upd: kener v4.0.23

Reviewed-on: #14

.gitea/workflows/prod_deploy.yaml

@@ -0,0 +1,39 @@
+name: Deploy to Server
+run-name: Deploying to ${{ runner.os}} server on ${{ gitea.ref }}
+on:
+  push:
+    branches:
+      - main
+      - ci/gitea-actions
+jobs:
+  deploy:
+    runs-on: prod
+    steps:
+      - name: Fetch and Diff Analysis
+        id: diff
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git fetch origin main
+          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
+          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
+          echo "Changed dirs: $CHANGES"
+
+      - name: Sync Server Files
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git reset --hard origin/main
+          echo "Server files synced with origin/main"
+
+      - name: Deploy Services
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          for dir in ${{ steps.diff.outputs.dirs }}; do
+            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
+              echo ">>> Deploying $dir"
+              cd "$dir"
+              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
+              cd ..
+            else
+              echo ">>> Skipping $dir: no compose file found"
+            fi
+          done

.github/workflows/prod_deploy.yaml

@@ -0,0 +1,41 @@
+## BINARY MODE, USE WITH THE GITHUB RUNNER BINARY INSTALLED ON THE SERVER
+
+name: Deploy to Server
+run-name: Deploying onto server on ${{ github.ref }}
+on:
+  push:
+    branches:
+      - main
+      - ci/actions
+jobs:
+  deploy:
+    runs-on: [prod, self-hosted]
+    steps:
+      - name: Fetch and Diff Analysis
+        id: diff
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git fetch origin main
+          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
+          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
+          echo "Changed dirs: $CHANGES"
+
+      - name: Sync Server Files
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git reset --hard origin/main
+          echo "Server files synced with origin/main"
+
+      - name: Deploy Services
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          for dir in ${{ steps.diff.outputs.dirs }}; do
+            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
+              echo ">>> Deploying $dir"
+              cd "$dir"
+              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
+              cd ..
+            else
+              echo ">>> Skipping $dir: no compose file found"
+            fi
+          done

.gitignore

@@ -10,7 +10,7 @@ gitea/gitea-db/
 gitea/gitea-data/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
-adguardhome/data/*
+adguardhome/conf/*
 dockmon/data/*
 portainer/portainer_data/*
 metube/MeTube_downloads
@@ -32,12 +32,15 @@ streaming/qbittorrent/*
 streaming/prowlarr/*
 
 # Homepage 
-homepages/forust_files/assets/images/team/*
 homepages/forust_files/.well-known/*
 
 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/dynamic/fileservers.yml
+traefik/dynamic/*.local.y*ml.*
+traefik/dynamic/*.external.y*ml
+
+
 traefik/logs/*
 
 # SSL Certificates
@@ -77,6 +80,8 @@ replacements.txt
 
 # Git
 .gitattributes
+# Gitea/github Runners
+.runner
 
 # Misc
 .DS_Store

adguardhome/compose.yaml

@@ -11,28 +11,24 @@ services:
       # - "68:68/tcp" # DHCP
       # - "3000:3000/tcp"
     volumes:
-      - ./data/work:/opt/adguardhome/work
-      - ./data/conf:/opt/adguardhome/conf
+      - data:/opt/adguardhome/work
+      - ./conf:/opt/adguardhome/conf
       - ./certs:/certs:ro
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.adguard.loadbalancer.server.port=3000"
       
       # Prod Router
       - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
       - "traefik.http.routers.adguard.entrypoints=websecure"
-      - "traefik.http.routers.adguard.middlewares=security-headers@file"
       - "traefik.http.routers.adguard.tls=true"
       # Local Router
       - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
       - "traefik.http.routers.adguard-local.entrypoints=websecure"
-      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-local.tls=true"
       # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) Host(`dns.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)"
       - "traefik.http.routers.adguard-dev.entrypoints=websecure"
-      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-dev.tls=true"
       # DoH Router
       - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
@@ -45,6 +41,8 @@ services:
       - glance.description=AdGuard Home is a network-wide software for blocking ads.
     networks:
       - proxy
+volumes:
+  data:
 networks:
   proxy:
     external: true

authentik/compose.yaml

@@ -42,26 +42,20 @@ services:
       - ./custom-templates:/templates
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
 
       # Prod Router
       - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
       - "traefik.http.routers.authentik-server.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
-      - "traefik.http.routers.authentik-server.service=authentik-server"
       - "traefik.http.routers.authentik-server.tls=true"
       # Local Router
-      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
       - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
-      - "traefik.http.routers.authentik-server-local.service=authentik-server"
       - "traefik.http.routers.authentik-server-local.tls=true"
       # Dev Router
       - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
       - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
       - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
       - "traefik.http.routers.authentik-server-dev.tls=true"
     networks:
       - proxy

checkmk/compose.yaml

@@ -13,24 +13,21 @@ services:
     environment:
       - CMK_PASSWORD=${CMK_PASSWORD:-password}
       - CMK_SITE_ID=cmk
+      - TZ=${TZ:-Etc/UTC}
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.checkmk.loadbalancer.server.port=5000"
 
       # Prod Router
       - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
       - "traefik.http.routers.checkmk.entrypoints=websecure"
-      - "traefik.http.routers.checkmk.middlewares=security-headers@file"
       - "traefik.http.routers.checkmk.tls=true"
       # Local Router
       - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
       - "traefik.http.routers.checkmk-local.entrypoints=websecure"
-      - "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
       - "traefik.http.routers.checkmk-local.tls=true"
       # Dev Router
       - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
-      - "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
       - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
       - "traefik.http.routers.checkmk-dev.tls=true"
     networks:

dockmon/compose.yaml

@@ -15,7 +15,6 @@ services:
          retries: 3
       labels:
          - "traefik.enable=true"
-         - "traefik.docker.network=proxy"
          - "traefik.http.services.dockmon.loadbalancer.server.port=443"
          - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
          - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
@@ -24,17 +23,14 @@ services:
          - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
          - "traefik.http.routers.dockmon.entrypoints=websecure"
          - "traefik.http.routers.dockmon.middlewares=security-chain@file"
-         - "traefik.http.routers.dockmon.service=dockmon"
          - "traefik.http.routers.dockmon.tls=true"
          # Local Router
          - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
          - "traefik.http.routers.dockmon-local.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
          - "traefik.http.routers.dockmon-local.tls=true"
          # Dev Router
          - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
          - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
          - "traefik.http.routers.dockmon-dev.tls=true"
 
          # Glance Metadata

downtify/compose.yaml

@@ -2,30 +2,28 @@ services:
   downtify:
     container_name: downtify
     image: ghcr.io/henriquesebastiao/downtify:latest
+    restart: unless-stopped
     # ports:
     #   - '7077:8000'
     volumes:
       - ./Downtify_downloads:/downloads
     labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy
-      - traefik.http.services.downtify.loadbalancer.server.port=8000
+      - "traefik.enable=true"
+      - "traefik.http.services.downtify.loadbalancer.server.port=8000"
 
       # Prod Router 
-      - traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
-      - traefik.http.routers.downtify.entrypoints=websecure
-      - traefik.http.routers.downtify.middlewares=security-chain@file
-      - traefik.http.routers.downtify.tls=true
+      - "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
+      - "traefik.http.routers.downtify.entrypoints=websecure"
+      - "traefik.http.routers.downtify.middlewares=security-chain@file"
+      - "traefik.http.routers.downtify.tls=true"
       # Local Router
-      - traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
-      - traefik.http.routers.downtify-local.entrypoints=websecure
-      - traefik.http.routers.downtify-local.middlewares=security-headers@file
-      - traefik.http.routers.downtify-local.tls=true
+      - "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
+      - "traefik.http.routers.downtify-local.entrypoints=websecure"
+      - "traefik.http.routers.downtify-local.tls=true"
       # Dev Router
-      - traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
-      - traefik.http.routers.downtify-dev.entrypoints=websecure
-      - traefik.http.routers.downtify-dev.middlewares=security-chain@file
-      - traefik.http.routers.downtify-dev.tls=true
+      - "traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)"
+      - "traefik.http.routers.downtify-dev.entrypoints=websecure"
+      - "traefik.http.routers.downtify-dev.tls=true"
     networks:
       - proxy
 networks:

errorpages/Dockerfile

@@ -0,0 +1,5 @@
+FROM nginx:alpine
+RUN rm -rf /usr/share/nginx/html/*
+COPY html /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

errorpages/compose.yaml

@@ -0,0 +1,19 @@
+services:
+  errorpage:
+    build: .
+    container_name: error-pages
+    restart: unless-stopped
+    # ports:
+    #   - 1234:80
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.error-pages.loadbalancer.server.port=80"
+      # Error handler middleware
+      - "traefik.http.middlewares.error-pages.errors.status=400-599"
+      - "traefik.http.middlewares.error-pages.errors.service=error-pages"
+      - "traefik.http.middlewares.error-pages.errors.query=/{status}.html"
+networks:
+  proxy:
+    external: true

errorpages/html/403.html

@@ -0,0 +1,208 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>403 // Forbidden</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="403">403</h1>
+            <p class="subtitle">> Forbidden / Access Denied.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>You do not have permission to access this resource.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> if you believe this is an
+                error.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ sudo access_resource</p>
+            <p>User is not in the sudoers file. This incident will be reported.</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/404.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>404 // Not Found</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="404">404</h1>
+            <p class="subtitle">> Page Not Found / Lost in the Void.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The page you are looking for does not exist or has been moved.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> if you believe this is an error.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ ping target</p>
+            <p>Destination Host Unreachable</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/500.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>500 // Server Error</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="500">500</h1>
+            <p class="subtitle">> Internal Server Error / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>Something went wrong on our end. We are working to fix it.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ systemctl status service</p>
+            <p>Active: failed (Result: core-dump)</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/502.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>502 // Bad Gateway</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="502">502</h1>
+            <p class="subtitle">> Bad Gateway / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The server received an invalid response from the upstream server.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ curl -I upstream_host</p>
+            <p>HTTP/1.1 502 Bad Gateway</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/503.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>503 // Service Unavailable</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="503">503</h1>
+            <p class="subtitle">> Service Unavailable / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The server is currently unable to handle the request due to maintenance or overload.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ systemctl start service</p>
+            <p>Job for service failed because the control process exited with error code.</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/504.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>504 // Gateway Timeout</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="504">504</h1>
+            <p class="subtitle">> Gateway Timeout / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The server did not receive a timely response from the upstream server.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ timeout 30s curl upstream</p>
+            <p>curl: (28) Operation timed out after 30001 milliseconds with 0 bytes received</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

gitea/compose.yaml

@@ -31,23 +31,19 @@ services:
       - /etc/localtime:/etc/localtime:ro
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
       # Prod Router
       - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.middlewares=security-headers@file"
       - "traefik.http.routers.gitea.tls=true"
       # Local Router
       - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`)"
       - "traefik.http.routers.gitea-local.entrypoints=websecure"
-      - "traefik.http.routers.gitea-local.middlewares=security-headers@file"
       - "traefik.http.routers.gitea-local.tls=true"
       # Dev Router
       - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)"
       - "traefik.http.routers.gitea-dev.entrypoints=websecure"
-      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
       - "traefik.http.routers.gitea-dev.tls=true"
       # SSH Router
       - "traefik.tcp.services.gitea.loadbalancer.server.port=22"

glance/compose.yaml

@@ -12,22 +12,19 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
-      # FIXME: traefik.services.glance.loadbalancer.server.port ??
+      - "traefik.services.glance.loadbalancer.server.port=8080"
 
       # Prod Router
       - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
       - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.middlewares=security-headers@file"
       - "traefik.http.routers.glance.tls=true"
       # Local Router
       - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`)"
       - "traefik.http.routers.glance-local.entrypoints=websecure"
-      - "traefik.http.routers.glance-local.middlewares=security-headers@file"
       - "traefik.http.routers.glance-local.tls=true"
       # Dev Router
       - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
       - "traefik.http.routers.glance-dev.entrypoints=websecure"
-      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
       - "traefik.http.routers.glance-dev.tls=true"
     networks:
       - proxy

headscale/compose.yaml

@@ -9,10 +9,10 @@ services:
     volumes:
       - ./config/headscale.yaml:/etc/headscale/config.yaml
       - data:/var/lib/headscale
+      - ./config/policy.json:/var/lib/headscale/policy.json
     labels:
       - "me.tale.headplane.target: headscale"
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.headscale.loadbalancer.server.port=8080"
       - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
 
@@ -62,12 +62,28 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     networks:
       - proxy
-    healthcheck:
-      test: [ "CMD", "/bin/hp_healthcheck" ]
-      interval: 30s
-      timeout: 5s
-      start_period: 5s
-      retries: 3
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+    networks:
+      - proxy
 volumes:
   data:
   headplane-data:

headscale/config/policy.json.example

@@ -0,0 +1,26 @@
+{
+    "groups": {
+        "group:admin": [
+            "admin@"
+        ],
+        "group:users": []
+    },
+    "tagOwners": {},
+    "hosts": {},
+    "acls": [
+        {
+            "#ha-meta": {
+                "name": "users",
+                "open": true
+            },
+            "action": "accept",
+            "src": [
+                "autogroup:member"
+            ],
+            "dst": [
+                "autogroup:self:*"
+            ]
+        }
+    ],
+    "ssh": []
+}

homepages/compose.yaml

@@ -12,23 +12,19 @@ services:
       - proxy
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
 
       # Prod Router
       - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
       - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
       - "traefik.http.routers.forust-homepage.tls=true"
       # Local Router
       - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`)"
       - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
       - "traefik.http.routers.forust-homepage-local.tls=true"
       # Dev Router
       - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
       - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
       - "traefik.http.routers.forust-homepage-dev.tls=true"
   xdfnx:
     build:
@@ -41,23 +37,20 @@ services:
       - ./xdfnx_files:/usr/share/nginx/html
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
 
       # Prod Router
       - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`)"
       - "traefik.http.routers.xdfnx.entrypoints=websecure"
-      - "traefik.http.routers.xdfnx.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx.tls.certresolver=letsencrypt" 
       - "traefik.http.routers.xdfnx.tls=true"
       # Local Router
       - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`)"
       - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
-      - "traefik.http.routers.xdfnx-local.middlewares=security-headers@file"
       - "traefik.http.routers.xdfnx-local.tls=true"
       # Dev Router
       - "traefik.http.routers.xdfnx-dev.rule=Host(`xdfnx.gigaforust.internal`)"
       - "traefik.http.routers.xdfnx-dev.entrypoints=websecure"
-      - "traefik.http.routers.xdfnx-dev.middlewares=security-headers@file"
       - "traefik.http.routers.xdfnx-dev.tls=true"
     networks:
       - proxy

homepages/forust_files/index.html

@@ -41,7 +41,7 @@
                 </li>
                 <li>
                     <i class="fas fa-envelope"></i>
-                    <a href="mailto:forust@forust.xyz">mail/contact@forust.xyz</a>
+                    <a href="mailto:contact@forust.xyz">mail/contact@forust.xyz</a>
                 </li>
                 <li>
                     <i class="fa-solid fa-key"></i>
@@ -116,7 +116,7 @@
                     <div class="avatar"
                         style="background-image: url('assets/images/team/anna.jpg'); background-size: cover; background-position: center;">
                     </div>
-                    <a href="" target="_blank">Anna~</a>
+                    <a href="./assets/images/love.png" target="_blank">Anna~</a>
                 </div>
 
                 <div class="member">

incident-archive/Overlay FS failure.md

@@ -0,0 +1,54 @@
+# Resolved: Overlay FS failure (and so containers)
+
+15-12-2025 03:02 AM EET: Degraded control panels' performances, following by full cascade docker failure
+
+15-12-2025 04:36 AM EET: Identified: Services are terminated due to server software (Overlay FS) + hardware issues (HDD).
+
+15-12-2025 08:45 PM EET: Restored NextCloud service with few tweaks to lower I/O
+
+---
+
+16-12-2025 08:34 PM EET: Ordered new HDD, ETA 22nd of December - 2nd of January
+
+---
+
+17-12-2025 02:47 AM EET: To avoid additional I/O into kuma's database, disabled uptime monitoring for non-critical services, such as:
+
+- Game servers
+- Gitea (no public projects being hosted yet)
+- Landings
+- Cloud services
+- PenPot
+- Auth provider
+- Secondary management tools
+- Chernuha's non-important infrastructure
+
+These can be identified by seeing ">2m ago" under monitor's heartbeats.
+
+---
+
+09-01-2026 02:32 PM EET: NextCloud's frontend files are corrupted due to the unknown issue. All user data is integrity-verified. To prevent user data corruption, NextCloud service will be restored after new hardware will be available.
+
+---
+
+14-01-2026 08:42 PM EET: After planned updating and restarting server, critical firmware software were corrupted because of physical degradation of the disk. Server inaccessible in any way
+
+---
+
+15-01-2026 11:30 AM EET: A new NAS-Grade HDD (Seagate IronWolf Pro) was ordered. ETA 16-01-2026 EET Before 12:00 PM
+
+---
+
+16-01-2026 12:47 AM EET: New server system is installed, data backed up. Experiencing docker memory leak.
+
+---
+
+17-01-2026 01:27 PM EET: All services except NextCloud and Satisfactory server are online.
+
+17-01-2026 03:48 PM EET: Nextcloud is online. Satisfactory will be provided on-demand. Monitoring status
+
+---
+
+##### Status: All services are online
+
+**Solution: moving all infrastructure onto new NAS-Grade HDD with fresh OS install**

kener/.env.example

@@ -0,0 +1,3 @@
+KENER_SECRET_KEY=your_secret_key_here
+ORIGIN=http://localhost:3000
+TZ=Etc/UTC

kener/compose.yaml

@@ -0,0 +1,59 @@
+services:
+  kener:
+    image: rajnandan1/kener:v4.0.23
+    container_name: kener
+    restart: unless-stopped
+    # ports:
+    #   - 3000:3000/tcp
+    environment:
+      - KENER_SECRET_KEY=${KENER_SECRET_KEY?Kener requires a secret key}
+      - ORIGIN=${ORIGIN:-http://localhost:3000}
+      - REDIS_URL=redis://redis:6379
+      - TZ:${TZ:-Etc/UTC}
+    depends_on:
+      redis:
+        condition: service_healthy
+    volumes:
+      - db:/app/database
+      - uploads:/app/uploads
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.kener.loadbalancer.server.port=3000"
+
+      # Prod Router
+      - "traefik.http.routers.kener.rule=Host(`status.forust.xyz`)"
+      - "traefik.http.routers.kener.entrypoints=websecure"
+      - "traefik.http.routers.kener.tls=true"
+      # Local Router
+      - "traefik.http.routers.kener-local.rule=Host(`status.workstation.internal`)"
+      - "traefik.http.routers.kener-local.entrypoints=websecure"
+      - "traefik.http.routers.kener-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.kener-dev.rule=Host(`status.gigaforust.internal`)"
+      - "traefik.http.routers.kener-dev.entrypoints=websecure"
+      - "traefik.http.routers.kener-dev.tls=true"
+    networks:
+      - proxy
+      - kener
+  redis:
+    image: redis:7-alpine
+    container_name: kener-redis
+    restart: unless-stopped
+    volumes:
+      - redis:/data
+    healthcheck:
+      test: [ "CMD", "redis-cli", "ping" ]
+      interval: 6s
+      timeout: 5s
+      retries: 5
+    networks:
+      - kener
+volumes:
+  db:
+  uploads:
+  redis:
+networks:
+  proxy:
+    external: true
+  kener:
+    external: false

metube/compose.yaml

@@ -14,7 +14,6 @@ services:
       - ./MeTube_downloads:/downloads
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.metube.loadbalancer.server.port=8081"
 
       # Prod Router
@@ -23,14 +22,12 @@ services:
       - "traefik.http.routers.metube.middlewares=security-chain@file"
       - "traefik.http.routers.metube.tls=true"
       # Local Router
-      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`))"
+      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`)"
       - "traefik.http.routers.metube-local.entrypoints=websecure"
-      - "traefik.http.routers.metube-local.middlewares=security-headers@file"
       - "traefik.http.routers.metube-local.tls=true"
       # Dev Router
       - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
       - "traefik.http.routers.metube-dev.entrypoints=websecure"
-      - "traefik.http.routers.metube-dev.middlewares=security-chain@file"
       - "traefik.http.routers.metube-dev.tls=true"
     networks:
       - proxy

n8n/compose.yaml

@@ -13,8 +13,8 @@ services:
       - N8N_SECURE_COOKIE=false
       - N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true
     volumes:
-      - ./n8n-node-data:/home/node/.n8n
-      - ./n8n-files:/files
+      - node-data:/home/node/.n8n
+      - files:/files
     extra_hosts:
       - "enterprise.n8n.io:104.26.13.187"
       - "enterprise.n8n.io:104.26.12.187"
@@ -27,28 +27,19 @@ services:
       - n8n
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
 
       # Prod Router
       - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
       - "traefik.http.routers.n8n.entrypoints=websecure"
-      - "traefik.http.routers.n8n.middlewares=security-headers@file"
-      - "traefik.http.routers.n8n.service=n8n"
       - "traefik.http.routers.n8n.tls=true"
-      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
-
       # Local Router
-      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`) || Host(`n8n.internal`)"
+      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`)"
       - "traefik.http.routers.n8n-local.entrypoints=websecure"
-      - "traefik.http.routers.n8n-local.middlewares=security-headers@file"
-      - "traefik.http.routers.n8n-local.service=n8n"
       - "traefik.http.routers.n8n-local.tls=true"
-
       # Dev Router
       - "traefik.http.routers.n8n-dev.rule=Host(`n8n.gigaforust.internal`)"
       - "traefik.http.routers.n8n-dev.entrypoints=websecure"
-      - "traefik.http.routers.n8n-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.n8n-dev.service=n8n"
       - "traefik.http.routers.n8n-dev.tls=true"
 
       - glance.name=n8n
@@ -60,3 +51,7 @@ networks:
     external: false
   proxy:
     external: true
+
+volumes:
+  node-data:
+  files:

netronome/.env.example

@@ -0,0 +1,29 @@
+## https://github.com/autobrr/netronome?tab=readme-ov-file#environment-variables
+
+# Server settings
+NETRONOME__HOST=0.0.0.0              # Listen address
+NETRONOME__PORT=7575                 # Web UI port
+NETRONOME__BASE_URL=/netronome                # Base URL for reverse proxy
+
+# Database (SQLite by default)
+NETRONOME__DB_TYPE=postgres            # sqlite or postgres
+NETRONOME__DB_PATH=netronome.db      # SQLite database path
+
+# PostgreSQL (when DB_TYPE=postgres)
+NETRONOME__DB_TYPE=postgres
+NETRONOME__DB_HOST=postgres
+NETRONOME__DB_PORT=5432
+NETRONOME__DB_USER=netronome
+NETRONOME__DB_PASSWORD=netronome
+NETRONOME__DB_NAME=netronome
+NETRONOME__DB_SSLMODE=disable
+
+# Authentication
+NETRONOME__AUTH_WHITELIST=127.0.0.1/32,192.168.1.0/24  # IP whitelist (comma-separated)
+NETRONOME__SESSION_SECRET=           # Session secret (auto-generated if empty)
+
+# OIDC (optional)
+NETRONOME__OIDC_ISSUER=https://accounts.google.com
+NETRONOME__OIDC_CLIENT_ID=your-client-id
+NETRONOME__OIDC_CLIENT_SECRET=your-secret
+NETRONOME__OIDC_REDIRECT_URL=https://example.com/api/auth/oidc/callback

netronome/compose.yaml

@@ -0,0 +1,59 @@
+services:
+  netronome:
+    image: ghcr.io/autobrr/netronome:latest
+    restart: unless-stopped
+    container_name: netronome
+    ports:
+      - "7575:7575"
+    cap_add:
+      - NET_RAW
+    env_file:
+      - .env
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.netronome.loadbalancer.server.port=7575"
+
+      # Prod Router
+      - "traefik.http.routers.netronome.rule=Host(`nm.forust.xyz`)"
+      - "traefik.http.routers.netronome.entrypoints=websecure"
+      - "traefik.http.routers.netronome.tls=true"
+      # Local Router
+      - "traefik.http.routers.netronome-local.rule=Host(`nm.workstation.internal`)"
+      - "traefik.http.routers.netronome-local.entrypoints=websecure"
+      - "traefik.http.routers.netronome-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.netronome-dev.rule=Host(`nm.gigaforust.internal`)"
+      - "traefik.http.routers.netronome-dev.entrypoints=websecure"
+      - "traefik.http.routers.netronome-dev.tls=true"
+    networks:
+      - proxy
+      - netronome
+    depends_on:
+      postgres:
+        condition: service_healthy
+  postgres:
+    container_name: netronome-postgres
+    image: postgres:17-alpine
+    environment:
+      - POSTGRES_USER=netronome
+      - POSTGRES_PASSWORD=netronome
+      - POSTGRES_DB=netronome
+    volumes:
+      - data:/var/lib/postgresql/data
+    healthcheck:
+      test: [ "CMD-SHELL", "pg_isready -U netronome" ]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+    networks:
+      - netronome
+volumes:
+  data:
+
+
+networks:
+  proxy:
+    external: true
+  netronome:
+    external: false

nextcloud/compose.yaml

@@ -17,7 +17,6 @@ services:
 
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       # AIO Services configuration
       - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
       - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
@@ -27,17 +26,14 @@ services:
       # - "traefik.http.routers.nextcloud-aio.rule=Host(`naio.forust.xyz`)"
       # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
       # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
-      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
       # - "traefik.http.routers.nextcloud-aio.tls=true"
       # Local Router
       - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`)"
       - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file"
       - "traefik.http.routers.nextcloud-aio-local.tls=true"
       # Dev Router
       - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`naio.gigaforust.internal`)"
       - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file"
       - "traefik.http.routers.nextcloud-aio-dev.tls=true"
 
       # Glance Metadata

penpot/compose.yaml

@@ -102,23 +102,19 @@ services:
 
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.penpot.loadbalancer.server.port=8080"
 
       # Prod Router
       - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
       - "traefik.http.routers.penpot.entrypoints=websecure"
-      - "traefik.http.routers.penpot.middlewares=security-headers@file"
       - "traefik.http.routers.penpot.tls=true"
       # Local Router
       - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`)"
       - "traefik.http.routers.penpot-local.entrypoints=websecure"
-      - "traefik.http.routers.penpot-local.middlewares=security-headers@file"
       - "traefik.http.routers.penpot-local.tls=true"
       # Dev Router
       - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.internal`)"
       - "traefik.http.routers.penpot-dev.entrypoints=websecure"
-      - "traefik.http.routers.penpot-dev.middlewares=security-headers@file"
       - "traefik.http.routers.penpot-dev.tls=true"
     environment:
       <<: [ *penpot-flags, *penpot-http-body-size ]

portainer/compose.yaml

@@ -7,29 +7,23 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - data:/data
     ports:
-      - 9443:9443
+      - 9000:9000
       # - 8000:8000  # Remove if you do not intend to use Edge Agents
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
-      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
-      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
 
       # Prod Router
       - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
       - "traefik.http.routers.portainer.entrypoints=websecure"
-      - "traefik.http.routers.portainer.middlewares=security-headers@file"
       - "traefik.http.routers.portainer.tls=true"
       # Local Router
       - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`)"
       - "traefik.http.routers.portainer-local.entrypoints=websecure"
-      - "traefik.http.routers.portainer-local.middlewares=security-headers@file"
       - "traefik.http.routers.portainer-local.tls=true"
       # Dev Router
       - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.internal`)"
       - "traefik.http.routers.portainer-dev.entrypoints=websecure"
-      - "traefik.http.routers.portainer-dev.middlewares=security-headers@file"
       - "traefik.http.routers.portainer-dev.tls=true"
 
       # Glance Metadata

termix/compose.yaml

@@ -11,23 +11,19 @@ services:
       PORT: "8080"
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.termix.loadbalancer.server.port=8080"
 
       # Prod Router
       - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
       - "traefik.http.routers.termix.entrypoints=websecure"
-      - "traefik.http.routers.termix.middlewares=security-headers@file"
       - "traefik.http.routers.termix.tls=true"
       # Local Router
       - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`)"
       - "traefik.http.routers.termix-local.entrypoints=websecure"
-      - "traefik.http.routers.termix-local.middlewares=security-headers@file"
       - "traefik.http.routers.termix-local.tls=true"
       # Dev Router
       - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.internal`)"
       - "traefik.http.routers.termix-dev.entrypoints=websecure"
-      - "traefik.http.routers.termix-dev.middlewares=security-headers@file"
       - "traefik.http.routers.termix-dev.tls=true"
     networks:
       - proxy

traefik/compose.yaml

@@ -17,10 +17,11 @@ services:
 
       # EntryPoints
       - "--entryPoints.web.address=:80"
-      - "--entryPoints.websecure.address=:443"
-      - "--entryPoints.websecure.http.tls=true"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
+      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entryPoints.websecure.address=:443"
+      - "--entryPoints.websecure.http.middlewares=error-pages@docker"
+      - "--entryPoints.websecure.http.tls=true"
       - "--entryPoints.ssh.address=:2221"
 
       # Let's Encrypt
@@ -34,15 +35,14 @@ services:
       # Cloudflare 
       - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
-      
-      # # Logging
-      # - "--log.level=INFO"
-      # - "--log.filePath=/var/log/traefik/traefik.log"
-      # - "--accesslog=true"
-      # - "--accesslog.filepath=/var/log/traefik/access.log"
+      # Logging
+      - "--log.level=INFO"
+      - "--log.filePath=/var/log/traefik/traefik.log"
+      - "--log.format=json"
+      - "--accesslog=true"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
 
       # Prod Router (Dash)
       - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
@@ -53,13 +53,11 @@ services:
       # Local Router
       - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`)"
       - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-local.middlewares=security-headers@file"
       - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
       - "traefik.http.routers.traefik-dashboard-local.tls=true"
       # Dev Router
       - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
       - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-chain@file"
       - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
       - "traefik.http.routers.traefik-dashboard-dev.tls=true"
 
@@ -80,4 +78,4 @@ services:
       - proxy
 networks:
   proxy:
-    external: true
+    external: true

traefik/dynamic/dynamic.yml

@@ -1,4 +1,4 @@
 http:
   serversTransports:
     insecureTransport:
-      insecureSkipVerify: true
+      insecureSkipVerify: true

traefik/dynamic/nextcloud-apache.yml

@@ -15,7 +15,6 @@ http:
       rule: "Host(`nextcloud.workstation.internal`)"
       entrypoints:
         - websecure
-        - web
       service: nextcloud
       middlewares:
         - nextcloud-chain
@@ -26,7 +25,6 @@ http:
       rule: "Host(`nextcloud.gigaforust.internal`)"
       entrypoints:
         - websecure
-        - web
       service: nextcloud
       middlewares:
         - nextcloud-chain

traefik/dynamic/tls.yml

@@ -2,16 +2,14 @@
 tls:
   certificates:
     # Cloudflare Origin CA *.forust.xyz
-    - certFile: /certs/cloudflare.pem
-      keyFile: /certs/cloudflare.key
-    - certFile: /certs/xdfnx.pem
-      keyFile: /certs/xdfnx.key
+    # - certFile: /certs/cloudflare.pem
+    #   keyFile: /certs/cloudflare.key
   stores:
     default:
       defaultCertificate:
         # Fallback local certificate
-        certFile: /certs/gigaforust.internal+1.pem
-        keyFile: /certs/gigaforust.internal+1-key.pem
+        certFile: /certs/local.pem
+        keyFile: /certs/local-key.pem
 
   options:
     default:

uptime-kuma/compose.yaml

@@ -9,7 +9,6 @@ services:
     #   - "3001:3001"
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
       - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
 
       # Prod Router