fix: routers for nextcloud frontend

fix: traefik service
chore: new auth credentials, revert to info logging
2025-12-06 00:38:16 +01:00 · 2025-12-05 21:00:55 +01:00 · 2025-12-05 20:33:14 +01:00 · 2025-12-05 18:53:19 +01:00 · 2025-12-05 14:36:57 +01:00 · 2025-12-05 04:30:51 +01:00
50 changed files with 3003 additions and 1441 deletions
@@ -0,0 +1,70 @@
+
+
+#===============================
+# Basic auth credentials
+#===============================
+#
+#
+#
+#===============================
+
+#===============================================
+#BEGIN TRAEFIK ENVIRONMENT VARIABLES ===========
+#===============================================
+
+#===============================================
+# General Traefik Environment Variables
+#===============================================
+HOST=hostname
+EMAIL=your@email.here
+CF_DNS_API_TOKEN=API_TOKEN_HERE
+CF_EMAIL=your_cloudflare@email.here
+TZ=Europe/Berlin
+
+#===============================================
+# Dockmon Traefik Configuration File
+#===============================================
+DOCKMON_APPNAME=dockmon
+DOCKMON_SUBDOMEN=dockmon
+#===============================================
+# Dashboard Traefik Environment Variables
+#===============================================
+DASHBOARD_APPNAME=traefik
+DASHBOARD_SUBDOMEN=traefik
+#===============================================
+# Watercrawl Traefik Environment Variables
+#===============================================
+WATERCRAWL_APPNAME=watercrawl
+WATERCRAWL_SUBDOMEN=watercrawl
+#===============================================
+# n8n Traefik Environment Variables
+#===============================================
+N8N_APPNAME=n8n
+N8N_SUBDOMEN=n8n
+#===============================================
+# Glance Traefik Environment Variables
+#===============================================
+GLANCE_APPNAME=glance
+GLANCE_SUBDOMEN=glance
+#===============================================
+# AdGuard Traefik Environment Variables
+#===============================================
+ADGUARD_APPNAME=adguard
+ADGUARD_SUBDOMEN=adguard
+#===============================================
+# Portainer Traefik Environment Variables
+#===============================================
+PORTAINER_APPNAME=portainer
+PORTAINER_SUBDOMEN=portainer
+#===============================================
+# Nextcloud Traefik Environment Variables
+#===============================================
+NEXTCLOUD_APPNAME=nextcloud
+NEXTCLOUD_SUBDOMEN=nextcloud
+#===============================================
+# Aio Traefik Environment Variables
+#===============================================
+NEXTCLOUD_AIO_APPNAME=nextcloud-aio
+NEXTCLOUD_AIO_SUBDOMEN=nextcloud-aio
+# END OF TRAEFIK ENVIRONMENT VARIABLES
+#===============================================
@@ -6,6 +6,8 @@ sync.ffs_lock
 .env
 .env.anna
 .env.forust
+.env.*
+!.env.*example

 # Volumes and data directories
 gitea/gitea-db/
@@ -17,16 +19,63 @@ dockmon/data/*
 portainer/portainer_data/*
 metube/MeTube_downloads
 uptime-kuma/data/
+termix/termix-data/*
+cfddns/config.json
+
+# Steaming services files
+streaming/jellyfin/*
+streaming/jellyseerr/*
+streaming/sonarr/*
+streaming/radarr/*
+streaming/data/*
+streaming/qbittorrent/*
+streaming/prowlarr/*
+
+# Homepage 
+homepage/files/assets/images/team/*

 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/logs/*
 traefik/certs/*

+# Monitoring
+monitoring/prometheus.yml
+
 # Python 
 .python-version
-.venv/
 venv/
+pyc
+unknown_errors.txt
+moonlogs.txt
+thumb.jpg
+antipm_pic.jpg
+musicbot/
+.trunk/
+previous_profiles/
+.python-version
+/modules/__pycache__/
+__pycache__/
+*.session
+*.session-old
+*.db
+*.sqlite3
+*-journal
+/venv/
+.venv/

 # DataSecurity
 replacements.txt
+
+# Vscode
+.vscode
+
+# Git
+.gitattributes
+
+# Misc
+.DS_Store
+.idea
+
+# Temp files
+edu_master/temp/
@@ -19,8 +19,30 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.entrypoints=websecure"
+      - "traefik.http.routers.adguard.middlewares=security-headers@file"
+      - "traefik.http.routers.adguard.service=adguard"
+      - "traefik.http.routers.adguard.tls=true"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
+
+      # Local Router
+      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.entrypoints=websecure"
+      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
+      - "traefik.http.routers.adguard-local.service=adguard"
+      - "traefik.http.routers.adguard-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.entrypoints=websecure"
+      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.adguard-dev.service=adguard"
+      - "traefik.http.routers.adguard-dev.tls=true"
+
      - glance.name=adguard
-      # - glance.icon=si:adguard
      - glance.url=https://adguard.forust.xyz/
      - glance.description=AdGuard Home is a network-wide software for blocking ads.
 networks:
@@ -0,0 +1,13 @@
+services:
+  cloudflare-ddns:
+    image: timothyjmiller/cloudflare-ddns:latest
+    container_name: cloudflare-ddns
+    security_opt:
+      - no-new-privileges:true
+    network_mode: 'host'
+    environment:
+      - PUID=1000
+      - PGID=1000
+    volumes:
+      - ./config.json:/config.json
+    restart: unless-stopped
@@ -0,0 +1,22 @@
+{
+  "cloudflare": [
+    {
+      "authentication": {
+        "api_token": "API_TOKEN"
+      },
+      "api_key": {
+        "api_key": "api_key_here",
+        "account_email": "your_email_here"
+      }
+      "zone_id": "your_zone-id",
+      "subdomains": [
+        { "name": "", "proxied": true },
+        { "name": "www", "proxied": true }
+      ]
+    }
+  ],
+  "a": true,
+  "aaaa": false,
+  "purgeUnknownRecords": false,
+  "ttl": 300
+}
@@ -20,8 +20,32 @@ services:
      labels:
         - "traefik.enable=true"
         - "traefik.docker.network=traefik-proxy"
+
+         # Prod Router
+         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+         - "traefik.http.routers.dockmon.entrypoints=websecure"
+         - "traefik.http.routers.dockmon.middlewares=security-headers@file,dockmon-auth@file"
+         - "traefik.http.routers.dockmon.service=dockmon"
+         - "traefik.http.routers.dockmon.tls=true"
+         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
+
+         # Local Router
+         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`) || Host(`dockmon.internal`)"
+         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
+         - "traefik.http.routers.dockmon-local.service=dockmon"
+         - "traefik.http.routers.dockmon-local.tls=true"
+
+         # Dev Router
+         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
+         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-headers@file"
+         - "traefik.http.routers.dockmon-dev.service=dockmon"
+         - "traefik.http.routers.dockmon-dev.tls=true"
+
         - glance.name=dockmon
-      # - glance.icon=sh:dockmon
         - glance.url=https://dockmon.forust.xyz/
         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.

@@ -0,0 +1,13 @@
+EDU_LOGIN=your_edu_login_here
+EDU_PASSWORD=your_edu_password_here
+EDU_URL_LOGIN=https://edu.edu.vn.ua/user/login
+EDU_URL_VERIFY=https://edu.edu.vn.ua/course/userlist
+PHPSESSID_INTERVAL=10
+USER_AGENT="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
+WEBINAR_URL=https://edu.edu.vn.ua/webinar/useractive
+WEBINAR_CHECK_INTERVAL=60
+REDIS_HOST=redis
+REDIS_PORT=6379
+PLAYWRIGHT_WS=ws://playwright-service:3000/ws
+WEBINAR_TELEGRAM_TOKEN=your_telegram_bot_token_here
+WEBINAR_ADMIN_ID=123456789
@@ -1,15 +0,0 @@
-ARG VERSION
-# Use the official WaterCrawl image as the base image
-FROM watercrawl/watercrawl:${VERSION:-v0.10.2}
-
-# Set working directory
-WORKDIR /var/www
-
-# Copy the extra requirements file
-COPY extra_requirements.txt /var/www/extra_requirements.txt
-
-# Install any additional packages
-RUN poetry run pip install -r /var/www/extra_requirements.txt
-
-# The rest of the configuration is inherited from the base image
-# The entrypoint and command should be defined in docker-compose.yml
@@ -1 +0,0 @@
-# Add your additional Python packages here, one per line
@@ -1,262 +1,45 @@
-x-app: &app
-  build:
-    context: ./backend/
-    dockerfile: Dockerfile
-    args:
-      - VERSION=${VERSION:-v0.10.2}
-  depends_on:
-    db:
-      condition: service_healthy
-  dns:
-    - 8.8.8.8
-    - 1.1.1.1
-  environment:
-    - SECRET_KEY=${SECRET_KEY:-django-insecure-el4wo4a4--=f0+ag#omp@^w4eq^8v4(scda&1a(td_y2@=sh6&}
-    - API_ENCRYPTION_KEY=${API_ENCRYPTION_KEY:-8zSd6JIuC7ovfZ4AoxG_XmhubW6CPnQWW7Qe_4TD1TQ=}
-    - DEBUG=${DEBUG:-True}
-    - ALLOWED_HOSTS=${ALLOWED_HOSTS:-*}
-    - LANGUAGE_CODE=${LANGUAGE_CODE:-en-us}
-    - TIME_ZONE=${TIME_ZONE:-UTC}
-    - USE_I18N=${USE_I18N:-True}
-    - USE_TZ=${USE_TZ:-True}
-    - STATIC_ROOT=${STATIC_ROOT:-storage/static/}
-    - MEDIA_ROOT=${MEDIA_ROOT:-storage/media/}
-    - LOG_LEVEL=${LOG_LEVEL:-INFO}
-    - REDIS_URL=${REDIS_URL:-redis://redis:6379/1}
-    - DATABASE_URL=postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@${POSTGRES_HOST:-db}:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-postgres}
-    - CELERY_BROKER_URL=${CELERY_BROKER_URL:-redis://redis:6379/0}
-    - CELERY_RESULT_BACKEND=${CELERY_RESULT_BACKEND:-django-db}
-    - REDIS_LOCKER_URL=${REDIS_LOCKER_URL:-redis://redis:6379/3}
-    - MINIO_ENDPOINT=minio:9000
-    - MINIO_EXTERNAL_ENDPOINT=nginx
-    - MINIO_REGION=us-east-1
-    - MINIO_ACCESS_KEY=minio
-    - MINIO_SECRET_KEY=minio123
-    - MINIO_USE_HTTPS=False
-    - MINIO_EXTERNAL_ENDPOINT_USE_HTTPS=False
-    - MINIO_URL_EXPIRY_HOURS=7
-    - MINIO_PRIVATE_BUCKET=private
-    - MINIO_PUBLIC_BUCKET=public
-    - CSRF_TRUSTED_ORIGINS=${CSRF_TRUSTED_ORIGINS:-}
-    - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-}
-    - CORS_ALLOWED_ORIGIN_REGEXES=${CORS_ALLOWED_ORIGIN_REGEXES:-}
-    - CORS_ALLOW_ALL_ORIGINS=${CORS_ALLOW_ALL_ORIGINS:-False}
-    - FRONTEND_URL=${FRONTEND_URL:-http://localhost}
-    - IS_LOGIN_ACTIVE=${IS_LOGIN_ACTIVE:-True}
-    - IS_SIGNUP_ACTIVE=${IS_SIGNUP_ACTIVE:-True}
-    - IS_GITHUB_LOGIN_ACTIVE=${IS_GITHUB_LOGIN_ACTIVE:-True}
-    - IS_GOOGLE_LOGIN_ACTIVE=${IS_GOOGLE_LOGIN_ACTIVE:-True}
-    - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID:-}
-    - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET:-}
-    - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
-    - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
-    - ACCESS_TOKEN_LIFETIME_MINUTES=${ACCESS_TOKEN_LIFETIME_MINUTES:-5}
-    - REFRESH_TOKEN_LIFETIME_DAYS=${REFRESH_TOKEN_LIFETIME_DAYS:-30}
-    - EMAIL_BACKEND=${EMAIL_BACKEND:-django.core.mail.backends.smtp.EmailBackend}
-    - EMAIL_HOST=${EMAIL_HOST:-}
-    - EMAIL_PORT=${EMAIL_PORT:-587}
-    - EMAIL_USE_TLS=${EMAIL_USE_TLS:-True}
-    - EMAIL_HOST_USER=${EMAIL_HOST_USER:-}
-    - EMAIL_HOST_PASSWORD=${EMAIL_HOST_PASSWORD:-}
-    - DEFAULT_FROM_EMAIL=${DEFAULT_FROM_EMAIL:-}
-    - SCRAPY_USER_AGENT=${SCRAPY_USER_AGENT:-WaterCrawl/0.1 (+https://github.com/watercrawl/watercrawl)}
-    - SCRAPY_ROBOTSTXT_OBEY=${SCRAPY_ROBOTSTXT_OBEY:-True}
-    - SCRAPY_CONCURRENT_REQUESTS=${SCRAPY_CONCURRENT_REQUESTS:-16}
-    - SCRAPY_DOWNLOAD_DELAY=${SCRAPY_DOWNLOAD_DELAY:-0}
-    - SCRAPY_CONCURRENT_REQUESTS_PER_DOMAIN=${SCRAPY_CONCURRENT_REQUESTS_PER_DOMAIN:-4}
-    - SCRAPY_CONCURRENT_REQUESTS_PER_IP=${SCRAPY_CONCURRENT_REQUESTS_PER_IP:-4}
-    - SCRAPY_COOKIES_ENABLED=${SCRAPY_COOKIES_ENABLED:-False}
-    - SCRAPY_HTTPCACHE_ENABLED=${SCRAPY_HTTPCACHE_ENABLED:-True}
-    - SCRAPY_HTTPCACHE_EXPIRATION_SECS=${SCRAPY_HTTPCACHE_EXPIRATION_SECS:-3600}
-    - SCRAPY_HTTPCACHE_DIR=${SCRAPY_HTTPCACHE_DIR:-httpcache}
-    - SCRAPY_LOG_LEVEL=${SCRAPY_LOG_LEVEL:-ERROR}
-    - SCRAPY_GOOGLE_API_KEY=${SCRAPY_GOOGLE_API_KEY:-}
-    - SCRAPY_GOOGLE_CSE_ID=${SCRAPY_GOOGLE_CSE_ID:-}
-    - SCRAPY_MAX_NUMBER_OF_SITEMAP_URLS=${SCRAPY_MAX_NUMBER_OF_SITEMAP_URLS:-20000}
-    - SCRAPY_SITEMAP_CRAWL_PAGE_LIMIT=${SCRAPY_SITEMAP_CRAWL_PAGE_LIMIT:-100}
-    - PLAYWRIGHT_SERVER=${PLAYWRIGHT_SERVER:-http://playwright:8000}
-    - PLAYWRIGHT_API_KEY=${PLAYWRIGHT_API_KEY:-your-secret-api-key}
-    - OPENAI_API_KEY=${OPENAI_API_KEY:-}
-    - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY:-}
-    - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET:-}
-    - GOOGLE_ANALYTICS_ID=${GOOGLE_ANALYTICS_ID:-}
-    - IS_ENTERPRISE_MODE_ACTIVE=${IS_ENTERPRISE_MODE_ACTIVE:-False}
-    - MAX_CRAWL_DEPTH=${MAX_CRAWL_DEPTH:--1}
-    - CAPTURE_USAGE_HISTORY=${CAPTURE_USAGE_HISTORY:-True}
-    - MCP_SERVER=${MCP_SERVER:-http://localhost/sse}
-  networks:
-    - traefik-proxy 
-    - default
-    - n8n
-    
-x-frontend: &frontend
-  image: watercrawl/frontend:${VERSION:-v0.10.2}
-  environment:
-    - VITE_API_BASE_URL=${API_BASE_URL:-http://localhost/api}
-  depends_on:
-    - app
-
 services:
-  nginx:
-    image: nginx:alpine
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf.template
-      - ./nginx/entrypoint.sh:/entrypoint.sh
-    environment:
-      - MINIO_PRIVATE_BUCKET=${MINIO_PRIVATE_BUCKET:-private}
-      - MINIO_PUBLIC_BUCKET=${MINIO_PUBLIC_BUCKET:-public}
-    command: ["/bin/sh", "/entrypoint.sh"]
-    depends_on:
-      - app
-      - frontend
-      - minio
-    restart: unless-stopped
-    networks:
-          - traefik-proxy 
-          - n8n
-
-    labels:
-    - "traefik.enable=true"
-    - "traefik.docker.network=traefik-proxy"
-
-  app:
-    <<: *app
-    command: [ "gunicorn", "-b", "0.0.0.0:9000", "-w", "2", "watercrawl.wsgi:application", "--access-logfile", "-", "--error-logfile", "-", "--timeout", "60" ]
-
-  celery:
-    <<: *app
-    command: [ "celery", "-A", "watercrawl", "worker", "-l", "info", "-S", "django" ]
-    dns:
-    - 1.1.1.1
-    - 8.8.8.8
-
-  celery-beat:
-    <<: *app
-    command: [ "celery", "-A", "watercrawl", "beat", "-l", "info", "-S", "django" ]
-
-  frontend:
-    <<: *frontend
-    command: [ "npm", "run", "serve" ]
-
-  minio:
-    image: minio/minio:RELEASE.2024-11-07T00-52-20Z
+  redis:
+    image: redis:alpine
    restart: unless-stopped
    volumes:
-      - ./volumes/minio-data:/data
-    command: server /data --console-address ":9001"
-    environment:
-      - MINIO_BROWSER_REDIRECT_URL=${MINIO_BROWSER_REDIRECT_URL:-http://localhost/minio-console/}
-      - MINIO_SERVER_URL=${MINIO_SERVER_URL:-http://localhost/}
-      - MINIO_ROOT_USER=${MINIO_ACCESS_KEY:-minio}
-      - MINIO_ROOT_PASSWORD=${MINIO_SECRET_KEY:-minio123}
-
-  playwright:
-    image: watercrawl/playwright:1.1
-    restart: unless-stopped
-    user: root
-    environment:
-      - AUTH_API_KEY=${PLAYWRIGHT_API_KEY:-your-secret-api-key}
-      - PORT=${PLAYWRIGHT_PORT:-8000}
-      - HOST=${PLAYWRIGHT_HOST:-0.0.0.0}
-    dns:
-      - 8.8.8.8
-      - 1.1.1.1
-    networks:
-      - traefik-proxy 
-      - n8n
-
-  db:
-    image: postgres:17.2-alpine3.21
-    restart: unless-stopped
-    environment:
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
-      - POSTGRES_USER=${POSTGRES_USER:-postgres}
-      - POSTGRES_DB=${POSTGRES_DB:-postgres}
-    volumes:
-      - ./volumes/postgres-db:/var/lib/postgresql/data
+      - redis-data:/data
    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready" ]
-      interval: 10s
-      timeout: 5s
+      test: [ "CMD", "redis-cli", "ping" ]
+      interval: 5s
+      timeout: 3s
      retries: 5

-  mcp:
-    image: watercrawl/mcp:v1.2.0
+  playwright-service:
+    image: mcr.microsoft.com/playwright:v1.56.0-jammy
    restart: unless-stopped
-    command: [ "sse", "--base-url", "http://app:9000", '--port', '3000', '--endpoint', '/sse' ]
-  networks:
-      - n8n
+    command: npx -y playwright@1.56.0 run-server --port 3000 --path /ws

+  session-keeper:
+    build: ./phpsessid-bot
+    env_file: .env
+    restart: unless-stopped
+    depends_on:
      redis:
-    image: redis:latest
+        condition: service_healthy
+    healthcheck:
+      test: [ "CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1" ]
+      interval: 30s
+      timeout: 5s
+      retries: 10
+      start_period: 60s
+
+  webinar-checker:
+    build: ./webinar-checker
+    env_file: .env
    restart: unless-stopped
-
-  llm:
-    image: ollama/ollama:latest
-    restart: unless-stopped
-    volumes:
-      - ./volumes/ollama-models:/root/.ollama
-    environment:
-      - OLLAMA_DISABLE_TELEMETRY=true
-      - OLLAMA_KEEP_ALIVE=5m
-      - OLLAMA_HOST=0.0.0.0:11434
-      - OLLAMA_NUM_PARALLEL=1
-      - OLLAMA_MAX_LOADED_MODELS=1
-    dns:
-      - 1.1.1.1
-      - 8.8.8.8
-    networks:
-      - n8n
-
-# docker exec -it edu_master-llm-1 ollama pull neural-chat:7b-q4
-# docker exec -it edu_master-llm-1 ollama pull mistral:7b-q4
-
-  # lessons-bot:
-  #       build:
-  #         context: edu_master/lessons_bot/
-  #         dockerfile: Dockerfile
-  #       restart: unless-stopped
-  #       environment:
-  #         - LESSONS_BOT_TOKEN=${LESSONS_BOT_TOKEN}
-  #         - N8N_WEBHOOK_URL=${N8N_WEBHOOK_URL:-http://n8n:5678/webhook-test/get-lessons}
-  #         - N8N_SECRET=${N8N_SECRET:-your-secret-token-here}
-  #         - WATERCRAWL_API_URL=${WATERCRAWL_API_URL:-http://app:9000/api}
-  #         - PHPSESSID_BOT_URL=${PHPSESSID_BOT_URL:-http://phpsessid-bot:5000}
-  #         - EDU_HOST=${EDU_HOST:-edu.edu.vn.ua}
-  #       depends_on:
-  #         - n8n
-  #         - app
-  #         - phpsessid-bot
-  #       dns:
-  #         - 1.1.1.1
-  #         - 8.8.8.8
-  #       networks:
-  #         - default
-          
-  phpsessid-bot:
-    build:
-      context: ./phpsessid_bot/
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    environment:
-      - EDU_HOST=${EDU_HOST:-edu.edu.vn.ua}
-      - EDU_LOGIN=${EDU_LOGIN}
-      - EDU_PASSWORD=${EDU_PASSWORD}
-      - BOT_PORT=${PHPSESSID_BOT_PORT:-5000}
-      - BOT_HOST=${PHPSESSID_BOT_HOST:-0.0.0.0}
-    dns:
-      - 1.1.1.1
-      - 8.8.8.8
-    networks:
-      - default
-
+    depends_on:
+      redis:
+        condition: service_healthy
+      session-keeper:
+        condition: service_healthy
+      playwright-service:
+        condition: service_started

 volumes:
-  n8n_data:
-  postgres-db:
-  minio-data:
-  ollama-models:
-  lmstudio_data:
-networks:
-    traefik-proxy:
-        external: true
+  redis-data:
@@ -1,16 +0,0 @@
-FROM python:3.11-slim
-
-WORKDIR /app
-
-# Установка зависимостей
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-
-# Копирование кода
-COPY config.py .
-COPY utils.py .
-COPY handlers.py .
-COPY main.py .
-
-# Запуск бота
-CMD ["python", "-u", "main.py"]
@@ -1,26 +0,0 @@
-import os
-from dotenv import load_dotenv
-
-load_dotenv()
-
-# Telegram
-BOT_TOKEN = os.getenv('LESSONS_BOT_TOKEN')
-
-# n8n
-N8N_WEBHOOK_URL = os.getenv('N8N_WEBHOOK_URL', 'http://n8n:5678/webhook/homework-check')
-N8N_SECRET = os.getenv('N8N_SECRET', 'your-secret-token-here')
-
-# WaterCrawl API
-WATERCRAWL_API_URL = os.getenv('WATERCRAWL_API_URL', 'http://app:9000/api')
-
-# PHPSESSID Bot
-PHPSESSID_BOT_URL = os.getenv('PHPSESSID_BOT_URL', 'http://phpsessid-bot:5000')
-
-# EDU site
-EDU_HOST = os.getenv('EDU_HOST', 'edu.edu.vn.ua')
-EDU_WEBINAR_URL = f'https://{EDU_HOST}/webinar/useractive'
-
-# Playwright
-PLAYWRIGHT_SERVER = os.getenv('PLAYWRIGHT_SERVER', 'http://playwright:8000')
-PLAYWRIGHT_API_KEY = os.getenv('PLAYWRIGHT_API_KEY', 'your-secret-api-key')
-WEBINAR_WAIT_TIME = int(os.getenv('WEBINAR_WAIT_TIME', '3'))  # Секунды ожидания загрузки
@@ -1,131 +0,0 @@
-import logging
-import requests
-from telegram import Update
-from telegram.ext import ContextTypes
-import config
-from utils import fetch_webinars, format_webinar_message
-
-logger = logging.getLogger(__name__)
-
-
-async def start(update: Update, context: ContextTypes.DEFAULT_TYPE):
-    """Команда /start"""
-    welcome_message = """
-Привет! Я бот для проверки домашних заданий и вебинаров.
-
-<b>Команды:</b>
-/check - Проверить несделанные уроки 
-/webinar - Проверить активные онлайн уроки
-/help - Помощь
-    """
-    await update.message.reply_text(welcome_message, parse_mode='HTML')
-
-
-async def help_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
-    """Команда /help"""
-    help_text = """
-<b>Как пользоваться ботом:</b>
-
-<b>/check</b> - Проверка домашних заданий
- Поиск несделанных уроков
-
-⏱ Проверка занимает 10-30 секунд
-
-<b>/webinar</b> - Активные онлайн уроки
- Проверка активных вебинаровв
-⏱ Проверка занимает 3-5 секунд
-    """
-    await update.message.reply_text(help_text, parse_mode='HTML')
-
-
-async def check_homework(update: Update, context: ContextTypes.DEFAULT_TYPE):
-    """Команда /check - запускает проверку уроков"""
-    chat_id = update.effective_chat.id
-    user_id = update.effective_user.id
-    username = update.effective_user.username or "unknown"
-    
-    # Отправляем уведомление что начали работу
-    status_message = await update.message.reply_text("Запускаю проверку уроков...")
-    
-    # Формируем данные для n8n
-    payload = {
-        "chat_id": chat_id,
-        "user_id": user_id,
-        "username": username,
-        "timestamp": update.message.date.isoformat()
-    }
-    
-    headers = {
-        "Authorization": f"Bearer {config.N8N_SECRET}",
-        "Content-Type": "application/json"
-    }
-    
-    try:
-        logger.info(f"Sending request to n8n for user {user_id}")
-        
-        # Отправляем запрос в n8n
-        response = requests.post(
-            config.N8N_WEBHOOK_URL,
-            json=payload,
-            headers=headers,
-            timeout=5  # Короткий таймаут т.к. это асинхронный запрос
-        )
-        
-        if response.status_code == 200:
-            await status_message.edit_text(
-                "✅ Запрос принят!\n"
-                "🔄 Парсинг сайта и анализ данных...\n"
-                "⏱ Это займет 10-30 секунд"
-            )
-            logger.info(f"Request accepted for user {user_id}")
-        else:
-            await status_message.edit_text(
-                f"Ошибка при отправке запроса. Функция в разработке\n"
-                f"Код: {response.status_code}"
-            )
-            logger.error(f"n8n returned status {response.status_code}")
-            
-    except requests.Timeout:
-        await status_message.edit_text("⏱ Запрос обрабатывается (таймаут соединения)")
-        logger.warning(f"Timeout for user {user_id}")
-    except Exception as e:
-        await status_message.edit_text(f"❌ Ошибка: {str(e)}")
-        logger.error(f"Error for user {user_id}: {e}", exc_info=True)
-
-
-async def check_webinar(update: Update, context: ContextTypes.DEFAULT_TYPE):
-    """Команда /webinar - проверяет активные онлайн уроки"""
-    user_id = update.effective_user.id
-    
-    # Отправляем уведомление что начали работу
-    status_message = await update.message.reply_text("Проверяю активные вебинары...")
-    
-    try:
-        logger.info(f"Checking webinars for user {user_id}")
-        
-        # Получаем список вебинаров
-        webinars = fetch_webinars()
-        
-        if webinars is None:
-            await status_message.edit_text(
-                "❌ Не удалось получить информацию о вебинарах\n"
-                "Попробуйте позже или обратитесь к администратору\n"
-                "|@MrForust|mr.forust| Либо же прямо сюда."
-            )
-            logger.error(f"Failed to fetch webinars for user {user_id}")
-            return
-        
-        # Форматируем и отправляем результат
-        message = format_webinar_message(webinars)
-        await status_message.edit_text(message, parse_mode='HTML', disable_web_page_preview=True)
-        
-        logger.info(f"Webinar check completed for user {user_id}: found {len(webinars)} webinars")
-        
-    except Exception as e:
-        await status_message.edit_text(f"❌ Ошибка: {str(e)}")
-        logger.error(f"Error checking webinars for user {user_id}: {e}", exc_info=True)
-
-
-async def error_handler(update: Update, context: ContextTypes.DEFAULT_TYPE):
-    """Обработчик ошибок"""
-    logger.error(f"Update {update} caused error {context.error}", exc_info=context.error)
@@ -1,42 +0,0 @@
-import logging
-from telegram import Update
-from telegram.ext import Application, CommandHandler
-import config
-from handlers import start, help_command, check_homework, check_webinar, error_handler
-
-# Настройка логирования
-logging.basicConfig(
-    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
-    level=logging.INFO
-)
-logger = logging.getLogger(__name__)
-
-
-def main():
-    """Запуск бота"""
-    if not config.BOT_TOKEN:
-        logger.error("LESSONS_BOT_TOKEN not set!")
-        return
-    
-    # Создаем приложение
-    application = Application.builder().token(config.BOT_TOKEN).build()
-    
-    # Регистрируем обработчики команд
-    application.add_handler(CommandHandler("start", start))
-    application.add_handler(CommandHandler("help", help_command))
-    application.add_handler(CommandHandler("check", check_homework))
-    application.add_handler(CommandHandler("webinar", check_webinar))
-    
-    # Регистрируем обработчик ошибок
-    application.add_error_handler(error_handler)
-    
-    # Запускаем бота
-    logger.info("Lessons Bot started!")
-    logger.info(f"PHPSESSID Bot URL: {config.PHPSESSID_BOT_URL}")
-    logger.info(f"n8n Webhook URL: {config.N8N_WEBHOOK_URL}")
-    
-    application.run_polling(allowed_updates=Update.ALL_TYPES)
-
-
-if __name__ == '__main__':
-    main()
@@ -1,5 +0,0 @@
-python-telegram-bot==20.7
-requests==2.31.0
-beautifulsoup4==4.12.2
-python-dotenv==1.0.0
-lxml==4.9.3
@@ -1,258 +0,0 @@
-import logging
-import requests
-from bs4 import BeautifulSoup
-from typing import Optional, Dict, List
-import config
-
-logger = logging.getLogger(__name__)
-
-
-def get_phpsessid() -> Optional[str]:
-    """
-    Получает валидный PHPSESSID через phpsessid-bot
-    
-    Returns:
-        str: PHPSESSID или None в случае ошибки
-    """
-    try:
-        url = f"{config.PHPSESSID_BOT_URL}/get-session"
-        logger.info(f"Requesting PHPSESSID from {url}")
-        
-        response = requests.post(url, timeout=10)
-        
-        if response.status_code == 200:
-            data = response.json()
-            if data.get('success'):
-                phpsessid = data.get('phpsessid')
-                logger.info(f"Got PHPSESSID: {phpsessid[:10]}...")
-                return phpsessid
-            else:
-                logger.error(f"Failed to get PHPSESSID: {data.get('error')}")
-                return None
-        else:
-            logger.error(f"PHPSESSID bot returned status {response.status_code}")
-            return None
-            
-    except Exception as e:
-        logger.error(f"Error getting PHPSESSID: {e}", exc_info=True)
-        return None
-
-
-def parse_webinar_table(html_content: str) -> List[Dict[str, str]]:
-    """
-    Парсит таблицу с вебинарами
-    
-    Args:
-        html_content: HTML контент страницы
-        
-    Returns:
-        List[Dict]: Список вебинаров или пустой список
-    """
-    try:
-        soup = BeautifulSoup(html_content, 'html.parser')
-        
-        # Находим таблицу с вебинарами
-        meetings_div = soup.find('div', {'id': 'meetings'})
-        if not meetings_div:
-            logger.warning("meetings div not found")
-            return []
-        
-        table = meetings_div.find('table', {'class': 'table table-zebra'})
-        if not table:
-            logger.warning("table not found")
-            return []
-        
-        tbody = table.find('tbody')
-        if not tbody:
-            logger.warning("tbody not found")
-            return []
-        
-        rows = tbody.find_all('tr')
-        if not rows:
-            return []
-        
-        # Проверяем на сообщение "Жодного онлайн уроку зараз"
-        first_row = rows[0]
-        td = first_row.find('td')
-        if td and 'Жодного онлайн уроку зараз' in td.get_text(strip=True):
-            logger.info("No webinars available")
-            return []
-        
-        # Парсим активные вебинары
-        webinars = []
-        for row in rows:
-            tds = row.find_all('td')
-            if len(tds) >= 4:
-                webinar = {
-                    'topic': tds[0].get_text(strip=True),
-                    'course': tds[1].get_text(strip=True),
-                    'teacher': tds[2].get_text(strip=True),
-                    'join_link': tds[3].find('a')['href'] if tds[3].find('a') else ''
-                }
-                webinars.append(webinar)
-                
-        logger.info(f"Parsed {len(webinars)} webinars")
-        return webinars
-        
-    except Exception as e:
-        logger.error(f"Error parsing webinar table: {e}", exc_info=True)
-        return []
-
-
-def fetch_webinars_with_playwright() -> Optional[List[Dict[str, str]]]:
-    """
-    Получает список активных вебинаров используя Playwright для динамического контента
-    
-    Returns:
-        List[Dict]: Список вебинаров или None в случае ошибки
-    """
-    # Получаем PHPSESSID
-    phpsessid = get_phpsessid()
-    if not phpsessid:
-        logger.error("Failed to get PHPSESSID")
-        return None
-    
-    try:
-        # Подготавливаем cookies для Playwright
-        cookies = [
-            {
-                'name': 'PHPSESSID',
-                'value': phpsessid,
-                'domain': config.EDU_HOST,
-                'path': '/'
-            }
-        ]
-        
-        # Запрос к Playwright серверу
-        playwright_request = {
-            'url': config.EDU_WEBINAR_URL,
-            'cookies': cookies,
-            'wait_until': 'networkidle',  # Ждем пока сеть успокоится
-            'wait_time': config.WEBINAR_WAIT_TIME * 1000,  # Дополнительное ожидание в миллисекундах
-            'user_agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36'
-        }
-        
-        headers = {
-            'Authorization': f'Bearer {config.PLAYWRIGHT_API_KEY}',
-            'Content-Type': 'application/json'
-        }
-        
-        logger.info(f"Fetching webinars via Playwright from {config.EDU_WEBINAR_URL}")
-        logger.info(f"Will wait {config.WEBINAR_WAIT_TIME} seconds for dynamic content")
-        
-        response = requests.post(
-            f"{config.PLAYWRIGHT_SERVER}/render",
-            json=playwright_request,
-            headers=headers,
-            timeout=30
-        )
-        
-        if response.status_code != 200:
-            logger.error(f"Playwright server returned status {response.status_code}")
-            logger.error(f"Response: {response.text}")
-            return None
-        
-        result = response.json()
-        html_content = result.get('html', '')
-        
-        if not html_content:
-            logger.error("No HTML content in Playwright response")
-            return None
-        
-        # Парсим таблицу
-        webinars = parse_webinar_table(html_content)
-        return webinars
-        
-    except Exception as e:
-        logger.error(f"Error fetching webinars via Playwright: {e}", exc_info=True)
-        return None
-
-
-def fetch_webinars() -> Optional[List[Dict[str, str]]]:
-    """
-    Получает список активных вебинаров
-    Сначала пробует через Playwright (для динамического контента),
-    при неудаче - через обычный requests
-    
-    Returns:
-        List[Dict]: Список вебинаров или None в случае ошибки
-    """
-    # Пробуем через Playwright
-    logger.info("Attempting to fetch via Playwright for dynamic content")
-    webinars = fetch_webinars_with_playwright()
-    
-    if webinars is not None:
-        return webinars
-    
-    # Fallback на обычный requests
-    logger.warning("Playwright fetch failed, falling back to simple requests")
-    
-    # Получаем PHPSESSID
-    phpsessid = get_phpsessid()
-    if not phpsessid:
-        logger.error("Failed to get PHPSESSID")
-        return None
-    
-    # Запрашиваем страницу с вебинарами
-    try:
-        headers = {
-            'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36',
-            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-            'Accept-Language': 'ru-RU,ru;q=0.9,uk;q=0.8',
-            'Referer': f'https://{config.EDU_HOST}/'
-        }
-        
-        cookies = {
-            'PHPSESSID': phpsessid
-        }
-        
-        logger.info(f"Fetching webinars from {config.EDU_WEBINAR_URL}")
-        response = requests.get(
-            config.EDU_WEBINAR_URL,
-            headers=headers,
-            cookies=cookies,
-            timeout=15
-        )
-        
-        if response.status_code != 200:
-            logger.error(f"Failed to fetch webinars page: {response.status_code}")
-            return None
-        
-        # Парсим таблицу
-        webinars = parse_webinar_table(response.text)
-        return webinars
-        
-    except Exception as e:
-        logger.error(f"Error fetching webinars: {e}", exc_info=True)
-        return None
-
-
-def format_webinar_message(webinars: List[Dict[str, str]]) -> str:
-    """
-    Форматирует список вебинаров для отправки в Telegram
-    
-    Args:
-        webinars: Список вебинаров
-        
-    Returns:
-        str: Отформатированное сообщение
-    """
-    if not webinars:
-        return "📭 Жодного онлайн уроку зараз"
-    
-    message = "🎓 <b>Активні онлайн уроки:</b>\n\n"
-    
-    for i, webinar in enumerate(webinars, 1):
-        message += f"<b>{i}. {webinar['topic']}</b>\n"
-        message += f"📚 Курс: {webinar['course']}\n"
-        message += f"👨‍🏫 Вчитель: {webinar['teacher']}\n"
-        
-        if webinar['join_link']:
-            full_link = webinar['join_link']
-            if not full_link.startswith('http'):
-                full_link = f"https://{config.EDU_HOST}{webinar['join_link']}"
-            message += f"🔗 <a href='{full_link}'>Увійти до уроку</a>\n"
-        
-        message += "\n"
-    
-    return message
@@ -1,8 +0,0 @@
-#!/bin/sh
-set -e
-
-# Replace environment variables in the Nginx configuration template
-envsubst '${MINIO_PRIVATE_BUCKET} ${MINIO_PUBLIC_BUCKET}' < /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf
-
-# Start Nginx
-exec nginx -g 'daemon off;'
@@ -1,87 +0,0 @@
-server {
-    listen 80;
-    server_name localhost;
-    client_max_body_size 100M;
-
-    # Frontend
-    location / {
-        proxy_pass http://frontend:80;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # API
-    location /api/ {
-        proxy_pass http://app:9000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # MCP
-    location ~ ^/(sse|messages) {
-        proxy_pass http://mcp:3000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-
-        # Important SSE settings
-        proxy_http_version 1.1;
-        proxy_set_header Connection "";
-
-        # Disable buffering so events are sent immediately
-        proxy_buffering off;
-        proxy_cache off;
-
-        # Increase timeouts so connection stays open
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-    }
-
-
-    # MinIO private bucket
-    location /${MINIO_PRIVATE_BUCKET}/ {
-        proxy_pass http://minio:9000/${MINIO_PRIVATE_BUCKET}/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_buffering off;
-    }
-
-    # MinIO public bucket
-    location /${MINIO_PUBLIC_BUCKET}/ {
-        proxy_pass http://minio:9000/${MINIO_PUBLIC_BUCKET}/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_buffering off;
-    }
-
-    # MinIO API - for direct S3 operations
-    # location /minio/api/ {
-    #     proxy_pass http://minio:9000/;
-    #     proxy_set_header Host $host;
-    #     proxy_set_header X-Real-IP $remote_addr;
-    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    #     proxy_set_header X-Forwarded-Proto $scheme;
-    #     proxy_buffering off;
-    # }
-
-    # MinIO Console
-    location /minio-console/ {
-        proxy_pass http://minio:9001/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        # Rewrite location headers
-        proxy_redirect / /minio-console/;
-    }
-}
@@ -0,0 +1,15 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y redis-tools && rm -rf /var/lib/apt/lists/*
+
+# Install dependencies
+RUN pip install requests redis
+
+# Copy application code
+COPY . .
+
+# Run the bot
+CMD ["python", "bot.py"]
@@ -0,0 +1,118 @@
+import os
+import time
+import requests
+import logging
+import redis
+from datetime import datetime
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+# Load configuration
+LOGIN = os.getenv('EDU_LOGIN')
+PASSWORD = os.getenv('EDU_PASSWORD')
+URL_LOGIN = os.getenv('EDU_URL_LOGIN', 'https://edu.edu.vn.ua/user/login')
+URL_VERIFY = os.getenv('EDU_URL_VERIFY', 'https://edu.edu.vn.ua/course/userlist')
+INTERVAL = int(os.getenv('PHPSESSID_INTERVAL', 10))
+USER_AGENT = os.getenv('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
+REDIS_HOST = os.getenv('REDIS_HOST', 'redis')
+REDIS_PORT = int(os.getenv('REDIS_PORT', 6379))
+
+SUCCESS_FILE = '/tmp/last_success'
+
+def touch_success_file():
+    """Updates the timestamp of the success file for healthchecks."""
+    try:
+        with open(SUCCESS_FILE, 'w') as f:
+            f.write(str(datetime.now().timestamp()))
+    except Exception as e:
+        logger.error(f"Failed to touch success file: {e}")
+
+def main():
+    logger.info("Starting Session Keeper Bot")
+    
+    # Connect to Redis
+    try:
+        redis_client = redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True)
+        redis_client.ping()
+        logger.info(f"Connected to Redis at {REDIS_HOST}:{REDIS_PORT}")
+    except Exception as e:
+        logger.error(f"Failed to connect to Redis: {e}")
+        return
+    
+    session = requests.Session()
+    
+    # Set headers
+    headers = {
+        'User-Agent': USER_AGENT,
+        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
+        'Accept-Language': 'en-US,en;q=0.9',
+        'Cache-Control': 'max-age=0',
+        'Upgrade-Insecure-Requests': '1',
+        'Sec-Fetch-Site': 'same-origin',
+        'Sec-Fetch-Mode': 'navigate',
+        'Sec-Fetch-User': '?1',
+        'Sec-Fetch-Dest': 'document',
+        'Sec-Ch-Ua': '"Not_A Brand";v="99", "Chromium";v="142"',
+        'Sec-Ch-Ua-Mobile': '?0',
+        'Sec-Ch-Ua-Platform': '"Linux"',
+        'Accept-Encoding': 'gzip, deflate, br',
+        'Priority': 'u=0, i'
+    }
+    session.headers.update(headers)
+
+    while True:
+        try:
+            logger.info("Attempting login...")
+            
+            # Login payload
+            payload = {
+                'login': LOGIN,
+                'password': PASSWORD
+            }
+            
+            # Perform Login
+            # Note: The user request shows a POST to /user/login with form data
+            # We need to make sure we handle the PHPSESSID correctly.
+            # If we already have a PHPSESSID, requests will send it.
+            
+            login_response = session.post(URL_LOGIN, data=payload, allow_redirects=True)
+            
+            logger.info(f"Login Response Status: {login_response.status_code}")
+            logger.info(f"Cookies after login: {session.cookies.get_dict()}")
+
+            # Verify Session
+            logger.info("Verifying session...")
+            verify_response = session.get(URL_VERIFY, allow_redirects=False)
+            
+            logger.info(f"Verify Response Status: {verify_response.status_code}")
+            
+            if verify_response.status_code == 200:
+                logger.info("Session verification SUCCESS (200 OK).")
+                touch_success_file()
+                
+                # Save PHPSESSID to Redis
+                phpsessid = session.cookies.get('PHPSESSID')
+                if phpsessid:
+                    try:
+                        redis_client.set('EDU_PHPSESSID', phpsessid)
+                        logger.info(f"Saved PHPSESSID to Redis: {phpsessid}")
+                    except Exception as e:
+                        logger.error(f"Failed to save PHPSESSID to Redis: {e}")
+            elif verify_response.status_code == 302:
+                logger.warning("Session verification FAILED (302 Redirect). Session might be invalid.")
+            else:
+                logger.warning(f"Session verification returned unexpected status: {verify_response.status_code}")
+
+        except Exception as e:
+            logger.error(f"An error occurred: {e}")
+
+        logger.info(f"Sleeping for {INTERVAL} minutes...")
+        time.sleep(INTERVAL * 60)
+
+if __name__ == "__main__":
+    main()
@@ -1,15 +0,0 @@
-FROM python:3.11-slim
-
-WORKDIR /app
-
-# Устанавливаем зависимости
-RUN pip install --no-cache-dir flask requests
-
-# Копируем код бота
-COPY main.py .
-
-# Открываем порт
-EXPOSE 5000
-
-# Запускаем бот
-CMD ["python", "-u", "main.py"]
@@ -1,216 +0,0 @@
-import os
-import logging
-from flask import Flask, request, jsonify
-import requests
-from datetime import datetime
-
-# Настройка логирования
-logging.basicConfig(
-    level=logging.INFO,
-    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
-)
-logger = logging.getLogger(__name__)
-
-app = Flask(__name__)
-
-# Конфигурация из переменных окружения
-EDU_HOST = os.getenv('EDU_HOST', 'edu.edu.vn.ua')
-EDU_LOGIN = os.getenv('EDU_LOGIN', '')
-EDU_PASSWORD = os.getenv('EDU_PASSWORD', '')
-BOT_PORT = int(os.getenv('BOT_PORT', '5000'))
-BOT_HOST = os.getenv('BOT_HOST', '0.0.0.0')
-
-# Кэш для хранения актуальной сессии
-session_cache = {
-    'phpsessid': None,
-    'expires_at': None
-}
-
-
-def login_and_get_session():
-    """
-    Выполняет логин и возвращает новый PHPSESSID
-    """
-    url = f"https://{EDU_HOST}/user/login"
-    
-    headers = {
-        'Cache-Control': 'max-age=0',
-        'Sec-Ch-Ua': '"Chromium";v="141", "Not?A_Brand";v="8"',
-        'Sec-Ch-Ua-Mobile': '?0',
-        'Sec-Ch-Ua-Platform': '"Linux"',
-        'Accept-Language': 'ru-RU,ru;q=0.9',
-        'Origin': f'https://{EDU_HOST}',
-        'Content-Type': 'application/x-www-form-urlencoded',
-        'Upgrade-Insecure-Requests': '1',
-        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36',
-        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
-        'Sec-Fetch-Site': 'same-origin',
-        'Sec-Fetch-Mode': 'navigate',
-        'Sec-Fetch-User': '?1',
-        'Sec-Fetch-Dest': 'document',
-        'Referer': f'https://{EDU_HOST}/',
-        'Accept-Encoding': 'gzip, deflate, br',
-        'Priority': 'u=0, i'
-    }
-    
-    data = {
-        'login': EDU_LOGIN,
-        'password': EDU_PASSWORD
-    }
-    
-    try:
-        logger.info(f"Attempting login to {url}")
-        response = requests.post(
-            url, 
-            data=data, 
-            headers=headers,
-            allow_redirects=False,
-            timeout=10
-        )
-        
-        # Получаем PHPSESSID из cookies
-        phpsessid = response.cookies.get('PHPSESSID')
-        
-        if phpsessid:
-            logger.info(f"Login successful, got PHPSESSID: {phpsessid[:10]}...")
-            return {
-                'success': True,
-                'phpsessid': phpsessid,
-                'status_code': response.status_code
-            }
-        else:
-            logger.warning(f"Login failed: no PHPSESSID in response. Status: {response.status_code}")
-            return {
-                'success': False,
-                'error': 'No PHPSESSID in response',
-                'status_code': response.status_code
-            }
-            
-    except requests.exceptions.RequestException as e:
-        logger.error(f"Login request failed: {str(e)}")
-        return {
-            'success': False,
-            'error': str(e)
-        }
-
-
-def validate_phpsessid(phpsessid):
-    """
-    Проверяет валидность существующего PHPSESSID
-    """
-    url = f"https://{EDU_HOST}/"
-    
-    headers = {
-        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36',
-        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
-    }
-    
-    cookies = {
-        'PHPSESSID': phpsessid
-    }
-    
-    try:
-        response = requests.get(url, headers=headers, cookies=cookies, timeout=10)
-        
-        # Проверяем, не редиректит ли на страницу логина
-        is_valid = response.status_code == 200 and '/user/login' not in response.url
-        
-        return {
-            'valid': is_valid,
-            'status_code': response.status_code,
-            'url': response.url
-        }
-    except requests.exceptions.RequestException as e:
-        logger.error(f"Validation request failed: {str(e)}")
-        return {
-            'valid': False,
-            'error': str(e)
-        }
-
-
-@app.route('/health', methods=['GET'])
-def health():
-    """Health check endpoint"""
-    return jsonify({'status': 'ok', 'timestamp': datetime.now().isoformat()})
-
-
-@app.route('/get-session', methods=['POST', 'GET'])
-def get_session():
-    """
-    Основной endpoint для получения валидного PHPSESSID
-    Возвращает кэшированную сессию или создает новую
-    """
-    result = login_and_get_session()
-    
-    if result['success']:
-        session_cache['phpsessid'] = result['phpsessid']
-        session_cache['last_updated'] = datetime.now().isoformat()
-        
-        return jsonify({
-            'success': True,
-            'phpsessid': result['phpsessid'],
-            'timestamp': datetime.now().isoformat()
-        })
-    else:
-        return jsonify({
-            'success': False,
-            'error': result.get('error', 'Login failed'),
-            'timestamp': datetime.now().isoformat()
-        }), 400
-
-
-@app.route('/validate-session', methods=['POST'])
-def validate_session():
-    """
-    Проверяет валидность переданного PHPSESSID
-    """
-    data = request.get_json() or {}
-    phpsessid = data.get('phpsessid') or request.args.get('phpsessid')
-    
-    if not phpsessid:
-        return jsonify({
-            'success': False,
-            'error': 'PHPSESSID not provided'
-        }), 400
-    
-    validation_result = validate_phpsessid(phpsessid)
-    
-    return jsonify({
-        'success': True,
-        'valid': validation_result.get('valid', False),
-        'details': validation_result,
-        'timestamp': datetime.now().isoformat()
-    })
-
-
-@app.route('/refresh-session', methods=['POST', 'GET'])
-def refresh_session():
-    """
-    Принудительно обновляет сессию
-    """
-    result = login_and_get_session()
-    
-    if result['success']:
-        return jsonify({
-            'success': True,
-            'phpsessid': result['phpsessid'],
-            'message': 'Session refreshed successfully',
-            'timestamp': datetime.now().isoformat()
-        })
-    else:
-        return jsonify({
-            'success': False,
-            'error': result.get('error', 'Failed to refresh session'),
-            'timestamp': datetime.now().isoformat()
-        }), 400
-
-
-if __name__ == '__main__':
-    if not EDU_LOGIN or not EDU_PASSWORD:
-        logger.error("EDU_LOGIN and EDU_PASSWORD must be set!")
-        exit(1)
-    
-    logger.info(f"Starting PHPSESSID validator bot on {BOT_HOST}:{BOT_PORT}")
-    logger.info(f"Target host: {EDU_HOST}")
-    
-    app.run(host=BOT_HOST, port=BOT_PORT, debug=False)
@@ -1,3 +0,0 @@
-flask==3.0.0
-requests==2.31.0
-Werkzeug==3.0.1
@@ -0,0 +1,10 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Install dependencies
+RUN pip install --upgrade pip && pip install playwright==1.56.0 redis requests "python-telegram-bot[job-queue]"
+
+COPY checker.py .
+
+CMD ["python", "checker.py"]
@@ -0,0 +1,589 @@
+import os
+import logging
+import redis
+import json
+
+from telegram import Update, InlineKeyboardButton, InlineKeyboardMarkup
+from telegram.ext import Application, CommandHandler, CallbackQueryHandler, ContextTypes
+from playwright.async_api import async_playwright
+
+# Logger
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+# Load environment variables
+WEBINAR_URL = os.getenv('WEBINAR_URL', 'https://edu.edu.vn.ua/webinar/useractive')
+WEBINAR_CHECK_INTERVAL = int(os.getenv('WEBINAR_CHECK_INTERVAL', 60))
+REDIS_HOST = os.getenv('REDIS_HOST', 'redis')
+REDIS_PORT = int(os.getenv('REDIS_PORT', 6379))
+PLAYWRIGHT_WS = os.getenv('PLAYWRIGHT_WS', 'ws://playwright-service:3000/ws')
+USER_AGENT = os.getenv('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
+WEBINAR_TELEGRAM_TOKEN = os.getenv('WEBINAR_TELEGRAM_TOKEN')
+ADMIN_ID = int(os.getenv('WEBINAR_ADMIN_ID', '0'))
+
+# Redis Keys
+KEY_WHITELIST = "bot:whitelist"
+KEY_WHITELIST_ENABLED = "bot:whitelist_enabled"
+KEY_SUBSCRIBERS = "bot:subscribers"
+KEY_PHPSESSID = "EDU_PHPSESSID"
+KEY_WEBINAR_HISTORY = "bot:webinar_history"  # Stores last 5 webinars
+
+# Initialize Redis
+try:
+    redis_client = redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True)
+    redis_client.ping()
+    logger.info(f"Connected to Redis at {REDIS_HOST}:{REDIS_PORT}")
+except Exception as e:
+    logger.error(f"Failed to connect to Redis: {e}")
+    exit(1)
+
+# --- Translations ---
+
+TRANSLATIONS = {
+    'ru': {
+        'welcome': "👋 Привет, {name}!\n\nЯ бот-уведомитель о вебинарах. Я буду сообщать вам, когда появится новый вебинар.\nВы подписаны на уведомления.",
+        'welcome_admin': "\n\n👑 <b>Режим администратора активен</b>",
+        'access_denied': "⛔ Доступ запрещен. Вас нет в белом списке.",
+        'help_title': "🤖 <b>Помощь по боту</b>\n\n",
+        'help_commands': "/start - Подписаться на уведомления\n/help - Показать это сообщение\n/language - Сменить язык",
+        'help_admin': "\n<b>Команды администратора:</b>\n/adduser [user_id] - Добавить пользователя в белый список\n/removeuser [user_id] - Удалить пользователя из белого списка\nИли используйте панель ниже для управления настройками.",
+        'admin_only': "⛔ Только для администратора!",
+        'user_added': "✅ Пользователь {user_id} добавлен в белый список",
+        'user_removed': "✅ Пользователь {user_id} удален из белого списка",
+        'user_not_in_whitelist': "⚠️ Пользователь {user_id} не был в белом списке",
+        'cannot_remove_admin': "❌ Невозможно удалить администратора из белого списка",
+        'invalid_user_id': "❌ Неверный ID пользователя. Должно быть число.",
+        'usage_adduser': "Использование: /adduser [user_id]",
+        'usage_removeuser': "Использование: /removeuser [user_id]",
+        'whitelist_enabled': "✅ Белый список включен",
+        'whitelist_disabled': "✅ Белый список отключен",
+        'whitelist_title': "📋 <b>Белый список:</b>\n",
+        'subscribers_title': "👥 <b>Подписчики:</b>\n",
+        'empty': "Пусто",
+        'force_check_running': "🔄 Запускаю проверку...",
+        'check_failed': "❌ Проверка не удалась. Смотрите логи.",
+        'check_completed_none': "✅ Проверка завершена. Вебинаров не найдено.",
+        'check_completed': "✅ Проверка завершена. Найдено {count} вебинар(ов)!",
+        'toggle_whitelist_disable': "🔒 Отключить белый список",
+        'toggle_whitelist_enable': "🔓 Включить белый список",
+        'view_whitelist': "📋 Посмотреть белый список",
+        'view_subscribers': "👥 Посмотреть подписчиков",
+        'force_check': "🔄 Принудительная проверка",
+        'webinar_found': "🎓 <b>Новый вебинар!</b>\n\n",
+        'webinar_item': "📌 <b>{name}</b>\n🔗 https://edu.edu.vn.ua{url}",
+        'select_language': "🌐 <b>Выберите язык / Оберіть мову / Select language:</b>",
+        'language_changed': "✅ Язык изменен на русский",
+        'flag_ru': "🇷🇺 Русский",
+        'flag_uk': "🇺🇦 Українська",
+        'flag_en': "🇬🇧 English",
+    },
+    'uk': {
+        'welcome': "👋 Привіт, {name}!\n\nЯ бот-сповіщувач про вебінари. Я повідомлятиму вас, коли з'явиться новий вебінар.\nВи підписані на сповіщення.",
+        'welcome_admin': "\n\n👑 <b>Режим адміністратора активний</b>",
+        'access_denied': "⛔ Доступ заборонено. Вас немає в білому списку.",
+        'help_title': "🤖 <b>Довідка по боту</b>\n\n",
+        'help_commands': "/start - Підписатися на сповіщення\n/help - Показати це повідомлення\n/language - Змінити мову",
+        'help_admin': "\n<b>Команди адміністратора:</b>\n/adduser [user_id] - Додати користувача до білого списку\n/removeuser [user_id] - Видалити користувача з білого списку\nАбо використовуйте панель нижче для керування налаштуваннями.",
+        'admin_only': "⛔ Тільки для адміністратора!",
+        'user_added': "✅ Користувач {user_id} доданий до білого списку",
+        'user_removed': "✅ Користувач {user_id} видалений з білого списку",
+        'user_not_in_whitelist': "⚠️ Користувач {user_id} не був у білому списку",
+        'cannot_remove_admin': "❌ Неможливо видалити адміністратора з білого списку",
+        'invalid_user_id': "❌ Невірний ID користувача. Має бути число.",
+        'usage_adduser': "Використання: /adduser [user_id]",
+        'usage_removeuser': "Використання: /removeuser [user_id]",
+        'whitelist_enabled': "✅ Білий список увімкнено",
+        'whitelist_disabled': "✅ Білий список вимкнено",
+        'whitelist_title': "📋 <b>Білий список:</b>\n",
+        'subscribers_title': "👥 <b>Підписники:</b>\n",
+        'empty': "Порожньо",
+        'force_check_running': "🔄 Запускаю перевірку...",
+        'check_failed': "❌ Перевірка не вдалася. Дивіться логи.",
+        'check_completed_none': "✅ Перевірка завершена. Вебінарів не знайдено.",
+        'check_completed': "✅ Перевірка завершена. Знайдено {count} вебінар(ів)!",
+        'toggle_whitelist_disable': "🔒 Вимкнути білий список",
+        'toggle_whitelist_enable': "🔓 Увімкнути білий список",
+        'view_whitelist': "📋 Переглянути білий список",
+        'view_subscribers': "👥 Переглянути підписників",
+        'force_check': "🔄 Примусова перевірка",
+        'webinar_found': "🎓 <b>Новий вебінар!</b>\n\n",
+        'webinar_item': "📌 <b>{name}</b>\n🔗 https://edu.edu.vn.ua{url}",
+        'select_language': "🌐 <b>Виберіть мову / Выберите язык / Select language:</b>",
+        'language_changed': "✅ Мову змінено на українську",
+        'flag_ru': "🇷🇺 Русский",
+        'flag_uk': "🇺🇦 Українська",
+        'flag_en': "🇬🇧 English",
+    },
+    'en': {
+        'welcome': "👋 Hello, {name}!\n\nI am the Webinar Checker Bot. I will notify you when a new webinar appears.\nYou have been subscribed to notifications.",
+        'welcome_admin': "\n\n👑 <b>Admin Mode Active</b>",
+        'access_denied': "⛔ Access denied. You are not on the whitelist.",
+        'help_title': "🤖 <b>Bot Help</b>\n\n",
+        'help_commands': "/start - Subscribe to notifications\n/help - Show this message\n/language - Change language",
+        'help_admin': "\n<b>Admin Commands:</b>\n/adduser [user_id] - Add user to whitelist\n/removeuser [user_id] - Remove user from whitelist\nOr use the panel below to manage settings.",
+        'admin_only': "⛔ Admin only!",
+        'user_added': "✅ User {user_id} added to whitelist",
+        'user_removed': "✅ User {user_id} removed from whitelist",
+        'user_not_in_whitelist': "⚠️ User {user_id} was not in whitelist",
+        'cannot_remove_admin': "❌ Cannot remove admin from whitelist",
+        'invalid_user_id': "❌ Invalid user ID. Must be a number.",
+        'usage_adduser': "Usage: /adduser [user_id]",
+        'usage_removeuser': "Usage: /removeuser [user_id]",
+        'whitelist_enabled': "✅ Whitelist Enabled",
+        'whitelist_disabled': "✅ Whitelist Disabled",
+        'whitelist_title': "📋 <b>Whitelist:</b>\n",
+        'subscribers_title': "👥 <b>Subscribers:</b>\n",
+        'empty': "Empty",
+        'force_check_running': "🔄 Running immediate check...",
+        'check_failed': "❌ Check failed. See logs for details.",
+        'check_completed_none': "✅ Check completed. No webinars found.",
+        'check_completed': "✅ Check completed. Found {count} webinar(s)!",
+        'toggle_whitelist_disable': "🔒 Disable Whitelist",
+        'toggle_whitelist_enable': "🔓 Enable Whitelist",
+        'view_whitelist': "📋 View Whitelist",
+        'view_subscribers': "👥 View Subscribers",
+        'force_check': "🔄 Force Check",
+        'webinar_found': "🎓 <b>New webinar found!</b>\n\n",
+        'webinar_item': "📌 <b>{name}</b>\n🔗 https://edu.edu.vn.ua{url}",
+        'select_language': "🌐 <b>Select language / Виберіть мову / Выберите язык:</b>",
+        'language_changed': "✅ Language changed to English",
+        'flag_ru': "🇷🇺 Русский",
+        'flag_uk': "🇺🇦 Українська",
+        'flag_en': "🇬🇧 English",
+    }
+}
+
+# --- Language Helper Functions ---
+
+def get_user_language(user_id: int) -> str:
+    """Get user's preferred language from Redis. Default: Ukrainian."""
+    lang = redis_client.get(f"user:{user_id}:language")
+    return lang if lang in ['ru', 'uk', 'en'] else 'uk'
+
+def set_user_language(user_id: int, lang: str):
+    """Save user's language preference to Redis."""
+    if lang in ['ru', 'uk', 'en']:
+        redis_client.set(f"user:{user_id}:language", lang)
+        logger.info(f"User {user_id} language set to {lang}")
+
+def t(user_id: int, key: str, **kwargs) -> str:
+    """Translate message for user with optional formatting."""
+    lang = get_user_language(user_id)
+    message = TRANSLATIONS.get(lang, TRANSLATIONS['uk']).get(key, key)
+    if kwargs:
+        return message.format(**kwargs)
+    return message
+
+def get_language_keyboard():
+    """Generate language selection keyboard."""
+    keyboard = [
+        [
+            InlineKeyboardButton("🇷🇺 Русский", callback_data="lang_ru"),
+            InlineKeyboardButton("🇺🇦 Українська", callback_data="lang_uk"),
+        ],
+        [
+            InlineKeyboardButton("🇬🇧 English", callback_data="lang_en"),
+        ]
+    ]
+    return InlineKeyboardMarkup(keyboard)
+
+# --- Helper Functions ---
+
+def is_whitelisted(user_id: int) -> bool:
+    """Check if user is allowed to use the bot."""
+    if user_id == ADMIN_ID:
+        return True
+    
+    enabled = redis_client.get(KEY_WHITELIST_ENABLED)
+    if enabled == "0":  # Whitelist disabled
+        return True
+        
+    return redis_client.sismember(KEY_WHITELIST, str(user_id))
+
+def get_admin_keyboard(user_id: int):
+    """Generate admin panel keyboard."""
+    whitelist_enabled = redis_client.get(KEY_WHITELIST_ENABLED) != "0"
+    toggle_text = t(user_id, 'toggle_whitelist_disable') if whitelist_enabled else t(user_id, 'toggle_whitelist_enable')
+    
+    keyboard = [
+        [InlineKeyboardButton(toggle_text, callback_data="toggle_whitelist")],
+        [InlineKeyboardButton(t(user_id, 'view_whitelist'), callback_data="view_whitelist")],
+        [InlineKeyboardButton(t(user_id, 'view_subscribers'), callback_data="view_subscribers")],
+        [InlineKeyboardButton(t(user_id, 'force_check'), callback_data="force_check")]
+    ]
+    return InlineKeyboardMarkup(keyboard)
+
+# --- Command Handlers ---
+
+async def start(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Handle /start command."""
+    user = update.effective_user
+    logger.info(f"User {user.id} ({user.username}) started the bot.")
+    
+    if not is_whitelisted(user.id):
+        await update.message.reply_text(t(user.id, 'access_denied'))
+        return
+
+    # Add to subscribers
+    redis_client.sadd(KEY_SUBSCRIBERS, user.id)
+    
+    msg = t(user.id, 'welcome', name=user.first_name)
+    
+    if user.id == ADMIN_ID:
+        msg += t(user.id, 'welcome_admin')
+        await update.message.reply_text(msg, parse_mode='HTML', reply_markup=get_admin_keyboard(user.id))
+    else:
+        await update.message.reply_text(msg, parse_mode='HTML')
+
+async def help_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Handle /help command."""
+    user_id = update.effective_user.id
+    msg = t(user_id, 'help_title') + t(user_id, 'help_commands')
+    
+    if user_id == ADMIN_ID:
+        msg += t(user_id, 'help_admin')
+        await update.message.reply_text(msg, parse_mode='HTML', reply_markup=get_admin_keyboard(user_id))
+    else:
+        await update.message.reply_text(msg, parse_mode='HTML')
+
+async def language_command(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Handle /language command."""
+    user_id = update.effective_user.id
+    await update.message.reply_text(
+        t(user_id, 'select_language'),
+        parse_mode='HTML',
+        reply_markup=get_language_keyboard()
+    )
+
+async def add_user(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Add user to whitelist (admin only)."""
+    admin_id = update.effective_user.id
+    if admin_id != ADMIN_ID:
+        await update.message.reply_text(t(admin_id, 'admin_only'))
+        return
+    
+    if not context.args:
+        await update.message.reply_text(t(admin_id, 'usage_adduser'))
+        return
+    
+    try:
+        user_id = int(context.args[0])
+        redis_client.sadd(KEY_WHITELIST, str(user_id))
+        await update.message.reply_text(t(admin_id, 'user_added', user_id=user_id))
+        logger.info(f"Admin added user {user_id} to whitelist")
+    except ValueError:
+        await update.message.reply_text(t(admin_id, 'invalid_user_id'))
+
+async def remove_user(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Remove user from whitelist (admin only)."""
+    admin_id = update.effective_user.id
+    if admin_id != ADMIN_ID:
+        await update.message.reply_text(t(admin_id, 'admin_only'))
+        return
+    
+    if not context.args:
+        await update.message.reply_text(t(admin_id, 'usage_removeuser'))
+        return
+    
+    try:
+        user_id = int(context.args[0])
+        if str(user_id) == str(ADMIN_ID):
+            await update.message.reply_text(t(admin_id, 'cannot_remove_admin'))
+            return
+        
+        removed = redis_client.srem(KEY_WHITELIST, str(user_id))
+        if removed:
+            await update.message.reply_text(t(admin_id, 'user_removed', user_id=user_id))
+            logger.info(f"Admin removed user {user_id} from whitelist")
+        else:
+            await update.message.reply_text(t(admin_id, 'user_not_in_whitelist', user_id=user_id))
+    except ValueError:
+        await update.message.reply_text(t(admin_id, 'invalid_user_id'))
+
+# --- Admin Callbacks ---
+
+async def admin_callback(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Handle admin panel button clicks."""
+    query = update.callback_query
+    user_id = query.from_user.id
+    
+    if user_id != ADMIN_ID:
+        await query.answer(t(user_id, 'admin_only'), show_alert=True)
+        return
+
+    await query.answer()
+    data = query.data
+
+    if data == "toggle_whitelist":
+        current = redis_client.get(KEY_WHITELIST_ENABLED)
+        new_state = "0" if current != "0" else "1"
+        redis_client.set(KEY_WHITELIST_ENABLED, new_state)
+        state_text = t(user_id, 'whitelist_disabled') if new_state == "0" else t(user_id, 'whitelist_enabled')
+        await query.edit_message_reply_markup(reply_markup=get_admin_keyboard(user_id))
+        await query.message.reply_text(state_text)
+
+    elif data == "view_whitelist":
+        members = redis_client.smembers(KEY_WHITELIST)
+        msg = t(user_id, 'whitelist_title') + ("\n".join(members) if members else t(user_id, 'empty'))
+        await query.message.reply_text(msg, parse_mode='HTML')
+
+    elif data == "view_subscribers":
+        subs = redis_client.smembers(KEY_SUBSCRIBERS)
+        msg = t(user_id, 'subscribers_title') + ("\n".join(subs) if subs else t(user_id, 'empty'))
+        await query.message.reply_text(msg, parse_mode='HTML')
+        
+    elif data == "force_check":
+        await query.message.reply_text(t(user_id, 'force_check_running'))
+        result = await check_webinars_job(context)
+        
+        if result is None:
+            await query.message.reply_text(t(user_id, 'check_failed'))
+        elif result == 0:
+            await query.message.reply_text(t(user_id, 'check_completed_none'))
+        else:
+            await query.message.reply_text(t(user_id, 'check_completed', count=result))
+
+async def language_callback(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    """Handle language selection button clicks."""
+    query = update.callback_query
+    user_id = query.from_user.id
+    data = query.data
+    
+    if data.startswith("lang_"):
+        lang = data.split("_")[1]
+        set_user_language(user_id, lang)
+        await query.answer()
+        await query.edit_message_text(
+            t(user_id, 'language_changed'),
+            parse_mode='HTML'
+        )
+
+# --- Webinar Checking Job ---
+
+def get_webinar_key(name: str, url: str) -> str:
+    """Generate unique key for a webinar based on name and URL."""
+    return f"{name}|{url}"
+
+def get_stored_webinars() -> list:
+    """Get list of stored webinar keys from Redis."""
+    data = redis_client.get(KEY_WEBINAR_HISTORY)
+    if data:
+        try:
+            return json.loads(data)
+        except Exception as e:
+            logger.error(f"Failed to parse webinar history: {e}")
+    return []
+
+def store_webinars(webinar_keys: list):
+    """Store up to 5 most recent webinar keys in Redis."""
+    # Keep only last 5
+    webinar_keys = webinar_keys[-5:]
+    try:
+        redis_client.set(KEY_WEBINAR_HISTORY, json.dumps(webinar_keys))
+        logger.info(f"Stored {len(webinar_keys)} webinar(s) in history")
+    except Exception as e:
+        logger.error(f"Failed to store webinar history: {e}")
+
+async def check_webinars_job(context: ContextTypes.DEFAULT_TYPE):
+    """Background job to check for webinars using Async Playwright.
+    
+    Returns:
+        int: Number of webinars found, or None if check failed
+    """
+    logger.info("Running webinar check...")
+    
+    phpsessid = redis_client.get(KEY_PHPSESSID)
+    if not phpsessid:
+        logger.warning("PHPSESSID missing. Skipping check.")
+        # --- DEBUG LOGGING ---
+        try:
+            with open('phpsessid_missing.log', 'a') as f:
+                f.write(f"[{os.getcwd()}] PHPSESSID missing at {context.job.last_run: %Y-%m-%d %H:%M:%S}\n")
+        except Exception as e:
+            logger.error(f"Failed to write PHPSESSID debug log: {e}")
+        # ---------------------
+        return None
+
+    current_webinars = []  # List of dicts with name, url, and formatted text
+    content = ""
+    
+    try:
+        async with async_playwright() as p:
+            # Connect to remote Playwright service
+            browser = await p.chromium.connect(PLAYWRIGHT_WS)
+            
+            try:
+                # Create browser context with user agent
+                context_browser = await browser.new_context(user_agent=USER_AGENT)
+                
+                # Add PHPSESSID cookie
+                await context_browser.add_cookies([{
+                    'name': 'PHPSESSID',
+                    'value': phpsessid,
+                    'domain': 'edu.edu.vn.ua',
+                    'path': '/'
+                }])
+                
+                # Create new page
+                page = await context_browser.new_page()
+                
+                try:
+                    # Navigate to webinar page
+                    await page.goto(WEBINAR_URL, wait_until='domcontentloaded')
+                    
+                    # Wait for the table to load
+                    await page.wait_for_selector('#meetings table', timeout=10000)
+                    await page.wait_for_timeout(2000)
+                    
+                    # Get page content
+                    content = await page.content()
+                    
+                    # Check if "no webinar" message is present
+                    if "Жодного онлайн уроку зараз" not in content:
+                        logger.info("!!! WEBINAR FOUND !!!")
+                        
+                        # Extract webinar details from table rows
+                        rows = page.locator('#meetings table tbody tr')
+                        count = await rows.count()
+                        
+                        for i in range(count):
+                            row = rows.nth(i)
+                            text = await row.inner_text()
+                            
+                            if "Жодного онлайн уроку зараз" not in text:
+                                # Extract name (topic) from first column
+                                name_elem = row.locator('td').nth(0)
+                                name = await name_elem.inner_text()
+                                name = name.strip()
+                                
+                                # Extract join URL from fourth column
+                                url_elem = row.locator('td').nth(3).locator('a[href*="/webinar/join/"]').first
+                                url = await url_elem.get_attribute('href')
+                                
+                                if name and url:
+                                    current_webinars.append({
+                                        'name': name,
+                                        'url': url,
+                                        'text': text.strip()
+                                    })
+                                    logger.info(f"Found webinar: {name} -> {url}")
+                    else:
+                        logger.info("No webinars found (expected message present)")
+                        
+                except Exception as e:
+                    logger.error(f"Error checking page: {e}. Saving content for debug.")
+                    # If page content is available, save it on error
+                    try:
+                        if page and not content:
+                            content = await page.content()
+                    except Exception:
+                        pass # Ignore error during content retrieval on check error
+                    
+                    return None
+                finally:
+                    await page.close()
+                    await context_browser.close()
+                    
+            finally:
+                await browser.close()
+                
+    except Exception as e:
+        logger.error(f"Playwright error: {e}")
+        return None
+    
+    # --- DEBUG LOGGING (Saving last response content) ---
+    if not current_webinars and content: #if no webinars found, save the page content
+        try:
+            with open('response.html', 'w', encoding='utf-8') as f:
+                f.write(content)
+            logger.info("Saved page content to response.html for debug.")
+        except Exception as e:
+            logger.error(f"Failed to write debug HTML: {e}")
+    # -----------------------------------------------------
+
+    # Check for NEW webinars and notify
+    if current_webinars:
+        # Get stored webinar history
+        stored_keys = get_stored_webinars()
+        logger.info(f"Stored webinar keys: {stored_keys}")
+        
+        # Find new webinars (not in history)
+        new_webinars = []
+        current_keys = []
+        
+        for webinar in current_webinars:
+            key = get_webinar_key(webinar['name'], webinar['url'])
+            current_keys.append(key)
+            
+            if key not in stored_keys:
+                new_webinars.append(webinar)
+                logger.info(f"NEW webinar detected: {webinar['name']}")
+        
+        # Update stored history with current webinars
+        # Merge old and new, keeping only last 5
+        updated_keys = stored_keys + [k for k in current_keys if k not in stored_keys]
+        store_webinars(updated_keys)
+        
+        # Notify subscribers ONLY about NEW webinars
+        if new_webinars:
+            subscribers = redis_client.smembers(KEY_SUBSCRIBERS)
+            logger.info(f"Sending notification about {len(new_webinars)} new webinar(s) to {len(subscribers)} subscriber(s)")
+            
+            for sub_id in subscribers:
+                try:
+                    # Build message in user's language
+                    webinar_items = "\n\n".join([
+                        t(int(sub_id), 'webinar_item', name=w['name'], url=w['url'])
+                        for w in new_webinars
+                    ])
+                    message = t(int(sub_id), 'webinar_found') + webinar_items
+                    
+                    await context.bot.send_message(chat_id=sub_id, text=message, parse_mode='HTML')
+                    logger.info(f"Notification sent to {sub_id}")
+                except Exception as e:
+                    logger.error(f"Failed to send to {sub_id}: {e}")
+        else:
+            logger.info(f"Found {len(current_webinars)} webinar(s), but all are already known")
+    
+    return len(current_webinars)
+
+# --- Main ---
+
+def main():
+    if not WEBINAR_TELEGRAM_TOKEN:
+        logger.error("WEBINAR_TELEGRAM_TOKEN is missing!")
+        return
+
+    # Set default whitelist state if not set
+    if not redis_client.exists(KEY_WHITELIST_ENABLED):
+        redis_client.set(KEY_WHITELIST_ENABLED, "1")  # Enabled by default
+
+    # Add admin to whitelist
+    if ADMIN_ID:
+        redis_client.sadd(KEY_WHITELIST, str(ADMIN_ID))
+
+    app = Application.builder().token(WEBINAR_TELEGRAM_TOKEN).build()
+
+    # Handlers
+    app.add_handler(CommandHandler("start", start))
+    app.add_handler(CommandHandler("help", help_command))
+    app.add_handler(CommandHandler("language", language_command))
+    app.add_handler(CommandHandler("adduser", add_user))
+    app.add_handler(CommandHandler("removeuser", remove_user))
+    
+    # Callback handlers - language selection first, then admin panel
+    app.add_handler(CallbackQueryHandler(language_callback, pattern="^lang_"))
+    app.add_handler(CallbackQueryHandler(admin_callback))
+
+    # Job Queue
+    job_queue = app.job_queue
+    job_queue.run_repeating(check_webinars_job, interval=WEBINAR_CHECK_INTERVAL, first=10)
+
+    logger.info("Bot started polling...")
+    app.run_polling()
+
+if __name__ == "__main__":
+    main()
@@ -25,6 +25,28 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
+      - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.middlewares=security-headers@file"
+      - "traefik.http.routers.gitea.service=gitea"
+      - "traefik.http.routers.gitea.tls=true"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
+
+      # Local Router
+      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`) || Host(`gitea.internal`)"
+      - "traefik.http.routers.gitea-local.entrypoints=websecure"
+      - "traefik.http.routers.gitea-local.middlewares=security-headers@file"
+      - "traefik.http.routers.gitea-local.service=gitea"
+      - "traefik.http.routers.gitea-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)"
+      - "traefik.http.routers.gitea-dev.entrypoints=websecure"
+      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.gitea-dev.service=gitea"
+      - "traefik.http.routers.gitea-dev.tls=true"
    ports:
      - "2221:22"
    depends_on:
@@ -12,6 +12,24 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
+      - "traefik.http.routers.glance.entrypoints=websecure"
+      - "traefik.http.routers.glance.middlewares=security-headers@file"
+      - "traefik.http.routers.glance.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`) || Host(`glance.internal`)"
+      - "traefik.http.routers.glance-local.entrypoints=websecure"
+      - "traefik.http.routers.glance-local.middlewares=security-headers@file"
+      - "traefik.http.routers.glance-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
+      - "traefik.http.routers.glance-dev.entrypoints=websecure"
+      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.glance-dev.tls=true"
    networks:
      - traefik-proxy
    dns:
@@ -0,0 +1,10 @@
+# everyone use that
+FROM nginx:alpine
+
+RUN rm -rf /usr/share/nginx/html/*
+
+COPY ./files /usr/share/nginx/html
+
+EXPOSE 80
+# Start 
+CMD ["nginx", "-g", "daemon off;"]
@@ -0,0 +1,39 @@
+services:
+  forust-homepage:
+    build: .
+    ports:
+      - "8085:80"
+    restart: unless-stopped
+    volumes:
+      - ./files:/usr/share/nginx/html
+    networks:
+      - traefik-proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage.tls=true"
+      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
+
+      # Local Router
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
+      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
+      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-dev.tls=true"
+
+networks:
+  traefik-proxy:
+    external: true
@@ -0,0 +1,167 @@
+/* hidden in a plain sight? */
+:root {
+    --bg-color: #050505;
+    --text-color: #e0e0e0;
+    --accent: #ffffff;
+    --dim: #666666;
+    --font-mono: 'Courier New', Courier, monospace;
+}
+
+* {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+body {
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    font-family: var(--font-mono);
+    line-height: 1.6;
+    font-size: 16px;
+    padding: 2rem;
+}
+
+a {
+    color: var(--text-color);
+    text-decoration: none;
+    border-bottom: 1px solid var(--dim);
+    transition: all 0.2s;
+}
+
+a:hover {
+    background-color: var(--text-color);
+    color: var(--bg-color);
+    border-color: var(--text-color);
+}
+
+.container {
+    max-width: 800px;
+    margin: 0 auto;
+}
+
+/* TEXT */
+h1 {
+    font-size: 2.5rem;
+    text-transform: uppercase;
+    letter-spacing: -2px;
+    margin-bottom: 0.5rem;
+}
+
+h2 {
+    font-size: 1.2rem;
+    margin-bottom: 1.5rem;
+    border-bottom: 1px solid var(--dim);
+    display: inline-block;
+    padding-right: 20px;
+}
+
+.subtitle {
+    color: var(--dim);
+    margin-bottom: 2rem;
+}
+
+hr {
+    border: 0;
+    border-top: 1px dashed var(--dim);
+    margin: 2rem 0;
+}
+
+.comment {
+    color: var(--dim);
+    font-size: 0.9rem;
+    margin-left: 10px;
+}
+
+/* SECTIONS */
+section {
+    margin-bottom: 3rem;
+}
+
+/* LISTS */
+ul {
+    list-style: none;
+}
+
+.link-list li {
+    margin-bottom: 0.8rem;
+    display: flex;
+    align-items: center;
+    gap: 15px;
+}
+
+/* STACK GRID */
+.grid-2 {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 2rem;
+}
+
+.skill-item {
+    display: flex;
+    justify-content: space-between;
+    margin-bottom: 0.5rem;
+}
+
+.level {
+    font-weight: bold;
+}
+
+.special .level {
+    color: var(--text-color);
+    text-shadow: 1px 0 0 red, -1px 0 0 blue; 
+}
+
+/* my dudes */
+.team-grid {
+    display: flex;
+    gap: 2rem;
+    flex-wrap: wrap;
+    margin-top: 1rem;
+}
+
+.member {
+    text-align: center;
+    width: 100px;
+}
+
+.avatar {
+    width: 80px;
+    height: 80px;
+    background-color: #222;
+    border: 2px solid var(--text-color);
+    margin: 0 auto 10px auto;
+    background-size: cover;
+}
+
+/* if no avatar added: */
+.placeholder::before {
+    content: "?";
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    font-size: 2rem;
+    color: var(--dim);
+}
+
+/* REPOS */
+.repo-list li {
+    margin-bottom: 1rem;
+}
+
+/* FOOTER */
+footer {
+    text-align: center;
+    color: var(--dim);
+    font-size: 0.8rem;
+/* flag{why-are-you-here?} */
+    margin-top: 4rem;
+}
+/* SMTH RESPONSIVE */
+@media (max-width: 600px) {
+    .grid-2 {
+        grid-template-columns: 1fr;
+        gap: 0;
+    }
+}
@@ -0,0 +1,178 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>MrForust // XRock</title>
+    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <link rel="stylesheet" href="assets/css/style.css">
+</head>
+
+<body>
+
+    <div class="container">
+        <header>
+            <h1 class="glitch" data-text="MrForust">Mr-Forust</h1>
+            <p class="subtitle">> CTF Player / XRock_Team / Just Signal.</p>
+        </header>
+
+        <hr>
+
+        <section id="socials">
+            <h2>./socials</h2>
+            <ul class="link-list">
+                <li>
+                    <i class="fab fa-github"></i>
+                    <a href="https://github.com/mr-forust" target="_blank">github/mr-forust</a>
+                </li>
+                <li>
+                    <i class="fas fa-flag"></i>
+                    <a href="https://tryhackme.com/p/MrForust" target="_blank">tryhackme/MrForust</a>
+                </li>
+                <li>
+                    <i class="fab fa-telegram-plane"></i>
+                    <a href="https://t.me/MrForust" target="_blank">telegram/MrForust</a>
+                </li>
+                <li>
+                    <i class="fab fa-discord"></i>
+                    <span>discord/mr.forust</span>
+                </li>
+                <li>
+                    <i class="fas fa-envelope"></i>
+                    <a href="mailto:forust@forust.xyz">forust@forust.xyz</a>
+                </li>
+            </ul>
+        </section>
+
+        <section id="stack">
+            <h2>./skills_and_tools</h2>
+            <div class="grid-2">
+                <div>
+                    <div class="skill-item">
+                        <span>ArchLinux # btw</span>
+                        <span class="level">[#######...]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Docker Compose</span> <span class="level">[#####.....]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Web Pentest</span> <span class="level">[#####.....]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Burpsuite</span> <span class="level">[#####.....]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Docker</span> <span class="level">[####......]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Steganography</span> <span class="level">[####......]</span>
+                    </div>
+                </div>
+                <div>
+                    <div class="skill-item">
+                        <span>Cryptography</span> <span class="level">[####......]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>OSINT</span> <span class="level">[####......]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Python</span> <span class="level">[###.......]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>HTML</span> <span class="level">[###.......]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Bash</span> <span class="level">[##........]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Golang</span> <span class="level">[#.........]</span>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        <section id="team">
+            <h2>./xrock_team</h2>
+            <p class="comment"># It's a select caste. Cybershamans. Cryptoanarchists. Shadows on the net..</p>
+
+            <div class="team-grid">
+                <div class="member">
+                    <div class="avatar"
+                        style="background-image: url('assets/images/team/mrforust.jpg'); background-size: cover; background-position: center;">
+                    </div>
+                    <a href="https://github.com/mr-forust" target="_blank">MrForust</a>
+                </div>
+
+                <div class="member">
+                    <div class="avatar"
+                        style="background-image: url('assets/images/team/anna.jpg'); background-size: cover; background-position: center;">
+                    </div>
+                    <a href="" target="_blank">Anna~</a>
+                </div>
+
+                <div class="member">
+                    <div class="avatar"
+                        style="background-image: url('assets/images/team/chernuha.jpg'); background-size: cover; background-position: center;">
+                    </div>
+                    <a href="https://chernuha.space" target="_blank">Chernuha</a>
+                </div>
+
+                <div class="member">
+                    <div class="avatar"
+                        style="background-image: url('assets/images/team/hudan.jpg'); background-size: cover; background-position: center;">
+                    </div>
+                    <a href="https://hudan.xyz" target="_blank">p1ngvi</a>
+                </div>
+
+                <div class="member">
+                    <div class="avatar"
+                        style="background-image: url('assets/images/team/xdfnx.jpg'); background-size: cover; background-position: center;">
+                    </div>
+                    <a href="https://xdfnx.cfd" target="_blank">xdfnx</a>
+                </div>
+            </div>
+        </section>
+
+        <section id="repos">
+            <h2>./favorite_repos</h2>
+            <ul class="repo-list">
+                <li>
+                    <a href="https://github.com/TDesktop-x64/tdesktop" target="_blank">TDesktop-x64/tdesktop</a>
+                    <span class="comment">// unofficial telegram client with some additions</span>
+                </li>
+                <li>
+                    <a href="https://github.com/traefik/traefik" target="_blank">traefik/traefik</a>
+                    <span class="comment">// beloved reverse-proxy</span>
+                </li>
+                <li>
+                    <a href="https://github.com/unhappychoice/gitlogue" target="_blank">unhappychoice/gitlogue</a>
+                    <span class="comment">// nice git log visualizer</span>
+                </li>
+                <li>
+                    <a href="https://github.com/mountain-loop/yaak" target="_blank">mountain-loop/yaak</a>
+                    <span class="comment">// modern, fancy api client</span>
+                </li>
+                <li>
+                    <a href="https://github.com/pear-devs/pear-desktop" target="_blank">pear-devs/pear-desktop</a>
+                    <span class="comment">// music client with a lot of features</span>
+                </li>
+                <li>
+                    <a href="https://github.com/epi052/feroxbuster" target="_blank">epi052/feroxbuster</a>
+                    <span class="comment">// directory discovery</span>
+                </li>
+            </ul>
+        </section>
+
+        <footer>
+            <p>root@xrock:~$ cat <a href="miku.html">./miku</a></p>
+            <p>miku?</p>
+            <p>root@xrock:~$ shutdown -h now</p>
+            <p>&copy; XRock - Just Signal.</p>
+        </footer>
+    </div>
+
+</body>
+
+</html>
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>miku?</title>
+</head>
+<body bgcolor="black" text="grey">
+
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠋⠉⠉⠀⠀⠀⠀⠀⠀⠛⠘⠛⠛⠛⠿⠿⠿⠿⠿⣽⠙⣛⡛⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠟⠋⠁⠀⠀⠀⠀⠀⢀⣀⣀⣀⣀⣀⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠂⠈⠙⠛⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢋⣰⢋⣴⠻⣿⡟⢹⡟⠋⠀⠀⠀⠀⢀⣠⣴⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣶⣶⣶⣶⣶⣶⣶⣿⣿⣿⣷⣶⣶⣦⣤⣄⣀⠀⠀⠉⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠋⡀⠏⣰⠟⠁⡰⢋⠀⠀⠀⠀⠀⢀⣠⣾⣿⣿⣿⡿⠟⠛⣛⣽⣯⣿⣽⣯⣿⣟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣖⡄⠀⠀⠉⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⣠⠾⠋⠀⢊⡴⠋⠀⠀⠀⣀⣴⣿⣿⣿⡿⠋⢀⣠⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⣿⣿⣽⣿⣯⣿⣯⣿⣽⣯⣿⢿⣷⣷⣄⠀⠀⠙⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⢠⠞⠁⠀⠀⣰⠋⠀⠀⢀⣤⣾⣿⣿⣿⠿⣋⣴⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⣝⣛⡫⠷⣿⡿⣯⣿⢿⣺⣄⠀⠈⠋⠙⣿⡻⣧⠹⣏⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠁⠀⢀⡴⠋⠀⠀⢠⡾⠁⠀⢀⣴⣿⣿⣿⣿⣿⣿⣾⠿⠛⣩⣽⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣭⣛⣿⣿⣻⣿⣷⣤⠀⠀⠘⢷⠘⣧⠹⣆⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠋⠀⢀⡰⠍⠀⠀⢀⣴⡟⠁⢀⣶⣿⣿⣿⣿⣿⣿⠟⣋⠴⢂⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡄⠀⠀⠀⠹⣦⠘⠀⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠿⠀⠀⢀⠀⠀⠀⢰⣾⠏⢀⣴⣾⣿⣿⡿⣻⡿⢛⣡⠞⣁⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⢿⣻⣽⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣄⢠⡀⠁⠘⢧⠀⠀⠹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠃⠀⠀⠀⠀⠠⠀⠀⠀⣿⠏⣴⣿⣿⣿⡿⣋⣾⠟⣱⠋⢂⣶⣿⣿⣿⣿⣿⣿⡿⣯⣿⣽⢿⡾⣟⣿⡽⣾⢽⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⠱⠀⠀⠈⢧⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⡋⠀⠠⢀⠏⠀⠀⠀⠀⠀⠀⢋⣾⣿⣿⣿⣿⣷⠟⡡⠞⢁⣼⣿⣿⣿⣿⣿⢟⣿⢿⣽⣟⡷⣯⣟⡿⣽⢯⡿⣽⢊⢷⣻⣟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣽⣿⣟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡂⠀⠀⠀⢫⠄⠀⠘⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⡈⠁⡌⠀⠀⠀⠀⠀⢀⣴⣿⣿⣿⣿⣿⠟⢁⢮⡱⣳⢾⣟⠋⣿⣿⡿⠃⣼⢯⡟⣾⡽⣳⠶⣭⠿⣽⣛⡞⣷⡈⢎⢷⡹⣯⣟⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⣿⣿⣿⣯⣿⣿⣿⣿⣿⣿⣟⣿⣿⣿⣿⣿⣿⣿⣷⡆⠀⠀⠀⠫⡄⠀⠈⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀⡔⠀⢈⠆⠀⠀⠀⣠⣾⣿⣿⣿⣿⢛⢋⡰⣋⢮⡱⢏⡾⠍⣰⣿⡿⠁⡼⣏⠷⡘⢼⣓⠧⡓⡜⣯⢳⣭⣛⢶⡁⢊⠶⣙⢧⡻⣷⣻⣯⣿⢿⣷⣿⢿⣯⣿⢿⣽⣾⢿⣳⣿⣽⡿⣿⣿⡿⣟⣾⣽⣻⢿⣿⣿⣿⣿⣧⠀⠀⠀⠄⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡧⠀⡘⠀⡀⠌⡐⠀⠀⣼⣿⣿⣿⣿⣿⠃⢀⠦⡓⢭⡲⢭⣓⠞⢠⣿⡟⢀⣼⢳⡍⠧⡑⠈⡝⠦⡑⡍⡖⣏⢶⡩⢞⠁⡄⠘⡱⢎⡵⢫⢷⣻⣽⣿⣻⣾⢿⣽⡾⣟⣯⡿⣟⣿⣳⣯⢿⡟⣿⣿⣟⡿⣞⡿⣯⣟⣿⢿⣿⣯⡀⠀⢀⠂⠀⠀⠟⡛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁⠠⠘⠰⢀⡘⠔⢀⣾⣿⣿⣿⣿⣿⠃⠀⡎⠵⣙⠶⣹⢣⡞⠁⣾⡿⢁⡾⣡⠗⡬⠑⢀⡆⡙⢆⠱⡘⠼⣘⠦⣝⢪⠀⣗⡀⠙⡼⣘⢏⡞⡵⣛⡾⣽⢯⣟⠾⡽⣭⢿⣹⢟⣷⡻⣎⢯⢳⡌⢿⣾⣟⣯⢳⡝⣺⠽⣻⣽⣻⡇⠀⠀⠀⠀⢰⡄⠸⡈⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠂⡍⡖⠀⠌⣠⣿⣿⣿⡿⣿⡿⠃⠀⡜⣌⠳⣬⢛⡴⢫⡜⢸⣿⠃⡼⣱⢃⠞⡠⢁⣾⠁⢹⠠⢃⢌⠣⡝⣚⢬⢣⠀⣿⣦⠀⠰⡩⠞⡼⣱⢫⡝⣧⢟⡾⢫⡕⣣⢏⢞⡹⢲⡝⡜⣊⠖⠲⠈⢿⣾⣻⠸⡜⣥⠫⣝⡷⣟⡧⠀⠀⠀⠀⠰⣃⠐⢠⠀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⢀⠱⢠⠄⠈⣴⣿⣿⣿⠟⣼⡿⢡⠃⡜⡰⢊⢷⡸⣍⢞⡣⠄⣿⣏⠴⣣⠧⣉⠎⢁⣼⣯⠇⠰⣉⠌⡄⠳⣌⠧⢎⢧⠀⣿⡽⣷⠀⠈⠽⡰⢣⠳⣜⢬⢫⡜⣳⠸⣑⢎⠎⡕⢣⠜⡰⢡⠎⣡⢃⠘⣿⣽⡆⢹⠰⣍⢲⡹⣟⣿⠀⠀⠀⢀⡃⠲⠀⢠⠂⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠄⡂⡜⢀⣾⣿⣿⣿⢋⣾⣟⢠⠃⡸⢰⡑⢯⡒⢷⣘⢮⡑⢸⣯⢏⡞⣡⠞⡤⠁⣾⠋⣾⠡⠐⡥⢂⠈⡱⣈⢮⡙⢦⠐⣏⠻⣿⣷⣤⠈⠱⣋⠳⣜⢪⡓⡼⣡⠳⣉⢎⢎⡙⠦⡙⡔⠣⢎⠔⡈⠆⢹⣯⣧⠈⡳⢌⠦⣱⣛⣮⠀⠀⠀⠆⡌⢡⠃⠄⢂⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠆⡑⢠⣾⣿⣿⡻⢃⣾⣿⠋⠆⠰⣁⠦⣙⠦⣏⠳⡜⢦⠁⣾⣏⠞⡴⢱⢊⠀⣼⢏⣾⣿⡅⠈⠴⠈⠐⢠⡑⢦⡙⣧⠈⣟⣦⠹⣿⣿⣄⠀⠉⠷⣌⠳⡜⣥⢃⠯⣜⣊⢦⡙⢦⠱⣌⠳⡌⢎⠱⡈⠄⢻⣿⡄⡹⢌⠲⡡⢞⡵⠀⠀⠀⡇⠄⡃⠥⢈⠄⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁⡈⠂⣴⣟⠫⡍⠰⢁⣾⣿⠃⡜⢀⠣⣐⠣⣍⠞⣌⢳⢩⢚⠀⡿⣌⠏⡼⢡⠂⠰⣿⡾⢿⣿⣇⠀⠓⡄⡄⠂⡜⢢⡝⡶⠐⣸⣿⣷⡜⢿⣿⣷⡠⠘⢌⡳⢍⠶⣩⠞⡴⣊⢦⡙⢆⡳⢌⠣⡜⣌⠲⡁⠎⠈⣿⣷⡱⢋⡒⠥⣫⠖⠀⠠⢌⡓⠌⡰⢁⠎⡐⠈⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⠀⢀⡾⢋⡌⢣⠌⢁⣿⡿⠁⡜⠀⢢⠑⡄⠳⣈⠞⡌⢎⠦⡉⢸⡗⡭⢊⡵⠁⣰⣶⣤⣤⣌⡙⠉⠷⠈⠄⢣⠐⣈⠳⣜⣳⠀⣿⣿⣿⣿⣦⡙⣿⣷⡀⠈⠼⣩⠞⣥⢛⡴⣍⠶⣉⠦⣑⠮⣑⢮⣐⢣⠱⡈⠅⠸⣷⡏⡵⢘⡐⢧⣻⠀⡡⢂⡝⢠⠐⡩⠐⢠⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠂⡰⢋⠔⠣⠘⢠⠃⣾⡟⠄⡐⢀⡘⠄⠣⢌⠱⠠⢎⡐⢣⡘⠁⣾⢸⡱⢋⠄⣘⣿⣿⣿⣿⣿⣿⣿⡦⠀⠁⢸⡄⢠⢋⢾⣱⠠⣿⣿⣿⣿⣿⣿⣌⢻⣿⣤⠈⢱⡚⢦⡛⣶⡩⢞⢥⠓⣜⢢⡍⠶⣨⢆⢣⡑⠌⡀⢿⣷⢡⠣⡘⠦⣏⠔⡁⠢⣜⠠⠂⢥⠃⠄⠂⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠅⢀⠰⠌⡌⢁⠊⠄⣸⡟⠀⡐⠀⡄⢢⢉⠒⡌⢂⠇⢢⠘⢤⠘⢰⠋⣦⡙⠂⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⡄⠘⢸⣧⠀⡚⣼⢳⠀⣿⣿⣿⣿⣿⣿⣿⡷⢈⢁⣤⠀⠍⡧⡝⢦⠻⣍⢮⡙⣤⠣⡜⢳⡰⢎⠲⣌⠒⡀⠘⣿⣎⠱⣀⠛⡼⢐⡈⠔⣌⠂⡉⠔⡨⢈⠄⣻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠃⠈⠐⠈⠆⢠⠂⠌⡐⢰⡿⠂⡐⠀⠰⡈⠆⡌⠒⡌⢌⡘⠤⡉⢆⠁⣼⣙⢦⠙⣠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀⠈⣿⡇⠘⡴⣻⠀⣹⣿⣿⣿⣿⣿⣿⣶⣾⣷⣿⡖⠀⠱⣩⠏⣝⢮⠳⡜⢤⠓⣍⠲⣱⢪⡑⢆⠣⡔⠁⢹⣎⠧⢠⠙⣞⠀⢎⠐⣌⠂⣁⠚⠄⢢⠀⢽⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠗⢀⣠⣶⠁⠌⠂⡌⢀⠂⢠⡿⠁⠀⠀⠀⣎⠡⡘⢠⠃⢌⠢⠄⡃⠜⡠⢀⡿⣜⠋⣰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡀⢿⣿⡆⢱⢻⠀⣸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣆⣄⠑⢮⡱⢎⠿⣜⠦⡙⢤⠛⣤⠓⡼⣈⠇⣆⠡⠀⢻⡜⡠⢙⡼⠈⠆⡌⣰⠡⠠⠘⡌⠠⠂⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⢛⣡⣴⣿⣿⡏⠐⢨⠀⠆⠠⠁⣼⠃⠀⠀⠀⡜⢄⠢⠑⡄⢊⠄⡃⠜⡠⢃⠔⠰⣯⠍⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣾⣿⣿⣀⠹⡇⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡦⡀⠹⢎⡝⣮⢧⠙⣢⠙⣤⠛⣔⢣⡚⢤⢃⠅⡈⠞⠤⡁⢞⡥⠘⡄⢲⠀⡅⢣⠐⡡⠁⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁⡈⠄⡘⢠⠁⢸⠇⠀⠀⠀⣼⠱⡈⠄⡡⠐⠌⢂⡘⠤⠑⠢⠀⣼⠇⠀⠀⠉⠙⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣄⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⣀⠉⢞⡬⣛⣇⠰⣉⠦⡹⢌⡖⡍⣆⠫⡔⡀⢈⠱⢈⠺⣄⠱⣌⠲⢁⠰⢀⠇⠄⡡⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠠⠐⢡⡘⠤⢀⡏⠀⠀⠀⣸⡱⢂⡁⠂⠄⡑⠈⡄⠰⡈⢡⠁⠐⡟⢀⣶⣤⣄⣀⠀⠀⠈⠙⠿⣿⣿⡙⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⢀⣸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡈⠲⡝⡾⣇⠈⡖⣩⠲⣌⠳⣌⢳⣜⡰⠀⠄⠊⣜⣣⢘⡧⡘⠄⢂⠡⢊⡐⠐⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⠠⣉⠐⢆⠂⡼⠀⠀⠀⣼⢣⢇⠃⠠⢈⠐⠠⠁⢄⠃⠤⠁⠌⡀⢡⣿⣿⣿⣿⣿⣿⣷⣦⣄⠀⠀⠙⠻⢷⣬⣙⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠿⣿⣿⣿⣿⠿⠟⠛⠛⠁⠀⠘⠵⣻⡄⠸⣄⠳⣌⠳⣌⠧⣿⢰⢃⠘⡀⠰⣧⢸⠲⡍⠂⡌⢐⡃⢄⡉⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⢂⠤⡙⡄⢰⠁⠀⠀⢬⡷⣩⠎⡄⠁⠄⡈⠄⡁⢂⠌⠄⣉⠰⠀⢠⣿⡟⠉⠉⠉⠉⠀⠁⠈⠁⠀⠀⠀⠀⠈⣹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⢡⣶⠾⠟⠋⠉⠀⠀⠀⢀⣀⣀⣠⣤⣤⡀⠓⠋⡀⢨⠓⣌⠳⣌⢳⡌⢠⡋⠄⠀⠐⣽⢸⠣⡅⢃⠐⢂⡅⢂⠰⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⡌⢂⡜⠀⠃⠀⠀⡜⢲⡝⠂⣁⡀⠈⡀⠄⡐⠐⡠⢈⠂⢄⠒⠀⠈⣿⣷⣀⣠⣤⣤⣶⣶⣶⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⠁⠀⠀⠀⠀⠀⠶⠾⣿⣿⣿⣿⣿⣿⣿⣿⠄⠀⠱⠀⡹⢄⣛⠈⣁⡘⢂⣇⠈⠆⠀⢘⣯⠃⡜⣀⠊⢄⡒⠈⡔⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⡐⢌⠒⠆⡈⠀⢠⠘⣌⢻⠌⣸⣿⠇⠀⢀⠐⠠⢁⡐⠠⠌⠂⢌⠀⠀⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣦⣤⣄⣀⠀⠀⠀⠉⠙⠻⢿⣿⡏⠀⠐⡀⠅⢀⠣⠎⠐⣿⣧⡀⢺⡀⠌⢡⠘⣮⠑⡌⠤⠈⡔⢨⢁⠰⠈⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⡰⢈⢜⡂⠀⢀⡎⠴⡨⡇⢰⣿⣿⡁⠀⠀⠌⡐⠠⠀⡡⠘⡈⠤⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣦⣄⣀⣠⣿⡟⠀⡈⠄⡐⠌⡄⢀⠩⠀⢿⣿⡄⠠⡇⠈⠄⠢⣝⠢⠜⡠⢃⡐⢃⠄⢊⠁⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⠠⡐⠡⡸⠀⢠⢃⡜⢰⠱⠇⣼⣿⣿⠄⠀⠈⠄⠠⠁⠠⢂⠡⡐⠐⡀⢠⣶⡎⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠠⠀⢂⠄⠃⠀⣬⣂⠀⢼⣿⣧⠀⢳⠈⠌⢡⢘⡇⡱⠄⡃⠌⡆⡘⠤⠁⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁⡰⢁⠣⡅⡘⢄⠺⡄⢣⠛⢰⣿⣿⣿⠀⠀⠌⠠⠁⣴⣆⠁⢂⠔⠡⠀⣿⣿⣿⡸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠀⠀⡅⠀⢠⣄⡀⢈⣿⣿⣄⠈⣿⣿⣄⠈⠧⡘⢀⠎⡖⢱⡈⠔⡡⢚⡀⢆⡁⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡯⠀⡔⢡⢊⡵⢈⠜⣸⠐⣣⠁⣾⣿⣿⠿⠀⠀⠌⢀⣾⣿⡏⠀⠌⡠⢁⠀⠻⣿⣿⣷⡜⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠿⠿⠿⠿⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⢋⣄⠀⡘⠀⠠⠘⢻⡻⣿⣿⣿⣿⠆⣿⣿⣧⠀⢃⠆⡡⢂⢝⠢⠜⡠⢁⠧⡈⢄⠒⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠰⡈⢆⣩⠆⣅⠚⣤⠙⡄⠸⣽⣿⣿⠁⠀⠀⣠⣿⣿⡿⠰⠀⢂⡁⢂⠀⣆⡈⠻⣿⣿⣦⡹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⣻⢖⡶⣹⢖⡶⣤⠦⠄⣹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣡⣿⡟⠠⠁⣀⠃⢀⢸⣿⣿⣿⣿⣿⡇⢿⣿⣿⡄⠈⢆⠡⢂⠌⣇⠓⠤⡉⢖⠡⠊⡌⢈⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠅⢢⠑⡌⡲⢌⡄⣋⠴⣉⠀⣩⣿⣿⡏⠀⢀⣴⣿⣿⣿⢁⣿⡅⢀⠒⠠⢀⣿⣷⣆⡈⠛⠿⠛⠛⠻⠿⠿⠿⢿⣿⣿⣿⣿⣷⡈⠻⣜⣧⣻⡜⡧⠋⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⣋⣴⣿⡿⠀⠀⠐⠤⠁⣾⣇⢹⣿⡿⢿⣿⣿⢸⣿⣿⣯⠀⢨⠂⡅⢊⡼⡘⠤⡑⢎⠰⢡⠘⡀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⢢⡉⠴⣙⠤⡘⢤⡓⠌⢠⣾⣿⣿⠀⣠⣾⣿⣿⣿⠇⣾⣿⣯⠀⠌⡡⠠⣿⣿⣿⣿⣦⣄⣀⠀⠂⠀⠀⠀⠀⠀⠀⠀⠉⠛⢿⣷⣬⣌⣁⣭⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⣋⣥⣾⣿⣿⣿⢃⡆⠀⢩⢀⣾⣿⣿⡌⢿⣿⣎⣿⣿⡄⣿⣿⣿⡆⢀⠳⣸⠠⡹⢄⠣⡘⢼⢀⠣⡘⡀⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡷⢀⠣⡘⢔⡫⢰⡉⢦⠍⠂⣸⣿⣿⡿⠁⣾⡟⣽⣿⡟⣰⣿⣿⣿⡀⢂⠡⢐⣿⣿⣿⣿⣿⣿⣿⣷⣤⠀⠀⠀⠋⠀⠀⠂⠀⠀⣸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠋⣁⣀⣀⣉⣙⣛⣻⣿⣧⣞⠀⠨⢀⣾⣿⣿⣿⣿⡘⣿⣿⡜⣿⣷⠸⣿⣿⣷⡀⠱⢸⠅⣟⠄⢣⠑⢮⠠⢃⠴⠁⢺⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⢈⣒⣉⠆⠛⣀⣈⣐⢃⣴⣿⣿⣿⠅⢘⣿⣽⢿⡿⢠⣿⣿⣿⣿⣧⠀⠆⢈⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⢢⣤⡠⢤⣤⣤⡴⢿⣿⣿⣿⣿⣿⣿⡿⠿⣛⣭⠇⣠⡴⣹⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⢠⣾⣿⣿⣿⣿⣿⣧⢹⣿⣷⣽⣿⡆⢿⣿⣿⣷⡄⢚⣉⣈⠋⠠⣍⣺⠀⠉⠦⣉⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠠⠚⣃⣋⣰⣿⣿⣿⣟⣡⣿⣿⣿⣿⣿⣿⣿⡤⣶⢀⣾⣿⣿⣿⣿⣿⣂⠨⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣬⠛⡓⢦⡙⠻⣿⣷⣬⣍⣛⣭⣵⣶⣾⡿⢋⣡⠞⣉⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⡆⢩⣦⣛⣿⣿⣾⣿⣿⣿⣧⡙⢿⣿⣯⡑⣈⣑⣋⠳⢢⡀⠈⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⡄⢰⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡔⡌⢿⣽⣿⣿⣿⣿⣿⣿⠄⠠⣿⣿⣿⣿⣿⣿⣿⣿⡿⢃⡿⣷⣶⠉⢢⡽⣷⣬⣙⠻⢿⣿⣿⠟⢋⣡⣴⢟⣡⡾⣽⣦⢿⣝⡻⣿⣿⣿⣿⣿⣿⠛⢀⣾⣿⣿⣿⣿⣿⣿⣿⡿⠻⠉⣄⣾⣿⣿⣿⣿⣿⣿⣿⣿⣼⣿⣿⣷⡘⣿⣿⡗⠀⢷⡀⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⣇⢸⡁⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣮⢽⠃⠙⢿⣿⣿⣿⣷⠀⢿⣿⣿⣿⣿⡿⠛⠁⣶⢏⣼⣿⣿⣷⣦⣿⣿⣿⣿⡗⢢⡙⣡⢾⣿⣿⣿⣿⣿⣿⣿⣿⣷⣟⣿⡈⠻⠿⣿⣿⣿⣷⣾⣿⣿⣿⣿⣿⡿⠟⠡⡄⣊⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡗⠠⣸⠇⢹⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⣿⠇⠸⣷⡀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣀⠸⣦⣈⠻⢿⣿⣧⣿⣿⣿⣿⣿⠀⠘⡇⢻⣼⣿⣿⣿⣿⣿⣿⣿⣿⠿⢿⣦⠙⢹⠏⣿⣿⣿⣿⣿⣿⠟⢿⣿⣿⣿⠀⠳⣀⢻⣿⣿⣿⣿⣿⣿⣿⠿⢋⣤⡞⢠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠀⣰⡿⢀⢸⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⣿⡏⠀⠀⠙⢷⡄⠹⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣟⠀⠈⠙⢷⣆⡙⢿⣿⣿⣿⣿⣿⠁⢠⣆⠸⣿⣿⣿⣿⣿⣿⣿⣿⣿⠗⣀⣄⣤⣤⣌⡐⢼⣿⣿⡿⠁⢰⡦⢙⠿⡿⢀⣃⠈⣿⣿⣿⣿⣿⣿⠛⣡⡶⠟⠁⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠋⢀⣼⠟⠀⠠⠈⣿⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠈⠛⢷⣄⡙⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡗⠀⠀⠀⠀⠙⢷⣆⠹⣿⣿⡿⠃⠄⣸⡆⠀⢻⣿⣿⣿⣿⣿⣿⡟⠁⢰⡿⣯⢿⡽⣯⢿⡀⢻⣿⠁⢠⣧⣶⡏⣰⠁⢸⣇⠀⠈⣿⣿⣿⠏⢀⣶⠟⠁⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠉⣀⣴⠿⠉⠀⠀⠀⠁⠸⣿⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⡿⠁⠀⠀⠀⠀⠀⠀⠀⠉⠻⢶⣄⡙⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠙⣷⡌⠻⣧⠐⣰⣿⣷⠀⠈⢿⣿⣿⣿⡿⠋⡁⠔⢺⠿⣽⢫⡽⣯⣟⠲⠄⡙⠿⣦⣍⡛⣰⠏⠀⣿⣿⡄⠀⢨⡿⠃⣴⡟⠁⠀⠀⠀⠀⠀⠀⠙⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠏⢁⣁⣴⠞⠋⠁⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠛⠷⣦⣄⡉⠛⠻⢿⣿⣿⣿⣿⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣄⠁⣰⣾⣿⣿⣧⠀⠈⠉⢉⣀⣴⡾⣷⡀⠈⢻⣓⣯⣙⡳⠃⣀⣶⣌⣐⠠⢠⡉⢀⠀⣶⡿⣿⣿⣄⠘⠁⣼⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠐⢯⢿⣿⡿⡿⠻⠛⢉⣀⣤⡾⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿
+⣿⣿⣿⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠙⠻⠶⣤⡈⠉⠙⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⢁⠂⠀⣿⠀⠙⣿⣿⣽⣿⣿⣿⣷⣾⡿⣷⣻⢷⣻⠀⢠⣟⡾⣽⢣⠀⣾⣿⣿⣻⣷⣶⣶⣿⣯⣿⣷⢿⣿⡟⠀⢸⠃⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⢀⣠⡴⠚⠋⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣿⣿⣿⣿
+⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠙⠲⢍⡖⣆⠦⠤⠤⠤⢠⣄⡌⣤⢤⣤⣙⠖⢠⣿⣿⣻⣾⣿⣿⣿⣷⣿⣳⣽⣻⣿⠇⢸⣞⡽⣽⢫⠐⠿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⡃⠐⣮⣤⢤⠤⣤⠤⣄⠤⠤⢤⢒⡤⢎⡜⠣⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿
+⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠓⠉⠓⠾⠜⠻⠞⠙⠁⣰⣾⣿⣿⣽⣿⣿⣿⣿⣿⣷⣿⣞⣿⣿⠀⢸⣎⣟⢮⣏⠀⢺⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⣀⠙⠋⠛⠲⠛⠜⠉⠛⠈⠁⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿
+⣿⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢺⠀⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⣿⠀⢸⡮⣝⡞⡼⠀⣸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⢸⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿
+⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀⡿⣼⡹⣜⡱⠂⣽⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡅⠈⢸⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣿
+⠇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⡿⢃⠀⡿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⢠⢳⢧⡝⢦⡹⡁⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⠄⢈⠻⣿⣧⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡰⢻⣿⣿⠇⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⢰⣋⢶⡹⢎⡵⣁⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⣝⢿⣿⣿⡄⠈⠰⣿⣿⣿⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣰⣿⣿⡘⣿⠅⠠⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠸⡜⡶⣩⢳⢎⡵⢸⣿⣿⣿⡏⠹⠿⠿⠟⠻⠛⡟⠻⠟⠀⣿⣿⣷⡀⠠⠙⣿⡏⣸⣿⣶⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿⣿⣿⡇⠝⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠂⢼⡹⣱⢏⡾⣘⠖⠘⣿⣿⣿⣿⣦⣉⣉⣭⣭⣤⣭⣤⣈⣸⣿⣿⣿⣧⠀⠘⢿⢀⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⠀⠊⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⢧⡛⡽⢪⠵⣩⠞⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠹⣿⣿⣿⣿⣆⠈⠀⢸⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣾⣿⣿⣿⣿⣿⣿⣿⡿⠂⠀⢸⣿⣿⣿⣟⡳⢯⣛⠿⣻⢿⡿⣿⠻⣟⣿⣿⣿⣿⠀⣎⠵⣩⢳⡙⢦⢫⠄⢻⣿⣿⣿⣿⢿⣻⡟⣿⢫⠟⡵⢪⢇⣹⣿⣿⣿⣿⡇⢈⠹⣿⣿⣿⣿⣿⣿⣿⣷⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⡆⠀⣠⣾⢿⣿⡗⢮⡑⢣⠘⡬⢑⠮⡑⢎⡱⢎⡞⡽⢹⡃⠀⡎⢧⠣⢧⣝⢣⢏⠆⡸⣏⠿⣱⢎⢳⡘⡜⢢⢋⡜⢌⡑⢊⠴⢻⣿⣿⣿⡇⠈⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
+
+</body>
+</html>
@@ -16,6 +16,28 @@ services:
      - traefik.enable=true
      - "traefik.docker.network=traefik-proxy"

+      # Prod Router
+      - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
+      - "traefik.http.routers.metube.entrypoints=websecure"
+      - "traefik.http.routers.metube.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube.service=metube"
+      - "traefik.http.routers.metube.tls=true"
+      - "traefik.http.services.metube.loadbalancer.server.port=8081"
+
+      # Local Router
+      - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`) || Host(`metube.internal`)"
+      - "traefik.http.routers.metube-local.entrypoints=websecure"
+      - "traefik.http.routers.metube-local.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-local.service=metube"
+      - "traefik.http.routers.metube-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
+      - "traefik.http.routers.metube-dev.entrypoints=websecure"
+      - "traefik.http.routers.metube-dev.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-dev.service=metube"
+      - "traefik.http.routers.metube-dev.tls=true"
+
    networks:
      - traefik-proxy
 networks:
@@ -28,6 +28,29 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
+      - "traefik.http.routers.n8n.entrypoints=websecure"
+      - "traefik.http.routers.n8n.middlewares=security-headers@file"
+      - "traefik.http.routers.n8n.service=n8n"
+      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+      # Local Router
+      - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`) || Host(`n8n.internal`)"
+      - "traefik.http.routers.n8n-local.entrypoints=websecure"
+      - "traefik.http.routers.n8n-local.middlewares=security-headers@file"
+      - "traefik.http.routers.n8n-local.service=n8n"
+      - "traefik.http.routers.n8n-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.n8n-dev.rule=Host(`n8n.gigaforust.internal`)"
+      - "traefik.http.routers.n8n-dev.entrypoints=websecure"
+      - "traefik.http.routers.n8n-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.n8n-dev.service=n8n"
+      - "traefik.http.routers.n8n-dev.tls=true"
+
      - glance.name=n8n
      - glance.icon=si:n8n
      - glance.url=https://n8n.forust.xyz/
@@ -18,13 +18,40 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router - DISABLED per user request
+      # - "traefik.http.routers.nextcloud-aio.rule=Host(`nextcloud-aio.forust.xyz`)"
+      # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
+      # - "traefik.http.routers.nextcloud-aio.middlewares=security-headers"
+      # - "traefik.http.routers.nextcloud-aio.service=nextcloud-aio"
+      # - "traefik.http.routers.nextcloud-aio.tls=true"
+      - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
+      - "traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https"
+      - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"
+
+      # - "traefik.http.services.nextcloud-aio.loadbalancer.serverstransport=insecureTransport@file"
+
+      # Local Router
+      - "traefik.http.routers.nextcloud-aio-local.rule=Host(`nextcloud-aio.workstation.internal`) || Host(`nextcloud-aio.internal`)"
+      - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-aio-local.middlewares=security-headers@file"
+      - "traefik.http.routers.nextcloud-aio-local.service=nextcloud-aio"
+      - "traefik.http.routers.nextcloud-aio-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.nextcloud-aio-dev.rule=Host(`nextcloud-aio.gigaforust.internal`)"
+      - "traefik.http.routers.nextcloud-aio-dev.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-aio-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.nextcloud-aio-dev.service=nextcloud-aio"
+      - "traefik.http.routers.nextcloud-aio-dev.tls=true"
+
      - glance.name=Nextcloud
      # - glance.icon=si:nextcloud
      - glance.url=https://nextcloud.forust.xyz/
      - glance.description=Nextcloud is a suite of client-server software for creating and using file hosting services.

-
-    environment: # Is needed when using any of the options below
+    environment:
+      # Is needed when using any of the options below
      AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
      APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
@@ -53,6 +80,7 @@ networks:
  nextcloud-aio:
    driver: bridge
    external: false
-volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
+volumes:
+  # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
@@ -0,0 +1 @@
+PENPOT_SECRET_KEY=somesecretfdsfsdfds
@@ -0,0 +1,295 @@
+## Common flags:
+# demo-users
+# email-verification
+# log-emails
+# log-invitation-tokens
+# login-with-github
+# login-with-gitlab
+# login-with-google
+# login-with-ldap
+# login-with-oidc
+# login-with-password
+# prepl-server
+# registration
+# secure-session-cookies
+# smtp
+# smtp-debug
+# telemetry
+# webhooks
+##
+## You can read more about all available flags and other
+## environment variables here:
+## https://help.penpot.app/technical-guide/configuration/#penpot-configuration
+#
+# WARNING: if you're exposing Penpot to the internet, you should remove the flags
+# 'disable-secure-session-cookies' and 'disable-email-verification'
+x-flags: &penpot-flags
+  PENPOT_FLAGS: disable-email-verification enable-prepl-server disable-secure-session-cookies login-with-github
+
+x-uri: &penpot-public-uri
+  PENPOT_PUBLIC_URI: http://localhost:9001
+
+x-body-size:
+  # Max body size (30MiB); Used for plain requests, should never be
+  # greater than multi-part size
+  &penpot-http-body-size
+  PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 31457280
+
+  # Max multipart body size (350MiB)
+  PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
+
+## Penpot SECRET KEY. It serves as a master key from which other keys for subsystems
+## (eg http sessions, or invitations) are derived.
+##
+## We recommend to use a trully randomly generated
+## 512 bits base64 encoded string here. You can generate one with:
+##
+## python3 -c "import secrets; print(secrets.token_urlsafe(64))"
+x-secret-key: &penpot-secret-key
+  PENPOT_SECRET_KEY: ${PENPOT_SECRET_KEY}
+
+networks:
+  penpot:
+  traefik-proxy:
+    external: true
+
+volumes:
+  penpot_postgres_v15:
+  penpot_assets:
+  penpot_traefik:
+    # penpot_minio:
+
+services:
+  ## Traefik service declaration example. Consider using it if you are going to expose
+  ## penpot to the internet, or a different host than `localhost`.
+
+  # traefik:
+  #   image: traefik:v3.3
+  #   networks:
+  #     - penpot
+  #   command:
+  #     - "--api.insecure=true"
+  #     - "--entryPoints.web.address=:80"
+  #     - "--providers.docker=true"
+  #     - "--providers.docker.exposedbydefault=false"
+  #     - "--entryPoints.websecure.address=:443"
+  #     - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+  #     - "--certificatesresolvers.letsencrypt.acme.email=<EMAIL_ADDRESS>"
+  #     - "--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json"
+  #   volumes:
+  #     - "penpot_traefik:/traefik"
+  #     - "/var/run/docker.sock:/var/run/docker.sock"
+  #   ports:
+  #     - "80:80"
+  #     - "443:443"
+
+  penpot-frontend:
+    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
+    restart: always
+    ports:
+      - 9001:8080
+
+    volumes:
+      - penpot_assets:/opt/data/assets
+
+    depends_on:
+      - penpot-backend
+      - penpot-exporter
+
+    networks:
+      - penpot
+      - traefik-proxy
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
+      - "traefik.http.routers.penpot.entrypoints=websecure"
+      - "traefik.http.routers.penpot.middlewares=security-headers@file"
+      - "traefik.http.routers.penpot.service=penpot"
+      - "traefik.http.routers.penpot.tls=true"
+      - "traefik.http.services.penpot.loadbalancer.server.port=8080"
+
+      # Local Router
+      - "traefik.http.routers.penpot-local.rule=Host(`penpot.workstation.internal`) || Host(`penpot.internal`)"
+      - "traefik.http.routers.penpot-local.entrypoints=websecure"
+      - "traefik.http.routers.penpot-local.middlewares=security-headers@file"
+      - "traefik.http.routers.penpot-local.service=penpot"
+      - "traefik.http.routers.penpot-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.penpot-dev.rule=Host(`penpot.gigaforust.internal`)"
+      - "traefik.http.routers.penpot-dev.entrypoints=websecure"
+      - "traefik.http.routers.penpot-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.penpot-dev.service=penpot"
+      - "traefik.http.routers.penpot-dev.tls=true"
+
+    environment:
+      <<: [ *penpot-flags, *penpot-http-body-size ]
+
+  penpot-backend:
+    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
+    restart: always
+
+    volumes:
+      - penpot_assets:/opt/data/assets
+
+    depends_on:
+      penpot-postgres:
+        condition: service_healthy
+      penpot-valkey:
+        condition: service_healthy
+
+    networks:
+      - penpot
+
+    ## Configuration envronment variables for the backend container.
+
+    environment:
+      <<: [ *penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key ]
+
+      ## The PREPL host. Mainly used for external programatic access to penpot backend
+      ## (example: admin). By default it will listen on `localhost` but if you are going to use
+      ## the `admin`, you will need to uncomment this and set the host to `0.0.0.0`.
+
+      # PENPOT_PREPL_HOST: 0.0.0.0
+
+      ## Database connection parameters. Don't touch them unless you are using custom
+      ## postgresql connection parameters.
+
+      PENPOT_DATABASE_URI: postgresql://penpot-postgres/penpot
+      PENPOT_DATABASE_USERNAME: penpot
+      PENPOT_DATABASE_PASSWORD: penpot
+
+      ## Valkey (or previously redis) is used for the websockets notifications. Don't touch
+      ## unless the valkey container has different parameters or different name.
+
+      PENPOT_REDIS_URI: redis://penpot-valkey/0
+
+      ## Default configuration for assets storage: using filesystem based with all files
+      ## stored in a docker volume.
+
+      PENPOT_ASSETS_STORAGE_BACKEND: assets-fs
+      PENPOT_STORAGE_ASSETS_FS_DIRECTORY: /opt/data/assets
+
+      ## Also can be configured to to use a S3 compatible storage
+      ## service like MiniIO. Look below for minio service setup.
+
+      # AWS_ACCESS_KEY_ID: <KEY_ID>
+      # AWS_SECRET_ACCESS_KEY: <ACCESS_KEY>
+      # PENPOT_ASSETS_STORAGE_BACKEND: assets-s3
+      # PENPOT_STORAGE_ASSETS_S3_ENDPOINT: http://penpot-minio:9000
+      # PENPOT_STORAGE_ASSETS_S3_BUCKET: <BUKET_NAME>
+
+      ## Telemetry. When enabled, a periodical process will send anonymous data about this
+      ## instance. Telemetry data will enable us to learn how the application is used,
+      ## based on real scenarios. If you want to help us, please leave it enabled. You can
+      ## audit what data we send with the code available on github.
+
+      PENPOT_TELEMETRY_ENABLED: true
+      PENPOT_TELEMETRY_REFERER: compose
+      # PENPOT_SMTP_DEFAULT_FROM: no-reply@example.com
+      # PENPOT_SMTP_DEFAULT_REPLY_TO: no-reply@example.com
+      # PENPOT_SMTP_HOST: penpot-mailcatch
+      # PENPOT_SMTP_PORT: 1025
+      # PENPOT_SMTP_USERNAME:
+      # PENPOT_SMTP_PASSWORD:
+      # PENPOT_SMTP_TLS: false
+      # PENPOT_SMTP_SSL: false
+
+  penpot-exporter:
+    image: "penpotapp/exporter:${PENPOT_VERSION:-latest}"
+    restart: always
+
+    depends_on:
+      penpot-valkey:
+        condition: service_healthy
+
+    networks:
+      - penpot
+
+    environment:
+      <<: [ *penpot-secret-key ]
+      # Don't touch it; this uses an internal docker network to
+      # communicate with the frontend.
+      PENPOT_PUBLIC_URI: http://penpot-frontend:8080
+
+      ## Valkey (or previously Redis) is used for the websockets notifications.
+      PENPOT_REDIS_URI: redis://penpot-valkey/0
+
+  penpot-postgres:
+    image: "postgres:15"
+    restart: always
+    stop_signal: SIGINT
+
+    healthcheck:
+      test: [ "CMD-SHELL", "pg_isready -U penpot" ]
+      interval: 2s
+      timeout: 10s
+      retries: 5
+      start_period: 2s
+
+    volumes:
+      - penpot_postgres_v15:/var/lib/postgresql/data
+
+    networks:
+      - penpot
+
+    environment:
+      - POSTGRES_INITDB_ARGS=--data-checksums
+      - POSTGRES_DB=penpot
+      - POSTGRES_USER=penpot
+      - POSTGRES_PASSWORD=penpot
+
+  penpot-valkey:
+    image: valkey/valkey:8.1
+    restart: always
+
+    healthcheck:
+      test: [ "CMD-SHELL", "valkey-cli ping | grep PONG" ]
+      interval: 1s
+      timeout: 3s
+      retries: 5
+      start_period: 3s
+
+    networks:
+      - penpot
+
+    environment:
+      # You can increase the max memory size if you have sufficient resources,
+      # although this should not be necessary.
+      - VALKEY_EXTRA_FLAGS=--maxmemory 128mb --maxmemory-policy volatile-lfu
+  ## A mailcatch service, used as temporal SMTP server. You can access via HTTP to the
+  ## port 1080 for read all emails the penpot platform has sent. Should be only used as a
+  ## temporal solution while no real SMTP provider is configured.
+
+  # penpot-mailcatch:
+  #   image: sj26/mailcatcher:latest
+  #   restart: always
+  #   expose:
+  #     - '1025'
+  #   ports:
+  #     - "1080:1080"
+  #   networks:
+  #     - penpot
+
+  ## Example configuration of MiniIO (S3 compatible object storage service); If you don't
+  ## have preference, then just use filesystem, this is here just for the completeness.
+
+  # minio:
+  #   image: "minio/minio:latest"
+  #   command: minio server /mnt/data --console-address ":9001"
+  #   restart: always
+  #
+  #   volumes:
+  #     - "penpot_minio:/mnt/data"
+  #
+  #   environment:
+  #     - MINIO_ROOT_USER=minioadmin
+  #     - MINIO_ROOT_PASSWORD=minioadmin
+  #
+  #   ports:
+  #     - 9000:9000
+  #     - 9001:9001
@@ -1,7 +1,7 @@
 services:
  portainer:
    container_name: portainer
-    image: portainer/portainer-ce:lts
+    image: portainer/portainer-ce:latest
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
@@ -14,8 +14,32 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
+      - "traefik.http.routers.portainer.entrypoints=websecure"
+      - "traefik.http.routers.portainer.middlewares=security-headers@file"
+      - "traefik.http.routers.portainer.service=portainer"
+      - "traefik.http.routers.portainer.tls=true"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9443"
+      - "traefik.http.services.portainer.loadbalancer.server.scheme=https"
+      - "traefik.http.services.portainer.loadbalancer.serverstransport=insecureTransport@file"
+
+      # Local Router
+      - "traefik.http.routers.portainer-local.rule=Host(`portainer.workstation.internal`) || Host(`portainer.internal`)"
+      - "traefik.http.routers.portainer-local.entrypoints=websecure"
+      - "traefik.http.routers.portainer-local.middlewares=security-headers@file"
+      - "traefik.http.routers.portainer-local.service=portainer"
+      - "traefik.http.routers.portainer-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.portainer-dev.rule=Host(`portainer.gigaforust.internal`)"
+      - "traefik.http.routers.portainer-dev.entrypoints=websecure"
+      - "traefik.http.routers.portainer-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.portainer-dev.service=portainer"
+      - "traefik.http.routers.portainer-dev.tls=true"
+
      - glance.name=Portainer
-      # - glance.icon=si:portainer
      - glance.url=https://portainer.forust.xyz/
      - glance.description=Portainer is a lightweight management UI which allows you to easily manage your Docker environments.

@@ -0,0 +1,46 @@
+services:
+  termix:
+    image: ghcr.io/lukegus/termix:latest
+    container_name: termix
+    restart: unless-stopped
+    ports:
+      - "3331:8080"
+    volumes:
+      - ./termix-data:/app/data
+    environment:
+      PORT: "8080"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
+      - "traefik.http.routers.termix.entrypoints=websecure"
+      - "traefik.http.routers.termix.middlewares=security-headers@file"
+      - "traefik.http.routers.termix.service=termix"
+      - "traefik.http.routers.termix.tls=true"
+      - "traefik.http.services.termix.loadbalancer.server.port=8080"
+
+      # Local Router
+      - "traefik.http.routers.termix-local.rule=Host(`termix.workstation.internal`) || Host(`termix.internal`)"
+      - "traefik.http.routers.termix-local.entrypoints=websecure"
+      - "traefik.http.routers.termix-local.middlewares=security-headers@file"
+      - "traefik.http.routers.termix-local.service=termix"
+      - "traefik.http.routers.termix-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.termix-dev.rule=Host(`termix.gigaforust.internal`)"
+      - "traefik.http.routers.termix-dev.entrypoints=websecure"
+      - "traefik.http.routers.termix-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.termix-dev.service=termix"
+      - "traefik.http.routers.termix-dev.tls=true"
+    networks:
+      - traefik-proxy
+
+networks:
+  traefik-proxy:
+    external: true
+
+volumes:
+  termix-data:
+    driver: local
@@ -1,11 +1,11 @@
 services:
  traefik:
-    image: traefik:v3.5
+    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    command:
      # API
-      - "--api.insecure=false"
+      - "--api.insecure=true"
      - "--api.dashboard=true"

      # Providers
@@ -43,6 +43,28 @@ services:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router (Dashboard) - DISABLED per user request
+      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
+      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
+      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
+      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
+      # - "traefik.http.routers.traefik-dashboard.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
+      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth@file,security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
+      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard-dev.tls=true"
+
      - glance.name=Traefik
      - glance.url=https://traefik.forust.xyz/
      - glance.description=Traefik is a modern reverse proxy and load balancer
@@ -0,0 +1,328 @@
+http:
+  routers:
+    # Traefik Dashboard (ADMIN, local only)
+    traefik-dashboard:
+      rule: "Host(`traefik.workstation`)"
+      entryPoints:
+        - websecure
+      service: api@internal
+      middlewares:
+        # - auth
+        - security-headers
+      tls: {}
+
+    # Nextcloud AIO Interface (ADMIN, local is better)
+    nextcloud-aio:
+      rule: "Host(`nextcloud-aio.workstation`)"
+      entryPoints:
+        - websecure
+      service: nextcloud-aio
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Termix (public (account required))
+    termix:
+      rule: "Host(`termix.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: termix
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # MeTube
+    metube:
+      rule: "Host(`metube.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: metube
+      middlewares:
+        - metube-auth
+        - security-headers
+      tls: {}
+    
+    # Portainer (public (account required))
+    portainer:
+      rule: "Host(`portainer.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: portainer
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Uptime Kuma
+    uptime-kuma:
+      rule: "Host(`uptime.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: uptime-kuma
+      tls: {}
+
+    # AdGuard Home (public (account required))
+    adguard:
+      rule: "Host(`adguard.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: adguard
+      middlewares:
+        - security-headers
+      tls: {}
+
+
+    # Nextcloud Main (public (account required))
+    nextcloud:
+      rule: "Host(`nextcloud.forust.xyz`)"
+      entrypoints:
+        - websecure
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Dockmon (public (account required))
+    dockmon:
+      rule: "Host(`dockmon.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: dockmon
+      middlewares:
+        # - dockmon-auth
+        - security-headers
+      tls: {}
+
+    # Gitea (public (account required))
+    gitea:
+      rule: "Host(`gitea.forust.xyz`)"
+      entryPoints:
+        - websecure
+        - ssh
+      service: gitea
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # # Glance (local only)
+    # glance:
+    #   rule: "Host(`glance.workstation`)"
+    #   entryPoints:
+    #     - websecure
+    #   service: glance
+    #   middlewares:
+    #     - security-headers
+    #   tls: {}
+
+    # Watercrawl (local only)
+    watercrawl:
+      rule: "Host(`watercrawl.workstation`)"
+      entryPoints:
+        - websecure
+      service: watercrawl
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # N8N (local only)
+    n8n:
+      rule: "Host(`n8n.workstation`)"
+      entryPoints:
+        - websecure
+      service: n8n
+      middlewares:
+        - security-headers
+      tls: {}
+
+
+  services:
+    # Portainer
+    portainer:
+      loadBalancer:
+        servers:
+          - url: "https://portainer:9443"
+        serversTransport: insecureTransport
+
+    # AdGuard Home
+    adguard:
+      loadBalancer:
+        servers:
+          - url: "http://adguardhome:3000"
+
+    # Nextcloud AIO Interface
+    nextcloud-aio:
+      loadBalancer:
+        servers:
+          - url: "https://nextcloud-aio-mastercontainer:8080"
+        serversTransport: insecureTransport
+
+    # Nextcloud Main
+    nextcloud:
+      loadBalancer:
+        servers:
+          - url: "http://nextcloud-aio-apache:11000"
+
+    # Uptime Kuma
+    uptime-kuma:
+      loadBalancer:
+        servers:
+          - url: "http://uptime-kuma:3001"
+
+    # Termix
+    termix:
+      loadBalancer:
+        servers:
+          - url: "http://termix:8080"
+
+    # Dockmon
+    dockmon:
+      loadBalancer:
+        servers:
+          - url: "https://dockmon:443"
+        serversTransport: insecureTransport
+
+    # # Glance
+    # glance:
+    #   loadBalancer:
+    #     servers:
+    #       - url: "http://glance:8080"
+
+    # Watercrawl
+    watercrawl:
+      loadBalancer:
+        servers:
+          - url: "http://nginx:80"
+
+    # N8N
+    n8n:
+      loadBalancer:
+        servers:
+          - url: "http://n8n:5678"
+
+    # Gitea
+    gitea:
+      loadBalancer:
+        servers:
+          - url: "http://gitea:3000"
+    # MeTube
+    metube:
+      loadBalancer:
+        servers:
+          - url: "http://metube:8081"
+
+  serversTransports:
+    insecureTransport:
+      insecureSkipVerify: true
+
+  middlewares:
+    # HTTPS Redirect
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+    # Metube Basic Auth
+    metube-auth:
+      basicAuth:
+        users:
+          - "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC"
+          # - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq"
+        realm: "MeTube Access"
+
+    # Basic Auth Traefik Dashboard
+    auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
+          # - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu"
+          # - "vv:"
+        realm: "Traefik Dashboard"
+
+    # Basic Auth Dockmon
+    dockmon-auth:
+      basicAuth:
+        users:
+          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
+        realm: "Dockmon Access"
+    
+    # Cloudflare IP Whitelist
+    cloudflare-ipwhitelist:
+      ipWhiteList:
+        sourceRange:
+          - "173.245.48.0/20"
+          - "103.21.244.0/22"
+          - "103.22.200.0/22"
+          - "103.31.4.0/22"
+          - "141.101.64.0/18"
+          - "108.162.192.0/18"
+          - "190.93.240.0/20"
+          - "188.114.96.0/20"
+          - "197.234.240.0/22"
+          - "198.41.128.0/17"
+          - "162.158.0.0/15"
+          - "104.16.0.0/13"
+          - "104.24.0.0/14"
+          - "172.64.0.0/13"
+          - "131.0.72.0/22"
+
+    # Security Headers
+    security-headers:
+      headers:
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+        customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Content-Type-Options: "nosniff"
+          Referrer-Policy: "strict-origin-when-cross-origin"
+
+    # Nextcloud specific headers
+    nextcloud-secure-headers:
+      headers:
+        hostsProxyHeaders:
+          - "X-Forwarded-Host"
+          - "X-Forwarded-Proto"
+        referrerPolicy: "same-origin"
+        customFrameOptionsValue: "SAMEORIGIN"
+
+    # Rate limiting
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1m
+
+    # Nextcloud chain
+    nextcloud-chain:
+      chain:
+        middlewares:
+          - nextcloud-secure-headers
+          - security-headers
+
+# TLS Configuration
+tls:
+  certificates:
+    # Cloudflare Origin CA *.forust.xyz
+    - certFile: /certs/cloudflare.pem
+      keyFile: /certs/cloudflare.key
+    # Local certificate
+    - certFile: /certs/workstation+1.pem
+      keyFile: /certs/workstation+1-key.pem
+  
+  stores:
+    default:
+      defaultCertificate:
+        # Fallback local certificate
+        certFile: /certs/workstation+1.pem
+        keyFile: /certs/workstation+1-key.pem
+  
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
@@ -1,68 +1,9 @@
 http:
+  serversTransports:
+    insecureTransport:
+      insecureSkipVerify: true
+
  routers:
-    # Traefik Dashboard (ADMIN, local only)
-    traefik-dashboard:
-      rule: "Host(`traefik.workstation`)"
-      entryPoints:
-        - websecure
-      service: api@internal
-      middlewares:
-        # - auth
-        - security-headers
-      tls: {}
-
-    # Nextcloud AIO Interface (ADMIN, local is better)
-    nextcloud-aio:
-      rule: "Host(`nextcloud-aio.workstation`)"
-      entryPoints:
-        - websecure
-      service: nextcloud-aio
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # MeTube
-    metube:
-      rule: "Host(`metube.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: metube
-      middlewares:
-        - metube-auth
-        - security-headers
-      tls: {}
-    
-    # Portainer (public (account required))
-    portainer:
-      rule: "Host(`portainer.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: portainer
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # # Uptime Kuma
-    # uptime-kuma:
-    #   rule: "Host(`uptime-kuma.forust.xyz`)"
-    #   entryPoints:
-    #     - websecure
-    #   service: uptime-kuma
-    #   # middlewares:
-    #   #   - security-headers
-    #   tls: {}
-
-    # AdGuard Home (public (account required))
-    adguard:
-      rule: "Host(`adguard.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: adguard
-      middlewares:
-        - security-headers
-      tls: {}
-
-
    # Nextcloud Main (public (account required))
    nextcloud:
      rule: "Host(`nextcloud.forust.xyz`)"
@@ -72,242 +13,9 @@ http:
      middlewares:
        - nextcloud-chain
      tls: {}
-
-    # Dockmon (public (account required))
-    dockmon:
-      rule: "Host(`dockmon.forust.xyz`)"
-      entryPoints:
-        - websecure
-      service: dockmon
-      middlewares:
-        # - dockmon-auth
-        - security-headers
-      tls: {}
-
-    # Gitea (public (account required))
-    gitea:
-      rule: "Host(`gitea.forust.xyz`)"
-      entryPoints:
-        - websecure
-        - ssh
-      service: gitea
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # # Glance (local only)
-    # glance:
-    #   rule: "Host(`glance.workstation`)"
-    #   entryPoints:
-    #     - websecure
-    #   service: glance
-    #   middlewares:
-    #     - security-headers
-    #   tls: {}
-
-    # Watercrawl (local only)
-    watercrawl:
-      rule: "Host(`watercrawl.workstation`)"
-      entryPoints:
-        - websecure
-      service: watercrawl
-      middlewares:
-        - security-headers
-      tls: {}
-
-    # N8N (local only)
-    n8n:
-      rule: "Host(`n8n.workstation`)"
-      entryPoints:
-        - websecure
-      service: n8n
-      middlewares:
-        - security-headers
-      tls: {}
-
-
  services:
-    # Portainer
-    portainer:
-      loadBalancer:
-        servers:
-          - url: "https://portainer:9443"
-        serversTransport: insecureTransport
-
-    # AdGuard Home
-    adguard:
-      loadBalancer:
-        servers:
-          - url: "http://adguardhome:3000"
-
-    # Nextcloud AIO Interface
-    nextcloud-aio:
-      loadBalancer:
-        servers:
-          - url: "https://nextcloud-aio-mastercontainer:8080"
-        serversTransport: insecureTransport
-
    # Nextcloud Main
    nextcloud:
      loadBalancer:
        servers:
          - url: "http://nextcloud-aio-apache:11000"
-
-    # # Uptime Kuma
-    # uptime-kuma:
-    #   loadBalancer:
-    #     servers: "http://uptime-kuma:3001"
-
-    # Dockmon
-    dockmon:
-      loadBalancer:
-        servers:
-          - url: "https://dockmon:443"
-        serversTransport: insecureTransport
-
-    # # Glance
-    # glance:
-    #   loadBalancer:
-    #     servers:
-    #       - url: "http://glance:8080"
-
-    # Watercrawl
-    watercrawl:
-      loadBalancer:
-        servers:
-          - url: "http://nginx:80"
-
-    # N8N
-    n8n:
-      loadBalancer:
-        servers:
-          - url: "http://n8n:5678"
-
-    # Gitea
-    gitea:
-      loadBalancer:
-        servers:
-          - url: "http://gitea:3000"
-    # MeTube
-    metube:
-      loadBalancer:
-        servers:
-          - url: "http://metube:8081"
-
-  serversTransports:
-    insecureTransport:
-      insecureSkipVerify: true
-
-  middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$3Q6gyLFW3NFNp4C6elnyfupntqB6VNB/tcIAeo8NEzvaqPxOjN0iC"
-          # - "jeepik:$2y$05$tIKrmhd7SYOe6yImRRAfpen7hpVdF8PnSbgBTCDZ.GI0Djx.Le2bq"
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
-          # - "jeepik:$2y$05$Q8QqJwSjpycVYONyk4id/.rDFApW9oL8tycRMlGttNySsDv71Rnsu"
-          # - "vv:"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
-        realm: "Dockmon Access"
-    
-    # Cloudflare IP Whitelist
-    cloudflare-ipwhitelist:
-      ipWhiteList:
-        sourceRange:
-          - "173.245.48.0/20"
-          - "103.21.244.0/22"
-          - "103.22.200.0/22"
-          - "103.31.4.0/22"
-          - "141.101.64.0/18"
-          - "108.162.192.0/18"
-          - "190.93.240.0/20"
-          - "188.114.96.0/20"
-          - "197.234.240.0/22"
-          - "198.41.128.0/17"
-          - "162.158.0.0/15"
-          - "104.16.0.0/13"
-          - "104.24.0.0/14"
-          - "172.64.0.0/13"
-          - "131.0.72.0/22"
-
-    # Security Headers
-    security-headers:
-      headers:
-        browserXssFilter: true
-        contentTypeNosniff: true
-        forceSTSHeader: true
-        stsIncludeSubdomains: true
-        stsPreload: true
-        stsSeconds: 31536000
-        customFrameOptionsValue: "SAMEORIGIN"
-        customResponseHeaders:
-          X-Content-Type-Options: "nosniff"
-          Referrer-Policy: "strict-origin-when-cross-origin"
-
-    # Nextcloud specific headers
-    nextcloud-secure-headers:
-      headers:
-        hostsProxyHeaders:
-          - "X-Forwarded-Host"
-          - "X-Forwarded-Proto"
-        referrerPolicy: "same-origin"
-        customFrameOptionsValue: "SAMEORIGIN"
-
-    # Rate limiting
-    rate-limit:
-      rateLimit:
-        average: 100
-        burst: 50
-        period: 1m
-
-    # Nextcloud chain
-    nextcloud-chain:
-      chain:
-        middlewares:
-          - nextcloud-secure-headers
-          - security-headers
-
-# TLS Configuration
-tls:
-  certificates:
-    # Cloudflare Origin CA *.forust.xyz
-    - certFile: /certs/cloudflare.pem
-      keyFile: /certs/cloudflare.key
-    # Local certificate
-    - certFile: /certs/workstation+1.pem
-      keyFile: /certs/workstation+1-key.pem
-  
-  stores:
-    default:
-      defaultCertificate:
-        # Fallback local certificate
-        certFile: /certs/workstation+1.pem
-        keyFile: /certs/workstation+1-key.pem
-  
-  options:
-    default:
-      minVersion: VersionTLS12
-      sniStrict: true
-      cipherSuites:
-        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
@@ -0,0 +1,86 @@
+http:
+  middlewares:
+    # HTTPS Redirect
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+    # Metube Basic Auth
+    metube-auth:
+      basicAuth:
+        users:
+          -  "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
+
+        realm: "MeTube Access"
+
+    # Basic Auth Traefik Dashboard
+    auth:
+      basicAuth:
+        users:
+          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
+        realm: "Traefik Dashboard"
+
+    # Basic Auth Dockmon
+    dockmon-auth:
+      basicAuth:
+        users:
+          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
+        realm: "Dockmon Access"
+    
+    # Cloudflare IP Whitelist
+    cloudflare-ipwhitelist:
+      ipWhiteList:
+        sourceRange:
+          - "173.245.48.0/20"
+          - "103.21.244.0/22"
+          - "103.22.200.0/22"
+          - "103.31.4.0/22"
+          - "141.101.64.0/18"
+          - "108.162.192.0/18"
+          - "190.93.240.0/20"
+          - "188.114.96.0/20"
+          - "197.234.240.0/22"
+          - "198.41.128.0/17"
+          - "162.158.0.0/15"
+          - "104.16.0.0/13"
+          - "104.24.0.0/14"
+          - "172.64.0.0/13"
+          - "131.0.72.0/22"
+
+    # Security Headers
+    security-headers:
+      headers:
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+        customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Content-Type-Options: "nosniff"
+          Referrer-Policy: "strict-origin-when-cross-origin"
+
+    # Nextcloud specific headers
+    nextcloud-secure-headers:
+      headers:
+        hostsProxyHeaders:
+          - "X-Forwarded-Host"
+          - "X-Forwarded-Proto"
+        referrerPolicy: "same-origin"
+        customFrameOptionsValue: "SAMEORIGIN"
+
+    # Rate limiting
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1m
+
+    # Nextcloud chain
+    nextcloud-chain:
+      chain:
+        middlewares:
+          - nextcloud-secure-headers
+          - security-headers
@@ -0,0 +1,153 @@
+http:
+  routers:
+    # Traefik Dashboard (dev access. local only)
+    traefik-dashboard-dev:
+      rule: "Host(`traefik.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: api@internal
+      middlewares:
+        # - auth
+        - security-headers
+      tls: {}
+
+    # Nextcloud AIO Interface (dev access. local only)
+    nextcloud-aio-dev:
+      rule: "Host(`nextcloud-aio.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: nextcloud-aio
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Termix (dev access, (account required))
+    termix-dev:
+      rule: "Host(`termix.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: termix
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # MeTube (dev access, (auth required))
+    metube-dev:
+      rule: "Host(`metube.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: metube
+      middlewares:
+        - metube-auth
+        - security-headers
+      tls: {}
+
+    # Portainer (dev acess, (account required))
+    portainer-dev:
+      rule: "Host(`portainer.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: portainer
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Uptime Kuma (dev access, (account required))
+    uptime-kuma-dev:
+      rule: "Host(`uptime.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: uptime-kuma
+      tls: {}
+
+    # AdGuard Home (dev access, (account required))
+    adguard-dev:
+      rule: "Host(`adguard.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: adguard
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Nextcloud Main (public (account required))
+    nextcloud-dev:
+      rule: "Host(`nextcloud.gigaforust`)"
+      entrypoints:
+        - websecure
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Dockmon (dev access (account required))
+    dockmon-dev:
+      rule: "Host(`dockmon.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: dockmon
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Gitea (dev access (account required))
+    gitea-dev:
+      rule: "Host(`gitea.gigaforust`)"
+      entryPoints:
+        - websecure
+        - ssh
+      service: gitea
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Glance (dev access, local only)
+    glance-dev:
+      rule: "Host(`glance.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: glance
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Watercrawl (dev access, local only)
+    watercrawl-dev:
+      rule: "Host(`watercrawl.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: watercrawl
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # N8N (local only)
+    n8n-dev:
+      rule: "Host(`n8n.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: n8n
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Landing Page (public)
+    forust-homepage-dev:
+      rule: "Host(`landing.gigaforust`)"
+      entryPoints:
+        - websecure
+      service: forust-homepage
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Penpot
+    penpot-dev:
+      rule: "Host(`penpot.gigaforust`)"
+      entryPoints:
+        - websecure
+        - web
+      service: penpot
+      middlewares:
+        - security-headers
+      tls: {}
@@ -0,0 +1,152 @@
+http:
+  routers:
+    # Traefik Dashboard (local access, ADMIN, local only)
+    traefik-dashboard-local:
+      rule: "Host(`traefik.workstation`)"
+      entryPoints:
+        - websecure
+      service: api@internal
+      middlewares:
+        # - auth
+        - security-headers
+      tls: {}
+
+    # Nextcloud AIO Interface (local access. ADMIN, local only)
+    nextcloud-aio-local:
+      rule: "Host(`nextcloud-aio.workstation`)"
+      entryPoints:
+        - websecure
+      service: nextcloud-aio
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Termix (local access, (account required))
+    termix-local:
+      rule: "Host(`termix.workstation`)"
+      entryPoints:
+        - websecure
+      service: termix
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # MeTube (local access, (auth required))
+    metube-local:
+      rule: "Host(`metube.workstation`)"
+      entryPoints:
+        - websecure
+      service: metube
+      middlewares:
+        - metube-auth
+        - security-headers
+      tls: {}
+
+    # Portainer (dev acess, (account required))
+    portainer-local:
+      rule: "Host(`portainer.workstation`)"
+      entryPoints:
+        - websecure
+      service: portainer
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Uptime Kuma (local access, (account required))
+    uptime-kuma-local:
+      rule: "Host(`uptime.workstation`)"
+      entryPoints:
+        - websecure
+      service: uptime-kuma
+      tls: {}
+
+    # AdGuard Home (local access, (account required))
+    adguard-local:
+      rule: "Host(`adguard.workstation`)"
+      entryPoints:
+        - websecure
+      service: adguard
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Nextcloud Main (public (account required))
+    nextcloud-local:
+      rule: "Host(`nextcloud.workstation`)"
+      entrypoints:
+        - websecure
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Nextcloud Main (public (account required))
+    penpot-local:
+      rule: "Host(`penpot.workstation`)"
+      entrypoints:
+        - websecure
+      service: penpot
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Dockmon (local access (account required))
+    dockmon-local:
+      rule: "Host(`dockmon.workstation`)"
+      entryPoints:
+        - websecure
+      service: dockmon
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Gitea (local access (account required))
+    gitea-local:
+      rule: "Host(`gitea.workstation`)"
+      entryPoints:
+        - websecure
+        - ssh
+      service: gitea
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Glance (local access)
+    glance-local:
+      rule: "Host(`glance.workstation`)"
+      entryPoints:
+        - websecure
+      service: glance
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Watercrawl (local access)
+    watercrawl-local:
+      rule: "Host(`watercrawl.workstation`)"
+      entryPoints:
+        - websecure
+      service: watercrawl
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # N8N (local only)
+    n8n-local:
+      rule: "Host(`n8n.workstation`)"
+      entryPoints:
+        - websecure
+      service: n8n
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Landing Page (local access)
+    forust-homepage-local:
+      rule: "Host(`landing.workstation`)"
+      entryPoints:
+        - websecure
+      service: forust-homepage
+      middlewares:
+        - security-headers
+      tls: {}
@@ -0,0 +1,152 @@
+http:
+  routers:
+    # Traefik Dashboard (ADMIN, without subdomeain)
+    traefik-dashboard:
+      rule: "Host(`traefik.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: api@internal
+      middlewares:
+        - auth
+        - security-headers
+      tls: {}
+
+    # Nextcloud AIO Interface (ADMIN, without subdomeain)
+    nextcloud-aio:
+      rule: "Host(`nextcloud-aio.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: nextcloud-aio
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Nextcloud AIO Interface (ADMIN, without subdomeain)
+    penpot:
+      rule: "Host(`penpot.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: penpot
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Termix (public (account required))
+    termix:
+      rule: "Host(`termix.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: termix
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # MeTube (public (auth required))
+    metube:
+      rule: "Host(`metube.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: metube
+      middlewares:
+        - metube-auth
+        - security-headers
+      tls: {}
+
+    # Portainer (public (account required))
+    portainer:
+      rule: "Host(`portainer.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: portainer
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Uptime Kuma (public (account required))
+    uptime-kuma:
+      rule: "Host(`uptime.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: uptime-kuma
+      tls: {}
+
+    # AdGuard Home (public (account required))
+    adguard:
+      rule: "Host(`adguard.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: adguard
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Nextcloud Main (public (account required))
+    nextcloud:
+      rule: "Host(`nextcloud.forust.xyz`)"
+      entrypoints:
+        - websecure
+      service: nextcloud
+      middlewares:
+        - nextcloud-chain
+      tls: {}
+
+    # Dockmon (public (account required))
+    dockmon:
+      rule: "Host(`dockmon.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: dockmon
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Gitea (public (account required))
+    gitea:
+      rule: "Host(`gitea.forust.xyz`)"
+      entryPoints:
+        - websecure
+        - ssh
+      service: gitea
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Glance (public, without subdomain)
+    glance:
+      rule: "Host(`glance.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: glance
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Watercrawl (public, without subdomain)
+    watercrawl:
+      rule: "Host(`watercrawl.fourst.xyz`)"
+      entryPoints:
+        - websecure
+      service: watercrawl
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # N8N (public, without subdomain)
+    n8n:
+      rule: "Host(`n8n.forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: n8n
+      middlewares:
+        - security-headers
+      tls: {}
+
+    # Landing Page (public)
+    forust-homepage:
+      rule: "Host(`forust.xyz`)"
+      entryPoints:
+        - websecure
+      service: forust-homepage
+      middlewares:
+        - security-headers
+      tls: {}
@@ -0,0 +1,86 @@
+http:
+  services:
+    # Portainer
+    portainer:
+      loadBalancer:
+        servers:
+          - url: "https://portainer:9443"
+        serversTransport: insecureTransport
+
+    # AdGuard Home
+    adguard:
+      loadBalancer:
+        servers:
+          - url: "http://adguardhome:3000"
+
+    # Nextcloud AIO Interface
+    nextcloud-aio:
+      loadBalancer:
+        servers:
+          - url: "https://nextcloud-aio-mastercontainer:8080"
+        serversTransport: insecureTransport
+
+    # Penpot
+    penpot:
+      loadBalancer:
+        servers:
+          - url: "http://penpot-frontend:8080"
+
+    # Nextcloud Main
+    nextcloud:
+      loadBalancer:
+        servers:
+          - url: "http://nextcloud-aio-apache:11000"
+
+    # Uptime Kuma
+    uptime-kuma:
+      loadBalancer:
+        servers:
+          - url: "http://uptime-kuma:3001"
+
+    # Termix
+    termix:
+      loadBalancer:
+        servers:
+          - url: "http://termix:8080"
+
+    # Dockmon
+    dockmon:
+      loadBalancer:
+        servers:
+          - url: "https://dockmon:443"
+        serversTransport: insecureTransport
+
+    # Glance
+    glance:
+      loadBalancer:
+        servers:
+          - url: "http://glance:8080"
+
+    # Watercrawl
+    watercrawl:
+      loadBalancer:
+        servers:
+          - url: "http://nginx:80"
+
+    # N8N
+    n8n:
+      loadBalancer:
+        servers:
+          - url: "http://n8n:5678"
+
+    # Gitea
+    gitea:
+      loadBalancer:
+        servers:
+          - url: "http://gitea:3000"
+    # MeTube
+    metube:
+      loadBalancer:
+        servers:
+          - url: "http://metube:8081"
+    # Landing Page
+    forust-homepage:
+      loadBalancer:
+        servers:
+          - url: "http://forust-homepage:80"
@@ -0,0 +1,22 @@
+# TLS Configuration
+tls:
+  certificates:
+    # Cloudflare Origin CA *.forust.xyz
+    - certFile: /certs/cloudflare.pem
+      keyFile: /certs/cloudflare.key
+
+  stores:
+    default:
+      defaultCertificate:
+        # Fallback local certificate
+        certFile: /certs/gigaforust.internal+1.pem
+        keyFile: /certs/gigaforust.internal+1-key.pem
+
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: false
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
@@ -10,14 +10,25 @@ services:
      - "3001:3001"
    labels:
      - "traefik.enable=true"
-    - "traefik.http.routers.uptime-kuma.rule=Host(`uptime-kuma.forust.xyz`)"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Prod Router
+      - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
      - "traefik.http.routers.uptime-kuma.entrypoints=websecure"
      - "traefik.http.routers.uptime-kuma.tls=true"
-    # - "traefik.http.routers.uptime-kuma.tls.certresolver=myresolver"
-    - "traefik.http.services.uptime-kuma.loadBalancer.server.port=3001"
+      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
+
+      # Local Router
+      - "traefik.http.routers.uptime-kuma-local.rule=Host(`uptime.workstation.internal`) || Host(`uptime.internal`)"
+      - "traefik.http.routers.uptime-kuma-local.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.uptime-kuma-dev.rule=Host(`uptime.gigaforust.internal`)"
+      - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma-dev.tls=true"
    networks:
      - traefik-proxy
 networks:
  traefik-proxy:
    external: true
-    
@@ -1,5 +1,6 @@
 .DS_Store
 .gitattributes
+
 .vscode
 /modules/__pycache__/
 __pycache__/
@@ -12,14 +13,4 @@ __pycache__/
 .venv/
 /downloads/
 /Downloads/
-/modules/custom_modules
-.idea
 config.ini
-unknown_errors.txt
-moonlogs.txt
-thumb.jpg
-antipm_pic.jpg
-musicbot/
-.trunk/
-previous_profiles/
-.python-version
Author	SHA1	Message	Date
forust	d48a01775d	fix: routers for nextcloud frontend	2025-12-06 00:38:16 +01:00
forust	99d50b43fe	fix: traefik service	2025-12-05 21:00:55 +01:00
forust	23e955bde7	chore: new auth credentials, revert to info logging	2025-12-05 20:33:14 +01:00
forust	7d7a0e5c8a	fix: penpot non- latin symbol	2025-12-05 18:53:19 +01:00
forust	a767107277	fix: refering to file-defined middlewares	2025-12-05 14:36:57 +01:00
forust	e68e37c285	refactor: use internal tld according to ICAAN	2025-12-05 04:30:51 +01:00
forust	fc6a11397b	refactor: move traefik configuration to docker-compose files via labels	2025-12-05 04:03:24 +01:00
forust	d776124f26	chore: unignored examples, example env for penpot	2025-12-04 20:25:32 +01:00
forust	8a0ed85e7c	feat: Penpoint service, traefik integration	2025-12-04 20:04:49 +01:00
forust	15f0f35ce4	chore: exclude prometheus config	2025-12-03 04:23:34 +01:00
forust	1ec145d4cf	chore: add xdfnx domain to team links	2025-12-03 00:30:06 +01:00
forust	8b6815f314	chore: gitignored temp folder for references	2025-12-02 13:10:13 +01:00
forust	2d05a1911c	feat: cloudflare IP sync (ddns)	2025-11-30 03:28:41 +01:00
forust	6f2f70ad09	chore: ingore streaming services	2025-11-28 12:59:15 +01:00
forust	6cb49be951	chore: update gitignore, add translations	2025-11-27 18:58:17 +01:00
forust	3bcabcce4b	feat: notify on new webinar, storing N last webinars in redis	2025-11-27 16:33:15 +01:00
forust	a54b7b000f	fix: add timeout for playwright to load page and debug response saving	2025-11-27 15:50:12 +01:00
forust	5b1fa11b5e	chore: switching to latest release of portainer	2025-11-27 02:13:54 +01:00
forust	380288d103	fix: port conflicts	2025-11-26 22:55:16 +01:00
forust	8fae8bf75d	feat: add admin commands to manage whitelist, extended webinar reporting	2025-11-26 22:25:47 +01:00
forust	d4e0e7f37a	feat: telegram webianr checker bot	2025-11-26 22:12:03 +01:00
forust	cb92bff0c5	feat: basic webinar checker bot	2025-11-26 21:08:43 +01:00
forust	bfbe841154	feat: redis integration	2025-11-26 20:53:53 +01:00
forust	7cbc5bf4f3	feat: edu phpsessid updater bot	2025-11-26 17:00:44 +01:00
forust	258ed04f98	feat: miku	2025-11-26 14:23:56 +01:00
forust	7ee0a1e7a2	feat: repos added to forust homepage	2025-11-26 11:51:09 +01:00
forust	739915c451	feat: team avatars	2025-11-26 01:20:12 +01:00
forust	68b5467a37	chore: exclude team images from project	2025-11-26 01:19:50 +01:00
forust	61e6b2b5c7	chore: reformat discord username to unified style	2025-11-26 01:01:37 +01:00
forust	272666d2fd	fix: container url forust-homepage	2025-11-26 00:44:58 +01:00
forust	aca485836b	fix: service names	2025-11-26 00:42:10 +01:00
forust	02671b9117	feat: traefik dynamic files for forust-homepage	2025-11-26 00:10:35 +01:00
forust	1c1170ca96	refactor: change names for forust-homepage	2025-11-26 00:09:12 +01:00
forust	3eab3b254a	Merge branch 'main' into landing	2025-11-26 00:02:37 +01:00
forust	5d9fc18ba5	feat: docker deployment	2025-11-26 00:01:43 +01:00
forust	03d39f8a32	chore: separate docker files from nginx	2025-11-25 23:59:15 +01:00
forust	7b60630d76	feat: new landing page matching xrock style	2025-11-25 23:48:12 +01:00
forust	cc20d848f8	chore: vv pass	2025-11-25 19:29:12 +01:00
forust	1040e4fdf7	chore: termix-data to gitignore	2025-11-20 03:44:50 +01:00
forust	7af5af0630	fix: Return glance service	2025-11-18 15:42:51 +01:00
forust	8f9be8a478	fix: Misplaced comment	2025-11-18 15:20:53 +01:00
forust	d1adaa54b1	feat: Add routers for local access	2025-11-18 15:19:27 +01:00
forust	b3b0d5b553	refactor: sepparate traefik production routers	2025-11-18 15:13:45 +01:00
forust	d22ef0cb44	feat: Add routers for local testing	2025-11-18 15:04:06 +01:00
forust	7c29d74c72	refactor: Removed routers from dynamic. Use .bak for references	2025-11-18 14:47:59 +01:00
forust	b2ae170ea0	refactor: Sepparate traefik middlewares	2025-11-18 14:45:30 +01:00
forust	2c2474165b	refactor: Sepparate traefik tls configuration	2025-11-18 14:43:49 +01:00
forust	155bb8d02b	refactor: Sepparate traefik services	2025-11-18 14:41:41 +01:00
forust	ed1b41ca1d	feat: Add termix ssh manager, traefik routers	2025-11-18 03:34:55 +01:00
forust	9bb5f070e3	chore: gitignore for termix	2025-11-18 03:34:34 +01:00
forust	b238e9ccf2	chore: Env example	2025-11-18 03:23:57 +01:00
forust	09a05a5ad5	chore: remove commented docker labels	2025-11-18 02:34:55 +01:00
forust	5b05207985	refactor: Move uptime-kuma traefik labels to dynamic.yaml	2025-11-18 02:30:42 +01:00
forust	319cf0ea1f	feat: Add demo landing page	2025-11-18 02:12:48 +01:00
				`@@ -1 +0,0 @@`
				`# Add your additional Python packages here, one per line`