Rework project structure

Signed-off-by: Bensuperpc <bensuperpc@gmail.com>
This commit is contained in:
2024-08-23 13:58:01 +02:00
parent bcec823b46
commit 927522a5a8
35 changed files with 39 additions and 33 deletions
+15
View File
@@ -0,0 +1,15 @@
{
email bensuperpc@gmail.com
key_type p384
log {
output file /data/logs/access.log
format json
}
}
import bensuperpc.org/*
import bensuperpc.com/*
import bensuperpc.net/*
import bensuperpc.ovh/*
import bensuperpc.fr/*
@@ -0,0 +1,7 @@
bensuperpc.com {
redir https://www.bensuperpc.org{uri} permanent
}
www.bensuperpc.com {
redir https://www.bensuperpc.org{uri} permanent
}
@@ -0,0 +1,7 @@
bensuperpc.fr {
redir https://www.bensuperpc.org{uri} permanent
}
www.bensuperpc.fr {
redir https://www.bensuperpc.org{uri} permanent
}
@@ -0,0 +1,19 @@
bensuperpc.net {
redir https://www.bensuperpc.org{uri} permanent
}
www.bensuperpc.net {
redir https://www.bensuperpc.org{uri} permanent
}
git.bensuperpc.net {
redir https://git.bensuperpc.org{uri} permanent
}
jellyfin.bensuperpc.net {
redir https://jellyfin.bensuperpc.org{uri} permanent
}
uptimekuma.bensuperpc.net {
redir https://uptimekuma.bensuperpc.org{uri} permanent
}
@@ -0,0 +1,114 @@
www.bensuperpc.org {
root * /var/www/html
php_fastcgi wordpress:9000
file_server
encode zstd gzip
# metrics /metrics
@disallowed {
path /xmlrpc.php
path *.sql
path /wp-content/uploads/*.php
}
rewrite @disallowed '/index.php'
respond /uploads/*.php 404
header {
# disable FLoC tracking
Permissions-Policy interest-cohort=()
# enable HSTS
Strict-Transport-Security max-age=31536000;
# disable clients from sniffing the media type
X-Content-Type-Options nosniff
# clickjacking protection
X-Frame-Options DENY
# Disable powerful features we don't need
Permissions-Policy "geolocation=(), camera=(), microphone=() interest-cohort=()"
}
}
bensuperpc.org {
redir https://www.bensuperpc.org{uri} permanent
}
adminer.bensuperpc.org {
reverse_proxy adminer:8080
}
uptimekuma.bensuperpc.org {
reverse_proxy uptime-kuma:3001
}
torrent.bensuperpc.org {
reverse_proxy qbittorrent:8080
}
qbittorrent.bensuperpc.org {
redir https://torrent.bensuperpc.org permanent
}
transmission.bensuperpc.org {
reverse_proxy transmission:9091
}
gitea.bensuperpc.org {
redir https://git.bensuperpc.org permanent
}
git.bensuperpc.org {
reverse_proxy gitea:3000
}
jellyfin.bensuperpc.org {
reverse_proxy jellyfin:8096
}
transfer.bensuperpc.org {
reverse_proxy psitransfer:3000
}
psitransfer.bensuperpc.org {
redir https://transfer.bensuperpc.org{uri} permanent
}
syncthing.bensuperpc.org {
reverse_proxy syncthing:8384 {
header_up Host {upstream_hostport}
}
}
link.bensuperpc.org {
# TODO: Use service with database
# Friendly links
redir /gnous https://gnous.eu permanent
redir /proxy https://imagisphe.re permanent
redir /patch https://spaceint.fr permanent
redir /greep https://greep.fr permanent
# Youtube links
redir /rickroll https://www.youtube.com/watch?v=dQw4w9WgXcQ permanent
redir /babyshark https://www.youtube.com/watch?v=XqZsoesa55w permanent
redir /cowcowcow https://www.youtube.com/watch?v=FavUpD_IjVY permanent
redir /badapple https://www.youtube.com/watch?v=FtutLA63Cp8 permanent
redir /macdo https://www.youtube.com/watch?v=Q16KpquGsIc permanent
redir /superiser https://www.youtube.com/watch?v=srnyVw-OR0g permanent
redir /daicon https://youtu.be/-840keiiFDE?si=zIPIokytxcnGw5fJ&t=162 permanent
redir /scp https://www.youtube.com/watch?v=FGCDndN20G8 permanent
redir /scpfb https://youtu.be/9zrKk-1E8zM?si=8R_ZBVG3GzMUYOe8&t=36 permanent
redir /mother https://youtu.be/w3NyycHR3fE?si=rNNSW9zYv0bcO2Eu permanent
redir /cpu https://www.youtube.com/watch?v=y39D4529FM4 permanent
redir /lechanteur https://youtu.be/HXdP15Ubu6M?si=N0qvhqo--3pmSGmb permanent
redir /bna https://youtu.be/3T3ofoKfEoY?si=_7HkGQXMC7rBng8O permanent
redir /jojo https://youtu.be/U0TXIXTzJEY?si=2acWJWX06ju2w4uj permanent
redir /patapon https://youtu.be/H6CbNHLHkmk?si=ZvU8SzrOK-oCUXT5 permanent
redir /darkwater https://youtu.be/Tr8ZgF4Dc0E?si=CEOmm2J6Jp5rdbbt permanent
redir /train https://youtu.be/l8mScKWj3kQ?si=BV07uJ9eP3kzV9Kl permanent
}
@@ -0,0 +1,7 @@
bensuperpc.ovh {
redir https://www.bensuperpc.org{uri} permanent
}
www.bensuperpc.ovh {
redir https://www.bensuperpc.org{uri} permanent
}
@@ -0,0 +1,42 @@
services:
# Caddy
caddy:
image: caddy:latest
container_name: caddy
profiles:
- caddy
restart: on-failure:5
ports:
- 80:80
- 443:443
volumes:
- wordpress:/var/www/html:rw
- caddy_data:/data:rw
- caddy_config:/config:rw
- ./caddy/config:/etc/caddy:ro
networks:
- infra-network
env_file:
- ./caddy/env/caddy.env
security_opt:
- no-new-privileges:true
#cap_drop:
# - ALL
cap_add:
- NET_ADMIN
healthcheck:
test: pidof caddy || exit 1
interval: 120s
timeout: 10s
retries: 3
volumes:
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
networks:
infra-network:
driver: bridge
name: infra-network
View File
@@ -0,0 +1,98 @@
# Example configuration file, it's safe to copy this as the default config file without any modification.
# You don't have to copy this file to your instance,
# just run `./act_runner generate-config > config.yaml` to generate a config file.
log:
# The level of logging, can be trace, debug, info, warn, error, fatal
level: info
runner:
# Where to store the registration result.
file: .runner
# Execute how many tasks concurrently at the same time.
capacity: 1
# Extra environment variables to run jobs.
envs:
A_TEST_ENV_NAME_1: a_test_env_value_1
A_TEST_ENV_NAME_2: a_test_env_value_2
# Extra environment variables to run jobs from a file.
# It will be ignored if it's empty or the file doesn't exist.
env_file: .env
# The timeout for a job to be finished.
# Please note that the Gitea instance also has a timeout (3h by default) for the job.
# So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
timeout: 3h
# Whether skip verifying the TLS certificate of the Gitea instance.
insecure: false
# The timeout for fetching the job from the Gitea instance.
fetch_timeout: 5s
# The interval for fetching the job from the Gitea instance.
fetch_interval: 2s
# The labels of a runner are used to determine which jobs the runner can run, and how to run them.
# Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
# Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
# If it's empty when registering, it will ask for inputting labels.
# If it's empty when execute `daemon`, will use labels in `.runner` file.
labels:
- "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
- "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
- "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
cache:
# Enable cache server to use actions/cache.
enabled: true
# The directory to store the cache data.
# If it's empty, the cache data will be stored in $HOME/.cache/actcache.
dir: ""
# The host of the cache server.
# It's not for the address to listen, but the address to connect from job containers.
# So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
host: ""
# The port of the cache server.
# 0 means to use a random available port.
port: 0
# The external cache server URL. Valid only when enable is true.
# If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
# The URL should generally end with "/".
external_server: ""
container:
# Specifies the network to which the container will connect.
# Could be host, bridge or the name of a custom network.
# If it's empty, act_runner will create a network automatically.
network: ""
# Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
privileged: false
# And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
options:
# The parent directory of a job's working directory.
# NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically.
# If the path starts with '/', the '/' will be trimmed.
# For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
# If it's empty, /workspace will be used.
workdir_parent:
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
# You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
# For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
# valid_volumes:
# - data
# - /src/*.json
# If you want to allow any volume, please use the following configuration:
# valid_volumes:
# - '**'
valid_volumes: []
# overrides the docker client host with the specified one.
# If it's empty, act_runner will find an available docker host automatically.
# If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
# If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
docker_host: ""
# Pull docker image(s) even if already present
force_pull: true
# Rebuild docker image(s) even if already present
force_rebuild: false
host:
# The parent directory of a job's working directory.
# If it's empty, $HOME/.cache/act/ will be used.
workdir_parent:
@@ -0,0 +1,72 @@
services:
# Gitea
gitea:
image: gitea/gitea:latest-rootless
container_name: gitea
profiles:
- gitea
restart: on-failure:5
depends_on:
- database_gitea
- caddy
ports:
- "22:22"
env_file:
- ./gitea/env/gitea.env
volumes:
- gitea_data:/var/lib/gitea
- gitea_config:/etc/gitea
# - /etc/timezone:/etc/timezone:ro
# - /etc/localtime:/etc/localtime:ro
networks:
- infra-network
security_opt:
- no-new-privileges:true
# Database gitea
database_gitea:
image: mariadb:latest
container_name: database_gitea
profiles:
- database
- gitea
restart: on-failure:5
volumes:
- gitea_db:/var/lib/mysql:rw
env_file:
- ./gitea/env/gitea_db.env
command: '--default-authentication-plugin=mysql_native_password'
networks:
- infra-network
security_opt:
- no-new-privileges:true
# Gitea-runner
gitea-runner:
image: gitea/act_runner:latest
container_name: gitea-runner
profiles:
- gitea-runner
depends_on:
- gitea
restart: on-failure:5
env_file:
- ./gitea/env/gitea-runner.env
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- gitea_runner:/data
- ./gitea/config/gitea_runner/config.yaml:/config.yaml:ro
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
gitea_data:
name: gitea_data
gitea_config:
name: gitea_config
gitea_db:
name: gitea_db
gitea_runner:
name: gitea_runner
+5
View File
@@ -0,0 +1,5 @@
GITEA_INSTANCE_URL=https://git.bensuperpc.org
GITEA_RUNNER_REGISTRATION_TOKEN=TBGzS0m823Xk732zRqjrbcSWFTEPajj5V5OFzXWP
GITEA_RUNNER_NAME=runner-1
#GITEA_RUNNER_LABELS=
CONFIG_FILE=/config.yaml
+15
View File
@@ -0,0 +1,15 @@
USER_UID=1000
USER_GID=1000
GITEA__database__DB_TYPE=mysql
GITEA__database__HOST=database_gitea:3306
GITEA__database__NAME=gitea
GITEA__database__USER=bensuperpc
GITEA__database__PASSWD=K7s5yoHknnEd7vsZoxb8I3dK9mjToF1j
GITEA__security__SECRET_KEY=ykcZt23an1E4lFHWvrCKdAyt16WAiK9c
#GITEA__security__INTERNAL_TOKEN=
GITEA__server__DOMAIN=git.bensuperpc.org
GITEA__server__SSH_DOMAIN=git.bensuperpc.org
GITEA__server__HTTP_PORT=3000
GITEA__server__SSH_LISTEN_PORT=22
GITEA__server__SSH_PORT=22
GITEA__server__ROOT_URL=https://git.bensuperpc.org
+4
View File
@@ -0,0 +1,4 @@
MYSQL_ROOT_PASSWORD=xpc4zIhHZzWKqVHcjBu4aW6aS7jG8d7X
MYSQL_USER=bensuperpc
MYSQL_PASSWORD=K7s5yoHknnEd7vsZoxb8I3dK9mjToF1j
MYSQL_DATABASE=gitea
@@ -0,0 +1,43 @@
services:
# Jellyfin
jellyfin:
image: jellyfin/jellyfin:latest
container_name: jellyfin
profiles:
- jellyfin
restart: on-failure:5
depends_on:
- caddy
env_file:
- ./jellyfin/env/jellyfin.env
volumes:
- jellyfin_config:/config
- jellyfin_data_movies:/movies:rw
- jellyfin_data_series:/series:rw
- jellyfin_data_documentaries:/documentaries:rw
- jellyfin_data_musics:/musics:rw
- jellyfin_data_personal:/personal:rw
- jellyfin_cache:/cache
# Hardware acceleration (For Intel and AMD GPUs)
devices:
- /dev/dri:/dev/dri
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
jellyfin_config:
name: jellyfin_config
jellyfin_data_movies:
name: jellyfin_data_movies
jellyfin_data_series:
name: jellyfin_data_series
jellyfin_data_documentaries:
name: jellyfin_data_documentaries
jellyfin_data_musics:
name: jellyfin_data_musics
jellyfin_data_personal:
name: jellyfin_data_personal
jellyfin_cache:
name: jellyfin_cache
View File
@@ -0,0 +1,30 @@
services:
# psitransfer
psitransfer:
image: psitrax/psitransfer:latest
container_name: psitransfer
profiles:
- psitransfer
restart: on-failure:5
depends_on:
- caddy
env_file:
- ./psitransfer/env/psitransfer.env
volumes:
- psitransfer_data:/data
networks:
- infra-network
security_opt:
- no-new-privileges:true
deploy:
resources:
limits:
cpus: '0.5'
memory: 512M
reservations:
cpus: '0.001'
memory: 20M
volumes:
psitransfer_data:
name: psitransfer_data
+2
View File
@@ -0,0 +1,2 @@
PSITRANSFER_ADMIN_PASS=n9jLVNT9QUotTJTT91JqH4GyBTg9pvEn
#PSITRANSFER_PORT=3000
@@ -0,0 +1,25 @@
services:
# qBittorrent
qbittorrent:
image: lscr.io/linuxserver/qbittorrent:latest
container_name: qbittorrent
profiles:
- qbittorrent
restart: on-failure:5
depends_on:
- caddy
env_file:
- ./qbittorrent/env/qbittorrent.env
volumes:
- qbittorrent_config:/config
- qbittorrent_data:/downloads
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
qbittorrent_config:
name: qbittorrent_config
qbittorrent_data:
name: qbittorrent_data
+5
View File
@@ -0,0 +1,5 @@
PUID=1000
PGID=1000
TZ=Etc/UTC
WEBUI_PORT=8080
TORRENTING_PORT=6881
@@ -0,0 +1,25 @@
services:
# syncthing
syncthing:
image: linuxserver/syncthing:latest
container_name: syncthing
profiles:
- syncthing
depends_on:
- caddy
restart: on-failure:5
env_file:
- ./syncthing/env/syncthing.env
volumes:
- syncthing_config:/config
- syncthing_data:/data1
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
syncthing_config:
name: syncthing_config
syncthing_data:
name: syncthing_data
+2
View File
@@ -0,0 +1,2 @@
PUID=1000
PGID=1000
@@ -0,0 +1,28 @@
services:
# transmission
transmission:
image: lscr.io/linuxserver/transmission:latest
container_name: transmission
profiles:
- transmission
restart: on-failure:5
depends_on:
- caddy
env_file:
- ./transmission/env/transmission.env
volumes:
- transmission_config:/config
- transmission_data:/downloads
- transmission_watch:/watch
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
transmission_config:
name: transmission_config
transmission_data:
name: transmission_data
transmission_watch:
name: transmission_watch
+5
View File
@@ -0,0 +1,5 @@
PUID=1000
PGID=1000
TZ=Etc/UTC
USER=admin
PASS=4vqXCNGG09JUBe7rXkuQS8MG7ovE6Vxj
@@ -0,0 +1,20 @@
services:
# Uptime Kuma
uptime-kuma:
image: louislam/uptime-kuma:latest
container_name: uptime-kuma
profiles:
- uptime-kuma
volumes:
- uptimekuma_data:/app/data
restart: on-failure:5
depends_on:
- caddy
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
uptimekuma_data:
name: uptimekuma_data
@@ -0,0 +1,16 @@
services:
# Watchtower
watchtower:
image: containrrr/watchtower
container_name: watchtower
profiles:
- watchtower
depends_on:
- caddy
restart: on-failure:5
networks:
- infra-network
volumes:
- /var/run/docker.sock:/var/run/docker.sock:rw
security_opt:
- no-new-privileges:true
@@ -0,0 +1,3 @@
memory_limit = 1024M
upload_max_filesize = 64M
post_max_size = 64M
@@ -0,0 +1,17 @@
services:
# Adminer
adminer:
image: adminer:latest
container_name: adminer
profiles:
- adminer
restart: on-failure:5
env_file:
- ./wordpress/env/adminer.env
depends_on:
- wordpress_db
- caddy
networks:
- infra-network
security_opt:
- no-new-privileges:true
@@ -0,0 +1,67 @@
services:
# Wordpress
wordpress:
image: wordpress:fpm
container_name: wordpress
profiles:
- wordpress
restart: on-failure:5
depends_on:
- wordpress_db
- caddy
env_file:
- ./wordpress/env/wordpress.env
volumes:
- ./wordpress/config/wordpress/php.ini:/usr/local/etc/php/conf.d/custom.ini:ro
- wordpress:/var/www/html:rw
networks:
- infra-network
security_opt:
- no-new-privileges:true
# Database wordpress
wordpress_db:
image: mariadb:latest
container_name: wordpress_db
profiles:
- database
- wordpress
depends_on:
- caddy
restart: on-failure:5
volumes:
- wordpress_db:/var/lib/mysql:rw
env_file:
- ./wordpress/env/wordpress_db.env
command: '--default-authentication-plugin=mysql_native_password'
networks:
- infra-network
security_opt:
- no-new-privileges:true
wordpress_backup:
image: mazzolino/restic:latest
container_name: wordpress_backup
profiles:
- wordpress
depends_on:
- wordpress
restart: on-failure:5
env_file:
- ./wordpress/env/backup.env
volumes:
- wordpress_backup:/mnt/restic
- wordpress_db:/data/wordpress_db:ro
- wordpress:/data/wordpress:ro
networks:
- infra-network
security_opt:
- no-new-privileges:true
volumes:
wordpress_db:
name: wordpress_db
wordpress:
name: wordpress
wordpress_backup:
name: wordpress_backup
+4
View File
@@ -0,0 +1,4 @@
MYSQL_ROOT_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ
MYSQL_USER=bensuperpc
MYSQL_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw
ADMINER_DEFAULT_SERVER=wordpress_db
+9
View File
@@ -0,0 +1,9 @@
#RUN_ON_STARTUP=true
BACKUP_CRON=*/30 * * * *
RESTIC_REPOSITORY=/mnt/restic
RESTIC_BACKUP_SOURCES=/data
RESTIC_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ
RESTIC_BACKUP_ARGS=--tag docker-volumes --verbose
RESTIC_FORGET_ARGS=--prune --keep-last 8 --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 4
#RESTIC_PRUNE_ARGS=
RESTIC_CHECK_ARGS=--read-data-subset=20%
+4
View File
@@ -0,0 +1,4 @@
WORDPRESS_DB_USER=bensuperpc
WORDPRESS_DB_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw
WORDPRESS_DB_NAME=wordpress
WORDPRESS_DB_HOST=wordpress_db:3306
+4
View File
@@ -0,0 +1,4 @@
MARIADB_ROOT_PASSWORD=7L1Ncbquax0B2TCOmrjaQl9n5mnY88bQ
MARIADB_USER=bensuperpc
MARIADB_PASSWORD=lEOEf8cndnDjp84O4Uv5D9zJLJDFatLw
MARIADB_DATABASE=wordpress