fix: remove www.xdfnx.cfd from ingress, add Gitea access log config

Signed-off-by: mr-forust <vzlomdsisma@gmail.com>

.docs/storage-audit-instruction.md

@@ -0,0 +1,191 @@
+# Инструкция: Анализ хранилища Kubernetes и настройка NFS
+
+## Цель
+Проанализировать текущую конфигурацию хранилища Kubernetes и подготовить план внедрения NFS StorageClass для сохранения данных при удалении namespace.
+
+## 1. Собрать информацию о кластере
+
+### 1.1. Версия Kubernetes и тип дистрибутива
+```bash
+kubectl version --short
+# или
+kubectl version
+```
+
+Определить, используется ли k3s, k8s, microk8s и т.д.:
+```bash
+# Проверить наличие k3s
+which k3s
+# Проверить процесс
+ps aux | grep -E 'kube|k3s'
+```
+
+### 1.2. StorageClass
+```bash
+kubectl get storageclass -o wide
+```
+
+Запомнить:
+- `PROVISIONER` — какой драйвер используется
+- `RECLAIMPOLICY` — Delete или Retain
+- Какой StorageClass помечен как `(default)`
+
+### 1.3. Существующие PV и PVC
+```bash
+kubectl get pv -o wide
+kubectl get pvc --all-namespaces
+```
+
+Посмотреть, какие PVC привязаны к каким PV, и какой reclaimPolicy у PV.
+
+### 1.4. Нода и диски
+```bash
+# Список нод
+kubectl get nodes -o wide
+
+# На каждой ноде (через ssh или локально):
+lsblk
+df -h
+cat /etc/fstab
+```
+
+Определить:
+- Есть ли отдельный раздел/диск для данных
+- Куда смонтированы разделы
+- Сколько свободного места
+- Есть ли монтирование NTFS-разделов (как `/media/forust/Programs`)
+
+### 1.5. Где local-path хранит данные (для k3s)
+```bash
+ls -la /var/lib/rancher/k3s/storage/ 2>/dev/null
+# или для microk8s
+ls -la /var/snap/microk8s/common/ 2>/dev/null
+```
+
+## 2. Анализ: сохраняются ли данные при удалении namespace?
+
+| Сценарий | Результат |
+|---|---|
+| `kubectl delete ns <ns>` | Все PVC в namespace удаляются |
+| PVC → PV c `reclaimPolicy: Delete` | PV и данные удалены |
+| PVC → PV c `reclaimPolicy: Retain` | PV остаётся (статус Released), данные целы |
+
+**Вывод:** Если reclaimPolicy в StorageClass = `Delete`, то данные **пропадут**. Если `Retain` — сохранятся.
+
+## 3. План внедрения NFS
+
+### 3.1. Проверить, установлен ли NFS
+```bash
+which nfsstat exportfs mount.nfs
+systemctl status nfs-server 2>/dev/null || systemctl status nfs-kernel-server 2>/dev/null
+```
+
+### 3.2. Выбрать директорию для NFS-экспорта
+
+Варианты (выбрать подходящий):
+- `/var/lib/k8s-nfs/` — на корневом разделе
+- `<путь к отдельному разделу>/k8s-nfs/` — если есть отдельный диск/раздел
+- Не рекомендуется использовать NTFS-раздел (проблемы с правами и производительностью)
+
+Требования:
+- Файловая система: ext4 или xfs (не ntfs!)
+- Достаточно свободного места
+- Права: `755`, владелец root
+
+### 3.3. Установить NFS-сервер
+
+```bash
+# Debian/Ubuntu
+apt update && apt install -y nfs-kernel-server
+
+# RHEL/Fedora
+dnf install -y nfs-utils
+```
+
+### 3.4. Настроить экспорт
+
+Создать директорию:
+```bash
+mkdir -p /var/lib/k8s-nfs
+chmod 755 /var/lib/k8s-nfs
+```
+
+Добавить в `/etc/exports`:
+```
+/var/lib/k8s-nfs *(rw,sync,no_subtree_check,no_root_squash)
+```
+
+Применить:
+```bash
+exportfs -rav
+```
+
+Проверить:
+```bash
+showmount -e localhost
+```
+
+### 3.5. Выбрать способ интеграции с Kubernetes
+
+#### Вариант A: nfs-subdir-external-provisioner (проще)
+```bash
+helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
+helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
+  --namespace kube-system \
+  --set nfs.server=127.0.0.1 \
+  --set nfs.path=/var/lib/k8s-nfs \
+  --set storageClass.name=nfs \
+  --set storageClass.defaultClass=false \
+  --set storageClass.reclaimPolicy=Retain
+```
+
+#### Вариант B: NFS CSI Driver
+```bash
+helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+helm install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system
+```
+
+После установки CSI драйвера создать StorageClass:
+```yaml
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 127.0.0.1
+  share: /var/lib/k8s-nfs
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+```
+
+### 3.6. Проверить результат
+```bash
+kubectl get storageclass
+kubectl get pods -n kube-system | grep -E 'nfs|provisioner'
+```
+
+## 4. Итоговая конфигурация
+
+После внедрения в кластере будет два StorageClass:
+
+| Имя | Provisioner | ReclaimPolicy | Назначение |
+|---|---|---|---|
+| `local-path` (default) | rancher.io/local-path | Delete | Временные данные, stateless |
+| `nfs` | nfs-subdir-external-provisioner или nfs.csi.k8s.io | Retain | Данные, которые нужно сохранять |
+
+**Главное преимущество:** PVC c `storageClassName: nfs` при удалении namespace сохраняют данные на диске, так как NFS-провизор использует `reclaimPolicy: Retain` или файлы физически остаются в NFS-экспорте.
+
+## 5. Ответы на частые вопросы
+
+**В:** Не упадёт ли local-path при установке NFS?
+**О:** Нет, они независимы. local-path продолжает работать как обычно.
+
+**В:** Данные NFS и local-path будут на одном диске?
+**О:** Да, можно настроить оба на одном разделе, в разных каталогах.
+
+**В:** Что если у меня несколько нод?
+**О:** NFS сервер нужно поднять на одной ноде, а с других нод должна быть доступна шари. Для multi-node лучше использовать отдельный сервер или distributed storage (Longhorn, Rook/Ceph).
+
+**В:** Можно ли использовать существующий NTFS-раздел для NFS?
+**О:** Не рекомендуется — NTFS не поддерживает права Linux (no_root_squash не сработает корректно), возможны проблемы с блокировками и производительностью.

.editorconfig

@@ -0,0 +1,24 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.{json,jsonc}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.py]
+indent_size = 4
+
+[{Makefile,makefile}]
+indent_style = tab

.gitea/workflows/ci.yaml

@@ -0,0 +1,326 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+  workflow_dispatch:
+
+env:
+  REGISTRY: gcr.forust.xyz
+
+jobs:
+  lint-prettier:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check formatting with Prettier
+        shell: bash
+        run: |
+          mapfile -t prettier_files < <(
+            git ls-files \
+              | grep -E '\.(md|json|ya?ml|html|css)$' \
+              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
+          )
+
+          if [ "${#prettier_files[@]}" -eq 0 ]; then
+            echo "No Prettier-managed files found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
+
+  lint-ruff:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Python with Ruff
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
+
+  lint-yaml:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint YAML syntax
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
+
+  lint-dockerfiles:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Dockerfiles
+        shell: bash
+        run: |
+          mapfile -t dockerfiles < <(
+            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
+          )
+
+          if [ "${#dockerfiles[@]}" -eq 0 ]; then
+            echo "No Dockerfiles found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
+
+  validate:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate Kubernetes manifests
+        shell: bash
+        run: |
+          mapfile -t manifests < <(
+            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
+              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
+          )
+
+          if [ "${#manifests[@]}" -eq 0 ]; then
+            echo "No Kubernetes manifests found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
+
+  build:
+    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
+    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed docker-built services
+        id: services
+        shell: bash
+        run: |
+          base="${{ github.event.before }}"
+          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
+            base="$(git rev-list --max-parents=0 HEAD)"
+          fi
+
+          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
+
+          services=()
+
+          add_service() {
+            local name="$1"
+            local seen=0
+            for existing in "${services[@]}"; do
+              if [ "$existing" = "$name" ]; then
+                seen=1
+                break
+              fi
+            done
+            if [ "$seen" -eq 0 ]; then
+              services+=("$name")
+            fi
+          }
+
+          for file in "${changed_files[@]}"; do
+            case "$file" in
+              dtek_notif/*)
+                add_service dtek_notif
+                ;;
+              errorpages/*)
+                add_service errorpages
+                ;;
+              userbot/*)
+                add_service userbot
+                ;;
+              homepages/*)
+                add_service homepages
+                ;;
+              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
+                add_service edu_master
+                ;;
+            esac
+          done
+
+          if [ "${#services[@]}" -eq 0 ]; then
+            echo "No docker-built services changed."
+            echo "services=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
+          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to registry
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" \
+            --password-stdin
+
+      - name: Build and push changed images
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
+
+          for service in "${services[@]}"; do
+            case "$service" in
+              dtek_notif)
+                image="${REGISTRY}/forust/dtek-notif"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" dtek_notif
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              errorpages)
+                image="${REGISTRY}/forust/error-pages"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" errorpages
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              userbot)
+                image="${REGISTRY}/forust/userbot"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" userbot
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              homepages)
+                for service in forust xdfnx; do
+                  case "$service" in
+                    forust)
+                      image="${REGISTRY}/forust/forust-homepage"
+                      ;;
+                    xdfnx)
+                      image="${REGISTRY}/forust/xdfnx-homepage"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+              edu_master)
+                for service in session-keeper webinar-checker; do
+                  case "$service" in
+                    session-keeper)
+                      context="edu_master/phpsessid-bot"
+                      image="${REGISTRY}/forust/session-keeper"
+                      ;;
+                    webinar-checker)
+                      context="edu_master/webinar-checker"
+                      image="${REGISTRY}/forust/webinar-checker"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" "$context"
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+            esac
+          done

.github/workflows/ci.yaml

@@ -0,0 +1,326 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+  workflow_dispatch:
+
+env:
+  REGISTRY: gcr.forust.xyz
+
+jobs:
+  lint-prettier:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check formatting with Prettier
+        shell: bash
+        run: |
+          mapfile -t prettier_files < <(
+            git ls-files \
+              | grep -E '\.(md|json|ya?ml|html|css)$' \
+              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
+          )
+
+          if [ "${#prettier_files[@]}" -eq 0 ]; then
+            echo "No Prettier-managed files found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
+
+  lint-ruff:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Python with Ruff
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
+
+  lint-yaml:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint YAML syntax
+        shell: bash
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
+
+  lint-dockerfiles:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint Dockerfiles
+        shell: bash
+        run: |
+          mapfile -t dockerfiles < <(
+            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
+          )
+
+          if [ "${#dockerfiles[@]}" -eq 0 ]; then
+            echo "No Dockerfiles found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
+
+  validate:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate Kubernetes manifests
+        shell: bash
+        run: |
+          mapfile -t manifests < <(
+            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
+              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
+          )
+
+          if [ "${#manifests[@]}" -eq 0 ]; then
+            echo "No Kubernetes manifests found."
+            exit 0
+          fi
+
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
+
+  build:
+    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
+    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed docker-built services
+        id: services
+        shell: bash
+        run: |
+          base="${{ github.event.before }}"
+          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
+            base="$(git rev-list --max-parents=0 HEAD)"
+          fi
+
+          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
+
+          services=()
+
+          add_service() {
+            local name="$1"
+            local seen=0
+            for existing in "${services[@]}"; do
+              if [ "$existing" = "$name" ]; then
+                seen=1
+                break
+              fi
+            done
+            if [ "$seen" -eq 0 ]; then
+              services+=("$name")
+            fi
+          }
+
+          for file in "${changed_files[@]}"; do
+            case "$file" in
+              dtek_notif/*)
+                add_service dtek_notif
+                ;;
+              errorpages/*)
+                add_service errorpages
+                ;;
+              userbot/*)
+                add_service userbot
+                ;;
+              homepages/*)
+                add_service homepages
+                ;;
+              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
+                add_service edu_master
+                ;;
+            esac
+          done
+
+          if [ "${#services[@]}" -eq 0 ]; then
+            echo "No docker-built services changed."
+            echo "services=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
+          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to registry
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" \
+            --password-stdin
+
+      - name: Build and push changed images
+        if: steps.services.outputs.services != ''
+        shell: bash
+        run: |
+          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
+
+          for service in "${services[@]}"; do
+            case "$service" in
+              dtek_notif)
+                image="${REGISTRY}/forust/dtek-notif"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" dtek_notif
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              errorpages)
+                image="${REGISTRY}/forust/error-pages"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" errorpages
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              userbot)
+                image="${REGISTRY}/forust/userbot"
+                tags=("latest")
+                case "${GITHUB_REF_NAME}" in
+                  main)
+                    tags+=("main" "prod")
+                    ;;
+                  dev)
+                    tags+=("dev")
+                    ;;
+                esac
+                build_args=()
+                for tag in "${tags[@]}"; do
+                  build_args+=(-t "${image}:${tag}")
+                done
+                docker build "${build_args[@]}" userbot
+                for tag in "${tags[@]}"; do
+                  docker push "${image}:${tag}"
+                done
+                ;;
+              homepages)
+                for service in forust xdfnx; do
+                  case "$service" in
+                    forust)
+                      image="${REGISTRY}/forust/forust-homepage"
+                      ;;
+                    xdfnx)
+                      image="${REGISTRY}/forust/xdfnx-homepage"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+              edu_master)
+                for service in session-keeper webinar-checker; do
+                  case "$service" in
+                    session-keeper)
+                      context="edu_master/phpsessid-bot"
+                      image="${REGISTRY}/forust/session-keeper"
+                      ;;
+                    webinar-checker)
+                      context="edu_master/webinar-checker"
+                      image="${REGISTRY}/forust/webinar-checker"
+                      ;;
+                  esac
+                  tags=("latest")
+                  case "${GITHUB_REF_NAME}" in
+                    main)
+                      tags+=("main" "prod")
+                      ;;
+                    dev)
+                      tags+=("dev")
+                      ;;
+                  esac
+                  build_args=()
+                  for tag in "${tags[@]}"; do
+                    build_args+=(-t "${image}:${tag}")
+                  done
+                  docker build "${build_args[@]}" "$context"
+                  for tag in "${tags[@]}"; do
+                    docker push "${image}:${tag}"
+                  done
+                done
+                ;;
+            esac
+          done

.gitignore

@@ -2,25 +2,26 @@
 sync.ffs_lock
 .sync.ffs_db
 
-# Environment 
-.env
-.env.anna
-.env.forust
-.env.*
-!.env.*example
+# Copyparty
+*.hist/
 
-# Volumes and data directories
+# Volumes, configs and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
-adguardhome/data/*
+adguardhome/conf/*
 dockmon/data/*
 portainer/portainer_data/*
 metube/MeTube_downloads
 uptime-kuma/data/
 termix/termix-data/*
 cfddns/config.json
+checkmk/checkmk/*
+downtify/Downtify_downloads
+headscale/config/*
+headscale/data/*
+searxng/core-config/*
 
 # Steaming services files
 streaming/jellyfin/*
@@ -32,12 +33,21 @@ streaming/qbittorrent/*
 streaming/prowlarr/*
 
 # Homepage
-homepage/files/assets/images/team/*
+homepages/forust_files/.well-known/*
 
 # Traefik files
 traefik/letsencrypt/acme.json
+traefik/dynamic/fileservers.yml
+traefik/dynamic/*.local.y*ml.*
+traefik/dynamic/*.external.y*ml
+traefik/k8s/fileservers.y*ml
+
 traefik/logs/*
+
+# SSL Certificates
+adguardhome/certs/*
 traefik/certs/*
+certs/
 
 # Monitoring
 monitoring/prometheus.yml
@@ -72,6 +82,8 @@ replacements.txt
 
 # Git
 .gitattributes
+# Gitea/github Runners
+.runner
 
 # Misc
 .DS_Store
@@ -79,3 +91,18 @@ replacements.txt
 
 # Temp files
 edu_master/temp/
+temp/*
+
+# Environment
+.env
+.env.anna
+.env.forust
+.env.*
+!*example
+
+# kubernetes
+*/k8s/*secret*
+!*/k8s/*secret*.example
+traefik/k8s/local-tls.yaml
+converters/k8s/config.yaml
+convertx/k8s/config.yaml

.hadolint.yaml

@@ -0,0 +1,10 @@
+ignored:
+  - DL3008
+  - DL3042
+  - DL3018
+  - DL3059
+trustedRegistries:
+  - docker.io
+  - ghcr.io
+  - quay.io
+  - gcr.forust.xyz

.markdownlint.json

@@ -0,0 +1,8 @@
+{
+  "default": true,
+  "MD013": false,
+  "MD024": false,
+  "MD033": false,
+  "MD041": false,
+  "MD046": false
+}

.prettierrc.yaml

@@ -0,0 +1,7 @@
+bracketSameLine: true
+htmlWhitespaceSensitivity: css
+printWidth: 120
+tabWidth: 2
+trailingComma: all
+proseWrap: preserve
+endOfLine: lf

.yamllint

@@ -0,0 +1,22 @@
+extends: default
+
+rules:
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  document-start: disable
+  line-length: disable
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+  truthy:
+    allowed-values:
+      - "true"
+      - "false"
+      - "on"

.zed/settings.json

@@ -0,0 +1,40 @@
+{
+  "tab_size": 2,
+  "soft_wrap": "prefer_line",
+  "preferred_line_length": 120,
+  "format_on_save": "on",
+  "languages": {
+    "YAML": {
+      "tab_size": 2,
+      "hard_tabs": false,
+      "format_on_save": "on",
+      "formatter": {
+        "language_server": { "name": "yaml-language-server" },
+      },
+    },
+    "Python": {
+      "tab_size": 4,
+      "format_on_save": "on",
+      "language_servers": ["pyright", "ruff"],
+      "formatter": {
+        "language_server": { "name": "ruff" },
+      },
+    },
+  },
+  "lsp": {
+    "yaml-language-server": {
+      "settings": {
+        "yaml": {
+          "schemas": {
+            "kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"],
+          },
+          "validate": true,
+          "completion": true,
+          "format": {
+            "enable": true,
+          },
+        },
+      },
+    },
+  },
+}

adguardhome/compose.yaml

@@ -3,48 +3,46 @@ services:
     image: adguard/adguardhome:latest
     container_name: adguardhome
     restart: unless-stopped
-    environment:
-      - TZ=${TZ}
     ports:
       - "53:53/tcp"
       - "53:53/udp"
+      - "853:853/tcp" # DNS over TLS
       # - "67:67/udp" # DHCP
       # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
     volumes:
-      - ./data/work:/opt/adguardhome/work
-      - ./data/conf:/opt/adguardhome/conf
-    networks:
-      - traefik-proxy
+      - data:/opt/adguardhome/work
+      - ./conf:/opt/adguardhome/conf
+      - ./certs:/certs:ro
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
-
-      # Prod Router
-      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
-      - "traefik.http.routers.adguard.entrypoints=websecure"
-      - "traefik.http.routers.adguard.middlewares=security-headers@file"
-      - "traefik.http.routers.adguard.service=adguard"
-      - "traefik.http.routers.adguard.tls=true"
       - "traefik.http.services.adguard.loadbalancer.server.port=3000"
 
+      # Prod Router
+      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.entrypoints=websecure"
+      - "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
       # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
       - "traefik.http.routers.adguard-local.entrypoints=websecure"
-      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
-      - "traefik.http.routers.adguard-local.service=adguard"
       - "traefik.http.routers.adguard-local.tls=true"
-
       # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)"
       - "traefik.http.routers.adguard-dev.entrypoints=websecure"
-      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.adguard-dev.service=adguard"
       - "traefik.http.routers.adguard-dev.tls=true"
+      # DoH Router
+      - "traefik.http.routers.dns-over-https.rule=(Host(`dns.forust.xyz` || Host(`adguard.forust.xyz`)) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns-over-https.entrypoints=websecure"
+      - "traefik.http.routers.dns-over-https.tls.certresolver=letsencrypt"
 
+      # Glance Metadata
       - glance.name=adguard
       - glance.url=https://adguard.forust.xyz/
       - glance.description=AdGuard Home is a network-wide software for blocking ads.
+    networks:
+      - proxy
+volumes:
+  data:
 networks:
-  traefik-proxy:
+  proxy:
     external: true

adguardhome/k8s/adguard.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-lb-service
+  namespace: adguard
+  annotations:
+    metallb.io/loadBalancerIPs: "192.168.80.3"
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: adguard
+  ports:
+    - name: dns-udp
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: dns-tcp
+      port: 53
+      targetPort: 53
+      protocol: TCP
+    - name: dot
+      port: 853
+      targetPort: 853
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-service
+  namespace: adguard
+spec:
+  selector:
+    app: adguard
+  ports:
+    - port: 3000
+      name: webui
+      targetPort: 3000
+    - port: 53
+      name: dns
+      targetPort: 53
+      protocol: UDP
+    - port: 53
+      name: dns-tcp
+      targetPort: 53
+      protocol: TCP
+    - port: 853
+      name: dot
+      targetPort: 853
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard-deployment
+  namespace: adguard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: adguard
+  template:
+    metadata:
+      labels:
+        app: adguard
+    spec:
+      containers:
+        - name: adguard
+          image: adguard/adguardhome:latest
+          resources:
+            limits:
+              memory: "1.5Gi"
+              cpu: "300m"
+            requests:
+              memory: "500Mi"
+              cpu: "50m"
+          ports:
+            - containerPort: 3000
+              name: webui
+            - containerPort: 53
+              name: dns
+            - containerPort: 853
+              name: dot
+          volumeMounts:
+            - name: adguard-data
+              mountPath: /opt/adguardhome/work
+              subPath: work
+            - name: adguard-data
+              mountPath: /opt/adguardhome/conf
+              subPath: conf
+            - name: adguard-certs
+              mountPath: /certs
+              readOnly: true
+      volumes:
+        - name: adguard-data
+          persistentVolumeClaim:
+            claimName: adguard-pvc
+        - name: adguard-certs
+          secret:
+            secretName: adguard-certs
+            items:
+              - key: tls.crt
+                path: fullchain.pem
+              - key: tls.key
+                path: privkey.pem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: adguard-pvc
+  namespace: adguard
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

adguardhome/k8s/ingress.yaml

@@ -0,0 +1,43 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-prod
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: adguard-service
+          port: 3000
+    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: adguard-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-local
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: adguard-service
+          port: 3000
+    - match: (Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)) && PathPrefix(`/dns-query`)
+      kind: Rule
+      services:
+        - name: adguard-service
+          port: 3000

adguardhome/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: adguard

adguardhome/k8s/secrets.yaml.example

@@ -0,0 +1,10 @@
+kubectl apply -f k8s/namespace.yaml && \
+kubectl create secret tls adguard-certs -n adguard \
+  --cert=certs/fullchain.pem \
+  --key=certs/privkey.pem --dry-run=client -o yaml > \
+  k8s/secrets.yaml
+
+#  OR WITH NO FILE CREATION:
+kubectl create secret tls adguard-certs -n adguard \
+  --cert=certs/fullchain.pem --key=certs/privkey.pem \
+  --save-config

authentik/.env.example

@@ -0,0 +1,20 @@
+# ===================================
+# Authentification app (authentik)
+
+# PostgresQL conf 
+PG_PASS=change_this_cuz_its_ur_db_pass
+PG_USER=authentik # it's okay
+
+# Image Settings
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2025.10.2
+
+# Networking
+PORT_HTTP=9000
+PORT_HTTPS=9443 # btw likely already used by portainer
+
+AUTHENTIK_SECRET_KEY=super_secret_super_scary_authenik_key
+
+AUTHENTIK_BOOTSTRAP_PASSWORD=pls_change_this
+
+AUTHENTIK_ERROR_REPORTING__ENABLED=true # Or false to turn off

authentik/compose.yaml

@@ -0,0 +1,95 @@
+services:
+  postgresql:
+    image: docker.io/library/postgres:15-alpine
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    volumes:
+      - database:/var/lib/postgresql/data
+    networks:
+      - authentik
+
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    command: server
+    container_name: authentik-server
+    restart: unless-stopped
+    # ports:
+    #   - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTPS:-9443}:9443
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
+
+      # Prod Router
+      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
+      - "traefik.http.routers.authentik-server.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
+      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
+      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-dev.tls=true"
+    networks:
+      - proxy
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    restart: unless-stopped
+    user: root
+    command: worker
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+    networks:
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+volumes:
+  database:
+    driver: local
+networks:
+  authentik:
+  proxy:
+    external: true

authentik/k8s/authentik.yaml

@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-server-service
+  namespace: authentik
+spec:
+  type: ClusterIP
+  selector:
+    app: authentik-server
+  ports:
+    - port: 9000
+      targetPort: 9000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-worker-service
+  namespace: authentik
+spec:
+  type: ClusterIP
+  selector:
+    app: authentik-worker
+  ports:
+    - port: 9000
+      targetPort: 9000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server-deployment
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-server
+  template:
+    metadata:
+      labels:
+        app: authentik-server
+    spec:
+      containers:
+        - name: authentik-server
+          image: ghcr.io/goauthentik/server:2025.10.2
+          args: ["server"]
+          envFrom:
+            - configMapRef:
+                name: authentik-config
+            - secretRef:
+                name: authentik-secrets
+          ports:
+            - containerPort: 9000
+          resources:
+            requests:
+              memory: "700Mi"
+              cpu: "300m"
+            limits:
+              memory: "1.5Gi"
+              cpu: "1000m"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-worker-deployment
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-worker
+  template:
+    metadata:
+      labels:
+        app: authentik-worker
+    spec:
+      containers:
+        - name: authentik-worker
+          image: ghcr.io/goauthentik/server:2025.10.2
+          args: ["worker"]
+          securityContext:
+            runAsUser: 0
+          envFrom:
+            - configMapRef:
+                name: authentik-config
+            - secretRef:
+                name: authentik-secrets
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "300m"
+            limits:
+              memory: "1Gi"
+              cpu: "700m"

authentik/k8s/config.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-config
+  namespace: authentik
+data:
+  AUTHENTIK_IMAGE: ghcr.io/goauthentik/server
+  AUTHENTIK_TAG: "2025.10.2"
+  AUTHENTIK_POSTGRESQL__HOST: authentik-postgres-service
+  AUTHENTIK_POSTGRESQL__NAME: authentik
+  AUTHENTIK_ERROR_REPORTING__ENABLED: "true"

authentik/k8s/ingress.yaml

@@ -0,0 +1,32 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-prod
+  namespace: authentik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.forust.xyz`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: authentik-server-service
+          port: 9000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-local
+  namespace: authentik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.workstation.internal`) || Host(`auth.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: authentik-server-service
+          port: 9000

authentik/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

authentik/k8s/postgresql.yaml

@@ -0,0 +1,66 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-postgres-service
+  namespace: authentik
+spec:
+  clusterIP: None
+  selector:
+    app: authentik-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: authentik-postgres-statefulset
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app: authentik-postgres
+  serviceName: authentik-postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: authentik-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: docker.io/library/postgres:15-alpine
+          env:
+            - name: POSTGRES_DB
+              value: authentik
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: authentik-secrets
+                  key: AUTHENTIK_POSTGRESQL__USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: authentik-secrets
+                  key: AUTHENTIK_POSTGRESQL__PASSWORD
+          ports:
+            - containerPort: 5432
+              name: postgres
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "200m"
+            limits:
+              memory: "1Gi"
+              cpu: "500m"
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 5Gi

authentik/k8s/secrets.yaml.example

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authentik-secrets
+  namespace: authentik
+type: Opaque
+stringData:
+  AUTHENTIK_SECRET_KEY: ""
+  AUTHENTIK_POSTGRESQL__PASSWORD: ""
+  AUTHENTIK_POSTGRESQL__USER: authentik
+  AUTHENTIK_BOOTSTRAP_PASSWORD: authentik

cfddns/.env.example

@@ -0,0 +1,15 @@
+CLOUDFLARE_API_TOKEN=YOUR_CLOUDFLARE_API_TOKEN
+DOMAINS=example.com,dns.example.com,mc.example.com,auth.example.com,ssh.example.com
+IP4_DOMAINS=
+IP6_DOMAINS=
+IP4_PROVIDER=cloudflare.trace
+IP6_PROVIDER=none # change if you want to update AAAA
+UPDATE_CRON=@every 5m
+UPDATE_ON_START=true
+DELETE_ON_STOP=false
+DELETE_ON_FAILURE=true
+TTL=1
+PROXIED=!is(dns.example.com) && !is(mc.example.com) && !is(ssh.example.com)
+EMOJI=true
+UPTIMEKUMA=https://uptime-kuma.example.com/api/push/AsaSDFGFkfklaFALSKffkfFKfkfkfkFK?status=up&msg=OK&ping=
+REJECT_CLOUDFLARE_IPS=true

cfddns/compose.yaml

@@ -2,12 +2,29 @@ services:
   cloudflare-ddns:
     image: timothyjmiller/cloudflare-ddns:latest
     container_name: cloudflare-ddns
+    restart: unless-stopped
     security_opt:
       - no-new-privileges:true
-    network_mode: 'host'
+    network_mode: "host"
+    # https://github.com/timothymiller/cloudflare-ddns#-quick-start
     environment:
-      - PUID=1000
-      - PGID=1000
-    volumes:
-      - ./config.json:/config.json
-    restart: unless-stopped
+      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?Cloudflare API token is required}
+      - DOMAINS=${DOMAINS:-}
+      - IP4_DOMAINS=${IP4_DOMAINS:-}
+      - IP6_DOMAINS=${IP6_DOMAINS:-}
+      - IP4_PROVIDER=${IP4_PROVIDER:-cloudflare.trace}
+      - IP6_PROVIDER=${IP6_PROVIDER:-none}
+      - UPDATE_CRON=${UPDATE_CRON:-@every 5m}
+      - UPDATE_ON_START=${UPDATE_ON_START:-true}
+      - DELETE_ON_STOP=${DELETE_ON_STOP:-false}
+      - DELETE_ON_FAILURE=${DELETE_ON_FAILURE:-true}
+      - TTL=${TTL:-1} # 1=auto
+      # to proxy only "dns.example.com" and "wfs.example.com" use "!is(dns.domain.com) && !is (wfs.domain.com)"
+      - PROXIED=${PROXIED:-true}
+      - EMOJI=${EMOJI:-true}
+      - UPTIMEKUMA=${UPTIMEKUMA:-}
+      - HEALTHCHECKS=${HEALTHCHECKS:-}
+      - REJECT_CLOUDFLARE_IPS=${REJECT_CLOUDFLARE_IPS:-true}
+      # volumes:
+      # Prefer using environment variables for configuration, config.json legacy support
+      # - ./config.json:/config.json

cfddns/config.json.example

@@ -7,7 +7,7 @@
       "api_key": {
         "api_key": "api_key_here",
         "account_email": "your_email_here"
-      }
+      },
       "zone_id": "your_zone-id",
       "subdomains": [
         { "name": "", "proxied": true },

cfddns/k8s/.gitignore

@@ -0,0 +1 @@
+secret.yaml

cfddns/k8s/deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cfddns
+  labels:
+    app: cfddns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cfddns
+  template:
+    metadata:
+      labels:
+        app: cfddns
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+        - name: cloudflare-ddns
+          image: timothyjmiller/cloudflare-ddns:latest
+          imagePullPolicy: Always
+          resources:
+            requests:
+              memory: "20Mi"
+              cpu: "30m"
+            limits:
+              memory: "64Mi"
+              cpu: "50m"
+          envFrom:
+            - secretRef:
+                name: cfddns-secrets

cfddns/k8s/secret.yaml.example

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cfddns-secrets
+type: Opaque
+stringData:
+  CLOUDFLARE_API_TOKEN: your_token
+  DOMAINS: "example.com,www.example.com"
+  IP4_PROVIDER: cloudflare.trace
+  IP6_PROVIDER: none
+  UPDATE_CRON: "@every 5m"
+  UPDATE_ON_START: "true"
+  DELETE_ON_STOP: "false"
+  DELETE_ON_FAILURE: "true"
+  TTL: "1"
+  PROXIED: "true"
+  EMOJI: "true"
+  REJECT_CLOUDFLARE_IPS: "true"

checkmk/.env.example

@@ -0,0 +1,2 @@
+CMK_PASSWORD=password
+TZ=Europe/Berlin

checkmk/compose.yaml

@@ -0,0 +1,39 @@
+services:
+  checkmk:
+    image: "checkmk/check-mk-raw:2.4.0-latest"
+    container_name: "checkmk"
+    restart: unless-stopped
+    # ports:
+    #   - 5000:5000
+    #   - 6776:8000
+    volumes:
+      - sites:/omd/sites
+    tmpfs:
+      - /opt/omd/sites/cmk/tmp:uid=1000,gid=1000
+    environment:
+      - CMK_PASSWORD=${CMK_PASSWORD:-password}
+      - CMK_SITE_ID=cmk
+      - TZ=${TZ:-Etc/UTC}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.checkmk.loadbalancer.server.port=5000"
+
+      # Prod Router
+      - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
+      - "traefik.http.routers.checkmk.entrypoints=websecure"
+      - "traefik.http.routers.checkmk.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
+      - "traefik.http.routers.checkmk-local.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
+      - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true
+volumes:
+  sites:

checkmk/k8s/checkmk.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: checkmk-service
+  namespace: checkmk
+spec:
+  selector:
+    app: checkmk
+  ports:
+    - port: 5000
+      targetPort: 5000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: checkmk-deployment
+  namespace: checkmk
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: checkmk
+  template:
+    metadata:
+      labels:
+        app: checkmk
+    spec:
+      containers:
+        - name: checkmk
+          image: checkmk/check-mk-raw:2.4.0-latest
+          envFrom:
+            - secretRef:
+                name: checkmk-secrets
+            - configMapRef:
+                name: checkmk-config
+          ports:
+            - containerPort: 5000
+          volumeMounts:
+            - name: sites
+              mountPath: /omd/sites
+            - name: tmp
+              mountPath: /opt/omd/sites/cmk/tmp
+          resources:
+            requests:
+              memory: "2Gi"
+              cpu: "600m"
+            limits:
+              memory: "5Gi"
+              cpu: "4"
+      volumes:
+        - name: sites
+          persistentVolumeClaim:
+            claimName: checkmk-sites-pvc
+        - name: tmp
+          emptyDir:
+            medium: Memory
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: checkmk-sites-pvc
+  namespace: checkmk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

checkmk/k8s/config.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: checkmk-config
+  namespace: checkmk
+data:
+  TZ: Europe/Bratislava
+  CMK_SITE_ID: cmk

checkmk/k8s/ingress.yaml

@@ -0,0 +1,32 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-prod
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cmk.forust.xyz`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: checkmk-service
+          port: 5000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-local
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cmk.workstation.internal`) || Host(`cmk.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: checkmk-service
+          port: 5000

checkmk/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: checkmk

checkmk/k8s/secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: checkmk-secrets
+  namespace: checkmk
+type: Opaque
+stringData:
+  CMK_PASSWORD: "password"

converters/.env.example

@@ -0,0 +1,9 @@
+ACCOUNT_REGISTRATION=false
+HTTP_ALLOWED=false
+ALLOW_UNAUTHENTICAED=false
+AUTO_DELETE_EVERY_N_HOURS=24
+WEBROOT=/convert
+HIDE_HISTORY=false
+LANGUAGE=en
+UNAUTHED_USER_SHARING=false
+MAX_CONVERT_PROCESS=0

converters/compose.yaml

@@ -0,0 +1,70 @@
+services:
+  convertx:
+    container_name: convertx
+    image: ghcr.io/c4illin/convertx:latest
+    restart: unless-stopped
+    ports:
+      - "9992:3000"
+    # https://github.com/C4illin/ConvertX#environment-variables
+    environment:
+      - JWT_SECRET=$(JWT_SECRET)
+      - ACCOUNT_REGISTRATION=$(ACCOUNT_REGISTRATION:-false)
+      - HTTP_ALLOWED=$(HTTP_ALLOWED:-false)
+      - ALLOW_UNAUTHENTICATED=$(ALLOW_UNAUTHENTICATED:-false)
+      - AUTO_DELETE_EVERY_N_HOURS=$(AUTO_DELETE_EVERY_N_HOURS:-24)
+      - WEBROOT=$(WEBROOT)
+      - HIDE_HISTORY=$(HIDE_HISTORY:-false)
+      - LANGUAGE=$(LANGUAGE:-en)
+      - UNAUTHENTICATED_USER_SHARING=$(UNAUTHENTICATED_USER_SHARING:-false)
+      - MAX_CONVERT_PROCESS=$(MAX_CONVERT_PROCESS:-0)
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.convertx.loadbalancer.server.port=3000"
+      # Prod Router
+      - "traefik.http.routers.convertx.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx.entrypoints=websecure"
+      - "traefik.http.routers.convertx.priority=50"
+      - "traefik.http.routers.convertx.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.convertx-local.rule=Host(`workstation.internal`) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx-local.entrypoints=websecure"
+      - "traefik.http.routers.convertx-local.priority=50"
+      - "traefik.http.routers.convertx-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.convertx-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx-dev.entrypoints=websecure"
+      - "traefik.http.routers.convertx-dev.priority=50"
+      - "traefik.http.routers.convertx-dev.tls=true"
+    networks:
+      - proxy
+    volumes:
+      - data:/app/data
+
+  bentopdf:
+    container_name: bentopdf
+    image: bentopdf/bentopdf:latest
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.bentopdf.loadbalancer.server.port=8080"
+
+      # Prod router
+      - "traefik.http.routers.bentopdf.rule=Host(`pdf.forust.xyz`)"
+      - "traefik.http.routers.bentopdf.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.bentopdf.tls=true"
+      # Local router
+      - "traefik.http.routers.bentopdf-local.rule=Host(`pdf.wokstation.internal`)"
+      - "traefik.http.routers.bentopdf-local.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf-local.tls=true"
+      # Dev router
+      - "traefik.http.routers.bentopdf-dev.rule=Host(`pdf.gigaforust.internal`)"
+      - "traefik.http.routers.bentopdf-dev.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true
+volumes:
+  data:

converters/k8s/bentopdf.yaml

@@ -0,0 +1,42 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: bentopdf-service
+  namespace: converters
+spec:
+  selector:
+    app: bentopdf
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf-deployment
+  namespace: converters
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: bentopdf
+  template:
+    metadata:
+      labels:
+        app: bentopdf
+    spec:
+      containers:
+        - image: bentopdf/bentopdf:latest
+          imagePullPolicy: Always
+          name: bentopdf
+          ports:
+            - containerPort: 8080
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+              ephemeral-storage: "100Mi"
+            limits:
+              memory: "700Mi"
+              cpu: "700m"
+              ephemeral-storage: "5Gi"

converters/k8s/config.yaml.example

@@ -0,0 +1,16 @@
+# test manifest with docker and k8s config keys mismatch
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: convertx-config
+  namespace: converters
+data:
+  ACCOUNT_REGISTRATION: "false"
+  HTTP_ALLOWED: "false"
+  ALLOW_UNAUTHENTICAED: "false"
+  AUTO_DELETE_EVERY_N_HOURS: "24"
+  WEBROOT: "/convert"
+  HIDE_HISTORY: "false"
+  LANGUAGE: "en"
+  UNAUTHED_USER_SHARING: "false"
+  MAX_CONVERT_PROCESS: "0"

converters/k8s/convertx.yaml

@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: convertx-service
+  namespace: converters
+spec:
+  selector:
+    app: convertx
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: convertx-deployment
+  namespace: converters
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: convertx
+  template:
+    metadata:
+      labels:
+        app: convertx
+    spec:
+      containers:
+        - image: ghcr.io/c4illin/convertx:latest
+          name: convertx
+          envFrom:
+            - configMapRef:
+                name: convertx-config
+            - secretRef:
+                name: convertx-secrets
+          ports:
+            - containerPort: 3000
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          resources:
+            requests:
+              memory: "250Mi"
+              cpu: "100m"
+            limits:
+              cpu: "1500m"
+              memory: "1.5Gi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: convertx-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: convertx-pvc
+  namespace: converters
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

converters/k8s/ingress.yaml

@@ -0,0 +1,65 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: convertx-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`workstation.internal`) || Host(`gigaforust.internal`)) && PathPrefix(`/convert`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: convertx-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.forust.xyz`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.workstation.internal`) || Host(`pdf.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080

converters/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: converters

converters/k8s/secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: convertx-secrets
+  namespace: converters
+type: Opaque
+stringData:
+  jwt-secret: ""

dockmon/compose.yaml

@@ -1,54 +1,46 @@
 services:
-   dockmon:
-      image: darthnorse/dockmon:latest
-      container_name: dockmon
-      restart: unless-stopped
-      ports:
-         - 8000:443
-      environment:
-         - TZ=Europe/Bratislava
-      volumes:
-         - ./data:/app/data
-         - /var/run/docker.sock:/var/run/docker.sock
-      healthcheck:
-         test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
-         interval: 30s
-         timeout: 10s
-         retries: 3
-      networks:
-         - traefik-proxy
-      labels:
-         - "traefik.enable=true"
-         - "traefik.docker.network=traefik-proxy"
+  dockmon:
+    image: darthnorse/dockmon:latest
+    container_name: dockmon
+    restart: unless-stopped
+    # ports:
+    #   - 8000:443
+    volumes:
+      - data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      test: ["CMD", "curl", "-k", "-f", "https://localhost:443/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+      - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+      - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
 
-         # Prod Router
-         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
-         - "traefik.http.routers.dockmon.entrypoints=websecure"
-         - "traefik.http.routers.dockmon.middlewares=security-headers@file,dockmon-auth@file"
-         - "traefik.http.routers.dockmon.service=dockmon"
-         - "traefik.http.routers.dockmon.tls=true"
-         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
-         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
-         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
-
-         # Local Router
-         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`) || Host(`dockmon.internal`)"
-         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
-         - "traefik.http.routers.dockmon-local.service=dockmon"
-         - "traefik.http.routers.dockmon-local.tls=true"
-
-         # Dev Router
-         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
-         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.middlewares=security-headers@file"
-         - "traefik.http.routers.dockmon-dev.service=dockmon"
-         - "traefik.http.routers.dockmon-dev.tls=true"
-
-         - glance.name=dockmon
-         - glance.url=https://dockmon.forust.xyz/
-         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
+      # Prod Router
+      - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+      - "traefik.http.routers.dockmon.entrypoints=websecure"
+      - "traefik.http.routers.dockmon.middlewares=security-headers@file"
+      - "traefik.http.routers.dockmon.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
+      - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+      - "traefik.http.routers.dockmon-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
+      - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+      - "traefik.http.routers.dockmon-dev.tls=true"
 
+      # Glance Metadata
+      - glance.name=dockmon
+      - glance.url=https://dockmon.forust.xyz/
+      - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
+    networks:
+      - proxy
+volumes:
+  data:
 networks:
-   traefik-proxy:
-      external: true
+  proxy:
+    external: true

dockmon/k8s/dockmon.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dockmon-service
+  namespace: dockmon
+spec:
+  clusterIP: None
+  selector:
+    app: dockmon
+  ports:
+    - port: 443
+      targetPort: 443
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: dockmon-statefulset
+  namespace: dockmon
+spec:
+  serviceName: dockmon-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dockmon
+  template:
+    metadata:
+      labels:
+        app: dockmon
+    spec:
+      containers:
+        - name: dockmon
+          image: darthnorse/dockmon:latest
+          ports:
+            - containerPort: 443
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 443
+              scheme: HTTPS
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "200m"
+            limits:
+              memory: "1.5Gi"
+              cpu: "700m "
+      volumes:
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

dockmon/k8s/ingress.yaml

@@ -0,0 +1,43 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: dockmon-transport
+  namespace: dockmon
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-prod
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`dockmon.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: security-headers@file
+      services:
+        - name: dockmon-service
+          port: 443
+          serversTransport: dockmon-transport
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-local
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`dockmon.workstation.internal`) || Host(`dockmon.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: dockmon-service
+          port: 443
+          serversTransport: dockmon-transport

dockmon/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dockmon

downtify/compose.yaml

@@ -0,0 +1,31 @@
+services:
+  downtify:
+    container_name: downtify
+    image: ghcr.io/henriquesebastiao/downtify:latest
+    restart: unless-stopped
+    # ports:
+    #   - '7077:8000'
+    volumes:
+      - ./Downtify_downloads:/downloads
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.downtify.loadbalancer.server.port=8000"
+
+      # Prod Router
+      - "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
+      - "traefik.http.routers.downtify.entrypoints=websecure"
+      - "traefik.http.routers.downtify.middlewares=security-chain@file"
+      - "traefik.http.routers.downtify.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
+      - "traefik.http.routers.downtify-local.entrypoints=websecure"
+      - "traefik.http.routers.downtify-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)"
+      - "traefik.http.routers.downtify-dev.entrypoints=websecure"
+      - "traefik.http.routers.downtify-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true

downtify/k8s/downtify.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: downtify-service
+  namespace: downtify
+spec:
+  selector:
+    app: downtify
+  ports:
+    - port: 8000
+      targetPort: 8000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: downtify-deployment
+  namespace: downtify
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: downtify
+  template:
+    metadata:
+      labels:
+        app: downtify
+    spec:
+      containers:
+        - name: downtify
+          image: ghcr.io/henriquesebastiao/downtify:latest
+          ports:
+            - containerPort: 8000
+          volumeMounts:
+            - name: downloads
+              mountPath: /downloads
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "200m"
+            limits:
+              memory: "1Gi"
+              cpu: "1"
+      volumes:
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: downtify-downloads-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: downtify-downloads-pvc
+  namespace: downtify
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

downtify/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-prod
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`downtify.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: security-chain@file
+      services:
+        - name: downtify-service
+          port: 8000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-local
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`downtify.workstation.internal`) || Host(`downtify.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: downtify-service
+          port: 8000

downtify/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: downtify

dtek_notif/docker-compose.yaml

@@ -3,10 +3,11 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
+    image: gcr.forust.xyz/forust/dtek-notif:latest
+    pull_policy: build
     restart: unless-stopped
     environment:
       - TZ=Europe/Kyiv
-    
     dns:
       - 1.1.1.1
       - 8.8.8.8

edu_master/compose.yaml

@@ -5,7 +5,7 @@ services:
     volumes:
       - redis-data:/data
     healthcheck:
-      test: [ "CMD", "redis-cli", "ping" ]
+      test: ["CMD", "redis-cli", "ping"]
       interval: 5s
       timeout: 3s
       retries: 5
@@ -17,13 +17,15 @@ services:
 
   session-keeper:
     build: ./phpsessid-bot
+    image: gcr.forust.xyz/forust/session-keeper:latest
+    pull_policy: build
     env_file: .env
     restart: unless-stopped
     depends_on:
       redis:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1" ]
+      test: ["CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
       interval: 30s
       timeout: 5s
       retries: 10
@@ -31,6 +33,8 @@ services:
 
   webinar-checker:
     build: ./webinar-checker
+    image: gcr.forust.xyz/forust/webinar-checker:latest
+    pull_policy: build
     env_file: .env
     restart: unless-stopped
     depends_on:

edu_master/phpsessid-bot/Dockerfile

@@ -3,10 +3,10 @@ FROM python:3.11-slim
 WORKDIR /app
 
 # Install system dependencies
-RUN apt-get update && apt-get install -y redis-tools && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends redis-tools && rm -rf /var/lib/apt/lists/*
 
 # Install dependencies
-RUN pip install requests redis
+RUN pip install --no-cache-dir requests==2.32.3 redis==5.2.1
 
 # Copy application code
 COPY . .

edu_master/phpsessid-bot/bot.py

@@ -1,28 +1,43 @@
+import logging
 import os
 import time
-import requests
-import logging
-import redis
 from datetime import datetime
 
+import redis
+import requests
+
 # Configure logging
-logging.basicConfig(
-    level=logging.INFO,
-    format='%(asctime)s - %(levelname)s - %(message)s'
-)
+logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
 logger = logging.getLogger(__name__)
 
-# Load configuration
-LOGIN = os.getenv('EDU_LOGIN')
-PASSWORD = os.getenv('EDU_PASSWORD')
-URL_LOGIN = os.getenv('EDU_URL_LOGIN', 'https://edu.edu.vn.ua/user/login')
-URL_VERIFY = os.getenv('EDU_URL_VERIFY', 'https://edu.edu.vn.ua/course/userlist')
-INTERVAL = int(os.getenv('PHPSESSID_INTERVAL', 10))
-USER_AGENT = os.getenv('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
-REDIS_HOST = os.getenv('REDIS_HOST', 'redis')
-REDIS_PORT = int(os.getenv('REDIS_PORT', 6379))
 
-SUCCESS_FILE = '/tmp/last_success'
+# Load configuration (adapted to .env keys)
+def _env(key, default=None):
+    v = os.getenv(key, default)
+    if isinstance(v, str) and len(v) >= 2 and ((v[0] == '"' and v[-1] == '"') or (v[0] == "'" and v[-1] == "'")):
+        return v[1:-1]
+    return v
+
+
+LOGIN = _env('KEEPER_LOGIN')
+PASSWORD = _env('KEEPER_PASSWORD')
+
+EDU_BASE = _env('EDU_URL_BASE', 'https://edu.edu.vn.ua')
+EDU_LOGIN_PATH = _env('EDU_URL_LOGIN', '/user/login')
+EDU_COURSES_PATH = _env('EDU_URL_COURSES', '/course/userlist')
+URL_LOGIN = f'{EDU_BASE.rstrip("/")}/{EDU_LOGIN_PATH.lstrip("/")}'
+URL_VERIFY = f'{EDU_BASE.rstrip("/")}/{EDU_COURSES_PATH.lstrip("/")}'
+
+INTERVAL = int(_env('KEEPER_INTERVAL', 10))
+USER_AGENT = _env(
+    'USER_AGENT',
+    'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36',
+)
+REDIS_HOST = _env('REDIS_HOST', 'redis')
+REDIS_PORT = int(_env('REDIS_PORT', 6379))
+
+SUCCESS_FILE = '/tmp/last_success'  # noqa: S108
+
 
 def touch_success_file():
     """Updates the timestamp of the success file for healthchecks."""
@@ -30,18 +45,19 @@ def touch_success_file():
         with open(SUCCESS_FILE, 'w') as f:
             f.write(str(datetime.now().timestamp()))
     except Exception as e:
-        logger.error(f"Failed to touch success file: {e}")
+        logger.error(f'Failed to touch success file: {e}')
+
 
 def main():
-    logger.info("Starting Session Keeper Bot")
+    logger.info('Starting Session Keeper Bot')
 
     # Connect to Redis
     try:
         redis_client = redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True)
         redis_client.ping()
-        logger.info(f"Connected to Redis at {REDIS_HOST}:{REDIS_PORT}")
+        logger.info(f'Connected to Redis at {REDIS_HOST}:{REDIS_PORT}')
     except Exception as e:
-        logger.error(f"Failed to connect to Redis: {e}")
+        logger.error(f'Failed to connect to Redis: {e}')
         return
 
     session = requests.Session()
@@ -61,19 +77,16 @@ def main():
         'Sec-Ch-Ua-Mobile': '?0',
         'Sec-Ch-Ua-Platform': '"Linux"',
         'Accept-Encoding': 'gzip, deflate, br',
-        'Priority': 'u=0, i'
+        'Priority': 'u=0, i',
     }
     session.headers.update(headers)
 
     while True:
         try:
-            logger.info("Attempting login...")
+            logger.info('Attempting login...')
 
             # Login payload
-            payload = {
-                'login': LOGIN,
-                'password': PASSWORD
-            }
+            payload = {'login': LOGIN, 'password': PASSWORD}
 
             # Perform Login
             # Note: The user request shows a POST to /user/login with form data
@@ -82,17 +95,17 @@ def main():
 
             login_response = session.post(URL_LOGIN, data=payload, allow_redirects=True)
 
-            logger.info(f"Login Response Status: {login_response.status_code}")
-            logger.info(f"Cookies after login: {session.cookies.get_dict()}")
+            logger.info(f'Login Response Status: {login_response.status_code}')
+            logger.info(f'Cookies after login: {session.cookies.get_dict()}')
 
             # Verify Session
-            logger.info("Verifying session...")
+            logger.info('Verifying session...')
             verify_response = session.get(URL_VERIFY, allow_redirects=False)
 
-            logger.info(f"Verify Response Status: {verify_response.status_code}")
+            logger.info(f'Verify Response Status: {verify_response.status_code}')
 
             if verify_response.status_code == 200:
-                logger.info("Session verification SUCCESS (200 OK).")
+                logger.info('Session verification SUCCESS (200 OK).')
                 touch_success_file()
 
                 # Save PHPSESSID to Redis
@@ -100,19 +113,20 @@ def main():
                 if phpsessid:
                     try:
                         redis_client.set('EDU_PHPSESSID', phpsessid)
-                        logger.info(f"Saved PHPSESSID to Redis: {phpsessid}")
+                        logger.info(f'Saved PHPSESSID to Redis: {phpsessid}')
                     except Exception as e:
-                        logger.error(f"Failed to save PHPSESSID to Redis: {e}")
+                        logger.error(f'Failed to save PHPSESSID to Redis: {e}')
             elif verify_response.status_code == 302:
-                logger.warning("Session verification FAILED (302 Redirect). Session might be invalid.")
+                logger.warning('Session verification FAILED (302 Redirect). Session might be invalid.')
             else:
-                logger.warning(f"Session verification returned unexpected status: {verify_response.status_code}")
+                logger.warning(f'Session verification returned unexpected status: {verify_response.status_code}')
 
         except Exception as e:
-            logger.error(f"An error occurred: {e}")
+            logger.error(f'An error occurred: {e}')
 
-        logger.info(f"Sleeping for {INTERVAL} minutes...")
+        logger.info(f'Sleeping for {INTERVAL} minutes...')
         time.sleep(INTERVAL * 60)
 
-if __name__ == "__main__":
+
+if __name__ == '__main__':
     main()

edu_master/webinar-checker/Dockerfile

@@ -3,7 +3,7 @@ FROM python:3.11-slim
 WORKDIR /app
 
 # Install dependencies
-RUN pip install --upgrade pip && pip install playwright==1.56.0 redis requests "python-telegram-bot[job-queue]"
+RUN pip install --no-cache-dir pip==25.0.1 && pip install --no-cache-dir playwright==1.56.0 redis==5.2.1 requests==2.32.3 "python-telegram-bot[job-queue]==21.10"
 
 COPY checker.py .
 

errorpages/Dockerfile

@@ -0,0 +1,5 @@
+FROM nginx:alpine
+RUN rm -rf /usr/share/nginx/html/*
+COPY html /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

errorpages/compose.yaml

@@ -0,0 +1,21 @@
+services:
+  errorpage:
+    build: .
+    image: gcr.forust.xyz/forust/error-pages:latest
+    pull_policy: build
+    container_name: error-pages
+    restart: unless-stopped
+    # ports:
+    #   - 1234:80
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.error-pages.loadbalancer.server.port=80"
+      # Error handler middleware
+      - "traefik.http.middlewares.error-pages.errors.status=400,402-599"
+      - "traefik.http.middlewares.error-pages.errors.service=error-pages"
+      - "traefik.http.middlewares.error-pages.errors.query=/{status}.html"
+networks:
+  proxy:
+    external: true

errorpages/html/403.html

@@ -0,0 +1,208 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>403 // Forbidden</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="403">403</h1>
+            <p class="subtitle">> Forbidden / Access Denied.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>You do not have permission to access this resource.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> if you believe this is an
+                error.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ sudo access_resource</p>
+            <p>User is not in the sudoers file. This incident will be reported.</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/404.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>404 // Not Found</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="404">404</h1>
+            <p class="subtitle">> Page Not Found / Lost in the Void.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The page you are looking for does not exist or has been moved.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> if you believe this is an error.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ ping target</p>
+            <p>Destination Host Unreachable</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/500.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>500 // Server Error</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="500">500</h1>
+            <p class="subtitle">> Internal Server Error / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>Something went wrong on our end. We are working to fix it.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ systemctl status service</p>
+            <p>Active: failed (Result: core-dump)</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/502.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>502 // Bad Gateway</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="502">502</h1>
+            <p class="subtitle">> Bad Gateway / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The server received an invalid response from the upstream server.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ curl -I upstream_host</p>
+            <p>HTTP/1.1 502 Bad Gateway</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/503.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>503 // Service Unavailable</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="503">503</h1>
+            <p class="subtitle">> Service Unavailable / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The server is currently unable to handle the request due to maintenance or overload.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ systemctl start service</p>
+            <p>Job for service failed because the control process exited with error code.</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/html/504.html

@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>504 // Gateway Timeout</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
+    </style>
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="504">504</h1>
+            <p class="subtitle">> Gateway Timeout / System Failure.</p>
+        </header>
+
+        <hr>
+
+        <section id="message">
+            <h2>./error_message</h2>
+            <p>The server did not receive a timely response from the upstream server.</p>
+            <br>
+            <p>Check the <a href="https://status.forust.xyz">System Status</a> for more information.</p>
+        </section>
+
+        <footer>
+            <p>root@error:~$ timeout 30s curl upstream</p>
+            <p>curl: (28) Operation timed out after 30001 milliseconds with 0 bytes received</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>

errorpages/k8s/error-pages.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: error-pages-service
+  namespace: error-pages
+spec:
+  selector:
+    app: error-pages
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: error-pages-deployment
+  namespace: error-pages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: error-pages
+  template:
+    metadata:
+      labels:
+        app: error-pages
+    spec:
+      containers:
+        - name: error-pages
+          image: gcr.forust.xyz/forust/error-pages:latest
+          ports:
+            - containerPort: 80
+---

errorpages/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: error-pages

gitea/.env.example

@@ -1,3 +1,6 @@
 GITEA_POSTGRES_USER=
 GITEA_POSTGRES_PASSWORD=
 GITEA_POSTGRES_DB=gitea
+GITEA_SMTP_PASS=
+MAILER_ADDR=
+SERVICE_EMAIL=email.used.by.services@domain.tld

gitea/compose.yaml

@@ -1,7 +1,8 @@
 services:
   server:
-    image: docker.gitea.com/gitea:1.25.1
+    image: docker.gitea.com/gitea:1.26
     container_name: gitea
+    restart: always
     environment:
       - USER_UID=1000
       - USER_GID=1000
@@ -11,47 +12,54 @@ services:
       - GITEA__database__USER=gitea
       - GITEA__database__PASSWD=gitea
       - GITEA__database__NAME=gitea
-      #Server
+      # Server
       - GITEA__server__ROOT_URL=https://gitea.forust.xyz
+      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
       - GITEA__server__SSH_PORT=2221
-    restart: always
-    networks:
-      - gitea-db
-      - traefik-proxy
+      # Mailer
+      - GITEA__mailer__ENABLED=true
+      - GITEA__mailer__FROM=${SERVICE_EMAIL}
+      - GITEA__mailer__SMTP_ADDR=${MAILER_ADDR}:465
+      - GITEA__mailer__USER=${SERVICE_EMAIL}
+      - GITEA__mailer__PASSWD=${GITEA_SMTP_PASS}
+      - GITEA__mailer__PROTOCOL=SMTP
+      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
+      - GITEA__service__ENABLE_NOTIFY_MAIL=true
     volumes:
       - ./gitea-data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
       # Prod Router
       - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.middlewares=security-headers@file"
-      - "traefik.http.routers.gitea.service=gitea"
-      - "traefik.http.routers.gitea.tls=true"
-      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-
+      - "traefik.http.routers.gitea.tls.certresolver"
       # Local Router
-      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`) || Host(`gitea.internal`)"
+      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`)"
       - "traefik.http.routers.gitea-local.entrypoints=websecure"
-      - "traefik.http.routers.gitea-local.middlewares=security-headers@file"
-      - "traefik.http.routers.gitea-local.service=gitea"
       - "traefik.http.routers.gitea-local.tls=true"
-
       # Dev Router
       - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)"
       - "traefik.http.routers.gitea-dev.entrypoints=websecure"
-      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.gitea-dev.service=gitea"
       - "traefik.http.routers.gitea-dev.tls=true"
+      # SSH Router
+      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
+      - "traefik.tcp.routers.gitea.entrypoints=ssh"
+      - "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
+      # Gitea container registry Router
+      - "traefik.http.routers.gitea-registry.rule=Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)"
+      - "traefik.http.routers.gitea-registry.entrypoints=websecure"
+      - "traefik.http.routers.gitea-registry.tls.certresolver=letsencrypt"
     ports:
       - "2221:22"
+    networks:
+      - gitea-db
+      - proxy
     depends_on:
       - db
-
   db:
     image: docker.io/library/postgres:14
     restart: always
@@ -59,13 +67,12 @@ services:
       - POSTGRES_USER=gitea
       - POSTGRES_PASSWORD=gitea
       - POSTGRES_DB=gitea
-    networks:
-      - gitea-db
     volumes:
       - ./gitea-db/:/var/lib/postgresql/data
-
+    networks:
+      - gitea-db
 networks:
   gitea-db:
     external: false
-  traefik-proxy:
+  proxy:
     external: true

gitea/k8s/config.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-config
+  namespace: gitea
+data:
+  GITEA__server__DOMAIN: "gitea.forust.xyz"
+  GITEA__server__ROOT_URL: "https://gitea.forust.xyz"
+  GITEA__server__SSH_DOMAIN: "gitssh.forust.xyz"
+  GITEA__server__SSH_PORT: "2221"
+
+  GITEA__database__DB_TYPE: "postgres"
+  GITEA__database__HOST: "gitea-postgres-service:5432"
+  GITEA__database__NAME: "gitea"
+  GITEA__security__REVERSE_PROXY_LIMIT: "1"
+  GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"
+
+  GITEA__mailer__ENABLED: "false"
+
+  GITEA__log__logger__access__MODE: "console, file"
+  USER_UID: "1000"
+  USER_GID: "1000"

gitea/k8s/gitea.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-service
+  namespace: gitea
+spec:
+  selector:
+    app: gitea
+  ports:
+    - port: 3000
+      name: http
+      targetPort: 3000
+    - port: 2221
+      name: ssh
+      targetPort: 22
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-deployment
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      containers:
+        - name: gitea
+          image: docker.gitea.com/gitea:1.26
+          envFrom:
+            - configMapRef:
+                name: gitea-config
+            - secretRef:
+                name: gitea-secrets
+          ports:
+            - containerPort: 3000
+              name: http
+            - containerPort: 2221
+              name: ssh
+          volumeMounts:
+            - name: gitea-data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "300m"
+            limits:
+              memory: "1.5Gi"
+              cpu: "1300m"
+      volumes:
+        - name: gitea-data
+          persistentVolumeClaim:
+            claimName: gitea-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-pvc
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---

gitea/k8s/ingress.yaml

@@ -0,0 +1,57 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-prod
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.forust.xyz`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: gitea-service
+          port: 3000
+    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: gitea-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-local
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: gitea-service
+          port: 3000
+    - match: (Host(`gcr.workstation.internal`) || Host(`gcr.gigaforust.internal`)) && PathPrefix(`/v2`)
+      kind: Rule
+      services:
+        - name: gitea-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: gitea-service
+          port: 2221

gitea/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea

gitea/k8s/postgres.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgres-service
+  namespace: gitea
+spec:
+  clusterIP: None
+  selector:
+    app: gitea-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-postgres-statefulset
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      app: gitea-postgres
+  serviceName: gitea-postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: gitea-postgres
+    spec:
+      containers:
+        - name: gitea-postgres
+          image: postgres:14
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: GITEA__database__USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: GITEA__database__PASSWD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: GITEA__database__USER
+          ports:
+            - containerPort: 5432
+              name: postgres
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

gitea/k8s/secrets.yaml.example

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-secrets
+  namespace: gitea
+type: Opaque
+stringData:
+  GITEA__database__USER: "gitea"
+  GITEA__database__PASSWD: "gitea"

glance/compose.yaml

@@ -11,30 +11,26 @@ services:
     env_file: .env
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
+      - "traefik.services.glance.loadbalancer.server.port=8080"
 
       # Prod Router
-      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
+      - "traefik.http.routers.glance.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/glance`)"
       - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.middlewares=security-headers@file"
-      - "traefik.http.routers.glance.tls=true"
-
+      - "traefik.http.routers.glance.priority=50"
+      - "traefik.http.routers.glance.tls.certresolver=letsencrypt"
       # Local Router
-      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`) || Host(`glance.internal`)"
+      - "traefik.http.routers.glance-local.rule=Host(`workstation.internal`) && PathPrefix(`/glance`)"
       - "traefik.http.routers.glance-local.entrypoints=websecure"
-      - "traefik.http.routers.glance-local.middlewares=security-headers@file"
+      - "traefik.http.routers.glance-local.priority=50"
       - "traefik.http.routers.glance-local.tls=true"
-
       # Dev Router
-      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
+      - "traefik.http.routers.glance-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/glance`)"
       - "traefik.http.routers.glance-dev.entrypoints=websecure"
-      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.glance-dev.priority=50"
       - "traefik.http.routers.glance-dev.tls=true"
     networks:
-      - traefik-proxy
-    dns:
-      - 1.1.1.1
-      - 8.8.8.8
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
     external: true

glance/config/home.yml

@@ -65,7 +65,6 @@
             - symbol: MSFT
               name: Microsoft
 
-
         - type: releases
           cache: 1d
           # Without authentication the Github API allows for up to 60 requests per hour. You can create a

glance/config/monitor.yml

@@ -1,15 +1,13 @@
 - name: Monitoring
   columns:
-  - size: small
-    widgets:
-      - type: dns-stats
-        service: adguard
-        url: http://adguardhome:3000
-        username: forust
-        password: ${ADGUARD_PASSWORD}
-  - size: full
-    widgets:
-      - type: docker-containers
-        hide-by-default: false
-        
-  
+    - size: small
+      widgets:
+        - type: dns-stats
+          service: adguard
+          url: http://adguardhome:3000
+          username: forust
+          password: ${ADGUARD_PASSWORD}
+    - size: full
+      widgets:
+        - type: docker-containers
+          hide-by-default: false

glance/k8s/glance-config.yaml

@@ -0,0 +1,211 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: glance-assets
+  namespace: glance
+data:
+  # Инжектируем твой брутализм напрямую в ассеты
+  user.css: |
+    :root {
+        --bg-color: #050505;
+        --text-color: #e0e0e0;
+        --accent: #ffffff;
+        --dim: #666666;
+        --font-mono: 'Courier New', Courier, monospace;
+    }
+
+    /* Принудительно ставим моноширинный шрифт для всего дашборда */
+    body, id, main, div, span, p, a, h1, h2, h3 {
+        font-family: var(--font-mono) !important;
+        letter-spacing: -0.5px;
+    }
+
+    /* Ломаем закругления Glance и делаем жесткие рамки */
+    .widget, .card, main div, [class*="widget"], [class*="card"] {
+        border-radius: 0px !important;
+        border: 1px solid var(--dim) !important;
+        box-shadow: none !important;
+        background-color: var(--bg-color) !important;
+    }
+
+    /* Стилизация ссылок под ховер-эффект из твоего style.css */
+    a {
+        color: var(--text-color) !important;
+        text-decoration: none !important;
+        border-bottom: 1px solid var(--dim) !important;
+        transition: all 0.2s;
+    }
+    a:hover {
+        background-color: var(--text-color) !important;
+        color: var(--bg-color) !important;
+        border-color: var(--text-color) !important;
+    }
+
+    /* Кастомизация заголовков внутри модулей */
+    h2, .widget-title, [class*="title"] {
+        text-transform: uppercase;
+        font-weight: bold;
+    }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: glance-config
+  namespace: glance
+data:
+  glance.yml: |
+    server:
+      assets-path: /app/assets
+      proxied: true
+      base-url: /glance
+    theme:
+      # Перевели #050505 и #e0e0e0 в формат HSL для Glance
+      background-color: 0 0 2       # Истинно черный фон
+      primary-color: 0 0 88         # Светло-серый текст
+      contrast-multiplier: 1.4
+      positive-color: 140 50 50     # Зеленый для UP-сервисов (не вырвиглазный)
+      negative-color: 0 70 50       # Красный для упавших сайтов
+      custom-css-file: /assets/user.css
+    pages:
+      - $include: home.yml
+      - $include: docker.yml
+      - $include: monitor.yml
+
+  home.yml: |
+    - name: Home
+      columns:
+        - size: small
+          widgets:
+            - type: clock
+              hour-format: 24h
+              timezones:
+                - timezone: Europe/Bratislava
+                  label: Bratislava
+                - timezone: Europe/Kyiv
+                  label: Kyiv
+                - timezone: Europe/Moscow
+                  label: St. Petersburg
+            - type: calendar
+              first-day-of-week: monday
+            - type: rss
+              limit: 10
+              collapse-after: 3
+              cache: 12h
+              feeds:
+                - url: https://selfh.st/rss/
+                  title: selfh.st
+        - size: full
+          widgets:
+            - type: group
+              widgets:
+                - type: hacker-news
+                - type: lobsters
+            - type: videos
+              channels:
+                - UCXuqSBlHAE6Xw-yeJA0Tunw
+                - UCR-DXc1voovS8nhAvccRZhg
+                - UCsBjURrPoezykLs9EqgamOA
+                - UCBJycsmduvYEL83R_U4JriQ
+                - UCHnyfMqiRRG1u-2MsSQLbXA
+            - type: group
+              widgets:
+                - type: reddit
+                  subreddit: technology
+                  show-thumbnails: true
+                - type: reddit
+                  subreddit: selfhosted
+                  show-thumbnails: true
+        - size: small
+          widgets:
+            - type: weather
+              location: London, United Kingdom
+              units: metric
+              hour-format: 12h
+              hide-location: true
+            - type: markets
+              markets:
+                - symbol: SPY
+                  name: S&P 500
+                - symbol: BTC-USD
+                  name: Bitcoin
+                - symbol: NVDA
+                  name: NVIDIA
+                - symbol: AAPL
+                  name: Apple
+                - symbol: MSFT
+                  name: Microsoft
+            - type: releases
+              cache: 1d
+              repositories:
+                - glanceapp/glance
+                - go-gitea/gitea
+                - nextcloud/all-in-one
+
+  docker.yml: |
+    - name: Docker
+      columns:
+        - size: full
+          widgets:
+            - type: docker-containers
+              hide-by-default: false
+
+  monitor.yml: |
+    - name: Monitoring
+      columns:
+        - size: small
+          widgets:
+            - type: dns-stats
+              service: adguard
+              url: http://adguard-service.adguard.svc.cluster.local:3000
+              username: forust
+              password: ${ADGUARD_PASSWORD}
+        - size: full
+          widgets:
+            - type: monitor
+              title: Services Status
+              cache: 1m
+              sites:
+                - title: forust.xyz
+                  url: https://forust.xyz
+                - title: dns.forust.xyz
+                  url: https://dns.forust.xyz
+                - title: www.lk-tour.com.ua
+                  url: https://www.lk-tour.com.ua
+                - title: lk-tour.com.ua
+                  url: https://lk-tour.com.ua
+                # - title: gitssh.forust.xyz
+                  # url: https://gitssh.forust.xyz
+                # - title: gcr.forust.xyz
+                  # url: https://gcr.forust.xyz/v2/
+                - title: gitea.forust.xyz
+                  url: https://gitea.forust.xyz
+                - title: nextcloud.forust.xyz
+                  url: https://nextcloud.forust.xyz
+                - title: mc.forust.xyz
+                  url: https://mc.forust.xyz/map
+                - title: auth.forust.xyz
+                  url: https://auth.forust.xyz
+                - title: metube.forust.xyz
+                  url: https://metube.forust.xyz
+                - title: dockmon.forust.xyz
+                  url: https://dockmon.forust.xyz
+                - title: portainer.forust.xyz
+                  url: https://portainer.forust.xyz
+                - title: termix.forust.xyz
+                  url: https://termix.forust.xyz
+                - title: uptime.forust.xyz
+                  url: https://uptime.forust.xyz
+                - title: cmk.forust.xyz
+                  url: https://cmk.forust.xyz
+                - title: search.forust.xyz
+                  url: https://search.forust.xyz
+                - title: status.forust.xyz
+                  url: https://status.forust.xyz
+                - title: traefik.forust.xyz
+                  url: https://traefik.forust.xyz
+                - title: media.forust.xyz
+                  url: https://media.forust.xyz
+                - title: wfs.forust.xyz
+                  url: https://wfs.forust.xyz
+                - title: forust.xyz/convert
+                  url: https://forust.xyz/convert

glance/k8s/glance.yaml

@@ -0,0 +1,78 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: glance-service
+  namespace: glance
+spec:
+  selector:
+    app: glance
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: glance-deployment
+  namespace: glance
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: glance
+  template:
+    metadata:
+      labels:
+        app: glance
+    spec:
+      containers:
+        - name: glance
+          image: glanceapp/glance
+          envFrom:
+            - secretRef:
+                name: glance-secrets
+          ports:
+            - containerPort: 8080
+          volumeMounts:
+            - name: glance-config
+              mountPath: /app/config/glance.yml
+              subPath: glance.yml
+            - name: glance-config
+              mountPath: /app/config/home.yml
+              subPath: home.yml
+            - name: glance-config
+              mountPath: /app/config/docker.yml
+              subPath: docker.yml
+            - name: glance-config
+              mountPath: /app/config/monitor.yml
+              subPath: monitor.yml
+            - name: glance-assets
+              mountPath: /app/assets/user.css
+              subPath: user.css
+            - name: docker-socket
+              mountPath: /var/run/docker.sock
+            - name: localtime
+              mountPath: /etc/localtime
+              readOnly: true
+          resources:
+            requests:
+              memory: "30Mi"
+              cpu: "20m"
+            limits:
+              memory: "100Mi"
+              cpu: "50m"
+      volumes:
+        - name: glance-config
+          configMap:
+            name: glance-config
+        - name: glance-assets
+          configMap:
+            name: glance-config
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+        - name: localtime
+          hostPath:
+            path: /etc/localtime
+            type: File

glance/k8s/ingress.yaml

@@ -0,0 +1,47 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: glance-prod
+  namespace: glance
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/glance`)
+      kind: Rule
+      priority: 50
+      middlewares:
+        - name: glance-stripprefix
+      services:
+        - name: glance-service
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: glance-local
+  namespace: glance
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`glance.workstation.internal`) || Host(`glance.gigaforust.internal`)) && PathPrefix(`/glance`)
+      kind: Rule
+      middlewares:
+        - name: glance-stripprefix
+      priority: 50
+      services:
+        - name: glance-service
+          port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: glance-stripprefix
+  namespace: glance
+spec:
+  stripPrefix:
+    prefixes:
+      - /glance

glance/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: glance

headscale/compose.yaml

@@ -0,0 +1,132 @@
+services:
+  headscale:
+    image: headscale/headscale:latest
+    restart: unless-stopped
+    container_name: headscale-server
+    command: serve
+    ports:
+      - 18080:8080
+      - 19090:9090
+    networks:
+      - proxy
+    volumes:
+      - ./config/headscale.yaml:/etc/headscale/config.yaml
+      - data:/var/lib/headscale
+      - ./config/policy.json:/var/lib/headscale/policy.json
+    labels:
+      - "me.tale.headplane.target: headscale"
+      - "traefik.enable=true"
+      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
+
+      ## SERVICE
+      # Prod Router
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
+      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.service=headscale"
+      - "traefik.http.routers.headscale-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.service=headscale"
+      - "traefik.http.routers.headscale-dev.tls=true"
+
+      ## METRICS
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+  headplane:
+    image: ghcr.io/tale/headplane:latest
+    container_name: headplane
+    restart: unless-stopped
+    ports:
+      - "13000:3000"
+    volumes:
+      - ./config/headplane.yaml:/etc/headplane/config.yaml
+      - ./config/headscale.yaml:/etc/headscale/config.yaml
+      - headplane-data:/var/lib/headplane
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.headplane.loadbalancer.server.port=3000"
+
+      # Middleware: add /admin prefix for root requests
+      - "traefik.http.middlewares.headplane-prefix.addPrefix.prefix=/admin"
+
+      # Prod Root Router
+      - "traefik.http.routers.headplane-root.rule=Host(`hp.forust.xyz`)"
+      - "traefik.http.routers.headplane-root.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root.tls.certresolver=letsencrypt"
+      # Prod Router
+      - "traefik.http.routers.headplane.rule=Host(`hp.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane.entrypoints=websecure"
+      - "traefik.http.routers.headplane.tls.certresolver=letsencrypt"
+      # Local Root Router
+      - "traefik.http.routers.headplane-root-local.rule=Host(`hp.workstation.internal`)"
+      - "traefik.http.routers.headplane-root-local.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root-local.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root-local.tls=true"
+      # Local Router
+      - "traefik.http.routers.headplane-local.rule=Host(`hp.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane-local.entrypoints=websecure"
+      - "traefik.http.routers.headplane-local.tls=true"
+      # Dev Root Router
+      - "traefik.http.routers.headplane-root-dev.rule=Host(`hp.gigaforust.internal`)"
+      - "traefik.http.routers.headplane-root-dev.entrypoints=websecure"
+      - "traefik.http.routers.headplane-root-dev.middlewares=headplane-prefix"
+      - "traefik.http.routers.headplane-root-dev.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headplane-dev.rule=Host(`hp.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headplane-dev.entrypoints=websecure"
+      - "traefik.http.routers.headplane-dev.tls=true"
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    ports:
+      - 10080:80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+    networks:
+      - proxy
+volumes:
+  data:
+  headplane-data:
+    name: headplane_data
+networks:
+  proxy:
+    external: true

headscale/config/headplane.yaml.example

@@ -0,0 +1,221 @@
+# Configuration for the Headplane server and web application
+server:
+  # These are the default values, change them as needed
+  host: "0.0.0.0"
+  port: 3000
+  # Should not include the dashboard prefix (/admin) portion.
+  # # Prod server_url
+  # base_url: https://hs.forust.xyz
+  # # Local base_url
+  # base_url: https://hs.workstation.internal
+  # # Dev base_url
+  # base_url: https://hs.gigaforust.internal
+
+  # You may provide `cookie_secret_path` instead to read a value from disk.
+  # See https://headplane.net/configuration/#sensitive-values
+  cookie_secret: "<change_me_to_something_secure!>"
+
+  # Whether cookies should be marked as Secure
+  # * Should be false if running without HTTPs
+  # * Should be true if running behind a reverse proxy with HTTPs
+  cookie_secure: true
+  # The maximum age of the session cookie in seconds
+  cookie_max_age: 86400 # 1 day in seconds
+
+  # This is not required, but if you want to restrict the cookie
+  # to a specific domain, set it here. Otherwise leave it commented out.
+  # This may not work as expected if not using a reverse proxy.
+  # cookie_domain: ""
+
+  # The path to persist Headplane specific data. All data going forward
+  # is stored in this directory, including the internal database and
+  # any cache related files.
+  data_path: "/var/lib/headplane"
+
+  # The info secret is optional and allows access to certain debug endpoints
+  # that may expose sensitive information about your Headplane instance.
+  #
+  # As of now, this protects the /api/info endpoint which exposes details about
+  # the Headplane and Headscale versions in use. In the future, more endpoints
+  # may be protected by this secret.
+  #
+  # If not set, these endpoints will be disabled.
+  # info_secret: "<change_me_to_something_secure!>"
+
+# Headscale specific settings to allow Headplane to talk
+# to Headscale and access deep integration features
+headscale:
+  # The URL to your Headscale instance
+  # (All API requests are routed through this URL)
+  # (THIS IS NOT the gRPC endpoint, but the HTTP endpoint)
+  #
+  # IMPORTANT: If you are using TLS this MUST be set to `https://`
+  url: "http://headscale-server:8080"
+
+  # If you use the TLS configuration in Headscale, and you are not using
+  # Let's Encrypt for your certificate, pass in the path to the certificate.
+  # (This has no effect if `url` does not start with `https://`)
+  # tls_cert_path: "/var/lib/headplane/tls.crt"
+
+  # Optional, public URL if its different from the `headscale.url`
+  # This affects certain parts of the web UI which shows Headscale's URL
+  public_url: "https://headscale.example.com"
+
+  # Path to the Headscale configuration file
+  # This is optional, but HIGHLY recommended for the best experience
+  # If this is read only, Headplane will show your configuration settings
+  # in the Web UI, but they cannot be changed.
+  config_path: "/etc/headscale/config.yaml"
+
+  # Whether the Headscale configuration should be strictly validated
+  # when reading from `config_path`. If true, Headplane will not interact
+  # with Headscale if there are any issues with the configuration file.
+  #
+  # This is recommended to be true for production deployments to, however it
+  # may not work if you are using a version of Headscale that has configuration
+  # options unknown to Headplane.
+  config_strict: true
+
+  # If you are using `dns.extra_records_path` in your Headscale
+  # configuration, you need to set this to the path for Headplane
+  # to be able to read the DNS records.
+  #
+  # Pass it in if using Docker and ensure that the file is both
+  # readable and writable to the Headplane process.
+  # When using this, Headplane will no longer need to automatically
+  # restart Headscale for DNS record changes.
+  # dns_records_path: "/var/lib/headscale/extra_records.json"
+
+# Integration configurations for Headplane to interact with Headscale
+integration:
+  # The Headplane agent allows retrieving information about nodes
+  # This allows the UI to display version, OS, and connectivity data
+  # You will see the Headplane agent in your Tailnet as a node when
+  # it connects.
+  agent:
+    enabled: false
+
+    # To connect to your Tailnet, you need to generate a pre-auth key
+    # This can be done via the web UI or through the `headscale` CLI.
+    pre_authkey: "<your-preauth-key>"
+
+    # Optionally change the name of the agent in the Tailnet.
+    # host_name: "headplane-agent"
+
+    # Configure different caching settings. By default, the agent will store
+    # caches in the path below for a maximum of 1 minute. If you want data
+    # to update faster, reduce the TTL, but this will increase the frequency
+    # of requests to Headscale.
+    # cache_ttl: 60
+    # cache_path: /var/lib/headplane/agent_cache.json
+
+    # The work_dir represents where the agent will store its data to be able
+    # to automatically reauthenticate with your Tailnet. It needs to be
+    # writable by the user running the Headplane process.
+    #
+    # If using Docker, it is best to leave this as the default.
+    # work_dir: "/var/lib/headplane/agent"
+
+  # Only one of these should be enabled at a time or you will get errors
+  # This does not include the agent integration (above), which can be enabled
+  # at the same time as any of these and is recommended for the best experience.
+  docker:
+    enabled: true
+
+    # By default we check for the presence of a container label (see the docs)
+    # to determine the container to signal when changes are made to DNS settings.
+    container_label: "me.tale.headplane.target=headscale"
+
+    # HOWEVER, you can fallback to a container name if you desire, but this is
+    # not recommended as its brittle and doesn't work with orchestrators that
+    # automatically assign container names.
+    #
+    # If `container_name` is set, it will override any label checks.
+    # container_name: "headscale-server"
+
+    # The path to the Docker socket (do not change this if you are unsure)
+    # Docker socket paths must start with unix:// or tcp:// and at the moment
+    # https connections are not supported.
+    socket: "unix:///var/run/docker.sock"
+
+  # Please refer to docs/integration/Kubernetes.md for more information
+  # on how to configure the Kubernetes integration. There are requirements in
+  # order to allow Headscale to be controlled by Headplane in a cluster.
+  kubernetes:
+    enabled: false
+    # Validates the manifest for the Pod to ensure all of the criteria
+    # are set correctly. Turn this off if you are having issues with
+    # shareProcessNamespace not being validated correctly.
+    validate_manifest: true
+    # This should be the name of the Pod running Headscale and Headplane.
+    # If this isn't static you should be using the Kubernetes Downward API
+    # to set this value (refer to docs/Integrated-Mode.md for more info).
+    pod_name: "headscale"
+
+  # Proc is the "Native" integration that only works when Headscale and
+  # Headplane are running outside of a container. There is no configuration,
+  # but you need to ensure that the Headplane process can terminate the
+  # Headscale process.
+  #
+  # (If they are both running under systemd as sudo, this will work).
+  proc:
+    enabled: false
+
+# OIDC Configuration for simpler authentication
+# (This is optional, but recommended for the best experience)
+# oidc:
+# The OIDC issuer URL
+# issuer: "https://accounts.google.com"
+
+# If you are using OIDC, you need to generate an API key
+# that can be used to authenticate other sessions when signing in.
+#
+# This can be done with `headscale apikeys create --expiration 999d`
+# headscale_api_key: "<your-headscale-api-key>"
+
+# If your OIDC provider does not support discovery (does not have the URL at
+# `/.well-known/openid-configuration`), you need to manually set endpoints.
+# This also works to override endpoints if you so desire or if your OIDC
+# discovery is missing certain endpoints (ie GitHub).
+# For some typical providers, see https://headplane.net/features/sso.
+# authorization_endpoint: ""
+# token_endpoint: ""
+# userinfo_endpoint: ""
+
+# The authentication method to use when communicating with the token endpoint.
+# This is fully optional and Headplane will attempt to auto-detect the best
+# method and fall back to `client_secret_basic` if unsure.
+# token_endpoint_auth_method: "client_secret_post"
+
+# The client ID for the OIDC client
+# For the best experience please ensure this is *identical* to the client_id
+# you are using for Headscale. because
+# client_id: "your-client-id"
+
+# The client secret for the OIDC client
+# You may also provide `client_secret_path` instead to read a value from disk.
+# See https://headplane.net/configuration/#sensitive-values
+# client_secret: "<your-client-secret>"
+
+# Whether to use PKCE when authenticating users. This is recommended as it
+# adds an extra layer of security to the authentication process. Enabling this
+# means your OIDC provider must support PKCE and it must be enabled on the
+# client.
+# use_pkce: true
+
+# If you want to disable traditional login via Headscale API keys
+# disable_api_key_login: false
+
+# By default profile pictures are pulled from the OIDC provider when
+# we go to fetch the userinfo endpoint. Optionally, this can be set to
+# "oidc" or "gravatar" as of 0.6.1.
+# profile_picture_source: "gravatar"
+
+# The scopes to request when authenticating users. The default is below.
+# scope: "openid email profile"
+
+# Extra query parameters can be passed to the authorization endpoint
+# by setting them here. This is useful for providers that require any kind
+# of custom hinting.
+# extra_params:
+#   prompt: "select_account" # Example: force account selection on Google

headscale/config/headscale.yaml.example

@@ -0,0 +1,80 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+node:
+  ephemeral:
+    inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false

headscale/config/policy.json.example

@@ -0,0 +1,21 @@
+{
+  "groups": {
+    "group:admin": ["admin@"],
+    "group:users": []
+  },
+  "tagOwners": {},
+  "hosts": {},
+  "acls": [
+    {
+      "randomizeClientPort": false,
+      "#ha-meta": {
+        "name": "users",
+        "open": true
+      },
+      "action": "accept",
+      "src": ["autogroup:member"],
+      "dst": ["autogroup:self:*"]
+    }
+  ],
+  "ssh": []
+}

headscale/k8s/external-service.yaml

@@ -0,0 +1,86 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-server-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 8080
+      targetPort: 18080
+      name: http
+    - port: 9090
+      targetPort: 19090
+      name: metrics
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headscale-server-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headscale-server-external
+addressType: IPv4
+ports:
+  - port: 18080
+    protocol: TCP
+    name: http
+  - port: 19090
+    protocol: TCP
+    name: metrics
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-ui-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 80
+      targetPort: 10080
+      name: http
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headscale-ui-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headscale-ui-external
+addressType: IPv4
+ports:
+  - port: 10080
+    protocol: TCP
+    name: http
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headplane-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 3000
+      targetPort: 13000
+      name: http
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headplane-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headplane-external
+addressType: IPv4
+ports:
+  - port: 13000
+    protocol: TCP
+    name: http
+endpoints:
+  - addresses:
+      - "192.168.88.100"

headscale/k8s/ingress.yaml

@@ -0,0 +1,107 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: headplane-prefix
+  namespace: headscale
+spec:
+  addPrefix:
+    prefix: "/admin"
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.forust.xyz`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: headscale-server-external
+          port: 8080
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+      kind: Rule
+      middlewares:
+      services:
+        - name: headscale-server-external
+          port: 9090
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headplane-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hp.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: Host(`hp.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 8080
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headscale-ui-external
+          port: 80
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/metrics`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 9090
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headplane-local
+  namespace: headscale
+spec:
+  routes:
+    - match: Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)
+      kind: Rule
+      middlewares:
+        - name: headplane-prefix
+      services:
+        - name: headplane-external
+          port: 3000
+    - match: (Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headplane-external
+          port: 3000

headscale/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: headscale

homepage/compose.yaml

@@ -1,39 +0,0 @@
-services:
-  forust-homepage:
-    build: .
-    ports:
-      - "8085:80"
-    restart: unless-stopped
-    volumes:
-      - ./files:/usr/share/nginx/html
-    networks:
-      - traefik-proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
-
-      # Prod Router
-      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
-      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage.tls=true"
-      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
-
-      # Local Router
-      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
-      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage-local.tls=true"
-
-      # Dev Router
-      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
-      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage-dev.tls=true"
-
-networks:
-  traefik-proxy:
-    external: true

homepage/files/index.html

@@ -1,178 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>MrForust // XRock</title>
-    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
-    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
-    <link rel="stylesheet" href="assets/css/style.css">
-</head>
-
-<body>
-
-    <div class="container">
-        <header>
-            <h1 class="glitch" data-text="MrForust">Mr-Forust</h1>
-            <p class="subtitle">> CTF Player / XRock_Team / Just Signal.</p>
-        </header>
-
-        <hr>
-
-        <section id="socials">
-            <h2>./socials</h2>
-            <ul class="link-list">
-                <li>
-                    <i class="fab fa-github"></i>
-                    <a href="https://github.com/mr-forust" target="_blank">github/mr-forust</a>
-                </li>
-                <li>
-                    <i class="fas fa-flag"></i>
-                    <a href="https://tryhackme.com/p/MrForust" target="_blank">tryhackme/MrForust</a>
-                </li>
-                <li>
-                    <i class="fab fa-telegram-plane"></i>
-                    <a href="https://t.me/MrForust" target="_blank">telegram/MrForust</a>
-                </li>
-                <li>
-                    <i class="fab fa-discord"></i>
-                    <span>discord/mr.forust</span>
-                </li>
-                <li>
-                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:forust@forust.xyz">forust@forust.xyz</a>
-                </li>
-            </ul>
-        </section>
-
-        <section id="stack">
-            <h2>./skills_and_tools</h2>
-            <div class="grid-2">
-                <div>
-                    <div class="skill-item">
-                        <span>ArchLinux # btw</span>
-                        <span class="level">[#######...]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Docker Compose</span> <span class="level">[#####.....]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Web Pentest</span> <span class="level">[#####.....]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Burpsuite</span> <span class="level">[#####.....]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Docker</span> <span class="level">[####......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Steganography</span> <span class="level">[####......]</span>
-                    </div>
-                </div>
-                <div>
-                    <div class="skill-item">
-                        <span>Cryptography</span> <span class="level">[####......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>OSINT</span> <span class="level">[####......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Python</span> <span class="level">[###.......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>HTML</span> <span class="level">[###.......]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Bash</span> <span class="level">[##........]</span>
-                    </div>
-                    <div class="skill-item">
-                        <span>Golang</span> <span class="level">[#.........]</span>
-                    </div>
-                </div>
-            </div>
-        </section>
-
-        <section id="team">
-            <h2>./xrock_team</h2>
-            <p class="comment"># It's a select caste. Cybershamans. Cryptoanarchists. Shadows on the net..</p>
-
-            <div class="team-grid">
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/mrforust.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://github.com/mr-forust" target="_blank">MrForust</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/anna.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="" target="_blank">Anna~</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/chernuha.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://chernuha.space" target="_blank">Chernuha</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/hudan.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://hudan.xyz" target="_blank">p1ngvi</a>
-                </div>
-
-                <div class="member">
-                    <div class="avatar"
-                        style="background-image: url('assets/images/team/xdfnx.jpg'); background-size: cover; background-position: center;">
-                    </div>
-                    <a href="https://xdfnx.cfd" target="_blank">xdfnx</a>
-                </div>
-            </div>
-        </section>
-
-        <section id="repos">
-            <h2>./favorite_repos</h2>
-            <ul class="repo-list">
-                <li>
-                    <a href="https://github.com/TDesktop-x64/tdesktop" target="_blank">TDesktop-x64/tdesktop</a>
-                    <span class="comment">// unofficial telegram client with some additions</span>
-                </li>
-                <li>
-                    <a href="https://github.com/traefik/traefik" target="_blank">traefik/traefik</a>
-                    <span class="comment">// beloved reverse-proxy</span>
-                </li>
-                <li>
-                    <a href="https://github.com/unhappychoice/gitlogue" target="_blank">unhappychoice/gitlogue</a>
-                    <span class="comment">// nice git log visualizer</span>
-                </li>
-                <li>
-                    <a href="https://github.com/mountain-loop/yaak" target="_blank">mountain-loop/yaak</a>
-                    <span class="comment">// modern, fancy api client</span>
-                </li>
-                <li>
-                    <a href="https://github.com/pear-devs/pear-desktop" target="_blank">pear-devs/pear-desktop</a>
-                    <span class="comment">// music client with a lot of features</span>
-                </li>
-                <li>
-                    <a href="https://github.com/epi052/feroxbuster" target="_blank">epi052/feroxbuster</a>
-                    <span class="comment">// directory discovery</span>
-                </li>
-            </ul>
-        </section>
-
-        <footer>
-            <p>root@xrock:~$ cat <a href="miku.html">./miku</a></p>
-            <p>miku?</p>
-            <p>root@xrock:~$ shutdown -h now</p>
-            <p>&copy; XRock - Just Signal.</p>
-        </footer>
-    </div>
-
-</body>
-
-</html>

homepages/Dockerfile.forust

@@ -0,0 +1,10 @@
+# everyone use that
+FROM nginx:alpine
+
+RUN rm -rf /usr/share/nginx/html/*
+
+COPY ./forust_files /usr/share/nginx/html
+
+EXPOSE 80
+# Start 
+CMD ["nginx", "-g", "daemon off;"]

homepages/Dockerfile.xdfnx

@@ -3,7 +3,7 @@ FROM nginx:alpine
 
 RUN rm -rf /usr/share/nginx/html/*
 
-COPY ./files /usr/share/nginx/html
+COPY ./xdfnx_files /usr/share/nginx/html
 
 EXPOSE 80
 # Start 

homepages/compose.yaml

@@ -0,0 +1,65 @@
+services:
+  forust:
+    build:
+      context: .
+      dockerfile: Dockerfile.forust
+    image: gcr.forust.xyz/forust/forust-homepage:latest
+    pull_policy: build
+    # ports:
+    #   - "8085:80"
+    restart: unless-stopped
+    volumes:
+      - ./forust_files:/usr/share/nginx/html
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`) || Host(`www.forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage.priority=10"
+      - "traefik.http.routers.forust-homepage.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`)"
+      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.priority=10"
+      - "traefik.http.routers.forust-homepage-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
+      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.priority=10"
+      - "traefik.http.routers.forust-homepage-dev.tls=true"
+  xdfnx:
+    build:
+      context: .
+      dockerfile: Dockerfile.xdfnx
+    image: gcr.forust.xyz/forust/xdfnx-homepage:latest
+    pull_policy: build
+    restart: unless-stopped
+    # ports:
+    #   - "8086:80"
+    volumes:
+      - ./xdfnx_files:/usr/share/nginx/html
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`)"
+      - "traefik.http.routers.xdfnx.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`)"
+      - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.xdfnx-dev.rule=Host(`xdfnx.gigaforust.internal`)"
+      - "traefik.http.routers.xdfnx-dev.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true