Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/checkmk

.gitignore

@@ -12,6 +12,7 @@ sync.ffs_lock
 # Volumes and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
+gitea/*runner/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
 adguardhome/data/*
@@ -22,6 +23,7 @@ uptime-kuma/data/
 termix/termix-data/*
 cfddns/config.json
 checkmk/checkmk/*
+downtify/Downtify_downloads
 
 # Steaming services files
 streaming/jellyfin/*
@@ -39,6 +41,9 @@ homepages/forust_files/assets/images/team/*
 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/logs/*
+
+# SSL Certificates
+adguardhome/certs/*
 traefik/certs/*
 
 # Monitoring
@@ -81,3 +86,4 @@ replacements.txt
 
 # Temp files
 edu_master/temp/
+temp/*

adguardhome/compose.yaml

@@ -3,48 +3,54 @@ services:
     image: adguard/adguardhome:latest
     container_name: adguardhome
     restart: unless-stopped
-    environment:
-      - TZ=${TZ}
     ports:
       - "53:53/tcp"
       - "53:53/udp"
+      - "853:853/tcp" # DNS over TLS
       # - "67:67/udp" # DHCP
       # - "68:68/tcp" # DHCP
       - "3000:3000/tcp"
     volumes:
       - ./data/work:/opt/adguardhome/work
       - ./data/conf:/opt/adguardhome/conf
+      - ./certs:/certs:ro
     networks:
-      - traefik-proxy
+      - proxy
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
 
       # Prod Router
-      - "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
+      - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
       - "traefik.http.routers.adguard.entrypoints=websecure"
       - "traefik.http.routers.adguard.middlewares=security-headers@file"
       - "traefik.http.routers.adguard.service=adguard"
       - "traefik.http.routers.adguard.tls=true"
-      - "traefik.http.services.adguard.loadbalancer.server.port=3000"
 
       # Local Router
-      - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
+      - "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
       - "traefik.http.routers.adguard-local.entrypoints=websecure"
       - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-local.service=adguard"
       - "traefik.http.routers.adguard-local.tls=true"
 
       # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
       - "traefik.http.routers.adguard-dev.entrypoints=websecure"
       - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-dev.service=adguard"
       - "traefik.http.routers.adguard-dev.tls=true"
 
+      # DoH
+      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns.entrypoints=websecure"
+      - "traefik.http.routers.dns.service=adguard"
+      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
+
       - glance.name=adguard
       - glance.url=https://adguard.forust.xyz/
       - glance.description=AdGuard Home is a network-wide software for blocking ads.
 networks:
-  traefik-proxy:
+  proxy:
     external: true

authentik/.env.example

@@ -0,0 +1,20 @@
+# ===================================
+# Authentification app (authentik)
+
+# PostgresQL conf 
+PG_PASS=change_this_cuz_its_ur_db_pass
+PG_USER=authentik # it's okay
+
+# Image Settings
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2025.10.2
+
+# Networking
+PORT_HTTP=9000
+PORT_HTTPS=9443 # btw likely already used by portainer
+
+AUTHENTIK_SECRET_KEY=super_secret_super_scary_authenik_key
+
+AUTHENTIK_BOOTSTRAP_PASSWORD=pls_change_this
+
+AUTHENTIK_ERROR_REPORTING__ENABLED=true # Or false to turn off

authentik/compose.yaml

@@ -0,0 +1,106 @@
+services:
+  postgresql:
+    image: docker.io/library/postgres:15-alpine
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    volumes:
+      - database:/var/lib/postgresql/data
+    networks:
+      - authentik
+
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    command: server
+    container_name: authentik-server
+    restart: unless-stopped
+    ports:
+      - ${PORT_HTTP:-9000}:9000
+      - ${PORT_HTTPS:-9443}:9443
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      # Services
+      # - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
+      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
+
+      # Prod Router
+      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
+      - "traefik.http.routers.authentik-server.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server.service=authentik-server"
+      - "traefik.http.routers.authentik-server.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
+      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-local.service=authentik-server"
+      - "traefik.http.routers.authentik-server-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
+      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
+      - "traefik.http.routers.authentik-server-dev.tls=true"
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    networks:
+      - proxy
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    restart: unless-stopped
+    user: root
+    command: worker
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+    networks:
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+volumes:
+  database:
+    driver: local
+networks:
+  authentik:
+  proxy:
+    external: true

dockmon/compose.yaml

@@ -16,15 +16,15 @@ services:
          timeout: 10s
          retries: 3
       networks:
-         - traefik-proxy
+         - proxy
       labels:
          - "traefik.enable=true"
-         - "traefik.docker.network=traefik-proxy"
+         - "traefik.docker.network=proxy"
 
          # Prod Router
          - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
          - "traefik.http.routers.dockmon.entrypoints=websecure"
-         - "traefik.http.routers.dockmon.middlewares=security-headers@file,dockmon-auth@file"
+         - "traefik.http.routers.dockmon.middlewares=security-chain@file"
          - "traefik.http.routers.dockmon.service=dockmon"
          - "traefik.http.routers.dockmon.tls=true"
          - "traefik.http.services.dockmon.loadbalancer.server.port=443"
@@ -41,7 +41,7 @@ services:
          # Dev Router
          - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
          - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.middlewares=security-headers@file"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
          - "traefik.http.routers.dockmon-dev.service=dockmon"
          - "traefik.http.routers.dockmon-dev.tls=true"
 
@@ -50,5 +50,5 @@ services:
          - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
 
 networks:
-   traefik-proxy:
+   proxy:
       external: true

downtify/compose.yaml

@@ -0,0 +1,39 @@
+services:
+  downtify:
+    container_name: downtify
+    image: ghcr.io/henriquesebastiao/downtify:latest
+    # ports:
+    #   - '7077:8000'
+    labels:
+      - traefik.enable=true
+      - traefik.http.services.downtify.loadbalancer.server.port=8000
+
+      # Prod Router 
+      - traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
+      - traefik.http.routers.downtify.entrypoints=websecure
+      - traefik.http.routers.downtify.middlewares=security-chain@file
+      - traefik.http.routers.downtify.service=downtify
+      - traefik.http.routers.downtify.tls=true
+
+      # Local Router
+      - traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
+      - traefik.http.routers.downtify-local.entrypoints=websecure
+      - traefik.http.routers.downtify-local.middlewares=security-headers@file
+      - traefik.http.routers.downtify-local.service=downtify
+      - traefik.http.routers.downtify-local.tls=true
+
+      # Dev Router
+      - traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
+      - traefik.http.routers.downtify-dev.entrypoints=websecure
+      - traefik.http.routers.downtify-dev.middlewares=security-chain@file
+      - traefik.http.routers.downtify-dev.service=downtify
+      - traefik.http.routers.downtify-dev.tls=true
+    networks:
+      - proxy
+
+    volumes:
+      - ./Downtify_downloads:/downloads
+
+networks:
+  proxy:
+    external: true

gitea/.env.example

@@ -1,3 +1,7 @@
 GITEA_POSTGRES_USER=
 GITEA_POSTGRES_PASSWORD=
-GITEA_POSTGRES_DB=gitea
+GITEA_POSTGRES_DB=gitea
+BASIC-RUNNER_TOKEN=
+GITEA_SMTP_PASS=
+MAILER_ADDR=
+SERVICE_EMAIL=email.used.by.services@domain.tld

gitea/compose.yaml

@@ -13,18 +13,28 @@ services:
       - GITEA__database__NAME=gitea
       #Server
       - GITEA__server__ROOT_URL=https://gitea.forust.xyz
+      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
       - GITEA__server__SSH_PORT=2221
+      # Mailer
+      - GITEA__mailer__ENABLED=true
+      - GITEA__mailer__FROM=${SERVICE_EMAIL}
+      - GITEA__mailer__SMTP_ADDR=${MAILER_ADDR}:465
+      - GITEA__mailer__USER=${SERVICE_EMAIL}
+      - GITEA__mailer__PASSWD=${GITEA_SMTP_PASS}
+      - GITEA__mailer__PROTOCOL=SMTP
+      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
+      - GITEA__service__ENABLE_NOTIFY_MAIL=true
     restart: always
     networks:
       - gitea-db
-      - traefik-proxy
+      - proxy
     volumes:
       - ./gitea-data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
@@ -47,11 +57,33 @@ services:
       - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
       - "traefik.http.routers.gitea-dev.service=gitea"
       - "traefik.http.routers.gitea-dev.tls=true"
+      - "traefik.tcp.routers.gitea.entrypoints=ssh"
+      - "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
+      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
     ports:
       - "2221:22"
     depends_on:
       - db
 
+  runner:
+    image: gitea/act_runner:0.2.11
+    container_name: gitea-runner
+    restart: always
+    depends_on:
+      - server
+    env_file:
+      - .env
+    networks:
+      - gitea-db
+    environment:
+      - GITEA_INSTANCE_URL=http://server:3000
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${BASIC-RUNNER_TOKEN}
+      - GITEA_RUNNER_NAME=basic-runner
+      - GITEA_RUNNER_LABELS=docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm
+    volumes:
+      - ./gitea-runner:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+
   db:
     image: docker.io/library/postgres:14
     restart: always
@@ -67,5 +99,5 @@ services:
 networks:
   gitea-db:
     external: false
-  traefik-proxy:
+  proxy:
     external: true

glance/compose.yaml

@@ -11,12 +11,12 @@ services:
     env_file: .env
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
       - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.middlewares=security-headers@file"
+      - "traefik.http.routers.glance.middlewares=security-chain@file"
       - "traefik.http.routers.glance.tls=true"
 
       # Local Router
@@ -28,13 +28,13 @@ services:
       # Dev Router
       - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
       - "traefik.http.routers.glance-dev.entrypoints=websecure"
-      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.glance-dev.middlewares=security-chain@file"
       - "traefik.http.routers.glance-dev.tls=true"
     networks:
-      - traefik-proxy
+      - proxy
     dns:
       - 1.1.1.1
       - 8.8.8.8
 networks:
-  traefik-proxy:
+  proxy:
     external: true

homepages/compose.yaml

@@ -9,10 +9,10 @@ services:
     volumes:
       - ./forust_files:/usr/share/nginx/html
     networks:
-      - traefik-proxy
+      - proxy
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Services
       - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
@@ -48,10 +48,10 @@ services:
     volumes:
       - ./xdfnx_files:/usr/share/nginx/html
     networks:
-      - traefik-proxy
+      - proxy
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
       
       # Services
       - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
@@ -79,5 +79,5 @@ services:
 
 
 networks:
-  traefik-proxy:
+  proxy:
     external: true

metube/compose.yaml

@@ -14,12 +14,12 @@ services:
       - ./MeTube_downloads:/downloads
     labels:
       - traefik.enable=true
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
       - "traefik.http.routers.metube.entrypoints=websecure"
-      - "traefik.http.routers.metube.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube.middlewares=security-chain@file"
       - "traefik.http.routers.metube.service=metube"
       - "traefik.http.routers.metube.tls=true"
       - "traefik.http.services.metube.loadbalancer.server.port=8081"
@@ -27,19 +27,19 @@ services:
       # Local Router
       - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`) || Host(`metube.internal`)"
       - "traefik.http.routers.metube-local.entrypoints=websecure"
-      - "traefik.http.routers.metube-local.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-local.middlewares=security-headers@file"
       - "traefik.http.routers.metube-local.service=metube"
       - "traefik.http.routers.metube-local.tls=true"
 
       # Dev Router
       - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
       - "traefik.http.routers.metube-dev.entrypoints=websecure"
-      - "traefik.http.routers.metube-dev.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-dev.middlewares=security-chain@file"
       - "traefik.http.routers.metube-dev.service=metube"
       - "traefik.http.routers.metube-dev.tls=true"
 
     networks:
-      - traefik-proxy
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
     external: true

n8n/compose.yaml

@@ -23,11 +23,11 @@ services:
       - 1.1.1.1
       - 8.8.8.8
     networks:
-      - traefik-proxy
+      - proxy
       - n8n
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
@@ -58,5 +58,5 @@ services:
 networks:
   n8n:
     external: false
-  traefik-proxy:
+  proxy:
     external: true

nextcloud/compose.yaml

@@ -1,6 +1,6 @@
 services:
   nextcloud-aio-mastercontainer:
-    image: ghcr.io/nextcloud-releases/all-in-one:latest
+    image: ghcr.io/nextcloud-releases/all-in-one:beta
     init: true # This setting makes sure that signals from main process inside the container are correctly forwarded to children. See https://docs.docker.com/reference/compose-file/services/#init
     restart: unless-stopped
     container_name: nextcloud-aio-mastercontainer # Do not change
@@ -9,8 +9,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     networks:
       - nextcloud-aio
-      - traefik-proxy # Optional: Connects the mastercontainer to the traefik-proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- 
       # ports:
       # - 8081:80 # may be removed if under reverse-proxy
       # - 8443:8443 
@@ -18,7 +17,7 @@ services:
 
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # AIO Services configuration
       - "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
@@ -56,7 +55,7 @@ services:
       AIO_DISABLE_BACKUP_SECTION: false
       APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       APACHE_IP_BINDING: 0.0.0.0 # Configure when going with reverse-proxy https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      APACHE_ADDITIONAL_NETWORK: traefik-proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      APACHE_ADDITIONAL_NETWORK: proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Backup retention See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
       COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
       FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M" # adjust fulltextsearch java options. https://github.com/nextcloud/all-in-one#how-to-adjust-the-fulltextsearch-java-options
@@ -76,7 +75,7 @@ services:
       # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. For macos it needs to be '/var/run/docker.sock'
 
 networks:
-  traefik-proxy:
+  proxy:
     external: true
   nextcloud-aio:
     driver: bridge

penpot/compose.yaml

@@ -50,7 +50,7 @@ x-secret-key: &penpot-secret-key
 
 networks:
   penpot:
-  traefik-proxy:
+  proxy:
     external: true
 
 volumes:
@@ -98,11 +98,11 @@ services:
 
     networks:
       - penpot
-      - traefik-proxy
+      - proxy
 
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"

portainer/compose.yaml

@@ -10,10 +10,10 @@ services:
       - 9443:9443
       # - 8000:8000  # Remove if you do not intend to use Edge Agents
     networks:
-      - traefik-proxy
+      - proxy
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
@@ -50,5 +50,5 @@ volumes:
 networks:
   default:
     name: portainer_network
-  traefik-proxy:
+  proxy:
     external: true

termix/compose.yaml

@@ -11,7 +11,7 @@ services:
       PORT: "8080"
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
@@ -35,10 +35,10 @@ services:
       - "traefik.http.routers.termix-dev.service=termix"
       - "traefik.http.routers.termix-dev.tls=true"
     networks:
-      - traefik-proxy
+      - proxy
 
 networks:
-  traefik-proxy:
+  proxy:
     external: true
 
 volumes:

traefik/.env.example

@@ -0,0 +1,3 @@
+# ===================================
+# Traefik envs 
+EMAIL=bobrovod@national.shitposting.agency

traefik/compose.yaml

@@ -11,7 +11,7 @@ services:
       # Providers
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=traefik-proxy"
+      - "--providers.docker.network=proxy"
       - "--providers.file.directory=/etc/traefik/dynamic"
       - "--providers.file.watch=true"
 
@@ -19,49 +19,46 @@ services:
       - "--entryPoints.web.address=:80"
       - "--entryPoints.websecure.address=:443"
       - "--entryPoints.websecure.http.tls=true"
-      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
-      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.ssh.address=:2221"
 
-      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
+      # Let's Encrypt
-      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
-      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      # # STAGING
       # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
-      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
 
       # Cloudflare 
       - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
-
+      # # Logging
-      # Logging
+      # - "--log.level=INFO"
-      - "--log.level=INFO"
+      # - "--log.filePath=/var/log/traefik/traefik.log"
-      - "--log.filePath=/var/log/traefik/traefik.log"
+      # - "--accesslog=true"
-      - "--accesslog=true"
+      # - "--accesslog.filepath=/var/log/traefik/access.log"
-      - "--accesslog.filepath=/var/log/traefik/access.log"
 
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
-      # Prod Router (Dashboard) - DISABLED per user request
+      # Prod Router (Dash)
-      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
+      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
-      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
-      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
+      - "traefik.http.routers.traefik-dashboard.middlewares=security-chain@file"
-      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard.service=api@internal"
-      # - "traefik.http.routers.traefik-dashboard.tls=true"
+      - "traefik.http.routers.traefik-dashboard.tls=true"
 
       # Local Router
       - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
       - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth@file,security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-local.middlewares=security-headers@file"
       - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
       - "traefik.http.routers.traefik-dashboard-local.tls=true"
 
       # Dev Router
       - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
       - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-chain@file"
       - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
       - "traefik.http.routers.traefik-dashboard-dev.tls=true"
 
@@ -78,14 +75,14 @@ services:
       - ./dynamic:/etc/traefik/dynamic:ro
       - ./certs:/certs:ro
       - ./logs:/var/log/traefik
-      # - ./traefik/letsencrypt:/letsencrypt
+      - ./letsencrypt:/letsencrypt
 
     networks:
-      - traefik-proxy
+      - proxy
 
     environment:
       - TZ=Europe/Bratislava
 
 networks:
-  traefik-proxy:
+  proxy:
     external: true

traefik/dynamic/middlewares.yml

@@ -1,33 +1,5 @@
 http:
   middlewares:
-    # HTTPS Redirect
-    redirect-https:
-      redirectScheme:
-        scheme: https
-        permanent: true
-
-    # Metube Basic Auth
-    metube-auth:
-      basicAuth:
-        users:
-          -  "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
-
-        realm: "MeTube Access"
-
-    # Basic Auth Traefik Dashboard
-    auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Traefik Dashboard"
-
-    # Basic Auth Dockmon
-    dockmon-auth:
-      basicAuth:
-        users:
-          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
-        realm: "Dockmon Access"
-    
     # Cloudflare IP Whitelist
     cloudflare-ipwhitelist:
       ipWhiteList:
@@ -48,6 +20,29 @@ http:
           - "172.64.0.0/13"
           - "131.0.72.0/22"
 
+    # Authentik + secure headers
+    security-chain:
+      chain:
+        middlewares:
+          - authentik@file
+          - security-headers@file
+    authentik:
+      forwardAuth:
+        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-meta-version
+
     # Security Headers
     security-headers:
       headers:
@@ -82,5 +77,5 @@ http:
     nextcloud-chain:
       chain:
         middlewares:
-          - nextcloud-secure-headers
+          - nextcloud-secure-headers@file
-          - security-headers
+          - security-headers@file

traefik/dynamic/redirect.yml

@@ -0,0 +1,23 @@
+http:
+  middlewares:
+    redirect-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+
+  routers:
+    acme-challenge-exempt:
+      rule: "PathPrefix(`/.well-known/acme-challenge`)"
+      entryPoints:
+        - web
+      service: noop@internal
+      priority: 100
+
+    http-catchall:
+      rule: "HostRegexp(`{host:.+}`)"
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-https
+      service: noop@internal
+      priority: 1

uptime-kuma/compose.yaml

@@ -10,7 +10,7 @@ services:
       - "3001:3001"
     labels:
       - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
+      - "traefik.docker.network=proxy"
 
       # Prod Router
       - "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
@@ -28,7 +28,7 @@ services:
       - "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
       - "traefik.http.routers.uptime-kuma-dev.tls=true"
     networks:
-      - traefik-proxy
+      - proxy
 networks:
-  traefik-proxy:
+  proxy:
     external: true

userbot/compose.yaml

@@ -1,9 +1,8 @@
 services:
-  userbot_forust:
+  forust:
     build:
       context: .
       dockerfile: Dockerfile
-    container_name: userbot_forust
     restart: unless-stopped
     env_file:
       - .env
@@ -16,11 +15,10 @@ services:
       - 8.8.8.8
       - 1.1.1.1
 
-  userbot_anna:
+  anna:
     build:
       context: .
       dockerfile: Dockerfile
-    container_name: userbot_anna
     restart: unless-stopped
     env_file:
       - .env
@@ -31,27 +29,4 @@ services:
       - ./volumes/logs_anna:/app/logs
     dns:
       - 8.8.8.8
-      - 1.1.1.1
+      - 1.1.1.1
-    develop:
-      watch:
-        - action: sync
-          path: modules
-          target: /app/modules
-        - action: sync
-          path: utils
-          target: /app/utils
-        - action: sync
-          path: main.py
-          target: /app/main.py
-        - action: rebuild
-          path: .env
-        - action: rebuild
-          path: .env.anna
-
-
-volumes:
-  downloads:
-
-networks:
-  userbot_network:
-    driver: bridge