Adding cron workflow for unsealing HC Vault.

Merged by Trez.One

.gitea/workflows/vault-auto-unseal-flow.yml

@@ -0,0 +1,28 @@
+name: Auto-Unseal for Vault
+on:
+  schedule:
+    - cron: "30 2 * * *"
+jobs:
+  auto-unseal:
+    name: Unseal Vault
+    runs-on: ubuntu-latest
+    env:
+      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
+      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+      VAULT_SHARDS: |
+        ${{ secrets.VAULT_UNSEAL_SHARDS }}
+      VAULT_NAMESPACE: ""
+    steps:
+      - name: Cache Vault install
+        id: cache-vault
+        uses: actions/cache@v4
+        with:
+          path: /opt/hostedtoolcache/vault/1.18.0/x64
+          key: vault-${{ runner.os }}-1.18.0
+      - name: Install Vault
+        uses: cpanato/vault-installer@main
+      - name: Unseal Vault
+        run: |
+          for vault_shard in $(cat ${VAULT_SHARDS}); do
+            vault operator unseal -address=${VAULT_ADDR} -non-interactive "${vault_shard}"
+          done

README.md

@@ -6,6 +6,7 @@
 | --- | --- |
 | actual_server | docker.io/actualbudget/actual-server:latest |
 | adguard | adguard/adguardhome:latest |
+| apprise-api | lscr.io/linuxserver/apprise-api:latest |
 | archivebox | archivebox/archivebox:latest |
 | audiobookshelf | ghcr.io/advplyr/audiobookshelf:latest |
 | authelia | authelia/authelia:master |
@@ -18,10 +19,6 @@
 | bitwarden | vaultwarden/server:latest |
 | bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.98 |
 | browserless | ghcr.io/browserless/chromium:latest |
-| bunkerweb | bunkerity/bunkerweb:1.6.0 |
-| bunkerweb-scheduler | bunkerity/bunkerweb-scheduler:1.6.0 |
-| bunkerweb-autoconf | bunkerity/bunkerweb-autoconf:1.6.0 |
-| bunkerweb-ui | bunkerity/bunkerweb-ui:1.6.0 |
 | bytebase | bytebase/bytebase:3.5.0 |
 | bytestash | ghcr.io/jordan-dalby/bytestash:latest |
 | castopod | castopod/castopod:latest |
@@ -39,8 +36,8 @@
 | delugevpn | ghcr.io/binhex/arch-delugevpn:latest |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
 | docker-volume-backup | offen/docker-volume-backup:v2 |
-| docuseal | docuseal/docuseal:latest |
 | duplicati | lscr.io/linuxserver/duplicati:latest |
+| explo | ghcr.io/lumepart/explo:latest |
 | fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main |
 | flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest |
 | ghost | ghost:latest |
@@ -83,6 +80,7 @@
 | lidify | thewicklowwolf/lidify:latest |
 | linkstack | linkstackorg/linkstack:latest |
 | lldap | lldap/lldap:stable |
+| loggifly | ghcr.io/clemcer/loggifly:latest |
 | maloja | krateng/maloja:latest |
 | manyfold | lscr.io/linuxserver/manyfold:latest |
 | mariadb | linuxserver/mariadb |
@@ -96,11 +94,6 @@
 | n8n | docker.n8n.io/n8nio/n8n |
 | navidrome | deluan/navidrome:latest |
 | netalertx | jokobsk/netalertx:latest |
-| netbird-dashboard | netbirdio/dashboard:latest |
-| netbird-signal | netbirdio/signal:latest |
-| netbird-relay | netbirdio/relay:latest |
-| netbird-management | netbirdio/management:latest |
-| netbird-coturn | coturn/coturn:latest |
 | nextcloud | nextcloud/all-in-one:latest |
 | ollama | ollama/ollama |
 | ombi | lscr.io/linuxserver/ombi:latest |
@@ -108,7 +101,7 @@
 | pgbackweb | eduardolat/pgbackweb:latest |
 | pgbackweb-db | postgres:16-alpine |
 | plantuml-server | plantuml/plantuml-server:jetty |
-| portainer | portainer/portainer-ce:2.27.0-alpine |
+| portainer | portainer/portainer-ce:alpine |
 | portall | need4swede/portall:latest |
 | postal-smtp | ghcr.io/postalserver/postal:latest |
 | postal-web | ghcr.io/postalserver/postal:latest |
@@ -132,10 +125,6 @@
 | sonarqube-pg-db | postgres:17-alpine |
 | sonarr | lscr.io/linuxserver/sonarr:latest |
 | sonashow | thewicklowwolf/sonashow:latest |
-| soularr | mrusse08/soularr:latest |
-| soularr-dashboard | git.trez.wtf/trez.one/soularr-dashboard:v0.1 |
-| soulseek | slskd/slskd |
-| sourcebot | ghcr.io/sourcebot-dev/sourcebot:latest |
 | speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest |
 | stable-diffusion-download | git.trez.wtf/trez.one/stable-diffusion-download:v9.0.0 |
 | stable-diffusion-webui | git.trez.wtf/trez.one/stable-diffusion-ui:v9.0.1 |
@@ -150,6 +139,5 @@
 | wallos | bellamy/wallos:latest |
 | watchtower | ghcr.io/containrrr/watchtower:latest |
 | web-check | lissy93/web-check |
-| your_spotify | lscr.io/linuxserver/your_spotify:latest |
 | youtubedl | nbr23/youtube-dl-server:latest |
 

ansible/app-configs/apprise_apprise.yml.j2

@@ -0,0 +1,3 @@
+urls:
+  - gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}
+  - mailtos://{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}@trez.wtf25?smtp=postal-smtp&from=noreply@trez.wtf

ansible/app-configs/ghost_config.production.json.j2

@@ -9,7 +9,7 @@
       "host"     : "mariadb",
       "user"     : "ghost",
       "password" : "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GHOST_DB_PASSWORD'] }}",
-      "database" : "ghost"
+      "database" : "ghost_db"
     }
   },
   "mail": {
@@ -30,7 +30,7 @@
   },
   "privacy": {
     "useGravatar": true
-  }
+  },
   "logging": {
     "level": "info",
     "rotation": {

ansible/app-configs/homepage_settings.yaml.j2

@@ -11,10 +11,10 @@ providers:
 title: Rinoa Dashboard (trez.WTF)
 headerStyle: underlined
 color: slate
-showStats: true
+showStats: false
 statusStyle: "dot"
 favicon: /icons/favicon.ico
-useEqualHeights: false
+useEqualHeights: true
 hideErrors: false
 searchDescriptions: true
 showSearchSuggestions: true
@@ -26,10 +26,10 @@ layout:
     columns: 4
   Infrastructure/App Performance Monitoring:
     style: row
-    columns: 4
+    columns: 3
   Code/DevOps:
     style: row
-    columns: 4
+    columns: 3
   Social:
     style: row
     columns: 4
@@ -41,7 +41,7 @@ layout:
     columns: 5
   Privacy/Security:
     style: row
-    columns: 3
+    columns: 5
   Personal/Professional Services:
     style: row
     columns: 5
@@ -50,7 +50,7 @@ layout:
     columns: 3
   Downloaders:
     style: row
-    columns: 3
+    columns: 2
   Media Library:
     style: row
-    columns: 3
+    columns: 4

ansible/app-configs/loggifly_config.yaml.j2

@@ -0,0 +1,23 @@
+containers:
+  immich-server:
+    action_keywords:
+      - restart:
+          regex: 'ADVICE:.*error'
+global_keywords:
+  keywords:
+    - panic
+  keywords_with_attachment:
+    - fatal
+notifications:
+  apprise:
+    url: gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}    # Any Apprise-compatible URL (https://github.com/caronc/apprise/wiki)
+# settings are optional because they all have default values
+settings:
+  log_level: INFO               # DEBUG, INFO, WARNING, ERROR
+  notification_cooldown: 5      # Seconds between alerts for same keyword (per container)
+  attachment_lines: 20          # Number of Lines to include in log attachments
+  multi_line_entries: true      # Detect multi-line log entries
+  disable_restart: false        # Disable restart when a config change is detected
+  disable_start_message: false  # Suppress startup notification
+  disable_shutdown_message: false  # Suppress shutdown notification
+  disable_restart_message: false   # Suppress config reload notification

ansible/app-configs/multi-scrobbler_config.json.j2

@@ -25,7 +25,7 @@
       "type": "spotify",
       "enable": true,
       "clients": [],
-      "name": "Spotify",
+      "name": "spotify",
       "data": {
         "clientId": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
         "clientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
@@ -34,7 +34,7 @@
     },
     {
       "type:": "lastfm",
-      "name": "Last.fm",
+      "name": "lastfm",
       "enable": true,
       "data": {
         "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
@@ -44,7 +44,7 @@
     },
     {
       "type": "listenbrainz",
-      "name": "ListenBrainz",
+      "name": "listenBrainz",
       "enable": true,
       "data": {
         "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
@@ -53,7 +53,7 @@
     },
     {
       "type": "subsonic",
-      "name": "Navidrome",
+      "name": "navidrome",
       "enable": true,
       "data": {
         "url": "http://navidrome:4533",
@@ -65,7 +65,7 @@
   "clients": [
     {
       "type": "lastfm",
-      "name": "Last.fm Client",
+      "name": "lastFmClient",
       "enable": true,
       "data": {
         "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
@@ -75,7 +75,7 @@
     },
     {
       "type": "listenbrainz",
-      "name": "ListenBrainz Client",
+      "name": ";istenBrainzClient",
       "enable": true,
       "data": {
         "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
@@ -85,7 +85,7 @@
     {
       "type": "maloja",
       "enable": true,
-      "name": "Maloja",
+      "name": "maloja",
       "data": {
         "url": "http://maloja:42010",
         "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_API_KEY'] }}"