Merge pull request 'feat/checkmk' (#7 ) from feat/checkmk into main

Reviewed-on: #7
Revert "fix: clean up traefik configuration and add redirect middleware"
2026-01-19 15:59:21 +01:00 · 2026-01-19 11:18:36 +01:00 · 2026-01-19 00:08:16 +01:00 · 2026-01-18 23:09:41 +01:00 · 2026-01-18 22:39:48 +01:00 · 2026-01-18 19:28:12 +01:00
45 changed files with 1970 additions and 1131 deletions
@@ -2,12 +2,8 @@
 sync.ffs_lock
 .sync.ffs_db

-# Environment 
-.env
-.env.anna
-.env.forust
-.env.*
-!.env.*example
+# Copyparty
+*.hist/

 # Volumes and data directories
 gitea/gitea-db/
@@ -21,6 +17,10 @@ metube/MeTube_downloads
 uptime-kuma/data/
 termix/termix-data/*
 cfddns/config.json
+checkmk/checkmk/*
+downtify/Downtify_downloads
+headscale/config/*
+headscale/data/*

 # Steaming services files
 streaming/jellyfin/*
@@ -32,11 +32,16 @@ streaming/qbittorrent/*
 streaming/prowlarr/*

 # Homepage 
-homepage/files/assets/images/team/*
+homepages/forust_files/assets/images/team/*
+homepages/forust_files/.well-known/*

 # Traefik files
 traefik/letsencrypt/acme.json
+traefik/dynamic/fileservers.yml
 traefik/logs/*
+
+# SSL Certificates
+adguardhome/certs/*
 traefik/certs/*

 # Monitoring
@@ -79,3 +84,11 @@ replacements.txt

 # Temp files
 edu_master/temp/
+temp/*
+
+# Environment 
+.env
+.env.anna
+.env.forust
+.env.*
+!*example
@@ -3,48 +3,54 @@ services:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
-    environment:
-      - TZ=${TZ}
    ports:
      - "53:53/tcp"
      - "53:53/udp"
+      - "853:853/tcp" # DNS over TLS
      # - "67:67/udp" # DHCP
      # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
    volumes:
      - ./data/work:/opt/adguardhome/work
      - ./data/conf:/opt/adguardhome/conf
+      - ./certs:/certs:ro
    networks:
-      - traefik-proxy
+      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"

      # Prod Router
-      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
      - "traefik.http.routers.adguard.middlewares=security-headers@file"
      - "traefik.http.routers.adguard.service=adguard"
      - "traefik.http.routers.adguard.tls=true"
-      - "traefik.http.services.adguard.loadbalancer.server.port=3000"

      # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
      - "traefik.http.routers.adguard-local.entrypoints=websecure"
      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-local.service=adguard"
      - "traefik.http.routers.adguard-local.tls=true"

      # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-dev.service=adguard"
      - "traefik.http.routers.adguard-dev.tls=true"

+      # DoH
+      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns.entrypoints=websecure"
+      - "traefik.http.routers.dns.service=adguard"
+      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
+
      - glance.name=adguard
      - glance.url=https://adguard.forust.xyz/
      - glance.description=AdGuard Home is a network-wide software for blocking ads.
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -0,0 +1,20 @@
+# ===================================
+# Authentification app (authentik)
+
+# PostgresQL conf 
+PG_PASS=change_this_cuz_its_ur_db_pass
+PG_USER=authentik # it's okay
+
+# Image Settings
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2025.10.2
+
+# Networking
+PORT_HTTP=9000
+PORT_HTTPS=9443 # btw likely already used by portainer
+
+AUTHENTIK_SECRET_KEY=super_secret_super_scary_authenik_key
+
+AUTHENTIK_BOOTSTRAP_PASSWORD=pls_change_this
+
+AUTHENTIK_ERROR_REPORTING__ENABLED=true # Or false to turn off
@@ -0,0 +1,106 @@
+services:
+  postgresql:
+    image: docker.io/library/postgres:15-alpine
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    volumes:
+      - database:/var/lib/postgresql/data
+    networks:
+      - authentik
+
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    command: server
+    container_name: authentik-server
+    restart: unless-stopped
+    # ports:
+    #   - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTPS:-9443}:9443
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      # Services
+      # - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
+      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
+
+      # Prod Router
+      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
+      - "traefik.http.routers.authentik-server.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server.service=authentik-server"
+      - "traefik.http.routers.authentik-server.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
+      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-local.service=authentik-server"
+      - "traefik.http.routers.authentik-server-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
+      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
+      - "traefik.http.routers.authentik-server-dev.tls=true"
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    networks:
+      - proxy
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    restart: unless-stopped
+    user: root
+    command: worker
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+    networks:
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+volumes:
+  database:
+    driver: local
+networks:
+  authentik:
+  proxy:
+    external: true
@@ -0,0 +1,2 @@
+CMK_PASSWORD=password
+TZ=Europe/Berlin
@@ -0,0 +1,50 @@
+services:
+  checkmk:
+    image: "checkmk/check-mk-raw:2.4.0-latest"
+    container_name: "checkmk"
+    environment:
+      - CMK_PASSWORD=${CMK_PASSWORD:-password}
+      - CMK_SITE_ID=cmk
+
+    volumes:
+      - sites:/omd/sites
+    tmpfs:
+      - /opt/omd/sites/cmk/tmp:uid=1000,gid=1000
+    ports:
+      - 5000:5000
+      - 6776:8000
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.checkmk.loadbalancer.server.port=5000"
+
+      # Prod Router
+      - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
+      - "traefik.http.routers.checkmk.entrypoints=websecure"
+      - "traefik.http.routers.checkmk.service=checkmk"
+      - "traefik.http.routers.checkmk.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`) || Host(`cmk.internal`)"
+      - "traefik.http.routers.checkmk-local.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-local.service=checkmk"
+      - "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
+      - "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk-dev.service=checkmk"
+      - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-dev.tls=true"
+
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true
+volumes:
+  sites:
@@ -16,15 +16,15 @@ services:
         timeout: 10s
         retries: 3
      networks:
-         - traefik-proxy
+         - proxy
      labels:
         - "traefik.enable=true"
-         - "traefik.docker.network=traefik-proxy"
+         - "traefik.docker.network=proxy"

         # Prod Router
         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
         - "traefik.http.routers.dockmon.entrypoints=websecure"
-         - "traefik.http.routers.dockmon.middlewares=security-headers@file,dockmon-auth@file"
+         - "traefik.http.routers.dockmon.middlewares=security-chain@file"
         - "traefik.http.routers.dockmon.service=dockmon"
         - "traefik.http.routers.dockmon.tls=true"
         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
@@ -41,7 +41,7 @@ services:
         # Dev Router
         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.middlewares=security-headers@file"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
         - "traefik.http.routers.dockmon-dev.service=dockmon"
         - "traefik.http.routers.dockmon-dev.tls=true"

@@ -50,5 +50,5 @@ services:
         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.

 networks:
-   traefik-proxy:
+   proxy:
      external: true
@@ -0,0 +1,39 @@
+services:
+  downtify:
+    container_name: downtify
+    image: ghcr.io/henriquesebastiao/downtify:latest
+    # ports:
+    #   - '7077:8000'
+    labels:
+      - traefik.enable=true
+      - traefik.http.services.downtify.loadbalancer.server.port=8000
+
+      # Prod Router 
+      - traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
+      - traefik.http.routers.downtify.entrypoints=websecure
+      - traefik.http.routers.downtify.middlewares=security-chain@file
+      - traefik.http.routers.downtify.service=downtify
+      - traefik.http.routers.downtify.tls=true
+
+      # Local Router
+      - traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
+      - traefik.http.routers.downtify-local.entrypoints=websecure
+      - traefik.http.routers.downtify-local.middlewares=security-headers@file
+      - traefik.http.routers.downtify-local.service=downtify
+      - traefik.http.routers.downtify-local.tls=true
+
+      # Dev Router
+      - traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
+      - traefik.http.routers.downtify-dev.entrypoints=websecure
+      - traefik.http.routers.downtify-dev.middlewares=security-chain@file
+      - traefik.http.routers.downtify-dev.service=downtify
+      - traefik.http.routers.downtify-dev.tls=true
+    networks:
+      - proxy
+
+    volumes:
+      - ./Downtify_downloads:/downloads
+
+networks:
+  proxy:
+    external: true
@@ -12,15 +12,26 @@ logging.basicConfig(
 )
 logger = logging.getLogger(__name__)

-# Load configuration
-LOGIN = os.getenv('EDU_LOGIN')
-PASSWORD = os.getenv('EDU_PASSWORD')
-URL_LOGIN = os.getenv('EDU_URL_LOGIN', 'https://edu.edu.vn.ua/user/login')
-URL_VERIFY = os.getenv('EDU_URL_VERIFY', 'https://edu.edu.vn.ua/course/userlist')
-INTERVAL = int(os.getenv('PHPSESSID_INTERVAL', 10))
-USER_AGENT = os.getenv('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
-REDIS_HOST = os.getenv('REDIS_HOST', 'redis')
-REDIS_PORT = int(os.getenv('REDIS_PORT', 6379))
+# Load configuration (adapted to .env keys)
+def _env(key, default=None):
+    v = os.getenv(key, default)
+    if isinstance(v, str) and len(v) >= 2 and ((v[0] == '"' and v[-1] == '"') or (v[0] == "'" and v[-1] == "'")):
+        return v[1:-1]
+    return v
+
+LOGIN = _env('KEEPER_LOGIN')
+PASSWORD = _env('KEEPER_PASSWORD')
+
+EDU_BASE = _env('EDU_URL_BASE', 'https://edu.edu.vn.ua')
+EDU_LOGIN_PATH = _env('EDU_URL_LOGIN', '/user/login')
+EDU_COURSES_PATH = _env('EDU_URL_COURSES', '/course/userlist')
+URL_LOGIN = f"{EDU_BASE.rstrip('/')}/{EDU_LOGIN_PATH.lstrip('/')}"
+URL_VERIFY = f"{EDU_BASE.rstrip('/')}/{EDU_COURSES_PATH.lstrip('/')}"
+
+INTERVAL = int(_env('KEEPER_INTERVAL', 10))
+USER_AGENT = _env('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
+REDIS_HOST = _env('REDIS_HOST', 'redis')
+REDIS_PORT = int(_env('REDIS_PORT', 6379))

 SUCCESS_FILE = '/tmp/last_success'

@@ -3,7 +3,8 @@ import logging
 import redis
 import json

-from telegram import Update, InlineKeyboardButton, InlineKeyboardMarkup
+from telegram import Update, InlineKeyboardButton, InlineKeyboardMarkup, ChatMember
+from telegram.constants import ChatType
 from telegram.ext import Application, CommandHandler, CallbackQueryHandler, ContextTypes
 from playwright.async_api import async_playwright

@@ -15,14 +16,23 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)

 # Load environment variables
-WEBINAR_URL = os.getenv('WEBINAR_URL', 'https://edu.edu.vn.ua/webinar/useractive')
-WEBINAR_CHECK_INTERVAL = int(os.getenv('WEBINAR_CHECK_INTERVAL', 60))
-REDIS_HOST = os.getenv('REDIS_HOST', 'redis')
-REDIS_PORT = int(os.getenv('REDIS_PORT', 6379))
-PLAYWRIGHT_WS = os.getenv('PLAYWRIGHT_WS', 'ws://playwright-service:3000/ws')
-USER_AGENT = os.getenv('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
-WEBINAR_TELEGRAM_TOKEN = os.getenv('WEBINAR_TELEGRAM_TOKEN')
-ADMIN_ID = int(os.getenv('WEBINAR_ADMIN_ID', '0'))
+def _env(key, default=None):
+    v = os.getenv(key, default)
+    if isinstance(v, str) and len(v) >= 2 and ((v[0] == '"' and v[-1] == '"') or (v[0] == "'" and v[-1] == "'")):
+        return v[1:-1]
+    return v
+
+EDU_BASE = _env('EDU_URL_BASE', 'https://edu.edu.vn.ua')
+EDU_WEBINAR_PATH = _env('EDU_URL_WEBINAR', '/webinar/useractive')
+WEBINAR_URL = f"{EDU_BASE.rstrip('/')}/{EDU_WEBINAR_PATH.lstrip('/')}"
+
+WEBINAR_CHECK_INTERVAL = int(_env('WEBINAR_CHECK_INTERVAL', 60))
+REDIS_HOST = _env('REDIS_HOST', 'redis')
+REDIS_PORT = int(_env('REDIS_PORT', 6379))
+PLAYWRIGHT_WS = _env('PLAYWRIGHT_WS', 'ws://playwright-service:3000/ws')
+USER_AGENT = _env('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
+WEBINAR_TELEGRAM_TOKEN = _env('WEBINAR_TELEGRAM_TOKEN')
+ADMIN_ID = int(_env('WEBINAR_ADMIN_ID', '0'))

 # Redis Keys
 KEY_WHITELIST = "bot:whitelist"
@@ -48,7 +58,7 @@ TRANSLATIONS = {
        'welcome_admin': "\n\n👑 <b>Режим администратора активен</b>",
        'access_denied': "⛔ Доступ запрещен. Вас нет в белом списке.",
        'help_title': "🤖 <b>Помощь по боту</b>\n\n",
-        'help_commands': "/start - Подписаться на уведомления\n/help - Показать это сообщение\n/language - Сменить язык",
+        'help_commands': "/start - Подписаться на уведомления\n/stop - Отписаться от уведомлений\n/help - Показать это сообщение\n/language - Сменить язык",
        'help_admin': "\n<b>Команды администратора:</b>\n/adduser [user_id] - Добавить пользователя в белый список\n/removeuser [user_id] - Удалить пользователя из белого списка\nИли используйте панель ниже для управления настройками.",
        'admin_only': "⛔ Только для администратора!",
        'user_added': "✅ Пользователь {user_id} добавлен в белый список",
@@ -85,7 +95,7 @@ TRANSLATIONS = {
        'welcome_admin': "\n\n👑 <b>Режим адміністратора активний</b>",
        'access_denied': "⛔ Доступ заборонено. Вас немає в білому списку.",
        'help_title': "🤖 <b>Довідка по боту</b>\n\n",
-        'help_commands': "/start - Підписатися на сповіщення\n/help - Показати це повідомлення\n/language - Змінити мову",
+        'help_commands': "/start - Підписатися на сповіщення\n/stop - Відписатися від сповіщень\n/help - Показати це повідомлення\n/language - Змінити мову",
        'help_admin': "\n<b>Команди адміністратора:</b>\n/adduser [user_id] - Додати користувача до білого списку\n/removeuser [user_id] - Видалити користувача з білого списку\nАбо використовуйте панель нижче для керування налаштуваннями.",
        'admin_only': "⛔ Тільки для адміністратора!",
        'user_added': "✅ Користувач {user_id} доданий до білого списку",
@@ -122,7 +132,7 @@ TRANSLATIONS = {
        'welcome_admin': "\n\n👑 <b>Admin Mode Active</b>",
        'access_denied': "⛔ Access denied. You are not on the whitelist.",
        'help_title': "🤖 <b>Bot Help</b>\n\n",
-        'help_commands': "/start - Subscribe to notifications\n/help - Show this message\n/language - Change language",
+        'help_commands': "/start - Subscribe to notifications\n/stop - Unsubscribe from notifications\n/help - Show this message\n/language - Change language",
        'help_admin': "\n<b>Admin Commands:</b>\n/adduser [user_id] - Add user to whitelist\n/removeuser [user_id] - Remove user from whitelist\nOr use the panel below to manage settings.",
        'admin_only': "⛔ Admin only!",
        'user_added': "✅ User {user_id} added to whitelist",
@@ -203,6 +213,21 @@ def is_whitelisted(user_id: int) -> bool:
        
    return redis_client.sismember(KEY_WHITELIST, str(user_id))

+async def is_group_admin(update: Update, context: ContextTypes.DEFAULT_TYPE) -> bool:
+    """Check if the user is an administrator in the group."""
+    user = update.effective_user
+    chat = update.effective_chat
+    
+    if chat.type in [ChatType.PRIVATE, "private"]:
+        return True
+        
+    try:
+        member = await context.bot.get_chat_member(chat.id, user.id)
+        return member.status in [ChatMember.OWNER, ChatMember.ADMINISTRATOR]
+    except Exception as e:
+        logger.error(f"Failed to check admin status: {e}")
+        return False
+
 def get_admin_keyboard(user_id: int):
    """Generate admin panel keyboard."""
    whitelist_enabled = redis_client.get(KEY_WHITELIST_ENABLED) != "0"
@@ -221,19 +246,21 @@ def get_admin_keyboard(user_id: int):
 async def start(update: Update, context: ContextTypes.DEFAULT_TYPE):
    """Handle /start command."""
    user = update.effective_user
-    logger.info(f"User {user.id} ({user.username}) started the bot.")
+    chat = update.effective_chat
+    logger.info(f"User {user.id} ({user.username}) started the bot in chat {chat.id} ({chat.type}).")
    
+    # Check whitelist - MUST be the user executing the command
    if not is_whitelisted(user.id):
        await update.message.reply_text(t(user.id, 'access_denied'))
        return

-    # Add to subscribers
-    redis_client.sadd(KEY_SUBSCRIBERS, user.id)
+    # Add to subscribers (Chat ID!)
+    redis_client.sadd(KEY_SUBSCRIBERS, chat.id)
    
-    msg = t(user.id, 'welcome', name=user.first_name)
+    msg = t(chat.id, 'welcome', name=user.first_name)
    
-    if user.id == ADMIN_ID:
-        msg += t(user.id, 'welcome_admin')
+    if user.id == ADMIN_ID and chat.type == "private":
+        msg += t(chat.id, 'welcome_admin')
        await update.message.reply_text(msg, parse_mode='HTML', reply_markup=get_admin_keyboard(user.id))
    else:
        await update.message.reply_text(msg, parse_mode='HTML')
@@ -241,19 +268,39 @@ async def start(update: Update, context: ContextTypes.DEFAULT_TYPE):
 async def help_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
    """Handle /help command."""
    user_id = update.effective_user.id
-    msg = t(user_id, 'help_title') + t(user_id, 'help_commands')
+    chat_id = update.effective_chat.id
+    msg = t(chat_id, 'help_title') + t(chat_id, 'help_commands')
    
-    if user_id == ADMIN_ID:
-        msg += t(user_id, 'help_admin')
+    if user_id == ADMIN_ID and update.effective_chat.type == "private":
+        msg += t(chat_id, 'help_admin')
        await update.message.reply_text(msg, parse_mode='HTML', reply_markup=get_admin_keyboard(user_id))
    else:
        await update.message.reply_text(msg, parse_mode='HTML')

+async def stop_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Handle /stop command (unsubscribe)."""
+    user = update.effective_user
+    chat = update.effective_chat
+    
+    # Permission check: Whitelisted user OR Group Admin
+    if not (is_whitelisted(user.id) or await is_group_admin(update, context)):
+        await update.message.reply_text(t(chat.id, 'access_denied')) # Or specific "admin only" message
+        return
+        
+    redis_client.srem(KEY_SUBSCRIBERS, chat.id)
+    await update.message.reply_text(t(chat.id, 'whitelist_disabled').replace(" whitelist", " notifications").replace("Білий список", "Сповіщення").replace("Белый список", "Уведомления") if chat.id else "Unsubscribed")
+
 async def language_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
    """Handle /language command."""
-    user_id = update.effective_user.id
+    user = update.effective_user
+    chat = update.effective_chat
+    
+    # Permission check for groups
+    if not (is_whitelisted(user.id) or await is_group_admin(update, context)):
+        return
+
    await update.message.reply_text(
-        t(user_id, 'select_language'),
+        t(chat.id, 'select_language'),
        parse_mode='HTML',
        reply_markup=get_language_keyboard()
    )
@@ -535,6 +582,7 @@ async def check_webinars_job(context: ContextTypes.DEFAULT_TYPE):
            for sub_id in subscribers:
                try:
                    # Build message in user's language
+                    # sub_id comes from redis set as string, convert to int for translation lookup
                    webinar_items = "\n\n".join([
                        t(int(sub_id), 'webinar_item', name=w['name'], url=w['url'])
                        for w in new_webinars
@@ -569,6 +617,7 @@ def main():

    # Handlers
    app.add_handler(CommandHandler("start", start))
+    app.add_handler(CommandHandler("stop", stop_command))
    app.add_handler(CommandHandler("help", help_command))
    app.add_handler(CommandHandler("language", language_command))
    app.add_handler(CommandHandler("adduser", add_user))
@@ -1,3 +1,6 @@
 GITEA_POSTGRES_USER=
 GITEA_POSTGRES_PASSWORD=
-GITEA_POSTGRES_DB=gitea
+GITEA_POSTGRES_DB=gitea
+GITEA_SMTP_PASS=
+MAILER_ADDR=
+SERVICE_EMAIL=email.used.by.services@domain.tld
@@ -13,18 +13,28 @@ services:
      - GITEA__database__NAME=gitea
      #Server
      - GITEA__server__ROOT_URL=https://gitea.forust.xyz
+      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
      - GITEA__server__SSH_PORT=2221
+      # Mailer
+      - GITEA__mailer__ENABLED=true
+      - GITEA__mailer__FROM=${SERVICE_EMAIL}
+      - GITEA__mailer__SMTP_ADDR=${MAILER_ADDR}:465
+      - GITEA__mailer__USER=${SERVICE_EMAIL}
+      - GITEA__mailer__PASSWD=${GITEA_SMTP_PASS}
+      - GITEA__mailer__PROTOCOL=SMTP
+      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
+      - GITEA__service__ENABLE_NOTIFY_MAIL=true
    restart: always
    networks:
      - gitea-db
-      - traefik-proxy
+      - proxy
    volumes:
      - ./gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
@@ -47,6 +57,9 @@ services:
      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
      - "traefik.http.routers.gitea-dev.service=gitea"
      - "traefik.http.routers.gitea-dev.tls=true"
+      - "traefik.tcp.routers.gitea.entrypoints=ssh"
+      - "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
+      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
    ports:
      - "2221:22"
    depends_on:
@@ -67,5 +80,5 @@ services:
 networks:
  gitea-db:
    external: false
-  traefik-proxy:
+  proxy:
    external: true
@@ -11,7 +11,7 @@ services:
    env_file: .env
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
@@ -31,10 +31,10 @@ services:
      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
      - "traefik.http.routers.glance-dev.tls=true"
    networks:
-      - traefik-proxy
+      - proxy
    dns:
      - 1.1.1.1
      - 8.8.8.8
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -0,0 +1,84 @@
+services:
+  server:
+    image: headscale/headscale:latest
+    restart: unless-stopped
+    command: serve
+    networks:
+      - proxy
+    volumes:
+      - ./config:/etc/headscale
+      - ./data:/var/lib/headscale
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
+
+      ## SERVICE
+      # Prod Router
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
+      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.service=headscale"
+      - "traefik.http.routers.headscale-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.service=headscale"
+      - "traefik.http.routers.headscale-dev.tls=true"
+
+      ## METRICS
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+    dns:
+        - 1.1.1.1
+        - 1.0.0.1
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "treafik.docker.network=proxy"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+
+networks:
+  proxy:
+    external: true
@@ -0,0 +1,79 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+randomize_client_port: false
@@ -1,39 +0,0 @@
-services:
-  forust-homepage:
-    build: .
-    ports:
-      - "8085:80"
-    restart: unless-stopped
-    volumes:
-      - ./files:/usr/share/nginx/html
-    networks:
-      - traefik-proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
-
-      # Prod Router
-      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
-      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage.tls=true"
-      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
-
-      # Local Router
-      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
-      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage-local.tls=true"
-
-      # Dev Router
-      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
-      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage-dev.tls=true"
-
-networks:
-  traefik-proxy:
-    external: true
@@ -0,0 +1,10 @@
+# everyone use that
+FROM nginx:alpine
+
+RUN rm -rf /usr/share/nginx/html/*
+
+COPY ./forust_files /usr/share/nginx/html
+
+EXPOSE 80
+# Start 
+CMD ["nginx", "-g", "daemon off;"]
@@ -3,7 +3,7 @@ FROM nginx:alpine

 RUN rm -rf /usr/share/nginx/html/*

-COPY ./files /usr/share/nginx/html
+COPY ./xdfnx_files /usr/share/nginx/html

 EXPOSE 80
 # Start 
@@ -0,0 +1,82 @@
+services:
+  forust:
+    build:
+      context: .
+      dockerfile: Dockerfile.forust
+    # ports:
+    #   - "8085:80"
+    restart: unless-stopped
+    volumes:
+      - ./forust_files:/usr/share/nginx/html
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+
+      # Services
+      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
+      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
+      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-dev.tls=true"
+
+  xdfnx:
+    build:
+      context: .
+      dockerfile: Dockerfile.xdfnx
+    # ports:
+    #   - "8086:80"
+    restart: unless-stopped
+    volumes:
+      - ./xdfnx_files:/usr/share/nginx/html
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      
+      # Services
+      - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`)"
+      - "traefik.http.routers.xdfnx.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx.service=xdfnx-homepage"
+      - "traefik.http.routers.xdfnx.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`) || Host(`xdfnx.internal`)"
+      - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx-local.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx-local.service=xdfnx-homepage"
+      - "traefik.http.routers.xdfnx-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.xdfnx-dev.rule=Host(`xdfnx.gigaforust.internal`)"
+      - "traefik.http.routers.xdfnx-dev.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
+      - "traefik.http.routers.xdfnx-dev.tls=true"
+
+networks:
+  proxy:
+    external: true
@@ -41,7 +41,14 @@
                </li>
                <li>
                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:forust@forust.xyz">forust@forust.xyz</a>
+                    <a href="mailto:forust@forust.xyz">mail/contact@forust.xyz</a>
+                </li>
+                <li>
+                    <i class="fa-solid fa-key"></i>
+                    <a href=".well-known/pgp-key.asc">security/PGP Key</a>
+                </li>
+                <li>
+                    <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
                </li>
            </ul>
        </section>
@@ -14,12 +14,12 @@ services:
      - ./MeTube_downloads:/downloads
    labels:
      - traefik.enable=true
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
      - "traefik.http.routers.metube.entrypoints=websecure"
-      - "traefik.http.routers.metube.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube.middlewares=security-chain@file"
      - "traefik.http.routers.metube.service=metube"
      - "traefik.http.routers.metube.tls=true"
      - "traefik.http.services.metube.loadbalancer.server.port=8081"
@@ -27,19 +27,19 @@ services:
      # Local Router
      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`) || Host(`metube.internal`)"
      - "traefik.http.routers.metube-local.entrypoints=websecure"
-      - "traefik.http.routers.metube-local.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-local.middlewares=security-headers@file"
      - "traefik.http.routers.metube-local.service=metube"
      - "traefik.http.routers.metube-local.tls=true"

      # Dev Router
      - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
      - "traefik.http.routers.metube-dev.entrypoints=websecure"
-      - "traefik.http.routers.metube-dev.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-dev.middlewares=security-chain@file"
      - "traefik.http.routers.metube-dev.service=metube"
      - "traefik.http.routers.metube-dev.tls=true"

    networks:
-      - traefik-proxy
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -23,11 +23,11 @@ services:
      - 1.1.1.1
      - 8.8.8.8
    networks:
-      - traefik-proxy
+      - proxy
      - n8n
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
@@ -58,5 +58,5 @@ services:
 networks:
  n8n:
    external: false
-  traefik-proxy:
+  proxy:
    external: true
@@ -1,81 +1,81 @@
 services:
  nextcloud-aio-mastercontainer:
-    image: ghcr.io/nextcloud-releases/all-in-one:latest # This is the container image used. You can switch to ghcr.io/nextcloud-releases/all-in-one:beta if you want to help testing new releases. See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel
+    image: ghcr.io/nextcloud-releases/all-in-one:beta
    init: true # This setting makes sure that signals from main process inside the container are correctly forwarded to children. See https://docs.docker.com/reference/compose-file/services/#init
-    restart: unless-stopped # This makes sure that the container starts always together with the host OS. See https://docs.docker.com/reference/compose-file/services/#restart
-    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
+    restart: unless-stopped
+    container_name: nextcloud-aio-mastercontainer # Do not change
    volumes:
-      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
-      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
-    # network_mode: bridge # This adds the container to the same network as docker run would do. Comment this line and uncomment the line below and the networks section at the end of the file if you want to define a custom MTU size for the docker network
+      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup) 
+      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - nextcloud-aio
-      - traefik-proxy # Optional: Connects the mastercontainer to the traefik-proxy network in order to make the built-in reverse proxy detection work.
+      - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      # ports:
-      # - 8081:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      # - 8888:8080 # This is the AIO interface, served via https and self-signed certificate. See https://github.com/nextcloud/all-in-one#explanation-of-used-ports
-      # - 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      # - 8081:80 # may be removed if under reverse-proxy
+      # - 8443:8443 
+      # - 8888:8080 # AIO
+
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

-      # Prod Router - DISABLED per user request
-      # - "traefik.http.routers.nextcloud-aio.rule=Host(`nextcloud-aio.forust.xyz`)"
-      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
-      # - "traefik.http.routers.nextcloud-aio.middlewares=security-headers"
-      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
-      # - "traefik.http.routers.nextcloud-aio.tls=true"
+      # AIO Services configuration
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
      - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
      - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"

-      # - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"
+      # Prod Router
+      # - "traefik.http.routers.nextcloud-aio.rule=Host(`naio.forust.xyz`)"
+      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
+      # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
+      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
+      # - "traefik.http.routers.nextcloud-aio.tls=true"

      # Local Router
-      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`nextcloud-aio.workstation.internal`) || Host(`nextcloud-aio.internal`)"
+      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`) || Host(`nextcloud-aio.internal`)"
      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file"
      - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio"
      - "traefik.http.routers.nextcloud-aio-local.tls=true"

      # Dev Router
-      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`nextcloud-aio.gigaforust.internal`)"
+      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`naio.gigaforust.internal`)"
      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file"
      - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio"
      - "traefik.http.routers.nextcloud-aio-dev.tls=true"

+      # Glanceapp/glance config
      - glance.name=Nextcloud
      # - glance.icon=si:nextcloud
      - glance.url=https://nextcloud.forust.xyz/
      - glance.description=Nextcloud is a suite of client-server software for creating and using file hosting services.

    environment:
-      # Is needed when using any of the options below
-      AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
+      AIO_DISABLE_BACKUP_SECTION: false
      APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      APACHE_ADDITIONAL_NETWORK: traefik-proxy # (Optional) Connect the apache container to an additional docker network. Needed when behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) running in a different docker network on same server. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
+      APACHE_IP_BINDING: 0.0.0.0 # Configure when going with reverse-proxy https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      APACHE_ADDITIONAL_NETWORK: proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Backup retention See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
      COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
-      FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M" # Allows to adjust the fulltextsearch java options. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-fulltextsearch-java-options
-      NEXTCLOUD_DATADIR: /media/forust/nextcloud/ncdata # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
-      NEXTCLOUD_MOUNT: /media/forust/nextcloud # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
-      NEXTCLOUD_UPLOAD_LIMIT: 16G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
-      NEXTCLOUD_MAX_TIME: 3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
+      FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M" # adjust fulltextsearch java options. https://github.com/nextcloud/all-in-one#how-to-adjust-the-fulltextsearch-java-options
+      NEXTCLOUD_DATADIR: /mnt/nextcloud/ncdata # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
+      NEXTCLOUD_MOUNT: /mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
+      NEXTCLOUD_UPLOAD_LIMIT: 16G # https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
+      NEXTCLOUD_MAX_TIME: 7200 # Max uploading time See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
      NEXTCLOUD_MEMORY_LIMIT: 512M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
-      # NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nextcloud container (Useful e.g. for LDAPS) See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
+      # NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts # CA certificates will be trusted by the OS of the nextcloud container See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
      NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
      NEXTCLOUD_ADDITIONAL_APKS: imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
-      NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
+      NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # dditional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
      NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device for containers that profit from it. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud
      # NEXTCLOUD_KEEP_DISABLED_APPS: false # Setting this to true will keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed. See https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps
-      SKIP_DOMAIN_VALIDATION: false # This should only be set to true if things are correctly configured. See https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-skip-the-domain-validation
+      SKIP_DOMAIN_VALIDATION: true # This should only be set to true if things are correctly configured. See https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-skip-the-domain-validation
      # TALK_PORT: 3478 # This a-llows to adjust the port that the talk container is using which is exposed on the host. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
-      # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock'
+      # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. For macos it needs to be '/var/run/docker.sock'

 networks:
-  traefik-proxy:
+  proxy:
    external: true
  nextcloud-aio:
    driver: bridge
@@ -83,4 +83,4 @@ networks:
 volumes:
  # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
-    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
+    name: nextcloud_aio_mastercontainer # Do not change
@@ -50,7 +50,7 @@ x-secret-key: &penpot-secret-key

 networks:
  penpot:
-  traefik-proxy:
+  proxy:
    external: true

 volumes:
@@ -86,8 +86,8 @@ services:
  penpot-frontend:
    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
    restart: always
-    ports:
-      - 9001:8080
+    # ports:
+    #   - 9001:8080

    volumes:
      - penpot_assets:/opt/data/assets
@@ -98,11 +98,11 @@ services:

    networks:
      - penpot
-      - traefik-proxy
+      - proxy

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
@@ -10,10 +10,10 @@ services:
      - 9443:9443
      # - 8000:8000  # Remove if you do not intend to use Edge Agents
    networks:
-      - traefik-proxy
+      - proxy
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
@@ -50,5 +50,5 @@ volumes:
 networks:
  default:
    name: portainer_network
-  traefik-proxy:
+  proxy:
    external: true
@@ -3,15 +3,15 @@ services:
    image: ghcr.io/lukegus/termix:latest
    container_name: termix
    restart: unless-stopped
-    ports:
-      - "3331:8080"
+    # ports:
+    #   - "3331:8080"
    volumes:
      - ./termix-data:/app/data
    environment:
      PORT: "8080"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
@@ -35,10 +35,10 @@ services:
      - "traefik.http.routers.termix-dev.service=termix"
      - "traefik.http.routers.termix-dev.tls=true"
    networks:
-      - traefik-proxy
+      - proxy

 networks:
-  traefik-proxy:
+  proxy:
    external: true

 volumes:
@@ -0,0 +1,3 @@
+# ===================================
+# Traefik envs 
+EMAIL=bobrovod@national.shitposting.agency
@@ -11,7 +11,7 @@ services:
      # Providers
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=traefik-proxy"
+      - "--providers.docker.network=proxy"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"

@@ -23,45 +23,45 @@ services:
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      - "--entryPoints.ssh.address=:2221"

-      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
-      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
-      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      # Let's Encrypt
+      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      # # STAGING
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"

      # Cloudflare 
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
-
-      # Logging
-      - "--log.level=INFO"
-      - "--log.filePath=/var/log/traefik/traefik.log"
-      - "--accesslog=true"
-      - "--accesslog.filepath=/var/log/traefik/access.log"
+      # # Logging
+      # - "--log.level=INFO"
+      # - "--log.filePath=/var/log/traefik/traefik.log"
+      # - "--accesslog=true"
+      # - "--accesslog.filepath=/var/log/traefik/access.log"

    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

-      # Prod Router (Dashboard) - DISABLED per user request
-      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
-      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
-      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
-      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
-      # - "traefik.http.routers.traefik-dashboard.tls=true"
+      # Prod Router (Dash)
+      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
+      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard.middlewares=security-chain@file"
+      - "traefik.http.routers.traefik-dashboard.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard.tls=true"

      # Local Router
      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth@file,security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-local.middlewares=security-headers@file"
      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-local.tls=true"

      # Dev Router
      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-chain@file"
      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-dev.tls=true"

@@ -78,14 +78,14 @@ services:
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./certs:/certs:ro
      - ./logs:/var/log/traefik
-      # - ./traefik/letsencrypt:/letsencrypt
+      - ./letsencrypt:/letsencrypt

    networks:
-      - traefik-proxy
+      - proxy

    environment:
      - TZ=Europe/Bratislava

 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -1,328 +0,0 @@
-http:
-  routers:
-    # Traefik Dashboard (ADMIN, local only)
-    traefik-dashboard:
-      rule: "Host(`traefik.workstation`)"
-      entryPoints:
-        - websecure
-      service: api@internal
-      middlewares:
-        # - auth
-        - security-headers
-      tls: {}
-
-    # Nextcloud AIO Interface (ADMIN, local is better)
-    nextcloud-aio:
-      rule: "Host(`nextcloud-aio.workstation`)"
-      entryPoints:
-        - websecure
-      service: nextcloud-aio
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Termix (public (account required))
-    termix:
-      rule: "Host(`termix.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: termix
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # MeTube
-    metube:
-      rule: "Host(`metube.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: metube
-      middlewares:
-        - metube-auth
-        - security-headers
-      tls: {}
-    
-    # Portainer (public (account required))
-    portainer:
-      rule: "Host(`portainer.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: portainer
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Uptime Kuma
-    uptime-kuma:
-      rule: "Host(`uptime.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: uptime-kuma
-      tls: {}
-
-    # AdGuard Home (public (account required))
-    adguard:
-      rule: "Host(`adguard.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: adguard
-      middlewares:
-        - security-headers
-      tls: {}
-
-
-    # Nextcloud Main (public (account required))
-    nextcloud:
-      rule: "Host(`nextcloud.forust.xyz`)"
-      entrypoints:
-        - websecure
-      service: nextcloud
-      middlewares:
-        - nextcloud-chain
-      tls: {}
-
-    # Dockmon (public (account required))
-    dockmon:
-      rule: "Host(`dockmon.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: dockmon
-      middlewares:
-        # - dockmon-auth
-        - security-headers
-      tls: {}
-
-    # Gitea (public (account required))
-    gitea:
-      rule: "Host(`gitea.forust.xyz`)"
-      entryPoints:
-        - websecure
-        - ssh
-      service: gitea
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # # Glance (local only)
-    # glance:
-    #   rule: "Host(`glance.workstation`)"
-    #   entryPoints:
-    #     - websecure
-    #   service: glance
-    #   middlewares:
-    #     - security-headers
-    #   tls: {}
-
-    # Watercrawl (local only)
-    watercrawl:
-      rule: "Host(`watercrawl.workstation`)"
-      entryPoints:
-        - websecure
-      service: watercrawl
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # N8N (local only)
-    n8n:
-      rule: "Host(`n8n.workstation`)"
-      entryPoints:
-        - websecure
-      service: n8n
-      middlewares:
-        - security-headers
-      tls: {}
-
-
-  services:
-    # Portainer
-    portainer:
-      loadBalancer:
-        servers:
-          - url: "https://portainer:9443"
-        serversTransport: insecureTransport
-
-    # AdGuard Home
-    adguard:
-      loadBalancer:
-        servers:
-          - url: "http://adguardhome:3000"
-
-    # Nextcloud AIO Interface
-    nextcloud-aio:
-      loadBalancer:
-        servers:
-          - url: "https://nextcloud-aio-mastercontainer:8080"
-        serversTransport: insecureTransport
-
-    # Nextcloud Main
-    nextcloud:
-      loadBalancer:
-        servers:
-          - url: "http://nextcloud-aio-apache:11000"
-
-    # Uptime Kuma
-    uptime-kuma:
-      loadBalancer:
-        servers:
-          - url: "http://uptime-kuma:3001"
-
-    # Termix
-    termix:
-      loadBalancer:
-        servers:
-          - url: "http://termix:8080"
-
-    # Dockmon
-    dockmon:
-      loadBalancer:
-        servers:
-          - url: "https://dockmon:443"
-        serversTransport: insecureTransport
-
-    # # Glance
-    # glance:
-    #   loadBalancer:
-    #     servers:
-    #       - url: "http://glance:8080"
-
-    # Watercrawl
-    watercrawl:
-      loadBalancer:
-        servers:
-          - url: "http://nginx:80"
-
-    # N8N
-    n8n:
-      loadBalancer:
-        servers:
-          - url: "http://n8n:5678"
-
-    # Gitea
-    gitea:
-      loadBalancer:
-        servers:
-          - url: "http://gitea:3000"
-    # MeTube
-    metube:
-      loadBalancer:
-        servers:
-          - url: "http://metube:8081"
-
-  serversTransports:
-    insecureTransport:
-      insecureSkipVerify: true
-
-  middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC"
-          # - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq"
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
-          # - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu"
-          # - "vv:"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
-        realm: "Dockmon Access"
-    
-    # Cloudflare IP Whitelist
-    cloudflare-ipwhitelist:
-      ipWhiteList:
-        sourceRange:
-          - "173.245.48.0/20"
-          - "103.21.244.0/22"
-          - "103.22.200.0/22"
-          - "103.31.4.0/22"
-          - "141.101.64.0/18"
-          - "108.162.192.0/18"
-          - "190.93.240.0/20"
-          - "188.114.96.0/20"
-          - "197.234.240.0/22"
-          - "198.41.128.0/17"
-          - "162.158.0.0/15"
-          - "104.16.0.0/13"
-          - "104.24.0.0/14"
-          - "172.64.0.0/13"
-          - "131.0.72.0/22"
-
-    # Security Headers
-    security-headers:
-      headers:
-        browserXssFilter: true
-        contentTypeNosniff: true
-        forceSTSHeader: true
-        stsIncludeSubdomains: true
-        stsPreload: true
-        stsSeconds: 31536000
-        customFrameOptionsValue: "SAMEORIGIN"
-        customResponseHeaders:
-          X-Content-Type-Options: "nosniff"
-          Referrer-Policy: "strict-origin-when-cross-origin"
-
-    # Nextcloud specific headers
-    nextcloud-secure-headers:
-      headers:
-        hostsProxyHeaders:
-          - "X-Forwarded-Host"
-          - "X-Forwarded-Proto"
-        referrerPolicy: "same-origin"
-        customFrameOptionsValue: "SAMEORIGIN"
-
-    # Rate limiting
-    rate-limit:
-      rateLimit:
-        average: 100
-        burst: 50
-        period: 1m
-
-    # Nextcloud chain
-    nextcloud-chain:
-      chain:
-        middlewares:
-          - nextcloud-secure-headers
-          - security-headers
-
-# TLS Configuration
-tls:
-  certificates:
-    # Cloudflare Origin CA *.forust.xyz
-    - certFile: /certs/cloudflare.pem
-      keyFile: /certs/cloudflare.key
-    # Local certificate
-    - certFile: /certs/workstation+1.pem
-      keyFile: /certs/workstation+1-key.pem
-  
-  stores:
-    default:
-      defaultCertificate:
-        # Fallback local certificate
-        certFile: /certs/workstation+1.pem
-        keyFile: /certs/workstation+1-key.pem
-  
-  options:
-    default:
-      minVersion: VersionTLS12
-      sniStrict: true
-      cipherSuites:
-        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
@@ -2,20 +2,3 @@ http:
  serversTransports:
    insecureTransport:
      insecureSkipVerify: true
-
-  routers:
-    # Nextcloud Main (public (account required))
-    nextcloud:
-      rule: "Host(`nextcloud.forust.xyz`)"
-      entrypoints:
-        - websecure
-      service: nextcloud
-      middlewares:
-        - nextcloud-chain
-      tls: {}
-  services:
-    # Nextcloud Main
-    nextcloud:
-      loadBalancer:
-        servers:
-          - url: "http://nextcloud-aio-apache:11000"
@@ -0,0 +1,23 @@
+http:
+  routers:
+    fs1-public:
+      rule: "Host(`fs1.domain.xyz`)"
+      entrypoints:
+        - websecure
+      service: fs1
+      middlewares:
+        - security-chain@file
+      tls: {}
+
+    fs1-workstation:
+      rule: "Host(`fs1.workstation.internal`)"
+      entrypoints:
+        - websecure
+      service: fs1
+      tls: {}
+      
+  services:
+    fs1:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:3923" # Copyparty port example
@@ -5,29 +5,6 @@ http:
      redirectScheme:
        scheme: https
        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          -  "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
-
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Dockmon Access"
-    
    # Cloudflare IP Whitelist
    cloudflare-ipwhitelist:
      ipWhiteList:
@@ -48,6 +25,29 @@ http:
          - "172.64.0.0/13"
          - "131.0.72.0/22"

+    # Authentik + secure headers
+    security-chain:
+      chain:
+        middlewares:
+          - authentik@file
+          - security-headers@file
+    authentik:
+      forwardAuth:
+        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-meta-version
+
    # Security Headers
    security-headers:
      headers:
@@ -82,5 +82,5 @@ http:
    nextcloud-chain:
      chain:
        middlewares:
-          - nextcloud-secure-headers
-          - security-headers
+          - nextcloud-secure-headers@file
+          - security-headers@file
@@ -0,0 +1,40 @@
+http:
+  routers:
+    # Nextcloud prod
+    nextcloud:
+      rule: "Host(`nextcloud.forust.xyz`)"
+      entrypoints:
+        - websecure
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Nextcloud dev
+    nextcloud-local:
+      rule: "Host(`nextcloud.workstation.internal`)"
+      entrypoints:
+        - websecure
+        - web
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Nextcloud dev
+    nextcloud-dev:
+      rule: "Host(`nextcloud.gigaforust.internal`)"
+      entrypoints:
+        - websecure
+        - web
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+  services:
+    # Nextcloud Main
+    nextcloud:
+      loadBalancer:
+        servers:
+          - url: "http://nextcloud-aio-apache:11000"
@@ -0,0 +1,8 @@
+http:
+  routers:
+    acme-challenge-exempt:
+      rule: "PathPrefix(`/.well-known/acme-challenge`)"
+      entryPoints:
+        - web
+      service: noop@internal
+      priority: 100
@@ -1,153 +0,0 @@
-http:
-  routers:
-    # Traefik Dashboard (dev access. local only)
-    traefik-dashboard-dev:
-      rule: "Host(`traefik.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: api@internal
-      middlewares:
-        # - auth
-        - security-headers
-      tls: {}
-
-    # Nextcloud AIO Interface (dev access. local only)
-    nextcloud-aio-dev:
-      rule: "Host(`nextcloud-aio.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: nextcloud-aio
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Termix (dev access, (account required))
-    termix-dev:
-      rule: "Host(`termix.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: termix
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # MeTube (dev access, (auth required))
-    metube-dev:
-      rule: "Host(`metube.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: metube
-      middlewares:
-        - metube-auth
-        - security-headers
-      tls: {}
-
-    # Portainer (dev acess, (account required))
-    portainer-dev:
-      rule: "Host(`portainer.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: portainer
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Uptime Kuma (dev access, (account required))
-    uptime-kuma-dev:
-      rule: "Host(`uptime.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: uptime-kuma
-      tls: {}
-
-    # AdGuard Home (dev access, (account required))
-    adguard-dev:
-      rule: "Host(`adguard.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: adguard
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Nextcloud Main (public (account required))
-    nextcloud-dev:
-      rule: "Host(`nextcloud.gigaforust`)"
-      entrypoints:
-        - websecure
-      service: nextcloud
-      middlewares:
-        - nextcloud-chain
-      tls: {}
-
-    # Dockmon (dev access (account required))
-    dockmon-dev:
-      rule: "Host(`dockmon.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: dockmon
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Gitea (dev access (account required))
-    gitea-dev:
-      rule: "Host(`gitea.gigaforust`)"
-      entryPoints:
-        - websecure
-        - ssh
-      service: gitea
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Glance (dev access, local only)
-    glance-dev:
-      rule: "Host(`glance.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: glance
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Watercrawl (dev access, local only)
-    watercrawl-dev:
-      rule: "Host(`watercrawl.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: watercrawl
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # N8N (local only)
-    n8n-dev:
-      rule: "Host(`n8n.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: n8n
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Landing Page (public)
-    forust-homepage-dev:
-      rule: "Host(`landing.gigaforust`)"
-      entryPoints:
-        - websecure
-      service: forust-homepage
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Penpot
-    penpot-dev:
-      rule: "Host(`penpot.gigaforust`)"
-      entryPoints:
-        - websecure
-        - web
-      service: penpot
-      middlewares:
-        - security-headers
-      tls: {}
@@ -1,152 +0,0 @@
-http:
-  routers:
-    # Traefik Dashboard (local access, ADMIN, local only)
-    traefik-dashboard-local:
-      rule: "Host(`traefik.workstation`)"
-      entryPoints:
-        - websecure
-      service: api@internal
-      middlewares:
-        # - auth
-        - security-headers
-      tls: {}
-
-    # Nextcloud AIO Interface (local access. ADMIN, local only)
-    nextcloud-aio-local:
-      rule: "Host(`nextcloud-aio.workstation`)"
-      entryPoints:
-        - websecure
-      service: nextcloud-aio
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Termix (local access, (account required))
-    termix-local:
-      rule: "Host(`termix.workstation`)"
-      entryPoints:
-        - websecure
-      service: termix
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # MeTube (local access, (auth required))
-    metube-local:
-      rule: "Host(`metube.workstation`)"
-      entryPoints:
-        - websecure
-      service: metube
-      middlewares:
-        - metube-auth
-        - security-headers
-      tls: {}
-
-    # Portainer (dev acess, (account required))
-    portainer-local:
-      rule: "Host(`portainer.workstation`)"
-      entryPoints:
-        - websecure
-      service: portainer
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Uptime Kuma (local access, (account required))
-    uptime-kuma-local:
-      rule: "Host(`uptime.workstation`)"
-      entryPoints:
-        - websecure
-      service: uptime-kuma
-      tls: {}
-
-    # AdGuard Home (local access, (account required))
-    adguard-local:
-      rule: "Host(`adguard.workstation`)"
-      entryPoints:
-        - websecure
-      service: adguard
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Nextcloud Main (public (account required))
-    nextcloud-local:
-      rule: "Host(`nextcloud.workstation`)"
-      entrypoints:
-        - websecure
-      service: nextcloud
-      middlewares:
-        - nextcloud-chain
-      tls: {}
-
-    # Nextcloud Main (public (account required))
-    penpot-local:
-      rule: "Host(`penpot.workstation`)"
-      entrypoints:
-        - websecure
-      service: penpot
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Dockmon (local access (account required))
-    dockmon-local:
-      rule: "Host(`dockmon.workstation`)"
-      entryPoints:
-        - websecure
-      service: dockmon
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Gitea (local access (account required))
-    gitea-local:
-      rule: "Host(`gitea.workstation`)"
-      entryPoints:
-        - websecure
-        - ssh
-      service: gitea
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Glance (local access)
-    glance-local:
-      rule: "Host(`glance.workstation`)"
-      entryPoints:
-        - websecure
-      service: glance
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Watercrawl (local access)
-    watercrawl-local:
-      rule: "Host(`watercrawl.workstation`)"
-      entryPoints:
-        - websecure
-      service: watercrawl
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # N8N (local only)
-    n8n-local:
-      rule: "Host(`n8n.workstation`)"
-      entryPoints:
-        - websecure
-      service: n8n
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Landing Page (local access)
-    forust-homepage-local:
-      rule: "Host(`landing.workstation`)"
-      entryPoints:
-        - websecure
-      service: forust-homepage
-      middlewares:
-        - security-headers
-      tls: {}
@@ -1,152 +0,0 @@
-http:
-  routers:
-    # Traefik Dashboard (ADMIN, without subdomeain)
-    traefik-dashboard:
-      rule: "Host(`traefik.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: api@internal
-      middlewares:
-        - auth
-        - security-headers
-      tls: {}
-
-    # Nextcloud AIO Interface (ADMIN, without subdomeain)
-    nextcloud-aio:
-      rule: "Host(`nextcloud-aio.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: nextcloud-aio
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Nextcloud AIO Interface (ADMIN, without subdomeain)
-    penpot:
-      rule: "Host(`penpot.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: penpot
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Termix (public (account required))
-    termix:
-      rule: "Host(`termix.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: termix
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # MeTube (public (auth required))
-    metube:
-      rule: "Host(`metube.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: metube
-      middlewares:
-        - metube-auth
-        - security-headers
-      tls: {}
-
-    # Portainer (public (account required))
-    portainer:
-      rule: "Host(`portainer.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: portainer
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Uptime Kuma (public (account required))
-    uptime-kuma:
-      rule: "Host(`uptime.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: uptime-kuma
-      tls: {}
-
-    # AdGuard Home (public (account required))
-    adguard:
-      rule: "Host(`adguard.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: adguard
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Nextcloud Main (public (account required))
-    nextcloud:
-      rule: "Host(`nextcloud.forust.xyz`)"
-      entrypoints:
-        - websecure
-      service: nextcloud
-      middlewares:
-        - nextcloud-chain
-      tls: {}
-
-    # Dockmon (public (account required))
-    dockmon:
-      rule: "Host(`dockmon.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: dockmon
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Gitea (public (account required))
-    gitea:
-      rule: "Host(`gitea.forust.xyz`)"
-      entryPoints:
-        - websecure
-        - ssh
-      service: gitea
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Glance (public, without subdomain)
-    glance:
-      rule: "Host(`glance.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: glance
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Watercrawl (public, without subdomain)
-    watercrawl:
-      rule: "Host(`watercrawl.fourst.xyz`)"
-      entryPoints:
-        - websecure
-      service: watercrawl
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # N8N (public, without subdomain)
-    n8n:
-      rule: "Host(`n8n.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: n8n
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # Landing Page (public)
-    forust-homepage:
-      rule: "Host(`forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: forust-homepage
-      middlewares:
-        - security-headers
-      tls: {}
@@ -1,86 +0,0 @@
-http:
-  services:
-    # Portainer
-    portainer:
-      loadBalancer:
-        servers:
-          - url: "https://portainer:9443"
-        serversTransport: insecureTransport
-
-    # AdGuard Home
-    adguard:
-      loadBalancer:
-        servers:
-          - url: "http://adguardhome:3000"
-
-    # Nextcloud AIO Interface
-    nextcloud-aio:
-      loadBalancer:
-        servers:
-          - url: "https://nextcloud-aio-mastercontainer:8080"
-        serversTransport: insecureTransport
-
-    # Penpot
-    penpot:
-      loadBalancer:
-        servers:
-          - url: "http://penpot-frontend:8080"
-
-    # Nextcloud Main
-    nextcloud:
-      loadBalancer:
-        servers:
-          - url: "http://nextcloud-aio-apache:11000"
-
-    # Uptime Kuma
-    uptime-kuma:
-      loadBalancer:
-        servers:
-          - url: "http://uptime-kuma:3001"
-
-    # Termix
-    termix:
-      loadBalancer:
-        servers:
-          - url: "http://termix:8080"
-
-    # Dockmon
-    dockmon:
-      loadBalancer:
-        servers:
-          - url: "https://dockmon:443"
-        serversTransport: insecureTransport
-
-    # Glance
-    glance:
-      loadBalancer:
-        servers:
-          - url: "http://glance:8080"
-
-    # Watercrawl
-    watercrawl:
-      loadBalancer:
-        servers:
-          - url: "http://nginx:80"
-
-    # N8N
-    n8n:
-      loadBalancer:
-        servers:
-          - url: "http://n8n:5678"
-
-    # Gitea
-    gitea:
-      loadBalancer:
-        servers:
-          - url: "http://gitea:3000"
-    # MeTube
-    metube:
-      loadBalancer:
-        servers:
-          - url: "http://metube:8081"
-    # Landing Page
-    forust-homepage:
-      loadBalancer:
-        servers:
-          - url: "http://forust-homepage:80"
@@ -4,7 +4,8 @@ tls:
    # Cloudflare Origin CA *.forust.xyz
    - certFile: /certs/cloudflare.pem
      keyFile: /certs/cloudflare.key
-
+    - certFile: /certs/xdfnx.pem
+      keyFile: /certs/xdfnx.key
  stores:
    default:
      defaultCertificate:
@@ -5,12 +5,12 @@ services:
    container_name: uptime-kuma
    volumes:
      - ./data:/app/data
-    ports:
+      # ports:
      # <Host Port>:<Container Port>
-      - "3001:3001"
+      # - "3001:3001"
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
@@ -28,7 +28,7 @@ services:
      - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
      - "traefik.http.routers.uptime-kuma-dev.tls=true"
    networks:
-      - traefik-proxy
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
    external: true
@@ -1,9 +1,8 @@
 services:
-  userbot_forust:
+  forust:
    build:
      context: .
      dockerfile: Dockerfile
-    container_name: userbot_forust
    restart: unless-stopped
    env_file:
      - .env
@@ -16,11 +15,10 @@ services:
      - 8.8.8.8
      - 1.1.1.1

-  userbot_anna:
+  anna:
    build:
      context: .
      dockerfile: Dockerfile
-    container_name: userbot_anna
    restart: unless-stopped
    env_file:
      - .env
@@ -31,27 +29,4 @@ services:
      - ./volumes/logs_anna:/app/logs
    dns:
      - 8.8.8.8
-      - 1.1.1.1
-    develop:
-      watch:
-        - action: sync
-          path: modules
-          target: /app/modules
-        - action: sync
-          path: utils
-          target: /app/utils
-        - action: sync
-          path: main.py
-          target: /app/main.py
-        - action: rebuild
-          path: .env
-        - action: rebuild
-          path: .env.anna
-
-
-volumes:
-  downloads:
-
-networks:
-  userbot_network:
-    driver: bridge
+      - 1.1.1.1
Author	SHA1	Message	Date
forust	c13056fba1	Merge pull request 'feat/checkmk' (#7 ) from feat/checkmk into main Reviewed-on: #7	2026-01-19 15:59:21 +01:00
forust	5fe8af82d5	Revert "fix: clean up traefik configuration and add redirect middleware" This reverts commit `dc7fe64fbc`.	2026-01-19 11:18:36 +01:00
forust	6d97246997	fix: change checkmk container restart policy to 'unless-stopped'	2026-01-19 00:08:16 +01:00
forust	6970279311	fix: remove checkmk port for docker cmk agent, using external agent	2026-01-18 23:09:41 +01:00
forust	02f4e0ab42	chore: switch to named volumes for site storing	2026-01-18 22:39:48 +01:00
forust	4a25622552	Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/checkmk	2026-01-18 19:28:12 +01:00
forust	0138fbd276	fix: update middleware for dev router in glance compose file	2026-01-18 19:24:41 +01:00
forust	94b5f39207	make glance dashboard public again	2026-01-18 00:19:39 +01:00
forust	403e88d548	fix: update NEXTCLOUD_DATADIR path to match new hardware	2026-01-17 17:44:11 +01:00
forust	d03a4844fb	chore: remove unused tailscale setup	2026-01-17 15:38:27 +01:00
forust	48ff08529e	Merge pull request 'feat: add group support for webinar notifier' (#5 ) from feat/edu-group into main Reviewed-on: #5	2026-01-14 16:46:37 +01:00
forust	81592b6142	feat: add group support for webinar notifier	2026-01-13 00:24:04 +01:00
forust	9480576966	fix: update bots' code to match .env keys	2026-01-12 15:33:42 +01:00
forust	9b43a9bef4	feat: add traefik configuration for external fileservers	2026-01-09 14:48:42 +01:00
forust	2b03335af5	chore: shorten aio subdomain	2026-01-06 19:04:23 +01:00
forust	ea738ec14c	Merge pull request 'add pgp pubkey to landing page, minor info changes' (#4 ) from chore/pgp into main Reviewed-on: #4	2026-01-03 02:26:04 +01:00
forust	e4e9d96a0b	add pgp pubkey to landing page, minor info changes	2026-01-03 02:25:12 +01:00
forust	89576032b9	fix: update DNS settings for headscale	2026-01-03 01:39:05 +01:00
forust	a9edfc0a25	fix: traefik middlewares for local and dev envs	2026-01-02 13:06:49 +01:00
forust	acb8009307	Merge pull request 'feat: headscale implementation' (#3 ) from feat/tailscale into main Reviewed-on: #3	2026-01-02 03:06:50 +01:00
forust	21f4e46028	chore: container name change for headscale web panel	2026-01-02 03:06:24 +01:00
forust	0234524635	feat: headscale implementation - Headscale server - Using goodieshq/headscale-admin as ui - UI protected by security-chain - Metrics available at /metrics	2026-01-02 01:29:51 +01:00
forust	26f5fb2fb9	Revert "feat: add gitea-basic-runner" This reverts commit `f0682319a7`.	2026-01-02 00:38:04 +01:00
forust	122e6f6986	Revert "chore: gitea runners gitignored" This reverts commit `e0f7ab6561`.	2026-01-02 00:37:47 +01:00
forust	ce0bc4613a	fix: headscale command	2026-01-01 03:19:45 +01:00
forust	8f4f460ff3	feat: add headscale server and UI configuration with Traefik routing	2026-01-01 02:39:28 +01:00
forust	c048efd569	Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/tailscale	2026-01-01 01:45:57 +01:00
forust	1f1e13ff39	WIP: fix: update checkmk configuration for correct routing	2026-01-01 00:25:17 +01:00
forust	c80a6c5351	Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/checkmk	2025-12-31 21:19:42 +01:00
forust	4fe3d660f1	Merge pull request 'Added DoT support on dns.forust.xyz' (#2 ) from fix/dns into main Reviewed-on: #2	2025-12-31 03:44:08 +01:00
forust	9675eac2bf	feat: add DoT support on dns.forust.xyz - Made adguard available on adguard. and dns. subdomain - DoT and DoH implementation complete	2025-12-31 03:41:38 +01:00
forust	dc7fe64fbc	fix: clean up traefik configuration and add redirect middleware	2025-12-30 22:44:52 +01:00
forust	502810a12e	fix: update traefik router rules for DNS and adjust letsencrypt volume path	2025-12-30 17:20:13 +01:00
forust	c047cc291d	LE for DoH	2025-12-30 16:54:23 +01:00
forust	f2b951673c	fix: add traefik route for dns o https	2025-12-30 15:47:39 +01:00
forust	6b7c0df586	Merge pull request 'refactor: update network refs form "traefik-proxy" to "proxy"' (#1 ) from refactor/traefik-network into main Reviewed-on: #1	2025-12-30 14:26:09 +01:00
forust	fb2f420520	refactor: update network refs form "traefik-proxy" to "proxy" - To allow testing dev vers of other services	2025-12-30 14:14:24 +01:00
forust	60c7d4ff17	feat: add mailer support and credentials for gitea	2025-12-28 23:35:31 +01:00
forust	d20ec696a3	tcp router for gite ssh	2025-12-26 21:02:47 +01:00
forust	c030b4cffa	Merge branch 'main' into fix/gitea-ssh	2025-12-26 20:58:22 +01:00
forust	e0f7ab6561	chore: gitea runners gitignored	2025-12-25 20:00:22 +01:00
forust	f0682319a7	feat: add gitea-basic-runner	2025-12-25 19:58:38 +01:00
forust	dbd3f36f76	kek	2025-12-25 19:54:32 +01:00
forust	4471da827c	kek	2025-12-25 19:41:25 +01:00
forust	163ea867ce	feat: downtify service, traefik integration	2025-12-20 02:00:10 +01:00
forust	dc75dbaf7c	chore: disable logging on pre-dormant period	2025-12-17 03:03:32 +01:00
forust	db0f0f7bb6	feat: tailscale server	2025-12-14 02:43:00 +01:00
forust	5e4c60bb30	chore (security): port hardening, commented out non-critical ports	2025-12-14 02:42:46 +01:00
forust	17cae71952	refactor: userbots' compose-files cleanup	2025-12-09 21:45:24 +01:00
forust	f4c695f95e	feat: security-chain (authentik) on no-login services, SSO traefik dashboard	2025-12-09 15:14:42 +01:00
forust	6bdb16ad21	chore: whitespaces	2025-12-09 13:23:59 +01:00
forust	6eb62f41cc	fix: authentik-traefik dns lookup	2025-12-09 13:23:48 +01:00
forust	586f0e3f7d	feat: authenitk-only access for metube	2025-12-09 03:58:36 +01:00
forust	0e46193f53	chore: replace sec middlewares with sec chain	2025-12-09 03:57:13 +01:00
forust	aed28ed15c	refactor: sepparate traefik and authentik	2025-12-09 03:52:20 +01:00
forust	f3b73bae11	feat: authentik service+envfile for traefik and authentik	2025-12-08 01:29:00 +01:00
forust	be049cfa0d	chore: gitignore checkmk's files	2025-12-08 00:34:08 +01:00
forust	bfb21adff7	using local directory for storing chkmk data	2025-12-07 22:06:30 +01:00
forust	1c75382a6e	fix: replace container_name to avoid misunderstandings	2025-12-07 04:14:56 +01:00
forust	9c5e037567	refactor: switch to official checkmk dockercompose	2025-12-07 04:10:32 +01:00
forust	4f9e7ea990	feat: nextcloud beta	2025-12-07 03:51:43 +01:00
forust	9f784d2c31	chore: gitignore checkmk's files	2025-12-07 02:59:18 +01:00
forust	a07e27bff6	feat: checkmk service	2025-12-07 02:44:12 +01:00
forust	c31369f2b7	add certfiles for xdfnx landing	2025-12-07 02:28:55 +01:00
forust	3bfcd6edf4	feat: add xdfnx's landing site	2025-12-07 02:17:19 +01:00
forust	504cbc81a0	fix: nextcloud traefik router parse error	2025-12-07 02:16:59 +01:00
forust	aa7239ee83	refactor: traefik dynamic configuration	2025-12-07 01:39:58 +01:00
forust	6d9427cf2a	chore: add traefik dev rule for main nextcloud	2025-12-06 02:34:19 +01:00
forust	70d60ed40a	chore: add traefik dev rule for main nextcloud	2025-12-06 02:33:10 +01:00
forust	aca6824309	chore: comments cleanup	2025-12-06 01:31:50 +01:00
forust	6843befac3	fix: temp labels for routing SSH for gitea	2025-11-16 00:01:35 +01:00
forust	0dfb09590d	fix: added ssh domain	2025-11-15 23:55:02 +01:00
forust	625eb9561b	testing: removed https:// from root url	2025-11-15 23:48:35 +01:00
forust	b367b64879	fix: removed ssh port-forwarding for gitea	2025-11-15 23:42:03 +01:00