Correcting image tag.

Merged by Trez.One

.gitea/workflows/pr-cloudflare-docker-deploy.yml

@@ -4,7 +4,9 @@ on:
     branches-ignore:
       - main
     paths:
+      - '**.yaml'
       - '**.yml'
+      - '**.j2'
 jobs:
   check-and-create-pr:
     name: Check and Create PR
@@ -249,6 +251,7 @@ jobs:
         run: |
            vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
       - name: Docker Compose Deployment
+        continue-on-error: true
         uses: keatonLiu/docker-compose-remote-action@v1.2
         with:
           ssh_user: gitea-deploy

.gitignore

@@ -1,2 +1,3 @@
 **/.cache_ggshield
-ansible/collections/ansible_collections/
+ansible/collections/ansible_collections/
+**/.env

README.md

@@ -27,6 +27,7 @@
 | czkawka | jlesage/czkawka |
 | dagu-scheduler | ghcr.io/dagu-org/dagu:latest |
 | dagu-server | ghcr.io/dagu-org/dagu:latest |
+| dbgate | dbgate/dbgate:alpine |
 | delugevpn | ghcr.io/binhex/arch-delugevpn:latest |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
 | docuseal | docuseal/docuseal:latest |
@@ -70,7 +71,8 @@
 | lidarr | lscr.io/linuxserver/lidarr:latest |
 | lidify | thewicklowwolf/lidify:latest |
 | lldap | lldap/lldap:stable |
-| localai | localai/localai:latest-aio-cpu |
+| lobe-chat | lobehub/lobe-chat-database |
+| lobe-chat-pg-db | pgvector/pgvector:pg16 |
 | maloja | krateng/maloja:latest |
 | mariadb | linuxserver/mariadb |
 | mastodon | lscr.io/linuxserver/mastodon:latest |
@@ -80,6 +82,11 @@
 | multi-scrobbler | foxxmd/multi-scrobbler |
 | n8n | docker.n8n.io/n8nio/n8n |
 | navidrome | deluan/navidrome:latest |
+| netbird-dashboard | netbirdio/dashboard:latest |
+| netbird-signal | netbirdio/signal:latest |
+| netbird-relay | netbirdio/relay:latest |
+| netbird-management | netbirdio/management:latest |
+| netbird-coturn | coturn/coturn:latest |
 | netbox | lscr.io/linuxserver/netbox:latest |
 | netbox-db | postgres:17-alpine |
 | nextcloud | lscr.io/linuxserver/nextcloud:latest |
@@ -118,6 +125,7 @@
 | sonashow | thewicklowwolf/sonashow:latest |
 | soularr | mrusse08/soularr:latest |
 | soulseek | slskd/slskd |
+| sourcebot | ghcr.io/sourcebot-dev/sourcebot:latest |
 | speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest |
 | spotisub | blastbeng/spotisub:latest |
 | swag | lscr.io/linuxserver/swag:latest |
@@ -138,7 +146,6 @@
 | wazuh.indexer | wazuh/wazuh-indexer: |
 | wazuh.manager | wazuh/wazuh-manager: |
 | web-check | lissy93/web-check |
-| whodb | clidey/whodb |
 | yacht | selfhostedpro/yacht |
 | your_spotify | lscr.io/linuxserver/your_spotify:latest |
 | youtubedl | nbr23/youtube-dl-server:latest |

ansible/app-configs/komodo_core.config.toml.j2

@@ -1,477 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-###########################
-# 🦎 KOMODO CORE CONFIG 🦎 #
-###########################
-
-## This is the offical "Default" config file for Komodo Core.
-## It serves as documentation for the meaning of the fields.
-## It is located at `https://github.com/mbecker20/komodo/blob/main/config/core.config.toml`.
-
-## All fields with a "Default" provided are optional. If they are
-## left out of the file, the "Default" value will be used.
-
-## This file is bundled into the official image, `ghcr.io/mbecker20/komodo`,
-## as the default config at `/config/config.toml`.
-## Komodo can start with no external config file mounted.
-
-## There is usually no need to create this file on your host.
-## Most fields can instead be configured using environment variables.
-## Environment variables will override values set in this file.
-
-## This will be the document title on the web page.
-## Env: KOMODO_TITLE
-## Default: 'Komodo'
-title = "Komodo @ Rinoa"
-
-## This should be the url used to access Komodo in browser, potentially behind DNS.
-## Eg https://komodo.example.com or http://12.34.56.78:9120. This should match the address configured in your Oauth app.
-## Env: KOMODO_HOST
-## Required, no default.
-host = "https://komodo.trez.wtf"
-
-## The port the core system will run on.
-## Env: KOMODO_PORT
-## Default: 9120
-port = 9120
-
-## This is the token used to authenticate core requests to periphery.
-## Ensure this matches a passkey in the connected periphery configs.
-## If the periphery servers don't have passkeys configured, this doesn't need to be changed.
-## Env: KOMODO_PASSKEY or KOMODO_PASSKEY_FILE
-## Required, no default
-passkey = "JgzFdZYbE7JfH5zhrh5pWUEQEWA4MCXG"
-
-## Ensure a server with this address exists on Core
-## upon first startup. Example: `https://periphery:8120`
-## Env: KOMODO_FIRST_SERVER
-## Optional, no default.
-first_server = ""
-
-## Disables write support on resources in the UI.
-## This protects users that that would normally have write priviledges during their UI usage,
-## when they intend to fully rely on ResourceSyncs to manage config.
-## Env: KOMODO_UI_WRITE_DISABLED
-## Default: false
-ui_write_disabled = false
-
-## Disables the confirm dialogs on all actions. All buttons will now be double-click.
-## Useful when only having http connection to core, as UI quick-copy button won't work.
-## Env: KOMODO_DISABLE_CONFIRM_DIALOG
-## Default: false
-disable_confirm_dialog = false
-
-## Configure the directory for sync files (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_SYNC_DIRECTORY
-## Default: /syncs
-sync_directory = "/syncs"
-
-## Configure the repo directory (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_REPO_DIRECTORY
-## Default: /repo-cache
-repo_directory = "/repo-cache"
-
-## Configure the action directory (inside the container).
-## There shouldn't be a need to change this, or even mount a volume.
-## Env: KOMODO_ACTION_DIRECTORY
-## Default: /action-cache
-action_directory = "/action-cache"
-
-################
-# AUTH / LOGIN #
-################
-
-## Allow user login with a username / password.
-## The password will be hashed and stored in the db for login comparison.
-##
-## NOTE:
-## Komodo has no API to recover account logins, but if this happens you can doctor the database using Mongo Compass.
-## Create a new Komodo user (Sign Up button), login to the database with Compass, note down your old users username and _id.
-## Then delete the old user, and update the new user to have the same username and _id. 
-## Make sure to set `enabled: true` and maybe `admin: true` on the new user as well, while using Compass.
-##
-## Env: KOMODO_LOCAL_AUTH
-## Default: false
-local_auth = true
-
-## Normally new users will be registered, but not enabled until an Admin enables them.
-## With `disable_user_registration = true`, only the first user to log in will registered as a user.
-## Env: KOMODO_DISABLE_USER_REGISTRATION
-## Default: false
-disable_user_registration = false
-
-## New users will be automatically enabled when they sign up.
-## Otherwise, new users will be disabled on first login.
-## The first user to login will always be enabled on creation.
-## Env: KOMODO_ENABLE_NEW_USERS
-## Default: false
-enable_new_users = false
-
-## Allows all users to have Read level access to all resources.
-## Env: KOMODO_TRANSPARENT_MODE
-## Default: false
-transparent_mode = false
-
-## Normally all enabled users can create resources.
-## If `disable_non_admin_create = true`, only admin users can create resources.
-## Env: KOMODO_DISABLE_NON_ADMIN_CREATE
-## Default: false
-disable_non_admin_create = false
-
-## Optionally provide a specific jwt secret.
-## Passing nothing or an empty string will cause one to be generated on every startup.
-## This means users will have to log in again if Komodo restarts.
-## Env: KOMODO_JWT_SECRET or KOMODO_JWT_SECRET_FILE
-## Default: empty string, meaning a random secret will be generated at startup.
-jwt_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_JWT_SECRET'] }}"
-
-## Specify how long a user can stay logged in before they have to log in again.
-## All jwts are invalidated on application restart unless `jwt_secret` is set.
-## Env: KOMODO_JWT_TTL
-## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk, 30-day
-## Default: 1-day. 
-jwt_ttl = "1-day"
-
-#############
-# OIDC Auth #
-#############
-
-## Enable logins with configured OIDC provider.
-## Env: KOMODO_OIDC_ENABLED
-## Default: false
-oidc_enabled = false
-
-## Give the provider address.
-##
-## The path, ie /application/o/komodo for Authentik,
-## is provider and configuration specific.
-##
-## Note. this address must be reachable from Komodo Core container.
-##
-## Env: KOMODO_OIDC_PROVIDER
-## Optional, no default.
-oidc_provider = "https://oidc.provider.internal/application/o/komodo"
-
-## Configure OIDC user redirect host.
-##
-## This is the host address users are redirected to in their browser,
-## and may be different from `oidc_provider` host depending on your networking.
-## If not provided (or empty string ""), the `oidc_provider` will be used.
-##
-## Note. DO NOT include the `path` part of the URL.
-## Example: `https://oidc.provider.external`
-##
-## Env: KOMODO_OIDC_REDIRECT_HOST
-## Optional, no default.
-oidc_redirect_host = ""
-
-## Give the OIDC Client ID.
-## Env: KOMODO_OIDC_CLIENT_ID or KOMODO_OIDC_CLIENT_ID_FILE
-oidc_client_id = ""
-
-## Give the OIDC Client Secret.
-## Env: KOMODO_OIDC_CLIENT_SECRET or KOMODO_OIDC_CLIENT_SECRET_FILE
-oidc_client_secret = ""
-
-## If true, use the full email for usernames.
-## Otherwise, the @address will be stripped,
-## making usernames more concise.
-## Env: KOMODO_OIDC_USE_FULL_EMAIL
-## Default: false.
-oidc_use_full_email = false
-
-## Some providers attach other audiences in addition to the client_id.
-## If you have this issue, `Invalid audiences: `...` is not a trusted audience"`,
-## you can add the audience `...` to the list here (assuming it should be trusted).
-## Env: KOMODO_OIDC_ADDITIONAL_AUDIENCES or KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE
-## Default: empty
-oidc_additional_audiences = []
-
-#########
-# OAUTH #
-#########
-
-## Google
-
-## Env: KOMODO_GOOGLE_OAUTH_ENABLED
-## Default: false
-google_oauth.enabled = false
-
-## Env: KOMODO_GOOGLE_OAUTH_ID or KOMODO_GOOGLE_OAUTH_ID_FILE
-## Required if google_oauth is enabled.
-google_oauth.id = ""
-
-## Env: KOMODO_GOOGLE_OAUTH_SECRET or KOMODO_GOOGLE_OAUTH_SECRET_FILE
-## Required if google_oauth is enabled.
-google_oauth.secret = ""
-
-## Github
-
-## Env: KOMODO_GITHUB_OAUTH_ENABLED
-## Default: false
-github_oauth.enabled = false
-
-## Env: KOMODO_GITHUB_OAUTH_ID or KOMODO_GITHUB_OAUTH_ID_FILE
-## Required if github_oauth is enabled.
-github_oauth.id = ""
-
-## Env: KOMODO_GITHUB_OAUTH_SECRET or KOMODO_GITHUB_OAUTH_SECRET_FILE
-## Required if github_oauth is enabled.
-github_oauth.secret = ""
-
-############
-# Security #
-############
-
-## Enable HTTPS server using the given key and cert.
-## Env: KOMODO_SSL_ENABLED
-## Default: false
-ssl_enabled = false
-
-## Path to the ssl key.
-## Env: KOMODO_SSL_KEY_FILE
-## Default: /config/ssl/key.pem
-ssl_key_file = "/config/ssl/key.pem"
-
-## Path to the ssl cert.
-## Env: KOMODO_SSL_CERT_FILE
-## Default: /config/ssl/cert.pem
-ssl_cert_file = "/config/ssl/cert.pem"
-
-############
-# DATABASE #
-############
-
-## Configure the database connection in one of the following ways:
-
-## Pass a full Mongo URI to the database.
-## Example: mongodb://username:password@localhost:27017
-## Env: KOMODO_DATABASE_URI or KOMODO_DATABASE_URI_FILE
-## Optional, can usually use `address`, `username`, `password` instead.
-database.uri = "mongodb://komodo:jtyl2U8KZPUe8V9MOTXQDYRlg7QemGuF@komodo-ferretdb:27017/komodo?authMechanism=PLAIN"
-
-## ==== * OR * ==== ##
-
-# Construct the address as mongodb://{username}:{password}@{address}
-## Env: KOMODO_DATABASE_ADDRESS
-# database.address = "localhost:27017"
-## Env: KOMODO_DATABASE_USERNAME or KOMODO_DATABASE_USERNAME_FILE
-# database.username = ""
-## Env: KOMODO_DATABASE_PASSWORD or KOMODO_DATABASE_PASSWORD_FILE
-# database.password = ""
-
-## ==== other ====
-
-## Komodo will create its collections under this database name.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_DB_NAME
-## Default: komodo.
-database.db_name = "komodo"
-
-## This is the assigned app_name of the mongo client.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_APP_NAME
-## Default: komodo_core.
-database.app_name = "komodo_core"
-
-############
-# WEBHOOKS #
-############
-
-## This token must be given to git provider during repo webhook config.
-## The secret configured on the git provider side must match the secret configured here.
-## If not provided, 
-## Env: KOMODO_WEBHOOK_SECRET or KOMODO_WEBHOOK_SECRET_FILE
-## Optional, no default.
-webhook_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_WEBHOOK_SECRET'] }}"
-
-## An alternate base url that is used to recieve git webhook requests.
-## If empty or not specified, will use 'host' address as base.
-## This is useful if Komodo is on an internal network, but can have a
-## proxy just allowing through the webhook listener api using NGINX.
-## Env: KOMODO_WEBHOOK_BASE_URL
-## Default: empty (none)
-webhook_base_url = ""
-
-## Configure Github webhook app. Enables webhook management apis.
-## <INSERT LINK TO GUIDE>
-## Env: KOMODO_GITHUB_WEBHOOK_APP_APP_ID or KOMODO_GITHUB_WEBHOOK_APP_APP_ID_FILE
-# github_webhook_app.app_id = 1234455 # Find on the app page.
-## Env: 
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS or KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS_FILE
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_NAMESPACES
-# github_webhook_app.installations = [
-#   ## Find the id after installing the app to user / organization. "namespace" is the username / organization name.
-#   { id = 1234, namespace = "mbecker20" }
-# ]
-
-## The path to Github webhook app private key. <INSERT LINK TO GUIDE>
-## This is defaulted to `/github/private-key.pem`, and doesn't need to be changed if running core in Docker.
-## Just mount the private key pem file on the host to `/github/private-key.pem` in the container.
-## Eg. `/your/path/to/key.pem : /github/private-key.pem`
-## Env: KOMODO_GITHUB_WEBHOOK_APP_PK_PATH
-# github_webhook_app.pk_path = "/path/to/pk.pem"
-
-###########
-# LOGGING #
-###########
-
-## Specify the logging verbosity
-## Env: KOMODO_LOGGING_LEVEL
-## Options: off, error, warn, info, debug, trace
-## Default: info
-logging.level = "info"
-
-## Specify the logging format for stdout / stderr.
-## Env: KOMODO_LOGGING_STDIO
-## Options: standard, json, none
-## Default: standard
-logging.stdio = "standard"
-
-## Optionally specify a opentelemetry otlp endpoint to send traces to.
-## Example: http://localhost:4317
-## Env: KOMODO_LOGGING_OTLP_ENDPOINT
-logging.otlp_endpoint = ""
-
-## Set the opentelemetry service name.
-## This will be attached to the telemetry Komodo will send.
-## Env: KOMODO_LOGGING_OPENTELEMETRY_SERVICE_NAME
-## Default: "Komodo"
-logging.opentelemetry_service_name = "Komodo"
-
-###########
-# PRUNING #
-###########
-
-## The number of days to keep historical system stats around, or 0 to disable pruning. 
-## Stats older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_STATS_FOR_DAYS
-## Default: 14
-keep_stats_for_days = 14
-
-## The number of days to keep alerts around, or 0 to disable pruning. 
-## Alerts older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_ALERTS_FOR_DAYS
-## Default: 14
-keep_alerts_for_days = 14
-
-##################
-# POLL INTERVALS #
-##################
-
-## Controls the rate at which servers are polled for health, system stats, and container status.
-## This affects network usage, and the size of the stats stored in mongo.
-## Env: KOMODO_MONITORING_INTERVAL
-## Options: 1-sec, 5-sec, 15-sec, 30-sec, 1-min, 2-min, 5-min, 15-min
-## Default: 15-sec
-monitoring_interval = "15-sec"
-
-## Interval at which to poll Resources for any updates / automated actions.
-## Env: KOMODO_RESOURCE_POLL_INTERVAL
-## Options: `15-sec`, `1-min`, `5-min`, `15-min`, `1-hr`.
-## Default: 5-min
-resource_poll_interval = "5-min"
-
-###################
-# CLOUD PROVIDERS #
-###################
-
-## Komodo can build images by deploying AWS EC2 instances,
-## running the build, and afterwards destroying the instance.
-
-## Additionally, Komodo can deploy cloud VPS on AWS EC2 and Hetzner.
-## Use the Template resource to configure launch preferences.
-## Hetzner is not supported for builds as their pricing model is by the hour,
-## while AWS is by the minute. This is very important for builds.
-
-## Provide AWS api keys for ephemeral builders / server launch
-## Env: KOMODO_AWS_ACCESS_KEY_ID or KOMODO_AWS_ACCESS_KEY_ID_FILE
-aws.access_key_id = ""
-## Env: KOMODO_AWS_SECRET_ACCESS_KEY or KOMODO_AWS_SECRET_ACCESS_KEY_FILE
-aws.secret_access_key = ""
-
-## Provide Hetzner api token for server launch
-## Env: KOMODO_HETZNER_TOKEN or KOMODO_HETZNER_TOKEN_FILE
-hetzner.token = ""
-
-#################
-# GIT PROVIDERS #
-#################
-
-## These will be available to attach to Builds, Repos, Stacks, and Syncs.
-## They allow these Resources to clone private repositories.
-## They cannot be configured on the environment.
-
-## configure git providers
-# [[git_provider]]
-# domain = "github.com"
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# 	{ username = "moghtech", token = "access_token_for_other_account" },
-# ]
-
-# [[git_provider]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-# [[git_provider]]
-# domain = "localhost:8000" # use a custom provider, like self-hosted gitea
-# https = false # use http://localhost:8000 as base-url for clone
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-######################
-# REGISTRY PROVIDERS #
-######################
-
-## These will be available to attach to Builds and Stacks.
-## They allow these Resources to pull private images.
-## They cannot be configured on the environment.
-
-## configure docker registries
-# [[docker_registry]]
-# domain = "docker.io"
-# accounts = [
-# 	{ username = "mbecker2020", token = "access_token_for_account" }
-# ]
-# organizations = ["DockerhubOrganization"]
-
-[[gitea_rinoa]]
-domain = "git.trez.wtf"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-[[gitea_rinoa_local]]
-domain = "http://gitea:3000"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-# [[docker_registry]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-# organizations = ["Mogh"] # These become available in the UI
-
-###########
-# SECRETS #
-###########
-
-## Provide Core based secrets.
-## These will be available to interpolate into your Deployment / Stack environments,
-## and will be hidden in the UI and logs.
-## These are available to use on any Periphery (Server),
-## but you can also limit access more by placing them in a single Periphery's config file instead.
-## These cannot be configured in the Komodo Core environment, they must be passed in the file.
-
-# [secrets]
-# SECRET_1 = "value_1"
-# SECRET_2 = "value_2"

ansible/app-configs/sourcebot_config.json.j2

@@ -0,0 +1,19 @@
+{% set vault_addr = 'https://vault.trez.wtf' %}
+{% set secrets_path = 'rinoa-docker/env' %}
+
+{
+  "$schema": "../schemas/v2/index.json",
+  "repos": [
+      {
+          "type": "gitea",
+          "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}",
+          "url": "https://git.trez.wtf",
+          "revisions": {
+              "branches": [
+                  "main",
+                  "*"
+              ]
+          }
+      }
+  ]
+}

docker-compose.yml

@@ -225,6 +225,13 @@ services:
         type: bind
   authelia:
     container_name: authelia
+    depends_on:
+      authelia-pg:
+        condition: service_started
+        required: true
+      lldap:
+        condition: service_started
+        required: true
     environment:
       AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD: ${AUTHELIA_AUTH_BIND_LDAP_PASSWORD}
       AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET}
@@ -264,9 +271,9 @@ services:
   authelia-pg:
     container_name: authelia-pg
     environment:
-      - POSTGRES_PASSWORD=${AUTHELIA_STORAGE_POSTGRES_PASSWORD}
-      - POSTGRES_USER=authelia
-      - POSTGRES_DB=authelia
+      POSTGRES_PASSWORD: ${AUTHELIA_STORAGE_POSTGRES_PASSWORD}
+      POSTGRES_USER: authelia
+      POSTGRES_DB: authelia
     expose:
       - 5432
     image: postgres:16-alpine
@@ -516,11 +523,13 @@ services:
   bunkerweb:
     container_name: bunkerweb
     environment:
-      SERVER_NAME: www.trez.wtf
       API_WHITELIST_IP: 172.18.0.0/16 192.168.1.0/24
-      USE_REAL_IP: yes
       REAL_IP_FROM: 172.18.0.0/16
       REAL_IP_HEADER: X-Forwarded-For
+      REVERSE_PROXY_HOST: http://swag:80
+      SERVER_NAME: bunker.trez.wtf
+      USE_REAL_IP: yes
+      USE_REVERSE_PROXY: yes
     expose:
       - 8080
       - 8443
@@ -542,8 +551,13 @@ services:
   bunkerweb-ui:
     container_name: bunkerweb-ui
     depends_on:
-      - bunkerweb
-      - docker-socket-proxy
+      bunkerweb:
+        condition: service_started
+        required: true
+        restart: true
+      docker-socket-proxy:
+        condition: service_started
+        required: true
     environment:
       DOCKER_HOST: tcp://dockerproxy:2375
     expose:
@@ -551,7 +565,7 @@ services:
     image: bunkerity/bunkerweb-ui:latest
     labels:
       homepage.group: Privacy/Security
-      homepage.name: Bunkerweb
+      homepage.name: Bunker Web
       homepage.href: https://bunker.${MY_TLD}
       homepage.icon: bunkerweb.svg
       homepage.description: Next-gen WAF
@@ -834,6 +848,162 @@ services:
         type: volume
         bind:
           create_host_path: true
+  dbgate:
+    container_name: dbgate
+    environment:
+      CONNECTIONS: authelia-pg,bitmagnet-pg-db,gitea-db,invidious-db,joplin-db,lobe-chat-pg-db,mariadb,mastodon-pg-db,mongodb,netbox-db,pgbackweb,pgbackweb-db,plausible-db,plausible-events-db,reactive-resume-pg,sonarqube-pg-db,synapse-db,tandoor-pg,traccar-pg,whodb,zitadel-pg-db
+
+      LOGIN: TrezOne
+      PASSWORD: ${DBGATE_LOGIN_PASSWORD}
+
+      LABEL_mariadb: mariadb
+      SERVER_mariadb: mariadb
+      USER_mariadb: root
+      PASSWORD_mariadb: ${MARIADB_ENVIRONMENT_MYSQL_ROOT_PASSWORD}
+      PORT_mariadb: 3306
+      ENGINE_mariadb: mariadb@dbgate-plugin-mysql
+
+      LABEL_authelia-pg: authelia-pg
+      SERVER_authelia-pg: authelia-pg
+      USER_authelia-pg: authelia
+      DATABASE_authelia-pg: authelia
+      PASSWORD_authelia-pg: ${BITMAGNET_POSTGRESQL_PASSWORD}
+      PORT_authelia-pg: 5432
+      ENGINE_authelia-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_bitmagnet-pg-db: bitmagnet-pg-db
+      SERVER_bitmagnet-pg-db: bitmagnet-pg-db
+      USER_bitmagnet-pg-db: bitmagnet-pg
+      DATABASE_bitmagnet-pg-db: bitmagnet
+      PASSWORD_bitmagnet-pg-db: ${BITMAGNET_POSTGRESQL_PASSWORD}
+      PORT_bitmagnet-pg-db: 5432
+      ENGINE_bitmagnet-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_gitea-db: gitea-db
+      SERVER_gitea-db: gitea-db
+      USER_gitea-db: gitea
+      PASSWORD_gitea-db: ${GITEA_PG_DB_PASSWORD}
+      DATABASE_gitea-db: gitea
+      PORT_gitea-db: 5432
+      ENGINE_gitea-db: postgres@dbgate-plugin-postgres
+
+      LABEL_invidious-db: invidious-db
+      SERVER_invidious-db: invidious-db
+      USER_invidious-db: kemal
+      PASSWORD_invidious-db: ${INVID_PG_DB_PASSWORD}
+      PORT_invidious-db: 5432
+      DATABASE_invidious-db: invidious
+      ENGINE_invidious-db: postgres@dbgate-plugin-postgres
+
+      LABEL_joplin-db: joplin-db
+      SERVER_joplin-db: joplin-db
+      USER_joplin-db: ${JOPLIN_POSTGRES_USER}
+      PASSWORD_joplin-db: ${JOPLIN_POSTGRES_DATABASE}
+      DATABASE_joplin-db: joplin
+      PORT_joplin-db: 5432
+      ENGINE_joplin-db: postgres@dbgate-plugin-postgres
+
+      LABEL_lobe-chat-pg-db: lobe-chat-pg-db
+      SERVER_lobe-chat-pg-db: lobe-chat-pg-db
+      USER_lobe-chat-pg-db: lobe
+      PASSWORD_lobe-chat-pg-db: ${GITEA_PG_DB_PASSWORD}
+      DATABASE_lobe-chat-pg-db: lobe
+      PORT_lobe-chat-pg-db: 5432
+      ENGINE_lobe-chat-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_mastodon-pg-db: mastodon-pg-db
+      SERVER_mastodon-pg-db: mastodon-pg-db
+      USER_mastodon-pg-db: mastodon
+      PASSWORD_mastodon-pg-db: ${MASTODON_PG_DB_PASSWORD}
+      DATABASE_mastodon-pg-db: mastodon
+      PORT_mastodon-pg-db: 5432
+      ENGINE_mastodon-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_mongodb: mongodb
+      URI_mongodb: mongodb://mongodb:27017
+      ENGINE_mongodb: mongo@dbgate-plugin-mongo
+
+      LABEL_netbox-db: netbox-db
+      SERVER_netbox-db: netbox-db
+      USER_netbox-db: netbox
+      PASSWORD_netbox-db: ${NETBOX_PG_DB_PASSWORD}
+      PORT_netbox-db: 5432
+      DATABASE_netbox-db: netbox
+      ENGINE_netbox-db: postgres@dbgate-plugin-postgres
+
+      LABEL_pgbackweb-db: pgbackweb-db
+      SERVER_pgbackweb-db: pgbackweb-db
+      USER_pgbackweb-db: pgbackweb
+      PASSWORD_pgbackweb-db: ${PGBACKWEB_PG_DB_PASSWD}
+      PORT_pgbackweb-db: 5432
+      ENGINE_pgbackweb-db: postgres@dbgate-plugin-postgres
+
+      LABEL_plausible-db: plausible-db
+      SERVER_plausible-db: plausible-db
+      USER_plausible-db: plausible
+      PASSWORD_plausible-db: ${PLAUSIBLE_PG_PASSWORD}
+      PORT_plausible-db: 5432
+      ENGINE_plausible-db: postgres@dbgate-plugin-postgres
+
+      LABEL_reactive-resume-pg: reactive-resume-pg
+      SERVER_reactive-resume-pg: reactive-resume-pg
+      USER_reactive-resume-pg: reactiveresume
+      PASSWORD_reactive-resume-pg: ${REACTIVE_RESUME_PGSQL_PASSWORD}
+      PORT_reactive-resume-pg: 5432
+      ENGINE_reactive-resume-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_sonarqube-pg-db: sonarqube-pg-db
+      SERVER_sonarqube-pg-db: sonarqube-pg-db
+      USER_sonarqube-pg-db: sonar
+      PASSWORD_sonarqube-pg-db: ${SONARQUBE_POSTGRES_PASSWORD}
+      PORT_sonarqube-pg-db: 5432
+      ENGINE_sonarqube-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_synapse-db: synapse-db
+      SERVER_synapse-db: synapse-db
+      USER_synapse-db: synapse
+      PASSWORD_synapse-db: ${SYNAPSE_POSTGRES_PASSWORD}
+      PORT_synapse-db: 5432
+      ENGINE_synapse-db: postgres@dbgate-plugin-postgres
+
+      LABEL_tandoor-pg: tandoor-pg
+      SERVER_tandoor-pg: tandoor-pg
+      USER_tandoor-pg: tandoor
+      PASSWORD_tandoor-pg: ${TANDOOR_POSTGRES_PASSWORD}
+      PORT_tandoor-pg: 5432
+      ENGINE_tandoor-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_traccar-pg: traccar-pg
+      SERVER_traccar-pg: traccar-pg
+      USER_traccar-pg: ${TRACCAR_POSTGRES_USER}
+      PASSWORD_traccar-pg: ${TRACCAR_POSTGRES_PASSWORD}
+      PORT_traccar-pg: 5432
+      ENGINE_traccar-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_zitadel-pg-db: zitadel-pg-db
+      SERVER_zitadel-pg-db: zitadel-pg-db
+      USER_zitadel-pg-db: root
+      PASSWORD_zitadel-pg-db: ${ZITADEL_DB_ADMIN_PASSWORD}
+      PORT_zitadel-pg-db: 5432
+      ENGINE_zitadel-pg-db: postgres@dbgate-plugin-postgres
+    image: dbgate/dbgate:alpine
+    labels:
+      homepage.group: System Administration
+      homepage.name: DbGate
+      homepage.href: https://dbs.${MY_TLD}
+      homepage.icon: sh-dbgate.png
+      homepage.description: Cross-platform database manager
+      swag: enable
+      swag_port: 3000
+      swag_proto: http
+      swag_url: dbs.${MY_TLD}
+      swag.uptime-kuma.enabled: true
+      swag.uptime-kuma.monitor.url: https://dbs.${MY_TLD}
+    ports:
+      - 49054:3000
+    restart: unless-stopped
+    volumes:
+      - dbgate-data:/root/.dbgate
   delugevpn:
     cap_add:
       - NET_ADMIN
@@ -1214,9 +1384,9 @@ services:
   gitea-db:
     container_name: gitea-db
     environment:
-      - POSTGRES_USER=gitea
-      - POSTGRES_PASSWORD=${GITEA_PG_DB_PASSWORD}
-      - POSTGRES_DB=gitea
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: ${GITEA_PG_DB_PASSWORD}
+      POSTGRES_DB: gitea
     expose:
       - 5432
     healthcheck:
@@ -1927,22 +2097,22 @@ services:
         target: 8003
     restart: always
     volumes:
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/app/public
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/app/public
         target: /var/www/app/public
         type: bind
         bind:
           create_host_path: true
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/app/storage
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/app/storage
         target: /var/www/app/storage
         type: bind
         bind:
           create_host_path: true
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/php/php.ini
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/php/php.ini
         target: /usr/local/etc/php/php.ini
         type: bind
         bind:
           create_host_path: true
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/php/php-cli.ini
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/php/php-cli.ini
         target: /usr/local/etc/php/php-cli.ini
         type: bind
         bind:
@@ -2640,9 +2810,9 @@ services:
   joplin-db:
     container_name: joplin-db
     environment:
-      - POSTGRES_PASSWORD=${JOPLIN_POSTGRES_PASSWORD}
-      - POSTGRES_USER=${JOPLIN_POSTGRES_USER}
-      - POSTGRES_DB=${JOPLIN_POSTGRES_DATABASE}
+      POSTGRES_PASSWORD: ${JOPLIN_POSTGRES_PASSWORD}
+      POSTGRES_USER: ${JOPLIN_POSTGRES_USER}
+      POSTGRES_DB: ${JOPLIN_POSTGRES_DATABASE}
     expose:
       - 5432
     image: postgres:17-alpine
@@ -2832,44 +3002,66 @@ services:
         type: bind
         bind:
           create_host_path: true
-  localai:
-    container_name: localai
+  lobe-chat:
+    container_name: lobe-chat
+    depends_on:
+      lobe-chat-pg-db:
+        condition: service_started
+        required: true
+      minio:
+        condition: service_started
+        required: true
+      zitadel:
+        condition: service_started
+        required: true
     environment:
-      - DEBUG=true
-    healthcheck:
-      interval: 1m
-      retries: 5
-      test:
-        - CMD
-        - curl
-        - -f
-        - http://localhost:8080/readyz
-      timeout: 20m
-    image: localai/localai:latest-aio-cpu
+      APP_URL: https://ai.trez.wtf/
+      KEY_VAULTS_SECRET: ${LOBECHAT_KEY_VAULT_SECRET}
+      DATABASE_URL: postgresql://lobe:${LOBECHAT_PG_DB_PASSWD}@lobe-chat-pg-db:5432/lobe
+      NEXTAUTH_URL: https://lobe.example.com/api/auth
+      NEXT_AUTH_SECRET: ${LOBECHAT_NEXT_AUTH_SECRET}
+      NEXT_AUTH_SSO_PROVIDERS: zitadel
+      AUTH_ZITADEL_ID: ${LOBECHAT_ZITADEL_CLIENT_ID}
+      AUTH_ZITADEL_SECRET: ${LOBECHAT_ZITADEL_CLIENT_SECRET}
+      AUTH_ZITADEL_ISSUER: https://id.trez.wtf
+      S3_ACCESS_KEY_ID: ${LOBECHAT_S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${LOBECHAT_S3_SECRET_ACCESS_KEY}
+      S3_ENDPOINT: http://minio:9000
+      S3_BUCKET: lobechat
+      S3_PUBLIC_DOMAIN: https://s3.trez.wtf
+      S3_ENABLE_PATH_STYLE: 1+
+      OPENAI_API_KEY: ${LOBECHAT_OPENAI_API_KEY}
+      ANTHROPIC_API_KEY: ${LOBECHAT_ANTHROPIC_API_KEY}
+      GITHUB_TOKEN: ${LOBECHAT_GITHUB_TOKEN}
+      OLLAMA_MODEL_LIST: +llama3.1:8b,+nomic-embed-text:latest,+starcoder2:3b,+llama3.1:latest,+llama2:7B
+      MISTRAL_API_KEY: ${LOBECHAT_MISTRAL_API_KEY}
+      GROQ_API_KEY: ${LOBECHAT_GROQAI_API_KEY}
+    image: lobehub/lobe-chat-database
     labels:
       homepage.group: Personal Services
-      homepage.name: LocalAI
+      homepage.name: LobeChat
       homepage.href: https://ai.${MY_TLD}
-      homepage.icon: /icons/localai.png
-      homepage.description: Open source OpenAI alternative
+      homepage.icon: lobe-chat.png
+      homepage.description: An open-source, modern-design ChatGPT/LLMs UI/Framework
       swag: enable
       swag_proto: http
-      swag_port: 8080
+      swag_port: 3210
       swag_url: ai.${MY_TLD}
-    networks:
-      default: null
     ports:
-      - mode: ingress
-        protocol: tcp
-        published: "8109"
-        target: 8080
-    restart: always
+      - 3210:3210
+    restart: unless-stopped
+  lobe-chat-pg-db:
+    container_name: lobe-chat-pg-db
+    environment:
+      POSTGRES_DB: lobe
+      POSTGRES_USER: lobe
+      POSTGRES_PASSWORD: ${LOBECHAT_PG_DB_PASSWD}
+    expose:
+      - 5432
+    image: pgvector/pgvector:pg16
     volumes:
-      - source: ${DOCKER_VOLUME_CONFIG}/localai/models
-        target: /build/models
-        type: bind
-        bind:
-          create_host_path: true
+      - ${DOCKER_VOLUME_CONFIG}/lobechat/db:/var/lib/postgresql/data
+    restart: unless-stopped
   maloja:
     container_name: maloja
     environment:
@@ -3237,7 +3429,7 @@ services:
       swag_url: netbird.${MY_TLD}
       swag_server_custom_directive: |
         location /signalexchange.SignalExchange/ {
-            grpc_pass grpc://netbird-signal;
+            grpc_pass grpc://netbird-signal:80;
             #grpc_ssl_verify off;
             grpc_read_timeout 1d;
             grpc_send_timeout 1d;
@@ -3245,11 +3437,11 @@ services:
         }
         # Proxy Management http endpoint
         location /api {
-            proxy_pass http://netbird-management;
+            proxy_pass http://netbird-management:443;
         }
         # Proxy Management grpc endpoint
         location /management.ManagementService/ {
-            grpc_pass grpc://netbird-management;
+            grpc_pass grpc://netbird-management:443;
             #grpc_ssl_verify off;
             grpc_read_timeout 1d;
             grpc_send_timeout 1d;
@@ -3272,6 +3464,7 @@ services:
     volumes:
       - netbird-signal:/var/lib/netbird
   netbird-relay:
+    container_name: netbird-relay
     image: netbirdio/relay:latest
     restart: unless-stopped
     environment:
@@ -3571,7 +3764,7 @@ services:
     image: eduardolat/pgbackweb:latest
     labels:
       homepage.group: System Administration
-      homepage.name: PGBackweb
+      homepage.name: PG Back Web
       homepage.href: https://pg.${MY_TLD}
       homepage.icon: sh-pg-back-web.svg
       homepage.description: Backups for PostgreSQL
@@ -3681,6 +3874,33 @@ services:
       - plausible-event-logs:/var/log/clickhouse-server
       - ${DOCKER_VOLUME_CONFIG}/plausible/clickhouse/clickhouse-config.xml:/etc/clickhouse-server/config.d/logging.xml:ro
       - ${DOCKER_VOLUME_CONFIG}/plausible/clickhouse/clickhouse-user-config.xml:/etc/clickhouse-server/users.d/logging.xml:ro
+  portainer:
+    container_name: portainer
+    depends_on:
+      docker-socket-proxy:
+        condition: service_started
+        required: true
+    environment:
+      DOCKER_HOST: tcp://dockerproxy:2375
+    expose:
+      - 8000
+      - 9443
+    image: portainer/portainer-ce:alpine-sts
+    labels:
+      swag: enable
+      swag_proto: http
+      swag_port: 8000
+      swag_url: portainer.${MY_TLD}
+      swag.uptime-kuma.enabled: true
+      swag.uptime-kuma.monitor.url: https://portainer.${MY_TLD}
+      homepage.group: System Administration
+      homepage.name: Portainer
+      homepage.href: https://portainer.${MY_TLD}
+      homepage.icon: portainer.svg
+      homepage.description: Service delivery platform for containerized applications
+    restart: unless-stopped
+    volumes:
+        - portainer-data:/data
   postal-smtp:
     cap_add:
       - NET_BIND_SERVICE
@@ -4580,6 +4800,28 @@ services:
         type: bind
         bind:
           create_host_path: true
+  sourcebot:
+    container_name: sourcebot
+    environment:
+      CONFIG_PATH: /data/config.json
+    image: ghcr.io/sourcebot-dev/sourcebot:latest
+    labels:
+      homepage.name: Sourcebot
+      homepage.group: Code/DevOps
+      homepage.description: Self-hosted internet performance tracking
+      homepage.href: https://source.${MY_TLD}
+      homepage.icon: /icons/sourcebot.png
+      swag: enable
+      swag_proto: http
+      swag_port: 3000
+      swag_url: source.${MY_TLD}
+      swag.uptime-kuma.enabled: true
+      swag.uptime-kuma.monitor.url: https://source.${MY_TLD}
+    ports:
+        - 45251:3000
+    restart: unless-stopped
+    volumes:
+      - ${DOCKER_VOLUME_CONFIG}/sourcebot:/data
   speedtest-tracker:
     container_name: speedtest-tracker
     image: lscr.io/linuxserver/speedtest-tracker:latest
@@ -4588,6 +4830,7 @@ services:
         PGID: ${PGID}
         APP_KEY: ${SPEEDTEST_TRACKER_APP_KEY}
         DB_CONNECTION: sqlite
+        SPEEDTEST_SCHEDULE: 15 */3 * * *
     labels:
       homepage.name: Speedtest Tracker
       homepage.group: System Administration
@@ -6604,32 +6847,6 @@ services:
         published: "3010"
         target: 3000
     restart: unless-stopped
-  whodb:
-    container_name: whodb
-    environment:
-      WHODB_MONGODB_1: null
-      WHODB_MYSQL_1: null
-    image: clidey/whodb
-    labels:
-      homepage.group: System Administration
-      homepage.name: WhoDB
-      homepage.href: https://dbs.${MY_TLD}
-      homepage.icon: /icons/whodb.png
-      homepage.description: Web-based DB management
-      swag: enable
-      swag_proto: http
-      swag_port: 8080
-      swag_url: dbs.${MY_TLD}
-      swag.uptime-kuma.enabled: true
-      swag.uptime-kuma.monitor.url: https://dbs.${MY_TLD}
-    networks:
-      default: null
-    ports:
-      - mode: ingress
-        protocol: tcp
-        published: "8900"
-        target: 8080
-    restart: unless-stopped
   yacht:
     container_name: yacht
     depends_on:
@@ -7154,6 +7371,8 @@ volumes:
     name: dagu_config
   dagu_data:
     name: dagu_data
+  dbgate-data:
+    name: dbgate-data
   fastenhealth-cache:
     name: fastenhealth-cache
   fastenhealth-db:
@@ -7226,6 +7445,8 @@ volumes:
     name: plausible-event-data
   plausible-event-logs:
     name: plausible-event-logs
+  portainer-data:
+    name: portainer-data
   reactive-resume-pg:
     name: reactive-resume-pg
   sonarqube-data: