Merge pull request 'add pgp pubkey to landing page, minor info changes' (#4 ) from chore/pgp into main

Reviewed-on: #4
add pgp pubkey to landing page, minor info changes
2026-01-03 02:26:04 +01:00 · 2026-01-03 02:25:12 +01:00 · 2026-01-03 01:39:05 +01:00 · 2026-01-02 13:06:49 +01:00 · 2026-01-02 03:06:50 +01:00 · 2026-01-02 03:06:24 +01:00
24 changed files with 323 additions and 134 deletions
@@ -2,17 +2,11 @@
 sync.ffs_lock
 .sync.ffs_db

-# Environment 
-.env
-.env.anna
-.env.forust
-.env.*
-!.env.*example
+

 # Volumes and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
-gitea/*runner/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
 adguardhome/data/*
@@ -24,6 +18,8 @@ termix/termix-data/*
 cfddns/config.json
 checkmk/checkmk/*
 downtify/Downtify_downloads
+headscale/config/*
+headscale/data/*

 # Steaming services files
 streaming/jellyfin/*
@@ -36,11 +32,14 @@ streaming/prowlarr/*

 # Homepage 
 homepages/forust_files/assets/images/team/*
-
+homepages/forust_files/.well-known/*

 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/logs/*
+
+# SSL Certificates
+adguardhome/certs/*
 traefik/certs/*

 # Monitoring
@@ -83,3 +82,11 @@ replacements.txt

 # Temp files
 edu_master/temp/
+temp/*
+
+# Environment 
+.env
+.env.anna
+.env.forust
+.env.*
+!*example
@@ -3,48 +3,54 @@ services:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
-    environment:
-      - TZ=${TZ}
    ports:
      - "53:53/tcp"
      - "53:53/udp"
+      - "853:853/tcp" # DNS over TLS
      # - "67:67/udp" # DHCP
      # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
    volumes:
      - ./data/work:/opt/adguardhome/work
      - ./data/conf:/opt/adguardhome/conf
+      - ./certs:/certs:ro
    networks:
-      - traefik-proxy
+      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"

      # Prod Router
-      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
      - "traefik.http.routers.adguard.middlewares=security-headers@file"
      - "traefik.http.routers.adguard.service=adguard"
      - "traefik.http.routers.adguard.tls=true"
-      - "traefik.http.services.adguard.loadbalancer.server.port=3000"

      # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
      - "traefik.http.routers.adguard-local.entrypoints=websecure"
      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-local.service=adguard"
      - "traefik.http.routers.adguard-local.tls=true"

      # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-dev.service=adguard"
      - "traefik.http.routers.adguard-dev.tls=true"

+      # DoH
+      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns.entrypoints=websecure"
+      - "traefik.http.routers.dns.service=adguard"
+      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
+
      - glance.name=adguard
      - glance.url=https://adguard.forust.xyz/
      - glance.description=AdGuard Home is a network-wide software for blocking ads.
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -26,9 +26,9 @@ services:
    command: server
    container_name: authentik-server
    restart: unless-stopped
-    ports:
-      - ${PORT_HTTP:-9000}:9000
-      - ${PORT_HTTPS:-9443}:9443
+    # ports:
+    #   - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTPS:-9443}:9443
    env_file:
      - .env
    environment:
@@ -40,7 +40,7 @@ services:

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
      # Services
      # - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
@@ -69,7 +69,7 @@ services:
      - ./media:/media
      - ./custom-templates:/templates
    networks:
-      - traefik-proxy
+      - proxy
      - authentik
    depends_on:
      postgresql:
@@ -102,5 +102,5 @@ volumes:
    driver: local
 networks:
  authentik:
-  traefik-proxy:
+  proxy:
    external: true
@@ -16,10 +16,10 @@ services:
         timeout: 10s
         retries: 3
      networks:
-         - traefik-proxy
+         - proxy
      labels:
         - "traefik.enable=true"
-         - "traefik.docker.network=traefik-proxy"
+         - "traefik.docker.network=proxy"

         # Prod Router
         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
@@ -50,5 +50,5 @@ services:
         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.

 networks:
-   traefik-proxy:
+   proxy:
      external: true
@@ -29,11 +29,11 @@ services:
      - traefik.http.routers.downtify-dev.service=downtify
      - traefik.http.routers.downtify-dev.tls=true
    networks:
-      - traefik-proxy
+      - proxy

    volumes:
      - ./Downtify_downloads:/downloads

 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -1,4 +1,6 @@
 GITEA_POSTGRES_USER=
 GITEA_POSTGRES_PASSWORD=
 GITEA_POSTGRES_DB=gitea
-BASIC-RUNNER_TOKEN=
+GITEA_SMTP_PASS=
+MAILER_ADDR=
+SERVICE_EMAIL=email.used.by.services@domain.tld
@@ -15,17 +15,26 @@ services:
      - GITEA__server__ROOT_URL=https://gitea.forust.xyz
      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
      - GITEA__server__SSH_PORT=2221
+      # Mailer
+      - GITEA__mailer__ENABLED=true
+      - GITEA__mailer__FROM=${SERVICE_EMAIL}
+      - GITEA__mailer__SMTP_ADDR=${MAILER_ADDR}:465
+      - GITEA__mailer__USER=${SERVICE_EMAIL}
+      - GITEA__mailer__PASSWD=${GITEA_SMTP_PASS}
+      - GITEA__mailer__PROTOCOL=SMTP
+      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
+      - GITEA__service__ENABLE_NOTIFY_MAIL=true
    restart: always
    networks:
      - gitea-db
-      - traefik-proxy
+      - proxy
    volumes:
      - ./gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
@@ -56,25 +65,6 @@ services:
    depends_on:
      - db

-  runner:
-    image: gitea/act_runner:0.2.11
-    container_name: gitea-runner
-    restart: always
-    depends_on:
-      - server
-    env_file:
-      - .env
-    networks:
-      - gitea-db
-    environment:
-      - GITEA_INSTANCE_URL=http://server:3000
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${BASIC-RUNNER_TOKEN}
-      - GITEA_RUNNER_NAME=basic-runner
-      - GITEA_RUNNER_LABELS=docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm
-    volumes:
-      - ./gitea-runner:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-
  db:
    image: docker.io/library/postgres:14
    restart: always
@@ -90,5 +80,5 @@ services:
 networks:
  gitea-db:
    external: false
-  traefik-proxy:
+  proxy:
    external: true
@@ -11,7 +11,7 @@ services:
    env_file: .env
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
@@ -31,10 +31,10 @@ services:
      - "traefik.http.routers.glance-dev.middlewares=security-chain@file"
      - "traefik.http.routers.glance-dev.tls=true"
    networks:
-      - traefik-proxy
+      - proxy
    dns:
      - 1.1.1.1
      - 8.8.8.8
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -0,0 +1,84 @@
+services:
+  server:
+    image: headscale/headscale:latest
+    restart: unless-stopped
+    command: serve
+    networks:
+      - proxy
+    volumes:
+      - ./config:/etc/headscale
+      - ./data:/var/lib/headscale
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
+
+      ## SERVICE
+      # Prod Router
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
+      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.service=headscale"
+      - "traefik.http.routers.headscale-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.service=headscale"
+      - "traefik.http.routers.headscale-dev.tls=true"
+
+      ## METRICS
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+    dns:
+        - 1.1.1.1
+        - 1.0.0.1
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "treafik.docker.network=proxy"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+
+networks:
+  proxy:
+    external: true
@@ -0,0 +1,79 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+randomize_client_port: false
@@ -3,16 +3,16 @@ services:
    build:
      context: .
      dockerfile: Dockerfile.forust
-    ports:
-      - "8085:80"
+    # ports:
+    #   - "8085:80"
    restart: unless-stopped
    volumes:
      - ./forust_files:/usr/share/nginx/html
    networks:
-      - traefik-proxy
+      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Services
      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
@@ -42,16 +42,16 @@ services:
    build:
      context: .
      dockerfile: Dockerfile.xdfnx
-    ports:
-      - "8086:80"
+    # ports:
+    #   - "8086:80"
    restart: unless-stopped
    volumes:
      - ./xdfnx_files:/usr/share/nginx/html
    networks:
-      - traefik-proxy
+      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
      
      # Services
      - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
@@ -77,7 +77,6 @@ services:
      - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
      - "traefik.http.routers.xdfnx-dev.tls=true"

-
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -41,7 +41,14 @@
                </li>
                <li>
                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:forust@forust.xyz">forust@forust.xyz</a>
+                    <a href="mailto:forust@forust.xyz">mail/contact@forust.xyz</a>
+                </li>
+                <li>
+                    <i class="fa-solid fa-key"></i>
+                    <a href=".well-known/pgp-key.asc">security/PGP Key</a>
+                </li>
+                <li>
+                    <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
                </li>
            </ul>
        </section>
@@ -14,7 +14,7 @@ services:
      - ./MeTube_downloads:/downloads
    labels:
      - traefik.enable=true
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
@@ -39,7 +39,7 @@ services:
      - "traefik.http.routers.metube-dev.tls=true"

    networks:
-      - traefik-proxy
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -23,11 +23,11 @@ services:
      - 1.1.1.1
      - 8.8.8.8
    networks:
-      - traefik-proxy
+      - proxy
      - n8n
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
@@ -58,5 +58,5 @@ services:
 networks:
  n8n:
    external: false
-  traefik-proxy:
+  proxy:
    external: true
@@ -9,7 +9,7 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - nextcloud-aio
-      - traefik-proxy # Optional: Connects the mastercontainer to the traefik-proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      # ports:
      # - 8081:80 # may be removed if under reverse-proxy
      # - 8443:8443 
@@ -17,7 +17,7 @@ services:

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # AIO Services configuration
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
@@ -55,7 +55,7 @@ services:
      AIO_DISABLE_BACKUP_SECTION: false
      APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      APACHE_IP_BINDING: 0.0.0.0 # Configure when going with reverse-proxy https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      APACHE_ADDITIONAL_NETWORK: traefik-proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      APACHE_ADDITIONAL_NETWORK: proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Backup retention See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
      COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
      FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M" # adjust fulltextsearch java options. https://github.com/nextcloud/all-in-one#how-to-adjust-the-fulltextsearch-java-options
@@ -75,7 +75,7 @@ services:
      # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. For macos it needs to be '/var/run/docker.sock'

 networks:
-  traefik-proxy:
+  proxy:
    external: true
  nextcloud-aio:
    driver: bridge
@@ -50,7 +50,7 @@ x-secret-key: &penpot-secret-key

 networks:
  penpot:
-  traefik-proxy:
+  proxy:
    external: true

 volumes:
@@ -86,8 +86,8 @@ services:
  penpot-frontend:
    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
    restart: always
-    ports:
-      - 9001:8080
+    # ports:
+    #   - 9001:8080

    volumes:
      - penpot_assets:/opt/data/assets
@@ -98,11 +98,11 @@ services:

    networks:
      - penpot
-      - traefik-proxy
+      - proxy

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
@@ -10,10 +10,10 @@ services:
      - 9443:9443
      # - 8000:8000  # Remove if you do not intend to use Edge Agents
    networks:
-      - traefik-proxy
+      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
@@ -50,5 +50,5 @@ volumes:
 networks:
  default:
    name: portainer_network
-  traefik-proxy:
+  proxy:
    external: true
@@ -0,0 +1 @@
+TS_AUTHKEY=tskey-auth-xxxxx-CNTRL
@@ -0,0 +1,21 @@
+services:
+  tailscale:
+    image: tailscale/tailscale:latest
+    container_name: tailscale
+    network_mode: host
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - tailscale_data:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_HOSTNAME=forust-server
+      # - TS_EXTRA_ARGS=--advertise-tags=tag:container
+
+volumes:
+  tailscale_data:
+    name: tailscale_data
@@ -3,15 +3,15 @@ services:
    image: ghcr.io/lukegus/termix:latest
    container_name: termix
    restart: unless-stopped
-    ports:
-      - "3331:8080"
+    # ports:
+    #   - "3331:8080"
    volumes:
      - ./termix-data:/app/data
    environment:
      PORT: "8080"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
@@ -35,10 +35,10 @@ services:
      - "traefik.http.routers.termix-dev.service=termix"
      - "traefik.http.routers.termix-dev.tls=true"
    networks:
-      - traefik-proxy
+      - proxy

 networks:
-  traefik-proxy:
+  proxy:
    external: true

 volumes:
@@ -11,7 +11,7 @@ services:
      # Providers
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=traefik-proxy"
+      - "--providers.docker.network=proxy"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"

@@ -19,16 +19,14 @@ services:
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.websecure.http.tls=true"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
-      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      - "--entryPoints.ssh.address=:2221"

-      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
-      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
-      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      # Let's Encrypt
+      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      # # STAGING
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"

      # Cloudflare 
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
@@ -41,7 +39,7 @@ services:

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router (Dash)
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
@@ -77,14 +75,14 @@ services:
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./certs:/certs:ro
      - ./logs:/var/log/traefik
-      # - ./traefik/letsencrypt:/letsencrypt
+      - ./letsencrypt:/letsencrypt

    networks:
-      - traefik-proxy
+      - proxy

    environment:
      - TZ=Europe/Bratislava

 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -1,33 +1,5 @@
 http:
  middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          - "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
-
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Dockmon Access"
-
    # Cloudflare IP Whitelist
    cloudflare-ipwhitelist:
      ipWhiteList:
@@ -0,0 +1,23 @@
+http:
+  middlewares:
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+  routers:
+    acme-challenge-exempt:
+      rule: "PathPrefix(`/.well-known/acme-challenge`)"
+      entryPoints:
+        - web
+      service: noop@internal
+      priority: 100
+
+    http-catchall:
+      rule: "HostRegexp(`{host:.+}`)"
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-https
+      service: noop@internal
+      priority: 1
@@ -5,12 +5,12 @@ services:
    container_name: uptime-kuma
    volumes:
      - ./data:/app/data
-    ports:
+      # ports:
      # <Host Port>:<Container Port>
-      - "3001:3001"
+      # - "3001:3001"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
@@ -28,7 +28,7 @@ services:
      - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
      - "traefik.http.routers.uptime-kuma-dev.tls=true"
    networks:
-      - traefik-proxy
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
    external: true
Author	SHA1	Message	Date
forust	ea738ec14c	Merge pull request 'add pgp pubkey to landing page, minor info changes' (#4 ) from chore/pgp into main Reviewed-on: #4	2026-01-03 02:26:04 +01:00
forust	e4e9d96a0b	add pgp pubkey to landing page, minor info changes	2026-01-03 02:25:12 +01:00
forust	89576032b9	fix: update DNS settings for headscale	2026-01-03 01:39:05 +01:00
forust	a9edfc0a25	fix: traefik middlewares for local and dev envs	2026-01-02 13:06:49 +01:00
forust	acb8009307	Merge pull request 'feat: headscale implementation' (#3 ) from feat/tailscale into main Reviewed-on: #3	2026-01-02 03:06:50 +01:00
forust	21f4e46028	chore: container name change for headscale web panel	2026-01-02 03:06:24 +01:00
forust	0234524635	feat: headscale implementation - Headscale server - Using goodieshq/headscale-admin as ui - UI protected by security-chain - Metrics available at /metrics	2026-01-02 01:29:51 +01:00
forust	26f5fb2fb9	Revert "feat: add gitea-basic-runner" This reverts commit `f0682319a7`.	2026-01-02 00:38:04 +01:00
forust	122e6f6986	Revert "chore: gitea runners gitignored" This reverts commit `e0f7ab6561`.	2026-01-02 00:37:47 +01:00
forust	ce0bc4613a	fix: headscale command	2026-01-01 03:19:45 +01:00
forust	8f4f460ff3	feat: add headscale server and UI configuration with Traefik routing	2026-01-01 02:39:28 +01:00
forust	c048efd569	Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/tailscale	2026-01-01 01:45:57 +01:00
forust	4fe3d660f1	Merge pull request 'Added DoT support on dns.forust.xyz' (#2 ) from fix/dns into main Reviewed-on: #2	2025-12-31 03:44:08 +01:00
forust	9675eac2bf	feat: add DoT support on dns.forust.xyz - Made adguard available on adguard. and dns. subdomain - DoT and DoH implementation complete	2025-12-31 03:41:38 +01:00
forust	dc7fe64fbc	fix: clean up traefik configuration and add redirect middleware	2025-12-30 22:44:52 +01:00
forust	502810a12e	fix: update traefik router rules for DNS and adjust letsencrypt volume path	2025-12-30 17:20:13 +01:00
forust	c047cc291d	LE for DoH	2025-12-30 16:54:23 +01:00
forust	f2b951673c	fix: add traefik route for dns o https	2025-12-30 15:47:39 +01:00
forust	6b7c0df586	Merge pull request 'refactor: update network refs form "traefik-proxy" to "proxy"' (#1 ) from refactor/traefik-network into main Reviewed-on: #1	2025-12-30 14:26:09 +01:00
forust	fb2f420520	refactor: update network refs form "traefik-proxy" to "proxy" - To allow testing dev vers of other services	2025-12-30 14:14:24 +01:00
forust	60c7d4ff17	feat: add mailer support and credentials for gitea	2025-12-28 23:35:31 +01:00
forust	db0f0f7bb6	feat: tailscale server	2025-12-14 02:43:00 +01:00
forust	5e4c60bb30	chore (security): port hardening, commented out non-critical ports	2025-12-14 02:42:46 +01:00