fix serge

.gitignore

@@ -12,7 +12,7 @@ data/matrix
 data/heimdall
 data/pihole/etc-pihole
 data/pxe
-data/postgres
+data/postgres/certs
 data/wireguard
 data/vaultwarden
 data/filebrowser
@@ -21,6 +21,10 @@ data/openvpn_*
 data/mailcow
 data/dockvpn
 data/hydra
+data/yt-dlp
+data/mongo
+data/gpg
+data/redis
 data.tar.gz
 data.7z
 data.7z.gpg

Makefile

@@ -8,6 +8,8 @@ mswarm: merge
 	docker stack deploy -c stacks/docker-compose.yml vps
 down:
 	docker stack rm vps
+pull:
+	for file in services/*; do docker-compose -f $$file pull; done
 export:
 	7z a -p data.7z data
 	gpg --encrypt --sign --recipient 'marc@marcpartensky.com' data.7z
@@ -18,7 +20,9 @@ networks:
 	docker network create --driver overlay --attachable postgres || true
 	docker network create --driver overlay --attachable mongo || true
 	docker network create --driver overlay --attachable vpn || true
+	docker network create --driver overlay --attachable redis || true
 	docker network create --driver overlay --subnet 172.22.1.0/24 --gateway 172.22.1.1 --attachable mailcow || true
+	docker network create --driver overlay --subnet 10.22.69.0/24 --gateway 10.22.69.1 --attachable pritunl || true
 node:
 	docker node update --label-add net=web contabo
 	docker node update --label-add net=none tower

data/adguard/AdGuardHome.yaml

@@ -1,6 +1,5 @@
 bind_host: 0.0.0.0
 bind_port: 3000
-beta_bind_port: 0
 users:
   - name: marc
     password: $2a$10$E9cknJr/bTLtSUJ9EaW8r.Gw30FX8Plm8jgq.LaYxMwiX4DEuDK7O
@@ -8,23 +7,20 @@ auth_attempts: 5
 block_auth_min: 15
 http_proxy: ""
 language: ""
+theme: auto
 debug_pprof: false
 web_session_ttl: 720
 dns:
   bind_hosts:
     - 0.0.0.0
   port: 53
-  statistics_interval: 1
-  querylog_enabled: true
-  querylog_file_enabled: true
-  querylog_interval: 2160h
-  querylog_size_memory: 1000
   anonymize_client_ip: false
   protection_enabled: true
   blocking_mode: default
   blocking_ipv4: ""
   blocking_ipv6: ""
   blocked_response_ttl: 10
+  protection_disabled_until: null
   parental_block_host: family-block.dns.adguard.com
   safebrowsing_block_host: standard-block.dns.adguard.com
   ratelimit: 20
@@ -57,20 +53,31 @@ dns:
   bogus_nxdomain: []
   aaaa_disabled: false
   enable_dnssec: false
-  edns_client_subnet: false
+  edns_client_subnet:
+    custom_ip: ""
+    enabled: false
+    use_custom: false
   max_goroutines: 300
   handle_ddr: true
   ipset: []
   ipset_file: ""
+  bootstrap_prefer_ipv6: false
   filtering_enabled: true
   filters_update_interval: 24
   parental_enabled: false
-  safesearch_enabled: false
   safebrowsing_enabled: false
   safebrowsing_cache_size: 1048576
   safesearch_cache_size: 1048576
   parental_cache_size: 1048576
   cache_time: 30
+  safe_search:
+    enabled: false
+    bing: true
+    duckduckgo: true
+    google: true
+    pixabay: true
+    yandex: true
+    youtube: true
   rewrites:
     - domain: medium.com
       answer: 0.0.0.0
@@ -81,6 +88,8 @@ dns:
   private_networks: []
   use_private_ptr_resolvers: true
   local_ptr_upstreams: []
+  use_dns64: false
+  dns64_prefixes: []
   serve_http3: false
   use_http3_upstreams: false
 tls:
@@ -98,6 +107,16 @@ tls:
   certificate_path: ""
   private_key_path: ""
   strict_sni_check: false
+querylog:
+  ignored: []
+  interval: 2160h
+  size_memory: 1000
+  enabled: true
+  file_enabled: true
+statistics:
+  ignored: []
+  interval: 24h
+  enabled: true
 filters:
   - enabled: true
     url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
@@ -161,4 +180,4 @@ os:
   group: ""
   user: ""
   rlimit_nofile: 0
-schema_version: 14
+schema_version: 20

data/grafana/grafana.ini

@@ -0,0 +1,11 @@
+[database]
+type = postgres
+host = postgres:5432
+name = grafana
+user = grafana
+password = ZTliY2MwOWQ5ZjNiMzUyMTc5YWMwNmJi
+ssl_mode = disable
+
+[auth.ldap]
+enabled = true
+config_file = /etc/grafana/ldap.toml

data/jupyterhub/jupyterhub_config.py

@@ -14,18 +14,37 @@ network_name = os.environ['DOCKER_NETWORK_NAME']
 c.SwarmSpawner.network_name = network_name
 c.SwarmSpawner.remove_containers = True
 c.SwarmSpawner.debug = True
-c.SwarmSpawner.image = "jupyterhub/singleuser:latest"
+# c.SwarmSpawner.image = "jupyterhub/singleuser:latest"
+# c.SwarmSpawner.image = "marcpartensky/jupyterhub-singleuser"
+# c.SwarmSpawner.image = os.environ["DOCKER_IMAGE"]
+# c.SwarmSpawner.host_ip = "juypterhub"
+# c.SwarmSpawner.container_spec = {
+#               # The command to run inside the service
+#               'args' : ['/usr/local/bin/start-singleuser.sh'], # (list)
+#               'Image' : 'juypterhub/singleuser',
+#               # 'mounts' : mounts
+#       }
 c.SwarmSpawner.host_ip = "0.0.0.0"
 
+# kill old kernels
+# https://opendreamkit.org/2018/10/17/jupyterhub-docker/
+# c.JupyterHub.services = [
+#     {
+#         'name': 'cull_idle',
+#         'admin': True,
+#         'command': 'python3 /srv/jupyterhub/cull_idle_servers.py --timeout=3600'.split(),
+#     },
+# ]
+
 # Persistence
-notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/jovyan/work'
-c.DockerSpawner.notebook_dir = notebook_dir
-c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }
+# notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/jovyan/work'
+# c.DockerSpawner.notebook_dir = notebook_dir
+# c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }
 
 # Authentication
 # c.JupyterHub.authenticator_class = 'dummyauthenticator.DummyAuthenticator'
 c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
-c.LDAPAuthenticator.server_address = "marcpartensky.com"
+c.LDAPAuthenticator.server_address = "ldap"
 c.LDAPAuthenticator.use_ssl = True
 c.LDAPAuthenticator.bind_dn_template = [
     "uid={username},ou=people,dc=admin,dc=org",

data/openssl/openssl.conf

@@ -0,0 +1,35 @@
+ [ req ]
+ default_bits           = 8192
+ default_keyfile        = privkey.pem
+ distinguished_name     = req_distinguished_name
+ attributes             = req_attributes
+ x509_extensions        = v3_ca
+
+ dirstring_type = nobmp
+
+ [ req_distinguished_name ]
+ countryName                    = FR
+ countryName_default            = FR
+ countryName_min                = 2
+ countryName_max                = 2
+
+ localityName                   = Europe/Paris
+
+ organizationalUnitName         = Marc Partensky Corp
+
+ commonName                     = Marc Partensky
+ commonName_max                 = 64
+
+ emailAddress                   = marc@marcpartensky.com
+ emailAddress_max               = 40
+
+ # [ req_attributes ]
+ # challengePassword              = A challenge password
+ # challengePassword_min          = 4
+ # challengePassword_max          = 20
+
+ [ v3_ca ]
+
+ subjectKeyIdentifier=hash
+ authorityKeyIdentifier=keyid:always,issuer:always
+ basicConstraints = CA:true

data/postgres/initdb.d/create-marc-user.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+set -e
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+	CREATE USER marc PASSWORD ZGQ4ZDk5OWEwYjNlMDJlNmQ5NmE1NjM5;
+	GRANT ALL PRIVILEGES ON DATABASE * TO marc;
+EOSQL
+

data/postgres/initdb.d/create-ssl-keys.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+cd /var/lib/postgresql/certs
+
+# private key and certificate from it
+openssl req -new -text -newkey rsa:8192 -passout pass:$POSTGRES_PASSWORD -subj /CN=localhost -out server.req -keyout privkey.pem
+# self signed root certificate
+openssl rsa -in privkey.pem -passin pass:$POSTGRES_PASSWORD -out server.key
+# derived certificate
+openssl req -x509 -in server.req -text -key server.key -out server.crt
+
+# change permissions to the root certificate for postgres
+chmod 600 server.key
+chown postgres:postgres server.key

data/prometheus/prometheus.yml

@@ -11,9 +11,13 @@ global:
 scrape_configs:
   # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
   - job_name: 'prometheus'
-
     # Override the global default and scrape targets from this job every 5 seconds.
     scrape_interval: 5s
-
     static_configs:
-      - targets: ['localhost:9090']
+      - targets: ['node-exporter:9100']
+
+  - job_name: cadvisor
+    scrape_interval: 5s
+    static_configs:
+    - targets:
+      - cadvisor:8080

data/traefik/traefik.yml

@@ -6,7 +6,8 @@ api:
   # insecure: false # = secure
   insecure: true
   dashboard: true
-  debug: true
+  # debug: true
+  debug: false
 providers:
   docker:
     swarmMode: true

env/vps.txt

@@ -4,8 +4,7 @@ valentin
 open-web-calendar
 adguard
 servant
-discord-bot
-ia
+discord
 docker-api
 ialab
 portainer
@@ -20,3 +19,5 @@ pritunl-mongo
 fail2ban
 ldap
 ldap-manager
+vaultwarden
+authentik

services/adguard.yml

@@ -24,20 +24,14 @@ services:
       - ../data/adguard:/opt/adguardhome/conf
     networks:
       - caddy
-    labels:
-      caddy: adguard.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 3000}}"
-      traefik.enable: "true"
-      traefik.http.routers.adguard.rule: Host(`adguard.marcpartensky.com`)
-      traefik.http.routers.adguard.entrypoints: websecure
-      traefik.http.routers.adguard.tls.certresolver: tls
-      traefik.http.services.adguard.loadbalancer.server.port: 3000
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.adguard.rule: Host(`adguard.marcpartensky.com`)
+        traefik.http.routers.adguard.rule: >
+          Host(`adguard.marcpartensky.com`) ||
+          Host(`adguard.marcpartensky.fr`)
         traefik.http.routers.adguard.entrypoints: websecure
-        traefik.http.routers.adguard.tls.certresolver: tls
+        traefik.http.routers.adguard.tls.certresolver: cloudflare
         traefik.http.services.adguard.loadbalancer.server.port: 3000
         traefik.http.routers.adguard.middlewares: ldap_auth
 

services/agenda_militant.yml

@@ -5,16 +5,10 @@ services:
     restart: unless-stopped
     networks:
       - caddy
-    labels:
-      caddy: agenda.militant.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 8080}}"
-      traefik.enable: "true"
-      traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
-      traefik.http.routers.agenda_militant.entrypoints: websecure
-      traefik.http.routers.agenda_militant.tls.certresolver: tls
-      traefik.http.services.agenda_militant.loadbalancer.server.port: 8080
     deploy:
       labels:
+        caddy: agenda.militant.marcpartensky.com
+        caddy.reverse_proxy: "{{upstreams 8080}}"
         traefik.enable: "true"
         traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
         traefik.http.routers.agenda_militant.entrypoints: websecure

services/authentik.yml

@@ -6,75 +6,66 @@ services:
     restart: unless-stopped
     command: server
     environment:
-      AUTHENTIK_REDIS__HOST: authentik_redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik_postgres
+      AUTHENTIK_DEBUG: "true"
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
       AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: admin
       # WORKERS: 2
-    volumes:
-      - authentik_media:/media
-      - authentik_templates:/templates
-      - authentik_geoip:/geoip
     env_file:
       - ../data/secrets/authentik.env
     # ports:
     #   - "0.0.0.0:${AUTHENTIK_PORT_HTTP:-9000}:9000"
     #   - "0.0.0.0:${AUTHENTIK_PORT_HTTPS:-9443}:9443"
-    depends_on:
-      - authentik_postgres
-      - authentik_redis
-      - authentik_worker
+    volumes:
+      - media:/media
+      - templates:/templates
+      - geoip:/geoip
+    # depends_on:
+    #   - postgres
+    #   - redis
+    #   - worker
     networks:
       - authentik
       - caddy
+      - postgres
+      - redis
+      - ldap
     labels:
       caddy: authentik.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 9000}}"
-      traefik.enable: "true"
-      traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.com`)
-      traefik.http.routers.authentik.entrypoints: websecure
-      traefik.http.routers.authentik.tls.certresolver: tls
-      traefik.http.services.authentik.loadbalancer.server.port: 9000
+      # traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.com`)
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.fr`)
+        traefik.http.routers.authentik.entrypoints: websecure
+        traefik.http.routers.authentik.tls.certresolver: cloudflare
+        traefik.http.services.authentik.loadbalancer.server.port: 9000
 
-  authentik_postgres:
-    image: postgres:alpine
-    restart: unless-stopped
-    volumes:
-      - authentik_postgres:/var/lib/postgresql/data
-    env_file:
-      - ../data/secrets/authentik.env
-    networks:
-      - authentik
-
-  authentik_redis:
-    image: redis:alpine
-    restart: unless-stopped
-    networks:
-      - authentik
-
-  authentik_worker:
+  worker:
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.2.1}
     restart: unless-stopped
     user: root
     command: worker
     environment:
-      AUTHENTIK_REDIS__HOST: authentik_redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik_postgres
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_POSTGRESQL__HOST: postgres
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
     # This is optional, and can be removed. If you remove this, the following will happen
     # - The permissions for the /backups and /media folders aren't fixed, so make sure they are 1000:1000
     # - The docker socket can't be accessed anymore
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - authentik_backups:/backups
-      - authentik_media:/media
-      - authentik_certs:/certs
-      - authentik_templates:/templates
-      - authentik_geoip:/geoip
+      - /srv/authentik:/backups
+      - media:/media
+      - certs:/certs
+      - templates:/templates
+      - geoip:/geoip
     env_file:
       - ../data/secrets/authentik.env
     networks:
       - authentik
+      - postgres
+      - redis
 
   # authentik_geoipupdate:
   #   image: maxmindinc/geoipupdate:latest
@@ -88,16 +79,41 @@ services:
   #   #   - ../data/secrets/authentik.env
   #   networks:
   #     - authentik
+  #     version: "3.5"
+
+  ldap:
+    image: ghcr.io/goauthentik/ldap
+    ports:
+      - 3389:389
+      - 6636:636
+    # Optionally specify which networks the container should be
+    # might be needed to reach the core authentik server
+    networks:
+      - authentik
+    environment:
+      AUTHENTIK_DEBUG: "true"
+      AUTHENTIK_HOST: http://authentik:9000
+      # AUTHENTIK_HOST: https://authentik:9443
+      # AUTHENTIK_HOST: https://authentik.marcpartensky.fr
+      AUTHENTIK_INSECURE: "false"
+    env_file:
+      - ../data/secrets/authentik_ldap.env
 
 volumes:
-  authentik_postgres:
-  authentik_backups:
-  authentik_media:
-  authentik_certs:
-  authentik_templates:
-  authentik_geoip:
+  # backups:
+  postgres:
+  media:
+  certs:
+  templates:
+  geoip:
 
 networks:
   authentik:
+  ldap:
+    external: true
+  redis:
+    external: true
+  postgres:
+    external: true
   caddy:
     external: true

services/beef.yml

@@ -21,7 +21,8 @@ services:
       caddy.@ws.1_header: "Upgrade websocket"
       caddy.0_reverse_proxy: "@ws {{upstreams 61985}}"
       traefik.enable: "true"
-      traefik.http.routers.beef.rule: Host(`beef.marcpartensky.com`)
+      # traefik.http.routers.beef.rule: Host(`beef.marcpartensky.com`)
+      traefik.http.routers.beef.rule: Host(`beef.marcpartensky.fr`)
       traefik.http.routers.beef.entrypoints: websecure
       traefik.http.routers.beef.tls.certresolver: tls
       traefik.http.services.beef.loadbalancer.server.port: 3000

services/cadvisor.yml

@@ -0,0 +1,54 @@
+version: '3'
+
+services:
+  cadvisor:
+    # image: google/cadvisor:v0.39.0
+    # image: google/cadvisor
+    image: gcr.io/cadvisor/cadvisor
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:rw
+      - /sys:/sys:ro
+      - /var/lib/docker:/var/lib/docker:ro
+    command:
+      - '-docker_only'
+      - '-logtostderr'
+    #   - '-storage-driver=influxdb'
+    #   - '-storage-opt=host=swarm-manager1:8086'
+    #   - '-storage-opt=database=cadvisor'
+    #   - '-storage-opt=retention=1d'
+    #   - '-storage-opt=user=root'
+    #   - '-storage-opt=password=yourpassword'
+    #   - '-housekeeping_interval=5s'
+    #   - '-enable_load_reader'
+    #   - '-cpu_global_percentage=true'
+    #   - '-cpu_historic_interval=1m'
+    #   - '-docker_label_enable'
+    networks:
+      - caddy
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
+      resources:
+        limits:
+          memory: 1g
+        reservations:
+          memory: 512m
+      restart_policy:
+        condition: on-failure
+      mode: global
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.cadvisor.rule: Host(`cadvisor.marcpartensky.fr`)
+        # traefik.http.routers.cadvisor.rule: >
+        #   Host(`cadvisor.marcpartensky.com`) || Host(`cadvisor.marcpartensky.fr`)
+        traefik.http.routers.cadvisor.entrypoints: websecure
+        traefik.http.routers.cadvisor.tls.certresolver: tls
+        traefik.http.services.cadvisor.loadbalancer.server.port: 8080
+        traefik.http.routers.cadvisor.middlewares: ldap_auth
+
+      
+networks:
+  caddy:
+    external: true

services/cloudflare.yml

@@ -0,0 +1,11 @@
+version: "3.9"
+services:
+  cloudflare:
+    image: cloudflare/cloudflared:latest
+    env_file: ../data/secrets/cloudflare.env
+    command: tunnel --no-autoupdate run
+    networks:
+      - caddy
+networks:
+  caddy:
+    external: true

services/crafty-controller.yml

@@ -0,0 +1,21 @@
+version: "3.9"
+services:
+  controller:
+    image: cybercube/crafty-controller
+    networks:
+      - caddy
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.controller.loadbalancer.server.port: 8000
+        traefik.http.routers.controller.rule: Host(`controller.marcpartensky.fr`)
+        # traefik.http.routers.controller.rule: >
+        #   Host(`controller.marcpartensky.com`) || Host(`controller.marcpartensky.fr`)
+        traefik.http.routers.controller.entrypoints: websecure
+        # traefik.http.routers.controller.tls.certresolver: tls
+        traefik.http.routers.controller.tls.certresolver: cloudflare
+        # traefik.http.routers.controller.middlewares: ldap_auth
+
+networks:
+  caddy:
+    external: true

services/crontab.yml

@@ -0,0 +1,29 @@
+version: "3.9"
+services:
+  ui:
+    image: alseambusher/crontab-ui
+    networks:
+      - caddy
+    # ports:
+    #   - 8000:8000
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - crontabs:/crontab-ui/crontabs
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.ui.loadbalancer.server.port: 8000
+        traefik.http.routers.ui.rule: >
+          Host(`cron.marcpartensky.com`) ||
+          Host(`cron.marcpartensky.fr`)
+        traefik.http.routers.ui.entrypoints: websecure
+        # traefik.http.routers.ui.tls.certresolver: tls
+        traefik.http.routers.ui.tls.certresolver: cloudflare
+        traefik.http.routers.ui.middlewares: ldap_auth
+
+volumes:
+  crontabs:
+
+networks:
+  caddy:
+    external: true

services/discord.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   bot:
-    image: marcpartensky/discord-bot
+    image: marcpartensky/discord-bot:v107.be20e90.2022-05-21
     restart: unless-stopped
     ports:
       - "7010:8000"

services/duplicati.yml

@@ -15,26 +15,16 @@ services:
       - duplicati_source:/source
     networks:
       - caddy
-    labels:
-      caddy: duplicati.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 8200}}"
-      traefik.enable: "true"
-      traefik.http.services.duplicati.loadbalancer.server.port: 8200
-      traefik.http.routers.duplicati.rule: >
-        Host(`duplicati.marcpartensky.com`) || Host(`dupliati.marcpartensky.fr`)
-      traefik.http.routers.duplicati.entrypoints: websecure
-      # traefik.http.routers.duplicati.tls.certresolver: tls
-      traefik.http.routers.duplicati.middlewares: ldap_auth
     deploy:
       labels:
         traefik.enable: "true"
         traefik.http.services.duplicati.loadbalancer.server.port: 8200
-        # traefik.http.routers.duplicati.rule: Host(`duplicati.marcpartensky.com`)
         traefik.http.routers.duplicati.rule: >
-          Host(`duplicati.marcpartensky.com`) || Host(`duplicati.marcpartensky.fr`)
+          Host(`duplicati.marcpartensky.com`) ||
+          Host(`duplicati.marcpartensky.fr`)
         traefik.http.routers.duplicati.entrypoints: websecure
-        # traefik.http.routers.duplicati.tls.certresolver: tls
-        traefik.http.routers.duplicati.tls.certresolver: cloudflare
+        traefik.http.routers.duplicati.tls.certresolver: tls
+        # traefik.http.routers.duplicati.tls.certresolver: cloudflare
         # traefik.http.routers.duplicati.middlewares: ldap_auth
 
 volumes:

services/etesync.yml

@@ -0,0 +1,34 @@
+version: "3.9"
+services:
+  etesync:
+    image: victorrds/etesync
+    restart: unless-stopped
+    networks:
+      - caddy
+      - postgres
+    env_file:
+      - ../data/secrets/etesync.env
+    volumes:
+      - static:/srv/etebase/static
+      - media:/data/media
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.etesync.loadbalancer.server.port: 3735
+        traefik.http.routers.etesync.rule: >
+          # Host(`etesync.marcpartensky.com`) ||
+          Host(`etesync.marcpartensky.fr`)
+        traefik.http.routers.etesync.entrypoints: websecure
+        traefik.http.routers.etesync.tls.certresolver: tls
+        # traefik.http.routers.etesync.tls.certresolver: cloudflare
+        # traefik.http.routers.etesync.middlewares: ldap_auth
+
+networks:
+  postgres:
+    external: true
+  caddy:
+    external: true
+
+volumes:
+  static:
+  media:

services/etherpad.yml

@@ -4,27 +4,36 @@ services:
   etherpad:
     image: etherpad/etherpad
     restart: unless-stopped
-    environment:
-      ADMIN_PASSWORD: supersecret
+    env_file:
+      - ../data/secrets/etherpad.env
+    # environment:
+    #   SETTINGS_PATH: /etc/etherpad/settings.json
     networks:
-        - caddy
-    labels:
-      caddy: etherpad.marcpartensky.com, pad.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 9001}}"
-      traefik.enable: "true"
-      traefik.http.routers.etherpad.rule: Host(`pad.marcpartensky.com`)
-      traefik.http.routers.etherpad.entrypoints: websecure
-      traefik.http.routers.etherpad.tls.certresolver: tls
-      traefik.http.services.etherpad.loadbalancer.server.port: 9001
+      - caddy
+      - postgres
+    # volumes:
+    #   - data:/opt/etherpad-lite/var
+    # volumes:
+    #   - ../data/etherpad/settings.json:/opt/etherpad-lite/settings.json
     deploy:
       labels:
         traefik.enable: "true"
         traefik.http.routers.etherpad.rule: >
-          Host(`pad.marcpartensky.com`) && Host(`pad.marcpartensky.fr`)
+          Host(`pad.marcpartensky.com`) ||
+          Host(`pad.marcpartensky.fr`)
         traefik.http.routers.etherpad.entrypoints: websecure
-        traefik.http.routers.etherpad.tls.certresolver: tls
+        traefik.http.routers.etherpad.tls.certresolver: cloudflare
         traefik.http.services.etherpad.loadbalancer.server.port: 9001
+        traefik.http.middlewares.redirect-pad-com.redirectregex.regex: "^https://etherpad.marcpartensky.com/(.*)"
+        traefik.http.middlewares.redirect-pad-com.redirectregex.replacement: "https://pad.marcpartensky.com/$${1}"
+        traefik.http.middlewares.redirect-pad-fr.redirectregex.regex: "^https://etherpad.marcpartensky.fr/(.*)"
+        traefik.http.middlewares.redirect-pad-fr.redirectregex.replacement: "https://pad.marcpartensky.fr/$${1}"
+
+# volumes:
+#   data:
 
 networks:
   caddy:
     external: true
+  postgres:
+    external: true

services/filebrowser.yml

@@ -6,7 +6,7 @@ services:
     restart: unless-stopped
     # user: "${UID}:${GID}"
     volumes:
-      - data:/data
+      - /root/Videos:/data
       - ../data/filebrowser:/config
     # environment:
       # FB_BASEURL: /filebrowser
@@ -15,7 +15,9 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.filebrowser.rule: Host(`file.marcpartensky.com`)
+        traefik.http.routers.filebrowser.rule: >
+          Host(`file.marcpartensky.fr`) ||
+          Host(`file.marcpartensky.com`)
         traefik.http.routers.filebrowser.entrypoints: websecure
         traefik.http.routers.filebrowser.tls.certresolver: tls
         traefik.http.services.filebrowser.loadbalancer.server.port: 8080

services/fuseki.yml

@@ -0,0 +1,31 @@
+version: "3.9"
+
+services:
+  fuseki:
+    image: stain/jena-fuseki
+    volumes:
+      # - ./config:/fuseki/configuration
+      - data:/fuseki/databases
+    # environment:
+    #   - FUSEKI_HOME=/fuseki
+    #   - FUSEKI_BASE=/fuseki/databases
+    env_file:
+      - ../data/secrets/fuseki.env
+    networks:
+      - caddy
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.fuseki.rule: Host(`fuseki.marcpartensky.com`)
+        traefik.http.services.fuseki.loadbalancer.server.port: 3030
+
+networks:
+  caddy:
+    external: true
+
+volumes:
+  data:

services/gitea-postgres.yml

@@ -1,19 +0,0 @@
-version: "3.9"
-
-services:
-  gitea_postgres:
-    image: postgres
-    restart: unless-stopped
-    env_file:
-      - ../data/secrets/gitea.env
-    networks:
-      - caddy
-      - gitea
-    volumes:
-      - gitea_postgres:/var/lib/postgresql/data
-
-volumes:
-  gitea_postgres:
-
-networks:
-  gitea:

services/gitea.yml

@@ -31,9 +31,9 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.gitea.rule: >
-        #   Host(`git.marcpartensky.com`) || Host(`git.marcpartensky.fr`)
-        traefik.http.routers.gitea.rule: Host(`git.marcpartensky.fr`)
+        traefik.http.routers.gitea.rule: >
+          Host(`git.marcpartensky.com`) ||
+          Host(`git.marcpartensky.fr`)
         traefik.http.routers.gitea.entrypoints: websecure
         # traefik.http.routers.gitea.tls.certresolver: tls
         traefik.http.routers.gitea.tls.certresolver: cloudflare

services/gpg.yml

@@ -0,0 +1,7 @@
+version: "3.9"
+services:
+  gpg:
+    image: marcpartensky/gpg
+    volumes:
+      - /srv:/srv
+      - ../data/gpg:/root/keys

services/grafana.yml

@@ -0,0 +1,38 @@
+version: "3.9"
+services:
+  grafana:
+    image: grafana/grafana
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/grafana.env
+    # environment:
+      # GF_INSTALL_PLUGINS: grafana-ldap-auth
+    volumes:
+      - ../data/grafana:/etc/grafana
+      - grafana:/var/lib/grafana
+    networks:
+      - caddy
+      - postgres
+      - ldap
+    deploy:
+      labels:
+        caddy: grafana.marcpartensky.com
+        caddy.reverse_proxy: "{{upstreams 3000}}"
+        traefik.enable: "true"
+        traefik.http.routers.grafana.rule: >
+          Host(`grafana.marcpartensky.fr`) ||
+          Host(`grafana.marcpartensky.com`)
+        traefik.http.routers.grafana.entrypoints: websecure
+        traefik.http.routers.grafana.tls.certresolver: tls
+        traefik.http.services.grafana.loadbalancer.server.port: 3000
+
+volumes:
+  grafana:
+
+networks:
+  ldap:
+    external: true
+  postgres:
+    external: true
+  caddy:
+    external: true

services/homer.yml

@@ -15,7 +15,9 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.homer.rule: Host(`homer.marcpartensky.com`)
+        traefik.http.routers.homer.rule: >
+          Host(`homer.marcpartensky.com`) ||
+          Host(`homer.marcpartensky.fr`)
         traefik.http.routers.homer.entrypoints: websecure
         traefik.http.routers.homer.tls.certresolver: tls
         traefik.http.services.homer.loadbalancer.server.port: 8080

services/hydra.yml

@@ -1,10 +1,12 @@
 version: "3.9"
 services:
   hydra:
-    image: marcpartensky/hydra
-    network: host
-    command: -P /rockyou.txt -L /usernames.txt ssh://192.168.252.84
-    workdir: /root
+    image: marcpartensky/hydra:latest
+    network_mode: host
+    env_file:
+      - ../data/secrets/hydra.env
+    # command: -P /rockyou.txt -L /usernames.txt ssh://192.168.252.18
+    # workdir: /root
     volumes:
       - ../data/hydra/rockyou.txt:/rockyou.txt
       - ../data/hydra/usernames.txt:/usernames.txt

services/ipfs.yml

@@ -9,6 +9,7 @@ services:
       TZ: Europe/Paris
     volumes:
       - ipfs:/config
+      - /srv/:/srv
     networks:
       - caddy
     ports:
@@ -28,8 +29,9 @@ services:
       labels:
         traefik.enable: "true"
         # traefik.http.routers.ipfs.rule: Host(`ipfs.marcpartensky.com`)
-        traefik.http.routers.ipfs.rule: >
-          Host(`ipfs.marcpartensky.com`) || Host(`ipfs.marcpartensky.fr`)
+        traefik.http.routers.ipfs.rule: Host(`ipfs.marcpartensky.fr`)
+        # traefik.http.routers.ipfs.rule: >
+        #   Host(`ipfs.marcpartensky.com`) || Host(`ipfs.marcpartensky.fr`)
         # traefik.http.routers.ipfs.entrypoints: websecure
         # traefik.http.routers.ipfs.tls.certresolver: tls
         traefik.http.routers.ipfs.tls.certresolver: cloudflare
@@ -43,7 +45,7 @@ services:
         # traefik.http.middlewares.add-context.redirectregex.regex: ^https:\\/\\/([^\\/]+)\\/?$$
         # traefik.http.middlewares.add-context.redirectregex.replacement: https://$$1/webui
         #
-        traefik.http.routers.service_nextcloud.middlewares: custom_repath
+        traefik.http.routers.ipfs.middlewares: custom_repath
         traefik.http.middlewares.custom_repath.replacepathregex.regex: ^/$$
         traefik.http.middlewares.custom_repath.replacepathregex.replacement: /webui
           

services/jellyfin.yml

@@ -26,8 +26,9 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.jellyfin.rule: Host(`jellyfin.marcpartensky.com`)
-        traefik.http.routers.jellyfin.rule: Host(`jellyfin.marcpartensky.fr`)
+        traefik.http.routers.jellyfin.rule: >
+          Host(`jellyfin.marcpartensky.fr`) ||
+          Host(`jellyfin.marcpartensky.com`)
         traefik.http.routers.jellyfin.entrypoints: websecure
         traefik.http.routers.jellyfin.tls.certresolver: tls
         traefik.http.services.jellyfin.loadbalancer.server.port: 8096

services/jupyterhub.yml

@@ -9,12 +9,15 @@ services:
       - ../data/jupyterhub/jupyterhub_config.py:/srv/jupyterhub/jupyterhub_config.py
       # - jupyterhub:/srv/jupyterhub
     networks:
-    - caddy
-    - jupyterhub
+      - ldap
+      - caddy
+      - jupyterhub
     environment:
-      DOCKER_JUPYTER_IMAGE: marcpartensky/jupyterlab
-      DOCKER_NETWORK_NAME: jupyterhub
+      # DOCKER_IMAGE: marcpartensky/jupyterlab
+      DOCKER_IMAGE: jupyterhub/singleuser
+      DOCKER_NETWORK_NAME: caddy
       HUB_IP: jupyterhub
+      DOCKER_HOST: unix:///var/run/docker.sock
     labels:
       caddy: jupyterhub.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 8000}}"
@@ -23,10 +26,12 @@ services:
       traefik.http.routers.jupyterhub.entrypoints: websecure
       traefik.http.routers.jupyterhub.tls.certresolver: tls
       traefik.http.services.jupyterhub.loadbalancer.server.port: 8000
+      # traefik.docker.network: jupyterhub_default
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.jupyterhub.rule: Host(`jupyterhub.marcpartensky.com`)
+        # traefik.http.routers.jupyterhub.rule: Host(`jupyterhub.marcpartensky.com`)
+        traefik.http.routers.jupyterhub.rule: Host(`hub.marcpartensky.fr`)
         traefik.http.routers.jupyterhub.entrypoints: websecure
         traefik.http.routers.jupyterhub.tls.certresolver: tls
         traefik.http.services.jupyterhub.loadbalancer.server.port: 8000
@@ -37,3 +42,5 @@ networks:
     driver: overlay
   caddy:
     external: true
+  ldap:
+    external: true

services/jupyterlab.yml

@@ -2,25 +2,41 @@ version: "3.9"
 
 services:
   jupyterlab:
-    image: jupyter/datascience-notebook:latest
-    restart: unless-stopped
+    # image: jupyter/datascience-notebook:latest
+    image: marcpartensky/jupyterlab
+    # restart: unless-stopped
     environment:
     #   - GEN_CERT=yes
       JUPYTER_ENABLE_LAB: "yes"
       GRANT_SUDO: "yes"
+      JUPYTER_CONFIG_DIR: /home/jupyter/.jupyter
+    # entrypoint: python -m jupyter lab
     # entrypoint: start.sh jupyter lab --user root
     networks:
       - caddy
-    labels:
-      caddy: lab.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 8888}}"
-      traefik.enable: "true"
-      traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.com`)
-      traefik.http.routers.jupyterlab.entrypoints: websecure
-      traefik.http.routers.jupyterlab.tls.certresolver: tls
-      traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
-    volumes:
-      - jupyterlab:/home/jovyan
+    # labels:
+    #   caddy: lab.marcpartensky.com
+    #   caddy.reverse_proxy: "{{upstreams 8888}}"
+    #   traefik.enable: "true"
+    #   traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.com`)
+    #   traefik.http.routers.jupyterlab.entrypoints: websecure
+    #   traefik.http.routers.jupyterlab.tls.certresolver: tls
+    #   traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
+    # volumes:
+      # - jupyterlab:/home/jupyter
+      # - ../data/jupyterlab/:/home/jupyter/.jupyter/
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
+      labels:
+        traefik.enable: "true"
+        # traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.fr`)
+        traefik.http.routers.jupyterlab.rule: >
+          Host(`lab.marcpartensky.fr`) && Host(`lab.marcpartensky.com`)
+        traefik.http.routers.jupyterlab.entrypoints: websecure
+        traefik.http.routers.jupyterlab.tls.certresolver: cloudflare
+        traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
 # entrypoint: start-notebook.sh \
     #     --NotebookApp.keyfile=key/0000_key-certbot.pem
     #     --NotebookApp.certfile=cert/0000_csr-certbot.pem

services/ldap.yml

@@ -20,6 +20,13 @@ services:
       - ldap:/var/lib/ldap
       - ldap_slapd:/etc/ldap/slapd.d
 
+
+  backup:
+    image: osixia/openldap-backup:1.5.0
+    environment:
+      LDAP_BACKUP_CONFIG_CRON_EXP: "0 5 * * *"
+      LDAP_BACKUP_DATA_CRON_EXP: "0 5 * * *"
+
 volumes:
   ldap:
   ldap_slapd:

services/logseq.yml

@@ -0,0 +1,29 @@
+version: "3.9"
+services:
+  logseq:
+    image: ghcr.io/logseq/logseq-webapp:latest
+    # volumes:
+    networks:
+      - traefik
+      - postgres
+    labels:
+      traefik.enable: "true"
+      # traefik.http.routers.focalboard.rule: >
+      #   Host(`board.marcpartensky.com`) || Host(`board.marcpartensky.fr`)
+      traefik.http.routers.logseq.service: logseq
+      traefik.http.routers.logseq.rule: >
+        Host(`logseq.marcpartensky.com`)
+      traefik.http.routers.logseq.tls: true
+      traefik.http.routers.logseq.entrypoints: web-secure
+      traefik.http.routers.logseq.tls.certresolver: default
+      traefik.http.services.logseq.loadbalancer.server.port: 80
+      # traefik.http.routers.focalboard.middlewares: ldap_auth
+
+volumes:
+  data:
+  pack:
+networks:
+  postgres:
+    external: true
+  traefik:
+    external: true

services/matrix.yml

@@ -14,7 +14,8 @@ services:
       - ../data/matrix:/data
       # - matrix:/data
     networks:
-        - caddy
+      - caddy
+      - postgres
     healthcheck:
       test: ["CMD", "curl", "-fSs", "http://localhost:8008/health"]
       interval: 15s
@@ -39,5 +40,7 @@ services:
         traefik.http.services.matrix.loadbalancer.server.port: 8008
 
 networks:
+  postgres:
+    external: true
   caddy:
     external: true

services/mc-backup.yml

@@ -1,7 +1,7 @@
 version: "3.9"
 
 services:
-  backups:
+  backup:
     image: itzg/mc-backup
     environment:
       BACKUP_INTERVAL: "1d"
@@ -9,7 +9,7 @@ services:
       SERVE_PORT: 25565
       RCON_HOST: minecraft
       RCON_PORT: 25575
-      PAUSE_IF_NO_PLAYER: true
+      PAUSE_IF_NO_PLAYER: "true"
       PLAYERS_ONLINE_CHECK_INTERVAL: 1h
       TZ: Europe/Paris
       DEST_DIR: /backups
@@ -18,6 +18,6 @@ services:
     - /srv/minecraft/champi:/data:ro
     # use a host attached directory so that it in turn can be backed up
     # to external/cloud storage
-    - ./mc-backups:/backups
+    - /srv/mcbackups:/backups
     # share network namespace with server to simplify rcon access
     # network_mode: "service:mc"

services/mcmyadmin.yml

@@ -20,17 +20,18 @@ services:
       caddy.reverse_proxy: "{{upstreams 8080}}"
       authorize.with: marc
       traefik.enable: "true"
-      traefik.http.routers.minecraft.rule: Host(`mcadmin.marcpartensky.com`)
-      traefik.http.routers.minecraft.entrypoints: websecure
-      traefik.http.routers.minecraft.tls.certresolver: tls
-      traefik.http.services.minecraft.loadbalancer.server.port: 8080
+      traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.com`)
+      traefik.http.routers.mcmyadmin.entrypoints: websecure
+      traefik.http.routers.mcmyadmin.tls.certresolver: tls
+      traefik.http.services.mcmyadmin.loadbalancer.server.port: 8080
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.minecraft.rule: Host(`mcadmin.marcpartensky.com`)
-        traefik.http.routers.minecraft.entrypoints: websecure
-        traefik.http.routers.minecraft.tls.certresolver: tls
-        traefik.http.services.minecraft.loadbalancer.server.port: 8080
+        # traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.com`)
+        traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.fr`)
+        traefik.http.routers.mcmyadmin.entrypoints: websecure
+        traefik.http.routers.mcmyadmin.tls.certresolver: tls
+        traefik.http.services.mcmyadmin.loadbalancer.server.port: 8080
 
 volumes:
   mcmyadmin:

services/minecraft_champi.yml

@@ -1,7 +1,7 @@
 version: "3.9"
 
 services:
-  minecraft_champi:
+  server:
     image: itzg/minecraft-server
     restart: unless-stopped
     environment:
@@ -29,6 +29,29 @@ services:
     networks:
       - minecraft
 
+  backup:
+    image: itzg/mc-backup
+    environment:
+      BACKUP_INTERVAL: "1d"
+      # instead of network_mode below, could declare RCON_HOST
+      SERVE_PORT: 25565
+      RCON_HOST: server
+      RCON_PORT: 25575
+      PAUSE_IF_NO_PLAYER: "true"
+      PLAYERS_ONLINE_CHECK_INTERVAL: 1h
+      TZ: Europe/Paris
+      DEST_DIR: /backups
+    networks:
+      - minecraft
+    volumes:
+    # mount the same volume used by server, but read-only
+    - /srv/minecraft/champi:/data:ro
+    # use a host attached directory so that it in turn can be backed up
+    # to external/cloud storage
+    - /srv/mcbackups:/backups
+    # share network namespace with server to simplify rcon access
+    # network_mode: "service:mc"
+
 # volumes:
 #   minecraft:
 

services/minidlna.yml

@@ -0,0 +1,33 @@
+version: "3.9"
+services:
+  minidlna:
+    image: geekduck/minidlna
+    volumes:
+      - music:/opt/Music
+      - videos:/opt/Videos
+      - pictures:/opt/Pictures
+      - db:/var/cache/minidlna
+      # - ../data/minidlna/minidlna.conf:/etc/minidlna.conf
+    networks:
+      - caddy
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.minidlna.loadbalancer.server.port: 8200
+        traefik.http.routers.minidlna.rule: Host(`minidlna.marcpartensky.fr`)
+        # traefik.http.routers.minidlna.rule: >
+        #   Host(`minidlna.marcpartensky.com`) || Host(`minidlna.marcpartensky.fr`)
+        traefik.http.routers.minidlna.entrypoints: websecure
+        # traefik.http.routers.minidlna.tls.certresolver: tls
+        traefik.http.routers.minidlna.tls.certresolver: cloudflare
+        # traefik.http.routers.minidlna.middlewares: ldap_auth
+
+volumes:
+  music:
+  videos:
+  pictures:
+  db:
+
+networks:
+  caddy:
+    external: true

services/mongo.yml

@@ -5,6 +5,8 @@ services:
     image: mongo
     restart: unless-stopped
     volumes:
+      - ../data/mongo/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
+      - ../data/mongo/config:/etc/mongo
       - mongo:/data/db
     networks:
       - mongo
@@ -39,7 +41,10 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
+        # traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
+        traefik.http.routers.mongo.rule: >
+          Host(`mongo.marcpartensky.fr`) ||
+          Host(`mongo.marcpartensky.com`)
         traefik.http.routers.mongo.entrypoints: websecure
         traefik.http.routers.mongo.tls.certresolver: tls
         traefik.http.services.mongo.loadbalancer.server.port: 8081

services/nextcloud.yml

@@ -16,22 +16,16 @@ services:
       - caddy
       - postgres
       - ldap
-      - nextcloud
         # depends_on:
         #   - nextcloud_mariadb
-    labels:
-      caddy: cloud.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams http 80}}"
-      traefik.enable: "true"
-      traefik.http.routers.nextcloud.rule: Host(`cloud.marcpartensky.com`)
-      traefik.http.routers.nextcloud.entrypoints: websecure
-      traefik.http.routers.nextcloud.tls.certresolver: tls
-      traefik.http.services.nextcloud.loadbalancer.server.port: 80
     deploy:
       labels:
+        caddy: cloud.marcpartensky.com
+        caddy.reverse_proxy: "{{upstreams http 80}}"
         traefik.enable: "true"
         traefik.http.routers.nextcloud.rule: >
-          Host(`cloud.marcpartensky.com`) && Host(`cloud.marcpartensky.fr`)
+          Host(`cloud.marcpartensky.com`) ||
+          Host(`cloud.marcpartensky.fr`)
         traefik.http.routers.nextcloud.entrypoints: websecure
         traefik.http.routers.nextcloud.tls.certresolver: tls
         traefik.http.services.nextcloud.loadbalancer.server.port: 80
@@ -43,7 +37,6 @@ volumes:
   apps:
 
 networks:
-  nextcloud:
   ldap:
     external: true
   caddy:

services/numeris.yml

@@ -7,14 +7,14 @@ services:
     env_file:
       - ../data/secrets/numeris.env
     links:
-      - numeris:db
+      - mysql:db
     networks:
       - caddy
       - numeris
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.phpmyadmin.rule: Host(`phpmyadmin.numeris.marcpartensky.com`)
+        traefik.http.routers.phpmyadmin.rule: Host(`phpmyadmin.numeris.marcpartensky.fr`)
         traefik.http.routers.phpmyadmin.entrypoints: websecure
         traefik.http.routers.phpmyadmin.tls.certresolver: tls
         traefik.http.services.phpmyadmin.loadbalancer.server.port: 80
@@ -42,7 +42,8 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
+        # traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
+        traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.fr`)
         traefik.http.routers.back.entrypoints: websecure
         traefik.http.routers.back.tls.certresolver: tls
         traefik.http.services.back.loadbalancer.server.port: 80
@@ -54,7 +55,40 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
+        # traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
+        traefik.http.routers.front.rule: Host(`numeris.marcpartensky.fr`)
+        traefik.http.routers.front.entrypoints: websecure
+        traefik.http.routers.front.tls.certresolver: tls
+        traefik.http.services.front.loadbalancer.server.port: 80
+        traefik.http.routers.front.middlewares: ldap_auth
+
+  back-staging:
+    image: numerisisep/numeris-back:staging
+    networks:
+      - caddy
+      - numeris
+    env_file:
+      - ../data/secrets/numeris.env
+    # volumes:
+    #   - .env:/home/numeris/.env
+    deploy:
+      labels:
+        traefik.enable: "true"
+        # traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
+        traefik.http.routers.back.rule: Host(`staging.api.numeris.marcpartensky.fr`)
+        traefik.http.routers.back.entrypoints: websecure
+        traefik.http.routers.back.tls.certresolver: tls
+        traefik.http.services.back.loadbalancer.server.port: 80
+
+  front-staging:
+    image: numerisisep/numeris-front:staging
+    networks:
+      - caddy
+    deploy:
+      labels:
+        traefik.enable: "true"
+        # traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
+        traefik.http.routers.front.rule: Host(`staging.numeris.marcpartensky.fr`)
         traefik.http.routers.front.entrypoints: websecure
         traefik.http.routers.front.tls.certresolver: tls
         traefik.http.services.front.loadbalancer.server.port: 80

services/pandoc.yml

@@ -9,18 +9,13 @@ services:
       - ../data/secrets/pandoc.env
     volumes:
       - pandoc:/app/files
-    labels:
-      caddy: pandoc.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 80}}"
-      traefik.enable: "true"
-      traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
-      traefik.http.routers.pandoc.entrypoints: websecure
-      traefik.http.routers.pandoc.tls.certresolver: tls
-      traefik.http.services.pandoc.loadbalancer.server.port: 80
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
+        # traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
+        traefik.http.routers.pandoc.rule: >
+          Host(`pandoc.marcpartensky.com`) ||
+          Host(`pandoc.marcpartensky.fr`)
         traefik.http.routers.pandoc.entrypoints: websecure
         traefik.http.routers.pandoc.tls.certresolver: tls
         traefik.http.services.pandoc.loadbalancer.server.port: 80

services/peertube.yml

@@ -1,25 +1,28 @@
-version: "3.3"
+version: "3.9"
 
 services:
 
   peertube:
     image: chocobozzz/peertube:production-bullseye
     restart: unless-stopped
-    networks:
-      - caddy
     env_file:
       - ../data/secrets/peertube.env
     ports:
      - "1935:1935" # If you don't want to use the live feature, you can comment this line
     #  - "9000:9000" # If you provide your own webserver and reverse-proxy, otherwise not suitable for production
     volumes:
-      - peertube_assets:/app/client/dist
-      - peertube:/data
+      - assets:/app/client/dist
+      - data:/data
       - ../data/peertube:/config
-    depends_on:
-      - peertube_postgres
-      - peertube_redis
-      - peertube_postfix
+    networks:
+      - peertube
+      - caddy
+      - postgres
+      - redis
+    # depends_on:
+    #   - peertube_postgres
+    #   - peertube_redis
+    #   - peertube_postfix
     labels:
       caddy: peertube.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 80}}"
@@ -28,36 +31,49 @@ services:
       traefik.http.routers.peertube.entrypoints: websecure
       traefik.http.routers.peertube.tls.certresolver: tls
       traefik.http.services.peertube.loadbalancer.server.port: 80
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.peertube.rule: Host(`peertube.marcpartensky.fr`)
+        traefik.http.routers.peertube.entrypoints: websecure
+        traefik.http.routers.peertube.tls.certresolver: tls
+        traefik.http.services.peertube.loadbalancer.server.port: 80
 
-  peertube_postgres:
-    image: postgres:13-alpine
-    restart: unless-stopped
-    env_file:
-      - ../data/secrets/peertube.env
-    volumes:
-      - peertube_postgres:/var/lib/postgresql/data
+  # peertube_postgres:
+  #   image: postgres:13-alpine
+  #   restart: unless-stopped
+  #   env_file:
+  #     - ../data/secrets/peertube.env
+  #   volumes:
+  #     - peertube_postgres:/var/lib/postgresql/data
 
-  peertube_redis:
-    image: redis:6-alpine
-    restart: unless-stopped
-    volumes:
-      - peertube_redis:/data
+  # peertube_redis:
+  #   image: redis:6-alpine
+  #   restart: unless-stopped
+  #   volumes:
+  #     - peertube_redis:/data
 
-  peertube_postfix:
-    image: mwader/postfix-relay
-    restart: unless-stopped
-    env_file:
-      - .env
-    volumes:
-      - peertube_postfix:/etc/opendkim/keys
+  # postfix:
+  #   image: mwader/postfix-relay
+  #   restart: unless-stopped
+  #   networks:
+  #     - peertube
+  #   env_file:
+  #     - .env
+  #   volumes:
+  #     - postfix:/etc/opendkim/keys
 
 networks:
+  peertube:
+  postgres:
+    external: true
+  redis:
+    external: true
   caddy:
     external: true
 
 volumes:
-  peertube:
-  peertube_assets:
-  peertube_postgres:
-  peertube_redis:
-  peertube_postfix:
+  data:
+  assets:
+  postgres:
+  postfix:

services/pg-backup.yml

@@ -0,0 +1,16 @@
+version: "3.9"
+services:
+  pg_backup:
+    image: kartoza/pg-backup:14-3.1
+    env_file:
+      - ../data/secrets/pg_backup.env
+    # environment:
+    #   POSTGRES_MAJOR_VERSION: 14
+    networks:
+      - postgres
+    volumes:
+      - /srv/pg-backup:/backups
+
+networks:
+  postgres:
+    external: true

services/pgadmin.yml

@@ -30,7 +30,8 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.com`)
+        # traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.com`)
+        traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.fr`)
         traefik.http.routers.pgadmin.entrypoints: websecure
         traefik.http.routers.pgadmin.tls.certresolver: tls
         traefik.http.services.pgadmin.loadbalancer.server.port: 80

services/portainer.yml

@@ -1,44 +1,85 @@
 version: "3.9"
 
 services:
-  portainer:
-    image: portainer/portainer-ce
-    restart: unless-stopped
-    environment:
-      VIRTUAL_HOST: docker.marcpartensky.com
-      VIRTUAL_PORT: 9000
+  agent:
+    image: portainer/agent:2.18.2
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - portainer:/data
+      - /var/lib/docker/volumes:/var/lib/docker/volumes
+    networks:
+      - portainer
+    # deploy:
+      # mode: global
+      # placement:
+      #   constraints: [node.platform.os == linux]
+
+  portainer:
+    image: portainer/portainer-ce:2.18.2
+    command: -H tcp://agent:9001 --tlsskipverify
+    # ports:
+    #   - "9443:9443"
+    #   - "9000:9000"
+    #   - "8000:8000"
     networks:
       - caddy
-    command:
-      - --logo
-      - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
-        # healthcheck:
-        # test: ["CMD", "curl", "-f", "http://localhost:9000"]
-        # test: ["CMD", "portainer", "--healthcheck"]
-    depends_on:
-      - caddy
-    labels:
-      caddy: docker.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams 9000}}"
-      traefik.enable: "true"
-      traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
-      traefik.http.routers.portainer.entrypoints: websecure
-      traefik.http.routers.portainer.tls.certresolver: tls
-      traefik.http.services.portainer.loadbalancer.server.port: 9000
+      - portainer
+    volumes:
+      - data:/data
     deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role == manager]
       labels:
         traefik.enable: "true"
-        traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
+        traefik.http.routers.portainer.rule: >
+          Host(`docker.marcpartensky.fr`) && Host(`docker.marcpartensky.com`)
         traefik.http.routers.portainer.entrypoints: websecure
-        traefik.http.routers.portainer.tls.certresolver: tls
+        # traefik.http.routers.portainer.tls.certresolver: tls
+        traefik.http.routers.portainer.tls.certresolver: cloudflare
         traefik.http.services.portainer.loadbalancer.server.port: 9000
 
+  # portainer:
+  #   image: portainer/portainer-ce
+  #   restart: unless-stopped
+  #   # environment:
+  #   #   VIRTUAL_HOST: docker.marcpartensky.com
+  #   #   VIRTUAL_PORT: 9000
+  #   volumes:
+  #     - /var/run/docker.sock:/var/run/docker.sock
+  #     - portainer:/data
+  #   networks:
+  #     - caddy
+  #   command:
+  #     - --logo
+  #     - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
+  #       # healthcheck:
+  #       # test: ["CMD", "curl", "-f", "http://localhost:9000"]
+  #       # test: ["CMD", "portainer", "--healthcheck"]
+  #   depends_on:
+  #     - caddy
+  #   labels:
+  #     caddy: docker.marcpartensky.com
+  #     caddy.reverse_proxy: "{{upstreams 9000}}"
+  #     traefik.enable: "true"
+  #     traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
+  #     traefik.http.routers.portainer.entrypoints: websecure
+  #     traefik.http.routers.portainer.tls.certresolver: tls
+  #     traefik.http.services.portainer.loadbalancer.server.port: 9000
+  #   deploy:
+  #     labels:
+  #       traefik.enable: "true"
+  #       traefik.http.routers.portainer.rule: >
+  #         Host(`docker.marcpartensky.fr`) && Host(`docker.marcpartensky.com`)
+  #       traefik.http.routers.portainer.entrypoints: websecure
+  #       traefik.http.routers.portainer.tls.certresolver: tls
+  #       traefik.http.services.portainer.loadbalancer.server.port: 9000
+  #
 volumes:
-  portainer:
+  # portainer:
+  data:
 
 networks:
+  portainer:
   caddy:
     external: true

services/postgres.yml

@@ -10,10 +10,9 @@ services:
         published: 5432
         mode: host
     volumes:
-      - ../data/postgres:/docker-entrypoint-initdb.d
       - postgres:/var/lib/postgresql/data
-      - ../data/postgres/server.crt:/var/lib/postgresql/server.crt
-      - ../data/postgres/server.key:/var/lib/postgresql/server.key
+      - ../data/postgres/initdb.d:/initdb.d
+      - ../data/postgres/certs:/var/lib/postgresql/certs
     env_file:
       - ../data/secrets/postgres.env
     command: |
@@ -21,10 +20,37 @@ services:
       -c log_statement=all
       -c log_destination=stderr
       -c ssl=on
-      -c ssl_cert_file=/var/lib/postgresql/server.crt
-      -c ssl_key_file=/var/lib/postgresql/server.key
+      -c ssl_cert_file=/var/lib/postgresql/certs/server.crt
+      -c ssl_key_file=/var/lib/postgresql/certs/server.key
     networks:
       - postgres
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -q || exit 1"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+
+  pgagent:
+    image: chiavegatto/postgres-pgagent
+    entrypoint: /bin/sh -c
+                "/tmp/wait-for-it.sh postgres:5432 --timeout=30 &&
+                psql -U postgres -h postgres -p 5432 -d postgres -c 'CREATE EXTENSION IF NOT EXISTS pgagent;' &&
+                pgagent -f hostaddr=postgres dbname=postgres user=postgres port=5432"
+    environment:
+      TIMEZONE: Europe/Paris
+    env_file:
+      - ../data/secrets/postgres.env
+    networks:
+      - postgres
+
+  backup:
+    image: kartoza/pg-backup:14-3.1
+    env_file:
+      - ../data/secrets/pg_backup.env
+    networks:
+      - postgres
+    volumes:
+      - /srv/pg-backup:/backups
 
   pgbackups:
     image: prodrigestivill/postgres-backup-local
@@ -32,10 +58,10 @@ services:
     # user: postgres:postgres
     volumes:
       - /srv/pgbackups:/backups
-    links:
-      - postgres
-    depends_on:
-      - postgres
+    # links:
+    #   - postgres
+    # depends_on:
+    #   - postgres
     networks:
       - postgres
     env_file:

services/pritunl.yml

@@ -6,12 +6,12 @@ services:
     restart: unless-stopped
     ports:
       - "1194-1195:1194-1195/udp"
-    depends_on:
-        - pritunl_mongo
+    # depends_on:
+    #     - pritunl_mongo
     environment:
       REVERSE_PROXY: "true"
       TZ: Europe/Paris
-      MONGODB_URI: mongodb://pritunl_mongo:27017/pritunl
+      MONGODB_URI: mongodb://mongo:27017/pritunl
       PRITUNL_DEBUG: "true"
       # WIREGUARD: true
     privileged: true
@@ -26,20 +26,17 @@ services:
     # volumes:
     #   - /etc/localtime:/etc/localtime:ro
     networks:
+      - mongo
       - caddy
       - pritunl
-    labels:
-      caddy: vpn.marcpartensky.com
-      caddy.reverse_proxy: "{{upstreams http 9700}}"
-      traefik.enable: "true"
-      traefik.http.routers.pritunl.rule: Host(`vpn.marcpartensky.com`)
-      traefik.http.routers.pritunl.entrypoints: websecure
-      traefik.http.routers.pritunl.tls.certresolver: tls
-      traefik.http.services.pritunl.loadbalancer.server.port: 9700
     deploy:
       labels:
+        caddy: vpn.marcpartensky.com
+        caddy.reverse_proxy: "{{upstreams http 9700}}"
         traefik.enable: "true"
-        traefik.http.routers.pritunl.rule: Host(`vpn.marcpartensky.com`)
+        traefik.http.routers.pritunl.rule: >
+          Host(`vpn.marcpartensky.fr`) ||
+          Host(`vpn.marcpartensky.com`)
         traefik.http.routers.pritunl.entrypoints: websecure
         traefik.http.routers.pritunl.tls.certresolver: tls
         traefik.http.services.pritunl.loadbalancer.server.port: 9700
@@ -47,9 +44,13 @@ services:
 networks:
   caddy:
     external: true
+  mongo:
+    external: true
   pritunl:
+    external: true
     # internal: true
     # driver: bridge
-    ipam:
-      config:
-        - subnet: 172.177.0.0/16
+    # ipam:
+    #   config:
+        # - subnet: 172.177.0.0/16
+        # - subnet: 10.177.0.0/16

services/prometheus.yml

@@ -0,0 +1,51 @@
+version: "3.9"
+
+services:
+  prometheus:
+    image: prom/prometheus
+    volumes:
+      - ../data/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+    networks:
+      - prometheus
+      - caddy
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.prometheus.rule: >
+          Host(`prometheus.marcpartensky.com`) || Host(`prometheus.marcpartensky.fr`)
+        traefik.http.routers.prometheus.entrypoints: websecure
+        traefik.http.routers.prometheus.tls.certresolver: tls
+        traefik.http.services.prometheus.loadbalancer.server.port: 9090
+
+  node-exporter:
+    image: prom/node-exporter
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - --path.procfs=/host/proc
+      - --path.sysfs=/host/sys
+      - --collector.filesystem.ignored-mount-points=\"^/(sys|proc|dev|host|etc)($$|/)\"
+    networks:
+      - prometheus
+
+  # cadvisor:
+  #   image: google/cadvisor
+  #   volumes:
+  #     - /:/rootfs:ro
+  #     - /var/run:/var/run:rw
+  #     - /sys:/sys:ro
+  #     - /var/lib/docker:/var/lib/docker:ro
+  #   ports:
+  #     - "8080:8080"
+  #   networks:
+  #     - prometheus
+  #
+networks:
+  prometheus:
+  caddy:
+    external: true
+

services/pufferpannel.yml

@@ -0,0 +1,28 @@
+version: "3.9"
+services:
+  puffer:
+    image: pufferpanel/pufferpanel
+    networks:
+      - caddy
+    volumes:
+      - ../data/pufferpanel:/etc/pufferpanel
+      - pufferpanel:/var/lib/pufferpanel
+      - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.puffer.loadbalancer.server.port: 8080
+        traefik.http.routers.puffer.rule: Host(`puffer.marcpartensky.fr`)
+        # traefik.http.routers.puffer.rule: >
+        #   Host(`puffer.marcpartensky.com`) || Host(`puffer.marcpartensky.fr`)
+        traefik.http.routers.puffer.entrypoints: websecure
+        # traefik.http.routers.puffer.tls.certresolver: tls
+        traefik.http.routers.puffer.tls.certresolver: cloudflare
+        # traefik.http.routers.puffer.middlewares: ldap_auth
+
+volumes:
+  pufferpanel:
+
+networks:
+  caddy:
+    external: true

services/redis.yml

@@ -0,0 +1,22 @@
+version: "3.9"
+services:
+  redis:
+    image: redis:alpine
+    command: redis-server --save 60 1 --loglevel warning
+    ports:
+      - "6379:6379"
+    networks:
+      - redis
+    volumes:
+      - ../data/redis:/usr/local/etc/redis
+      - /srv/redis:/data
+    healthcheck:
+       test: ["CMD", "redis-cli","ping"]
+    # deploy:
+    #   placement:
+    #     constraints:
+    #       - node.role == manager
+
+networks:
+  redis:
+    external: true

services/resume.yml

@@ -0,0 +1,60 @@
+version: "3.9"
+
+services:
+  server:
+    image: amruthpillai/reactive-resume:server-latest
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/resume.env
+    environment:
+      PUBLIC_URL: https://cv.marcpartensky.fr
+      PUBLIC_SERVER_URL: https://cv.marcpartensky.fr/api
+    networks:
+      - caddy
+      - postgres
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.server.loadbalancer.server.port: 3100
+        traefik.http.routers.server.rule: Host(`api.cv.marcpartensky.fr`)
+        # traefik.http.routers.server.rule: "Host(`cv.marcpartensky.fr`) && PathPrefix(`/api`)"
+        # traefik.http.routers.server.rule: >
+        #   Host(`cv.marcpartensky.com`) &&
+        #   PathPrefix(`/api`) ||
+        #   Host(`cv.marcpartensky.fr`) &&
+        #   PathPrefix(`/api`)
+        traefik.http.routers.server.entrypoints: websecure
+        # traefik.http.routers.server.tls.certresolver: cloudflare
+        traefik.http.routers.server.tls.certresolver: tls
+
+  client:
+    image: amruthpillai/reactive-resume:client-latest
+    restart: unless-stopped
+    env_file:
+     - ../data/secrets/resume.env
+    environment:
+      PUBLIC_URL: https://cv.marcpartensky.fr
+      PUBLIC_SERVER_URL: https://cv.marcpartensky.fr/api
+    networks:
+      - caddy
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.client.loadbalancer.server.port: 3000
+        # traefik.http.routers.client.rule: Host(`cv.marcpartensky.fr`)
+        traefik.http.routers.client.rule: >
+          Host(`cv.marcpartensky.fr`)
+          # Host(`cv.marcpartensky.com`) &&
+          # Path(`/`) ||
+          # Host(`cv.marcpartensky.fr`) &&
+          # Path(`/`)
+        traefik.http.routers.client.entrypoints: websecure
+        # traefik.http.routers.client.tls.certresolver: cloudflare
+        traefik.http.routers.server.tls.certresolver: tls
+        # traefik.http.routers.client.middlewares: ldap_auth
+networks:
+  postgres:
+    external: true
+  caddy:
+    external: true
+

services/seafile.yml

@@ -16,8 +16,6 @@ services:
     image: memcached:1.6
     restart: unless-stopped
     entrypoint: memcached -m 256
-    networks:
-      - seafile
     networks:
       seafile:
         aliases:
@@ -37,8 +35,6 @@ services:
     # mem_limit: 2g
     volumes:
       - elasticsearch:/usr/share/elasticsearch/data  # Requested, specifies the path to Elasticsearch data persistent store.
-    networks:
-      - seafile
     networks:
       seafile:
         aliases:

services/serge.yml

@@ -0,0 +1,25 @@
+version: "3"
+
+services:
+  serge:
+    image: ghcr.io/nsarrazin/serge:latest
+    networks:
+      - caddy
+    volumes:
+      - weights:/usr/src/app/weights
+      - data:/data/db/
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.serge.rule: >
+          Host(`serge.marcpartensky.fr`) ||
+          Host(`serge.marcpartensky.com`)
+        traefik.http.routers.serge.entrypoints: websecure
+        traefik.http.services.serge.loadbalancer.server.port: 8008
+
+networks:
+  caddy:
+    external: true
+volumes:
+  data:
+  weights:

services/signoz.yml

@@ -0,0 +1,248 @@
+version: "3.9"
+
+x-clickhouse-defaults: &clickhouse-defaults
+  image: clickhouse/clickhouse-server:22.8.8-alpine
+  tty: true
+  deploy:
+    restart_policy:
+      condition: on-failure
+  depends_on:
+    - zookeeper-1
+    # - zookeeper-2
+    # - zookeeper-3
+  logging:
+    options:
+      max-size: 50m
+      max-file: "3"
+  healthcheck:
+    # "clickhouse", "client", "-u ${CLICKHOUSE_USER}", "--password ${CLICKHOUSE_PASSWORD}", "-q 'SELECT 1'"
+    test: ["CMD", "wget", "--spider", "-q", "localhost:8123/ping"]
+    interval: 30s
+    timeout: 5s
+    retries: 3
+  ulimits:
+    nproc: 65535
+    nofile:
+      soft: 262144
+      hard: 262144
+
+x-clickhouse-depend: &clickhouse-depend
+  depends_on:
+    - clickhouse
+    # - clickhouse-2
+    # - clickhouse-3
+
+services:
+  zookeeper-1:
+    image: bitnami/zookeeper:3.7.0
+    hostname: zookeeper-1
+    user: root
+    ports:
+      - "2181:2181"
+      - "2888:2888"
+      - "3888:3888"
+    volumes:
+      - ./data/zookeeper-1:/bitnami/zookeeper
+    environment:
+      - ZOO_SERVER_ID=1
+      # - ZOO_SERVERS=0.0.0.0:2888:3888,zookeeper-2:2888:3888,zookeeper-3:2888:3888
+      - ALLOW_ANONYMOUS_LOGIN=yes
+      - ZOO_AUTOPURGE_INTERVAL=1
+
+  # zookeeper-2:
+  #   image: bitnami/zookeeper:3.7.0
+  #   hostname: zookeeper-2
+  #   user: root
+  #   ports:
+  #     - "2182:2181"
+  #     - "2889:2888"
+  #     - "3889:3888"
+  #   volumes:
+  #     - ./data/zookeeper-2:/bitnami/zookeeper
+  #   environment:
+  #     - ZOO_SERVER_ID=2
+  #     - ZOO_SERVERS=zookeeper-1:2888:3888,0.0.0.0:2888:3888,zookeeper-3:2888:3888
+  #     - ALLOW_ANONYMOUS_LOGIN=yes
+  #     - ZOO_AUTOPURGE_INTERVAL=1
+
+  # zookeeper-3:
+  #   image: bitnami/zookeeper:3.7.0
+  #   hostname: zookeeper-3
+  #   user: root
+  #   ports:
+  #     - "2183:2181"
+  #     - "2890:2888"
+  #     - "3890:3888"
+  #   volumes:
+  #     - ./data/zookeeper-3:/bitnami/zookeeper
+  #   environment:
+  #     - ZOO_SERVER_ID=3
+  #     - ZOO_SERVERS=zookeeper-1:2888:3888,zookeeper-2:2888:3888,0.0.0.0:2888:3888
+  #     - ALLOW_ANONYMOUS_LOGIN=yes
+  #     - ZOO_AUTOPURGE_INTERVAL=1
+
+  clickhouse:
+    <<: *clickhouse-defaults
+    hostname: clickhouse
+    # ports:
+    #   - "9000:9000"
+    #   - "8123:8123"
+    #   - "9181:9181"
+    volumes:
+      - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
+      - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
+      - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
+      # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
+      - ./data/clickhouse/:/var/lib/clickhouse/
+
+  # clickhouse-2:
+  #   <<: *clickhouse-defaults
+  #   hostname: clickhouse-2
+  #   ports:
+  #     - "9001:9000"
+  #     - "8124:8123"
+  #     - "9182:9181"
+  #   volumes:
+  #     - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
+  #     - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
+  #     - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
+  #     # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
+  #     - ./data/clickhouse-2/:/var/lib/clickhouse/
+
+  # clickhouse-3:
+  #   <<: *clickhouse-defaults
+  #   hostname: clickhouse-3
+  #   ports:
+  #     - "9002:9000"
+  #     - "8125:8123"
+  #     - "9183:9181"
+  #   volumes:
+  #     - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
+  #     - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
+  #     - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
+  #     # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
+  #     - ./data/clickhouse-3/:/var/lib/clickhouse/
+
+  alertmanager:
+    image: signoz/alertmanager:0.23.0-0.2
+    volumes:
+      - ./data/alertmanager:/data
+    command:
+      - --queryService.url=http://query-service:8085
+      - --storage.path=/data
+    depends_on:
+      - query-service
+    deploy:
+      restart_policy:
+        condition: on-failure
+
+  query-service:
+    image: signoz/query-service:0.17.0
+    command: ["-config=/root/config/prometheus.yml"]
+    # ports:
+    #   - "6060:6060"     # pprof port
+    #   - "8080:8080"     # query-service port
+    volumes:
+      - ./prometheus.yml:/root/config/prometheus.yml
+      - ../dashboards:/root/config/dashboards
+      - ./data/signoz/:/var/lib/signoz/
+    environment:
+      - ClickHouseUrl=tcp://clickhouse:9000/?database=signoz_traces
+      - ALERTMANAGER_API_PREFIX=http://alertmanager:9093/api/
+      - SIGNOZ_LOCAL_DB_PATH=/var/lib/signoz/signoz.db
+      - DASHBOARDS_PATH=/root/config/dashboards
+      - STORAGE=clickhouse
+      - GODEBUG=netdns=go
+      - TELEMETRY_ENABLED=true
+      - DEPLOYMENT_TYPE=docker-swarm
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "localhost:8080/api/v1/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    deploy:
+      restart_policy:
+        condition: on-failure
+    <<: *clickhouse-depend
+
+  frontend:
+    image: signoz/frontend:0.17.0
+    deploy:
+      restart_policy:
+        condition: on-failure
+    depends_on:
+      - alertmanager
+      - query-service
+    ports:
+      - "3301:3301"
+    volumes:
+      - ../common/nginx-config.conf:/etc/nginx/conf.d/default.conf
+
+  otel-collector:
+    image: signoz/signoz-otel-collector:0.66.6
+    command: ["--config=/etc/otel-collector-config.yaml"]
+    user: root # required for reading docker container logs
+    volumes:
+      - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+    environment:
+      - OTEL_RESOURCE_ATTRIBUTES=host.name={{.Node.Hostname}},os.type={{.Node.Platform.OS}},dockerswarm.service.name={{.Service.Name}},dockerswarm.task.name={{.Task.Name}}
+      - DOCKER_MULTI_NODE_CLUSTER=false
+      - LOW_CARDINAL_EXCEPTION_GROUPING=false
+    ports:
+      # - "1777:1777"     # pprof extension
+      - "4317:4317"     # OTLP gRPC receiver
+      - "4318:4318"     # OTLP HTTP receiver
+      # - "8888:8888"     # OtelCollector internal metrics
+      # - "8889:8889"     # signoz spanmetrics exposed by the agent
+      # - "9411:9411"     # Zipkin port
+      # - "13133:13133"   # Health check extension
+      # - "14250:14250"   # Jaeger gRPC
+      # - "14268:14268"   # Jaeger thrift HTTP
+      # - "55678:55678"   # OpenCensus receiver
+      # - "55679:55679"   # zPages extension
+    deploy:
+      mode: global
+      restart_policy:
+        condition: on-failure
+    <<: *clickhouse-depend
+
+  otel-collector-metrics:
+    image: signoz/signoz-otel-collector:0.66.6
+    command: ["--config=/etc/otel-collector-metrics-config.yaml"]
+    volumes:
+      - ./otel-collector-metrics-config.yaml:/etc/otel-collector-metrics-config.yaml
+    # ports:
+    #   - "1777:1777"     # pprof extension
+    #   - "8888:8888"     # OtelCollector internal metrics
+    #   - "13133:13133"   # Health check extension
+    #   - "55679:55679"   # zPages extension
+    deploy:
+      restart_policy:
+        condition: on-failure
+    <<: *clickhouse-depend
+
+  hotrod:
+    image: jaegertracing/example-hotrod:1.30
+    command: ["all"]
+    environment:
+      - JAEGER_ENDPOINT=http://otel-collector:14268/api/traces
+    logging:
+      options:
+        max-size: 50m
+        max-file: "3"
+
+  load-hotrod:
+    image: "grubykarol/locust:1.2.3-python3.9-alpine3.12"
+    hostname: load-hotrod
+    environment:
+      ATTACKED_HOST: http://hotrod:8080
+      LOCUST_MODE: standalone
+      NO_PROXY: standalone
+      TASK_DELAY_FROM: 5
+      TASK_DELAY_TO: 30
+      QUIET_MODE: "${QUIET_MODE:-false}"
+      LOCUST_OPTS: "--headless -u 10 -r 1"
+    volumes:
+      - ../common/locust-scripts:/locust
+

services/swarm-visualizer.yml

@@ -13,9 +13,12 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.swarm_visualizer.rule: Host(`swarm.marcpartensky.com`)
+        # traefik.http.routers.swarm_visualizer.rule: Host(`swarm.marcpartensky.com`)
+        traefik.http.routers.swarm_visualizer.rule: >
+          Host(`swarm.marcpartensky.fr`) && Host(`swarm.marcpartensky.com`)
         traefik.http.routers.swarm_visualizer.entrypoints: websecure
-        traefik.http.routers.swarm_visualizer.tls.certresolver: tls
+        # traefik.http.routers.swarm_visualizer.tls.certresolver: tls
+        traefik.http.routers.swarm_visualizer.tls.certresolver: cloudflare
         traefik.http.services.swarm_visualizer.loadbalancer.server.port: 8080
 
 networks:

services/syncthing.yml

@@ -0,0 +1,17 @@
+version: "3.9"
+services:
+  syncthing:
+    image: lscr.io/linuxserver/syncthing:latest
+    restart: unless-stopped
+    environment:
+      PUID: 1000
+      PGID: 1000
+      TZ: Etc/UTC
+    volumes:
+      - /path/to/appdata/config:/config
+      - /path/to/data1:/data1
+      - /path/to/data2:/data2
+    ports:
+      - 8384:8384
+      - 22000:22000
+      - 21027:21027/udp

services/traefik.yml

@@ -4,8 +4,8 @@ services:
   traefik:
     image: traefik:2.9.1 # https://github.com/wiltonsr/ldapauth/issues/25
     # image: traefik:latest # https://github.com/wiltonsr/ldapauth/issues/25
-    # env_file:
-    #   - ../data/secrets/traefik.env
+    env_file:
+      - ../data/secrets/traefik.env
     # restart: unless-stopped
     # command:
     #   ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
@@ -38,8 +38,7 @@ services:
       - caddy
       - ldap
     volumes:
-      - ../data/traefik/traefik.yml:/traefik.yml # static configuration
-      - ../data/traefik/dynamic.yml:/dynamic.yml
+      - ../data/traefik:/etc/traefik
         # - traefik_letsencrypt:/letsencrypt
       - traefik:/config
       - /var/run/docker.sock:/var/run/docker.sock:ro

services/uptime.yml

@@ -14,7 +14,7 @@ services:
         traefik.http.routers.kuma.rule: >
           Host(`uptime.marcpartensky.com`) || Host(`uptime.marcpartensky.fr`)
         traefik.http.routers.kuma.entrypoints: websecure
-        traefik.http.routers.kuma.tls.certresolver: cloudflare
+        traefik.http.routers.kuma.tls.certresolver: tls
         traefik.http.routers.kuma.middlewares: ldap_auth
 
 networks:

services/vaultwarden.yml

@@ -41,16 +41,12 @@ services:
     #   traefik.http.services.vaultwarden.loadbalancer.server.port: 80
     deploy:
       labels:
-        # traefik.enable: "false"
         traefik.enable: "true"
-        # traefik.http.routers.vaultwarden.rule: >
-        #   Host(`vault.marcpartensky.com`)
         traefik.http.routers.vaultwarden.rule: >
-          Host(`vault.marcpartensky.com`) ||
           Host(`vault.marcpartensky.fr`) ||
-          Host(`secret.marcpartensky.fr`)
+          Host(`vault.marcpartensky.com`)
         traefik.http.routers.vaultwarden.entrypoints: websecure
-        traefik.http.routers.vaultwarden.tls.certresolver: tls
+        traefik.http.routers.vaultwarden.tls.certresolver: cloudflare
         traefik.http.services.vaultwarden.loadbalancer.server.port: 80
 
   # ldap_admin:

services/wallabag.yml

@@ -0,0 +1,99 @@
+version: "3.9"
+services:
+  wallabag:
+    image: wallabag/wallabag
+    volumes:
+      # Volumes for data-related folders
+      - assets:/var/www/html/web/assets
+      - data:/var/www/html/data
+      - cache:/var/www/.cache
+      # Uncomment the following volume if you run rootless Docker
+      # A limitation blocks permissions on root docker, see
+      # https://github.com/moby/moby/issues/40881
+      # - type: tmpfs
+      #   target: /var/www/html/var/cache
+      # Override third-party libraries for dev
+      # - ../graby-site-config:/var/www/html/vendor/j0k3r/graby-site-config
+      # - ../php-readability:/var/www/html/vendor/j0k3r/php-readability
+      # - ../graby:/var/www/html/vendor/j0k3r/graby
+      # - ../HTMLawed:/var/www/html/vendor/fossar/htmlawed
+      # - ../PHPePub:/var/www/html/vendor/wallabag/phpepub
+      # - ../guzzle-site-authenticator:/var/www/html/vendor/bdunogier/guzzle-site-authenticator
+    env_file:
+      # Copy docker/php/env.example to docker/php/env and customize
+      - ../data/secrets/wallabag.env
+      # Uncomment the database engine you want, it will use sqlite if both are commented
+      # - ./docker/mariadb/env
+      # - ./docker/postgres/env
+      # Uncomment to enable Xdebug
+      # - ./docker/php/xdebug
+    # ports:
+      # - 8000:8000
+      # Uncomment to permit Xdebug remote session
+      # - 9000:9000
+    # depends_on:
+      # - mariadb
+      # - postgres
+      # - redis
+    networks:
+      - caddy
+      - postgres
+      - redis
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.services.wallabag.loadbalancer.server.port: 80
+        traefik.http.routers.wallabag.rule: >
+          Host(`wallabag.marcpartensky.com`) ||
+          Host(`wallabag.marcpartensky.fr`)
+        traefik.http.routers.wallabag.entrypoints: websecure
+        # traefik.http.routers.wallabag.tls.certresolver: tls
+        traefik.http.routers.wallabag.tls.certresolver: cloudflare
+        # traefik.http.routers.wallabag.middlewares: ldap_auth
+
+    # postgres:
+    #     image: postgres:11-alpine
+    #     volumes:
+    #         - db-data:/var/lib/postgresql/data
+    #     env_file:
+    #         - ./docker/postgres/env
+    #     healthcheck:
+    #         test: ["CMD-SHELL", "pg_isready -q || exit 1"]
+    #         interval: 10s
+    #         timeout: 3s
+    #         retries: 3
+
+    # mariadb:
+    #    image: mariadb:10
+    #    ports:
+    #        - "3306:3306"
+    #    volumes:
+    #        - db-data:/var/lib/mysql
+    #    env_file:
+    #        - ./docker/mariadb/env
+
+    # rabbitmq:
+    #     image: rabbitmq:3-management-alpine
+    #     ports:
+    #         - "15672:15672"
+
+  # redis:
+  #   image: redis:6-alpine
+  #   healthcheck:
+  #     test: ["CMD", "redis-cli", "ping"]
+  #     interval: 10s
+  #     timeout: 3s
+  #     retries: 3
+
+volumes:
+  assets:
+  data:
+  cache:
+networks:
+  wallabag:
+  caddy:
+    external: true
+  postgres:
+    external: true
+  redis:
+    external: true

services/website.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   website:
-    image: marcpartensky/website
+    image: marcpartensky/website:v140.f211658.2023-11-01
     restart: unless-stopped
     env_file:
       - ../data/secrets/website.env
@@ -17,14 +17,15 @@ services:
     # command:
     #   - "80"
     #   - "0.0.0.0"
-    depends_on:
-      - redis
+    # depends_on:
+    #   - redis
     volumes:
       - media:/app/media
     networks:
-      - postgres
       - website
       - caddy
+      - postgres
+      - redis
     # labels:
     #   caddy: marcpartensky.com
     #   caddy.reverse_proxy: "{{upstreams 80}}"
@@ -60,23 +61,25 @@ services:
         traefik.http.routers.website.tls.certresolver: tls
         traefik.http.services.website.loadbalancer.server.port: 80
 
-  redis:
-    image: redis:alpine
-    restart: unless-stopped
-    networks:
-      - website
-    healthcheck:
-       test: ["CMD", "redis-cli","ping"]
-    deploy:
-      placement:
-        constraints:
-          - node.role == manager
+  # redis:
+  #   image: redis:alpine
+  #   restart: unless-stopped
+  #   networks:
+  #     - website
+  #   healthcheck:
+  #      test: ["CMD", "redis-cli","ping"]
+  #   deploy:
+  #     placement:
+  #       constraints:
+  #         - node.role == manager
 
 volumes:
   media:
 
 networks:
   website:
+  redis:
+    external: true
   postgres:
     external: true
   caddy:

services/wger.yml

@@ -0,0 +1,90 @@
+#
+# Please consult the `Deployment` section in the readme if you want to deploy
+# this. You *need* to keep this nginx service, even if you have your own,
+# otherwise the static files will not be served correctly! If you do remove
+# it, configure yours similarly to what's in config/nginx.conf
+# Also take a look at the "Static files" section in the .env file
+
+services:
+  wger:
+    image: wger/server:latest
+    # depends_on:
+    #   db:
+    #     condition: service_healthy
+    #   cache:
+    #     condition: service_healthy
+    env_file:
+      - ../data/secrets/wger.env
+    volumes:
+      - static:/home/wger/static
+      - media:/home/wger/media
+    healthcheck:
+      test: wget --no-verbose --tries=1 --spider http://localhost:8000
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  nginx:
+    image: nginx:stable
+    volumes:
+      - ../data/wger/nginx.conf:/etc/nginx/conf.d/default.conf
+      - static:/wger/static:ro
+      - media:/wger/media:ro
+    ports:
+      - "80:80"
+    healthcheck:
+      test: service nginx status
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # cache:
+  #   image: redis
+  #   expose:
+  #     - 6379
+  #   healthcheck:
+  #     test: redis-cli ping
+  #     interval: 10s
+  #     timeout: 5s
+  #     retries: 5
+  #   restart: unless-stopped
+
+  celery_worker:
+    image: wger/server:latest
+    container_name: wger_celery_worker
+    command: /start-worker
+    env_file:
+      - ./data/secrets/wger.env
+    # depends_on:
+    #   cache:
+    #     condition: service_healthy
+    #   db:
+    #     condition: service_healthy
+    healthcheck:
+      test: celery -A wger inspect ping
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  celery_beat:
+    image: wger/server:latest
+    command: /start-beat
+    volumes:
+      - celery-beat:/home/wger/beat/
+    env_file:
+      - ./config/.env
+      - ./data/secrets/wger.env
+    # depends_on:
+    #   cache:
+    #     condition: service_healthy
+
+volumes:
+  celery-beat:
+  static:
+  media:
+
+networks:
+  caddy:
+    external: true
+  postgres:
+    external: true

services/whoami.yml

@@ -8,6 +8,7 @@ services:
       # replicas: 0
       labels:
         traefik.enable: "true"
+        # traefik.http.routers.whoami.rule: Host(`whoami.marcpartensky.fr`)
         traefik.http.routers.whoami.rule: >
           Host(`whoami.marcpartensky.com`) || Host(`whoami.marcpartensky.fr`)
         traefik.http.routers.whoami.entrypoints: websecure

services/yt-dlp.yml

@@ -5,9 +5,11 @@ services:
     image: marcpartensky/yt-dlp
     restart: unless-stopped
     volumes:
+      - ../data/yt-dlp:/root/downloads
       - ~/Videos/Youtube:/srv
     env_file:
       - ../data/secrets/yt-dlp.env
+    network_mode: none
 
   webui:
     image: ghcr.io/marcopeocchi/yt-dlp-web-ui:latest
@@ -20,9 +22,10 @@ services:
       labels:
         traefik.enable: "true"
         traefik.http.routers.ytdlp.rule: >
-          Host(`yt.marcpartensky.fr`)
+          Host(`yt.marcpartensky.fr`) ||
+          Host(`yt.marcpartensky.com`)
         traefik.http.routers.ytdlp.entrypoints: websecure
-        traefik.http.routers.ytdlp.tls.certresolver: tls
+        traefik.http.routers.ytdlp.tls.certresolver: cloudflare
         traefik.http.services.ytdlp.loadbalancer.server.port: 3033
 
 volumes: