides the default key in the log line to be `traceId`, which is then used by Grafana to
-    // identify the trace ID for correlation with the Tempo datasource.
-    overrides {
-        trace_id_key = "traceId"
-    }
-    // Send to the OpenTelemetry Loki exporter.
-    output {
-        logs = [otelcol.exporter.loki.autologging.input]
-    }
-}
-
-// Simply forwards the incoming OpenTelemetry log format out as a Loki log.
-// We need this stage to ensure we can then process the logline as a Loki object.
-otelcol.exporter.loki "autologging" {
-    forward_to = [loki.process.autologging.receiver]
-}
-
-// The Loki processor allows us to accept a correctly formatted Loki log and mutate it into
-// a set of fields for output.
-loki.process "autologging" {
-    // The JSON stage simply extracts the `body` (the actual logline) from the Loki log, ignoring
-    // all other fields.
-    stage.json {
-        expressions = { "body" = "" }
-    }
-    // The output stage takes the body (the main logline) and uses this as the source for the output
-    // logline. In this case, it essentially turns it into logfmt.
-    stage.output {
-        source = "body"
-    }
-
-    // Finally send the processed logline onto the Loki exporter.
-    forward_to = [loki.write.autologging.receiver]
-}
-
-// The Loki writer receives a processed Loki log and then writes it to a Loki instance.
-loki.write "autologging" {
-    // Add the `agent` value to the `job` label, so we can identify it as having been generated
-    // by Grafana Agent when querying.
-    external_labels = {
-        job = "agent",
-    }
-
-    // Output the Loki log to the local Loki instance.
-    endpoint {
-        url = json_path(local.file.endpoints.content, ".logs.url")[0]
-
-        // The basic auth credentials for the Loki instance.
-        basic_auth {
-            username = json_path(local.file.endpoints.content, ".logs.basicAuth.username")[0]
-            password = json_path(local.file.endpoints.content, ".logs.basicAuth.password")[0]
-        }
-    }
-}
-
-// The Tail Sampling processor will use a set of policies to determine which received traces to keep
-// and send to Tempo.
-otelcol.processor.tail_sampling "errors" {
-    // Total wait time from the start of a trace before making a sampling decision. Note that smaller time
-    // periods can potentially cause a decision to be made before the end of a trace has occurred.
-    decision_wait = "30s"
-
-    // The following policies follow a logical OR pattern, meaning that if any of the policies match,
-    // the trace will be kept. For logical AND, you can use the `and` policy. Every span of a trace is
-    // examined by each policy in turn. A match will cause a short-circuit.
-
-    // This policy defines that traces that contain errors should be kept.
-    policy {
-        // The name of the policy can be used for logging purposes.
-        name = "sample-erroring-traces"
-        // The type must match the type of policy to be used, in this case examing the status code
-        // of every span in the trace.
-        type = "status_code"
-        // This block determines the error codes that should match in order to keep the trace,
-        // in this case the OpenTelemetry 'ERROR' code.
-        status_code {
-            status_codes = [ "ERROR" ]
-        }
-    }
-
-    // This policy defines that only traces that are longer than 200ms in total should be kept.
-    policy {
-        // The name of the policy can be used for logging purposes.
-        name = "sample-long-traces"
-        // The type must match the policy to be used, in this case the total latency of the trace.
-        type = "latency"
-        // This block determines the total length of the trace in milliseconds.
-        latency {
-            threshold_ms = 200
-        }
-    }
-
-    // The output block forwards the kept traces onto the batch processor, which will marshall them
-    // for exporting to Tempo.
-    output {
-        traces = [otelcol.processor.batch.default.input]
-    }
-}
-
-// The Spanmetrics Connector will generate RED metrics based on the incoming trace span data.
-otelcol.connector.spanmetrics "tracemetrics" {
-    // The namespace explicit adds a prefix to all the generated span metrics names.
-    // In this case, we'll ensure they match as closely as possible those generated by Tempo.
-    namespace = "traces.spanmetrics"
-
-    // Each extra dimension (metrics label) to be added to the generated metrics from matching span attributes. These
-    // need to be defined with a name and optionally a default value (in the following cases, we do not want a default
-    // value if the span attribute is not present).
-    dimension {
-        name = "http.method"
-    }
-    dimension {
-        name = "http.target"
-    }
-    dimension {
-        name = "http.status_code"
-    }
-    dimension {
-        name = "service.version"
-    }
-
-    // A histogram block must be present, either explicitly defining bucket values or via an exponential block.
-    // We do the latter here.
-    histogram {
-        explicit {
-        }
-    }
-
-    // The exemplar block is added to ensure we generate exemplars for traces on relevant metric values.
-    exemplars {
-        enabled = true
-    }
-
-    // Generated metrics data is in OTLP format. We send this data to the OpenTelemetry Prometheus exporter to ensure
-    // it gets transformed into Prometheus format data.
-    output {
-        metrics = [otelcol.exporter.prometheus.tracemetrics.input]
-    }
-}
-
-// The Servicegraph Connector will generate service graph metrics (edges and nodes) based on incoming trace spans.
-otelcol.connector.servicegraph "tracemetrics" {
-    // Extra dimensions (metrics labels) to be added to the generated metrics from matching span attributes.
-    // For this component, this is defined as an array. There are no default values and the labels will not be generated
-    // for missing span attributes.
-    dimensions = [
-        "http.method",
-        "http.target",
-        "http.status_code",
-        "service.version",
-    ]
-
-    // Generated metrics data is in OTLP format. We send this data to the OpenTelemetry Prometheus exporter to ensure
-    // it gets transformed into Prometheus format data.
-    output {
-        metrics = [otelcol.exporter.prometheus.tracemetrics.input]
-    }
-}
-
-otelcol.exporter.prometheus "tracemetrics" {
-    // Forward to our local Prometheus remote writer which will send the metrics to Mimir.
-    forward_to = [prometheus.remote_write.mimir.receiver]
-}
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Profiling
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-
-pyroscope.write "pyroscope" {
-        endpoint {
-                url = json_path(local.file.endpoints.content, ".profiles.url")[0]
-                basic_auth {
-                        username = json_path(local.file.endpoints.content, ".profiles.basicAuth.username")[0]
-                        password = json_path(local.file.endpoints.content, ".profiles.basicAuth.password")[0]
-                }
-        }
-        external_labels = {}
-}
-
-pyroscope.ebpf "rinoadocker" {
-        forward_to = [pyroscope.write.pyroscope.receiver]
-        targets = discovery.docker.rinoadocker.targets
-}

ansible/app-configs/grafana/alloy/alloy_endpoints.json.j2

@@ -1,34 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-    "metrics": {
-        "url": "http://grafana-mimir:9009/api/v1/push",
-        "basicAuth": {
-            "username": "",
-            "password": ""
-        }
-    },
-    "logs": {
-        "url": "http://grafana-loki:3100/loki/api/v1/push",
-        "basicAuth": {
-            "username": "",
-            "password": ""
-        }
-    },
-    "traces": {
-        "url": "http://grafana-tempo:4317",
-        "basicAuthToken": "",
-        "tls": {
-            "insecure": true,
-            "insecureSkipVerify": true
-        }
-    },
-    "profiles": {
-        "url": "http://grafana-pyroscope:4040",
-        "basicAuth": {
-            "username": "",
-            "password": ""
-        }
-    }
-}

ansible/app-configs/grafana/beyla/beyla.yml.j2

@@ -1,7 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-routes:
-  patterns:
-    - /*
-  unmatched: heuristic

ansible/app-configs/grafana/mimir/mimir.yaml.j2

@@ -1,77 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-multitenancy_enabled: false
-no_auth_tenant: rinoa_mimir
-# target: query-frontend
-# api:
-#   prometheus_http_prefix: '/prometheus'
-server:
-  http_listen_port: 9009
-# frontend:
-#   split_queries_by_interval: 24h
-#   align_queries_with_step: true
-  # cache_results: true
-  # results_cache:
-  #   backend: "memcached"
-  #   memcached:
-  #     addresses: "memcached-mimir:11211"
-#   downstream_url: http://grafana-agent:12345
-
-common:
-  storage:
-    backend: s3
-    s3:
-      endpoint: minio:9000
-      access_key_id: "Q8KAihuXtGgmretKNh7C"
-      secret_access_key: "hOlRODtnvFlNlL26Bj3GizZG6Ys3rlpG8p6Vo3NX"
-      bucket_name: "mimir"
-      insecure: true
-
-blocks_storage:
-  storage_prefix: rinoa
-  tsdb:
-    dir: /tmp/mimir/tsdb
-
-memberlist:
-  tls_enabled: false
-
-compactor:
-  # Directory to temporarily store blocks underdoing compaction.
-  data_dir: /tmp/mimir/compactor
-  # The sharding ring type used to share the hashed ring for the compactor.
-  sharding_ring:
-    # Use memberlist backend store (the default).
-    kvstore:
-      store: memberlist
-
-# The distributor receives incoming metrics data for the system.
-distributor:
-  # The ring to share hash ring data across instances.
-  ring:
-    # The address advertised in the ring. Localhost.
-    instance_addr: 127.0.0.1
-    # Use memberlist backend store (the default).
-    kvstore:
-      store: memberlist
-
-# The ingester receives data from the distributor and processes it into indices and blocks.
-ingester:
-  # The ring to share hash ring data across instances.
-  ring:
-    # The address advertised in the ring. Localhost.
-    instance_addr: 127.0.0.1
-    # Use memberlist backend store (the default).
-    kvstore:
-      store: memberlist
-    # Only run one instance of the ingesters.
-    # Note: It is highly recommended to run more than one ingester in production, the default is an RF of 3.
-    replication_factor: 1
-
-# The store gateway block configures gateway storage.
-store_gateway:
-  # Configuration for the hash ring.
-  sharding_ring:
-    # Only run a single instance. In production setups, the replication factor must
-    # be set on the querier and ruler as well.
-    replication_factor: 1

ansible/app-configs/grafana/pyroscope/config.yaml.j2

@@ -1,12 +0,0 @@
-storage:
-  backend: s3
-  s3:
-    bucket_name: pyroscope
-    endpoint: minio:9000
-    region: us-east-fh-pln
-    access_key_id: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_PYROSCOPE_STORAGE_ACCESS_KEY'] }}
-    secret_access_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_PYROSCOPE_STORAGE_SECRET_KEY'] }}
-    insecure: true
-
-analytics:
-  reporting_enabled: false

ansible/app-configs/grafana/tempo/config.yml.j2

@@ -1,787 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-target: all
-http_api_prefix: ""
-autocomplete_filtering_enabled: true
-server:
-    http_listen_network: tcp
-    http_listen_address: ""
-    http_listen_port: 80
-    http_listen_conn_limit: 0
-    grpc_listen_network: tcp
-    grpc_listen_address: ""
-    grpc_listen_port: 9095
-    grpc_listen_conn_limit: 0
-    tls_cipher_suites: ""
-    tls_min_version: ""
-    http_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    grpc_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    register_instrumentation: true
-    report_grpc_codes_in_instrumentation_label_enabled: false
-    graceful_shutdown_timeout: 30s
-    http_server_read_timeout: 30s
-    http_server_read_header_timeout: 0s
-    http_server_write_timeout: 30s
-    http_server_idle_timeout: 2m0s
-    http_log_closed_connections_without_response_enabled: false
-    grpc_server_max_recv_msg_size: 16777216
-    grpc_server_max_send_msg_size: 16777216
-    grpc_server_max_concurrent_streams: 100
-    grpc_server_max_connection_idle: 2562047h47m16.854775807s
-    grpc_server_max_connection_age: 2562047h47m16.854775807s
-    grpc_server_max_connection_age_grace: 2562047h47m16.854775807s
-    grpc_server_keepalive_time: 2h0m0s
-    grpc_server_keepalive_timeout: 20s
-    grpc_server_min_time_between_pings: 10s
-    grpc_server_ping_without_stream_allowed: true
-    grpc_server_num_workers: 0
-    log_format: logfmt
-    log_level: info
-    log_source_ips_enabled: false
-    log_source_ips_header: ""
-    log_source_ips_regex: ""
-    log_request_headers: false
-    log_request_at_info_level_enabled: false
-    log_request_exclude_headers_list: ""
-    http_path_prefix: ""
-internal_server:
-    http_listen_network: tcp
-    http_listen_address: ""
-    http_listen_port: 3101
-    http_listen_conn_limit: 0
-    grpc_listen_network: ""
-    grpc_listen_address: ""
-    grpc_listen_port: 0
-    grpc_listen_conn_limit: 0
-    tls_cipher_suites: ""
-    tls_min_version: ""
-    http_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    grpc_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    register_instrumentation: false
-    report_grpc_codes_in_instrumentation_label_enabled: false
-    graceful_shutdown_timeout: 30s
-    http_server_read_timeout: 30s
-    http_server_read_header_timeout: 0s
-    http_server_write_timeout: 30s
-    http_server_idle_timeout: 2m0s
-    http_log_closed_connections_without_response_enabled: false
-    grpc_server_max_recv_msg_size: 0
-    grpc_server_max_send_msg_size: 0
-    grpc_server_max_concurrent_streams: 0
-    grpc_server_max_connection_idle: 0s
-    grpc_server_max_connection_age: 0s
-    grpc_server_max_connection_age_grace: 0s
-    grpc_server_keepalive_time: 0s
-    grpc_server_keepalive_timeout: 0s
-    grpc_server_min_time_between_pings: 0s
-    grpc_server_ping_without_stream_allowed: false
-    grpc_server_num_workers: 0
-    log_format: logfmt
-    log_level: info
-    log_source_ips_enabled: false
-    log_source_ips_header: ""
-    log_source_ips_regex: ""
-    log_request_headers: false
-    log_request_at_info_level_enabled: false
-    log_request_exclude_headers_list: ""
-    http_path_prefix: ""
-    enable: false
-distributor:
-    ring:
-        kvstore:
-            store: memberlist
-            prefix: collectors/
-            consul:
-                host: localhost:8500
-                acl_token: ""
-                http_client_timeout: 20s
-                consistent_reads: false
-                watch_rate_limit: 1
-                watch_burst_size: 1
-                cas_retry_delay: 1s
-            etcd:
-                endpoints: []
-                dial_timeout: 10s
-                max_retries: 10
-                tls_enabled: false
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: ""
-                username: ""
-                password: ""
-            multi:
-                primary: ""
-                secondary: ""
-                mirror_enabled: false
-                mirror_timeout: 2s
-        heartbeat_period: 5s
-        heartbeat_timeout: 5m0s
-        instance_id: local-instance
-        instance_interface_names:
-            - eth0
-            - en0
-        instance_port: 0
-        instance_addr: ""
-    receivers: {}
-    override_ring_key: distributor
-    forwarders: []
-    extend_writes: true
-    retry_after_on_resource_exhausted: 0s
-ingester_client:
-    pool_config:
-        checkinterval: 15s
-        healthcheckenabled: true
-        healthchecktimeout: 1s
-        maxconcurrenthealthchecks: 0
-    remote_timeout: 5s
-    grpc_client_config:
-        max_recv_msg_size: 104857600
-        max_send_msg_size: 104857600
-        grpc_compression: snappy
-        rate_limit: 0
-        rate_limit_burst: 0
-        backoff_on_ratelimits: false
-        backoff_config:
-            min_period: 100ms
-            max_period: 10s
-            max_retries: 10
-        initial_stream_window_size: 63KiB1023B
-        initial_connection_window_size: 63KiB1023B
-        tls_enabled: false
-        tls_cert_path: ""
-        tls_key_path: ""
-        tls_ca_path: ""
-        tls_server_name: ""
-        tls_insecure_skip_verify: false
-        tls_cipher_suites: ""
-        tls_min_version: ""
-        connect_timeout: 5s
-        connect_backoff_base_delay: 1s
-        connect_backoff_max_delay: 5s
-metrics_generator_client:
-    pool_config:
-        checkinterval: 15s
-        healthcheckenabled: true
-        healthchecktimeout: 1s
-        maxconcurrenthealthchecks: 0
-    remote_timeout: 5s
-    grpc_client_config:
-        max_recv_msg_size: 104857600
-        max_send_msg_size: 104857600
-        grpc_compression: snappy
-        rate_limit: 0
-        rate_limit_burst: 0
-        backoff_on_ratelimits: false
-        backoff_config:
-            min_period: 100ms
-            max_period: 10s
-            max_retries: 10
-        initial_stream_window_size: 63KiB1023B
-        initial_connection_window_size: 63KiB1023B
-        tls_enabled: false
-        tls_cert_path: ""
-        tls_key_path: ""
-        tls_ca_path: ""
-        tls_server_name: ""
-        tls_insecure_skip_verify: false
-        tls_cipher_suites: ""
-        tls_min_version: ""
-        connect_timeout: 5s
-        connect_backoff_base_delay: 1s
-        connect_backoff_max_delay: 5s
-querier:
-    search:
-        query_timeout: 30s
-        prefer_self: 10
-        external_hedge_requests_at: 8s
-        external_hedge_requests_up_to: 2
-        external_backend: ""
-        google_cloud_run: null
-        external_endpoints: []
-    trace_by_id:
-        query_timeout: 10s
-    max_concurrent_queries: 20
-    frontend_worker:
-        frontend_address: 127.0.0.1:9095
-        dns_lookup_duration: 10s
-        parallelism: 2
-        match_max_concurrent: true
-        id: ""
-        grpc_client_config:
-            max_recv_msg_size: 104857600
-            max_send_msg_size: 16777216
-            grpc_compression: gzip
-            rate_limit: 0
-            rate_limit_burst: 0
-            backoff_on_ratelimits: false
-            backoff_config:
-                min_period: 100ms
-                max_period: 1s
-                max_retries: 5
-            initial_stream_window_size: 0B
-            initial_connection_window_size: 0B
-            tls_enabled: false
-            tls_cert_path: ""
-            tls_key_path: ""
-            tls_ca_path: ""
-            tls_server_name: ""
-            tls_insecure_skip_verify: false
-            tls_cipher_suites: ""
-            tls_min_version: ""
-            connect_timeout: 0s
-            connect_backoff_base_delay: 0s
-            connect_backoff_max_delay: 0s
-    query_relevant_ingesters: false
-query_frontend:
-    max_outstanding_per_tenant: 2000
-    querier_forget_delay: 0s
-    max_batch_size: 5
-    max_retries: 2
-    search:
-        concurrent_jobs: 1000
-        target_bytes_per_job: 104857600
-        default_result_limit: 20
-        max_result_limit: 0
-        max_duration: 168h0m0s
-        query_backend_after: 15m0s
-        query_ingesters_until: 30m0s
-    trace_by_id:
-        query_shards: 50
-        hedge_requests_at: 2s
-        hedge_requests_up_to: 2
-    metrics:
-        concurrent_jobs: 1000
-        target_bytes_per_job: 104857600
-        max_duration: 0s
-        query_backend_after: 1h0m0s
-        interval: 5m0s
-    multi_tenant_queries_enabled: true
-compactor:
-    ring:
-        kvstore:
-            store: ""
-            prefix: collectors/
-            consul:
-                host: localhost:8500
-                acl_token: ""
-                http_client_timeout: 20s
-                consistent_reads: false
-                watch_rate_limit: 1
-                watch_burst_size: 1
-                cas_retry_delay: 1s
-            etcd:
-                endpoints: []
-                dial_timeout: 10s
-                max_retries: 10
-                tls_enabled: false
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: ""
-                username: ""
-                password: ""
-            multi:
-                primary: ""
-                secondary: ""
-                mirror_enabled: false
-                mirror_timeout: 2s
-        heartbeat_period: 5s
-        heartbeat_timeout: 1m0s
-        wait_stability_min_duration: 1m0s
-        wait_stability_max_duration: 5m0s
-        instance_id: local-instance
-        instance_interface_names:
-            - eth0
-            - en0
-        instance_port: 0
-        instance_addr: ""
-        enable_inet6: false
-        wait_active_instance_timeout: 10m0s
-    compaction:
-        v2_in_buffer_bytes: 5242880
-        v2_out_buffer_bytes: 20971520
-        v2_prefetch_traces_count: 1000
-        compaction_window: 1h0m0s
-        max_compaction_objects: 6000000
-        max_block_bytes: 107374182400
-        block_retention: 336h0m0s
-        compacted_block_retention: 1h0m0s
-        retention_concurrency: 10
-        max_time_per_tenant: 5m0s
-        compaction_cycle: 30s
-    override_ring_key: compactor
-ingester:
-    lifecycler:
-        ring:
-            kvstore:
-                store: inmemory
-                prefix: collectors/
-                consul:
-                    host: localhost:8500
-                    acl_token: ""
-                    http_client_timeout: 20s
-                    consistent_reads: false
-                    watch_rate_limit: 1
-                    watch_burst_size: 1
-                    cas_retry_delay: 1s
-                etcd:
-                    endpoints: []
-                    dial_timeout: 10s
-                    max_retries: 10
-                    tls_enabled: false
-                    tls_cert_path: ""
-                    tls_key_path: ""
-                    tls_ca_path: ""
-                    tls_server_name: ""
-                    tls_insecure_skip_verify: false
-                    tls_cipher_suites: ""
-                    tls_min_version: ""
-                    username: ""
-                    password: ""
-                multi:
-                    primary: ""
-                    secondary: ""
-                    mirror_enabled: false
-                    mirror_timeout: 2s
-            heartbeat_timeout: 5m0s
-            replication_factor: 1
-            zone_awareness_enabled: false
-            excluded_zones: ""
-        num_tokens: 128
-        heartbeat_period: 5s
-        heartbeat_timeout: 1m0s
-        observe_period: 0s
-        join_after: 0s
-        min_ready_duration: 15s
-        interface_names:
-            - en0
-            - bridge100
-        enable_inet6: false
-        final_sleep: 0s
-        tokens_file_path: ""
-        availability_zone: ""
-        unregister_on_shutdown: true
-        readiness_check_ring_health: true
-        address: 127.0.0.1
-        port: 0
-        id: local-instance
-    concurrent_flushes: 4
-    flush_check_period: 10s
-    flush_op_timeout: 5m0s
-    trace_idle_period: 10s
-    max_block_duration: 30m0s
-    max_block_bytes: 524288000
-    complete_block_timeout: 15m0s
-    override_ring_key: ring
-    flush_all_on_shutdown: false
-metrics_generator:
-    ring:
-        kvstore:
-            store: inmemory
-            prefix: collectors/
-            consul:
-                host: localhost:8500
-                acl_token: ""
-                http_client_timeout: 20s
-                consistent_reads: false
-                watch_rate_limit: 1
-                watch_burst_size: 1
-                cas_retry_delay: 1s
-            etcd:
-                endpoints: []
-                dial_timeout: 10s
-                max_retries: 10
-                tls_enabled: false
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: ""
-                username: ""
-                password: ""
-            multi:
-                primary: ""
-                secondary: ""
-                mirror_enabled: false
-                mirror_timeout: 2s
-        heartbeat_period: 5s
-        heartbeat_timeout: 1m0s
-        instance_id: local-instance
-        instance_interface_names:
-            - eth0
-            - en0
-        instance_addr: 127.0.0.1
-        instance_port: 0
-        enable_inet6: false
-    processor:
-        service_graphs:
-            wait: 10s
-            max_items: 10000
-            workers: 10
-            histogram_buckets:
-                - 0.1
-                - 0.2
-                - 0.4
-                - 0.8
-                - 1.6
-                - 3.2
-                - 6.4
-                - 12.8
-            dimensions: []
-            enable_client_server_prefix: false
-            peer_attributes:
-                - peer.service
-                - db.name
-                - db.system
-            span_multiplier_key: ""
-        span_metrics:
-            histogram_buckets:
-                - 0.002
-                - 0.004
-                - 0.008
-                - 0.016
-                - 0.032
-                - 0.064
-                - 0.128
-                - 0.256
-                - 0.512
-                - 1.024
-                - 2.048
-                - 4.096
-                - 8.192
-                - 16.384
-            intrinsic_dimensions:
-                service: true
-                span_name: true
-                span_kind: true
-                status_code: true
-            dimensions: []
-            dimension_mappings: []
-            enable_target_info: false
-            span_multiplier_key: ""
-            subprocessors:
-                0: true
-                1: true
-                2: true
-            filter_policies: []
-            target_info_excluded_dimensions: []
-        local_blocks:
-            block:
-                bloom_filter_false_positive: 0.01
-                bloom_filter_shard_size_bytes: 102400
-                version: vParquet3
-                search_encoding: snappy
-                search_page_size_bytes: 1048576
-                v2_index_downsample_bytes: 1048576
-                v2_index_page_size_bytes: 256000
-                v2_encoding: zstd
-                parquet_row_group_size_bytes: 100000000
-                parquet_dedicated_columns: []
-            search:
-                chunk_size_bytes: 1000000
-                prefetch_trace_count: 1000
-                read_buffer_count: 32
-                read_buffer_size_bytes: 1048576
-                cache_control:
-                    footer: false
-                    column_index: false
-                    offset_index: false
-            flush_check_period: 10s
-            trace_idle_period: 10s
-            max_block_duration: 1m0s
-            max_block_bytes: 500000000
-            complete_block_timeout: 1h0m0s
-            max_live_traces: 0
-            concurrent_blocks: 10
-            filter_server_spans: true
-    registry:
-        collection_interval: 15s
-        stale_duration: 15m0s
-        max_label_name_length: 1024
-        max_label_value_length: 2048
-    storage:
-        path: ""
-        wal:
-            wal_segment_size: 134217728
-            wal_compression: none
-            stripe_size: 16384
-            truncate_frequency: 2h0m0s
-            min_wal_time: 300000
-            max_wal_time: 14400000
-            no_lockfile: false
-        remote_write_flush_deadline: 1m0s
-        remote_write_add_org_id_header: true
-    traces_storage:
-        path: ""
-        completedfilepath: ""
-        blocksfilepath: ""
-        v2_encoding: none
-        search_encoding: none
-        ingestion_time_range_slack: 0s
-        version: vParquet3
-    metrics_ingestion_time_range_slack: 30s
-    query_timeout: 30s
-    override_ring_key: metrics-generator
-storage:
-    trace:
-        pool:
-            max_workers: 400
-            queue_depth: 20000
-        wal:
-            path: /tmp/tempo/wal
-            completedfilepath: /tmp/tempo/wal/completed
-            blocksfilepath: /tmp/tempo/wal/blocks
-            v2_encoding: snappy
-            search_encoding: none
-            ingestion_time_range_slack: 2m0s
-            version: vParquet3
-        block:
-            bloom_filter_false_positive: 0.01
-            bloom_filter_shard_size_bytes: 102400
-            version: vParquet3
-            search_encoding: snappy
-            search_page_size_bytes: 1048576
-            v2_index_downsample_bytes: 1048576
-            v2_index_page_size_bytes: 256000
-            v2_encoding: zstd
-            parquet_row_group_size_bytes: 100000000
-            parquet_dedicated_columns: []
-        search:
-            chunk_size_bytes: 1000000
-            prefetch_trace_count: 1000
-            read_buffer_count: 32
-            read_buffer_size_bytes: 1048576
-            cache_control:
-                footer: false
-                column_index: false
-                offset_index: false
-        blocklist_poll: 5m0s
-        blocklist_poll_concurrency: 50
-        blocklist_poll_fallback: true
-        blocklist_poll_tenant_index_builders: 2
-        blocklist_poll_stale_tenant_index: 0s
-        blocklist_poll_jitter_ms: 0
-        blocklist_poll_tolerate_consecutive_errors: 1
-        backend: local
-        local:
-            path: /tmp/tempo/traces
-        gcs:
-            bucket_name: ""
-            prefix: ""
-            chunk_buffer_size: 10485760
-            endpoint: ""
-            hedge_requests_at: 0s
-            hedge_requests_up_to: 2
-            insecure: false
-            object_cache_control: ""
-            object_metadata: {}
-            list_blocks_concurrency: 3
-        s3:
-            tls_cert_path: ""
-            tls_key_path: ""
-            tls_ca_path: ""
-            tls_server_name: ""
-            tls_insecure_skip_verify: false
-            tls_cipher_suites: ""
-            tls_min_version: VersionTLS12
-            bucket: ""
-            prefix: ""
-            endpoint: ""
-            region: ""
-            access_key: ""
-            secret_key: ""
-            session_token: ""
-            insecure: false
-            part_size: 0
-            hedge_requests_at: 0s
-            hedge_requests_up_to: 2
-            signature_v2: false
-            forcepathstyle: false
-            bucket_lookup_type: 0
-            tags: {}
-            storage_class: ""
-            metadata: {}
-            native_aws_auth_enabled: false
-            list_blocks_concurrency: 3
-        azure:
-            storage_account_name: ""
-            storage_account_key: ""
-            use_managed_identity: false
-            use_federated_token: false
-            user_assigned_id: ""
-            container_name: ""
-            prefix: ""
-            endpoint_suffix: blob.core.windows.net
-            max_buffers: 4
-            buffer_size: 3145728
-            hedge_requests_at: 0s
-            hedge_requests_up_to: 2
-            use_v2_sdk: false
-        cache: ""
-        background_cache:
-            writeback_goroutines: 10
-            writeback_buffer: 10000
-        memcached: null
-        redis: null
-        cache_min_compaction_level: 0
-        cache_max_block_age: 0s
-overrides:
-    defaults:
-        ingestion:
-            rate_strategy: local
-            rate_limit_bytes: 15000000
-            burst_size_bytes: 20000000
-            max_traces_per_user: 10000
-        read:
-            max_bytes_per_tag_values_query: 5000000
-        global:
-            max_bytes_per_trace: 5000000
-    per_tenant_override_config: ""
-    per_tenant_override_period: 10s
-    user_configurable_overrides:
-        enabled: false
-        poll_interval: 1m0s
-        client:
-            backend: ""
-            confirm_versioning: true
-            local:
-                path: ""
-            gcs:
-                bucket_name: ""
-                prefix: ""
-                chunk_buffer_size: 10485760
-                endpoint: ""
-                hedge_requests_at: 0s
-                hedge_requests_up_to: 2
-                insecure: false
-                object_cache_control: ""
-                object_metadata: {}
-                list_blocks_concurrency: 3
-            s3:
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: VersionTLS12
-                bucket: ""
-                prefix: ""
-                endpoint: ""
-                region: ""
-                access_key: ""
-                secret_key: ""
-                session_token: ""
-                insecure: false
-                part_size: 0
-                hedge_requests_at: 0s
-                hedge_requests_up_to: 2
-                signature_v2: false
-                forcepathstyle: false
-                bucket_lookup_type: 0
-                tags: {}
-                storage_class: ""
-                metadata: {}
-                native_aws_auth_enabled: false
-                list_blocks_concurrency: 3
-            azure:
-                storage_account_name: ""
-                storage_account_key: ""
-                use_managed_identity: false
-                use_federated_token: false
-                user_assigned_id: ""
-                container_name: ""
-                prefix: ""
-                endpoint_suffix: blob.core.windows.net
-                max_buffers: 4
-                buffer_size: 3145728
-                hedge_requests_at: 0s
-                hedge_requests_up_to: 2
-                use_v2_sdk: false
-        api:
-            check_for_conflicting_runtime_overrides: false
-memberlist:
-    node_name: ""
-    randomize_node_name: true
-    stream_timeout: 2s
-    retransmit_factor: 2
-    pull_push_interval: 30s
-    gossip_interval: 1s
-    gossip_nodes: 2
-    gossip_to_dead_nodes_time: 30s
-    dead_node_reclaim_time: 0s
-    compression_enabled: false
-    advertise_addr: ""
-    advertise_port: 7946
-    cluster_label: ""
-    cluster_label_verification_disabled: false
-    join_members: []
-    min_join_backoff: 1s
-    max_join_backoff: 1m0s
-    max_join_retries: 10
-    abort_if_cluster_join_fails: false
-    rejoin_interval: 0s
-    left_ingesters_timeout: 5m0s
-    leave_timeout: 20s
-    message_history_buffer_bytes: 0
-    bind_addr: []
-    bind_port: 7946
-    packet_dial_timeout: 2s
-    packet_write_timeout: 5s
-    tls_enabled: false
-    tls_cert_path: ""
-    tls_key_path: ""
-    tls_ca_path: ""
-    tls_server_name: ""
-    tls_insecure_skip_verify: false
-    tls_cipher_suites: ""
-    tls_min_version: ""
-usage_report:
-    reporting_enabled: true
-    backoff:
-        min_period: 100ms
-        max_period: 10s
-        max_retries: 0
-cache:
-    background:
-        writeback_goroutines: 10
-        writeback_buffer: 10000
-    caches: []

ansible/app-configs/grafana/tempo/tempo.yaml.j2

@@ -1,54 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
-server:
-  http_listen_port: 3200
-
-distributor:
-  receivers:                           # this configuration will listen on all ports and protocols that tempo is capable of.
-    jaeger:                            # the receives all come from the OpenTelemetry collector.  more configuration information can
-      protocols:                       # be found there: https://github.com/open-telemetry/opentelemetry-collector/tree/main/receiver
-        thrift_http:                   #
-        grpc:                          # for a production deployment you should only enable the receivers you need!
-        thrift_binary:
-        thrift_compact:
-    zipkin:
-    otlp:
-      protocols:
-        http:
-        grpc:
-    opencensus:
-
-ingester:
-  max_block_duration: 5m               # cut the headblock when this much time passes. this is being set for demo purposes and should probably be left alone normally
-
-compactor:
-  compaction:
-    block_retention: 1h                # overall Tempo trace retention. set for demo purposes
-
-# metrics_generator:
-#   registry:
-#     external_labels:
-#       source: tempo
-#       cluster: docker-compose
-#   storage:
-#     path: /tmp/tempo/generator/wal
-#     remote_write:
-#       - url: http://grafana-alloy:12345/api/v1/write
-#         send_exemplars: true
-
-storage:
-  trace:
-    backend: s3                        # backend configuration to use
-    wal:
-      path: /tmp/tempo/wal             # where to store the the wal locally
-    s3:
-      bucket: tempo                    # how to store data in s3
-      endpoint: minio:9000
-      access_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_TEMPO_STORAGE_ACCESS_KEY'] }}
-      secret_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_TEMPO_STORAGE_SECRET_KEY'] }}
-      insecure: true
-
-usage_report:
-  reporting_enabled: false

ansible/app-configs/grafana_alloy_config.alloy

@@ -1,404 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Agent globals
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-local.file "endpoints" {
-    // The endpoints file is used to define the endpoints, credentials and options
-    // for the Agent export to.
-    filename = "/etc/alloy/endpoints.json"
-}
-
-discovery.docker "rinoadocker" {
-        host = env("DOCKER_HOST")
-}
-
-tracing {
-    write_to = [otelcol.exporter.otlp.tempo.input]
-}
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Metrics
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-prometheus.remote_write "mimir" {
-  endpoint {
-    url = json_path(local.file.endpoints.content, ".metrics.url")[0]
-    basic_auth {
-        username = json_path(local.file.endpoints.content, ".metrics.basicAuth.username")[0]
-        password = json_path(local.file.endpoints.content, ".metrics.basicAuth.password")[0]
-    }
-  }
-}
-
-prometheus.scrape "prometheus" {
-        targets = [{
-                __address__ = "localhost:12345",
-        }]
-        forward_to = [prometheus.remote_write.mimir.receiver]
-        job_name   = "prometheus"
-}
-
-prometheus.exporter.unix "rinoa" {
-        procfs_path = "/host/proc"
-        sysfs_path  = "/host/sys"
-        rootfs_path = "/rootfs"
-}
-
-prometheus.scrape "rinoa" {
-        targets    = prometheus.exporter.unix.rinoa.targets
-        forward_to = [prometheus.remote_write.mimir.receiver]
-        job_name   = "rinoa_host"
-}
-
-prometheus.exporter.cadvisor "docker" {
-        docker_host      = env("DOCKER_HOST")
-        storage_duration = "5m"
-}
-
-prometheus.scrape "docker" {
-        targets    = prometheus.exporter.cadvisor.docker.targets
-        forward_to = [prometheus.remote_write.mimir.receiver]
-        job_name   = "docker_stats"
-}
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Logging
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-loki.write "loki" {
-        endpoint {
-                url = json_path(local.file.endpoints.content, ".logs.url")[0]
-                basic_auth {
-                        username = json_path(local.file.endpoints.content, ".logs.basicAuth.username")[0]
-                        password = json_path(local.file.endpoints.content, ".logs.basicAuth.password")[0]
-                }
-        }
-        external_labels = {}
-}
-
-loki.source.journal "hostjournal" {
-        forward_to = [loki.write.loki.receiver]
-        max_age = "24h"
-        path = "/rootfs/var/log/journal/"
-        labels = {
-                job = "host-journal",
-        }
-}
-
-local.file_match "system" {
-        path_targets = [{
-                __address__ = "localhost",
-                __path__    = "/rootfs/var/log/*log",
-                job         = "varlogs",
-        }]
-}
-
-loki.source.file "system" {
-        targets    = local.file_match.system.targets
-        forward_to = [loki.write.loki.receiver]
-}
-
-loki.source.docker "containers" {
-        host       = env("DOCKER_HOST")
-        targets    = discovery.docker.rinoadocker.targets
-        forward_to = [loki.write.loki.receiver]
-        labels     = {
-                job = "containerlogs",
-        }
-}
-
-loki.process "containers" {
-        forward_to = [loki.write.loki.receiver]
-        // stage.docker {}
-        stage.json {
-		expressions = {
-			attrs  = "",
-			output = "log",
-			stream = "stream",
-		}
-	}
-
-	stage.json {
-		expressions = {
-			tag = "",
-		}
-		source = "attrs"
-	}
-
-	stage.regex {
-		expression = "(?P<image_name>(?:[^|]*[^|])).(?P<container_name>(?:[^|]*[^|])).(?P<image_id>(?:[^|]*[^|])).(?P<container_id>(?:[^|]*[^|]))"
-		source     = "tag"
-	}
-
-	stage.timestamp {
-		source = "time"
-		format = "RFC3339Nano"
-	}
-
-	stage.labels {
-		values = {
-			container_id   = null,
-			container_name = null,
-			image_id       = null,
-			image_name     = null,
-			stream         = null,
-			tag            = null,
-		}
-	}
-
-	stage.output {
-		source = "output"
-	}
-}
-
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Traces
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-beyla.ebpf "rinoadocker" {
-    open_port = "80-65535"
-    routes {
-        unmatched = "heauristic"
-    }
-    output {
-        traces = [
-            otelcol.connector.servicegraph.tracemetrics.input,
-            otelcol.connector.spanmetrics.tracemetrics.input,
-            otelcol.processor.batch.default.input,
-            otelcol.connector.spanlogs.autologging.input,
-        ]
-    }
-}
-
-prometheus.scrape "beyla" { 
-    targets = beyla.ebpf.rinoadocker.targets
-    forward_to = [prometheus.remote_write.mimir.receiver]
-}
-
-otelcol.auth.headers "tempo" {
-    header {
-        key = "Authorization"
-        value = join(["Basic ", json_path(local.file.endpoints.content, ".traces.basicAuthToken")[0]], "")
-    }
-}
-
-otelcol.processor.batch "default" {
-    // Wait until we've received 16K of data.
-    send_batch_size = 16384
-    send_batch_max_size = 16384
-    // Or until 2 seconds have elapsed.
-    timeout = "2s"
-    // When the Agent has enough batched data, send it to the OpenTelemetry exporter named 'tempo'.
-    output {
-        traces = [otelcol.exporter.otlp.tempo.input]
-    }
-}
-
-otelcol.exporter.otlp "tempo" {
-    // Define the client for exporting.
-    client {
-        // Authentication block.
-        auth = otelcol.auth.headers.tempo.handler
-
-        // Send to the locally running Tempo instance, on port 4317 (OTLP gRPC).
-        endpoint = json_path(local.file.endpoints.content, ".traces.url")[0]
-
-        // Configure TLS settings for communicating with the endpoint.
-        tls {
-            // The connection is insecure.
-            insecure = json_path(local.file.endpoints.content, ".traces.tls.insecure")[0]
-            // Do not verify TLS certificates when connecting.
-            insecure_skip_verify = json_path(local.file.endpoints.content, ".traces.tls.insecureSkipVerify")[0]
-        }
-    }
-}
-
-otelcol.connector.spanlogs "autologging" {
-    // We only want to output a line for each root span (ie. every single trace), and not for every
-    // process or span (outputting a line for every span would be extremely verbose).
-    spans = false
-    roots = true
-    processes = false
-    // We want to ensure that the following three span attributes are included in the log line, if
-    // present.
-    span_attributes = [ "http.method", "http.target", "http.status_code" ]
-
-    // Overrides the default key in the log line to be `traceId`, which is then used by Grafana to
-    // identify the trace ID for correlation with the Tempo datasource.
-    overrides {
-        trace_id_key = "traceId"
-    }
-    // Send to the OpenTelemetry Loki exporter.
-    output {
-        logs = [otelcol.exporter.loki.autologging.input]
-    }
-}
-
-// Simply forwards the incoming OpenTelemetry log format out as a Loki log.
-// We need this stage to ensure we can then process the logline as a Loki object.
-otelcol.exporter.loki "autologging" {
-    forward_to = [loki.process.autologging.receiver]
-}
-
-// The Loki processor allows us to accept a correctly formatted Loki log and mutate it into
-// a set of fields for output.
-loki.process "autologging" {
-    // The JSON stage simply extracts the `body` (the actual logline) from the Loki log, ignoring
-    // all other fields.
-    stage.json {
-        expressions = { "body" = "" }
-    }
-    // The output stage takes the body (the main logline) and uses this as the source for the output
-    // logline. In this case, it essentially turns it into logfmt.
-    stage.output {
-        source = "body"
-    }
-
-    // Finally send the processed logline onto the Loki exporter.
-    forward_to = [loki.write.autologging.receiver]
-}
-
-// The Loki writer receives a processed Loki log and then writes it to a Loki instance.
-loki.write "autologging" {
-    // Add the `agent` value to the `job` label, so we can identify it as having been generated
-    // by Grafana Agent when querying.
-    external_labels = {
-        job = "agent",
-    }
-
-    // Output the Loki log to the local Loki instance.
-    endpoint {
-        url = json_path(local.file.endpoints.content, ".logs.url")[0]
-
-        // The basic auth credentials for the Loki instance.
-        basic_auth {
-            username = json_path(local.file.endpoints.content, ".logs.basicAuth.username")[0]
-            password = json_path(local.file.endpoints.content, ".logs.basicAuth.password")[0]
-        }
-    }
-}
-
-// The Tail Sampling processor will use a set of policies to determine which received traces to keep
-// and send to Tempo.
-otelcol.processor.tail_sampling "errors" {
-    // Total wait time from the start of a trace before making a sampling decision. Note that smaller time
-    // periods can potentially cause a decision to be made before the end of a trace has occurred.
-    decision_wait = "30s"
-
-    // The following policies follow a logical OR pattern, meaning that if any of the policies match,
-    // the trace will be kept. For logical AND, you can use the `and` policy. Every span of a trace is
-    // examined by each policy in turn. A match will cause a short-circuit.
-
-    // This policy defines that traces that contain errors should be kept.
-    policy {
-        // The name of the policy can be used for logging purposes.
-        name = "sample-erroring-traces"
-        // The type must match the type of policy to be used, in this case examing the status code
-        // of every span in the trace.
-        type = "status_code"
-        // This block determines the error codes that should match in order to keep the trace,
-        // in this case the OpenTelemetry 'ERROR' code.
-        status_code {
-            status_codes = [ "ERROR" ]
-        }
-    }
-
-    // This policy defines that only traces that are longer than 200ms in total should be kept.
-    policy {
-        // The name of the policy can be used for logging purposes.
-        name = "sample-long-traces"
-        // The type must match the policy to be used, in this case the total latency of the trace.
-        type = "latency"
-        // This block determines the total length of the trace in milliseconds.
-        latency {
-            threshold_ms = 200
-        }
-    }
-
-    // The output block forwards the kept traces onto the batch processor, which will marshall them
-    // for exporting to Tempo.
-    output {
-        traces = [otelcol.processor.batch.default.input]
-    }
-}
-
-// The Spanmetrics Connector will generate RED metrics based on the incoming trace span data.
-otelcol.connector.spanmetrics "tracemetrics" {
-    // The namespace explicit adds a prefix to all the generated span metrics names.
-    // In this case, we'll ensure they match as closely as possible those generated by Tempo.
-    namespace = "traces.spanmetrics"
-
-    // Each extra dimension (metrics label) to be added to the generated metrics from matching span attributes. These
-    // need to be defined with a name and optionally a default value (in the following cases, we do not want a default
-    // value if the span attribute is not present).
-    dimension {
-        name = "http.method"
-    }
-    dimension {
-        name = "http.target"
-    }
-    dimension {
-        name = "http.status_code"
-    }
-    dimension {
-        name = "service.version"
-    }
-
-    // A histogram block must be present, either explicitly defining bucket values or via an exponential block.
-    // We do the latter here.
-    histogram {
-        explicit {
-        }
-    }
-
-    // The exemplar block is added to ensure we generate exemplars for traces on relevant metric values.
-    exemplars {
-        enabled = true
-    }
-
-    // Generated metrics data is in OTLP format. We send this data to the OpenTelemetry Prometheus exporter to ensure
-    // it gets transformed into Prometheus format data.
-    output {
-        metrics = [otelcol.exporter.prometheus.tracemetrics.input]
-    }
-}
-
-// The Servicegraph Connector will generate service graph metrics (edges and nodes) based on incoming trace spans.
-otelcol.connector.servicegraph "tracemetrics" {
-    // Extra dimensions (metrics labels) to be added to the generated metrics from matching span attributes.
-    // For this component, this is defined as an array. There are no default values and the labels will not be generated
-    // for missing span attributes.
-    dimensions = [
-        "http.method",
-        "http.target",
-        "http.status_code",
-        "service.version",
-    ]
-
-    // Generated metrics data is in OTLP format. We send this data to the OpenTelemetry Prometheus exporter to ensure
-    // it gets transformed into Prometheus format data.
-    output {
-        metrics = [otelcol.exporter.prometheus.tracemetrics.input]
-    }
-}
-
-otelcol.exporter.prometheus "tracemetrics" {
-    // Forward to our local Prometheus remote writer which will send the metrics to Mimir.
-    forward_to = [prometheus.remote_write.mimir.receiver]
-}
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Profiling
-/////////////////////////////////////////////////////////////////////////////////////////////////////////////
-
-pyroscope.write "pyroscope" {
-        endpoint {
-                url = json_path(local.file.endpoints.content, ".profiles.url")[0]
-                basic_auth {
-                        username = json_path(local.file.endpoints.content, ".profiles.basicAuth.username")[0]
-                        password = json_path(local.file.endpoints.content, ".profiles.basicAuth.password")[0]
-                }
-        }
-        external_labels = {}
-}
-
-pyroscope.ebpf "rinoadocker" {
-        forward_to = [pyroscope.write.pyroscope.receiver]
-        targets = discovery.docker.rinoadocker.targets
-}

ansible/app-configs/grafana_alloy_endpoints.json.j2

@@ -1,34 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-    "metrics": {
-        "url": "http://grafana-mimir:9009/api/v1/push",
-        "basicAuth": {
-            "username": "",
-            "password": ""
-        }
-    },
-    "logs": {
-        "url": "http://grafana-loki:3100/loki/api/v1/push",
-        "basicAuth": {
-            "username": "",
-            "password": ""
-        }
-    },
-    "traces": {
-        "url": "http://grafana-tempo:4317",
-        "basicAuthToken": "",
-        "tls": {
-            "insecure": true,
-            "insecureSkipVerify": true
-        }
-    },
-    "profiles": {
-        "url": "http://grafana-pyroscope:4040",
-        "basicAuth": {
-            "username": "",
-            "password": ""
-        }
-    }
-}

ansible/app-configs/grafana_beyla.yml.j2

@@ -1,7 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-routes:
-  patterns:
-    - /*
-  unmatched: heuristic

ansible/app-configs/grafana_mimir.yaml.j2

@@ -1,77 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-multitenancy_enabled: false
-no_auth_tenant: rinoa_mimir
-# target: query-frontend
-# api:
-#   prometheus_http_prefix: '/prometheus'
-server:
-  http_listen_port: 9009
-# frontend:
-#   split_queries_by_interval: 24h
-#   align_queries_with_step: true
-  # cache_results: true
-  # results_cache:
-  #   backend: "memcached"
-  #   memcached:
-  #     addresses: "memcached-mimir:11211"
-#   downstream_url: http://grafana-agent:12345
-
-common:
-  storage:
-    backend: s3
-    s3:
-      endpoint: minio:9000
-      access_key_id: "Q8KAihuXtGgmretKNh7C"
-      secret_access_key: "hOlRODtnvFlNlL26Bj3GizZG6Ys3rlpG8p6Vo3NX"
-      bucket_name: "mimir"
-      insecure: true
-
-blocks_storage:
-  storage_prefix: rinoa
-  tsdb:
-    dir: /tmp/mimir/tsdb
-
-memberlist:
-  tls_enabled: false
-
-compactor:
-  # Directory to temporarily store blocks underdoing compaction.
-  data_dir: /tmp/mimir/compactor
-  # The sharding ring type used to share the hashed ring for the compactor.
-  sharding_ring:
-    # Use memberlist backend store (the default).
-    kvstore:
-      store: memberlist
-
-# The distributor receives incoming metrics data for the system.
-distributor:
-  # The ring to share hash ring data across instances.
-  ring:
-    # The address advertised in the ring. Localhost.
-    instance_addr: 127.0.0.1
-    # Use memberlist backend store (the default).
-    kvstore:
-      store: memberlist
-
-# The ingester receives data from the distributor and processes it into indices and blocks.
-ingester:
-  # The ring to share hash ring data across instances.
-  ring:
-    # The address advertised in the ring. Localhost.
-    instance_addr: 127.0.0.1
-    # Use memberlist backend store (the default).
-    kvstore:
-      store: memberlist
-    # Only run one instance of the ingesters.
-    # Note: It is highly recommended to run more than one ingester in production, the default is an RF of 3.
-    replication_factor: 1
-
-# The store gateway block configures gateway storage.
-store_gateway:
-  # Configuration for the hash ring.
-  sharding_ring:
-    # Only run a single instance. In production setups, the replication factor must
-    # be set on the querier and ruler as well.
-    replication_factor: 1

ansible/app-configs/grafana_pyroscope_config.yaml.j2

@@ -1,12 +0,0 @@
-storage:
-  backend: s3
-  s3:
-    bucket_name: pyroscope
-    endpoint: minio:9000
-    region: us-east-fh-pln
-    access_key_id: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_PYROSCOPE_STORAGE_ACCESS_KEY'] }}
-    secret_access_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_PYROSCOPE_STORAGE_SECRET_KEY'] }}
-    insecure: true
-
-analytics:
-  reporting_enabled: false

ansible/app-configs/grafana_tempo_config.yml.j2

@@ -1,787 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-target: all
-http_api_prefix: ""
-autocomplete_filtering_enabled: true
-server:
-    http_listen_network: tcp
-    http_listen_address: ""
-    http_listen_port: 80
-    http_listen_conn_limit: 0
-    grpc_listen_network: tcp
-    grpc_listen_address: ""
-    grpc_listen_port: 9095
-    grpc_listen_conn_limit: 0
-    tls_cipher_suites: ""
-    tls_min_version: ""
-    http_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    grpc_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    register_instrumentation: true
-    report_grpc_codes_in_instrumentation_label_enabled: false
-    graceful_shutdown_timeout: 30s
-    http_server_read_timeout: 30s
-    http_server_read_header_timeout: 0s
-    http_server_write_timeout: 30s
-    http_server_idle_timeout: 2m0s
-    http_log_closed_connections_without_response_enabled: false
-    grpc_server_max_recv_msg_size: 16777216
-    grpc_server_max_send_msg_size: 16777216
-    grpc_server_max_concurrent_streams: 100
-    grpc_server_max_connection_idle: 2562047h47m16.854775807s
-    grpc_server_max_connection_age: 2562047h47m16.854775807s
-    grpc_server_max_connection_age_grace: 2562047h47m16.854775807s
-    grpc_server_keepalive_time: 2h0m0s
-    grpc_server_keepalive_timeout: 20s
-    grpc_server_min_time_between_pings: 10s
-    grpc_server_ping_without_stream_allowed: true
-    grpc_server_num_workers: 0
-    log_format: logfmt
-    log_level: info
-    log_source_ips_enabled: false
-    log_source_ips_header: ""
-    log_source_ips_regex: ""
-    log_request_headers: false
-    log_request_at_info_level_enabled: false
-    log_request_exclude_headers_list: ""
-    http_path_prefix: ""
-internal_server:
-    http_listen_network: tcp
-    http_listen_address: ""
-    http_listen_port: 3101
-    http_listen_conn_limit: 0
-    grpc_listen_network: ""
-    grpc_listen_address: ""
-    grpc_listen_port: 0
-    grpc_listen_conn_limit: 0
-    tls_cipher_suites: ""
-    tls_min_version: ""
-    http_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    grpc_tls_config:
-        cert: ""
-        key: null
-        client_ca: ""
-        cert_file: ""
-        key_file: ""
-        client_auth_type: ""
-        client_ca_file: ""
-    register_instrumentation: false
-    report_grpc_codes_in_instrumentation_label_enabled: false
-    graceful_shutdown_timeout: 30s
-    http_server_read_timeout: 30s
-    http_server_read_header_timeout: 0s
-    http_server_write_timeout: 30s
-    http_server_idle_timeout: 2m0s
-    http_log_closed_connections_without_response_enabled: false
-    grpc_server_max_recv_msg_size: 0
-    grpc_server_max_send_msg_size: 0
-    grpc_server_max_concurrent_streams: 0
-    grpc_server_max_connection_idle: 0s
-    grpc_server_max_connection_age: 0s
-    grpc_server_max_connection_age_grace: 0s
-    grpc_server_keepalive_time: 0s
-    grpc_server_keepalive_timeout: 0s
-    grpc_server_min_time_between_pings: 0s
-    grpc_server_ping_without_stream_allowed: false
-    grpc_server_num_workers: 0
-    log_format: logfmt
-    log_level: info
-    log_source_ips_enabled: false
-    log_source_ips_header: ""
-    log_source_ips_regex: ""
-    log_request_headers: false
-    log_request_at_info_level_enabled: false
-    log_request_exclude_headers_list: ""
-    http_path_prefix: ""
-    enable: false
-distributor:
-    ring:
-        kvstore:
-            store: memberlist
-            prefix: collectors/
-            consul:
-                host: localhost:8500
-                acl_token: ""
-                http_client_timeout: 20s
-                consistent_reads: false
-                watch_rate_limit: 1
-                watch_burst_size: 1
-                cas_retry_delay: 1s
-            etcd:
-                endpoints: []
-                dial_timeout: 10s
-                max_retries: 10
-                tls_enabled: false
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: ""
-                username: ""
-                password: ""
-            multi:
-                primary: ""
-                secondary: ""
-                mirror_enabled: false
-                mirror_timeout: 2s
-        heartbeat_period: 5s
-        heartbeat_timeout: 5m0s
-        instance_id: local-instance
-        instance_interface_names:
-            - eth0
-            - en0
-        instance_port: 0
-        instance_addr: ""
-    receivers: {}
-    override_ring_key: distributor
-    forwarders: []
-    extend_writes: true
-    retry_after_on_resource_exhausted: 0s
-ingester_client:
-    pool_config:
-        checkinterval: 15s
-        healthcheckenabled: true
-        healthchecktimeout: 1s
-        maxconcurrenthealthchecks: 0
-    remote_timeout: 5s
-    grpc_client_config:
-        max_recv_msg_size: 104857600
-        max_send_msg_size: 104857600
-        grpc_compression: snappy
-        rate_limit: 0
-        rate_limit_burst: 0
-        backoff_on_ratelimits: false
-        backoff_config:
-            min_period: 100ms
-            max_period: 10s
-            max_retries: 10
-        initial_stream_window_size: 63KiB1023B
-        initial_connection_window_size: 63KiB1023B
-        tls_enabled: false
-        tls_cert_path: ""
-        tls_key_path: ""
-        tls_ca_path: ""
-        tls_server_name: ""
-        tls_insecure_skip_verify: false
-        tls_cipher_suites: ""
-        tls_min_version: ""
-        connect_timeout: 5s
-        connect_backoff_base_delay: 1s
-        connect_backoff_max_delay: 5s
-metrics_generator_client:
-    pool_config:
-        checkinterval: 15s
-        healthcheckenabled: true
-        healthchecktimeout: 1s
-        maxconcurrenthealthchecks: 0
-    remote_timeout: 5s
-    grpc_client_config:
-        max_recv_msg_size: 104857600
-        max_send_msg_size: 104857600
-        grpc_compression: snappy
-        rate_limit: 0
-        rate_limit_burst: 0
-        backoff_on_ratelimits: false
-        backoff_config:
-            min_period: 100ms
-            max_period: 10s
-            max_retries: 10
-        initial_stream_window_size: 63KiB1023B
-        initial_connection_window_size: 63KiB1023B
-        tls_enabled: false
-        tls_cert_path: ""
-        tls_key_path: ""
-        tls_ca_path: ""
-        tls_server_name: ""
-        tls_insecure_skip_verify: false
-        tls_cipher_suites: ""
-        tls_min_version: ""
-        connect_timeout: 5s
-        connect_backoff_base_delay: 1s
-        connect_backoff_max_delay: 5s
-querier:
-    search:
-        query_timeout: 30s
-        prefer_self: 10
-        external_hedge_requests_at: 8s
-        external_hedge_requests_up_to: 2
-        external_backend: ""
-        google_cloud_run: null
-        external_endpoints: []
-    trace_by_id:
-        query_timeout: 10s
-    max_concurrent_queries: 20
-    frontend_worker:
-        frontend_address: 127.0.0.1:9095
-        dns_lookup_duration: 10s
-        parallelism: 2
-        match_max_concurrent: true
-        id: ""
-        grpc_client_config:
-            max_recv_msg_size: 104857600
-            max_send_msg_size: 16777216
-            grpc_compression: gzip
-            rate_limit: 0
-            rate_limit_burst: 0
-            backoff_on_ratelimits: false
-            backoff_config:
-                min_period: 100ms
-                max_period: 1s
-                max_retries: 5
-            initial_stream_window_size: 0B
-            initial_connection_window_size: 0B
-            tls_enabled: false
-            tls_cert_path: ""
-            tls_key_path: ""
-            tls_ca_path: ""
-            tls_server_name: ""
-            tls_insecure_skip_verify: false
-            tls_cipher_suites: ""
-            tls_min_version: ""
-            connect_timeout: 0s
-            connect_backoff_base_delay: 0s
-            connect_backoff_max_delay: 0s
-    query_relevant_ingesters: false
-query_frontend:
-    max_outstanding_per_tenant: 2000
-    querier_forget_delay: 0s
-    max_batch_size: 5
-    max_retries: 2
-    search:
-        concurrent_jobs: 1000
-        target_bytes_per_job: 104857600
-        default_result_limit: 20
-        max_result_limit: 0
-        max_duration: 168h0m0s
-        query_backend_after: 15m0s
-        query_ingesters_until: 30m0s
-    trace_by_id:
-        query_shards: 50
-        hedge_requests_at: 2s
-        hedge_requests_up_to: 2
-    metrics:
-        concurrent_jobs: 1000
-        target_bytes_per_job: 104857600
-        max_duration: 0s
-        query_backend_after: 1h0m0s
-        interval: 5m0s
-    multi_tenant_queries_enabled: true
-compactor:
-    ring:
-        kvstore:
-            store: ""
-            prefix: collectors/
-            consul:
-                host: localhost:8500
-                acl_token: ""
-                http_client_timeout: 20s
-                consistent_reads: false
-                watch_rate_limit: 1
-                watch_burst_size: 1
-                cas_retry_delay: 1s
-            etcd:
-                endpoints: []
-                dial_timeout: 10s
-                max_retries: 10
-                tls_enabled: false
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: ""
-                username: ""
-                password: ""
-            multi:
-                primary: ""
-                secondary: ""
-                mirror_enabled: false
-                mirror_timeout: 2s
-        heartbeat_period: 5s
-        heartbeat_timeout: 1m0s
-        wait_stability_min_duration: 1m0s
-        wait_stability_max_duration: 5m0s
-        instance_id: local-instance
-        instance_interface_names:
-            - eth0
-            - en0
-        instance_port: 0
-        instance_addr: ""
-        enable_inet6: false
-        wait_active_instance_timeout: 10m0s
-    compaction:
-        v2_in_buffer_bytes: 5242880
-        v2_out_buffer_bytes: 20971520
-        v2_prefetch_traces_count: 1000
-        compaction_window: 1h0m0s
-        max_compaction_objects: 6000000
-        max_block_bytes: 107374182400
-        block_retention: 336h0m0s
-        compacted_block_retention: 1h0m0s
-        retention_concurrency: 10
-        max_time_per_tenant: 5m0s
-        compaction_cycle: 30s
-    override_ring_key: compactor
-ingester:
-    lifecycler:
-        ring:
-            kvstore:
-                store: inmemory
-                prefix: collectors/
-                consul:
-                    host: localhost:8500
-                    acl_token: ""
-                    http_client_timeout: 20s
-                    consistent_reads: false
-                    watch_rate_limit: 1
-                    watch_burst_size: 1
-                    cas_retry_delay: 1s
-                etcd:
-                    endpoints: []
-                    dial_timeout: 10s
-                    max_retries: 10
-                    tls_enabled: false
-                    tls_cert_path: ""
-                    tls_key_path: ""
-                    tls_ca_path: ""
-                    tls_server_name: ""
-                    tls_insecure_skip_verify: false
-                    tls_cipher_suites: ""
-                    tls_min_version: ""
-                    username: ""
-                    password: ""
-                multi:
-                    primary: ""
-                    secondary: ""
-                    mirror_enabled: false
-                    mirror_timeout: 2s
-            heartbeat_timeout: 5m0s
-            replication_factor: 1
-            zone_awareness_enabled: false
-            excluded_zones: ""
-        num_tokens: 128
-        heartbeat_period: 5s
-        heartbeat_timeout: 1m0s
-        observe_period: 0s
-        join_after: 0s
-        min_ready_duration: 15s
-        interface_names:
-            - en0
-            - bridge100
-        enable_inet6: false
-        final_sleep: 0s
-        tokens_file_path: ""
-        availability_zone: ""
-        unregister_on_shutdown: true
-        readiness_check_ring_health: true
-        address: 127.0.0.1
-        port: 0
-        id: local-instance
-    concurrent_flushes: 4
-    flush_check_period: 10s
-    flush_op_timeout: 5m0s
-    trace_idle_period: 10s
-    max_block_duration: 30m0s
-    max_block_bytes: 524288000
-    complete_block_timeout: 15m0s
-    override_ring_key: ring
-    flush_all_on_shutdown: false
-metrics_generator:
-    ring:
-        kvstore:
-            store: inmemory
-            prefix: collectors/
-            consul:
-                host: localhost:8500
-                acl_token: ""
-                http_client_timeout: 20s
-                consistent_reads: false
-                watch_rate_limit: 1
-                watch_burst_size: 1
-                cas_retry_delay: 1s
-            etcd:
-                endpoints: []
-                dial_timeout: 10s
-                max_retries: 10
-                tls_enabled: false
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: ""
-                username: ""
-                password: ""
-            multi:
-                primary: ""
-                secondary: ""
-                mirror_enabled: false
-                mirror_timeout: 2s
-        heartbeat_period: 5s
-        heartbeat_timeout: 1m0s
-        instance_id: local-instance
-        instance_interface_names:
-            - eth0
-            - en0
-        instance_addr: 127.0.0.1
-        instance_port: 0
-        enable_inet6: false
-    processor:
-        service_graphs:
-            wait: 10s
-            max_items: 10000
-            workers: 10
-            histogram_buckets:
-                - 0.1
-                - 0.2
-                - 0.4
-                - 0.8
-                - 1.6
-                - 3.2
-                - 6.4
-                - 12.8
-            dimensions: []
-            enable_client_server_prefix: false
-            peer_attributes:
-                - peer.service
-                - db.name
-                - db.system
-            span_multiplier_key: ""
-        span_metrics:
-            histogram_buckets:
-                - 0.002
-                - 0.004
-                - 0.008
-                - 0.016
-                - 0.032
-                - 0.064
-                - 0.128
-                - 0.256
-                - 0.512
-                - 1.024
-                - 2.048
-                - 4.096
-                - 8.192
-                - 16.384
-            intrinsic_dimensions:
-                service: true
-                span_name: true
-                span_kind: true
-                status_code: true
-            dimensions: []
-            dimension_mappings: []
-            enable_target_info: false
-            span_multiplier_key: ""
-            subprocessors:
-                0: true
-                1: true
-                2: true
-            filter_policies: []
-            target_info_excluded_dimensions: []
-        local_blocks:
-            block:
-                bloom_filter_false_positive: 0.01
-                bloom_filter_shard_size_bytes: 102400
-                version: vParquet3
-                search_encoding: snappy
-                search_page_size_bytes: 1048576
-                v2_index_downsample_bytes: 1048576
-                v2_index_page_size_bytes: 256000
-                v2_encoding: zstd
-                parquet_row_group_size_bytes: 100000000
-                parquet_dedicated_columns: []
-            search:
-                chunk_size_bytes: 1000000
-                prefetch_trace_count: 1000
-                read_buffer_count: 32
-                read_buffer_size_bytes: 1048576
-                cache_control:
-                    footer: false
-                    column_index: false
-                    offset_index: false
-            flush_check_period: 10s
-            trace_idle_period: 10s
-            max_block_duration: 1m0s
-            max_block_bytes: 500000000
-            complete_block_timeout: 1h0m0s
-            max_live_traces: 0
-            concurrent_blocks: 10
-            filter_server_spans: true
-    registry:
-        collection_interval: 15s
-        stale_duration: 15m0s
-        max_label_name_length: 1024
-        max_label_value_length: 2048
-    storage:
-        path: ""
-        wal:
-            wal_segment_size: 134217728
-            wal_compression: none
-            stripe_size: 16384
-            truncate_frequency: 2h0m0s
-            min_wal_time: 300000
-            max_wal_time: 14400000
-            no_lockfile: false
-        remote_write_flush_deadline: 1m0s
-        remote_write_add_org_id_header: true
-    traces_storage:
-        path: ""
-        completedfilepath: ""
-        blocksfilepath: ""
-        v2_encoding: none
-        search_encoding: none
-        ingestion_time_range_slack: 0s
-        version: vParquet3
-    metrics_ingestion_time_range_slack: 30s
-    query_timeout: 30s
-    override_ring_key: metrics-generator
-storage:
-    trace:
-        pool:
-            max_workers: 400
-            queue_depth: 20000
-        wal:
-            path: /tmp/tempo/wal
-            completedfilepath: /tmp/tempo/wal/completed
-            blocksfilepath: /tmp/tempo/wal/blocks
-            v2_encoding: snappy
-            search_encoding: none
-            ingestion_time_range_slack: 2m0s
-            version: vParquet3
-        block:
-            bloom_filter_false_positive: 0.01
-            bloom_filter_shard_size_bytes: 102400
-            version: vParquet3
-            search_encoding: snappy
-            search_page_size_bytes: 1048576
-            v2_index_downsample_bytes: 1048576
-            v2_index_page_size_bytes: 256000
-            v2_encoding: zstd
-            parquet_row_group_size_bytes: 100000000
-            parquet_dedicated_columns: []
-        search:
-            chunk_size_bytes: 1000000
-            prefetch_trace_count: 1000
-            read_buffer_count: 32
-            read_buffer_size_bytes: 1048576
-            cache_control:
-                footer: false
-                column_index: false
-                offset_index: false
-        blocklist_poll: 5m0s
-        blocklist_poll_concurrency: 50
-        blocklist_poll_fallback: true
-        blocklist_poll_tenant_index_builders: 2
-        blocklist_poll_stale_tenant_index: 0s
-        blocklist_poll_jitter_ms: 0
-        blocklist_poll_tolerate_consecutive_errors: 1
-        backend: local
-        local:
-            path: /tmp/tempo/traces
-        gcs:
-            bucket_name: ""
-            prefix: ""
-            chunk_buffer_size: 10485760
-            endpoint: ""
-            hedge_requests_at: 0s
-            hedge_requests_up_to: 2
-            insecure: false
-            object_cache_control: ""
-            object_metadata: {}
-            list_blocks_concurrency: 3
-        s3:
-            tls_cert_path: ""
-            tls_key_path: ""
-            tls_ca_path: ""
-            tls_server_name: ""
-            tls_insecure_skip_verify: false
-            tls_cipher_suites: ""
-            tls_min_version: VersionTLS12
-            bucket: ""
-            prefix: ""
-            endpoint: ""
-            region: ""
-            access_key: ""
-            secret_key: ""
-            session_token: ""
-            insecure: false
-            part_size: 0
-            hedge_requests_at: 0s
-            hedge_requests_up_to: 2
-            signature_v2: false
-            forcepathstyle: false
-            bucket_lookup_type: 0
-            tags: {}
-            storage_class: ""
-            metadata: {}
-            native_aws_auth_enabled: false
-            list_blocks_concurrency: 3
-        azure:
-            storage_account_name: ""
-            storage_account_key: ""
-            use_managed_identity: false
-            use_federated_token: false
-            user_assigned_id: ""
-            container_name: ""
-            prefix: ""
-            endpoint_suffix: blob.core.windows.net
-            max_buffers: 4
-            buffer_size: 3145728
-            hedge_requests_at: 0s
-            hedge_requests_up_to: 2
-            use_v2_sdk: false
-        cache: ""
-        background_cache:
-            writeback_goroutines: 10
-            writeback_buffer: 10000
-        memcached: null
-        redis: null
-        cache_min_compaction_level: 0
-        cache_max_block_age: 0s
-overrides:
-    defaults:
-        ingestion:
-            rate_strategy: local
-            rate_limit_bytes: 15000000
-            burst_size_bytes: 20000000
-            max_traces_per_user: 10000
-        read:
-            max_bytes_per_tag_values_query: 5000000
-        global:
-            max_bytes_per_trace: 5000000
-    per_tenant_override_config: ""
-    per_tenant_override_period: 10s
-    user_configurable_overrides:
-        enabled: false
-        poll_interval: 1m0s
-        client:
-            backend: ""
-            confirm_versioning: true
-            local:
-                path: ""
-            gcs:
-                bucket_name: ""
-                prefix: ""
-                chunk_buffer_size: 10485760
-                endpoint: ""
-                hedge_requests_at: 0s
-                hedge_requests_up_to: 2
-                insecure: false
-                object_cache_control: ""
-                object_metadata: {}
-                list_blocks_concurrency: 3
-            s3:
-                tls_cert_path: ""
-                tls_key_path: ""
-                tls_ca_path: ""
-                tls_server_name: ""
-                tls_insecure_skip_verify: false
-                tls_cipher_suites: ""
-                tls_min_version: VersionTLS12
-                bucket: ""
-                prefix: ""
-                endpoint: ""
-                region: ""
-                access_key: ""
-                secret_key: ""
-                session_token: ""
-                insecure: false
-                part_size: 0
-                hedge_requests_at: 0s
-                hedge_requests_up_to: 2
-                signature_v2: false
-                forcepathstyle: false
-                bucket_lookup_type: 0
-                tags: {}
-                storage_class: ""
-                metadata: {}
-                native_aws_auth_enabled: false
-                list_blocks_concurrency: 3
-            azure:
-                storage_account_name: ""
-                storage_account_key: ""
-                use_managed_identity: false
-                use_federated_token: false
-                user_assigned_id: ""
-                container_name: ""
-                prefix: ""
-                endpoint_suffix: blob.core.windows.net
-                max_buffers: 4
-                buffer_size: 3145728
-                hedge_requests_at: 0s
-                hedge_requests_up_to: 2
-                use_v2_sdk: false
-        api:
-            check_for_conflicting_runtime_overrides: false
-memberlist:
-    node_name: ""
-    randomize_node_name: true
-    stream_timeout: 2s
-    retransmit_factor: 2
-    pull_push_interval: 30s
-    gossip_interval: 1s
-    gossip_nodes: 2
-    gossip_to_dead_nodes_time: 30s
-    dead_node_reclaim_time: 0s
-    compression_enabled: false
-    advertise_addr: ""
-    advertise_port: 7946
-    cluster_label: ""
-    cluster_label_verification_disabled: false
-    join_members: []
-    min_join_backoff: 1s
-    max_join_backoff: 1m0s
-    max_join_retries: 10
-    abort_if_cluster_join_fails: false
-    rejoin_interval: 0s
-    left_ingesters_timeout: 5m0s
-    leave_timeout: 20s
-    message_history_buffer_bytes: 0
-    bind_addr: []
-    bind_port: 7946
-    packet_dial_timeout: 2s
-    packet_write_timeout: 5s
-    tls_enabled: false
-    tls_cert_path: ""
-    tls_key_path: ""
-    tls_ca_path: ""
-    tls_server_name: ""
-    tls_insecure_skip_verify: false
-    tls_cipher_suites: ""
-    tls_min_version: ""
-usage_report:
-    reporting_enabled: true
-    backoff:
-        min_period: 100ms
-        max_period: 10s
-        max_retries: 0
-cache:
-    background:
-        writeback_goroutines: 10
-        writeback_buffer: 10000
-    caches: []

ansible/app-configs/grafana_tempo_tempo.yaml.j2

@@ -1,54 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
-server:
-  http_listen_port: 3200
-
-distributor:
-  receivers:                           # this configuration will listen on all ports and protocols that tempo is capable of.
-    jaeger:                            # the receives all come from the OpenTelemetry collector.  more configuration information can
-      protocols:                       # be found there: https://github.com/open-telemetry/opentelemetry-collector/tree/main/receiver
-        thrift_http:                   #
-        grpc:                          # for a production deployment you should only enable the receivers you need!
-        thrift_binary:
-        thrift_compact:
-    zipkin:
-    otlp:
-      protocols:
-        http:
-        grpc:
-    opencensus:
-
-ingester:
-  max_block_duration: 5m               # cut the headblock when this much time passes. this is being set for demo purposes and should probably be left alone normally
-
-compactor:
-  compaction:
-    block_retention: 1h                # overall Tempo trace retention. set for demo purposes
-
-# metrics_generator:
-#   registry:
-#     external_labels:
-#       source: tempo
-#       cluster: docker-compose
-#   storage:
-#     path: /tmp/tempo/generator/wal
-#     remote_write:
-#       - url: http://grafana-alloy:12345/api/v1/write
-#         send_exemplars: true
-
-storage:
-  trace:
-    backend: s3                        # backend configuration to use
-    wal:
-      path: /tmp/tempo/wal             # where to store the the wal locally
-    s3:
-      bucket: tempo                    # how to store data in s3
-      endpoint: minio:9000
-      access_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_TEMPO_STORAGE_ACCESS_KEY'] }}
-      secret_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MINIO_TEMPO_STORAGE_SECRET_KEY'] }}
-      insecure: true
-
-usage_report:
-  reporting_enabled: false

ansible/app-configs/homepage/bookmarks.yaml.j2

@@ -1,22 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/bookmarks
-
-#- Developer:
-#    - Github:
-#        - abbr: GH
-#          href: https://github.com/
-#
-#- Social:
-#    - Reddit:
-#        - abbr: RE
-#          href: https://reddit.com/
-#
-#- Entertainment:
-#    - YouTube:
-#        - abbr: YT
-#          href: https://youtube.com/

ansible/app-configs/homepage/docker.yaml.j2

@@ -1,15 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/docker/
-
-# my-docker:
-#   host: 127.0.0.1
-#   port: 2375
-
- my-docker:
-   host: dockerproxy
-   port: 2375

ansible/app-configs/homepage/kubernetes.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
----
-# sample kubernetes config

ansible/app-configs/homepage/services.yaml.j2

@@ -1,33 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/services
-
-#- My First Group:
-#    - My First Service:
-#        href: http://localhost/
-#        description: Homepage is awesome
-#
-#- My Second Group:
-#    - My Second Service:
-#        href: http://localhost/
-#        description: Homepage is the best
-#
-#- My Third Group:
-#    - My Third Service:
-#        href: http://localhost/
-#        description: Homepage is 😎
-
-- Automation:
-    - Home Assistant (Rikku):
-        href: https://ha.trez.wtf
-        description: Smart Home
-        icon: home-assistant.png
-        weight: 0
-        widget:
-            type: homeassistant
-            url: http://192.168.1.252:8123
-            key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_HOME_ASSISTANT_API_KEY'] }}
-

ansible/app-configs/homepage/settings.yaml.j2

@@ -1,56 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/settings
-
-providers:
-  openweathermap: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_OPENWEATHERMAP_API_KEY'] }}
-  # weatherapi: weatherapiapikey
-title: Rinoa Dashboard (trez.WTF)
-headerStyle: underlined
-color: slate
-showStats: false
-statusStyle: "dot"
-favicon: /icons/favicon.ico
-useEqualHeights: true
-hideErrors: false
-searchDescriptions: true
-showSearchSuggestions: true
-provider: duckduckgo
-
-layout:
-  System Administration:
-    style: row
-    columns: 4
-  Infrastructure/App Performance Monitoring:
-    style: row
-    columns: 3
-  Code/DevOps:
-    style: row
-    columns: 3
-  Social:
-    style: row
-    columns: 4
-  Lifestyle:
-    style: row
-    columns: 3
-  Automation:
-    style: row
-    columns: 5
-  Privacy/Security:
-    style: row
-    columns: 5
-  Personal/Professional Services:
-    style: row
-    columns: 5
-  Servarr Stack:
-    style: row
-    columns: 3
-  Downloaders:
-    style: row
-    columns: 2
-  Media Library:
-    style: row
-    columns: 3

ansible/app-configs/homepage/widgets.yaml.j2

@@ -1,33 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/widgets
-
-- resources:
-    label: System
-    cpu: true
-    memory: true
-    cputemp: true
-    uptime: true
-
-- resources:
-    label: Storage
-    expanded: true
-    disk:
-        - /
-        - /rinoa-storage
-
-- search:
-    provider: custom
-    url: https://search.trez.wtf/search?q=
-    target: _blank
-
-- openweathermap:
-    label: New York
-    latitude: 40.72
-    longitude: -73.85
-    units: imperial
-    provider: openweathermap
-    cache: 10

ansible/app-configs/homepage_bookmarks.yaml.j2

@@ -1,22 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/bookmarks
-
-#- Developer:
-#    - Github:
-#        - abbr: GH
-#          href: https://github.com/
-#
-#- Social:
-#    - Reddit:
-#        - abbr: RE
-#          href: https://reddit.com/
-#
-#- Entertainment:
-#    - YouTube:
-#        - abbr: YT
-#          href: https://youtube.com/

ansible/app-configs/homepage_docker.yaml.j2

@@ -1,15 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/docker/
-
-# my-docker:
-#   host: 127.0.0.1
-#   port: 2375
-
- my-docker:
-   host: dockerproxy
-   port: 2375

ansible/app-configs/homepage_kubernetes.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-
----
-# sample kubernetes config

ansible/app-configs/homepage_services.yaml.j2

@@ -1,33 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/services
-
-#- My First Group:
-#    - My First Service:
-#        href: http://localhost/
-#        description: Homepage is awesome
-#
-#- My Second Group:
-#    - My Second Service:
-#        href: http://localhost/
-#        description: Homepage is the best
-#
-#- My Third Group:
-#    - My Third Service:
-#        href: http://localhost/
-#        description: Homepage is 😎
-
-- Automation:
-    - Home Assistant (Rikku):
-        href: https://ha.trez.wtf
-        description: Smart Home
-        icon: home-assistant.png
-        weight: 0
-        widget:
-            type: homeassistant
-            url: http://192.168.1.252:8123
-            key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_HOME_ASSISTANT_API_KEY'] }}
-

ansible/app-configs/homepage_settings.yaml.j2

@@ -1,56 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/settings
-
-providers:
-  openweathermap: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_OPENWEATHERMAP_API_KEY'] }}
-  # weatherapi: weatherapiapikey
-title: Rinoa Dashboard (trez.WTF)
-headerStyle: underlined
-color: slate
-showStats: false
-statusStyle: "dot"
-favicon: /icons/favicon.ico
-useEqualHeights: true
-hideErrors: false
-searchDescriptions: true
-showSearchSuggestions: true
-provider: duckduckgo
-
-layout:
-  System Administration:
-    style: row
-    columns: 4
-  Infrastructure/App Performance Monitoring:
-    style: row
-    columns: 3
-  Code/DevOps:
-    style: row
-    columns: 3
-  Social:
-    style: row
-    columns: 4
-  Lifestyle:
-    style: row
-    columns: 3
-  Automation:
-    style: row
-    columns: 5
-  Privacy/Security:
-    style: row
-    columns: 5
-  Personal/Professional Services:
-    style: row
-    columns: 5
-  Servarr Stack:
-    style: row
-    columns: 3
-  Downloaders:
-    style: row
-    columns: 2
-  Media Library:
-    style: row
-    columns: 3

ansible/app-configs/homepage_widgets.yaml.j2

@@ -1,33 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
----
-# For configuration options and examples, please see:
-# https://gethomepage.dev/en/configs/widgets
-
-- resources:
-    label: System
-    cpu: true
-    memory: true
-    cputemp: true
-    uptime: true
-
-- resources:
-    label: Storage
-    expanded: true
-    disk:
-        - /
-        - /rinoa-storage
-
-- search:
-    provider: custom
-    url: https://search.trez.wtf/search?q=
-    target: _blank
-
-- openweathermap:
-    label: New York
-    latitude: 40.72
-    longitude: -73.85
-    units: imperial
-    provider: openweathermap
-    cache: 10

ansible/app-configs/invidious/config.yml.j2

@@ -1,952 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-#########################################
-#
-#  Database and other external servers
-#
-#########################################
-
-##
-## Database configuration with separate parameters.
-## This setting is MANDATORY, unless 'database_url' is used.
-##
-db:
-  user: kemal
-  host: invidious-db
-  port: 5432
-  dbname: invidious
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_PG_DB_PASSWORD'] }}
-
-##
-## Database configuration using a single URI. This is an
-## alternative to the 'db' parameter above. If both forms
-## are used, then only database_url is used.
-## This setting is MANDATORY, unless 'db' is used.
-##
-## Note: The 'database_url' setting allows the use of UNIX
-## sockets. To do so, remove the IP address (or FQDN) and port
-## and append the 'host' parameter. E.g:
-##   postgres://kemal:kemal@/invidious?host=/var/run/postgresql
-##
-## Accepted values: a postgres:// URI
-## Default: postgres://kemal:kemal@localhost:5432/invidious
-##
-#database_url: postgres://kemal:kemal@localhost:5432/invidious
-
-##
-## Enable automatic table integrity check. This will create
-## the required tables and columns if anything is missing.
-##
-## Accepted values: true, false
-## Default: false
-##
-check_tables: true
-
-
-##
-## Path to an external signature resolver, used to emulate
-## the Youtube client's Javascript. If no such server is
-## available, some videos will not be playable.
-##
-## When this setting is commented out, no external
-## resolver will be used.
-##
-## Accepted values: a path to a UNIX socket or "<IP>:<Port>"
-## Default: <none>
-##
-signature_server: invidious-sig-helper:12999
-
-
-#########################################
-#
-#  Server config
-#
-#########################################
-
-# -----------------------------
-#  Network (inbound)
-# -----------------------------
-
-##
-## Port to listen on for incoming connections.
-##
-## Note: Ports lower than 1024 requires either root privileges
-## (not recommended) or the "CAP_NET_BIND_SERVICE" capability
-## (See https://stackoverflow.com/a/414258 and `man capabilities`)
-##
-## Accepted values: 1-65535
-## Default: 3000
-##
-#port: 3000
-
-##
-## When the invidious instance is behind a proxy, and the proxy
-## listens on a different port than the instance does, this lets
-## invidious know about it. This is used to craft absolute URLs
-## to the instance (e.g in the API).
-##
-## Note: This setting is MANDATORY if invidious is behind a
-## reverse proxy.
-##
-## Accepted values: 1-65535
-## Default: <none>
-##
-#external_port:
-
-##
-## Interface address to listen on for incoming connections.
-##
-## Accepted values: a valid IPv4 or IPv6 address.
-## default: 0.0.0.0  (listen on all interfaces)
-##
-#host_binding: 0.0.0.0
-
-##
-## Domain name under which this instance is hosted. This is
-## used to craft absolute URLs to the instance (e.g in the API).
-## The domain MUST be defined if your instance is accessed from
-## a domain name (like 'example.com').
-##
-## Accepted values: a fully qualified domain name (FQDN)
-## Default: <none>
-##
-# domain:
-
-##
-## Tell Invidious that it is behind a proxy that provides only
-## HTTPS, so all links must use the https:// scheme. This
-## setting MUST be set to true if invidious is behind a
-## reverse proxy serving HTTPs.
-##
-## Accepted values: true, false
-## Default: false
-##
-https_only: false
-
-##
-## Enable/Disable 'Strict-Transport-Security'. Make sure that
-## the domain specified under 'domain' is served securely.
-##
-## Accepted values: true, false
-## Default: true
-##
-#hsts: true
-
-
-# -----------------------------
-#  Network (outbound)
-# -----------------------------
-
-##
-## Disable proxying server-wide. Can be disable as a whole, or
-## only for a single function.
-##
-## Accepted values: true, false, dash, livestreams, downloads, local
-## Default: false
-##
-#disable_proxy: false
-
-##
-## Size of the HTTP pool used to connect to youtube. Each
-## domain ('youtube.com', 'ytimg.com', ...) has its own pool.
-##
-## Accepted values: a positive integer
-## Default: 100
-##
-#pool_size: 100
-
-
-##
-## Additional cookies to be sent when requesting the youtube API.
-##
-## Accepted values: a string in the format "name1=value1; name2=value2..."
-## Default: <none>
-##
-#cookies:
-
-##
-## Force connection to youtube over a specific IP family.
-##
-## Note: This may sometimes resolve issues involving rate-limiting.
-## See https://github.com/ytdl-org/youtube-dl/issues/21729.
-##
-## Accepted values: ipv4, ipv6
-## Default: <none>
-##
-#force_resolve:
-
-##
-## Configuration for using a HTTP proxy
-##
-## If unset, then no HTTP proxy will be used.
-## 
-#http_proxy:
-#  user:
-#  password:
-#  host:
-#  port:
-
-
-##
-## Use Innertube's transcripts API instead of timedtext for closed captions
-##
-## Useful for larger instances as InnerTube is **not ratelimited**. See https://github.com/iv-org/invidious/issues/2567
-##
-## Subtitle experience may differ slightly on Invidious.
-##
-## Accepted values: true, false
-## Default: false
-##
-# use_innertube_for_captions: false
-
-##
-## Send Google session informations. This is useful when Invidious is blocked
-## by the message "This helps protect our community."
-## See https://github.com/iv-org/invidious/issues/4734.
-##
-## Warning: These strings gives much more identifiable information to Google!
-##
-## Accepted values: String
-## Default: <none>
-##
-po_token: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_PO_TOKEN'] }}
-visitor_data: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_VISITOR_DATA'] }}
-
-# -----------------------------
-#  Logging
-# -----------------------------
-
-##
-## Path to log file. Can be absolute or relative to the invidious
-## binary. This is overridden if "-o OUTPUT" or "--output=OUTPUT"
-## are passed on the command line.
-##
-## Accepted values: a filesystem path or 'STDOUT'
-## Default: STDOUT
-##
-#output: STDOUT
-
-##
-## Logging Verbosity. This is overridden if "-l LEVEL" or
-## "--log-level=LEVEL" are passed on the command line.
-##
-## Accepted values: All, Trace, Debug, Info, Warn, Error, Fatal, Off
-## Default: Info
-##
-#log_level: Info
-
-##
-## Enables colors in logs. Useful for debugging purposes
-## This is overridden if "-k" or "--colorize"
-## are passed on the command line.
-## Colors are also disabled if the environment variable
-## NO_COLOR is present and has any value
-##
-## Accepted values: true, false
-## Default: true
-##
-#colorize_logs: false
-
-# -----------------------------
-#  Features
-# -----------------------------
-
-##
-## Enable/Disable the "Popular" tab on the main page.
-##
-## Accepted values: true, false
-## Default: true
-##
-#popular_enabled: true
-
-##
-## Enable/Disable statstics (available at /api/v1/stats).
-## The following data is available:
-##   - Software name ("invidious") and version+branch (same data as
-##     displayed in the footer, e.g: "2021.05.13-75e5b49" / "master")
-##   - The value of the 'registration_enabled' config (true/false)
-##   - Number of currently registered users
-##   - Number of registered users who connected in the last month
-##   - Number of registered users who connected in the last 6 months
-##   - Timestamp of the last server restart
-##   - Timestamp of the last "Channel Refresh" job execution
-##
-## Warning: This setting MUST be set to true if you plan to run
-## a public instance. It is used by api.invidious.io to refresh
-## your instance's status.
-##
-## Accepted values: true, false
-## Default: false
-##
-#statistics_enabled: false
-
-
-# -----------------------------
-#  Users and accounts
-# -----------------------------
-
-##
-## Allow/Forbid Invidious (local) account creation. Invidious
-## accounts allow users to subscribe to channels and to create
-## playlists without a Google account.
-##
-## Accepted values: true, false
-## Default: true
-##
-#registration_enabled: true
-
-##
-## Allow/Forbid users to log-in.
-##
-## Accepted values: true, false
-## Default: true
-##
-#login_enabled: true
-
-##
-## Enable/Disable the captcha challenge on the login page.
-##
-## Note: this is a basic captcha challenge that doesn't
-## depend on any third parties.
-##
-## Accepted values: true, false
-## Default: true
-##
-#captcha_enabled: true
-
-##
-## List of usernames that will be granted administrator rights.
-## A user with administrator rights will be able to change the
-## server configuration options listed below in /preferences,
-## in addition to the usual user preferences.
-##
-## Server-wide settings:
-##   - popular_enabled
-##   - captcha_enabled
-##   - login_enabled
-##   - registration_enabled
-##   - statistics_enabled
-## Default user preferences:
-##   - default_home
-##   - feed_menu
-##
-## Accepted values: an array of strings
-## Default: [""]
-##
-#admins: [""]
-
-##
-## Enable/Disable the user notifications for all users
-##
-## Note: On large instances, it is recommended to set this option to 'false'
-## in order to reduce the amount of data written to the database, and hence
-## improve the overall performance of the instance.
-##
-## Accepted values: true, false
-## Default: true
-##
-#enable_user_notifications: true
-
-# -----------------------------
-#  Background jobs
-# -----------------------------
-
-##
-## Number of threads to use when crawling channel videos (during
-## subscriptions update).
-##
-## Notes: This setting is overridden if either "-c THREADS" or
-## "--channel-threads=THREADS" is passed on the command line.
-##
-## Accepted values: a positive integer
-## Default: 1
-##
-channel_threads: 1
-
-##
-## Time interval between two executions of the job that crawls
-## channel videos (subscriptions update).
-##
-## Accepted values: a valid time interval (like 1h30m or 90m)
-## Default: 30m
-##
-#channel_refresh_interval: 30m
-
-##
-## Forcefully dump and re-download the entire list of uploaded
-## videos when crawling channel (during subscriptions update).
-##
-## Accepted values: true, false
-## Default: false
-##
-full_refresh: false
-
-##
-## Number of threads to use when updating RSS feeds.
-##
-## Notes: This setting is overridden if either "-f THREADS" or
-## "--feed-threads=THREADS" is passed on the command line.
-##
-## Accepted values: a positive integer
-## Default: 1
-##
-feed_threads: 1
-
-
-jobs:
-
-  ## Options for the database cleaning job
-  clear_expired_items:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-  ## Options for the channels updater job
-  refresh_channels:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-  ## Options for the RSS feeds updater job
-  refresh_feeds:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-
-# -----------------------------
-#  Miscellaneous
-# -----------------------------
-
-##
-## custom banner displayed at the top of every page. This can
-## used for instance announcements, e.g.
-##
-## Accepted values: any string. HTML is accepted.
-## Default: <none>
-##
-#banner:
-
-##
-## Subscribe to channels using PubSubHub (Google PubSubHubbub service).
-## PubSubHub allows Invidious to be instantly notified when a new video
-## is published on any subscribed channels. When PubSubHub is not used,
-## Invidious will check for new videos every minute.
-##
-## Note: This setting is recommended for public instances.
-##
-## Note 2:
-##  - Requires a public instance (it uses /feed/webhook/v1)
-##  - Requires 'domain' and 'hmac_key' to be set.
-##  - Setting this parameter to any number greater than zero will
-##    enable channel subscriptions via PubSubHub, but will limit the
-##    amount of concurrent subscriptions.
-##
-## Accepted values: true, false, a positive integer
-## Default: false
-##
-#use_pubsub_feeds: false
-
-##
-## HMAC signing key used for CSRF tokens, cookies and pubsub
-## subscriptions verification.
-##
-## Note: This parameter is mandatory and should be a random string.
-## Such random string can be generated on linux with the following
-## command: `pwgen 20 1`
-##
-## Accepted values: a string
-## Default: <none>
-##
-hmac_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_HMAC_KEY'] }}
-
-##
-## List of video IDs where the "download" widget must be
-## disabled, in order to comply with DMCA requests.
-##
-## Accepted values: an array of string
-## Default: <none>
-##
-#dmca_content:
-
-##
-## Cache video annotations in the database.
-##
-## Warning: empty annotations or annotations that only contain
-## cards won't be cached.
-##
-## Accepted values: true, false
-## Default: false
-##
-#cache_annotations: false
-
-##
-## Source code URL. If your instance is running a modified source
-## code, you MUST publish it somewhere and set this option.
-##
-## Accepted values: a string
-## Default: <none>
-##
-#modified_source_code_url: ""
-
-##
-## Maximum custom playlist length limit.
-##
-## Accepted values: Integer
-## Default: 500
-##
-#playlist_length_limit: 500
-
-#########################################
-#
-#  Default user preferences
-#
-#########################################
-
-##
-## NOTE: All the settings below define the default user
-## preferences. They will apply to ALL users connecting
-## without a preferences cookie (so either on the first
-## connection to the instance or after clearing the
-## browser's cookies).
-##
-
-default_user_preferences:
-
-  # -----------------------------
-  #  Internationalization
-  # -----------------------------
-
-  ##
-  ## Default user interface language (locale).
-  ##
-  ## Note: When hosting a public instance, overriding the
-  ## default (english) is not recommended, as it may
-  ## people using other languages.
-  ##
-  ## Accepted values:
-  ##   ar      (Arabic)
-  ##   da      (Danish)
-  ##   de      (German)
-  ##   en-US   (english, US)
-  ##   el      (Greek)
-  ##   eo      (Esperanto)
-  ##   es      (Spanish)
-  ##   fa      (Persian)
-  ##   fi      (Finnish)
-  ##   fr      (French)
-  ##   he      (Hebrew)
-  ##   hr      (Hungarian)
-  ##   id      (Indonesian)
-  ##   is      (Icelandic)
-  ##   it      (Italian)
-  ##   ja      (Japanese)
-  ##   nb-NO   (Norwegian, Bokmål)
-  ##   nl      (Dutch)
-  ##   pl      (Polish)
-  ##   pt-BR   (Portuguese, Brazil)
-  ##   pt-PT   (Portuguese, Portugal)
-  ##   ro      (Romanian)
-  ##   ru      (Russian)
-  ##   sv      (Swedish)
-  ##   tr      (Turkish)
-  ##   uk      (Ukrainian)
-  ##   zh-CN   (Chinese, China)  (a.k.a "Simplified Chinese")
-  ##   zh-TW   (Chinese, Taiwan) (a.k.a "Traditional Chinese")
-  ##
-  ## Default: en-US
-  ##
-  #locale: en-US
-
-  ##
-  ## Default geographical location for content.
-  ##
-  ## Accepted values:
-  ##   AE, AR, AT, AU, AZ, BA, BD, BE, BG, BH, BO, BR, BY, CA, CH, CL, CO, CR,
-  ##   CY, CZ, DE, DK, DO, DZ, EC, EE, EG, ES, FI, FR, GB, GE, GH, GR, GT, HK,
-  ##   HN, HR, HU, ID, IE, IL, IN, IQ, IS, IT, JM, JO, JP, KE, KR, KW, KZ, LB,
-  ##   LI, LK, LT, LU, LV, LY, MA, ME, MK, MT, MX, MY, NG, NI, NL, NO, NP, NZ,
-  ##   OM, PA, PE, PG, PH, PK, PL, PR, PT, PY, QA, RO, RS, RU, SA, SE, SG, SI,
-  ##   SK, SN, SV, TH, TN, TR, TW, TZ, UA, UG, US, UY, VE, VN, YE, ZA, ZW
-  ##
-  ## Default: US
-  ##
-  #region: US
-
-  ##
-  ## Top 3 preferred languages for video captions.
-  ##
-  ## Note: overriding the default (no preferred
-  ## caption language) is not recommended, in order
-  ## to not penalize people using other languages.
-  ##
-  ## Accepted values: a three-entries array.
-  ## Each entry can be one of:
-  ##   "English", "English (auto-generated)",
-  ##   "Afrikaans", "Albanian", "Amharic", "Arabic",
-  ##   "Armenian", "Azerbaijani", "Bangla", "Basque",
-  ##   "Belarusian", "Bosnian", "Bulgarian", "Burmese",
-  ##   "Catalan", "Cebuano", "Chinese (Simplified)",
-  ##   "Chinese (Traditional)", "Corsican", "Croatian",
-  ##   "Czech", "Danish", "Dutch", "Esperanto", "Estonian",
-  ##   "Filipino", "Finnish", "French", "Galician", "Georgian",
-  ##   "German", "Greek", "Gujarati", "Haitian Creole", "Hausa",
-  ##   "Hawaiian", "Hebrew", "Hindi", "Hmong", "Hungarian",
-  ##   "Icelandic", "Igbo", "Indonesian", "Irish", "Italian",
-  ##   "Japanese", "Javanese", "Kannada", "Kazakh", "Khmer",
-  ##   "Korean", "Kurdish", "Kyrgyz", "Lao", "Latin", "Latvian",
-  ##   "Lithuanian", "Luxembourgish", "Macedonian",
-  ##   "Malagasy", "Malay", "Malayalam", "Maltese", "Maori",
-  ##   "Marathi", "Mongolian", "Nepali", "Norwegian Bokmål",
-  ##   "Nyanja", "Pashto", "Persian", "Polish", "Portuguese",
-  ##   "Punjabi", "Romanian", "Russian", "Samoan",
-  ##   "Scottish Gaelic", "Serbian", "Shona", "Sindhi",
-  ##   "Sinhala", "Slovak", "Slovenian", "Somali",
-  ##   "Southern Sotho", "Spanish", "Spanish (Latin America)",
-  ##   "Sundanese",  "Swahili", "Swedish", "Tajik", "Tamil",
-  ##   "Telugu", "Thai", "Turkish", "Ukrainian", "Urdu",
-  ##   "Uzbek", "Vietnamese", "Welsh", "Western Frisian",
-  ##   "Xhosa", "Yiddish", "Yoruba", "Zulu"
-  ##
-  ## Default: ["", "", ""]
-  ##
-  #captions: ["", "", ""]
-
-
-  # -----------------------------
-  #  Interface
-  # -----------------------------
-
-  ##
-  ## Enable/Disable dark mode.
-  ##
-  ## Accepted values: "dark", "light", "auto"
-  ## Default: "auto"
-  ##
-  #dark_mode: "auto"
-
-  ##
-  ## Enable/Disable thin mode (no video thumbnails).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #thin_mode: false
-
-  ##
-  ## List of feeds available on the home page.
-  ##
-  ## Note: "Subscriptions" and "Playlists" are only visible
-  ## when the user is logged in.
-  ##
-  ## Accepted values: A list of strings
-  ## Each entry can be one of: "Popular", "Trending",
-  ##    "Subscriptions", "Playlists"
-  ##
-  ## Default: ["Popular", "Trending", "Subscriptions", "Playlists"]  (show all feeds)
-  ##
-  #feed_menu: ["Popular", "Trending", "Subscriptions", "Playlists"]
-
-  ##
-  ## Default feed to display on the home page.
-  ##
-  ## Note: setting this option to "Popular" has no
-  ## effect when 'popular_enabled' is set to false.
-  ##
-  ## Accepted values: Popular, Trending, Subscriptions, Playlists, <none>
-  ## Default: Popular
-  ##
-  #default_home: Popular
-
-  ##
-  ## Default number of results to display per page.
-  ##
-  ## Note: this affects invidious-generated pages only, such
-  ## as watch history and subscription feeds. Playlists, search
-  ## results and channel videos depend on the data returned by
-  ## the Youtube API.
-  ##
-  ## Accepted values: any positive integer
-  ## Default: 40
-  ##
-  #max_results: 40
-
-  ##
-  ## Show/hide annotations.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #annotations: false
-
-  ##
-  ## Show/hide annotation.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #annotations_subscribed: false
-
-  ##
-  ## Type of comments to display below video.
-  ##
-  ## Accepted values: a two-entries array.
-  ## Each entry can be one of: "youtube", "reddit", ""
-  ##
-  ## Default: ["youtube", ""]
-  ##
-  #comments: ["youtube", ""]
-
-  ##
-  ## Default player style.
-  ##
-  ## Accepted values: invidious, youtube
-  ## Default: invidious
-  ##
-  #player_style: invidious
-
-  ##
-  ## Show/Hide the "related videos" sidebar when
-  ## watching a video.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #related_videos: true
-
-
-  # -----------------------------
-  #  Video player behavior
-  # -----------------------------
-
-  ##
-  ## This option controls the value of the HTML5 <video> element's
-  ## "preload" attribute.
-  ##
-  ## If set to 'false', no video data will be loaded until the user
-  ## explicitly starts the video by clicking the "Play" button.
-  ## If set to 'true', the web browser will buffer some video data
-  ## while the page is loading.
-  ##
-  ## See: https://www.w3schools.com/tags/att_video_preload.asp
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #preload: true
-
-  ##
-  ## Automatically play videos on page load.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #autoplay: false
-
-  ##
-  ## Automatically load the "next" video (either next in
-  ## playlist or proposed) when the current video ends.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #continue: false
-
-  ##
-  ## Autoplay next video by default.
-  ##
-  ## Note: Only effective if 'continue' is set to true.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #continue_autoplay: true
-
-  ##
-  ## Play videos in Audio-only mode by default.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #listen: false
-
-  ##
-  ## Loop videos automatically.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #video_loop: false
-
-
-  # -----------------------------
-  #  Video playback settings
-  # -----------------------------
-
-  ##
-  ## Default video quality.
-  ##
-  ## Accepted values: dash, hd720, medium, small
-  ## Default: hd720
-  ##
-  #quality: hd720
-
-  ##
-  ## Default dash video quality.
-  ##
-  ## Note: this setting only takes effet if the
-  ## 'quality' parameter is set to "dash".
-  ##
-  ## Accepted values:
-  ##    auto, best, 4320p, 2160p, 1440p, 1080p,
-  ##    720p, 480p, 360p, 240p, 144p, worst
-  ## Default: auto
-  ##
-  #quality_dash: auto
-
-  ##
-  ## Default video playback speed.
-  ##
-  ## Accepted values: 0.25, 0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0
-  ## Default: 1.0
-  ##
-  #speed: 1.0
-
-  ##
-  ## Default volume.
-  ##
-  ## Accepted values: 0-100
-  ## Default: 100
-  ##
-  #volume: 100
-
-  ##
-  ## Allow 360° videos to be played.
-  ##
-  ## Note: This feature requires a WebGL-enabled browser.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #vr_mode: true
-  
-  ##
-  ## Save the playback position
-  ## Allow to continue watching at the previous position when
-  ## watching the same video.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #save_player_pos: false
-
-  # -----------------------------
-  #  Subscription feed
-  # -----------------------------
-
-  ##
-  ## In the "Subscription" feed, only show the latest video
-  ## of each channel the user is subscribed to.
-  ##
-  ## Note: when combined with 'unseen_only', the latest unseen
-  ## video of each channel will be displayed instead of the
-  ## latest by date.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #latest_only: false
-
-  ##
-  ## Enable/Disable user subscriptions desktop notifications.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #notifications_only: false
-
-  ##
-  ## In the "Subscription" feed, Only show the videos that the
-  ## user haven't watched yet (i.e which are not in their watch
-  ## history).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #unseen_only: false
-
-  ##
-  ## Default sorting parameter for subscription feeds.
-  ##
-  ## Accepted values:
-  ##   'alphabetically'
-  ##   'alphabetically - reverse'
-  ##   'channel name'
-  ##   'channel name - reverse'
-  ##   'published'
-  ##   'published - reverse'
-  ##
-  ## Default: published
-  ##
-  #sort: published
-
-
-  # -----------------------------
-  #  Miscellaneous
-  # -----------------------------
-
-  ##
-  ## Proxy videos through instance by default.
-  ##
-  ## Warning: As most users won't change this setting in their
-  ## preferences, defaulting  to true will significantly
-  ## increase the instance's network usage, so make sure that
-  ## your server's connection can handle it.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #local: false
-
-  ##
-  ## Show the connected user's nick at the top right.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #show_nick: true
-
-  ##
-  ## Automatically redirect to a random instance when the user uses
-  ## any "switch invidious instance" link (For videos, it's the plane
-  ## icon, next to "watch on youtube" and "listen"). When set to false,
-  ## the user is sent to https://redirect.invidious.io instead, where
-  ## they can manually select an instance.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #automatic_instance_redirect: false
-
-  ##
-  ## Show the entire video description by default (when set to 'false',
-  ## only the first few lines of the description are shown and a
-  ## "show more" button allows to expand it).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #extend_desc: false

ansible/app-configs/invidious_config.yml.j2

@@ -1,952 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-#########################################
-#
-#  Database and other external servers
-#
-#########################################
-
-##
-## Database configuration with separate parameters.
-## This setting is MANDATORY, unless 'database_url' is used.
-##
-db:
-  user: kemal
-  host: invidious-db
-  port: 5432
-  dbname: invidious
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_PG_DB_PASSWORD'] }}
-
-##
-## Database configuration using a single URI. This is an
-## alternative to the 'db' parameter above. If both forms
-## are used, then only database_url is used.
-## This setting is MANDATORY, unless 'db' is used.
-##
-## Note: The 'database_url' setting allows the use of UNIX
-## sockets. To do so, remove the IP address (or FQDN) and port
-## and append the 'host' parameter. E.g:
-##   postgres://kemal:kemal@/invidious?host=/var/run/postgresql
-##
-## Accepted values: a postgres:// URI
-## Default: postgres://kemal:kemal@localhost:5432/invidious
-##
-#database_url: postgres://kemal:kemal@localhost:5432/invidious
-
-##
-## Enable automatic table integrity check. This will create
-## the required tables and columns if anything is missing.
-##
-## Accepted values: true, false
-## Default: false
-##
-check_tables: true
-
-
-##
-## Path to an external signature resolver, used to emulate
-## the Youtube client's Javascript. If no such server is
-## available, some videos will not be playable.
-##
-## When this setting is commented out, no external
-## resolver will be used.
-##
-## Accepted values: a path to a UNIX socket or "<IP>:<Port>"
-## Default: <none>
-##
-signature_server: invidious-sig-helper:12999
-
-
-#########################################
-#
-#  Server config
-#
-#########################################
-
-# -----------------------------
-#  Network (inbound)
-# -----------------------------
-
-##
-## Port to listen on for incoming connections.
-##
-## Note: Ports lower than 1024 requires either root privileges
-## (not recommended) or the "CAP_NET_BIND_SERVICE" capability
-## (See https://stackoverflow.com/a/414258 and `man capabilities`)
-##
-## Accepted values: 1-65535
-## Default: 3000
-##
-#port: 3000
-
-##
-## When the invidious instance is behind a proxy, and the proxy
-## listens on a different port than the instance does, this lets
-## invidious know about it. This is used to craft absolute URLs
-## to the instance (e.g in the API).
-##
-## Note: This setting is MANDATORY if invidious is behind a
-## reverse proxy.
-##
-## Accepted values: 1-65535
-## Default: <none>
-##
-#external_port:
-
-##
-## Interface address to listen on for incoming connections.
-##
-## Accepted values: a valid IPv4 or IPv6 address.
-## default: 0.0.0.0  (listen on all interfaces)
-##
-#host_binding: 0.0.0.0
-
-##
-## Domain name under which this instance is hosted. This is
-## used to craft absolute URLs to the instance (e.g in the API).
-## The domain MUST be defined if your instance is accessed from
-## a domain name (like 'example.com').
-##
-## Accepted values: a fully qualified domain name (FQDN)
-## Default: <none>
-##
-# domain:
-
-##
-## Tell Invidious that it is behind a proxy that provides only
-## HTTPS, so all links must use the https:// scheme. This
-## setting MUST be set to true if invidious is behind a
-## reverse proxy serving HTTPs.
-##
-## Accepted values: true, false
-## Default: false
-##
-https_only: false
-
-##
-## Enable/Disable 'Strict-Transport-Security'. Make sure that
-## the domain specified under 'domain' is served securely.
-##
-## Accepted values: true, false
-## Default: true
-##
-#hsts: true
-
-
-# -----------------------------
-#  Network (outbound)
-# -----------------------------
-
-##
-## Disable proxying server-wide. Can be disable as a whole, or
-## only for a single function.
-##
-## Accepted values: true, false, dash, livestreams, downloads, local
-## Default: false
-##
-#disable_proxy: false
-
-##
-## Size of the HTTP pool used to connect to youtube. Each
-## domain ('youtube.com', 'ytimg.com', ...) has its own pool.
-##
-## Accepted values: a positive integer
-## Default: 100
-##
-#pool_size: 100
-
-
-##
-## Additional cookies to be sent when requesting the youtube API.
-##
-## Accepted values: a string in the format "name1=value1; name2=value2..."
-## Default: <none>
-##
-#cookies:
-
-##
-## Force connection to youtube over a specific IP family.
-##
-## Note: This may sometimes resolve issues involving rate-limiting.
-## See https://github.com/ytdl-org/youtube-dl/issues/21729.
-##
-## Accepted values: ipv4, ipv6
-## Default: <none>
-##
-#force_resolve:
-
-##
-## Configuration for using a HTTP proxy
-##
-## If unset, then no HTTP proxy will be used.
-## 
-#http_proxy:
-#  user:
-#  password:
-#  host:
-#  port:
-
-
-##
-## Use Innertube's transcripts API instead of timedtext for closed captions
-##
-## Useful for larger instances as InnerTube is **not ratelimited**. See https://github.com/iv-org/invidious/issues/2567
-##
-## Subtitle experience may differ slightly on Invidious.
-##
-## Accepted values: true, false
-## Default: false
-##
-# use_innertube_for_captions: false
-
-##
-## Send Google session informations. This is useful when Invidious is blocked
-## by the message "This helps protect our community."
-## See https://github.com/iv-org/invidious/issues/4734.
-##
-## Warning: These strings gives much more identifiable information to Google!
-##
-## Accepted values: String
-## Default: <none>
-##
-po_token: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_PO_TOKEN'] }}
-visitor_data: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_VISITOR_DATA'] }}
-
-# -----------------------------
-#  Logging
-# -----------------------------
-
-##
-## Path to log file. Can be absolute or relative to the invidious
-## binary. This is overridden if "-o OUTPUT" or "--output=OUTPUT"
-## are passed on the command line.
-##
-## Accepted values: a filesystem path or 'STDOUT'
-## Default: STDOUT
-##
-#output: STDOUT
-
-##
-## Logging Verbosity. This is overridden if "-l LEVEL" or
-## "--log-level=LEVEL" are passed on the command line.
-##
-## Accepted values: All, Trace, Debug, Info, Warn, Error, Fatal, Off
-## Default: Info
-##
-#log_level: Info
-
-##
-## Enables colors in logs. Useful for debugging purposes
-## This is overridden if "-k" or "--colorize"
-## are passed on the command line.
-## Colors are also disabled if the environment variable
-## NO_COLOR is present and has any value
-##
-## Accepted values: true, false
-## Default: true
-##
-#colorize_logs: false
-
-# -----------------------------
-#  Features
-# -----------------------------
-
-##
-## Enable/Disable the "Popular" tab on the main page.
-##
-## Accepted values: true, false
-## Default: true
-##
-#popular_enabled: true
-
-##
-## Enable/Disable statstics (available at /api/v1/stats).
-## The following data is available:
-##   - Software name ("invidious") and version+branch (same data as
-##     displayed in the footer, e.g: "2021.05.13-75e5b49" / "master")
-##   - The value of the 'registration_enabled' config (true/false)
-##   - Number of currently registered users
-##   - Number of registered users who connected in the last month
-##   - Number of registered users who connected in the last 6 months
-##   - Timestamp of the last server restart
-##   - Timestamp of the last "Channel Refresh" job execution
-##
-## Warning: This setting MUST be set to true if you plan to run
-## a public instance. It is used by api.invidious.io to refresh
-## your instance's status.
-##
-## Accepted values: true, false
-## Default: false
-##
-#statistics_enabled: false
-
-
-# -----------------------------
-#  Users and accounts
-# -----------------------------
-
-##
-## Allow/Forbid Invidious (local) account creation. Invidious
-## accounts allow users to subscribe to channels and to create
-## playlists without a Google account.
-##
-## Accepted values: true, false
-## Default: true
-##
-#registration_enabled: true
-
-##
-## Allow/Forbid users to log-in.
-##
-## Accepted values: true, false
-## Default: true
-##
-#login_enabled: true
-
-##
-## Enable/Disable the captcha challenge on the login page.
-##
-## Note: this is a basic captcha challenge that doesn't
-## depend on any third parties.
-##
-## Accepted values: true, false
-## Default: true
-##
-#captcha_enabled: true
-
-##
-## List of usernames that will be granted administrator rights.
-## A user with administrator rights will be able to change the
-## server configuration options listed below in /preferences,
-## in addition to the usual user preferences.
-##
-## Server-wide settings:
-##   - popular_enabled
-##   - captcha_enabled
-##   - login_enabled
-##   - registration_enabled
-##   - statistics_enabled
-## Default user preferences:
-##   - default_home
-##   - feed_menu
-##
-## Accepted values: an array of strings
-## Default: [""]
-##
-#admins: [""]
-
-##
-## Enable/Disable the user notifications for all users
-##
-## Note: On large instances, it is recommended to set this option to 'false'
-## in order to reduce the amount of data written to the database, and hence
-## improve the overall performance of the instance.
-##
-## Accepted values: true, false
-## Default: true
-##
-#enable_user_notifications: true
-
-# -----------------------------
-#  Background jobs
-# -----------------------------
-
-##
-## Number of threads to use when crawling channel videos (during
-## subscriptions update).
-##
-## Notes: This setting is overridden if either "-c THREADS" or
-## "--channel-threads=THREADS" is passed on the command line.
-##
-## Accepted values: a positive integer
-## Default: 1
-##
-channel_threads: 1
-
-##
-## Time interval between two executions of the job that crawls
-## channel videos (subscriptions update).
-##
-## Accepted values: a valid time interval (like 1h30m or 90m)
-## Default: 30m
-##
-#channel_refresh_interval: 30m
-
-##
-## Forcefully dump and re-download the entire list of uploaded
-## videos when crawling channel (during subscriptions update).
-##
-## Accepted values: true, false
-## Default: false
-##
-full_refresh: false
-
-##
-## Number of threads to use when updating RSS feeds.
-##
-## Notes: This setting is overridden if either "-f THREADS" or
-## "--feed-threads=THREADS" is passed on the command line.
-##
-## Accepted values: a positive integer
-## Default: 1
-##
-feed_threads: 1
-
-
-jobs:
-
-  ## Options for the database cleaning job
-  clear_expired_items:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-  ## Options for the channels updater job
-  refresh_channels:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-  ## Options for the RSS feeds updater job
-  refresh_feeds:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-
-# -----------------------------
-#  Miscellaneous
-# -----------------------------
-
-##
-## custom banner displayed at the top of every page. This can
-## used for instance announcements, e.g.
-##
-## Accepted values: any string. HTML is accepted.
-## Default: <none>
-##
-#banner:
-
-##
-## Subscribe to channels using PubSubHub (Google PubSubHubbub service).
-## PubSubHub allows Invidious to be instantly notified when a new video
-## is published on any subscribed channels. When PubSubHub is not used,
-## Invidious will check for new videos every minute.
-##
-## Note: This setting is recommended for public instances.
-##
-## Note 2:
-##  - Requires a public instance (it uses /feed/webhook/v1)
-##  - Requires 'domain' and 'hmac_key' to be set.
-##  - Setting this parameter to any number greater than zero will
-##    enable channel subscriptions via PubSubHub, but will limit the
-##    amount of concurrent subscriptions.
-##
-## Accepted values: true, false, a positive integer
-## Default: false
-##
-#use_pubsub_feeds: false
-
-##
-## HMAC signing key used for CSRF tokens, cookies and pubsub
-## subscriptions verification.
-##
-## Note: This parameter is mandatory and should be a random string.
-## Such random string can be generated on linux with the following
-## command: `pwgen 20 1`
-##
-## Accepted values: a string
-## Default: <none>
-##
-hmac_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_HMAC_KEY'] }}
-
-##
-## List of video IDs where the "download" widget must be
-## disabled, in order to comply with DMCA requests.
-##
-## Accepted values: an array of string
-## Default: <none>
-##
-#dmca_content:
-
-##
-## Cache video annotations in the database.
-##
-## Warning: empty annotations or annotations that only contain
-## cards won't be cached.
-##
-## Accepted values: true, false
-## Default: false
-##
-#cache_annotations: false
-
-##
-## Source code URL. If your instance is running a modified source
-## code, you MUST publish it somewhere and set this option.
-##
-## Accepted values: a string
-## Default: <none>
-##
-#modified_source_code_url: ""
-
-##
-## Maximum custom playlist length limit.
-##
-## Accepted values: Integer
-## Default: 500
-##
-#playlist_length_limit: 500
-
-#########################################
-#
-#  Default user preferences
-#
-#########################################
-
-##
-## NOTE: All the settings below define the default user
-## preferences. They will apply to ALL users connecting
-## without a preferences cookie (so either on the first
-## connection to the instance or after clearing the
-## browser's cookies).
-##
-
-default_user_preferences:
-
-  # -----------------------------
-  #  Internationalization
-  # -----------------------------
-
-  ##
-  ## Default user interface language (locale).
-  ##
-  ## Note: When hosting a public instance, overriding the
-  ## default (english) is not recommended, as it may
-  ## people using other languages.
-  ##
-  ## Accepted values:
-  ##   ar      (Arabic)
-  ##   da      (Danish)
-  ##   de      (German)
-  ##   en-US   (english, US)
-  ##   el      (Greek)
-  ##   eo      (Esperanto)
-  ##   es      (Spanish)
-  ##   fa      (Persian)
-  ##   fi      (Finnish)
-  ##   fr      (French)
-  ##   he      (Hebrew)
-  ##   hr      (Hungarian)
-  ##   id      (Indonesian)
-  ##   is      (Icelandic)
-  ##   it      (Italian)
-  ##   ja      (Japanese)
-  ##   nb-NO   (Norwegian, Bokmål)
-  ##   nl      (Dutch)
-  ##   pl      (Polish)
-  ##   pt-BR   (Portuguese, Brazil)
-  ##   pt-PT   (Portuguese, Portugal)
-  ##   ro      (Romanian)
-  ##   ru      (Russian)
-  ##   sv      (Swedish)
-  ##   tr      (Turkish)
-  ##   uk      (Ukrainian)
-  ##   zh-CN   (Chinese, China)  (a.k.a "Simplified Chinese")
-  ##   zh-TW   (Chinese, Taiwan) (a.k.a "Traditional Chinese")
-  ##
-  ## Default: en-US
-  ##
-  #locale: en-US
-
-  ##
-  ## Default geographical location for content.
-  ##
-  ## Accepted values:
-  ##   AE, AR, AT, AU, AZ, BA, BD, BE, BG, BH, BO, BR, BY, CA, CH, CL, CO, CR,
-  ##   CY, CZ, DE, DK, DO, DZ, EC, EE, EG, ES, FI, FR, GB, GE, GH, GR, GT, HK,
-  ##   HN, HR, HU, ID, IE, IL, IN, IQ, IS, IT, JM, JO, JP, KE, KR, KW, KZ, LB,
-  ##   LI, LK, LT, LU, LV, LY, MA, ME, MK, MT, MX, MY, NG, NI, NL, NO, NP, NZ,
-  ##   OM, PA, PE, PG, PH, PK, PL, PR, PT, PY, QA, RO, RS, RU, SA, SE, SG, SI,
-  ##   SK, SN, SV, TH, TN, TR, TW, TZ, UA, UG, US, UY, VE, VN, YE, ZA, ZW
-  ##
-  ## Default: US
-  ##
-  #region: US
-
-  ##
-  ## Top 3 preferred languages for video captions.
-  ##
-  ## Note: overriding the default (no preferred
-  ## caption language) is not recommended, in order
-  ## to not penalize people using other languages.
-  ##
-  ## Accepted values: a three-entries array.
-  ## Each entry can be one of:
-  ##   "English", "English (auto-generated)",
-  ##   "Afrikaans", "Albanian", "Amharic", "Arabic",
-  ##   "Armenian", "Azerbaijani", "Bangla", "Basque",
-  ##   "Belarusian", "Bosnian", "Bulgarian", "Burmese",
-  ##   "Catalan", "Cebuano", "Chinese (Simplified)",
-  ##   "Chinese (Traditional)", "Corsican", "Croatian",
-  ##   "Czech", "Danish", "Dutch", "Esperanto", "Estonian",
-  ##   "Filipino", "Finnish", "French", "Galician", "Georgian",
-  ##   "German", "Greek", "Gujarati", "Haitian Creole", "Hausa",
-  ##   "Hawaiian", "Hebrew", "Hindi", "Hmong", "Hungarian",
-  ##   "Icelandic", "Igbo", "Indonesian", "Irish", "Italian",
-  ##   "Japanese", "Javanese", "Kannada", "Kazakh", "Khmer",
-  ##   "Korean", "Kurdish", "Kyrgyz", "Lao", "Latin", "Latvian",
-  ##   "Lithuanian", "Luxembourgish", "Macedonian",
-  ##   "Malagasy", "Malay", "Malayalam", "Maltese", "Maori",
-  ##   "Marathi", "Mongolian", "Nepali", "Norwegian Bokmål",
-  ##   "Nyanja", "Pashto", "Persian", "Polish", "Portuguese",
-  ##   "Punjabi", "Romanian", "Russian", "Samoan",
-  ##   "Scottish Gaelic", "Serbian", "Shona", "Sindhi",
-  ##   "Sinhala", "Slovak", "Slovenian", "Somali",
-  ##   "Southern Sotho", "Spanish", "Spanish (Latin America)",
-  ##   "Sundanese",  "Swahili", "Swedish", "Tajik", "Tamil",
-  ##   "Telugu", "Thai", "Turkish", "Ukrainian", "Urdu",
-  ##   "Uzbek", "Vietnamese", "Welsh", "Western Frisian",
-  ##   "Xhosa", "Yiddish", "Yoruba", "Zulu"
-  ##
-  ## Default: ["", "", ""]
-  ##
-  #captions: ["", "", ""]
-
-
-  # -----------------------------
-  #  Interface
-  # -----------------------------
-
-  ##
-  ## Enable/Disable dark mode.
-  ##
-  ## Accepted values: "dark", "light", "auto"
-  ## Default: "auto"
-  ##
-  #dark_mode: "auto"
-
-  ##
-  ## Enable/Disable thin mode (no video thumbnails).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #thin_mode: false
-
-  ##
-  ## List of feeds available on the home page.
-  ##
-  ## Note: "Subscriptions" and "Playlists" are only visible
-  ## when the user is logged in.
-  ##
-  ## Accepted values: A list of strings
-  ## Each entry can be one of: "Popular", "Trending",
-  ##    "Subscriptions", "Playlists"
-  ##
-  ## Default: ["Popular", "Trending", "Subscriptions", "Playlists"]  (show all feeds)
-  ##
-  #feed_menu: ["Popular", "Trending", "Subscriptions", "Playlists"]
-
-  ##
-  ## Default feed to display on the home page.
-  ##
-  ## Note: setting this option to "Popular" has no
-  ## effect when 'popular_enabled' is set to false.
-  ##
-  ## Accepted values: Popular, Trending, Subscriptions, Playlists, <none>
-  ## Default: Popular
-  ##
-  #default_home: Popular
-
-  ##
-  ## Default number of results to display per page.
-  ##
-  ## Note: this affects invidious-generated pages only, such
-  ## as watch history and subscription feeds. Playlists, search
-  ## results and channel videos depend on the data returned by
-  ## the Youtube API.
-  ##
-  ## Accepted values: any positive integer
-  ## Default: 40
-  ##
-  #max_results: 40
-
-  ##
-  ## Show/hide annotations.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #annotations: false
-
-  ##
-  ## Show/hide annotation.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #annotations_subscribed: false
-
-  ##
-  ## Type of comments to display below video.
-  ##
-  ## Accepted values: a two-entries array.
-  ## Each entry can be one of: "youtube", "reddit", ""
-  ##
-  ## Default: ["youtube", ""]
-  ##
-  #comments: ["youtube", ""]
-
-  ##
-  ## Default player style.
-  ##
-  ## Accepted values: invidious, youtube
-  ## Default: invidious
-  ##
-  #player_style: invidious
-
-  ##
-  ## Show/Hide the "related videos" sidebar when
-  ## watching a video.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #related_videos: true
-
-
-  # -----------------------------
-  #  Video player behavior
-  # -----------------------------
-
-  ##
-  ## This option controls the value of the HTML5 <video> element's
-  ## "preload" attribute.
-  ##
-  ## If set to 'false', no video data will be loaded until the user
-  ## explicitly starts the video by clicking the "Play" button.
-  ## If set to 'true', the web browser will buffer some video data
-  ## while the page is loading.
-  ##
-  ## See: https://www.w3schools.com/tags/att_video_preload.asp
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #preload: true
-
-  ##
-  ## Automatically play videos on page load.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #autoplay: false
-
-  ##
-  ## Automatically load the "next" video (either next in
-  ## playlist or proposed) when the current video ends.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #continue: false
-
-  ##
-  ## Autoplay next video by default.
-  ##
-  ## Note: Only effective if 'continue' is set to true.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #continue_autoplay: true
-
-  ##
-  ## Play videos in Audio-only mode by default.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #listen: false
-
-  ##
-  ## Loop videos automatically.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #video_loop: false
-
-
-  # -----------------------------
-  #  Video playback settings
-  # -----------------------------
-
-  ##
-  ## Default video quality.
-  ##
-  ## Accepted values: dash, hd720, medium, small
-  ## Default: hd720
-  ##
-  #quality: hd720
-
-  ##
-  ## Default dash video quality.
-  ##
-  ## Note: this setting only takes effet if the
-  ## 'quality' parameter is set to "dash".
-  ##
-  ## Accepted values:
-  ##    auto, best, 4320p, 2160p, 1440p, 1080p,
-  ##    720p, 480p, 360p, 240p, 144p, worst
-  ## Default: auto
-  ##
-  #quality_dash: auto
-
-  ##
-  ## Default video playback speed.
-  ##
-  ## Accepted values: 0.25, 0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0
-  ## Default: 1.0
-  ##
-  #speed: 1.0
-
-  ##
-  ## Default volume.
-  ##
-  ## Accepted values: 0-100
-  ## Default: 100
-  ##
-  #volume: 100
-
-  ##
-  ## Allow 360° videos to be played.
-  ##
-  ## Note: This feature requires a WebGL-enabled browser.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #vr_mode: true
-  
-  ##
-  ## Save the playback position
-  ## Allow to continue watching at the previous position when
-  ## watching the same video.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #save_player_pos: false
-
-  # -----------------------------
-  #  Subscription feed
-  # -----------------------------
-
-  ##
-  ## In the "Subscription" feed, only show the latest video
-  ## of each channel the user is subscribed to.
-  ##
-  ## Note: when combined with 'unseen_only', the latest unseen
-  ## video of each channel will be displayed instead of the
-  ## latest by date.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #latest_only: false
-
-  ##
-  ## Enable/Disable user subscriptions desktop notifications.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #notifications_only: false
-
-  ##
-  ## In the "Subscription" feed, Only show the videos that the
-  ## user haven't watched yet (i.e which are not in their watch
-  ## history).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #unseen_only: false
-
-  ##
-  ## Default sorting parameter for subscription feeds.
-  ##
-  ## Accepted values:
-  ##   'alphabetically'
-  ##   'alphabetically - reverse'
-  ##   'channel name'
-  ##   'channel name - reverse'
-  ##   'published'
-  ##   'published - reverse'
-  ##
-  ## Default: published
-  ##
-  #sort: published
-
-
-  # -----------------------------
-  #  Miscellaneous
-  # -----------------------------
-
-  ##
-  ## Proxy videos through instance by default.
-  ##
-  ## Warning: As most users won't change this setting in their
-  ## preferences, defaulting  to true will significantly
-  ## increase the instance's network usage, so make sure that
-  ## your server's connection can handle it.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #local: false
-
-  ##
-  ## Show the connected user's nick at the top right.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #show_nick: true
-
-  ##
-  ## Automatically redirect to a random instance when the user uses
-  ## any "switch invidious instance" link (For videos, it's the plane
-  ## icon, next to "watch on youtube" and "listen"). When set to false,
-  ## the user is sent to https://redirect.invidious.io instead, where
-  ## they can manually select an instance.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #automatic_instance_redirect: false
-
-  ##
-  ## Show the entire video description by default (when set to 'false',
-  ## only the first few lines of the description are shown and a
-  ## "show more" button allows to expand it).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #extend_desc: false

ansible/app-configs/invoice-ninja/invoice-ninja.env.j2

@@ -1,52 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-# IN application vars
-IN_APP_URL=https://biz.trez.wtf
-IN_APP_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['IN_APP_KEY'] }}
-IN_APP_DEBUG=true
-IN_REQUIRE_HTTPS=false
-IN_PHANTOMJS_PDF_GENERATION=false
-IN_PDF_GENERATOR=snappdf
-IN_TRUSTED_PROXIES='*'
-
-
-IN_QUEUE_CONNECTION=database
-
-# DB connection
-IN_DB_HOST=mariadb
-IN_DB_PORT=3306
-IN_DB_DATABASE=invoice_ninja
-IN_DB_USERNAME=ininja
-IN_DB_PASSWORD={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['IN_MYSQL_PASSWORD'] }}
-
-# Create initial user
-# Default to these values if empty
-# IN_USER_EMAIL=admin@example.com
-# IN_PASSWORD=changeme!
-IN_USER_EMAIL=
-IN_PASSWORD=
-
-# Mail options
-IN_MAIL_MAILER=log
-IN_MAIL_HOST=postal-smtp
-IN_MAIL_PORT=25
-IN_MAIL_USERNAME={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}
-IN_MAIL_PASSWORD={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}
-IN_MAIL_ENCRYPTION=null
-IN_MAIL_FROM_ADDRESS='noreply@trez.wtf'
-IN_MAIL_FROM_NAME='Treasured IT'
-
-# MySQL
-IN_MYSQL_ROOT_PASSWORD=ninjaAdm1nPassword
-IN_MYSQL_USER=ninja
-IN_MYSQL_PASSWORD=ninja
-IN_MYSQL_DATABASE=ninja
-
-# GoCardless/Nordigen API key for banking integration
-NORDIGEN_SECRET_ID=
-NORDIGEN_SECRET_KEY=
-
-# V4 env vars
-# DB_STRICT=false
-# APP_CIPHER=AES-256-CBC

ansible/app-configs/invoice-ninja_invoice-ninja.env.j2

@@ -1,52 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-# IN application vars
-IN_APP_URL=https://biz.trez.wtf
-IN_APP_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['IN_APP_KEY'] }}
-IN_APP_DEBUG=true
-IN_REQUIRE_HTTPS=false
-IN_PHANTOMJS_PDF_GENERATION=false
-IN_PDF_GENERATOR=snappdf
-IN_TRUSTED_PROXIES='*'
-
-
-IN_QUEUE_CONNECTION=database
-
-# DB connection
-IN_DB_HOST=mariadb
-IN_DB_PORT=3306
-IN_DB_DATABASE=invoice_ninja
-IN_DB_USERNAME=ininja
-IN_DB_PASSWORD={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['IN_MYSQL_PASSWORD'] }}
-
-# Create initial user
-# Default to these values if empty
-# IN_USER_EMAIL=admin@example.com
-# IN_PASSWORD=changeme!
-IN_USER_EMAIL=
-IN_PASSWORD=
-
-# Mail options
-IN_MAIL_MAILER=log
-IN_MAIL_HOST=postal-smtp
-IN_MAIL_PORT=25
-IN_MAIL_USERNAME={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}
-IN_MAIL_PASSWORD={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}
-IN_MAIL_ENCRYPTION=null
-IN_MAIL_FROM_ADDRESS='noreply@trez.wtf'
-IN_MAIL_FROM_NAME='Treasured IT'
-
-# MySQL
-IN_MYSQL_ROOT_PASSWORD=ninjaAdm1nPassword
-IN_MYSQL_USER=ninja
-IN_MYSQL_PASSWORD=ninja
-IN_MYSQL_DATABASE=ninja
-
-# GoCardless/Nordigen API key for banking integration
-NORDIGEN_SECRET_ID=
-NORDIGEN_SECRET_KEY=
-
-# V4 env vars
-# DB_STRICT=false
-# APP_CIPHER=AES-256-CBC

ansible/app-configs/librechat/librechat.env.j2

@@ -1,550 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-#=====================================================================#
-#                       LibreChat Configuration                       #
-#=====================================================================#
-# Please refer to the reference documentation for assistance          #
-# with configuring your LibreChat environment.                        #
-#                                                                     #
-# https://www.librechat.ai/docs/configuration/dotenv                  #
-#=====================================================================#
-
-#==================================================#
-#               Server Configuration               #
-#==================================================#
-
-HOST=localhost
-PORT=3080
-
-MONGO_URI=mongodb://librechat:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_MONGODB_PASSWORD'] }}@mongodb:27017/librechat?replicaSet=rinoa
-
-DOMAIN_CLIENT=https://ai.trez.wtf
-DOMAIN_SERVER=https://ai.trez.wtf
-
-NO_INDEX=true
-# Use the address that is at most n number of hops away from the Express application.
-# req.socket.remoteAddress is the first hop, and the rest are looked for in the X-Forwarded-For header from right to left.
-# A value of 0 means that the first untrusted address would be req.socket.remoteAddress, i.e. there is no reverse proxy.
-# Defaulted to 1.
-TRUST_PROXY=1
-
-#===============#
-# JSON Logging  #
-#===============#
-
-# Use when process console logs in cloud deployment like GCP/AWS
-CONSOLE_JSON=true
-
-#===============#
-# Debug Logging #
-#===============#
-
-DEBUG_LOGGING=true
-DEBUG_CONSOLE=false
-
-#=============#
-# Permissions #
-#=============#
-
-# UID=1000
-# GID=1000
-
-#===============#
-# Configuration #
-#===============#
-# Use an absolute path, a relative path, or a URL
-
-# CONFIG_PATH="/alternative/path/to/librechat.yaml"
-
-#===================================================#
-#                     Endpoints                     #
-#===================================================#
-
-# ENDPOINTS=openAI,assistants,azureOpenAI,google,gptPlugins,anthropic
-
-PROXY=
-
-#===================================#
-# Known Endpoints - librechat.yaml  #
-#===================================#
-# https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints
-
-# ANYSCALE_API_KEY=
-# APIPIE_API_KEY=
-# COHERE_API_KEY=
-DEEPSEEK_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_DEEPSEEK_API_KEY'] }}
-# DATABRICKS_API_KEY=
-# FIREWORKS_API_KEY=
-# GROQ_API_KEY=
-# HUGGINGFACE_TOKEN=
-MISTRAL_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_MISTRAL_API_KEY'] }}
-# OPENROUTER_KEY=
-# PERPLEXITY_API_KEY=
-# SHUTTLEAI_API_KEY=
-# TOGETHERAI_API_KEY=
-# UNIFY_API_KEY=
-# XAI_API_KEY=
-
-#============#
-# Anthropic  #
-#============#
-
-ANTHROPIC_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_ANTHROPIC_API_KEY'] }}
-ANTHROPIC_MODELS=claude-3-7-sonnet-latest,claude-3-7-sonnet-20250219,claude-3-5-haiku-20241022,claude-3-5-sonnet-20241022,claude-3-5-sonnet-latest,claude-3-5-sonnet-20240620,claude-3-opus-20240229,claude-3-sonnet-20240229,claude-3-haiku-20240307,claude-2.1,claude-2,claude-1.2,claude-1,claude-1-100k,claude-instant-1,claude-instant-1-100k
-# ANTHROPIC_REVERSE_PROXY=
-
-#============#
-# Azure      #
-#============#
-
-# Note: these variables are DEPRECATED
-# Use the `librechat.yaml` configuration for `azureOpenAI` instead
-# You may also continue to use them if you opt out of using the `librechat.yaml` configuration
-
-# AZURE_OPENAI_DEFAULT_MODEL=gpt-3.5-turbo # Deprecated
-# AZURE_OPENAI_MODELS=gpt-3.5-turbo,gpt-4 # Deprecated
-# AZURE_USE_MODEL_AS_DEPLOYMENT_NAME=TRUE # Deprecated
-# AZURE_API_KEY= # Deprecated
-# AZURE_OPENAI_API_INSTANCE_NAME= # Deprecated
-# AZURE_OPENAI_API_DEPLOYMENT_NAME= # Deprecated
-# AZURE_OPENAI_API_VERSION= # Deprecated
-# AZURE_OPENAI_API_COMPLETIONS_DEPLOYMENT_NAME= # Deprecated
-# AZURE_OPENAI_API_EMBEDDINGS_DEPLOYMENT_NAME= # Deprecated
-# PLUGINS_USE_AZURE="true" # Deprecated
-
-#=================#
-#   AWS Bedrock   #
-#=================#
-
-# BEDROCK_AWS_DEFAULT_REGION=us-east-1 # A default region must be provided
-# BEDROCK_AWS_ACCESS_KEY_ID=someAccessKey
-# BEDROCK_AWS_SECRET_ACCESS_KEY=someSecretAccessKey
-# BEDROCK_AWS_SESSION_TOKEN=someSessionToken
-
-# Note: This example list is not meant to be exhaustive. If omitted, all known, supported model IDs will be included for you.
-# BEDROCK_AWS_MODELS=anthropic.claude-3-5-sonnet-20240620-v1:0,meta.llama3-1-8b-instruct-v1:0
-
-# See all Bedrock model IDs here: https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns
-
-# Notes on specific models:
-# The following models are not support due to not supporting streaming:
-# ai21.j2-mid-v1
-
-# The following models are not support due to not supporting conversation history:
-# ai21.j2-ultra-v1, cohere.command-text-v14, cohere.command-light-text-v14
-
-#============#
-# Google     #
-#============#
-
-{# GOOGLE_KEY=user_provided #}
-
-# GOOGLE_REVERSE_PROXY=
-# Some reverse proxies do not support the X-goog-api-key header, uncomment to pass the API key in Authorization header instead.
-# GOOGLE_AUTH_HEADER=true
-
-# Gemini API (AI Studio)
-# GOOGLE_MODELS=gemini-2.0-flash-exp,gemini-2.0-flash-thinking-exp-1219,gemini-exp-1121,gemini-exp-1114,gemini-1.5-flash-latest,gemini-1.0-pro,gemini-1.0-pro-001,gemini-1.0-pro-latest,gemini-1.0-pro-vision-latest,gemini-1.5-pro-latest,gemini-pro,gemini-pro-vision
-
-# Vertex AI
-# GOOGLE_MODELS=gemini-1.5-flash-preview-0514,gemini-1.5-pro-preview-0514,gemini-1.0-pro-vision-001,gemini-1.0-pro-002,gemini-1.0-pro-001,gemini-pro-vision,gemini-1.0-pro
-
-# GOOGLE_TITLE_MODEL=gemini-pro
-
-# GOOGLE_LOC=us-central1
-
-# Google Safety Settings
-# NOTE: These settings apply to both Vertex AI and Gemini API (AI Studio)
-#
-# For Vertex AI:
-# To use the BLOCK_NONE setting, you need either:
-# (a) Access through an allowlist via your Google account team, or
-# (b) Switch to monthly invoiced billing: https://cloud.google.com/billing/docs/how-to/invoiced-billing
-#
-# For Gemini API (AI Studio):
-# BLOCK_NONE is available by default, no special account requirements.
-#
-# Available options: BLOCK_NONE, BLOCK_ONLY_HIGH, BLOCK_MEDIUM_AND_ABOVE, BLOCK_LOW_AND_ABOVE
-#
-# GOOGLE_SAFETY_SEXUALLY_EXPLICIT=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_HATE_SPEECH=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_HARASSMENT=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_DANGEROUS_CONTENT=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_CIVIC_INTEGRITY=BLOCK_ONLY_HIGH
-
-#============#
-# OpenAI     #
-#============#
-
-OPENAI_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_OPENAI_API_KEY'] }}
-OPENAI_MODELS=o1,o1-mini,o1-preview,gpt-4o,chatgpt-4o-latest,gpt-4o-mini,gpt-3.5-turbo-0125,gpt-3.5-turbo-0301,gpt-3.5-turbo,gpt-4,gpt-4-0613,gpt-4-vision-preview,gpt-3.5-turbo-0613,gpt-3.5-turbo-16k-0613,gpt-4-0125-preview,gpt-4-turbo-preview,gpt-4-1106-preview,gpt-3.5-turbo-1106,gpt-3.5-turbo-instruct,gpt-3.5-turbo-instruct-0914,gpt-3.5-turbo-16k
-
-DEBUG_OPENAI=false
-
-# TITLE_CONVO=false
-# OPENAI_TITLE_MODEL=gpt-4o-mini
-
-# OPENAI_SUMMARIZE=true
-# OPENAI_SUMMARY_MODEL=gpt-4o-mini
-
-# OPENAI_FORCE_PROMPT=true
-
-# OPENAI_REVERSE_PROXY=
-
-# OPENAI_ORGANIZATION=
-
-#====================#
-#   Assistants API   #
-#====================#
-
-# ASSISTANTS_API_KEY=user_provided
-# ASSISTANTS_BASE_URL=
-# ASSISTANTS_MODELS=gpt-4o,gpt-4o-mini,gpt-3.5-turbo-0125,gpt-3.5-turbo-16k-0613,gpt-3.5-turbo-16k,gpt-3.5-turbo,gpt-4,gpt-4-0314,gpt-4-32k-0314,gpt-4-0613,gpt-3.5-turbo-0613,gpt-3.5-turbo-1106,gpt-4-0125-preview,gpt-4-turbo-preview,gpt-4-1106-preview
-
-#==========================#
-#   Azure Assistants API   #
-#==========================#
-
-# Note: You should map your credentials with custom variables according to your Azure OpenAI Configuration
-# The models for Azure Assistants are also determined by your Azure OpenAI configuration.
-
-# More info, including how to enable use of Assistants with Azure here:
-# https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints/azure#using-assistants-with-azure
-
-#============#
-# OpenRouter #
-#============#
-# !!!Warning: Use the variable above instead of this one. Using this one will override the OpenAI endpoint
-# OPENROUTER_API_KEY=
-
-#============#
-# Plugins    #
-#============#
-
-# PLUGIN_MODELS=gpt-4o,gpt-4o-mini,gpt-4,gpt-4-turbo-preview,gpt-4-0125-preview,gpt-4-1106-preview,gpt-4-0613,gpt-3.5-turbo,gpt-3.5-turbo-0125,gpt-3.5-turbo-1106,gpt-3.5-turbo-0613
-
-# DEBUG_PLUGINS=
-
-CREDS_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_CREDS_KEY'] }}
-CREDS_IV={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_CREDS_IV'] }}
-
-# Azure AI Search
-#-----------------
-# AZURE_AI_SEARCH_SERVICE_ENDPOINT=
-# AZURE_AI_SEARCH_INDEX_NAME=
-# AZURE_AI_SEARCH_API_KEY=
-
-# AZURE_AI_SEARCH_API_VERSION=
-# AZURE_AI_SEARCH_SEARCH_OPTION_QUERY_TYPE=
-# AZURE_AI_SEARCH_SEARCH_OPTION_TOP=
-# AZURE_AI_SEARCH_SEARCH_OPTION_SELECT=
-
-# DALL·E
-#----------------
-# DALLE_API_KEY=
-# DALLE3_API_KEY=
-# DALLE2_API_KEY=
-# DALLE3_SYSTEM_PROMPT=
-# DALLE2_SYSTEM_PROMPT=
-# DALLE_REVERSE_PROXY=
-# DALLE3_BASEURL=
-# DALLE2_BASEURL=
-
-# DALL·E (via Azure OpenAI)
-# Note: requires some of the variables above to be set
-#----------------
-# DALLE3_AZURE_API_VERSION=
-# DALLE2_AZURE_API_VERSION=
-
-
-# Google
-#-----------------
-GOOGLE_SEARCH_API_KEY=
-GOOGLE_CSE_ID=
-
-# YOUTUBE
-#-----------------
-YOUTUBE_API_KEY=
-
-# SerpAPI
-#-----------------
-SERPAPI_API_KEY=
-
-# Stable Diffusion
-#-----------------
-SD_WEBUI_URL=http://stable-diffusion-webui:7860
-
-# Tavily
-#-----------------
-TAVILY_API_KEY=
-
-# Traversaal
-#-----------------
-TRAVERSAAL_API_KEY=
-
-# WolframAlpha
-#-----------------
-WOLFRAM_APP_ID=
-
-# Zapier
-#-----------------
-ZAPIER_NLA_API_KEY=
-
-#==================================================#
-#                      Search                      #
-#==================================================#
-
-SEARCH=true
-MEILI_NO_ANALYTICS=true
-MEILI_HOST=http://meilisearch:7700
-MEILI_MASTER_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MEILISEARCH_MASTER_KEY'] }}
-
-# Optional: Disable indexing, useful in a multi-node setup
-# where only one instance should perform an index sync.
-# MEILI_NO_SYNC=true
-
-#==================================================#
-#          Speech to Text & Text to Speech         #
-#==================================================#
-
-STT_API_KEY=
-TTS_API_KEY=
-
-#==================================================#
-#                        RAG                       #
-#==================================================#
-# More info: https://www.librechat.ai/docs/configuration/rag_api
-
-# RAG_OPENAI_BASEURL=
-# RAG_OPENAI_API_KEY=
-# RAG_USE_FULL_CONTEXT=
-# EMBEDDINGS_PROVIDER=openai
-# EMBEDDINGS_MODEL=text-embedding-3-small
-
-#===================================================#
-#                    User System                    #
-#===================================================#
-
-#========================#
-# Moderation             #
-#========================#
-
-OPENAI_MODERATION=false
-OPENAI_MODERATION_API_KEY=
-# OPENAI_MODERATION_REVERSE_PROXY=
-
-BAN_VIOLATIONS=true
-BAN_DURATION=1000 * 60 * 60 * 2
-BAN_INTERVAL=20
-
-LOGIN_VIOLATION_SCORE=1
-REGISTRATION_VIOLATION_SCORE=1
-CONCURRENT_VIOLATION_SCORE=1
-MESSAGE_VIOLATION_SCORE=1
-NON_BROWSER_VIOLATION_SCORE=20
-
-LOGIN_MAX=7
-LOGIN_WINDOW=5
-REGISTER_MAX=5
-REGISTER_WINDOW=60
-
-LIMIT_CONCURRENT_MESSAGES=true
-CONCURRENT_MESSAGE_MAX=2
-
-LIMIT_MESSAGE_IP=true
-MESSAGE_IP_MAX=40
-MESSAGE_IP_WINDOW=1
-
-LIMIT_MESSAGE_USER=false
-MESSAGE_USER_MAX=40
-MESSAGE_USER_WINDOW=1
-
-ILLEGAL_MODEL_REQ_SCORE=5
-
-#========================#
-# Balance                #
-#========================#
-
-CHECK_BALANCE=false
-# START_BALANCE=20000 # note: the number of tokens that will be credited after registration.
-
-#========================#
-# Registration and Login #
-#========================#
-
-ALLOW_EMAIL_LOGIN=true
-ALLOW_REGISTRATION=true
-ALLOW_SOCIAL_LOGIN=false
-ALLOW_SOCIAL_REGISTRATION=false
-ALLOW_PASSWORD_RESET=false
-# ALLOW_ACCOUNT_DELETION=true # note: enabled by default if omitted/commented out
-ALLOW_UNVERIFIED_EMAIL_LOGIN=true
-
-SESSION_EXPIRY=1000 * 60 * 15
-REFRESH_TOKEN_EXPIRY=(1000 * 60 * 60 * 24) * 7
-
-JWT_SECRET={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_JWT_SECRET'] }}
-JWT_REFRESH_SECRET={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_JWT_REFRESH_SECRET'] }}
-
-
-# Discord
-DISCORD_CLIENT_ID=
-DISCORD_CLIENT_SECRET=
-DISCORD_CALLBACK_URL=/oauth/discord/callback
-
-# Facebook
-FACEBOOK_CLIENT_ID=
-FACEBOOK_CLIENT_SECRET=
-FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
-
-# GitHub
-GITHUB_CLIENT_ID=
-GITHUB_CLIENT_SECRET=
-GITHUB_CALLBACK_URL=/oauth/github/callback
-# GitHub Enterprise
-# GITHUB_ENTERPRISE_BASE_URL=
-# GITHUB_ENTERPRISE_USER_AGENT=
-
-# Google
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-GOOGLE_CALLBACK_URL=/oauth/google/callback
-
-# Apple
-APPLE_CLIENT_ID=
-APPLE_TEAM_ID=
-APPLE_KEY_ID=
-APPLE_PRIVATE_KEY_PATH=
-APPLE_CALLBACK_URL=/oauth/apple/callback
-
-# OpenID
-OPENID_CLIENT_ID=
-OPENID_CLIENT_SECRET=
-OPENID_ISSUER=
-OPENID_SESSION_SECRET=
-OPENID_SCOPE="openid profile email"
-OPENID_CALLBACK_URL=/oauth/openid/callback
-OPENID_REQUIRED_ROLE=
-OPENID_REQUIRED_ROLE_TOKEN_KIND=
-OPENID_REQUIRED_ROLE_PARAMETER_PATH=
-# Set to determine which user info property returned from OpenID Provider to store as the User's username
-OPENID_USERNAME_CLAIM=
-# Set to determine which user info property returned from OpenID Provider to store as the User's name
-OPENID_NAME_CLAIM=
-
-OPENID_BUTTON_LABEL=
-OPENID_IMAGE_URL=
-
-# LDAP
-# LDAP_URL=
-# LDAP_BIND_DN=
-# LDAP_BIND_CREDENTIALS=
-# LDAP_USER_SEARCH_BASE=
-# LDAP_SEARCH_FILTER=mail=
-# LDAP_CA_CERT_PATH=
-# LDAP_TLS_REJECT_UNAUTHORIZED=
-# LDAP_LOGIN_USES_USERNAME=true
-# LDAP_ID=
-# LDAP_USERNAME=
-# LDAP_EMAIL=
-# LDAP_FULL_NAME=
-
-#========================#
-# Email Password Reset   #
-#========================#
-
-EMAIL_SERVICE=
-EMAIL_HOST=postal-smtp
-EMAIL_PORT=25
-EMAIL_ENCRYPTION=
-EMAIL_ENCRYPTION_HOSTNAME=
-EMAIL_ALLOW_SELFSIGNED=
-EMAIL_USERNAME=
-EMAIL_PASSWORD=
-EMAIL_FROM_NAME=
-EMAIL_FROM=noreply@librechat.ai
-
-#========================#
-# Firebase CDN           #
-#========================#
-
-# FIREBASE_API_KEY=
-# FIREBASE_AUTH_DOMAIN=
-# FIREBASE_PROJECT_ID=
-# FIREBASE_STORAGE_BUCKET=
-# FIREBASE_MESSAGING_SENDER_ID=
-# FIREBASE_APP_ID=
-
-#========================#
-# Shared Links           #
-#========================#
-
-ALLOW_SHARED_LINKS=true
-ALLOW_SHARED_LINKS_PUBLIC=true
-
-#==============================#
-# Static File Cache Control    #
-#==============================#
-
-# Leave commented out to use defaults: 1 day (86400 seconds) for s-maxage and 2 days (172800 seconds) for max-age
-# NODE_ENV must be set to production for these to take effect
-# STATIC_CACHE_MAX_AGE=172800
-# STATIC_CACHE_S_MAX_AGE=86400
-
-# If you have another service in front of your LibreChat doing compression, disable express based compression here
-# DISABLE_COMPRESSION=true
-
-#===================================================#
-#                        UI                         #
-#===================================================#
-
-APP_TITLE=LibreChat
-# CUSTOM_FOOTER="My custom footer"
-HELP_AND_FAQ_URL=https://librechat.ai
-
-# SHOW_BIRTHDAY_ICON=true
-
-# Google tag manager id
-#ANALYTICS_GTM_ID=user provided google tag manager id
-
-#===============#
-# REDIS Options #
-#===============#
-
-REDIS_URI=redis:6379
-USE_REDIS=true
-
-# USE_REDIS_CLUSTER=true
-# REDIS_CA=/path/to/ca.crt
-
-#==================================================#
-#                      Others                      #
-#==================================================#
-#   You should leave the following commented out   #
-
-# NODE_ENV=
-
-# E2E_USER_EMAIL=
-# E2E_USER_PASSWORD=
-
-#=====================================================#
-#                  Cache Headers                      #
-#=====================================================#
-#   Headers that control caching of the index.html    #
-#   Default configuration prevents caching to ensure  #
-#   users always get the latest version. Customize    #
-#   only if you understand caching implications.      #
-
-# INDEX_HTML_CACHE_CONTROL=no-cache, no-store, must-revalidate
-# INDEX_HTML_PRAGMA=no-cache
-# INDEX_HTML_EXPIRES=0
-
-# no-cache: Forces validation with server before using cached version
-# no-store: Prevents storing the response entirely
-# must-revalidate: Prevents using stale content when offline
-
-#=====================================================#
-#                  OpenWeather                        #
-#=====================================================#
-OPENWEATHER_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_OPENWEATHERMAP_API_KEY'] }}

ansible/app-configs/librechat/librechat.yaml.j2

@@ -1,33 +0,0 @@
-version: 1.0.0
-endpoints:
-  custom:
-    - name: "ollama"
-      apiKey: "ollama"
-      baseURL: "http://ollama:11434/v1/chat/completions"
-      models:
-        default: [
-          "deepseek-r1:1.5b",
-          "deepseek-coder-v2:16b",
-          "deepseek-v3:671b",
-          "llama3.3:70b",
-          "phi4:14b",
-          "qwen2.5",
-          "llama2:7b",
-          "mistral:7b",
-          "codellama:7b",
-          "tinyllama:1.1b",
-          "starcoder2:3b",
-          "dolphin-mistral:7b",
-          "smollm2:1.7b",
-          "orca-mini:3b",
-          "mistral-openorca:7b"
-        ]
-# fetching list of models is supported but the `name` field must start
-# with `ollama` (case-insensitive), as it does in this example.
-        fetch: true
-      titleConvo: true
-      titleModel: "current_model"
-      summarize: false
-      summaryModel: "current_model"
-      forcePrompt: false
-      modelDisplayLabel: "Ollama"

ansible/app-configs/librechat_librechat.env.j2

@@ -1,550 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-#=====================================================================#
-#                       LibreChat Configuration                       #
-#=====================================================================#
-# Please refer to the reference documentation for assistance          #
-# with configuring your LibreChat environment.                        #
-#                                                                     #
-# https://www.librechat.ai/docs/configuration/dotenv                  #
-#=====================================================================#
-
-#==================================================#
-#               Server Configuration               #
-#==================================================#
-
-HOST=localhost
-PORT=3080
-
-MONGO_URI=mongodb://librechat:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_MONGODB_PASSWORD'] }}@mongodb:27017/librechat?replicaSet=rinoa
-
-DOMAIN_CLIENT=https://ai.trez.wtf
-DOMAIN_SERVER=https://ai.trez.wtf
-
-NO_INDEX=true
-# Use the address that is at most n number of hops away from the Express application.
-# req.socket.remoteAddress is the first hop, and the rest are looked for in the X-Forwarded-For header from right to left.
-# A value of 0 means that the first untrusted address would be req.socket.remoteAddress, i.e. there is no reverse proxy.
-# Defaulted to 1.
-TRUST_PROXY=1
-
-#===============#
-# JSON Logging  #
-#===============#
-
-# Use when process console logs in cloud deployment like GCP/AWS
-CONSOLE_JSON=true
-
-#===============#
-# Debug Logging #
-#===============#
-
-DEBUG_LOGGING=true
-DEBUG_CONSOLE=false
-
-#=============#
-# Permissions #
-#=============#
-
-# UID=1000
-# GID=1000
-
-#===============#
-# Configuration #
-#===============#
-# Use an absolute path, a relative path, or a URL
-
-# CONFIG_PATH="/alternative/path/to/librechat.yaml"
-
-#===================================================#
-#                     Endpoints                     #
-#===================================================#
-
-# ENDPOINTS=openAI,assistants,azureOpenAI,google,gptPlugins,anthropic
-
-PROXY=
-
-#===================================#
-# Known Endpoints - librechat.yaml  #
-#===================================#
-# https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints
-
-# ANYSCALE_API_KEY=
-# APIPIE_API_KEY=
-# COHERE_API_KEY=
-DEEPSEEK_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_DEEPSEEK_API_KEY'] }}
-# DATABRICKS_API_KEY=
-# FIREWORKS_API_KEY=
-# GROQ_API_KEY=
-# HUGGINGFACE_TOKEN=
-MISTRAL_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_MISTRAL_API_KEY'] }}
-# OPENROUTER_KEY=
-# PERPLEXITY_API_KEY=
-# SHUTTLEAI_API_KEY=
-# TOGETHERAI_API_KEY=
-# UNIFY_API_KEY=
-# XAI_API_KEY=
-
-#============#
-# Anthropic  #
-#============#
-
-ANTHROPIC_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_ANTHROPIC_API_KEY'] }}
-ANTHROPIC_MODELS=claude-3-7-sonnet-latest,claude-3-7-sonnet-20250219,claude-3-5-haiku-20241022,claude-3-5-sonnet-20241022,claude-3-5-sonnet-latest,claude-3-5-sonnet-20240620,claude-3-opus-20240229,claude-3-sonnet-20240229,claude-3-haiku-20240307,claude-2.1,claude-2,claude-1.2,claude-1,claude-1-100k,claude-instant-1,claude-instant-1-100k
-# ANTHROPIC_REVERSE_PROXY=
-
-#============#
-# Azure      #
-#============#
-
-# Note: these variables are DEPRECATED
-# Use the `librechat.yaml` configuration for `azureOpenAI` instead
-# You may also continue to use them if you opt out of using the `librechat.yaml` configuration
-
-# AZURE_OPENAI_DEFAULT_MODEL=gpt-3.5-turbo # Deprecated
-# AZURE_OPENAI_MODELS=gpt-3.5-turbo,gpt-4 # Deprecated
-# AZURE_USE_MODEL_AS_DEPLOYMENT_NAME=TRUE # Deprecated
-# AZURE_API_KEY= # Deprecated
-# AZURE_OPENAI_API_INSTANCE_NAME= # Deprecated
-# AZURE_OPENAI_API_DEPLOYMENT_NAME= # Deprecated
-# AZURE_OPENAI_API_VERSION= # Deprecated
-# AZURE_OPENAI_API_COMPLETIONS_DEPLOYMENT_NAME= # Deprecated
-# AZURE_OPENAI_API_EMBEDDINGS_DEPLOYMENT_NAME= # Deprecated
-# PLUGINS_USE_AZURE="true" # Deprecated
-
-#=================#
-#   AWS Bedrock   #
-#=================#
-
-# BEDROCK_AWS_DEFAULT_REGION=us-east-1 # A default region must be provided
-# BEDROCK_AWS_ACCESS_KEY_ID=someAccessKey
-# BEDROCK_AWS_SECRET_ACCESS_KEY=someSecretAccessKey
-# BEDROCK_AWS_SESSION_TOKEN=someSessionToken
-
-# Note: This example list is not meant to be exhaustive. If omitted, all known, supported model IDs will be included for you.
-# BEDROCK_AWS_MODELS=anthropic.claude-3-5-sonnet-20240620-v1:0,meta.llama3-1-8b-instruct-v1:0
-
-# See all Bedrock model IDs here: https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns
-
-# Notes on specific models:
-# The following models are not support due to not supporting streaming:
-# ai21.j2-mid-v1
-
-# The following models are not support due to not supporting conversation history:
-# ai21.j2-ultra-v1, cohere.command-text-v14, cohere.command-light-text-v14
-
-#============#
-# Google     #
-#============#
-
-{# GOOGLE_KEY=user_provided #}
-
-# GOOGLE_REVERSE_PROXY=
-# Some reverse proxies do not support the X-goog-api-key header, uncomment to pass the API key in Authorization header instead.
-# GOOGLE_AUTH_HEADER=true
-
-# Gemini API (AI Studio)
-# GOOGLE_MODELS=gemini-2.0-flash-exp,gemini-2.0-flash-thinking-exp-1219,gemini-exp-1121,gemini-exp-1114,gemini-1.5-flash-latest,gemini-1.0-pro,gemini-1.0-pro-001,gemini-1.0-pro-latest,gemini-1.0-pro-vision-latest,gemini-1.5-pro-latest,gemini-pro,gemini-pro-vision
-
-# Vertex AI
-# GOOGLE_MODELS=gemini-1.5-flash-preview-0514,gemini-1.5-pro-preview-0514,gemini-1.0-pro-vision-001,gemini-1.0-pro-002,gemini-1.0-pro-001,gemini-pro-vision,gemini-1.0-pro
-
-# GOOGLE_TITLE_MODEL=gemini-pro
-
-# GOOGLE_LOC=us-central1
-
-# Google Safety Settings
-# NOTE: These settings apply to both Vertex AI and Gemini API (AI Studio)
-#
-# For Vertex AI:
-# To use the BLOCK_NONE setting, you need either:
-# (a) Access through an allowlist via your Google account team, or
-# (b) Switch to monthly invoiced billing: https://cloud.google.com/billing/docs/how-to/invoiced-billing
-#
-# For Gemini API (AI Studio):
-# BLOCK_NONE is available by default, no special account requirements.
-#
-# Available options: BLOCK_NONE, BLOCK_ONLY_HIGH, BLOCK_MEDIUM_AND_ABOVE, BLOCK_LOW_AND_ABOVE
-#
-# GOOGLE_SAFETY_SEXUALLY_EXPLICIT=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_HATE_SPEECH=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_HARASSMENT=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_DANGEROUS_CONTENT=BLOCK_ONLY_HIGH
-# GOOGLE_SAFETY_CIVIC_INTEGRITY=BLOCK_ONLY_HIGH
-
-#============#
-# OpenAI     #
-#============#
-
-OPENAI_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_OPENAI_API_KEY'] }}
-OPENAI_MODELS=o1,o1-mini,o1-preview,gpt-4o,chatgpt-4o-latest,gpt-4o-mini,gpt-3.5-turbo-0125,gpt-3.5-turbo-0301,gpt-3.5-turbo,gpt-4,gpt-4-0613,gpt-4-vision-preview,gpt-3.5-turbo-0613,gpt-3.5-turbo-16k-0613,gpt-4-0125-preview,gpt-4-turbo-preview,gpt-4-1106-preview,gpt-3.5-turbo-1106,gpt-3.5-turbo-instruct,gpt-3.5-turbo-instruct-0914,gpt-3.5-turbo-16k
-
-DEBUG_OPENAI=false
-
-# TITLE_CONVO=false
-# OPENAI_TITLE_MODEL=gpt-4o-mini
-
-# OPENAI_SUMMARIZE=true
-# OPENAI_SUMMARY_MODEL=gpt-4o-mini
-
-# OPENAI_FORCE_PROMPT=true
-
-# OPENAI_REVERSE_PROXY=
-
-# OPENAI_ORGANIZATION=
-
-#====================#
-#   Assistants API   #
-#====================#
-
-# ASSISTANTS_API_KEY=user_provided
-# ASSISTANTS_BASE_URL=
-# ASSISTANTS_MODELS=gpt-4o,gpt-4o-mini,gpt-3.5-turbo-0125,gpt-3.5-turbo-16k-0613,gpt-3.5-turbo-16k,gpt-3.5-turbo,gpt-4,gpt-4-0314,gpt-4-32k-0314,gpt-4-0613,gpt-3.5-turbo-0613,gpt-3.5-turbo-1106,gpt-4-0125-preview,gpt-4-turbo-preview,gpt-4-1106-preview
-
-#==========================#
-#   Azure Assistants API   #
-#==========================#
-
-# Note: You should map your credentials with custom variables according to your Azure OpenAI Configuration
-# The models for Azure Assistants are also determined by your Azure OpenAI configuration.
-
-# More info, including how to enable use of Assistants with Azure here:
-# https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints/azure#using-assistants-with-azure
-
-#============#
-# OpenRouter #
-#============#
-# !!!Warning: Use the variable above instead of this one. Using this one will override the OpenAI endpoint
-# OPENROUTER_API_KEY=
-
-#============#
-# Plugins    #
-#============#
-
-# PLUGIN_MODELS=gpt-4o,gpt-4o-mini,gpt-4,gpt-4-turbo-preview,gpt-4-0125-preview,gpt-4-1106-preview,gpt-4-0613,gpt-3.5-turbo,gpt-3.5-turbo-0125,gpt-3.5-turbo-1106,gpt-3.5-turbo-0613
-
-# DEBUG_PLUGINS=
-
-CREDS_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_CREDS_KEY'] }}
-CREDS_IV={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_CREDS_IV'] }}
-
-# Azure AI Search
-#-----------------
-# AZURE_AI_SEARCH_SERVICE_ENDPOINT=
-# AZURE_AI_SEARCH_INDEX_NAME=
-# AZURE_AI_SEARCH_API_KEY=
-
-# AZURE_AI_SEARCH_API_VERSION=
-# AZURE_AI_SEARCH_SEARCH_OPTION_QUERY_TYPE=
-# AZURE_AI_SEARCH_SEARCH_OPTION_TOP=
-# AZURE_AI_SEARCH_SEARCH_OPTION_SELECT=
-
-# DALL·E
-#----------------
-# DALLE_API_KEY=
-# DALLE3_API_KEY=
-# DALLE2_API_KEY=
-# DALLE3_SYSTEM_PROMPT=
-# DALLE2_SYSTEM_PROMPT=
-# DALLE_REVERSE_PROXY=
-# DALLE3_BASEURL=
-# DALLE2_BASEURL=
-
-# DALL·E (via Azure OpenAI)
-# Note: requires some of the variables above to be set
-#----------------
-# DALLE3_AZURE_API_VERSION=
-# DALLE2_AZURE_API_VERSION=
-
-
-# Google
-#-----------------
-GOOGLE_SEARCH_API_KEY=
-GOOGLE_CSE_ID=
-
-# YOUTUBE
-#-----------------
-YOUTUBE_API_KEY=
-
-# SerpAPI
-#-----------------
-SERPAPI_API_KEY=
-
-# Stable Diffusion
-#-----------------
-SD_WEBUI_URL=http://stable-diffusion-webui:7860
-
-# Tavily
-#-----------------
-TAVILY_API_KEY=
-
-# Traversaal
-#-----------------
-TRAVERSAAL_API_KEY=
-
-# WolframAlpha
-#-----------------
-WOLFRAM_APP_ID=
-
-# Zapier
-#-----------------
-ZAPIER_NLA_API_KEY=
-
-#==================================================#
-#                      Search                      #
-#==================================================#
-
-SEARCH=true
-MEILI_NO_ANALYTICS=true
-MEILI_HOST=http://meilisearch:7700
-MEILI_MASTER_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MEILISEARCH_MASTER_KEY'] }}
-
-# Optional: Disable indexing, useful in a multi-node setup
-# where only one instance should perform an index sync.
-# MEILI_NO_SYNC=true
-
-#==================================================#
-#          Speech to Text & Text to Speech         #
-#==================================================#
-
-STT_API_KEY=
-TTS_API_KEY=
-
-#==================================================#
-#                        RAG                       #
-#==================================================#
-# More info: https://www.librechat.ai/docs/configuration/rag_api
-
-# RAG_OPENAI_BASEURL=
-# RAG_OPENAI_API_KEY=
-# RAG_USE_FULL_CONTEXT=
-# EMBEDDINGS_PROVIDER=openai
-# EMBEDDINGS_MODEL=text-embedding-3-small
-
-#===================================================#
-#                    User System                    #
-#===================================================#
-
-#========================#
-# Moderation             #
-#========================#
-
-OPENAI_MODERATION=false
-OPENAI_MODERATION_API_KEY=
-# OPENAI_MODERATION_REVERSE_PROXY=
-
-BAN_VIOLATIONS=true
-BAN_DURATION=1000 * 60 * 60 * 2
-BAN_INTERVAL=20
-
-LOGIN_VIOLATION_SCORE=1
-REGISTRATION_VIOLATION_SCORE=1
-CONCURRENT_VIOLATION_SCORE=1
-MESSAGE_VIOLATION_SCORE=1
-NON_BROWSER_VIOLATION_SCORE=20
-
-LOGIN_MAX=7
-LOGIN_WINDOW=5
-REGISTER_MAX=5
-REGISTER_WINDOW=60
-
-LIMIT_CONCURRENT_MESSAGES=true
-CONCURRENT_MESSAGE_MAX=2
-
-LIMIT_MESSAGE_IP=true
-MESSAGE_IP_MAX=40
-MESSAGE_IP_WINDOW=1
-
-LIMIT_MESSAGE_USER=false
-MESSAGE_USER_MAX=40
-MESSAGE_USER_WINDOW=1
-
-ILLEGAL_MODEL_REQ_SCORE=5
-
-#========================#
-# Balance                #
-#========================#
-
-CHECK_BALANCE=false
-# START_BALANCE=20000 # note: the number of tokens that will be credited after registration.
-
-#========================#
-# Registration and Login #
-#========================#
-
-ALLOW_EMAIL_LOGIN=true
-ALLOW_REGISTRATION=true
-ALLOW_SOCIAL_LOGIN=false
-ALLOW_SOCIAL_REGISTRATION=false
-ALLOW_PASSWORD_RESET=false
-# ALLOW_ACCOUNT_DELETION=true # note: enabled by default if omitted/commented out
-ALLOW_UNVERIFIED_EMAIL_LOGIN=true
-
-SESSION_EXPIRY=1000 * 60 * 15
-REFRESH_TOKEN_EXPIRY=(1000 * 60 * 60 * 24) * 7
-
-JWT_SECRET={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_JWT_SECRET'] }}
-JWT_REFRESH_SECRET={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBRECHAT_JWT_REFRESH_SECRET'] }}
-
-
-# Discord
-DISCORD_CLIENT_ID=
-DISCORD_CLIENT_SECRET=
-DISCORD_CALLBACK_URL=/oauth/discord/callback
-
-# Facebook
-FACEBOOK_CLIENT_ID=
-FACEBOOK_CLIENT_SECRET=
-FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
-
-# GitHub
-GITHUB_CLIENT_ID=
-GITHUB_CLIENT_SECRET=
-GITHUB_CALLBACK_URL=/oauth/github/callback
-# GitHub Enterprise
-# GITHUB_ENTERPRISE_BASE_URL=
-# GITHUB_ENTERPRISE_USER_AGENT=
-
-# Google
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-GOOGLE_CALLBACK_URL=/oauth/google/callback
-
-# Apple
-APPLE_CLIENT_ID=
-APPLE_TEAM_ID=
-APPLE_KEY_ID=
-APPLE_PRIVATE_KEY_PATH=
-APPLE_CALLBACK_URL=/oauth/apple/callback
-
-# OpenID
-OPENID_CLIENT_ID=
-OPENID_CLIENT_SECRET=
-OPENID_ISSUER=
-OPENID_SESSION_SECRET=
-OPENID_SCOPE="openid profile email"
-OPENID_CALLBACK_URL=/oauth/openid/callback
-OPENID_REQUIRED_ROLE=
-OPENID_REQUIRED_ROLE_TOKEN_KIND=
-OPENID_REQUIRED_ROLE_PARAMETER_PATH=
-# Set to determine which user info property returned from OpenID Provider to store as the User's username
-OPENID_USERNAME_CLAIM=
-# Set to determine which user info property returned from OpenID Provider to store as the User's name
-OPENID_NAME_CLAIM=
-
-OPENID_BUTTON_LABEL=
-OPENID_IMAGE_URL=
-
-# LDAP
-# LDAP_URL=
-# LDAP_BIND_DN=
-# LDAP_BIND_CREDENTIALS=
-# LDAP_USER_SEARCH_BASE=
-# LDAP_SEARCH_FILTER=mail=
-# LDAP_CA_CERT_PATH=
-# LDAP_TLS_REJECT_UNAUTHORIZED=
-# LDAP_LOGIN_USES_USERNAME=true
-# LDAP_ID=
-# LDAP_USERNAME=
-# LDAP_EMAIL=
-# LDAP_FULL_NAME=
-
-#========================#
-# Email Password Reset   #
-#========================#
-
-EMAIL_SERVICE=
-EMAIL_HOST=postal-smtp
-EMAIL_PORT=25
-EMAIL_ENCRYPTION=
-EMAIL_ENCRYPTION_HOSTNAME=
-EMAIL_ALLOW_SELFSIGNED=
-EMAIL_USERNAME=
-EMAIL_PASSWORD=
-EMAIL_FROM_NAME=
-EMAIL_FROM=noreply@librechat.ai
-
-#========================#
-# Firebase CDN           #
-#========================#
-
-# FIREBASE_API_KEY=
-# FIREBASE_AUTH_DOMAIN=
-# FIREBASE_PROJECT_ID=
-# FIREBASE_STORAGE_BUCKET=
-# FIREBASE_MESSAGING_SENDER_ID=
-# FIREBASE_APP_ID=
-
-#========================#
-# Shared Links           #
-#========================#
-
-ALLOW_SHARED_LINKS=true
-ALLOW_SHARED_LINKS_PUBLIC=true
-
-#==============================#
-# Static File Cache Control    #
-#==============================#
-
-# Leave commented out to use defaults: 1 day (86400 seconds) for s-maxage and 2 days (172800 seconds) for max-age
-# NODE_ENV must be set to production for these to take effect
-# STATIC_CACHE_MAX_AGE=172800
-# STATIC_CACHE_S_MAX_AGE=86400
-
-# If you have another service in front of your LibreChat doing compression, disable express based compression here
-# DISABLE_COMPRESSION=true
-
-#===================================================#
-#                        UI                         #
-#===================================================#
-
-APP_TITLE=LibreChat
-# CUSTOM_FOOTER="My custom footer"
-HELP_AND_FAQ_URL=https://librechat.ai
-
-# SHOW_BIRTHDAY_ICON=true
-
-# Google tag manager id
-#ANALYTICS_GTM_ID=user provided google tag manager id
-
-#===============#
-# REDIS Options #
-#===============#
-
-REDIS_URI=redis:6379
-USE_REDIS=true
-
-# USE_REDIS_CLUSTER=true
-# REDIS_CA=/path/to/ca.crt
-
-#==================================================#
-#                      Others                      #
-#==================================================#
-#   You should leave the following commented out   #
-
-# NODE_ENV=
-
-# E2E_USER_EMAIL=
-# E2E_USER_PASSWORD=
-
-#=====================================================#
-#                  Cache Headers                      #
-#=====================================================#
-#   Headers that control caching of the index.html    #
-#   Default configuration prevents caching to ensure  #
-#   users always get the latest version. Customize    #
-#   only if you understand caching implications.      #
-
-# INDEX_HTML_CACHE_CONTROL=no-cache, no-store, must-revalidate
-# INDEX_HTML_PRAGMA=no-cache
-# INDEX_HTML_EXPIRES=0
-
-# no-cache: Forces validation with server before using cached version
-# no-store: Prevents storing the response entirely
-# must-revalidate: Prevents using stale content when offline
-
-#=====================================================#
-#                  OpenWeather                        #
-#=====================================================#
-OPENWEATHER_API_KEY={{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_OPENWEATHERMAP_API_KEY'] }}

ansible/app-configs/librechat_librechat.yaml.j2

@@ -1,33 +0,0 @@
-version: 1.0.0
-endpoints:
-  custom:
-    - name: "ollama"
-      apiKey: "ollama"
-      baseURL: "http://ollama:11434/v1/chat/completions"
-      models:
-        default: [
-          "deepseek-r1:1.5b",
-          "deepseek-coder-v2:16b",
-          "deepseek-v3:671b",
-          "llama3.3:70b",
-          "phi4:14b",
-          "qwen2.5",
-          "llama2:7b",
-          "mistral:7b",
-          "codellama:7b",
-          "tinyllama:1.1b",
-          "starcoder2:3b",
-          "dolphin-mistral:7b",
-          "smollm2:1.7b",
-          "orca-mini:3b",
-          "mistral-openorca:7b"
-        ]
-# fetching list of models is supported but the `name` field must start
-# with `ollama` (case-insensitive), as it does in this example.
-        fetch: true
-      titleConvo: true
-      titleModel: "current_model"
-      summarize: false
-      summaryModel: "current_model"
-      forcePrompt: false
-      modelDisplayLabel: "Ollama"

ansible/app-configs/lidarr/config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <BindAddress>*</BindAddress>
-  <Port>8686</Port>
-  <SslPort>6868</SslPort>
-  <EnableSsl>False</EnableSsl>
-  <LaunchBrowser>True</LaunchBrowser>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIDARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <Branch>master</Branch>
-  <LogLevel>trace</LogLevel>
-  <SslCertPath></SslCertPath>
-  <SslCertPassword></SslCertPassword>
-  <UrlBase></UrlBase>
-  <InstanceName>Lidarr</InstanceName>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <Theme>auto</Theme>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-</Config>

ansible/app-configs/lidarr_config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <BindAddress>*</BindAddress>
-  <Port>8686</Port>
-  <SslPort>6868</SslPort>
-  <EnableSsl>False</EnableSsl>
-  <LaunchBrowser>True</LaunchBrowser>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIDARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <Branch>master</Branch>
-  <LogLevel>trace</LogLevel>
-  <SslCertPath></SslCertPath>
-  <SslCertPassword></SslCertPassword>
-  <UrlBase></UrlBase>
-  <InstanceName>Lidarr</InstanceName>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <Theme>auto</Theme>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-</Config>

ansible/app-configs/lidify/config.json.j2

@@ -1,25 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-    "lidarr_address": "http://lidarr:8686",
-    "lidarr_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIDARR_API_KEY'] }}",
-    "spotify_client_secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-    "root_folder_path": "/data/media/music",
-    "spotify_client_id": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
-    "spotify_client_secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-    "fallback_to_top_result": false,
-    "lidarr_api_timeout": 120.0,
-    "quality_profile_id": 1,
-    "metadata_profile_id": 1,
-    "search_for_missing_albums": false,
-    "dry_run_adding_to_lidarr": true,
-    "app_name": "lidify",
-    "app_rev": "0.09",
-    "app_url": "lidify.trez.wtf",
-    "last_fm_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
-    "last_fm_api_secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-    "mode": "LastFM",
-    "auto_start": false,
-    "auto_start_delay": 60
-}

ansible/app-configs/lidify_settings_config.json.j2

@@ -1,25 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-    "lidarr_address": "http://lidarr:8686",
-    "lidarr_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIDARR_API_KEY'] }}",
-    "spotify_client_secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-    "root_folder_path": "/data/media/music",
-    "spotify_client_id": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
-    "spotify_client_secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-    "fallback_to_top_result": false,
-    "lidarr_api_timeout": 120.0,
-    "quality_profile_id": 1,
-    "metadata_profile_id": 1,
-    "search_for_missing_albums": false,
-    "dry_run_adding_to_lidarr": true,
-    "app_name": "lidify",
-    "app_rev": "0.09",
-    "app_url": "lidify.trez.wtf",
-    "last_fm_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
-    "last_fm_api_secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-    "mode": "LastFM",
-    "auto_start": false,
-    "auto_start_delay": 60
-}

ansible/app-configs/loggifly/config.yaml.j2

@@ -1,33 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-containers:
-  ghost_blog:
-    action_keywords:
-      - restart:
-          regex: ':[0-9]{2}\] ERROR.*$'
-  immich-server:
-    action_keywords:
-      - restart:
-          regex: 'ADVICE:.*error'
-  invidious:
-    keywords:
-      - regex: 'Error reading.*Connection reset by peer trying to reconnect...'
-global_keywords:
-  keywords:
-    - panic
-  keywords_with_attachment:
-    - fatal
-notifications:
-  apprise:
-    url: gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}    # Any Apprise-compatible URL (https://github.com/caronc/apprise/wiki)
-# settings are optional because they all have default values
-settings:
-  log_level: INFO               # DEBUG, INFO, WARNING, ERROR
-  notification_cooldown: 5      # Seconds between alerts for same keyword (per container)
-  attachment_lines: 20          # Number of Lines to include in log attachments
-  multi_line_entries: true      # Detect multi-line log entries
-  disable_restart: false        # Disable restart when a config change is detected
-  disable_start_message: false  # Suppress startup notification
-  disable_shutdown_message: false  # Suppress shutdown notification
-  disable_restart_message: false   # Suppress config reload notification

ansible/app-configs/loggifly_config.yaml.j2

@@ -1,33 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-containers:
-  ghost_blog:
-    action_keywords:
-      - restart:
-          regex: ':[0-9]{2}\] ERROR.*$'
-  immich-server:
-    action_keywords:
-      - restart:
-          regex: 'ADVICE:.*error'
-  invidious:
-    keywords:
-      - regex: 'Error reading.*Connection reset by peer trying to reconnect...'
-global_keywords:
-  keywords:
-    - panic
-  keywords_with_attachment:
-    - fatal
-notifications:
-  apprise:
-    url: gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}    # Any Apprise-compatible URL (https://github.com/caronc/apprise/wiki)
-# settings are optional because they all have default values
-settings:
-  log_level: INFO               # DEBUG, INFO, WARNING, ERROR
-  notification_cooldown: 5      # Seconds between alerts for same keyword (per container)
-  attachment_lines: 20          # Number of Lines to include in log attachments
-  multi_line_entries: true      # Detect multi-line log entries
-  disable_restart: false        # Disable restart when a config change is detected
-  disable_start_message: false  # Suppress startup notification
-  disable_shutdown_message: false  # Suppress shutdown notification
-  disable_restart_message: false   # Suppress config reload notification

ansible/app-configs/mirotalk/src/config.js.j2

@@ -1,159 +0,0 @@
-'use strict';
-
-const packageJson = require('../../package.json');
-
-module.exports = {
-    // Branding and customizations require a license: https://codecanyon.net/item/mirotalk-p2p-webrtc-realtime-video-conferences/38376661
-    brand: {
-        app: {
-            language: 'en', // https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes
-            name: 'MiroTalk',
-            title: '<h1>MiroTalk</h1/>Free browser based Real-time video calls.<br />Simple, Secure, Fast.',
-            description:
-                'Start your next video call with a single click. No download, plug-in, or login is required. Just get straight to talking, messaging, and sharing your screen.',
-            joinDescription: 'Pick a room name.<br />How about this one?',
-            joinButtonLabel: 'JOIN ROOM',
-            joinLastLabel: 'Your recent room:',
-        },
-        og: {
-            type: 'app-webrtc',
-            siteName: 'MiroTalk',
-            title: 'Click the link to make a call.',
-            description:
-                'MiroTalk calling provides real-time HD quality and latency simply not available with traditional technology.',
-            image: 'https://p2p.mirotalk.com/images/preview.png',
-            url: 'https://p2p.mirotalk.com',
-        },
-        site: {
-            shortcutIcon: '../images/logo.svg',
-            appleTouchIcon: '../images/logo.svg',
-            landingTitle: 'MiroTalk a Free Secure Video Calls, Chat & Screen Sharing.',
-            newCallTitle: 'MiroTalk a Free Secure Video Calls, Chat & Screen Sharing.',
-            newCallRoomTitle: 'Pick name. <br />Share URL. <br />Start conference.',
-            newCallRoomDescription:
-                "Each room has its disposable URL. Just pick a room name and share your custom URL. It's that easy.",
-            loginTitle: 'MiroTalk - Host Protected login required.',
-            clientTitle: 'MiroTalk WebRTC Video call, Chat Room & Screen Sharing.',
-            privacyPolicyTitle: 'MiroTalk - privacy and policy.',
-            stunTurnTitle: 'Test Stun/Turn Servers.',
-            notFoundTitle: 'MiroTalk - 404 Page not found.',
-        },
-        html: {
-            features: true,
-            browsers: true,
-            teams: true, // please keep me always true ;)
-            tryEasier: true,
-            poweredBy: true,
-            sponsors: true,
-            advertisers: true,
-            footer: true,
-        },
-        about: {
-            imageUrl: '../images/mirotalk-logo.gif',
-            title: `WebRTC P2P v${packageJson.version}`,
-            html: `
-                <button
-                    id="support-button"
-                    data-umami-event="Support button"
-                    onclick="window.open('https://codecanyon.net/user/miroslavpejic85')">
-                    <i class="fas fa-heart" ></i>&nbsp;Support
-                </button>
-                <br /><br /><br />
-                Author:<a
-                    id="linkedin-button"
-                    data-umami-event="Linkedin button"
-                    href="https://www.linkedin.com/in/miroslav-pejic-976a07101/" target="_blank">
-                    Miroslav Pejic
-                </a>
-                <br /><br />
-                Email:<a
-                    id="email-button"
-                    data-umami-event="Email button"
-                    href="mailto:miroslav.pejic.85@gmail.com?subject=MiroTalk P2P info">
-                    miroslav.pejic.85@gmail.com
-                </a>
-                <br /><br />
-                <hr />
-                <span>&copy; 2025 MiroTalk P2P, all rights reserved</span>
-                <hr />
-            `,
-        },
-        //...
-    },
-    /**
-     * Configuration for controlling the visibility of buttons in the MiroTalk P2P client.
-     * Set properties to true to show the corresponding buttons, or false to hide them.
-     * captionBtn, showSwapCameraBtn, showScreenShareBtn, showFullScreenBtn, showVideoPipBtn, showDocumentPipBtn -> (auto-detected).
-     */
-    buttons: {
-        main: {
-            showShareQr: true,
-            showShareRoomBtn: true, // For guests
-            showHideMeBtn: true,
-            showAudioBtn: true,
-            showVideoBtn: true,
-            showScreenBtn: true, // autodetected
-            showRecordStreamBtn: true,
-            showChatRoomBtn: true,
-            showCaptionRoomBtn: true,
-            showRoomEmojiPickerBtn: true,
-            showMyHandBtn: true,
-            showWhiteboardBtn: true,
-            showSnapshotRoomBtn: true,
-            showFileShareBtn: true,
-            showDocumentPipBtn: true,
-            showMySettingsBtn: true,
-            showAboutBtn: true, // Please keep me always true, Thank you!
-        },
-        chat: {
-            showTogglePinBtn: true,
-            showMaxBtn: true,
-            showSaveMessageBtn: true,
-            showMarkDownBtn: true,
-            showChatGPTBtn: true,
-            showFileShareBtn: true,
-            showShareVideoAudioBtn: true,
-            showParticipantsBtn: true,
-        },
-        caption: {
-            showTogglePinBtn: true,
-            showMaxBtn: true,
-        },
-        settings: {
-            showMicOptionsBtn: true,
-            showTabRoomPeerName: true,
-            showTabRoomParticipants: true,
-            showTabRoomSecurity: true,
-            showTabEmailInvitation: true,
-            showCaptionEveryoneBtn: true,
-            showMuteEveryoneBtn: true,
-            showHideEveryoneBtn: true,
-            showEjectEveryoneBtn: true,
-            showLockRoomBtn: true,
-            showUnlockRoomBtn: true,
-            showShortcutsBtn: true,
-        },
-        remote: {
-            showAudioVolume: true,
-            audioBtnClickAllowed: true,
-            videoBtnClickAllowed: true,
-            showVideoPipBtn: true,
-            showKickOutBtn: true,
-            showSnapShotBtn: true,
-            showFileShareBtn: true,
-            showShareVideoAudioBtn: true,
-            showPrivateMessageBtn: true,
-            showZoomInOutBtn: false,
-            showVideoFocusBtn: true,
-        },
-        local: {
-            showVideoPipBtn: true,
-            showSnapShotBtn: true,
-            showVideoCircleBtn: true,
-            showZoomInOutBtn: false,
-        },
-        whiteboard: {
-            whiteboardLockBtn: false,
-        },
-    },
-};

ansible/app-configs/mirotalk_src_config.js.j2

@@ -1,159 +0,0 @@
-'use strict';
-
-const packageJson = require('../../package.json');
-
-module.exports = {
-    // Branding and customizations require a license: https://codecanyon.net/item/mirotalk-p2p-webrtc-realtime-video-conferences/38376661
-    brand: {
-        app: {
-            language: 'en', // https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes
-            name: 'MiroTalk',
-            title: '<h1>MiroTalk</h1/>Free browser based Real-time video calls.<br />Simple, Secure, Fast.',
-            description:
-                'Start your next video call with a single click. No download, plug-in, or login is required. Just get straight to talking, messaging, and sharing your screen.',
-            joinDescription: 'Pick a room name.<br />How about this one?',
-            joinButtonLabel: 'JOIN ROOM',
-            joinLastLabel: 'Your recent room:',
-        },
-        og: {
-            type: 'app-webrtc',
-            siteName: 'MiroTalk',
-            title: 'Click the link to make a call.',
-            description:
-                'MiroTalk calling provides real-time HD quality and latency simply not available with traditional technology.',
-            image: 'https://p2p.mirotalk.com/images/preview.png',
-            url: 'https://p2p.mirotalk.com',
-        },
-        site: {
-            shortcutIcon: '../images/logo.svg',
-            appleTouchIcon: '../images/logo.svg',
-            landingTitle: 'MiroTalk a Free Secure Video Calls, Chat & Screen Sharing.',
-            newCallTitle: 'MiroTalk a Free Secure Video Calls, Chat & Screen Sharing.',
-            newCallRoomTitle: 'Pick name. <br />Share URL. <br />Start conference.',
-            newCallRoomDescription:
-                "Each room has its disposable URL. Just pick a room name and share your custom URL. It's that easy.",
-            loginTitle: 'MiroTalk - Host Protected login required.',
-            clientTitle: 'MiroTalk WebRTC Video call, Chat Room & Screen Sharing.',
-            privacyPolicyTitle: 'MiroTalk - privacy and policy.',
-            stunTurnTitle: 'Test Stun/Turn Servers.',
-            notFoundTitle: 'MiroTalk - 404 Page not found.',
-        },
-        html: {
-            features: true,
-            browsers: true,
-            teams: true, // please keep me always true ;)
-            tryEasier: true,
-            poweredBy: true,
-            sponsors: true,
-            advertisers: true,
-            footer: true,
-        },
-        about: {
-            imageUrl: '../images/mirotalk-logo.gif',
-            title: `WebRTC P2P v${packageJson.version}`,
-            html: `
-                <button
-                    id="support-button"
-                    data-umami-event="Support button"
-                    onclick="window.open('https://codecanyon.net/user/miroslavpejic85')">
-                    <i class="fas fa-heart" ></i>&nbsp;Support
-                </button>
-                <br /><br /><br />
-                Author:<a
-                    id="linkedin-button"
-                    data-umami-event="Linkedin button"
-                    href="https://www.linkedin.com/in/miroslav-pejic-976a07101/" target="_blank">
-                    Miroslav Pejic
-                </a>
-                <br /><br />
-                Email:<a
-                    id="email-button"
-                    data-umami-event="Email button"
-                    href="mailto:miroslav.pejic.85@gmail.com?subject=MiroTalk P2P info">
-                    miroslav.pejic.85@gmail.com
-                </a>
-                <br /><br />
-                <hr />
-                <span>&copy; 2025 MiroTalk P2P, all rights reserved</span>
-                <hr />
-            `,
-        },
-        //...
-    },
-    /**
-     * Configuration for controlling the visibility of buttons in the MiroTalk P2P client.
-     * Set properties to true to show the corresponding buttons, or false to hide them.
-     * captionBtn, showSwapCameraBtn, showScreenShareBtn, showFullScreenBtn, showVideoPipBtn, showDocumentPipBtn -> (auto-detected).
-     */
-    buttons: {
-        main: {
-            showShareQr: true,
-            showShareRoomBtn: true, // For guests
-            showHideMeBtn: true,
-            showAudioBtn: true,
-            showVideoBtn: true,
-            showScreenBtn: true, // autodetected
-            showRecordStreamBtn: true,
-            showChatRoomBtn: true,
-            showCaptionRoomBtn: true,
-            showRoomEmojiPickerBtn: true,
-            showMyHandBtn: true,
-            showWhiteboardBtn: true,
-            showSnapshotRoomBtn: true,
-            showFileShareBtn: true,
-            showDocumentPipBtn: true,
-            showMySettingsBtn: true,
-            showAboutBtn: true, // Please keep me always true, Thank you!
-        },
-        chat: {
-            showTogglePinBtn: true,
-            showMaxBtn: true,
-            showSaveMessageBtn: true,
-            showMarkDownBtn: true,
-            showChatGPTBtn: true,
-            showFileShareBtn: true,
-            showShareVideoAudioBtn: true,
-            showParticipantsBtn: true,
-        },
-        caption: {
-            showTogglePinBtn: true,
-            showMaxBtn: true,
-        },
-        settings: {
-            showMicOptionsBtn: true,
-            showTabRoomPeerName: true,
-            showTabRoomParticipants: true,
-            showTabRoomSecurity: true,
-            showTabEmailInvitation: true,
-            showCaptionEveryoneBtn: true,
-            showMuteEveryoneBtn: true,
-            showHideEveryoneBtn: true,
-            showEjectEveryoneBtn: true,
-            showLockRoomBtn: true,
-            showUnlockRoomBtn: true,
-            showShortcutsBtn: true,
-        },
-        remote: {
-            showAudioVolume: true,
-            audioBtnClickAllowed: true,
-            videoBtnClickAllowed: true,
-            showVideoPipBtn: true,
-            showKickOutBtn: true,
-            showSnapShotBtn: true,
-            showFileShareBtn: true,
-            showShareVideoAudioBtn: true,
-            showPrivateMessageBtn: true,
-            showZoomInOutBtn: false,
-            showVideoFocusBtn: true,
-        },
-        local: {
-            showVideoPipBtn: true,
-            showSnapShotBtn: true,
-            showVideoCircleBtn: true,
-            showZoomInOutBtn: false,
-        },
-        whiteboard: {
-            whiteboardLockBtn: false,
-        },
-    },
-};

ansible/app-configs/multi-scrobbler/config.json.j2

@@ -1,111 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-  "debugMode": false,
-  "disableWeb": false,
-  "sourceDefaults": {
-    "logPayload": false,
-    "logFilterFailure": "warn",
-    "logPlayerState": false,
-    "scrobbleThresholds": {
-      "duration": 30,
-      "percent": 20
-    },
-    "maxPollRetries": 1,
-    "maxRequestRetries": 1,
-    "retryMultiplier": 1.5
-  },
-  "clientDefaults": {
-    "maxRequestRetries": 1,
-    "retryMultiplier": 1.5
-  },
-  "sources": [
-    {
-      "type": "spotify",
-      "enable": true,
-      "clients": [],
-      "name": "spotify",
-      "data": {
-        "clientId": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
-        "clientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/callback"
-      }
-    },
-    {
-      "type": "lastfm",
-      "enable": true,
-      "clients": [],
-      "name": "lastfm",
-      "data": {
-        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
-        "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/lastfm/callback"
-      }
-    },
-    {
-      "type": "listenbrainz",
-      "enable": true,
-      "clients": [],
-      "name": "listenBrainz",
-      "data": {
-        "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
-        "username": "Trez.One"
-      }
-    },
-    {
-      "type": "subsonic",
-      "enable": true,
-      "clients": [],
-      "name": "navidrome",
-      "data": {
-        "url": "http://navidrome:4533",
-        "user": "admin",
-        "password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NAVIDROME_PASSWORD'] }}"
-      }
-    }
-  ],
-  "clients": [
-    {
-      "type": "lastfm",
-      "enable": true,
-      "name": "lastFmClient",
-      "data": {
-        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
-        "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/lastfm/callback"
-      }
-    },
-    {
-      "type": "listenbrainz",
-      "enable": true,
-      "name": "ListenBrainzClient",
-      "data": {
-        "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
-        "username": "Trez.One"
-      }
-    },
-    {
-      "type": "maloja",
-      "enable": true,
-      "name": "maloja",
-      "data": {
-        "url": "http://maloja:42010",
-        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_API_KEY'] }}"
-      }
-    }
-  ],
-  "webhooks": [
-    {
-      "name": "Gotify",
-      "type": "gotify",
-      "url": "http://gotify",
-      "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MULTI_SCROBBLER_GOTIFY_TOKEN'] }}",
-      "priorities": {
-        "info": 5,
-        "warn": 7,
-        "error": 10
-      }
-    }
-  ]
-}

ansible/app-configs/multi-scrobbler_config.json.j2

@@ -1,111 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-  "debugMode": false,
-  "disableWeb": false,
-  "sourceDefaults": {
-    "logPayload": false,
-    "logFilterFailure": "warn",
-    "logPlayerState": false,
-    "scrobbleThresholds": {
-      "duration": 30,
-      "percent": 20
-    },
-    "maxPollRetries": 1,
-    "maxRequestRetries": 1,
-    "retryMultiplier": 1.5
-  },
-  "clientDefaults": {
-    "maxRequestRetries": 1,
-    "retryMultiplier": 1.5
-  },
-  "sources": [
-    {
-      "type": "spotify",
-      "enable": true,
-      "clients": [],
-      "name": "spotify",
-      "data": {
-        "clientId": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
-        "clientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/callback"
-      }
-    },
-    {
-      "type": "lastfm",
-      "enable": true,
-      "clients": [],
-      "name": "lastfm",
-      "data": {
-        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
-        "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/lastfm/callback"
-      }
-    },
-    {
-      "type": "listenbrainz",
-      "enable": true,
-      "clients": [],
-      "name": "listenBrainz",
-      "data": {
-        "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
-        "username": "Trez.One"
-      }
-    },
-    {
-      "type": "subsonic",
-      "enable": true,
-      "clients": [],
-      "name": "navidrome",
-      "data": {
-        "url": "http://navidrome:4533",
-        "user": "admin",
-        "password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NAVIDROME_PASSWORD'] }}"
-      }
-    }
-  ],
-  "clients": [
-    {
-      "type": "lastfm",
-      "enable": true,
-      "name": "lastFmClient",
-      "data": {
-        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
-        "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/lastfm/callback"
-      }
-    },
-    {
-      "type": "listenbrainz",
-      "enable": true,
-      "name": "ListenBrainzClient",
-      "data": {
-        "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
-        "username": "Trez.One"
-      }
-    },
-    {
-      "type": "maloja",
-      "enable": true,
-      "name": "maloja",
-      "data": {
-        "url": "http://maloja:42010",
-        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_API_KEY'] }}"
-      }
-    }
-  ],
-  "webhooks": [
-    {
-      "name": "Gotify",
-      "type": "gotify",
-      "url": "http://gotify",
-      "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MULTI_SCROBBLER_GOTIFY_TOKEN'] }}",
-      "priorities": {
-        "info": 5,
-        "warn": 7,
-        "error": 10
-      }
-    }
-  ]
-}

ansible/app-configs/netbird/management.json.j2

@@ -1,76 +0,0 @@
-{
-  "Stuns": [
-    {
-      "Proto": "udp",
-      "URI": "stun:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
-      "Username": "",
-      "Password": null
-    }
-  ],
-  "TURNConfig": {
-    "Turns": [
-      {
-        "Proto": "udp",
-        "URI": "turn:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
-        "Username": "self",
-        "Password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}"
-      }
-    ],
-    "CredentialsTTL": "12h",
-    "Secret": "secret",
-    "TimeBasedCredentials": false
-  },
-  "Relay": {
-    "Addresses": [
-      "rel://netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:33080"
-    ],
-    "CredentialsTTL": "24h",
-    "Secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_RELAY_AUTH_SECRET'] }}"
-  },
-  "Signal": {
-    "Proto": "https",
-    "URI": "netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:10001",
-    "Username": "",
-    "Password": null
-  },
-  "ReverseProxy": {
-    "TrustedHTTPProxies": [],
-    "TrustedHTTPProxiesCount": 0,
-    "TrustedPeers": [
-      "0.0.0.0/0"
-    ]
-  },
-  "Datadir": "",
-  "DataStoreEncryptionKey": "",
-  "StoreConfig": {
-    "Engine": "sqlite"
-  },
-  "HttpConfig": {
-    "Address": "0.0.0.0:33073",
-    "AuthIssuer": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
-    "AuthAudience": "netbird",
-    "AuthKeysLocation": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/jwks.json",
-    "AuthUserIDClaim": "",
-    "CertFile": "",
-    "CertKey": "",
-    "IdpSignKeyRefreshEnabled": true,
-    "OIDCConfigEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/.well-known/openid-configuration"
-  },
-  "IdpManagerConfig": {},
-  "DeviceAuthorizationFlow": {},
-  "PKCEAuthorizationFlow": {
-    "ProviderConfig": {
-      "Audience": "netbird",
-      "ClientID": "netbird",
-      "ClientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}",
-      "Domain": "",
-      "AuthorizationEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/api/oidc/authorization",
-      "TokenEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/api/oidc/token",
-      "Scope": "openid profile email offline_access api",
-      "RedirectURLs": [
-        "http://localhost:53000"
-      ],
-      "UseIDToken": true
-    }
-  }
-}

ansible/app-configs/netbird/openid-configuration.json.j2

@@ -1,122 +0,0 @@
-{
-    "issuer": "https://id.trez.wtf",
-    "authorization_endpoint": "https://id.trez.wtf/oauth/v2/authorize",
-    "token_endpoint": "https://id.trez.wtf/oauth/v2/token",
-    "introspection_endpoint": "https://id.trez.wtf/oauth/v2/introspect",
-    "userinfo_endpoint": "https://id.trez.wtf/oidc/v1/userinfo",
-    "revocation_endpoint": "https://id.trez.wtf/oauth/v2/revoke",
-    "end_session_endpoint": "https://id.trez.wtf/oidc/v1/end_session",
-    "device_authorization_endpoint": "https://id.trez.wtf/oauth/v2/device_authorization",
-    "jwks_uri": "https://id.trez.wtf/oauth/v2/keys",
-    "scopes_supported": [
-        "openid",
-        "profile",
-        "email",
-        "phone",
-        "address",
-        "offline_access"
-    ],
-    "response_types_supported": [
-        "code",
-        "id_token",
-        "id_token token"
-    ],
-    "response_modes_supported": [
-        "query",
-        "fragment",
-        "form_post"
-    ],
-    "grant_types_supported": [
-        "authorization_code",
-        "implicit",
-        "refresh_token",
-        "client_credentials",
-        "urn:ietf:params:oauth:grant-type:jwt-bearer",
-        "urn:ietf:params:oauth:grant-type:device_code"
-    ],
-    "subject_types_supported": [
-        "public"
-    ],
-    "id_token_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "request_object_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "token_endpoint_auth_methods_supported": [
-        "none",
-        "client_secret_basic",
-        "client_secret_post",
-        "private_key_jwt"
-    ],
-    "token_endpoint_auth_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "revocation_endpoint_auth_methods_supported": [
-        "none",
-        "client_secret_basic",
-        "client_secret_post",
-        "private_key_jwt"
-    ],
-    "revocation_endpoint_auth_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "introspection_endpoint_auth_methods_supported": [
-        "client_secret_basic",
-        "private_key_jwt"
-    ],
-    "introspection_endpoint_auth_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "claims_supported": [
-        "sub",
-        "aud",
-        "exp",
-        "iat",
-        "iss",
-        "auth_time",
-        "nonce",
-        "acr",
-        "amr",
-        "c_hash",
-        "at_hash",
-        "act",
-        "scopes",
-        "client_id",
-        "azp",
-        "preferred_username",
-        "name",
-        "family_name",
-        "given_name",
-        "locale",
-        "email",
-        "email_verified",
-        "phone_number",
-        "phone_number_verified"
-    ],
-    "code_challenge_methods_supported": [
-        "S256"
-    ],
-    "ui_locales_supported": [
-        "bg",
-        "cs",
-        "de",
-        "en",
-        "es",
-        "fr",
-        "hu",
-        "id",
-        "it",
-        "ja",
-        "ko",
-        "mk",
-        "nl",
-        "pl",
-        "pt",
-        "ru",
-        "sv",
-        "zh"
-    ],
-    "request_parameter_supported": true,
-    "request_uri_parameter_supported": false
-}

ansible/app-configs/netbird/turnserver.conf.j2

@@ -1,725 +0,0 @@
-# Coturn TURN SERVER configuration file
-#
-# Boolean values note: where a boolean value is supposed to be used,
-# you can use '0', 'off', 'no', 'false', or 'f' as 'false,
-# and you can use '1', 'on', 'yes', 'true', or 't' as 'true'
-# If the value is missing, then it means 'true' by default.
-#
-
-# Listener interface device (optional, Linux only).
-# NOT RECOMMENDED.
-#
-#listening-device=eth0
-
-# TURN listener port for UDP and TCP (Default: 3478).
-# Note: actually, TLS & DTLS sessions can connect to the
-# "plain" TCP & UDP port(s), too - if allowed by configuration.
-#
-listening-port=3478
-
-# TURN listener port for TLS (Default: 5349).
-# Note: actually, "plain" TCP & UDP sessions can connect to the TLS & DTLS
-# port(s), too - if allowed by configuration. The TURN server
-# "automatically" recognizes the type of traffic. Actually, two listening
-# endpoints (the "plain" one and the "tls" one) are equivalent in terms of
-# functionality; but Coturn keeps both endpoints to satisfy the RFC 5766 specs.
-# For secure TCP connections, Coturn currently supports SSL version 3 and
-# TLS version 1.0, 1.1 and 1.2.
-# For secure UDP connections, Coturn supports DTLS version 1.
-#
-tls-listening-port=5349
-
-# Alternative listening port for UDP and TCP listeners;
-# default (or zero) value means "listening port plus one".
-# This is needed for RFC 5780 support
-# (STUN extension specs, NAT behavior discovery). The TURN Server
-# supports RFC 5780 only if it is started with more than one
-# listening IP address of the same family (IPv4 or IPv6).
-# RFC 5780 is supported only by UDP protocol, other protocols
-# are listening to that endpoint only for "symmetry".
-#
-#alt-listening-port=0
-
-# Alternative listening port for TLS and DTLS protocols.
-# Default (or zero) value means "TLS listening port plus one".
-#
-#alt-tls-listening-port=0
-
-# Some network setups will require using a TCP reverse proxy in front
-# of the STUN server. If the proxy port option is set a single listener
-# is started on the given port that accepts connections using the
-# haproxy proxy protocol v2.
-# (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
-#
-#tcp-proxy-port=5555
-
-# Listener IP address of relay server. Multiple listeners can be specified.
-# If no IP(s) specified in the config file or in the command line options,
-# then all IPv4 and IPv6 system IPs will be used for listening.
-#
-#listening-ip=172.17.19.101
-#listening-ip=10.207.21.238
-#listening-ip=2607:f0d0:1002:51::4
-
-# Auxiliary STUN/TURN server listening endpoint.
-# Aux servers have almost full TURN and STUN functionality.
-# The (minor) limitations are:
-#
-# 1) Auxiliary servers do not have alternative ports and
-# they do not support STUN RFC 5780 functionality (CHANGE REQUEST).
-#
-# 2) Auxiliary servers also are never returning ALTERNATIVE-SERVER reply.
-#
-# Valid formats are 1.2.3.4:5555 for IPv4 and [1:2::3:4]:5555 for IPv6.
-#
-# There may be multiple aux-server options, each will be used for listening
-# to client requests.
-#
-#aux-server=172.17.19.110:33478
-#aux-server=[2607:f0d0:1002:51::4]:33478
-
-# (recommended for older Linuxes only)
-# Automatically balance UDP traffic over auxiliary servers (if configured).
-# The load balancing is using the ALTERNATE-SERVER mechanism.
-# The TURN client must support 300 ALTERNATE-SERVER response for this
-# functionality.
-#
-#udp-self-balance
-
-# Relay interface device for relay sockets (optional, Linux only).
-# NOT RECOMMENDED.
-#
-#relay-device=eth1
-
-# Relay address (the local IP address that will be used to relay the
-# packets to the peer).
-# Multiple relay addresses may be used.
-# The same IP(s) can be used as both listening IP(s) and relay IP(s).
-#
-# If no relay IP(s) specified, then the turnserver will apply the default
-# policy: it will decide itself which relay addresses to be used, and it
-# will always be using the client socket IP address as the relay IP address
-# of the TURN session (if the requested relay address family is the same
-# as the family of the client socket).
-#
-#relay-ip=172.17.19.105
-#relay-ip=2607:f0d0:1002:51::5
-
-# For Amazon EC2 users:
-#
-# TURN Server public/private address mapping, if the server is behind NAT.
-# In that situation, if a -X is used in form "-X <ip>" then that ip will be reported
-# as relay IP address of all allocations. This scenario works only in a simple case
-# when one single relay address is be used, and no RFC5780 functionality is required.
-# That single relay address must be mapped by NAT to the 'external' IP.
-# The "external-ip" value, if not empty, is returned in XOR-RELAYED-ADDRESS field.
-# For that 'external' IP, NAT must forward ports directly (relayed port 12345
-# must be always mapped to the same 'external' port 12345).
-#
-# In more complex case when more than one IP address is involved,
-# that option must be used several times, each entry must
-# have form "-X <public-ip/private-ip>", to map all involved addresses.
-# RFC5780 NAT discovery STUN functionality will work correctly,
-# if the addresses are mapped properly, even when the TURN server itself
-# is behind A NAT.
-#
-# By default, this value is empty, and no address mapping is used.
-#
-# external-ip=193.224.22.37
-#
-#OR:
-#
-#external-ip=60.70.80.91/172.17.19.101
-#external-ip=60.70.80.92/172.17.19.102
-
-external-ip=108.29.206.17
-
-# Number of the relay threads to handle the established connections
-# (in addition to authentication thread and the listener thread).
-# If explicitly set to 0 then application runs relay process in a
-# single thread, in the same thread with the listener process
-# (the authentication thread will still be a separate thread).
-#
-# If this parameter is not set, then the default OS-dependent
-# thread pattern algorithm will be employed. Usually the default
-# algorithm is optimal, so you have to change this option
-# if you want to make some fine tweaks.
-#
-# In the older systems (Linux kernel before 3.9),
-# the number of UDP threads is always one thread per network listening
-# endpoint - including the auxiliary endpoints - unless 0 (zero) or
-# 1 (one) value is set.
-#
-#relay-threads=0
-
-# Lower and upper bounds of the UDP relay endpoints:
-# (default values are 49152 and 65535)
-#
-min-port=49152
-max-port=65535
-
-# Uncomment to run TURN server in 'normal' 'moderate' verbose mode.
-# By default the verbose mode is off.
-#verbose
-
-# Uncomment to run TURN server in 'extra' verbose mode.
-# This mode is very annoying and produces lots of output.
-# Not recommended under normal circumstances.
-#
-#Verbose
-
-# Uncomment to use fingerprints in the TURN messages.
-# By default the fingerprints are off.
-#
-fingerprint
-
-# Uncomment to use long-term credential mechanism.
-# By default no credentials mechanism is used (any user allowed).
-#
-lt-cred-mech
-
-# This option is the opposite of lt-cred-mech.
-# (TURN Server with no-auth option allows anonymous access).
-# If neither option is defined, and no users are defined,
-# then no-auth is default. If at least one user is defined,
-# in this file, in command line or in usersdb file, then
-# lt-cred-mech is default.
-#
-#no-auth
-
-# TURN REST API flag.
-# (Time Limited Long Term Credential)
-# Flag that sets a special authorization option that is based upon authentication secret.
-#
-# This feature's purpose is to support "TURN Server REST API", see
-# "TURN REST API" link in the project's page
-# https://github.com/coturn/coturn/
-#
-# This option is used with timestamp:
-#
-# usercombo -> "timestamp:userid"
-# turn user -> usercombo
-# turn password -> base64(hmac(secret key, usercombo))
-#
-# This allows TURN credentials to be accounted for a specific user id.
-# If you don't have a suitable id, then the timestamp alone can be used.
-# This option is enabled by turning on secret-based authentication.
-# The actual value of the secret is defined either by the option static-auth-secret,
-# or can be found in the turn_secret table in the database (see below).
-#
-# Read more about it:
-#  - https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00
-#  - https://www.ietf.org/proceedings/87/slides/slides-87-behave-10.pdf
-#
-# Be aware that use-auth-secret overrides some parts of lt-cred-mech.
-# The use-auth-secret feature depends internally on lt-cred-mech, so if you set
-# this option then it automatically enables lt-cred-mech internally
-# as if you had enabled both.
-#
-# Note that you can use only one auth mechanism at the same time! This is because,
-# both mechanisms conduct username and password validation in different ways.
-#
-# Use either lt-cred-mech or use-auth-secret in the conf
-# to avoid any confusion.
-#
-#use-auth-secret
-
-# 'Static' authentication secret value (a string) for TURN REST API only.
-# If not set, then the turn server
-# will try to use the 'dynamic' value in the turn_secret table
-# in the user database (if present). The database-stored  value can be changed on-the-fly
-# by a separate program, so this is why that mode is considered 'dynamic'.
-#
-#static-auth-secret=north
-
-# Server name used for
-# the oAuth authentication purposes.
-# The default value is the realm name.
-#
-# server-name=stun.wiretrustee.com
-
-# Flag that allows oAuth authentication.
-#
-#oauth
-
-# 'Static' user accounts for the long term credentials mechanism, only.
-# This option cannot be used with TURN REST API.
-# 'Static' user accounts are NOT dynamically checked by the turnserver process,
-# so they can NOT be changed while the turnserver is running.
-#
-#user=username1:key1
-#user=username2:key2
-# OR:
-user=self:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}
-#user=username2:password2
-#
-# Keys must be generated by turnadmin utility. The key value depends
-# on user name, realm, and password:
-#
-# Example:
-# $ turnadmin -k -u ninefingers -r north.gov -p youhavetoberealistic
-# Output: 0xbc807ee29df3c9ffa736523fb2c4e8ee
-# ('0x' in the beginning of the key is what differentiates the key from
-# password. If it has 0x then it is a key, otherwise it is a password).
-#
-# The corresponding user account entry in the config file will be:
-#
-#user=ninefingers:0xbc807ee29df3c9ffa736523fb2c4e8ee
-# Or, equivalently, with open clear password (less secure):
-#user=ninefingers:youhavetoberealistic
-#
-
-# SQLite database file name.
-#
-# The default file name is /var/db/turndb or /usr/local/var/db/turndb or
-# /var/lib/turn/turndb.
-#
-#userdb=/var/db/turndb
-
-# PostgreSQL database connection string in the case that you are using PostgreSQL
-# as the user database.
-# This database can be used for the long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-# See http://www.postgresql.org/docs/8.4/static/libpq-connect.html for 8.x PostgreSQL
-# versions connection string format, see
-# http://www.postgresql.org/docs/9.2/static/libpq-connect.html#LIBPQ-CONNSTRING
-# for 9.x and newer connection string formats.
-#
-#psql-userdb="host=<host> dbname=<database-name> user=<database-user> password=<database-user-password> connect_timeout=30"
-
-# MySQL database connection string in the case that you are using MySQL
-# as the user database.
-# This database can be used for the long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-#
-# Optional connection string parameters for the secure communications (SSL):
-# ca, capath, cert, key, cipher
-# (see http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html for the
-# command options description).
-#
-# Use the string format below (space separated parameters, all optional):
-#
-# mysql-userdb="host=mysql dbname=coturn user=coturn password=CHANGE_ME port=3306 connect_timeout=10 read_timeout=10"
-
-# If you want to use an encrypted password in the MySQL connection string,
-# then set the MySQL password encryption secret key file with this option.
-#
-# Warning: If this option is set, then the mysql password must be set in "mysql-userdb" in an encrypted format!
-# If you want to use a cleartext password then do not set this option!
-#
-# This is the file path for the aes encrypted secret key used for password encryption.
-#
-#secret-key-file=/path/
-
-# MongoDB database connection string in the case that you are using MongoDB
-# as the user database.
-# This database can be used for long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-# Use the string format described at http://hergert.me/docs/mongo-c-driver/mongoc_uri.html
-#
-#mongo-userdb="mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][/[database][?options]]"
-
-# Redis database connection string in the case that you are using Redis
-# as the user database.
-# This database can be used for long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-# Use the string format below (space separated parameters, all optional):
-#
-#redis-userdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
-
-# Redis status and statistics database connection string, if used (default - empty, no Redis stats DB used).
-# This database keeps allocations status information, and it can be also used for publishing
-# and delivering traffic and allocation event notifications.
-# The connection string has the same parameters as redis-userdb connection string.
-# Use the string format below (space separated parameters, all optional):
-#
-#redis-statsdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
-
-# The default realm to be used for the users when no explicit
-# origin/realm relationship is found in the database, or if the TURN
-# server is not using any database (just the commands-line settings
-# and the userdb file). Must be used with long-term credentials
-# mechanism or with TURN REST API.
-#
-# Note: If the default realm is not specified, then realm falls back to the host domain name.
-#       If the domain name string is empty, or set to '(None)', then it is initialized as an empty string.
-#
-# realm=wiretrustee.com
-# This flag sets the origin consistency
-# check. Across the session, all requests must have the same
-# main ORIGIN attribute value (if the ORIGIN was
-# initially used by the session).
-#
-#check-origin-consistency
-
-# Per-user allocation quota.
-# default value is 0 (no quota, unlimited number of sessions per user).
-# This option can also be set through the database, for a particular realm.
-#
-#user-quota=0
-
-# Total allocation quota.
-# default value is 0 (no quota).
-# This option can also be set through the database, for a particular realm.
-#
-#total-quota=0
-
-# Max bytes-per-second bandwidth a TURN session is allowed to handle
-# (input and output network streams are treated separately). Anything above
-# that limit will be dropped or temporarily suppressed (within
-# the available buffer limits).
-# This option can also be set through the database, for a particular realm.
-#
-#max-bps=0
-
-#
-# Maximum server capacity.
-# Total bytes-per-second bandwidth the TURN server is allowed to allocate
-# for the sessions, combined (input and output network streams are treated separately).
-#
-# bps-capacity=0
-
-# Uncomment if no UDP client listener is desired.
-# By default UDP client listener is always started.
-#
-#no-udp
-
-# Uncomment if no TCP client listener is desired.
-# By default TCP client listener is always started.
-#
-#no-tcp
-
-# Uncomment if no TLS client listener is desired.
-# By default TLS client listener is always started.
-#
-#no-tls
-
-# Uncomment if no DTLS client listener is desired.
-# By default DTLS client listener is always started.
-#
-#no-dtls
-
-# Uncomment if no UDP relay endpoints are allowed.
-# By default UDP relay endpoints are enabled (like in RFC 5766).
-#
-#no-udp-relay
-
-# Uncomment if no TCP relay endpoints are allowed.
-# By default TCP relay endpoints are enabled (like in RFC 6062).
-#
-#no-tcp-relay
-
-# Uncomment if extra security is desired,
-# with nonce value having a limited lifetime.
-# The nonce value is unique for a session.
-# Set this option to limit the nonce lifetime.
-# Set it to 0 for unlimited lifetime.
-# It defaults to 600 secs (10 min) if no value is provided. After that delay,
-# the client will get 438 error and will have to re-authenticate itself.
-#
-#stale-nonce=600
-
-# Uncomment if you want to set the maximum allocation
-# time before it has to be refreshed.
-# Default is 3600s.
-#
-#max-allocate-lifetime=3600
-
-
-# Uncomment to set the lifetime for the channel.
-# Default value is 600 secs (10 minutes).
-# This value MUST not be changed for production purposes.
-#
-#channel-lifetime=600
-
-# Uncomment to set the permission lifetime.
-# Default to 300 secs (5 minutes).
-# In production this value MUST not be changed,
-# however it can be useful for test purposes.
-#
-#permission-lifetime=300
-
-# Certificate file.
-# Use an absolute path or path relative to the
-# configuration file.
-# Use PEM file format.
-#
-cert=/etc/coturn/certs/cert.pem
-
-# Private key file.
-# Use an absolute path or path relative to the
-# configuration file.
-# Use PEM file format.
-#
-pkey=/etc/coturn/private/privkey.pem
-
-# Private key file password, if it is in encoded format.
-# This option has no default value.
-#
-#pkey-pwd=...
-
-# Allowed OpenSSL cipher list for TLS/DTLS connections.
-# Default value is "DEFAULT".
-#
-#cipher-list="DEFAULT"
-
-# CA file in OpenSSL format.
-# Forces TURN server to verify the client SSL certificates.
-# By default this is not set: there is no default value and the client
-# certificate is not checked.
-#
-# Example:
-#CA-file=/etc/ssh/id_rsa.cert
-
-# Curve name for EC ciphers, if supported by OpenSSL
-# library (TLS and DTLS). The default value is prime256v1,
-# if pre-OpenSSL 1.0.2 is used. With OpenSSL 1.0.2+,
-# an optimal curve will be automatically calculated, if not defined
-# by this option.
-#
-#ec-curve-name=prime256v1
-
-# Use 566 bits predefined DH TLS key. Default size of the key is 2066.
-#
-#dh566
-
-# Use 1066 bits predefined DH TLS key. Default size of the key is 2066.
-#
-#dh1066
-
-# Use custom DH TLS key, stored in PEM format in the file.
-# Flags --dh566 and --dh2066 are ignored when the DH key is taken from a file.
-#
-#dh-file=<DH-PEM-file-name>
-
-# Flag to prevent stdout log messages.
-# By default, all log messages go to both stdout and to
-# the configured log file. With this option everything will
-# go to the configured log only (unless the log file itself is stdout).
-#
-#no-stdout-log
-
-# Option to set the log file name.
-# By default, the turnserver tries to open a log file in
-# /var/log, /var/tmp, /tmp and the current directory
-# (Whichever file open operation succeeds first will be used).
-# With this option you can set the definite log file name.
-# The special names are "stdout" and "-" - they will force everything
-# to the stdout. Also, the "syslog" name will force everything to
-# the system log (syslog).
-# In the runtime, the logfile can be reset with the SIGHUP signal
-# to the turnserver process.
-#
-log-file=stdout
-
-# Option to redirect all log output into system log (syslog).
-#
-# syslog
-
-# This flag means that no log file rollover will be used, and the log file
-# name will be constructed as-is, without PID and date appendage.
-# This option can be used, for example, together with the logrotate tool.
-#
-#simple-log
-
-# Option to set the "redirection" mode. The value of this option
-# will be the address of the alternate server for UDP & TCP service in the form of
-# <ip>[:<port>]. The server will send this value in the attribute
-# ALTERNATE-SERVER, with error 300, on ALLOCATE request, to the client.
-# Client will receive only values with the same address family
-# as the client network endpoint address family.
-# See RFC 5389 and RFC 5766 for the description of ALTERNATE-SERVER functionality.
-# The client must use the obtained value for subsequent TURN communications.
-# If more than one --alternate-server option is provided, then the functionality
-# can be more accurately described as "load-balancing" than a mere "redirection".
-# If the port number is omitted, then the default port
-# number 3478 for the UDP/TCP protocols will be used.
-# Colon (:) characters in IPv6 addresses may conflict with the syntax of
-# the option. To alleviate this conflict, literal IPv6 addresses are enclosed
-# in square brackets in such resource identifiers, for example:
-# [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 .
-# Multiple alternate servers can be set. They will be used in the
-# round-robin manner. All servers in the pool are considered of equal weight and
-# the load will be distributed equally. For example, if you have 4 alternate servers,
-# then each server will receive 25% of ALLOCATE requests. A alternate TURN server
-# address can be used more than one time with the alternate-server option, so this
-# can emulate "weighting" of the servers.
-#
-# Examples:
-#alternate-server=1.2.3.4:5678
-#alternate-server=11.22.33.44:56789
-#alternate-server=5.6.7.8
-#alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
-
-# Option to set alternative server for TLS & DTLS services in form of
-# <ip>:<port>. If the port number is omitted, then the default port
-# number 5349 for the TLS/DTLS protocols will be used. See the previous
-# option for the functionality description.
-#
-# Examples:
-#tls-alternate-server=1.2.3.4:5678
-#tls-alternate-server=11.22.33.44:56789
-#tls-alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
-
-# Option to suppress TURN functionality, only STUN requests will be processed.
-# Run as STUN server only, all TURN requests will be ignored.
-# By default, this option is NOT set.
-#
-#stun-only
-
-# Option to hide software version. Enhance security when used in production.
-# Revealing the specific software version of the agent through the
-# SOFTWARE attribute might allow them to become more vulnerable to
-# attacks against software that is known to contain security holes.
-# Implementers SHOULD make usage of the SOFTWARE attribute a
-# configurable option (https://tools.ietf.org/html/rfc5389#section-16.1.2)
-#
-no-software-attribute
-
-# Option to suppress STUN functionality, only TURN requests will be processed.
-# Run as TURN server only, all STUN requests will be ignored.
-# By default, this option is NOT set.
-#
-#no-stun
-
-# This is the timestamp/username separator symbol (character) in TURN REST API.
-# The default value is ':'.
-# rest-api-separator=:
-
-# Flag that can be used to allow peers on the loopback addresses (127.x.x.x and ::1).
-# This is an extra security measure.
-#
-# (To avoid any security issue that allowing loopback access may raise,
-# the no-loopback-peers option is replaced by allow-loopback-peers.)
-#
-# Allow it only for testing in a development environment!
-# In production it adds a possible security vulnerability, so for security reasons
-# it is not allowed using it together with empty cli-password.
-#
-#allow-loopback-peers
-
-# Flag that can be used to disallow peers on well-known broadcast addresses (224.0.0.0 and above, and FFXX:*).
-# This is an extra security measure.
-#
-#no-multicast-peers
-
-# Option to set the max time, in seconds, allowed for full allocation establishment.
-# Default is 60 seconds.
-#
-#max-allocate-timeout=60
-
-# Option to allow or ban specific ip addresses or ranges of ip addresses.
-# If an ip address is specified as both allowed and denied, then the ip address is
-# considered to be allowed. This is useful when you wish to ban a range of ip
-# addresses, except for a few specific ips within that range.
-#
-# This can be used when you do not want users of the turn server to be able to access
-# machines reachable by the turn server, but would otherwise be unreachable from the
-# internet (e.g. when the turn server is sitting behind a NAT)
-#
-# Examples:
-# denied-peer-ip=83.166.64.0-83.166.95.255
-# allowed-peer-ip=83.166.68.45
-
-# File name to store the pid of the process.
-# Default is /var/run/turnserver.pid (if superuser account is used) or
-# /var/tmp/turnserver.pid .
-#
-pidfile="/var/tmp/turnserver.pid"
-
-# Require authentication of the STUN Binding request.
-# By default, the clients are allowed anonymous access to the STUN Binding functionality.
-#
-#secure-stun
-
-# Mobility with ICE (MICE) specs support.
-#
-#mobility
-
-# Allocate Address Family according
-# If enabled then TURN server allocates address family according  the TURN
-# Client <=> Server communication address family.
-# (By default Coturn works according RFC 6156.)
-# !!Warning: Enabling this option breaks RFC6156 section-4.2 (violates use default IPv4)!!
-#
-#keep-address-family
-
-
-# User name to run the process. After the initialization, the turnserver process
-# will attempt to change the current user ID to that user.
-#
-#proc-user=<user-name>
-
-# Group name to run the process. After the initialization, the turnserver process
-# will attempt to change the current group ID to that group.
-#
-#proc-group=<group-name>
-
-# Turn OFF the CLI support.
-# By default it is always ON.
-# See also options cli-ip and cli-port.
-#
-no-cli
-
-#Local system IP address to be used for CLI server endpoint. Default value
-# is 127.0.0.1.
-#
-# cli-ip=127.0.0.1
-
-# CLI server port. Default is 5766.
-#
-# cli-port=5766
-
-# CLI access password. Default is empty (no password).
-# For the security reasons, it is recommended that you use the encrypted
-# form of the password (see the -P command in the turnadmin utility).
-#
-# Secure form for password 'qwerty':
-#
-#cli-password=$5$79a316b350311570$81df9cfb9af7f5e5a76eada31e7097b663a0670f99a3c07ded3f1c8e59c5658a
-#
-# Or insecure form for the same password:
-#
-# cli-password=CHANGE_ME
-
-# Enable Web-admin support on https. By default it is Disabled.
-# If it is enabled it also enables a http a simple static banner page
-# with a small reminder that the admin page is available only on https.
-#
-#web-admin
-
-# Local system IP address to be used for Web-admin server endpoint. Default value is 127.0.0.1.
-#
-#web-admin-ip=127.0.0.1
-
-# Web-admin server port. Default is 8080.
-#
-#web-admin-port=8080
-
-# Web-admin server listen on STUN/TURN worker threads
-# By default it is disabled for security reasons! (Not recommended in any production environment!)
-#
-#web-admin-listen-on-workers
-
-# Server relay. NON-STANDARD AND DANGEROUS OPTION.
-# Only for those applications when you want to run
-# server applications on the relay endpoints.
-# This option eliminates the IP permissions check on
-# the packets incoming to the relay endpoints.
-#
-#server-relay
-
-# Maximum number of output sessions in ps CLI command.
-# This value can be changed on-the-fly in CLI. The default value is 256.
-#
-#cli-max-output-sessions
-
-# Set network engine type for the process (for internal purposes).
-#
-#ne=[1|2|3]
-
-# Do not allow an TLS/DTLS version of protocol
-#
-#no-tlsv1
-#no-tlsv1_1
-#no-tlsv1_2

ansible/app-configs/netbird_management.json.j2

@@ -1,76 +0,0 @@
-{
-  "Stuns": [
-    {
-      "Proto": "udp",
-      "URI": "stun:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
-      "Username": "",
-      "Password": null
-    }
-  ],
-  "TURNConfig": {
-    "Turns": [
-      {
-        "Proto": "udp",
-        "URI": "turn:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
-        "Username": "self",
-        "Password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}"
-      }
-    ],
-    "CredentialsTTL": "12h",
-    "Secret": "secret",
-    "TimeBasedCredentials": false
-  },
-  "Relay": {
-    "Addresses": [
-      "rel://netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:33080"
-    ],
-    "CredentialsTTL": "24h",
-    "Secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_RELAY_AUTH_SECRET'] }}"
-  },
-  "Signal": {
-    "Proto": "https",
-    "URI": "netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:10001",
-    "Username": "",
-    "Password": null
-  },
-  "ReverseProxy": {
-    "TrustedHTTPProxies": [],
-    "TrustedHTTPProxiesCount": 0,
-    "TrustedPeers": [
-      "0.0.0.0/0"
-    ]
-  },
-  "Datadir": "",
-  "DataStoreEncryptionKey": "",
-  "StoreConfig": {
-    "Engine": "sqlite"
-  },
-  "HttpConfig": {
-    "Address": "0.0.0.0:33073",
-    "AuthIssuer": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
-    "AuthAudience": "netbird",
-    "AuthKeysLocation": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/jwks.json",
-    "AuthUserIDClaim": "",
-    "CertFile": "",
-    "CertKey": "",
-    "IdpSignKeyRefreshEnabled": true,
-    "OIDCConfigEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/.well-known/openid-configuration"
-  },
-  "IdpManagerConfig": {},
-  "DeviceAuthorizationFlow": {},
-  "PKCEAuthorizationFlow": {
-    "ProviderConfig": {
-      "Audience": "netbird",
-      "ClientID": "netbird",
-      "ClientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['AUTHELIA_NETBIRD_CLIENT_SECRET'] }}",
-      "Domain": "",
-      "AuthorizationEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/api/oidc/authorization",
-      "TokenEndpoint": "https://auth.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/api/oidc/token",
-      "Scope": "openid profile email offline_access api",
-      "RedirectURLs": [
-        "http://localhost:53000"
-      ],
-      "UseIDToken": true
-    }
-  }
-}

ansible/app-configs/netbird_openid-configuration.json.j2

@@ -1,122 +0,0 @@
-{
-    "issuer": "https://id.trez.wtf",
-    "authorization_endpoint": "https://id.trez.wtf/oauth/v2/authorize",
-    "token_endpoint": "https://id.trez.wtf/oauth/v2/token",
-    "introspection_endpoint": "https://id.trez.wtf/oauth/v2/introspect",
-    "userinfo_endpoint": "https://id.trez.wtf/oidc/v1/userinfo",
-    "revocation_endpoint": "https://id.trez.wtf/oauth/v2/revoke",
-    "end_session_endpoint": "https://id.trez.wtf/oidc/v1/end_session",
-    "device_authorization_endpoint": "https://id.trez.wtf/oauth/v2/device_authorization",
-    "jwks_uri": "https://id.trez.wtf/oauth/v2/keys",
-    "scopes_supported": [
-        "openid",
-        "profile",
-        "email",
-        "phone",
-        "address",
-        "offline_access"
-    ],
-    "response_types_supported": [
-        "code",
-        "id_token",
-        "id_token token"
-    ],
-    "response_modes_supported": [
-        "query",
-        "fragment",
-        "form_post"
-    ],
-    "grant_types_supported": [
-        "authorization_code",
-        "implicit",
-        "refresh_token",
-        "client_credentials",
-        "urn:ietf:params:oauth:grant-type:jwt-bearer",
-        "urn:ietf:params:oauth:grant-type:device_code"
-    ],
-    "subject_types_supported": [
-        "public"
-    ],
-    "id_token_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "request_object_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "token_endpoint_auth_methods_supported": [
-        "none",
-        "client_secret_basic",
-        "client_secret_post",
-        "private_key_jwt"
-    ],
-    "token_endpoint_auth_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "revocation_endpoint_auth_methods_supported": [
-        "none",
-        "client_secret_basic",
-        "client_secret_post",
-        "private_key_jwt"
-    ],
-    "revocation_endpoint_auth_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "introspection_endpoint_auth_methods_supported": [
-        "client_secret_basic",
-        "private_key_jwt"
-    ],
-    "introspection_endpoint_auth_signing_alg_values_supported": [
-        "RS256"
-    ],
-    "claims_supported": [
-        "sub",
-        "aud",
-        "exp",
-        "iat",
-        "iss",
-        "auth_time",
-        "nonce",
-        "acr",
-        "amr",
-        "c_hash",
-        "at_hash",
-        "act",
-        "scopes",
-        "client_id",
-        "azp",
-        "preferred_username",
-        "name",
-        "family_name",
-        "given_name",
-        "locale",
-        "email",
-        "email_verified",
-        "phone_number",
-        "phone_number_verified"
-    ],
-    "code_challenge_methods_supported": [
-        "S256"
-    ],
-    "ui_locales_supported": [
-        "bg",
-        "cs",
-        "de",
-        "en",
-        "es",
-        "fr",
-        "hu",
-        "id",
-        "it",
-        "ja",
-        "ko",
-        "mk",
-        "nl",
-        "pl",
-        "pt",
-        "ru",
-        "sv",
-        "zh"
-    ],
-    "request_parameter_supported": true,
-    "request_uri_parameter_supported": false
-}

ansible/app-configs/netbird_turnserver.conf.j2

@@ -1,725 +0,0 @@
-# Coturn TURN SERVER configuration file
-#
-# Boolean values note: where a boolean value is supposed to be used,
-# you can use '0', 'off', 'no', 'false', or 'f' as 'false,
-# and you can use '1', 'on', 'yes', 'true', or 't' as 'true'
-# If the value is missing, then it means 'true' by default.
-#
-
-# Listener interface device (optional, Linux only).
-# NOT RECOMMENDED.
-#
-#listening-device=eth0
-
-# TURN listener port for UDP and TCP (Default: 3478).
-# Note: actually, TLS & DTLS sessions can connect to the
-# "plain" TCP & UDP port(s), too - if allowed by configuration.
-#
-listening-port=3478
-
-# TURN listener port for TLS (Default: 5349).
-# Note: actually, "plain" TCP & UDP sessions can connect to the TLS & DTLS
-# port(s), too - if allowed by configuration. The TURN server
-# "automatically" recognizes the type of traffic. Actually, two listening
-# endpoints (the "plain" one and the "tls" one) are equivalent in terms of
-# functionality; but Coturn keeps both endpoints to satisfy the RFC 5766 specs.
-# For secure TCP connections, Coturn currently supports SSL version 3 and
-# TLS version 1.0, 1.1 and 1.2.
-# For secure UDP connections, Coturn supports DTLS version 1.
-#
-tls-listening-port=5349
-
-# Alternative listening port for UDP and TCP listeners;
-# default (or zero) value means "listening port plus one".
-# This is needed for RFC 5780 support
-# (STUN extension specs, NAT behavior discovery). The TURN Server
-# supports RFC 5780 only if it is started with more than one
-# listening IP address of the same family (IPv4 or IPv6).
-# RFC 5780 is supported only by UDP protocol, other protocols
-# are listening to that endpoint only for "symmetry".
-#
-#alt-listening-port=0
-
-# Alternative listening port for TLS and DTLS protocols.
-# Default (or zero) value means "TLS listening port plus one".
-#
-#alt-tls-listening-port=0
-
-# Some network setups will require using a TCP reverse proxy in front
-# of the STUN server. If the proxy port option is set a single listener
-# is started on the given port that accepts connections using the
-# haproxy proxy protocol v2.
-# (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
-#
-#tcp-proxy-port=5555
-
-# Listener IP address of relay server. Multiple listeners can be specified.
-# If no IP(s) specified in the config file or in the command line options,
-# then all IPv4 and IPv6 system IPs will be used for listening.
-#
-#listening-ip=172.17.19.101
-#listening-ip=10.207.21.238
-#listening-ip=2607:f0d0:1002:51::4
-
-# Auxiliary STUN/TURN server listening endpoint.
-# Aux servers have almost full TURN and STUN functionality.
-# The (minor) limitations are:
-#
-# 1) Auxiliary servers do not have alternative ports and
-# they do not support STUN RFC 5780 functionality (CHANGE REQUEST).
-#
-# 2) Auxiliary servers also are never returning ALTERNATIVE-SERVER reply.
-#
-# Valid formats are 1.2.3.4:5555 for IPv4 and [1:2::3:4]:5555 for IPv6.
-#
-# There may be multiple aux-server options, each will be used for listening
-# to client requests.
-#
-#aux-server=172.17.19.110:33478
-#aux-server=[2607:f0d0:1002:51::4]:33478
-
-# (recommended for older Linuxes only)
-# Automatically balance UDP traffic over auxiliary servers (if configured).
-# The load balancing is using the ALTERNATE-SERVER mechanism.
-# The TURN client must support 300 ALTERNATE-SERVER response for this
-# functionality.
-#
-#udp-self-balance
-
-# Relay interface device for relay sockets (optional, Linux only).
-# NOT RECOMMENDED.
-#
-#relay-device=eth1
-
-# Relay address (the local IP address that will be used to relay the
-# packets to the peer).
-# Multiple relay addresses may be used.
-# The same IP(s) can be used as both listening IP(s) and relay IP(s).
-#
-# If no relay IP(s) specified, then the turnserver will apply the default
-# policy: it will decide itself which relay addresses to be used, and it
-# will always be using the client socket IP address as the relay IP address
-# of the TURN session (if the requested relay address family is the same
-# as the family of the client socket).
-#
-#relay-ip=172.17.19.105
-#relay-ip=2607:f0d0:1002:51::5
-
-# For Amazon EC2 users:
-#
-# TURN Server public/private address mapping, if the server is behind NAT.
-# In that situation, if a -X is used in form "-X <ip>" then that ip will be reported
-# as relay IP address of all allocations. This scenario works only in a simple case
-# when one single relay address is be used, and no RFC5780 functionality is required.
-# That single relay address must be mapped by NAT to the 'external' IP.
-# The "external-ip" value, if not empty, is returned in XOR-RELAYED-ADDRESS field.
-# For that 'external' IP, NAT must forward ports directly (relayed port 12345
-# must be always mapped to the same 'external' port 12345).
-#
-# In more complex case when more than one IP address is involved,
-# that option must be used several times, each entry must
-# have form "-X <public-ip/private-ip>", to map all involved addresses.
-# RFC5780 NAT discovery STUN functionality will work correctly,
-# if the addresses are mapped properly, even when the TURN server itself
-# is behind A NAT.
-#
-# By default, this value is empty, and no address mapping is used.
-#
-# external-ip=193.224.22.37
-#
-#OR:
-#
-#external-ip=60.70.80.91/172.17.19.101
-#external-ip=60.70.80.92/172.17.19.102
-
-external-ip=108.29.206.17
-
-# Number of the relay threads to handle the established connections
-# (in addition to authentication thread and the listener thread).
-# If explicitly set to 0 then application runs relay process in a
-# single thread, in the same thread with the listener process
-# (the authentication thread will still be a separate thread).
-#
-# If this parameter is not set, then the default OS-dependent
-# thread pattern algorithm will be employed. Usually the default
-# algorithm is optimal, so you have to change this option
-# if you want to make some fine tweaks.
-#
-# In the older systems (Linux kernel before 3.9),
-# the number of UDP threads is always one thread per network listening
-# endpoint - including the auxiliary endpoints - unless 0 (zero) or
-# 1 (one) value is set.
-#
-#relay-threads=0
-
-# Lower and upper bounds of the UDP relay endpoints:
-# (default values are 49152 and 65535)
-#
-min-port=49152
-max-port=65535
-
-# Uncomment to run TURN server in 'normal' 'moderate' verbose mode.
-# By default the verbose mode is off.
-#verbose
-
-# Uncomment to run TURN server in 'extra' verbose mode.
-# This mode is very annoying and produces lots of output.
-# Not recommended under normal circumstances.
-#
-#Verbose
-
-# Uncomment to use fingerprints in the TURN messages.
-# By default the fingerprints are off.
-#
-fingerprint
-
-# Uncomment to use long-term credential mechanism.
-# By default no credentials mechanism is used (any user allowed).
-#
-lt-cred-mech
-
-# This option is the opposite of lt-cred-mech.
-# (TURN Server with no-auth option allows anonymous access).
-# If neither option is defined, and no users are defined,
-# then no-auth is default. If at least one user is defined,
-# in this file, in command line or in usersdb file, then
-# lt-cred-mech is default.
-#
-#no-auth
-
-# TURN REST API flag.
-# (Time Limited Long Term Credential)
-# Flag that sets a special authorization option that is based upon authentication secret.
-#
-# This feature's purpose is to support "TURN Server REST API", see
-# "TURN REST API" link in the project's page
-# https://github.com/coturn/coturn/
-#
-# This option is used with timestamp:
-#
-# usercombo -> "timestamp:userid"
-# turn user -> usercombo
-# turn password -> base64(hmac(secret key, usercombo))
-#
-# This allows TURN credentials to be accounted for a specific user id.
-# If you don't have a suitable id, then the timestamp alone can be used.
-# This option is enabled by turning on secret-based authentication.
-# The actual value of the secret is defined either by the option static-auth-secret,
-# or can be found in the turn_secret table in the database (see below).
-#
-# Read more about it:
-#  - https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00
-#  - https://www.ietf.org/proceedings/87/slides/slides-87-behave-10.pdf
-#
-# Be aware that use-auth-secret overrides some parts of lt-cred-mech.
-# The use-auth-secret feature depends internally on lt-cred-mech, so if you set
-# this option then it automatically enables lt-cred-mech internally
-# as if you had enabled both.
-#
-# Note that you can use only one auth mechanism at the same time! This is because,
-# both mechanisms conduct username and password validation in different ways.
-#
-# Use either lt-cred-mech or use-auth-secret in the conf
-# to avoid any confusion.
-#
-#use-auth-secret
-
-# 'Static' authentication secret value (a string) for TURN REST API only.
-# If not set, then the turn server
-# will try to use the 'dynamic' value in the turn_secret table
-# in the user database (if present). The database-stored  value can be changed on-the-fly
-# by a separate program, so this is why that mode is considered 'dynamic'.
-#
-#static-auth-secret=north
-
-# Server name used for
-# the oAuth authentication purposes.
-# The default value is the realm name.
-#
-# server-name=stun.wiretrustee.com
-
-# Flag that allows oAuth authentication.
-#
-#oauth
-
-# 'Static' user accounts for the long term credentials mechanism, only.
-# This option cannot be used with TURN REST API.
-# 'Static' user accounts are NOT dynamically checked by the turnserver process,
-# so they can NOT be changed while the turnserver is running.
-#
-#user=username1:key1
-#user=username2:key2
-# OR:
-user=self:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}
-#user=username2:password2
-#
-# Keys must be generated by turnadmin utility. The key value depends
-# on user name, realm, and password:
-#
-# Example:
-# $ turnadmin -k -u ninefingers -r north.gov -p youhavetoberealistic
-# Output: 0xbc807ee29df3c9ffa736523fb2c4e8ee
-# ('0x' in the beginning of the key is what differentiates the key from
-# password. If it has 0x then it is a key, otherwise it is a password).
-#
-# The corresponding user account entry in the config file will be:
-#
-#user=ninefingers:0xbc807ee29df3c9ffa736523fb2c4e8ee
-# Or, equivalently, with open clear password (less secure):
-#user=ninefingers:youhavetoberealistic
-#
-
-# SQLite database file name.
-#
-# The default file name is /var/db/turndb or /usr/local/var/db/turndb or
-# /var/lib/turn/turndb.
-#
-#userdb=/var/db/turndb
-
-# PostgreSQL database connection string in the case that you are using PostgreSQL
-# as the user database.
-# This database can be used for the long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-# See http://www.postgresql.org/docs/8.4/static/libpq-connect.html for 8.x PostgreSQL
-# versions connection string format, see
-# http://www.postgresql.org/docs/9.2/static/libpq-connect.html#LIBPQ-CONNSTRING
-# for 9.x and newer connection string formats.
-#
-#psql-userdb="host=<host> dbname=<database-name> user=<database-user> password=<database-user-password> connect_timeout=30"
-
-# MySQL database connection string in the case that you are using MySQL
-# as the user database.
-# This database can be used for the long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-#
-# Optional connection string parameters for the secure communications (SSL):
-# ca, capath, cert, key, cipher
-# (see http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html for the
-# command options description).
-#
-# Use the string format below (space separated parameters, all optional):
-#
-# mysql-userdb="host=mysql dbname=coturn user=coturn password=CHANGE_ME port=3306 connect_timeout=10 read_timeout=10"
-
-# If you want to use an encrypted password in the MySQL connection string,
-# then set the MySQL password encryption secret key file with this option.
-#
-# Warning: If this option is set, then the mysql password must be set in "mysql-userdb" in an encrypted format!
-# If you want to use a cleartext password then do not set this option!
-#
-# This is the file path for the aes encrypted secret key used for password encryption.
-#
-#secret-key-file=/path/
-
-# MongoDB database connection string in the case that you are using MongoDB
-# as the user database.
-# This database can be used for long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-# Use the string format described at http://hergert.me/docs/mongo-c-driver/mongoc_uri.html
-#
-#mongo-userdb="mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][/[database][?options]]"
-
-# Redis database connection string in the case that you are using Redis
-# as the user database.
-# This database can be used for long-term credential mechanism
-# and it can store the secret value for secret-based timed authentication in TURN REST API.
-# Use the string format below (space separated parameters, all optional):
-#
-#redis-userdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
-
-# Redis status and statistics database connection string, if used (default - empty, no Redis stats DB used).
-# This database keeps allocations status information, and it can be also used for publishing
-# and delivering traffic and allocation event notifications.
-# The connection string has the same parameters as redis-userdb connection string.
-# Use the string format below (space separated parameters, all optional):
-#
-#redis-statsdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
-
-# The default realm to be used for the users when no explicit
-# origin/realm relationship is found in the database, or if the TURN
-# server is not using any database (just the commands-line settings
-# and the userdb file). Must be used with long-term credentials
-# mechanism or with TURN REST API.
-#
-# Note: If the default realm is not specified, then realm falls back to the host domain name.
-#       If the domain name string is empty, or set to '(None)', then it is initialized as an empty string.
-#
-# realm=wiretrustee.com
-# This flag sets the origin consistency
-# check. Across the session, all requests must have the same
-# main ORIGIN attribute value (if the ORIGIN was
-# initially used by the session).
-#
-#check-origin-consistency
-
-# Per-user allocation quota.
-# default value is 0 (no quota, unlimited number of sessions per user).
-# This option can also be set through the database, for a particular realm.
-#
-#user-quota=0
-
-# Total allocation quota.
-# default value is 0 (no quota).
-# This option can also be set through the database, for a particular realm.
-#
-#total-quota=0
-
-# Max bytes-per-second bandwidth a TURN session is allowed to handle
-# (input and output network streams are treated separately). Anything above
-# that limit will be dropped or temporarily suppressed (within
-# the available buffer limits).
-# This option can also be set through the database, for a particular realm.
-#
-#max-bps=0
-
-#
-# Maximum server capacity.
-# Total bytes-per-second bandwidth the TURN server is allowed to allocate
-# for the sessions, combined (input and output network streams are treated separately).
-#
-# bps-capacity=0
-
-# Uncomment if no UDP client listener is desired.
-# By default UDP client listener is always started.
-#
-#no-udp
-
-# Uncomment if no TCP client listener is desired.
-# By default TCP client listener is always started.
-#
-#no-tcp
-
-# Uncomment if no TLS client listener is desired.
-# By default TLS client listener is always started.
-#
-#no-tls
-
-# Uncomment if no DTLS client listener is desired.
-# By default DTLS client listener is always started.
-#
-#no-dtls
-
-# Uncomment if no UDP relay endpoints are allowed.
-# By default UDP relay endpoints are enabled (like in RFC 5766).
-#
-#no-udp-relay
-
-# Uncomment if no TCP relay endpoints are allowed.
-# By default TCP relay endpoints are enabled (like in RFC 6062).
-#
-#no-tcp-relay
-
-# Uncomment if extra security is desired,
-# with nonce value having a limited lifetime.
-# The nonce value is unique for a session.
-# Set this option to limit the nonce lifetime.
-# Set it to 0 for unlimited lifetime.
-# It defaults to 600 secs (10 min) if no value is provided. After that delay,
-# the client will get 438 error and will have to re-authenticate itself.
-#
-#stale-nonce=600
-
-# Uncomment if you want to set the maximum allocation
-# time before it has to be refreshed.
-# Default is 3600s.
-#
-#max-allocate-lifetime=3600
-
-
-# Uncomment to set the lifetime for the channel.
-# Default value is 600 secs (10 minutes).
-# This value MUST not be changed for production purposes.
-#
-#channel-lifetime=600
-
-# Uncomment to set the permission lifetime.
-# Default to 300 secs (5 minutes).
-# In production this value MUST not be changed,
-# however it can be useful for test purposes.
-#
-#permission-lifetime=300
-
-# Certificate file.
-# Use an absolute path or path relative to the
-# configuration file.
-# Use PEM file format.
-#
-cert=/etc/coturn/certs/cert.pem
-
-# Private key file.
-# Use an absolute path or path relative to the
-# configuration file.
-# Use PEM file format.
-#
-pkey=/etc/coturn/private/privkey.pem
-
-# Private key file password, if it is in encoded format.
-# This option has no default value.
-#
-#pkey-pwd=...
-
-# Allowed OpenSSL cipher list for TLS/DTLS connections.
-# Default value is "DEFAULT".
-#
-#cipher-list="DEFAULT"
-
-# CA file in OpenSSL format.
-# Forces TURN server to verify the client SSL certificates.
-# By default this is not set: there is no default value and the client
-# certificate is not checked.
-#
-# Example:
-#CA-file=/etc/ssh/id_rsa.cert
-
-# Curve name for EC ciphers, if supported by OpenSSL
-# library (TLS and DTLS). The default value is prime256v1,
-# if pre-OpenSSL 1.0.2 is used. With OpenSSL 1.0.2+,
-# an optimal curve will be automatically calculated, if not defined
-# by this option.
-#
-#ec-curve-name=prime256v1
-
-# Use 566 bits predefined DH TLS key. Default size of the key is 2066.
-#
-#dh566
-
-# Use 1066 bits predefined DH TLS key. Default size of the key is 2066.
-#
-#dh1066
-
-# Use custom DH TLS key, stored in PEM format in the file.
-# Flags --dh566 and --dh2066 are ignored when the DH key is taken from a file.
-#
-#dh-file=<DH-PEM-file-name>
-
-# Flag to prevent stdout log messages.
-# By default, all log messages go to both stdout and to
-# the configured log file. With this option everything will
-# go to the configured log only (unless the log file itself is stdout).
-#
-#no-stdout-log
-
-# Option to set the log file name.
-# By default, the turnserver tries to open a log file in
-# /var/log, /var/tmp, /tmp and the current directory
-# (Whichever file open operation succeeds first will be used).
-# With this option you can set the definite log file name.
-# The special names are "stdout" and "-" - they will force everything
-# to the stdout. Also, the "syslog" name will force everything to
-# the system log (syslog).
-# In the runtime, the logfile can be reset with the SIGHUP signal
-# to the turnserver process.
-#
-log-file=stdout
-
-# Option to redirect all log output into system log (syslog).
-#
-# syslog
-
-# This flag means that no log file rollover will be used, and the log file
-# name will be constructed as-is, without PID and date appendage.
-# This option can be used, for example, together with the logrotate tool.
-#
-#simple-log
-
-# Option to set the "redirection" mode. The value of this option
-# will be the address of the alternate server for UDP & TCP service in the form of
-# <ip>[:<port>]. The server will send this value in the attribute
-# ALTERNATE-SERVER, with error 300, on ALLOCATE request, to the client.
-# Client will receive only values with the same address family
-# as the client network endpoint address family.
-# See RFC 5389 and RFC 5766 for the description of ALTERNATE-SERVER functionality.
-# The client must use the obtained value for subsequent TURN communications.
-# If more than one --alternate-server option is provided, then the functionality
-# can be more accurately described as "load-balancing" than a mere "redirection".
-# If the port number is omitted, then the default port
-# number 3478 for the UDP/TCP protocols will be used.
-# Colon (:) characters in IPv6 addresses may conflict with the syntax of
-# the option. To alleviate this conflict, literal IPv6 addresses are enclosed
-# in square brackets in such resource identifiers, for example:
-# [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 .
-# Multiple alternate servers can be set. They will be used in the
-# round-robin manner. All servers in the pool are considered of equal weight and
-# the load will be distributed equally. For example, if you have 4 alternate servers,
-# then each server will receive 25% of ALLOCATE requests. A alternate TURN server
-# address can be used more than one time with the alternate-server option, so this
-# can emulate "weighting" of the servers.
-#
-# Examples:
-#alternate-server=1.2.3.4:5678
-#alternate-server=11.22.33.44:56789
-#alternate-server=5.6.7.8
-#alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
-
-# Option to set alternative server for TLS & DTLS services in form of
-# <ip>:<port>. If the port number is omitted, then the default port
-# number 5349 for the TLS/DTLS protocols will be used. See the previous
-# option for the functionality description.
-#
-# Examples:
-#tls-alternate-server=1.2.3.4:5678
-#tls-alternate-server=11.22.33.44:56789
-#tls-alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
-
-# Option to suppress TURN functionality, only STUN requests will be processed.
-# Run as STUN server only, all TURN requests will be ignored.
-# By default, this option is NOT set.
-#
-#stun-only
-
-# Option to hide software version. Enhance security when used in production.
-# Revealing the specific software version of the agent through the
-# SOFTWARE attribute might allow them to become more vulnerable to
-# attacks against software that is known to contain security holes.
-# Implementers SHOULD make usage of the SOFTWARE attribute a
-# configurable option (https://tools.ietf.org/html/rfc5389#section-16.1.2)
-#
-no-software-attribute
-
-# Option to suppress STUN functionality, only TURN requests will be processed.
-# Run as TURN server only, all STUN requests will be ignored.
-# By default, this option is NOT set.
-#
-#no-stun
-
-# This is the timestamp/username separator symbol (character) in TURN REST API.
-# The default value is ':'.
-# rest-api-separator=:
-
-# Flag that can be used to allow peers on the loopback addresses (127.x.x.x and ::1).
-# This is an extra security measure.
-#
-# (To avoid any security issue that allowing loopback access may raise,
-# the no-loopback-peers option is replaced by allow-loopback-peers.)
-#
-# Allow it only for testing in a development environment!
-# In production it adds a possible security vulnerability, so for security reasons
-# it is not allowed using it together with empty cli-password.
-#
-#allow-loopback-peers
-
-# Flag that can be used to disallow peers on well-known broadcast addresses (224.0.0.0 and above, and FFXX:*).
-# This is an extra security measure.
-#
-#no-multicast-peers
-
-# Option to set the max time, in seconds, allowed for full allocation establishment.
-# Default is 60 seconds.
-#
-#max-allocate-timeout=60
-
-# Option to allow or ban specific ip addresses or ranges of ip addresses.
-# If an ip address is specified as both allowed and denied, then the ip address is
-# considered to be allowed. This is useful when you wish to ban a range of ip
-# addresses, except for a few specific ips within that range.
-#
-# This can be used when you do not want users of the turn server to be able to access
-# machines reachable by the turn server, but would otherwise be unreachable from the
-# internet (e.g. when the turn server is sitting behind a NAT)
-#
-# Examples:
-# denied-peer-ip=83.166.64.0-83.166.95.255
-# allowed-peer-ip=83.166.68.45
-
-# File name to store the pid of the process.
-# Default is /var/run/turnserver.pid (if superuser account is used) or
-# /var/tmp/turnserver.pid .
-#
-pidfile="/var/tmp/turnserver.pid"
-
-# Require authentication of the STUN Binding request.
-# By default, the clients are allowed anonymous access to the STUN Binding functionality.
-#
-#secure-stun
-
-# Mobility with ICE (MICE) specs support.
-#
-#mobility
-
-# Allocate Address Family according
-# If enabled then TURN server allocates address family according  the TURN
-# Client <=> Server communication address family.
-# (By default Coturn works according RFC 6156.)
-# !!Warning: Enabling this option breaks RFC6156 section-4.2 (violates use default IPv4)!!
-#
-#keep-address-family
-
-
-# User name to run the process. After the initialization, the turnserver process
-# will attempt to change the current user ID to that user.
-#
-#proc-user=<user-name>
-
-# Group name to run the process. After the initialization, the turnserver process
-# will attempt to change the current group ID to that group.
-#
-#proc-group=<group-name>
-
-# Turn OFF the CLI support.
-# By default it is always ON.
-# See also options cli-ip and cli-port.
-#
-no-cli
-
-#Local system IP address to be used for CLI server endpoint. Default value
-# is 127.0.0.1.
-#
-# cli-ip=127.0.0.1
-
-# CLI server port. Default is 5766.
-#
-# cli-port=5766
-
-# CLI access password. Default is empty (no password).
-# For the security reasons, it is recommended that you use the encrypted
-# form of the password (see the -P command in the turnadmin utility).
-#
-# Secure form for password 'qwerty':
-#
-#cli-password=$5$79a316b350311570$81df9cfb9af7f5e5a76eada31e7097b663a0670f99a3c07ded3f1c8e59c5658a
-#
-# Or insecure form for the same password:
-#
-# cli-password=CHANGE_ME
-
-# Enable Web-admin support on https. By default it is Disabled.
-# If it is enabled it also enables a http a simple static banner page
-# with a small reminder that the admin page is available only on https.
-#
-#web-admin
-
-# Local system IP address to be used for Web-admin server endpoint. Default value is 127.0.0.1.
-#
-#web-admin-ip=127.0.0.1
-
-# Web-admin server port. Default is 8080.
-#
-#web-admin-port=8080
-
-# Web-admin server listen on STUN/TURN worker threads
-# By default it is disabled for security reasons! (Not recommended in any production environment!)
-#
-#web-admin-listen-on-workers
-
-# Server relay. NON-STANDARD AND DANGEROUS OPTION.
-# Only for those applications when you want to run
-# server applications on the relay endpoints.
-# This option eliminates the IP permissions check on
-# the packets incoming to the relay endpoints.
-#
-#server-relay
-
-# Maximum number of output sessions in ps CLI command.
-# This value can be changed on-the-fly in CLI. The default value is 256.
-#
-#cli-max-output-sessions
-
-# Set network engine type for the process (for internal purposes).
-#
-#ne=[1|2|3]
-
-# Do not allow an TLS/DTLS version of protocol
-#
-#no-tlsv1
-#no-tlsv1_1
-#no-tlsv1_2

ansible/app-configs/plausible/clickhouse-config.xml.j2

@@ -1,11 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<clickhouse>
-    <profiles>
-        <default>
-            <log_queries>0</log_queries>
-            <log_query_threads>0</log_query_threads>
-        </default>
-    </profiles>
-</clickhouse>

ansible/app-configs/plausible_clickhouse-config.xml.j2

@@ -1,11 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<clickhouse>
-    <profiles>
-        <default>
-            <log_queries>0</log_queries>
-            <log_query_threads>0</log_query_threads>
-        </default>
-    </profiles>
-</clickhouse>

ansible/app-configs/postal/postal.yml.j2

@@ -1,62 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-version: 2
-
-postal:
-  web_hostname: post.trez.wtf
-  web_protocol: http
-  smtp_hostname: post.trez.wtf
-  use_ip_pools: false
-  signing_key_path: /config/signing.key
-  trusted_proxies: [ "172.18.0.0/16" ]
-
-web_server:
-  default_port: 5000
-  default_bind_address: 0.0.0.0
-
-main_db:
-  host: mariadb
-  username: postal
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_MYSQL_PASSWORD'] }}
-  database: postal
-
-message_db:
-  host: mariadb
-  username: postal
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_MYSQL_PASSWORD'] }}
-  prefix: postal
-
-smtp_server:
-  default_port: 25
-  default_bind_address: "::"
-  tls_enabled: true
-  tls_certificate_path: /config/certs/fullchain.pem
-  tls_private_key_path: /config/certs/privkey.pem
-
-dns:
-  # Specify the DNS records that you have configured. Refer to the documentation at
-  # https://github.com/atech/postal/wiki/Domains-&-DNS-Configuration for further
-  # information about these.
-  mx_records:
-    - mx.post.trez.wtf
-  spf_include: spf.post.trez.wtf
-  return_path_domain: rp.post.trez.wtf
-  route_domain: routes.post.trez.wtf
-  track_domain: track.post.trez.wtf
-
-smtp:
-  # Specify an SMTP server that can be used to send messages from the Postal management
-  # system to users. You can configure this to use a Postal mail server once the
-  # your installation has been set up.
-  host: postal-smtp
-  port: 25
-  username: rinoa/postal-smtp
-  password: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}"
-  from_name: Postal @ Rinoa
-  from_address: noreply@trez.wtf
-
-rails:
-  # This is generated automatically by the config initialization. It should be a random
-  # string unique to your installation.
-  secret_key: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_RAILS_SECRET_KEY'] }}"

ansible/app-configs/postal_postal.yml.j2

@@ -1,62 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-version: 2
-
-postal:
-  web_hostname: post.trez.wtf
-  web_protocol: http
-  smtp_hostname: post.trez.wtf
-  use_ip_pools: false
-  signing_key_path: /config/signing.key
-  trusted_proxies: [ "172.18.0.0/16" ]
-
-web_server:
-  default_port: 5000
-  default_bind_address: 0.0.0.0
-
-main_db:
-  host: mariadb
-  username: postal
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_MYSQL_PASSWORD'] }}
-  database: postal
-
-message_db:
-  host: mariadb
-  username: postal
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_MYSQL_PASSWORD'] }}
-  prefix: postal
-
-smtp_server:
-  default_port: 25
-  default_bind_address: "::"
-  tls_enabled: true
-  tls_certificate_path: /config/certs/fullchain.pem
-  tls_private_key_path: /config/certs/privkey.pem
-
-dns:
-  # Specify the DNS records that you have configured. Refer to the documentation at
-  # https://github.com/atech/postal/wiki/Domains-&-DNS-Configuration for further
-  # information about these.
-  mx_records:
-    - mx.post.trez.wtf
-  spf_include: spf.post.trez.wtf
-  return_path_domain: rp.post.trez.wtf
-  route_domain: routes.post.trez.wtf
-  track_domain: track.post.trez.wtf
-
-smtp:
-  # Specify an SMTP server that can be used to send messages from the Postal management
-  # system to users. You can configure this to use a Postal mail server once the
-  # your installation has been set up.
-  host: postal-smtp
-  port: 25
-  username: rinoa/postal-smtp
-  password: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}"
-  from_name: Postal @ Rinoa
-  from_address: noreply@trez.wtf
-
-rails:
-  # This is generated automatically by the config initialization. It should be a random
-  # string unique to your installation.
-  secret_key: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_RAILS_SECRET_KEY'] }}"

ansible/app-configs/prowlarr/config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <BindAddress>*</BindAddress>
-  <Port>9696</Port>
-  <SslPort>6969</SslPort>
-  <EnableSsl>False</EnableSsl>
-  <LaunchBrowser>True</LaunchBrowser>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['PROWLARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-  <Branch>master</Branch>
-  <LogLevel>info</LogLevel>
-  <SslCertPath></SslCertPath>
-  <SslCertPassword></SslCertPassword>
-  <UrlBase></UrlBase>
-  <InstanceName>Prowlarr</InstanceName>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <Theme>light</Theme>
-</Config>

ansible/app-configs/prowlarr_config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <BindAddress>*</BindAddress>
-  <Port>9696</Port>
-  <SslPort>6969</SslPort>
-  <EnableSsl>False</EnableSsl>
-  <LaunchBrowser>True</LaunchBrowser>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['PROWLARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-  <Branch>master</Branch>
-  <LogLevel>info</LogLevel>
-  <SslCertPath></SslCertPath>
-  <SslCertPassword></SslCertPassword>
-  <UrlBase></UrlBase>
-  <InstanceName>Prowlarr</InstanceName>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <Theme>light</Theme>
-</Config>

ansible/app-configs/radarec/config.json.j2

@@ -1,20 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-    "radarr_address": "http://radarr:7878",
-    "radarr_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['RADARR_API_KEY'] }}",
-    "root_folder_path": "/data/media/movies",
-    "tmdb_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['TMDB_API_KEY'] }}",
-    "fallback_to_top_result": false,
-    "radarr_api_timeout": 120.0,
-    "quality_profile_id": 1,
-    "metadata_profile_id": 1,
-    "search_for_movie": true,
-    "dry_run_adding_to_radarr": false,
-    "minimum_rating": 4.5,
-    "minimum_votes": 50,
-    "language_choice": "all",
-    "auto_start": true,
-    "auto_start_delay": 60.0
-}

ansible/app-configs/radarec_settings_config.json.j2

@@ -1,20 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-{
-    "radarr_address": "http://radarr:7878",
-    "radarr_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['RADARR_API_KEY'] }}",
-    "root_folder_path": "/data/media/movies",
-    "tmdb_api_key": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['TMDB_API_KEY'] }}",
-    "fallback_to_top_result": false,
-    "radarr_api_timeout": 120.0,
-    "quality_profile_id": 1,
-    "metadata_profile_id": 1,
-    "search_for_movie": true,
-    "dry_run_adding_to_radarr": false,
-    "minimum_rating": 4.5,
-    "minimum_votes": 50,
-    "language_choice": "all",
-    "auto_start": true,
-    "auto_start_delay": 60.0
-}

ansible/app-configs/radarr/config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <LogLevel>info</LogLevel>
-  <BindAddress>*</BindAddress>
-  <EnableSsl>False</EnableSsl>
-  <SslCertPath></SslCertPath>
-  <Port>7878</Port>
-  <UrlBase></UrlBase>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['RADARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <SslPort>9898</SslPort>
-  <LaunchBrowser>True</LaunchBrowser>
-  <Branch>master</Branch>
-  <SslCertPassword></SslCertPassword>
-  <InstanceName>Radarr</InstanceName>
-  <Theme>auto</Theme>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-</Config>

ansible/app-configs/radarr_config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <LogLevel>info</LogLevel>
-  <BindAddress>*</BindAddress>
-  <EnableSsl>False</EnableSsl>
-  <SslCertPath></SslCertPath>
-  <Port>7878</Port>
-  <UrlBase></UrlBase>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['RADARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <SslPort>9898</SslPort>
-  <LaunchBrowser>True</LaunchBrowser>
-  <Branch>master</Branch>
-  <SslCertPassword></SslCertPassword>
-  <InstanceName>Radarr</InstanceName>
-  <Theme>auto</Theme>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-</Config>

ansible/app-configs/readarr/config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <BindAddress>*</BindAddress>
-  <Port>8787</Port>
-  <SslPort>6868</SslPort>
-  <EnableSsl>False</EnableSsl>
-  <LaunchBrowser>True</LaunchBrowser>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['READARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <Branch>develop</Branch>
-  <LogLevel>info</LogLevel>
-  <SslCertPath></SslCertPath>
-  <SslCertPassword></SslCertPassword>
-  <UrlBase></UrlBase>
-  <InstanceName>Readarr</InstanceName>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <Theme>auto</Theme>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-</Config>

ansible/app-configs/readarr_config.xml.j2

@@ -1,21 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-<Config>
-  <BindAddress>*</BindAddress>
-  <Port>8787</Port>
-  <SslPort>6868</SslPort>
-  <EnableSsl>False</EnableSsl>
-  <LaunchBrowser>True</LaunchBrowser>
-  <ApiKey>{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['READARR_API_KEY'] }}</ApiKey>
-  <AuthenticationMethod>Forms</AuthenticationMethod>
-  <Branch>develop</Branch>
-  <LogLevel>info</LogLevel>
-  <SslCertPath></SslCertPath>
-  <SslCertPassword></SslCertPassword>
-  <UrlBase></UrlBase>
-  <InstanceName>Readarr</InstanceName>
-  <UpdateMechanism>Docker</UpdateMechanism>
-  <Theme>auto</Theme>
-  <AuthenticationRequired>Enabled</AuthenticationRequired>
-</Config>

ansible/app-configs/romm/config.yml.j2

@@ -1,48 +0,0 @@
-# This is a generic example of a configuration file
-# Rename this file to `config.yml`, copy it to a `config` folder, and mount that folder as per the docker-compose.example.yml
-# Only uncomment the lines you want to use/modify, or add new ones where needed
-
-exclude:
-  # Exclude platforms to be scanned
-  platforms: [] # ['my_excluded_platform_1', 'my_excluded_platform_2']
-
-  # Exclude roms or parts of roms to be scanned
-  roms:
-    # Single file games section.
-    # Will not apply to files that are in sub-folders (multi-disc roms, games with updates, DLC, patches, etc.)
-    single_file:
-      # Exclude all files with certain extensions to be scanned
-      extensions: [] # ['xml', 'txt']
-
-      # Exclude matched file names to be scanned.
-      # Supports unix filename pattern matching
-      # Can also exclude files by extension
-      names: [] # ['info.txt', '._*', '*.nfo']
-
-    # Multi files games section
-    # Will apply to files that are in sub-folders (multi-disc roms, games with updates, DLC, patches, etc.)
-    multi_file:
-      # Exclude matched 'folder' names to be scanned (RomM identifies folders as multi file games)
-      names: [] # ['my_multi_file_game', 'DLC']
-
-      # Exclude files within sub-folders.
-      parts:
-        # Exclude matched file names to be scanned from multi file roms
-        # Keep in mind that RomM doesn't scan folders inside multi files games,
-        # so there is no need to exclude folders from inside of multi files games.
-        names: [] # ['data.xml', '._*'] # Supports unix filename pattern matching
-
-        # Exclude all files with certain extensions to be scanned from multi file roms
-        extensions: [] # ['xml', 'txt']
-
-system:
-  # Asociate different platform names to your current file system platform names
-  # [your custom platform folder name]: [RomM platform name]
-  # In this example if you have a 'gc' folder, RomM will treat it like the 'ngc' folder and if you have a 'psx' folder, RomM will treat it like the 'ps' folder
-  platforms: {} # { gc: 'ngc', psx: 'ps' }
-
-  # Asociate one platform to it's main version
-  versions: {} # { naomi: 'arcade' }
-
-# The folder name where your roms are located
-filesystem: {} # { roms_folder: 'roms' } For example if your folder structure is /home/user/library/roms_folder