Ansible private key fix (hopefully).

.gitea/workflows/pr-ansible-config-only-deploy.yml

@@ -1,160 +0,0 @@
-name: Gitea Branch PR & Ansible Configurations Deployment
-on:
-  push:
-    branches:
-      - '**'
-    paths:
-      - '**.j2'
-jobs:
-  check-and-create-pr:
-    if: github.ref != 'refs/heads/main'
-    name: Check and Create PR
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/tea/0.9.2/x64
-          key: tea-${{ runner.os }}-0.9.2
-      - name: Install tea
-        uses: supplypike/setup-bin@v4
-        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
-      - name: Check if open PR exists
-        id: check-opened-pr-step
-        continue-on-error: true
-        run: |
-          tea login add --name gitea-rinoa --url "${{ secrets.RINOA_GITEA_URL }}" --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
-          pr_exists=$(tea pr list --repo ${{ github.repository }} --state open --fields index,title,head | egrep ${{ github.ref_name }} | tail -1 | wc -l)
-          echo "exists=$pr_exists" >> $GITHUB_OUTPUT
-      - name: Create PR
-        if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
-        run: |
-          tea login default gitea-rinoa
-          pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
-          pr_index_new=$(expr ${pr_index_old} + 1)
-          tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Ansible Configs.j2"
-  ansible-lint:
-    name: Ansible Lint
-    needs: [check-and-create-pr]
-    runs-on: ubuntu-latest
-    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
-      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      VAULT_NAMESPACE: ""
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Cache Ansible Galaxy Collections
-        uses: actions/cache@v3
-        with:
-          path: ansible/collections
-          key: ${{ runner.os }}-ansible-${{ hashFiles('./ansible/collections/requirements.yml') }}
-          restore-keys: |
-            ${{ runner.os }}-ansible-
-      - name: Install Ansible
-        uses: alex-oleshkevich/setup-ansible@v1.0.1
-        with:
-          version: "11.0.0"
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
-      - name: Install hvac
-        run: pip install hvac
-      - name: Ansible Playbook Dry Run
-        uses: dawidd6/action-ansible-playbook@v2
-        with:
-          directory: ansible/
-          playbook: docker_config_deploy.yml
-          key: ${{ secrets.RINOA_ANSIBLE_PRIVATE_KEY }}
-          options: |
-            --inventory inventory/hosts.yml
-            --check
-          requirements: collections/requirements.yml
-          vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Ansible Config Dry Run @ Rinoa'
-          notification_message: 'Ansible dry run completed successfully.'
-  pr-merge:
-    name: PR Merge
-    needs: [regenerate-readme-modified-services]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install tea
-        uses: supplypike/setup-bin@v4
-        with:
-          uri: 'https://gitea.com/gitea/tea/releases/download/v0.9.2/tea-0.9.2-linux-amd64'
-          name: 'tea'
-          version: '0.9.2'
-      - name: PR Merge
-        id: pr_merge
-        run: |
-          tea login add --name gitea-rinoa --url ${{ secrets.RINOA_GITEA_URL }} --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
-          tea login default gitea-rinoa
-          echo "Merging PR..."
-          pr_index=$(tea pr ls --repo ${{ github.repository }} --state open --fields index,title,head,state --output csv | egrep ${{ github.ref_name }} | awk -F"," '{print $1}' | sed -e 's|"||g')
-          tea pr m --repo ${{ github.repository }} --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" --message "Merged by ${{ github.actor }}" ${pr_index}
-          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Merge Successful'
-          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
-  ansible-config-deploy:
-    name: Ansible Config Deployment
-    runs-on: ubuntu-latest
-    needs: [pr-merge]
-    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
-      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      DOCKER_HOST: tcp://dockerproxy:2375
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: main
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/vault/1.18.0/x64
-          key: vault-${{ runner.os }}-1.18.0
-      - name: Install Ansible
-        uses: alex-oleshkevich/setup-ansible@v1.0.1
-        with:
-          version: "11.0.0"
-      - name: Install Vault
-        uses: cpanato/vault-installer@main
-      - name: Install hvac
-        run: pip install hvac
-      - name: Deploy Docker Configs via Ansible
-        uses: dawidd6/action-ansible-playbook@v2
-        with:
-          directory: ansible/
-          playbook: docker_config_deploy.yml
-          key: ${{secrets.RINOA_ANSIBLE_PRIVATE_KEY}}
-          options: |
-            --inventory inventory/hosts.yml
-          requirements: collections/requirements.yml
-          vault_password: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Ansible Config Deployment @ Rinoa'
-          notification_message: 'Deployment completed successfully.'

.gitea/workflows/pr-cloudflare-docker-deploy.yml

@@ -1,13 +1,14 @@
 name: Gitea Branch PR, Cloudflare DNS, README generation, & Ansible/Docker Deployment
 on:
   push:
-    branches:
+    branches-ignore:
-      - '**'
+      - main
     paths:
-      - 'docker-compose.yml'
+      - '**.yaml'
+      - '**.yml'
+      - '**.j2'
 jobs:
   check-and-create-pr:
-    if: github.ref != 'refs/heads/main'
     name: Check and Create PR
     runs-on: ubuntu-latest
     steps:
@@ -32,7 +33,9 @@ jobs:
         continue-on-error: true
         run: |
           tea login add --name gitea-rinoa --url "${{ secrets.RINOA_GITEA_URL }}" --user gitea-sonarqube-bot --password "${{ secrets.BOT_GITEA_PASSWORD }}" --token ${{ secrets.BOT_GITEA_TOKEN }}
+          tea pr list --repo ${{ github.repository }} --state all
           pr_exists=$(tea pr list --repo ${{ github.repository }} --state open --fields index,title,head | egrep ${{ github.ref_name }} | tail -1 | wc -l)
+          echo ${pr_exists}
           echo "exists=$pr_exists" >> $GITHUB_OUTPUT
       - name: Create PR
         if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
@@ -40,7 +43,7 @@ jobs:
           tea login default gitea-rinoa
           pr_index_old=$(tea pr ls --repo ${{ github.repository }} --state all --fields index,title,head --output csv | sed -e 's|"||g' | egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
           pr_index_new=$(expr ${pr_index_old} + 1)
-          tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }} -L "Docker Compose, Ansible Configs.j2"
+          tea pr c -r ${{ github.repository }} -t "Automated PR for ${{ github.ref_name }} - #${pr_index_new}" -d "Automatically created PR for branch: ${{ github.ref_name }}" -a ${{ github.actor }}
   docker-compose-ansible-lints:
     name: Docker Compose & Ansible Lints
     needs: [check-and-create-pr]
@@ -48,7 +51,6 @@ jobs:
     env:
       VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
-      VAULT_NAMESPACE: ""
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -72,7 +74,7 @@ jobs:
         with:
           directory: ansible/
           playbook: docker_config_deploy.yml
-          key: ${{ secrets.RINOA_ANSIBLE_PRIVATE_KEY }}
+          key: ${{secrets.RINOA_ANSIBLE_PRIVATE_SSH_KEY}}
           options: |
             --inventory inventory/hosts.yml
             --check
@@ -254,7 +256,8 @@ jobs:
           notification_title: 'GITEA: PR Merge Successful'
           notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
   ansible-config-docker-compose-deploy:
-    name: Ansible Configs & Docker Compose Deployment
+    name: Deploy via Ansible & Docker Compose
+    timeout-minutes: 360
     runs-on: ubuntu-latest
     needs: [pr-merge]
     env:
@@ -302,12 +305,11 @@ jobs:
            vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
       - name: Docker Compose Deployment
         # if: ${{ steps.regenerate-readme-modified-services.outputs.modified_services != '' }}
-        timeout-minutes: 360
         continue-on-error: true
         uses: keatonLiu/docker-compose-remote-action@v1.2
         with:
           docker_compose_file: docker-compose.yml
-          docker_args: -d --remove-orphans --pull missing --no-recreate
+          docker_args: -d --remove-orphans --pull missing
           ssh_user: gitea-deploy
           ssh_host: 192.168.1.254
           ssh_host_public_key: ${{ secrets.RINOA_GITEA_PUBLIC_SSH_KEY }}

README.md

@@ -20,14 +20,10 @@
 | castopod | castopod/castopod:latest |
 | cloudflared | cloudflare/cloudflared:latest |
 | cloudflareddns | ghcr.io/hotio/cloudflareddns:latest |
-| convertx | ghcr.io/c4illin/convertx |
 | cronicle | elestio/cronicle:latest |
 | crowdsec | crowdsecurity/crowdsec:latest |
 | crowdsec-dashboard | metabase/metabase |
 | czkawka | jlesage/czkawka |
-| dawarich-app | freikin/dawarich:latest |
-| dawarich-pg-db | postgis/postgis:17-3.5-alpine |
-| dawarich-sidekiq | freikin/dawarich:latest |
 | dbgate | dbgate/dbgate:alpine |
 | delugevpn | ghcr.io/binhex/arch-delugevpn:latest |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |
@@ -43,6 +39,13 @@
 | gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0 |
 | gluetun | qmcgaw/gluetun:latest |
 | gotify | gotify/server |
+| grafana | grafana/grafana-enterprise:latest |
+| grafana-alloy | grafana/alloy:latest |
+| grafana-loki | grafana/loki:latest |
+| grafana-mimir | grafana/mimir:latest |
+| grafana-mimir-memcached | memcached |
+| grafana-pyroscope | grafana/pyroscope:latest |
+| grafana-tempo | grafana/tempo:latest |
 | guacamole | flcontainers/guacamole:latest |
 | homepage | ghcr.io/gethomepage/homepage:latest |
 | hortusfox | ghcr.io/danielbrendel/hortusfox-web:latest |
@@ -54,7 +57,6 @@
 | immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest |
 | influxdb2 | influxdb:2-alpine |
 | invidious | quay.io/invidious/invidious:latest |
-| invidious-sig-helper | quay.io/invidious/inv-sig-helper:latest |
 | invidious-db | docker.io/library/postgres:14 |
 | invoice-ninja | invoiceninja/invoiceninja-debian:5 |
 | invoice-ninja_proxy | nginx |
@@ -69,7 +71,6 @@
 | jitsi-web | jitsi/web:stable |
 | joplin-db | postgres:17-alpine |
 | joplin | joplin/server:latest |
-| libretranslate | libretranslate/libretranslate |
 | lidarr | lscr.io/linuxserver/lidarr:latest |
 | lidify | thewicklowwolf/lidify:latest |
 | lldap | lldap/lldap:stable |
@@ -94,8 +95,6 @@
 | open-webui | ghcr.io/open-webui/open-webui:main |
 | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest |
 | parseable | containers.parseable.com/parseable/parseable:latest |
-| peppermint | pepperlabs/peppermint:latest |
-| peppermint-pg-db | postgres:17-alpine |
 | pgbackweb | eduardolat/pgbackweb:latest |
 | pgbackweb-db | postgres:16-alpine |
 | plantuml-server | plantuml/plantuml-server:jetty |
@@ -133,6 +132,8 @@
 | swag | lscr.io/linuxserver/swag:latest |
 | tandoor | vabene1111/recipes |
 | tandoor-pg | postgres:16-alpine |
+| traccar | traccar/traccar:latest |
+| traccar-pg | postgres:16-alpine |
 | unmanic | josh5/unmanic:latest |
 | uptimekuma | louislam/uptime-kuma:latest |
 | vault | hashicorp/vault:latest |
@@ -143,6 +144,16 @@
 | web-check | lissy93/web-check |
 | your_spotify | lscr.io/linuxserver/your_spotify:latest |
 | youtubedl | nbr23/youtube-dl-server:latest |
+| zammad-backup | postgres: |
+| zammad-elasticsearch | bitnami/elasticsearch: |
+| zammad-init | : |
+| zammad-memcached | memcached: |
+| zammad-nginx | : |
+| zammad-postgresql | postgres: |
+| zammad-railsserver | : |
+| zammad-redis | redis: |
+| zammad-scheduler | : |
+| zammad-websocket | : |
 | zitadel | ghcr.io/zitadel/zitadel:latest |
 | zitadel-pg-db | postgres:16-alpine |
 

ansible/app-configs/crowdsec_local-api-credentials.yaml.j2

@@ -1,6 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-url: http://0.0.0.0:8080
-login: localhost
-password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['CROWDSEC_LOCAL_API_KEY'] }}

ansible/app-configs/gitea_act-runner_config.yaml.j2

@@ -0,0 +1,101 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 2
+  # Extra environment variables to run jobs.
+  envs:
+    A_TEST_ENV_NAME_1: a_test_env_value_1
+    A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # The timeout for the runner to wait for running jobs to finish when shutting down.
+  # Any running jobs that haven't finished after this timeout will be cancelled.
+  shutdown_timeout: 0s
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+  # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `daemon`, will use labels in `.runner` file.
+  labels:
+    - "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+    - "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
+    - "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: "192.168.1.254"
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 63604
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: "compose_default"
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options:
+  # The parent directory of a job's working directory.
+  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
+  # If the path starts with '/', the '/' will be trimmed.
+  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: []
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+  # Pull docker image(s) even if already present
+  force_pull: false
+  # Rebuild docker image(s) even if already present
+  force_rebuild: false
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

ansible/app-configs/homepage_settings.yaml.j2

@@ -23,7 +23,7 @@ provider: duckduckgo
 layout:
   System Administration:
     style: row
-    columns: 3
+    columns: 4
     # fiveColumns: true
   Infrastructure/App Performance Monitoring:
     style: row

ansible/app-configs/invidious_config.yml.j2

@@ -1,949 +0,0 @@
-#########################################
-#
-#  Database and other external servers
-#
-#########################################
-
-##
-## Database configuration with separate parameters.
-## This setting is MANDATORY, unless 'database_url' is used.
-##
-db:
-  user: kemal
-  host: invidious-db
-  port: 5432
-  dbname: invidious
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_PG_DB_PASSWORD'] }}
-
-##
-## Database configuration using a single URI. This is an
-## alternative to the 'db' parameter above. If both forms
-## are used, then only database_url is used.
-## This setting is MANDATORY, unless 'db' is used.
-##
-## Note: The 'database_url' setting allows the use of UNIX
-## sockets. To do so, remove the IP address (or FQDN) and port
-## and append the 'host' parameter. E.g:
-##   postgres://kemal:kemal@/invidious?host=/var/run/postgresql
-##
-## Accepted values: a postgres:// URI
-## Default: postgres://kemal:kemal@localhost:5432/invidious
-##
-#database_url: postgres://kemal:kemal@localhost:5432/invidious
-
-##
-## Enable automatic table integrity check. This will create
-## the required tables and columns if anything is missing.
-##
-## Accepted values: true, false
-## Default: false
-##
-check_tables: true
-
-
-##
-## Path to an external signature resolver, used to emulate
-## the Youtube client's Javascript. If no such server is
-## available, some videos will not be playable.
-##
-## When this setting is commented out, no external
-## resolver will be used.
-##
-## Accepted values: a path to a UNIX socket or "<IP>:<Port>"
-## Default: <none>
-##
-signature_server: invidious-sig-helper:12999
-
-
-#########################################
-#
-#  Server config
-#
-#########################################
-
-# -----------------------------
-#  Network (inbound)
-# -----------------------------
-
-##
-## Port to listen on for incoming connections.
-##
-## Note: Ports lower than 1024 requires either root privileges
-## (not recommended) or the "CAP_NET_BIND_SERVICE" capability
-## (See https://stackoverflow.com/a/414258 and `man capabilities`)
-##
-## Accepted values: 1-65535
-## Default: 3000
-##
-#port: 3000
-
-##
-## When the invidious instance is behind a proxy, and the proxy
-## listens on a different port than the instance does, this lets
-## invidious know about it. This is used to craft absolute URLs
-## to the instance (e.g in the API).
-##
-## Note: This setting is MANDATORY if invidious is behind a
-## reverse proxy.
-##
-## Accepted values: 1-65535
-## Default: <none>
-##
-#external_port:
-
-##
-## Interface address to listen on for incoming connections.
-##
-## Accepted values: a valid IPv4 or IPv6 address.
-## default: 0.0.0.0  (listen on all interfaces)
-##
-#host_binding: 0.0.0.0
-
-##
-## Domain name under which this instance is hosted. This is
-## used to craft absolute URLs to the instance (e.g in the API).
-## The domain MUST be defined if your instance is accessed from
-## a domain name (like 'example.com').
-##
-## Accepted values: a fully qualified domain name (FQDN)
-## Default: <none>
-##
-# domain:
-
-##
-## Tell Invidious that it is behind a proxy that provides only
-## HTTPS, so all links must use the https:// scheme. This
-## setting MUST be set to true if invidious is behind a
-## reverse proxy serving HTTPs.
-##
-## Accepted values: true, false
-## Default: false
-##
-https_only: false
-
-##
-## Enable/Disable 'Strict-Transport-Security'. Make sure that
-## the domain specified under 'domain' is served securely.
-##
-## Accepted values: true, false
-## Default: true
-##
-#hsts: true
-
-
-# -----------------------------
-#  Network (outbound)
-# -----------------------------
-
-##
-## Disable proxying server-wide. Can be disable as a whole, or
-## only for a single function.
-##
-## Accepted values: true, false, dash, livestreams, downloads, local
-## Default: false
-##
-#disable_proxy: false
-
-##
-## Size of the HTTP pool used to connect to youtube. Each
-## domain ('youtube.com', 'ytimg.com', ...) has its own pool.
-##
-## Accepted values: a positive integer
-## Default: 100
-##
-#pool_size: 100
-
-
-##
-## Additional cookies to be sent when requesting the youtube API.
-##
-## Accepted values: a string in the format "name1=value1; name2=value2..."
-## Default: <none>
-##
-#cookies:
-
-##
-## Force connection to youtube over a specific IP family.
-##
-## Note: This may sometimes resolve issues involving rate-limiting.
-## See https://github.com/ytdl-org/youtube-dl/issues/21729.
-##
-## Accepted values: ipv4, ipv6
-## Default: <none>
-##
-#force_resolve:
-
-##
-## Configuration for using a HTTP proxy
-##
-## If unset, then no HTTP proxy will be used.
-## 
-#http_proxy:
-#  user:
-#  password:
-#  host:
-#  port:
-
-
-##
-## Use Innertube's transcripts API instead of timedtext for closed captions
-##
-## Useful for larger instances as InnerTube is **not ratelimited**. See https://github.com/iv-org/invidious/issues/2567
-##
-## Subtitle experience may differ slightly on Invidious.
-##
-## Accepted values: true, false
-## Default: false
-##
-# use_innertube_for_captions: false
-
-##
-## Send Google session informations. This is useful when Invidious is blocked
-## by the message "This helps protect our community."
-## See https://github.com/iv-org/invidious/issues/4734.
-##
-## Warning: These strings gives much more identifiable information to Google!
-##
-## Accepted values: String
-## Default: <none>
-##
-po_token: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_PO_TOKEN'] }}
-visitor_data: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_VISITOR_DATA'] }}
-
-# -----------------------------
-#  Logging
-# -----------------------------
-
-##
-## Path to log file. Can be absolute or relative to the invidious
-## binary. This is overridden if "-o OUTPUT" or "--output=OUTPUT"
-## are passed on the command line.
-##
-## Accepted values: a filesystem path or 'STDOUT'
-## Default: STDOUT
-##
-#output: STDOUT
-
-##
-## Logging Verbosity. This is overridden if "-l LEVEL" or
-## "--log-level=LEVEL" are passed on the command line.
-##
-## Accepted values: All, Trace, Debug, Info, Warn, Error, Fatal, Off
-## Default: Info
-##
-#log_level: Info
-
-##
-## Enables colors in logs. Useful for debugging purposes
-## This is overridden if "-k" or "--colorize"
-## are passed on the command line.
-## Colors are also disabled if the environment variable
-## NO_COLOR is present and has any value
-##
-## Accepted values: true, false
-## Default: true
-##
-#colorize_logs: false
-
-# -----------------------------
-#  Features
-# -----------------------------
-
-##
-## Enable/Disable the "Popular" tab on the main page.
-##
-## Accepted values: true, false
-## Default: true
-##
-#popular_enabled: true
-
-##
-## Enable/Disable statstics (available at /api/v1/stats).
-## The following data is available:
-##   - Software name ("invidious") and version+branch (same data as
-##     displayed in the footer, e.g: "2021.05.13-75e5b49" / "master")
-##   - The value of the 'registration_enabled' config (true/false)
-##   - Number of currently registered users
-##   - Number of registered users who connected in the last month
-##   - Number of registered users who connected in the last 6 months
-##   - Timestamp of the last server restart
-##   - Timestamp of the last "Channel Refresh" job execution
-##
-## Warning: This setting MUST be set to true if you plan to run
-## a public instance. It is used by api.invidious.io to refresh
-## your instance's status.
-##
-## Accepted values: true, false
-## Default: false
-##
-#statistics_enabled: false
-
-
-# -----------------------------
-#  Users and accounts
-# -----------------------------
-
-##
-## Allow/Forbid Invidious (local) account creation. Invidious
-## accounts allow users to subscribe to channels and to create
-## playlists without a Google account.
-##
-## Accepted values: true, false
-## Default: true
-##
-#registration_enabled: true
-
-##
-## Allow/Forbid users to log-in.
-##
-## Accepted values: true, false
-## Default: true
-##
-#login_enabled: true
-
-##
-## Enable/Disable the captcha challenge on the login page.
-##
-## Note: this is a basic captcha challenge that doesn't
-## depend on any third parties.
-##
-## Accepted values: true, false
-## Default: true
-##
-#captcha_enabled: true
-
-##
-## List of usernames that will be granted administrator rights.
-## A user with administrator rights will be able to change the
-## server configuration options listed below in /preferences,
-## in addition to the usual user preferences.
-##
-## Server-wide settings:
-##   - popular_enabled
-##   - captcha_enabled
-##   - login_enabled
-##   - registration_enabled
-##   - statistics_enabled
-## Default user preferences:
-##   - default_home
-##   - feed_menu
-##
-## Accepted values: an array of strings
-## Default: [""]
-##
-#admins: [""]
-
-##
-## Enable/Disable the user notifications for all users
-##
-## Note: On large instances, it is recommended to set this option to 'false'
-## in order to reduce the amount of data written to the database, and hence
-## improve the overall performance of the instance.
-##
-## Accepted values: true, false
-## Default: true
-##
-#enable_user_notifications: true
-
-# -----------------------------
-#  Background jobs
-# -----------------------------
-
-##
-## Number of threads to use when crawling channel videos (during
-## subscriptions update).
-##
-## Notes: This setting is overridden if either "-c THREADS" or
-## "--channel-threads=THREADS" is passed on the command line.
-##
-## Accepted values: a positive integer
-## Default: 1
-##
-channel_threads: 1
-
-##
-## Time interval between two executions of the job that crawls
-## channel videos (subscriptions update).
-##
-## Accepted values: a valid time interval (like 1h30m or 90m)
-## Default: 30m
-##
-#channel_refresh_interval: 30m
-
-##
-## Forcefully dump and re-download the entire list of uploaded
-## videos when crawling channel (during subscriptions update).
-##
-## Accepted values: true, false
-## Default: false
-##
-full_refresh: false
-
-##
-## Number of threads to use when updating RSS feeds.
-##
-## Notes: This setting is overridden if either "-f THREADS" or
-## "--feed-threads=THREADS" is passed on the command line.
-##
-## Accepted values: a positive integer
-## Default: 1
-##
-feed_threads: 1
-
-
-jobs:
-
-  ## Options for the database cleaning job
-  clear_expired_items:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-  ## Options for the channels updater job
-  refresh_channels:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-  ## Options for the RSS feeds updater job
-  refresh_feeds:
-
-    ## Enable/Disable job
-    ##
-    ## Accepted values: true, false
-    ## Default: true
-    ##
-    enable: true
-
-
-# -----------------------------
-#  Miscellaneous
-# -----------------------------
-
-##
-## custom banner displayed at the top of every page. This can
-## used for instance announcements, e.g.
-##
-## Accepted values: any string. HTML is accepted.
-## Default: <none>
-##
-#banner:
-
-##
-## Subscribe to channels using PubSubHub (Google PubSubHubbub service).
-## PubSubHub allows Invidious to be instantly notified when a new video
-## is published on any subscribed channels. When PubSubHub is not used,
-## Invidious will check for new videos every minute.
-##
-## Note: This setting is recommended for public instances.
-##
-## Note 2:
-##  - Requires a public instance (it uses /feed/webhook/v1)
-##  - Requires 'domain' and 'hmac_key' to be set.
-##  - Setting this parameter to any number greater than zero will
-##    enable channel subscriptions via PubSubHub, but will limit the
-##    amount of concurrent subscriptions.
-##
-## Accepted values: true, false, a positive integer
-## Default: false
-##
-#use_pubsub_feeds: false
-
-##
-## HMAC signing key used for CSRF tokens, cookies and pubsub
-## subscriptions verification.
-##
-## Note: This parameter is mandatory and should be a random string.
-## Such random string can be generated on linux with the following
-## command: `pwgen 20 1`
-##
-## Accepted values: a string
-## Default: <none>
-##
-hmac_key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['INVID_HMAC_KEY'] }}
-
-##
-## List of video IDs where the "download" widget must be
-## disabled, in order to comply with DMCA requests.
-##
-## Accepted values: an array of string
-## Default: <none>
-##
-#dmca_content:
-
-##
-## Cache video annotations in the database.
-##
-## Warning: empty annotations or annotations that only contain
-## cards won't be cached.
-##
-## Accepted values: true, false
-## Default: false
-##
-#cache_annotations: false
-
-##
-## Source code URL. If your instance is running a modified source
-## code, you MUST publish it somewhere and set this option.
-##
-## Accepted values: a string
-## Default: <none>
-##
-#modified_source_code_url: ""
-
-##
-## Maximum custom playlist length limit.
-##
-## Accepted values: Integer
-## Default: 500
-##
-#playlist_length_limit: 500
-
-#########################################
-#
-#  Default user preferences
-#
-#########################################
-
-##
-## NOTE: All the settings below define the default user
-## preferences. They will apply to ALL users connecting
-## without a preferences cookie (so either on the first
-## connection to the instance or after clearing the
-## browser's cookies).
-##
-
-default_user_preferences:
-
-  # -----------------------------
-  #  Internationalization
-  # -----------------------------
-
-  ##
-  ## Default user interface language (locale).
-  ##
-  ## Note: When hosting a public instance, overriding the
-  ## default (english) is not recommended, as it may
-  ## people using other languages.
-  ##
-  ## Accepted values:
-  ##   ar      (Arabic)
-  ##   da      (Danish)
-  ##   de      (German)
-  ##   en-US   (english, US)
-  ##   el      (Greek)
-  ##   eo      (Esperanto)
-  ##   es      (Spanish)
-  ##   fa      (Persian)
-  ##   fi      (Finnish)
-  ##   fr      (French)
-  ##   he      (Hebrew)
-  ##   hr      (Hungarian)
-  ##   id      (Indonesian)
-  ##   is      (Icelandic)
-  ##   it      (Italian)
-  ##   ja      (Japanese)
-  ##   nb-NO   (Norwegian, Bokmål)
-  ##   nl      (Dutch)
-  ##   pl      (Polish)
-  ##   pt-BR   (Portuguese, Brazil)
-  ##   pt-PT   (Portuguese, Portugal)
-  ##   ro      (Romanian)
-  ##   ru      (Russian)
-  ##   sv      (Swedish)
-  ##   tr      (Turkish)
-  ##   uk      (Ukrainian)
-  ##   zh-CN   (Chinese, China)  (a.k.a "Simplified Chinese")
-  ##   zh-TW   (Chinese, Taiwan) (a.k.a "Traditional Chinese")
-  ##
-  ## Default: en-US
-  ##
-  #locale: en-US
-
-  ##
-  ## Default geographical location for content.
-  ##
-  ## Accepted values:
-  ##   AE, AR, AT, AU, AZ, BA, BD, BE, BG, BH, BO, BR, BY, CA, CH, CL, CO, CR,
-  ##   CY, CZ, DE, DK, DO, DZ, EC, EE, EG, ES, FI, FR, GB, GE, GH, GR, GT, HK,
-  ##   HN, HR, HU, ID, IE, IL, IN, IQ, IS, IT, JM, JO, JP, KE, KR, KW, KZ, LB,
-  ##   LI, LK, LT, LU, LV, LY, MA, ME, MK, MT, MX, MY, NG, NI, NL, NO, NP, NZ,
-  ##   OM, PA, PE, PG, PH, PK, PL, PR, PT, PY, QA, RO, RS, RU, SA, SE, SG, SI,
-  ##   SK, SN, SV, TH, TN, TR, TW, TZ, UA, UG, US, UY, VE, VN, YE, ZA, ZW
-  ##
-  ## Default: US
-  ##
-  #region: US
-
-  ##
-  ## Top 3 preferred languages for video captions.
-  ##
-  ## Note: overriding the default (no preferred
-  ## caption language) is not recommended, in order
-  ## to not penalize people using other languages.
-  ##
-  ## Accepted values: a three-entries array.
-  ## Each entry can be one of:
-  ##   "English", "English (auto-generated)",
-  ##   "Afrikaans", "Albanian", "Amharic", "Arabic",
-  ##   "Armenian", "Azerbaijani", "Bangla", "Basque",
-  ##   "Belarusian", "Bosnian", "Bulgarian", "Burmese",
-  ##   "Catalan", "Cebuano", "Chinese (Simplified)",
-  ##   "Chinese (Traditional)", "Corsican", "Croatian",
-  ##   "Czech", "Danish", "Dutch", "Esperanto", "Estonian",
-  ##   "Filipino", "Finnish", "French", "Galician", "Georgian",
-  ##   "German", "Greek", "Gujarati", "Haitian Creole", "Hausa",
-  ##   "Hawaiian", "Hebrew", "Hindi", "Hmong", "Hungarian",
-  ##   "Icelandic", "Igbo", "Indonesian", "Irish", "Italian",
-  ##   "Japanese", "Javanese", "Kannada", "Kazakh", "Khmer",
-  ##   "Korean", "Kurdish", "Kyrgyz", "Lao", "Latin", "Latvian",
-  ##   "Lithuanian", "Luxembourgish", "Macedonian",
-  ##   "Malagasy", "Malay", "Malayalam", "Maltese", "Maori",
-  ##   "Marathi", "Mongolian", "Nepali", "Norwegian Bokmål",
-  ##   "Nyanja", "Pashto", "Persian", "Polish", "Portuguese",
-  ##   "Punjabi", "Romanian", "Russian", "Samoan",
-  ##   "Scottish Gaelic", "Serbian", "Shona", "Sindhi",
-  ##   "Sinhala", "Slovak", "Slovenian", "Somali",
-  ##   "Southern Sotho", "Spanish", "Spanish (Latin America)",
-  ##   "Sundanese",  "Swahili", "Swedish", "Tajik", "Tamil",
-  ##   "Telugu", "Thai", "Turkish", "Ukrainian", "Urdu",
-  ##   "Uzbek", "Vietnamese", "Welsh", "Western Frisian",
-  ##   "Xhosa", "Yiddish", "Yoruba", "Zulu"
-  ##
-  ## Default: ["", "", ""]
-  ##
-  #captions: ["", "", ""]
-
-
-  # -----------------------------
-  #  Interface
-  # -----------------------------
-
-  ##
-  ## Enable/Disable dark mode.
-  ##
-  ## Accepted values: "dark", "light", "auto"
-  ## Default: "auto"
-  ##
-  #dark_mode: "auto"
-
-  ##
-  ## Enable/Disable thin mode (no video thumbnails).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #thin_mode: false
-
-  ##
-  ## List of feeds available on the home page.
-  ##
-  ## Note: "Subscriptions" and "Playlists" are only visible
-  ## when the user is logged in.
-  ##
-  ## Accepted values: A list of strings
-  ## Each entry can be one of: "Popular", "Trending",
-  ##    "Subscriptions", "Playlists"
-  ##
-  ## Default: ["Popular", "Trending", "Subscriptions", "Playlists"]  (show all feeds)
-  ##
-  #feed_menu: ["Popular", "Trending", "Subscriptions", "Playlists"]
-
-  ##
-  ## Default feed to display on the home page.
-  ##
-  ## Note: setting this option to "Popular" has no
-  ## effect when 'popular_enabled' is set to false.
-  ##
-  ## Accepted values: Popular, Trending, Subscriptions, Playlists, <none>
-  ## Default: Popular
-  ##
-  #default_home: Popular
-
-  ##
-  ## Default number of results to display per page.
-  ##
-  ## Note: this affects invidious-generated pages only, such
-  ## as watch history and subscription feeds. Playlists, search
-  ## results and channel videos depend on the data returned by
-  ## the Youtube API.
-  ##
-  ## Accepted values: any positive integer
-  ## Default: 40
-  ##
-  #max_results: 40
-
-  ##
-  ## Show/hide annotations.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #annotations: false
-
-  ##
-  ## Show/hide annotation.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #annotations_subscribed: false
-
-  ##
-  ## Type of comments to display below video.
-  ##
-  ## Accepted values: a two-entries array.
-  ## Each entry can be one of: "youtube", "reddit", ""
-  ##
-  ## Default: ["youtube", ""]
-  ##
-  #comments: ["youtube", ""]
-
-  ##
-  ## Default player style.
-  ##
-  ## Accepted values: invidious, youtube
-  ## Default: invidious
-  ##
-  #player_style: invidious
-
-  ##
-  ## Show/Hide the "related videos" sidebar when
-  ## watching a video.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #related_videos: true
-
-
-  # -----------------------------
-  #  Video player behavior
-  # -----------------------------
-
-  ##
-  ## This option controls the value of the HTML5 <video> element's
-  ## "preload" attribute.
-  ##
-  ## If set to 'false', no video data will be loaded until the user
-  ## explicitly starts the video by clicking the "Play" button.
-  ## If set to 'true', the web browser will buffer some video data
-  ## while the page is loading.
-  ##
-  ## See: https://www.w3schools.com/tags/att_video_preload.asp
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #preload: true
-
-  ##
-  ## Automatically play videos on page load.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #autoplay: false
-
-  ##
-  ## Automatically load the "next" video (either next in
-  ## playlist or proposed) when the current video ends.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #continue: false
-
-  ##
-  ## Autoplay next video by default.
-  ##
-  ## Note: Only effective if 'continue' is set to true.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #continue_autoplay: true
-
-  ##
-  ## Play videos in Audio-only mode by default.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #listen: false
-
-  ##
-  ## Loop videos automatically.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #video_loop: false
-
-
-  # -----------------------------
-  #  Video playback settings
-  # -----------------------------
-
-  ##
-  ## Default video quality.
-  ##
-  ## Accepted values: dash, hd720, medium, small
-  ## Default: hd720
-  ##
-  #quality: hd720
-
-  ##
-  ## Default dash video quality.
-  ##
-  ## Note: this setting only takes effet if the
-  ## 'quality' parameter is set to "dash".
-  ##
-  ## Accepted values:
-  ##    auto, best, 4320p, 2160p, 1440p, 1080p,
-  ##    720p, 480p, 360p, 240p, 144p, worst
-  ## Default: auto
-  ##
-  #quality_dash: auto
-
-  ##
-  ## Default video playback speed.
-  ##
-  ## Accepted values: 0.25, 0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0
-  ## Default: 1.0
-  ##
-  #speed: 1.0
-
-  ##
-  ## Default volume.
-  ##
-  ## Accepted values: 0-100
-  ## Default: 100
-  ##
-  #volume: 100
-
-  ##
-  ## Allow 360° videos to be played.
-  ##
-  ## Note: This feature requires a WebGL-enabled browser.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #vr_mode: true
-  
-  ##
-  ## Save the playback position
-  ## Allow to continue watching at the previous position when
-  ## watching the same video.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #save_player_pos: false
-
-  # -----------------------------
-  #  Subscription feed
-  # -----------------------------
-
-  ##
-  ## In the "Subscription" feed, only show the latest video
-  ## of each channel the user is subscribed to.
-  ##
-  ## Note: when combined with 'unseen_only', the latest unseen
-  ## video of each channel will be displayed instead of the
-  ## latest by date.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #latest_only: false
-
-  ##
-  ## Enable/Disable user subscriptions desktop notifications.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #notifications_only: false
-
-  ##
-  ## In the "Subscription" feed, Only show the videos that the
-  ## user haven't watched yet (i.e which are not in their watch
-  ## history).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #unseen_only: false
-
-  ##
-  ## Default sorting parameter for subscription feeds.
-  ##
-  ## Accepted values:
-  ##   'alphabetically'
-  ##   'alphabetically - reverse'
-  ##   'channel name'
-  ##   'channel name - reverse'
-  ##   'published'
-  ##   'published - reverse'
-  ##
-  ## Default: published
-  ##
-  #sort: published
-
-
-  # -----------------------------
-  #  Miscellaneous
-  # -----------------------------
-
-  ##
-  ## Proxy videos through instance by default.
-  ##
-  ## Warning: As most users won't change this setting in their
-  ## preferences, defaulting  to true will significantly
-  ## increase the instance's network usage, so make sure that
-  ## your server's connection can handle it.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #local: false
-
-  ##
-  ## Show the connected user's nick at the top right.
-  ##
-  ## Accepted values: true, false
-  ## Default: true
-  ##
-  #show_nick: true
-
-  ##
-  ## Automatically redirect to a random instance when the user uses
-  ## any "switch invidious instance" link (For videos, it's the plane
-  ## icon, next to "watch on youtube" and "listen"). When set to false,
-  ## the user is sent to https://redirect.invidious.io instead, where
-  ## they can manually select an instance.
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #automatic_instance_redirect: false
-
-  ##
-  ## Show the entire video description by default (when set to 'false',
-  ## only the first few lines of the description are shown and a
-  ## "show more" button allows to expand it).
-  ##
-  ## Accepted values: true, false
-  ## Default: false
-  ##
-  #extend_desc: false

ansible/app-configs/sabnzbd_sabnzbd.ini.j2

@@ -342,7 +342,7 @@ host = news.newshosting.com
 port = 563
 timeout = 60
 username = thetrezuredone
-password = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['SLSK_USER_PASSWORD'] }}
+password = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['SLSKD_PASSWORD'] }}
 connections = 8
 ssl = 1
 ssl_verify = 3

ansible/app-configs/soularr_config.ini.j2

@@ -1,76 +0,0 @@
-{% set vault_addr = 'https://vault.trez.wtf' %}
-{% set secrets_path = 'rinoa-docker/env' %}
-
-[Lidarr]
-api_key = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['LIDARR_API_KEY'] }}
-host_url = http://lidarr:8686
-#This should be the path mounted in lidarr that points to your slskd download directory.
-#If Lidarr is not running in Docker then this may just be the same dir as Slskd is using below.
-download_dir = /storage
-
-[Slskd]
-#Api key from Slskd. Need to set this up manually. See link to Slskd docs above.
-api_key = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['SLSKD_API_KEY'] }}
-host_url = http://gluetun:5030
-#Slskd download directory. Should have set it up when installing Slskd.
-download_dir = /app/downloads
-#Removes searches from Slskd after the search finishes.
-delete_searches = False
-#Maximum time (in seconds) that the script will wait for downloads to complete.
-#This is used to prevent the script from running forever due to a stalled download. Defaults to 1 hour.
-stalled_timeout = 3600
-
-[Release Settings]
-#Selects the release with the most common amount of tracks out of all the releases.
-use_most_common_tracknum = True
-allow_multi_disc = True
-#See full list of countries below.
-accepted_countries = Europe,Japan,United Kingdom,United States,[Worldwide],Australia,Canada
-#See full list of formats below.
-accepted_formats = CD,Digital Media,Vinyl
-
-[Search Settings]
-search_timeout = 5000
-maximum_peer_queue = 50
-#Min upload speed in bit/s
-minimum_peer_upload_speed = 0
-#Min match ratio accepted when comparing lidarr track names to soulseek filenames.
-minimum_filename_match_ratio = 0.5
-#Specify the file types you prefer from most to least. As well as their attributes such as bitrate / samplerate / bitdepth.
-#For flacs you can choose the bitdepth/samplerate. And for mp3s the bitrate.
-#If you do not care about the specific quality you can still just put "flac" or "mp3".
-#Soularr will then just look at the filetype and ignore file attributes.
-allowed_filetypes = flac 24/192,flac 16/44.1,flac,mp3 320,mp3
-ignored_users = User1,User2,Fred,Bob
-#Set to False if you only want to search for complete albums
-search_for_tracks = True
-#Set to True if you want to add the artist's name to the beginning of the search for albums
-album_prepend_artist = False
-track_prepend_artist = True
-#Valid search types: all || incrementing_page || first_page
-  #"all" will search for every wanted record everytime soularr is run.
-  #"incrementing_page" will start with the first page and increment to the next on each run.
-  #"first_page" will repeatedly search the first page.
-#If using the search type "first_page" remove_wanted_on_failure should be enabled.
-search_type = incrementing_page
-#How mancy records to grab each run, must be a number between 1 - 2,147,483,647
-number_of_albums_to_grab = 10
-#Unmonitors the album if Soularr can't find it and places it in "failure_list.txt".
-#Failed albums can be re monitored by filtering "Unmonitored" in the Lidarr wanted list.
-remove_wanted_on_failure = False
-#Comma separated list of words that can't be in the title of albums or tracks. Case insensitive.
-title_blacklist = BlacklistWord1,blacklistword2
-#Lidarr source to use for searching. Accepted values are "all", "missing", or "cutoff_unmet". If "all" is selected
-# then both missing and cutoff_unme will be searched. The default value is "missing".
-search_source = missing
-
-[Logging]
-#These options are passed into the logger's basicConfig() method as-is.
-#This means, if you're familiar with Python's logging module, you can configure
-#the logger with options beyond what's listed here by default.
-#For more information on available options  --  https://docs.python.org/3/library/logging.html#logging.basicConfig
-level = INFO
-# Format of log message  --  https://docs.python.org/3/library/logging.html#logrecord-attributes
-format = [%(levelname)s|%(module)s|L%(lineno)d] %(asctime)s: %(message)s
-# Format of datetimes  --  https://docs.python.org/3/library/time.html#time.strftime
-datefmt = %Y-%m-%dT%H:%M:%S%z

ansible/app-configs/soulseek_slskd.yml.j2

@@ -1,212 +1,238 @@
 {% set vault_addr = 'https://vault.trez.wtf' %}
 {% set secrets_path = 'rinoa-docker/env' %}
 
-directories:
+# debug: false
-  incomplete: /app/incomplete
+# remote_configuration: false
-  downloads: /app/downloads
+# remote_file_management: false
-shares:
+# instance_name: default
-  directories:
+# flags:
-    - /music
+#   no_logo: false
-rooms:
+#   no_start: false
-  - '! meow chat :3'
+#   no_config_watch: false
-  - '#ANUS'
+#   no_connect: false
-  - '#CORONAVIRUS'
+#   no_share_scan: false
-  - '#Horrorcore'
+#   force_share_scan: false
-  - '#La France'
+#   no_version_check: false
-  - '#icilombre-hardcore'
+#   log_sql: false
-  - '#polska'
+#   experimental: false
-  - '#vegan'
+#   volatile: false
-  - $$RARE RAP MUSIC$$
+#   case_sensitive_reg_ex: false
-  - ([6)]
+#   legacy_windows_tcp_keepalive: false
-  - +Autism+
+# relay:
-  - +BlackMetal+
+#   enabled: false
-  - +HIP_HOP_SCENE_RELEASES+
+#   mode: controller # controller (default), agent, or debug (for local development)
-  - /mu/
+#   # controller config is required when running in 'agent' mode
-  - 60lover
+#   # this specifies the relay controller that will be controlling this agent
-  - 60lover v2
+#   controller:
-  - 70 Rare groove Soul Jazz
+#     address: https://some.site.com:5000
-  - 80's 12 Inches & More
+#     ignore_certificate_errors: false
-  - 90's Rare Riddim !!
+#     api_key: <a 16-255 character string corresponding to one of the controller's 'readwrite' or 'administrator' API keys>
-  - 90's emo
+#     secret: <a 16-255 character shared secret matching the controller's config for this agent>
-  - <>Electronics Labels<>
+#     downloads: false
-  - ACID
+#   # agent config is optional when running in 'controller' mode
-  - ARGENTINA
+#   # this specifies all of the agents capable of connecting
-  - "ATLLUMINATI\u201Cawareness"
+#   agents:
-  - AUSTRALIA
+#     my_agent:
-  - Alcohol
+#       instance_name: my_agent # make sure the top-level instance_name of the agent matches!
-  - Ambient
+#       secret: <a 16-255 character string unique to this agent>
-  - Anime
+#       cidr: 0.0.0.0/0,::/0
-  - Audiobooks
+# permissions:
-  - Avantgarde
+#   file:
-  - BDSM
+#     mode: ~ # not for Windows, chmod syntax, e.g. 644, 777. can't escalate beyond umask
-  - BLUES BUNKER MUSIC
+# directories:
-  - BOB DYLAN ROOM
+#   incomplete: ~
-  - BigEdsClassicRock
+#   downloads: ~
-  - BigedsSixties
+# shares:
-  - Blues&Soul
+#   directories:
-  - Bootlegged concerts
+#     - ~
-  - Brasil
+#   filters:
-  - Breakcore
+#     - \.ini$
-  - CHILE
+#     - Thumbs.db$
-  - Canada
+#     - \.DS_Store$
-  - China Room
+#   cache:
-  - Chiptunes
+#     storage_mode: memory
-  - Christians
+#     workers: 16
-  - Classical
+#     retention: ~ # retain indefinitely (do not automatically re-scan)
-  - Come To The Sabbath !
+# rooms:
-  - Communism
+#   - ~
-  - DEATH METAL CLUB
+# global:
-  - Dark Ambient
+#   upload:
-  - De Koffie Shop
+#     slots: 20
-  - De Kroeg
+#     speed_limit: 1000 # in kibibytes
-  - Deathrock
+#   limits:
-  - DieMilitarmusik
+#     queued:
-  - Disco Classics
+#       files: 500
-  - Doom Metal
+#       megabytes: 5000
-  - Doujin Music
+#     daily:
-  - Dub Techno
+#       files: 1000
-  - Dubstep
+#       megabytes: 10000
-  - EBM-GOTHIC-INDUSTRIAL
+#       failures: 200
-  - EBooks
+#     weekly:
-  - Emo
+#       files: 5000
-  - Eurodance
+#       megabytes: 50000
-  - Eurovision Song Contest
+#       failures: 1000
-  - Experimental Electronica
+#   download:
-  - FOLK MUSIC
+#     slots: 500
-  - Free Jazz
+#     speed_limit: 1000
-  - Furry
+# groups:
-  - Gay
+#   default:
-  - Gothic
+#     upload:
-  - Greece
+#       priority: 500
-  - Grindcore
+#       strategy: roundrobin
-  - HEE cum eaters 1! !
+#       slots: 10
-  - HOUSE MUSIC LOVERS (AG)
+#     limits:
-  - Happy Hardcore
+#       queued:
-  - Hardcore NL
+#         files: 150
-  - Hardcore/punk
+#         megabytes: 1500
-  - Hip Hop
+#       daily: ~ # no daily limits (weekly still apply)
-  - Horror movies
+#       weekly:
-  - IDM
+#         files: 1500
-  - INDUSTRIAL
+#         megabytes: 15000
-  - IReGGaeGaLaXy
+#         failures: 150
-  - Incredibly Strange Music
+#   leechers:
-  - Israel
+#     thresholds:
-  - Jaz (Full CDs)
+#       files: 1
-  - Jazz
+#       directories: 1
-  - Jazz-Rock-Fusion-Guitar
+#     upload:
-  - Juggalo Family
+#       priority: 999
-  - Jungle
+#       strategy: roundrobin
-  - Korean Music
+#       slots: 1
-  - LANGUAGE EXCHANGE here
+#       speed_limit: 100
-  - LGBTQ+!!
+#     limits:
-  - Last.fm
+#       queued:
-  - Linux
+#         files: 15
-  - Lossless Scores
+#         megabytes: 150
-  - MOVIES
+#       daily:
-  - Mac Users
+#         files: 30
-  - Metal
+#         megabytes: 300
-  - MovieMusic
+#         failures: 10
-  - NORWAY
+#       weekly:
-  - New Crystal Vibrations
+#         files: 150
-  - New Wave
+#         megabytes: 1500
-  - New Zealand
+#         failures: 30
-  - OLD SKOOL GANGSTA SHIT
+#   blacklisted:
-  - OLDSCHOOL 88-94
+#     members:
-  - OLI SHOTA CUB ROOM!
+#       - <username to blacklist>
-  - Original Blues Bunker
+#     cidrs:
-  - PSYCHEDELIA
+#       - <CIDR to blacklist, e.g. 255.255.255.255/32>
-  - PUNK/HARDCORE/GRIND
+#   user_defined:
-  - Portugal
+#     my_buddies:
-  - Post Punk
+#       upload:
-  - Post-Hardcore (modern)
+#         priority: 250
-  - Progressive Rock
+#         strategy: firstinfirstout
-  - Psychedelic/Acid Rock
+#         slots: 10
-  - Psytrance
+#       limits:
-  - Quebec
+#         queued:
-  - REGGAE
+#           files: 1000 # override global default
-  - Rare Music
+#       members:
-  - RareVHS/DVD/Rips
+#         - alice
-  - Retro Gaming
+#         - bob
-  - Romania
+# blacklist:
-  - Room Name
+#   enabled: true
-  - SIsk Idiots !!
+#   file: <path to file containing CIDRs to blacklist>
-  - SLUDGE!
+# filters:
-  - Slovenia
+#   search:
-  - Soundtracks&Scores
+#     request:
-  - Spain
+#       - ^.{1,2}$
-  - Stoner HiVe
+# web:
-  - Stoner Rock
+#   port: 5030
-  - Strange Music
+#   https:
-  - TECHNO, Mixes and Tunes
+#     disabled: false
-  - THC
+#     port: 5031
-  - Talia
+#     force: false
-  - The Dangerous Kitchen
+#     certificate:
-  - TheScoreZone
+#       pfx: ~
-  - Thrash Metal
+#       password: ~
-  - Tinmans Movie Room
+#   url_base: /
-  - Trip-Hop
+#   content_path: wwwroot
-  - Ttalian_dancefloor
+#   logging: false
-  - Twee Folks
+#   authentication:
-  - UK DUB
+#     disabled: false
-  - URIDDIM!!
+#     username: slskd
-  - Ukraine
+#     password: slskd
-  - Underground Hiphop
+#     jwt:
-  - VAPORWAVE
+#       key: ~
-  - Video Game Chat
+#       ttl: 604800000
-  - Vinyl Addicts
+#     api_keys:
-  - Vocaloid
+#       my_api_key:
-  - WHATCDs
+#         key: <some example string between 16 and 255 characters>
-  - World Music
+#         role: readonly # readonly, readwrite, administrator
-  - Yacht Rock
+#         cidr: 0.0.0.0/0,::/0
-  - '[German] [Deutsch]'
+# retention:
-  - abbey road Itd
+#   transfers:
-  - anime cunny
+#     upload:
-  - bleeps&klonks
+#       succeeded: 1440 # 1 day
-  - breakbeat
+#       errored: 30
-  - comics
+#       cancelled: 5
-  - deep house connection
+#     download:
-  - drum'n'bass
+#       succeeded: 1440 # 1 day
-  - eesti mehed
+#       errored: 20160 # 2 weeks 
-  - electro
+#       cancelled: 5
-  - flacfield
+#   files:
-  - food
+#     complete: 20160 # 2 weeks
-  - for Losers
+#     incomplete: 43200 # 30 days
-  - hungary
+#   logs: 259200 # 180 days
-  - indie
+# logger:
-  - japanese music
+#   disk: false
-  - library music
+#   no_color: false
-  - lossless
+#   loki: ~
-  - minimal music
+# metrics:
-  - museek
+#   enabled: false
-  - noise
+#   url: /metrics
-  - 'on'
+#   authentication:
-  - postrock
+#     disabled: false
-  - programming
+#     username: slskd
-  - progressive house
+#     password: slskd
-  - public porn
+# feature:
-  - r/musichoarder
+#   swagger: false
-  - ru
+# soulseek:
-  - shoegaze
+#   address: vps.slsknet.org
-  - tapekvit
+#   port: 2271
-  - test
+#   username: ~
-  - trancEaddict
+#   password: ~
-  - trivia
+#   description: |
-  - what.cd
+#     A slskd user. https://github.com/slskd/slskd
-  - what.cd electronic
+#   listen_ip_address: 0.0.0.0
-  - what.cd-flac
+#   listen_port: 50300
-  - '{Italo Disco'
+#   diagnostic_level: Info
-web:
+#   distributed_network:
-  authentication:
+#     disabled: false
-    username: slskd
+#     disable_children: false
-    password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['SLSKD_WEB_PASSSWORD'] }}
+#     child_limit: 25
-    api_keys:
+#     logging: false
-      my_api_key:
+#   connection:
-        key: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['SLSKD_API_KEY'] }}
+#     timeout:
-        role: readwrite0
+#       connect: 10000
-        cidr: 0.0.0.0/0,::/0
+#       inactivity: 15000
-soulseek:
+#     buffer:
-  address: vps.slsknet.org
+#       read: 16384
-  port: 2271
+#       write: 16384
-  username: Trez.One
+#       transfer: 262144
-  password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['SLSK_USER_PASSWORD'] }}
+#       write_queue: 250
-  diagnostic_level: Info
+#     proxy:
+#       enabled: false
+#       address: ~
+#       port: ~
+#       username: ~
+#       password: ~
+# integration:
+#   ftp:
+#     enabled: false
+#     address: ~
+#     port: ~
+#     username: ~
+#     password: ~
+#     remote_path: /
+#     encryption_mode: auto
+#     ignore_certificate_errors: false
+#     overwrite_existing: true
+#     connection_timeout: 5000
+#     retry_attempts: 3
+#   pushbullet:
+#     enabled: false
+#     access_token: ~
+#     notification_prefix: "From slskd:"
+#     notify_on_private_message: true
+#     notify_on_room_mention: true
+#     retry_attempts: 3
+#     cooldown_time: 900000

ansible/app-configs/vector.yaml.j2

@@ -0,0 +1,32 @@
+  sources:
+    rinoa_docker_logs:
+      type: docker_logs
+      exclude_containers:
+        - zammad-init
+        - vector
+
+  sinks:
+    parseable:
+      type: http
+      method: post
+      batch:
+        max_bytes: 10485760
+        max_events: 1000
+        timeout_secs: 10
+      compression: gzip
+      inputs:
+        - rinoa_docker_logs
+      encoding:
+        codec: json
+      uri: http://parseable:8000/api/v1/ingest'
+      auth:
+        strategy: basic
+        user: admin
+        password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['PARSEABLE_PASSWORD'] }}
+      request:
+        headers:
+          X-P-Stream: vectordemo
+      healthcheck:
+        enabled: true
+        path: 'http://parseable:8000/api/v1/liveness'
+        port: 80

ansible/app-configs/vector_vector.yaml.j2

@@ -2,7 +2,7 @@
     rinoa_docker_logs:
       type: docker_logs
       exclude_containers:
-        - vector
+        - zammad-init
 
   sinks:
     parseable:
@@ -24,7 +24,7 @@
         password: {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['PARSEABLE_PASSWORD'] }}
       request:
         headers:
-          X-P-Stream: rinoa-docker-logs
+          X-P-Stream: vectordemo
       healthcheck:
         enabled: true
         path: 'http://parseable:8000/api/v1/liveness'

ansible/group_vars/all.yml

@@ -1,14 +1,14 @@
 vault_addr: "https://vault.trez.wtf"
 vault_token: !vault |
   $ANSIBLE_VAULT;1.1;AES256
-  30623330336664656231653066343930303830343530323930613666643863623837633738346639
+  66373236656261373330343233616231386539616566613864306436613635323533336365383232
-  3734386663383333386635623931343361343363396434660a633637666539626264653437636134
+  6636653139393566643265303135343864363632393035380a643566373137316363626438356431
-  36616334386264383330323164333432623538366234326563323664353338646331353233396161
+  64653237313866316537326565386164373564353166346334663638636531353337303937346466
-  3030623162373232320a386432393337613431303432613065626163326363316365613937623031
+  3539366634393337620a653133336530333963343638643934303336653935363932643665353234
-  39316566343238363934383833376136323461336666663762383663633531303138616132333938
+  63343565663632633563396131346139666236313863663332386131633831633566373366613738
-  30316334363436333164303035643835316238313038663761636338313433303766626238656234
+  63343634313539336534666632313736343338623538303434316230383764643432646663356238
-  34373436396430646339326361366634363735346637303865373164363663663263646661366663
+  61373132633062346436363036333533623931313037306633616662623032616137613734343638
-  36336334393535386332646461313262646131383932353534363936623961613761333762376561
+  63633031616161623437623935346366636433653435646333313638376161663237323130636433
-  31366662626231346638346339626565653831613865646436643233653066366534
+  31383031646666626163323966393738386233346137326231366263316532343563
 vault_token_cleaned: "{{ vault_token | regex_replace('\\n', '') }}"
 secrets_path: "rinoa-docker/env"