From 8069c41e2575df9a135e047744b1797e02f864c0 Mon Sep 17 00:00:00 2001 From: Bensuperpc Date: Mon, 6 Jul 2026 21:07:17 +0200 Subject: [PATCH] test --- .github/workflows/main.yml | 2 - .github/workflows/submodule-update.yml | 31 --- .gitignore | 5 + Makefile | 8 + README.md | 179 +++--------------- infrastructure/docker-compose.yml | 2 + .../7daystodie/docker-compose.7daystodie.yml | 2 +- ...{7daystodie.env => 7daystodie.env.example} | 2 +- .../backup/docker-compose.backup.yml | 8 +- .../backup/env/7daystodie_backup.env | 14 -- .../backup/env/7daystodie_backup.env.example} | 4 +- .../services/argus/docker-compose.argus.yml | 2 +- .../authelia/config/configuration.yml | 15 +- .../authelia/docker-compose.authelia.yml | 18 +- .../services/authelia/env/authelia.env | 7 - .../authelia/env/authelia.env.example | 8 + .../authelia/env/authelia_postgres.env | 3 - .../env/authelia_postgres.env.example | 3 + .../bentopdf/docker-compose.bentopdf.yml | 2 +- .../services/caddy/config/Caddyfile | 1 + .../caddy/config/website/vscode.caddy | 6 + .../services/caddy/docker-compose.caddy.yml | 12 +- .../env/{caddy.env => caddy.env.example} | 1 + ...dy_backup.env => caddy_backup.env.example} | 4 +- .../docker-compose.vscode-server.yml | 36 ++++ .../code-server/env/vscode-server.env.example | 4 + .../cyberchef/docker-compose.cyberchef.yml | 20 +- .../docker-compose.dependency-track.yml | 20 +- ...track.env => dependency-track.env.example} | 2 +- .../dependency-track/env/postgres.env | 3 - .../dependency-track/env/postgres.env.example | 3 + .../services/dozzle/config/users.yml | 7 +- .../services/dozzle/docker-compose.dozzle.yml | 4 +- .../env/{dozzle.env => dozzle.env.example} | 0 .../services/dufs/docker-compose.dufs.yml | 8 +- .../dufs/env/{dufs.env => dufs.env.example} | 2 +- .../forgejo/docker-compose.forgejo.yml | 14 +- .../env/{forgejo.env => forgejo.env.example} | 6 +- .../services/forgejo/env/forgejo_db.env | 4 - .../forgejo/env/forgejo_db.env.example | 4 + ..._runner.env => forgejo_runner.env.example} | 2 +- .../services/homepage/config/services.yaml | 7 + .../homepage/docker-compose.homepage.yml | 13 +- .../{homepage.env => homepage.env.example} | 0 .../it-tools/docker-compose.it-tools.yml | 4 +- .../jellyfin/docker-compose.jellyfin.yml | 8 +- .../{jellyfin.env => jellyfin.env.example} | 0 .../localai/docker-compose.localai.yml | 8 +- .../env/{localai.env => localai.env.example} | 0 .../services/main/docker-compose.main.yml | 9 +- .../services/memos/docker-compose.memos.yml | 8 +- .../env/{memos.env => memos.env.example} | 0 .../backup/docker-compose.backup.yml | 8 +- .../backup/env/backup.env.example} | 6 +- .../docker-compose.minecraft.yml | 4 +- ...s_plugins.env => mods_plugins.env.example} | 2 +- .../env/{proxy.env => proxy.env.example} | 6 +- .../env/{server.env => server.env.example} | 7 +- .../env/{world.env => world.env.example} | 2 +- .../omni-tools/docker-compose.omni-tools.yml | 2 +- .../open-webui/docker-compose.open-webui.yml | 64 +++---- .../open-webui/env/litellm-postgres.env | 3 - .../env/litellm-postgres.env.example | 3 + .../services/open-webui/env/litellm.env | 11 -- .../open-webui/env/litellm.env.example | 11 ++ ...llama.env => openwebui-ollama.env.example} | 0 .../open-webui/env/openwebui-pgadmin.env | 4 - .../env/openwebui-pgadmin.env.example | 4 + .../open-webui/env/openwebui-pipelines.env | 1 - .../env/openwebui-pipelines.env.example | 1 + .../open-webui/env/openwebui-postgres.env | 3 - .../env/openwebui-postgres.env.example | 3 + .../open-webui/env/openwebui-qdrant.env | 2 - .../env/openwebui-qdrant.env.example | 2 + .../open-webui/env/openwebui-valkey.env | 1 - .../env/openwebui-valkey.env.example | 1 + .../{openwebui.env => openwebui.env.example} | 12 +- .../openssh/docker-compose.openssh.yml | 17 +- .../env/{openssh.env => openssh.env.example} | 4 +- .../picoshare/docker-compose.picoshare.yml | 12 +- .../services/picoshare/env/picoshare.env | 3 - .../picoshare/env/picoshare.env.example | 3 + .../privatebin/docker-compose.privatebin.yml | 10 +- .../docker-compose.projectsend.yml | 21 +- ...rojectsend.env => projectsend.env.example} | 0 .../projectsend/env/projectsend_db.env | 4 - .../env/projectsend_db.env.example | 4 + .../docker-compose.psitransfer.yml | 10 +- .../services/psitransfer/env/psitransfer.env | 2 - .../psitransfer/env/psitransfer.env.example | 2 + .../docker-compose.qbittorrent.yml | 9 +- ...bittorrent.env => qbittorrent.env.example} | 2 +- .../backup/docker-compose.backup.yml | 2 +- ...up.env => satisfactory_backup.env.example} | 2 +- .../docker-compose.satisfactory.yml | 11 +- ...isfactory.env => satisfactory.env.example} | 2 +- .../{searxng.env => searxng.env.example} | 0 .../searxng/docker-compose.searxng.yml | 20 +- .../docker-compose.stirlingpdf.yml | 10 +- ...tirlingpdf.env => stirlingpdf.env.example} | 2 +- .../syncthing/docker-compose.syncthing.yml | 9 +- .../services/syncthing/env/syncthing.env | 0 .../syncthing/env/syncthing.env.example | 1 + .../backup/docker-compose.backup.yml | 2 +- .../env/teamfortress2_backup.env.example} | 4 +- .../docker-compose.teamfortress2.yml | 14 +- .../teamfortress2/env/teamfortress2.env | 10 - .../env/teamfortress2.env.example | 12 ++ .../docker-compose.transmission.yml | 8 +- .../transmission/env/transmission.env | 3 - .../transmission/env/transmission.env.example | 3 + .../docker-compose.uptime-kuma.yml | 12 +- .../wordpress/docker-compose.wordpress.yml | 12 +- .../services/wordpress/env/wordpress.env | 4 - .../wordpress/env/wordpress.env.example | 4 + ...ackup.env => wordpress_backup.env.example} | 4 +- .../services/wordpress/env/wordpress_db.env | 4 - .../wordpress/env/wordpress_db.env.example | 4 + presets/tools.conf | 2 +- tools/clean_secrets.sh | 32 ++++ tools/init_secrets.sh | 50 +++++ 121 files changed, 496 insertions(+), 548 deletions(-) delete mode 100644 .github/workflows/submodule-update.yml rename infrastructure/services/7daystodie-server/7daystodie/env/{7daystodie.env => 7daystodie.env.example} (88%) delete mode 100644 infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env rename infrastructure/services/{minecraft-server/backup/env/backup.env => 7daystodie-server/backup/env/7daystodie_backup.env.example} (90%) delete mode 100644 infrastructure/services/authelia/env/authelia.env create mode 100644 infrastructure/services/authelia/env/authelia.env.example delete mode 100644 infrastructure/services/authelia/env/authelia_postgres.env create mode 100644 infrastructure/services/authelia/env/authelia_postgres.env.example create mode 100644 infrastructure/services/caddy/config/website/vscode.caddy rename infrastructure/services/caddy/env/{caddy.env => caddy.env.example} (96%) rename infrastructure/services/caddy/env/{caddy_backup.env => caddy_backup.env.example} (87%) create mode 100644 infrastructure/services/code-server/docker-compose.vscode-server.yml create mode 100644 infrastructure/services/code-server/env/vscode-server.env.example rename infrastructure/services/dependency-track/env/{dependency-track.env => dependency-track.env.example} (80%) delete mode 100644 infrastructure/services/dependency-track/env/postgres.env create mode 100644 infrastructure/services/dependency-track/env/postgres.env.example rename infrastructure/services/dozzle/env/{dozzle.env => dozzle.env.example} (100%) rename infrastructure/services/dufs/env/{dufs.env => dufs.env.example} (66%) rename infrastructure/services/forgejo/env/{forgejo.env => forgejo.env.example} (82%) delete mode 100644 infrastructure/services/forgejo/env/forgejo_db.env create mode 100644 infrastructure/services/forgejo/env/forgejo_db.env.example rename infrastructure/services/forgejo/env/{forgejo_runner.env => forgejo_runner.env.example} (75%) rename infrastructure/services/homepage/env/{homepage.env => homepage.env.example} (100%) rename infrastructure/services/jellyfin/env/{jellyfin.env => jellyfin.env.example} (100%) rename infrastructure/services/localai/env/{localai.env => localai.env.example} (100%) rename infrastructure/services/memos/env/{memos.env => memos.env.example} (100%) rename infrastructure/services/{teamfortress2-server/backup/env/teamfortress2_backup.env => minecraft-server/backup/env/backup.env.example} (86%) rename infrastructure/services/minecraft-server/minecraft-server/env/{mods_plugins.env => mods_plugins.env.example} (97%) rename infrastructure/services/minecraft-server/minecraft-server/env/{proxy.env => proxy.env.example} (73%) rename infrastructure/services/minecraft-server/minecraft-server/env/{server.env => server.env.example} (94%) rename infrastructure/services/minecraft-server/minecraft-server/env/{world.env => world.env.example} (96%) delete mode 100644 infrastructure/services/open-webui/env/litellm-postgres.env create mode 100644 infrastructure/services/open-webui/env/litellm-postgres.env.example delete mode 100644 infrastructure/services/open-webui/env/litellm.env create mode 100644 infrastructure/services/open-webui/env/litellm.env.example rename infrastructure/services/open-webui/env/{openwebui-ollama.env => openwebui-ollama.env.example} (100%) delete mode 100644 infrastructure/services/open-webui/env/openwebui-pgadmin.env create mode 100644 infrastructure/services/open-webui/env/openwebui-pgadmin.env.example delete mode 100644 infrastructure/services/open-webui/env/openwebui-pipelines.env create mode 100644 infrastructure/services/open-webui/env/openwebui-pipelines.env.example delete mode 100644 infrastructure/services/open-webui/env/openwebui-postgres.env create mode 100644 infrastructure/services/open-webui/env/openwebui-postgres.env.example delete mode 100644 infrastructure/services/open-webui/env/openwebui-qdrant.env create mode 100644 infrastructure/services/open-webui/env/openwebui-qdrant.env.example delete mode 100644 infrastructure/services/open-webui/env/openwebui-valkey.env create mode 100644 infrastructure/services/open-webui/env/openwebui-valkey.env.example rename infrastructure/services/open-webui/env/{openwebui.env => openwebui.env.example} (65%) rename infrastructure/services/openssh/env/{openssh.env => openssh.env.example} (86%) delete mode 100644 infrastructure/services/picoshare/env/picoshare.env create mode 100644 infrastructure/services/picoshare/env/picoshare.env.example rename infrastructure/services/projectsend/env/{projectsend.env => projectsend.env.example} (100%) delete mode 100644 infrastructure/services/projectsend/env/projectsend_db.env create mode 100644 infrastructure/services/projectsend/env/projectsend_db.env.example delete mode 100644 infrastructure/services/psitransfer/env/psitransfer.env create mode 100644 infrastructure/services/psitransfer/env/psitransfer.env.example rename infrastructure/services/qbittorrent/env/{qbittorrent.env => qbittorrent.env.example} (56%) rename infrastructure/services/satisfactory-server/backup/env/{satisfactory_backup.env => satisfactory_backup.env.example} (89%) rename infrastructure/services/satisfactory-server/satisfactory/env/{satisfactory.env => satisfactory.env.example} (93%) rename infrastructure/services/searxng/config/{searxng.env => searxng.env.example} (100%) rename infrastructure/services/stirlingpdf/env/{stirlingpdf.env => stirlingpdf.env.example} (76%) delete mode 100644 infrastructure/services/syncthing/env/syncthing.env create mode 100644 infrastructure/services/syncthing/env/syncthing.env.example rename infrastructure/services/{7daystodie-server/7daystodie/env/7daystodie_backup.env => teamfortress2-server/backup/env/teamfortress2_backup.env.example} (85%) delete mode 100644 infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env create mode 100644 infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env.example delete mode 100644 infrastructure/services/transmission/env/transmission.env create mode 100644 infrastructure/services/transmission/env/transmission.env.example delete mode 100644 infrastructure/services/wordpress/env/wordpress.env create mode 100644 infrastructure/services/wordpress/env/wordpress.env.example rename infrastructure/services/wordpress/env/{wordpress_backup.env => wordpress_backup.env.example} (86%) delete mode 100644 infrastructure/services/wordpress/env/wordpress_db.env create mode 100644 infrastructure/services/wordpress/env/wordpress_db.env.example create mode 100755 tools/clean_secrets.sh create mode 100755 tools/init_secrets.sh diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index a7fd06a..155936c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -26,8 +26,6 @@ jobs: with: submodules: "recursive" fetch-depth: 0 - - name: "Check compose" - run: make check - name: "Update server image" run: make pull - name: "Build server" diff --git a/.github/workflows/submodule-update.yml b/.github/workflows/submodule-update.yml deleted file mode 100644 index 190ea66..0000000 --- a/.github/workflows/submodule-update.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: submodule-update - -on: - schedule: - - cron: '0 */8 * * *' - workflow_dispatch: - -jobs: - image: - name: submodule-update - runs-on: ubuntu-latest - steps: - - name: "Checkout Code" - uses: actions/checkout@v5 - with: - token: ${{ secrets.CI_TOKEN }} - repository: ${{ github.repository }} - submodules: 'recursive' - fetch-depth: 1 - # Update references - - name: Git Sumbodule Update - run: | - git pull --recurse-submodules - git submodule update --remote --recursive - # Commit and push - - name: Commit update - run: | - git config --global user.name 'Bensuperpc' - git config --global user.email 'bensuperpc@gmail.com' - git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }} - git commit -am "Auto updated submodule references" && git push || echo "No changes to commit" diff --git a/.gitignore b/.gitignore index 45cec20..ea6c0c4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,7 @@ /*.tar.gz + +infrastructure/services/**/env/*.env +infrastructure/services/**/config/*.env +!infrastructure/services/**/env/*.env.example +!infrastructure/services/**/config/*.env.example diff --git a/Makefile b/Makefile index 723e253..80d7499 100644 --- a/Makefile +++ b/Makefile @@ -29,3 +29,11 @@ CONFIGS := ia torrent tools #DOCKER_PROFILES := include DockerCompose.mk + +.PHONY: init +init: + @bash tools/init_secrets.sh + +.PHONY: clean-secrets +clean-secrets: + @bash tools/clean_secrets.sh diff --git a/README.md b/README.md index 2b23e10..d77014f 100644 --- a/README.md +++ b/README.md @@ -151,165 +151,73 @@ And then, caddy will generate the certificate for you and renew it automatically ### Configure the infrastructure -You need to configure the infrastructure with your own configuration. - -You can generate a password with 32 characters: +Every service ships a `*.env.example` file. Real `*.env` files are gitignored and never committed - generate them locally with: ```sh -openssl rand -base64 32 +make init ``` -Or online: [passwordsgenerator.net](https://passwordsgenerator.net/) +This copies every `*.env.example` → `*.env` and fills in randomly generated passwords, keys and tokens (including shared values that must match across services, e.g. a service and its database). Existing `.env` files are never overwritten, so re-running it later is always safe. + +After `make init`, a few things still need manual attention: #### Caddy -For [caddy_backup.env](infrastructure/services/caddy/env/caddy_backup.env) file, you need to change the password(s) for the restic backup. - -```sh -RESTIC_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ -``` - -On [caddy.env](infrastructure/services/caddy/env/caddy.env) file, you need to update some variables, like the main domain, mail domain and scheme (http or https). +Edit [caddy.env](infrastructure/services/caddy/env/caddy.env.example) to set your domain and mail address: ```sh MAIN_DOMAIN=bensuperpc.org MAIL_DOMAIN=bensuperpc@gmail.com -# Scheme SCHEME=https -# ignore_loaded_certs off AUTO_HTTPS_OPTIONS=ignore_loaded_certs ``` -#### Authelia +#### Authelia - user database -For [authelia.env](infrastructure/services/authelia/env/authelia.env) file, you need to change the password(s) and secret key: - -```sh -AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=ht87MVnXkXhBpDkMUHqKDqdg8UGBJt+Fx5jNIqXnN2k= -AUTHELIA_SESSION_SECRET=nsvbXKGRXVZUCUkOapntlq/Zh+d75WacTK5Jgyh8zYk= -AUTHELIA_STORAGE_ENCRYPTION_KEY=aWeIT74xIhGVd9nUOr4YTToTl5rpBEbzc/fv4jemuos= -AUTHELIA_STORAGE_POSTGRES_HOST=authelia-postgres -AUTHELIA_STORAGE_POSTGRES_PORT=5432 -AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia_db -AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia -AUTHELIA_STORAGE_POSTGRES_PASSWORD=sAdkxFW6k3GiMOrlBpl6OV76eb9cQz/uk95jmA2UpI8= -``` - -Same for [authelia_postgres.env](infrastructure/services/authelia/env/authelia_postgres.env) file, you need to change the password(s) and user for the database. - -```sh -POSTGRES_USER=authelia -POSTGRES_PASSWORD=sAdkxFW6k3GiMOrlBpl6OV76eb9cQz/uk95jmA2UpI8= -POSTGRES_DB=authelia_db -``` - -You also need to update [users_database.yml](infrastructure/services/authelia/config/users_database.yml) +`make init` generates all Authelia secrets automatically. [users_database.yml](infrastructure/services/authelia/config/users_database.yml) ships with a **placeholder example user** (`bensuperpc`) - replace it with your own before starting the stack, don't just add a user next to it. Generate an argon2 hash for your password: ```sh docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'MyPassword' ``` -#### Dozzle +Then edit the `username`, `displayname`, `password` hash and `email` fields to match. -To generate a new user for dozzle, you can use the following command [users.yml](infrastructure/services/dozzle/config/users.yml): +#### Dozzle - user account + +Generate a user entry for [users.yml](infrastructure/services/dozzle/config/users.yml): ```sh docker run -it --rm amir20/dozzle generate bensuperpc --password mypassword --email bensuperpc@gmail.com --name "bensuperpc" ``` -#### PsiTransfer +#### OpenSSH - public key -For [psitransfer.env](infrastructure/services/psitransfer/env/psitransfer.env) file, you need to change the secret key. +Replace [id_ed25519.pub](infrastructure/services/openssh/config/authorized_keys/id_ed25519.pub) with your own public SSH key. -```sh -PSITRANSFER_ADMIN_PASS=n9jLVNT9QUotTJTT91JqH4GyBTg9pvEn -``` +#### Open-WebUI - Ollama model -For [projectsend_db.env](infrastructure/services/projectsend/env/projectsend_db.env) file, you need to change the password(s) and user for the database. - -```sh -MARIADB_ROOT_PASSWORD=8O34297GrBfT3Ld34Lfg9mpotmZwbJtt -MARIADB_USER=bensuperpc -MARIADB_PASSWORD=wdSUa1JEZhXie5AJ5NcX1w73xmpO12EY -``` - -#### Picoshare - -For [picoshare.env](infrastructure/services/picoshare/env/picoshare.env) file, you need to change the secret key. - -```sh -PS_SHARED_SECRET=CBuS4DJLqIe93xF1KGYRrnhxUFBqLD2n -``` - -#### Dufs - -For [dufs.env](infrastructure/services/dufs/env/dufs.env) file, you need to change the secret key and if you want the user name. - -```sh -DUFS_AUTH="admin:heqihlOfBmJDESGFlpbPi7P7Mi6F7RkV@/:rw|@/:ro" -``` - -#### Stirling PDF - -For [stirlingpdf.env](infrastructure/services/stirlingpdf/env/stirlingpdf.env) file, it's **completly optional**, you can change the password(s) and user. - -```sh -# Enable security, optional -DOCKER_ENABLE_SECURITY=true -SECURITY_ENABLE_LOGIN=true -# Can be disabled after initial login, optional, -# default it admin:stirling -SECURITY_INITIALLOGIN_USERNAME=admin -SECURITY_INITIALLOGIN_PASSWORD=Jw9U039f5xc2mFcacvGvPD9RjwIh4DzO -``` - -#### OpenSSH - -You can need to add/change the public ssh key [id_ed25519.pub](infrastructure/services/openssh/config/authorized_keys/id_ed25519.pub) (its my public key), also change the config/password in [openssh.env](infrastructure/services/openssh/env/openssh.env): - -```sh -SUDO_ACCESS=true -#PUBLIC_KEY_URL=https://github.com/bensuperpc.keys -PUBLIC_KEY_DIR=/authorized_ssh_keys -USER_PASSWORD=rdUwf36C11PLmpU9Lvq7tP5pfFBKAuCh - -#PUBLIC_KEY=yourpublickey -#PUBLIC_KEY_FILE=/path/to/file -#PUBLIC_KEY_DIR=/path/to/directory/containing/_only_/pubkeys -#USER_PASSWORD_FILE=/path/to/file -``` - -#### Open-WebUI - -For [open-webui.env](infrastructure/services/open-webui/env/openwebui.env) file, you must change the secret key for the webui and configure its PostgreSQL backend. - -```sh -WEBUI_SECRET_KEY=7d83b15a417d090ba5c6b899270a05dd215c60848354c0c7574226d6ff02f39e -DATABASE_URL=postgresql://postgres:securepassword123@openwebui-postgres:5432/openwebui -REDIS_URL=redis://:valkey_password@valkey:6379/0 -``` - -Also update [openwebui-postgres.env](infrastructure/services/open-webui/env/openwebui-postgres.env) and [openwebui-valkey.env](infrastructure/services/open-webui/env/openwebui-valkey.env) with your own credentials. - -To download the model, through open-webui GUI or you can use the following command: +After starting the stack, pull a model via the Open-WebUI GUI or with: ```sh docker exec -it ollama ollama run deepseek-r1:8b ``` -#### Dependency-Track +#### Team Fortress 2 - Steam GSLT -For [dependency-track.env](infrastructure/services/dependency-track/env/dependency-track.env) file, you need to set the database credentials and the API server URL. +`make init` will remind you: set `SRCDS_TOKEN` in [teamfortress2.env](infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env) with your token from [steamcommunity.com/dev/managegameservers](https://steamcommunity.com/dev/managegameservers). + +#### Dependency-Track - first login + +Default credentials are `admin` / `admin` - **change them on first login**. + +#### Forgejo - installation lock + +After the first-run installation wizard completes, set in [forgejo.env](infrastructure/services/forgejo/env/forgejo.env.example): ```sh -POSTGRES_USER=dtrack -POSTGRES_PASSWORD= -POSTGRES_DB=dtrack_db -ALPINE_DATA_DIRECTORY=/data +FORGEJO__security__INSTALL_LOCK=true ``` -The frontend is available at `https://dependency-track.bensuperpc.org` and the API server at `/api/*`. Default credentials are `admin` / `admin`, **change them on first login**. - ### Homepage You can change the homepage config in these files: @@ -319,16 +227,6 @@ You can change the homepage config in these files: - [settings.yaml](infrastructure/services/homepage/config/settings.yaml) - [widgets.yaml](infrastructure/services/homepage/config/widgets.yaml) -### Forgejo - -For Forgejo installation, you must change the password(s) and user in [forgejo_db.env](infrastructure/services/forgejo/env/forgejo_db.env) file and [forgejo.env](infrastructure/services/forgejo/env/forgejo.env) file. - -Once the installation is complete, you need to set the installation lock: - -```sh -FORGEJO__security__INSTALL_LOCK=true -``` - ### Forgejo Runner (Out of date) ```sh @@ -436,29 +334,6 @@ AUTO_HTTPS_OPTIONS=ignore_loaded_certs And remove all the `import authelia_middleware` in the caddyfiles, authelia need https to work. -#### Wordpress - -For the [wordpress.env](infrastructure/services/wordpress/env/wordpress.env) file, you need to change the password and user for the database. - -```sh -WORDPRESS_DB_USER=bensuperpc -WORDPRESS_DB_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw -``` - -For [wordpress_db.env](infrastructure/services/wordpress/env/wordpress_db.env) file, you need to change the password(s) and user for the database. - -```sh -MARIADB_ROOT_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ -MARIADB_USER=bensuperpc -MARIADB_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw -``` - -For [wordpress_backup.env](infrastructure/services/wordpress/env/wordpress_backup.env) file, you need to change the password(s) for the restic backup. - -```sh -RESTIC_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ -``` - ## Sources - [Wordpress](https://wordpress.org/) diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml index 387abda..bd908c6 100644 --- a/infrastructure/docker-compose.yml +++ b/infrastructure/docker-compose.yml @@ -65,3 +65,5 @@ include: - services/localai/docker-compose.localai.yml # Bentopdf - services/bentopdf/docker-compose.bentopdf.yml +# Code-server + - services/code-server/docker-compose.vscode-server.yml diff --git a/infrastructure/services/7daystodie-server/7daystodie/docker-compose.7daystodie.yml b/infrastructure/services/7daystodie-server/7daystodie/docker-compose.7daystodie.yml index 5ce5912..bcf955e 100644 --- a/infrastructure/services/7daystodie-server/7daystodie/docker-compose.7daystodie.yml +++ b/infrastructure/services/7daystodie-server/7daystodie/docker-compose.7daystodie.yml @@ -1,7 +1,7 @@ services: # 7 days to die server 7daystodie_server: - image: vinanrra/7dtd-server:latest + image: vinanrra/7dtd-server:${SEVENDAYSTODIE_DOCKER_TAG:-latest} container_name: 7daystodie_server profiles: - 7daystodie_server diff --git a/infrastructure/services/7daystodie-server/7daystodie/env/7daystodie.env b/infrastructure/services/7daystodie-server/7daystodie/env/7daystodie.env.example similarity index 88% rename from infrastructure/services/7daystodie-server/7daystodie/env/7daystodie.env rename to infrastructure/services/7daystodie-server/7daystodie/env/7daystodie.env.example index 76cb4d6..9ae20a0 100644 --- a/infrastructure/services/7daystodie-server/7daystodie/env/7daystodie.env +++ b/infrastructure/services/7daystodie-server/7daystodie/env/7daystodie.env.example @@ -4,4 +4,4 @@ TimeZone=Europe/Paris BACKUP=NO BACKUP_HOUR=2 BACKUP_MAX=7 -MONITOR=NO \ No newline at end of file +MONITOR=NO diff --git a/infrastructure/services/7daystodie-server/backup/docker-compose.backup.yml b/infrastructure/services/7daystodie-server/backup/docker-compose.backup.yml index 161dbbc..f5ae478 100644 --- a/infrastructure/services/7daystodie-server/backup/docker-compose.backup.yml +++ b/infrastructure/services/7daystodie-server/backup/docker-compose.backup.yml @@ -1,19 +1,19 @@ services: 7daystodie_backup: - image: mazzolino/restic:latest + image: mazzolino/restic:${RESTIC_DOCKER_TAG:-latest} container_name: 7daystodie_backup profiles: - 7daystodie_backup depends_on: - 7daystodie_server - restart: on-failure:7 + extends: + file: ../../common.yml + service: service-base env_file: - ./env/7daystodie_backup.env volumes: - 7daystodie_backup:/mnt/restic - 7daystodie_server_save:/data:ro - security_opt: - - no-new-privileges:true network_mode: none cap_drop: - NET_ADMIN diff --git a/infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env b/infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env deleted file mode 100644 index 4df6131..0000000 --- a/infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env +++ /dev/null @@ -1,14 +0,0 @@ -#RUN_ON_STARTUP=true -RESTIC_REPOSITORY=/mnt/restic -RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=SCY5cmu12Odca302EXabPA9jXYkCb2NN -# Backup (exuclusive with Check and Prune) -BACKUP_CRON=*/15 * * * * -RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose -#RESTIC_FORGET_ARGS=--prune --keep-last 8 --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 4 -# Check (exuclusive with Check and Prune) -#CHECK_CRON=*/15 * * * * -#RESTIC_CHECK_ARGS=--read-data-subset=40% -# Prune (exuclusive with Check and Prune) -#PRUNE_CRON=*/15 * * * * -#RESTIC_PRUNE_ARGS= \ No newline at end of file diff --git a/infrastructure/services/minecraft-server/backup/env/backup.env b/infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env.example similarity index 90% rename from infrastructure/services/minecraft-server/backup/env/backup.env rename to infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env.example index 3b34023..da3892c 100644 --- a/infrastructure/services/minecraft-server/backup/env/backup.env +++ b/infrastructure/services/7daystodie-server/backup/env/7daystodie_backup.env.example @@ -1,10 +1,10 @@ #RUN_ON_STARTUP=true RESTIC_REPOSITORY=/mnt/restic RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=7xymiWBH4c56rlBXPXbgkxF2zw3f2AGs +RESTIC_PASSWORD=__GENERATE_7DTD_RESTIC_PASSWORD__ # Backup (exuclusive with Check and Prune) -RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose BACKUP_CRON=*/15 * * * * +RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose #RESTIC_FORGET_ARGS=--prune --keep-last 8 --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 4 # Check (exuclusive with Check and Prune) #CHECK_CRON=*/15 * * * * diff --git a/infrastructure/services/argus/docker-compose.argus.yml b/infrastructure/services/argus/docker-compose.argus.yml index 07e84af..7be3093 100644 --- a/infrastructure/services/argus/docker-compose.argus.yml +++ b/infrastructure/services/argus/docker-compose.argus.yml @@ -1,7 +1,7 @@ services: # argus argus: - image: releaseargus/argus:latest + image: releaseargus/argus:${ARGUS_DOCKER_TAG:-latest} container_name: argus profiles: - argus diff --git a/infrastructure/services/authelia/config/configuration.yml b/infrastructure/services/authelia/config/configuration.yml index 0dab98c..051d35d 100644 --- a/infrastructure/services/authelia/config/configuration.yml +++ b/infrastructure/services/authelia/config/configuration.yml @@ -10,6 +10,9 @@ authentication_backend: file: path: /config/users_database.yml +# totp: +# issuer: bensuperpc.org + access_control: default_policy: deny rules: @@ -25,7 +28,7 @@ access_control: - "homepage.bensuperpc.org" - "forgejo.bensuperpc.org" policy: bypass - - domain: + - domain: - "jellyfin.bensuperpc.org" - "openwebui.bensuperpc.org" - "qbittorrent.bensuperpc.org" @@ -37,8 +40,8 @@ access_control: subject: - 'group:admins' - 'group:users' - policy: one_factor - - domain: + policy: one_factor + - domain: - "*.bensuperpc.org" subject: - 'group:admins' @@ -68,4 +71,8 @@ storage: notifier: filesystem: - filename: /config/notification.txt \ No newline at end of file + filename: /config/notification.txt + # smtp: + # address: "submission://smtp.example.com:587" + # username: bensuperpc + # sender: "Authelia " \ No newline at end of file diff --git a/infrastructure/services/authelia/docker-compose.authelia.yml b/infrastructure/services/authelia/docker-compose.authelia.yml index d603ecd..3c8709a 100644 --- a/infrastructure/services/authelia/docker-compose.authelia.yml +++ b/infrastructure/services/authelia/docker-compose.authelia.yml @@ -1,41 +1,41 @@ services: authelia: container_name: authelia - image: authelia/authelia:latest + image: authelia/authelia:${AUTHELIA_DOCKER_TAG:-4.39.20} profiles: - authelia - caddy depends_on: authelia-postgres: condition: service_healthy + extends: + file: ../common.yml + service: service-base # environment: # - TZ=America/New_York # - PUID=${PUID:-1000} # - PGID=${PGID:-1000} env_file: - ./env/authelia.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - ./config:/config networks: - caddy-infra - authelia-internal - restart: on-failure:7 authelia-postgres: - image: postgres:17-alpine + image: postgres:${AUTHELIA_POSTGRES_DOCKER_TAG:-18.4-alpine3.24} container_name: authelia-postgres - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base volumes: - - authelia_db_data:/var/lib/postgresql/data + - authelia_db_data:/var/lib/postgresql env_file: - ./env/authelia_postgres.env profiles: - authelia - caddy - environment: - - TZ=${TZ:-Europe/Paris} healthcheck: test: [ "CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}" ] interval: 5s diff --git a/infrastructure/services/authelia/env/authelia.env b/infrastructure/services/authelia/env/authelia.env deleted file mode 100644 index 1249453..0000000 --- a/infrastructure/services/authelia/env/authelia.env +++ /dev/null @@ -1,7 +0,0 @@ -AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=ht87MVnXkXhBpDkMUHqKDqdg8UGBJt+Fx5jNIqXnN2k= -AUTHELIA_SESSION_SECRET=nsvbXKGRXVZUCUkOapntlq/Zh+d75WacTK5Jgyh8zYk= -AUTHELIA_STORAGE_ENCRYPTION_KEY=aWeIT74xIhGVd9nUOr4YTToTl5rpBEbzc/fv4jemuos= -AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://authelia-postgres:5432 -AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia_db -AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia -AUTHELIA_STORAGE_POSTGRES_PASSWORD=sAdkxFW6k3GiMOrlBpl6OV76eb9cQz/uk95jmA2UpI8= \ No newline at end of file diff --git a/infrastructure/services/authelia/env/authelia.env.example b/infrastructure/services/authelia/env/authelia.env.example new file mode 100644 index 0000000..1adda2e --- /dev/null +++ b/infrastructure/services/authelia/env/authelia.env.example @@ -0,0 +1,8 @@ +AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=__GENERATE_AUTHELIA_JWT_SECRET__ +AUTHELIA_SESSION_SECRET=__GENERATE_AUTHELIA_SESSION_SECRET__ +AUTHELIA_STORAGE_ENCRYPTION_KEY=__GENERATE_AUTHELIA_STORAGE_ENCRYPTION_KEY__ +AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://authelia-postgres:5432 +AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia_db +AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia +AUTHELIA_STORAGE_POSTGRES_PASSWORD=__GENERATE_AUTHELIA_DB_PASSWORD__ +#AUTHELIA_NOTIFIER_SMTP_PASSWORD=your-smtp-password-here diff --git a/infrastructure/services/authelia/env/authelia_postgres.env b/infrastructure/services/authelia/env/authelia_postgres.env deleted file mode 100644 index b857242..0000000 --- a/infrastructure/services/authelia/env/authelia_postgres.env +++ /dev/null @@ -1,3 +0,0 @@ -POSTGRES_USER=authelia -POSTGRES_PASSWORD=sAdkxFW6k3GiMOrlBpl6OV76eb9cQz/uk95jmA2UpI8= -POSTGRES_DB=authelia_db diff --git a/infrastructure/services/authelia/env/authelia_postgres.env.example b/infrastructure/services/authelia/env/authelia_postgres.env.example new file mode 100644 index 0000000..e332b35 --- /dev/null +++ b/infrastructure/services/authelia/env/authelia_postgres.env.example @@ -0,0 +1,3 @@ +POSTGRES_USER=authelia +POSTGRES_PASSWORD=__GENERATE_AUTHELIA_DB_PASSWORD__ +POSTGRES_DB=authelia_db diff --git a/infrastructure/services/bentopdf/docker-compose.bentopdf.yml b/infrastructure/services/bentopdf/docker-compose.bentopdf.yml index 8b25d28..2d80a80 100644 --- a/infrastructure/services/bentopdf/docker-compose.bentopdf.yml +++ b/infrastructure/services/bentopdf/docker-compose.bentopdf.yml @@ -3,7 +3,7 @@ services: extends: file: ../common.yml service: service-base - image: ghcr.io/alam00000/bentopdf-simple:latest + image: ghcr.io/alam00000/bentopdf-simple:${BENTOPDF_DOCKER_TAG:-latest} container_name: bentopdf profiles: - bentopdf diff --git a/infrastructure/services/caddy/config/Caddyfile b/infrastructure/services/caddy/config/Caddyfile index f3df153..00d84c8 100644 --- a/infrastructure/services/caddy/config/Caddyfile +++ b/infrastructure/services/caddy/config/Caddyfile @@ -47,3 +47,4 @@ import website/dozzle.caddy import website/litellm.caddy import website/localai.caddy import website/bentopdf.caddy +import website/vscode.caddy diff --git a/infrastructure/services/caddy/config/website/vscode.caddy b/infrastructure/services/caddy/config/website/vscode.caddy new file mode 100644 index 0000000..283e681 --- /dev/null +++ b/infrastructure/services/caddy/config/website/vscode.caddy @@ -0,0 +1,6 @@ +{$SCHEME}://vscode.{$MAIN_DOMAIN} { + import authelia_middleware + reverse_proxy {$VSCODE_SERVER_ADDRESS} { + header_up Host {upstream_hostport} + } +} diff --git a/infrastructure/services/caddy/docker-compose.caddy.yml b/infrastructure/services/caddy/docker-compose.caddy.yml index 4cfbed7..9e45745 100644 --- a/infrastructure/services/caddy/docker-compose.caddy.yml +++ b/infrastructure/services/caddy/docker-compose.caddy.yml @@ -2,14 +2,13 @@ services: # Caddy caddy: #image: bensuperpc/caddy-l4:latest - image: caddy:latest + image: caddy:${CADDY_DOCKER_TAG:-latest} container_name: caddy profiles: - caddy depends_on: main_infrastructure: condition: service_completed_successfully - restart: on-failure:7 ports: - 80:80/tcp - 80:80/udp @@ -32,10 +31,9 @@ services: - caddy-web env_file: - ./env/caddy.env - environment: - - TZ=${TZ:-Europe/Paris} - security_opt: - - no-new-privileges:true + extends: + file: ../common.yml + service: service-base healthcheck: test: pidof caddy || exit 1 interval: 120s @@ -43,7 +41,7 @@ services: retries: 3 caddy_backup: - image: mazzolino/restic:latest + image: mazzolino/restic:${RESTIC_DOCKER_TAG:-latest} container_name: caddy_backup profiles: - caddy diff --git a/infrastructure/services/caddy/env/caddy.env b/infrastructure/services/caddy/env/caddy.env.example similarity index 96% rename from infrastructure/services/caddy/env/caddy.env rename to infrastructure/services/caddy/env/caddy.env.example index 860836b..9119ec0 100644 --- a/infrastructure/services/caddy/env/caddy.env +++ b/infrastructure/services/caddy/env/caddy.env.example @@ -25,6 +25,7 @@ AUTHELIA_ADDRESS=authelia:9091 DOZZLE_ADDRESS=dozzle:8080 LOCALAI_ADDRESS=localai:8080 BENTOPDF_ADDRESS=bentopdf:8080 +VSCODE_SERVER_ADDRESS=vscode-server:8443 # Scheme SCHEME=https # ignore_loaded_certs off diff --git a/infrastructure/services/caddy/env/caddy_backup.env b/infrastructure/services/caddy/env/caddy_backup.env.example similarity index 87% rename from infrastructure/services/caddy/env/caddy_backup.env rename to infrastructure/services/caddy/env/caddy_backup.env.example index 363c402..720271a 100644 --- a/infrastructure/services/caddy/env/caddy_backup.env +++ b/infrastructure/services/caddy/env/caddy_backup.env.example @@ -1,7 +1,7 @@ #RUN_ON_STARTUP=true RESTIC_REPOSITORY=/mnt/restic RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=YFQh8v3Wi95v0p6h88D4u8C8z4gLfdMw +RESTIC_PASSWORD=__GENERATE_CADDY_RESTIC_PASSWORD__ # Backup (exuclusive with Check and Prune) BACKUP_CRON=*/30 * * * * RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose @@ -11,4 +11,4 @@ RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose #RESTIC_CHECK_ARGS=--read-data-subset=40% # Prune (exuclusive with Check and Prune) #PRUNE_CRON=*/30 * * * * -#RESTIC_PRUNE_ARGS= \ No newline at end of file +#RESTIC_PRUNE_ARGS= diff --git a/infrastructure/services/code-server/docker-compose.vscode-server.yml b/infrastructure/services/code-server/docker-compose.vscode-server.yml new file mode 100644 index 0000000..ece72f3 --- /dev/null +++ b/infrastructure/services/code-server/docker-compose.vscode-server.yml @@ -0,0 +1,36 @@ +services: + # vscode-server + vscode-server: + extends: + file: ../common.yml + service: service-base + image: lscr.io/linuxserver/code-server:${VSCODE_SERVER_DOCKER_TAG:-latest} + container_name: vscode-server + environment: + - PUID=${PUID:-1000} + - PGID=${PGID:-1000} + env_file: + - ./env/vscode-server.env + profiles: + - vscode-server + depends_on: + - caddy + volumes: + - vscode-server_config:/config:rw + - public_data:/public_data:rw + - private_data:/private_data:rw + networks: + - caddy-dev + +networks: + caddy-dev: + driver: bridge + name: caddy-dev + +volumes: + vscode-server_config: + name: vscode-server_config + private_data: + name: private_data + public_data: + name: public_data \ No newline at end of file diff --git a/infrastructure/services/code-server/env/vscode-server.env.example b/infrastructure/services/code-server/env/vscode-server.env.example new file mode 100644 index 0000000..abb0daa --- /dev/null +++ b/infrastructure/services/code-server/env/vscode-server.env.example @@ -0,0 +1,4 @@ +SUDO_PASSWORD=__GENERATE_SUDO_VSCODE_SERVER_PASSWORD__ +PASSWORD=__GENERATE_VSCODE_SERVER_PASSWORD__ +PROXY_DOMAIN=vscode.bensuperpc.org +DOCKER_MODS=linuxserver/mods:code-server-python3 diff --git a/infrastructure/services/cyberchef/docker-compose.cyberchef.yml b/infrastructure/services/cyberchef/docker-compose.cyberchef.yml index 22cecd6..0d7dbca 100644 --- a/infrastructure/services/cyberchef/docker-compose.cyberchef.yml +++ b/infrastructure/services/cyberchef/docker-compose.cyberchef.yml @@ -1,36 +1,32 @@ services: # cyberchef cyberchef0: - image: mpepping/cyberchef:latest + extends: + file: ../common.yml + service: service-base + image: mpepping/cyberchef:${CYBERCHEF_DOCKER_TAG:-latest} container_name: cyberchef0 profiles: - cyberchef - restart: on-failure:7 depends_on: - caddy networks: - caddy-tools read_only: false - security_opt: - - no-new-privileges:true - cap_drop: - - SYS_ADMIN cyberchef1: - image: mpepping/cyberchef:latest + extends: + file: ../common.yml + service: service-base + image: mpepping/cyberchef:${CYBERCHEF_DOCKER_TAG:-latest} container_name: cyberchef1 profiles: - cyberchef - restart: on-failure:7 depends_on: - caddy networks: - caddy-tools read_only: false - security_opt: - - no-new-privileges:true - cap_drop: - - SYS_ADMIN networks: caddy-tools: diff --git a/infrastructure/services/dependency-track/docker-compose.dependency-track.yml b/infrastructure/services/dependency-track/docker-compose.dependency-track.yml index 442df75..e18a38a 100644 --- a/infrastructure/services/dependency-track/docker-compose.dependency-track.yml +++ b/infrastructure/services/dependency-track/docker-compose.dependency-track.yml @@ -1,6 +1,6 @@ services: dependency-track-apiserver: - image: dependencytrack/apiserver + image: dependencytrack/apiserver:${DEPENDENCY_TRACK_API_DOCKER_TAG:-latest} container_name: dependency-track-apiserver profiles: - dependency-track @@ -9,7 +9,9 @@ services: condition: service_healthy env_file: - ./env/dependency-track.env - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base networks: - caddy-web - dependency-track-internal @@ -17,11 +19,13 @@ services: - 'dtrack-data:/data' dependency-track-frontend: - image: dependencytrack/frontend + image: dependencytrack/frontend:${DEPENDENCY_TRACK_FRONTEND_DOCKER_TAG:-latest} container_name: dependency-track-frontend profiles: - dependency-track - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base networks: - caddy-web - dependency-track-internal @@ -30,19 +34,19 @@ services: condition: service_healthy caddy: condition: service_healthy - security_opt: - - no-new-privileges:true env_file: - ./env/dependency-track.env dependency-track-postgres: - image: postgres:17-alpine + image: postgres:${DEPENDENCY_TRACK_POSTGRES_DOCKER_TAG:-17-alpine} container_name: dependency-track-postgres profiles: - dependency-track env_file: - ./env/postgres.env - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base networks: - dependency-track-internal healthcheck: diff --git a/infrastructure/services/dependency-track/env/dependency-track.env b/infrastructure/services/dependency-track/env/dependency-track.env.example similarity index 80% rename from infrastructure/services/dependency-track/env/dependency-track.env rename to infrastructure/services/dependency-track/env/dependency-track.env.example index 9593033..9884c64 100644 --- a/infrastructure/services/dependency-track/env/dependency-track.env +++ b/infrastructure/services/dependency-track/env/dependency-track.env.example @@ -2,6 +2,6 @@ ALPINE_DATABASE_MODE="external" ALPINE_DATABASE_URL="jdbc:postgresql://dependency-track-postgres:5432/dtrack" ALPINE_DATABASE_DRIVER="org.postgresql.Driver" ALPINE_DATABASE_USERNAME="dtrack" -ALPINE_DATABASE_PASSWORD="dtrack" +ALPINE_DATABASE_PASSWORD="__GENERATE_DTRACK_DB_PASSWORD__" API_BASE_URL="https://dependency-track.bensuperpc.org" diff --git a/infrastructure/services/dependency-track/env/postgres.env b/infrastructure/services/dependency-track/env/postgres.env deleted file mode 100644 index b45a53e..0000000 --- a/infrastructure/services/dependency-track/env/postgres.env +++ /dev/null @@ -1,3 +0,0 @@ -POSTGRES_DB="dtrack" -POSTGRES_USER="dtrack" -POSTGRES_PASSWORD="dtrack" diff --git a/infrastructure/services/dependency-track/env/postgres.env.example b/infrastructure/services/dependency-track/env/postgres.env.example new file mode 100644 index 0000000..7ea2d23 --- /dev/null +++ b/infrastructure/services/dependency-track/env/postgres.env.example @@ -0,0 +1,3 @@ +POSTGRES_DB="dtrack" +POSTGRES_USER="dtrack" +POSTGRES_PASSWORD="__GENERATE_DTRACK_DB_PASSWORD__" diff --git a/infrastructure/services/dozzle/config/users.yml b/infrastructure/services/dozzle/config/users.yml index 42164c6..a3c1a46 100644 --- a/infrastructure/services/dozzle/config/users.yml +++ b/infrastructure/services/dozzle/config/users.yml @@ -1,7 +1,8 @@ users: - bensuperpc: - email: bensuperpc@gmail.com - name: bensuperpc + admin: + email: me@email.net + name: admin + # docker run -it --rm amir20/dozzle generate admin --password password --email me@email.net --name "admin" password: $2a$11$w56N4NICh5xD5Bbq6Z2Z2ef9/QUaa/YKleMiawn/Bru9hYsQOJyrm filter: "" roles: "" \ No newline at end of file diff --git a/infrastructure/services/dozzle/docker-compose.dozzle.yml b/infrastructure/services/dozzle/docker-compose.dozzle.yml index 4deb538..699ef09 100644 --- a/infrastructure/services/dozzle/docker-compose.dozzle.yml +++ b/infrastructure/services/dozzle/docker-compose.dozzle.yml @@ -1,6 +1,6 @@ services: dozzle: - image: amir20/dozzle:latest + image: amir20/dozzle:${DOZZLE_DOCKER_TAG:-latest} container_name: dozzle profiles: - dozzle @@ -22,7 +22,7 @@ services: - dozzle-internal dozzle-dockerproxy: - image: tecnativa/docker-socket-proxy:latest + image: tecnativa/docker-socket-proxy:${DOCKER_SOCKET_PROXY_DOCKER_TAG:-latest} container_name: dozzle-dockerproxy profiles: - dozzle diff --git a/infrastructure/services/dozzle/env/dozzle.env b/infrastructure/services/dozzle/env/dozzle.env.example similarity index 100% rename from infrastructure/services/dozzle/env/dozzle.env rename to infrastructure/services/dozzle/env/dozzle.env.example diff --git a/infrastructure/services/dufs/docker-compose.dufs.yml b/infrastructure/services/dufs/docker-compose.dufs.yml index 0258c2f..f6c67df 100644 --- a/infrastructure/services/dufs/docker-compose.dufs.yml +++ b/infrastructure/services/dufs/docker-compose.dufs.yml @@ -1,12 +1,14 @@ services: # dufs dufs: - image: sigoden/dufs:latest + image: sigoden/dufs:${DUFS_DOCKER_TAG:-latest} container_name: dufs profiles: - dufs # user: ${PUID:-1000}:${PGID:-1000} - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy env_file: @@ -15,8 +17,6 @@ services: - public_data:/data networks: - caddy-files - security_opt: - - no-new-privileges:true volumes: public_data: diff --git a/infrastructure/services/dufs/env/dufs.env b/infrastructure/services/dufs/env/dufs.env.example similarity index 66% rename from infrastructure/services/dufs/env/dufs.env rename to infrastructure/services/dufs/env/dufs.env.example index aaba117..2b0897d 100644 --- a/infrastructure/services/dufs/env/dufs.env +++ b/infrastructure/services/dufs/env/dufs.env.example @@ -4,4 +4,4 @@ DUFS_SERVE_PATH=/data DUFS_HIDDEN=tmp,*.log,*.lock DUFS_ALLOW_ALL=true DUFS_COMPRESS=medium -DUFS_AUTH="admin:heqihlOfBmJDESGFlpbPi7P7Mi6F7RkV@/:rw|@/:ro" +DUFS_AUTH="admin:__GENERATE_DUFS_PASSWORD__@/:rw|@/:ro" diff --git a/infrastructure/services/forgejo/docker-compose.forgejo.yml b/infrastructure/services/forgejo/docker-compose.forgejo.yml index ed762fd..b1b959d 100644 --- a/infrastructure/services/forgejo/docker-compose.forgejo.yml +++ b/infrastructure/services/forgejo/docker-compose.forgejo.yml @@ -1,7 +1,7 @@ services: # forgejo forgejo: - image: codeberg.org/forgejo/forgejo:15 + image: codeberg.org/forgejo/forgejo:${FORGEJO_DOCKER_TAG:-15} container_name: forgejo profiles: - forgejo @@ -26,13 +26,15 @@ services: # Database forgejo database_forgejo: - image: mariadb:latest + image: mariadb:${FORGEJO_DB_DOCKER_TAG:-latest} container_name: database_forgejo profiles: - forgejo depends_on: - caddy - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base volumes: - forgejo_db:/var/lib/mysql:rw env_file: @@ -40,12 +42,10 @@ services: command: '--default-authentication-plugin=mysql_native_password' networks: - forgejo-internal - security_opt: - - no-new-privileges:true # forgejo-runner docker-in-docker: - image: code.forgejo.org/oci/docker:dind + image: code.forgejo.org/oci/docker:${FORGEJO_DIND_DOCKER_TAG:-dind} container_name: 'docker_dind' hostname: docker networks: @@ -60,7 +60,7 @@ services: - forgejo_certs:/certs forgejo_runner: - image: data.forgejo.org/forgejo/runner:12 + image: data.forgejo.org/forgejo/runner:${FORGEJO_RUNNER_DOCKER_TAG:-12} networks: - forgejo-internal profiles: diff --git a/infrastructure/services/forgejo/env/forgejo.env b/infrastructure/services/forgejo/env/forgejo.env.example similarity index 82% rename from infrastructure/services/forgejo/env/forgejo.env rename to infrastructure/services/forgejo/env/forgejo.env.example index 7c6f82e..efc633d 100644 --- a/infrastructure/services/forgejo/env/forgejo.env +++ b/infrastructure/services/forgejo/env/forgejo.env.example @@ -4,7 +4,7 @@ FORGEJO__database__DB_TYPE=mysql FORGEJO__database__HOST=database_forgejo:3306 FORGEJO__database__NAME=forgejo FORGEJO__database__USER=bensuperpc -FORGEJO__database__PASSWD=ZcuHcM9tnIEM7EEO7R5jCpEt6v1d6r7s +FORGEJO__database__PASSWD=__GENERATE_FORGEJO_DB_PASSWORD__ FORGEJO__APP_NAME=Bensuperpc's Forgejo FORGEJO__APP_SLOGAN=Personal Code, Mirrors, and More FORGEJO__server__DOMAIN=git.bensuperpc.org @@ -13,7 +13,7 @@ FORGEJO__server__HTTP_PORT=3000 FORGEJO__server__SSH_LISTEN_PORT=2222 FORGEJO__server__SSH_PORT=22 FORGEJO__server__ROOT_URL=https://git.bensuperpc.org -FORGEJO__security__SECRET_KEY=7IWrMh7mC7UMo1SowvUsAT2LOX49eU6P +FORGEJO__security__SECRET_KEY=__GENERATE_FORGEJO_SECRET_KEY__ #FORGEJO__security__INTERNAL_TOKEN= FORGEJO__security__INSTALL_LOCK=true FORGEJO__security__MIN_PASSWORD_LENGTH=8 @@ -22,4 +22,4 @@ FORGEJO__actions__DEFAULT_ACTIONS_URL="https://git.bensuperpc.org" #FORGEJO__log__LEVEL: "debug" FORGEJO__repository__ENABLE_PUSH_CREATE_USER=true FORGEJO__repository__DEFAULT_PUSH_CREATE_PRIVATE=false -FORGEJO__repository__DEFAULT_REPO_UNITS=repo.code,repo.actions \ No newline at end of file +FORGEJO__repository__DEFAULT_REPO_UNITS=repo.code,repo.actions diff --git a/infrastructure/services/forgejo/env/forgejo_db.env b/infrastructure/services/forgejo/env/forgejo_db.env deleted file mode 100644 index 339e340..0000000 --- a/infrastructure/services/forgejo/env/forgejo_db.env +++ /dev/null @@ -1,4 +0,0 @@ -MARIADB_ROOT_PASSWORD=ZI8Trbot3b8WGqE5AKj1yphKMu4v9qQw -MARIADB_USER=bensuperpc -MARIADB_PASSWORD=ZcuHcM9tnIEM7EEO7R5jCpEt6v1d6r7s -MARIADB_DATABASE=forgejo \ No newline at end of file diff --git a/infrastructure/services/forgejo/env/forgejo_db.env.example b/infrastructure/services/forgejo/env/forgejo_db.env.example new file mode 100644 index 0000000..4912858 --- /dev/null +++ b/infrastructure/services/forgejo/env/forgejo_db.env.example @@ -0,0 +1,4 @@ +MARIADB_ROOT_PASSWORD=__GENERATE_FORGEJO_DB_ROOT_PASSWORD__ +MARIADB_USER=bensuperpc +MARIADB_PASSWORD=__GENERATE_FORGEJO_DB_PASSWORD__ +MARIADB_DATABASE=forgejo diff --git a/infrastructure/services/forgejo/env/forgejo_runner.env b/infrastructure/services/forgejo/env/forgejo_runner.env.example similarity index 75% rename from infrastructure/services/forgejo/env/forgejo_runner.env rename to infrastructure/services/forgejo/env/forgejo_runner.env.example index 3186930..c8e9f9c 100644 --- a/infrastructure/services/forgejo/env/forgejo_runner.env +++ b/infrastructure/services/forgejo/env/forgejo_runner.env.example @@ -1,3 +1,3 @@ DOCKER_HOST=tcp://docker:2376 DOCKER_CERT_PATH=/certs/client -DOCKER_TLS_VERIFY=1 \ No newline at end of file +DOCKER_TLS_VERIFY=1 diff --git a/infrastructure/services/homepage/config/services.yaml b/infrastructure/services/homepage/config/services.yaml index 6d9761d..2c4a08c 100644 --- a/infrastructure/services/homepage/config/services.yaml +++ b/infrastructure/services/homepage/config/services.yaml @@ -152,6 +152,13 @@ # ping: transmission.bensuperpc.org container: transmission server: my-docker + - vscode-server: + icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons@master/png/vscode.png + href: https://vscode.bensuperpc.org/ + description: VS Code Server + # ping: vscode.bensuperpc.org + container: vscode-server + server: my-docker - Games: - minecraft: diff --git a/infrastructure/services/homepage/docker-compose.homepage.yml b/infrastructure/services/homepage/docker-compose.homepage.yml index c858bc3..3a06776 100644 --- a/infrastructure/services/homepage/docker-compose.homepage.yml +++ b/infrastructure/services/homepage/docker-compose.homepage.yml @@ -1,11 +1,13 @@ services: # homepage homepage: - image: ghcr.io/gethomepage/homepage:latest + image: ghcr.io/gethomepage/homepage:${HOMEPAGE_DOCKER_TAG:-latest} container_name: homepage profiles: - homepage - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base # environment: # - PUID=${PUID:-1000} # - PGID=${PGID:-1000} @@ -14,8 +16,6 @@ services: - homepage-dockerproxy env_file: - ./env/homepage.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - homepage_log:/app/logs - ./config:/app/config @@ -23,11 +23,8 @@ services: networks: - caddy-infra - homepage-internal - security_opt: - - no-new-privileges:true - homepage-dockerproxy: - image: tecnativa/docker-socket-proxy:latest + image: tecnativa/docker-socket-proxy:${DOCKER_SOCKET_PROXY_DOCKER_TAG:-latest} container_name: homepage-dockerproxy profiles: - homepage diff --git a/infrastructure/services/homepage/env/homepage.env b/infrastructure/services/homepage/env/homepage.env.example similarity index 100% rename from infrastructure/services/homepage/env/homepage.env rename to infrastructure/services/homepage/env/homepage.env.example diff --git a/infrastructure/services/it-tools/docker-compose.it-tools.yml b/infrastructure/services/it-tools/docker-compose.it-tools.yml index 7c6db93..af92124 100644 --- a/infrastructure/services/it-tools/docker-compose.it-tools.yml +++ b/infrastructure/services/it-tools/docker-compose.it-tools.yml @@ -4,7 +4,7 @@ services: extends: file: ../common.yml service: service-base - image: ghcr.io/sharevb/it-tools:latest + image: ghcr.io/sharevb/it-tools:${IT_TOOLS_DOCKER_TAG:-latest} container_name: it-tools0 profiles: - it-tools @@ -18,7 +18,7 @@ services: extends: file: ../common.yml service: service-base - image: ghcr.io/sharevb/it-tools:latest + image: ghcr.io/sharevb/it-tools:${IT_TOOLS_DOCKER_TAG:-latest} container_name: it-tools1 profiles: - it-tools diff --git a/infrastructure/services/jellyfin/docker-compose.jellyfin.yml b/infrastructure/services/jellyfin/docker-compose.jellyfin.yml index dc91ef3..85df8e9 100644 --- a/infrastructure/services/jellyfin/docker-compose.jellyfin.yml +++ b/infrastructure/services/jellyfin/docker-compose.jellyfin.yml @@ -1,11 +1,13 @@ services: # Jellyfin jellyfin: - image: lscr.io/linuxserver/jellyfin:latest + image: lscr.io/linuxserver/jellyfin:${JELLYFIN_DOCKER_TAG:-latest} container_name: jellyfin profiles: - jellyfin - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base environment: - PUID=${PUID:-1000} - PGID=${PGID:-1000} @@ -24,8 +26,6 @@ services: - /dev/dri:/dev/dri networks: - caddy-media - security_opt: - - no-new-privileges:true volumes: jellyfin_config: diff --git a/infrastructure/services/jellyfin/env/jellyfin.env b/infrastructure/services/jellyfin/env/jellyfin.env.example similarity index 100% rename from infrastructure/services/jellyfin/env/jellyfin.env rename to infrastructure/services/jellyfin/env/jellyfin.env.example diff --git a/infrastructure/services/localai/docker-compose.localai.yml b/infrastructure/services/localai/docker-compose.localai.yml index 376130e..4953d03 100644 --- a/infrastructure/services/localai/docker-compose.localai.yml +++ b/infrastructure/services/localai/docker-compose.localai.yml @@ -7,13 +7,13 @@ services: container_name: localai profiles: - localai - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy env_file: - ./env/localai.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - localai_data:/data - localai_models:/models @@ -21,8 +21,6 @@ services: - localai_config:/config networks: - caddy-ai - security_opt: - - no-new-privileges:true volumes: localai_models: diff --git a/infrastructure/services/localai/env/localai.env b/infrastructure/services/localai/env/localai.env.example similarity index 100% rename from infrastructure/services/localai/env/localai.env rename to infrastructure/services/localai/env/localai.env.example diff --git a/infrastructure/services/main/docker-compose.main.yml b/infrastructure/services/main/docker-compose.main.yml index 8a5d962..0334889 100644 --- a/infrastructure/services/main/docker-compose.main.yml +++ b/infrastructure/services/main/docker-compose.main.yml @@ -1,15 +1,16 @@ services: main_infrastructure: container_name: main_infrastructure - image: alpine:latest + image: alpine:${ALPINE_DOCKER_TAG:-latest} profiles: - main_infrastructure volumes: - public_data:/public_data:rw - private_data:/private_data:rw read_only: true - security_opt: - - no-new-privileges:true + extends: + file: ../common.yml + service: service-base cap_drop: - ALL cap_add: @@ -22,7 +23,7 @@ services: container_name: watchtower profiles: - main_infrastructure - image: nickfedor/watchtower:latest + image: nickfedor/watchtower:${WATCHTOWER_DOCKER_TAG:-latest} environment: - TZ=${TZ:-Europe/Paris} volumes: diff --git a/infrastructure/services/memos/docker-compose.memos.yml b/infrastructure/services/memos/docker-compose.memos.yml index 60d9bd1..be45218 100644 --- a/infrastructure/services/memos/docker-compose.memos.yml +++ b/infrastructure/services/memos/docker-compose.memos.yml @@ -1,11 +1,13 @@ services: # memos memos: - image: neosmemo/memos:latest + image: neosmemo/memos:${MEMOS_DOCKER_TAG:-latest} container_name: memos profiles: - memos - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy env_file: @@ -14,8 +16,6 @@ services: - memos_config:/var/opt/memos networks: - caddy-tools - security_opt: - - no-new-privileges:true volumes: memos_config: diff --git a/infrastructure/services/memos/env/memos.env b/infrastructure/services/memos/env/memos.env.example similarity index 100% rename from infrastructure/services/memos/env/memos.env rename to infrastructure/services/memos/env/memos.env.example diff --git a/infrastructure/services/minecraft-server/backup/docker-compose.backup.yml b/infrastructure/services/minecraft-server/backup/docker-compose.backup.yml index 39af09c..1c88a4a 100644 --- a/infrastructure/services/minecraft-server/backup/docker-compose.backup.yml +++ b/infrastructure/services/minecraft-server/backup/docker-compose.backup.yml @@ -1,21 +1,21 @@ services: minecraft_backup: - image: mazzolino/restic:latest + image: mazzolino/restic:${RESTIC_DOCKER_TAG:-latest} container_name: minecraft_backup profiles: - minecraft_backup depends_on: - mc-server - minecraft_proxy - restart: on-failure:7 + extends: + file: ../../common.yml + service: service-base env_file: - ./env/backup.env volumes: - minecraft_server_backup:/mnt/restic - minecraft_server_data:/data/minecraft_server_data:ro - minecraft_proxy_data:/data/minecraft_proxy_data:ro - security_opt: - - no-new-privileges:true network_mode: none cap_drop: - NET_ADMIN diff --git a/infrastructure/services/teamfortress2-server/backup/env/teamfortress2_backup.env b/infrastructure/services/minecraft-server/backup/env/backup.env.example similarity index 86% rename from infrastructure/services/teamfortress2-server/backup/env/teamfortress2_backup.env rename to infrastructure/services/minecraft-server/backup/env/backup.env.example index 4df6131..1fbf219 100644 --- a/infrastructure/services/teamfortress2-server/backup/env/teamfortress2_backup.env +++ b/infrastructure/services/minecraft-server/backup/env/backup.env.example @@ -1,14 +1,14 @@ #RUN_ON_STARTUP=true RESTIC_REPOSITORY=/mnt/restic RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=SCY5cmu12Odca302EXabPA9jXYkCb2NN +RESTIC_PASSWORD=__GENERATE_MINECRAFT_RESTIC_PASSWORD__ # Backup (exuclusive with Check and Prune) -BACKUP_CRON=*/15 * * * * RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose +BACKUP_CRON=*/15 * * * * #RESTIC_FORGET_ARGS=--prune --keep-last 8 --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 4 # Check (exuclusive with Check and Prune) #CHECK_CRON=*/15 * * * * #RESTIC_CHECK_ARGS=--read-data-subset=40% # Prune (exuclusive with Check and Prune) #PRUNE_CRON=*/15 * * * * -#RESTIC_PRUNE_ARGS= \ No newline at end of file +#RESTIC_PRUNE_ARGS= diff --git a/infrastructure/services/minecraft-server/minecraft-server/docker-compose.minecraft.yml b/infrastructure/services/minecraft-server/minecraft-server/docker-compose.minecraft.yml index bef7db1..4b9dd39 100644 --- a/infrastructure/services/minecraft-server/minecraft-server/docker-compose.minecraft.yml +++ b/infrastructure/services/minecraft-server/minecraft-server/docker-compose.minecraft.yml @@ -1,6 +1,6 @@ services: minecraft_proxy: - image: itzg/bungeecord:latest + image: itzg/mc-proxy:${MINECRAFT_PROXY_DOCKER_TAG:-java25} container_name: minecraft_proxy_server profiles: - minecraft_proxy @@ -26,7 +26,7 @@ services: - minecraft-network mc-server: - image: itzg/minecraft-server:latest + image: itzg/minecraft-server:${MINECRAFT_SERVER_DOCKER_TAG:-java25} container_name: minecraft_server profiles: - minecraft_server diff --git a/infrastructure/services/minecraft-server/minecraft-server/env/mods_plugins.env b/infrastructure/services/minecraft-server/minecraft-server/env/mods_plugins.env.example similarity index 97% rename from infrastructure/services/minecraft-server/minecraft-server/env/mods_plugins.env rename to infrastructure/services/minecraft-server/minecraft-server/env/mods_plugins.env.example index c322296..f4f0f96 100644 --- a/infrastructure/services/minecraft-server/minecraft-server/env/mods_plugins.env +++ b/infrastructure/services/minecraft-server/minecraft-server/env/mods_plugins.env.example @@ -31,4 +31,4 @@ REMOVE_OLD_MODS_DEPTH=16 # MODS_FORGEAPI_IGNORE_GAMETYPE # REMOVE_OLD_FORGEAPI_MODS # REMOVE_OLD_DATAPACKS_DEPTH -# REMOVE_OLD_DATAPACKS_INCLUDE \ No newline at end of file +# REMOVE_OLD_DATAPACKS_INCLUDE diff --git a/infrastructure/services/minecraft-server/minecraft-server/env/proxy.env b/infrastructure/services/minecraft-server/minecraft-server/env/proxy.env.example similarity index 73% rename from infrastructure/services/minecraft-server/minecraft-server/env/proxy.env rename to infrastructure/services/minecraft-server/minecraft-server/env/proxy.env.example index 0836c73..b42de36 100644 --- a/infrastructure/services/minecraft-server/minecraft-server/env/proxy.env +++ b/infrastructure/services/minecraft-server/minecraft-server/env/proxy.env.example @@ -1,12 +1,12 @@ TYPE=VELOCITY -VELOCITY_VERSION=3.5.0-SNAPSHOT -VELOCITY_BUILD_ID=594 +VELOCITY_VERSION=4.0.0-SNAPSHOT +VELOCITY_BUILD_ID=5 #PLUGINS= #SPIGET_PLUGINS= DEBUG=false DEBUG_HELPER=false ENABLE_RCON=false -#RCON_PASSWORD=6hxU3Oxmh2Q8e6S9fjkdWJik +#RCON_PASSWORD=__GENERATE_MINECRAFT_PROXY_RCON_PASSWORD__ #RCON_PORT=25576 INIT_MEMORY=512M MAX_MEMORY=1536M diff --git a/infrastructure/services/minecraft-server/minecraft-server/env/server.env b/infrastructure/services/minecraft-server/minecraft-server/env/server.env.example similarity index 94% rename from infrastructure/services/minecraft-server/minecraft-server/env/server.env rename to infrastructure/services/minecraft-server/minecraft-server/env/server.env.example index e5df29c..18ac83a 100644 --- a/infrastructure/services/minecraft-server/minecraft-server/env/server.env +++ b/infrastructure/services/minecraft-server/minecraft-server/env/server.env.example @@ -11,8 +11,8 @@ ENFORCE_SECURE_PROFILE=false # Server jar options TYPE=PURPUR -VERSION=1.21.11 -PURPUR_BUILD=2568 +VERSION=26.2 +PURPUR_BUILD=2608 FORCE_REDOWNLOAD=false BUILD_FROM_SOURCE=false @@ -64,7 +64,7 @@ ALLOW_FLIGHT=false # RCON options ENABLE_RCON=false -RCON_PASSWORD=6hxU3Oxmh2Q8e6S9fjkdWJik +RCON_PASSWORD=__GENERATE_MINECRAFT_RCON_PASSWORD__ RCON_PORT=25575 BROADCAST_CONSOLE_TO_OPS=true BROADCAST_RCON_TO_OPS=true @@ -78,4 +78,3 @@ SNOOPER_ENABLED=true ENABLE_STATUS=true PREVIEWS_CHAT=false #SYNC_CHUNK_WRITES=true - diff --git a/infrastructure/services/minecraft-server/minecraft-server/env/world.env b/infrastructure/services/minecraft-server/minecraft-server/env/world.env.example similarity index 96% rename from infrastructure/services/minecraft-server/minecraft-server/env/world.env rename to infrastructure/services/minecraft-server/minecraft-server/env/world.env.example index bc4211a..bb2f945 100644 --- a/infrastructure/services/minecraft-server/minecraft-server/env/world.env +++ b/infrastructure/services/minecraft-server/minecraft-server/env/world.env.example @@ -19,4 +19,4 @@ SEED=3820 # Spawn Entities Options SPAWN_ANIMALS=true SPAWN_MONSTERS=true -SPAWN_NPCS=true \ No newline at end of file +SPAWN_NPCS=true diff --git a/infrastructure/services/omni-tools/docker-compose.omni-tools.yml b/infrastructure/services/omni-tools/docker-compose.omni-tools.yml index 7b15e89..8864126 100644 --- a/infrastructure/services/omni-tools/docker-compose.omni-tools.yml +++ b/infrastructure/services/omni-tools/docker-compose.omni-tools.yml @@ -2,7 +2,7 @@ x-omni-tools: &omni-tools extends: file: ../common.yml service: service-base - image: iib0011/omni-tools:latest + image: iib0011/omni-tools:${OMNI_TOOLS_DOCKER_TAG:-latest} profiles: - omni-tools depends_on: diff --git a/infrastructure/services/open-webui/docker-compose.open-webui.yml b/infrastructure/services/open-webui/docker-compose.open-webui.yml index a6ddc57..892b39c 100644 --- a/infrastructure/services/open-webui/docker-compose.open-webui.yml +++ b/infrastructure/services/open-webui/docker-compose.open-webui.yml @@ -2,14 +2,16 @@ name: openwebui services: ollama: - image: ollama/ollama:${OLLAMA_DOCKER_TAG:-0.30.11} + image: ollama/ollama:${OLLAMA_DOCKER_TAG:-0.32.4} container_name: ollama profiles: - openwebui - ollama depends_on: - caddy - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base tty: true volumes: - openwebui-ollama:/root/.ollama @@ -17,10 +19,6 @@ services: # - ${OLLAMA_PORT:-11434}:11434 env_file: - ./env/openwebui-ollama.env - environment: - - TZ=${TZ:-Europe/Paris} - security_opt: - - no-new-privileges:true networks: - openwebui-internal # devices: @@ -28,24 +26,22 @@ services: # - /dev/kfd litellm: - image: ghcr.io/berriai/litellm:${LITELLM_DOCKER_TAG:-v1.89.6} + image: ghcr.io/berriai/litellm:${LITELLM_DOCKER_TAG:-v1.93.0} container_name: litellm profiles: - openwebui - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: litellm-postgres: condition: service_healthy env_file: - ./env/litellm.env - environment: - - TZ=${TZ:-Europe/Paris} command: ["--port", "4000", "--detailed_debug"] networks: - caddy-ai - openwebui-internal - security_opt: - - no-new-privileges:true litellm-postgres: image: postgres:${POSTGRES_DOCKER_TAG:-18.4-alpine3.24} @@ -54,11 +50,11 @@ services: - openwebui env_file: - ./env/litellm-postgres.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - litellm-postgres:/var/lib/postgresql - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base networks: - openwebui-internal healthcheck: @@ -74,11 +70,11 @@ services: - openwebui env_file: - ./env/openwebui-postgres.env - environment: - - TZ=${TZ:-Europe/Paris} + extends: + file: ../common.yml + service: service-base volumes: - openwebui-postgres:/var/lib/postgresql - restart: on-failure:7 networks: - openwebui-internal healthcheck: @@ -88,10 +84,13 @@ services: retries: 5 openwebui: - image: ghcr.io/open-webui/open-webui:${WEBUI_DOCKER_TAG:-git-ecd48e2} + image: ghcr.io/open-webui/open-webui:${OPEN_WEBUI_DOCKER_TAG:-v0.11.0} container_name: openwebui profiles: - openwebui + extends: + file: ../common.yml + service: service-base volumes: - openwebui:/app/backend/data depends_on: @@ -102,40 +101,37 @@ services: - valkey env_file: - ./env/openwebui.env - environment: - - TZ=${TZ:-Europe/Paris} # - UID=${PUID:-1000} # - GID=${PGID:-1000} # ports: # - ${OPEN_WEBUI_PORT:-3000}:8080 - restart: on-failure:7 networks: - caddy-ai - openwebui-internal - security_opt: - - no-new-privileges:true openwebui-pipelines: image: ghcr.io/open-webui/pipelines:${WEBUI_PIPELINE_DOCKER_TAG:-git-039f9c5} container_name: openwebui-pipelines profiles: - openwebui + extends: + file: ../common.yml + service: service-base networks: - openwebui-internal env_file: - ./env/openwebui-pipelines.env - restart: on-failure:7 volumes: - openwebui-pipelines:/app/pipelines - security_opt: - - no-new-privileges:true qdrant: - image: qdrant/qdrant:${QDRANT_DOCKER_TAG:-v1.18.2} + image: qdrant/qdrant:${QDRANT_DOCKER_TAG:-v1.18.3} profiles: - openwebui container_name: qdrant - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base # ports: # - "6333:6333" # - "6334:6334" @@ -147,14 +143,18 @@ services: - openwebui-internal valkey: - image: valkey/valkey:${VALKEY_DOCKER_TAG:-9.1.0-alpine} + image: valkey/valkey:${VALKEY_DOCKER_TAG:-9.1.1-alpine} container_name: valkey profiles: - openwebui env_file: - ./env/openwebui-valkey.env - restart: on-failure:7 - command: valkey-server --requirepass ${VALKEY_PASSWORD:-valkey_password} --maxclients 10000 --timeout 1800 + extends: + file: ../common.yml + service: service-base + # $$VALKEY_PASSWORD (not ${VALKEY_PASSWORD}) so it's expanded at container + # runtime from env_file, not at compose-parse time from the host shell. + command: sh -c 'exec valkey-server --requirepass "$$VALKEY_PASSWORD" --maxclients 10000 --timeout 1800' volumes: - openwebui-valkey:/data networks: diff --git a/infrastructure/services/open-webui/env/litellm-postgres.env b/infrastructure/services/open-webui/env/litellm-postgres.env deleted file mode 100644 index bd6d2b7..0000000 --- a/infrastructure/services/open-webui/env/litellm-postgres.env +++ /dev/null @@ -1,3 +0,0 @@ -POSTGRES_USER=litellm_user -POSTGRES_PASSWORD=fdbdfsgfdghgjhfjtjgdfssdgsfdg -POSTGRES_DB=litellm_db \ No newline at end of file diff --git a/infrastructure/services/open-webui/env/litellm-postgres.env.example b/infrastructure/services/open-webui/env/litellm-postgres.env.example new file mode 100644 index 0000000..1ee28dc --- /dev/null +++ b/infrastructure/services/open-webui/env/litellm-postgres.env.example @@ -0,0 +1,3 @@ +POSTGRES_USER=litellm_user +POSTGRES_PASSWORD=__GENERATE_LITELLM_DB_PASSWORD__ +POSTGRES_DB=litellm_db diff --git a/infrastructure/services/open-webui/env/litellm.env b/infrastructure/services/open-webui/env/litellm.env deleted file mode 100644 index 7f62f29..0000000 --- a/infrastructure/services/open-webui/env/litellm.env +++ /dev/null @@ -1,11 +0,0 @@ -DATABASE_URL=postgresql://litellm_user:fdbdfsgfdghgjhfjtjgdfssdgsfdg@litellm-postgres:5432/litellm_db - -LITELLM_MASTER_KEY=a51d5a17f7b8f96128866c6bfc903ec0 - -LITELLM_MODE=proxy -UI_USERNAME=admin -UI_PASSWORD=ffdsfsdsfdggdfsgdfhgfsgfsg -PROXY_BASE_URL=https://litellm.bensuperpc.org - -#OPENAI_API_KEY= -#ANTHROPIC_API_KEY= \ No newline at end of file diff --git a/infrastructure/services/open-webui/env/litellm.env.example b/infrastructure/services/open-webui/env/litellm.env.example new file mode 100644 index 0000000..3a0569f --- /dev/null +++ b/infrastructure/services/open-webui/env/litellm.env.example @@ -0,0 +1,11 @@ +DATABASE_URL=postgresql://litellm_user:__GENERATE_LITELLM_DB_PASSWORD__@litellm-postgres:5432/litellm_db + +LITELLM_MASTER_KEY=__GENERATE_LITELLM_MASTER_KEY__ + +LITELLM_MODE=proxy +UI_USERNAME=admin +UI_PASSWORD=__GENERATE_LITELLM_UI_PASSWORD__ +PROXY_BASE_URL=https://litellm.bensuperpc.org + +#OPENAI_API_KEY= +#ANTHROPIC_API_KEY= diff --git a/infrastructure/services/open-webui/env/openwebui-ollama.env b/infrastructure/services/open-webui/env/openwebui-ollama.env.example similarity index 100% rename from infrastructure/services/open-webui/env/openwebui-ollama.env rename to infrastructure/services/open-webui/env/openwebui-ollama.env.example diff --git a/infrastructure/services/open-webui/env/openwebui-pgadmin.env b/infrastructure/services/open-webui/env/openwebui-pgadmin.env deleted file mode 100644 index bca5178..0000000 --- a/infrastructure/services/open-webui/env/openwebui-pgadmin.env +++ /dev/null @@ -1,4 +0,0 @@ -PGADMIN_DEFAULT_EMAIL=admin@local.ai -PGADMIN_DEFAULT_PASSWORD=admin123 -PGADMIN_CONFIG_SERVER_MODE=False -PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False \ No newline at end of file diff --git a/infrastructure/services/open-webui/env/openwebui-pgadmin.env.example b/infrastructure/services/open-webui/env/openwebui-pgadmin.env.example new file mode 100644 index 0000000..01b83fb --- /dev/null +++ b/infrastructure/services/open-webui/env/openwebui-pgadmin.env.example @@ -0,0 +1,4 @@ +PGADMIN_DEFAULT_EMAIL=admin@local.ai +PGADMIN_DEFAULT_PASSWORD=__GENERATE_PGADMIN_PASSWORD__ +PGADMIN_CONFIG_SERVER_MODE=False +PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False diff --git a/infrastructure/services/open-webui/env/openwebui-pipelines.env b/infrastructure/services/open-webui/env/openwebui-pipelines.env deleted file mode 100644 index b7ce65a..0000000 --- a/infrastructure/services/open-webui/env/openwebui-pipelines.env +++ /dev/null @@ -1 +0,0 @@ -PIPELINES_API_KEY=ssdfsfdsfdgfgfg \ No newline at end of file diff --git a/infrastructure/services/open-webui/env/openwebui-pipelines.env.example b/infrastructure/services/open-webui/env/openwebui-pipelines.env.example new file mode 100644 index 0000000..3f3e12a --- /dev/null +++ b/infrastructure/services/open-webui/env/openwebui-pipelines.env.example @@ -0,0 +1 @@ +PIPELINES_API_KEY=__GENERATE_PIPELINES_API_KEY__ diff --git a/infrastructure/services/open-webui/env/openwebui-postgres.env b/infrastructure/services/open-webui/env/openwebui-postgres.env deleted file mode 100644 index 3c96482..0000000 --- a/infrastructure/services/open-webui/env/openwebui-postgres.env +++ /dev/null @@ -1,3 +0,0 @@ -POSTGRES_DB=openwebui -POSTGRES_USER=postgres -POSTGRES_PASSWORD=securepassword123 diff --git a/infrastructure/services/open-webui/env/openwebui-postgres.env.example b/infrastructure/services/open-webui/env/openwebui-postgres.env.example new file mode 100644 index 0000000..d9c1c3e --- /dev/null +++ b/infrastructure/services/open-webui/env/openwebui-postgres.env.example @@ -0,0 +1,3 @@ +POSTGRES_DB=openwebui +POSTGRES_USER=postgres +POSTGRES_PASSWORD=__GENERATE_OPENWEBUI_DB_PASSWORD__ diff --git a/infrastructure/services/open-webui/env/openwebui-qdrant.env b/infrastructure/services/open-webui/env/openwebui-qdrant.env deleted file mode 100644 index 0ccc59d..0000000 --- a/infrastructure/services/open-webui/env/openwebui-qdrant.env +++ /dev/null @@ -1,2 +0,0 @@ -QDRANT__SERVICE__API_KEY=qdrant_api_key -QDRANT__SERVICE__ENABLE_API_KEY_AUTHORIZATION=true \ No newline at end of file diff --git a/infrastructure/services/open-webui/env/openwebui-qdrant.env.example b/infrastructure/services/open-webui/env/openwebui-qdrant.env.example new file mode 100644 index 0000000..fd34610 --- /dev/null +++ b/infrastructure/services/open-webui/env/openwebui-qdrant.env.example @@ -0,0 +1,2 @@ +QDRANT__SERVICE__API_KEY=__GENERATE_QDRANT_API_KEY__ +QDRANT__SERVICE__ENABLE_API_KEY_AUTHORIZATION=true diff --git a/infrastructure/services/open-webui/env/openwebui-valkey.env b/infrastructure/services/open-webui/env/openwebui-valkey.env deleted file mode 100644 index 63ddc43..0000000 --- a/infrastructure/services/open-webui/env/openwebui-valkey.env +++ /dev/null @@ -1 +0,0 @@ -VALKEY_PASSWORD=valkey_password diff --git a/infrastructure/services/open-webui/env/openwebui-valkey.env.example b/infrastructure/services/open-webui/env/openwebui-valkey.env.example new file mode 100644 index 0000000..650b3bc --- /dev/null +++ b/infrastructure/services/open-webui/env/openwebui-valkey.env.example @@ -0,0 +1 @@ +VALKEY_PASSWORD=__GENERATE_VALKEY_PASSWORD__ diff --git a/infrastructure/services/open-webui/env/openwebui.env b/infrastructure/services/open-webui/env/openwebui.env.example similarity index 65% rename from infrastructure/services/open-webui/env/openwebui.env rename to infrastructure/services/open-webui/env/openwebui.env.example index 857c1ff..e053785 100644 --- a/infrastructure/services/open-webui/env/openwebui.env +++ b/infrastructure/services/open-webui/env/openwebui.env.example @@ -1,10 +1,10 @@ OLLAMA_BASE_URL=http://ollama:11434 OPENAI_API_BASE_URL=http://litellm:4000/v1 -OPENAI_API_KEY=a51d5a17f7b8f96128866c6bfc903ec0 +OPENAI_API_KEY=__GENERATE_LITELLM_MASTER_KEY__ # openssl rand -hex 32 -WEBUI_SECRET_KEY=7d83b15a417d090ba5c6b899270a05dd215c60848354c0c7574226d6ff02f39e +WEBUI_SECRET_KEY=__GENERATE_OPENWEBUI_SECRET_KEY__ #HF_HUB_OFFLINE=1 # Disable analytics @@ -16,7 +16,7 @@ ANONYMIZED_TELEMETRY=false #OPENAI_API_KEY= # Database configuration -DATABASE_URL=postgresql://postgres:securepassword123@openwebui-postgres:5432/openwebui +DATABASE_URL=postgresql://postgres:__GENERATE_OPENWEBUI_DB_PASSWORD__@openwebui-postgres:5432/openwebui DATABASE_POOL_SIZE=20 DATABASE_POOL_MAX_OVERFLOW=10 DATABASE_POOL_TIMEOUT=30 @@ -24,12 +24,12 @@ DATABASE_POOL_RECYCLE=1800 VECTOR_DB=${VECTOR_DB:-qdrant} QDRANT_URI=http://qdrant:6333 -QDRANT_API_KEY=qdrant_api_key +QDRANT_API_KEY=__GENERATE_QDRANT_API_KEY__ -REDIS_URL=redis://:valkey_password@valkey:6379/0 +REDIS_URL=redis://:__GENERATE_VALKEY_PASSWORD__@valkey:6379/0 ENABLE_WEBSOCKET_SUPPORT=true WEBSOCKET_MANAGER=redis -WEBSOCKET_REDIS_URL=redis://:valkey_password@valkey:6379/1?socket_timeout=86400 +WEBSOCKET_REDIS_URL=redis://:__GENERATE_VALKEY_PASSWORD__@valkey:6379/1?socket_timeout=86400 # Fix issues with redis lib 8.0.0 and openwebUI 0.10.1 WEBSOCKET_REDIS_OPTIONS={"socket_timeout":null} diff --git a/infrastructure/services/openssh/docker-compose.openssh.yml b/infrastructure/services/openssh/docker-compose.openssh.yml index 5a58e9e..7c5da3b 100644 --- a/infrastructure/services/openssh/docker-compose.openssh.yml +++ b/infrastructure/services/openssh/docker-compose.openssh.yml @@ -1,7 +1,7 @@ services: # openssh openssh: - image: linuxserver/openssh-server:latest + image: linuxserver/openssh-server:${OPENSSH_DOCKER_TAG:-latest} container_name: openssh profiles: - openssh @@ -30,12 +30,8 @@ services: - minecraft_server_backup:/minecraft_server_backup:rw - minecraft_server_data:/minecraft_server_data:rw - minecraft_proxy_data:/minecraft_proxy_data:rw - - forgejo_data:/forgejo_data:rw - - forgejo_db:/forgejo_db:rw - - teamfortress2_backup:/teamfortress2_backup:rw - - teamfortress2_data:/teamfortress2_data:rw - - argus_data:/argus_data:rw - qbittorrent_config:/qbittorrent_config:rw + - vscode-server_config:/vscode-server_config:rw networks: - openssh-network security_opt: @@ -83,16 +79,11 @@ volumes: name: teamfortress2_backup teamfortress2_data: name: teamfortress2_data -# forgejo - forgejo_data: - name: forgejo_data - forgejo_db: - name: forgejo_db # argus - argus_data: - name: argus_data qbittorrent_config: name: qbittorrent_config + vscode-server_config: + name: vscode-server_config networks: openssh-network: diff --git a/infrastructure/services/openssh/env/openssh.env b/infrastructure/services/openssh/env/openssh.env.example similarity index 86% rename from infrastructure/services/openssh/env/openssh.env rename to infrastructure/services/openssh/env/openssh.env.example index 1a32161..6edc63e 100644 --- a/infrastructure/services/openssh/env/openssh.env +++ b/infrastructure/services/openssh/env/openssh.env.example @@ -4,11 +4,11 @@ DOCKER_MODS=linuxserver/mods:openssh-server-rsync #PUBLIC_KEY_URL=https://github.com/bensuperpc.keys PUBLIC_KEY_DIR=/authorized_ssh_keys USER_NAME=admin -USER_PASSWORD=it47mnLJIhNFspkYQo70zJsAYX7n0DSX +USER_PASSWORD=__GENERATE_OPENSSH_USER_PASSWORD__ #PUBLIC_KEY=yourpublickey #PUBLIC_KEY_FILE=/path/to/file #PUBLIC_KEY_DIR=/path/to/directory/containing/_only_/pubkeys #PUBLIC_KEY_URL=https://github.com/username.keys #USER_PASSWORD_FILE=/path/to/file -#LOG_STDOUT= \ No newline at end of file +#LOG_STDOUT= diff --git a/infrastructure/services/picoshare/docker-compose.picoshare.yml b/infrastructure/services/picoshare/docker-compose.picoshare.yml index b08f79f..4f91310 100644 --- a/infrastructure/services/picoshare/docker-compose.picoshare.yml +++ b/infrastructure/services/picoshare/docker-compose.picoshare.yml @@ -1,26 +1,22 @@ services: # picoshare picoshare: - image: mtlynch/picoshare:latest + extends: + file: ../common.yml + service: service-base + image: mtlynch/picoshare:${PICOSHARE_DOCKER_TAG:-latest} container_name: picoshare profiles: - picoshare - restart: on-failure:7 depends_on: - caddy env_file: - ./env/picoshare.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - picoshare_data:/data networks: - caddy-files - security_opt: - - no-new-privileges:true read_only: false - cap_drop: - - SYS_ADMIN # tmpfs: # - /tmp diff --git a/infrastructure/services/picoshare/env/picoshare.env b/infrastructure/services/picoshare/env/picoshare.env deleted file mode 100644 index b739293..0000000 --- a/infrastructure/services/picoshare/env/picoshare.env +++ /dev/null @@ -1,3 +0,0 @@ -PS_SHARED_SECRET=CBuS4DJLqIe93xF1KGYRrnhxUFBqLD2n -PORT=4001 -PS_BEHIND_PROXY=true diff --git a/infrastructure/services/picoshare/env/picoshare.env.example b/infrastructure/services/picoshare/env/picoshare.env.example new file mode 100644 index 0000000..db9dcfa --- /dev/null +++ b/infrastructure/services/picoshare/env/picoshare.env.example @@ -0,0 +1,3 @@ +PS_SHARED_SECRET=__GENERATE_PICOSHARE_SHARED_SECRET__ +PORT=4001 +PS_BEHIND_PROXY=true diff --git a/infrastructure/services/privatebin/docker-compose.privatebin.yml b/infrastructure/services/privatebin/docker-compose.privatebin.yml index 138b9a5..458ecd2 100644 --- a/infrastructure/services/privatebin/docker-compose.privatebin.yml +++ b/infrastructure/services/privatebin/docker-compose.privatebin.yml @@ -1,22 +1,20 @@ services: # privatebin privatebin: - image: privatebin/nginx-fpm-alpine:latest + image: privatebin/nginx-fpm-alpine:${PRIVATEBIN_DOCKER_TAG:-latest} container_name: privatebin profiles: - privatebin - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy volumes: - privatebin_data:/srv/data - ./config/conf.php:/srv/cfg/conf.php:ro - environment: - - TZ=${TZ:-Europe/Paris} networks: - caddy-tools - security_opt: - - no-new-privileges:true read_only: true volumes: diff --git a/infrastructure/services/projectsend/docker-compose.projectsend.yml b/infrastructure/services/projectsend/docker-compose.projectsend.yml index 8a81d43..7ac1024 100644 --- a/infrastructure/services/projectsend/docker-compose.projectsend.yml +++ b/infrastructure/services/projectsend/docker-compose.projectsend.yml @@ -1,11 +1,13 @@ services: # projectsend projectsend: - image: linuxserver/projectsend:latest + extends: + file: ../common.yml + service: service-base + image: linuxserver/projectsend:${PROJECTSEND_DOCKER_TAG:-latest} container_name: projectsend profiles: - projectsend - restart: on-failure:7 depends_on: - caddy env_file: @@ -16,32 +18,25 @@ services: networks: - caddy-files - projectsend-internal - security_opt: - - no-new-privileges:true - cap_drop: - - SYS_ADMIN # Database projectsend projectsend_db: - image: mariadb:latest + image: mariadb:${PROJECTSEND_DB_DOCKER_TAG:-latest} container_name: projectsend_db profiles: - - database - projectsend + extends: + file: ../common.yml + service: service-base depends_on: - caddy - restart: on-failure:7 volumes: - projectsend_db:/var/lib/mysql:rw env_file: - ./env/projectsend_db.env - environment: - - TZ=${TZ:-Europe/Paris} command: '--default-authentication-plugin=mysql_native_password' networks: - projectsend-internal - security_opt: - - no-new-privileges:true volumes: projectsend_db: diff --git a/infrastructure/services/projectsend/env/projectsend.env b/infrastructure/services/projectsend/env/projectsend.env.example similarity index 100% rename from infrastructure/services/projectsend/env/projectsend.env rename to infrastructure/services/projectsend/env/projectsend.env.example diff --git a/infrastructure/services/projectsend/env/projectsend_db.env b/infrastructure/services/projectsend/env/projectsend_db.env deleted file mode 100644 index 77f1999..0000000 --- a/infrastructure/services/projectsend/env/projectsend_db.env +++ /dev/null @@ -1,4 +0,0 @@ -MARIADB_ROOT_PASSWORD=8O34297GrBfT3Ld34Lfg9mpotmZwbJtt -MARIADB_USER=bensuperpc -MARIADB_PASSWORD=wdSUa1JEZhXie5AJ5NcX1w73xmpO12EY -MARIADB_DATABASE=projectsend diff --git a/infrastructure/services/projectsend/env/projectsend_db.env.example b/infrastructure/services/projectsend/env/projectsend_db.env.example new file mode 100644 index 0000000..cf68369 --- /dev/null +++ b/infrastructure/services/projectsend/env/projectsend_db.env.example @@ -0,0 +1,4 @@ +MARIADB_ROOT_PASSWORD=__GENERATE_PROJECTSEND_DB_ROOT_PASSWORD__ +MARIADB_USER=bensuperpc +MARIADB_PASSWORD=__GENERATE_PROJECTSEND_DB_PASSWORD__ +MARIADB_DATABASE=projectsend diff --git a/infrastructure/services/psitransfer/docker-compose.psitransfer.yml b/infrastructure/services/psitransfer/docker-compose.psitransfer.yml index f6a10d5..b8947e4 100644 --- a/infrastructure/services/psitransfer/docker-compose.psitransfer.yml +++ b/infrastructure/services/psitransfer/docker-compose.psitransfer.yml @@ -1,24 +1,22 @@ services: # psitransfer psitransfer: - image: psitrax/psitransfer:latest + image: psitrax/psitransfer:${PSITRANSFER_DOCKER_TAG:-latest} container_name: psitransfer profiles: - psitransfer - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base # user: ${PUID:-1000}:${PGID:-1000} depends_on: - caddy env_file: - ./env/psitransfer.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - psitransfer_data:/data networks: - caddy-files - security_opt: - - no-new-privileges:true read_only: true volumes: diff --git a/infrastructure/services/psitransfer/env/psitransfer.env b/infrastructure/services/psitransfer/env/psitransfer.env deleted file mode 100644 index 4032ffe..0000000 --- a/infrastructure/services/psitransfer/env/psitransfer.env +++ /dev/null @@ -1,2 +0,0 @@ -PSITRANSFER_ADMIN_PASS=n9jLVNT9QUotTJTT91JqH4GyBTg9pvEn -#PSITRANSFER_PORT=3000 diff --git a/infrastructure/services/psitransfer/env/psitransfer.env.example b/infrastructure/services/psitransfer/env/psitransfer.env.example new file mode 100644 index 0000000..e336c46 --- /dev/null +++ b/infrastructure/services/psitransfer/env/psitransfer.env.example @@ -0,0 +1,2 @@ +PSITRANSFER_ADMIN_PASS=__GENERATE_PSITRANSFER_ADMIN_PASS__ +#PSITRANSFER_PORT=3000 diff --git a/infrastructure/services/qbittorrent/docker-compose.qbittorrent.yml b/infrastructure/services/qbittorrent/docker-compose.qbittorrent.yml index 51b48e9..08dd90d 100644 --- a/infrastructure/services/qbittorrent/docker-compose.qbittorrent.yml +++ b/infrastructure/services/qbittorrent/docker-compose.qbittorrent.yml @@ -1,11 +1,13 @@ services: # qBittorrent qbittorrent: - image: lscr.io/linuxserver/qbittorrent:latest + image: lscr.io/linuxserver/qbittorrent:${QBITTORRENT_DOCKER_TAG:-latest} container_name: qbittorrent profiles: - qbittorrent - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy env_file: @@ -13,7 +15,6 @@ services: environment: - PUID=${PUID:-1000} - PGID=${PGID:-1000} - - TZ=${TZ:-Europe/Paris} ports: - 6881:6881 - 6881:6881/udp @@ -23,8 +24,6 @@ services: - private_data:/private_downloads networks: - caddy-media - security_opt: - - no-new-privileges:true volumes: qbittorrent_config: diff --git a/infrastructure/services/qbittorrent/env/qbittorrent.env b/infrastructure/services/qbittorrent/env/qbittorrent.env.example similarity index 56% rename from infrastructure/services/qbittorrent/env/qbittorrent.env rename to infrastructure/services/qbittorrent/env/qbittorrent.env.example index a9d1fe8..8a1cbaf 100644 --- a/infrastructure/services/qbittorrent/env/qbittorrent.env +++ b/infrastructure/services/qbittorrent/env/qbittorrent.env.example @@ -1,4 +1,4 @@ WEBUI_PORT=8080 TORRENTING_PORT=6881 # Use alternative WebUI: /vuetorrent -DOCKER_MODS=ghcr.io/vuetorrent/vuetorrent-lsio-mod:latest \ No newline at end of file +DOCKER_MODS=ghcr.io/vuetorrent/vuetorrent-lsio-mod:latest diff --git a/infrastructure/services/satisfactory-server/backup/docker-compose.backup.yml b/infrastructure/services/satisfactory-server/backup/docker-compose.backup.yml index 1b38aa7..882eb2c 100644 --- a/infrastructure/services/satisfactory-server/backup/docker-compose.backup.yml +++ b/infrastructure/services/satisfactory-server/backup/docker-compose.backup.yml @@ -1,6 +1,6 @@ services: satisfactory_backup: - image: mazzolino/restic:latest + image: mazzolino/restic:${RESTIC_DOCKER_TAG:-latest} container_name: satisfactory_backup profiles: - satisfactory_backup diff --git a/infrastructure/services/satisfactory-server/backup/env/satisfactory_backup.env b/infrastructure/services/satisfactory-server/backup/env/satisfactory_backup.env.example similarity index 89% rename from infrastructure/services/satisfactory-server/backup/env/satisfactory_backup.env rename to infrastructure/services/satisfactory-server/backup/env/satisfactory_backup.env.example index e94f3b6..563364b 100644 --- a/infrastructure/services/satisfactory-server/backup/env/satisfactory_backup.env +++ b/infrastructure/services/satisfactory-server/backup/env/satisfactory_backup.env.example @@ -1,7 +1,7 @@ #RUN_ON_STARTUP=true RESTIC_REPOSITORY=/mnt/restic RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=SCY5cmu12Odca302EXabPA9jXYkCb2NN +RESTIC_PASSWORD=__GENERATE_SATISFACTORY_RESTIC_PASSWORD__ # Backup (exuclusive with Check and Prune) BACKUP_CRON=*/15 * * * * RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose diff --git a/infrastructure/services/satisfactory-server/satisfactory/docker-compose.satisfactory.yml b/infrastructure/services/satisfactory-server/satisfactory/docker-compose.satisfactory.yml index 0000bbc..3739099 100644 --- a/infrastructure/services/satisfactory-server/satisfactory/docker-compose.satisfactory.yml +++ b/infrastructure/services/satisfactory-server/satisfactory/docker-compose.satisfactory.yml @@ -1,11 +1,13 @@ services: # Satisfactory server satisfactory_server: - image: wolveix/satisfactory-server:latest + extends: + file: ../../common.yml + service: service-base + image: wolveix/satisfactory-server:${SATISFACTORY_DOCKER_TAG:-latest} container_name: satisfactory_server profiles: - satisfactory_server - restart: on-failure:7 ports: - 7777:7777/udp - 7777:7777/tcp @@ -19,17 +21,12 @@ services: environment: - PUID=${PUID:-1000} - PGID=${PGID:-1000} - - TZ=${TZ:-Europe/Paris} - security_opt: - - no-new-privileges:true healthcheck: test: bash /healthcheck.sh interval: 30s timeout: 10s retries: 3 start_period: 120s - cap_drop: - - SYS_ADMIN volumes: satisfactory_server_config: diff --git a/infrastructure/services/satisfactory-server/satisfactory/env/satisfactory.env b/infrastructure/services/satisfactory-server/satisfactory/env/satisfactory.env.example similarity index 93% rename from infrastructure/services/satisfactory-server/satisfactory/env/satisfactory.env rename to infrastructure/services/satisfactory-server/satisfactory/env/satisfactory.env.example index 56a8f86..732d749 100644 --- a/infrastructure/services/satisfactory-server/satisfactory/env/satisfactory.env +++ b/infrastructure/services/satisfactory-server/satisfactory/env/satisfactory.env.example @@ -14,4 +14,4 @@ TIMEOUT=60 AUTOSAVEONDISCONNECT=true CRASHREPORT=true -NETWORKQUALITY=3 \ No newline at end of file +NETWORKQUALITY=3 diff --git a/infrastructure/services/searxng/config/searxng.env b/infrastructure/services/searxng/config/searxng.env.example similarity index 100% rename from infrastructure/services/searxng/config/searxng.env rename to infrastructure/services/searxng/config/searxng.env.example diff --git a/infrastructure/services/searxng/docker-compose.searxng.yml b/infrastructure/services/searxng/docker-compose.searxng.yml index b862527..239f29a 100644 --- a/infrastructure/services/searxng/docker-compose.searxng.yml +++ b/infrastructure/services/searxng/docker-compose.searxng.yml @@ -4,14 +4,14 @@ services: searxng: container_name: searxng image: docker.io/searxng/searxng:${SEARXNG_VERSION:-latest} - restart: on-failure:7 depends_on: - caddy profiles: - searxng + extends: + file: ../common.yml + service: service-base env_file: ./config/searxng.env - environment: - - TZ=${TZ:-Europe/Paris} networks: - caddy-tools - searxng-internal @@ -22,19 +22,19 @@ services: - 1.1.1.1 - 8.8.8.8 - valkey: + searxng-valkey: container_name: searxng-valkey profiles: - searxng - image: docker.io/valkey/valkey:9-alpine + image: docker.io/valkey/valkey:${SEARXNG_VALKEY_DOCKER_TAG:-9-alpine} + extends: + file: ../common.yml + service: service-base command: valkey-server --save 30 1 --loglevel warning - restart: on-failure:7 - environment: - - TZ=${TZ:-Europe/Paris} networks: - searxng-internal volumes: - - valkey-data:/data/ + - searxng-valkey-data:/data/ networks: caddy-tools: @@ -47,5 +47,5 @@ networks: volumes: searxng-data: {} searxng-config: {} - valkey-data: {} + searxng-valkey-data: {} diff --git a/infrastructure/services/stirlingpdf/docker-compose.stirlingpdf.yml b/infrastructure/services/stirlingpdf/docker-compose.stirlingpdf.yml index 030adb6..c81fb12 100644 --- a/infrastructure/services/stirlingpdf/docker-compose.stirlingpdf.yml +++ b/infrastructure/services/stirlingpdf/docker-compose.stirlingpdf.yml @@ -1,24 +1,22 @@ services: # stirlingpdf stirlingpdf: - image: frooodle/s-pdf:latest + image: frooodle/s-pdf:${STIRLINGPDF_DOCKER_TAG:-latest} container_name: stirlingpdf profiles: - stirlingpdf - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy env_file: - ./env/stirlingpdf.env - environment: - - TZ=${TZ:-Europe/Paris} volumes: - stirlingpdf_config:/configs - stirlingpdf_tessdata:/usr/share/tessdata networks: - caddy-tools - security_opt: - - no-new-privileges:true read_only: false volumes: diff --git a/infrastructure/services/stirlingpdf/env/stirlingpdf.env b/infrastructure/services/stirlingpdf/env/stirlingpdf.env.example similarity index 76% rename from infrastructure/services/stirlingpdf/env/stirlingpdf.env rename to infrastructure/services/stirlingpdf/env/stirlingpdf.env.example index 3af7bd9..2872b6e 100644 --- a/infrastructure/services/stirlingpdf/env/stirlingpdf.env +++ b/infrastructure/services/stirlingpdf/env/stirlingpdf.env.example @@ -6,4 +6,4 @@ LANGS=en_GB # Can be disabled after initial login, optional, # default it admin:stirling #SECURITY_INITIALLOGIN_USERNAME=admin -#SECURITY_INITIALLOGIN_PASSWORD=Jw9U039f5xc2mFcacvGvPD9RjwIh4DzO +#SECURITY_INITIALLOGIN_PASSWORD=__GENERATE_STIRLINGPDF_LOGIN_PASSWORD__ diff --git a/infrastructure/services/syncthing/docker-compose.syncthing.yml b/infrastructure/services/syncthing/docker-compose.syncthing.yml index f6d4a4d..f3f237d 100644 --- a/infrastructure/services/syncthing/docker-compose.syncthing.yml +++ b/infrastructure/services/syncthing/docker-compose.syncthing.yml @@ -1,27 +1,26 @@ services: # syncthing syncthing: - image: linuxserver/syncthing:latest + image: linuxserver/syncthing:${SYNCTHING_DOCKER_TAG:-latest} container_name: syncthing profiles: - syncthing depends_on: - caddy - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base env_file: - ./env/syncthing.env environment: - PUID=${PUID:-1000} - PGID=${PGID:-1000} - - TZ=${TZ:-Europe/Paris} volumes: - syncthing_config:/config - public_data:/data1 - private_data:/data2 networks: - caddy-media - security_opt: - - no-new-privileges:true volumes: syncthing_config: diff --git a/infrastructure/services/syncthing/env/syncthing.env b/infrastructure/services/syncthing/env/syncthing.env deleted file mode 100644 index e69de29..0000000 diff --git a/infrastructure/services/syncthing/env/syncthing.env.example b/infrastructure/services/syncthing/env/syncthing.env.example new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/infrastructure/services/syncthing/env/syncthing.env.example @@ -0,0 +1 @@ + diff --git a/infrastructure/services/teamfortress2-server/backup/docker-compose.backup.yml b/infrastructure/services/teamfortress2-server/backup/docker-compose.backup.yml index 7ce47b5..b1100c1 100644 --- a/infrastructure/services/teamfortress2-server/backup/docker-compose.backup.yml +++ b/infrastructure/services/teamfortress2-server/backup/docker-compose.backup.yml @@ -1,6 +1,6 @@ services: teamfortress2_backup: - image: mazzolino/restic:latest + image: mazzolino/restic:${RESTIC_DOCKER_TAG:-latest} container_name: teamfortress2_backup profiles: - teamfortress2_backup diff --git a/infrastructure/services/7daystodie-server/7daystodie/env/7daystodie_backup.env b/infrastructure/services/teamfortress2-server/backup/env/teamfortress2_backup.env.example similarity index 85% rename from infrastructure/services/7daystodie-server/7daystodie/env/7daystodie_backup.env rename to infrastructure/services/teamfortress2-server/backup/env/teamfortress2_backup.env.example index 4df6131..07c897e 100644 --- a/infrastructure/services/7daystodie-server/7daystodie/env/7daystodie_backup.env +++ b/infrastructure/services/teamfortress2-server/backup/env/teamfortress2_backup.env.example @@ -1,7 +1,7 @@ #RUN_ON_STARTUP=true RESTIC_REPOSITORY=/mnt/restic RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=SCY5cmu12Odca302EXabPA9jXYkCb2NN +RESTIC_PASSWORD=__GENERATE_TEAMFORTRESS2_RESTIC_PASSWORD__ # Backup (exuclusive with Check and Prune) BACKUP_CRON=*/15 * * * * RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose @@ -11,4 +11,4 @@ RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose #RESTIC_CHECK_ARGS=--read-data-subset=40% # Prune (exuclusive with Check and Prune) #PRUNE_CRON=*/15 * * * * -#RESTIC_PRUNE_ARGS= \ No newline at end of file +#RESTIC_PRUNE_ARGS= diff --git a/infrastructure/services/teamfortress2-server/teamfortress2/docker-compose.teamfortress2.yml b/infrastructure/services/teamfortress2-server/teamfortress2/docker-compose.teamfortress2.yml index b165b3d..5d2febd 100644 --- a/infrastructure/services/teamfortress2-server/teamfortress2/docker-compose.teamfortress2.yml +++ b/infrastructure/services/teamfortress2-server/teamfortress2/docker-compose.teamfortress2.yml @@ -1,11 +1,13 @@ services: # Team Fortress 2 server teamfortress2_server: - image: cm2network/tf2:sourcemod-x64 + extends: + file: ../../common.yml + service: service-base + image: cm2network/tf2:${TEAMFORTRESS2_DOCKER_TAG:-sourcemod-x64} container_name: teamfortress2_server profiles: - teamfortress2_server - restart: on-failure:7 ports: - "27015:27015/tcp" - "27015:27015/udp" @@ -15,16 +17,10 @@ services: - teamfortress2-network env_file: - ./env/teamfortress2.env - environment: - - TZ=${TZ:-Europe/Paris} +# environment: # - PUID=${PUID:-1000} # - PGID=${PGID:-1000} - security_opt: - - no-new-privileges:true - cap_drop: - - SYS_ADMIN - volumes: teamfortress2_data: name: teamfortress2_data diff --git a/infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env b/infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env deleted file mode 100644 index 57b0884..0000000 --- a/infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env +++ /dev/null @@ -1,10 +0,0 @@ -SRCDS_TOKEN=D3667770288B9CC33B0E526D441FA241 -SRCDS_PW=linuxmasterrace -SRCDS_PORT=27015 -SRCDS_MAXPLAYERS=32 -SRCDS_REGION=3 -SRCDS_STARTMAP=pl_goldrush -#SRCDS_MAPCYCLE="mapcycle_default.txt" -#pl_badwater -SRCDS_CFG=server.cfg -SRCDS_SECURED=0 diff --git a/infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env.example b/infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env.example new file mode 100644 index 0000000..40bafb1 --- /dev/null +++ b/infrastructure/services/teamfortress2-server/teamfortress2/env/teamfortress2.env.example @@ -0,0 +1,12 @@ +# Get a free Game Server Login Token from https://steamcommunity.com/dev/managegameservers +# This is NOT a value make init can generate for you, you must fill it in yourself. +SRCDS_TOKEN=CHANGEME_STEAM_GSLT_TOKEN +SRCDS_PW=__GENERATE_TEAMFORTRESS2_SERVER_PW__ +SRCDS_PORT=27015 +SRCDS_MAXPLAYERS=32 +SRCDS_REGION=3 +SRCDS_STARTMAP=pl_goldrush +#SRCDS_MAPCYCLE="mapcycle_default.txt" +#pl_badwater +SRCDS_CFG=server.cfg +SRCDS_SECURED=0 diff --git a/infrastructure/services/transmission/docker-compose.transmission.yml b/infrastructure/services/transmission/docker-compose.transmission.yml index 3fed8ec..ca1e353 100644 --- a/infrastructure/services/transmission/docker-compose.transmission.yml +++ b/infrastructure/services/transmission/docker-compose.transmission.yml @@ -1,11 +1,13 @@ services: # transmission transmission: - image: lscr.io/linuxserver/transmission:latest + image: lscr.io/linuxserver/transmission:${TRANSMISSION_DOCKER_TAG:-latest} container_name: transmission profiles: - transmission - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base depends_on: - caddy env_file: @@ -19,8 +21,6 @@ services: - transmission_watch:/watch networks: - caddy-media - security_opt: - - no-new-privileges:true volumes: transmission_config: diff --git a/infrastructure/services/transmission/env/transmission.env b/infrastructure/services/transmission/env/transmission.env deleted file mode 100644 index 547866d..0000000 --- a/infrastructure/services/transmission/env/transmission.env +++ /dev/null @@ -1,3 +0,0 @@ -TZ=Etc/UTC -USER=admin -PASS=4vqXCNGG09JUBe7rXkuQS8MG7ovE6Vxj \ No newline at end of file diff --git a/infrastructure/services/transmission/env/transmission.env.example b/infrastructure/services/transmission/env/transmission.env.example new file mode 100644 index 0000000..eb26cce --- /dev/null +++ b/infrastructure/services/transmission/env/transmission.env.example @@ -0,0 +1,3 @@ +TZ=Etc/UTC +USER=admin +PASS=__GENERATE_TRANSMISSION_PASSWORD__ diff --git a/infrastructure/services/uptime-kuma/docker-compose.uptime-kuma.yml b/infrastructure/services/uptime-kuma/docker-compose.uptime-kuma.yml index 797c00a..d96f1e2 100644 --- a/infrastructure/services/uptime-kuma/docker-compose.uptime-kuma.yml +++ b/infrastructure/services/uptime-kuma/docker-compose.uptime-kuma.yml @@ -1,23 +1,19 @@ services: # Uptime Kuma uptime-kuma: - image: louislam/uptime-kuma:2 + extends: + file: ../common.yml + service: service-base + image: louislam/uptime-kuma:${UPTIME_KUMA_DOCKER_TAG:-2} container_name: uptime-kuma profiles: - uptime-kuma volumes: - uptimekuma_data:/app/data - environment: - - TZ=${TZ:-Europe/Paris} - restart: on-failure:7 depends_on: - caddy networks: - caddy-infra - security_opt: - - no-new-privileges:true - cap_drop: - - SYS_ADMIN volumes: uptimekuma_data: diff --git a/infrastructure/services/wordpress/docker-compose.wordpress.yml b/infrastructure/services/wordpress/docker-compose.wordpress.yml index fad3d00..fd3cac0 100644 --- a/infrastructure/services/wordpress/docker-compose.wordpress.yml +++ b/infrastructure/services/wordpress/docker-compose.wordpress.yml @@ -1,7 +1,7 @@ services: # Wordpress wordpress: - image: wordpress:fpm + image: wordpress:${WORDPRESS_DOCKER_TAG:-fpm} container_name: wordpress profiles: - wordpress @@ -24,14 +24,16 @@ services: # Database wordpress wordpress_db: - image: mariadb:latest + image: mariadb:${WORDPRESS_DB_DOCKER_TAG:-latest} container_name: wordpress_db profiles: - database - wordpress depends_on: - caddy - restart: on-failure:7 + extends: + file: ../common.yml + service: service-base volumes: - wordpress_db:/var/lib/mysql:rw env_file: @@ -41,11 +43,9 @@ services: command: '--default-authentication-plugin=mysql_native_password' networks: - wordpress-internal - security_opt: - - no-new-privileges:true wordpress_backup: - image: mazzolino/restic:latest + image: mazzolino/restic:${RESTIC_DOCKER_TAG:-latest} container_name: wordpress_backup profiles: - wordpress diff --git a/infrastructure/services/wordpress/env/wordpress.env b/infrastructure/services/wordpress/env/wordpress.env deleted file mode 100644 index 4c0d95a..0000000 --- a/infrastructure/services/wordpress/env/wordpress.env +++ /dev/null @@ -1,4 +0,0 @@ -WORDPRESS_DB_USER=bensuperpc -WORDPRESS_DB_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw -WORDPRESS_DB_NAME=wordpress -WORDPRESS_DB_HOST=wordpress_db:3306 \ No newline at end of file diff --git a/infrastructure/services/wordpress/env/wordpress.env.example b/infrastructure/services/wordpress/env/wordpress.env.example new file mode 100644 index 0000000..ab13fda --- /dev/null +++ b/infrastructure/services/wordpress/env/wordpress.env.example @@ -0,0 +1,4 @@ +WORDPRESS_DB_USER=bensuperpc +WORDPRESS_DB_PASSWORD=__GENERATE_WORDPRESS_DB_PASSWORD__ +WORDPRESS_DB_NAME=wordpress +WORDPRESS_DB_HOST=wordpress_db:3306 diff --git a/infrastructure/services/wordpress/env/wordpress_backup.env b/infrastructure/services/wordpress/env/wordpress_backup.env.example similarity index 86% rename from infrastructure/services/wordpress/env/wordpress_backup.env rename to infrastructure/services/wordpress/env/wordpress_backup.env.example index 1a4cabb..38194e6 100644 --- a/infrastructure/services/wordpress/env/wordpress_backup.env +++ b/infrastructure/services/wordpress/env/wordpress_backup.env.example @@ -1,7 +1,7 @@ #RUN_ON_STARTUP=true RESTIC_REPOSITORY=/mnt/restic RESTIC_BACKUP_SOURCES=/data -RESTIC_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ +RESTIC_PASSWORD=__GENERATE_WORDPRESS_RESTIC_PASSWORD__ # Backup (exuclusive with Check and Prune) BACKUP_CRON=*/30 * * * * RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose @@ -11,4 +11,4 @@ RESTIC_FORGET_ARGS=--prune --keep-last 8 --keep-daily 7 --keep-weekly 5 --keep-m #RESTIC_CHECK_ARGS=--read-data-subset=40% # Prune (exuclusive with Check and Prune) #PRUNE_CRON=*/30 * * * * -#RESTIC_PRUNE_ARGS= \ No newline at end of file +#RESTIC_PRUNE_ARGS= diff --git a/infrastructure/services/wordpress/env/wordpress_db.env b/infrastructure/services/wordpress/env/wordpress_db.env deleted file mode 100644 index ddadb91..0000000 --- a/infrastructure/services/wordpress/env/wordpress_db.env +++ /dev/null @@ -1,4 +0,0 @@ -MARIADB_ROOT_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ -MARIADB_USER=bensuperpc -MARIADB_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw -MARIADB_DATABASE=wordpress diff --git a/infrastructure/services/wordpress/env/wordpress_db.env.example b/infrastructure/services/wordpress/env/wordpress_db.env.example new file mode 100644 index 0000000..55a1bf0 --- /dev/null +++ b/infrastructure/services/wordpress/env/wordpress_db.env.example @@ -0,0 +1,4 @@ +MARIADB_ROOT_PASSWORD=__GENERATE_WORDPRESS_DB_ROOT_PASSWORD__ +MARIADB_USER=bensuperpc +MARIADB_PASSWORD=__GENERATE_WORDPRESS_DB_PASSWORD__ +MARIADB_DATABASE=wordpress diff --git a/presets/tools.conf b/presets/tools.conf index 460dd37..925197e 100644 --- a/presets/tools.conf +++ b/presets/tools.conf @@ -1,2 +1,2 @@ DOCKER_PROFILES += main_infrastructure caddy homepage -DOCKER_PROFILES += it-tools omni-tools cyberchef bentopdf +DOCKER_PROFILES += it-tools omni-tools cyberchef bentopdf vscode-server diff --git a/tools/clean_secrets.sh b/tools/clean_secrets.sh new file mode 100755 index 0000000..f39c7fc --- /dev/null +++ b/tools/clean_secrets.sh @@ -0,0 +1,32 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +SERVICES_DIR="${ROOT_DIR}/infrastructure/services" + +FORCE=0 +if [[ "${1:-}" == "-y" || "${1:-}" == "--force" ]]; then + FORCE=1 +fi + +mapfile -d '' -t targets < <(find "${SERVICES_DIR}" -type f -name '*.env' -print0 | sort -z) + +if [[ "${#targets[@]}" -eq 0 ]]; then + echo "No .env file found, nothing to do." + exit 0 +fi + +echo "This will permanently delete ${#targets[@]} .env file(s) (secrets/passwords included):" +printf ' %s\n' "${targets[@]/#${ROOT_DIR}\//}" + +if [[ "${FORCE}" -ne 1 ]]; then + read -r -p "Continue? [y/N] " reply + if [[ ! "${reply}" =~ ^[Yy]$ ]]; then + echo "Aborted." + exit 1 + fi +fi + +rm -f -- "${targets[@]}" + +echo "Deleted ${#targets[@]} .env file(s). Run 'make init' to regenerate them." diff --git a/tools/init_secrets.sh b/tools/init_secrets.sh new file mode 100755 index 0000000..99da514 --- /dev/null +++ b/tools/init_secrets.sh @@ -0,0 +1,50 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +SERVICES_DIR="${ROOT_DIR}/infrastructure/services" + +random_value() { + openssl rand -base64 16 +} + +mapfile -d '' -t examples < <(find "${SERVICES_DIR}" -type f -name '*.env.example' -print0 | sort -z) + +created=0 +skipped=0 + +for example in "${examples[@]}"; do + target="${example%.example}" + if [[ -f "${target}" ]]; then + skipped=$((skipped + 1)) + continue + fi + cp "${example}" "${target}" + created=$((created + 1)) +done + +mapfile -d '' -t targets < <(find "${SERVICES_DIR}" -type f -name '*.env' -print0) + +declare -A generated +tokens="$(grep -hoE '__GENERATE_[A-Z0-9_]+__' "${targets[@]}" 2>/dev/null | sort -u || true)" + +for token in ${tokens}; do + if [[ -z "${generated[${token}]:-}" ]]; then + generated[${token}]="$(random_value)" + fi + value="${generated[${token}]}" + for f in "${targets[@]}"; do + if grep -qF -- "${token}" "${f}" 2>/dev/null; then + sed -i "s#${token}#${value}#g" "${f}" + fi + done +done + +echo "Created ${created} env file(s), left ${skipped} existing one(s) untouched." + +remaining="$(grep -rlF 'CHANGEME_' "${targets[@]}" 2>/dev/null || true)" +if [[ -n "${remaining}" ]]; then + echo + echo "These files still need a value you must fill in by hand:" + echo "${remaining}" +fi