Merge branch 'main' into optimize/userbot

updated traefik to v3.7,
resolved maxResponseBodySize not set
2026-05-25 01:48:31 +02:00 · 2026-05-25 01:47:59 +02:00 · 2026-05-25 01:43:46 +02:00 · 2026-05-21 22:14:29 +02:00 · 2026-05-21 22:12:33 +02:00 · 2026-05-21 21:34:40 +02:00
56 changed files with 1478 additions and 340 deletions
@@ -0,0 +1,39 @@
+name: Deploy to Server
+run-name: Deploying to ${{ runner.os}} server on ${{ gitea.ref }}
+on:
+  push:
+    branches:
+      - main
+      - ci/gitea-actions
+jobs:
+  deploy:
+    runs-on: prod
+    steps:
+      - name: Fetch and Diff Analysis
+        id: diff
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git fetch origin main
+          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
+          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
+          echo "Changed dirs: $CHANGES"
+
+      - name: Sync Server Files
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git reset --hard origin/main
+          echo "Server files synced with origin/main"
+
+      - name: Deploy Services
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          for dir in ${{ steps.diff.outputs.dirs }}; do
+            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
+              echo ">>> Deploying $dir"
+              cd "$dir"
+              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
+              cd ..
+            else
+              echo ">>> Skipping $dir: no compose file found"
+            fi
+          done
@@ -0,0 +1,41 @@
+## BINARY MODE, USE WITH THE GITHUB RUNNER BINARY INSTALLED ON THE SERVER
+
+name: Deploy to Server
+run-name: Deploying onto server on ${{ github.ref }}
+on:
+  push:
+    branches:
+      - main
+      - ci/actions
+jobs:
+  deploy:
+    runs-on: [prod, self-hosted]
+    steps:
+      - name: Fetch and Diff Analysis
+        id: diff
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git fetch origin main
+          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
+          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
+          echo "Changed dirs: $CHANGES"
+
+      - name: Sync Server Files
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          git reset --hard origin/main
+          echo "Server files synced with origin/main"
+
+      - name: Deploy Services
+        run: |
+          cd ${{ secrets.PROD_DIR }}
+          for dir in ${{ steps.diff.outputs.dirs }}; do
+            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
+              echo ">>> Deploying $dir"
+              cd "$dir"
+              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
+              cd ..
+            else
+              echo ">>> Skipping $dir: no compose file found"
+            fi
+          done
@@ -5,12 +5,12 @@ sync.ffs_lock
 # Copyparty
 *.hist/

-# Volumes and data directories
+# Volumes, configs and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
-adguardhome/data/*
+adguardhome/conf/*
 dockmon/data/*
 portainer/portainer_data/*
 metube/MeTube_downloads
@@ -21,6 +21,7 @@ checkmk/checkmk/*
 downtify/Downtify_downloads
 headscale/config/*
 headscale/data/*
+searxng/core-config/settings.yml

 # Steaming services files
 streaming/jellyfin/*
@@ -32,12 +33,15 @@ streaming/qbittorrent/*
 streaming/prowlarr/*

 # Homepage 
-homepages/forust_files/assets/images/team/*
 homepages/forust_files/.well-known/*

 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/dynamic/fileservers.yml
+traefik/dynamic/*.local.y*ml.*
+traefik/dynamic/*.external.y*ml
+
+
 traefik/logs/*

 # SSL Certificates
@@ -77,6 +81,8 @@ replacements.txt

 # Git
 .gitattributes
+# Gitea/github Runners
+.runner

 # Misc
 .DS_Store
@@ -11,28 +11,24 @@ services:
      # - "68:68/tcp" # DHCP
      # - "3000:3000/tcp"
    volumes:
-      - ./data/work:/opt/adguardhome/work
-      - ./data/conf:/opt/adguardhome/conf
+      - data:/opt/adguardhome/work
+      - ./conf:/opt/adguardhome/conf
      - ./certs:/certs:ro
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
      
      # Prod Router
      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
-      - "traefik.http.routers.adguard.middlewares=security-headers@file"
      - "traefik.http.routers.adguard.tls=true"
      # Local Router
      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
      - "traefik.http.routers.adguard-local.entrypoints=websecure"
-      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-local.tls=true"
      # Dev Router
      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)"
      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
-      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-dev.tls=true"
      # DoH Router
      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
@@ -45,6 +41,8 @@ services:
      - glance.description=AdGuard Home is a network-wide software for blocking ads.
    networks:
      - proxy
+volumes:
+  data:
 networks:
  proxy:
    external: true
@@ -42,26 +42,20 @@ services:
      - ./custom-templates:/templates
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"

      # Prod Router
      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
      - "traefik.http.routers.authentik-server.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
-      - "traefik.http.routers.authentik-server.service=authentik-server"
      - "traefik.http.routers.authentik-server.tls=true"
      # Local Router
-      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
-      - "traefik.http.routers.authentik-server-local.service=authentik-server"
      - "traefik.http.routers.authentik-server-local.tls=true"
      # Dev Router
      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
      - "traefik.http.routers.authentik-server-dev.tls=true"
    networks:
      - proxy
@@ -0,0 +1,15 @@
+CLOUDFLARE_API_TOKEN=YOUR_CLOUDFLARE_API_TOKEN
+DOMAINS=example.com,dns.example.com,mc.example.com,auth.example.com,ssh.example.com
+IP4_DOMAINS=
+IP6_DOMAINS=
+IP4_PROVIDER=cloudflare.trace
+IP6_PROVIDER=none # change if you want to update AAAA
+UPDATE_CRON=@every 5m
+UPDATE_ON_START=true
+DELETE_ON_STOP=false
+DELETE_ON_FAILURE=true
+TTL=1
+PROXIED=!is(dns.example.com) && !is(mc.example.com) && !is(ssh.example.com)
+EMOJI=true
+UPTIMEKUMA=https://uptime-kuma.example.com/api/push/AsaSDFGFkfklaFALSKffkfFKfkfkfkFK?status=up&msg=OK&ping=
+REJECT_CLOUDFLARE_IPS=true
@@ -6,8 +6,25 @@ services:
    security_opt:
      - no-new-privileges:true
    network_mode: 'host'
+    # https://github.com/timothymiller/cloudflare-ddns#-quick-start
    environment:
-      - PUID=1000
-      - PGID=1000
-    volumes:
-      - ./config.json:/config.json
+      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?Cloudflare API token is required}
+      - DOMAINS=${DOMAINS:-}
+      - IP4_DOMAINS=${IP4_DOMAINS:-}
+      - IP6_DOMAINS=${IP6_DOMAINS:-}
+      - IP4_PROVIDER=${IP4_PROVIDER:-cloudflare.trace}
+      - IP6_PROVIDER=${IP6_PROVIDER:-none}
+      - UPDATE_CRON=${UPDATE_CRON:-@every 5m}
+      - UPDATE_ON_START=${UPDATE_ON_START:-true}
+      - DELETE_ON_STOP=${DELETE_ON_STOP:-false}
+      - DELETE_ON_FAILURE=${DELETE_ON_FAILURE:-true}
+      - TTL=${TTL:-1} # 1=auto
+      # to proxy only "dns.example.com" and "wfs.example.com" use "!is(dns.domain.com) && !is (wfs.domain.com)"
+      - PROXIED=${PROXIED:-true}
+      - EMOJI=${EMOJI:-true}
+      - UPTIMEKUMA=${UPTIMEKUMA:-}
+      - HEALTHCHECKS=${HEALTHCHECKS:-}
+      - REJECT_CLOUDFLARE_IPS=${REJECT_CLOUDFLARE_IPS:-true}
+      # volumes:
+      # Prefer using environment variables for configuration, config.json legacy support
+      # - ./config.json:/config.json
@@ -16,22 +16,18 @@ services:
      - TZ=${TZ:-Etc/UTC}
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.checkmk.loadbalancer.server.port=5000"

      # Prod Router
      - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
      - "traefik.http.routers.checkmk.entrypoints=websecure"
-      - "traefik.http.routers.checkmk.middlewares=security-headers@file"
      - "traefik.http.routers.checkmk.tls=true"
      # Local Router
      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
      - "traefik.http.routers.checkmk-local.entrypoints=websecure"
-      - "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
      - "traefik.http.routers.checkmk-local.tls=true"
      # Dev Router
      - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
-      - "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
      - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
      - "traefik.http.routers.checkmk-dev.tls=true"
    networks:
@@ -15,7 +15,6 @@ services:
         retries: 3
      labels:
         - "traefik.enable=true"
-         - "traefik.docker.network=proxy"
         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
@@ -24,17 +23,14 @@ services:
         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
         - "traefik.http.routers.dockmon.entrypoints=websecure"
         - "traefik.http.routers.dockmon.middlewares=security-chain@file"
-         - "traefik.http.routers.dockmon.service=dockmon"
         - "traefik.http.routers.dockmon.tls=true"
         # Local Router
         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
         - "traefik.http.routers.dockmon-local.tls=true"
         # Dev Router
         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
         - "traefik.http.routers.dockmon-dev.tls=true"

         # Glance Metadata
@@ -2,30 +2,28 @@ services:
  downtify:
    container_name: downtify
    image: ghcr.io/henriquesebastiao/downtify:latest
+    restart: unless-stopped
    # ports:
    #   - '7077:8000'
    volumes:
      - ./Downtify_downloads:/downloads
    labels:
-      - traefik.enable=true
-      - traefik.docker.network=proxy
-      - traefik.http.services.downtify.loadbalancer.server.port=8000
+      - "traefik.enable=true"
+      - "traefik.http.services.downtify.loadbalancer.server.port=8000"

      # Prod Router 
-      - traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
-      - traefik.http.routers.downtify.entrypoints=websecure
-      - traefik.http.routers.downtify.middlewares=security-chain@file
-      - traefik.http.routers.downtify.tls=true
+      - "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
+      - "traefik.http.routers.downtify.entrypoints=websecure"
+      - "traefik.http.routers.downtify.middlewares=security-chain@file"
+      - "traefik.http.routers.downtify.tls=true"
      # Local Router
-      - traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
-      - traefik.http.routers.downtify-local.entrypoints=websecure
-      - traefik.http.routers.downtify-local.middlewares=security-headers@file
-      - traefik.http.routers.downtify-local.tls=true
+      - "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
+      - "traefik.http.routers.downtify-local.entrypoints=websecure"
+      - "traefik.http.routers.downtify-local.tls=true"
      # Dev Router
-      - traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
-      - traefik.http.routers.downtify-dev.entrypoints=websecure
-      - traefik.http.routers.downtify-dev.middlewares=security-chain@file
-      - traefik.http.routers.downtify-dev.tls=true
+      - "traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)"
+      - "traefik.http.routers.downtify-dev.entrypoints=websecure"
+      - "traefik.http.routers.downtify-dev.tls=true"
    networks:
      - proxy
 networks:
@@ -9,11 +9,10 @@ services:
      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.services.errorpage.loadbalancer.server.port=80"
+      - "traefik.http.services.error-pages.loadbalancer.server.port=80"
      # Error handler middleware
      - "traefik.http.middlewares.error-pages.errors.status=400-599"
-      - "traefik.http.middlewares.error-pages.errors.service=errorpage"
+      - "traefik.http.middlewares.error-pages.errors.service=error-pages"
      - "traefik.http.middlewares.error-pages.errors.query=/{status}.html"
 networks:
  proxy:
@@ -7,7 +7,175 @@
    <title>403 // Forbidden</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="style.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
 </head>

 <body>
@@ -24,7 +192,7 @@
            <h2>./error_message</h2>
            <p>You do not have permission to access this resource.</p>
            <br>
-            <p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> if you believe this is an
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> if you believe this is an
                error.</p>
        </section>

@@ -7,7 +7,175 @@
    <title>404 // Not Found</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="style.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
 </head>

 <body>
@@ -24,7 +192,7 @@
            <h2>./error_message</h2>
            <p>The page you are looking for does not exist or has been moved.</p>
            <br>
-            <p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> if you believe this is an error.</p>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> if you believe this is an error.</p>
        </section>

        <footer>
@@ -7,7 +7,175 @@
    <title>500 // Server Error</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="style.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
 </head>

 <body>
@@ -24,7 +192,7 @@
            <h2>./error_message</h2>
            <p>Something went wrong on our end. We are working to fix it.</p>
            <br>
-            <p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
        </section>

        <footer>
@@ -7,7 +7,175 @@
    <title>502 // Bad Gateway</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="style.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
 </head>

 <body>
@@ -24,7 +192,7 @@
            <h2>./error_message</h2>
            <p>The server received an invalid response from the upstream server.</p>
            <br>
-            <p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
        </section>

        <footer>
@@ -7,7 +7,175 @@
    <title>503 // Service Unavailable</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="style.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
 </head>

 <body>
@@ -24,7 +192,7 @@
            <h2>./error_message</h2>
            <p>The server is currently unable to handle the request due to maintenance or overload.</p>
            <br>
-            <p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
        </section>

        <footer>
@@ -7,7 +7,175 @@
    <title>504 // Gateway Timeout</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="style.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
 </head>

 <body>
@@ -24,7 +192,7 @@
            <h2>./error_message</h2>
            <p>The server did not receive a timely response from the upstream server.</p>
            <br>
-            <p>Check the <a href="https://uptime.forust.xyz/status/forust">System Status</a> for more information.</p>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
        </section>

        <footer>
@@ -1,167 +0,0 @@
-/* hidden in a plain sight? */
-:root {
-    --bg-color: #050505;
-    --text-color: #e0e0e0;
-    --accent: #ffffff;
-    --dim: #666666;
-    --font-mono: 'Courier New', Courier, monospace;
-}
-
-* {
-    box-sizing: border-box;
-    margin: 0;
-    padding: 0;
-}
-
-body {
-    background-color: var(--bg-color);
-    color: var(--text-color);
-    font-family: var(--font-mono);
-    line-height: 1.6;
-    font-size: 16px;
-    padding: 2rem;
-}
-
-a {
-    color: var(--text-color);
-    text-decoration: none;
-    border-bottom: 1px solid var(--dim);
-    transition: all 0.2s;
-}
-
-a:hover {
-    background-color: var(--text-color);
-    color: var(--bg-color);
-    border-color: var(--text-color);
-}
-
-.container {
-    max-width: 800px;
-    margin: 0 auto;
-}
-
-/* TEXT */
-h1 {
-    font-size: 2.5rem;
-    text-transform: uppercase;
-    letter-spacing: -2px;
-    margin-bottom: 0.5rem;
-}
-
-h2 {
-    font-size: 1.2rem;
-    margin-bottom: 1.5rem;
-    border-bottom: 1px solid var(--dim);
-    display: inline-block;
-    padding-right: 20px;
-}
-
-.subtitle {
-    color: var(--dim);
-    margin-bottom: 2rem;
-}
-
-hr {
-    border: 0;
-    border-top: 1px dashed var(--dim);
-    margin: 2rem 0;
-}
-
-.comment {
-    color: var(--dim);
-    font-size: 0.9rem;
-    margin-left: 10px;
-}
-
-/* SECTIONS */
-section {
-    margin-bottom: 3rem;
-}
-
-/* LISTS */
-ul {
-    list-style: none;
-}
-
-.link-list li {
-    margin-bottom: 0.8rem;
-    display: flex;
-    align-items: center;
-    gap: 15px;
-}
-
-/* STACK GRID */
-.grid-2 {
-    display: grid;
-    grid-template-columns: 1fr 1fr;
-    gap: 2rem;
-}
-
-.skill-item {
-    display: flex;
-    justify-content: space-between;
-    margin-bottom: 0.5rem;
-}
-
-.level {
-    font-weight: bold;
-}
-
-.special .level {
-    color: var(--text-color);
-    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
-}
-
-/* my dudes */
-.team-grid {
-    display: flex;
-    gap: 2rem;
-    flex-wrap: wrap;
-    margin-top: 1rem;
-}
-
-.member {
-    text-align: center;
-    width: 100px;
-}
-
-.avatar {
-    width: 80px;
-    height: 80px;
-    background-color: #222;
-    border: 2px solid var(--text-color);
-    margin: 0 auto 10px auto;
-    background-size: cover;
-}
-
-/* if no avatar added: */
-.placeholder::before {
-    content: "?";
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    height: 100%;
-    font-size: 2rem;
-    color: var(--dim);
-}
-
-/* REPOS */
-.repo-list li {
-    margin-bottom: 1rem;
-}
-
-/* FOOTER */
-footer {
-    text-align: center;
-    color: var(--dim);
-    font-size: 0.8rem;
-/* flag{why-are-you-here?} */
-    margin-top: 4rem;
-}
-/* SMTH RESPONSIVE */
-@media (max-width: 600px) {
-    .grid-2 {
-        grid-template-columns: 1fr;
-        gap: 0;
-    }
-}
@@ -1,6 +1,6 @@
 services:
  server:
-    image: docker.gitea.com/gitea:1.25.1
+    image: docker.gitea.com/gitea:1.26
    container_name: gitea
    restart: always
    environment:
@@ -31,23 +31,19 @@ services:
      - /etc/localtime:/etc/localtime:ro
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"

      # Prod Router
      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.middlewares=security-headers@file"
      - "traefik.http.routers.gitea.tls=true"
      # Local Router
      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`)"
      - "traefik.http.routers.gitea-local.entrypoints=websecure"
-      - "traefik.http.routers.gitea-local.middlewares=security-headers@file"
      - "traefik.http.routers.gitea-local.tls=true"
      # Dev Router
      - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)"
      - "traefik.http.routers.gitea-dev.entrypoints=websecure"
-      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
      - "traefik.http.routers.gitea-dev.tls=true"
      # SSH Router
      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
@@ -12,22 +12,19 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
-      # FIXME: traefik.services.glance.loadbalancer.server.port ??
+      - "traefik.services.glance.loadbalancer.server.port=8080"

      # Prod Router
      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
      - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.middlewares=security-headers@file"
      - "traefik.http.routers.glance.tls=true"
      # Local Router
      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`)"
      - "traefik.http.routers.glance-local.entrypoints=websecure"
-      - "traefik.http.routers.glance-local.middlewares=security-headers@file"
      - "traefik.http.routers.glance-local.tls=true"
      # Dev Router
      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
      - "traefik.http.routers.glance-dev.entrypoints=websecure"
-      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
      - "traefik.http.routers.glance-dev.tls=true"
    networks:
      - proxy
@@ -9,10 +9,10 @@ services:
    volumes:
      - ./config/headscale.yaml:/etc/headscale/config.yaml
      - data:/var/lib/headscale
+      - ./config/policy.json:/var/lib/headscale/policy.json
    labels:
      - "me.tale.headplane.target: headscale"
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"

@@ -62,12 +62,28 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
-    healthcheck:
-      test: [ "CMD", "/bin/hp_healthcheck" ]
-      interval: 30s
-      timeout: 5s
-      start_period: 5s
-      retries: 3
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+    networks:
+      - proxy
 volumes:
  data:
  headplane-data:
@@ -0,0 +1,26 @@
+{
+    "groups": {
+        "group:admin": [
+            "admin@"
+        ],
+        "group:users": []
+    },
+    "tagOwners": {},
+    "hosts": {},
+    "acls": [
+        {
+            "#ha-meta": {
+                "name": "users",
+                "open": true
+            },
+            "action": "accept",
+            "src": [
+                "autogroup:member"
+            ],
+            "dst": [
+                "autogroup:self:*"
+            ]
+        }
+    ],
+    "ssh": []
+}
@@ -12,23 +12,19 @@ services:
      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"

      # Prod Router
      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
      - "traefik.http.routers.forust-homepage.tls=true"
      # Local Router
      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`)"
      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
      - "traefik.http.routers.forust-homepage-local.tls=true"
      # Dev Router
      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
      - "traefik.http.routers.forust-homepage-dev.tls=true"
  xdfnx:
    build:
@@ -41,23 +37,20 @@ services:
      - ./xdfnx_files:/usr/share/nginx/html
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"

      # Prod Router
      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`)"
      - "traefik.http.routers.xdfnx.entrypoints=websecure"
-      - "traefik.http.routers.xdfnx.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx.tls.certresolver=letsencrypt" 
      - "traefik.http.routers.xdfnx.tls=true"
      # Local Router
      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`)"
      - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
-      - "traefik.http.routers.xdfnx-local.middlewares=security-headers@file"
      - "traefik.http.routers.xdfnx-local.tls=true"
      # Dev Router
      - "traefik.http.routers.xdfnx-dev.rule=Host(`xdfnx.gigaforust.internal`)"
      - "traefik.http.routers.xdfnx-dev.entrypoints=websecure"
-      - "traefik.http.routers.xdfnx-dev.middlewares=security-headers@file"
      - "traefik.http.routers.xdfnx-dev.tls=true"
    networks:
      - proxy
@@ -41,7 +41,7 @@
                </li>
                <li>
                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:forust@forust.xyz">mail/contact@forust.xyz</a>
+                    <a href="mailto:contact@forust.xyz">mail/contact@forust.xyz</a>
                </li>
                <li>
                    <i class="fa-solid fa-key"></i>
@@ -116,7 +116,7 @@
                    <div class="avatar"
                        style="background-image: url('assets/images/team/anna.jpg'); background-size: cover; background-position: center;">
                    </div>
-                    <a href="" target="_blank">Anna~</a>
+                    <a href="./assets/images/love.png" target="_blank">Anna~</a>
                </div>

                <div class="member">
@@ -1,6 +1,6 @@
 services:
  kener:
-    image: rajnandan1/kener:latest
+    image: rajnandan1/kener:4.0.23
    container_name: kener
    restart: unless-stopped
    # ports:
@@ -8,13 +8,16 @@ services:
    environment:
      - KENER_SECRET_KEY=${KENER_SECRET_KEY?Kener requires a secret key}
      - ORIGIN=${ORIGIN:-http://localhost:3000}
+      - REDIS_URL=redis://redis:6379
      - TZ:${TZ:-Etc/UTC}
+    depends_on:
+      redis:
+        condition: service_healthy
    volumes:
      - db:/app/database
      - uploads:/app/uploads
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.kener.loadbalancer.server.port=3000"

      # Prod Router
@@ -31,9 +34,26 @@ services:
      - "traefik.http.routers.kener-dev.tls=true"
    networks:
      - proxy
+      - kener
+  redis:
+    image: redis:7-alpine
+    container_name: kener-redis
+    restart: unless-stopped
+    volumes:
+      - redis:/data
+    healthcheck:
+      test: [ "CMD", "redis-cli", "ping" ]
+      interval: 6s
+      timeout: 5s
+      retries: 5
+    networks:
+      - kener
 volumes:
  db:
  uploads:
+  redis:
 networks:
  proxy:
    external: true
+  kener:
+    external: false
@@ -14,7 +14,6 @@ services:
      - ./MeTube_downloads:/downloads
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.metube.loadbalancer.server.port=8081"

      # Prod Router
@@ -25,12 +24,10 @@ services:
      # Local Router
      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`)"
      - "traefik.http.routers.metube-local.entrypoints=websecure"
-      - "traefik.http.routers.metube-local.middlewares=security-headers@file"
      - "traefik.http.routers.metube-local.tls=true"
      # Dev Router
      - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
      - "traefik.http.routers.metube-dev.entrypoints=websecure"
-      - "traefik.http.routers.metube-dev.middlewares=security-chain@file"
      - "traefik.http.routers.metube-dev.tls=true"
    networks:
      - proxy
@@ -13,8 +13,8 @@ services:
      - N8N_SECURE_COOKIE=false
      - N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true
    volumes:
-      - ./n8n-node-data:/home/node/.n8n
-      - ./n8n-files:/files
+      - node-data:/home/node/.n8n
+      - files:/files
    extra_hosts:
      - "enterprise.n8n.io:104.26.13.187"
      - "enterprise.n8n.io:104.26.12.187"
@@ -27,28 +27,19 @@ services:
      - n8n
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

      # Prod Router
      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
-      - "traefik.http.routers.n8n.middlewares=security-headers@file"
-      - "traefik.http.routers.n8n.service=n8n"
      - "traefik.http.routers.n8n.tls=true"
-      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
-
      # Local Router
-      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`) || Host(`n8n.internal`)"
+      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`)"
      - "traefik.http.routers.n8n-local.entrypoints=websecure"
-      - "traefik.http.routers.n8n-local.middlewares=security-headers@file"
-      - "traefik.http.routers.n8n-local.service=n8n"
      - "traefik.http.routers.n8n-local.tls=true"
-
      # Dev Router
      - "traefik.http.routers.n8n-dev.rule=Host(`n8n.gigaforust.internal`)"
      - "traefik.http.routers.n8n-dev.entrypoints=websecure"
-      - "traefik.http.routers.n8n-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.n8n-dev.service=n8n"
      - "traefik.http.routers.n8n-dev.tls=true"

      - glance.name=n8n
@@ -60,3 +51,7 @@ networks:
    external: false
  proxy:
    external: true
+
+volumes:
+  node-data:
+  files:
@@ -0,0 +1,29 @@
+## https://github.com/autobrr/netronome?tab=readme-ov-file#environment-variables
+
+# Server settings
+NETRONOME__HOST=0.0.0.0              # Listen address
+NETRONOME__PORT=7575                 # Web UI port
+NETRONOME__BASE_URL=/netronome                # Base URL for reverse proxy
+
+# Database (SQLite by default)
+NETRONOME__DB_TYPE=postgres            # sqlite or postgres
+NETRONOME__DB_PATH=netronome.db      # SQLite database path
+
+# PostgreSQL (when DB_TYPE=postgres)
+NETRONOME__DB_TYPE=postgres
+NETRONOME__DB_HOST=postgres
+NETRONOME__DB_PORT=5432
+NETRONOME__DB_USER=netronome
+NETRONOME__DB_PASSWORD=netronome
+NETRONOME__DB_NAME=netronome
+NETRONOME__DB_SSLMODE=disable
+
+# Authentication
+NETRONOME__AUTH_WHITELIST=127.0.0.1/32,192.168.1.0/24  # IP whitelist (comma-separated)
+NETRONOME__SESSION_SECRET=           # Session secret (auto-generated if empty)
+
+# OIDC (optional)
+NETRONOME__OIDC_ISSUER=https://accounts.google.com
+NETRONOME__OIDC_CLIENT_ID=your-client-id
+NETRONOME__OIDC_CLIENT_SECRET=your-secret
+NETRONOME__OIDC_REDIRECT_URL=https://example.com/api/auth/oidc/callback
@@ -0,0 +1,59 @@
+services:
+  netronome:
+    image: ghcr.io/autobrr/netronome:latest
+    restart: unless-stopped
+    container_name: netronome
+    ports:
+      - "7575:7575"
+    cap_add:
+      - NET_RAW
+    env_file:
+      - .env
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.netronome.loadbalancer.server.port=7575"
+
+      # Prod Router
+      - "traefik.http.routers.netronome.rule=Host(`nm.forust.xyz`)"
+      - "traefik.http.routers.netronome.entrypoints=websecure"
+      - "traefik.http.routers.netronome.tls=true"
+      # Local Router
+      - "traefik.http.routers.netronome-local.rule=Host(`nm.workstation.internal`)"
+      - "traefik.http.routers.netronome-local.entrypoints=websecure"
+      - "traefik.http.routers.netronome-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.netronome-dev.rule=Host(`nm.gigaforust.internal`)"
+      - "traefik.http.routers.netronome-dev.entrypoints=websecure"
+      - "traefik.http.routers.netronome-dev.tls=true"
+    networks:
+      - proxy
+      - netronome
+    depends_on:
+      postgres:
+        condition: service_healthy
+  postgres:
+    container_name: netronome-postgres
+    image: postgres:17-alpine
+    environment:
+      - POSTGRES_USER=netronome
+      - POSTGRES_PASSWORD=netronome
+      - POSTGRES_DB=netronome
+    volumes:
+      - data:/var/lib/postgresql/data
+    healthcheck:
+      test: [ "CMD-SHELL", "pg_isready -U netronome" ]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+    networks:
+      - netronome
+volumes:
+  data:
+
+
+networks:
+  proxy:
+    external: true
+  netronome:
+    external: false
@@ -7,6 +7,7 @@ services:
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup) 
      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /dev/dri:/dev/dri
    networks:
      - nextcloud-aio
      - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
@@ -17,7 +18,6 @@ services:

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      # AIO Services configuration
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
@@ -27,17 +27,14 @@ services:
      # - "traefik.http.routers.nextcloud-aio.rule=Host(`naio.forust.xyz`)"
      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
      # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
-      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
      # - "traefik.http.routers.nextcloud-aio.tls=true"
      # Local Router
      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`)"
      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file"
      - "traefik.http.routers.nextcloud-aio-local.tls=true"
      # Dev Router
      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`naio.gigaforust.internal`)"
      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file"
      - "traefik.http.routers.nextcloud-aio-dev.tls=true"

      # Glance Metadata
@@ -61,7 +58,7 @@ services:
      NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
      NEXTCLOUD_ADDITIONAL_APKS: imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
      NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # dditional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
-      NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device for containers that profit from it. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud
+      # NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device for containers that profit from it. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud
      # NEXTCLOUD_KEEP_DISABLED_APPS: false # Setting this to true will keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed. See https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps
      SKIP_DOMAIN_VALIDATION: true # This should only be set to true if things are correctly configured. See https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-skip-the-domain-validation
      # TALK_PORT: 3478 # This a-llows to adjust the port that the talk container is using which is exposed on the host. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
@@ -71,6 +68,7 @@ networks:
  proxy:
    external: true
  nextcloud-aio:
+    name: nextcloud-aio
    driver: bridge
    external: false
 volumes:
@@ -102,23 +102,19 @@ services:

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.penpot.loadbalancer.server.port=8080"

      # Prod Router
      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
      - "traefik.http.routers.penpot.entrypoints=websecure"
-      - "traefik.http.routers.penpot.middlewares=security-headers@file"
      - "traefik.http.routers.penpot.tls=true"
      # Local Router
      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`)"
      - "traefik.http.routers.penpot-local.entrypoints=websecure"
-      - "traefik.http.routers.penpot-local.middlewares=security-headers@file"
      - "traefik.http.routers.penpot-local.tls=true"
      # Dev Router
      - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.internal`)"
      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
-      - "traefik.http.routers.penpot-dev.middlewares=security-headers@file"
      - "traefik.http.routers.penpot-dev.tls=true"
    environment:
      <<: [ *penpot-flags, *penpot-http-body-size ]
@@ -1,35 +1,29 @@
 services:
  portainer:
-    image: portainer/portainer-ce:latest
+    image: portainer/portainer-ce:2.41.0
    container_name: portainer
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - data:/data
    ports:
-      - 9443:9443
+      - 9000:9000
      # - 8000:8000  # Remove if you do not intend to use Edge Agents
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
-      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
-      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9000"

      # Prod Router
      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
-      - "traefik.http.routers.portainer.middlewares=security-headers@file"
      - "traefik.http.routers.portainer.tls=true"
      # Local Router
      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`)"
      - "traefik.http.routers.portainer-local.entrypoints=websecure"
-      - "traefik.http.routers.portainer-local.middlewares=security-headers@file"
      - "traefik.http.routers.portainer-local.tls=true"
      # Dev Router
      - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.internal`)"
      - "traefik.http.routers.portainer-dev.entrypoints=websecure"
-      - "traefik.http.routers.portainer-dev.middlewares=security-headers@file"
      - "traefik.http.routers.portainer-dev.tls=true"

      # Glance Metadata
@@ -0,0 +1,15 @@
+# Read the documentation before using the `docker-compose.yml` file:
+# https://docs.searxng.org/admin/installation-docker.html
+#
+# Additional ENVs:
+# https://docs.searxng.org/admin/settings/settings_general.html#settings-general
+# https://docs.searxng.org/admin/settings/settings_server.html#settings-server
+
+# Use a specific version tag. E.g. "latest" or "2026.3.25-541c6c3cb".
+#SEARXNG_VERSION=latest
+
+# Listen to a specific address.
+#SEARXNG_HOST=[::]
+
+# Listen to a specific port.
+SEARXNG_PORT=8080
@@ -0,0 +1,45 @@
+# Read the documentation before using the `docker-compose.yml` file:
+# https://docs.searxng.org/admin/installation-docker.html
+services:
+  core:
+    container_name: searxng-core
+    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-latest}
+    restart: unless-stopped
+    # ports:
+      # - ${SEARXNG_PORT:-8080}
+    env_file: .env
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.searxng.loadbalancer.server.port=8080"
+      # Prod Router
+      - "traefik.http.routers.searxng.rule=Host(`s.forust.xyz` || `searxng.forust.xyz`)"
+      - "traefik.http.routers.searxng.entrypoints=websecure"
+      - "traefik.http.routers.searxng.tls=true"
+      # Local Router
+      - "traefik.http.routers.searxng-local.rule=Host(`s.workstation.internal` || `searxng.workstation.internal`)"
+      - "traefik.http.routers.searxng-local.entrypoints=websecure"
+      - "traefik.http.routers.searxng-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.searxng-dev.rule=Host(`searxng.gigaforust.internal`)"
+      - "traefik.http.routers.searxng-dev.entrypoints=websecure"
+      - "traefik.http.routers.searxng-dev.tls=true"
+    networks:
+      - proxy
+    volumes:
+      - ./core-config/:/etc/searxng/:Z
+      - core-data:/var/cache/searxng/
+
+  valkey:
+    container_name: searxng-valkey
+    image: docker.io/valkey/valkey:9-alpine
+    command: valkey-server --save 30 1 --loglevel warning
+    restart: unless-stopped
+    volumes:
+      - valkey-data:/data/
+
+volumes:
+  core-data:
+  valkey-data:
+networks:
+  proxy:
+    external: true
@@ -11,23 +11,19 @@ services:
      PORT: "8080"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.termix.loadbalancer.server.port=8080"

      # Prod Router
      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
      - "traefik.http.routers.termix.entrypoints=websecure"
-      - "traefik.http.routers.termix.middlewares=security-headers@file"
      - "traefik.http.routers.termix.tls=true"
      # Local Router
      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`)"
      - "traefik.http.routers.termix-local.entrypoints=websecure"
-      - "traefik.http.routers.termix-local.middlewares=security-headers@file"
      - "traefik.http.routers.termix-local.tls=true"
      # Dev Router
      - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.internal`)"
      - "traefik.http.routers.termix-dev.entrypoints=websecure"
-      - "traefik.http.routers.termix-dev.middlewares=security-headers@file"
      - "traefik.http.routers.termix-dev.tls=true"
    networks:
      - proxy
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: traefik:latest
+    image: traefik:v3.7
    container_name: traefik
    restart: unless-stopped
    command:
@@ -17,8 +17,8 @@ services:

      # EntryPoints
      - "--entryPoints.web.address=:80"
-      # - "--entryPoints.web.http.middlewares=error-pages@docker"
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
+      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.websecure.http.middlewares=error-pages@docker"
      - "--entryPoints.websecure.http.tls=true"
@@ -35,14 +35,14 @@ services:
      # Cloudflare 
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
-      # # Logging
-      # - "--log.level=INFO"
-      # - "--log.filePath=/var/log/traefik/traefik.log"
-      # - "--accesslog=true"
-      # - "--accesslog.filepath=/var/log/traefik/access.log"
+      # Logging
+      - "--log.level=INFO"
+      - "--log.filePath=/var/log/traefik/traefik.log"
+      - "--log.format=json"
+      - "--accesslog=true"
+      - "--accesslog.filepath=/var/log/traefik/access.log"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"

      # Prod Router (Dash)
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
@@ -53,13 +53,11 @@ services:
      # Local Router
      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`)"
      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-local.middlewares=security-headers@file"
      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-local.tls=true"
      # Dev Router
      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file"
      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-dev.tls=true"

@@ -35,6 +35,7 @@ http:
      forwardAuth:
        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
+        maxResponseBodySize: 1048576
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
@@ -15,7 +15,6 @@ http:
      rule: "Host(`nextcloud.workstation.internal`)"
      entrypoints:
        - websecure
-        - web
      service: nextcloud
      middlewares:
        - nextcloud-chain
@@ -26,7 +25,6 @@ http:
      rule: "Host(`nextcloud.gigaforust.internal`)"
      entrypoints:
        - websecure
-        - web
      service: nextcloud
      middlewares:
        - nextcloud-chain
@@ -4,14 +4,12 @@ tls:
    # Cloudflare Origin CA *.forust.xyz
    # - certFile: /certs/cloudflare.pem
    #   keyFile: /certs/cloudflare.key
-    - certFile: /certs/xdfnx.pem
-      keyFile: /certs/xdfnx.key
  stores:
    default:
      defaultCertificate:
        # Fallback local certificate
-        certFile: /certs/gigaforust.internal+1.pem
-        keyFile: /certs/gigaforust.internal+1-key.pem
+        certFile: /certs/local.pem
+        keyFile: /certs/local-key.pem

  options:
    default:
@@ -9,7 +9,6 @@ services:
    #   - "3001:3001"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"
      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"

      # Prod Router
@@ -1 +1,12 @@
 .unused
+Downloads
+.venv
+volumes
+.env
+.env.*
+my_account.session
+.gitignore
+README.md
+.git
+uv.lock
+.deepsource.toml
@@ -1,10 +1,18 @@
-FROM python:3.11
+FROM python:3.11-slim
+
 WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git wget ffmpeg mediainfo && \ 
+    rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt /app/
+
+RUN python -m pip install --no-cache-dir --upgrade pip && \
+    python -m pip install --no-cache-dir -r /app/requirements.txt
+
 COPY . /app
-RUN apt-get -qq update && apt-get -qq install -y git wget ffmpeg mediainfo\
- && apt-get clean \
- && rm -rf /var/lib/apt/lists/*
-RUN python -m venv --copies /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
-RUN pip install --no-cache-dir -r requirements.txt
-CMD ["python", "main.py"]
+
+ENV PYTHONUNBUFFERED=1
+
+CMD ["python", "-u", "main.py"]
@@ -3,6 +3,8 @@ services:
    build:
      context: .
      dockerfile: Dockerfile
+    image: userbot:latest
+    pull_policy: never
    restart: unless-stopped
    env_file:
      - .env
@@ -16,9 +18,10 @@ services:
      - 1.1.1.1

  anna:
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: userbot:latest
+    pull_policy: never
+    depends_on:
+      - forust
    restart: unless-stopped
    env_file:
      - .env
@@ -90,11 +90,19 @@ def load_missing_modules():
    os.makedirs(custom_modules_path, exist_ok=True)

    try:
-        f = requests.get(
-            "https://raw.githubusercontent.com/The-MoonTg-project/custom_modules/main/full.txt"
-        ).text
-    except Exception:
-        logging.error("Failed to fetch custom modules list")
+        resp = requests.get(
+            "https://raw.githubusercontent.com/The-MoonTg-project/custom_modules/main/full.txt",
+            timeout=10,
+        )
+        if not resp.ok:
+            logging.error(
+                "Failed to fetch custom modules list: HTTP %s",
+                resp.status_code,
+            )
+            return
+        f = resp.text
+    except Exception as e:
+        logging.error("Failed to fetch custom modules list: %s", e)
        return
    modules_dict = {
        line.split("/")[-1].split()[0]: line.strip() for line in f.splitlines()
@@ -3,7 +3,7 @@ name = "userbot"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
-requires-python = ">=3.13"
+requires-python = ">=3.11"
 dependencies = [
    "aiofiles>=25.1.0",
    "aiohttp>=3.13.2",
@@ -18,3 +18,5 @@ aiohttp
 aiofiles
 pySmartDL
 qrcode
+bottle
+dulwich
@@ -1,8 +1,8 @@
 import os
 import environs

+env = environs.Env()
 try:
-    env = environs.Env()
    env.read_env("./.env")
 except FileNotFoundError:
    print("No .env file found, using os.environ.")
@@ -22,6 +22,7 @@ import re
 import shlex
 import subprocess
 import sys
+import tempfile
 import time
 import traceback
 from PIL import Image
@@ -85,13 +86,17 @@ async def edit_or_send_as_file(
        return
    if len(tex) > 1024:
        await message.edit("<code>OutPut is Too Large, Sending As File!</code>")
-        file_names = f"{file_name}.txt"
-        with open(file_names, "w") as fn:
+        with tempfile.NamedTemporaryFile(
+            "w", delete=False, suffix=".txt", prefix=f"{file_name}_"
+        ) as fn:
            fn.write(tex)
-        await client.send_document(message.chat.id, file_names, caption=caption)
+            temp_path = fn.name
+        try:
+            await client.send_document(message.chat.id, temp_path, caption=caption)
            await message.delete()
-        if os.path.exists(file_names):
-            os.remove(file_names)
+        finally:
+            if os.path.exists(temp_path):
+                os.remove(temp_path)
        return
    return await message.edit(tex)

@@ -249,12 +254,7 @@ def is_admin(func):
            chat_member = await client.get_chat_member(
                message.chat.id, message.from_user.id
            )
-            chat_admins = []
-            async for member in client.get_chat_members(
-                message.chat.id, filter=ChatMembersFilter.ADMINISTRATORS
-            ):
-                chat_admins.append(member)
-            if chat_member in chat_admins:
+            if chat_member.status in ("administrator", "creator"):
                return await func(client, message)
            await message.edit("You need to be an admin to perform this action.")
        except UserNotParticipant:
Author	SHA1	Message	Date
forust	b9c11b8eab	Merge branch 'main' into optimize/userbot Deploy to Server / deploy (push) Has been cancelled Details	2026-05-25 01:48:31 +02:00
forust	6dac841b2c	updated traefik to v3.7, Deploy to Server / deploy (push) Has been cancelled Details resolved maxResponseBodySize not set	2026-05-25 01:47:59 +02:00
forust	526a2b617a	refactor: update .dockerignore pull_policy never to use local images	2026-05-25 01:43:46 +02:00
forust	1e08391e0e	refactor: improved error handling, timeouts and use temp files	2026-05-21 22:14:29 +02:00
forust	0a31601b77	refactor: imporved layer caching for dockerfile using existing built image for account 2	2026-05-21 22:12:33 +02:00
forust	25eb89c902	feat: add searxng service (metasearch engine)	2026-05-21 21:34:40 +02:00
forust	d988b0f7db	refactor: change Cloudlfare DDNS config to env-based Deploy to Server / deploy (push) Failing after 14m7s Details	2026-05-08 17:38:41 +02:00
forust	e873f37159	refactor: nextcloud now requires mounting /dev/dri inside the container. Deploy to Server / deploy (push) Failing after 0s Details Changed network name for nextcloud	2026-05-08 16:39:09 +02:00
forust	8362f45bdc	upd: updated image tags for services: - gitea 1.25.1 --> 1.26 - portainer-ce latest --> 2.41.0 - traefik latest --> 3.6.15	2026-05-08 16:37:26 +02:00
forust	fd5ea6cadd	upd: kener v4.0.23 Deploy to Server / deploy (push) Failing after 0s Details	2026-04-10 02:29:02 +02:00
forust	aa3598ee3d	Merge pull request 'upd: updated kener to v4' (#14 ) from upd/kener-v4 into main Deploy to Server / deploy (push) Failing after 1s Details Reviewed-on: #14	2026-02-27 13:06:36 +01:00
forust	c0205fa49b	upd: updated kener to v4	2026-02-27 13:05:56 +01:00
forust	a22707770f	feat: update certificates logic: Deploy to Server / deploy (push) Failing after 1s Details - Switched xdfnx's homepage certificates to traefik-managed mode - Renamed local fallback certs	2026-02-25 21:12:44 +01:00
forust	646f988a86	chore: Pinned stable kener version Deploy to Server / deploy (push) Failing after 5s Details	2026-02-24 12:09:06 +01:00
forust	414d17d839	deleted test gitea workflow Deploy to Server / deploy (push) Successful in 1s Details	2026-02-22 03:53:51 +01:00
forust	812e4eb87a	ci: add copy of the gitea workflow for the github Deploy to Server / deploy (push) Successful in 1s Details	2026-02-22 03:37:45 +01:00
forust	70b3b203fb	fix: update email address Deploy to Server / deploy (push) Has been cancelled Details	2026-02-22 00:28:19 +01:00
forust	d857f3838d	revert testing message Deploy to Server / deploy (push) Successful in 1s Details Gitea Actions Demo / Explore-Gitea-Actions (push) Has been cancelled Details	2026-02-20 20:41:01 +01:00
forust	f8620349a9	fix deploy pipeline to prevent logspam Deploy to Server / deploy (push) Successful in 16s Details Gitea Actions Demo / Explore-Gitea-Actions (push) Has been cancelled Details	2026-02-20 20:38:39 +01:00
forust	b1acff5c85	ci: add run-name to deployment workflow Deploy to Server / deploy (push) Successful in 19s Details Gitea Actions Demo / Explore-Gitea-Actions (push) Has been cancelled Details	2026-02-20 20:25:17 +01:00
forust	beb6dca6a2	CI test change	2026-02-20 20:23:11 +01:00
forust	aed6ff31f7	fix: add .runner (act runner settings) to .gitignore	2026-02-20 20:22:10 +01:00
forust	73684af21b	ci: deploy workflow with local act_runner Deploy to Server / deploy (push) Successful in 1s Details Gitea Actions Demo / Explore-Gitea-Actions (push) Has been cancelled Details	2026-02-20 20:09:26 +01:00
forust	cd5c90adcc	Merge branch 'main' into ci/gitea-actions	2026-02-20 20:08:48 +01:00
forust	578a1ca544	revert: naio needs insecure transport `2593b54402` chore: add backquotes for downtify traefik labels removed insecureTransport	2026-02-20 01:25:23 +01:00
forust	12ed20a306	fix: support for external dynamic traefik configs	2026-02-20 01:16:54 +01:00
forust	400e7b6595	Starting learning cicd from scratch Gitea Actions Demo / Explore-Gitea-Actions (push) Successful in 8s Details Demo gitea action	2026-02-19 00:36:02 +01:00
forust	f58e96a25d	add support for external dynamic traefik configs	2026-02-07 01:56:10 +01:00
forust	a3e5f5a78b	fix: let traefik handle https to portainer	2026-02-05 02:42:39 +01:00
forust	1a09a62a4c	chore: deploy and lint workflows	2026-02-05 02:17:47 +01:00
forust	2593b54402	chore: add backquotes for downtify traefik labels removed insecureTransport	2026-02-05 01:33:04 +01:00
forust	42826a037c	refactor: store n8n data in named volumes	2026-02-04 22:26:43 +01:00
forust	d7a68237e5	chore: remove redundant or unnececary traefik labels - traefik.docker.network= (defined by traefik cli) - traefik.http.routers.<routername>.middlewares=security-headers@file" (applied globally by traefik cli)	2026-02-04 22:26:27 +01:00
forust	bbb8bdf0a7	feat: traefik routers for netronome, exported netronome env to .env	2026-02-04 11:00:44 +01:00
forust	f4d3bd9c6d	feat: basic netronome service	2026-02-03 14:25:53 +01:00
forust	6b919df7c6	chore: restart downtify service unless stopped	2026-02-01 17:24:50 +01:00
forust	3ee0b96ed5	feat: add acl policies to the headscale	2026-02-01 01:14:58 +01:00
forust	d25d213d9b	feat: add headscale admin web admin (along with headplane accessible via port)	2026-01-31 13:38:33 +01:00
forust	a3b7c4c889	commit team avatars (and love)	2026-01-29 21:19:34 +01:00
forust	3dbb50c924	json logging	2026-01-29 17:30:09 +01:00
forust	54da82432b	fix: remove headplane healtcheck (always false negative)	2026-01-29 17:22:47 +01:00
forust	e5eb234c41	chore: gitignore for adguard	2026-01-29 17:22:40 +01:00
forust	721348e67f	refactor: switch adguard data to named volume	2026-01-29 17:22:33 +01:00
forust	d58ae2a5e7	chore: new statuspage for errorpages	2026-01-25 23:41:42 +01:00
forust	aa516c3445	Merge pull request 'fix: errorpage styles fixes #11 ' (#12 ) from fix/errorpage-styles into main Reviewed-on: #12	2026-01-25 23:39:10 +01:00
forust	b5cc7d9a0d	fix: errorpage styles fixes #11	2026-01-25 23:38:34 +01:00