2025-09-22 19:10:44 -04:00
2 changed files with 219 additions and 261 deletions
@@ -43,7 +43,7 @@
 | dead-man-hand | ghcr.io/bkupidura/dead-man-hand:latest |  |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |  |
 | dockflare | alplat/dockflare:stable | Cloudflare Tunnel controller |
-| dockpeek | ghcr.io/dockpeek/dockpeek:v1.6.2 | Real-time port monitoring and discovery |
+| dockpeek | ghcr.io/dockpeek/dockpeek:v1.6.3@sha256:c8985e6aaf1c88bbece6c25932b443d9c182b455ef1ee2c33bf5651f95f92988 | Real-time port monitoring and discovery |
 | duplicati | lscr.io/linuxserver/duplicati:latest | Data backup |
 | easyappointments | alextselegidis/easyappointments:1.5.2 | Highly customizable appointment scheduler |
 | excalidraw | excalidraw/excalidraw:latest | Virtual whiteboard for sketching hand-drawn like diagrams |
@@ -159,7 +159,7 @@
 | reactive-resume-pg | postgres:16-alpine@sha256:1c6d2f6e4d30d49c529e09a627e8178db5011dde88d955eb08db2e135e64aa09 |  |
 | readarr | lscr.io/linuxserver/readarr:develop | eBook/Audiobook Automation |
 | redlib | quay.io/redlib/redlib:latest | Redlib is a private front-end like Invidious but for Reddit |
-| renovate | renovate/renovate:41.97.7-full |  |
+| renovate | renovate/renovate:41.97.12-full@sha256:e20639264151d9dce8f0fc3b1219748f4844a76cc157263551d8e7e061daa60e |  |
 | renovate-valkey | docker.io/bitnami/valkey:latest |  |
 | rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest | Fully customizable communications platform with high standards of data protection |
 | romm | rommapp/romm:latest | Beautiful, powerful, self-hosted ROM manager |
@@ -175,9 +175,9 @@
 | signoz-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
 | signoz-init-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
 | signoz-logspout | pavanputhra/logspout-signoz |  |
-| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.5 |  |
+| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.6 |  |
-| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.5 |  |
+| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.6 |  |
-| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.5 |  |
+| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.6 |  |
 | signoz-zookeeper-1 | bitnami/zookeeper:3.7.1 |  |
 | sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts | Code/DevOps quality/security |
 | sonarqube-pg-db | postgres:17-alpine@sha256:d5f196a551b5cef1c70853c6dd588f456d16ca4ea733e3f31c75bc1ae2f65f3f |  |
@@ -198,7 +198,6 @@
 | uptimekuma | louislam/uptime-kuma:latest | HTTP Endpoint Monitoring |
 | vault | hashicorp/vault:latest | HashiCorp Vault for secrets, key/value stores, etc. |
 | wallos | bellamy/wallos:latest | Subscription Tracking |
 | watchtower | ghcr.io/containrrr/watchtower:latest | Container-based solution for automating Docker container base image updates |
 | web-check | lissy93/web-check | Site scanner for attack vectors, architecture, security configs, and more |
 | whodb | clidey/whodb | Lightweight next-gen database explorer |
 | wizarr | ghcr.io/wizarrrr/wizarr | User invitation management system for Jellyfin, Plex, and Emby |
@@ -40,7 +40,7 @@ x-maxun: &maxun-env
    MAXUN_TELEMETRY: true
    PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 0
-    CHROMIUM_FLAGS: '--disable-gpu --no-sandbox --headless=new'
+    CHROMIUM_FLAGS: "--disable-gpu --no-sandbox --headless=new"
    #DEBUG: pw:api
    #PWDEBUG: 1
 x-penpot-flags: &penpot-flags
@@ -344,7 +344,7 @@ services:
      homepage.href: http://192.168.1.254:54995
      homepage.description: Multi-channel notification API
      homepage.widget.type: customapi
-      homepage.widget.headers: 'Accept: application/json'
+      homepage.widget.headers: "Accept: application/json"
      homepage.widget.url: http://apprise-api:8000/status
      homepage.widget.method: GET
      homepage.widget.mappings[0].label: Status
@@ -368,7 +368,7 @@ services:
    environment:
      ADMIN_USERNAME: admin # creates an admin user on first run with the given user/pass combo
      ADMIN_PASSWORD: ${ARCHIVEBOX_ADMIN_PASSWORD}
-      ALLOWED_HOSTS: '*'                   # set this to the hostname(s) you're going to serve the site from!
+      ALLOWED_HOSTS: "*" # set this to the hostname(s) you're going to serve the site from!
      CSRF_TRUSTED_ORIGINS: http://localhost:8000 # you MUST set this to the server's URL for admin login and the REST API to work
      PUBLIC_INDEX: false # set to False to prevent anonymous users from viewing snapshot list
      PUBLIC_SNAPSHOTS: false # set to False to prevent anonymous users from viewing snapshot content
@@ -453,7 +453,7 @@ services:
    expose:
      - 5432
    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U asciinema']
+      test: ["CMD-SHELL", "pg_isready -U asciinema"]
      interval: 2s
      timeout: 5s
      retries: 10
@@ -687,7 +687,7 @@ services:
    environment:
      PORT: 45876
      # Do not remove quotes around the key
-      KEY: '${BESZEL_RINOA_AGENT_KEY}'
+      KEY: "${BESZEL_RINOA_AGENT_KEY}"
    expose:
      - 45876
    image: henrygd/beszel-agent:latest
@@ -1137,7 +1137,6 @@ services:
      MGID: ${GID-1000}
    image: metabase/metabase
    labels:
      com.centurylinklabs.watchtower.enable: false
      homepage.group: Privacy/Security
      homepage.name: CrowdSec Dashboard
      homepage.href: https://csec.${MY_TLD}
@@ -1255,7 +1254,7 @@ services:
      homepage.icon: sh-dagu.svg
      homepage.description: Cron alternative with a web UI
      homepage.widget.type: customapi
-      homepage.widget.headers: 'Authorization: Bearer ${DAGU_AUTH_TOKEN}'
+      homepage.widget.headers: "Authorization: Bearer ${DAGU_AUTH_TOKEN}"
      homepage.widget.url: http://dagu:8080/api/v2/health
      homepage.widget.method: GET
      homepage.widget.mappings[0].label: Status
@@ -1280,7 +1279,7 @@ services:
      - ${DOCKER_VOLUME_STORAGE}/backups/:/backups
      - /var/run/docker.sock:/var/run/docker.sock
  dawarich-app:
-    command: ['bin/rails', 'server', '-p', '3000', '-b', '::']
+    command: ["bin/rails", "server", "-p", "3000", "-b", "::"]
    container_name: dawarich-app
    depends_on:
      dawarich-pg-db:
@@ -1292,8 +1291,8 @@ services:
    deploy:
      resources:
        limits:
-          cpus: '0.50'    # Limit CPU usage to 50% of one core
+          cpus: "0.50" # Limit CPU usage to 50% of one core
-          memory: '4G'    # Limit memory usage to 4GB
+          memory: "4G" # Limit memory usage to 4GB
    entrypoint: web-entrypoint.sh
    environment:
      RAILS_ENV: production
@@ -1314,7 +1313,11 @@ services:
      ENABLE_TELEMETRY: false # More on telemetry: https://dawarich.app/docs/tutorials/telemetry
      SELF_HOSTED: true
    healthcheck:
-      test: [ "CMD-SHELL", "wget -qO - http://127.0.0.1:3000/api/v1/health | grep -q '\"status\"\\s*:\\s*\"ok\"'" ]
+      test:
        [
          "CMD-SHELL",
          "wget -qO - http://127.0.0.1:3000/api/v1/health | grep -q '\"status\"\\s*:\\s*\"ok\"'",
        ]
      interval: 10s
      retries: 30
      start_period: 30s
@@ -1368,7 +1371,7 @@ services:
      - dawarich_db_data:/var/lib/postgresql/data
      - dawarich_shared:/var/shared
  dawarich-sidekiq:
-    command: ['sidekiq']
+    command: ["sidekiq"]
    container_name: dawarich-sidekiq
    depends_on:
      dawarich-app:
@@ -1383,8 +1386,8 @@ services:
    deploy:
      resources:
        limits:
-          cpus: '0.50'    # Limit CPU usage to 50% of one core
+          cpus: "0.50" # Limit CPU usage to 50% of one core
-          memory: '4G'    # Limit memory usage to 4GB
+          memory: "4G" # Limit memory usage to 4GB
    entrypoint: sidekiq-entrypoint.sh
    environment:
      APPLICATION_HOSTS: localhost,loc.${MY_TLD}
@@ -1506,7 +1509,11 @@ services:
      TUNNEL_NAME: dockflared-tunnel
      TZ: ${TZ}
    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- --server-response http://localhost:5000/ping 2>&1 | awk '/^  HTTP/{code=$2} /^[^{]/{next} {print; fflush()} END{exit (code>=400 || code==0)}' >/dev/null"]
+      test:
        [
          "CMD-SHELL",
          "wget -qO- --server-response http://localhost:5000/ping 2>&1 | awk '/^  HTTP/{code=$2} /^[^{]/{next} {print; fflush()} END{exit (code>=400 || code==0)}' >/dev/null",
        ]
      interval: 1m30s
      timeout: 30s
      retries: 5
@@ -1677,7 +1684,7 @@ services:
      MAIL_SMTP_CRYPTO: tls
      MAIL_SMTP_PORT: 25
      MAIL_FROM_ADDRESS: noreply@${MY_TLD}
-      MAIL_FROM_NAME: 'Trez'
+      MAIL_FROM_NAME: "Trez"
      MAIL_REPLY_TO_ADDRESS: it-services@${MY_TLD}
    labels:
      homepage.group: Professional Services
@@ -1703,7 +1710,7 @@ services:
    #   - easyappointments:/var/www/html
  excalidraw:
    container_name: excalidraw
-    image: 'excalidraw/excalidraw:latest'
+    image: "excalidraw/excalidraw:latest"
    labels:
      homepage.group: Personal Tools
      homepage.name: Excalidraw
@@ -2119,7 +2126,7 @@ services:
    container_name: guacamole
    environment:
      DOCKER_HOST: tcp://dockerproxy:2375
-      EXTENSIONS: 'auth-totp'
+      EXTENSIONS: "auth-totp"
      TZ: ${TZ}
    image: flcontainers/guacamole:latest
    labels:
@@ -2231,8 +2238,7 @@ services:
      swag_proto: http
      swag_port: 2283
      swag_url: pics.${MY_TLD}
-      swag_server_custom_directive:
+      swag_server_custom_directive: location /share {
        location /share {
        proxy_pass http://immich-public-proxy:3000;
        }
        location /tools {
@@ -3252,7 +3258,7 @@ services:
      APP_PORT: ${JOPLIN_APP_PORT}
      APP_BASE_URL: ${JOPLIN_APP_BASE_URL}
      DB_CLIENT: pg
-      INSTANCE_NAME: 'Joplin @ Rinoa'
+      INSTANCE_NAME: "Joplin @ Rinoa"
      IS_ADMIN_INSTANCE: true
      MAILER_ENABLED: 1
      MAILER_HOST: postal-SMTP
@@ -3345,7 +3351,7 @@ services:
    environment:
      LT_UPDATE_MODELS: true
    healthcheck:
-      test: ['CMD-SHELL', './venv/bin/python scripts/healthcheck.py']
+      test: ["CMD-SHELL", "./venv/bin/python scripts/healthcheck.py"]
    image: libretranslate/libretranslate
    labels:
      homepage.group: Personal Tools
@@ -3655,7 +3661,11 @@ services:
      PUID: ${PUID}
      TZ: ${TZ}
    healthcheck:
-      test: [ "CMD-SHELL", "mariadb-admin ping -h localhost -p${MARIADB_ENVIRONMENT_MYSQL_ROOT_PASSWORD}|| exit 1" ]
+      test:
        [
          "CMD-SHELL",
          "mariadb-admin ping -h localhost -p${MARIADB_ENVIRONMENT_MYSQL_ROOT_PASSWORD}|| exit 1",
        ]
      interval: 1m30s
      timeout: 10s
      retries: 5
@@ -3785,7 +3795,7 @@ services:
    restart: unless-stopped
    security_opt:
      - seccomp=unconfined # This might help with browser sandbox issues
-    shm_size: '2gb' # Increase shared memory size for Chromium
+    shm_size: "2gb" # Increase shared memory size for Chromium
    volumes:
      - /var/run/dbus:/var/run/dbus
  maxun-frontend:
@@ -4043,7 +4053,7 @@ services:
    volumes:
      - mixpost-valkey-data:/data/valkey
  mgob:
-    command: '-LogLevel=info'
+    command: "-LogLevel=info"
    container_name: mgob
    image: stefanprodan/mgob
    labels:
@@ -4170,7 +4180,7 @@ services:
      ND_AUTOIMPORTPLAYLISTS: true
      ND_BASEURL: ""
      ND_BACKUP_PATH: /backups
-      ND_BACKUP_SCHEDULE: '@every 6h'
+      ND_BACKUP_SCHEDULE: "@every 6h"
      ND_BACKUP_COUNT: 7
      ND_ENABLEGRAVATAR: true
      ND_ENABLESHARING: true
@@ -4182,7 +4192,7 @@ services:
      ND_MUSICFOLDER: /music
      ND_PLAYLISTPATH: /playlists
      ND_SCANNER_GROUPALBUMRELEASES: true
-      ND_SCANSCHEDULE: '@every 6h'
+      ND_SCANSCHEDULE: "@every 6h"
      ND_SESSIONTIMEOUT: 24h
      ND_SPOTIFY_ID: ${YOUR_SPOTIFY_ID}
      ND_SPOTIFY_SECRET: ${YOUR_SPOTIFY_SECRET}
@@ -4357,7 +4367,7 @@ services:
    healthcheck:
      interval: 10s
      retries: 10
-      test: "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""
+      test: 'pg_isready -U "$$POSTGRES_USER" -d "$$POSTGRES_DB"'
      timeout: 2s
    image: postgres:16-alpine@sha256:1c6d2f6e4d30d49c529e09a627e8178db5011dde88d955eb08db2e135e64aa09
    profiles: ["rinoa-apps"]
@@ -4462,7 +4472,7 @@ services:
      LIBRETRANSLATE: http://libretranslate:5000
      OLLAMA: http://ollama:11434
      OLLAMA_MODEL: smollm2:1.7b
-      THEME: 'pole'
+      THEME: "pole"
      DISABLE_DICTIONARY: false
    image: kweg/omnipoly:latest
    labels:
@@ -4879,7 +4889,7 @@ services:
      API_PORT: 8080
      FLORACODEX_URL: https://api.floracodex.com
      FLORACODEX_KEY: ${PLANTIT_FLORACODEX_APP_KEY}
-      ALLOWED_ORIGINS: '*' # CORS allowed origins (comma separated list)
+      ALLOWED_ORIGINS: "*" # CORS allowed origins (comma separated list)
      LOG_LEVEL: DEBUG # could be: DEBUG, INFO, WARN, ERROR
      CONTACT_MAIL: noreply@${MY_TLD} # address used as "contact" for template email
      REMINDER_NOTIFY_CHECK: 0 30 7 * * * # 6-values crontab expression to set the check time for reminders
@@ -4902,8 +4912,7 @@ services:
      swag_proto: http
      swag_port: 3000
      swag_url: plants.${MY_TLD}
-      swag_server_custom_directive:
+      swag_server_custom_directive: location /api {
        location /api {
        proxy_pass http://plant-it:8080;
        }
      swag.uptime-kuma.enabled: true
@@ -4937,7 +4946,7 @@ services:
    container_name: plantuml-server
    expose:
      - 8080
-    image: 'plantuml/plantuml-server:jetty'
+    image: "plantuml/plantuml-server:jetty"
    profiles: ["rinoa-apps"]
    restart: unless-stopped
  portainer:
@@ -5193,7 +5202,7 @@ services:
      QBT_DRY_RUN: false
      # Logging Configuration
      QBT_LOG_LEVEL: INFO
-      QBT_DIVIDER: '='
+      QBT_DIVIDER: "="
      QBT_WIDTH: 100
    ports:
      - 5965:8080
@@ -5240,8 +5249,7 @@ services:
      homepage.widget.user: admin
      homepage.widget.password: "${DELUGEVPN_PASSWORD}"
      swag: enable
-      swag_server_custom_directive:
+      swag_server_custom_directive: location /mgmt {
        location /mgmt {
        proxy_pass http://qbit-manage:8080;
        }
      swag_port: 8080
@@ -6835,55 +6843,6 @@ services:
    volumes:
      - wallos-db:/var/www/html/db
      - wallos-logos:/var/www/html/images/uploads/logos
  watchtower:
    container_name: watchtower
    environment:
      REPO_PASS:
      REPO_USER:
      TZ: ${TZ}
      WATCHTOWER_CLEANUP: true
      WATCHTOWER_INCLUDE_STOPPED: false
      WATCHTOWER_MONITOR_ONLY: false
      WATCHTOWER_NOTIFICATIONS_LEVEL: info
      WATCHTOWER_NOTIFICATION_TEMPLATE: '{{range .}}{{.Message}}{{println}}{{end}}'
      WATCHTOWER_NOTIFICATION_URL: "gotify://gotify/${WATCHTOWER_NOTIFICATION_GOTIFY_TOKEN}?disabletls=true"
      WATCHTOWER_SCHEDULE: 0 0 4 * * *
      WATCHTOWER_TIMEOUT: 30s
      WATCHTOWER_HTTP_API_METRICS: true
      WATCHTOWER_HTTP_API_TOKEN: ${WATCHTOWER_HTTP_API_TOKEN}
    expose:
      - 8080
    hostname: Rinoa
    image: ghcr.io/containrrr/watchtower:latest
    labels:
      homepage.group: Automation
      homepage.name: Watchtower
      homepage.icon: watchtower.svg
      homepage.description: Container-based solution for automating Docker container base image updates
      homepage.widget.type: watchtower
      homepage.widget.url: http://watchtower:8080
      homepage.widget.key: ${WATCHTOWER_HTTP_API_TOKEN}
    networks:
      default: null
    profiles: ["rinoa-apps"]
    restart: unless-stopped
    volumes:
      - bind:
          create_host_path: true
        read_only: true
        source: /etc/localtime
        target: /etc/localtime
        type: bind
      - bind:
          create_host_path: true
        source: /rinoa-storage
        target: /storage
        type: bind
      - bind:
          create_host_path: true
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        type: bind
  web-check:
    container_name: web-check
    image: lissy93/web-check
@@ -7178,9 +7137,9 @@ services:
    environment:
      # Enable authorization without HTTPS. For external access with
      #   SSL termination, use solutions like nginx-proxy-manager.
-      ELASTICSEARCH_ENABLE_SECURITY: 'true'
+      ELASTICSEARCH_ENABLE_SECURITY: "true"
-      ELASTICSEARCH_SKIP_TRANSPORT_TLS: 'true'
+      ELASTICSEARCH_SKIP_TRANSPORT_TLS: "true"
-      ELASTICSEARCH_ENABLE_REST_TLS: 'false'
+      ELASTICSEARCH_ENABLE_REST_TLS: "false"
      # ELASTICSEARCH_USER is hardcoded to 'elastic' in the container.
      ELASTICSEARCH_PASSWORD: ${ELASTICSEARCH_PASS:-zammad}
  zammad-init: