fix: remove www.xdfnx.cfd from ingress, add Gitea access log config

deleted crowdsec stack from the repo. will figure something else
Signed-off-by: mr-forust <vzlomdsisma@gmail.com>
2026-07-20 11:40:41 +02:00 · 2026-07-19 23:16:14 +02:00 · 2026-07-05 02:59:31 +02:00 · 2026-07-04 01:01:05 +02:00 · 2026-07-04 00:55:46 +02:00 · 2026-07-04 00:46:13 +02:00
214 changed files with 8570 additions and 8178 deletions
@@ -0,0 +1,191 @@
+# Инструкция: Анализ хранилища Kubernetes и настройка NFS
+
+## Цель
+Проанализировать текущую конфигурацию хранилища Kubernetes и подготовить план внедрения NFS StorageClass для сохранения данных при удалении namespace.
+
+## 1. Собрать информацию о кластере
+
+### 1.1. Версия Kubernetes и тип дистрибутива
+```bash
+kubectl version --short
+# или
+kubectl version
+```
+
+Определить, используется ли k3s, k8s, microk8s и т.д.:
+```bash
+# Проверить наличие k3s
+which k3s
+# Проверить процесс
+ps aux | grep -E 'kube|k3s'
+```
+
+### 1.2. StorageClass
+```bash
+kubectl get storageclass -o wide
+```
+
+Запомнить:
+- `PROVISIONER` — какой драйвер используется
+- `RECLAIMPOLICY` — Delete или Retain
+- Какой StorageClass помечен как `(default)`
+
+### 1.3. Существующие PV и PVC
+```bash
+kubectl get pv -o wide
+kubectl get pvc --all-namespaces
+```
+
+Посмотреть, какие PVC привязаны к каким PV, и какой reclaimPolicy у PV.
+
+### 1.4. Нода и диски
+```bash
+# Список нод
+kubectl get nodes -o wide
+
+# На каждой ноде (через ssh или локально):
+lsblk
+df -h
+cat /etc/fstab
+```
+
+Определить:
+- Есть ли отдельный раздел/диск для данных
+- Куда смонтированы разделы
+- Сколько свободного места
+- Есть ли монтирование NTFS-разделов (как `/media/forust/Programs`)
+
+### 1.5. Где local-path хранит данные (для k3s)
+```bash
+ls -la /var/lib/rancher/k3s/storage/ 2>/dev/null
+# или для microk8s
+ls -la /var/snap/microk8s/common/ 2>/dev/null
+```
+
+## 2. Анализ: сохраняются ли данные при удалении namespace?
+
+| Сценарий | Результат |
+|---|---|
+| `kubectl delete ns <ns>` | Все PVC в namespace удаляются |
+| PVC → PV c `reclaimPolicy: Delete` | PV и данные удалены |
+| PVC → PV c `reclaimPolicy: Retain` | PV остаётся (статус Released), данные целы |
+
+**Вывод:** Если reclaimPolicy в StorageClass = `Delete`, то данные **пропадут**. Если `Retain` — сохранятся.
+
+## 3. План внедрения NFS
+
+### 3.1. Проверить, установлен ли NFS
+```bash
+which nfsstat exportfs mount.nfs
+systemctl status nfs-server 2>/dev/null || systemctl status nfs-kernel-server 2>/dev/null
+```
+
+### 3.2. Выбрать директорию для NFS-экспорта
+
+Варианты (выбрать подходящий):
+- `/var/lib/k8s-nfs/` — на корневом разделе
+- `<путь к отдельному разделу>/k8s-nfs/` — если есть отдельный диск/раздел
+- Не рекомендуется использовать NTFS-раздел (проблемы с правами и производительностью)
+
+Требования:
+- Файловая система: ext4 или xfs (не ntfs!)
+- Достаточно свободного места
+- Права: `755`, владелец root
+
+### 3.3. Установить NFS-сервер
+
+```bash
+# Debian/Ubuntu
+apt update && apt install -y nfs-kernel-server
+
+# RHEL/Fedora
+dnf install -y nfs-utils
+```
+
+### 3.4. Настроить экспорт
+
+Создать директорию:
+```bash
+mkdir -p /var/lib/k8s-nfs
+chmod 755 /var/lib/k8s-nfs
+```
+
+Добавить в `/etc/exports`:
+```
+/var/lib/k8s-nfs *(rw,sync,no_subtree_check,no_root_squash)
+```
+
+Применить:
+```bash
+exportfs -rav
+```
+
+Проверить:
+```bash
+showmount -e localhost
+```
+
+### 3.5. Выбрать способ интеграции с Kubernetes
+
+#### Вариант A: nfs-subdir-external-provisioner (проще)
+```bash
+helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
+helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
+  --namespace kube-system \
+  --set nfs.server=127.0.0.1 \
+  --set nfs.path=/var/lib/k8s-nfs \
+  --set storageClass.name=nfs \
+  --set storageClass.defaultClass=false \
+  --set storageClass.reclaimPolicy=Retain
+```
+
+#### Вариант B: NFS CSI Driver
+```bash
+helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+helm install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system
+```
+
+После установки CSI драйвера создать StorageClass:
+```yaml
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 127.0.0.1
+  share: /var/lib/k8s-nfs
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+```
+
+### 3.6. Проверить результат
+```bash
+kubectl get storageclass
+kubectl get pods -n kube-system | grep -E 'nfs|provisioner'
+```
+
+## 4. Итоговая конфигурация
+
+После внедрения в кластере будет два StorageClass:
+
+| Имя | Provisioner | ReclaimPolicy | Назначение |
+|---|---|---|---|
+| `local-path` (default) | rancher.io/local-path | Delete | Временные данные, stateless |
+| `nfs` | nfs-subdir-external-provisioner или nfs.csi.k8s.io | Retain | Данные, которые нужно сохранять |
+
+**Главное преимущество:** PVC c `storageClassName: nfs` при удалении namespace сохраняют данные на диске, так как NFS-провизор использует `reclaimPolicy: Retain` или файлы физически остаются в NFS-экспорте.
+
+## 5. Ответы на частые вопросы
+
+**В:** Не упадёт ли local-path при установке NFS?
+**О:** Нет, они независимы. local-path продолжает работать как обычно.
+
+**В:** Данные NFS и local-path будут на одном диске?
+**О:** Да, можно настроить оба на одном разделе, в разных каталогах.
+
+**В:** Что если у меня несколько нод?
+**О:** NFS сервер нужно поднять на одной ноде, а с других нод должна быть доступна шари. Для multi-node лучше использовать отдельный сервер или distributed storage (Longhorn, Rook/Ceph).
+
+**В:** Можно ли использовать существующий NTFS-раздел для NFS?
+**О:** Не рекомендуется — NTFS не поддерживает права Linux (no_root_squash не сработает корректно), возможны проблемы с блокировками и производительностью.
@@ -0,0 +1,24 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.{json,jsonc}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.py]
+indent_size = 4
+
+[{Makefile,makefile}]
+indent_style = tab
@@ -0,0 +1,326 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+  workflow_dispatch:
+
+env:
+  REGISTRY: gcr.forust.xyz
+
+jobs:
+  lint-prettier:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check formatting with Prettier
+        shell: bash
+        run: |
+          mapfile -t prettier_files < <(
+            git ls-files \
+              | grep -E '\.(md|json|ya?ml|html|css)$' \
+              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
+          )
+
+          if [ "${#prettier_files[@]}" -eq 0 ]; then
+            echo "No Prettier-managed files found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
+
+  lint-ruff:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Python with Ruff
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
+
+  lint-yaml:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint YAML syntax
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
+
+  lint-dockerfiles:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Dockerfiles
+        shell: bash
+        run: |
+          mapfile -t dockerfiles < <(
+            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
+          )
+
+          if [ "${#dockerfiles[@]}" -eq 0 ]; then
+            echo "No Dockerfiles found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
+
+  validate:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate Kubernetes manifests
+        shell: bash
+        run: |
+          mapfile -t manifests < <(
+            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
+              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
+          )
+
+          if [ "${#manifests[@]}" -eq 0 ]; then
+            echo "No Kubernetes manifests found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
+
+  build:
+    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
+    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed docker-built services
+        id: services
+        shell: bash
+        run: |
+          base="${{ github.event.before }}"
+          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
+            base="$(git rev-list --max-parents=0 HEAD)"
+          fi
+
+          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
+
+          services=()
+
+          add_service() {
+            local name="$1"
+            local seen=0
+            for existing in "${services[@]}"; do
+              if [ "$existing" = "$name" ]; then
+                seen=1
+                break
+              fi
+            done
+            if [ "$seen" -eq 0 ]; then
+              services+=("$name")
+            fi
+          }
+
+          for file in "${changed_files[@]}"; do
+            case "$file" in
+              dtek_notif/*)
+                add_service dtek_notif
+                ;;
+              errorpages/*)
+                add_service errorpages
+                ;;
+              userbot/*)
+                add_service userbot
+                ;;
+              homepages/*)
+                add_service homepages
+                ;;
+              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
+                add_service edu_master
+                ;;
+            esac
+          done
+
+          if [ "${#services[@]}" -eq 0 ]; then
+            echo "No docker-built services changed."
+            echo "services=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
+          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to registry
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" \
+            --password-stdin
+
+      - name: Build and push changed images
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
+
+          for service in "${services[@]}"; do
+            case "$service" in
+              dtek_notif)
+                image="${REGISTRY}/forust/dtek-notif"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" dtek_notif
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              errorpages)
+                image="${REGISTRY}/forust/error-pages"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" errorpages
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              userbot)
+                image="${REGISTRY}/forust/userbot"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" userbot
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              homepages)
+                for service in forust xdfnx; do
+                  case "$service" in
+                    forust)
+                      image="${REGISTRY}/forust/forust-homepage"
+                      ;;
+                    xdfnx)
+                      image="${REGISTRY}/forust/xdfnx-homepage"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+              edu_master)
+                for service in session-keeper webinar-checker; do
+                  case "$service" in
+                    session-keeper)
+                      context="edu_master/phpsessid-bot"
+                      image="${REGISTRY}/forust/session-keeper"
+                      ;;
+                    webinar-checker)
+                      context="edu_master/webinar-checker"
+                      image="${REGISTRY}/forust/webinar-checker"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" "$context"
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+            esac
+          done
@@ -1,39 +0,0 @@
-name: Deploy to Server
-run-name: Deploying to ${{ runner.os}} server on ${{ gitea.ref }}
-on:
-  push:
-    branches:
-      - main
-      - ci/gitea-actions
-jobs:
-  deploy:
-    runs-on: prod
-    steps:
-      - name: Fetch and Diff Analysis
-        id: diff
-        run: |
-          cd ${{ secrets.PROD_DIR }}
-          git fetch origin main
-          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
-          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
-          echo "Changed dirs: $CHANGES"
-
-      - name: Sync Server Files
-        run: |
-          cd ${{ secrets.PROD_DIR }}
-          git reset --hard origin/main
-          echo "Server files synced with origin/main"
-
-      - name: Deploy Services
-        run: |
-          cd ${{ secrets.PROD_DIR }}
-          for dir in ${{ steps.diff.outputs.dirs }}; do
-            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
-              echo ">>> Deploying $dir"
-              cd "$dir"
-              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
-              cd ..
-            else
-              echo ">>> Skipping $dir: no compose file found"
-            fi
-          done
@@ -0,0 +1,326 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+  workflow_dispatch:
+
+env:
+  REGISTRY: gcr.forust.xyz
+
+jobs:
+  lint-prettier:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check formatting with Prettier
+        shell: bash
+        run: |
+          mapfile -t prettier_files < <(
+            git ls-files \
+              | grep -E '\.(md|json|ya?ml|html|css)$' \
+              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
+          )
+
+          if [ "${#prettier_files[@]}" -eq 0 ]; then
+            echo "No Prettier-managed files found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
+
+  lint-ruff:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Python with Ruff
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
+
+  lint-yaml:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint YAML syntax
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
+
+  lint-dockerfiles:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Dockerfiles
+        shell: bash
+        run: |
+          mapfile -t dockerfiles < <(
+            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
+          )
+
+          if [ "${#dockerfiles[@]}" -eq 0 ]; then
+            echo "No Dockerfiles found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
+
+  validate:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate Kubernetes manifests
+        shell: bash
+        run: |
+          mapfile -t manifests < <(
+            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
+              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
+          )
+
+          if [ "${#manifests[@]}" -eq 0 ]; then
+            echo "No Kubernetes manifests found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
+
+  build:
+    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
+    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed docker-built services
+        id: services
+        shell: bash
+        run: |
+          base="${{ github.event.before }}"
+          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
+            base="$(git rev-list --max-parents=0 HEAD)"
+          fi
+
+          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
+
+          services=()
+
+          add_service() {
+            local name="$1"
+            local seen=0
+            for existing in "${services[@]}"; do
+              if [ "$existing" = "$name" ]; then
+                seen=1
+                break
+              fi
+            done
+            if [ "$seen" -eq 0 ]; then
+              services+=("$name")
+            fi
+          }
+
+          for file in "${changed_files[@]}"; do
+            case "$file" in
+              dtek_notif/*)
+                add_service dtek_notif
+                ;;
+              errorpages/*)
+                add_service errorpages
+                ;;
+              userbot/*)
+                add_service userbot
+                ;;
+              homepages/*)
+                add_service homepages
+                ;;
+              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
+                add_service edu_master
+                ;;
+            esac
+          done
+
+          if [ "${#services[@]}" -eq 0 ]; then
+            echo "No docker-built services changed."
+            echo "services=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
+          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to registry
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" \
+            --password-stdin
+
+      - name: Build and push changed images
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
+
+          for service in "${services[@]}"; do
+            case "$service" in
+              dtek_notif)
+                image="${REGISTRY}/forust/dtek-notif"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" dtek_notif
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              errorpages)
+                image="${REGISTRY}/forust/error-pages"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" errorpages
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              userbot)
+                image="${REGISTRY}/forust/userbot"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" userbot
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              homepages)
+                for service in forust xdfnx; do
+                  case "$service" in
+                    forust)
+                      image="${REGISTRY}/forust/forust-homepage"
+                      ;;
+                    xdfnx)
+                      image="${REGISTRY}/forust/xdfnx-homepage"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+              edu_master)
+                for service in session-keeper webinar-checker; do
+                  case "$service" in
+                    session-keeper)
+                      context="edu_master/phpsessid-bot"
+                      image="${REGISTRY}/forust/session-keeper"
+                      ;;
+                    webinar-checker)
+                      context="edu_master/webinar-checker"
+                      image="${REGISTRY}/forust/webinar-checker"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" "$context"
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+            esac
+          done
@@ -1,41 +0,0 @@
-## BINARY MODE, USE WITH THE GITHUB RUNNER BINARY INSTALLED ON THE SERVER
-
-name: Deploy to Server
-run-name: Deploying onto server on ${{ github.ref }}
-on:
-  push:
-    branches:
-      - main
-      - ci/actions
-jobs:
-  deploy:
-    runs-on: [prod, self-hosted]
-    steps:
-      - name: Fetch and Diff Analysis
-        id: diff
-        run: |
-          cd ${{ secrets.PROD_DIR }}
-          git fetch origin main
-          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
-          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
-          echo "Changed dirs: $CHANGES"
-
-      - name: Sync Server Files
-        run: |
-          cd ${{ secrets.PROD_DIR }}
-          git reset --hard origin/main
-          echo "Server files synced with origin/main"
-
-      - name: Deploy Services
-        run: |
-          cd ${{ secrets.PROD_DIR }}
-          for dir in ${{ steps.diff.outputs.dirs }}; do
-            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
-              echo ">>> Deploying $dir"
-              cd "$dir"
-              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
-              cd ..
-            else
-              echo ">>> Skipping $dir: no compose file found"
-            fi
-          done
@@ -32,7 +32,7 @@ streaming/data/*
 streaming/qbittorrent/*
 streaming/prowlarr/*

-# Homepage 
+# Homepage
 homepages/forust_files/.well-known/*

 # Traefik files
@@ -40,7 +40,7 @@ traefik/letsencrypt/acme.json
 traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
-
+traefik/k8s/fileservers.y*ml

 traefik/logs/*

@@ -52,7 +52,7 @@ certs/
 # Monitoring
 monitoring/prometheus.yml

-# Python 
+# Python
 .python-version
 venv/
 pyc
@@ -93,7 +93,7 @@ replacements.txt
 edu_master/temp/
 temp/*

-# Environment 
+# Environment
 .env
 .env.anna
 .env.forust
@@ -104,4 +104,5 @@ temp/*
 */k8s/*secret*
 !*/k8s/*secret*.example
 traefik/k8s/local-tls.yaml
+converters/k8s/config.yaml
 convertx/k8s/config.yaml
@@ -0,0 +1,10 @@
+ignored:
+  - DL3008
+  - DL3042
+  - DL3018
+  - DL3059
+trustedRegistries:
+  - docker.io
+  - ghcr.io
+  - quay.io
+  - gcr.forust.xyz
@@ -0,0 +1,8 @@
+{
+  "default": true,
+  "MD013": false,
+  "MD024": false,
+  "MD033": false,
+  "MD041": false,
+  "MD046": false
+}
@@ -0,0 +1,7 @@
+bracketSameLine: true
+htmlWhitespaceSensitivity: css
+printWidth: 120
+tabWidth: 2
+trailingComma: all
+proseWrap: preserve
+endOfLine: lf
@@ -0,0 +1,22 @@
+extends: default
+
+rules:
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  document-start: disable
+  line-length: disable
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+  truthy:
+    allowed-values:
+      - "true"
+      - "false"
+      - "on"
@@ -0,0 +1,40 @@
+{
+  "tab_size": 2,
+  "soft_wrap": "prefer_line",
+  "preferred_line_length": 120,
+  "format_on_save": "on",
+  "languages": {
+    "YAML": {
+      "tab_size": 2,
+      "hard_tabs": false,
+      "format_on_save": "on",
+      "formatter": {
+        "language_server": { "name": "yaml-language-server" },
+      },
+    },
+    "Python": {
+      "tab_size": 4,
+      "format_on_save": "on",
+      "language_servers": ["pyright", "ruff"],
+      "formatter": {
+        "language_server": { "name": "ruff" },
+      },
+    },
+  },
+  "lsp": {
+    "yaml-language-server": {
+      "settings": {
+        "yaml": {
+          "schemas": {
+            "kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"],
+          },
+          "validate": true,
+          "completion": true,
+          "format": {
+            "enable": true,
+          },
+        },
+      },
+    },
+  },
+}
@@ -17,11 +17,11 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
-      
+
      # Prod Router
      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
-      - "traefik.http.routers.adguard.tls=true"
+      - "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
      - "traefik.http.routers.adguard-local.entrypoints=websecure"
@@ -31,10 +31,10 @@ services:
      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
      - "traefik.http.routers.adguard-dev.tls=true"
      # DoH Router
-      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
-      - "traefik.http.routers.dns.entrypoints=websecure"
-      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
-      
+      - "traefik.http.routers.dns-over-https.rule=(Host(`dns.forust.xyz` || Host(`adguard.forust.xyz`)) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns-over-https.entrypoints=websecure"
+      - "traefik.http.routers.dns-over-https.tls.certresolver=letsencrypt"
+
      # Glance Metadata
      - glance.name=adguard
      - glance.url=https://adguard.forust.xyz/
@@ -1,5 +1,31 @@
 apiVersion: v1
 kind: Service
+metadata:
+  name: adguard-lb-service
+  namespace: adguard
+  annotations:
+    metallb.io/loadBalancerIPs: "192.168.80.3"
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: adguard
+  ports:
+    - name: dns-udp
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: dns-tcp
+      port: 53
+      targetPort: 53
+      protocol: TCP
+    - name: dot
+      port: 853
+      targetPort: 853
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
 metadata:
  name: adguard-service
  namespace: adguard
@@ -7,8 +7,15 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^(adguard|dns)\.forust\.xyz$`)
+    - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
      kind: Rule
+      middlewares:
+      services:
+        - name: adguard-service
+          port: 3000
+    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
+      kind: Rule
+      middlewares:
      services:
        - name: adguard-service
          port: 3000
@@ -24,39 +31,13 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^(adguard|dns)\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
      kind: Rule
      services:
        - name: adguard-service
          port: 3000
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: adguard-doh
-  namespace: adguard
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^(adguard|dns)\.forust\.xyz$`) && PathPrefix(`/dns-query`)
+    - match: (Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)) && PathPrefix(`/dns-query`)
      kind: Rule
      services:
        - name: adguard-service
          port: 3000
-  tls:
-    certResolver: letsencrypt
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
-metadata:
-  name: adguard-dot
-  namespace: adguard
-spec:
-  entryPoints:
-    - dot
-  routes:
-    - match: HostSNI(`*`)
-      services:
-        - name: adguard-service
-          port: 853
@@ -47,7 +47,7 @@ services:
      # Prod Router
      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
      - "traefik.http.routers.authentik-server.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server.tls=true"
+      - "traefik.http.routers.authentik-server.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^auth\.forust\.xyz$`)
+    - match: Host(`auth.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: authentik-server-service
          port: 9000
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^auth\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`auth.workstation.internal`) || Host(`auth.gigaforust.internal`)
      kind: Rule
      services:
        - name: authentik-server-service
          port: 9000
-
@@ -5,7 +5,7 @@ services:
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
-    network_mode: 'host'
+    network_mode: "host"
    # https://github.com/timothymiller/cloudflare-ddns#-quick-start
    environment:
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?Cloudflare API token is required}
@@ -7,7 +7,7 @@
      "api_key": {
        "api_key": "api_key_here",
        "account_email": "your_email_here"
-      }
+      },
      "zone_id": "your_zone-id",
      "subdomains": [
        { "name": "", "proxied": true },
@@ -21,7 +21,7 @@ services:
      # Prod Router
      - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
      - "traefik.http.routers.checkmk.entrypoints=websecure"
-      - "traefik.http.routers.checkmk.tls=true"
+      - "traefik.http.routers.checkmk.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
      - "traefik.http.routers.checkmk-local.entrypoints=websecure"
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^cmk\.forust\.xyz$`)
+    - match: Host(`cmk.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: checkmk-service
          port: 5000
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^cmk\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`cmk.workstation.internal`) || Host(`cmk.gigaforust.internal`)
      kind: Rule
      services:
        - name: checkmk-service
          port: 5000
-
@@ -0,0 +1,9 @@
+ACCOUNT_REGISTRATION=false
+HTTP_ALLOWED=false
+ALLOW_UNAUTHENTICAED=false
+AUTO_DELETE_EVERY_N_HOURS=24
+WEBROOT=/convert
+HIDE_HISTORY=false
+LANGUAGE=en
+UNAUTHED_USER_SHARING=false
+MAX_CONVERT_PROCESS=0
@@ -0,0 +1,70 @@
+services:
+  convertx:
+    container_name: convertx
+    image: ghcr.io/c4illin/convertx:latest
+    restart: unless-stopped
+    ports:
+      - "9992:3000"
+    # https://github.com/C4illin/ConvertX#environment-variables
+    environment:
+      - JWT_SECRET=$(JWT_SECRET)
+      - ACCOUNT_REGISTRATION=$(ACCOUNT_REGISTRATION:-false)
+      - HTTP_ALLOWED=$(HTTP_ALLOWED:-false)
+      - ALLOW_UNAUTHENTICATED=$(ALLOW_UNAUTHENTICATED:-false)
+      - AUTO_DELETE_EVERY_N_HOURS=$(AUTO_DELETE_EVERY_N_HOURS:-24)
+      - WEBROOT=$(WEBROOT)
+      - HIDE_HISTORY=$(HIDE_HISTORY:-false)
+      - LANGUAGE=$(LANGUAGE:-en)
+      - UNAUTHENTICATED_USER_SHARING=$(UNAUTHENTICATED_USER_SHARING:-false)
+      - MAX_CONVERT_PROCESS=$(MAX_CONVERT_PROCESS:-0)
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.convertx.loadbalancer.server.port=3000"
+      # Prod Router
+      - "traefik.http.routers.convertx.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx.entrypoints=websecure"
+      - "traefik.http.routers.convertx.priority=50"
+      - "traefik.http.routers.convertx.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.convertx-local.rule=Host(`workstation.internal`) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx-local.entrypoints=websecure"
+      - "traefik.http.routers.convertx-local.priority=50"
+      - "traefik.http.routers.convertx-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.convertx-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx-dev.entrypoints=websecure"
+      - "traefik.http.routers.convertx-dev.priority=50"
+      - "traefik.http.routers.convertx-dev.tls=true"
+    networks:
+      - proxy
+    volumes:
+      - data:/app/data
+
+  bentopdf:
+    container_name: bentopdf
+    image: bentopdf/bentopdf:latest
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.bentopdf.loadbalancer.server.port=8080"
+
+      # Prod router
+      - "traefik.http.routers.bentopdf.rule=Host(`pdf.forust.xyz`)"
+      - "traefik.http.routers.bentopdf.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.bentopdf.tls=true"
+      # Local router
+      - "traefik.http.routers.bentopdf-local.rule=Host(`pdf.wokstation.internal`)"
+      - "traefik.http.routers.bentopdf-local.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf-local.tls=true"
+      # Dev router
+      - "traefik.http.routers.bentopdf-dev.rule=Host(`pdf.gigaforust.internal`)"
+      - "traefik.http.routers.bentopdf-dev.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true
+volumes:
+  data:
@@ -0,0 +1,42 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: bentopdf-service
+  namespace: converters
+spec:
+  selector:
+    app: bentopdf
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf-deployment
+  namespace: converters
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: bentopdf
+  template:
+    metadata:
+      labels:
+        app: bentopdf
+    spec:
+      containers:
+        - image: bentopdf/bentopdf:latest
+          imagePullPolicy: Always
+          name: bentopdf
+          ports:
+            - containerPort: 8080
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+              ephemeral-storage: "100Mi"
+            limits:
+              memory: "700Mi"
+              cpu: "700m"
+              ephemeral-storage: "5Gi"
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: convertx-config
-  namespace: convertx
+  namespace: converters
 data:
  ACCOUNT_REGISTRATION: "false"
  HTTP_ALLOWED: "false"
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: convertx-service
-  namespace: convertx
+  namespace: converters
 spec:
  selector:
    app: convertx
@@ -14,7 +14,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: convertx-deployment
-  namespace: convertx
+  namespace: converters
 spec:
  replicas: 1
  selector:
@@ -54,7 +54,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: convertx-pvc
-  namespace: convertx
+  namespace: converters
 spec:
  accessModes:
    - ReadWriteOnce
@@ -0,0 +1,65 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: convertx-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`workstation.internal`) || Host(`gigaforust.internal`)) && PathPrefix(`/convert`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: convertx-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.forust.xyz`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.workstation.internal`) || Host(`pdf.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: convertx
+  name: converters
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: convertx-secrets
+  namespace: converters
 type: Opaque
 stringData:
  jwt-secret: ""
@@ -1,43 +0,0 @@
-services:
-  convertx:
-    container_name: convertx
-    image: ghcr.io/c4illin/convertx:latest
-    restart: unless-stopped
-    ports:
-      - "9992:3000"
-    # https://github.com/C4illin/ConvertX#environment-variables
-    environment:
-      - JWT_SECRET=$(JWT_SECRET)
-      - ACCOUNT_REGISTRATION=$(ACCOUNT_REGISTRATION:-false)
-      - HTTP_ALLOWED=$(HTTP_ALLOWED:-false)
-      - ALLOW_UNAUTHENTICATED=$(ALLOW_UNAUTHENTICATED:-false)
-      - AUTO_DELETE_EVERY_N_HOURS=$(AUTO_DELETE_EVERY_N_HOURS:-24)
-      - WEBROOT=$(WEBROOT)
-      - HIDE_HISTORY=$(HIDE_HISTORY:-false)
-      - LANGUAGE=$(LANGUAGE:-en)
-      - UNAUTHENTICATED_USER_SHARING=$(UNAUTHENTICATED_USER_SHARING:-false)
-      - MAX_CONVERT_PROCESS=$(MAX_CONVERT_PROCESS:-0)
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.convertx.loadbalancer.server.port=3000"
-      # Prod Router
-      - "traefik.http.routers.convertx.rule=Host(`convert.forust.xyz`)"
-      - "traefik.http.routers.convertx.entrypoints=websecure"
-      - "traefik.http.routers.convertx.tls=true"
-      # Local Router
-      - "traefik.http.routers.convertx-local.rule=Host(`convert.workstation.internal`)"
-      - "traefik.http.routers.convertx-local.entrypoints=websecure"
-      - "traefik.http.routers.convertx-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.convertx-dev.rule=Host(`convertx.gigaforust.internal`)"
-      - "traefik.http.routers.convertx-dev.entrypoints=websecure"
-      - "traefik.http.routers.convertx-dev.tls=true"
-    networks:
-      - proxy
-    volumes:
-      - data:/app/data
-networks:
-  proxy:
-    external: true
-volumes:
-  data:
@@ -1,32 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: convertx-prod
-  namespace: convertx
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^forust\.xyz$`) && PathPrefix(`/convert`)
-      kind: Rule
-      services:
-        - name: convertx-service
-          port: 3000
-  tls:
-    certResolver: letsencrypt
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: convertx-local
-  namespace: convertx
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^(workstation|gigaforust)\.internal$`) && PathPrefix(`/convert`)
-      kind: Rule
-      services:
-        - name: convertx-service
-          port: 3000
-
@@ -1,46 +1,46 @@
 services:
-   dockmon:
-      image: darthnorse/dockmon:latest
-      container_name: dockmon
-      restart: unless-stopped
-      # ports:
-      #    - 8000:443
-      volumes:
-         - data:/app/data
-         - /var/run/docker.sock:/var/run/docker.sock
-      healthcheck:
-         test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
-         interval: 30s
-         timeout: 10s
-         retries: 3
-      labels:
-         - "traefik.enable=true"
-         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
-         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
-         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
+  dockmon:
+    image: darthnorse/dockmon:latest
+    container_name: dockmon
+    restart: unless-stopped
+    # ports:
+    #   - 8000:443
+    volumes:
+      - data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      test: ["CMD", "curl", "-k", "-f", "https://localhost:443/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+      - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+      - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"

-         # Prod Router
-         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
-         - "traefik.http.routers.dockmon.entrypoints=websecure"
-         - "traefik.http.routers.dockmon.middlewares=security-headers@file"
-         - "traefik.http.routers.dockmon.tls=true"
-         # Local Router
-         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
-         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-local.tls=true"
-         # Dev Router
-         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
-         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.tls=true"
+      # Prod Router
+      - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+      - "traefik.http.routers.dockmon.entrypoints=websecure"
+      - "traefik.http.routers.dockmon.middlewares=security-headers@file"
+      - "traefik.http.routers.dockmon.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
+      - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+      - "traefik.http.routers.dockmon-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
+      - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+      - "traefik.http.routers.dockmon-dev.tls=true"

-         # Glance Metadata
-         - glance.name=dockmon
-         - glance.url=https://dockmon.forust.xyz/
-         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
-      networks:
-         - proxy
+      # Glance Metadata
+      - glance.name=dockmon
+      - glance.url=https://dockmon.forust.xyz/
+      - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
+    networks:
+      - proxy
 volumes:
-   data:
+  data:
 networks:
-   proxy:
-      external: true
+  proxy:
+    external: true
@@ -15,7 +15,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^dockmon\.forust\.xyz$`)
+    - match: Host(`dockmon.forust.xyz`)
      kind: Rule
      middlewares:
        - name: security-headers@file
@@ -35,10 +35,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^dockmon\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`dockmon.workstation.internal`) || Host(`dockmon.gigaforust.internal`)
      kind: Rule
      services:
        - name: dockmon-service
          port: 443
          serversTransport: dockmon-transport
-
@@ -11,11 +11,11 @@ services:
      - "traefik.enable=true"
      - "traefik.http.services.downtify.loadbalancer.server.port=8000"

-      # Prod Router 
+      # Prod Router
      - "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
      - "traefik.http.routers.downtify.entrypoints=websecure"
      - "traefik.http.routers.downtify.middlewares=security-chain@file"
-      - "traefik.http.routers.downtify.tls=true"
+      - "traefik.http.routers.downtify.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
      - "traefik.http.routers.downtify-local.entrypoints=websecure"
@@ -7,7 +7,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^downtify\.forust\.xyz$`)
+    - match: Host(`downtify.forust.xyz`)
      kind: Rule
      middlewares:
        - name: security-chain@file
@@ -26,9 +26,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^downtify\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`downtify.workstation.internal`) || Host(`downtify.gigaforust.internal`)
      kind: Rule
      services:
        - name: downtify-service
          port: 8000
-
@@ -5,7 +5,7 @@ services:
    volumes:
      - redis-data:/data
    healthcheck:
-      test: [ "CMD", "redis-cli", "ping" ]
+      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
@@ -25,7 +25,7 @@ services:
      redis:
        condition: service_healthy
    healthcheck:
-      test: [ "CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1" ]
+      test: ["CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
      interval: 30s
      timeout: 5s
      retries: 10
@@ -3,10 +3,10 @@ FROM python:3.11-slim
 WORKDIR /app

 # Install system dependencies
-RUN apt-get update && apt-get install -y redis-tools && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends redis-tools && rm -rf /var/lib/apt/lists/*

 # Install dependencies
-RUN pip install requests redis
+RUN pip install --no-cache-dir requests==2.32.3 redis==5.2.1

 # Copy application code
 COPY . .
@@ -1,17 +1,16 @@
+import logging
 import os
 import time
-import requests
-import logging
-import redis
 from datetime import datetime

+import redis
+import requests
+
 # Configure logging
-logging.basicConfig(
-    level=logging.INFO,
-    format='%(asctime)s - %(levelname)s - %(message)s'
-)
+logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
 logger = logging.getLogger(__name__)

+
 # Load configuration (adapted to .env keys)
 def _env(key, default=None):
    v = os.getenv(key, default)
@@ -19,21 +18,26 @@ def _env(key, default=None):
        return v[1:-1]
    return v

+
 LOGIN = _env('KEEPER_LOGIN')
 PASSWORD = _env('KEEPER_PASSWORD')

 EDU_BASE = _env('EDU_URL_BASE', 'https://edu.edu.vn.ua')
 EDU_LOGIN_PATH = _env('EDU_URL_LOGIN', '/user/login')
 EDU_COURSES_PATH = _env('EDU_URL_COURSES', '/course/userlist')
-URL_LOGIN = f"{EDU_BASE.rstrip('/')}/{EDU_LOGIN_PATH.lstrip('/')}"
-URL_VERIFY = f"{EDU_BASE.rstrip('/')}/{EDU_COURSES_PATH.lstrip('/')}"
+URL_LOGIN = f'{EDU_BASE.rstrip("/")}/{EDU_LOGIN_PATH.lstrip("/")}'
+URL_VERIFY = f'{EDU_BASE.rstrip("/")}/{EDU_COURSES_PATH.lstrip("/")}'

 INTERVAL = int(_env('KEEPER_INTERVAL', 10))
-USER_AGENT = _env('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
+USER_AGENT = _env(
+    'USER_AGENT',
+    'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36',
+)
 REDIS_HOST = _env('REDIS_HOST', 'redis')
 REDIS_PORT = int(_env('REDIS_PORT', 6379))

-SUCCESS_FILE = '/tmp/last_success'
+SUCCESS_FILE = '/tmp/last_success'  # noqa: S108
+

 def touch_success_file():
    """Updates the timestamp of the success file for healthchecks."""
@@ -41,22 +45,23 @@ def touch_success_file():
        with open(SUCCESS_FILE, 'w') as f:
            f.write(str(datetime.now().timestamp()))
    except Exception as e:
-        logger.error(f"Failed to touch success file: {e}")
+        logger.error(f'Failed to touch success file: {e}')
+

 def main():
-    logger.info("Starting Session Keeper Bot")
-    
+    logger.info('Starting Session Keeper Bot')
+
    # Connect to Redis
    try:
        redis_client = redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True)
        redis_client.ping()
-        logger.info(f"Connected to Redis at {REDIS_HOST}:{REDIS_PORT}")
+        logger.info(f'Connected to Redis at {REDIS_HOST}:{REDIS_PORT}')
    except Exception as e:
-        logger.error(f"Failed to connect to Redis: {e}")
+        logger.error(f'Failed to connect to Redis: {e}')
        return
-    
+
    session = requests.Session()
-    
+
    # Set headers
    headers = {
        'User-Agent': USER_AGENT,
@@ -72,58 +77,56 @@ def main():
        'Sec-Ch-Ua-Mobile': '?0',
        'Sec-Ch-Ua-Platform': '"Linux"',
        'Accept-Encoding': 'gzip, deflate, br',
-        'Priority': 'u=0, i'
+        'Priority': 'u=0, i',
    }
    session.headers.update(headers)

    while True:
        try:
-            logger.info("Attempting login...")
-            
+            logger.info('Attempting login...')
+
            # Login payload
-            payload = {
-                'login': LOGIN,
-                'password': PASSWORD
-            }
-            
+            payload = {'login': LOGIN, 'password': PASSWORD}
+
            # Perform Login
            # Note: The user request shows a POST to /user/login with form data
            # We need to make sure we handle the PHPSESSID correctly.
            # If we already have a PHPSESSID, requests will send it.
-            
+
            login_response = session.post(URL_LOGIN, data=payload, allow_redirects=True)
-            
-            logger.info(f"Login Response Status: {login_response.status_code}")
-            logger.info(f"Cookies after login: {session.cookies.get_dict()}")
+
+            logger.info(f'Login Response Status: {login_response.status_code}')
+            logger.info(f'Cookies after login: {session.cookies.get_dict()}')

            # Verify Session
-            logger.info("Verifying session...")
+            logger.info('Verifying session...')
            verify_response = session.get(URL_VERIFY, allow_redirects=False)
-            
-            logger.info(f"Verify Response Status: {verify_response.status_code}")
-            
+
+            logger.info(f'Verify Response Status: {verify_response.status_code}')
+
            if verify_response.status_code == 200:
-                logger.info("Session verification SUCCESS (200 OK).")
+                logger.info('Session verification SUCCESS (200 OK).')
                touch_success_file()
-                
+
                # Save PHPSESSID to Redis
                phpsessid = session.cookies.get('PHPSESSID')
                if phpsessid:
                    try:
                        redis_client.set('EDU_PHPSESSID', phpsessid)
-                        logger.info(f"Saved PHPSESSID to Redis: {phpsessid}")
+                        logger.info(f'Saved PHPSESSID to Redis: {phpsessid}')
                    except Exception as e:
-                        logger.error(f"Failed to save PHPSESSID to Redis: {e}")
+                        logger.error(f'Failed to save PHPSESSID to Redis: {e}')
            elif verify_response.status_code == 302:
-                logger.warning("Session verification FAILED (302 Redirect). Session might be invalid.")
+                logger.warning('Session verification FAILED (302 Redirect). Session might be invalid.')
            else:
-                logger.warning(f"Session verification returned unexpected status: {verify_response.status_code}")
+                logger.warning(f'Session verification returned unexpected status: {verify_response.status_code}')

        except Exception as e:
-            logger.error(f"An error occurred: {e}")
+            logger.error(f'An error occurred: {e}')

-        logger.info(f"Sleeping for {INTERVAL} minutes...")
+        logger.info(f'Sleeping for {INTERVAL} minutes...')
        time.sleep(INTERVAL * 60)

-if __name__ == "__main__":
+
+if __name__ == '__main__':
    main()
@@ -3,7 +3,7 @@ FROM python:3.11-slim
 WORKDIR /app

 # Install dependencies
-RUN pip install --upgrade pip && pip install playwright==1.56.0 redis requests "python-telegram-bot[job-queue]"
+RUN pip install --no-cache-dir pip==25.0.1 && pip install --no-cache-dir playwright==1.56.0 redis==5.2.1 requests==2.32.3 "python-telegram-bot[job-queue]==21.10"

 COPY checker.py .

@@ -12,7 +12,7 @@ services:
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=gitea
      - GITEA__database__NAME=gitea
-      #Server
+      # Server
      - GITEA__server__ROOT_URL=https://gitea.forust.xyz
      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
      - GITEA__server__SSH_PORT=2221
@@ -36,7 +36,7 @@ services:
      # Prod Router
      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.tls=true"
+      - "traefik.http.routers.gitea.tls.certresolver"
      # Local Router
      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`)"
      - "traefik.http.routers.gitea-local.entrypoints=websecure"
@@ -53,7 +53,6 @@ services:
      - "traefik.http.routers.gitea-registry.rule=Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)"
      - "traefik.http.routers.gitea-registry.entrypoints=websecure"
      - "traefik.http.routers.gitea-registry.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.gitea-registry.tls=true"
    ports:
      - "2221:22"
    networks:
@@ -16,5 +16,7 @@ data:
  GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"

  GITEA__mailer__ENABLED: "false"
+
+  GITEA__log__logger__access__MODE: "console, file"
  USER_UID: "1000"
  USER_GID: "1000"
@@ -7,8 +7,15 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^gitea\.forust\.xyz$`)
+    - match: Host(`gitea.forust.xyz`)
      kind: Rule
+      middlewares:
+      services:
+        - name: gitea-service
+          port: 3000
+    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
+      kind: Rule
+      middlewares:
      services:
        - name: gitea-service
          port: 3000
@@ -24,29 +31,16 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^gitea\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)
      kind: Rule
      services:
        - name: gitea-service
          port: 3000
-
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitea-registry
-  namespace: gitea
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
+    - match: (Host(`gcr.workstation.internal`) || Host(`gcr.gigaforust.internal`)) && PathPrefix(`/v2`)
      kind: Rule
      services:
        - name: gitea-service
          port: 3000
-  tls:
-    certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
@@ -15,19 +15,22 @@ services:
      - "traefik.services.glance.loadbalancer.server.port=8080"

      # Prod Router
-      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
+      - "traefik.http.routers.glance.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/glance`)"
      - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.tls=true"
+      - "traefik.http.routers.glance.priority=50"
+      - "traefik.http.routers.glance.tls.certresolver=letsencrypt"
      # Local Router
-      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`)"
+      - "traefik.http.routers.glance-local.rule=Host(`workstation.internal`) && PathPrefix(`/glance`)"
      - "traefik.http.routers.glance-local.entrypoints=websecure"
+      - "traefik.http.routers.glance-local.priority=50"
      - "traefik.http.routers.glance-local.tls=true"
      # Dev Router
-      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
+      - "traefik.http.routers.glance-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/glance`)"
      - "traefik.http.routers.glance-dev.entrypoints=websecure"
+      - "traefik.http.routers.glance-dev.priority=50"
      - "traefik.http.routers.glance-dev.tls=true"
    networks:
      - proxy
 networks:
  proxy:
-    external: true
+    external: true
@@ -64,7 +64,6 @@
              name: Apple
            - symbol: MSFT
              name: Microsoft
-        

        - type: releases
          cache: 1d
@@ -1,15 +1,13 @@
 - name: Monitoring
  columns:
-  - size: small
-    widgets:
-      - type: dns-stats
-        service: adguard
-        url: http://adguardhome:3000
-        username: forust
-        password: ${ADGUARD_PASSWORD}
-  - size: full
-    widgets:
-      - type: docker-containers
-        hide-by-default: false
-        
-  
+    - size: small
+      widgets:
+        - type: dns-stats
+          service: adguard
+          url: http://adguardhome:3000
+          username: forust
+          password: ${ADGUARD_PASSWORD}
+    - size: full
+      widgets:
+        - type: docker-containers
+          hide-by-default: false
@@ -56,6 +56,8 @@ data:
  glance.yml: |
    server:
      assets-path: /app/assets
+      proxied: true
+      base-url: /glance
    theme:
      # Перевели #050505 и #e0e0e0 в формат HSL для Glance
      background-color: 0 0 2       # Истинно черный фон
@@ -56,7 +56,7 @@ spec:
              readOnly: true
          resources:
            requests:
-              memory: "10Mi"
+              memory: "30Mi"
              cpu: "20m"
            limits:
              memory: "100Mi"
@@ -7,10 +7,11 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^forust\.xyz$`)
+    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/glance`)
      kind: Rule
+      priority: 50
      middlewares:
-        - name: glance-strupprefix
+        - name: glance-stripprefix
      services:
        - name: glance-service
          port: 8080
@@ -26,10 +27,21 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^glance\.(workstation|gigaforust)\.internal$`)
+    - match: (Host(`glance.workstation.internal`) || Host(`glance.gigaforust.internal`)) && PathPrefix(`/glance`)
      kind: Rule
+      middlewares:
+        - name: glance-stripprefix
+      priority: 50
      services:
        - name: glance-service
          port: 8080
-
-
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: glance-stripprefix
+  namespace: glance
+spec:
+  stripPrefix:
+    prefixes:
+      - /glance
@@ -24,7 +24,7 @@ services:
      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
      - "traefik.http.routers.headscale.entrypoints=websecure"
      - "traefik.http.routers.headscale.service=headscale"
-      - "traefik.http.routers.headscale.tls=true"
+      - "traefik.http.routers.headscale.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
      - "traefik.http.routers.headscale-local.entrypoints=websecure"
@@ -57,7 +57,7 @@ services:
    container_name: headplane
    restart: unless-stopped
    ports:
-      - '13000:3000'
+      - "13000:3000"
    volumes:
      - ./config/headplane.yaml:/etc/headplane/config.yaml
      - ./config/headscale.yaml:/etc/headscale/config.yaml
@@ -65,6 +65,40 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.headplane.loadbalancer.server.port=3000"
+
+      # Middleware: add /admin prefix for root requests
+      - "traefik.http.middlewares.headplane-prefix.addPrefix.prefix=/admin"
+
+      # Prod Root Router
+      - "traefik.http.routers.headplane-root.rule=Host(`hp.forust.xyz`)"
+      - "traefik.http.routers.headplane-root.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root.tls.certresolver=letsencrypt"
+      # Prod Router
+      - "traefik.http.routers.headplane.rule=Host(`hp.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane.entrypoints=websecure"
+      - "traefik.http.routers.headplane.tls.certresolver=letsencrypt"
+      # Local Root Router
+      - "traefik.http.routers.headplane-root-local.rule=Host(`hp.workstation.internal`)"
+      - "traefik.http.routers.headplane-root-local.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root-local.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root-local.tls=true"
+      # Local Router
+      - "traefik.http.routers.headplane-local.rule=Host(`hp.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane-local.entrypoints=websecure"
+      - "traefik.http.routers.headplane-local.tls=true"
+      # Dev Root Router
+      - "traefik.http.routers.headplane-root-dev.rule=Host(`hp.gigaforust.internal`)"
+      - "traefik.http.routers.headplane-root-dev.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root-dev.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root-dev.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headplane-dev.rule=Host(`hp.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane-dev.entrypoints=websecure"
+      - "traefik.http.routers.headplane-dev.tls=true"
  web:
    image: goodieshq/headscale-admin:latest
    restart: unless-stopped
@@ -78,7 +112,7 @@ services:
      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
-      - "traefik.http.routers.headscale-ui.tls=true"
+      - "traefik.http.routers.headscale-ui.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
@@ -33,7 +33,9 @@ derp:
  auto_update_enabled: true
  update_frequency: 24h
 disable_check_updates: false
-ephemeral_node_inactivity_timeout: 30m
+node:
+  ephemeral:
+    inactivity_timeout: 30m
 database:
  type: sqlite
  debug: false
@@ -76,4 +78,3 @@ unix_socket: /var/run/headscale/headscale.sock
 unix_socket_permission: "0770"
 logtail:
  enabled: false
-randomize_client_port: false
@@ -1,26 +1,21 @@
 {
-    "groups": {
-        "group:admin": [
-            "admin@"
-        ],
-        "group:users": []
-    },
-    "tagOwners": {},
-    "hosts": {},
-    "acls": [
-        {
-            "#ha-meta": {
-                "name": "users",
-                "open": true
-            },
-            "action": "accept",
-            "src": [
-                "autogroup:member"
-            ],
-            "dst": [
-                "autogroup:self:*"
-            ]
-        }
-    ],
-    "ssh": []
-}
+  "groups": {
+    "group:admin": ["admin@"],
+    "group:users": []
+  },
+  "tagOwners": {},
+  "hosts": {},
+  "acls": [
+    {
+      "randomizeClientPort": false,
+      "#ha-meta": {
+        "name": "users",
+        "open": true
+      },
+      "action": "accept",
+      "src": ["autogroup:member"],
+      "dst": ["autogroup:self:*"]
+    }
+  ],
+  "ssh": []
+}
@@ -57,3 +57,30 @@ ports:
 endpoints:
  - addresses:
      - "192.168.88.100"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headplane-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 3000
+      targetPort: 13000
+      name: http
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headplane-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headplane-external
+addressType: IPv4
+ports:
+  - port: 13000
+    protocol: TCP
+    name: http
+endpoints:
+  - addresses:
+      - "192.168.88.100"
@@ -1,82 +1,36 @@
 apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
+kind: Middleware
 metadata:
-  name: headscale-server-prod
+  name: headplane-prefix
  namespace: headscale
 spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.forust\.xyz$`)
-      kind: Rule
-      services:
-        - name: headscale-server-external
-          port: 8080
-  tls:
-    certResolver: letsencrypt
+  addPrefix:
+    prefix: "/admin"
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-local
+  name: headscale-prod
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`)
-      kind: Rule
-      services:
-        - name: headscale-server-external
-          port: 8080
-
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-ui-prod
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.forust\.xyz$`) && PathPrefix(`/admin`)
+    - match: Host(`hs.forust.xyz`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: headscale-server-external
+          port: 8080
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
      kind: Rule
      middlewares:
-        - name: security-chain@file
      services:
        - name: headscale-ui-external
          port: 80
-  tls:
-    certResolver: letsencrypt
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-ui-local
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/admin`)
-      kind: Rule
-      services:
-        - name: headscale-ui-external
-          port: 80
-
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: headscale-metrics-prod
-  namespace: headscale
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^hs\.forust\.xyz$`) && PathPrefix(`/metrics`)
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
      kind: Rule
+      middlewares:
      services:
        - name: headscale-server-external
          port: 9090
@@ -86,16 +40,68 @@ spec:
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-metrics-local
+  name: headplane-prod
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/metrics`)
+    - match: Host(`hp.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: Host(`hp.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 8080
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/metrics`)
      kind: Rule
      services:
        - name: headscale-server-external
          port: 9090
-
-
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headplane-local
+  namespace: headscale
+spec:
+  routes:
+    - match: Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: (Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000
@@ -19,14 +19,17 @@ services:
      # Prod Router
      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`) || Host(`www.forust.xyz`)"
      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.tls=true"
+      - "traefik.http.routers.forust-homepage.priority=10"
+      - "traefik.http.routers.forust-homepage.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`)"
      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.priority=10"
      - "traefik.http.routers.forust-homepage-local.tls=true"
      # Dev Router
      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.priority=10"
      - "traefik.http.routers.forust-homepage-dev.tls=true"
  xdfnx:
    build:
@@ -47,7 +50,6 @@ services:
      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`)"
      - "traefik.http.routers.xdfnx.entrypoints=websecure"
      - "traefik.http.routers.xdfnx.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.xdfnx.tls=true"
      # Local Router
      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`)"
      - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
@@ -1,196 +1,225 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>MrForust // XRock</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
-    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="assets/css/style.css">
-</head>
-
-<body>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" />
+    <link rel="stylesheet" href="assets/css/style.css" />
+  </head>

+  <body>
    <div class="container">
-        <header>
-            <h1 class="glitch" data-text="MrForust">Mr-Forust</h1>
-            <p class="subtitle">> CTF Player / XRock_Team / Just Signal.</p>
-        </header>
+      <header>
+        <h1 class="glitch" data-text="MrForust">Mr-Forust</h1>
+        <p class="subtitle">> CTF Player / XRock_Team / Just Signal.</p>
+      </header>

-        <hr>
+      <hr />

-        <section id="socials">
-            <h2>./socials</h2>
-            <ul class="link-list">
-                <li>
-                    <i class="fab fa-github"></i>
-                    <a href="https://github.com/mr-forust" target="_blank">github/mr-forust</a>
-                </li>
-                <li>
-                    <i class="fas fa-flag"></i>
-                    <a href="https://tryhackme.com/p/MrForust" target="_blank">tryhackme/MrForust</a>
-                </li>
-                <li>
-                    <i class="fab fa-telegram-plane"></i>
-                    <a href="https://t.me/MrForust" target="_blank">telegram/MrForust</a>
-                </li>
-                <li>
-                    <i class="fab fa-discord"></i>
-                    <span>discord/mr.forust</span>
-                </li>
-                <li>
-                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:contact@forust.xyz">mail/contact@forust.xyz</a>
-                </li>
-                <li>
-                    <i class="fa fa-pie-chart"></i>
-                    <a href="https://forust.xyz/glance">forust/dashboard</a>
-                </li>
-                <li>
-                    <i class="fa fa-refresh"></i>
-                    <a href="https://forust.xyz/convert">forust/converter</a>
-                </li>
-                <li>
-                    <i class="fa-solid fa-key"></i>
-                    <a href=".well-known/pgp-key.asc">security/PGP Key</a>
-                </li>
-                <li>
-                    <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
-                </li>
-            </ul>
+      <div class="grid-2">
+        <section id="contacts">
+          <h2>./contacts</h2>
+          <ul class="link-list">
+            <li>
+              <i class="fab fa-github"></i>
+              <a href="https://github.com/mr-forust" target="_blank">github/mr-forust</a>
+            </li>
+            <li>
+              <i class="fas fa-flag"></i>
+              <a href="https://tryhackme.com/p/MrForust" target="_blank">tryhackme/MrForust</a>
+            </li>
+            <li>
+              <i class="fab fa-telegram-plane"></i>
+              <a href="https://t.me/MrForust" target="_blank">telegram/MrForust</a>
+            </li>
+            <li>
+              <i class="fab fa-discord"></i>
+              <span>discord/mr.forust</span>
+            </li>
+            <li>
+              <i class="fas fa-envelope"></i>
+              <a href="mailto:contact@forust.xyz">mail/contact@forust.xyz</a>
+            </li>
+            <li>
+              <i class="fa-solid fa-key"></i>
+              <a href=".well-known/pgp-key.asc">security/PGP Key</a>
+            </li>
+            <li>
+              <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
+            </li>
+          </ul>
        </section>

-        <section id="stack">
-            <h2>./skills_and_tools</h2>
-            <div class="grid-2">
-                <div>
-                    <div class="skill-item">
-                        <span>ArchLinux # btw</span>
-                        <span class="level">[#######...]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Kubernetes</span> <span class="level">[###.......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Docker</span> <span class="level">[####......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Docker Compose</span> <span class="level">[#####.....]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Web Pentest</span> <span class="level">[#####.....]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Burpsuite</span> <span class="level">[#####.....]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Steganography</span> <span class="level">[####......]</span>
-                    </div>
-                </div>
-                <div>
-                    <div class="skill-item">
-                        <span>Cryptography</span> <span class="level">[####......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>OSINT</span> <span class="level">[####......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Python</span> <span class="level">[###.......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>HTML</span> <span class="level">[###.......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Bash</span> <span class="level">[##........]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Golang</span> <span class="level">[#.........]</span>
-                    </div>
-                </div>
+        <section id="tools">
+          <h2>./tools</h2>
+          <ul class="link-list">
+            <li>
+              <i class="fa fa-pie-chart"></i>
+              <a href="https://forust.xyz/glance" target="_blank">forust/dashboard</a>
+              <p class="comment"># Glance dashboard</p>
+            </li>
+            <li>
+              <i class="fa fa-refresh"></i>
+              <a href="https://forust.xyz/convert" target="_blank">forust/converter</a>
+              <p class="comment"># ConvertX instance</p>
+            </li>
+            <li>
+              <i class="fa-solid fa-file-pdf"></i>
+              <a href="https://pdf.forust.xyz" target="_blank">pdf.forust.xyz</a>
+              <p class="comment"># BentoPDF instance</p>
+            </li>
+          </ul>
+        </section>
+      </div>
+
+      <section id="stack">
+        <h2>./skills</h2>
+        <div class="grid-2">
+          <div>
+            <div class="skill-item">
+              <span>ArchLinux # btw</span>
+              <span class="level">[#######...]</span>
            </div>
-        </section>
-
-        <section id="team">
-            <h2>./xrock_team</h2>
-            <p class="comment"># It's a select caste. Cybershamans. Cryptoanarchists. Shadows on the net..</p>
-
-            <div class="team-grid">
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/mrforust.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://github.com/mr-forust" target="_blank">MrForust</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/anna.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="./assets/images/love.png" target="_blank">Anna~</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/chernuha.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://chernuha.space" target="_blank">Chernuha</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/hudan.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://hudan.xyz" target="_blank">p1ngvi</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/xdfnx.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://xdfnx.cfd" target="_blank">xdfnx</a>
-                </div>
+            <div class="skill-item"><span>Kubernetes</span> <span class="level">[###.......]</span></div>
+            <div class="skill-item"><span>Docker</span> <span class="level">[####......]</span></div>
+            <div class="skill-item">
+              <span>Docker Compose</span>
+              <span class="level">[#####.....]</span>
            </div>
-        </section>
+            <div class="skill-item"><span>Web Pentest</span> <span class="level">[#####.....]</span></div>
+            <div class="skill-item"><span>Burpsuite</span> <span class="level">[#####.....]</span></div>
+            <div class="skill-item"><span>Steganography</span> <span class="level">[####......]</span></div>
+          </div>
+          <div>
+            <div class="skill-item"><span>Cryptography</span> <span class="level">[####......]</span></div>
+            <div class="skill-item"><span>OSINT</span> <span class="level">[####......]</span></div>
+            <div class="skill-item"><span>Python</span> <span class="level">[###.......]</span></div>
+            <div class="skill-item"><span>HTML</span> <span class="level">[###.......]</span></div>
+            <div class="skill-item"><span>Bash</span> <span class="level">[##........]</span></div>
+            <div class="skill-item"><span>Golang</span> <span class="level">[#.........]</span></div>
+          </div>
+        </div>
+      </section>

-        <section id="repos">
-            <h2>./favorite_repos</h2>
-            <ul class="repo-list">
-                <li>
-                    <a href="https://github.com/TDesktop-x64/tdesktop" target="_blank">TDesktop-x64/tdesktop</a>
-                    <span class="comment">// unofficial telegram client with some additions</span>
-                </li>
-                <li>
-                    <a href="https://github.com/traefik/traefik" target="_blank">traefik/traefik</a>
-                    <span class="comment">// beloved reverse-proxy</span>
-                </li>
-                <li>
-                    <a href="https://github.com/unhappychoice/gitlogue" target="_blank">unhappychoice/gitlogue</a>
-                    <span class="comment">// nice git log visualizer</span>
-                </li>
-                <li>
-                    <a href="https://github.com/mountain-loop/yaak" target="_blank">mountain-loop/yaak</a>
-                    <span class="comment">// modern, fancy api client</span>
-                </li>
-                <li>
-                    <a href="https://github.com/pear-devs/pear-desktop" target="_blank">pear-devs/pear-desktop</a>
-                    <span class="comment">// music client with a lot of features</span>
-                </li>
-                <li>
-                    <a href="https://github.com/epi052/feroxbuster" target="_blank">epi052/feroxbuster</a>
-                    <span class="comment">// directory discovery</span>
-                </li>
-            </ul>
-        </section>
+      <section id="team">
+        <h2>./xrock_team</h2>
+        <p class="comment"># It's a select caste. Cybershamans. Cryptoanarchists. Shadows on the net..</p>

-        <footer>
-            <p>root@xrock:~$ cat <a href="miku.html">./miku</a></p>
-            <p>miku?</p>
-            <p>root@xrock:~$ shutdown -h now</p>
-            <p>&copy; XRock - Just Signal.</p>
-        </footer>
+        <div class="team-grid">
+          <div class="member">
+            <div
+              class="avatar"
+              style="
+                background-image: url(&quot;assets/images/team/mrforust.jpg&quot;);
+                background-size: cover;
+                background-position: center;
+              "
+            ></div>
+            <a href="https://github.com/mr-forust" target="_blank">MrForust</a>
+          </div>
+
+          <div class="member">
+            <div
+              class="avatar"
+              style="
+                background-image: url(&quot;assets/images/team/anna.jpg&quot;);
+                background-size: cover;
+                background-position: center;
+              "
+            ></div>
+            <a href="./assets/images/love.png" target="_blank">Anna~</a>
+          </div>
+
+          <div class="member">
+            <div
+              class="avatar"
+              style="
+                background-image: url(&quot;assets/images/team/chernuha.jpg&quot;);
+                background-size: cover;
+                background-position: center;
+              "
+            ></div>
+            <a href="https://chernuha.space" target="_blank">Chernuha</a>
+          </div>
+
+          <div class="member">
+            <div
+              class="avatar"
+              style="
+                background-image: url(&quot;assets/images/team/hudan.jpg&quot;);
+                background-size: cover;
+                background-position: center;
+              "
+            ></div>
+            <a href="https://hudan.xyz" target="_blank">p1ngvi</a>
+          </div>
+
+          <div class="member">
+            <div
+              class="avatar"
+              style="
+                background-image: url(&quot;assets/images/team/xdfnx.jpg&quot;);
+                background-size: cover;
+                background-position: center;
+              "
+            ></div>
+            <a href="https://xdfnx.cfd" target="_blank">xdfnx</a>
+          </div>
+        </div>
+      </section>
+
+      <section id="projects">
+        <h2>./projects</h2>
+        <ul class="repo-list">
+          <li>
+            <a href="https://gitea.forust.xyz/forust/gosleep" target="_blank">forust/gosleep</a>
+            <span class="comment">// linux sleep timer written in rust (originally in go)</span>
+          </li>
+        </ul>
+      </section>
+
+      <section id="repos">
+        <h2>./favorite_repos</h2>
+        <ul class="repo-list">
+          <li>
+            <a href="https://github.com/TDesktop-x64/tdesktop" target="_blank">TDesktop-x64/tdesktop</a>
+            <span class="comment">// unofficial telegram client with some additions</span>
+          </li>
+          <li>
+            <a href="https://github.com/traefik/traefik" target="_blank">traefik/traefik</a>
+            <span class="comment">// beloved reverse-proxy</span>
+          </li>
+          <li>
+            <a href="https://github.com/unhappychoice/gitlogue" target="_blank">unhappychoice/gitlogue</a>
+            <span class="comment">// nice git log visualizer</span>
+          </li>
+          <li>
+            <a href="https://github.com/tstack/lnav" target="_blank">tstack/lnav</a>
+            <span class="comment">// powerful log reader</span>
+          </li>
+          <li>
+            <a href="https://github.com/mountain-loop/yaak" target="_blank">mountain-loop/yaak</a>
+            <span class="comment">// modern, fancy api client</span>
+          </li>
+          <li>
+            <a href="https://github.com/pear-devs/pear-desktop" target="_blank">pear-devs/pear-desktop</a>
+            <span class="comment">// music client with a lot of features</span>
+          </li>
+          <li>
+            <a href="https://github.com/epi052/feroxbuster" target="_blank">epi052/feroxbuster</a>
+            <span class="comment">// directory discovery</span>
+          </li>
+        </ul>
+      </section>
+
+      <footer>
+        <p>root@xrock:~$ cat <a href="miku.html">./miku</a></p>
+        <p>miku?</p>
+        <p>root@xrock:~$ shutdown -h now</p>
+        <p>&copy; XRock - Just Signal.</p>
+      </footer>
    </div>
-
-</body>
-
-</html>
+  </body>
+</html>
@@ -28,6 +28,7 @@ spec:
      containers:
        - name: forust-homepage
          image: gcr.forust.xyz/forust/forust-homepage:latest
+          imagePullPolicy: Always
          ports:
            - containerPort: 80
          resources:
@@ -68,6 +69,7 @@ spec:
      containers:
        - name: xdfnx-homepage
          image: gcr.forust.xyz/forust/xdfnx-homepage:latest
+          imagePullPolicy: Always
          ports:
            - containerPort: 80
          resources:
@@ -7,8 +7,10 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^(forust\.xyz|www\.forust\.xyz)$`)
+    - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
      kind: Rule
+      middlewares:
+      priority: 10
      services:
        - name: forust-homepage-service
          port: 80
@@ -24,8 +26,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^landing\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`landing.workstation.internal`) || Host(`landing.gigaforust.internal`)
      kind: Rule
+      priority: 10
      services:
        - name: forust-homepage-service
          port: 80
@@ -39,8 +42,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^(xdfnx\.cfd|www\.xdfnx\.cfd)$`)
+    - match: Host(`xdfnx.cfd`)
      kind: Rule
+      middlewares:
      services:
        - name: xdfnx-homepage-service
          port: 80
@@ -56,9 +60,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^xdfnx\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`xdfnx.workstation.internal`) || Host(`xdfnx.gigaforust.internal`)
      kind: Rule
      services:
        - name: xdfnx-homepage-service
          port: 80
-
@@ -23,7 +23,7 @@ services:
      # Prod Router
      - "traefik.http.routers.kener.rule=Host(`status.forust.xyz`)"
      - "traefik.http.routers.kener.entrypoints=websecure"
-      - "traefik.http.routers.kener.tls=true"
+      - "traefik.http.routers.kener.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.kener-local.rule=Host(`status.workstation.internal`)"
      - "traefik.http.routers.kener-local.entrypoints=websecure"
@@ -42,7 +42,7 @@ services:
    volumes:
      - redis:/data
    healthcheck:
-      test: [ "CMD", "redis-cli", "ping" ]
+      test: ["CMD", "redis-cli", "ping"]
      interval: 6s
      timeout: 5s
      retries: 5
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^status\.forust\.xyz$`)
+    - match: Host(`status.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: kener-service
          port: 3000
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^status\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`status.workstation.internal`) || Host(`status.gigaforust.internal`)
      kind: Rule
      services:
        - name: kener-service
          port: 3000
-
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: kener
-          image: rajnandan1/kener:4.0.23
+          image: rajnandan1/kener:4.1.0
          envFrom:
            - configMapRef:
                name: kener-config
@@ -20,7 +20,7 @@ services:
      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
      - "traefik.http.routers.metube.entrypoints=websecure"
      - "traefik.http.routers.metube.middlewares=security-chain@file"
-      - "traefik.http.routers.metube.tls=true"
+      - "traefik.http.routers.metube.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`)"
      - "traefik.http.routers.metube-local.entrypoints=websecure"
@@ -7,7 +7,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^metube\.forust\.xyz$`)
+    - match: Host(`metube.forust.xyz`)
      kind: Rule
      middlewares:
        - name: security-headers@file
@@ -26,9 +26,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^metube\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`metube.workstation.internal`) || Host(`metube.gigaforust.internal`)
      kind: Rule
      services:
        - name: metube-service
          port: 8081
-
@@ -32,7 +32,7 @@ services:
      # Prod Router
      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
-      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`)"
      - "traefik.http.routers.n8n-local.entrypoints=websecure"
@@ -54,4 +54,4 @@ networks:

 volumes:
  node-data:
-  files:
+  files:
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^n8n\.forust\.xyz$`)
+    - match: Host(`n8n.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: n8n-service
          port: 5678
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^n8n\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`n8n.workstation.internal`) || Host(`n8n.gigaforust.internal`)
      kind: Rule
      services:
        - name: n8n-service
          port: 5678
-
@@ -16,7 +16,7 @@ services:
      # Prod Router
      - "traefik.http.routers.netronome.rule=Host(`nm.forust.xyz`)"
      - "traefik.http.routers.netronome.entrypoints=websecure"
-      - "traefik.http.routers.netronome.tls=true"
+      - "traefik.http.routers.netronome.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.netronome-local.rule=Host(`nm.workstation.internal`)"
      - "traefik.http.routers.netronome-local.entrypoints=websecure"
@@ -41,7 +41,7 @@ services:
    volumes:
      - data:/var/lib/postgresql/data
    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -U netronome" ]
+      test: ["CMD-SHELL", "pg_isready -U netronome"]
      interval: 5s
      timeout: 5s
      retries: 5
@@ -51,7 +51,6 @@ services:
 volumes:
  data:

-
 networks:
  proxy:
    external: true
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^nm\.forust\.xyz$`)
+    - match: Host(`nm.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: netronome-service
          port: 7575
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^nm\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`nm.workstation.internal`) || Host(`nm.gigaforust.internal`)
      kind: Rule
      services:
        - name: netronome-service
          port: 7575
-
@@ -5,7 +5,7 @@ services:
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer # Do not change
    volumes:
-      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup) 
+      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup)
      - /var/run/docker.sock:/var/run/docker.sock
      - /dev/dri:/dev/dri
    ports:
@@ -25,7 +25,7 @@ services:
      # - "traefik.http.routers.nextcloud-aio.rule=Host(`naio.forust.xyz`)"
      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
      # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
-      # - "traefik.http.routers.nextcloud-aio.tls=true"
+      # - "traefik.http.routers.nextcloud-aio.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`)"
      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
@@ -8,7 +8,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^nextcloud\.forust\.xyz$`)
+    - match: Host(`nextcloud.forust.xyz`)
      kind: Rule
      middlewares:
        - name: nextcloud-chain@file
@@ -27,34 +27,33 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^nextcloud\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`nextcloud.workstation.internal`) || Host(`nextcloud.gigaforust.internal`)
      kind: Rule
      middlewares:
        - name: nextcloud-chain@file
      services:
        - name: nextcloud-apache
          port: 11000
-
---
+# ---
 # Nextcloud AIO
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: naio-prod
-  namespace: nextcloud
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`^naio\.forust\.xyz$`)
-      kind: Rule
-      services:
-        - name: nextcloud-aio
-          port: 8888
-          scheme: https
-          serversTransport: insecure-transport # <-- Ссылка на ваш CRD ресурс вместо @file
-  tls:
-    certResolver: letsencrypt
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: naio-prod
+#   namespace: nextcloud
+# spec:
+#   entryPoints:
+# - websecure
+# routes:
+#   - match: Host(`naio.forust.xyz`)
+#     kind: Rule
+#     services:
+#       - name: nextcloud-aio
+#         port: 8888
+#         scheme: https
+#         serversTransport: insecure-transport
+# tls:
+#   certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -65,11 +64,10 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^naio\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`naio.workstation.internal`) || Host(`naio.gigaforust.internal`)
      kind: Rule
      services:
        - name: nextcloud-aio
          port: 8888
          scheme: https
          serversTransport: insecure-transport
-
@@ -107,7 +107,7 @@ services:
      # Prod Router
      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
      - "traefik.http.routers.penpot.entrypoints=websecure"
-      - "traefik.http.routers.penpot.tls=true"
+      - "traefik.http.routers.penpot.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`)"
      - "traefik.http.routers.penpot-local.entrypoints=websecure"
@@ -117,7 +117,7 @@ services:
      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
      - "traefik.http.routers.penpot-dev.tls=true"
    environment:
-      <<: [ *penpot-flags, *penpot-http-body-size ]
+      <<: [*penpot-flags, *penpot-http-body-size]
  penpot-backend:
    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
    restart: always
@@ -137,7 +137,7 @@ services:
    ## Configuration envronment variables for the backend container.

    environment:
-      <<: [ *penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key ]
+      <<: [*penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key]

      ## The PREPL host. Mainly used for external programatic access to penpot backend
      ## (example: admin). By default it will listen on `localhost` but if you are going to use
@@ -200,7 +200,7 @@ services:
      - penpot

    environment:
-      <<: [ *penpot-secret-key ]
+      <<: [*penpot-secret-key]
      # Don't touch it; this uses an internal docker network to
      # communicate with the frontend.
      PENPOT_PUBLIC_URI: http://penpot-frontend:8080
@@ -214,7 +214,7 @@ services:
    stop_signal: SIGINT

    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -U penpot" ]
+      test: ["CMD-SHELL", "pg_isready -U penpot"]
      interval: 2s
      timeout: 10s
      retries: 5
@@ -237,7 +237,7 @@ services:
    restart: always

    healthcheck:
-      test: [ "CMD-SHELL", "valkey-cli ping | grep PONG" ]
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
      interval: 1s
      timeout: 3s
      retries: 5
@@ -16,7 +16,7 @@ services:
      # Prod Router
      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
-      - "traefik.http.routers.portainer.tls=true"
+      - "traefik.http.routers.portainer.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`)"
      - "traefik.http.routers.portainer-local.entrypoints=websecure"
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^portainer\.forust\.xyz$`)
+    - match: Host(`portainer.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: portainer-service
          port: 9000
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^portainer\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`portainer.workstation.internal`) || Host(`portainer.gigaforust.internal`)
      kind: Rule
      services:
        - name: portainer-service
          port: 9000
-
@@ -0,0 +1,2 @@
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=changeme
@@ -0,0 +1,5 @@
+route:
+  receiver: default
+
+receivers:
+  - name: default
@@ -0,0 +1,66 @@
+services:
+  grafana:
+    image: grafana/grafana:11.6.0
+    container_name: prometheus-grafana
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?grafana admin password required}
+    volumes:
+      - grafana-data:/var/lib/grafana
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.prometheus-grafana.loadbalancer.server.port=3000"
+
+      # Prod Router
+      - "traefik.http.routers.grafana.rule=Host(`grafana.forust.xyz`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls=true"
+      # Local Router
+      - "traefik.http.routers.grafana-local.rule=Host(`grafana.workstation.internal`)"
+      - "traefik.http.routers.grafana-local.entrypoints=websecure"
+      - "traefik.http.routers.grafana-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.grafana-dev.rule=Host(`grafana.gigaforust.internal`)"
+      - "traefik.http.routers.grafana-dev.entrypoints=websecure"
+      - "traefik.http.routers.grafana-dev.tls=true"
+    networks:
+      - proxy
+
+  prometheus:
+    image: prom/prometheus:v3.2.1
+    container_name: prometheus-prometheus
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yaml"
+      - "--storage.tsdb.path=/prometheus"
+      - "--storage.tsdb.retention.time=90d"
+    volumes:
+      - prometheus-data:/prometheus
+      - ./prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
+    networks:
+      - proxy
+
+  alertmanager:
+    image: prom/alertmanager:v0.28.1
+    container_name: prometheus-alertmanager
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/alertmanager/alertmanager.yaml"
+      - "--storage.path=/alertmanager"
+    volumes:
+      - alertmanager-data:/alertmanager
+      - ./alertmanager.yaml:/etc/alertmanager/alertmanager.yaml:ro
+    networks:
+      - proxy
+
+volumes:
+  grafana-data:
+  prometheus-data:
+  alertmanager-data:
+
+networks:
+  proxy:
+    external: true
@@ -0,0 +1,52 @@
+grafana:
+  grafana.ini:
+    server:
+      domain: grafana.forust.xyz
+      root_url: https://grafana.forust.xyz
+    auth.anonymous:
+      enabled: false
+    users:
+      allow_sign_up: false
+  admin:
+    existingSecret: grafana-admin
+    userKey: admin-user
+    passwordKey: admin-password
+
+  persistence:
+    enabled: true
+    size: 10Gi
+
+  ingress:
+    enabled: false
+
+  service:
+    port: 80
+
+prometheus:
+  prometheusSpec:
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: "local-path"
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 40Gi
+    resources:
+      requests:
+        memory: "700Mi"
+        cpu: 200m
+      limits:
+        memory: "2Gi"
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+
+          resources:
+            requests:
+              storage: 20Gi
@@ -0,0 +1,35 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: grafana-prod
+  namespace: prometheus
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`grafana.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "security-chain@file"
+      services:
+        - name: prometheus-stack-grafana
+          port: 80
+  tls:
+    certResolver: letsencrypt
+    domains:
+      - main: grafana.forust.xyz
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: grafana-local
+  namespace: prometheus
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`grafana.workstation.internal`) || Host(`grafana.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: prometheus-stack-grafana
+          port: 80
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prometheus
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: prometheus
+type: Opaque
+stringData:
+  admin-user: "admin"
+  admin-password: ""
@@ -0,0 +1,8 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:9090"]
@@ -0,0 +1,4 @@
+{
+  "venvPath": "/home/forust/homelab/userbot",
+  "venv": ".venv"
+}
@@ -0,0 +1,11 @@
+target-version = "py311"
+line-length = 120
+
+[lint]
+select = ["E", "F", "W", "I", "N", "UP", "S", "B", "A", "C4", "SIM", "ARG"]
+ignore = ["E501", "S101"]
+
+[format]
+quote-style = "single"
+indent-style = "space"
+line-ending = "lf"
@@ -6,15 +6,15 @@ services:
    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-latest}
    restart: unless-stopped
    # ports:
-      # - ${SEARXNG_PORT:-8080}
+    # - ${SEARXNG_PORT:-8080}
    env_file: .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.searxng.loadbalancer.server.port=8080"
      # Prod Router
-      - "traefik.http.routers.searxng.rule=Host(`s.forust.xyz` || `searxng.forust.xyz`)"
+      - "traefik.http.routers.searxng.rule=Host(`s.forust.xyz` || `search.forust.xyz`)"
      - "traefik.http.routers.searxng.entrypoints=websecure"
-      - "traefik.http.routers.searxng.tls=true"
+      - "traefik.http.routers.searxng.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.searxng-local.rule=Host(`s.workstation.internal` || `searxng.workstation.internal`)"
      - "traefik.http.routers.searxng-local.entrypoints=websecure"
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^(s|searxng)\.forust\.xyz$`)
+    - match: Host(`s.forust.xyz`) || Host(`search.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: searxng-service
          port: 8080
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^(s|searxng)\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`s.workstation.internal`) || Host(`searxng.workstation.internal`) || Host(`s.gigaforust.internal`) || Host(`searxng.gigaforust.internal`)
      kind: Rule
      services:
        - name: searxng-service
          port: 8080
-
@@ -16,7 +16,7 @@ services:
      # Prod Router
      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
      - "traefik.http.routers.termix.entrypoints=websecure"
-      - "traefik.http.routers.termix.tls=true"
+      - "traefik.http.routers.termix.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`)"
      - "traefik.http.routers.termix-local.entrypoints=websecure"
@@ -31,4 +31,4 @@ networks:
  proxy:
    external: true
 volumes:
-  data:
+  data:
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^termix\.forust\.xyz$`)
+    - match: Host(`termix.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: termix-service
          port: 8080
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^termix\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`termix.workstation.internal`) || Host(`termix.gigaforust.internal`)
      kind: Rule
      services:
        - name: termix-service
          port: 8080
-
@@ -32,7 +32,7 @@ services:
      # # STAGING
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"

-      # Cloudflare 
+      # Cloudflare
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
      # Logging
@@ -49,7 +49,7 @@ services:
      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard.middlewares=security-chain@file"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
-      - "traefik.http.routers.traefik-dashboard.tls=true"
+      - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`)"
      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
@@ -1,4 +1,4 @@
 http:
  serversTransports:
    insecureTransport:
-      insecureSkipVerify: true
+      insecureSkipVerify: true
@@ -8,7 +8,8 @@ http:
      service: nextcloud
      middlewares:
        - nextcloud-chain
-      tls: {}
+      tls:
+        certresolver: letsencrypt

    # Nextcloud dev
    nextcloud-local:
@@ -0,0 +1,23 @@
+http:
+  routers:
+    fs1-public:
+      rule: "Host(`fs1.domain.xyz`)"
+      entrypoints:
+        - websecure
+      service: fs1
+      middlewares:
+        - security-chain@file
+      tls: {}
+
+    fs1-workstation:
+      rule: "Host(`fs1.workstation.internal`)"
+      entrypoints:
+        - websecure
+      service: fs1
+      tls: {}
+      
+  services:
+    fs1:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:3923" # Copyparty port example
@@ -8,8 +8,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^traefik\.forust\.xyz$`)
+    - match: Host(`traefik.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: api@internal
          kind: TraefikService
@@ -25,9 +26,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^traefik\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`traefik.workstation.internal`) || Host(`traefik.gigaforust.internal`)
      kind: Rule
      services:
        - name: api@internal
          kind: TraefikService
-
@@ -50,7 +50,7 @@ data:
              - security-headers@file
        authentik:
          forwardAuth:
-            address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+            address: "http://authentik-server-service.authentik.svc:9000/outpost.goauthentik.io/auth/traefik"
            trustForwardHeader: true
            maxResponseBodySize: 1048576
            authResponseHeaders:
@@ -1,5 +1,9 @@
 # Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml
 hostNetwork: false
+image:
+  registry: docker.io/library
+  repository: traefik
+  tag: v3.7.6

 securityContext:
  capabilities:
@@ -13,6 +17,8 @@ service:
  type: LoadBalancer
  annotations:
    metallb.io/loadBalancerIPs: "192.168.80.2"
+  spec:
+    externalTrafficPolicy: Local
 api:
  dashboard: true
  insecure: true
@@ -21,16 +27,7 @@ updateStrategy:
  type: Recreate

 deployment:
-  initContainers:
-    - name: volume-permissions
-      image: busybox:latest
-      command:
-        - sh
-        - -c
-        - "mkdir -p /data/letsencrypt && touch /data/letsencrypt/acme.json && chmod 600 /data/letsencrypt/acme.json"
-      volumeMounts:
-        - name: data
-          mountPath: /data
+  enabled: true

 providers:
  kubernetesIngress:
@@ -75,12 +72,22 @@ ports:
    protocol: UDP
    expose:
      default: true
-  dot:
-    port: 853
-    exposedPort: 853
+  metrics:
+    port: 9100
+    exposedPort: 9100
    protocol: TCP
    expose:
-      default: true
+      default: false
+
+metrics:
+  prometheus:
+    enabled: true
+    entryPoint: metrics
+    serviceMonitor:
+      enabled: true
+      additionalLabels:
+        release: prometheus-stack
+      namespace: prometheus

 ingressRoute:
  dashboard:
@@ -111,14 +118,15 @@ volumes:
  - name: traefik-dynamic
    mountPath: /etc/traefik/dynamic
    type: configMap
-
 additionalArguments:
  - "--providers.file.directory=/etc/traefik/dynamic"
  - "--providers.file.watch=true"
+  - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
+  - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"

-logs:
-  general:
-    level: INFO
-    format: json
-  access:
-    enabled: true
+log:
+  level: INFO
+accessLog:
+  enabled: true
+  format: common
@@ -14,7 +14,7 @@ services:
      # Prod Router
      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
      - "traefik.http.routers.uptime-kuma.entrypoints=websecure"
-      - "traefik.http.routers.uptime-kuma.tls=true"
+      - "traefik.http.routers.uptime-kuma.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.uptime-kuma-local.rule=Host(`uptime.workstation.internal`)"
      - "traefik.http.routers.uptime-kuma-local.entrypoints=websecure"
@@ -29,4 +29,4 @@ volumes:
  data:
 networks:
  proxy:
-    external: true
+    external: true
@@ -7,8 +7,9 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^uptime\.forust\.xyz$`)
+    - match: Host(`uptime.forust.xyz`)
      kind: Rule
+      middlewares:
      services:
        - name: uptime-kuma-service
          port: 3001
@@ -24,9 +25,8 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: HostRegexp(`^uptime\.(workstation|gigaforust)\.internal$`)
+    - match: Host(`uptime.workstation.internal`) || Host(`uptime.gigaforust.internal`)
      kind: Rule
      services:
        - name: uptime-kuma-service
          port: 3001
-
@@ -2,13 +2,7 @@
  "name": "Moon-userbot",
  "description": "A Simple, Fast, Customizable, Ai powered Userbot for Telegram with most easiest installation.",
  "logo": "https://camo.githubusercontent.com/1efdfa6416b3cd08471d865ca9ebf0fbdd38602ea95425f18a9bec6aeeefe49b/68747470733a2f2f74656c656772612e70682f66696c652f3063333763326662306631393463633163303334342e6a7067",
-  "keywords": [
-    "telegram",
-    "Moon-userbot",
-    "bot",
-    "python",
-    "pyrogram"
-  ],
+  "keywords": ["telegram", "Moon-userbot", "bot", "python", "pyrogram"],
  "env": {
    "API_ID": {
      "description": "Get it from my.telegram.org",
@@ -3,10 +3,10 @@ from flask import Flask
 app = Flask(__name__)


-@app.route("/")
+@app.route('/')
 def hello_world():
-    return "This is Moon"
+    return 'This is Moon'


-if __name__ == "__main__":
+if __name__ == '__main__':
    app.run()
--- a/Show More
+++ b/Show More