fix: update DNS settings for headscale

Reviewed-on: #3

.gitignore

@@ -2,17 +2,11 @@
 sync.ffs_lock
 .sync.ffs_db
 
-# Environment 
+
-.env
-.env.anna
-.env.forust
-.env.*
-!.env.*example
 
 # Volumes and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
-gitea/*runner/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
 adguardhome/data/*
@@ -24,6 +18,8 @@ termix/termix-data/*
 cfddns/config.json
 checkmk/checkmk/*
 downtify/Downtify_downloads
+headscale/config/*
+headscale/data/*
 
 # Steaming services files
 streaming/jellyfin/*
@@ -41,6 +37,9 @@ homepages/forust_files/assets/images/team/*
 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/logs/*
+
+# SSL Certificates
+adguardhome/certs/*
 traefik/certs/*
 
 # Monitoring
@@ -83,3 +82,11 @@ replacements.txt
 
 # Temp files
 edu_master/temp/
+temp/*
+
+# Environment 
+.env
+.env.anna
+.env.forust
+.env.*
+!*example

adguardhome/compose.yaml

@@ -3,45 +3,51 @@ services:
     image: adguard/adguardhome:latest
     container_name: adguardhome
     restart: unless-stopped
-    environment:
-      - TZ=${TZ}
     ports:
       - "53:53/tcp"
       - "53:53/udp"
+      - "853:853/tcp" # DNS over TLS
       # - "67:67/udp" # DHCP
       # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
     volumes:
       - ./data/work:/opt/adguardhome/work
       - ./data/conf:/opt/adguardhome/conf
+      - ./certs:/certs:ro
     networks:
       - proxy
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
 
       # Prod Router
-      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
       - "traefik.http.routers.adguard.entrypoints=websecure"
       - "traefik.http.routers.adguard.middlewares=security-headers@file"
       - "traefik.http.routers.adguard.service=adguard"
       - "traefik.http.routers.adguard.tls=true"
-      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
 
       # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
       - "traefik.http.routers.adguard-local.entrypoints=websecure"
       - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-local.service=adguard"
       - "traefik.http.routers.adguard-local.tls=true"
 
       # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
       - "traefik.http.routers.adguard-dev.entrypoints=websecure"
       - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-dev.service=adguard"
       - "traefik.http.routers.adguard-dev.tls=true"
 
+      # DoH
+      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns.entrypoints=websecure"
+      - "traefik.http.routers.dns.service=adguard"
+      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
+
       - glance.name=adguard
       - glance.url=https://adguard.forust.xyz/
       - glance.description=AdGuard Home is a network-wide software for blocking ads.

authentik/compose.yaml

@@ -26,9 +26,9 @@ services:
     command: server
     container_name: authentik-server
     restart: unless-stopped
-    ports:
+    # ports:
-      - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTP:-9000}:9000
-      - ${PORT_HTTPS:-9443}:9443
+    #   - ${PORT_HTTPS:-9443}:9443
     env_file:
       - .env
     environment:

gitea/.env.example

@@ -1,7 +1,6 @@
 GITEA_POSTGRES_USER=
 GITEA_POSTGRES_PASSWORD=
 GITEA_POSTGRES_DB=gitea
-BASIC-RUNNER_TOKEN=
 GITEA_SMTP_PASS=
 MAILER_ADDR=
 SERVICE_EMAIL=email.used.by.services@domain.tld

gitea/compose.yaml

@@ -65,25 +65,6 @@ services:
     depends_on:
       - db
 
-  runner:
-    image: gitea/act_runner:0.2.11
-    container_name: gitea-runner
-    restart: always
-    depends_on:
-      - server
-    env_file:
-      - .env
-    networks:
-      - gitea-db
-    environment:
-      - GITEA_INSTANCE_URL=http://server:3000
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${BASIC-RUNNER_TOKEN}
-      - GITEA_RUNNER_NAME=basic-runner
-      - GITEA_RUNNER_LABELS=docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm
-    volumes:
-      - ./gitea-runner:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-
   db:
     image: docker.io/library/postgres:14
     restart: always

headscale/compose.yaml

@@ -0,0 +1,84 @@
+services:
+  server:
+    image: headscale/headscale:latest
+    restart: unless-stopped
+    command: serve
+    networks:
+      - proxy
+    volumes:
+      - ./config:/etc/headscale
+      - ./data:/var/lib/headscale
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
+
+      ## SERVICE
+      # Prod Router
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
+      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.service=headscale"
+      - "traefik.http.routers.headscale-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.service=headscale"
+      - "traefik.http.routers.headscale-dev.tls=true"
+
+      ## METRICS
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+    dns:
+        - 1.1.1.1
+        - 1.0.0.1
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "treafik.docker.network=proxy"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-local.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui-dev.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+
+networks:
+  proxy:
+    external: true

headscale/config/config.yaml.example

@@ -0,0 +1,79 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+randomize_client_port: false

homepages/compose.yaml

@@ -3,8 +3,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.forust
-    ports:
+    # ports:
-      - "8085:80"
+    #   - "8085:80"
     restart: unless-stopped
     volumes:
       - ./forust_files:/usr/share/nginx/html
@@ -42,8 +42,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.xdfnx
-    ports:
+    # ports:
-      - "8086:80"
+    #   - "8086:80"
     restart: unless-stopped
     volumes:
       - ./xdfnx_files:/usr/share/nginx/html
@@ -77,7 +77,6 @@ services:
       - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
       - "traefik.http.routers.xdfnx-dev.tls=true"
 
-
 networks:
   proxy:
     external: true

penpot/compose.yaml

@@ -86,8 +86,8 @@ services:
   penpot-frontend:
     image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
     restart: always
-    ports:
+    # ports:
-      - 9001:8080
+    #   - 9001:8080
 
     volumes:
       - penpot_assets:/opt/data/assets

tailscale/.env.example

@@ -0,0 +1 @@
+TS_AUTHKEY=tskey-auth-xxxxx-CNTRL

tailscale/compose.yaml

@@ -0,0 +1,21 @@
+services:
+  tailscale:
+    image: tailscale/tailscale:latest
+    container_name: tailscale
+    network_mode: host
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - tailscale_data:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_HOSTNAME=forust-server
+      # - TS_EXTRA_ARGS=--advertise-tags=tag:container
+
+volumes:
+  tailscale_data:
+    name: tailscale_data

termix/compose.yaml

@@ -3,8 +3,8 @@ services:
     image: ghcr.io/lukegus/termix:latest
     container_name: termix
     restart: unless-stopped
-    ports:
+    # ports:
-      - "3331:8080"
+    #   - "3331:8080"
     volumes:
       - ./termix-data:/app/data
     environment:

traefik/compose.yaml

@@ -19,16 +19,14 @@ services:
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
       - "--entryPoints.websecure.http.tls=true"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
-      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.ssh.address=:2221"
 
-      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
+      # Let's Encrypt
-      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
-      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      # # STAGING
       # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
 
       # Cloudflare 
       - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
@@ -77,7 +75,7 @@ services:
       - ./dynamic:/etc/traefik/dynamic:ro
       - ./certs:/certs:ro
       - ./logs:/var/log/traefik
-      # - ./traefik/letsencrypt:/letsencrypt
+      - ./letsencrypt:/letsencrypt
 
     networks:
       - proxy
@@ -87,4 +85,4 @@ services:
 
 networks:
   proxy:
-    external: true
+    external: true

traefik/dynamic/middlewares.yml

@@ -1,33 +1,5 @@
 http:
   middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          - "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
-
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Dockmon Access"
-
     # Cloudflare IP Whitelist
     cloudflare-ipwhitelist:
       ipWhiteList:

traefik/dynamic/redirect.yml

@@ -0,0 +1,23 @@
+http:
+  middlewares:
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+  routers:
+    acme-challenge-exempt:
+      rule: "PathPrefix(`/.well-known/acme-challenge`)"
+      entryPoints:
+        - web
+      service: noop@internal
+      priority: 100
+
+    http-catchall:
+      rule: "HostRegexp(`{host:.+}`)"
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-https
+      service: noop@internal
+      priority: 1

uptime-kuma/compose.yaml

@@ -5,9 +5,9 @@ services:
     container_name: uptime-kuma
     volumes:
       - ./data:/app/data
-    ports:
+      # ports:
       # <Host Port>:<Container Port>
-      - "3001:3001"
+      # - "3001:3001"
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"