feat: add traefik configuration for external fileservers

chore: shorten aio subdomain
Merge pull request 'add pgp pubkey to landing page, minor info changes' (#4 ) from chore/pgp into main
2026-01-09 14:48:42 +01:00 · 2026-01-06 19:04:23 +01:00 · 2026-01-03 02:26:04 +01:00 · 2026-01-03 02:25:12 +01:00 · 2026-01-03 01:39:05 +01:00 · 2026-01-02 13:06:49 +01:00
19 changed files with 291 additions and 92 deletions
@@ -2,17 +2,9 @@
 sync.ffs_lock
 .sync.ffs_db

-# Environment 
-.env
-.env.anna
-.env.forust
-.env.*
-!.env.*example
-
 # Volumes and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
-gitea/*runner/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
 adguardhome/data/*
@@ -24,6 +16,8 @@ termix/termix-data/*
 cfddns/config.json
 checkmk/checkmk/*
 downtify/Downtify_downloads
+headscale/config/*
+headscale/data/*

 # Steaming services files
 streaming/jellyfin/*
@@ -36,11 +30,15 @@ streaming/prowlarr/*

 # Homepage 
 homepages/forust_files/assets/images/team/*
-
+homepages/forust_files/.well-known/*

 # Traefik files
 traefik/letsencrypt/acme.json
+traefik/dynamic/fileservers.yml
 traefik/logs/*
+
+# SSL Certificates
+adguardhome/certs/*
 traefik/certs/*

 # Monitoring
@@ -83,3 +81,11 @@ replacements.txt

 # Temp files
 edu_master/temp/
+temp/*
+
+# Environment 
+.env
+.env.anna
+.env.forust
+.env.*
+!*example
@@ -3,45 +3,51 @@ services:
    image: adguard/adguardhome:latest
    container_name: adguardhome
    restart: unless-stopped
-    environment:
-      - TZ=${TZ}
    ports:
      - "53:53/tcp"
      - "53:53/udp"
+      - "853:853/tcp" # DNS over TLS
      # - "67:67/udp" # DHCP
      # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
    volumes:
      - ./data/work:/opt/adguardhome/work
      - ./data/conf:/opt/adguardhome/conf
+      - ./certs:/certs:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"

      # Prod Router
-      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
      - "traefik.http.routers.adguard.entrypoints=websecure"
      - "traefik.http.routers.adguard.middlewares=security-headers@file"
      - "traefik.http.routers.adguard.service=adguard"
      - "traefik.http.routers.adguard.tls=true"
-      - "traefik.http.services.adguard.loadbalancer.server.port=3000"

      # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
      - "traefik.http.routers.adguard-local.entrypoints=websecure"
      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-local.service=adguard"
      - "traefik.http.routers.adguard-local.tls=true"

      # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
      - "traefik.http.routers.adguard-dev.service=adguard"
      - "traefik.http.routers.adguard-dev.tls=true"

+      # DoH
+      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns.entrypoints=websecure"
+      - "traefik.http.routers.dns.service=adguard"
+      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
+
      - glance.name=adguard
      - glance.url=https://adguard.forust.xyz/
      - glance.description=AdGuard Home is a network-wide software for blocking ads.
@@ -26,9 +26,9 @@ services:
    command: server
    container_name: authentik-server
    restart: unless-stopped
-    ports:
-      - ${PORT_HTTP:-9000}:9000
-      - ${PORT_HTTPS:-9443}:9443
+    # ports:
+    #   - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTPS:-9443}:9443
    env_file:
      - .env
    environment:
@@ -1,7 +1,6 @@
 GITEA_POSTGRES_USER=
 GITEA_POSTGRES_PASSWORD=
 GITEA_POSTGRES_DB=gitea
-BASIC-RUNNER_TOKEN=
 GITEA_SMTP_PASS=
 MAILER_ADDR=
 SERVICE_EMAIL=email.used.by.services@domain.tld
@@ -65,25 +65,6 @@ services:
    depends_on:
      - db

-  runner:
-    image: gitea/act_runner:0.2.11
-    container_name: gitea-runner
-    restart: always
-    depends_on:
-      - server
-    env_file:
-      - .env
-    networks:
-      - gitea-db
-    environment:
-      - GITEA_INSTANCE_URL=http://server:3000
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${BASIC-RUNNER_TOKEN}
-      - GITEA_RUNNER_NAME=basic-runner
-      - GITEA_RUNNER_LABELS=docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm
-    volumes:
-      - ./gitea-runner:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-
  db:
    image: docker.io/library/postgres:14
    restart: always
@@ -0,0 +1,84 @@
+services:
+  server:
+    image: headscale/headscale:latest
+    restart: unless-stopped
+    command: serve
+    networks:
+      - proxy
+    volumes:
+      - ./config:/etc/headscale
+      - ./data:/var/lib/headscale
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
+
+      ## SERVICE
+      # Prod Router
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
+      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.service=headscale"
+      - "traefik.http.routers.headscale-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.service=headscale"
+      - "traefik.http.routers.headscale-dev.tls=true"
+
+      ## METRICS
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+    dns:
+        - 1.1.1.1
+        - 1.0.0.1
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "treafik.docker.network=proxy"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+
+networks:
+  proxy:
+    external: true
@@ -0,0 +1,79 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+randomize_client_port: false
@@ -3,8 +3,8 @@ services:
    build:
      context: .
      dockerfile: Dockerfile.forust
-    ports:
-      - "8085:80"
+    # ports:
+    #   - "8085:80"
    restart: unless-stopped
    volumes:
      - ./forust_files:/usr/share/nginx/html
@@ -42,8 +42,8 @@ services:
    build:
      context: .
      dockerfile: Dockerfile.xdfnx
-    ports:
-      - "8086:80"
+    # ports:
+    #   - "8086:80"
    restart: unless-stopped
    volumes:
      - ./xdfnx_files:/usr/share/nginx/html
@@ -77,7 +77,6 @@ services:
      - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
      - "traefik.http.routers.xdfnx-dev.tls=true"

-
 networks:
  proxy:
    external: true
@@ -41,7 +41,14 @@
                </li>
                <li>
                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:forust@forust.xyz">forust@forust.xyz</a>
+                    <a href="mailto:forust@forust.xyz">mail/contact@forust.xyz</a>
+                </li>
+                <li>
+                    <i class="fa-solid fa-key"></i>
+                    <a href=".well-known/pgp-key.asc">security/PGP Key</a>
+                </li>
+                <li>
+                    <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
                </li>
            </ul>
        </section>
@@ -25,21 +25,21 @@ services:
      - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"

      # Prod Router
-      # - "traefik.http.routers.nextcloud-aio.rule=Host(`nextcloud-aio.forust.xyz`)"
+      # - "traefik.http.routers.nextcloud-aio.rule=Host(`naio.forust.xyz`)"
      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
-      # - "traefik.http.routers.nextcloud-aio.middlewares=security-headers"
+      # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
      # - "traefik.http.routers.nextcloud-aio.tls=true"

      # Local Router
-      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`nextcloud-aio.workstation.internal`) || Host(`nextcloud-aio.internal`)"
+      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`) || Host(`nextcloud-aio.internal`)"
      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file"
      - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio"
      - "traefik.http.routers.nextcloud-aio-local.tls=true"

      # Dev Router
-      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`nextcloud-aio.gigaforust.internal`)"
+      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`naio.gigaforust.internal`)"
      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file"
      - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio"
@@ -86,8 +86,8 @@ services:
  penpot-frontend:
    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
    restart: always
-    ports:
-      - 9001:8080
+    # ports:
+    #   - 9001:8080

    volumes:
      - penpot_assets:/opt/data/assets
@@ -0,0 +1 @@
+TS_AUTHKEY=tskey-auth-xxxxx-CNTRL
@@ -0,0 +1,21 @@
+services:
+  tailscale:
+    image: tailscale/tailscale:latest
+    container_name: tailscale
+    network_mode: host
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - tailscale_data:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_HOSTNAME=forust-server
+      # - TS_EXTRA_ARGS=--advertise-tags=tag:container
+
+volumes:
+  tailscale_data:
+    name: tailscale_data
@@ -3,8 +3,8 @@ services:
    image: ghcr.io/lukegus/termix:latest
    container_name: termix
    restart: unless-stopped
-    ports:
-      - "3331:8080"
+    # ports:
+    #   - "3331:8080"
    volumes:
      - ./termix-data:/app/data
    environment:
@@ -19,16 +19,14 @@ services:
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.websecure.http.tls=true"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
-      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      - "--entryPoints.ssh.address=:2221"

-      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
-      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
-      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      # Let's Encrypt
+      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      # # STAGING
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"

      # Cloudflare 
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
@@ -77,7 +75,7 @@ services:
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./certs:/certs:ro
      - ./logs:/var/log/traefik
-      # - ./traefik/letsencrypt:/letsencrypt
+      - ./letsencrypt:/letsencrypt

    networks:
      - proxy
@@ -87,4 +85,4 @@ services:

 networks:
  proxy:
-    external: true
+    external: true
@@ -0,0 +1,23 @@
+http:
+  routers:
+    fs1-public:
+      rule: "Host(`fs1.domain.xyz`)"
+      entrypoints:
+        - websecure
+      service: fs1
+      middlewares:
+        - security-chain@file
+      tls: {}
+
+    fs1-workstation:
+      rule: "Host(`fs1.workstation.internal`)"
+      entrypoints:
+        - websecure
+      service: fs1
+      tls: {}
+      
+  services:
+    fs1:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:3923" # Copyparty port example
@@ -1,33 +1,5 @@
 http:
  middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          - "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
-
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Dockmon Access"
-
    # Cloudflare IP Whitelist
    cloudflare-ipwhitelist:
      ipWhiteList:
@@ -0,0 +1,23 @@
+http:
+  middlewares:
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+  routers:
+    acme-challenge-exempt:
+      rule: "PathPrefix(`/.well-known/acme-challenge`)"
+      entryPoints:
+        - web
+      service: noop@internal
+      priority: 100
+
+    http-catchall:
+      rule: "HostRegexp(`{host:.+}`)"
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-https
+      service: noop@internal
+      priority: 1
@@ -5,9 +5,9 @@ services:
    container_name: uptime-kuma
    volumes:
      - ./data:/app/data
-    ports:
+      # ports:
      # <Host Port>:<Container Port>
-      - "3001:3001"
+      # - "3001:3001"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
Author	SHA1	Message	Date
forust	9b43a9bef4	feat: add traefik configuration for external fileservers	2026-01-09 14:48:42 +01:00
forust	2b03335af5	chore: shorten aio subdomain	2026-01-06 19:04:23 +01:00
forust	ea738ec14c	Merge pull request 'add pgp pubkey to landing page, minor info changes' (#4 ) from chore/pgp into main Reviewed-on: #4	2026-01-03 02:26:04 +01:00
forust	e4e9d96a0b	add pgp pubkey to landing page, minor info changes	2026-01-03 02:25:12 +01:00
forust	89576032b9	fix: update DNS settings for headscale	2026-01-03 01:39:05 +01:00
forust	a9edfc0a25	fix: traefik middlewares for local and dev envs	2026-01-02 13:06:49 +01:00
forust	acb8009307	Merge pull request 'feat: headscale implementation' (#3 ) from feat/tailscale into main Reviewed-on: #3	2026-01-02 03:06:50 +01:00
forust	21f4e46028	chore: container name change for headscale web panel	2026-01-02 03:06:24 +01:00
forust	0234524635	feat: headscale implementation - Headscale server - Using goodieshq/headscale-admin as ui - UI protected by security-chain - Metrics available at /metrics	2026-01-02 01:29:51 +01:00
forust	26f5fb2fb9	Revert "feat: add gitea-basic-runner" This reverts commit `f0682319a7`.	2026-01-02 00:38:04 +01:00
forust	122e6f6986	Revert "chore: gitea runners gitignored" This reverts commit `e0f7ab6561`.	2026-01-02 00:37:47 +01:00
forust	ce0bc4613a	fix: headscale command	2026-01-01 03:19:45 +01:00
forust	8f4f460ff3	feat: add headscale server and UI configuration with Traefik routing	2026-01-01 02:39:28 +01:00
forust	c048efd569	Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/tailscale	2026-01-01 01:45:57 +01:00
forust	4fe3d660f1	Merge pull request 'Added DoT support on dns.forust.xyz' (#2 ) from fix/dns into main Reviewed-on: #2	2025-12-31 03:44:08 +01:00
forust	9675eac2bf	feat: add DoT support on dns.forust.xyz - Made adguard available on adguard. and dns. subdomain - DoT and DoH implementation complete	2025-12-31 03:41:38 +01:00
forust	dc7fe64fbc	fix: clean up traefik configuration and add redirect middleware	2025-12-30 22:44:52 +01:00
forust	502810a12e	fix: update traefik router rules for DNS and adjust letsencrypt volume path	2025-12-30 17:20:13 +01:00
forust	c047cc291d	LE for DoH	2025-12-30 16:54:23 +01:00
forust	f2b951673c	fix: add traefik route for dns o https	2025-12-30 15:47:39 +01:00
forust	db0f0f7bb6	feat: tailscale server	2025-12-14 02:43:00 +01:00
forust	5e4c60bb30	chore (security): port hardening, commented out non-critical ports	2025-12-14 02:42:46 +01:00