Adding more notifications to pipeline; YAML format fixing for environments key.

.
Adding login for DbGate.
2025-01-23 15:53:49 -05:00 · 2025-01-23 14:38:09 -05:00 · 2025-01-23 14:21:42 -05:00 · 2025-01-23 13:16:56 -05:00 · 2025-01-23 18:16:17 +00:00 · 2025-01-23 12:52:56 -05:00
11 changed files with 1467 additions and 597 deletions
@@ -4,7 +4,9 @@ on:
    branches-ignore:
      - main
    paths:
+      - '**.yaml'
      - '**.yml'
+      - '**.j2'
 jobs:
  check-and-create-pr:
    name: Check and Create PR
@@ -77,6 +79,13 @@ jobs:
            --check
          requirements: collections/requirements.yml
          vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
+          notification_message: 'Ansible dry run completed successfully.'
      - name: Generate .env file for Docker Compose Dry Run
        run: |
          vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
@@ -95,6 +104,13 @@ jobs:
          up-opts: --dry-run -d --remove-orphans
        env:
          DOCKER_HOST: tcp://dockerproxy:2375
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
+          notification_message: 'Docker Compose dry run completed successfully.'
  cloudflare-dns-setup:
    name: Cloudflare DNS Setup
    needs: [docker-compose-ansible-lints]
@@ -130,6 +146,13 @@ jobs:
        run: |
          yq '.services[].labels.swag_url' docker-compose.yml | egrep -v 'null' | sed -e 's|"||g' | awk -F'.' '{print $1}' | sort > compose_subdomains.txt
          flarectl --json dns list --zone "trez.wtf" --type=CNAME --content "trez.wtf" | jq '.[].Name' | sed -e 's|"||g' | awk -F"." '{print $1}' | sort > cloudflare_subdomains.txt
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
+          notification_message: 'Starting Cloudflare setup'
      - name: Compare Subdomains
        id: compare-subdomains
        uses: LouisBrunner/diff-action@v2.2.0
@@ -150,6 +173,13 @@ jobs:
            echo "Creating $subdomain.trez.wtf..."
            flarectl dns create --zone "trez.wtf" --name "${subdomain}" --type=CNAME --content "trez.wtf" --proxy true
          done
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
+          notification_message: 'Cloudflare DNS setup completed successfully.'
  regenerate-readme:
    name: Update README
    runs-on: ubuntu-latest
@@ -201,6 +231,14 @@ jobs:
          echo "Merging PR..."
          pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
          tea pr m --repo ${{ github.repository }} --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" --message "Merged by ${{ github.actor }}" ${pr_index}
+          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: PR Merge Successful'
+          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
  ansible-config-docker-compose-deploy:
    name: Deploy via Ansible & Docker Compose
    runs-on: ubuntu-latest
@@ -243,12 +281,13 @@ jobs:
        with:
          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'Ansible Config Deployment @ Rinoa'
+          notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
          notification_message: 'Deployment completed successfully.'
      - name: Generate .env file for deployment
        run: |
           vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
      - name: Docker Compose Deployment
+        continue-on-error: true
        uses: keatonLiu/docker-compose-remote-action@v1.2
        with:
          ssh_user: gitea-deploy
@@ -261,5 +300,5 @@ jobs:
        with:
          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'Docker Compose Deployment @ Rinoa'
+          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
          notification_message: 'Deployment completed successfully.'
@@ -1,2 +1,3 @@
 **/.cache_ggshield
-ansible/collections/ansible_collections/
+ansible/collections/ansible_collections/
+**/.env
@@ -27,6 +27,7 @@
 | czkawka | jlesage/czkawka |
 | dagu-scheduler | ghcr.io/dagu-org/dagu:latest |
 | dagu-server | ghcr.io/dagu-org/dagu:latest |
+| dbgate | dbgate/dbgate:alpine |
 | delugevpn | ghcr.io/binhex/arch-delugevpn:latest |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
 | docuseal | docuseal/docuseal:latest |
@@ -70,7 +71,8 @@
 | lidarr | lscr.io/linuxserver/lidarr:latest |
 | lidify | thewicklowwolf/lidify:latest |
 | lldap | lldap/lldap:stable |
-| localai | localai/localai:latest-aio-cpu |
+| lobe-chat | lobehub/lobe-chat-database |
+| lobe-chat-pg-db | pgvector/pgvector:pg16 |
 | maloja | krateng/maloja:latest |
 | mariadb | linuxserver/mariadb |
 | mastodon | lscr.io/linuxserver/mastodon:latest |
@@ -80,6 +82,11 @@
 | multi-scrobbler | foxxmd/multi-scrobbler |
 | n8n | docker.n8n.io/n8nio/n8n |
 | navidrome | deluan/navidrome:latest |
+| netbird-dashboard | netbirdio/dashboard:latest |
+| netbird-signal | netbirdio/signal:latest |
+| netbird-relay | netbirdio/relay:latest |
+| netbird-management | netbirdio/management:latest |
+| netbird-coturn | coturn/coturn:latest |
 | netbox | lscr.io/linuxserver/netbox:latest |
 | netbox-db | postgres:17-alpine |
 | nextcloud | lscr.io/linuxserver/nextcloud:latest |
@@ -88,6 +95,7 @@
 | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest |
 | pgbackweb | eduardolat/pgbackweb:latest |
 | pgbackweb-db | postgres:16-alpine |
+| plantuml-server | plantuml/plantuml-server:jetty |
 | plausible | ghcr.io/plausible/community-edition:v2.1.0 |
 | plausible_db | postgres:16-alpine |
 | plausible_events_db | clickhouse/clickhouse-server:24.3.3.102-alpine |
@@ -117,6 +125,7 @@
 | sonashow | thewicklowwolf/sonashow:latest |
 | soularr | mrusse08/soularr:latest |
 | soulseek | slskd/slskd |
+| sourcebot | ghcr.io/sourcebot-dev/sourcebot:latest |
 | speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest |
 | spotisub | blastbeng/spotisub:latest |
 | swag | lscr.io/linuxserver/swag:latest |
@@ -137,7 +146,6 @@
 | wazuh.indexer | wazuh/wazuh-indexer: |
 | wazuh.manager | wazuh/wazuh-manager: |
 | web-check | lissy93/web-check |
-| whodb | clidey/whodb |
 | yacht | selfhostedpro/yacht |
 | your_spotify | lscr.io/linuxserver/your_spotify:latest |
 | youtubedl | nbr23/youtube-dl-server:latest |
@@ -115,7 +115,7 @@ DEFAULT_TRUST_MODEL = committer
 JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_OAUTH2_JWT_SECRET'] }}

 [ui]
-THEMES = theme-catppuccin-blue-auto.css,theme-catppuccin-sapphire-auto.css,theme-catppuccin-yellow-auto.css,theme-catppuccin-maroon-auto.css,theme-catppuccin-mauve-auto.css,theme-catppuccin-peach-auto.css,theme-catppuccin-teal-auto.css,theme-catppuccin-flamingo-auto.css,theme-catppuccin-lavender-auto.css,theme-catppuccin-pink-auto.css,theme-catppuccin-red-auto.css,theme-catppuccin-rosewater-auto.css,theme-catppuccin-sky-auto.css,theme-catppuccin-green-auto.css
+THEMES =

 [actions]
 ENABLED = true
@@ -29,5 +29,5 @@
        widget:
            type: homeassistant
            url: http://192.168.1.252:8123
-            key: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI5MTFlMDZiMzNlODc0MWYyYjM3Mzg0NDhiMzMyNzMxYiIsImlhdCI6MTcxMzEzODc3MiwiZXhwIjoyMDI4NDk4NzcyfQ.CXFBjf0sJAGdMrRd_PTCkkzU3LsCgkckG8HvbdSYEhs
+            key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['HOMEPAGE_HOME_ASSISTANT_API_KEY'] }}

@@ -1,477 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-###########################
-# 🦎 KOMODO CORE CONFIG 🦎 #
-###########################
-
-## This is the offical "Default" config file for Komodo Core.
-## It serves as documentation for the meaning of the fields.
-## It is located at `https://github.com/mbecker20/komodo/blob/main/config/core.config.toml`.
-
-## All fields with a "Default" provided are optional. If they are
-## left out of the file, the "Default" value will be used.
-
-## This file is bundled into the official image, `ghcr.io/mbecker20/komodo`,
-## as the default config at `/config/config.toml`.
-## Komodo can start with no external config file mounted.
-
-## There is usually no need to create this file on your host.
-## Most fields can instead be configured using environment variables.
-## Environment variables will override values set in this file.
-
-## This will be the document title on the web page.
-## Env: KOMODO_TITLE
-## Default: 'Komodo'
-title = "Komodo @ Rinoa"
-
-## This should be the url used to access Komodo in browser, potentially behind DNS.
-## Eg https://komodo.example.com or http://12.34.56.78:9120. This should match the address configured in your Oauth app.
-## Env: KOMODO_HOST
-## Required, no default.
-host = "https://komodo.trez.wtf"
-
-## The port the core system will run on.
-## Env: KOMODO_PORT
-## Default: 9120
-port = 9120
-
-## This is the token used to authenticate core requests to periphery.
-## Ensure this matches a passkey in the connected periphery configs.
-## If the periphery servers don't have passkeys configured, this doesn't need to be changed.
-## Env: KOMODO_PASSKEY or KOMODO_PASSKEY_FILE
-## Required, no default
-passkey = "JgzFdZYbE7JfH5zhrh5pWUEQEWA4MCXG"
-
-## Ensure a server with this address exists on Core
-## upon first startup. Example: `https://periphery:8120`
-## Env: KOMODO_FIRST_SERVER
-## Optional, no default.
-first_server = ""
-
-## Disables write support on resources in the UI.
-## This protects users that that would normally have write priviledges during their UI usage,
-## when they intend to fully rely on ResourceSyncs to manage config.
-## Env: KOMODO_UI_WRITE_DISABLED
-## Default: false
-ui_write_disabled = false
-
-## Disables the confirm dialogs on all actions. All buttons will now be double-click.
-## Useful when only having http connection to core, as UI quick-copy button won't work.
-## Env: KOMODO_DISABLE_CONFIRM_DIALOG
-## Default: false
-disable_confirm_dialog = false
-
-## Configure the directory for sync files (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_SYNC_DIRECTORY
-## Default: /syncs
-sync_directory = "/syncs"
-
-## Configure the repo directory (inside the container).
-## There shouldn't be a need to change this, just mount a volume.
-## Env: KOMODO_REPO_DIRECTORY
-## Default: /repo-cache
-repo_directory = "/repo-cache"
-
-## Configure the action directory (inside the container).
-## There shouldn't be a need to change this, or even mount a volume.
-## Env: KOMODO_ACTION_DIRECTORY
-## Default: /action-cache
-action_directory = "/action-cache"
-
-################
-# AUTH / LOGIN #
-################
-
-## Allow user login with a username / password.
-## The password will be hashed and stored in the db for login comparison.
-##
-## NOTE:
-## Komodo has no API to recover account logins, but if this happens you can doctor the database using Mongo Compass.
-## Create a new Komodo user (Sign Up button), login to the database with Compass, note down your old users username and _id.
-## Then delete the old user, and update the new user to have the same username and _id. 
-## Make sure to set `enabled: true` and maybe `admin: true` on the new user as well, while using Compass.
-##
-## Env: KOMODO_LOCAL_AUTH
-## Default: false
-local_auth = true
-
-## Normally new users will be registered, but not enabled until an Admin enables them.
-## With `disable_user_registration = true`, only the first user to log in will registered as a user.
-## Env: KOMODO_DISABLE_USER_REGISTRATION
-## Default: false
-disable_user_registration = false
-
-## New users will be automatically enabled when they sign up.
-## Otherwise, new users will be disabled on first login.
-## The first user to login will always be enabled on creation.
-## Env: KOMODO_ENABLE_NEW_USERS
-## Default: false
-enable_new_users = false
-
-## Allows all users to have Read level access to all resources.
-## Env: KOMODO_TRANSPARENT_MODE
-## Default: false
-transparent_mode = false
-
-## Normally all enabled users can create resources.
-## If `disable_non_admin_create = true`, only admin users can create resources.
-## Env: KOMODO_DISABLE_NON_ADMIN_CREATE
-## Default: false
-disable_non_admin_create = false
-
-## Optionally provide a specific jwt secret.
-## Passing nothing or an empty string will cause one to be generated on every startup.
-## This means users will have to log in again if Komodo restarts.
-## Env: KOMODO_JWT_SECRET or KOMODO_JWT_SECRET_FILE
-## Default: empty string, meaning a random secret will be generated at startup.
-jwt_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_JWT_SECRET'] }}"
-
-## Specify how long a user can stay logged in before they have to log in again.
-## All jwts are invalidated on application restart unless `jwt_secret` is set.
-## Env: KOMODO_JWT_TTL
-## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk, 30-day
-## Default: 1-day. 
-jwt_ttl = "1-day"
-
-#############
-# OIDC Auth #
-#############
-
-## Enable logins with configured OIDC provider.
-## Env: KOMODO_OIDC_ENABLED
-## Default: false
-oidc_enabled = false
-
-## Give the provider address.
-##
-## The path, ie /application/o/komodo for Authentik,
-## is provider and configuration specific.
-##
-## Note. this address must be reachable from Komodo Core container.
-##
-## Env: KOMODO_OIDC_PROVIDER
-## Optional, no default.
-oidc_provider = "https://oidc.provider.internal/application/o/komodo"
-
-## Configure OIDC user redirect host.
-##
-## This is the host address users are redirected to in their browser,
-## and may be different from `oidc_provider` host depending on your networking.
-## If not provided (or empty string ""), the `oidc_provider` will be used.
-##
-## Note. DO NOT include the `path` part of the URL.
-## Example: `https://oidc.provider.external`
-##
-## Env: KOMODO_OIDC_REDIRECT_HOST
-## Optional, no default.
-oidc_redirect_host = ""
-
-## Give the OIDC Client ID.
-## Env: KOMODO_OIDC_CLIENT_ID or KOMODO_OIDC_CLIENT_ID_FILE
-oidc_client_id = ""
-
-## Give the OIDC Client Secret.
-## Env: KOMODO_OIDC_CLIENT_SECRET or KOMODO_OIDC_CLIENT_SECRET_FILE
-oidc_client_secret = ""
-
-## If true, use the full email for usernames.
-## Otherwise, the @address will be stripped,
-## making usernames more concise.
-## Env: KOMODO_OIDC_USE_FULL_EMAIL
-## Default: false.
-oidc_use_full_email = false
-
-## Some providers attach other audiences in addition to the client_id.
-## If you have this issue, `Invalid audiences: `...` is not a trusted audience"`,
-## you can add the audience `...` to the list here (assuming it should be trusted).
-## Env: KOMODO_OIDC_ADDITIONAL_AUDIENCES or KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE
-## Default: empty
-oidc_additional_audiences = []
-
-#########
-# OAUTH #
-#########
-
-## Google
-
-## Env: KOMODO_GOOGLE_OAUTH_ENABLED
-## Default: false
-google_oauth.enabled = false
-
-## Env: KOMODO_GOOGLE_OAUTH_ID or KOMODO_GOOGLE_OAUTH_ID_FILE
-## Required if google_oauth is enabled.
-google_oauth.id = ""
-
-## Env: KOMODO_GOOGLE_OAUTH_SECRET or KOMODO_GOOGLE_OAUTH_SECRET_FILE
-## Required if google_oauth is enabled.
-google_oauth.secret = ""
-
-## Github
-
-## Env: KOMODO_GITHUB_OAUTH_ENABLED
-## Default: false
-github_oauth.enabled = false
-
-## Env: KOMODO_GITHUB_OAUTH_ID or KOMODO_GITHUB_OAUTH_ID_FILE
-## Required if github_oauth is enabled.
-github_oauth.id = ""
-
-## Env: KOMODO_GITHUB_OAUTH_SECRET or KOMODO_GITHUB_OAUTH_SECRET_FILE
-## Required if github_oauth is enabled.
-github_oauth.secret = ""
-
-############
-# Security #
-############
-
-## Enable HTTPS server using the given key and cert.
-## Env: KOMODO_SSL_ENABLED
-## Default: false
-ssl_enabled = false
-
-## Path to the ssl key.
-## Env: KOMODO_SSL_KEY_FILE
-## Default: /config/ssl/key.pem
-ssl_key_file = "/config/ssl/key.pem"
-
-## Path to the ssl cert.
-## Env: KOMODO_SSL_CERT_FILE
-## Default: /config/ssl/cert.pem
-ssl_cert_file = "/config/ssl/cert.pem"
-
-############
-# DATABASE #
-############
-
-## Configure the database connection in one of the following ways:
-
-## Pass a full Mongo URI to the database.
-## Example: mongodb://username:password@localhost:27017
-## Env: KOMODO_DATABASE_URI or KOMODO_DATABASE_URI_FILE
-## Optional, can usually use `address`, `username`, `password` instead.
-database.uri = "mongodb://komodo:jtyl2U8KZPUe8V9MOTXQDYRlg7QemGuF@komodo-ferretdb:27017/komodo?authMechanism=PLAIN"
-
-## ==== * OR * ==== ##
-
-# Construct the address as mongodb://{username}:{password}@{address}
-## Env: KOMODO_DATABASE_ADDRESS
-# database.address = "localhost:27017"
-## Env: KOMODO_DATABASE_USERNAME or KOMODO_DATABASE_USERNAME_FILE
-# database.username = ""
-## Env: KOMODO_DATABASE_PASSWORD or KOMODO_DATABASE_PASSWORD_FILE
-# database.password = ""
-
-## ==== other ====
-
-## Komodo will create its collections under this database name.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_DB_NAME
-## Default: komodo.
-database.db_name = "komodo"
-
-## This is the assigned app_name of the mongo client.
-## The only reason to change this is if multiple Komodo Cores share the same db.
-## Env: KOMODO_DATABASE_APP_NAME
-## Default: komodo_core.
-database.app_name = "komodo_core"
-
-############
-# WEBHOOKS #
-############
-
-## This token must be given to git provider during repo webhook config.
-## The secret configured on the git provider side must match the secret configured here.
-## If not provided, 
-## Env: KOMODO_WEBHOOK_SECRET or KOMODO_WEBHOOK_SECRET_FILE
-## Optional, no default.
-webhook_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['KOMODO_WEBHOOK_SECRET'] }}"
-
-## An alternate base url that is used to recieve git webhook requests.
-## If empty or not specified, will use 'host' address as base.
-## This is useful if Komodo is on an internal network, but can have a
-## proxy just allowing through the webhook listener api using NGINX.
-## Env: KOMODO_WEBHOOK_BASE_URL
-## Default: empty (none)
-webhook_base_url = ""
-
-## Configure Github webhook app. Enables webhook management apis.
-## <INSERT LINK TO GUIDE>
-## Env: KOMODO_GITHUB_WEBHOOK_APP_APP_ID or KOMODO_GITHUB_WEBHOOK_APP_APP_ID_FILE
-# github_webhook_app.app_id = 1234455 # Find on the app page.
-## Env: 
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS or KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_IDS_FILE
-##   - KOMODO_GITHUB_WEBHOOK_APP_INSTALLATIONS_NAMESPACES
-# github_webhook_app.installations = [
-#   ## Find the id after installing the app to user / organization. "namespace" is the username / organization name.
-#   { id = 1234, namespace = "mbecker20" }
-# ]
-
-## The path to Github webhook app private key. <INSERT LINK TO GUIDE>
-## This is defaulted to `/github/private-key.pem`, and doesn't need to be changed if running core in Docker.
-## Just mount the private key pem file on the host to `/github/private-key.pem` in the container.
-## Eg. `/your/path/to/key.pem : /github/private-key.pem`
-## Env: KOMODO_GITHUB_WEBHOOK_APP_PK_PATH
-# github_webhook_app.pk_path = "/path/to/pk.pem"
-
-###########
-# LOGGING #
-###########
-
-## Specify the logging verbosity
-## Env: KOMODO_LOGGING_LEVEL
-## Options: off, error, warn, info, debug, trace
-## Default: info
-logging.level = "info"
-
-## Specify the logging format for stdout / stderr.
-## Env: KOMODO_LOGGING_STDIO
-## Options: standard, json, none
-## Default: standard
-logging.stdio = "standard"
-
-## Optionally specify a opentelemetry otlp endpoint to send traces to.
-## Example: http://localhost:4317
-## Env: KOMODO_LOGGING_OTLP_ENDPOINT
-logging.otlp_endpoint = ""
-
-## Set the opentelemetry service name.
-## This will be attached to the telemetry Komodo will send.
-## Env: KOMODO_LOGGING_OPENTELEMETRY_SERVICE_NAME
-## Default: "Komodo"
-logging.opentelemetry_service_name = "Komodo"
-
-###########
-# PRUNING #
-###########
-
-## The number of days to keep historical system stats around, or 0 to disable pruning. 
-## Stats older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_STATS_FOR_DAYS
-## Default: 14
-keep_stats_for_days = 14
-
-## The number of days to keep alerts around, or 0 to disable pruning. 
-## Alerts older that are than this number of days are deleted on a daily cycle.
-## Env: KOMODO_KEEP_ALERTS_FOR_DAYS
-## Default: 14
-keep_alerts_for_days = 14
-
-##################
-# POLL INTERVALS #
-##################
-
-## Controls the rate at which servers are polled for health, system stats, and container status.
-## This affects network usage, and the size of the stats stored in mongo.
-## Env: KOMODO_MONITORING_INTERVAL
-## Options: 1-sec, 5-sec, 15-sec, 30-sec, 1-min, 2-min, 5-min, 15-min
-## Default: 15-sec
-monitoring_interval = "15-sec"
-
-## Interval at which to poll Resources for any updates / automated actions.
-## Env: KOMODO_RESOURCE_POLL_INTERVAL
-## Options: `15-sec`, `1-min`, `5-min`, `15-min`, `1-hr`.
-## Default: 5-min
-resource_poll_interval = "5-min"
-
-###################
-# CLOUD PROVIDERS #
-###################
-
-## Komodo can build images by deploying AWS EC2 instances,
-## running the build, and afterwards destroying the instance.
-
-## Additionally, Komodo can deploy cloud VPS on AWS EC2 and Hetzner.
-## Use the Template resource to configure launch preferences.
-## Hetzner is not supported for builds as their pricing model is by the hour,
-## while AWS is by the minute. This is very important for builds.
-
-## Provide AWS api keys for ephemeral builders / server launch
-## Env: KOMODO_AWS_ACCESS_KEY_ID or KOMODO_AWS_ACCESS_KEY_ID_FILE
-aws.access_key_id = ""
-## Env: KOMODO_AWS_SECRET_ACCESS_KEY or KOMODO_AWS_SECRET_ACCESS_KEY_FILE
-aws.secret_access_key = ""
-
-## Provide Hetzner api token for server launch
-## Env: KOMODO_HETZNER_TOKEN or KOMODO_HETZNER_TOKEN_FILE
-hetzner.token = ""
-
-#################
-# GIT PROVIDERS #
-#################
-
-## These will be available to attach to Builds, Repos, Stacks, and Syncs.
-## They allow these Resources to clone private repositories.
-## They cannot be configured on the environment.
-
-## configure git providers
-# [[git_provider]]
-# domain = "github.com"
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# 	{ username = "moghtech", token = "access_token_for_other_account" },
-# ]
-
-# [[git_provider]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-# [[git_provider]]
-# domain = "localhost:8000" # use a custom provider, like self-hosted gitea
-# https = false # use http://localhost:8000 as base-url for clone
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-
-######################
-# REGISTRY PROVIDERS #
-######################
-
-## These will be available to attach to Builds and Stacks.
-## They allow these Resources to pull private images.
-## They cannot be configured on the environment.
-
-## configure docker registries
-# [[docker_registry]]
-# domain = "docker.io"
-# accounts = [
-# 	{ username = "mbecker2020", token = "access_token_for_account" }
-# ]
-# organizations = ["DockerhubOrganization"]
-
-[[gitea_rinoa]]
-domain = "git.trez.wtf"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-[[gitea_rinoa_local]]
-domain = "http://gitea:3000"
-accounts = [
-	{ username = "gitea-sonarqube-bot", token = "594a3a9611bdb508bd6a3575e2ddb3ac4922a4da" }
-]
-
-# [[docker_registry]]
-# domain = "git.mogh.tech" # use a custom provider, like self-hosted gitea
-# accounts = [
-# 	{ username = "mbecker20", token = "access_token_for_account" },
-# ]
-# organizations = ["Mogh"] # These become available in the UI
-
-###########
-# SECRETS #
-###########
-
-## Provide Core based secrets.
-## These will be available to interpolate into your Deployment / Stack environments,
-## and will be hidden in the UI and logs.
-## These are available to use on any Periphery (Server),
-## but you can also limit access more by placing them in a single Periphery's config file instead.
-## These cannot be configured in the Komodo Core environment, they must be passed in the file.
-
-# [secrets]
-# SECRET_1 = "value_1"
-# SECRET_2 = "value_2"
@@ -0,0 +1,106 @@
+{
+  "Stuns": [
+    {
+      "Proto": "udp",
+      "URI": "stun:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
+      "Username": "",
+      "Password": null
+    }
+  ],
+  "TURNConfig": {
+    "Turns": [
+      {
+        "Proto": "udp",
+        "URI": "turn:netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:3478",
+        "Username": "self",
+        "Password": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}"
+      }
+    ],
+    "CredentialsTTL": "12h",
+    "Secret": "secret",
+    "TimeBasedCredentials": false
+  },
+  "Relay": {
+    "Addresses": [
+      "rel://netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:33080"
+    ],
+    "CredentialsTTL": "24h",
+    "Secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_RELAY_AUTH_SECRET'] }}"
+  },
+  "Signal": {
+    "Proto": "https",
+    "URI": "netbird.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}:10001",
+    "Username": "",
+    "Password": null
+  },
+  "ReverseProxy": {
+    "TrustedHTTPProxies": [],
+    "TrustedHTTPProxiesCount": 0,
+    "TrustedPeers": [
+      "0.0.0.0/0"
+    ]
+  },
+  "Datadir": "",
+  "DataStoreEncryptionKey": "",
+  "StoreConfig": {
+    "Engine": "sqlite"
+  },
+  "HttpConfig": {
+    "Address": "0.0.0.0:33073",
+    "AuthIssuer": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
+    "AuthAudience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+    "AuthKeysLocation": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/keys",
+    "AuthUserIDClaim": "",
+    "CertFile": "",
+    "CertKey": "",
+    "IdpSignKeyRefreshEnabled": true,
+    "OIDCConfigEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/.well-known/openid-configuration"
+  },
+  "IdpManagerConfig": {
+    "ManagerType": "zitadel",
+    "ClientConfig": {
+      "Issuer": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}",
+      "TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
+      "ClientID": "netbird",
+      "ClientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_SECRET'] }}",
+      "GrantType": "client_credentials"
+    },
+    "ExtraConfig": {
+      "ManagementEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/management/v1"
+    },
+    "Auth0ClientCredentials": null,
+    "AzureClientCredentials": null,
+    "KeycloakClientCredentials": null,
+    "ZitadelClientCredentials": null
+  },
+  "DeviceAuthorizationFlow": {
+    "Provider": "hosted",
+    "ProviderConfig": {
+      "Audience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "AuthorizationEndpoint": "",
+      "Domain": "",
+      "ClientID": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "ClientSecret": "",
+      "TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
+      "DeviceAuthEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/device_authorization",
+      "Scope": "openid",
+      "UseIDToken": false,
+      "RedirectURLs": null
+    }
+  },
+  "PKCEAuthorizationFlow": {
+    "ProviderConfig": {
+      "Audience": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "ClientID": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_ZITADEL_CLIENT_ID'] }}",
+      "ClientSecret": "",
+      "Domain": "",
+      "AuthorizationEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/authorize",
+      "TokenEndpoint": "https://id.{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MY_TLD'] }}/oauth/v2/token",
+      "Scope": "openid profile email offline_access api",
+      "RedirectURLs": [
+        "http://localhost:53000"
+      ],
+      "UseIDToken": false
+    }
+  }
+}
@@ -0,0 +1,122 @@
+{
+    "issuer": "https://id.trez.wtf",
+    "authorization_endpoint": "https://id.trez.wtf/oauth/v2/authorize",
+    "token_endpoint": "https://id.trez.wtf/oauth/v2/token",
+    "introspection_endpoint": "https://id.trez.wtf/oauth/v2/introspect",
+    "userinfo_endpoint": "https://id.trez.wtf/oidc/v1/userinfo",
+    "revocation_endpoint": "https://id.trez.wtf/oauth/v2/revoke",
+    "end_session_endpoint": "https://id.trez.wtf/oidc/v1/end_session",
+    "device_authorization_endpoint": "https://id.trez.wtf/oauth/v2/device_authorization",
+    "jwks_uri": "https://id.trez.wtf/oauth/v2/keys",
+    "scopes_supported": [
+        "openid",
+        "profile",
+        "email",
+        "phone",
+        "address",
+        "offline_access"
+    ],
+    "response_types_supported": [
+        "code",
+        "id_token",
+        "id_token token"
+    ],
+    "response_modes_supported": [
+        "query",
+        "fragment",
+        "form_post"
+    ],
+    "grant_types_supported": [
+        "authorization_code",
+        "implicit",
+        "refresh_token",
+        "client_credentials",
+        "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "urn:ietf:params:oauth:grant-type:device_code"
+    ],
+    "subject_types_supported": [
+        "public"
+    ],
+    "id_token_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "request_object_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "token_endpoint_auth_methods_supported": [
+        "none",
+        "client_secret_basic",
+        "client_secret_post",
+        "private_key_jwt"
+    ],
+    "token_endpoint_auth_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "revocation_endpoint_auth_methods_supported": [
+        "none",
+        "client_secret_basic",
+        "client_secret_post",
+        "private_key_jwt"
+    ],
+    "revocation_endpoint_auth_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "introspection_endpoint_auth_methods_supported": [
+        "client_secret_basic",
+        "private_key_jwt"
+    ],
+    "introspection_endpoint_auth_signing_alg_values_supported": [
+        "RS256"
+    ],
+    "claims_supported": [
+        "sub",
+        "aud",
+        "exp",
+        "iat",
+        "iss",
+        "auth_time",
+        "nonce",
+        "acr",
+        "amr",
+        "c_hash",
+        "at_hash",
+        "act",
+        "scopes",
+        "client_id",
+        "azp",
+        "preferred_username",
+        "name",
+        "family_name",
+        "given_name",
+        "locale",
+        "email",
+        "email_verified",
+        "phone_number",
+        "phone_number_verified"
+    ],
+    "code_challenge_methods_supported": [
+        "S256"
+    ],
+    "ui_locales_supported": [
+        "bg",
+        "cs",
+        "de",
+        "en",
+        "es",
+        "fr",
+        "hu",
+        "id",
+        "it",
+        "ja",
+        "ko",
+        "mk",
+        "nl",
+        "pl",
+        "pt",
+        "ru",
+        "sv",
+        "zh"
+    ],
+    "request_parameter_supported": true,
+    "request_uri_parameter_supported": false
+}
@@ -0,0 +1,725 @@
+# Coturn TURN SERVER configuration file
+#
+# Boolean values note: where a boolean value is supposed to be used,
+# you can use '0', 'off', 'no', 'false', or 'f' as 'false,
+# and you can use '1', 'on', 'yes', 'true', or 't' as 'true'
+# If the value is missing, then it means 'true' by default.
+#
+
+# Listener interface device (optional, Linux only).
+# NOT RECOMMENDED.
+#
+#listening-device=eth0
+
+# TURN listener port for UDP and TCP (Default: 3478).
+# Note: actually, TLS & DTLS sessions can connect to the
+# "plain" TCP & UDP port(s), too - if allowed by configuration.
+#
+listening-port=3478
+
+# TURN listener port for TLS (Default: 5349).
+# Note: actually, "plain" TCP & UDP sessions can connect to the TLS & DTLS
+# port(s), too - if allowed by configuration. The TURN server
+# "automatically" recognizes the type of traffic. Actually, two listening
+# endpoints (the "plain" one and the "tls" one) are equivalent in terms of
+# functionality; but Coturn keeps both endpoints to satisfy the RFC 5766 specs.
+# For secure TCP connections, Coturn currently supports SSL version 3 and
+# TLS version 1.0, 1.1 and 1.2.
+# For secure UDP connections, Coturn supports DTLS version 1.
+#
+tls-listening-port=5349
+
+# Alternative listening port for UDP and TCP listeners;
+# default (or zero) value means "listening port plus one".
+# This is needed for RFC 5780 support
+# (STUN extension specs, NAT behavior discovery). The TURN Server
+# supports RFC 5780 only if it is started with more than one
+# listening IP address of the same family (IPv4 or IPv6).
+# RFC 5780 is supported only by UDP protocol, other protocols
+# are listening to that endpoint only for "symmetry".
+#
+#alt-listening-port=0
+
+# Alternative listening port for TLS and DTLS protocols.
+# Default (or zero) value means "TLS listening port plus one".
+#
+#alt-tls-listening-port=0
+
+# Some network setups will require using a TCP reverse proxy in front
+# of the STUN server. If the proxy port option is set a single listener
+# is started on the given port that accepts connections using the
+# haproxy proxy protocol v2.
+# (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
+#
+#tcp-proxy-port=5555
+
+# Listener IP address of relay server. Multiple listeners can be specified.
+# If no IP(s) specified in the config file or in the command line options,
+# then all IPv4 and IPv6 system IPs will be used for listening.
+#
+#listening-ip=172.17.19.101
+#listening-ip=10.207.21.238
+#listening-ip=2607:f0d0:1002:51::4
+
+# Auxiliary STUN/TURN server listening endpoint.
+# Aux servers have almost full TURN and STUN functionality.
+# The (minor) limitations are:
+#
+# 1) Auxiliary servers do not have alternative ports and
+# they do not support STUN RFC 5780 functionality (CHANGE REQUEST).
+#
+# 2) Auxiliary servers also are never returning ALTERNATIVE-SERVER reply.
+#
+# Valid formats are 1.2.3.4:5555 for IPv4 and [1:2::3:4]:5555 for IPv6.
+#
+# There may be multiple aux-server options, each will be used for listening
+# to client requests.
+#
+#aux-server=172.17.19.110:33478
+#aux-server=[2607:f0d0:1002:51::4]:33478
+
+# (recommended for older Linuxes only)
+# Automatically balance UDP traffic over auxiliary servers (if configured).
+# The load balancing is using the ALTERNATE-SERVER mechanism.
+# The TURN client must support 300 ALTERNATE-SERVER response for this
+# functionality.
+#
+#udp-self-balance
+
+# Relay interface device for relay sockets (optional, Linux only).
+# NOT RECOMMENDED.
+#
+#relay-device=eth1
+
+# Relay address (the local IP address that will be used to relay the
+# packets to the peer).
+# Multiple relay addresses may be used.
+# The same IP(s) can be used as both listening IP(s) and relay IP(s).
+#
+# If no relay IP(s) specified, then the turnserver will apply the default
+# policy: it will decide itself which relay addresses to be used, and it
+# will always be using the client socket IP address as the relay IP address
+# of the TURN session (if the requested relay address family is the same
+# as the family of the client socket).
+#
+#relay-ip=172.17.19.105
+#relay-ip=2607:f0d0:1002:51::5
+
+# For Amazon EC2 users:
+#
+# TURN Server public/private address mapping, if the server is behind NAT.
+# In that situation, if a -X is used in form "-X <ip>" then that ip will be reported
+# as relay IP address of all allocations. This scenario works only in a simple case
+# when one single relay address is be used, and no RFC5780 functionality is required.
+# That single relay address must be mapped by NAT to the 'external' IP.
+# The "external-ip" value, if not empty, is returned in XOR-RELAYED-ADDRESS field.
+# For that 'external' IP, NAT must forward ports directly (relayed port 12345
+# must be always mapped to the same 'external' port 12345).
+#
+# In more complex case when more than one IP address is involved,
+# that option must be used several times, each entry must
+# have form "-X <public-ip/private-ip>", to map all involved addresses.
+# RFC5780 NAT discovery STUN functionality will work correctly,
+# if the addresses are mapped properly, even when the TURN server itself
+# is behind A NAT.
+#
+# By default, this value is empty, and no address mapping is used.
+#
+# external-ip=193.224.22.37
+#
+#OR:
+#
+#external-ip=60.70.80.91/172.17.19.101
+#external-ip=60.70.80.92/172.17.19.102
+
+external-ip=108.29.206.17
+
+# Number of the relay threads to handle the established connections
+# (in addition to authentication thread and the listener thread).
+# If explicitly set to 0 then application runs relay process in a
+# single thread, in the same thread with the listener process
+# (the authentication thread will still be a separate thread).
+#
+# If this parameter is not set, then the default OS-dependent
+# thread pattern algorithm will be employed. Usually the default
+# algorithm is optimal, so you have to change this option
+# if you want to make some fine tweaks.
+#
+# In the older systems (Linux kernel before 3.9),
+# the number of UDP threads is always one thread per network listening
+# endpoint - including the auxiliary endpoints - unless 0 (zero) or
+# 1 (one) value is set.
+#
+#relay-threads=0
+
+# Lower and upper bounds of the UDP relay endpoints:
+# (default values are 49152 and 65535)
+#
+min-port=49152
+max-port=65535
+
+# Uncomment to run TURN server in 'normal' 'moderate' verbose mode.
+# By default the verbose mode is off.
+#verbose
+
+# Uncomment to run TURN server in 'extra' verbose mode.
+# This mode is very annoying and produces lots of output.
+# Not recommended under normal circumstances.
+#
+#Verbose
+
+# Uncomment to use fingerprints in the TURN messages.
+# By default the fingerprints are off.
+#
+fingerprint
+
+# Uncomment to use long-term credential mechanism.
+# By default no credentials mechanism is used (any user allowed).
+#
+lt-cred-mech
+
+# This option is the opposite of lt-cred-mech.
+# (TURN Server with no-auth option allows anonymous access).
+# If neither option is defined, and no users are defined,
+# then no-auth is default. If at least one user is defined,
+# in this file, in command line or in usersdb file, then
+# lt-cred-mech is default.
+#
+#no-auth
+
+# TURN REST API flag.
+# (Time Limited Long Term Credential)
+# Flag that sets a special authorization option that is based upon authentication secret.
+#
+# This feature's purpose is to support "TURN Server REST API", see
+# "TURN REST API" link in the project's page
+# https://github.com/coturn/coturn/
+#
+# This option is used with timestamp:
+#
+# usercombo -> "timestamp:userid"
+# turn user -> usercombo
+# turn password -> base64(hmac(secret key, usercombo))
+#
+# This allows TURN credentials to be accounted for a specific user id.
+# If you don't have a suitable id, then the timestamp alone can be used.
+# This option is enabled by turning on secret-based authentication.
+# The actual value of the secret is defined either by the option static-auth-secret,
+# or can be found in the turn_secret table in the database (see below).
+#
+# Read more about it:
+#  - https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00
+#  - https://www.ietf.org/proceedings/87/slides/slides-87-behave-10.pdf
+#
+# Be aware that use-auth-secret overrides some parts of lt-cred-mech.
+# The use-auth-secret feature depends internally on lt-cred-mech, so if you set
+# this option then it automatically enables lt-cred-mech internally
+# as if you had enabled both.
+#
+# Note that you can use only one auth mechanism at the same time! This is because,
+# both mechanisms conduct username and password validation in different ways.
+#
+# Use either lt-cred-mech or use-auth-secret in the conf
+# to avoid any confusion.
+#
+#use-auth-secret
+
+# 'Static' authentication secret value (a string) for TURN REST API only.
+# If not set, then the turn server
+# will try to use the 'dynamic' value in the turn_secret table
+# in the user database (if present). The database-stored  value can be changed on-the-fly
+# by a separate program, so this is why that mode is considered 'dynamic'.
+#
+#static-auth-secret=north
+
+# Server name used for
+# the oAuth authentication purposes.
+# The default value is the realm name.
+#
+# server-name=stun.wiretrustee.com
+
+# Flag that allows oAuth authentication.
+#
+#oauth
+
+# 'Static' user accounts for the long term credentials mechanism, only.
+# This option cannot be used with TURN REST API.
+# 'Static' user accounts are NOT dynamically checked by the turnserver process,
+# so they can NOT be changed while the turnserver is running.
+#
+#user=username1:key1
+#user=username2:key2
+# OR:
+user=self:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NETBIRD_TURN_PASSWORD'] }}
+#user=username2:password2
+#
+# Keys must be generated by turnadmin utility. The key value depends
+# on user name, realm, and password:
+#
+# Example:
+# $ turnadmin -k -u ninefingers -r north.gov -p youhavetoberealistic
+# Output: 0xbc807ee29df3c9ffa736523fb2c4e8ee
+# ('0x' in the beginning of the key is what differentiates the key from
+# password. If it has 0x then it is a key, otherwise it is a password).
+#
+# The corresponding user account entry in the config file will be:
+#
+#user=ninefingers:0xbc807ee29df3c9ffa736523fb2c4e8ee
+# Or, equivalently, with open clear password (less secure):
+#user=ninefingers:youhavetoberealistic
+#
+
+# SQLite database file name.
+#
+# The default file name is /var/db/turndb or /usr/local/var/db/turndb or
+# /var/lib/turn/turndb.
+#
+#userdb=/var/db/turndb
+
+# PostgreSQL database connection string in the case that you are using PostgreSQL
+# as the user database.
+# This database can be used for the long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+# See http://www.postgresql.org/docs/8.4/static/libpq-connect.html for 8.x PostgreSQL
+# versions connection string format, see
+# http://www.postgresql.org/docs/9.2/static/libpq-connect.html#LIBPQ-CONNSTRING
+# for 9.x and newer connection string formats.
+#
+#psql-userdb="host=<host> dbname=<database-name> user=<database-user> password=<database-user-password> connect_timeout=30"
+
+# MySQL database connection string in the case that you are using MySQL
+# as the user database.
+# This database can be used for the long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+#
+# Optional connection string parameters for the secure communications (SSL):
+# ca, capath, cert, key, cipher
+# (see http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html for the
+# command options description).
+#
+# Use the string format below (space separated parameters, all optional):
+#
+# mysql-userdb="host=mysql dbname=coturn user=coturn password=CHANGE_ME port=3306 connect_timeout=10 read_timeout=10"
+
+# If you want to use an encrypted password in the MySQL connection string,
+# then set the MySQL password encryption secret key file with this option.
+#
+# Warning: If this option is set, then the mysql password must be set in "mysql-userdb" in an encrypted format!
+# If you want to use a cleartext password then do not set this option!
+#
+# This is the file path for the aes encrypted secret key used for password encryption.
+#
+#secret-key-file=/path/
+
+# MongoDB database connection string in the case that you are using MongoDB
+# as the user database.
+# This database can be used for long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+# Use the string format described at http://hergert.me/docs/mongo-c-driver/mongoc_uri.html
+#
+#mongo-userdb="mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][/[database][?options]]"
+
+# Redis database connection string in the case that you are using Redis
+# as the user database.
+# This database can be used for long-term credential mechanism
+# and it can store the secret value for secret-based timed authentication in TURN REST API.
+# Use the string format below (space separated parameters, all optional):
+#
+#redis-userdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
+
+# Redis status and statistics database connection string, if used (default - empty, no Redis stats DB used).
+# This database keeps allocations status information, and it can be also used for publishing
+# and delivering traffic and allocation event notifications.
+# The connection string has the same parameters as redis-userdb connection string.
+# Use the string format below (space separated parameters, all optional):
+#
+#redis-statsdb="ip=<ip-address> dbname=<database-number> password=<database-user-password> port=<port> connect_timeout=<seconds>"
+
+# The default realm to be used for the users when no explicit
+# origin/realm relationship is found in the database, or if the TURN
+# server is not using any database (just the commands-line settings
+# and the userdb file). Must be used with long-term credentials
+# mechanism or with TURN REST API.
+#
+# Note: If the default realm is not specified, then realm falls back to the host domain name.
+#       If the domain name string is empty, or set to '(None)', then it is initialized as an empty string.
+#
+# realm=wiretrustee.com
+# This flag sets the origin consistency
+# check. Across the session, all requests must have the same
+# main ORIGIN attribute value (if the ORIGIN was
+# initially used by the session).
+#
+#check-origin-consistency
+
+# Per-user allocation quota.
+# default value is 0 (no quota, unlimited number of sessions per user).
+# This option can also be set through the database, for a particular realm.
+#
+#user-quota=0
+
+# Total allocation quota.
+# default value is 0 (no quota).
+# This option can also be set through the database, for a particular realm.
+#
+#total-quota=0
+
+# Max bytes-per-second bandwidth a TURN session is allowed to handle
+# (input and output network streams are treated separately). Anything above
+# that limit will be dropped or temporarily suppressed (within
+# the available buffer limits).
+# This option can also be set through the database, for a particular realm.
+#
+#max-bps=0
+
+#
+# Maximum server capacity.
+# Total bytes-per-second bandwidth the TURN server is allowed to allocate
+# for the sessions, combined (input and output network streams are treated separately).
+#
+# bps-capacity=0
+
+# Uncomment if no UDP client listener is desired.
+# By default UDP client listener is always started.
+#
+#no-udp
+
+# Uncomment if no TCP client listener is desired.
+# By default TCP client listener is always started.
+#
+#no-tcp
+
+# Uncomment if no TLS client listener is desired.
+# By default TLS client listener is always started.
+#
+#no-tls
+
+# Uncomment if no DTLS client listener is desired.
+# By default DTLS client listener is always started.
+#
+#no-dtls
+
+# Uncomment if no UDP relay endpoints are allowed.
+# By default UDP relay endpoints are enabled (like in RFC 5766).
+#
+#no-udp-relay
+
+# Uncomment if no TCP relay endpoints are allowed.
+# By default TCP relay endpoints are enabled (like in RFC 6062).
+#
+#no-tcp-relay
+
+# Uncomment if extra security is desired,
+# with nonce value having a limited lifetime.
+# The nonce value is unique for a session.
+# Set this option to limit the nonce lifetime.
+# Set it to 0 for unlimited lifetime.
+# It defaults to 600 secs (10 min) if no value is provided. After that delay,
+# the client will get 438 error and will have to re-authenticate itself.
+#
+#stale-nonce=600
+
+# Uncomment if you want to set the maximum allocation
+# time before it has to be refreshed.
+# Default is 3600s.
+#
+#max-allocate-lifetime=3600
+
+
+# Uncomment to set the lifetime for the channel.
+# Default value is 600 secs (10 minutes).
+# This value MUST not be changed for production purposes.
+#
+#channel-lifetime=600
+
+# Uncomment to set the permission lifetime.
+# Default to 300 secs (5 minutes).
+# In production this value MUST not be changed,
+# however it can be useful for test purposes.
+#
+#permission-lifetime=300
+
+# Certificate file.
+# Use an absolute path or path relative to the
+# configuration file.
+# Use PEM file format.
+#
+cert=/etc/coturn/certs/cert.pem
+
+# Private key file.
+# Use an absolute path or path relative to the
+# configuration file.
+# Use PEM file format.
+#
+pkey=/etc/coturn/private/privkey.pem
+
+# Private key file password, if it is in encoded format.
+# This option has no default value.
+#
+#pkey-pwd=...
+
+# Allowed OpenSSL cipher list for TLS/DTLS connections.
+# Default value is "DEFAULT".
+#
+#cipher-list="DEFAULT"
+
+# CA file in OpenSSL format.
+# Forces TURN server to verify the client SSL certificates.
+# By default this is not set: there is no default value and the client
+# certificate is not checked.
+#
+# Example:
+#CA-file=/etc/ssh/id_rsa.cert
+
+# Curve name for EC ciphers, if supported by OpenSSL
+# library (TLS and DTLS). The default value is prime256v1,
+# if pre-OpenSSL 1.0.2 is used. With OpenSSL 1.0.2+,
+# an optimal curve will be automatically calculated, if not defined
+# by this option.
+#
+#ec-curve-name=prime256v1
+
+# Use 566 bits predefined DH TLS key. Default size of the key is 2066.
+#
+#dh566
+
+# Use 1066 bits predefined DH TLS key. Default size of the key is 2066.
+#
+#dh1066
+
+# Use custom DH TLS key, stored in PEM format in the file.
+# Flags --dh566 and --dh2066 are ignored when the DH key is taken from a file.
+#
+#dh-file=<DH-PEM-file-name>
+
+# Flag to prevent stdout log messages.
+# By default, all log messages go to both stdout and to
+# the configured log file. With this option everything will
+# go to the configured log only (unless the log file itself is stdout).
+#
+#no-stdout-log
+
+# Option to set the log file name.
+# By default, the turnserver tries to open a log file in
+# /var/log, /var/tmp, /tmp and the current directory
+# (Whichever file open operation succeeds first will be used).
+# With this option you can set the definite log file name.
+# The special names are "stdout" and "-" - they will force everything
+# to the stdout. Also, the "syslog" name will force everything to
+# the system log (syslog).
+# In the runtime, the logfile can be reset with the SIGHUP signal
+# to the turnserver process.
+#
+log-file=stdout
+
+# Option to redirect all log output into system log (syslog).
+#
+# syslog
+
+# This flag means that no log file rollover will be used, and the log file
+# name will be constructed as-is, without PID and date appendage.
+# This option can be used, for example, together with the logrotate tool.
+#
+#simple-log
+
+# Option to set the "redirection" mode. The value of this option
+# will be the address of the alternate server for UDP & TCP service in the form of
+# <ip>[:<port>]. The server will send this value in the attribute
+# ALTERNATE-SERVER, with error 300, on ALLOCATE request, to the client.
+# Client will receive only values with the same address family
+# as the client network endpoint address family.
+# See RFC 5389 and RFC 5766 for the description of ALTERNATE-SERVER functionality.
+# The client must use the obtained value for subsequent TURN communications.
+# If more than one --alternate-server option is provided, then the functionality
+# can be more accurately described as "load-balancing" than a mere "redirection".
+# If the port number is omitted, then the default port
+# number 3478 for the UDP/TCP protocols will be used.
+# Colon (:) characters in IPv6 addresses may conflict with the syntax of
+# the option. To alleviate this conflict, literal IPv6 addresses are enclosed
+# in square brackets in such resource identifiers, for example:
+# [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 .
+# Multiple alternate servers can be set. They will be used in the
+# round-robin manner. All servers in the pool are considered of equal weight and
+# the load will be distributed equally. For example, if you have 4 alternate servers,
+# then each server will receive 25% of ALLOCATE requests. A alternate TURN server
+# address can be used more than one time with the alternate-server option, so this
+# can emulate "weighting" of the servers.
+#
+# Examples:
+#alternate-server=1.2.3.4:5678
+#alternate-server=11.22.33.44:56789
+#alternate-server=5.6.7.8
+#alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
+
+# Option to set alternative server for TLS & DTLS services in form of
+# <ip>:<port>. If the port number is omitted, then the default port
+# number 5349 for the TLS/DTLS protocols will be used. See the previous
+# option for the functionality description.
+#
+# Examples:
+#tls-alternate-server=1.2.3.4:5678
+#tls-alternate-server=11.22.33.44:56789
+#tls-alternate-server=[2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478
+
+# Option to suppress TURN functionality, only STUN requests will be processed.
+# Run as STUN server only, all TURN requests will be ignored.
+# By default, this option is NOT set.
+#
+#stun-only
+
+# Option to hide software version. Enhance security when used in production.
+# Revealing the specific software version of the agent through the
+# SOFTWARE attribute might allow them to become more vulnerable to
+# attacks against software that is known to contain security holes.
+# Implementers SHOULD make usage of the SOFTWARE attribute a
+# configurable option (https://tools.ietf.org/html/rfc5389#section-16.1.2)
+#
+no-software-attribute
+
+# Option to suppress STUN functionality, only TURN requests will be processed.
+# Run as TURN server only, all STUN requests will be ignored.
+# By default, this option is NOT set.
+#
+#no-stun
+
+# This is the timestamp/username separator symbol (character) in TURN REST API.
+# The default value is ':'.
+# rest-api-separator=:
+
+# Flag that can be used to allow peers on the loopback addresses (127.x.x.x and ::1).
+# This is an extra security measure.
+#
+# (To avoid any security issue that allowing loopback access may raise,
+# the no-loopback-peers option is replaced by allow-loopback-peers.)
+#
+# Allow it only for testing in a development environment!
+# In production it adds a possible security vulnerability, so for security reasons
+# it is not allowed using it together with empty cli-password.
+#
+#allow-loopback-peers
+
+# Flag that can be used to disallow peers on well-known broadcast addresses (224.0.0.0 and above, and FFXX:*).
+# This is an extra security measure.
+#
+#no-multicast-peers
+
+# Option to set the max time, in seconds, allowed for full allocation establishment.
+# Default is 60 seconds.
+#
+#max-allocate-timeout=60
+
+# Option to allow or ban specific ip addresses or ranges of ip addresses.
+# If an ip address is specified as both allowed and denied, then the ip address is
+# considered to be allowed. This is useful when you wish to ban a range of ip
+# addresses, except for a few specific ips within that range.
+#
+# This can be used when you do not want users of the turn server to be able to access
+# machines reachable by the turn server, but would otherwise be unreachable from the
+# internet (e.g. when the turn server is sitting behind a NAT)
+#
+# Examples:
+# denied-peer-ip=83.166.64.0-83.166.95.255
+# allowed-peer-ip=83.166.68.45
+
+# File name to store the pid of the process.
+# Default is /var/run/turnserver.pid (if superuser account is used) or
+# /var/tmp/turnserver.pid .
+#
+pidfile="/var/tmp/turnserver.pid"
+
+# Require authentication of the STUN Binding request.
+# By default, the clients are allowed anonymous access to the STUN Binding functionality.
+#
+#secure-stun
+
+# Mobility with ICE (MICE) specs support.
+#
+#mobility
+
+# Allocate Address Family according
+# If enabled then TURN server allocates address family according  the TURN
+# Client <=> Server communication address family.
+# (By default Coturn works according RFC 6156.)
+# !!Warning: Enabling this option breaks RFC6156 section-4.2 (violates use default IPv4)!!
+#
+#keep-address-family
+
+
+# User name to run the process. After the initialization, the turnserver process
+# will attempt to change the current user ID to that user.
+#
+#proc-user=<user-name>
+
+# Group name to run the process. After the initialization, the turnserver process
+# will attempt to change the current group ID to that group.
+#
+#proc-group=<group-name>
+
+# Turn OFF the CLI support.
+# By default it is always ON.
+# See also options cli-ip and cli-port.
+#
+no-cli
+
+#Local system IP address to be used for CLI server endpoint. Default value
+# is 127.0.0.1.
+#
+# cli-ip=127.0.0.1
+
+# CLI server port. Default is 5766.
+#
+# cli-port=5766
+
+# CLI access password. Default is empty (no password).
+# For the security reasons, it is recommended that you use the encrypted
+# form of the password (see the -P command in the turnadmin utility).
+#
+# Secure form for password 'qwerty':
+#
+#cli-password=$5$79a316b350311570$81df9cfb9af7f5e5a76eada31e7097b663a0670f99a3c07ded3f1c8e59c5658a
+#
+# Or insecure form for the same password:
+#
+# cli-password=CHANGE_ME
+
+# Enable Web-admin support on https. By default it is Disabled.
+# If it is enabled it also enables a http a simple static banner page
+# with a small reminder that the admin page is available only on https.
+#
+#web-admin
+
+# Local system IP address to be used for Web-admin server endpoint. Default value is 127.0.0.1.
+#
+#web-admin-ip=127.0.0.1
+
+# Web-admin server port. Default is 8080.
+#
+#web-admin-port=8080
+
+# Web-admin server listen on STUN/TURN worker threads
+# By default it is disabled for security reasons! (Not recommended in any production environment!)
+#
+#web-admin-listen-on-workers
+
+# Server relay. NON-STANDARD AND DANGEROUS OPTION.
+# Only for those applications when you want to run
+# server applications on the relay endpoints.
+# This option eliminates the IP permissions check on
+# the packets incoming to the relay endpoints.
+#
+#server-relay
+
+# Maximum number of output sessions in ps CLI command.
+# This value can be changed on-the-fly in CLI. The default value is 256.
+#
+#cli-max-output-sessions
+
+# Set network engine type for the process (for internal purposes).
+#
+#ne=[1|2|3]
+
+# Do not allow an TLS/DTLS version of protocol
+#
+#no-tlsv1
+#no-tlsv1_1
+#no-tlsv1_2
@@ -0,0 +1,19 @@
+{% set vault_addr = 'https://vault.trez.wtf' %}
+{% set secrets_path = 'rinoa-docker/env' %}
+
+{
+  "$schema": "../schemas/v2/index.json",
+  "repos": [
+      {
+          "type": "gitea",
+          "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}",
+          "url": "https://git.trez.wtf",
+          "revisions": {
+              "branches": [
+                  "main",
+                  "*"
+              ]
+          }
+      }
+  ]
+}
@@ -22,6 +22,16 @@ services:
      # See all options and more details at https://actualbudget.github.io/docs/Installing/Configuration
      # !! If you are not using any of these options, remove the 'environment:' tag entirely.
    image: docker.io/actualbudget/actual-server:latest
+    labels:
+      swag: enable
+      swag_port: 5006
+      swag_proto: http
+      swag_url: fin.${MY_TLD}
+      homepage.group: Lifestyle
+      homepage.name: Actual Budget
+      homepage.icon: actual-budget.svg
+      homepage.href: https://fin.${MY_TLD}
+      homepage.description: Privacy-focused app for managing finances
    ports:
      - 5006:5006
    restart: unless-stopped
@@ -30,7 +40,7 @@ services:
  adguard:
    container_name: adguard
    environment:
-      TZ: America/New_York
+      TZ: ${TZ}
    hostname: Rinoa
    image: adguard/adguardhome:latest
    labels:
@@ -215,6 +225,13 @@ services:
        type: bind
  authelia:
    container_name: authelia
+    depends_on:
+      authelia-pg:
+        condition: service_started
+        required: true
+      lldap:
+        condition: service_started
+        required: true
    environment:
      AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD: ${AUTHELIA_AUTH_BIND_LDAP_PASSWORD}
      AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET}
@@ -254,9 +271,9 @@ services:
  authelia-pg:
    container_name: authelia-pg
    environment:
-      - POSTGRES_PASSWORD=${AUTHELIA_STORAGE_POSTGRES_PASSWORD}
-      - POSTGRES_USER=authelia
-      - POSTGRES_DB=authelia
+      POSTGRES_PASSWORD: ${AUTHELIA_STORAGE_POSTGRES_PASSWORD}
+      POSTGRES_USER: authelia
+      POSTGRES_DB: authelia
    expose:
      - 5432
    image: postgres:16-alpine
@@ -272,10 +289,10 @@ services:
  bazarr:
    container_name: bazarr
    environment:
-      - PGID=1000
-      - PUID=1000
-      - TZ=America/New_York
-      - DOCKER_MODS=ghcr.io/gilbn/theme.park:bazarr
+      PGID: ${PGID}
+      PUID: ${PUID}
+      TZ: ${TZ}
+      DOCKER_MODS: ghcr.io/gilbn/theme.park:bazarr
    hostname: Rinoa
    image: lscr.io/linuxserver/bazarr:latest
    labels:
@@ -506,11 +523,13 @@ services:
  bunkerweb:
    container_name: bunkerweb
    environment:
-      SERVER_NAME: www.trez.wtf
      API_WHITELIST_IP: 172.18.0.0/16 192.168.1.0/24
-      USE_REAL_IP: yes
      REAL_IP_FROM: 172.18.0.0/16
      REAL_IP_HEADER: X-Forwarded-For
+      REVERSE_PROXY_HOST: http://swag:80
+      SERVER_NAME: bunker.trez.wtf
+      USE_REAL_IP: yes
+      USE_REVERSE_PROXY: yes
    expose:
      - 8080
      - 8443
@@ -532,8 +551,13 @@ services:
  bunkerweb-ui:
    container_name: bunkerweb-ui
    depends_on:
-      - bunkerweb
-      - docker-socket-proxy
+      bunkerweb:
+        condition: service_started
+        required: true
+        restart: true
+      docker-socket-proxy:
+        condition: service_started
+        required: true
    environment:
      DOCKER_HOST: tcp://dockerproxy:2375
    expose:
@@ -541,9 +565,9 @@ services:
    image: bunkerity/bunkerweb-ui:latest
    labels:
      homepage.group: Privacy/Security
-      homepage.name: Bunkerweb
+      homepage.name: Bunker Web
      homepage.href: https://bunker.${MY_TLD}
-      homepage.icon: bunker.svg
+      homepage.icon: bunkerweb.svg
      homepage.description: Next-gen WAF
      swag: enable
      swag_port: 7000
@@ -824,6 +848,162 @@ services:
        type: volume
        bind:
          create_host_path: true
+  dbgate:
+    container_name: dbgate
+    environment:
+      CONNECTIONS: authelia-pg,bitmagnet-pg-db,gitea-db,invidious-db,joplin-db,lobe-chat-pg-db,mariadb,mastodon-pg-db,mongodb,netbox-db,pgbackweb,pgbackweb-db,plausible-db,plausible-events-db,reactive-resume-pg,sonarqube-pg-db,synapse-db,tandoor-pg,traccar-pg,whodb,zitadel-pg-db
+
+      LOGIN: TrezOne
+      PASSWORD: ${DBGATE_LOGIN_PASSWORD}
+
+      LABEL_mariadb: mariadb
+      SERVER_mariadb: mariadb
+      USER_mariadb: root
+      PASSWORD_mariadb: ${MARIADB_ENVIRONMENT_MYSQL_ROOT_PASSWORD}
+      PORT_mariadb: 3306
+      ENGINE_mariadb: mariadb@dbgate-plugin-mysql
+
+      LABEL_authelia-pg: authelia-pg
+      SERVER_authelia-pg: authelia-pg
+      USER_authelia-pg: authelia
+      DATABASE_authelia-pg: authelia
+      PASSWORD_authelia-pg: ${BITMAGNET_POSTGRESQL_PASSWORD}
+      PORT_authelia-pg: 5432
+      ENGINE_authelia-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_bitmagnet-pg-db: bitmagnet-pg-db
+      SERVER_bitmagnet-pg-db: bitmagnet-pg-db
+      USER_bitmagnet-pg-db: bitmagnet-pg
+      DATABASE_bitmagnet-pg-db: bitmagnet
+      PASSWORD_bitmagnet-pg-db: ${BITMAGNET_POSTGRESQL_PASSWORD}
+      PORT_bitmagnet-pg-db: 5432
+      ENGINE_bitmagnet-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_gitea-db: gitea-db
+      SERVER_gitea-db: gitea-db
+      USER_gitea-db: gitea
+      PASSWORD_gitea-db: ${GITEA_PG_DB_PASSWORD}
+      DATABASE_gitea-db: gitea
+      PORT_gitea-db: 5432
+      ENGINE_gitea-db: postgres@dbgate-plugin-postgres
+
+      LABEL_invidious-db: invidious-db
+      SERVER_invidious-db: invidious-db
+      USER_invidious-db: kemal
+      PASSWORD_invidious-db: ${INVID_PG_DB_PASSWORD}
+      PORT_invidious-db: 5432
+      DATABASE_invidious-db: invidious
+      ENGINE_invidious-db: postgres@dbgate-plugin-postgres
+
+      LABEL_joplin-db: joplin-db
+      SERVER_joplin-db: joplin-db
+      USER_joplin-db: ${JOPLIN_POSTGRES_USER}
+      PASSWORD_joplin-db: ${JOPLIN_POSTGRES_DATABASE}
+      DATABASE_joplin-db: joplin
+      PORT_joplin-db: 5432
+      ENGINE_joplin-db: postgres@dbgate-plugin-postgres
+
+      LABEL_lobe-chat-pg-db: lobe-chat-pg-db
+      SERVER_lobe-chat-pg-db: lobe-chat-pg-db
+      USER_lobe-chat-pg-db: lobe
+      PASSWORD_lobe-chat-pg-db: ${GITEA_PG_DB_PASSWORD}
+      DATABASE_lobe-chat-pg-db: lobe
+      PORT_lobe-chat-pg-db: 5432
+      ENGINE_lobe-chat-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_mastodon-pg-db: mastodon-pg-db
+      SERVER_mastodon-pg-db: mastodon-pg-db
+      USER_mastodon-pg-db: mastodon
+      PASSWORD_mastodon-pg-db: ${MASTODON_PG_DB_PASSWORD}
+      DATABASE_mastodon-pg-db: mastodon
+      PORT_mastodon-pg-db: 5432
+      ENGINE_mastodon-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_mongodb: mongodb
+      URI_mongodb: mongodb://mongodb:27017
+      ENGINE_mongodb: mongo@dbgate-plugin-mongo
+
+      LABEL_netbox-db: netbox-db
+      SERVER_netbox-db: netbox-db
+      USER_netbox-db: netbox
+      PASSWORD_netbox-db: ${NETBOX_PG_DB_PASSWORD}
+      PORT_netbox-db: 5432
+      DATABASE_netbox-db: netbox
+      ENGINE_netbox-db: postgres@dbgate-plugin-postgres
+
+      LABEL_pgbackweb-db: pgbackweb-db
+      SERVER_pgbackweb-db: pgbackweb-db
+      USER_pgbackweb-db: pgbackweb
+      PASSWORD_pgbackweb-db: ${PGBACKWEB_PG_DB_PASSWD}
+      PORT_pgbackweb-db: 5432
+      ENGINE_pgbackweb-db: postgres@dbgate-plugin-postgres
+
+      LABEL_plausible-db: plausible-db
+      SERVER_plausible-db: plausible-db
+      USER_plausible-db: plausible
+      PASSWORD_plausible-db: ${PLAUSIBLE_PG_PASSWORD}
+      PORT_plausible-db: 5432
+      ENGINE_plausible-db: postgres@dbgate-plugin-postgres
+
+      LABEL_reactive-resume-pg: reactive-resume-pg
+      SERVER_reactive-resume-pg: reactive-resume-pg
+      USER_reactive-resume-pg: reactiveresume
+      PASSWORD_reactive-resume-pg: ${REACTIVE_RESUME_PGSQL_PASSWORD}
+      PORT_reactive-resume-pg: 5432
+      ENGINE_reactive-resume-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_sonarqube-pg-db: sonarqube-pg-db
+      SERVER_sonarqube-pg-db: sonarqube-pg-db
+      USER_sonarqube-pg-db: sonar
+      PASSWORD_sonarqube-pg-db: ${SONARQUBE_POSTGRES_PASSWORD}
+      PORT_sonarqube-pg-db: 5432
+      ENGINE_sonarqube-pg-db: postgres@dbgate-plugin-postgres
+
+      LABEL_synapse-db: synapse-db
+      SERVER_synapse-db: synapse-db
+      USER_synapse-db: synapse
+      PASSWORD_synapse-db: ${SYNAPSE_POSTGRES_PASSWORD}
+      PORT_synapse-db: 5432
+      ENGINE_synapse-db: postgres@dbgate-plugin-postgres
+
+      LABEL_tandoor-pg: tandoor-pg
+      SERVER_tandoor-pg: tandoor-pg
+      USER_tandoor-pg: tandoor
+      PASSWORD_tandoor-pg: ${TANDOOR_POSTGRES_PASSWORD}
+      PORT_tandoor-pg: 5432
+      ENGINE_tandoor-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_traccar-pg: traccar-pg
+      SERVER_traccar-pg: traccar-pg
+      USER_traccar-pg: ${TRACCAR_POSTGRES_USER}
+      PASSWORD_traccar-pg: ${TRACCAR_POSTGRES_PASSWORD}
+      PORT_traccar-pg: 5432
+      ENGINE_traccar-pg: postgres@dbgate-plugin-postgres
+
+      LABEL_zitadel-pg-db: zitadel-pg-db
+      SERVER_zitadel-pg-db: zitadel-pg-db
+      USER_zitadel-pg-db: root
+      PASSWORD_zitadel-pg-db: ${ZITADEL_DB_ADMIN_PASSWORD}
+      PORT_zitadel-pg-db: 5432
+      ENGINE_zitadel-pg-db: postgres@dbgate-plugin-postgres
+    image: dbgate/dbgate:alpine
+    labels:
+      homepage.group: System Administration
+      homepage.name: DbGate
+      homepage.href: https://dbs.${MY_TLD}
+      homepage.icon: sh-dbgate.png
+      homepage.description: Cross-platform database manager
+      swag: enable
+      swag_port: 3000
+      swag_proto: http
+      swag_url: dbs.${MY_TLD}
+      swag.uptime-kuma.enabled: true
+      swag.uptime-kuma.monitor.url: https://dbs.${MY_TLD}
+    ports:
+      - 49054:3000
+    restart: unless-stopped
+    volumes:
+      - dbgate-data:/root/.dbgate
  delugevpn:
    cap_add:
      - NET_ADMIN
@@ -1204,9 +1384,9 @@ services:
  gitea-db:
    container_name: gitea-db
    environment:
-      - POSTGRES_USER=gitea
-      - POSTGRES_PASSWORD=${GITEA_PG_DB_PASSWORD}
-      - POSTGRES_DB=gitea
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: ${GITEA_PG_DB_PASSWORD}
+      POSTGRES_DB: gitea
    expose:
      - 5432
    healthcheck:
@@ -1444,7 +1624,7 @@ services:
    command: run --disable-reporting=true --stability.level=public-preview --server.http.listen-addr=0.0.0.0:12345 /etc/alloy/config.alloy
    container_name: grafana-alloy
    environment:
-      - DOCKER_HOST=tcp://dockerproxy:2375
+      DOCKER_HOST: tcp://dockerproxy:2375
    image: grafana/alloy:latest
    labels:
      homepage.group: Infrastructure/App Performance Monitoring
@@ -1917,22 +2097,22 @@ services:
        target: 8003
    restart: always
    volumes:
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/app/public
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/app/public
        target: /var/www/app/public
        type: bind
        bind:
          create_host_path: true
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/app/storage
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/app/storage
        target: /var/www/app/storage
        type: bind
        bind:
          create_host_path: true
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/php/php.ini
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/php/php.ini
        target: /usr/local/etc/php/php.ini
        type: bind
        bind:
          create_host_path: true
-      - source: ${DOCKER_VOLUME_CONFIG}/invoice_ninja/php/php-cli.ini
+      - source: ${DOCKER_VOLUME_CONFIG}/invoice-ninja/php/php-cli.ini
        target: /usr/local/etc/php/php-cli.ini
        type: bind
        bind:
@@ -1981,7 +2161,7 @@ services:
      homepage.group: Professional Services
      homepage.name: Invoice Ninja
      homepage.href: https://biz.${MY_TLD}
-      homepage.icon: invoiceninja.svg
+      homepage.icon: invoice-ninja.svg
      homepage.description: Simple invoicing, multiple payment options, expense and vendor management, and more!
    networks:
      default: null
@@ -2630,9 +2810,9 @@ services:
  joplin-db:
    container_name: joplin-db
    environment:
-      - POSTGRES_PASSWORD=${JOPLIN_POSTGRES_PASSWORD}
-      - POSTGRES_USER=${JOPLIN_POSTGRES_USER}
-      - POSTGRES_DB=${JOPLIN_POSTGRES_DATABASE}
+      POSTGRES_PASSWORD: ${JOPLIN_POSTGRES_PASSWORD}
+      POSTGRES_USER: ${JOPLIN_POSTGRES_USER}
+      POSTGRES_DB: ${JOPLIN_POSTGRES_DATABASE}
    expose:
      - 5432
    image: postgres:17-alpine
@@ -2688,8 +2868,8 @@ services:
  lidarr:
    container_name: lidarr
    environment:
-      PGID: 1000
-      PUID: 1000
+      PGID: ${PGID}
+      PUID: ${PUID}
      TZ: America/New_York
      DOCKER_MODS: ghcr.io/gilbn/theme.park:lidarr
    hostname: Rinoa
@@ -2822,44 +3002,66 @@ services:
        type: bind
        bind:
          create_host_path: true
-  localai:
-    container_name: localai
+  lobe-chat:
+    container_name: lobe-chat
+    depends_on:
+      lobe-chat-pg-db:
+        condition: service_started
+        required: true
+      minio:
+        condition: service_started
+        required: true
+      zitadel:
+        condition: service_started
+        required: true
    environment:
-      - DEBUG=true
-    healthcheck:
-      interval: 1m
-      retries: 5
-      test:
-        - CMD
-        - curl
-        - -f
-        - http://localhost:8080/readyz
-      timeout: 20m
-    image: localai/localai:latest-aio-cpu
+      APP_URL: https://ai.trez.wtf/
+      KEY_VAULTS_SECRET: ${LOBECHAT_KEY_VAULT_SECRET}
+      DATABASE_URL: postgresql://lobe:${LOBECHAT_PG_DB_PASSWD}@lobe-chat-pg-db:5432/lobe
+      NEXTAUTH_URL: https://lobe.example.com/api/auth
+      NEXT_AUTH_SECRET: ${LOBECHAT_NEXT_AUTH_SECRET}
+      NEXT_AUTH_SSO_PROVIDERS: zitadel
+      AUTH_ZITADEL_ID: ${LOBECHAT_ZITADEL_CLIENT_ID}
+      AUTH_ZITADEL_SECRET: ${LOBECHAT_ZITADEL_CLIENT_SECRET}
+      AUTH_ZITADEL_ISSUER: https://id.trez.wtf
+      S3_ACCESS_KEY_ID: ${LOBECHAT_S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${LOBECHAT_S3_SECRET_ACCESS_KEY}
+      S3_ENDPOINT: http://minio:9000
+      S3_BUCKET: lobechat
+      S3_PUBLIC_DOMAIN: https://s3.trez.wtf
+      S3_ENABLE_PATH_STYLE: 1+
+      OPENAI_API_KEY: ${LOBECHAT_OPENAI_API_KEY}
+      ANTHROPIC_API_KEY: ${LOBECHAT_ANTHROPIC_API_KEY}
+      GITHUB_TOKEN: ${LOBECHAT_GITHUB_TOKEN}
+      OLLAMA_MODEL_LIST: +llama3.1:8b,+nomic-embed-text:latest,+starcoder2:3b,+llama3.1:latest,+llama2:7B
+      MISTRAL_API_KEY: ${LOBECHAT_MISTRAL_API_KEY}
+      GROQ_API_KEY: ${LOBECHAT_GROQAI_API_KEY}
+    image: lobehub/lobe-chat-database
    labels:
      homepage.group: Personal Services
-      homepage.name: LocalAI
+      homepage.name: LobeChat
      homepage.href: https://ai.${MY_TLD}
-      homepage.icon: /icons/localai.png
-      homepage.description: Open source OpenAI alternative
+      homepage.icon: lobe-chat.png
+      homepage.description: An open-source, modern-design ChatGPT/LLMs UI/Framework
      swag: enable
      swag_proto: http
-      swag_port: 8080
+      swag_port: 3210
      swag_url: ai.${MY_TLD}
-    networks:
-      default: null
    ports:
-      - mode: ingress
-        protocol: tcp
-        published: "8109"
-        target: 8080
-    restart: always
+      - 3210:3210
+    restart: unless-stopped
+  lobe-chat-pg-db:
+    container_name: lobe-chat-pg-db
+    environment:
+      POSTGRES_DB: lobe
+      POSTGRES_USER: lobe
+      POSTGRES_PASSWORD: ${LOBECHAT_PG_DB_PASSWD}
+    expose:
+      - 5432
+    image: pgvector/pgvector:pg16
    volumes:
-      - source: ${DOCKER_VOLUME_CONFIG}/localai/models
-        target: /build/models
-        type: bind
-        bind:
-          create_host_path: true
+      - ${DOCKER_VOLUME_CONFIG}/lobechat/db:/var/lib/postgresql/data
+    restart: unless-stopped
  maloja:
    container_name: maloja
    environment:
@@ -3192,6 +3394,123 @@ services:
        type: bind
        bind:
          create_host_path: true
+  netbird-dashboard:
+    container_name: netbird-dashboard
+    environment:
+      # Endpoints
+      NETBIRD_MGMT_API_ENDPOINT: https://netbird.${MY_TLD}:33073
+      NETBIRD_MGMT_GRPC_API_ENDPOINT: https://netbird.${MY_TLD}:33073
+      # OIDC
+      AUTH_AUDIENCE: ${NETBIRD_ZITADEL_CLIENT_ID}
+      AUTH_CLIENT_ID: ${NETBIRD_ZITADEL_CLIENT_ID}
+      AUTH_CLIENT_SECRET: ${NETBIRD_ZITADEL_CLIENT_SECRET}
+      AUTH_AUTHORITY: https://id.${MY_TLD}
+      USE_AUTH0: false
+      AUTH_SUPPORTED_SCOPES: openid profile email offline_access api
+      AUTH_REDIRECT_URI: /auth
+      AUTH_SILENT_REDIRECT_URI: /silent-auth
+      NETBIRD_TOKEN_SOURCE: accessToken
+      # SSL
+      NGINX_SSL_PORT: 443
+      # Letsencrypt
+      LETSENCRYPT_DOMAIN:
+      LETSENCRYPT_EMAIL:
+    image: netbirdio/dashboard:latest
+    labels:
+      homepage.group: Privacy/Security
+      homepage.name: Netbird
+      homepage.href: https://netbird.${MY_TLD}
+      homepage.icon: netbird.svg
+      homepage.description: Peer-to-peer private network and centralized access control system
+      swag: enable
+      swag_proto: http
+      swag_port: 80
+      swag_auth: authelia
+      swag_url: netbird.${MY_TLD}
+      swag_server_custom_directive: |
+        location /signalexchange.SignalExchange/ {
+            grpc_pass grpc://netbird-signal:80;
+            #grpc_ssl_verify off;
+            grpc_read_timeout 1d;
+            grpc_send_timeout 1d;
+            grpc_socket_keepalive on;
+        }
+        # Proxy Management http endpoint
+        location /api {
+            proxy_pass http://netbird-management:443;
+        }
+        # Proxy Management grpc endpoint
+        location /management.ManagementService/ {
+            grpc_pass grpc://netbird-management:443;
+            #grpc_ssl_verify off;
+            grpc_read_timeout 1d;
+            grpc_send_timeout 1d;
+            grpc_socket_keepalive on;
+        }
+      swag.uptime-kuma.enabled: true
+      swag.uptime-kuma.monitor.url: https://netbird.${MY_TLD}
+    ports:
+      - 32908:80
+      - 36610:443
+    restart: unless-stopped
+    volumes:
+      - netbird-letsencrypt:/etc/letsencrypt/
+  netbird-signal:
+    container_name: netbird-signal
+    image: netbirdio/signal:latest
+    ports:
+      - 10001:80
+    restart: unless-stopped
+    volumes:
+      - netbird-signal:/var/lib/netbird
+  netbird-relay:
+    container_name: netbird-relay
+    image: netbirdio/relay:latest
+    restart: unless-stopped
+    environment:
+      NB_LOG_LEVEL: info
+      NB_LISTEN_ADDRESS: :33080
+      NB_EXPOSED_ADDRESS: netbird.${MY_TLD}:33080
+      # todo: change to a secure secret
+      NB_AUTH_SECRET: ${NETBIRD_RELAY_AUTH_SECRET}
+    ports:
+      - 33080:33080
+  netbird-management:
+    command: [
+      "--port", "443",
+      "--log-file", "console",
+      "--log-level", "info",
+      "--disable-anonymous-metrics=false",
+      "--single-account-mode-domain=netbird.${MY_TLD}",
+      "--dns-domain=netbird.selfhosted"
+      ]
+    container_name: netbird-management
+    depends_on:
+      netbird-dashboard:
+        condition: service_started
+    environment:
+      NETBIRD_STORE_ENGINE_POSTGRES_DSN:
+      NETBIRD_STORE_ENGINE_MYSQL_DSN:
+    image: netbirdio/management:latest
+    restart: unless-stopped
+    volumes:
+      - netbird-mgmt:/var/lib/netbird
+      - netbird-letsencrypt:/etc/letsencrypt:ro
+      - ${DOCKER_VOLUME_CONFIG}/netbird/management.json:/etc/netbird/management.json
+    ports:
+      - 33073:443 #API port
+  netbird-coturn:
+    command:
+      - -c /etc/turnserver.conf
+    container_name: netbird-coturn
+    image: coturn/coturn:latest
+    restart: unless-stopped
+    #domainname: netbird.${MY_TLD} # only needed when TLS is enabled
+    volumes:
+      - ${DOCKER_VOLUME_CONFIG}/netbird/turnserver.conf:/etc/turnserver.conf:ro
+    #      - ${DOCKER_VOLUME_CONFIG}/netbird/privkey.pem:/etc/coturn/private/privkey.pem:ro
+    #      - ${DOCKER_VOLUME_CONFIG}/netbird/cert.pem:/etc/coturn/certs/cert.pem:ro
+    network_mode: host
  netbox:
    container_name: netbox
    depends_on:
@@ -3263,9 +3582,9 @@ services:
        required: true
        restart: true
    environment:
-      PGID: 1000
-      PUID: 1000
-      TZ: America/New_York
+      PGID: ${PGID}
+      PUID: ${PUID}
+      TZ: ${TZ}
      LOG_LEVEL: debug
    hostname: Rinoa
    image: lscr.io/linuxserver/nextcloud:latest
@@ -3331,8 +3650,8 @@ services:
  ombi:
    container_name: ombi
    environment:
-      PGID: "1000"
-      PUID: "1000"
+      PGID: ${PGID}
+      PUID: ${PUID}
      TZ: America/New_York
    hostname: Rinoa
    image: lscr.io/linuxserver/ombi:latest
@@ -3445,7 +3764,7 @@ services:
    image: eduardolat/pgbackweb:latest
    labels:
      homepage.group: System Administration
-      homepage.name: PGBackweb
+      homepage.name: PG Back Web
      homepage.href: https://pg.${MY_TLD}
      homepage.icon: sh-pg-back-web.svg
      homepage.description: Backups for PostgreSQL
@@ -3455,6 +3774,7 @@ services:
      swag_url: pg.${MY_TLD}
    ports:
      - "8085:8085" # Access the web interface at http://localhost:8085
+    restart: unless-stopped
  pgbackweb-db:
    container_name: pgbackweb-db
    environment:
@@ -3469,6 +3789,7 @@ services:
      timeout: 5s
      retries: 5
    image: postgres:16-alpine
+    restart: unless-stopped
    volumes:
      - pgbackweb-data:/var/lib/postgresql/data
  plantuml-server:
@@ -3622,8 +3943,8 @@ services:
  prowlarr:
    container_name: prowlarr
    environment:
-      PGID: 1000
-      PUID: 1000
+      PGID: ${PGID}
+      PUID: ${PUID}
      TZ: America/New_York
      DOCKER_MODS: ghcr.io/gilbn/theme.park:sonarr
      TP_DOMAIN: trez.wtf\/themepark
@@ -3724,9 +4045,9 @@ services:
  radarr:
    container_name: radarr
    environment:
-      PGID: "1000"
-      PUID: "1000"
-      TZ: America/New_York
+      PGID: ${PGID}
+      PUID: ${PUID}
+      TZ: ${TZ}
    hostname: Rinoa
    image: lscr.io/linuxserver/radarr:latest
    labels:
@@ -3837,8 +4158,8 @@ services:
  readarr:
    container_name: readarr
    environment:
-      PGID: 1000
-      PUID: 1000
+      PGID: ${PGID}
+      PUID: ${PUID}
      TZ: America/New_York
      DOCKER_MODS: ghcr.io/gilbn/theme.park:readnarr
    hostname: Rinoa
@@ -4281,7 +4602,7 @@ services:
    read_only: true
    restart: unless-stopped
  sonarqube-pg-db:
-    container_name: sonarqube-pg-db    
+    container_name: sonarqube-pg-db
    environment:
      POSTGRES_USER: sonar
      POSTGRES_PASSWORD: ${SONARQUBE_POSTGRES_PASSWORD}
@@ -4299,9 +4620,9 @@ services:
  sonarr:
    container_name: sonarr
    environment:
-      PGID: 1000
-      PUID: 1000
-      TZ: America/New_York
+      PGID: ${PGID}
+      PUID: ${PUID}
+      TZ: ${TZ}
      DOCKER_MODS: ghcr.io/gilbn/theme.park:sonarr
    hostname: Rinoa
    image: lscr.io/linuxserver/sonarr:latest
@@ -4431,7 +4752,7 @@ services:
      homepage.group: Downloaders
      homepage.description: Modern client-server application for the Soulseek file-sharing network.
      homepage.href: https://slsk.${MY_TLD}
-      homepage.icon: /icons/slskd.png
+      homepage.icon: slskd.svg
      swag: enable
      swag_proto: http
      swag_url: slsk.${MY_TLD}
@@ -4452,6 +4773,28 @@ services:
        type: bind
        bind:
          create_host_path: true
+  sourcebot:
+    container_name: sourcebot
+    environment:
+      CONFIG_PATH: /data/config.json
+    image: ghcr.io/sourcebot-dev/sourcebot:latest
+    labels:
+      homepage.name: Sourcebot
+      homepage.group: Code/DevOps
+      homepage.description: Self-hosted internet performance tracking
+      homepage.href: https://source.${MY_TLD}
+      homepage.icon: /icons/sourcebot.png
+      swag: enable
+      swag_proto: http
+      swag_port: 3000
+      swag_url: source.${MY_TLD}
+      swag.uptime-kuma.enabled: true
+      swag.uptime-kuma.monitor.url: https://source.${MY_TLD}
+    ports:
+        - 45251:3000
+    restart: unless-stopped
+    volumes:
+      - ${DOCKER_VOLUME_CONFIG}/sourcebot:/data
  speedtest-tracker:
    container_name: speedtest-tracker
    image: lscr.io/linuxserver/speedtest-tracker:latest
@@ -4460,8 +4803,9 @@ services:
        PGID: ${PGID}
        APP_KEY: ${SPEEDTEST_TRACKER_APP_KEY}
        DB_CONNECTION: sqlite
+        SPEEDTEST_SCHEDULE: 15 */3 * * *
    labels:
-      homepage.name: Speedtest Traccker
+      homepage.name: Speedtest Tracker
      homepage.group: System Administration
      homepage.description: Self-hosted internet performance tracking
      homepage.href: https://speed.${MY_TLD}
@@ -4592,7 +4936,7 @@ services:
      swag_url: matrix.${MY_TLD}
      swag_port: 8008
      swag.uptime-kuma.enabled: true
-      swag.uptime-kuma.monitor.url: https://matrix.${MY_TLD}  
+      swag.uptime-kuma.monitor.url: https://matrix.${MY_TLD}
    ports:
      - 19345:8008
      - 8448:8448/tcp
@@ -5982,8 +6326,8 @@ services:
  uptimekuma:
    container_name: uptimekuma
    environment:
-      PGID: 1000
-      PUID: 1000
+      PGID: ${PGID}
+      PUID: ${PUID}
      TZ: America/New_York
      UPTIME_KUMA_USERNAME: ${UPTIME_KUMA_USERNAME}
      UPTIME_KUMA_PASSWORD: ${UPTIME_KUMA_PASSWORD}
@@ -6239,7 +6583,7 @@ services:
      homepage.group: Privacy/Security
      homepage.name: Wazuh
      homepage.href: https://wsec.${MY_TLD}
-      homepage.icon: wazuh-opaque.png
+      homepage.icon: wazuh.svg
      homepage.description: OSS Security Platform for XDR/SIEM
    links:
      - wazuh.indexer:wazuh.indexer
@@ -6289,7 +6633,7 @@ services:
  wazuh.indexer:
    container_name: wazuh.indexer
    environment:
-      - OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m
+      OPENSEARCH_JAVA_OPTS: -Xms512m -Xmx512m
    hostname: wazuh.indexer
    image: wazuh/wazuh-indexer:${WAZUH_VERSION}
    networks:
@@ -6476,32 +6820,6 @@ services:
        published: "3010"
        target: 3000
    restart: unless-stopped
-  whodb:
-    container_name: whodb
-    environment:
-      WHODB_MONGODB_1: null
-      WHODB_MYSQL_1: null
-    image: clidey/whodb
-    labels:
-      homepage.group: System Administration
-      homepage.name: WhoDB
-      homepage.href: https://dbs.${MY_TLD}
-      homepage.icon: /icons/whodb.png
-      homepage.description: Web-based DB management
-      swag: enable
-      swag_proto: http
-      swag_port: 8080
-      swag_url: dbs.${MY_TLD}
-      swag.uptime-kuma.enabled: true
-      swag.uptime-kuma.monitor.url: https://dbs.${MY_TLD}
-    networks:
-      default: null
-    ports:
-      - mode: ingress
-        protocol: tcp
-        published: "8900"
-        target: 8080
-    restart: unless-stopped
  yacht:
    container_name: yacht
    depends_on:
@@ -6531,8 +6849,8 @@ services:
  your_spotify:
    container_name: your_spotify
    environment:
-      PUID: 1000
-      PGID: 1000
+      PUID: ${PUID}
+      PGID: ${PGID}
      TZ: ${TZ}
      APP_URL: https://myspotify.${MY_TLD}
      SPOTIFY_PUBLIC: ${YOUR_SPOTIFY_ID}
@@ -6565,8 +6883,8 @@ services:
  youtubedl:
    container_name: youtubedl
    environment:
-      PGID: "1000"
-      PUID: "1000"
+      PGID: ${PGID}
+      PUID: ${PUID}
      TZ: America/New_York
      YDL_CONFIG_PATH: /youtube-dl/config.yml
      YDL_DEBUG: "false"
@@ -6575,7 +6893,7 @@ services:
    labels:
      homepage.group: Downloaders
      homepage.name: YoutubeDL
-      homepage.icon: youtubedl.png
+      homepage.icon: youtube-dl.svg
      homepage.href: https://ytdl.${MY_TLD}
      homepage.description: YouTube Downloader
      swag: enable
@@ -6987,6 +7305,7 @@ services:
      homepage.href: https://id.${MY_TLD}
      homepage.icon: zitadel.svg
      homepage.description: Centralized authentication management
+    restart: unless-stopped
    volumes:
      - ${DOCKER_VOLUME_CONFIG}/zitadel/config.yaml:/config.yaml
      - ${DOCKER_VOLUME_CONFIG}/zitadel/init-steps.yaml:/init-steps.yaml
@@ -7005,7 +7324,7 @@ services:
      retries: 5
      start_period: '20s'
    image: postgres:16-alpine
-    restart: always
+    restart: unless-stopped
    volumes: 
      - zitadel-pg-db:/var/lib/postgresql/data
 volumes:
@@ -7025,6 +7344,8 @@ volumes:
    name: dagu_config
  dagu_data:
    name: dagu_data
+  dbgate-data:
+    name: dbgate-data
  fastenhealth-cache:
    name: fastenhealth-cache
  fastenhealth-db:
@@ -7073,6 +7394,12 @@ volumes:
    name: mongo1_data
  n8n-data:
    name: n8n-data
+  netbird-mgmt:
+    name: netbird-mgmt
+  netbird-signal:
+    name: netbird-signal
+  netbird-letsencrypt:
+    name: netbird-letsencrypt
  netbox-pg-db:
    name: netbox-pg-db
  ollama:
Author	SHA1	Message	Date
Trez.One	0825c61e39	Adding more notifications to pipeline; YAML format fixing for environments key. Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Check and Create PR (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Docker Compose & Ansible Lints (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Cloudflare DNS Setup (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Update README (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / PR Merge (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Deploy via Ansible & Docker Compose (push) Has been cancelled Details	2025-01-23 15:53:49 -05:00
Trez.One	a99ef85ef2	.	2025-01-23 14:38:09 -05:00
Trez.One	bf600a618d	Adding login for DbGate.	2025-01-23 14:21:42 -05:00
gitea-sonarqube-bot	b0cc71e809	Auto Merge of PR 30 - sourcebot-deployment Merged by Trez.One	2025-01-23 13:16:56 -05:00
Trez.One	ffccf913f1	chore: Update README	2025-01-23 18:16:17 +00:00
Trez.One	53bb8c18d8	Adding Sourcebot service. Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Check and Create PR (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Docker Compose & Ansible Lints (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Cloudflare DNS Setup (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Update README (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / PR Merge (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Deploy via Ansible & Docker Compose (push) Has been cancelled Details	2025-01-23 12:52:56 -05:00
gitea-sonarqube-bot	7171a55bbb	Auto Merge of PR 29 - whodb-removal-dbgate-deploy Merged by Trez.One	2025-01-23 10:57:54 -05:00
Trez.One	b683e1814d	chore: Update README	2025-01-23 15:56:55 +00:00
Trez.One	58faa3bda8	Removing Whodb in favor of DbGate; YAML formatting for environments.	2025-01-23 10:25:35 -05:00
gitea-sonarqube-bot	096ae28095	Auto Merge of PR 28 - speedtest-tracker-schedule Merged by Trez.One	2025-01-22 20:17:29 -05:00
Trez.One	93de2b342c	Adding schedule for Speedtest-Tracker. Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Check and Create PR (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Docker Compose & Ansible Lints (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Cloudflare DNS Setup (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Update README (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / PR Merge (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Deploy via Ansible & Docker Compose (push) Has been cancelled Details	2025-01-22 20:07:09 -05:00
Trez.One	cae84dbe3e	Tweaks to Bunker Web.	2025-01-22 17:24:01 -05:00
Trez.One	302f9433e1	Tweaks to Bunker Web.	2025-01-22 17:00:25 -05:00
Trez.One	7bac47af7b	Fixes for LobeChat.	2025-01-22 13:54:25 -05:00
gitea-sonarqube-bot	38171fc963	Auto Merge of PR 27 - lobe-chat-deploy-localai-remove Merged by Trez.One	2025-01-22 12:07:34 -05:00
Trez.One	71c0f97d83	Added labels for LobeChat. Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Check and Create PR (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Docker Compose & Ansible Lints (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Cloudflare DNS Setup (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Update README (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / PR Merge (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Deploy via Ansible & Docker Compose (push) Has been cancelled Details	2025-01-22 11:53:41 -05:00
gitea-sonarqube-bot	9891d538fc	Auto Merge of PR 26 - lobe-chat-deploy-localai-remove Merged by Trez.One	2025-01-22 11:20:51 -05:00
Trez.One	dc0ffbaf88	chore: Update README	2025-01-22 16:19:33 +00:00
Trez.One	9e9e811d37	Removing Komodo config.	2025-01-22 11:00:33 -05:00
Trez.One	8c7d5d66b8	Adding Lobechat service and removing LocalAI.	2025-01-22 09:29:01 -05:00
Trez.One	c7d3d79970	.	2025-01-21 19:24:51 -05:00
Trez.One	0f370b9f8b	Adding paths for workflow trigger.	2025-01-21 19:04:17 -05:00
Trez.One	0e2cbf9f0d	Netbird SWAG fixes.	2025-01-21 18:24:47 -05:00
Trez.One	1439a4e21b	Small Netbird fixes.	2025-01-21 17:44:10 -05:00
gitea-sonarqube-bot	3a6ef8ac63	Auto Merge of PR 25 - netbird-deployment Merged by Trez.One	2025-01-21 17:05:03 -05:00
Trez.One	4a4b7145d5	chore: Update README	2025-01-21 22:04:27 +00:00
Trez.One	2fe527b6f2	Forgot to add volumes. Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Check and Create PR (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Docker Compose & Ansible Lints (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Cloudflare DNS Setup (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Update README (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / PR Merge (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Deploy via Ansible & Docker Compose (push) Has been cancelled Details	2025-01-21 16:55:58 -05:00
Trez.One	44266c9eaa	Adding Netbird service.	2025-01-21 16:40:33 -05:00
Trez.One	157f2590f3	Merge remote-tracking branch 'refs/remotes/origin/main'	2025-01-21 11:14:24 -05:00
Trez.One	b16bd2896a	Vault fixes.	2025-01-21 11:14:11 -05:00
Trez.One	462c6beb4b	Restart policy for Zitadel.	2025-01-21 09:49:25 -05:00
Charish Patel	9d66532199	Added restart policy for PG Back Web.	2025-01-21 09:22:06 -05:00
Trez.One	6d96b79e9f	Minor fixes.	2025-01-20 17:53:30 -05:00
Trez.One	08fb3a86df	Minor fixes.	2025-01-20 17:51:06 -05:00
Trez.One	b6f9e0539e	Minor fixes for some services.	2025-01-20 17:49:02 -05:00
gitea-sonarqube-bot	f93f6999e7	Auto Merge of PR 24 - actual-budget-labels Merged by Trez.One	2025-01-20 17:17:51 -05:00
Trez.One	cbf85ea1cc	Adding labels for Actual budget. Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Check and Create PR (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Docker Compose & Ansible Lints (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Cloudflare DNS Setup (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Update README (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / PR Merge (push) Has been cancelled Details Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment / Deploy via Ansible & Docker Compose (push) Has been cancelled Details	2025-01-20 16:37:06 -05:00
gitea-sonarqube-bot	3c96065889	Auto Merge of PR 23 - plantuml-deployment Merged by Trez.One	2025-01-20 13:36:37 -05:00
Trez.One	7a66ec29df	chore: Update README	2025-01-20 18:36:06 +00:00