template for lampa service

feat: headplane (ui for headscale)
fix: bad request
2026-01-21 11:36:36 +01:00 · 2026-01-21 10:09:31 +01:00 · 2026-01-20 15:11:06 +01:00 · 2026-01-20 00:17:42 +01:00 · 2026-01-20 00:08:18 +01:00 · 2026-01-20 00:05:10 +01:00
21 changed files with 397 additions and 231 deletions
@@ -14,43 +14,37 @@ services:
      - ./data/work:/opt/adguardhome/work
      - ./data/conf:/opt/adguardhome/conf
      - ./certs:/certs:ro
-    networks:
-      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
-
+      
      # Prod Router
      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
      - "traefik.http.routers.adguard.middlewares=security-headers@file"
-      - "traefik.http.routers.adguard.service=adguard"
      - "traefik.http.routers.adguard.tls=true"
-
      # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
      - "traefik.http.routers.adguard-local.entrypoints=websecure"
      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
-      - "traefik.http.routers.adguard-local.service=adguard"
      - "traefik.http.routers.adguard-local.tls=true"
-
      # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) Host(`dns.gigaforust.internal`)"
      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.adguard-dev.service=adguard"
      - "traefik.http.routers.adguard-dev.tls=true"
-
-      # DoH
+      # DoH Router
      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
      - "traefik.http.routers.dns.entrypoints=websecure"
-      - "traefik.http.routers.dns.service=adguard"
      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
-
+      
+      # Glance Metadata
      - glance.name=adguard
      - glance.url=https://adguard.forust.xyz/
      - glance.description=AdGuard Home is a network-wide software for blocking ads.
+    networks:
+      - proxy
 networks:
  proxy:
    external: true
@@ -37,12 +37,12 @@ services:
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
-      # Services
-      # - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"

      # Prod Router
@@ -51,23 +51,18 @@ services:
      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
      - "traefik.http.routers.authentik-server.service=authentik-server"
      - "traefik.http.routers.authentik-server.tls=true"
-
      # Local Router
      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
      - "traefik.http.routers.authentik-server-local.service=authentik-server"
      - "traefik.http.routers.authentik-server-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
      - "traefik.http.routers.authentik-server-dev.tls=true"
-    volumes:
-      - ./media:/media
-      - ./custom-templates:/templates
    networks:
      - proxy
      - authentik
@@ -2,6 +2,7 @@ services:
  cloudflare-ddns:
    image: timothyjmiller/cloudflare-ddns:latest
    container_name: cloudflare-ddns
+    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    network_mode: 'host'
@@ -10,4 +11,3 @@ services:
      - PGID=1000
    volumes:
      - ./config.json:/config.json
-    restart: unless-stopped
@@ -2,18 +2,17 @@ services:
  checkmk:
    image: "checkmk/check-mk-raw:2.4.0-latest"
    container_name: "checkmk"
-    environment:
-      - CMK_PASSWORD=${CMK_PASSWORD:-password}
-      - CMK_SITE_ID=cmk
-
+    restart: unless-stopped
+    # ports:
+    #   - 5000:5000
+    #   - 6776:8000
    volumes:
      - sites:/omd/sites
    tmpfs:
      - /opt/omd/sites/cmk/tmp:uid=1000,gid=1000
-    ports:
-      - 5000:5000
-      - 6776:8000
-    restart: unless-stopped
+    environment:
+      - CMK_PASSWORD=${CMK_PASSWORD:-password}
+      - CMK_SITE_ID=cmk
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
@@ -22,27 +21,20 @@ services:
      # Prod Router
      - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
      - "traefik.http.routers.checkmk.entrypoints=websecure"
-      - "traefik.http.routers.checkmk.service=checkmk"
      - "traefik.http.routers.checkmk.middlewares=security-headers@file"
      - "traefik.http.routers.checkmk.tls=true"
-
      # Local Router
-      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`) || Host(`cmk.internal`)"
+      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
      - "traefik.http.routers.checkmk-local.entrypoints=websecure"
-      - "traefik.http.routers.checkmk-local.service=checkmk"
      - "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
      - "traefik.http.routers.checkmk-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
      - "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.checkmk-dev.service=checkmk"
      - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
      - "traefik.http.routers.checkmk-dev.tls=true"
-
    networks:
      - proxy
-
 networks:
  proxy:
    external: true
@@ -3,23 +3,22 @@ services:
      image: darthnorse/dockmon:latest
      container_name: dockmon
      restart: unless-stopped
-      ports:
-         - 8000:443
-      environment:
-         - TZ=Europe/Bratislava
+      # ports:
+      #    - 8000:443
      volumes:
-         - ./data:/app/data
+         - data:/app/data
         - /var/run/docker.sock:/var/run/docker.sock
      healthcheck:
         test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
         interval: 30s
         timeout: 10s
         retries: 3
-      networks:
-         - proxy
      labels:
         - "traefik.enable=true"
         - "traefik.docker.network=proxy"
+         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"

         # Prod Router
         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
@@ -27,28 +26,25 @@ services:
         - "traefik.http.routers.dockmon.middlewares=security-chain@file"
         - "traefik.http.routers.dockmon.service=dockmon"
         - "traefik.http.routers.dockmon.tls=true"
-         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
-         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
-         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
-
         # Local Router
-         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`) || Host(`dockmon.internal`)"
+         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
         - "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
-         - "traefik.http.routers.dockmon-local.service=dockmon"
         - "traefik.http.routers.dockmon-local.tls=true"
-
         # Dev Router
         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
-         - "traefik.http.routers.dockmon-dev.service=dockmon"
         - "traefik.http.routers.dockmon-dev.tls=true"

+         # Glance Metadata
         - glance.name=dockmon
         - glance.url=https://dockmon.forust.xyz/
         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
-
+      networks:
+         - proxy
+volumes:
+   data:
 networks:
   proxy:
      external: true
@@ -4,36 +4,30 @@ services:
    image: ghcr.io/henriquesebastiao/downtify:latest
    # ports:
    #   - '7077:8000'
+    volumes:
+      - ./Downtify_downloads:/downloads
    labels:
      - traefik.enable=true
+      - traefik.docker.network=proxy
      - traefik.http.services.downtify.loadbalancer.server.port=8000

      # Prod Router 
      - traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
      - traefik.http.routers.downtify.entrypoints=websecure
      - traefik.http.routers.downtify.middlewares=security-chain@file
-      - traefik.http.routers.downtify.service=downtify
      - traefik.http.routers.downtify.tls=true
-
      # Local Router
      - traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
      - traefik.http.routers.downtify-local.entrypoints=websecure
      - traefik.http.routers.downtify-local.middlewares=security-headers@file
-      - traefik.http.routers.downtify-local.service=downtify
      - traefik.http.routers.downtify-local.tls=true
-
      # Dev Router
      - traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
      - traefik.http.routers.downtify-dev.entrypoints=websecure
      - traefik.http.routers.downtify-dev.middlewares=security-chain@file
-      - traefik.http.routers.downtify-dev.service=downtify
      - traefik.http.routers.downtify-dev.tls=true
    networks:
      - proxy
-
-    volumes:
-      - ./Downtify_downloads:/downloads
-
 networks:
  proxy:
    external: true
@@ -15,6 +15,11 @@ logging.basicConfig(
 )
 logger = logging.getLogger(__name__)

+# Suppress HTTP request logs
+logging.getLogger('urllib3').setLevel(logging.WARNING)
+logging.getLogger('httpx').setLevel(logging.WARNING)
+logging.getLogger('telegram.ext._application').setLevel(logging.WARNING)
+
 # Load environment variables
 def _env(key, default=None):
    v = os.getenv(key, default)
@@ -39,7 +44,7 @@ KEY_WHITELIST = "bot:whitelist"
 KEY_WHITELIST_ENABLED = "bot:whitelist_enabled"
 KEY_SUBSCRIBERS = "bot:subscribers"
 KEY_PHPSESSID = "EDU_PHPSESSID"
-KEY_WEBINAR_HISTORY = "bot:webinar_history"  # Stores last 5 webinars
+KEY_WEBINAR_HISTORY = "bot:webinar_history"  # Stores last 3 webinars

 # Initialize Redis
 try:
@@ -89,6 +94,8 @@ TRANSLATIONS = {
        'flag_ru': "🇷🇺 Русский",
        'flag_uk': "🇺🇦 Українська",
        'flag_en': "🇬🇧 English",
+        'history_cleared': "✅ История вебинаров очищена",
+        'history_clear_failed': "❌ Ошибка при очистке истории",
    },
    'uk': {
        'welcome': "👋 Привіт, {name}!\n\nЯ бот-сповіщувач про вебінари. Я повідомлятиму вас, коли з'явиться новий вебінар.\nВи підписані на сповіщення.",
@@ -126,6 +133,8 @@ TRANSLATIONS = {
        'flag_ru': "🇷🇺 Русский",
        'flag_uk': "🇺🇦 Українська",
        'flag_en': "🇬🇧 English",
+        'history_cleared': "✅ Історія вебінарів очищена",
+        'history_clear_failed': "❌ Помилка при очищенні історії",
    },
    'en': {
        'welcome': "👋 Hello, {name}!\n\nI am the Webinar Checker Bot. I will notify you when a new webinar appears.\nYou have been subscribed to notifications.",
@@ -163,6 +172,8 @@ TRANSLATIONS = {
        'flag_ru': "🇷🇺 Русский",
        'flag_uk': "🇺🇦 Українська",
        'flag_en': "🇬🇧 English",
+        'history_cleared': "✅ Webinar history cleared",
+        'history_clear_failed': "❌ Error clearing history",
    }
 }

@@ -350,6 +361,21 @@ async def remove_user(update: Update, context: ContextTypes.DEFAULT_TYPE):
    except ValueError:
        await update.message.reply_text(t(admin_id, 'invalid_user_id'))

+async def clear_history(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Clear webinar history (admin only)."""
+    admin_id = update.effective_user.id
+    if admin_id != ADMIN_ID:
+        await update.message.reply_text(t(admin_id, 'admin_only'))
+        return
+    
+    try:
+        redis_client.delete(KEY_WEBINAR_HISTORY)
+        await update.message.reply_text(t(admin_id, 'history_cleared'))
+        logger.info("Admin cleared webinar history")
+    except Exception as e:
+        logger.error(f"Failed to clear history: {e}")
+        await update.message.reply_text(t(admin_id, 'history_clear_failed'))
+
 # --- Admin Callbacks ---

 async def admin_callback(update: Update, context: ContextTypes.DEFAULT_TYPE):
@@ -410,9 +436,9 @@ async def language_callback(update: Update, context: ContextTypes.DEFAULT_TYPE):

 # --- Webinar Checking Job ---

-def get_webinar_key(name: str, url: str) -> str:
-    """Generate unique key for a webinar based on name and URL."""
-    return f"{name}|{url}"
+def get_webinar_key(url: str) -> str:
+    """Generate unique key for a webinar based on URL."""
+    return url

 def get_stored_webinars() -> list:
    """Get list of stored webinar keys from Redis."""
@@ -425,9 +451,9 @@ def get_stored_webinars() -> list:
    return []

 def store_webinars(webinar_keys: list):
-    """Store up to 5 most recent webinar keys in Redis."""
-    # Keep only last 5
-    webinar_keys = webinar_keys[-5:]
+    """Store up to 3 most recent webinar keys in Redis."""
+    # Keep only last 3
+    webinar_keys = webinar_keys[-3:]
    try:
        redis_client.set(KEY_WEBINAR_HISTORY, json.dumps(webinar_keys))
        logger.info(f"Stored {len(webinar_keys)} webinar(s) in history")
@@ -562,7 +588,7 @@ async def check_webinars_job(context: ContextTypes.DEFAULT_TYPE):
        current_keys = []
        
        for webinar in current_webinars:
-            key = get_webinar_key(webinar['name'], webinar['url'])
+            key = get_webinar_key(webinar['url'])
            current_keys.append(key)
            
            if key not in stored_keys:
@@ -622,6 +648,7 @@ def main():
    app.add_handler(CommandHandler("language", language_command))
    app.add_handler(CommandHandler("adduser", add_user))
    app.add_handler(CommandHandler("removeuser", remove_user))
+    app.add_handler(CommandHandler("clearhistory", clear_history))
    
    # Callback handlers - language selection first, then admin panel
    app.add_handler(CallbackQueryHandler(language_callback, pattern="^lang_"))
@@ -2,6 +2,7 @@ services:
  server:
    image: docker.gitea.com/gitea:1.25.1
    container_name: gitea
+    restart: always
    environment:
      - USER_UID=1000
      - USER_GID=1000
@@ -24,10 +25,6 @@ services:
      - GITEA__mailer__PROTOCOL=SMTP
      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
      - GITEA__service__ENABLE_NOTIFY_MAIL=true
-    restart: always
-    networks:
-      - gitea-db
-      - proxy
    volumes:
      - ./gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
@@ -35,36 +32,34 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"

      # Prod Router
      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.middlewares=security-headers@file"
-      - "traefik.http.routers.gitea.service=gitea"
      - "traefik.http.routers.gitea.tls=true"
-      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-
      # Local Router
-      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`) || Host(`gitea.internal`)"
+      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`)"
      - "traefik.http.routers.gitea-local.entrypoints=websecure"
      - "traefik.http.routers.gitea-local.middlewares=security-headers@file"
-      - "traefik.http.routers.gitea-local.service=gitea"
      - "traefik.http.routers.gitea-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)"
      - "traefik.http.routers.gitea-dev.entrypoints=websecure"
      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.gitea-dev.service=gitea"
      - "traefik.http.routers.gitea-dev.tls=true"
+      # SSH Router
+      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
      - "traefik.tcp.routers.gitea.entrypoints=ssh"
      - "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
-      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
    ports:
      - "2221:22"
+    networks:
+      - gitea-db
+      - proxy
    depends_on:
      - db
-
  db:
    image: docker.io/library/postgres:14
    restart: always
@@ -72,11 +67,10 @@ services:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=gitea
      - POSTGRES_DB=gitea
-    networks:
-      - gitea-db
    volumes:
      - ./gitea-db/:/var/lib/postgresql/data
-
+    networks:
+      - gitea-db
 networks:
  gitea-db:
    external: false
@@ -12,19 +12,18 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      # FIXME: traefik.services.glance.loadbalancer.server.port ??

      # Prod Router
      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
      - "traefik.http.routers.glance.entrypoints=websecure"
      - "traefik.http.routers.glance.middlewares=security-headers@file"
      - "traefik.http.routers.glance.tls=true"
-
      # Local Router
-      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`) || Host(`glance.internal`)"
+      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`)"
      - "traefik.http.routers.glance-local.entrypoints=websecure"
      - "traefik.http.routers.glance-local.middlewares=security-headers@file"
      - "traefik.http.routers.glance-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
      - "traefik.http.routers.glance-dev.entrypoints=websecure"
@@ -32,9 +31,6 @@ services:
      - "traefik.http.routers.glance-dev.tls=true"
    networks:
      - proxy
-    dns:
-      - 1.1.1.1
-      - 8.8.8.8
 networks:
  proxy:
    external: true
@@ -1,14 +1,16 @@
 services:
-  server:
+  headscale:
    image: headscale/headscale:latest
    restart: unless-stopped
+    container_name: headscale-server
    command: serve
    networks:
      - proxy
    volumes:
-      - ./config:/etc/headscale
-      - ./data:/var/lib/headscale
+      - ./config/headscale.yaml:/etc/headscale/config.yaml
+      - data:/var/lib/headscale
    labels:
+      - "me.tale.headplane.target: headscale"
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
@@ -47,38 +49,29 @@ services:
      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics-dev.tls=true"
-    dns:
-        - 1.1.1.1
-        - 1.0.0.1
-  web:
-    image: goodieshq/headscale-admin:latest
+  headplane:
+    image: ghcr.io/tale/headplane:latest
+    container_name: headplane
    restart: unless-stopped
+    ports:
+      - '3000:3000'
+    volumes:
+      - ./config/headplane.yaml:/etc/headplane/config.yaml
+      - ./config/headscale.yaml:/etc/headscale/config.yaml
+      - headplane-data:/var/lib/headplane
+      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "treafik.docker.network=proxy"
-      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
-
-      # Prod Router
-      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
-      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
-      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
-      - "traefik.http.routers.headscale-ui.service=headscale-ui"
-      - "traefik.http.routers.headscale-ui.tls=true"
-      # Local Router
-      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
-      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
-      - "traefik.http.routers.headscale-ui-local.middlewares=security-chain@file"
-      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
-      - "traefik.http.routers.headscale-ui-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
-      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
-      - "traefik.http.routers.headscale-ui-dev.middlewares=security-chain@file"
-      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
-      - "traefik.http.routers.headscale-ui-dev.tls=true"
-
+    healthcheck:
+      test: [ "CMD", "/bin/hp_healthcheck" ]
+      interval: 30s
+      timeout: 5s
+      start_period: 5s
+      retries: 3
+volumes:
+  data:
+  headplane-data:
+    name: headplane_data
 networks:
  proxy:
    external: true
@@ -0,0 +1,221 @@
+# Configuration for the Headplane server and web application
+server:
+  # These are the default values, change them as needed
+  host: "0.0.0.0"
+  port: 3000
+  # Should not include the dashboard prefix (/admin) portion.
+  # # Prod server_url
+  # base_url: https://hs.forust.xyz
+  # # Local base_url
+  # base_url: https://hs.workstation.internal
+  # # Dev base_url
+  # base_url: https://hs.gigaforust.internal
+
+  # You may provide `cookie_secret_path` instead to read a value from disk.
+  # See https://headplane.net/configuration/#sensitive-values
+  cookie_secret: "<change_me_to_something_secure!>"
+
+  # Whether cookies should be marked as Secure
+  # * Should be false if running without HTTPs
+  # * Should be true if running behind a reverse proxy with HTTPs
+  cookie_secure: true
+  # The maximum age of the session cookie in seconds
+  cookie_max_age: 86400 # 1 day in seconds
+
+  # This is not required, but if you want to restrict the cookie
+  # to a specific domain, set it here. Otherwise leave it commented out.
+  # This may not work as expected if not using a reverse proxy.
+  # cookie_domain: ""
+
+  # The path to persist Headplane specific data. All data going forward
+  # is stored in this directory, including the internal database and
+  # any cache related files.
+  data_path: "/var/lib/headplane"
+
+  # The info secret is optional and allows access to certain debug endpoints
+  # that may expose sensitive information about your Headplane instance.
+  #
+  # As of now, this protects the /api/info endpoint which exposes details about
+  # the Headplane and Headscale versions in use. In the future, more endpoints
+  # may be protected by this secret.
+  #
+  # If not set, these endpoints will be disabled.
+  # info_secret: "<change_me_to_something_secure!>"
+
+# Headscale specific settings to allow Headplane to talk
+# to Headscale and access deep integration features
+headscale:
+  # The URL to your Headscale instance
+  # (All API requests are routed through this URL)
+  # (THIS IS NOT the gRPC endpoint, but the HTTP endpoint)
+  #
+  # IMPORTANT: If you are using TLS this MUST be set to `https://`
+  url: "http://headscale-server:8080"
+
+  # If you use the TLS configuration in Headscale, and you are not using
+  # Let's Encrypt for your certificate, pass in the path to the certificate.
+  # (This has no effect if `url` does not start with `https://`)
+  # tls_cert_path: "/var/lib/headplane/tls.crt"
+
+  # Optional, public URL if its different from the `headscale.url`
+  # This affects certain parts of the web UI which shows Headscale's URL
+  public_url: "https://headscale.example.com"
+
+  # Path to the Headscale configuration file
+  # This is optional, but HIGHLY recommended for the best experience
+  # If this is read only, Headplane will show your configuration settings
+  # in the Web UI, but they cannot be changed.
+  config_path: "/etc/headscale/config.yaml"
+
+  # Whether the Headscale configuration should be strictly validated
+  # when reading from `config_path`. If true, Headplane will not interact
+  # with Headscale if there are any issues with the configuration file.
+  #
+  # This is recommended to be true for production deployments to, however it
+  # may not work if you are using a version of Headscale that has configuration
+  # options unknown to Headplane.
+  config_strict: true
+
+  # If you are using `dns.extra_records_path` in your Headscale
+  # configuration, you need to set this to the path for Headplane
+  # to be able to read the DNS records.
+  #
+  # Pass it in if using Docker and ensure that the file is both
+  # readable and writable to the Headplane process.
+  # When using this, Headplane will no longer need to automatically
+  # restart Headscale for DNS record changes.
+  # dns_records_path: "/var/lib/headscale/extra_records.json"
+
+# Integration configurations for Headplane to interact with Headscale
+integration:
+  # The Headplane agent allows retrieving information about nodes
+  # This allows the UI to display version, OS, and connectivity data
+  # You will see the Headplane agent in your Tailnet as a node when
+  # it connects.
+  agent:
+    enabled: false
+
+    # To connect to your Tailnet, you need to generate a pre-auth key
+    # This can be done via the web UI or through the `headscale` CLI.
+    pre_authkey: "<your-preauth-key>"
+
+    # Optionally change the name of the agent in the Tailnet.
+    # host_name: "headplane-agent"
+
+    # Configure different caching settings. By default, the agent will store
+    # caches in the path below for a maximum of 1 minute. If you want data
+    # to update faster, reduce the TTL, but this will increase the frequency
+    # of requests to Headscale.
+    # cache_ttl: 60
+    # cache_path: /var/lib/headplane/agent_cache.json
+
+    # The work_dir represents where the agent will store its data to be able
+    # to automatically reauthenticate with your Tailnet. It needs to be
+    # writable by the user running the Headplane process.
+    #
+    # If using Docker, it is best to leave this as the default.
+    # work_dir: "/var/lib/headplane/agent"
+
+  # Only one of these should be enabled at a time or you will get errors
+  # This does not include the agent integration (above), which can be enabled
+  # at the same time as any of these and is recommended for the best experience.
+  docker:
+    enabled: true
+
+    # By default we check for the presence of a container label (see the docs)
+    # to determine the container to signal when changes are made to DNS settings.
+    container_label: "me.tale.headplane.target=headscale"
+
+    # HOWEVER, you can fallback to a container name if you desire, but this is
+    # not recommended as its brittle and doesn't work with orchestrators that
+    # automatically assign container names.
+    #
+    # If `container_name` is set, it will override any label checks.
+    # container_name: "headscale-server"
+
+    # The path to the Docker socket (do not change this if you are unsure)
+    # Docker socket paths must start with unix:// or tcp:// and at the moment
+    # https connections are not supported.
+    socket: "unix:///var/run/docker.sock"
+
+  # Please refer to docs/integration/Kubernetes.md for more information
+  # on how to configure the Kubernetes integration. There are requirements in
+  # order to allow Headscale to be controlled by Headplane in a cluster.
+  kubernetes:
+    enabled: false
+    # Validates the manifest for the Pod to ensure all of the criteria
+    # are set correctly. Turn this off if you are having issues with
+    # shareProcessNamespace not being validated correctly.
+    validate_manifest: true
+    # This should be the name of the Pod running Headscale and Headplane.
+    # If this isn't static you should be using the Kubernetes Downward API
+    # to set this value (refer to docs/Integrated-Mode.md for more info).
+    pod_name: "headscale"
+
+  # Proc is the "Native" integration that only works when Headscale and
+  # Headplane are running outside of a container. There is no configuration,
+  # but you need to ensure that the Headplane process can terminate the
+  # Headscale process.
+  #
+  # (If they are both running under systemd as sudo, this will work).
+  proc:
+    enabled: false
+
+# OIDC Configuration for simpler authentication
+# (This is optional, but recommended for the best experience)
+# oidc:
+# The OIDC issuer URL
+# issuer: "https://accounts.google.com"
+
+# If you are using OIDC, you need to generate an API key
+# that can be used to authenticate other sessions when signing in.
+#
+# This can be done with `headscale apikeys create --expiration 999d`
+# headscale_api_key: "<your-headscale-api-key>"
+
+# If your OIDC provider does not support discovery (does not have the URL at
+# `/.well-known/openid-configuration`), you need to manually set endpoints.
+# This also works to override endpoints if you so desire or if your OIDC
+# discovery is missing certain endpoints (ie GitHub).
+# For some typical providers, see https://headplane.net/features/sso.
+# authorization_endpoint: ""
+# token_endpoint: ""
+# userinfo_endpoint: ""
+
+# The authentication method to use when communicating with the token endpoint.
+# This is fully optional and Headplane will attempt to auto-detect the best
+# method and fall back to `client_secret_basic` if unsure.
+# token_endpoint_auth_method: "client_secret_post"
+
+# The client ID for the OIDC client
+# For the best experience please ensure this is *identical* to the client_id
+# you are using for Headscale. because
+# client_id: "your-client-id"
+
+# The client secret for the OIDC client
+# You may also provide `client_secret_path` instead to read a value from disk.
+# See https://headplane.net/configuration/#sensitive-values
+# client_secret: "<your-client-secret>"
+
+# Whether to use PKCE when authenticating users. This is recommended as it
+# adds an extra layer of security to the authentication process. Enabling this
+# means your OIDC provider must support PKCE and it must be enabled on the
+# client.
+# use_pkce: true
+
+# If you want to disable traditional login via Headscale API keys
+# disable_api_key_login: false
+
+# By default profile pictures are pulled from the OIDC provider when
+# we go to fetch the userinfo endpoint. Optionally, this can be set to
+# "oidc" or "gravatar" as of 0.6.1.
+# profile_picture_source: "gravatar"
+
+# The scopes to request when authenticating users. The default is below.
+# scope: "openid email profile"
+
+# Extra query parameters can be passed to the authorization endpoint
+# by setting them here. This is useful for providers that require any kind
+# of custom hinting.
+# extra_params:
+#   prompt: "select_account" # Example: force account selection on Google
@@ -13,70 +13,54 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
-
-      # Services
      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"

      # Prod Router
      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage.service=forust-homepage"
      - "traefik.http.routers.forust-homepage.tls=true"
-
      # Local Router
-      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`)"
      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
      - "traefik.http.routers.forust-homepage-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
      - "traefik.http.routers.forust-homepage-dev.tls=true"
-
  xdfnx:
    build:
      context: .
      dockerfile: Dockerfile.xdfnx
+    restart: unless-stopped
    # ports:
    #   - "8086:80"
-    restart: unless-stopped
    volumes:
      - ./xdfnx_files:/usr/share/nginx/html
-    networks:
-      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
-      
-      # Services
      - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"

      # Prod Router
      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`)"
      - "traefik.http.routers.xdfnx.entrypoints=websecure"
      - "traefik.http.routers.xdfnx.middlewares=security-headers@file"
-      - "traefik.http.routers.xdfnx.service=xdfnx-homepage"
      - "traefik.http.routers.xdfnx.tls=true"
-
      # Local Router
-      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`) || Host(`xdfnx.internal`)"
+      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`)"
      - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
      - "traefik.http.routers.xdfnx-local.middlewares=security-headers@file"
-      - "traefik.http.routers.xdfnx-local.service=xdfnx-homepage"
      - "traefik.http.routers.xdfnx-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.xdfnx-dev.rule=Host(`xdfnx.gigaforust.internal`)"
      - "traefik.http.routers.xdfnx-dev.entrypoints=websecure"
      - "traefik.http.routers.xdfnx-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
      - "traefik.http.routers.xdfnx-dev.tls=true"
-
+    networks:
+      - proxy
 networks:
  proxy:
    external: true
@@ -1,7 +1,7 @@
 services:
  metube:
    image: ghcr.io/alexta69/metube
-    # container_name: metube
+    container_name: metube
    restart: unless-stopped
    # ports:
    # - "8081:8081"
@@ -13,31 +13,25 @@ services:
    volumes:
      - ./MeTube_downloads:/downloads
    labels:
-      - traefik.enable=true
+      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.metube.loadbalancer.server.port=8081"

      # Prod Router
      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
      - "traefik.http.routers.metube.entrypoints=websecure"
      - "traefik.http.routers.metube.middlewares=security-chain@file"
-      - "traefik.http.routers.metube.service=metube"
      - "traefik.http.routers.metube.tls=true"
-      - "traefik.http.services.metube.loadbalancer.server.port=8081"
-
      # Local Router
-      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`) || Host(`metube.internal`)"
+      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`))"
      - "traefik.http.routers.metube-local.entrypoints=websecure"
      - "traefik.http.routers.metube-local.middlewares=security-headers@file"
-      - "traefik.http.routers.metube-local.service=metube"
      - "traefik.http.routers.metube-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
      - "traefik.http.routers.metube-dev.entrypoints=websecure"
      - "traefik.http.routers.metube-dev.middlewares=security-chain@file"
-      - "traefik.http.routers.metube-dev.service=metube"
      - "traefik.http.routers.metube-dev.tls=true"
-
    networks:
      - proxy
 networks:
@@ -18,7 +18,6 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
-
      # AIO Services configuration
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
@@ -30,27 +29,21 @@ services:
      # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
      # - "traefik.http.routers.nextcloud-aio.tls=true"
-
      # Local Router
-      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`) || Host(`nextcloud-aio.internal`)"
+      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`)"
      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file"
-      - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio"
      - "traefik.http.routers.nextcloud-aio-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`naio.gigaforust.internal`)"
      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio"
      - "traefik.http.routers.nextcloud-aio-dev.tls=true"

-      # Glanceapp/glance config
+      # Glance Metadata
      - glance.name=Nextcloud
-      # - glance.icon=si:nextcloud
      - glance.url=https://nextcloud.forust.xyz/
      - glance.description=Nextcloud is a suite of client-server software for creating and using file hosting services.
-
    environment:
      AIO_DISABLE_BACKUP_SECTION: false
      APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
@@ -103,32 +103,25 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.penpot.loadbalancer.server.port=8080"

      # Prod Router
      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
      - "traefik.http.routers.penpot.entrypoints=websecure"
      - "traefik.http.routers.penpot.middlewares=security-headers@file"
-      - "traefik.http.routers.penpot.service=penpot"
      - "traefik.http.routers.penpot.tls=true"
-      - "traefik.http.services.penpot.loadbalancer.server.port=8080"
-
      # Local Router
-      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`) || Host(`penpot.internal`)"
+      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`)"
      - "traefik.http.routers.penpot-local.entrypoints=websecure"
      - "traefik.http.routers.penpot-local.middlewares=security-headers@file"
-      - "traefik.http.routers.penpot-local.service=penpot"
      - "traefik.http.routers.penpot-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.internal`)"
      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
      - "traefik.http.routers.penpot-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.penpot-dev.service=penpot"
      - "traefik.http.routers.penpot-dev.tls=true"
-
    environment:
      <<: [ *penpot-flags, *penpot-http-body-size ]
-
  penpot-backend:
    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
    restart: always
@@ -1,54 +1,45 @@
 services:
  portainer:
-    container_name: portainer
    image: portainer/portainer-ce:latest
+    container_name: portainer
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
-      - ./portainer_data:/data
+      - data:/data
    ports:
      - 9443:9443
      # - 8000:8000  # Remove if you do not intend to use Edge Agents
-    networks:
-      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
+      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
+      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"

      # Prod Router
      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.middlewares=security-headers@file"
-      - "traefik.http.routers.portainer.service=portainer"
      - "traefik.http.routers.portainer.tls=true"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
-      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
-      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"
-
      # Local Router
-      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`) || Host(`portainer.internal`)"
+      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`)"
      - "traefik.http.routers.portainer-local.entrypoints=websecure"
      - "traefik.http.routers.portainer-local.middlewares=security-headers@file"
-      - "traefik.http.routers.portainer-local.service=portainer"
      - "traefik.http.routers.portainer-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.internal`)"
      - "traefik.http.routers.portainer-dev.entrypoints=websecure"
      - "traefik.http.routers.portainer-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.portainer-dev.service=portainer"
      - "traefik.http.routers.portainer-dev.tls=true"

+      # Glance Metadata
      - glance.name=Portainer
      - glance.url=https://portainer.forust.xyz/
      - glance.description=Portainer is a lightweight management UI which allows you to easily manage your Docker environments.
-
+    networks:
+      - proxy
 volumes:
-  portainer_data:
-    name: portainer_data
-
+  data:
 networks:
-  default:
-    name: portainer_network
  proxy:
    external: true
@@ -0,0 +1,26 @@
+# sudo mount /dev/sdc5 /mnt/mediaserver
+
+
+    # volumes:
+    #   - /mnt/mediaserver:/<somepath>
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.lampa.loadbalancer.server.port=<container port>"
+      # Prod Router
+      - "traefik.http.routers.lampa.rule=Host(`media.forust.xyz`)"
+      - "traefik.http.routers.lampa.entrypoints=websecure"
+      - "traefik.http.routers.lampa.tls=true"
+      # Local Router
+      - "traefik.http.routers.lampa-local.rule=Host(`media.workstation.internal`)"
+      - "traefik.http.routers.lampa-local.entrypoints=websecure"
+      - "traefik.http.routers.lampa-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.lampa-dev.rule=Host(`media.gigaforust.internal`)"
+      - "traefik.http.routers.jellyfin-dev.entrypoints=websecure"
+      - "traefik.http.routers.jellyfin-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true
@@ -6,41 +6,33 @@ services:
    # ports:
    #   - "3331:8080"
    volumes:
-      - ./termix-data:/app/data
+      - data:/app/data
    environment:
      PORT: "8080"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.termix.loadbalancer.server.port=8080"

      # Prod Router
      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
      - "traefik.http.routers.termix.entrypoints=websecure"
      - "traefik.http.routers.termix.middlewares=security-headers@file"
-      - "traefik.http.routers.termix.service=termix"
      - "traefik.http.routers.termix.tls=true"
-      - "traefik.http.services.termix.loadbalancer.server.port=8080"
-
      # Local Router
-      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`) || Host(`termix.internal`)"
+      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`)"
      - "traefik.http.routers.termix-local.entrypoints=websecure"
      - "traefik.http.routers.termix-local.middlewares=security-headers@file"
-      - "traefik.http.routers.termix-local.service=termix"
      - "traefik.http.routers.termix-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.internal`)"
      - "traefik.http.routers.termix-dev.entrypoints=websecure"
      - "traefik.http.routers.termix-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.termix-dev.service=termix"
      - "traefik.http.routers.termix-dev.tls=true"
    networks:
      - proxy
-
 networks:
  proxy:
    external: true
-
 volumes:
-  termix-data:
-    driver: local
+  data:
@@ -34,12 +34,12 @@ services:
      # Cloudflare 
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
+      
      # # Logging
      # - "--log.level=INFO"
      # - "--log.filePath=/var/log/traefik/traefik.log"
      # - "--accesslog=true"
      # - "--accesslog.filepath=/var/log/traefik/access.log"
-
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
@@ -50,14 +50,12 @@ services:
      - "traefik.http.routers.traefik-dashboard.middlewares=security-chain@file"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.tls=true"
-
      # Local Router
-      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
+      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`)"
      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard-local.middlewares=security-headers@file"
      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
@@ -65,27 +63,21 @@ services:
      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-dev.tls=true"

+      # Glance Metadata
      - glance.name=Traefik
      - glance.url=https://traefik.forust.xyz/
      - glance.description=Traefik is a modern reverse proxy and load balancer
-
-    ports:
-      - "80:80"
-      - "443:443"
-
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./certs:/certs:ro
      - ./logs:/var/log/traefik
      - ./letsencrypt:/letsencrypt
-
+    ports:
+      - "80:80"
+      - "443:443"
    networks:
      - proxy
-
-    environment:
-      - TZ=Europe/Bratislava
-
 networks:
  proxy:
-    external: true
+    external: true
@@ -1,34 +1,33 @@
 services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
-    restart: unless-stopped
    container_name: uptime-kuma
+    restart: unless-stopped
    volumes:
-      - ./data:/app/data
-      # ports:
-      # <Host Port>:<Container Port>
-      # - "3001:3001"
+      - data:/app/data
+    # ports:
+    #   - "3001:3001"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"

      # Prod Router
      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
      - "traefik.http.routers.uptime-kuma.entrypoints=websecure"
      - "traefik.http.routers.uptime-kuma.tls=true"
-      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
-
      # Local Router
-      - "traefik.http.routers.uptime-kuma-local.rule=Host(`uptime.workstation.internal`) || Host(`uptime.internal`)"
+      - "traefik.http.routers.uptime-kuma-local.rule=Host(`uptime.workstation.internal`)"
      - "traefik.http.routers.uptime-kuma-local.entrypoints=websecure"
      - "traefik.http.routers.uptime-kuma-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.uptime-kuma-dev.rule=Host(`uptime.gigaforust.internal`)"
      - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
      - "traefik.http.routers.uptime-kuma-dev.tls=true"
    networks:
      - proxy
+volumes:
+  data:
 networks:
  proxy:
-    external: true
+    external: true
Author	SHA1	Message	Date
forust	5b3ef39102	template for lampa service	2026-01-21 11:36:36 +01:00
forust	bf72007b14	feat: headplane (ui for headscale)	2026-01-21 10:09:31 +01:00
forust	0bad0a817e	fix: bad request Revert "chore: compose cleanup:" This reverts nextcloud service's changes from commit `45ce789f58`.	2026-01-20 15:11:06 +01:00
forust	525fed3b92	Merge pull request 'chore/compose-cleanup' (#8 ) from chore/compose-cleanup into main Reviewed-on: #8	2026-01-20 00:17:42 +01:00
forust	fe5e5c5e35	fix: aborted connection to portainer	2026-01-20 00:08:18 +01:00
forust	72aa022048	fix: "http plaintext sent to https"	2026-01-20 00:05:10 +01:00
forust	f18d4d9be4	chore: use volumes to store data of - portainer - headscale - termix - uptime-kuma - dockmon	2026-01-19 23:58:26 +01:00
forust	45ce789f58	chore: compose cleanup: - Remove TZ envs - +- unified compose structure - Minify where possible - Remove <service>.internal routers - Remove service specifications where possible Affected services: - adguardhome - authentik - cfddns - checkmk - dockmon - downtify - gitea - glance - headscale - homepages - metube - nextcloud - penpot - portainer - termix - traefik - uptime-kuma TODO: Move data from directory to volumes	2026-01-19 23:33:50 +01:00
forust	d7c05fd058	fix: use webinar links to detect duplicates, supress logspam from telegram bot	2026-01-19 17:01:23 +01:00