Merge branch 'master' into fuck

tableau
jellyfin.yml that works
2023-03-07 12:30:22 +01:00 · 2023-03-07 12:26:14 +01:00 · 2023-03-07 12:26:14 +01:00 · 2023-03-07 12:26:14 +01:00 · 2023-03-07 12:26:14 +01:00 · 2023-03-06 16:28:47 +01:00
70 changed files with 319 additions and 2666 deletions
@@ -12,7 +12,7 @@ data/matrix
 data/heimdall
 data/pihole/etc-pihole
 data/pxe
-data/postgres/certs
+data/postgres
 data/wireguard
 data/vaultwarden
 data/filebrowser
@@ -21,10 +21,6 @@ data/openvpn_*
 data/mailcow
 data/dockvpn
 data/hydra
-data/yt-dlp
-data/mongo
-data/gpg
-data/redis
 data.tar.gz
 data.7z
 data.7z.gpg
@@ -8,8 +8,6 @@ mswarm: merge
 	docker stack deploy -c stacks/docker-compose.yml vps
 down:
 	docker stack rm vps
-pull:
-	for file in services/*; do docker-compose -f $$file pull; done
 export:
 	7z a -p data.7z data
 	gpg --encrypt --sign --recipient 'marc@marcpartensky.com' data.7z
@@ -20,9 +18,7 @@ networks:
 	docker network create --driver overlay --attachable postgres || true
 	docker network create --driver overlay --attachable mongo || true
 	docker network create --driver overlay --attachable vpn || true
-	docker network create --driver overlay --attachable redis || true
 	docker network create --driver overlay --subnet 172.22.1.0/24 --gateway 172.22.1.1 --attachable mailcow || true
-	docker network create --driver overlay --subnet 10.22.69.0/24 --gateway 10.22.69.1 --attachable pritunl || true
 node:
 	docker node update --label-add net=web contabo
 	docker node update --label-add net=none tower
@@ -1,5 +1,6 @@
 bind_host: 0.0.0.0
 bind_port: 3000
+beta_bind_port: 0
 users:
  - name: marc
    password: $2a$10$E9cknJr/bTLtSUJ9EaW8r.Gw30FX8Plm8jgq.LaYxMwiX4DEuDK7O
@@ -7,20 +8,23 @@ auth_attempts: 5
 block_auth_min: 15
 http_proxy: ""
 language: ""
-theme: auto
 debug_pprof: false
 web_session_ttl: 720
 dns:
  bind_hosts:
    - 0.0.0.0
  port: 53
+  statistics_interval: 1
+  querylog_enabled: true
+  querylog_file_enabled: true
+  querylog_interval: 2160h
+  querylog_size_memory: 1000
  anonymize_client_ip: false
  protection_enabled: true
  blocking_mode: default
  blocking_ipv4: ""
  blocking_ipv6: ""
  blocked_response_ttl: 10
-  protection_disabled_until: null
  parental_block_host: family-block.dns.adguard.com
  safebrowsing_block_host: standard-block.dns.adguard.com
  ratelimit: 20
@@ -53,31 +57,20 @@ dns:
  bogus_nxdomain: []
  aaaa_disabled: false
  enable_dnssec: false
-  edns_client_subnet:
-    custom_ip: ""
-    enabled: false
-    use_custom: false
+  edns_client_subnet: false
  max_goroutines: 300
  handle_ddr: true
  ipset: []
  ipset_file: ""
-  bootstrap_prefer_ipv6: false
  filtering_enabled: true
  filters_update_interval: 24
  parental_enabled: false
+  safesearch_enabled: false
  safebrowsing_enabled: false
  safebrowsing_cache_size: 1048576
  safesearch_cache_size: 1048576
  parental_cache_size: 1048576
  cache_time: 30
-  safe_search:
-    enabled: false
-    bing: true
-    duckduckgo: true
-    google: true
-    pixabay: true
-    yandex: true
-    youtube: true
  rewrites:
    - domain: medium.com
      answer: 0.0.0.0
@@ -88,8 +81,6 @@ dns:
  private_networks: []
  use_private_ptr_resolvers: true
  local_ptr_upstreams: []
-  use_dns64: false
-  dns64_prefixes: []
  serve_http3: false
  use_http3_upstreams: false
 tls:
@@ -107,16 +98,6 @@ tls:
  certificate_path: ""
  private_key_path: ""
  strict_sni_check: false
-querylog:
-  ignored: []
-  interval: 2160h
-  size_memory: 1000
-  enabled: true
-  file_enabled: true
-statistics:
-  ignored: []
-  interval: 24h
-  enabled: true
 filters:
  - enabled: true
    url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
@@ -180,4 +161,4 @@ os:
  group: ""
  user: ""
  rlimit_nofile: 0
-schema_version: 20
+schema_version: 14
@@ -1,11 +0,0 @@
-[database]
-type = postgres
-host = postgres:5432
-name = grafana
-user = grafana
-password = ZTliY2MwOWQ5ZjNiMzUyMTc5YWMwNmJi
-ssl_mode = disable
-
-[auth.ldap]
-enabled = true
-config_file = /etc/grafana/ldap.toml
@@ -14,37 +14,18 @@ network_name = os.environ['DOCKER_NETWORK_NAME']
 c.SwarmSpawner.network_name = network_name
 c.SwarmSpawner.remove_containers = True
 c.SwarmSpawner.debug = True
-# c.SwarmSpawner.image = "jupyterhub/singleuser:latest"
-# c.SwarmSpawner.image = "marcpartensky/jupyterhub-singleuser"
-# c.SwarmSpawner.image = os.environ["DOCKER_IMAGE"]
-# c.SwarmSpawner.host_ip = "juypterhub"
-# c.SwarmSpawner.container_spec = {
-#               # The command to run inside the service
-#               'args' : ['/usr/local/bin/start-singleuser.sh'], # (list)
-#               'Image' : 'juypterhub/singleuser',
-#               # 'mounts' : mounts
-#       }
+c.SwarmSpawner.image = "jupyterhub/singleuser:latest"
 c.SwarmSpawner.host_ip = "0.0.0.0"

-# kill old kernels
-# https://opendreamkit.org/2018/10/17/jupyterhub-docker/
-# c.JupyterHub.services = [
-#     {
-#         'name': 'cull_idle',
-#         'admin': True,
-#         'command': 'python3 /srv/jupyterhub/cull_idle_servers.py --timeout=3600'.split(),
-#     },
-# ]
-
 # Persistence
-# notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/jovyan/work'
-# c.DockerSpawner.notebook_dir = notebook_dir
-# c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }
+notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/jovyan/work'
+c.DockerSpawner.notebook_dir = notebook_dir
+c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }

 # Authentication
 # c.JupyterHub.authenticator_class = 'dummyauthenticator.DummyAuthenticator'
 c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
-c.LDAPAuthenticator.server_address = "ldap"
+c.LDAPAuthenticator.server_address = "marcpartensky.com"
 c.LDAPAuthenticator.use_ssl = True
 c.LDAPAuthenticator.bind_dn_template = [
    "uid={username},ou=people,dc=admin,dc=org",
@@ -1,35 +0,0 @@
- [ req ]
- default_bits           = 8192
- default_keyfile        = privkey.pem
- distinguished_name     = req_distinguished_name
- attributes             = req_attributes
- x509_extensions        = v3_ca
-
- dirstring_type = nobmp
-
- [ req_distinguished_name ]
- countryName                    = FR
- countryName_default            = FR
- countryName_min                = 2
- countryName_max                = 2
-
- localityName                   = Europe/Paris
-
- organizationalUnitName         = Marc Partensky Corp
-
- commonName                     = Marc Partensky
- commonName_max                 = 64
-
- emailAddress                   = marc@marcpartensky.com
- emailAddress_max               = 40
-
- # [ req_attributes ]
- # challengePassword              = A challenge password
- # challengePassword_min          = 4
- # challengePassword_max          = 20
-
- [ v3_ca ]
-
- subjectKeyIdentifier=hash
- authorityKeyIdentifier=keyid:always,issuer:always
- basicConstraints = CA:true
@@ -1,8 +0,0 @@
-#!/bin/bash
-set -e
-
-psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
-	CREATE USER marc PASSWORD ZGQ4ZDk5OWEwYjNlMDJlNmQ5NmE1NjM5;
-	GRANT ALL PRIVILEGES ON DATABASE * TO marc;
-EOSQL
-
@@ -1,14 +0,0 @@
-#!/bin/sh
-
-cd /var/lib/postgresql/certs
-
-# private key and certificate from it
-openssl req -new -text -newkey rsa:8192 -passout pass:$POSTGRES_PASSWORD -subj /CN=localhost -out server.req -keyout privkey.pem
-# self signed root certificate
-openssl rsa -in privkey.pem -passin pass:$POSTGRES_PASSWORD -out server.key
-# derived certificate
-openssl req -x509 -in server.req -text -key server.key -out server.crt
-
-# change permissions to the root certificate for postgres
-chmod 600 server.key
-chown postgres:postgres server.key
@@ -11,13 +11,9 @@ global:
 scrape_configs:
  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
  - job_name: 'prometheus'
+
    # Override the global default and scrape targets from this job every 5 seconds.
    scrape_interval: 5s
-    static_configs:
-      - targets: ['node-exporter:9100']

-  - job_name: cadvisor
-    scrape_interval: 5s
    static_configs:
-    - targets:
-      - cadvisor:8080
+      - targets: ['localhost:9090']
@@ -6,8 +6,7 @@ api:
  # insecure: false # = secure
  insecure: true
  dashboard: true
-  # debug: true
-  debug: false
+  debug: true
 providers:
  docker:
    swarmMode: true
@@ -4,7 +4,8 @@ valentin
 open-web-calendar
 adguard
 servant
-discord
+discord-bot
+ia
 docker-api
 ialab
 portainer
@@ -19,5 +20,3 @@ pritunl-mongo
 fail2ban
 ldap
 ldap-manager
-vaultwarden
-authentik
@@ -24,14 +24,20 @@ services:
      - ../data/adguard:/opt/adguardhome/conf
    networks:
      - caddy
+    labels:
+      caddy: adguard.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 3000}}"
+      traefik.enable: "true"
+      traefik.http.routers.adguard.rule: Host(`adguard.marcpartensky.com`)
+      traefik.http.routers.adguard.entrypoints: websecure
+      traefik.http.routers.adguard.tls.certresolver: tls
+      traefik.http.services.adguard.loadbalancer.server.port: 3000
    deploy:
      labels:
        traefik.enable: "true"
-        traefik.http.routers.adguard.rule: >
-          Host(`adguard.marcpartensky.com`) ||
-          Host(`adguard.marcpartensky.fr`)
+        traefik.http.routers.adguard.rule: Host(`adguard.marcpartensky.com`)
        traefik.http.routers.adguard.entrypoints: websecure
-        traefik.http.routers.adguard.tls.certresolver: cloudflare
+        traefik.http.routers.adguard.tls.certresolver: tls
        traefik.http.services.adguard.loadbalancer.server.port: 3000
        traefik.http.routers.adguard.middlewares: ldap_auth

@@ -5,10 +5,16 @@ services:
    restart: unless-stopped
    networks:
      - caddy
+    labels:
+      caddy: agenda.militant.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8080}}"
+      traefik.enable: "true"
+      traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
+      traefik.http.routers.agenda_militant.entrypoints: websecure
+      traefik.http.routers.agenda_militant.tls.certresolver: tls
+      traefik.http.services.agenda_militant.loadbalancer.server.port: 8080
    deploy:
      labels:
-        caddy: agenda.militant.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams 8080}}"
        traefik.enable: "true"
        traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
        traefik.http.routers.agenda_militant.entrypoints: websecure
@@ -6,66 +6,75 @@ services:
    restart: unless-stopped
    command: server
    environment:
-      AUTHENTIK_DEBUG: "true"
+      AUTHENTIK_REDIS__HOST: authentik_redis
+      AUTHENTIK_POSTGRESQL__HOST: authentik_postgres
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
      AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: admin
      # WORKERS: 2
+    volumes:
+      - authentik_media:/media
+      - authentik_templates:/templates
+      - authentik_geoip:/geoip
    env_file:
      - ../data/secrets/authentik.env
    # ports:
    #   - "0.0.0.0:${AUTHENTIK_PORT_HTTP:-9000}:9000"
    #   - "0.0.0.0:${AUTHENTIK_PORT_HTTPS:-9443}:9443"
-    volumes:
-      - media:/media
-      - templates:/templates
-      - geoip:/geoip
-    # depends_on:
-    #   - postgres
-    #   - redis
-    #   - worker
+    depends_on:
+      - authentik_postgres
+      - authentik_redis
+      - authentik_worker
    networks:
      - authentik
      - caddy
-      - postgres
-      - redis
-      - ldap
    labels:
      caddy: authentik.marcpartensky.com
      caddy.reverse_proxy: "{{upstreams 9000}}"
-      # traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.com`)
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.fr`)
-        traefik.http.routers.authentik.entrypoints: websecure
-        traefik.http.routers.authentik.tls.certresolver: cloudflare
-        traefik.http.services.authentik.loadbalancer.server.port: 9000
+      traefik.enable: "true"
+      traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.com`)
+      traefik.http.routers.authentik.entrypoints: websecure
+      traefik.http.routers.authentik.tls.certresolver: tls
+      traefik.http.services.authentik.loadbalancer.server.port: 9000

-  worker:
+  authentik_postgres:
+    image: postgres:alpine
+    restart: unless-stopped
+    volumes:
+      - authentik_postgres:/var/lib/postgresql/data
+    env_file:
+      - ../data/secrets/authentik.env
+    networks:
+      - authentik
+
+  authentik_redis:
+    image: redis:alpine
+    restart: unless-stopped
+    networks:
+      - authentik
+
+  authentik_worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.2.1}
    restart: unless-stopped
    user: root
    command: worker
    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgres
+      AUTHENTIK_REDIS__HOST: authentik_redis
+      AUTHENTIK_POSTGRESQL__HOST: authentik_postgres
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    # This is optional, and can be removed. If you remove this, the following will happen
    # - The permissions for the /backups and /media folders aren't fixed, so make sure they are 1000:1000
    # - The docker socket can't be accessed anymore
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
-      - /srv/authentik:/backups
-      - media:/media
-      - certs:/certs
-      - templates:/templates
-      - geoip:/geoip
+      - authentik_backups:/backups
+      - authentik_media:/media
+      - authentik_certs:/certs
+      - authentik_templates:/templates
+      - authentik_geoip:/geoip
    env_file:
      - ../data/secrets/authentik.env
    networks:
      - authentik
-      - postgres
-      - redis

  # authentik_geoipupdate:
  #   image: maxmindinc/geoipupdate:latest
@@ -79,41 +88,16 @@ services:
  #   #   - ../data/secrets/authentik.env
  #   networks:
  #     - authentik
-  #     version: "3.5"
-
-  ldap:
-    image: ghcr.io/goauthentik/ldap
-    ports:
-      - 3389:389
-      - 6636:636
-    # Optionally specify which networks the container should be
-    # might be needed to reach the core authentik server
-    networks:
-      - authentik
-    environment:
-      AUTHENTIK_DEBUG: "true"
-      AUTHENTIK_HOST: http://authentik:9000
-      # AUTHENTIK_HOST: https://authentik:9443
-      # AUTHENTIK_HOST: https://authentik.marcpartensky.fr
-      AUTHENTIK_INSECURE: "false"
-    env_file:
-      - ../data/secrets/authentik_ldap.env

 volumes:
-  # backups:
-  postgres:
-  media:
-  certs:
-  templates:
-  geoip:
+  authentik_postgres:
+  authentik_backups:
+  authentik_media:
+  authentik_certs:
+  authentik_templates:
+  authentik_geoip:

 networks:
  authentik:
-  ldap:
-    external: true
-  redis:
-    external: true
-  postgres:
-    external: true
  caddy:
    external: true
@@ -21,8 +21,7 @@ services:
      caddy.@ws.1_header: "Upgrade websocket"
      caddy.0_reverse_proxy: "@ws {{upstreams 61985}}"
      traefik.enable: "true"
-      # traefik.http.routers.beef.rule: Host(`beef.marcpartensky.com`)
-      traefik.http.routers.beef.rule: Host(`beef.marcpartensky.fr`)
+      traefik.http.routers.beef.rule: Host(`beef.marcpartensky.com`)
      traefik.http.routers.beef.entrypoints: websecure
      traefik.http.routers.beef.tls.certresolver: tls
      traefik.http.services.beef.loadbalancer.server.port: 3000
@@ -1,54 +0,0 @@
-version: '3'
-
-services:
-  cadvisor:
-    # image: google/cadvisor:v0.39.0
-    # image: google/cadvisor
-    image: gcr.io/cadvisor/cadvisor
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:rw
-      - /sys:/sys:ro
-      - /var/lib/docker:/var/lib/docker:ro
-    command:
-      - '-docker_only'
-      - '-logtostderr'
-    #   - '-storage-driver=influxdb'
-    #   - '-storage-opt=host=swarm-manager1:8086'
-    #   - '-storage-opt=database=cadvisor'
-    #   - '-storage-opt=retention=1d'
-    #   - '-storage-opt=user=root'
-    #   - '-storage-opt=password=yourpassword'
-    #   - '-housekeeping_interval=5s'
-    #   - '-enable_load_reader'
-    #   - '-cpu_global_percentage=true'
-    #   - '-cpu_historic_interval=1m'
-    #   - '-docker_label_enable'
-    networks:
-      - caddy
-    deploy:
-      placement:
-        constraints:
-          - node.role == manager
-      resources:
-        limits:
-          memory: 1g
-        reservations:
-          memory: 512m
-      restart_policy:
-        condition: on-failure
-      mode: global
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.cadvisor.rule: Host(`cadvisor.marcpartensky.fr`)
-        # traefik.http.routers.cadvisor.rule: >
-        #   Host(`cadvisor.marcpartensky.com`) || Host(`cadvisor.marcpartensky.fr`)
-        traefik.http.routers.cadvisor.entrypoints: websecure
-        traefik.http.routers.cadvisor.tls.certresolver: tls
-        traefik.http.services.cadvisor.loadbalancer.server.port: 8080
-        traefik.http.routers.cadvisor.middlewares: ldap_auth
-
-      
-networks:
-  caddy:
-    external: true
@@ -1,11 +0,0 @@
-version: "3.9"
-services:
-  cloudflare:
-    image: cloudflare/cloudflared:latest
-    env_file: ../data/secrets/cloudflare.env
-    command: tunnel --no-autoupdate run
-    networks:
-      - caddy
-networks:
-  caddy:
-    external: true
@@ -1,21 +0,0 @@
-version: "3.9"
-services:
-  controller:
-    image: cybercube/crafty-controller
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.controller.loadbalancer.server.port: 8000
-        traefik.http.routers.controller.rule: Host(`controller.marcpartensky.fr`)
-        # traefik.http.routers.controller.rule: >
-        #   Host(`controller.marcpartensky.com`) || Host(`controller.marcpartensky.fr`)
-        traefik.http.routers.controller.entrypoints: websecure
-        # traefik.http.routers.controller.tls.certresolver: tls
-        traefik.http.routers.controller.tls.certresolver: cloudflare
-        # traefik.http.routers.controller.middlewares: ldap_auth
-
-networks:
-  caddy:
-    external: true
@@ -1,29 +0,0 @@
-version: "3.9"
-services:
-  ui:
-    image: alseambusher/crontab-ui
-    networks:
-      - caddy
-    # ports:
-    #   - 8000:8000
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - crontabs:/crontab-ui/crontabs
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.ui.loadbalancer.server.port: 8000
-        traefik.http.routers.ui.rule: >
-          Host(`cron.marcpartensky.com`) ||
-          Host(`cron.marcpartensky.fr`)
-        traefik.http.routers.ui.entrypoints: websecure
-        # traefik.http.routers.ui.tls.certresolver: tls
-        traefik.http.routers.ui.tls.certresolver: cloudflare
-        traefik.http.routers.ui.middlewares: ldap_auth
-
-volumes:
-  crontabs:
-
-networks:
-  caddy:
-    external: true
@@ -2,7 +2,7 @@ version: "3.9"

 services:
  bot:
-    image: marcpartensky/discord-bot:v107.be20e90.2022-05-21
+    image: marcpartensky/discord-bot
    restart: unless-stopped
    ports:
      - "7010:8000"
@@ -15,16 +15,26 @@ services:
      - duplicati_source:/source
    networks:
      - caddy
+    labels:
+      caddy: duplicati.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8200}}"
+      traefik.enable: "true"
+      traefik.http.services.duplicati.loadbalancer.server.port: 8200
+      traefik.http.routers.duplicati.rule: >
+        Host(`duplicati.marcpartensky.com`) || Host(`dupliati.marcpartensky.fr`)
+      traefik.http.routers.duplicati.entrypoints: websecure
+      # traefik.http.routers.duplicati.tls.certresolver: tls
+      traefik.http.routers.duplicati.middlewares: ldap_auth
    deploy:
      labels:
        traefik.enable: "true"
        traefik.http.services.duplicati.loadbalancer.server.port: 8200
+        # traefik.http.routers.duplicati.rule: Host(`duplicati.marcpartensky.com`)
        traefik.http.routers.duplicati.rule: >
-          Host(`duplicati.marcpartensky.com`) ||
-          Host(`duplicati.marcpartensky.fr`)
+          Host(`duplicati.marcpartensky.com`) || Host(`duplicati.marcpartensky.fr`)
        traefik.http.routers.duplicati.entrypoints: websecure
-        traefik.http.routers.duplicati.tls.certresolver: tls
-        # traefik.http.routers.duplicati.tls.certresolver: cloudflare
+        # traefik.http.routers.duplicati.tls.certresolver: tls
+        traefik.http.routers.duplicati.tls.certresolver: cloudflare
        # traefik.http.routers.duplicati.middlewares: ldap_auth

 volumes:
@@ -1,34 +0,0 @@
-version: "3.9"
-services:
-  etesync:
-    image: victorrds/etesync
-    restart: unless-stopped
-    networks:
-      - caddy
-      - postgres
-    env_file:
-      - ../data/secrets/etesync.env
-    volumes:
-      - static:/srv/etebase/static
-      - media:/data/media
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.etesync.loadbalancer.server.port: 3735
-        traefik.http.routers.etesync.rule: >
-          # Host(`etesync.marcpartensky.com`) ||
-          Host(`etesync.marcpartensky.fr`)
-        traefik.http.routers.etesync.entrypoints: websecure
-        traefik.http.routers.etesync.tls.certresolver: tls
-        # traefik.http.routers.etesync.tls.certresolver: cloudflare
-        # traefik.http.routers.etesync.middlewares: ldap_auth
-
-networks:
-  postgres:
-    external: true
-  caddy:
-    external: true
-
-volumes:
-  static:
-  media:
@@ -4,36 +4,27 @@ services:
  etherpad:
    image: etherpad/etherpad
    restart: unless-stopped
-    env_file:
-      - ../data/secrets/etherpad.env
-    # environment:
-    #   SETTINGS_PATH: /etc/etherpad/settings.json
+    environment:
+      ADMIN_PASSWORD: supersecret
    networks:
-      - caddy
-      - postgres
-    # volumes:
-    #   - data:/opt/etherpad-lite/var
-    # volumes:
-    #   - ../data/etherpad/settings.json:/opt/etherpad-lite/settings.json
+        - caddy
+    labels:
+      caddy: etherpad.marcpartensky.com, pad.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 9001}}"
+      traefik.enable: "true"
+      traefik.http.routers.etherpad.rule: Host(`pad.marcpartensky.com`)
+      traefik.http.routers.etherpad.entrypoints: websecure
+      traefik.http.routers.etherpad.tls.certresolver: tls
+      traefik.http.services.etherpad.loadbalancer.server.port: 9001
    deploy:
      labels:
        traefik.enable: "true"
        traefik.http.routers.etherpad.rule: >
-          Host(`pad.marcpartensky.com`) ||
-          Host(`pad.marcpartensky.fr`)
+          Host(`pad.marcpartensky.com`) && Host(`pad.marcpartensky.fr`)
        traefik.http.routers.etherpad.entrypoints: websecure
-        traefik.http.routers.etherpad.tls.certresolver: cloudflare
+        traefik.http.routers.etherpad.tls.certresolver: tls
        traefik.http.services.etherpad.loadbalancer.server.port: 9001
-        traefik.http.middlewares.redirect-pad-com.redirectregex.regex: "^https://etherpad.marcpartensky.com/(.*)"
-        traefik.http.middlewares.redirect-pad-com.redirectregex.replacement: "https://pad.marcpartensky.com/$${1}"
-        traefik.http.middlewares.redirect-pad-fr.redirectregex.regex: "^https://etherpad.marcpartensky.fr/(.*)"
-        traefik.http.middlewares.redirect-pad-fr.redirectregex.replacement: "https://pad.marcpartensky.fr/$${1}"
-
-# volumes:
-#   data:

 networks:
  caddy:
    external: true
-  postgres:
-    external: true
@@ -6,7 +6,7 @@ services:
    restart: unless-stopped
    # user: "${UID}:${GID}"
    volumes:
-      - /root/Videos:/data
+      - data:/data
      - ../data/filebrowser:/config
    # environment:
      # FB_BASEURL: /filebrowser
@@ -15,9 +15,7 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        traefik.http.routers.filebrowser.rule: >
-          Host(`file.marcpartensky.fr`) ||
-          Host(`file.marcpartensky.com`)
+        traefik.http.routers.filebrowser.rule: Host(`file.marcpartensky.com`)
        traefik.http.routers.filebrowser.entrypoints: websecure
        traefik.http.routers.filebrowser.tls.certresolver: tls
        traefik.http.services.filebrowser.loadbalancer.server.port: 8080
@@ -1,31 +0,0 @@
-version: "3.9"
-
-services:
-  fuseki:
-    image: stain/jena-fuseki
-    volumes:
-      # - ./config:/fuseki/configuration
-      - data:/fuseki/databases
-    # environment:
-    #   - FUSEKI_HOME=/fuseki
-    #   - FUSEKI_BASE=/fuseki/databases
-    env_file:
-      - ../data/secrets/fuseki.env
-    networks:
-      - caddy
-    deploy:
-      replicas: 1
-      placement:
-        constraints:
-          - node.role == manager
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.fuseki.rule: Host(`fuseki.marcpartensky.com`)
-        traefik.http.services.fuseki.loadbalancer.server.port: 3030
-
-networks:
-  caddy:
-    external: true
-
-volumes:
-  data:
@@ -0,0 +1,19 @@
+version: "3.9"
+
+services:
+  gitea_postgres:
+    image: postgres
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/gitea.env
+    networks:
+      - caddy
+      - gitea
+    volumes:
+      - gitea_postgres:/var/lib/postgresql/data
+
+volumes:
+  gitea_postgres:
+
+networks:
+  gitea:
@@ -31,9 +31,9 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        traefik.http.routers.gitea.rule: >
-          Host(`git.marcpartensky.com`) ||
-          Host(`git.marcpartensky.fr`)
+        # traefik.http.routers.gitea.rule: >
+        #   Host(`git.marcpartensky.com`) || Host(`git.marcpartensky.fr`)
+        traefik.http.routers.gitea.rule: Host(`git.marcpartensky.fr`)
        traefik.http.routers.gitea.entrypoints: websecure
        # traefik.http.routers.gitea.tls.certresolver: tls
        traefik.http.routers.gitea.tls.certresolver: cloudflare
@@ -1,7 +0,0 @@
-version: "3.9"
-services:
-  gpg:
-    image: marcpartensky/gpg
-    volumes:
-      - /srv:/srv
-      - ../data/gpg:/root/keys
@@ -1,38 +0,0 @@
-version: "3.9"
-services:
-  grafana:
-    image: grafana/grafana
-    restart: unless-stopped
-    env_file:
-      - ../data/secrets/grafana.env
-    # environment:
-      # GF_INSTALL_PLUGINS: grafana-ldap-auth
-    volumes:
-      - ../data/grafana:/etc/grafana
-      - grafana:/var/lib/grafana
-    networks:
-      - caddy
-      - postgres
-      - ldap
-    deploy:
-      labels:
-        caddy: grafana.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams 3000}}"
-        traefik.enable: "true"
-        traefik.http.routers.grafana.rule: >
-          Host(`grafana.marcpartensky.fr`) ||
-          Host(`grafana.marcpartensky.com`)
-        traefik.http.routers.grafana.entrypoints: websecure
-        traefik.http.routers.grafana.tls.certresolver: tls
-        traefik.http.services.grafana.loadbalancer.server.port: 3000
-
-volumes:
-  grafana:
-
-networks:
-  ldap:
-    external: true
-  postgres:
-    external: true
-  caddy:
-    external: true
@@ -15,9 +15,7 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        traefik.http.routers.homer.rule: >
-          Host(`homer.marcpartensky.com`) ||
-          Host(`homer.marcpartensky.fr`)
+        traefik.http.routers.homer.rule: Host(`homer.marcpartensky.com`)
        traefik.http.routers.homer.entrypoints: websecure
        traefik.http.routers.homer.tls.certresolver: tls
        traefik.http.services.homer.loadbalancer.server.port: 8080
@@ -1,12 +1,10 @@
 version: "3.9"
 services:
  hydra:
-    image: marcpartensky/hydra:latest
-    network_mode: host
-    env_file:
-      - ../data/secrets/hydra.env
-    # command: -P /rockyou.txt -L /usernames.txt ssh://192.168.252.18
-    # workdir: /root
+    image: marcpartensky/hydra
+    network: host
+    command: -P /rockyou.txt -L /usernames.txt ssh://192.168.252.84
+    workdir: /root
    volumes:
      - ../data/hydra/rockyou.txt:/rockyou.txt
      - ../data/hydra/usernames.txt:/usernames.txt
@@ -9,7 +9,6 @@ services:
      TZ: Europe/Paris
    volumes:
      - ipfs:/config
-      - /srv/:/srv
    networks:
      - caddy
    ports:
@@ -29,9 +28,8 @@ services:
      labels:
        traefik.enable: "true"
        # traefik.http.routers.ipfs.rule: Host(`ipfs.marcpartensky.com`)
-        traefik.http.routers.ipfs.rule: Host(`ipfs.marcpartensky.fr`)
-        # traefik.http.routers.ipfs.rule: >
-        #   Host(`ipfs.marcpartensky.com`) || Host(`ipfs.marcpartensky.fr`)
+        traefik.http.routers.ipfs.rule: >
+          Host(`ipfs.marcpartensky.com`) || Host(`ipfs.marcpartensky.fr`)
        # traefik.http.routers.ipfs.entrypoints: websecure
        # traefik.http.routers.ipfs.tls.certresolver: tls
        traefik.http.routers.ipfs.tls.certresolver: cloudflare
@@ -45,7 +43,7 @@ services:
        # traefik.http.middlewares.add-context.redirectregex.regex: ^https:\\/\\/([^\\/]+)\\/?$$
        # traefik.http.middlewares.add-context.redirectregex.replacement: https://$$1/webui
        #
-        traefik.http.routers.ipfs.middlewares: custom_repath
+        traefik.http.routers.service_nextcloud.middlewares: custom_repath
        traefik.http.middlewares.custom_repath.replacepathregex.regex: ^/$$
        traefik.http.middlewares.custom_repath.replacepathregex.replacement: /webui
          
@@ -26,9 +26,8 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        traefik.http.routers.jellyfin.rule: >
-          Host(`jellyfin.marcpartensky.fr`) ||
-          Host(`jellyfin.marcpartensky.com`)
+        # traefik.http.routers.jellyfin.rule: Host(`jellyfin.marcpartensky.com`)
+        traefik.http.routers.jellyfin.rule: Host(`jellyfin.marcpartensky.fr`)
        traefik.http.routers.jellyfin.entrypoints: websecure
        traefik.http.routers.jellyfin.tls.certresolver: tls
        traefik.http.services.jellyfin.loadbalancer.server.port: 8096
@@ -9,15 +9,12 @@ services:
      - ../data/jupyterhub/jupyterhub_config.py:/srv/jupyterhub/jupyterhub_config.py
      # - jupyterhub:/srv/jupyterhub
    networks:
-      - ldap
-      - caddy
-      - jupyterhub
+    - caddy
+    - jupyterhub
    environment:
-      # DOCKER_IMAGE: marcpartensky/jupyterlab
-      DOCKER_IMAGE: jupyterhub/singleuser
-      DOCKER_NETWORK_NAME: caddy
+      DOCKER_JUPYTER_IMAGE: marcpartensky/jupyterlab
+      DOCKER_NETWORK_NAME: jupyterhub
      HUB_IP: jupyterhub
-      DOCKER_HOST: unix:///var/run/docker.sock
    labels:
      caddy: jupyterhub.marcpartensky.com
      caddy.reverse_proxy: "{{upstreams 8000}}"
@@ -26,12 +23,10 @@ services:
      traefik.http.routers.jupyterhub.entrypoints: websecure
      traefik.http.routers.jupyterhub.tls.certresolver: tls
      traefik.http.services.jupyterhub.loadbalancer.server.port: 8000
-      # traefik.docker.network: jupyterhub_default
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.jupyterhub.rule: Host(`jupyterhub.marcpartensky.com`)
-        traefik.http.routers.jupyterhub.rule: Host(`hub.marcpartensky.fr`)
+        traefik.http.routers.jupyterhub.rule: Host(`jupyterhub.marcpartensky.com`)
        traefik.http.routers.jupyterhub.entrypoints: websecure
        traefik.http.routers.jupyterhub.tls.certresolver: tls
        traefik.http.services.jupyterhub.loadbalancer.server.port: 8000
@@ -42,5 +37,3 @@ networks:
    driver: overlay
  caddy:
    external: true
-  ldap:
-    external: true
@@ -2,41 +2,25 @@ version: "3.9"

 services:
  jupyterlab:
-    # image: jupyter/datascience-notebook:latest
-    image: marcpartensky/jupyterlab
-    # restart: unless-stopped
+    image: jupyter/datascience-notebook:latest
+    restart: unless-stopped
    environment:
    #   - GEN_CERT=yes
      JUPYTER_ENABLE_LAB: "yes"
      GRANT_SUDO: "yes"
-      JUPYTER_CONFIG_DIR: /home/jupyter/.jupyter
-    # entrypoint: python -m jupyter lab
    # entrypoint: start.sh jupyter lab --user root
    networks:
      - caddy
-    # labels:
-    #   caddy: lab.marcpartensky.com
-    #   caddy.reverse_proxy: "{{upstreams 8888}}"
-    #   traefik.enable: "true"
-    #   traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.com`)
-    #   traefik.http.routers.jupyterlab.entrypoints: websecure
-    #   traefik.http.routers.jupyterlab.tls.certresolver: tls
-    #   traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
-    # volumes:
-      # - jupyterlab:/home/jupyter
-      # - ../data/jupyterlab/:/home/jupyter/.jupyter/
-    deploy:
-      placement:
-        constraints:
-          - node.role == manager
-      labels:
-        traefik.enable: "true"
-        # traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.fr`)
-        traefik.http.routers.jupyterlab.rule: >
-          Host(`lab.marcpartensky.fr`) && Host(`lab.marcpartensky.com`)
-        traefik.http.routers.jupyterlab.entrypoints: websecure
-        traefik.http.routers.jupyterlab.tls.certresolver: cloudflare
-        traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
+    labels:
+      caddy: lab.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8888}}"
+      traefik.enable: "true"
+      traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.com`)
+      traefik.http.routers.jupyterlab.entrypoints: websecure
+      traefik.http.routers.jupyterlab.tls.certresolver: tls
+      traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
+    volumes:
+      - jupyterlab:/home/jovyan
 # entrypoint: start-notebook.sh \
    #     --NotebookApp.keyfile=key/0000_key-certbot.pem
    #     --NotebookApp.certfile=cert/0000_csr-certbot.pem
@@ -20,13 +20,6 @@ services:
      - ldap:/var/lib/ldap
      - ldap_slapd:/etc/ldap/slapd.d

-
-  backup:
-    image: osixia/openldap-backup:1.5.0
-    environment:
-      LDAP_BACKUP_CONFIG_CRON_EXP: "0 5 * * *"
-      LDAP_BACKUP_DATA_CRON_EXP: "0 5 * * *"
-
 volumes:
  ldap:
  ldap_slapd:
@@ -1,29 +0,0 @@
-version: "3.9"
-services:
-  logseq:
-    image: ghcr.io/logseq/logseq-webapp:latest
-    # volumes:
-    networks:
-      - traefik
-      - postgres
-    labels:
-      traefik.enable: "true"
-      # traefik.http.routers.focalboard.rule: >
-      #   Host(`board.marcpartensky.com`) || Host(`board.marcpartensky.fr`)
-      traefik.http.routers.logseq.service: logseq
-      traefik.http.routers.logseq.rule: >
-        Host(`logseq.marcpartensky.com`)
-      traefik.http.routers.logseq.tls: true
-      traefik.http.routers.logseq.entrypoints: web-secure
-      traefik.http.routers.logseq.tls.certresolver: default
-      traefik.http.services.logseq.loadbalancer.server.port: 80
-      # traefik.http.routers.focalboard.middlewares: ldap_auth
-
-volumes:
-  data:
-  pack:
-networks:
-  postgres:
-    external: true
-  traefik:
-    external: true
@@ -14,8 +14,7 @@ services:
      - ../data/matrix:/data
      # - matrix:/data
    networks:
-      - caddy
-      - postgres
+        - caddy
    healthcheck:
      test: ["CMD", "curl", "-fSs", "http://localhost:8008/health"]
      interval: 15s
@@ -40,7 +39,5 @@ services:
        traefik.http.services.matrix.loadbalancer.server.port: 8008

 networks:
-  postgres:
-    external: true
  caddy:
    external: true
@@ -1,7 +1,7 @@
 version: "3.9"

 services:
-  backup:
+  backups:
    image: itzg/mc-backup
    environment:
      BACKUP_INTERVAL: "1d"
@@ -9,7 +9,7 @@ services:
      SERVE_PORT: 25565
      RCON_HOST: minecraft
      RCON_PORT: 25575
-      PAUSE_IF_NO_PLAYER: "true"
+      PAUSE_IF_NO_PLAYER: true
      PLAYERS_ONLINE_CHECK_INTERVAL: 1h
      TZ: Europe/Paris
      DEST_DIR: /backups
@@ -18,6 +18,6 @@ services:
    - /srv/minecraft/champi:/data:ro
    # use a host attached directory so that it in turn can be backed up
    # to external/cloud storage
-    - /srv/mcbackups:/backups
+    - ./mc-backups:/backups
    # share network namespace with server to simplify rcon access
    # network_mode: "service:mc"
@@ -20,18 +20,17 @@ services:
      caddy.reverse_proxy: "{{upstreams 8080}}"
      authorize.with: marc
      traefik.enable: "true"
-      traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.com`)
-      traefik.http.routers.mcmyadmin.entrypoints: websecure
-      traefik.http.routers.mcmyadmin.tls.certresolver: tls
-      traefik.http.services.mcmyadmin.loadbalancer.server.port: 8080
+      traefik.http.routers.minecraft.rule: Host(`mcadmin.marcpartensky.com`)
+      traefik.http.routers.minecraft.entrypoints: websecure
+      traefik.http.routers.minecraft.tls.certresolver: tls
+      traefik.http.services.minecraft.loadbalancer.server.port: 8080
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.com`)
-        traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.fr`)
-        traefik.http.routers.mcmyadmin.entrypoints: websecure
-        traefik.http.routers.mcmyadmin.tls.certresolver: tls
-        traefik.http.services.mcmyadmin.loadbalancer.server.port: 8080
+        traefik.http.routers.minecraft.rule: Host(`mcadmin.marcpartensky.com`)
+        traefik.http.routers.minecraft.entrypoints: websecure
+        traefik.http.routers.minecraft.tls.certresolver: tls
+        traefik.http.services.minecraft.loadbalancer.server.port: 8080

 volumes:
  mcmyadmin:
@@ -1,7 +1,7 @@
 version: "3.9"

 services:
-  server:
+  minecraft_champi:
    image: itzg/minecraft-server
    restart: unless-stopped
    environment:
@@ -29,29 +29,6 @@ services:
    networks:
      - minecraft

-  backup:
-    image: itzg/mc-backup
-    environment:
-      BACKUP_INTERVAL: "1d"
-      # instead of network_mode below, could declare RCON_HOST
-      SERVE_PORT: 25565
-      RCON_HOST: server
-      RCON_PORT: 25575
-      PAUSE_IF_NO_PLAYER: "true"
-      PLAYERS_ONLINE_CHECK_INTERVAL: 1h
-      TZ: Europe/Paris
-      DEST_DIR: /backups
-    networks:
-      - minecraft
-    volumes:
-    # mount the same volume used by server, but read-only
-    - /srv/minecraft/champi:/data:ro
-    # use a host attached directory so that it in turn can be backed up
-    # to external/cloud storage
-    - /srv/mcbackups:/backups
-    # share network namespace with server to simplify rcon access
-    # network_mode: "service:mc"
-
 # volumes:
 #   minecraft:

@@ -1,33 +0,0 @@
-version: "3.9"
-services:
-  minidlna:
-    image: geekduck/minidlna
-    volumes:
-      - music:/opt/Music
-      - videos:/opt/Videos
-      - pictures:/opt/Pictures
-      - db:/var/cache/minidlna
-      # - ../data/minidlna/minidlna.conf:/etc/minidlna.conf
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.minidlna.loadbalancer.server.port: 8200
-        traefik.http.routers.minidlna.rule: Host(`minidlna.marcpartensky.fr`)
-        # traefik.http.routers.minidlna.rule: >
-        #   Host(`minidlna.marcpartensky.com`) || Host(`minidlna.marcpartensky.fr`)
-        traefik.http.routers.minidlna.entrypoints: websecure
-        # traefik.http.routers.minidlna.tls.certresolver: tls
-        traefik.http.routers.minidlna.tls.certresolver: cloudflare
-        # traefik.http.routers.minidlna.middlewares: ldap_auth
-
-volumes:
-  music:
-  videos:
-  pictures:
-  db:
-
-networks:
-  caddy:
-    external: true
@@ -5,8 +5,6 @@ services:
    image: mongo
    restart: unless-stopped
    volumes:
-      - ../data/mongo/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
-      - ../data/mongo/config:/etc/mongo
      - mongo:/data/db
    networks:
      - mongo
@@ -41,10 +39,7 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
-        traefik.http.routers.mongo.rule: >
-          Host(`mongo.marcpartensky.fr`) ||
-          Host(`mongo.marcpartensky.com`)
+        traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
        traefik.http.routers.mongo.entrypoints: websecure
        traefik.http.routers.mongo.tls.certresolver: tls
        traefik.http.services.mongo.loadbalancer.server.port: 8081
@@ -16,16 +16,22 @@ services:
      - caddy
      - postgres
      - ldap
+      - nextcloud
        # depends_on:
        #   - nextcloud_mariadb
+    labels:
+      caddy: cloud.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams http 80}}"
+      traefik.enable: "true"
+      traefik.http.routers.nextcloud.rule: Host(`cloud.marcpartensky.com`)
+      traefik.http.routers.nextcloud.entrypoints: websecure
+      traefik.http.routers.nextcloud.tls.certresolver: tls
+      traefik.http.services.nextcloud.loadbalancer.server.port: 80
    deploy:
      labels:
-        caddy: cloud.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams http 80}}"
        traefik.enable: "true"
        traefik.http.routers.nextcloud.rule: >
-          Host(`cloud.marcpartensky.com`) ||
-          Host(`cloud.marcpartensky.fr`)
+          Host(`cloud.marcpartensky.com`) && Host(`cloud.marcpartensky.fr`)
        traefik.http.routers.nextcloud.entrypoints: websecure
        traefik.http.routers.nextcloud.tls.certresolver: tls
        traefik.http.services.nextcloud.loadbalancer.server.port: 80
@@ -37,6 +43,7 @@ volumes:
  apps:

 networks:
+  nextcloud:
  ldap:
    external: true
  caddy:
@@ -7,14 +7,14 @@ services:
    env_file:
      - ../data/secrets/numeris.env
    links:
-      - mysql:db
+      - numeris:db
    networks:
      - caddy
      - numeris
    deploy:
      labels:
        traefik.enable: "true"
-        traefik.http.routers.phpmyadmin.rule: Host(`phpmyadmin.numeris.marcpartensky.fr`)
+        traefik.http.routers.phpmyadmin.rule: Host(`phpmyadmin.numeris.marcpartensky.com`)
        traefik.http.routers.phpmyadmin.entrypoints: websecure
        traefik.http.routers.phpmyadmin.tls.certresolver: tls
        traefik.http.services.phpmyadmin.loadbalancer.server.port: 80
@@ -42,8 +42,7 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
-        traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.fr`)
+        traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
        traefik.http.routers.back.entrypoints: websecure
        traefik.http.routers.back.tls.certresolver: tls
        traefik.http.services.back.loadbalancer.server.port: 80
@@ -55,40 +54,7 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
-        traefik.http.routers.front.rule: Host(`numeris.marcpartensky.fr`)
-        traefik.http.routers.front.entrypoints: websecure
-        traefik.http.routers.front.tls.certresolver: tls
-        traefik.http.services.front.loadbalancer.server.port: 80
-        traefik.http.routers.front.middlewares: ldap_auth
-
-  back-staging:
-    image: numerisisep/numeris-back:staging
-    networks:
-      - caddy
-      - numeris
-    env_file:
-      - ../data/secrets/numeris.env
-    # volumes:
-    #   - .env:/home/numeris/.env
-    deploy:
-      labels:
-        traefik.enable: "true"
-        # traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
-        traefik.http.routers.back.rule: Host(`staging.api.numeris.marcpartensky.fr`)
-        traefik.http.routers.back.entrypoints: websecure
-        traefik.http.routers.back.tls.certresolver: tls
-        traefik.http.services.back.loadbalancer.server.port: 80
-
-  front-staging:
-    image: numerisisep/numeris-front:staging
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        # traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
-        traefik.http.routers.front.rule: Host(`staging.numeris.marcpartensky.fr`)
+        traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
        traefik.http.routers.front.entrypoints: websecure
        traefik.http.routers.front.tls.certresolver: tls
        traefik.http.services.front.loadbalancer.server.port: 80
@@ -9,13 +9,18 @@ services:
      - ../data/secrets/pandoc.env
    volumes:
      - pandoc:/app/files
+    labels:
+      caddy: pandoc.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 80}}"
+      traefik.enable: "true"
+      traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
+      traefik.http.routers.pandoc.entrypoints: websecure
+      traefik.http.routers.pandoc.tls.certresolver: tls
+      traefik.http.services.pandoc.loadbalancer.server.port: 80
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
-        traefik.http.routers.pandoc.rule: >
-          Host(`pandoc.marcpartensky.com`) ||
-          Host(`pandoc.marcpartensky.fr`)
+        traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
        traefik.http.routers.pandoc.entrypoints: websecure
        traefik.http.routers.pandoc.tls.certresolver: tls
        traefik.http.services.pandoc.loadbalancer.server.port: 80
@@ -1,28 +1,25 @@
-version: "3.9"
+version: "3.3"

 services:

  peertube:
    image: chocobozzz/peertube:production-bullseye
    restart: unless-stopped
+    networks:
+      - caddy
    env_file:
      - ../data/secrets/peertube.env
    ports:
     - "1935:1935" # If you don't want to use the live feature, you can comment this line
    #  - "9000:9000" # If you provide your own webserver and reverse-proxy, otherwise not suitable for production
    volumes:
-      - assets:/app/client/dist
-      - data:/data
+      - peertube_assets:/app/client/dist
+      - peertube:/data
      - ../data/peertube:/config
-    networks:
-      - peertube
-      - caddy
-      - postgres
-      - redis
-    # depends_on:
-    #   - peertube_postgres
-    #   - peertube_redis
-    #   - peertube_postfix
+    depends_on:
+      - peertube_postgres
+      - peertube_redis
+      - peertube_postfix
    labels:
      caddy: peertube.marcpartensky.com
      caddy.reverse_proxy: "{{upstreams 80}}"
@@ -31,49 +28,36 @@ services:
      traefik.http.routers.peertube.entrypoints: websecure
      traefik.http.routers.peertube.tls.certresolver: tls
      traefik.http.services.peertube.loadbalancer.server.port: 80
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.peertube.rule: Host(`peertube.marcpartensky.fr`)
-        traefik.http.routers.peertube.entrypoints: websecure
-        traefik.http.routers.peertube.tls.certresolver: tls
-        traefik.http.services.peertube.loadbalancer.server.port: 80

-  # peertube_postgres:
-  #   image: postgres:13-alpine
-  #   restart: unless-stopped
-  #   env_file:
-  #     - ../data/secrets/peertube.env
-  #   volumes:
-  #     - peertube_postgres:/var/lib/postgresql/data
+  peertube_postgres:
+    image: postgres:13-alpine
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/peertube.env
+    volumes:
+      - peertube_postgres:/var/lib/postgresql/data

-  # peertube_redis:
-  #   image: redis:6-alpine
-  #   restart: unless-stopped
-  #   volumes:
-  #     - peertube_redis:/data
+  peertube_redis:
+    image: redis:6-alpine
+    restart: unless-stopped
+    volumes:
+      - peertube_redis:/data

-  # postfix:
-  #   image: mwader/postfix-relay
-  #   restart: unless-stopped
-  #   networks:
-  #     - peertube
-  #   env_file:
-  #     - .env
-  #   volumes:
-  #     - postfix:/etc/opendkim/keys
+  peertube_postfix:
+    image: mwader/postfix-relay
+    restart: unless-stopped
+    env_file:
+      - .env
+    volumes:
+      - peertube_postfix:/etc/opendkim/keys

 networks:
-  peertube:
-  postgres:
-    external: true
-  redis:
-    external: true
  caddy:
    external: true

 volumes:
-  data:
-  assets:
-  postgres:
-  postfix:
+  peertube:
+  peertube_assets:
+  peertube_postgres:
+  peertube_redis:
+  peertube_postfix:
@@ -1,16 +0,0 @@
-version: "3.9"
-services:
-  pg_backup:
-    image: kartoza/pg-backup:14-3.1
-    env_file:
-      - ../data/secrets/pg_backup.env
-    # environment:
-    #   POSTGRES_MAJOR_VERSION: 14
-    networks:
-      - postgres
-    volumes:
-      - /srv/pg-backup:/backups
-
-networks:
-  postgres:
-    external: true
@@ -30,8 +30,7 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.com`)
-        traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.fr`)
+        traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.com`)
        traefik.http.routers.pgadmin.entrypoints: websecure
        traefik.http.routers.pgadmin.tls.certresolver: tls
        traefik.http.services.pgadmin.loadbalancer.server.port: 80
@@ -1,85 +1,44 @@
 version: "3.9"

 services:
-  agent:
-    image: portainer/agent:2.18.2
+  portainer:
+    image: portainer/portainer-ce
+    restart: unless-stopped
+    environment:
+      VIRTUAL_HOST: docker.marcpartensky.com
+      VIRTUAL_PORT: 9000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
-      - /var/lib/docker/volumes:/var/lib/docker/volumes
-    networks:
-      - portainer
-    # deploy:
-      # mode: global
-      # placement:
-      #   constraints: [node.platform.os == linux]
-
-  portainer:
-    image: portainer/portainer-ce:2.18.2
-    command: -H tcp://agent:9001 --tlsskipverify
-    # ports:
-    #   - "9443:9443"
-    #   - "9000:9000"
-    #   - "8000:8000"
+      - portainer:/data
    networks:
      - caddy
-      - portainer
-    volumes:
-      - data:/data
+    command:
+      - --logo
+      - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
+        # healthcheck:
+        # test: ["CMD", "curl", "-f", "http://localhost:9000"]
+        # test: ["CMD", "portainer", "--healthcheck"]
+    depends_on:
+      - caddy
+    labels:
+      caddy: docker.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 9000}}"
+      traefik.enable: "true"
+      traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
+      traefik.http.routers.portainer.entrypoints: websecure
+      traefik.http.routers.portainer.tls.certresolver: tls
+      traefik.http.services.portainer.loadbalancer.server.port: 9000
    deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints: [node.role == manager]
      labels:
        traefik.enable: "true"
-        traefik.http.routers.portainer.rule: >
-          Host(`docker.marcpartensky.fr`) && Host(`docker.marcpartensky.com`)
+        traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
        traefik.http.routers.portainer.entrypoints: websecure
-        # traefik.http.routers.portainer.tls.certresolver: tls
-        traefik.http.routers.portainer.tls.certresolver: cloudflare
+        traefik.http.routers.portainer.tls.certresolver: tls
        traefik.http.services.portainer.loadbalancer.server.port: 9000

-  # portainer:
-  #   image: portainer/portainer-ce
-  #   restart: unless-stopped
-  #   # environment:
-  #   #   VIRTUAL_HOST: docker.marcpartensky.com
-  #   #   VIRTUAL_PORT: 9000
-  #   volumes:
-  #     - /var/run/docker.sock:/var/run/docker.sock
-  #     - portainer:/data
-  #   networks:
-  #     - caddy
-  #   command:
-  #     - --logo
-  #     - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
-  #       # healthcheck:
-  #       # test: ["CMD", "curl", "-f", "http://localhost:9000"]
-  #       # test: ["CMD", "portainer", "--healthcheck"]
-  #   depends_on:
-  #     - caddy
-  #   labels:
-  #     caddy: docker.marcpartensky.com
-  #     caddy.reverse_proxy: "{{upstreams 9000}}"
-  #     traefik.enable: "true"
-  #     traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
-  #     traefik.http.routers.portainer.entrypoints: websecure
-  #     traefik.http.routers.portainer.tls.certresolver: tls
-  #     traefik.http.services.portainer.loadbalancer.server.port: 9000
-  #   deploy:
-  #     labels:
-  #       traefik.enable: "true"
-  #       traefik.http.routers.portainer.rule: >
-  #         Host(`docker.marcpartensky.fr`) && Host(`docker.marcpartensky.com`)
-  #       traefik.http.routers.portainer.entrypoints: websecure
-  #       traefik.http.routers.portainer.tls.certresolver: tls
-  #       traefik.http.services.portainer.loadbalancer.server.port: 9000
-  #
 volumes:
-  # portainer:
-  data:
+  portainer:

 networks:
-  portainer:
  caddy:
    external: true
@@ -10,9 +10,10 @@ services:
        published: 5432
        mode: host
    volumes:
+      - ../data/postgres:/docker-entrypoint-initdb.d
      - postgres:/var/lib/postgresql/data
-      - ../data/postgres/initdb.d:/initdb.d
-      - ../data/postgres/certs:/var/lib/postgresql/certs
+      - ../data/postgres/server.crt:/var/lib/postgresql/server.crt
+      - ../data/postgres/server.key:/var/lib/postgresql/server.key
    env_file:
      - ../data/secrets/postgres.env
    command: |
@@ -20,37 +21,10 @@ services:
      -c log_statement=all
      -c log_destination=stderr
      -c ssl=on
-      -c ssl_cert_file=/var/lib/postgresql/certs/server.crt
-      -c ssl_key_file=/var/lib/postgresql/certs/server.key
+      -c ssl_cert_file=/var/lib/postgresql/server.crt
+      -c ssl_key_file=/var/lib/postgresql/server.key
    networks:
      - postgres
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -q || exit 1"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-
-  pgagent:
-    image: chiavegatto/postgres-pgagent
-    entrypoint: /bin/sh -c
-                "/tmp/wait-for-it.sh postgres:5432 --timeout=30 &&
-                psql -U postgres -h postgres -p 5432 -d postgres -c 'CREATE EXTENSION IF NOT EXISTS pgagent;' &&
-                pgagent -f hostaddr=postgres dbname=postgres user=postgres port=5432"
-    environment:
-      TIMEZONE: Europe/Paris
-    env_file:
-      - ../data/secrets/postgres.env
-    networks:
-      - postgres
-
-  backup:
-    image: kartoza/pg-backup:14-3.1
-    env_file:
-      - ../data/secrets/pg_backup.env
-    networks:
-      - postgres
-    volumes:
-      - /srv/pg-backup:/backups

  pgbackups:
    image: prodrigestivill/postgres-backup-local
@@ -58,10 +32,10 @@ services:
    # user: postgres:postgres
    volumes:
      - /srv/pgbackups:/backups
-    # links:
-    #   - postgres
-    # depends_on:
-    #   - postgres
+    links:
+      - postgres
+    depends_on:
+      - postgres
    networks:
      - postgres
    env_file:
@@ -6,12 +6,12 @@ services:
    restart: unless-stopped
    ports:
      - "1194-1195:1194-1195/udp"
-    # depends_on:
-    #     - pritunl_mongo
+    depends_on:
+        - pritunl_mongo
    environment:
      REVERSE_PROXY: "true"
      TZ: Europe/Paris
-      MONGODB_URI: mongodb://mongo:27017/pritunl
+      MONGODB_URI: mongodb://pritunl_mongo:27017/pritunl
      PRITUNL_DEBUG: "true"
      # WIREGUARD: true
    privileged: true
@@ -26,17 +26,20 @@ services:
    # volumes:
    #   - /etc/localtime:/etc/localtime:ro
    networks:
-      - mongo
      - caddy
      - pritunl
+    labels:
+      caddy: vpn.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams http 9700}}"
+      traefik.enable: "true"
+      traefik.http.routers.pritunl.rule: Host(`vpn.marcpartensky.com`)
+      traefik.http.routers.pritunl.entrypoints: websecure
+      traefik.http.routers.pritunl.tls.certresolver: tls
+      traefik.http.services.pritunl.loadbalancer.server.port: 9700
    deploy:
      labels:
-        caddy: vpn.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams http 9700}}"
        traefik.enable: "true"
-        traefik.http.routers.pritunl.rule: >
-          Host(`vpn.marcpartensky.fr`) ||
-          Host(`vpn.marcpartensky.com`)
+        traefik.http.routers.pritunl.rule: Host(`vpn.marcpartensky.com`)
        traefik.http.routers.pritunl.entrypoints: websecure
        traefik.http.routers.pritunl.tls.certresolver: tls
        traefik.http.services.pritunl.loadbalancer.server.port: 9700
@@ -44,13 +47,9 @@ services:
 networks:
  caddy:
    external: true
-  mongo:
-    external: true
  pritunl:
-    external: true
    # internal: true
    # driver: bridge
-    # ipam:
-    #   config:
-        # - subnet: 172.177.0.0/16
-        # - subnet: 10.177.0.0/16
+    ipam:
+      config:
+        - subnet: 172.177.0.0/16
@@ -1,51 +0,0 @@
-version: "3.9"
-
-services:
-  prometheus:
-    image: prom/prometheus
-    volumes:
-      - ../data/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
-    command:
-      - --config.file=/etc/prometheus/prometheus.yml
-    networks:
-      - prometheus
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.prometheus.rule: >
-          Host(`prometheus.marcpartensky.com`) || Host(`prometheus.marcpartensky.fr`)
-        traefik.http.routers.prometheus.entrypoints: websecure
-        traefik.http.routers.prometheus.tls.certresolver: tls
-        traefik.http.services.prometheus.loadbalancer.server.port: 9090
-
-  node-exporter:
-    image: prom/node-exporter
-    volumes:
-      - /proc:/host/proc:ro
-      - /sys:/host/sys:ro
-      - /:/rootfs:ro
-    command:
-      - --path.procfs=/host/proc
-      - --path.sysfs=/host/sys
-      - --collector.filesystem.ignored-mount-points=\"^/(sys|proc|dev|host|etc)($$|/)\"
-    networks:
-      - prometheus
-
-  # cadvisor:
-  #   image: google/cadvisor
-  #   volumes:
-  #     - /:/rootfs:ro
-  #     - /var/run:/var/run:rw
-  #     - /sys:/sys:ro
-  #     - /var/lib/docker:/var/lib/docker:ro
-  #   ports:
-  #     - "8080:8080"
-  #   networks:
-  #     - prometheus
-  #
-networks:
-  prometheus:
-  caddy:
-    external: true
-
@@ -1,28 +0,0 @@
-version: "3.9"
-services:
-  puffer:
-    image: pufferpanel/pufferpanel
-    networks:
-      - caddy
-    volumes:
-      - ../data/pufferpanel:/etc/pufferpanel
-      - pufferpanel:/var/lib/pufferpanel
-      - /var/run/docker.sock:/var/run/docker.sock
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.puffer.loadbalancer.server.port: 8080
-        traefik.http.routers.puffer.rule: Host(`puffer.marcpartensky.fr`)
-        # traefik.http.routers.puffer.rule: >
-        #   Host(`puffer.marcpartensky.com`) || Host(`puffer.marcpartensky.fr`)
-        traefik.http.routers.puffer.entrypoints: websecure
-        # traefik.http.routers.puffer.tls.certresolver: tls
-        traefik.http.routers.puffer.tls.certresolver: cloudflare
-        # traefik.http.routers.puffer.middlewares: ldap_auth
-
-volumes:
-  pufferpanel:
-
-networks:
-  caddy:
-    external: true
@@ -1,22 +0,0 @@
-version: "3.9"
-services:
-  redis:
-    image: redis:alpine
-    command: redis-server --save 60 1 --loglevel warning
-    ports:
-      - "6379:6379"
-    networks:
-      - redis
-    volumes:
-      - ../data/redis:/usr/local/etc/redis
-      - /srv/redis:/data
-    healthcheck:
-       test: ["CMD", "redis-cli","ping"]
-    # deploy:
-    #   placement:
-    #     constraints:
-    #       - node.role == manager
-
-networks:
-  redis:
-    external: true
@@ -1,60 +0,0 @@
-version: "3.9"
-
-services:
-  server:
-    image: amruthpillai/reactive-resume:server-latest
-    restart: unless-stopped
-    env_file:
-      - ../data/secrets/resume.env
-    environment:
-      PUBLIC_URL: https://cv.marcpartensky.fr
-      PUBLIC_SERVER_URL: https://cv.marcpartensky.fr/api
-    networks:
-      - caddy
-      - postgres
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.server.loadbalancer.server.port: 3100
-        traefik.http.routers.server.rule: Host(`api.cv.marcpartensky.fr`)
-        # traefik.http.routers.server.rule: "Host(`cv.marcpartensky.fr`) && PathPrefix(`/api`)"
-        # traefik.http.routers.server.rule: >
-        #   Host(`cv.marcpartensky.com`) &&
-        #   PathPrefix(`/api`) ||
-        #   Host(`cv.marcpartensky.fr`) &&
-        #   PathPrefix(`/api`)
-        traefik.http.routers.server.entrypoints: websecure
-        # traefik.http.routers.server.tls.certresolver: cloudflare
-        traefik.http.routers.server.tls.certresolver: tls
-
-  client:
-    image: amruthpillai/reactive-resume:client-latest
-    restart: unless-stopped
-    env_file:
-     - ../data/secrets/resume.env
-    environment:
-      PUBLIC_URL: https://cv.marcpartensky.fr
-      PUBLIC_SERVER_URL: https://cv.marcpartensky.fr/api
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.client.loadbalancer.server.port: 3000
-        # traefik.http.routers.client.rule: Host(`cv.marcpartensky.fr`)
-        traefik.http.routers.client.rule: >
-          Host(`cv.marcpartensky.fr`)
-          # Host(`cv.marcpartensky.com`) &&
-          # Path(`/`) ||
-          # Host(`cv.marcpartensky.fr`) &&
-          # Path(`/`)
-        traefik.http.routers.client.entrypoints: websecure
-        # traefik.http.routers.client.tls.certresolver: cloudflare
-        traefik.http.routers.server.tls.certresolver: tls
-        # traefik.http.routers.client.middlewares: ldap_auth
-networks:
-  postgres:
-    external: true
-  caddy:
-    external: true
-
@@ -16,6 +16,8 @@ services:
    image: memcached:1.6
    restart: unless-stopped
    entrypoint: memcached -m 256
+    networks:
+      - seafile
    networks:
      seafile:
        aliases:
@@ -35,6 +37,8 @@ services:
    # mem_limit: 2g
    volumes:
      - elasticsearch:/usr/share/elasticsearch/data  # Requested, specifies the path to Elasticsearch data persistent store.
+    networks:
+      - seafile
    networks:
      seafile:
        aliases:
@@ -1,25 +0,0 @@
-version: "3"
-
-services:
-  serge:
-    image: ghcr.io/nsarrazin/serge:latest
-    networks:
-      - caddy
-    volumes:
-      - weights:/usr/src/app/weights
-      - data:/data/db/
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.serge.rule: >
-          Host(`serge.marcpartensky.fr`) ||
-          Host(`serge.marcpartensky.com`)
-        traefik.http.routers.serge.entrypoints: websecure
-        traefik.http.services.serge.loadbalancer.server.port: 8008
-
-networks:
-  caddy:
-    external: true
-volumes:
-  data:
-  weights:
@@ -1,248 +0,0 @@
-version: "3.9"
-
-x-clickhouse-defaults: &clickhouse-defaults
-  image: clickhouse/clickhouse-server:22.8.8-alpine
-  tty: true
-  deploy:
-    restart_policy:
-      condition: on-failure
-  depends_on:
-    - zookeeper-1
-    # - zookeeper-2
-    # - zookeeper-3
-  logging:
-    options:
-      max-size: 50m
-      max-file: "3"
-  healthcheck:
-    # "clickhouse", "client", "-u ${CLICKHOUSE_USER}", "--password ${CLICKHOUSE_PASSWORD}", "-q 'SELECT 1'"
-    test: ["CMD", "wget", "--spider", "-q", "localhost:8123/ping"]
-    interval: 30s
-    timeout: 5s
-    retries: 3
-  ulimits:
-    nproc: 65535
-    nofile:
-      soft: 262144
-      hard: 262144
-
-x-clickhouse-depend: &clickhouse-depend
-  depends_on:
-    - clickhouse
-    # - clickhouse-2
-    # - clickhouse-3
-
-services:
-  zookeeper-1:
-    image: bitnami/zookeeper:3.7.0
-    hostname: zookeeper-1
-    user: root
-    ports:
-      - "2181:2181"
-      - "2888:2888"
-      - "3888:3888"
-    volumes:
-      - ./data/zookeeper-1:/bitnami/zookeeper
-    environment:
-      - ZOO_SERVER_ID=1
-      # - ZOO_SERVERS=0.0.0.0:2888:3888,zookeeper-2:2888:3888,zookeeper-3:2888:3888
-      - ALLOW_ANONYMOUS_LOGIN=yes
-      - ZOO_AUTOPURGE_INTERVAL=1
-
-  # zookeeper-2:
-  #   image: bitnami/zookeeper:3.7.0
-  #   hostname: zookeeper-2
-  #   user: root
-  #   ports:
-  #     - "2182:2181"
-  #     - "2889:2888"
-  #     - "3889:3888"
-  #   volumes:
-  #     - ./data/zookeeper-2:/bitnami/zookeeper
-  #   environment:
-  #     - ZOO_SERVER_ID=2
-  #     - ZOO_SERVERS=zookeeper-1:2888:3888,0.0.0.0:2888:3888,zookeeper-3:2888:3888
-  #     - ALLOW_ANONYMOUS_LOGIN=yes
-  #     - ZOO_AUTOPURGE_INTERVAL=1
-
-  # zookeeper-3:
-  #   image: bitnami/zookeeper:3.7.0
-  #   hostname: zookeeper-3
-  #   user: root
-  #   ports:
-  #     - "2183:2181"
-  #     - "2890:2888"
-  #     - "3890:3888"
-  #   volumes:
-  #     - ./data/zookeeper-3:/bitnami/zookeeper
-  #   environment:
-  #     - ZOO_SERVER_ID=3
-  #     - ZOO_SERVERS=zookeeper-1:2888:3888,zookeeper-2:2888:3888,0.0.0.0:2888:3888
-  #     - ALLOW_ANONYMOUS_LOGIN=yes
-  #     - ZOO_AUTOPURGE_INTERVAL=1
-
-  clickhouse:
-    <<: *clickhouse-defaults
-    hostname: clickhouse
-    # ports:
-    #   - "9000:9000"
-    #   - "8123:8123"
-    #   - "9181:9181"
-    volumes:
-      - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
-      - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
-      - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
-      # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
-      - ./data/clickhouse/:/var/lib/clickhouse/
-
-  # clickhouse-2:
-  #   <<: *clickhouse-defaults
-  #   hostname: clickhouse-2
-  #   ports:
-  #     - "9001:9000"
-  #     - "8124:8123"
-  #     - "9182:9181"
-  #   volumes:
-  #     - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
-  #     - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
-  #     - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
-  #     # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
-  #     - ./data/clickhouse-2/:/var/lib/clickhouse/
-
-  # clickhouse-3:
-  #   <<: *clickhouse-defaults
-  #   hostname: clickhouse-3
-  #   ports:
-  #     - "9002:9000"
-  #     - "8125:8123"
-  #     - "9183:9181"
-  #   volumes:
-  #     - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
-  #     - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
-  #     - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
-  #     # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
-  #     - ./data/clickhouse-3/:/var/lib/clickhouse/
-
-  alertmanager:
-    image: signoz/alertmanager:0.23.0-0.2
-    volumes:
-      - ./data/alertmanager:/data
-    command:
-      - --queryService.url=http://query-service:8085
-      - --storage.path=/data
-    depends_on:
-      - query-service
-    deploy:
-      restart_policy:
-        condition: on-failure
-
-  query-service:
-    image: signoz/query-service:0.17.0
-    command: ["-config=/root/config/prometheus.yml"]
-    # ports:
-    #   - "6060:6060"     # pprof port
-    #   - "8080:8080"     # query-service port
-    volumes:
-      - ./prometheus.yml:/root/config/prometheus.yml
-      - ../dashboards:/root/config/dashboards
-      - ./data/signoz/:/var/lib/signoz/
-    environment:
-      - ClickHouseUrl=tcp://clickhouse:9000/?database=signoz_traces
-      - ALERTMANAGER_API_PREFIX=http://alertmanager:9093/api/
-      - SIGNOZ_LOCAL_DB_PATH=/var/lib/signoz/signoz.db
-      - DASHBOARDS_PATH=/root/config/dashboards
-      - STORAGE=clickhouse
-      - GODEBUG=netdns=go
-      - TELEMETRY_ENABLED=true
-      - DEPLOYMENT_TYPE=docker-swarm
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "localhost:8080/api/v1/health"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    deploy:
-      restart_policy:
-        condition: on-failure
-    <<: *clickhouse-depend
-
-  frontend:
-    image: signoz/frontend:0.17.0
-    deploy:
-      restart_policy:
-        condition: on-failure
-    depends_on:
-      - alertmanager
-      - query-service
-    ports:
-      - "3301:3301"
-    volumes:
-      - ../common/nginx-config.conf:/etc/nginx/conf.d/default.conf
-
-  otel-collector:
-    image: signoz/signoz-otel-collector:0.66.6
-    command: ["--config=/etc/otel-collector-config.yaml"]
-    user: root # required for reading docker container logs
-    volumes:
-      - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml
-      - /var/lib/docker/containers:/var/lib/docker/containers:ro
-    environment:
-      - OTEL_RESOURCE_ATTRIBUTES=host.name={{.Node.Hostname}},os.type={{.Node.Platform.OS}},dockerswarm.service.name={{.Service.Name}},dockerswarm.task.name={{.Task.Name}}
-      - DOCKER_MULTI_NODE_CLUSTER=false
-      - LOW_CARDINAL_EXCEPTION_GROUPING=false
-    ports:
-      # - "1777:1777"     # pprof extension
-      - "4317:4317"     # OTLP gRPC receiver
-      - "4318:4318"     # OTLP HTTP receiver
-      # - "8888:8888"     # OtelCollector internal metrics
-      # - "8889:8889"     # signoz spanmetrics exposed by the agent
-      # - "9411:9411"     # Zipkin port
-      # - "13133:13133"   # Health check extension
-      # - "14250:14250"   # Jaeger gRPC
-      # - "14268:14268"   # Jaeger thrift HTTP
-      # - "55678:55678"   # OpenCensus receiver
-      # - "55679:55679"   # zPages extension
-    deploy:
-      mode: global
-      restart_policy:
-        condition: on-failure
-    <<: *clickhouse-depend
-
-  otel-collector-metrics:
-    image: signoz/signoz-otel-collector:0.66.6
-    command: ["--config=/etc/otel-collector-metrics-config.yaml"]
-    volumes:
-      - ./otel-collector-metrics-config.yaml:/etc/otel-collector-metrics-config.yaml
-    # ports:
-    #   - "1777:1777"     # pprof extension
-    #   - "8888:8888"     # OtelCollector internal metrics
-    #   - "13133:13133"   # Health check extension
-    #   - "55679:55679"   # zPages extension
-    deploy:
-      restart_policy:
-        condition: on-failure
-    <<: *clickhouse-depend
-
-  hotrod:
-    image: jaegertracing/example-hotrod:1.30
-    command: ["all"]
-    environment:
-      - JAEGER_ENDPOINT=http://otel-collector:14268/api/traces
-    logging:
-      options:
-        max-size: 50m
-        max-file: "3"
-
-  load-hotrod:
-    image: "grubykarol/locust:1.2.3-python3.9-alpine3.12"
-    hostname: load-hotrod
-    environment:
-      ATTACKED_HOST: http://hotrod:8080
-      LOCUST_MODE: standalone
-      NO_PROXY: standalone
-      TASK_DELAY_FROM: 5
-      TASK_DELAY_TO: 30
-      QUIET_MODE: "${QUIET_MODE:-false}"
-      LOCUST_OPTS: "--headless -u 10 -r 1"
-    volumes:
-      - ../common/locust-scripts:/locust
-
@@ -13,12 +13,9 @@ services:
    deploy:
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.swarm_visualizer.rule: Host(`swarm.marcpartensky.com`)
-        traefik.http.routers.swarm_visualizer.rule: >
-          Host(`swarm.marcpartensky.fr`) && Host(`swarm.marcpartensky.com`)
+        traefik.http.routers.swarm_visualizer.rule: Host(`swarm.marcpartensky.com`)
        traefik.http.routers.swarm_visualizer.entrypoints: websecure
-        # traefik.http.routers.swarm_visualizer.tls.certresolver: tls
-        traefik.http.routers.swarm_visualizer.tls.certresolver: cloudflare
+        traefik.http.routers.swarm_visualizer.tls.certresolver: tls
        traefik.http.services.swarm_visualizer.loadbalancer.server.port: 8080

 networks:
@@ -1,17 +0,0 @@
-version: "3.9"
-services:
-  syncthing:
-    image: lscr.io/linuxserver/syncthing:latest
-    restart: unless-stopped
-    environment:
-      PUID: 1000
-      PGID: 1000
-      TZ: Etc/UTC
-    volumes:
-      - /path/to/appdata/config:/config
-      - /path/to/data1:/data1
-      - /path/to/data2:/data2
-    ports:
-      - 8384:8384
-      - 22000:22000
-      - 21027:21027/udp
@@ -4,8 +4,8 @@ services:
  traefik:
    image: traefik:2.9.1 # https://github.com/wiltonsr/ldapauth/issues/25
    # image: traefik:latest # https://github.com/wiltonsr/ldapauth/issues/25
-    env_file:
-      - ../data/secrets/traefik.env
+    # env_file:
+    #   - ../data/secrets/traefik.env
    # restart: unless-stopped
    # command:
    #   ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
@@ -38,7 +38,8 @@ services:
      - caddy
      - ldap
    volumes:
-      - ../data/traefik:/etc/traefik
+      - ../data/traefik/traefik.yml:/traefik.yml # static configuration
+      - ../data/traefik/dynamic.yml:/dynamic.yml
        # - traefik_letsencrypt:/letsencrypt
      - traefik:/config
      - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -14,7 +14,7 @@ services:
        traefik.http.routers.kuma.rule: >
          Host(`uptime.marcpartensky.com`) || Host(`uptime.marcpartensky.fr`)
        traefik.http.routers.kuma.entrypoints: websecure
-        traefik.http.routers.kuma.tls.certresolver: tls
+        traefik.http.routers.kuma.tls.certresolver: cloudflare
        traefik.http.routers.kuma.middlewares: ldap_auth

 networks:
@@ -41,12 +41,16 @@ services:
    #   traefik.http.services.vaultwarden.loadbalancer.server.port: 80
    deploy:
      labels:
+        # traefik.enable: "false"
        traefik.enable: "true"
+        # traefik.http.routers.vaultwarden.rule: >
+        #   Host(`vault.marcpartensky.com`)
        traefik.http.routers.vaultwarden.rule: >
+          Host(`vault.marcpartensky.com`) ||
          Host(`vault.marcpartensky.fr`) ||
-          Host(`vault.marcpartensky.com`)
+          Host(`secret.marcpartensky.fr`)
        traefik.http.routers.vaultwarden.entrypoints: websecure
-        traefik.http.routers.vaultwarden.tls.certresolver: cloudflare
+        traefik.http.routers.vaultwarden.tls.certresolver: tls
        traefik.http.services.vaultwarden.loadbalancer.server.port: 80

  # ldap_admin:
@@ -1,99 +0,0 @@
-version: "3.9"
-services:
-  wallabag:
-    image: wallabag/wallabag
-    volumes:
-      # Volumes for data-related folders
-      - assets:/var/www/html/web/assets
-      - data:/var/www/html/data
-      - cache:/var/www/.cache
-      # Uncomment the following volume if you run rootless Docker
-      # A limitation blocks permissions on root docker, see
-      # https://github.com/moby/moby/issues/40881
-      # - type: tmpfs
-      #   target: /var/www/html/var/cache
-      # Override third-party libraries for dev
-      # - ../graby-site-config:/var/www/html/vendor/j0k3r/graby-site-config
-      # - ../php-readability:/var/www/html/vendor/j0k3r/php-readability
-      # - ../graby:/var/www/html/vendor/j0k3r/graby
-      # - ../HTMLawed:/var/www/html/vendor/fossar/htmlawed
-      # - ../PHPePub:/var/www/html/vendor/wallabag/phpepub
-      # - ../guzzle-site-authenticator:/var/www/html/vendor/bdunogier/guzzle-site-authenticator
-    env_file:
-      # Copy docker/php/env.example to docker/php/env and customize
-      - ../data/secrets/wallabag.env
-      # Uncomment the database engine you want, it will use sqlite if both are commented
-      # - ./docker/mariadb/env
-      # - ./docker/postgres/env
-      # Uncomment to enable Xdebug
-      # - ./docker/php/xdebug
-    # ports:
-      # - 8000:8000
-      # Uncomment to permit Xdebug remote session
-      # - 9000:9000
-    # depends_on:
-      # - mariadb
-      # - postgres
-      # - redis
-    networks:
-      - caddy
-      - postgres
-      - redis
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.wallabag.loadbalancer.server.port: 80
-        traefik.http.routers.wallabag.rule: >
-          Host(`wallabag.marcpartensky.com`) ||
-          Host(`wallabag.marcpartensky.fr`)
-        traefik.http.routers.wallabag.entrypoints: websecure
-        # traefik.http.routers.wallabag.tls.certresolver: tls
-        traefik.http.routers.wallabag.tls.certresolver: cloudflare
-        # traefik.http.routers.wallabag.middlewares: ldap_auth
-
-    # postgres:
-    #     image: postgres:11-alpine
-    #     volumes:
-    #         - db-data:/var/lib/postgresql/data
-    #     env_file:
-    #         - ./docker/postgres/env
-    #     healthcheck:
-    #         test: ["CMD-SHELL", "pg_isready -q || exit 1"]
-    #         interval: 10s
-    #         timeout: 3s
-    #         retries: 3
-
-    # mariadb:
-    #    image: mariadb:10
-    #    ports:
-    #        - "3306:3306"
-    #    volumes:
-    #        - db-data:/var/lib/mysql
-    #    env_file:
-    #        - ./docker/mariadb/env
-
-    # rabbitmq:
-    #     image: rabbitmq:3-management-alpine
-    #     ports:
-    #         - "15672:15672"
-
-  # redis:
-  #   image: redis:6-alpine
-  #   healthcheck:
-  #     test: ["CMD", "redis-cli", "ping"]
-  #     interval: 10s
-  #     timeout: 3s
-  #     retries: 3
-
-volumes:
-  assets:
-  data:
-  cache:
-networks:
-  wallabag:
-  caddy:
-    external: true
-  postgres:
-    external: true
-  redis:
-    external: true
@@ -2,7 +2,7 @@ version: "3.9"

 services:
  website:
-    image: marcpartensky/website:v140.f211658.2023-11-01
+    image: marcpartensky/website
    restart: unless-stopped
    env_file:
      - ../data/secrets/website.env
@@ -17,15 +17,14 @@ services:
    # command:
    #   - "80"
    #   - "0.0.0.0"
-    # depends_on:
-    #   - redis
+    depends_on:
+      - redis
    volumes:
      - media:/app/media
    networks:
+      - postgres
      - website
      - caddy
-      - postgres
-      - redis
    # labels:
    #   caddy: marcpartensky.com
    #   caddy.reverse_proxy: "{{upstreams 80}}"
@@ -61,25 +60,23 @@ services:
        traefik.http.routers.website.tls.certresolver: tls
        traefik.http.services.website.loadbalancer.server.port: 80

-  # redis:
-  #   image: redis:alpine
-  #   restart: unless-stopped
-  #   networks:
-  #     - website
-  #   healthcheck:
-  #      test: ["CMD", "redis-cli","ping"]
-  #   deploy:
-  #     placement:
-  #       constraints:
-  #         - node.role == manager
+  redis:
+    image: redis:alpine
+    restart: unless-stopped
+    networks:
+      - website
+    healthcheck:
+       test: ["CMD", "redis-cli","ping"]
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager

 volumes:
  media:

 networks:
  website:
-  redis:
-    external: true
  postgres:
    external: true
  caddy:
@@ -1,90 +0,0 @@
-#
-# Please consult the `Deployment` section in the readme if you want to deploy
-# this. You *need* to keep this nginx service, even if you have your own,
-# otherwise the static files will not be served correctly! If you do remove
-# it, configure yours similarly to what's in config/nginx.conf
-# Also take a look at the "Static files" section in the .env file
-
-services:
-  wger:
-    image: wger/server:latest
-    # depends_on:
-    #   db:
-    #     condition: service_healthy
-    #   cache:
-    #     condition: service_healthy
-    env_file:
-      - ../data/secrets/wger.env
-    volumes:
-      - static:/home/wger/static
-      - media:/home/wger/media
-    healthcheck:
-      test: wget --no-verbose --tries=1 --spider http://localhost:8000
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  nginx:
-    image: nginx:stable
-    volumes:
-      - ../data/wger/nginx.conf:/etc/nginx/conf.d/default.conf
-      - static:/wger/static:ro
-      - media:/wger/media:ro
-    ports:
-      - "80:80"
-    healthcheck:
-      test: service nginx status
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  # cache:
-  #   image: redis
-  #   expose:
-  #     - 6379
-  #   healthcheck:
-  #     test: redis-cli ping
-  #     interval: 10s
-  #     timeout: 5s
-  #     retries: 5
-  #   restart: unless-stopped
-
-  celery_worker:
-    image: wger/server:latest
-    container_name: wger_celery_worker
-    command: /start-worker
-    env_file:
-      - ./data/secrets/wger.env
-    # depends_on:
-    #   cache:
-    #     condition: service_healthy
-    #   db:
-    #     condition: service_healthy
-    healthcheck:
-      test: celery -A wger inspect ping
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  celery_beat:
-    image: wger/server:latest
-    command: /start-beat
-    volumes:
-      - celery-beat:/home/wger/beat/
-    env_file:
-      - ./config/.env
-      - ./data/secrets/wger.env
-    # depends_on:
-    #   cache:
-    #     condition: service_healthy
-
-volumes:
-  celery-beat:
-  static:
-  media:
-
-networks:
-  caddy:
-    external: true
-  postgres:
-    external: true
@@ -8,7 +8,6 @@ services:
      # replicas: 0
      labels:
        traefik.enable: "true"
-        # traefik.http.routers.whoami.rule: Host(`whoami.marcpartensky.fr`)
        traefik.http.routers.whoami.rule: >
          Host(`whoami.marcpartensky.com`) || Host(`whoami.marcpartensky.fr`)
        traefik.http.routers.whoami.entrypoints: websecure
@@ -5,11 +5,9 @@ services:
    image: marcpartensky/yt-dlp
    restart: unless-stopped
    volumes:
-      - ../data/yt-dlp:/root/downloads
      - ~/Videos/Youtube:/srv
    env_file:
      - ../data/secrets/yt-dlp.env
-    network_mode: none

  webui:
    image: ghcr.io/marcopeocchi/yt-dlp-web-ui:latest
@@ -22,10 +20,9 @@ services:
      labels:
        traefik.enable: "true"
        traefik.http.routers.ytdlp.rule: >
-          Host(`yt.marcpartensky.fr`) ||
-          Host(`yt.marcpartensky.com`)
+          Host(`yt.marcpartensky.fr`)
        traefik.http.routers.ytdlp.entrypoints: websecure
-        traefik.http.routers.ytdlp.tls.certresolver: cloudflare
+        traefik.http.routers.ytdlp.tls.certresolver: tls
        traefik.http.services.ytdlp.loadbalancer.server.port: 3033

 volumes:
Author	SHA1	Message	Date
marc	0c65605a28	Merge branch 'master' into fuck	2023-03-07 12:30:22 +01:00
marc	46b728a7ed	tableau	2023-03-07 12:26:14 +01:00
marc	4872b046fa	jellyfin.yml that works	2023-03-07 12:26:14 +01:00
marc	cf5b055b24	yt.marcpartensky.fr	2023-03-07 12:26:14 +01:00
marc	2cdf14caba	ytdlp webui	2023-03-07 12:26:14 +01:00
marc	783fc29049	yt-dlp	2023-03-06 16:28:47 +01:00
marc	b37a2bb6e3	container name yt-dlp.yml	2023-03-04 19:52:21 +01:00