Tweaks to workflow.

Merged by Trez.One

.gitea/workflows/pr-cloudflare-docker-deploy.yml

@@ -4,7 +4,9 @@ on:
     branches-ignore:
       - main
     paths:
+      - '**.yaml'
       - '**.yml'
+      - '**.j2'
 jobs:
   check-and-create-pr:
     name: Check and Create PR
@@ -77,6 +79,13 @@ jobs:
             --check
           requirements: collections/requirements.yml
           vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
+          notification_message: 'Ansible dry run completed successfully.'
       - name: Generate .env file for Docker Compose Dry Run
         run: |
           vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
@@ -95,6 +104,13 @@ jobs:
           up-opts: --dry-run -d --remove-orphans
         env:
           DOCKER_HOST: tcp://dockerproxy:2375
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
+          notification_message: 'Docker Compose dry run completed successfully.'
   cloudflare-dns-setup:
     name: Cloudflare DNS Setup
     needs: [docker-compose-ansible-lints]
@@ -130,6 +146,13 @@ jobs:
         run: |
           yq '.services[].labels.swag_url' docker-compose.yml | egrep -v 'null' | sed -e 's|"||g' | awk -F'.' '{print $1}' | sort > compose_subdomains.txt
           flarectl --json dns list --zone "trez.wtf" --type=CNAME --content "trez.wtf" | jq '.[].Name' | sed -e 's|"||g' | awk -F"." '{print $1}' | sort > cloudflare_subdomains.txt
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
+          notification_message: 'Starting Cloudflare setup'
       - name: Compare Subdomains
         id: compare-subdomains
         uses: LouisBrunner/diff-action@v2.2.0
@@ -150,17 +173,39 @@ jobs:
             echo "Creating $subdomain.trez.wtf..."
             flarectl dns create --zone "trez.wtf" --name "${subdomain}" --type=CNAME --content "trez.wtf" --proxy true
           done
-  regenerate-readme:
-    name: Update README
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
+          notification_message: 'Cloudflare DNS setup completed successfully.'
+  regenerate-readme-modified-services:
+    name: Update README & Generate List of Modified Services
     runs-on: ubuntu-latest
     needs: [cloudflare-dns-setup]
     outputs:
       pr-pushed: ${{ steps.commit-readme.outputs.pushed }}
+      modified_services: ${{ steps.compare-services.outputs.modified_services }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Install yq
         uses: dcarbone/install-yq-action@v1
+      - name: Fetch main branch for comparison
+        run: |
+          git fetch origin main:main
+      - name: Compare services using yq
+        continue-on-error: true
+        id: compare-services
+        run: |
+          current_services=$(yq '.services | to_entries' docker-compose.yml)
+          git show main:docker-compose.yml > main_compose.yml
+          main_services=$(yq '.services | to_entries' main_compose.yml)
+          modified_services_file=$(comm -13 <(echo "$main_services") <(echo "$current_services") > changes_compose.yml)
+          modified_services=${egrep '^  [a-z]' changes.yml | sed -e 's|^  ||g' -e 's|:||g' | sed ':a;N;$!ba;s/\n/ /g'}
+          echo "Modified services: $modified_services"
+          echo "modified_services=$modified_services" >> $GITHUB_OUTPUT
       - name: Generate service list
         run: |
           yq '.services | to_entries | map({"service": .key, "image": .value.image})' docker-compose.yml > services.yml
@@ -201,6 +246,14 @@ jobs:
           echo "Merging PR..."
           pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
           tea pr m --repo ${{ github.repository }} --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" --message "Merged by ${{ github.actor }}" ${pr_index}
+          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: PR Merge Successful'
+          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
   ansible-config-docker-compose-deploy:
     name: Deploy via Ansible & Docker Compose
     runs-on: ubuntu-latest
@@ -243,23 +296,26 @@ jobs:
         with:
           gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
           gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'Ansible Config Deployment @ Rinoa'
+          notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
           notification_message: 'Deployment completed successfully.'
       - name: Generate .env file for deployment
         run: |
            vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
       - name: Docker Compose Deployment
+        if: ${{ steps.regenerate-readme-modified-services.outputs.modified_services != '' }}
+        continue-on-error: true
         uses: keatonLiu/docker-compose-remote-action@v1.2
         with:
+          docker_compose_file: docker-compose.yml
+          docker_args: -d --remove-orphans --pull missing --parallel -1 ${{ steps.regenerate-readme-modified-services.outputs.modified_services }}
           ssh_user: gitea-deploy
           ssh_host: 192.168.1.254
           ssh_host_public_key: ${{ secrets.RINOA_GITEA_PUBLIC_SSH_KEY }}
           ssh_private_key: ${{ secrets.RINOA_GITEA_PRIVATE_SSH_KEY }}
-          docker_compose_file: docker-compose.yml
       - name: Gotify Notification
         uses: eikendev/gotify-action@master
         with:
           gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
           gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'Docker Compose Deployment @ Rinoa'
+          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
           notification_message: 'Deployment completed successfully.'

.gitignore

@@ -1,2 +1,3 @@
 **/.cache_ggshield
-ansible/collections/ansible_collections/
+ansible/collections/ansible_collections/
+**/.env

README.md

@@ -16,9 +16,6 @@
 | bitwarden | vaultwarden/server:latest |
 | bluesky-pds | ghcr.io/bluesky-social/pds:latest |
 | browserless | ghcr.io/browserless/chromium:latest |
-| bunkerweb | bunkerity/bunkerweb:latest |
-| bunkerweb-scheduler | bunkerity/bunkerweb-scheduler:latest |
-| bunkerweb-ui | bunkerity/bunkerweb-ui:latest |
 | castopod | castopod/castopod:latest |
 | cloudflared | cloudflare/cloudflared:latest |
 | cloudflareddns | ghcr.io/hotio/cloudflareddns:latest |
@@ -27,6 +24,7 @@
 | czkawka | jlesage/czkawka |
 | dagu-scheduler | ghcr.io/dagu-org/dagu:latest |
 | dagu-server | ghcr.io/dagu-org/dagu:latest |
+| dbgate | dbgate/dbgate:alpine |
 | delugevpn | ghcr.io/binhex/arch-delugevpn:latest |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
 | docuseal | docuseal/docuseal:latest |
@@ -52,6 +50,12 @@
 | homepage | ghcr.io/gethomepage/homepage:latest |
 | hortusfox | ghcr.io/danielbrendel/hortusfox-web:latest |
 | hugo | hugomods/hugo:exts |
+| immich-server | ghcr.io/immich-app/immich-server:release |
+| immich-machine-learning | ghcr.io/immich-app/immich-machine-learning:release |
+| immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1 |
+| immich-public-proxy | alangrainger/immich-public-proxy:latest |
+| immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest |
+| influxdb2 | influxdb:2-alpine |
 | invidious | quay.io/invidious/invidious:latest |
 | invidious-db | docker.io/library/postgres:14 |
 | invoice_ninja | invoiceninja/invoiceninja:5 |
@@ -70,19 +74,25 @@
 | lidarr | lscr.io/linuxserver/lidarr:latest |
 | lidify | thewicklowwolf/lidify:latest |
 | lldap | lldap/lldap:stable |
-| localai | localai/localai:latest-aio-cpu |
+| lobe-chat | lobehub/lobe-chat-database |
+| lobe-chat-pg-db | pgvector/pgvector:pg16 |
 | maloja | krateng/maloja:latest |
 | mariadb | linuxserver/mariadb |
 | mastodon | lscr.io/linuxserver/mastodon:latest |
 | mastodon-pg-db | postgres:17-alpine |
 | minio | minio/minio |
-| mongodb | mongo:7.0 |
+| mongodb | bitnami/mongodb:7.0 |
 | multi-scrobbler | foxxmd/multi-scrobbler |
 | n8n | docker.n8n.io/n8nio/n8n |
 | navidrome | deluan/navidrome:latest |
+| netbird-dashboard | netbirdio/dashboard:latest |
+| netbird-signal | netbirdio/signal:latest |
+| netbird-relay | netbirdio/relay:latest |
+| netbird-management | netbirdio/management:latest |
+| netbird-coturn | coturn/coturn:latest |
 | netbox | lscr.io/linuxserver/netbox:latest |
 | netbox-db | postgres:17-alpine |
-| nextcloud | lscr.io/linuxserver/nextcloud:latest |
+| nextcloud | nextcloud/all-in-one:latest |
 | ollama | ollama/ollama |
 | ombi | lscr.io/linuxserver/ombi:latest |
 | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest |
@@ -92,6 +102,7 @@
 | plausible | ghcr.io/plausible/community-edition:v2.1.0 |
 | plausible_db | postgres:16-alpine |
 | plausible_events_db | clickhouse/clickhouse-server:24.3.3.102-alpine |
+| portainer | portainer/portainer-ce:alpine-sts |
 | postal-smtp | ghcr.io/postalserver/postal:latest |
 | postal-web | ghcr.io/postalserver/postal:latest |
 | postal-worker | ghcr.io/postalserver/postal:latest |
@@ -103,6 +114,7 @@
 | readarr | lscr.io/linuxserver/readarr:develop |
 | redis | redis:alpine |
 | redlib | quay.io/redlib/redlib:latest |
+| rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest |
 | sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest |
 | scraperr | jpyles0524/scraperr:latest |
 | scraperr-api | jpyles0524/scraperr_api:latest |
@@ -118,11 +130,10 @@
 | sonashow | thewicklowwolf/sonashow:latest |
 | soularr | mrusse08/soularr:latest |
 | soulseek | slskd/slskd |
+| sourcebot | ghcr.io/sourcebot-dev/sourcebot:latest |
 | speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest |
 | spotisub | blastbeng/spotisub:latest |
 | swag | lscr.io/linuxserver/swag:latest |
-| synapse | docker.io/matrixdotorg/synapse:latest |
-| synapse-db | postgres:16-alpine |
 | tandoor | vabene1111/recipes |
 | tandoor-pg | postgres:16-alpine |
 | traccar | traccar/traccar:latest |
@@ -133,13 +144,11 @@
 | wallabag | wallabag/wallabag |
 | wallos | bellamy/wallos:latest |
 | watchtower | ghcr.io/containrrr/watchtower:latest |
-| wazuh.agent | opennix/wazuh-agent:latest |
-| wazuh.dashboard | wazuh/wazuh-dashboard: |
-| wazuh.indexer | wazuh/wazuh-indexer: |
-| wazuh.manager | wazuh/wazuh-manager: |
+| wazuh-agent | kennyopennix/wazuh-agent:latest |
+| wazuh-dashboard | wazuh/wazuh-dashboard: |
+| wazuh-indexer | wazuh/wazuh-indexer: |
+| wazuh-manager | wazuh/wazuh-manager: |
 | web-check | lissy93/web-check |
-| whodb | clidey/whodb |
-| yacht | selfhostedpro/yacht |
 | your_spotify | lscr.io/linuxserver/your_spotify:latest |
 | youtubedl | nbr23/youtube-dl-server:latest |
 | zammad-backup | postgres: |

ansible/app-configs/komodo_core.config.toml.j2

@@ -1,477 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-###########################
-# 🦎 KOMODO CORE CONFIG 🦎 #
-###########################
-
-## This is the offical "Default" config file for Komodo Core.
-## It serves as documentation for the meaning of the fields.
-## It is located at `https://github.com/mbecker20/komodo/blob/main/config/core.config.toml`.
-
-## All fields with a "Default" provided are optional. If they are
-## left out of the file, the "Default" value will be used.
-
-## This file is bundled into the official image, `ghcr.io/mbecker20/komodo`,
-## as the default config at `/config/config.toml`.
-## Komodo can start with no external config file mounted.
-
-## There is usually no need to create this file on your host.
-## Most fields can instead be configured using environment variables.
-## Environment variables will override values set in this file.
-
-## This will be the document title on the web page.
-## Env: KOMODO_TITLE
-## Default: 'Komodo'
-title = "Komodo @ Rinoa"
-
-## This should be the url used to access Komodo in browser, potentially behind DNS.
-## Eg https://komodo.example.com or http://12.34.56.78:9120. This should match the address configured in your Oauth app.
-## Env: KOMODO_HOST
-## Required, no default.
-host = "https://komodo.trez.wtf"
-
-## The port the core system will run on.
-## Env: KOMODO_PORT
-## Default: 9120
-port = 9120
-
-## This is the token used to authenticate core requests to periphery.
-## Ensure this matches a passkey in the connected periphery configs.
-## If the periphery servers don't have passkeys configured, this doesn't need to be changed.
-## Env: KOMODO_PASSKEY or KOMODO_PASSKEY_FILE
-## Required, no default
-passkey = "JgzFdZYbE7JfH5zhrh5pWUEQEWA4MCXG"
-
-## Ensure a server with this address exists on Core
-## upon first startup. Example: `https://periphery:8120`
-## Env: KOMODO_FIRST_SERVER
-## Optional, no default.
-first_server = ""
-
-## Disables write support on resources in the UI.
-## This protects users that that would normally have write priviledges during their UI usage,
-## when they intend to fully rely on ResourceSyncs to manage config.
-## Env: KOMODO_UI_WRITE_DISABLED
-## Default: false
-ui_write_disabled = false
-
-## Disables the confirm dialogs on all actions. All buttons will now be double-click.
-## Useful when only having http connection to core, as UI quick-copy button won't work.
-## Env: KOMODO_DISABLE_CONFIRM_DIALOG
-## Default: false
-disable_confirm_dialog = false
-
-## Configure the directory for sync files (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_SYNC_DIRECTORY
-## Default: /syncs
-sync_directory = "/syncs"
-
-## Configure the repo directory (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_REPO_DIRECTORY
-## Default: /repo-cache
-repo_directory = "/repo-cache"
-
-## Configure the action directory (inside the container).
-## There shouldn't be a need to change this, or even mount a volume.
-## Env: KOMODO_ACTION_DIRECTORY
-## Default: /action-cache
-action_directory = "/action-cache"
-
-################
-# AUTH / LOGIN #
-################
-
-## Allow user login with a username / password.
-## The password will be hashed and stored in the db for login comparison.
-##
-## NOTE:
-## Komodo has no API to recover account logins, but if this happens you can doctor the database using Mongo Compass.
-## Create a new Komodo user (Sign Up button), login to the database with Compass, note down your old users username and _id.
-## Then delete the old user, and update the new user to have the same username and _id. 
-## Make sure to set `enabled: true` and maybe `admin: true` on the new user as well, while using Compass.
-##
-## Env: KOMODO_LOCAL_AUTH
-## Default: false
-local_auth = true
-
-## Normally new users will be registered, but not enabled until an Admin enables them.
-## With `disable_user_registration = true`, only the first user to log in will registered as a user.
-## Env: KOMODO_DISABLE_USER_REGISTRATION
-## Default: false
-disable_user_registration = false
-
-## New users will be automatically enabled when they sign up.
-## Otherwise, new users will be disabled on first login.
-## The first user to login will always be enabled on creation.
-## Env: KOMODO_ENABLE_NEW_USERS
-## Default: false
-enable_new_users = false
-
-## Allows all users to have Read level access to all resources.
-## Env: KOMODO_TRANSPARENT_MODE
-## Default: false
-transparent_mode = false
-
-## Normally all enabled users can create resources.
-## If `disable_non_admin_create = true`, only admin users can create resources.
-## Env: KOMODO_DISABLE_NON_ADMIN_CREATE
-## Default: false
-disable_non_admin_create = false
-
-## Optionally provide a specific jwt secret.
-## Passing nothing or an empty string will cause one to be generated on every startup.
-## This means users will have to log in again if Komodo restarts.
-## Env: KOMODO_JWT_SECRET or KOMODO_JWT_SECRET_FILE
-## Default: empty string, meaning a random secret will be generated at startup.
-jwt_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_JWT_SECRET'] }}"
-
-## Specify how long a user can stay logged in before they have to log in again.
-## All jwts are invalidated on application restart unless `jwt_secret` is set.
-## Env: KOMODO_JWT_TTL
-## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk, 30-day
-## Default: 1-day. 
-jwt_ttl = "1-day"
-
-#############
-# OIDC Auth #
-#############
-
-## Enable logins with configured OIDC provider.
-## Env: KOMODO_OIDC_ENABLED
-## Default: false
-oidc_enabled = false
-
-## Give the provider address.
-##
-## The path, ie /application/o/komodo for Authentik,
-## is provider and configuration specific.
-##
-## Note. this address must be reachable from Komodo Core container.
-##
-## Env: KOMODO_OIDC_PROVIDER
-## Optional, no default.
-oidc_provider = "https://oidc.provider.internal/application/o/komodo"
-
-## Configure OIDC user redirect host.
-##
-## This is the host address users are redirected to in their browser,
-## and may be different from `oidc_provider` host depending on your networking.
-## If not provided (or empty string ""), the `oidc_provider` will be used.
-##
-## Note. DO NOT include the `path` part of the URL.
-## Example: `https://oidc.provider.external`
-##
-## Env: KOMODO_OIDC_REDIRECT_HOST
-## Optional, no default.
-oidc_redirect_host = ""
-
-## Give the OIDC Client ID.
-## Env: KOMODO_OIDC_CLIENT_ID or KOMODO_OIDC_CLIENT_ID_FILE
-oidc_client_id = ""
-
-## Give the OIDC Client Secret.
-## Env: KOMODO_OIDC_CLIENT_SECRET or KOMODO_OIDC_CLIENT_SECRET_FILE
-oidc_client_secret = ""
-
-## If true, use the full email for usernames.
-## Otherwise, the @address will be stripped,
-## making usernames more concise.
-## Env: KOMODO_OIDC_USE_FULL_EMAIL
-## Default: false.
-oidc_use_full_email = false
-
-## Some providers attach other audiences in addition to the client_id.
-## If you have this issue, `Invalid audiences: `...` is not a trusted audience"`,
-## you can add the audience `...` to the list here (assuming it should be trusted).
-## Env: KOMODO_OIDC_ADDITIONAL_AUDIENCES or KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE
-## Default: empty
-oidc_additional_audiences = []
-
-#########
-# OAUTH #
-#########
-
-## Google
-
-## Env: KOMODO_GOOGLE_OAUTH_ENABLED
-## Default: false
-google_oauth.enabled = false
-
-## Env: KOMODO_GOOGLE_OAUTH_ID or KOMODO_GOOGLE_OAUTH_ID_FILE
-## Required if google_oauth is enabled.
-google_oauth.id = ""
-
-## Env: KOMODO_GOOGLE_OAUTH_SECRET or KOMODO_GOOGLE_OAUTH_SECRET_FILE
-## Required if google_oauth is enabled.
-google_oauth.secret = ""
-
-## Github
-
-## Env: KOMODO_GITHUB_OAUTH_ENABLED
-## Default: false
-github_oauth.enabled = false
-
-## Env: KOMODO_GITHUB_OAUTH_ID or KOMODO_GITHUB_OAUTH_ID_FILE
-## Required if github_oauth is enabled.
-github_oauth.id = ""
-
-## Env: KOMODO_GITHUB_OAUTH_SECRET or KOMODO_GITHUB_OAUTH_SECRET_FILE
-## Required if github_oauth is enabled.
-github_oauth.secret = ""
-
-############
-# Security #
-############
-
-## Enable HTTPS server using the given key and cert.
-## Env: KOMODO_SSL_ENABLED
-## Default: false
-ssl_enabled = false
-
-## Path to the ssl key.
-## Env: KOMODO_SSL_KEY_FILE
-## Default: /config/ssl/key.pem
-ssl_key_file = "/config/ssl/key.pem"
-
-## Path to the ssl cert.
-## Env: KOMODO_SSL_CERT_FILE
-## Default: /config/ssl/cert.pem
-ssl_cert_file = "/config/ssl/cert.pem"
-
-############
-# DATABASE #
-############
-
-## Configure the database connection in one of the following ways:
-
-## Pass a full Mongo URI to the database.
-## Example: mongodb://username:password@localhost:27017
-## Env: KOMODO_DATABASE_URI or KOMODO_DATABASE_URI_FILE
-## Optional, can usually use `address`, `username`, `password` instead.
-database.uri = "mongodb://komodo:jtyl2U8KZPUe8V9MOTXQDYRlg7QemGuF@komodo-ferretdb:27017/komodo?authMechanism=PLAIN"
-
-## ==== * OR * ==== ##
-
-# Construct the address as mongodb://{username}:{password}@{address}
-## Env: KOMODO_DATABASE_ADDRESS
-# database.address = "localhost:27017"
-## Env: KOMODO_DATABASE_USERNAME or KOMODO_DATABASE_USERNAME_FILE
-# database.username = ""
-## Env: KOMODO_DATABASE_PASSWORD or KOMODO_DATABASE_PASSWORD_FILE
-# database.password = ""
-
-## ==== other ====
-
-## Komodo will create its collections under this database name.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_DB_NAME
-## Default: komodo.
-database.db_name = "komodo"
-
-## This is the assigned app_name of the mongo client.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_APP_NAME
-## Default: komodo_core.
-database.app_name = "komodo_core"
-
-############
-# WEBHOOKS #
-############
-
-## This token must be given to git provider during repo webhook config.
-## The secret configured on the git provider side must match the secret configured here.
-## If not provided, 
-## Env: KOMODO_WEBHOOK_SECRET or KOMODO_WEBHOOK_SECRET_FILE
-## Optional, no default.
-webhook_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_WEBHOOK_SECRET'] }}"
-
-## An alternate base url that is used to recieve git webhook requests.
-## If empty or not specified, will use 'host' address as base.
-## This is useful if Komodo is on an internal network, but can have a
-## proxy just allowing through the webhook listener api using NGINX.
-## Env: KOMODO_WEBHOOK_BASE_URL
-## Default: empty (none)
-webhook_base_url = ""
-
-## Configure Github webhook app. Enables webhook management apis.
-## <INSERT LINK TO GUIDE>
-## Env: KOMODO_GITHUB_WEBHOOK_APP_APP_ID or KOMODO_GITHUB_WEBHOOK_APP_APP_ID_FILE
-# github_webhook_app.app_id = 1234455 # Find on the app page.
-## Env: 
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS or KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS_FILE
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_NAMESPACES
-# github_webhook_app.installations = [
-#   ## Find the id after installing the app to user / organization. "namespace" is the username / organization name.
-#   { id = 1234, namespace = "mbecker20" }
-# ]
-
-## The path to Github webhook app private key. <INSERT LINK TO GUIDE>
-## This is defaulted to `/github/private-key.pem`, and doesn't need to be changed if running core in Docker.
-## Just mount the private key pem file on the host to `/github/private-key.pem` in the container.
-## Eg. `/your/path/to/key.pem : /github/private-key.pem`
-## Env: KOMODO_GITHUB_WEBHOOK_APP_PK_PATH
-# github_webhook_app.pk_path = "/path/to/pk.pem"
-
-###########
-# LOGGING #
-###########
-
-## Specify the logging verbosity
-## Env: KOMODO_LOGGING_LEVEL
-## Options: off, error, warn, info, debug, trace
-## Default: info
-logging.level = "info"
-
-## Specify the logging format for stdout / stderr.
-## Env: KOMODO_LOGGING_STDIO
-## Options: standard, json, none
-## Default: standard
-logging.stdio = "standard"
-
-## Optionally specify a opentelemetry otlp endpoint to send traces to.
-## Example: http://localhost:4317
-## Env: KOMODO_LOGGING_OTLP_ENDPOINT
-logging.otlp_endpoint = ""
-
-## Set the opentelemetry service name.
-## This will be attached to the telemetry Komodo will send.
-## Env: KOMODO_LOGGING_OPENTELEMETRY_SERVICE_NAME
-## Default: "Komodo"
-logging.opentelemetry_service_name = "Komodo"
-
-###########
-# PRUNING #
-###########
-
-## The number of days to keep historical system stats around, or 0 to disable pruning. 
-## Stats older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_STATS_FOR_DAYS
-## Default: 14
-keep_stats_for_days = 14
-
-## The number of days to keep alerts around, or 0 to disable pruning. 
-## Alerts older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_ALERTS_FOR_DAYS
-## Default: 14
-keep_alerts_for_days = 14
-
-##################
-# POLL INTERVALS #
-##################
-
-## Controls the rate at which servers are polled for health, system stats, and container status.
-## This affects network usage, and the size of the stats stored in mongo.
-## Env: KOMODO_MONITORING_INTERVAL
-## Options: 1-sec, 5-sec, 15-sec, 30-sec, 1-min, 2-min, 5-min, 15-min
-## Default: 15-sec
-monitoring_interval = "15-sec"
-
-## Interval at which to poll Resources for any updates / automated actions.
-## Env: KOMODO_RESOURCE_POLL_INTERVAL
-## Options: `15-sec`, `1-min`, `5-min`, `15-min`, `1-hr`.
-## Default: 5-min
-resource_poll_interval = "5-min"
-
-###################
-# CLOUD PROVIDERS #
-###################
-
-## Komodo can build images by deploying AWS EC2 instances,
-## running the build, and afterwards destroying the instance.
-
-## Additionally, Komodo can deploy cloud VPS on AWS EC2 and Hetzner.
-## Use the Template resource to configure launch preferences.
-## Hetzner is not supported for builds as their pricing model is by the hour,
-## while AWS is by the minute. This is very important for builds.
-
-## Provide AWS api keys for ephemeral builders / server launch
-## Env: KOMODO_AWS_ACCESS_KEY_ID or KOMODO_AWS_ACCESS_KEY_ID_FILE
-aws.access_key_id = ""
-## Env: KOMODO_AWS_SECRET_ACCESS_KEY or KOMODO_AWS_SECRET_ACCESS_KEY_FILE
-aws.secret_access_key = ""
-
-## Provide Hetzner api token for server launch
-## Env: KOMODO_HETZNER_TOKEN or KOMODO_HETZNER_TOKEN_FILE
-hetzner.token = ""
-
-#################
-# GIT PROVIDERS #
-#################
-
-## These will be available to attach to Builds, Repos, Stacks, and Syncs.
-## They allow these Resources to clone private repositories.
-## They cannot be configured on the environment.
-
-## configure git providers
-# [[git_provider]]
-# domain = "github.com"
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# 	{ username = "moghtech", token = "access_token_for_other_account" },
-# ]
-
-# [[git_provider]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-# [[git_provider]]
-# domain = "localhost:8000" # use a custom provider, like self-hosted gitea
-# https = false # use http://localhost:8000 as base-url for clone
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-######################
-# REGISTRY PROVIDERS #
-######################
-
-## These will be available to attach to Builds and Stacks.
-## They allow these Resources to pull private images.
-## They cannot be configured on the environment.
-
-## configure docker registries
-# [[docker_registry]]
-# domain = "docker.io"
-# accounts = [
-# 	{ username = "mbecker2020", token = "access_token_for_account" }
-# ]
-# organizations = ["DockerhubOrganization"]
-
-[[gitea_rinoa]]
-domain = "git.trez.wtf"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-[[gitea_rinoa_local]]
-domain = "http://gitea:3000"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-# [[docker_registry]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-# organizations = ["Mogh"] # These become available in the UI
-
-###########
-# SECRETS #
-###########
-
-## Provide Core based secrets.
-## These will be available to interpolate into your Deployment / Stack environments,
-## and will be hidden in the UI and logs.
-## These are available to use on any Periphery (Server),
-## but you can also limit access more by placing them in a single Periphery's config file instead.
-## These cannot be configured in the Komodo Core environment, they must be passed in the file.
-
-# [secrets]
-# SECRET_1 = "value_1"
-# SECRET_2 = "value_2"

ansible/app-configs/sourcebot_config.json.j2

@@ -0,0 +1,19 @@
+{% set vault_addr = 'https://vault.trez.wtf' %}
+{% set secrets_path = 'rinoa-docker/env' %}
+
+{
+  "$schema": "../schemas/v2/index.json",
+  "repos": [
+      {
+          "type": "gitea",
+          "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}",
+          "url": "https://git.trez.wtf",
+          "revisions": {
+              "branches": [
+                  "main",
+                  "*"
+              ]
+          }
+      }
+  ]
+}