Initial deployment for Immich.

Merged by Trez.One

.gitea/workflows/pr-cloudflare-docker-deploy.yml

@@ -4,7 +4,9 @@ on:
     branches-ignore:
       - main
     paths:
+      - '**.yaml'
       - '**.yml'
+      - '**.j2'
 jobs:
   check-and-create-pr:
     name: Check and Create PR
@@ -77,6 +79,13 @@ jobs:
             --check
           requirements: collections/requirements.yml
           vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
+          notification_message: 'Ansible dry run completed successfully.'
       - name: Generate .env file for Docker Compose Dry Run
         run: |
           vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
@@ -95,6 +104,13 @@ jobs:
           up-opts: --dry-run -d --remove-orphans
         env:
           DOCKER_HOST: tcp://dockerproxy:2375
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
+          notification_message: 'Docker Compose dry run completed successfully.'
   cloudflare-dns-setup:
     name: Cloudflare DNS Setup
     needs: [docker-compose-ansible-lints]
@@ -130,6 +146,13 @@ jobs:
         run: |
           yq '.services[].labels.swag_url' docker-compose.yml | egrep -v 'null' | sed -e 's|"||g' | awk -F'.' '{print $1}' | sort > compose_subdomains.txt
           flarectl --json dns list --zone "trez.wtf" --type=CNAME --content "trez.wtf" | jq '.[].Name' | sed -e 's|"||g' | awk -F"." '{print $1}' | sort > cloudflare_subdomains.txt
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
+          notification_message: 'Starting Cloudflare setup'
       - name: Compare Subdomains
         id: compare-subdomains
         uses: LouisBrunner/diff-action@v2.2.0
@@ -150,6 +173,13 @@ jobs:
             echo "Creating $subdomain.trez.wtf..."
             flarectl dns create --zone "trez.wtf" --name "${subdomain}" --type=CNAME --content "trez.wtf" --proxy true
           done
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
+          notification_message: 'Cloudflare DNS setup completed successfully.'
   regenerate-readme:
     name: Update README
     runs-on: ubuntu-latest
@@ -201,6 +231,14 @@ jobs:
           echo "Merging PR..."
           pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
           tea pr m --repo ${{ github.repository }} --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" --message "Merged by ${{ github.actor }}" ${pr_index}
+          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: PR Merge Successful'
+          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
   ansible-config-docker-compose-deploy:
     name: Deploy via Ansible & Docker Compose
     runs-on: ubuntu-latest
@@ -243,12 +281,13 @@ jobs:
         with:
           gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
           gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'Ansible Config Deployment @ Rinoa'
+          notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
           notification_message: 'Deployment completed successfully.'
       - name: Generate .env file for deployment
         run: |
            vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
       - name: Docker Compose Deployment
+        continue-on-error: true
         uses: keatonLiu/docker-compose-remote-action@v1.2
         with:
           ssh_user: gitea-deploy
@@ -261,5 +300,5 @@ jobs:
         with:
           gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
           gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'Docker Compose Deployment @ Rinoa'
+          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
           notification_message: 'Deployment completed successfully.'

.gitignore

@@ -1,2 +1,3 @@
 **/.cache_ggshield
-ansible/collections/ansible_collections/
+ansible/collections/ansible_collections/
+**/.env

README.md

@@ -27,6 +27,7 @@
 | czkawka | jlesage/czkawka |
 | dagu-scheduler | ghcr.io/dagu-org/dagu:latest |
 | dagu-server | ghcr.io/dagu-org/dagu:latest |
+| dbgate | dbgate/dbgate:alpine |
 | delugevpn | ghcr.io/binhex/arch-delugevpn:latest |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
 | docuseal | docuseal/docuseal:latest |
@@ -70,16 +71,22 @@
 | lidarr | lscr.io/linuxserver/lidarr:latest |
 | lidify | thewicklowwolf/lidify:latest |
 | lldap | lldap/lldap:stable |
-| localai | localai/localai:latest-aio-cpu |
+| lobe-chat | lobehub/lobe-chat-database |
+| lobe-chat-pg-db | pgvector/pgvector:pg16 |
 | maloja | krateng/maloja:latest |
 | mariadb | linuxserver/mariadb |
 | mastodon | lscr.io/linuxserver/mastodon:latest |
 | mastodon-pg-db | postgres:17-alpine |
 | minio | minio/minio |
-| mongodb | mongo:7.0 |
+| mongodb | bitnami/mongodb:7.0 |
 | multi-scrobbler | foxxmd/multi-scrobbler |
 | n8n | docker.n8n.io/n8nio/n8n |
 | navidrome | deluan/navidrome:latest |
+| netbird-dashboard | netbirdio/dashboard:latest |
+| netbird-signal | netbirdio/signal:latest |
+| netbird-relay | netbirdio/relay:latest |
+| netbird-management | netbirdio/management:latest |
+| netbird-coturn | coturn/coturn:latest |
 | netbox | lscr.io/linuxserver/netbox:latest |
 | netbox-db | postgres:17-alpine |
 | nextcloud | lscr.io/linuxserver/nextcloud:latest |
@@ -88,9 +95,11 @@
 | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest |
 | pgbackweb | eduardolat/pgbackweb:latest |
 | pgbackweb-db | postgres:16-alpine |
+| plantuml-server | plantuml/plantuml-server:jetty |
 | plausible | ghcr.io/plausible/community-edition:v2.1.0 |
 | plausible_db | postgres:16-alpine |
 | plausible_events_db | clickhouse/clickhouse-server:24.3.3.102-alpine |
+| portainer | portainer/portainer-ce:alpine-sts |
 | postal-smtp | ghcr.io/postalserver/postal:latest |
 | postal-web | ghcr.io/postalserver/postal:latest |
 | postal-worker | ghcr.io/postalserver/postal:latest |
@@ -102,6 +111,7 @@
 | readarr | lscr.io/linuxserver/readarr:develop |
 | redis | redis:alpine |
 | redlib | quay.io/redlib/redlib:latest |
+| rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest |
 | sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest |
 | scraperr | jpyles0524/scraperr:latest |
 | scraperr-api | jpyles0524/scraperr_api:latest |
@@ -117,11 +127,10 @@
 | sonashow | thewicklowwolf/sonashow:latest |
 | soularr | mrusse08/soularr:latest |
 | soulseek | slskd/slskd |
+| sourcebot | ghcr.io/sourcebot-dev/sourcebot:latest |
 | speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest |
 | spotisub | blastbeng/spotisub:latest |
 | swag | lscr.io/linuxserver/swag:latest |
-| synapse | docker.io/matrixdotorg/synapse:latest |
-| synapse-db | postgres:16-alpine |
 | tandoor | vabene1111/recipes |
 | tandoor-pg | postgres:16-alpine |
 | traccar | traccar/traccar:latest |
@@ -137,7 +146,6 @@
 | wazuh.indexer | wazuh/wazuh-indexer: |
 | wazuh.manager | wazuh/wazuh-manager: |
 | web-check | lissy93/web-check |
-| whodb | clidey/whodb |
 | yacht | selfhostedpro/yacht |
 | your_spotify | lscr.io/linuxserver/your_spotify:latest |
 | youtubedl | nbr23/youtube-dl-server:latest |

ansible/app-configs/gitea_app.ini.j2

@@ -115,7 +115,7 @@ DEFAULT_TRUST_MODEL = committer
 JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_OAUTH2_JWT_SECRET'] }}
 
 [ui]
-THEMES = theme-catppuccin-blue-auto.css,theme-catppuccin-sapphire-auto.css,theme-catppuccin-yellow-auto.css,theme-catppuccin-maroon-auto.css,theme-catppuccin-mauve-auto.css,theme-catppuccin-peach-auto.css,theme-catppuccin-teal-auto.css,theme-catppuccin-flamingo-auto.css,theme-catppuccin-lavender-auto.css,theme-catppuccin-pink-auto.css,theme-catppuccin-red-auto.css,theme-catppuccin-rosewater-auto.css,theme-catppuccin-sky-auto.css,theme-catppuccin-green-auto.css
+THEMES =
 
 [actions]
 ENABLED = true

ansible/app-configs/homepage_services.yaml.j2

@@ -29,5 +29,5 @@
         widget:
             type: homeassistant
             url: http://192.168.1.252:8123
-            key: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI5MTFlMDZiMzNlODc0MWYyYjM3Mzg0NDhiMzMyNzMxYiIsImlhdCI6MTcxMzEzODc3MiwiZXhwIjoyMDI4NDk4NzcyfQ.CXFBjf0sJAGdMrRd_PTCkkzU3LsCgkckG8HvbdSYEhs
+            key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_HOME_ASSISTANT_API_KEY'] }}
 

ansible/app-configs/komodo_core.config.toml.j2

@@ -1,477 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-###########################
-# 🦎 KOMODO CORE CONFIG 🦎 #
-###########################
-
-## This is the offical "Default" config file for Komodo Core.
-## It serves as documentation for the meaning of the fields.
-## It is located at `https://github.com/mbecker20/komodo/blob/main/config/core.config.toml`.
-
-## All fields with a "Default" provided are optional. If they are
-## left out of the file, the "Default" value will be used.
-
-## This file is bundled into the official image, `ghcr.io/mbecker20/komodo`,
-## as the default config at `/config/config.toml`.
-## Komodo can start with no external config file mounted.
-
-## There is usually no need to create this file on your host.
-## Most fields can instead be configured using environment variables.
-## Environment variables will override values set in this file.
-
-## This will be the document title on the web page.
-## Env: KOMODO_TITLE
-## Default: 'Komodo'
-title = "Komodo @ Rinoa"
-
-## This should be the url used to access Komodo in browser, potentially behind DNS.
-## Eg https://komodo.example.com or http://12.34.56.78:9120. This should match the address configured in your Oauth app.
-## Env: KOMODO_HOST
-## Required, no default.
-host = "https://komodo.trez.wtf"
-
-## The port the core system will run on.
-## Env: KOMODO_PORT
-## Default: 9120
-port = 9120
-
-## This is the token used to authenticate core requests to periphery.
-## Ensure this matches a passkey in the connected periphery configs.
-## If the periphery servers don't have passkeys configured, this doesn't need to be changed.
-## Env: KOMODO_PASSKEY or KOMODO_PASSKEY_FILE
-## Required, no default
-passkey = "JgzFdZYbE7JfH5zhrh5pWUEQEWA4MCXG"
-
-## Ensure a server with this address exists on Core
-## upon first startup. Example: `https://periphery:8120`
-## Env: KOMODO_FIRST_SERVER
-## Optional, no default.
-first_server = ""
-
-## Disables write support on resources in the UI.
-## This protects users that that would normally have write priviledges during their UI usage,
-## when they intend to fully rely on ResourceSyncs to manage config.
-## Env: KOMODO_UI_WRITE_DISABLED
-## Default: false
-ui_write_disabled = false
-
-## Disables the confirm dialogs on all actions. All buttons will now be double-click.
-## Useful when only having http connection to core, as UI quick-copy button won't work.
-## Env: KOMODO_DISABLE_CONFIRM_DIALOG
-## Default: false
-disable_confirm_dialog = false
-
-## Configure the directory for sync files (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_SYNC_DIRECTORY
-## Default: /syncs
-sync_directory = "/syncs"
-
-## Configure the repo directory (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_REPO_DIRECTORY
-## Default: /repo-cache
-repo_directory = "/repo-cache"
-
-## Configure the action directory (inside the container).
-## There shouldn't be a need to change this, or even mount a volume.
-## Env: KOMODO_ACTION_DIRECTORY
-## Default: /action-cache
-action_directory = "/action-cache"
-
-################
-# AUTH / LOGIN #
-################
-
-## Allow user login with a username / password.
-## The password will be hashed and stored in the db for login comparison.
-##
-## NOTE:
-## Komodo has no API to recover account logins, but if this happens you can doctor the database using Mongo Compass.
-## Create a new Komodo user (Sign Up button), login to the database with Compass, note down your old users username and _id.
-## Then delete the old user, and update the new user to have the same username and _id. 
-## Make sure to set `enabled: true` and maybe `admin: true` on the new user as well, while using Compass.
-##
-## Env: KOMODO_LOCAL_AUTH
-## Default: false
-local_auth = true
-
-## Normally new users will be registered, but not enabled until an Admin enables them.
-## With `disable_user_registration = true`, only the first user to log in will registered as a user.
-## Env: KOMODO_DISABLE_USER_REGISTRATION
-## Default: false
-disable_user_registration = false
-
-## New users will be automatically enabled when they sign up.
-## Otherwise, new users will be disabled on first login.
-## The first user to login will always be enabled on creation.
-## Env: KOMODO_ENABLE_NEW_USERS
-## Default: false
-enable_new_users = false
-
-## Allows all users to have Read level access to all resources.
-## Env: KOMODO_TRANSPARENT_MODE
-## Default: false
-transparent_mode = false
-
-## Normally all enabled users can create resources.
-## If `disable_non_admin_create = true`, only admin users can create resources.
-## Env: KOMODO_DISABLE_NON_ADMIN_CREATE
-## Default: false
-disable_non_admin_create = false
-
-## Optionally provide a specific jwt secret.
-## Passing nothing or an empty string will cause one to be generated on every startup.
-## This means users will have to log in again if Komodo restarts.
-## Env: KOMODO_JWT_SECRET or KOMODO_JWT_SECRET_FILE
-## Default: empty string, meaning a random secret will be generated at startup.
-jwt_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_JWT_SECRET'] }}"
-
-## Specify how long a user can stay logged in before they have to log in again.
-## All jwts are invalidated on application restart unless `jwt_secret` is set.
-## Env: KOMODO_JWT_TTL
-## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk, 30-day
-## Default: 1-day. 
-jwt_ttl = "1-day"
-
-#############
-# OIDC Auth #
-#############
-
-## Enable logins with configured OIDC provider.
-## Env: KOMODO_OIDC_ENABLED
-## Default: false
-oidc_enabled = false
-
-## Give the provider address.
-##
-## The path, ie /application/o/komodo for Authentik,
-## is provider and configuration specific.
-##
-## Note. this address must be reachable from Komodo Core container.
-##
-## Env: KOMODO_OIDC_PROVIDER
-## Optional, no default.
-oidc_provider = "https://oidc.provider.internal/application/o/komodo"
-
-## Configure OIDC user redirect host.
-##
-## This is the host address users are redirected to in their browser,
-## and may be different from `oidc_provider` host depending on your networking.
-## If not provided (or empty string ""), the `oidc_provider` will be used.
-##
-## Note. DO NOT include the `path` part of the URL.
-## Example: `https://oidc.provider.external`
-##
-## Env: KOMODO_OIDC_REDIRECT_HOST
-## Optional, no default.
-oidc_redirect_host = ""
-
-## Give the OIDC Client ID.
-## Env: KOMODO_OIDC_CLIENT_ID or KOMODO_OIDC_CLIENT_ID_FILE
-oidc_client_id = ""
-
-## Give the OIDC Client Secret.
-## Env: KOMODO_OIDC_CLIENT_SECRET or KOMODO_OIDC_CLIENT_SECRET_FILE
-oidc_client_secret = ""
-
-## If true, use the full email for usernames.
-## Otherwise, the @address will be stripped,
-## making usernames more concise.
-## Env: KOMODO_OIDC_USE_FULL_EMAIL
-## Default: false.
-oidc_use_full_email = false
-
-## Some providers attach other audiences in addition to the client_id.
-## If you have this issue, `Invalid audiences: `...` is not a trusted audience"`,
-## you can add the audience `...` to the list here (assuming it should be trusted).
-## Env: KOMODO_OIDC_ADDITIONAL_AUDIENCES or KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE
-## Default: empty
-oidc_additional_audiences = []
-
-#########
-# OAUTH #
-#########
-
-## Google
-
-## Env: KOMODO_GOOGLE_OAUTH_ENABLED
-## Default: false
-google_oauth.enabled = false
-
-## Env: KOMODO_GOOGLE_OAUTH_ID or KOMODO_GOOGLE_OAUTH_ID_FILE
-## Required if google_oauth is enabled.
-google_oauth.id = ""
-
-## Env: KOMODO_GOOGLE_OAUTH_SECRET or KOMODO_GOOGLE_OAUTH_SECRET_FILE
-## Required if google_oauth is enabled.
-google_oauth.secret = ""
-
-## Github
-
-## Env: KOMODO_GITHUB_OAUTH_ENABLED
-## Default: false
-github_oauth.enabled = false
-
-## Env: KOMODO_GITHUB_OAUTH_ID or KOMODO_GITHUB_OAUTH_ID_FILE
-## Required if github_oauth is enabled.
-github_oauth.id = ""
-
-## Env: KOMODO_GITHUB_OAUTH_SECRET or KOMODO_GITHUB_OAUTH_SECRET_FILE
-## Required if github_oauth is enabled.
-github_oauth.secret = ""
-
-############
-# Security #
-############
-
-## Enable HTTPS server using the given key and cert.
-## Env: KOMODO_SSL_ENABLED
-## Default: false
-ssl_enabled = false
-
-## Path to the ssl key.
-## Env: KOMODO_SSL_KEY_FILE
-## Default: /config/ssl/key.pem
-ssl_key_file = "/config/ssl/key.pem"
-
-## Path to the ssl cert.
-## Env: KOMODO_SSL_CERT_FILE
-## Default: /config/ssl/cert.pem
-ssl_cert_file = "/config/ssl/cert.pem"
-
-############
-# DATABASE #
-############
-
-## Configure the database connection in one of the following ways:
-
-## Pass a full Mongo URI to the database.
-## Example: mongodb://username:password@localhost:27017
-## Env: KOMODO_DATABASE_URI or KOMODO_DATABASE_URI_FILE
-## Optional, can usually use `address`, `username`, `password` instead.
-database.uri = "mongodb://komodo:jtyl2U8KZPUe8V9MOTXQDYRlg7QemGuF@komodo-ferretdb:27017/komodo?authMechanism=PLAIN"
-
-## ==== * OR * ==== ##
-
-# Construct the address as mongodb://{username}:{password}@{address}
-## Env: KOMODO_DATABASE_ADDRESS
-# database.address = "localhost:27017"
-## Env: KOMODO_DATABASE_USERNAME or KOMODO_DATABASE_USERNAME_FILE
-# database.username = ""
-## Env: KOMODO_DATABASE_PASSWORD or KOMODO_DATABASE_PASSWORD_FILE
-# database.password = ""
-
-## ==== other ====
-
-## Komodo will create its collections under this database name.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_DB_NAME
-## Default: komodo.
-database.db_name = "komodo"
-
-## This is the assigned app_name of the mongo client.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_APP_NAME
-## Default: komodo_core.
-database.app_name = "komodo_core"
-
-############
-# WEBHOOKS #
-############
-
-## This token must be given to git provider during repo webhook config.
-## The secret configured on the git provider side must match the secret configured here.
-## If not provided, 
-## Env: KOMODO_WEBHOOK_SECRET or KOMODO_WEBHOOK_SECRET_FILE
-## Optional, no default.
-webhook_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_WEBHOOK_SECRET'] }}"
-
-## An alternate base url that is used to recieve git webhook requests.
-## If empty or not specified, will use 'host' address as base.
-## This is useful if Komodo is on an internal network, but can have a
-## proxy just allowing through the webhook listener api using NGINX.
-## Env: KOMODO_WEBHOOK_BASE_URL
-## Default: empty (none)
-webhook_base_url = ""
-
-## Configure Github webhook app. Enables webhook management apis.
-## <INSERT LINK TO GUIDE>
-## Env: KOMODO_GITHUB_WEBHOOK_APP_APP_ID or KOMODO_GITHUB_WEBHOOK_APP_APP_ID_FILE
-# github_webhook_app.app_id = 1234455 # Find on the app page.
-## Env: 
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS or KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS_FILE
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_NAMESPACES
-# github_webhook_app.installations = [
-#   ## Find the id after installing the app to user / organization. "namespace" is the username / organization name.
-#   { id = 1234, namespace = "mbecker20" }
-# ]
-
-## The path to Github webhook app private key. <INSERT LINK TO GUIDE>
-## This is defaulted to `/github/private-key.pem`, and doesn't need to be changed if running core in Docker.
-## Just mount the private key pem file on the host to `/github/private-key.pem` in the container.
-## Eg. `/your/path/to/key.pem : /github/private-key.pem`
-## Env: KOMODO_GITHUB_WEBHOOK_APP_PK_PATH
-# github_webhook_app.pk_path = "/path/to/pk.pem"
-
-###########
-# LOGGING #
-###########
-
-## Specify the logging verbosity
-## Env: KOMODO_LOGGING_LEVEL
-## Options: off, error, warn, info, debug, trace
-## Default: info
-logging.level = "info"
-
-## Specify the logging format for stdout / stderr.
-## Env: KOMODO_LOGGING_STDIO
-## Options: standard, json, none
-## Default: standard
-logging.stdio = "standard"
-
-## Optionally specify a opentelemetry otlp endpoint to send traces to.
-## Example: http://localhost:4317
-## Env: KOMODO_LOGGING_OTLP_ENDPOINT
-logging.otlp_endpoint = ""
-
-## Set the opentelemetry service name.
-## This will be attached to the telemetry Komodo will send.
-## Env: KOMODO_LOGGING_OPENTELEMETRY_SERVICE_NAME
-## Default: "Komodo"
-logging.opentelemetry_service_name = "Komodo"
-
-###########
-# PRUNING #
-###########
-
-## The number of days to keep historical system stats around, or 0 to disable pruning. 
-## Stats older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_STATS_FOR_DAYS
-## Default: 14
-keep_stats_for_days = 14
-
-## The number of days to keep alerts around, or 0 to disable pruning. 
-## Alerts older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_ALERTS_FOR_DAYS
-## Default: 14
-keep_alerts_for_days = 14
-
-##################
-# POLL INTERVALS #
-##################
-
-## Controls the rate at which servers are polled for health, system stats, and container status.
-## This affects network usage, and the size of the stats stored in mongo.
-## Env: KOMODO_MONITORING_INTERVAL
-## Options: 1-sec, 5-sec, 15-sec, 30-sec, 1-min, 2-min, 5-min, 15-min
-## Default: 15-sec
-monitoring_interval = "15-sec"
-
-## Interval at which to poll Resources for any updates / automated actions.
-## Env: KOMODO_RESOURCE_POLL_INTERVAL
-## Options: `15-sec`, `1-min`, `5-min`, `15-min`, `1-hr`.
-## Default: 5-min
-resource_poll_interval = "5-min"
-
-###################
-# CLOUD PROVIDERS #
-###################
-
-## Komodo can build images by deploying AWS EC2 instances,
-## running the build, and afterwards destroying the instance.
-
-## Additionally, Komodo can deploy cloud VPS on AWS EC2 and Hetzner.
-## Use the Template resource to configure launch preferences.
-## Hetzner is not supported for builds as their pricing model is by the hour,
-## while AWS is by the minute. This is very important for builds.
-
-## Provide AWS api keys for ephemeral builders / server launch
-## Env: KOMODO_AWS_ACCESS_KEY_ID or KOMODO_AWS_ACCESS_KEY_ID_FILE
-aws.access_key_id = ""
-## Env: KOMODO_AWS_SECRET_ACCESS_KEY or KOMODO_AWS_SECRET_ACCESS_KEY_FILE
-aws.secret_access_key = ""
-
-## Provide Hetzner api token for server launch
-## Env: KOMODO_HETZNER_TOKEN or KOMODO_HETZNER_TOKEN_FILE
-hetzner.token = ""
-
-#################
-# GIT PROVIDERS #
-#################
-
-## These will be available to attach to Builds, Repos, Stacks, and Syncs.
-## They allow these Resources to clone private repositories.
-## They cannot be configured on the environment.
-
-## configure git providers
-# [[git_provider]]
-# domain = "github.com"
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# 	{ username = "moghtech", token = "access_token_for_other_account" },
-# ]
-
-# [[git_provider]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-# [[git_provider]]
-# domain = "localhost:8000" # use a custom provider, like self-hosted gitea
-# https = false # use http://localhost:8000 as base-url for clone
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-######################
-# REGISTRY PROVIDERS #
-######################
-
-## These will be available to attach to Builds and Stacks.
-## They allow these Resources to pull private images.
-## They cannot be configured on the environment.
-
-## configure docker registries
-# [[docker_registry]]
-# domain = "docker.io"
-# accounts = [
-# 	{ username = "mbecker2020", token = "access_token_for_account" }
-# ]
-# organizations = ["DockerhubOrganization"]
-
-[[gitea_rinoa]]
-domain = "git.trez.wtf"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-[[gitea_rinoa_local]]
-domain = "http://gitea:3000"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-# [[docker_registry]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-# organizations = ["Mogh"] # These become available in the UI
-
-###########
-# SECRETS #
-###########
-
-## Provide Core based secrets.
-## These will be available to interpolate into your Deployment / Stack environments,
-## and will be hidden in the UI and logs.
-## These are available to use on any Periphery (Server),
-## but you can also limit access more by placing them in a single Periphery's config file instead.
-## These cannot be configured in the Komodo Core environment, they must be passed in the file.
-
-# [secrets]
-# SECRET_1 = "value_1"
-# SECRET_2 = "value_2"

ansible/app-configs/netbird_management.json.j2

@@ -0,0 +1,106 @@
+{
+  "Stuns": [
+    {
+      "Proto": "udp",
+      "URI": "stun:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
+      "Username": "",
+      "Password": null
+    }
+  ],
+  "TURNConfig": {
+    "Turns": [
+      {
+        "Proto": "udp",
+        "URI": "turn:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
+        "Username": "self",
+        "Password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}"
+      }
+    ],
+    "CredentialsTTL": "12h",
+    "Secret": "secret",
+    "TimeBasedCredentials": false
+  },
+  "Relay": {
+    "Addresses": [
+      "rel://netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:33080"
+    ],
+    "CredentialsTTL": "24h",
+    "Secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_RELAY_AUTH_SECRET'] }}"
+  },
+  "Signal": {
+    "Proto": "https",
+    "URI": "netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:10001",
+    "Username": "",
+    "Password": null
+  },
+  "ReverseProxy": {
+    "TrustedHTTPProxies": [],
+    "TrustedHTTPProxiesCount": 0,
+    "TrustedPeers": [
+      "0.0.0.0/0"
+    ]
+  },
+  "Datadir": "",
+  "DataStoreEncryptionKey": "",
+  "StoreConfig": {
+    "Engine": "sqlite"
+  },
+  "HttpConfig": {
+    "Address": "0.0.0.0:33073",
+    "AuthIssuer": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
+    "AuthAudience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+    "AuthKeysLocation": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/keys",
+    "AuthUserIDClaim": "",
+    "CertFile": "",
+    "CertKey": "",
+    "IdpSignKeyRefreshEnabled": true,
+    "OIDCConfigEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/.well-known/openid-configuration"
+  },
+  "IdpManagerConfig": {
+    "ManagerType": "zitadel",
+    "ClientConfig": {
+      "Issuer": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
+      "TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
+      "ClientID": "netbird",
+      "ClientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_SECRET'] }}",
+      "GrantType": "client_credentials"
+    },
+    "ExtraConfig": {
+      "ManagementEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/management/v1"
+    },
+    "Auth0ClientCredentials": null,
+    "AzureClientCredentials": null,
+    "KeycloakClientCredentials": null,
+    "ZitadelClientCredentials": null
+  },
+  "DeviceAuthorizationFlow": {
+    "Provider": "hosted",
+    "ProviderConfig": {
+      "Audience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "AuthorizationEndpoint": "",
+      "Domain": "",
+      "ClientID": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "ClientSecret": "",
+      "TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
+      "DeviceAuthEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/device_authorization",
+      "Scope": "openid",
+      "UseIDToken": false,
+      "RedirectURLs": null
+    }
+  },
+  "PKCEAuthorizationFlow": {
+    "ProviderConfig": {
+      "Audience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "ClientID": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "ClientSecret": "",
+      "Domain": "",
+      "AuthorizationEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/authorize",
+      "TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
+      "Scope": "openid profile email offline_access api",
+      "RedirectURLs": [
+        "http://localhost:53000"
+      ],
+      "UseIDToken": false
+    }
+  }
+}

ansible/app-configs/netbird_openid-configuration.json.j2

@@ -0,0 +1,122 @@
+{
+    "issuer": "https://id.trez.wtf",
+    "authorization_endpoint": "https://id.trez.wtf/oauth/v2/authorize",
+    "token_endpoint": "https://id.trez.wtf/oauth/v2/token",
+    "introspection_endpoint": "https://id.trez.wtf/oauth/v2/introspect",
+    "userinfo_endpoint": "https://id.trez.wtf/oidc/v1/userinfo",
+    "revocation_endpoint": "https://id.trez.wtf/oauth/v2/revoke",
+    "end_session_endpoint": "https://id.trez.wtf/oidc/v1/end_session",
+    "device_authorization_endpoint": "https://id.trez.wtf/oauth/v2/device_authorization",
+    "jwks_uri": "https://id.trez.wtf/oauth/v2/keys",
+    "scopes_supported": [
+        "openid",
+        "profile",
+        "email",
+        "phone",
+        "address",
+        "offline_access"
+    ],
+    "response_types_supported": [
+        "code",
+        "id_token",
+        "id_token token"
+    ],
+    "response_modes_supported": [
+        "query",
+        "fragment",
+        "form_post"
+    ],
+    "grant_types_supported": [
+        "authorization_code",
+        "implicit",
+        "refresh_token",
+        "client_credentials",
+        "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "urn:ietf:params:oauth:grant-type:device_code"
+    ],
+    "subject_types_supported": [
+        "public"
+    ],
+    "id_token_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "request_object_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "token_endpoint_auth_methods_supported": [
+        "none",
+        "client_secret_basic",
+        "client_secret_post",
+        "private_key_jwt"
+    ],
+    "token_endpoint_auth_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "revocation_endpoint_auth_methods_supported": [
+        "none",
+        "client_secret_basic",
+        "client_secret_post",
+        "private_key_jwt"
+    ],
+    "revocation_endpoint_auth_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "introspection_endpoint_auth_methods_supported": [
+        "client_secret_basic",
+        "private_key_jwt"
+    ],
+    "introspection_endpoint_auth_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "claims_supported": [
+        "sub",
+        "aud",
+        "exp",
+        "iat",
+        "iss",
+        "auth_time",
+        "nonce",
+        "acr",
+        "amr",
+        "c_hash",
+        "at_hash",
+        "act",
+        "scopes",
+        "client_id",
+        "azp",
+        "preferred_username",
+        "name",
+        "family_name",
+        "given_name",
+        "locale",
+        "email",
+        "email_verified",
+        "phone_number",
+        "phone_number_verified"
+    ],
+    "code_challenge_methods_supported": [
+        "S256"
+    ],
+    "ui_locales_supported": [
+        "bg",
+        "cs",
+        "de",
+        "en",
+        "es",
+        "fr",
+        "hu",
+        "id",
+        "it",
+        "ja",
+        "ko",
+        "mk",
+        "nl",
+        "pl",
+        "pt",
+        "ru",
+        "sv",
+        "zh"
+    ],
+    "request_parameter_supported": true,
+    "request_uri_parameter_supported": false
+}

ansible/app-configs/netbird_turnserver.conf.j2

@@ -0,0 +1,725 @@
+# Coturn TURN SERVER configuration file
+#
+# Boolean values note: where a boolean value is supposed to be used,
+# you can use '0', 'off', 'no', 'false', or 'f' as 'false,
+# and you can use '1', 'on', 'yes', 'true', or 't' as 'true'
+# If the value is missing, then it means 'true' by default.
+#
+
+# Listener interface device (optional, Linux only).
+# NOT RECOMMENDED.
+#
+#listening-device=eth0
+
+# TURN listener port for UDP and TCP (Default: 3478).
+# Note: actually, TLS & DTLS sessions can connect to the
+# "plain" TCP & UDP port(s), too - if allowed by configuration.
+#
+listening-port=3478
+
+# TURN listener port for TLS (Default: 5349).
+# Note: actually, "plain" TCP & UDP sessions can connect to the TLS & DTLS
+# port(s), too - if allowed by configuration. The TURN server
+# "automatically" recognizes the type of traffic. Actually, two listening
+# endpoints (the "plain" one and the "tls" one) are equivalent in terms of
+# functionality; but Coturn keeps both endpoints to satisfy the RFC 5766 specs.
+# For secure TCP connections, Coturn currently supports SSL version 3 and
+# TLS version 1.0, 1.1 and 1.2.
+# For secure UDP connections, Coturn supports DTLS version 1.
+#
+tls-listening-port=5349
+
+# Alternative listening port for UDP and TCP listeners;
+# default (or zero) value means "listening port plus one".
+# This is needed for RFC 5780 support
+# (STUN extension specs, NAT behavior discovery). The TURN Server
+# supports RFC 5780 only if it is started with more than one
+# listening IP address of the same family (IPv4 or IPv6).
+# RFC 5780 is supported only by UDP protocol, other protocols
+# are listening to that endpoint only for "symmetry".
+#
+#alt-listening-port=0
+
+# Alternative listening port for TLS and DTLS protocols.
+# Default (or zero) value means "TLS listening port plus one".
+#
+#alt-tls-listening-port=0
+
+# Some network setups will require using a TCP reverse proxy in front
+# of the STUN server. If the proxy port option is set a single listener
+# is started on the given port that accepts connections using the
+# haproxy proxy protocol v2.
+# (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
+#
+#tcp-proxy-port=5555
+
+# Listener IP address of relay server. Multiple listeners can be specified.
+# If no IP(s) specified in the config file or in the command line options,
+# then all IPv4 and IPv6 system IPs will be used for listening.
+#
+#listening-ip=172.17.19.101
+#listening-ip=10.207.21.238
+#listening-ip=2607:f0d0:1002:51::4
+
+# Auxiliary STUN/TURN server listening endpoint.
+# Aux servers have almost full TURN and STUN functionality.
+# The (minor) limitations are:
+#
+# 1) Auxiliary servers do not have alternative ports and
+# they do not support STUN RFC 5780 functionality (CHANGE REQUEST).
+#
+# 2) Auxiliary servers also are never returning ALTERNATIVE-SERVER reply.
+#
+# Valid formats are 1.2.3.4:5555 for IPv4 and [1:2::3:4]:5555 for IPv6.
+#
+# There may be multiple aux-server options, each will be used for listening
+# to client requests.
+#
+#aux-server=172.17.19.110:33478
+#aux-server=[2607:f0d0:1002:51::4]:33478
+
+# (recommended for older Linuxes only)
+# Automatically balance UDP traffic over auxiliary servers (if configured).
+# The load balancing is using the ALTERNATE-SERVER mechanism.
+# The TURN client must support 300 ALTERNATE-SERVER response for this
+# functionality.
+#
+#udp-self-balance
+
+# Relay interface device for relay sockets (optional, Linux only).
+# NOT RECOMMENDED.
+#
+#relay-device=eth1
+
+# Relay address (the local IP address that will be used to relay the
+# packets to the peer).
+# Multiple relay addresses may be used.
+# The same IP(s) can be used as both listening IP(s) and relay IP(s).
+#
+# If no relay IP(s) specified, then the turnserver will apply the default
+# policy: it will decide itself which relay addresses to be used, and it
+# will always be using the client socket IP address as the relay IP address
+# of the TURN session (if the requested relay address family is the same
+# as the family of the client socket).
+#
+#relay-ip=172.17.19.105
+#relay-ip=2607:f0d0:1002:51::5
+
+# For Amazon EC2 users:
+#
+# TURN Server public/private address mapping, if the server is behind NAT.
+# In that situation, if a -X is used in form "-X <ip>" then that ip will be reported
+# as relay IP address of all allocations. This scenario works only in a simple case
+# when one single relay address is be used, and no RFC5780 functionality is required.
+# That single relay address must be mapped by NAT to the 'external' IP.
+# The "external-ip" value, if not empty, is returned in XOR-RELAYED-ADDRESS field.
+# For that 'external' IP, NAT must forward ports directly (relayed port 12345
+# must be always mapped to the same 'external' port 12345).
+#
+# In more complex case when more than one IP address is involved,
+# that option must be used several times, each entry must
+# have form "-X <public-ip/private-ip>", to map all involved addresses.
+# RFC5780 NAT discovery STUN functionality will work correctly,
+# if the addresses are mapped properly, even when the TURN server itself
+# is behind A NAT.
+#
+# By default, this value is empty, and no address mapping is used.
+#
+# external-ip=193.224.22.37
+#
+#OR:
+#
+#external-ip=60.70.80.91/172.17.19.101
+#external-ip=60.70.80.92/172.17.19.102
+
+external-ip=108.29.206.17
+
+# Number of the relay threads to handle the established connections
+# (in addition to authentication thread and the listener thread).
+# If explicitly set to 0 then application runs relay process in a
+# single thread, in the same thread with the listener process
+# (the authentication thread will still be a separate thread).
+#
+# If this parameter is not set, then the default OS-dependent
+# thread pattern algorithm will be employed. Usually the default
+# algorithm is optimal, so you have to change this option
+# if you want to make some fine tweaks.
+#
+# In the older systems (Linux kernel before 3.9),
+# the number of UDP threads is always one thread per network listening
+# endpoint - including the auxiliary endpoints - unless 0 (zero) or
+# 1 (one) value is set.
+#
+#relay-threads=0
+
+# Lower and upper bounds of the UDP relay endpoints:
+# (default values are 49152 and 65535)
+#
+min-port=49152
+max-port=65535
+
+# Uncomment to run TURN server in 'normal' 'moderate' verbose mode.
+# By default the verbose mode is off.
+#verbose
+
+# Uncomment to run TURN server in 'extra' verbose mode.
+# This mode is very annoying and produces lots of output.
+# Not recommended under normal circumstances.
+#
+#Verbose
+
+# Uncomment to use fingerprints in the TURN messages.
+# By default the fingerprints are off.
+#
+fingerprint
+
+# Uncomment to use long-term credential mechanism.
+# By default no credentials mechanism is used (any user allowed).
+#
+lt-cred-mech
+
+# This option is the opposite of lt-cred-mech.
+# (TURN Server with no-auth option allows anonymous access).
+# If neither option is defined, and no users are defined,
+# then no-auth is default. If at least one user is defined,
+# in this file, in command line or in usersdb file, then
+# lt-cred-mech is default.
+#
+#no-auth
+
+# TURN REST API flag.
+# (Time Limited Long Term Credential)
+# Flag that sets a special authorization option that is based upon authentication secret.
+#
+# This feature's purpose is to support "TURN Server REST API", see
+# "TURN REST API" link in the project's page
+# https://github.com/coturn/coturn/
+#
+# This option is used with timestamp:
+#
+# usercombo -> "timestamp:userid"
+# turn user -> usercombo
+# turn password -> base64(hmac(secret key, usercombo))
+#
+# This allows TURN credentials to be accounted for a specific user id.
+# If you don't have a suitable id, then the timestamp alone can be used.
+# This option is enabled by turning on secret-based authentication.
+# The actual value of the secret is defined either by the option static-auth-secret,
+# or can be found in the turn_secret table in the database (see below).
+#
+# Read more about it:
+#  - https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00
+#  - https://www.ietf.org/proceedings/87/slides/slides-87-behave-10.pdf
+#
+# Be aware that use-auth-secret overrides some parts of lt-cred-mech.
+# The use-auth-secret feature depends internally on lt-cred-mech, so if you set
+# this option then it automatically enables lt-cred-mech internally
+# as if you had enabled both.
+#
+# Note that you can use only one auth mechanism at the same time! This is because,
+# both mechanisms conduct username and password validation in different ways.
+#
+# Use either lt-cred-mech or use-auth-secret in the conf
+# to avoid any confusion.
+#
+#use-auth-secret
+
+# 'Static' authentication secret value (a string) for TURN REST API only.
+# If not set, then the turn server
+# will try to use the 'dynamic' value in the turn_secret table
+# in the user database (if present). The database-stored  value can be changed on-the-fly
+# by a separate program, so this is why that mode is considered 'dynamic'.
+#
+#static-auth-secret=north
+
+# Server name used for
+# the oAuth authentication purposes.
+# The default value is the realm name.
+#
+# server-name=stun.wiretrustee.com
+
+# Flag that allows oAuth authentication.
+#
+#oauth
+
+# 'Static' user accounts for the long term credentials mechanism, only.
+# This option cannot be used with TURN REST API.
+# 'Static' user accounts are NOT dynamically checked by the turnserver process,
+# so they can NOT be changed while the turnserver is running.
+#
+#user=username1:key1
+#user=username2:key2
+# OR:
+user=self:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}
+#user=username2:password2
+#
+# Keys must be generated by turnadmin utility. The key value depends
+# on user name, realm, and password:
+#
+# Example:
+# $ turnadmin -k -u ninefingers -r north.gov -p youhavetoberealistic
+# Output: 0xbc807ee29df3c9ffa736523fb2c4e8ee
+# ('0x' in the beginning of the key is what differentiates the key from
+# password. If it has 0x then it is a key, otherwise it is a password).
+#
+# The corresponding user account entry in the config file will be:
+#
+#user=ninefingers:0xbc807ee29df3c9ffa736523fb2c4e8ee
+# Or, equivalently, with open clear password (less secure):
+#user=ninefingers:youhavetoberealistic
+#
+
+# SQLite database file name.
+#
+# The default file name is /var/db/turndb or /usr/local/var/db/turndb or
+# /var/lib/turn/turndb.
+#
+#userdb=/var/db/turndb
+
+# PostgreSQL database connection string in the case that you are using PostgreSQL
+# as the user database.
+# This database can be used for the long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+# See http://www.postgresql.org/docs/8.4/static/libpq-connect.html for 8.x PostgreSQL
+# versions connection string format, see
+# http://www.postgresql.org/docs/9.2/static/libpq-connect.html#LIBPQ-CONNSTRING
+# for 9.x and newer connection string formats.
+#
+#psql-userdb="host=<host> dbname=<database-name> user=<database-user> password=<database-user-password> connect_timeout=30"
+
+# MySQL database connection string in the case that you are using MySQL
+# as the user database.
+# This database can be used for the long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+#
+# Optional connection string parameters for the secure communications (SSL):
+# ca, capath, cert, key, cipher
+# (see http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html for the
+# command options description).
+#
+# Use the string format below (space separated parameters, all optional):
+#
+# mysql-userdb="host=mysql dbname=coturn user=coturn password=CHANGE_ME port=3306 connect_timeout=10 read_timeout=10"
+
+# If you want to use an encrypted password in the MySQL connection string,
+# then set the MySQL password encryption secret key file with this option.
+#
+# Warning: If this option is set, then the mysql password must be set in "mysql-userdb" in an encrypted format!
+# If you want to use a cleartext password then do not set this option!
+#
+# This is the file path for the aes encrypted secret key used for password encryption.
+#
+#secret-key-file=/path/
+
+# MongoDB database connection string in the case that you are using MongoDB
+# as the user database.
+# This database can be used for long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+# Use the string format described at http://hergert.me/docs/mongo-c-driver/mongoc_uri.html
+#
+#mongo-userdb="mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][/[database][?options]]"
+
+# Redis database connection string in the case that you are using Redis
+# as the user database.
+# This database can be used for long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+# Use the string format below (space separated parameters, all optional):
+#
+#redis-userdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
+
+# Redis status and statistics database connection string, if used (default - empty, no Redis stats DB used).
+# This database keeps allocations status information, and it can be also used for publishing
+# and delivering traffic and allocation event notifications.
+# The connection string has the same parameters as redis-userdb connection string.
+# Use the string format below (space separated parameters, all optional):
+#
+#redis-statsdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
+
+# The default realm to be used for the users when no explicit
+# origin/realm relationship is found in the database, or if the TURN
+# server is not using any database (just the commands-line settings
+# and the userdb file). Must be used with long-term credentials
+# mechanism or with TURN REST API.
+#
+# Note: If the default realm is not specified, then realm falls back to the host domain name.
+#       If the domain name string is empty, or set to '(None)', then it is initialized as an empty string.
+#
+# realm=wiretrustee.com
+# This flag sets the origin consistency
+# check. Across the session, all requests must have the same
+# main ORIGIN attribute value (if the ORIGIN was
+# initially used by the session).
+#
+#check-origin-consistency
+
+# Per-user allocation quota.
+# default value is 0 (no quota, unlimited number of sessions per user).
+# This option can also be set through the database, for a particular realm.
+#
+#user-quota=0
+
+# Total allocation quota.
+# default value is 0 (no quota).
+# This option can also be set through the database, for a particular realm.
+#
+#total-quota=0
+
+# Max bytes-per-second bandwidth a TURN session is allowed to handle
+# (input and output network streams are treated separately). Anything above
+# that limit will be dropped or temporarily suppressed (within
+# the available buffer limits).
+# This option can also be set through the database, for a particular realm.
+#
+#max-bps=0
+
+#
+# Maximum server capacity.
+# Total bytes-per-second bandwidth the TURN server is allowed to allocate
+# for the sessions, combined (input and output network streams are treated separately).
+#
+# bps-capacity=0
+
+# Uncomment if no UDP client listener is desired.
+# By default UDP client listener is always started.
+#
+#no-udp
+
+# Uncomment if no TCP client listener is desired.
+# By default TCP client listener is always started.
+#
+#no-tcp
+
+# Uncomment if no TLS client listener is desired.
+# By default TLS client listener is always started.
+#
+#no-tls
+
+# Uncomment if no DTLS client listener is desired.
+# By default DTLS client listener is always started.
+#
+#no-dtls
+
+# Uncomment if no UDP relay endpoints are allowed.
+# By default UDP relay endpoints are enabled (like in RFC 5766).
+#
+#no-udp-relay
+
+# Uncomment if no TCP relay endpoints are allowed.
+# By default TCP relay endpoints are enabled (like in RFC 6062).
+#
+#no-tcp-relay
+
+# Uncomment if extra security is desired,
+# with nonce value having a limited lifetime.
+# The nonce value is unique for a session.
+# Set this option to limit the nonce lifetime.
+# Set it to 0 for unlimited lifetime.
+# It defaults to 600 secs (10 min) if no value is provided. After that delay,
+# the client will get 438 error and will have to re-authenticate itself.
+#
+#stale-nonce=600
+
+# Uncomment if you want to set the maximum allocation
+# time before it has to be refreshed.
+# Default is 3600s.
+#
+#max-allocate-lifetime=3600
+
+
+# Uncomment to set the lifetime for the channel.
+# Default value is 600 secs (10 minutes).
+# This value MUST not be changed for production purposes.
+#
+#channel-lifetime=600
+
+# Uncomment to set the permission lifetime.
+# Default to 300 secs (5 minutes).
+# In production this value MUST not be changed,
+# however it can be useful for test purposes.
+#
+#permission-lifetime=300
+
+# Certificate file.
+# Use an absolute path or path relative to the
+# configuration file.
+# Use PEM file format.
+#
+cert=/etc/coturn/certs/cert.pem
+
+# Private key file.
+# Use an absolute path or path relative to the
+# configuration file.
+# Use PEM file format.
+#
+pkey=/etc/coturn/private/privkey.pem
+
+# Private key file password, if it is in encoded format.
+# This option has no default value.
+#
+#pkey-pwd=...
+
+# Allowed OpenSSL cipher list for TLS/DTLS connections.
+# Default value is "DEFAULT".
+#
+#cipher-list="DEFAULT"
+
+# CA file in OpenSSL format.
+# Forces TURN server to verify the client SSL certificates.
+# By default this is not set: there is no default value and the client
+# certificate is not checked.
+#
+# Example:
+#CA-file=/etc/ssh/id_rsa.cert
+
+# Curve name for EC ciphers, if supported by OpenSSL
+# library (TLS and DTLS). The default value is prime256v1,
+# if pre-OpenSSL 1.0.2 is used. With OpenSSL 1.0.2+,
+# an optimal curve will be automatically calculated, if not defined
+# by this option.
+#
+#ec-curve-name=prime256v1
+
+# Use 566 bits predefined DH TLS key. Default size of the key is 2066.
+#
+#dh566
+
+# Use 1066 bits predefined DH TLS key. Default size of the key is 2066.
+#
+#dh1066
+
+# Use custom DH TLS key, stored in PEM format in the file.
+# Flags --dh566 and --dh2066 are ignored when the DH key is taken from a file.
+#
+#dh-file=<DH-PEM-file-name>
+
+# Flag to prevent stdout log messages.
+# By default, all log messages go to both stdout and to
+# the configured log file. With this option everything will
+# go to the configured log only (unless the log file itself is stdout).
+#
+#no-stdout-log
+
+# Option to set the log file name.
+# By default, the turnserver tries to open a log file in
+# /var/log, /var/tmp, /tmp and the current directory
+# (Whichever file open operation succeeds first will be used).
+# With this option you can set the definite log file name.
+# The special names are "stdout" and "-" - they will force everything
+# to the stdout. Also, the "syslog" name will force everything to
+# the system log (syslog).
+# In the runtime, the logfile can be reset with the SIGHUP signal
+# to the turnserver process.
+#
+log-file=stdout
+
+# Option to redirect all log output into system log (syslog).
+#
+# syslog
+
+# This flag means that no log file rollover will be used, and the log file
+# name will be constructed as-is, without PID and date appendage.
+# This option can be used, for example, together with the logrotate tool.
+#
+#simple-log
+
+# Option to set the "redirection" mode. The value of this option
+# will be the address of the alternate server for UDP & TCP service in the form of
+# <ip>[:<port>]. The server will send this value in the attribute
+# ALTERNATE-SERVER, with error 300, on ALLOCATE request, to the client.
+# Client will receive only values with the same address family
+# as the client network endpoint address family.
+# See RFC 5389 and RFC 5766 for the description of ALTERNATE-SERVER functionality.
+# The client must use the obtained value for subsequent TURN communications.
+# If more than one --alternate-server option is provided, then the functionality
+# can be more accurately described as "load-balancing" than a mere "redirection".
+# If the port number is omitted, then the default port
+# number 3478 for the UDP/TCP protocols will be used.
+# Colon (:) characters in IPv6 addresses may conflict with the syntax of
+# the option. To alleviate this conflict, literal IPv6 addresses are enclosed
+# in square brackets in such resource identifiers, for example:
+# [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 .
+# Multiple alternate servers can be set. They will be used in the
+# round-robin manner. All servers in the pool are considered of equal weight and
+# the load will be distributed equally. For example, if you have 4 alternate servers,
+# then each server will receive 25% of ALLOCATE requests. A alternate TURN server
+# address can be used more than one time with the alternate-server option, so this
+# can emulate "weighting" of the servers.
+#
+# Examples:
+#alternate-server=1.2.3.4:5678
+#alternate-server=11.22.33.44:56789
+#alternate-server=5.6.7.8
+#alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
+
+# Option to set alternative server for TLS & DTLS services in form of
+# <ip>:<port>. If the port number is omitted, then the default port
+# number 5349 for the TLS/DTLS protocols will be used. See the previous
+# option for the functionality description.
+#
+# Examples:
+#tls-alternate-server=1.2.3.4:5678
+#tls-alternate-server=11.22.33.44:56789
+#tls-alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
+
+# Option to suppress TURN functionality, only STUN requests will be processed.
+# Run as STUN server only, all TURN requests will be ignored.
+# By default, this option is NOT set.
+#
+#stun-only
+
+# Option to hide software version. Enhance security when used in production.
+# Revealing the specific software version of the agent through the
+# SOFTWARE attribute might allow them to become more vulnerable to
+# attacks against software that is known to contain security holes.
+# Implementers SHOULD make usage of the SOFTWARE attribute a
+# configurable option (https://tools.ietf.org/html/rfc5389#section-16.1.2)
+#
+no-software-attribute
+
+# Option to suppress STUN functionality, only TURN requests will be processed.
+# Run as TURN server only, all STUN requests will be ignored.
+# By default, this option is NOT set.
+#
+#no-stun
+
+# This is the timestamp/username separator symbol (character) in TURN REST API.
+# The default value is ':'.
+# rest-api-separator=:
+
+# Flag that can be used to allow peers on the loopback addresses (127.x.x.x and ::1).
+# This is an extra security measure.
+#
+# (To avoid any security issue that allowing loopback access may raise,
+# the no-loopback-peers option is replaced by allow-loopback-peers.)
+#
+# Allow it only for testing in a development environment!
+# In production it adds a possible security vulnerability, so for security reasons
+# it is not allowed using it together with empty cli-password.
+#
+#allow-loopback-peers
+
+# Flag that can be used to disallow peers on well-known broadcast addresses (224.0.0.0 and above, and FFXX:*).
+# This is an extra security measure.
+#
+#no-multicast-peers
+
+# Option to set the max time, in seconds, allowed for full allocation establishment.
+# Default is 60 seconds.
+#
+#max-allocate-timeout=60
+
+# Option to allow or ban specific ip addresses or ranges of ip addresses.
+# If an ip address is specified as both allowed and denied, then the ip address is
+# considered to be allowed. This is useful when you wish to ban a range of ip
+# addresses, except for a few specific ips within that range.
+#
+# This can be used when you do not want users of the turn server to be able to access
+# machines reachable by the turn server, but would otherwise be unreachable from the
+# internet (e.g. when the turn server is sitting behind a NAT)
+#
+# Examples:
+# denied-peer-ip=83.166.64.0-83.166.95.255
+# allowed-peer-ip=83.166.68.45
+
+# File name to store the pid of the process.
+# Default is /var/run/turnserver.pid (if superuser account is used) or
+# /var/tmp/turnserver.pid .
+#
+pidfile="/var/tmp/turnserver.pid"
+
+# Require authentication of the STUN Binding request.
+# By default, the clients are allowed anonymous access to the STUN Binding functionality.
+#
+#secure-stun
+
+# Mobility with ICE (MICE) specs support.
+#
+#mobility
+
+# Allocate Address Family according
+# If enabled then TURN server allocates address family according  the TURN
+# Client <=> Server communication address family.
+# (By default Coturn works according RFC 6156.)
+# !!Warning: Enabling this option breaks RFC6156 section-4.2 (violates use default IPv4)!!
+#
+#keep-address-family
+
+
+# User name to run the process. After the initialization, the turnserver process
+# will attempt to change the current user ID to that user.
+#
+#proc-user=<user-name>
+
+# Group name to run the process. After the initialization, the turnserver process
+# will attempt to change the current group ID to that group.
+#
+#proc-group=<group-name>
+
+# Turn OFF the CLI support.
+# By default it is always ON.
+# See also options cli-ip and cli-port.
+#
+no-cli
+
+#Local system IP address to be used for CLI server endpoint. Default value
+# is 127.0.0.1.
+#
+# cli-ip=127.0.0.1
+
+# CLI server port. Default is 5766.
+#
+# cli-port=5766
+
+# CLI access password. Default is empty (no password).
+# For the security reasons, it is recommended that you use the encrypted
+# form of the password (see the -P command in the turnadmin utility).
+#
+# Secure form for password 'qwerty':
+#
+#cli-password=$5$79a316b350311570$81df9cfb9af7f5e5a76eada31e7097b663a0670f99a3c07ded3f1c8e59c5658a
+#
+# Or insecure form for the same password:
+#
+# cli-password=CHANGE_ME
+
+# Enable Web-admin support on https. By default it is Disabled.
+# If it is enabled it also enables a http a simple static banner page
+# with a small reminder that the admin page is available only on https.
+#
+#web-admin
+
+# Local system IP address to be used for Web-admin server endpoint. Default value is 127.0.0.1.
+#
+#web-admin-ip=127.0.0.1
+
+# Web-admin server port. Default is 8080.
+#
+#web-admin-port=8080
+
+# Web-admin server listen on STUN/TURN worker threads
+# By default it is disabled for security reasons! (Not recommended in any production environment!)
+#
+#web-admin-listen-on-workers
+
+# Server relay. NON-STANDARD AND DANGEROUS OPTION.
+# Only for those applications when you want to run
+# server applications on the relay endpoints.
+# This option eliminates the IP permissions check on
+# the packets incoming to the relay endpoints.
+#
+#server-relay
+
+# Maximum number of output sessions in ps CLI command.
+# This value can be changed on-the-fly in CLI. The default value is 256.
+#
+#cli-max-output-sessions
+
+# Set network engine type for the process (for internal purposes).
+#
+#ne=[1|2|3]
+
+# Do not allow an TLS/DTLS version of protocol
+#
+#no-tlsv1
+#no-tlsv1_1
+#no-tlsv1_2

ansible/app-configs/sourcebot_config.json.j2

@@ -0,0 +1,19 @@
+{% set vault_addr = 'https://vault.trez.wtf' %}
+{% set secrets_path = 'rinoa-docker/env' %}
+
+{
+  "$schema": "../schemas/v2/index.json",
+  "repos": [
+      {
+          "type": "gitea",
+          "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}",
+          "url": "https://git.trez.wtf",
+          "revisions": {
+              "branches": [
+                  "main",
+                  "*"
+              ]
+          }
+      }
+  ]
+}