chore: Update README

Adding Patchman service.
Auto Merge of PR 136 - dagu-deploy-cronicle-removal_2025-08-08T11-13-25
2025-08-08 17:05:41 +00:00 · 2025-08-08 13:01:28 -04:00 · 2025-08-08 12:14:14 -04:00 · 2025-08-08 16:13:44 +00:00 · 2025-08-08 12:09:36 -04:00 · 2025-08-07 21:14:07 -04:00
15 changed files with 1676 additions and 372 deletions
@@ -8,6 +8,10 @@ on:
      - '**/docker-compose.yml'
      - '**/pr-cloudflare-docker-deploy.yml'
      - '!ansible/**.yml'
+env:
+  FLARECTL_VERSION: '0.115.0'
+  HC_VAULT_VERSION: '1.20.0'
+  TEA_VERSION: '0.10.1'
 jobs:
  check-and-create-pr:
    if: github.ref != 'refs/heads/main'
@@ -22,14 +26,14 @@ jobs:
        id: cache-tea
        uses: actions/cache@v4
        with:
-          path: /opt/hostedtoolcache/tea/0.9.2/x64
-          key: tea-${{ runner.os }}-0.9.2
+          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
+          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
      - name: Install tea
        uses: supplypike/setup-bin@v4
        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
+          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
+          name: tea
+          version: ${{ env.TEA_VERSION }}
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
@@ -110,7 +114,7 @@ jobs:
          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
          echo "$mod_svcs" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
-      - name: Testing service list output
+      - name: List of Services for (Re)Deployment
        run: |
          echo -e "${{ steps.detect_services.outputs.docker_svc_list }}"
  docker-compose-dry-run:
@@ -129,8 +133,17 @@ jobs:
      - name: Login to Gitea Container Registry
        run: |
          docker login -u gitea-sonarqube-bot -p ${RINOA_REGISTRY_PASSWORD} git.trez.wtf
-      - name: Install Vault
+      - name: Cache Vault install
+        id: cache-vault
+        uses: actions/cache@v4
+        with:
+          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
+          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+      - name: Install Vault (only if not cached)
+        if: steps.cache-vault.outputs.cache-hit != 'true'
        uses: cpanato/vault-installer@main
+        with:
+          version: ${{ env.HC_VAULT_VERSION }}
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
@@ -172,13 +185,13 @@ jobs:
        uses: actions/cache@v4
        with:
          path: ~/.flarectl
-          key: flarectl-${{ runner.os }}-${{ hashFiles('workflow-config.yml') }}
+          key: flarectl-${{ runner.os }}-${{ env.FLARECTL_VERSION }}-${{ hashFiles('workflow-config.yml') }}
      - name: Install flarectl
        uses: supplypike/setup-bin@v4
        with:
-          uri: 'https://github.com/cloudflare/cloudflare-go/releases/download/v0.113.0/flarectl_0.113.0_linux_amd64.tar.gz'
-          name: 'flarectl'
-          version: '0.113.0'
+          uri: https://github.com/cloudflare/cloudflare-go/releases/download/v${{ env.FLARECTL_VERSION }}/flarectl_${{ env.FLARECTL_VERSION }}_linux_amd64.tar.gz
+          name: flarectl
+          version: ${{ env.FLARECTL_VERSION }}
      - name: Cache Subdomain Files
        uses: actions/cache@v4
        with:
@@ -277,12 +290,18 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+      - name: Cache tea CLI
+        id: cache-tea
+        uses: actions/cache@v4
+        with:
+          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
+          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
      - name: Install tea
        uses: supplypike/setup-bin@v4
        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
+          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
+          name: tea
+          version: ${{ env.TEA_VERSION }}
      - name: PR Merge
        id: pr_merge
        run: |
@@ -318,10 +337,13 @@ jobs:
        id: cache-vault
        uses: actions/cache@v4
        with:
-          path: /opt/hostedtoolcache/vault/1.18.0/x64
-          key: vault-${{ runner.os }}-1.18.0
-      - name: Install Vault
+          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
+          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+      - name: Install Vault (only if not cached)
+        if: steps.cache-vault.outputs.cache-hit != 'true'
        uses: cpanato/vault-installer@main
+        with:
+          version: ${{ env.HC_VAULT_VERSION }}
      - name: Login to Gitea Container Registry
        run: |
          docker login -u gitea-sonarqube-bot -p ${RINOA_REGISTRY_PASSWORD} git.trez.wtf
@@ -345,12 +367,14 @@ jobs:
            ${{ needs.generate-service-list.outputs.svc_deploy_list }}
          up-flags: -d --remove-orphans
          down-flags: --dry-run
-      - name: Check Services' Healthiness
-        uses: thegabriele97/dockercompose-health-action@main
+      - name: Docker Compose Healthcheck
+        uses: jaracogmbh/docker-compose-health-check-action@v1.0.0
        with:
-          filename: 'docker-compose.yml'
-          timeout: '60'
-          workdir: '.'
+          max-retries: 30
+          retry-interval: 10
+          compose-file: "docker-compose.yml"
+          skip-exited: "true"
+          skip-no-healthcheck: "true"
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
@@ -1,10 +1,10 @@
 name: Auto-Unseal for Vault
-
 on:
  workflow_dispatch:
  schedule:
-    - cron: "0 5 * * *"
-
+    - cron: '30 5 * * *'
+env:
+  HC_VAULT_VERSION: '1.20.0'
 jobs:
  auto-unseal:
    name: Unseal Vault
@@ -14,23 +14,34 @@ jobs:
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
      VAULT_SHARDS: ${{ secrets.VAULT_UNSEAL_SHARDS }}
      VAULT_NAMESPACE: ""
-
    steps:
+      - name: Vault Unseal Start
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: HC Vault @ Rinoa'
+          notification_message: 'Hashicorp Vault unsealing started... 🔐'
      - name: Cache Vault install
        id: cache-vault
        uses: actions/cache@v4
        with:
-          path: /opt/hostedtoolcache/vault/1.18.0/x64
-          key: vault-${{ runner.os }}-1.18.0
-
+          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
+          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
      - name: Install Vault (only if not cached)
        if: steps.cache-vault.outputs.cache-hit != 'true'
        uses: cpanato/vault-installer@main
        with:
-          version: 1.18.0
-
+          version: ${{ env.HC_VAULT_VERSION }}
      - name: Unseal Vault
        run: |
          for vault_shard in $VAULT_SHARDS; do
            vault operator unseal -address="${VAULT_ADDR}" -non-interactive "${vault_shard}"
          done
+      - name: Vault Unseal Completion
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
+          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
+          notification_title: 'GITEA: HC Vault @ Rinoa'
+          notification_message: 'Hashicorp Vault unsealed! 🔓'
@@ -4,6 +4,7 @@

 | Service | Image |
 | --- | --- |
+| 13ft | ghcr.io/wasi-master/13ft:latest |
 | actual_server | docker.io/actualbudget/actual-server:latest |
 | adguard | adguard/adguardhome:latest |
 | apprise-api | lscr.io/linuxserver/apprise-api:latest |
@@ -22,14 +23,17 @@
 | bytestash | ghcr.io/jordan-dalby/bytestash:latest |
 | castopod | castopod/castopod:latest |
 | castopod-valkey | docker.io/bitnami/valkey:latest |
+| changedetection | ghcr.io/dgtlmoon/changedetection.io |
+| changedetection-chrome | dgtlmoon/sockpuppetbrowser:latest |
 | chrome | gcr.io/zenika-hub/alpine-chrome:123 |
+| clipcascade | sathvikrao/clipcascade:latest |
 | cloudflareddns | ghcr.io/hotio/cloudflareddns:latest |
 | convertx | ghcr.io/c4illin/convertx |
-| cronicle | elestio/cronicle:latest |
 | crowdsec | crowdsecurity/crowdsec:latest |
 | crowdsec-dashboard | metabase/metabase |
 | cyber-chef | mpepping/cyberchef:latest |
 | czkawka | jlesage/czkawka |
+| dagu | ghcr.io/dagu-org/dagu:alpine |
 | dawarich-app | freikin/dawarich:latest |
 | dawarich-pg-db | postgis/postgis:17-3.5-alpine |
 | dawarich-sidekiq | freikin/dawarich:latest |
@@ -38,13 +42,15 @@
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
 | dockflare | alplat/dockflare:stable |
 | duplicati | lscr.io/linuxserver/duplicati:latest |
+| easyappointments | alextselegidis/easyappointments:1.5.1 |
 | excalidraw | excalidraw/excalidraw:latest |
 | explo | ghcr.io/lumepart/explo:latest |
 | fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main |
 | flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest |
-| freescout | tiredofit/freescout:latest |
+| garage | dxflrs/garage:v2.0.0 |
+| garage-webui | khairul169/garage-webui:latest |
 | ghost | ghost:latest |
-| gitea | gitea/gitea:1.24.0 |
+| gitea | gitea/gitea:1.24.3 |
 | gitea-db | postgres:14 |
 | gitea-runner | gitea/act_runner:latest |
 | gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0 |
@@ -54,7 +60,7 @@
 | graylog-datanode | graylog/graylog-datanode:6.1 |
 | guacamole | flcontainers/guacamole:latest |
 | homepage | ghcr.io/gethomepage/homepage:latest |
-| hugo | hugomods/hugo:exts-0.145.0 |
+| hugo | hugomods/hugo:exts |
 | immich-server | ghcr.io/immich-app/immich-server:release |
 | immich-machine-learning | ghcr.io/immich-app/immich-machine-learning:release |
 | immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1 |
@@ -105,6 +111,7 @@
 | meme-search-pro | ghcr.io/neonwatty/meme_search_pro:latest |
 | meme-search-pro-img2txt-gen | ghcr.io/neonwatty/image_to_text_generator:latest |
 | meme-search-db | pgvector/pgvector:pg17 |
+| mini-qr | ghcr.io/lyqht/mini-qr:latest |
 | minio | minio/minio:RELEASE.2025-04-22T22-12-26Z |
 | mixpost | inovector/mixpost:latest |
 | mixpost-valkey | docker.io/bitnami/valkey:latest |
@@ -116,10 +123,14 @@
 | nextcloud | nextcloud/all-in-one:latest |
 | ollama | ollama/ollama |
 | ombi | lscr.io/linuxserver/ombi:latest |
-| omni-tools | iib0011/omni-tools:latest |
+| omnitools | iib0011/omni-tools:latest |
 | omnipoly | kweg/omnipoly:latest |
 | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest |
 | paperless-valkey | docker.io/bitnami/valkey:latest |
+| patchman-server | ghcr.io/tigattack/patchman |
+| patchman-worker | ghcr.io/tigattack/patchman |
+| patchman-memcached | memcached:1.6-alpine |
+| patchman-valkey | docker.io/bitnami/valkey:latest |
 | penpot-frontend | penpotapp/frontend:latest |
 | penpot-backend | penpotapp/backend:latest |
 | penpot-exporter | penpotapp/exporter:latest |
@@ -133,6 +144,8 @@
 | plant-it-valkey | docker.io/bitnami/valkey:latest |
 | plantuml-server | plantuml/plantuml-server:jetty |
 | portainer | portainer/portainer-ce:alpine |
+| portchecker-web | ghcr.io/dsgnr/portcheckerio-web:latest |
+| portchecker-api | ghcr.io/dsgnr/portcheckerio-api:latest |
 | portnote-web | haedlessdev/portnote:latest |
 | portnote-agent | haedlessdev/portnote-agent:latest |
 | portnote-pg-db | postgres:17-alpine |
@@ -157,14 +170,14 @@
 | scrutiny | ghcr.io/analogj/scrutiny:master-omnibus |
 | searxng | searxng/searxng:latest |
 | searxng-valkey | docker.io/bitnami/valkey:latest |
-| semaphore | semaphoreui/semaphore:v2.12.14 |
-| signoz-app | signoz/signoz:v0.86.2 |
+| semaphore-ui | semaphoreui/semaphore:v2.12.14 |
+| signoz-app | signoz/signoz:v0.91.0 |
 | signoz-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |
 | signoz-init-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |
 | signoz-logspout | pavanputhra/logspout-signoz |
-| signoz-otel-collector | signoz/signoz-otel-collector:v0.111.42 |
-| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.111.42 |
-| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.111.42 |
+| signoz-otel-collector | signoz/signoz-otel-collector:v0.128.2 |
+| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.128.2 |
+| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.128.2 |
 | signoz-zookeeper-1 | bitnami/zookeeper:3.7.1 |
 | sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts |
 | sonarqube-pg-db | postgres:17-alpine |
@@ -180,6 +193,8 @@
 | swag | lscr.io/linuxserver/swag:latest |
 | tandoor | vabene1111/recipes |
 | tandoor-pg | postgres:16-alpine |
+| umami | ghcr.io/umami-software/umami:postgresql-latest |
+| umami-pg-db | postgres:15-alpine |
 | unmanic | josh5/unmanic:latest |
 | uptimekuma | louislam/uptime-kuma:latest |
 | vault | hashicorp/vault:latest |
@@ -189,4 +204,14 @@
 | whodb | clidey/whodb |
 | wizarr | ghcr.io/wizarrrr/wizarr |
 | youtubedl | nbr23/youtube-dl-server:latest |
+| zammad-backup | ghcr.io/zammad/zammad:6.5.0-15 |
+| zammad-elasticsearch | elasticsearch:8.18.0 |
+| zammad-init | ghcr.io/zammad/zammad:6.5.0-15 |
+| zammad-memcached | memcached:1.6.38-alpine |
+| zammad-nginx | ghcr.io/zammad/zammad:6.5.0-15 |
+| zammad-postgresql | postgres:17.5-alpine |
+| zammad-railsserver | ghcr.io/zammad/zammad:6.5.0-15 |
+| zammad-redis | redis:7.4.2-alpine |
+| zammad-scheduler | ghcr.io/zammad/zammad:6.5.0-15 |
+| zammad-websocket | ghcr.io/zammad/zammad:6.5.0-15 |

@@ -1,45 +0,0 @@
-# Rinoa Docker_configs Ansible Project
-
-## Included content/ Directory Structure
-
-The directory structure follows best practices recommended by the Ansible community. Feel free to customize this template according to your specific project requirements.
-
-```
- ansible-project/
- |── .devcontainer/
- |    └── docker/
- |        └── devcontainer.json
- |    └── podman/
- |        └── devcontainer.json
- |    └── devcontainer.json
- |── .github/
- |    └── workflows/
- |        └── tests.yml
- |    └── ansible-code-bot.yml
- |── .vscode/
- |    └── extensions.json
- |── collections/
- |   └── requirements.yml
- |   └── ansible_collections/
- |       └── project_org/
- |           └── project_repo/
- |               └── README.md
- |               └── roles/sample_role/
- |                         └── README.md
- |                         └── tasks/main.yml
- |── inventory/
- |   └── groups_vars/
- |   └── host_vars/
- |   └── hosts.yml
- |── ansible-navigator.yml
- |── ansible.cfg
- |── devfile.yaml
- |── linux_playbook.yml
- |── network_playbook.yml
- |── README.md
- |── site.yml
-```
-
-## Compatible with Ansible-lint
-
-Tested with ansible-lint >=24.2.0 releases and the current development version of ansible-core.
@@ -0,0 +1,25 @@
+{% set vault_addr = 'https://vault.trez.wtf' %}
+{% set secrets_path = 'rinoa-docker/env' %}
+EXPLO_SYSTEM: subsonic
+SYSTEM_URL: http://navidrome:4533
+SYSTEM_USERNAME: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NAVIDROME_USERNAME'] }}
+SYSTEM_PASSWORD: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['NAVIDROME_PASSWORD'] }}
+DOWNLOAD_DIR: /downloads
+PLAYLIST_DIR: /playlists
+LISTENBRAINZ_USER: Trez.One
+YOUTUBE_API_KEY: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUTUBE_DATA_API_V3_KEY'] }}
+# Assign a custom path to yt-dlp
+# YTDLP_PATH=
+# Keywords to ignore on videos downloaded by youtube (separated by only commas)
+FILTER_LIST: live,remix,instrumental,extended
+# Define a custom filename sepatator for special characters
+# FILENAME_SEPARATOR=
+# true to keep pervious weeks discoveries, only set to false if the parent folder only contains discovered songs (deletes every file in folder)
+PERSIST: true
+# 'playlist' to get tracks from Weekly Exploration playlist, anything else gets it from API (not the best recommendations). 'test' will download 1 song
+LISTENBRAINZ_DISCOVERY: playlist
+# Time to sleep (in minutes) between scanning and querying tracks from your system (If using Subsonic, Jellyfin)
+SLEEP: 5
+# Whether to provide additional info for debugging
+DEBUG: true
+SINGLE_ARTIST: true
@@ -9,7 +9,7 @@ compression_level = 10

 rpc_bind_addr = "[::]:3901"
 rpc_public_addr = "localhost:3901"
-rpc_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GARAGE_RPC_SECRET'] }}"
+rpc_secret = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GARAGE_RPC_SECRET'] }}"

 [s3_api]
 s3_region = "us-east-fh-pln"
@@ -18,8 +18,9 @@ root_domain = ".s3.trez.wtf"

 [s3_web]
 bind_addr = "[::]:3902"
+root_domain = ".garage.trez.wtf"

 [admin]
 api_bind_addr = "[::]:3903"
-admin_token = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GARAGE_ADMIN_TOKEN'] }}"
-metrics_token = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_USER'] }}:{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GARAGE_METRICS_TOKEN'] }}"
+admin_token = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GARAGE_ADMIN_TOKEN'] }}"
+metrics_token = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GARAGE_METRICS_TOKEN'] }}"
@@ -0,0 +1,22 @@
+ui = true
+disable_clustering = true
+log_level = "debug"
+api_addr = "http://127.0.0.1:8200"
+// storage "raft" {
+//   path = "/path/to/raft/data"
+//   node_id = "raft_node_id"
+// }
+
+storage "s3" {
+    endpoint = "minio:9000"
+    bucket = "secrets-vault"
+    region = "us-east-fh-pln"
+    s3_force_path_style = "true"
+    disable_ssl = "true"
+}
+
+listener "tcp" {
+  address = "0.0.0.0:8200"
+  proxy_protocol_behavior = "use_always"
+  tls_disable = 1
+}
@@ -23,7 +23,7 @@ provider: duckduckgo
 layout:
  System Administration:
    style: row
-    columns: 4
+    columns: 5
  Infrastructure/App Performance Monitoring:
    style: row
    columns: 5
@@ -44,10 +44,10 @@ layout:
    columns: 5
  Personal Tools:
    style: row
-    columns: 3
+    columns: 4
  Professional Services:
    style: row
-    columns: 4
+    columns: 5
  Servarr Stack:
    style: row
    columns: 5
@@ -0,0 +1,124 @@
+[app]
+# Log level: info, debug, warn, error, fatal
+log_level = "debug"
+# Environment: dev, prod.
+# Setting to "dev" will enable color logging in terminal.
+env = "dev"
+# Whether to automatically check for application updates on start up, app updates are shown as a banner in the admin panel.
+check_updates = true
+
+# HTTP server.
+[app.server]
+# Address to bind the HTTP server to.
+address = "0.0.0.0:9000"
+# Unix socket path (leave empty to use TCP address instead)
+socket = ""
+# Do NOT disable secure cookies in production environment if you don't know exactly what you're doing!
+disable_secure_cookies = false
+# Request read and write timeouts.
+read_timeout = "5s"
+write_timeout = "5s"
+# Maximum request body size in bytes (100MB)
+# If you are using proxy, you may need to configure them to allow larger request bodies.
+max_body_size = 104857600
+# Size of the read buffer for incoming requests
+read_buffer_size = 4096
+# Keepalive settings.
+keepalive_timeout = "10s"
+
+# File upload provider to use, either `fs` or `s3`.
+[upload]
+provider = "s3"
+
+# Filesystem provider.
+[upload.fs]
+# Directory where uploaded files are stored, make sure this directory exists and is writable by the application.
+upload_path = 'uploads'
+
+# S3 provider.
+[upload.s3]
+# S3 endpoint URL (required only for non-AWS S3-compatible providers like MinIO).
+# Leave empty to use default AWS endpoints.
+url = "http://minio:9000"
+
+# AWS S3 credentials, keep empty to use attached IAM roles.
+access_key = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBREDESK_S3_ACCESS_KEY'] }}"
+secret_key = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBREDESK_S3_SECRET_KEY'] }}"
+
+# AWS region, e.g., "us-east-1", "eu-west-1", etc.
+region = "us-east-fh-pln"
+# S3 bucket name where files will be stored.
+bucket = "libredesk"
+# Optional prefix path within the S3 bucket where files will be stored.
+# Example, if set to "uploads/media", files will be stored under that path.
+# Useful for organizing files inside a shared bucket.
+bucket_path = ""
+# S3 signed URL expiry duration (e.g., "30m", "1h")
+expiry = "30m"
+
+# Postgres.
+[db]
+# If running locally, use `localhost`.
+host = "libredesk-pg-db"
+# Database port, default is 5432.
+port = 5432
+# Update the following values with your database credentials.
+user = "libredesk"
+password = "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIBREDESK_PG_DB_PASSWD'] }}"
+database = "libredesk"
+ssl_mode = "disable"
+# Maximum number of open database connections
+max_open = 30
+# Maximum number of idle connections in the pool
+max_idle = 30
+# Maximum time a connection can be reused before being closed
+max_lifetime = "300s"
+
+# Redis.
+[redis]
+# If running locally, use `localhost:6379`.
+address = "libredesk-valkey:6379"
+password = ""
+db = 0
+
+[message]
+# Number of workers processing outgoing message queue
+outgoing_queue_workers = 10
+# Number of workers processing incoming message queue
+incoming_queue_workers = 10
+# How often to scan for outgoing messages to process, keep it low to process messages quickly.
+message_outgoing_scan_interval = "50ms"
+# Maximum number of messages that can be queued for incoming processing
+incoming_queue_size = 5000
+# Maximum number of messages that can be queued for outgoing processing
+outgoing_queue_size = 5000
+
+[notification]
+# Number of concurrent notification workers
+concurrency = 2
+# Maximum number of notifications that can be queued
+queue_size = 2000
+
+[automation]
+# Number of workers processing automation rules
+worker_count = 10
+
+[autoassigner]
+# How often to run automatic conversation assignment
+autoassign_interval = "5m"
+
+[webhook]
+# Number of webhook delivery workers
+workers = 5
+# Maximum number of webhook deliveries that can be queued
+queue_size = 10000
+# HTTP timeout for webhook requests
+timeout = "15s"
+
+[conversation]
+# How often to check for conversations to unsnooze
+unsnooze_interval = "5m"
+
+[sla]
+# How often to evaluate SLA compliance for conversations
+evaluation_interval = "5m"
@@ -1,6 +1,5 @@
 {% set vault_addr = 'https://vault.trez.wtf' %}
 {% set secrets_path = 'rinoa-docker/env' %}
-
 containers:
  ghost_blog:
    action_keywords:
@@ -25,63 +24,11 @@ containers:
  scrutiny:
    action_keywords:
      - restart:
-          regex: '^s6-rc: fatal: timed out$'
+          regex: '^s6-.*: fatal.*$'
  swag:
    action_keywords:
      - restart:
-          regex: 's6-rc: fatal.*'
-  authelia-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  castopod-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  dawarich-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  immich-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  librechat-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  manyfold-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  mastodon-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  maxun-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  mixpost-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  paperless-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  plant-it-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  romm-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
-  searxng-valkey:
-    action_keywords:
-    - restart:
-        regex: 'Asynchronous AOF fsync is taking too long.*slow down the server.$'
+          regex: '^s6-.*: fatal.*$'
 global_keywords:
  keywords:
    - panic
@@ -24,30 +24,31 @@
    {
      "type": "spotify",
      "enable": true,
-      "clients": [],
-      "name": "spotify",
+      "clients": ["lastfmClient", "ListenBrainzClient", "maloja"],
+      "name": "spotifySource",
      "data": {
        "clientId": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_ID'] }}",
        "clientSecret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['YOUR_SPOTIFY_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/callback"
+        "redirectUri": "https://scrobble.trez.wtf/callback"
      }
    },
    {
      "type": "lastfm",
      "enable": true,
-      "clients": [],
-      "name": "lastfm",
+      "clients": ["ListenBrainzClient", "maloja"],
+      "configureAs": "source",
+      "name": "lastfmSource",
      "data": {
        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
        "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/lastfm/callback"
+        "redirectUri": "https://scrobble.trez.wtf/lastfm/callback"
      }
    },
    {
      "type": "listenbrainz",
      "enable": true,
-      "clients": [],
-      "name": "listenBrainz",
+      "clients": ["lastfmClient", "maloja"],
+      "name": "listenBrainzSource",
      "data": {
        "token": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_LISTENBRAINZ_TOKEN'] }}",
        "username": "Trez.One"
@@ -56,8 +57,8 @@
    {
      "type": "subsonic",
      "enable": true,
-      "clients": [],
-      "name": "navidrome",
+      "clients": ["lastfmClient", "ListenBrainzClient", "maloja"],
+      "name": "navidromeSource",
      "data": {
        "url": "http://navidrome:4533",
        "user": "admin",
@@ -70,10 +71,11 @@
      "type": "lastfm",
      "enable": true,
      "name": "lastFmClient",
+      "configureAs": "client",
      "data": {
        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_KEY'] }}",
        "secret": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LASTFM_API_SECRET'] }}",
-        "redirectUri": "http://localhost:9078/lastfm/callback"
+        "redirectUri": "https://scrobble.trez.wtf/lastfm/callback"
      }
    },
    {
@@ -88,7 +90,7 @@
    {
      "type": "maloja",
      "enable": true,
-      "name": "maloja",
+      "name": "malojaClient",
      "data": {
        "url": "http://maloja:42010",
        "apiKey": "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['MALOJA_API_KEY'] }}"
@@ -0,0 +1,225 @@
+{% set vault_addr = 'https://vault.trez.wtf' %}
+{% set secrets_path = 'rinoa-docker/env' %}
+# This is an example configuration file that documents all the options.
+# It will need to be modified for your specific use case.
+# These are not default values. You MUST review the config settings and properly configure this EXAMPLE file.
+# Please refer to the link below for more details on how to set up the configuration file
+# https://github.com/StuffAnThings/qbit_manage/wiki/Config-Setup
+
+commands:
+  # The commands defined below will OVERRIDE any commands used in command line and docker env variables.
+  dry_run: True
+  recheck: False
+  cat_update: False
+  tag_update: False
+  rem_unregistered: False
+  tag_tracker_error: False
+  rem_orphaned: False
+  tag_nohardlinks: False
+  share_limits: False
+  skip_qb_version_check: False
+  skip_cleanup: False
+
+qbt:
+  # qBittorrent parameters
+  # Pass environment variables to the config via !ENV tag
+  host: qbittorrentvpn:8080
+  user: admin
+  pass: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['DELUGEVPN_PASSWORD'] }}
+
+settings:
+  force_auto_tmm: False # Will force qBittorrent to enable Automatic Torrent Management for each torrent.
+  force_auto_tmm_ignore_tags: #Torrents with these tags will be ignored when force_auto_tmm is enabled.
+    - cross-seed
+    - Upload
+  tracker_error_tag: issue # Will set the tag of any torrents that do not have a working tracker.
+  nohardlinks_tag: noHL # Will set the tag of any torrents with no hardlinks.
+  stalled_tag: stalledDL # Will set the tag of any torrents stalled downloading.
+  share_limits_tag: ~share_limit # Will add this tag when applying share limits to provide an easy way to filter torrents by share limit group/priority for each torrent
+  share_limits_min_seeding_time_tag: MinSeedTimeNotReached # Tag to be added to torrents that have not yet reached the minimum seeding time
+  share_limits_min_num_seeds_tag: MinSeedsNotMet # Tag to be added to torrents that have not yet reached the minimum number of seeds
+  share_limits_last_active_tag: LastActiveLimitNotReached # Tag to be added to torrents that have not yet reached the last active limit
+  cat_filter_completed: True # Filters for completed torrents only when running cat_update command
+  share_limits_filter_completed: True # Filters for completed torrents only when running share_limits command
+  tag_nohardlinks_filter_completed: True # Filters for completed torrents only when running tag_nohardlinks command
+  rem_unregistered_filter_completed: False # Filters for completed torrents only when running rem_unregistered command
+  cat_update_all: True # Checks and updates all torrent categories if set to True when running cat_update command, otherwise only update torrents that are uncategorized
+  disable_qbt_default_share_limits: True # Allows QBM to handle share limits by disabling qBittorrents default Share limits. Only active when the share_limits command is set to True
+  tag_stalled_torrents: True # Tags any downloading torrents that are stalled with the `stalledDL` tag when running the tag_update command
+  rem_unregistered_ignore_list: # Ignores a list of words found in the status of the tracker when running rem_unregistered command and will not remove the torrent if matched
+    - example placeholder words
+    - ignore if found
+
+directory:
+  # Do not remove these
+  # root_dir var: </your/path/here/>  # Root downloads directory used to check for orphaned files, noHL, and RecycleBin.
+  # <OPTIONAL> remote_dir var: </your/path/here/>  # Path of docker host mapping of root_dir.
+  # remote_dir must be set if you're running qbit_manage locally and qBittorrent/cross_seed is in a docker
+  # remote_dir should not be set if qbit_manage is running in a container
+  # <OPTIONAL> recycle_bin var: </your/path/here/>   # Path of the RecycleBin folder. Default location is set to remote_dir/.RecycleBin
+  # <OPTIONAL> torrents_dir var: </your/path/here/>  # Path of the your qbittorrent torrents directory. Required for `save_torrents` attribute in recyclebin
+  # <OPTIONAL> orphaned_dir var: </your/path/here/>  # Path of the the Orphaned Data folder. This is similar to RecycleBin, but only for orphaned data.
+  root_dir: "/downloads"
+  # remote_dir: "/host/path/to/torrents/ifdocker/torrents/"
+  # recycle_bin: "/path/to/.RecycleBin"
+  torrents_dir: "/downloads/completed/torrent"
+
+cat:
+  # Category & Path Parameters
+  # All save paths in qbittorent must be populated below.
+  # If you want to leave a save_path as uncategorized you can use the key 'Uncategorized' as the name of the category.
+  # You can use Unix filename pattern matching as well when specifying the save_path
+  # <Category Name> : <save_path>  # Path of your save directory.
+  lidarr: "/downloads/completed/torrent/music"
+  # prowlarr: "/data/torrents"
+  radarr: "/downloads/completed/torrent/movies"
+  readarr: "/downloads/completed/torrent/ebooks"
+  tv-sonarr: "/downloads/completed/torrent//tv"
+
+cat_change:
+  # This moves all the torrents from one category to another category. This executes on --cat-update
+  # WARNING: if the paths are different and Default Torrent Management Mode is set to automatic the files could be moved !!!
+  # <Old Category Name> : <New Category>
+  CatA.cross-seed: CatA
+  CatB.cross-seed: CatB
+
+tracker:
+  # Mandatory
+  # Tag Parameters
+  # <Tracker URL Keyword>:    # <MANDATORY> This is the keyword in the tracker url. You can define multiple tracker urls by splitting with `|` delimiter
+  # <MANDATORY> Set tag name. Can be a list of tags or a single tag
+  #   tag: <Tag Name>
+  # <OPTIONAL> Set the category based on tracker URL. This category option takes priority over the category defined by save directory
+  #   cat: <Category Name>
+  # <OPTIONAL> Set this to the notifiarr react name. This is used to add indexer reactions to the notifications sent by Notifiarr
+  #   notifiarr: <notifiarr indexer>
+  animebytes.tv:
+    tag: AnimeBytes
+    notifiarr: animebytes
+  avistaz:
+    tag:
+      - Avistaz
+      - tag2
+      - tag3
+    notifiarr: avistaz
+  beyond-hd:
+    tag: [Beyond-HD, tag2, tag3]
+    cat: movies
+    notifiarr: beyondhd
+  blutopia:
+    tag: Blutopia
+    notifiarr: blutopia
+  cartoonchaos:
+    tag: CartoonChaos
+  digitalcore:
+    tag: DigitalCore
+    notifiarr: digitalcore
+  gazellegames:
+    tag: GGn
+  hdts:
+    tag: HDTorrents
+  landof.tv:
+    tag: BroadcasTheNet
+    notifiarr: broadcasthenet
+  myanonamouse:
+    tag: MaM
+  passthepopcorn:
+    tag: PassThePopcorn
+    notifiarr: passthepopcorn
+  privatehd:
+    tag: PrivateHD
+    notifiarr:
+  torrentdb:
+    tag: TorrentDB
+    notifiarr: torrentdb
+  torrentleech|tleechreload:
+    tag: TorrentLeech
+    notifiarr: torrentleech
+  tv-vault:
+    tag: TV-Vault
+  # The "other" key is a special keyword and if defined will tag any other trackers that don't match the above trackers into this tag
+  other:
+    tag: other
+
+nohardlinks:
+  # Tag Movies/Series that are not hard linked outside the root directory
+  # Mandatory to fill out directory parameter above to use this function (root_dir/remote_dir)
+  # This variable should be set to your category name of your completed movies/completed series in qbit. Acceptable variable can be any category you would like to tag if there are no hardlinks found
+  movies-completed-4k:
+  series-completed-4k:
+  movies-completed:
+    # <OPTIONAL> exclude_tags var: Will exclude torrents with any of the following tags when searching through the category.
+    exclude_tags:
+      - Beyond-HD
+      - AnimeBytes
+      - MaM
+    # <OPTIONAL> ignore_root_dir var: Will ignore any hardlinks detected in the same root_dir (Default True).
+    ignore_root_dir: true
+  # Can have additional categories set with separate ratio/seeding times defined.
+  series-completed:
+    # <OPTIONAL> exclude_tags var: Will exclude torrents with any of the following tags when searching through the category.
+    exclude_tags:
+      - Beyond-HD
+      - BroadcasTheNet
+    # <OPTIONAL> ignore_root_dir var: Will ignore any hardlinks detected in the same root_dir (Default True).
+    ignore_root_dir: true
+
+share_limits:
+  # Control how torrent share limits are set depending on the priority of your grouping
+  # Each torrent will be matched with the share limit group with the highest priority that meets the group filter criteria.
+  # Each torrent can only be matched with one share limit group
+  # This variable is mandatory and is a text defining the name of your grouping. This can be any string you want
+  spacesaver:
+    priority: 2
+    max_ratio: 3
+    min_last_active: 24h
+    cleanup: false
+  default:
+    priority: 999
+    max_ratio: -1
+    max_seeding_time: -1
+    cleanup: false
+recyclebin:
+  # Recycle Bin method of deletion will move files into the recycle bin (Located in /root_dir/.RecycleBin) instead of directly deleting them in qbit
+  # By default the Recycle Bin will be emptied on every run of the qbit_manage script if empty_after_x_days is defined.
+  enabled: true
+  # <OPTIONAL> empty_after_x_days var:
+  # Will automatically remove all files and folders in recycle bin after x days. (Checks every script run)
+  # If this variable is not defined it, the RecycleBin will never be emptied.
+  # WARNING: Setting this variable to 0 will delete all files immediately upon script run!
+  empty_after_x_days: 60
+  # <OPTIONAL> save_torrents var:
+  # If this option is set to true you MUST fill out the torrents_dir in the directory attribute.
+  # This will save a copy of your .torrent and .fastresume file in the recycle bin before deleting it from qbittorrent
+  save_torrents: true
+  # <OPTIONAL> split_by_category var:
+  # This will split the recycle bin folder by the save path defined in the `cat` attribute
+  # and add the base folder name of the recycle bin that was defined in the `recycle_bin` sub-attribute under directory.
+  split_by_category: false
+
+orphaned:
+  # Orphaned files are those in the root_dir download directory that are not referenced by any active torrents.
+  # Will automatically remove all files and folders in orphaned data after x days. (Checks every script run)
+  # If this variable is not defined it, the orphaned data will never be emptied.
+  # WARNING: Setting this variable to 0 will delete all files immediately upon script run!
+  empty_after_x_days: 60
+  # File patterns that will not be considered orphaned files. Handy for generated files that aren't part of the torrent but belong with the torrent's files
+  exclude_patterns:
+    - "**/.DS_Store"
+    - "**/Thumbs.db"
+    - "**/@eaDir"
+    - "/data/torrents/temp/**"
+    - "**/*.!qB"
+    - "**/*_unpackerred"
+  # Set your desired threshold for the maximum number of orphaned files qbm will delete in a single run. (-1 to disable safeguards)
+  # This will help reduce the number of accidental large amount orphaned deletions in a single run
+  # WARNING: Setting this variable to -1 will not safeguard against any deletions
+  max_orphaned_files_to_delete: 50
+
+apprise:
+  # Apprise integration with webhooks
+  # Leave Empty/Blank to disable
+  # Mandatory to fill out the url of your apprise API endpoint
+  api_url: http://apprise-api:8000
+  # Mandatory to fill out the notification url/urls based on the notification services provided by apprise. https://github.com/caronc/apprise/wiki
+  notify_url: gotify://gotify/{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['APPRISE_GOTIFY_TOKEN'] }}
@@ -8,6 +8,104 @@ receivers:
        endpoint: 0.0.0.0:4317
      http:
        endpoint: 0.0.0.0:4318
+  hostmetrics:
+    collection_interval: 60s  # Frequency of metrics collection.
+    scrapers:
+      cpu: {}
+      load: {}
+      memory: {}
+      disk: {}
+      filesystem: {}
+      network: {}
+  docker_stats:
+    endpoint: unix:///var/run/docker.sock
+    collection_interval: 30s
+    timeout: 10s
+    api_version: "1.51"
+    metrics:
+      container.uptime:
+        enabled: true
+      container.restarts:
+        enabled: true
+      container.network.io.usage.rx_errors:
+        enabled: true
+      container.network.io.usage.tx_errors:
+        enabled: true
+      container.network.io.usage.rx_packets:
+        enabled: true
+      container.network.io.usage.tx_packets:
+        enabled: true
+  filelog/nginx-access-logs:
+    include: ["${env:NGINX_ACCESS_LOG_FILE}"]
+    operators:
+      # Parse the default nginx access log format. Nginx defaults to the "combined" log format
+      # $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"
+      # For more details, see https://nginx.org/en/docs/http/ngx_http_log_module.html
+      - type: regex_parser
+        if: body matches '^(?P<remote_addr>[0-9\\.]+) - (?P<remote_user>[^\\s]+) \\[(?P<ts>.+)\\] "(?P<request_method>\\w+?) (?P<request_path>.+?)" (?P<status>[0-9]+) (?P<body_bytes_sent>[0-9]+) "(?P<http_referrer>.+?)" "(?P<http_user_agent>.+?)"$'
+        parse_from: body
+        parse_to: attributes
+        regex: '^(?P<remote_addr>[0-9\.]+) - (?P<remote_user>[^\s]+) \[(?P<ts>.+)\] "(?P<request_method>\w+?) (?P<request_path>.+?)" (?P<status>[0-9]+) (?P<body_bytes_sent>[0-9]+) "(?P<http_referrer>.+?)" "(?P<http_user_agent>.+?)"$'
+        timestamp:
+          parse_from: attributes.ts
+          layout: "02/Jan/2006:15:04:05 -0700"
+          layout_type: gotime
+        severity:
+          parse_from: attributes.status
+          overwrite_text: true
+          mapping:
+            debug: "1xx"
+            info:
+              - "2xx"
+              - "3xx"
+            warn: "4xx"
+            error: "5xx"
+      - type: remove
+        if: attributes.ts != nil
+        field: attributes.ts
+      - type: add
+        field: attributes.source
+        value: nginx
+
+  filelog/nginx-error-logs:
+    include: ["${env:NGINX_ERROR_LOG_FILE}"]
+    operators:
+      # Parse the default nginx error log format.
+      # YYYY/MM/DD HH:MM:SS [LEVEL] PID#TID: *CID MESSAGE
+      # For more details, see https://github.com/phusion/nginx/blob/master/src/core/ngx_log.c
+      - type: regex_parser
+        if: body matches '^(?P<ts>.+?) \\[(?P<log_level>\\w+)\\] (?P<pid>\\d+)#(?P<tid>\\d+). \\*(?P<cid>\\d+) (?P<message>.+)$'
+        parse_from: body
+        parse_to: attributes
+        regex: '^(?P<ts>.+?) \[(?P<log_level>\w+)\] (?P<pid>\d+)#(?P<tid>\d+). \*(?P<cid>\d+) (?P<message>.+)$'
+        timestamp:
+          parse_from: attributes.ts
+          layout: "2006/01/02 15:04:05"
+          layout_type: gotime
+        severity:
+          parse_from: attributes.log_level
+          overwrite_text: true
+          mapping:
+            debug: "debug"
+            info:
+              - "info"
+              - "notice"
+            warn: "warn"
+            error:
+              - "error"
+              - "crit"
+              - "alert"
+            fatal: "emerg"
+      - type: remove
+        if: attributes.ts != nil
+        field: attributes.ts
+      - type: move
+        if: attributes.message != nil
+        from: attributes.message
+        to: body
+      - type: add
+        field: attributes.source
+        value: nginx
  prometheus:
    config:
      global:
@@ -25,9 +123,21 @@ processors:
    send_batch_max_size: 11000
    timeout: 10s
  resourcedetection:
-    # Using OTEL_RESOURCE_ATTRIBUTES envvar, env detector adds custom labels.
    detectors: [env, system]
+    system:
+      hostname_sources: [os]
+  resourcedetection/env:
+    detectors: [env]
    timeout: 2s
+    override: false
+  resourcedetection/system:
+    detectors: ["system"]
+    system:
+      hostname_sources: ["dns", "os"]
+  resourcedetection/docker:
+    detectors: [env, docker]
+    timeout: 2s
+    override: false
  signozspanmetrics/delta:
    metrics_exporter: clickhousemetricswrite, signozclickhousemetrics
    metrics_flush_interval: 60s
@@ -78,12 +188,14 @@ exporters:
    timeout: 10s
    use_new_schema: true
  # debug: {}
+  otlp/nginx-logs:
+    endpoint: "localhost:4317"
+    tls:
+      insecure: true
 service:
  telemetry:
    logs:
      encoding: json
-    metrics:
-      address: 0.0.0.0:8888
  extensions:
    - health_check
    - pprof
@@ -95,7 +207,11 @@ service:
    metrics:
      receivers: [otlp]
      processors: [batch]
-      exporters: [clickhousemetricswrite, signozclickhousemetrics]
+      exporters: [clickhousemetricswrite, signozclickhousemetrics, resourcedetection/docker, resourcedetection/system]
+    metrics/hostmetrics:
+      receivers: [hostmetrics]
+      processors: [resourcedetection, resource/env]
+      exporters: [otlp]
    metrics/prometheus:
      receivers: [prometheus]
      processors: [batch]
@@ -1,14 +1,14 @@
 vault_addr: "https://vault.trez.wtf"
 vault_token: !vault |
  $ANSIBLE_VAULT;1.1;AES256
-  62353532343234343230663331623062376533346166343963383464303535646362376233663361
-  3532343530653365663331393339646337653564316337390a646264353561623132366635343032
-  63326535376434353837663334366336613631346161363034646134333439613531376362646161
-  6438316662626566340a346665666234386630633764376336333063363934643162393565386330
-  35333139303939613232303264646236326637613862303339353334623066393966353032333839
-  33323962303635333335376364366336663035303530396262356130373537363134303937353433
-  34393338336666396338616465666466613931373461663761366235643437646136373039353939
-  33643133313264303637646336653537383337336661313765663366356262343064316334313337
-  35306232303132653566356130343366313139336665313737363732613261623439
+  31616264333530373062366539333738643937326562616130636266646532653862663966663862
+  6336343130363932316237373939656530663339383061360a626433656432633734363635313236
+  36646161663939393035333066656435663064313031636430386163653438336165663432393563
+  3032316331653662310a653930623965303835396239383663306438633738356563633834623036
+  35616132656166663233613937346364343439306561306661633239623837373564323430386635
+  31663762303234326363643262633761363661656538373333396139376132303564336635623632
+  30303166336432653038333733386334323262623736626435623933653035363035383930366166
+  64376639396664303034656533656339363436306638396462333230636136396538303638323338
+  3138
 vault_token_cleaned: "{{ vault_token | regex_replace('\\n', '') }}"
 secrets_path: "rinoa-docker/env"