Merge branch 'master' into fuck

.gitignore

@@ -21,10 +21,6 @@ data/openvpn_*
 data/mailcow
 data/dockvpn
 data/hydra
-data/yt-dlp
-data/mongo
-data/gpg
-data/redis
 data.tar.gz
 data.7z
 data.7z.gpg

Makefile

@@ -8,8 +8,6 @@ mswarm: merge
 	docker stack deploy -c stacks/docker-compose.yml vps
 down:
 	docker stack rm vps
-pull:
-	for file in services/*; do docker-compose -f $$file pull; done
 export:
 	7z a -p data.7z data
 	gpg --encrypt --sign --recipient 'marc@marcpartensky.com' data.7z
@@ -20,9 +18,7 @@ networks:
 	docker network create --driver overlay --attachable postgres || true
 	docker network create --driver overlay --attachable mongo || true
 	docker network create --driver overlay --attachable vpn || true
-	docker network create --driver overlay --attachable redis || true
 	docker network create --driver overlay --subnet 172.22.1.0/24 --gateway 172.22.1.1 --attachable mailcow || true
-	docker network create --driver overlay --subnet 10.22.69.0/24 --gateway 10.22.69.1 --attachable pritunl || true
 node:
 	docker node update --label-add net=web contabo
 	docker node update --label-add net=none tower

data/adguard/AdGuardHome.yaml

@@ -1,5 +1,6 @@
 bind_host: 0.0.0.0
 bind_port: 3000
+beta_bind_port: 0
 users:
   - name: marc
     password: $2a$10$E9cknJr/bTLtSUJ9EaW8r.Gw30FX8Plm8jgq.LaYxMwiX4DEuDK7O
@@ -7,20 +8,23 @@ auth_attempts: 5
 block_auth_min: 15
 http_proxy: ""
 language: ""
-theme: auto
 debug_pprof: false
 web_session_ttl: 720
 dns:
   bind_hosts:
     - 0.0.0.0
   port: 53
+  statistics_interval: 1
+  querylog_enabled: true
+  querylog_file_enabled: true
+  querylog_interval: 2160h
+  querylog_size_memory: 1000
   anonymize_client_ip: false
   protection_enabled: true
   blocking_mode: default
   blocking_ipv4: ""
   blocking_ipv6: ""
   blocked_response_ttl: 10
-  protection_disabled_until: null
   parental_block_host: family-block.dns.adguard.com
   safebrowsing_block_host: standard-block.dns.adguard.com
   ratelimit: 20
@@ -53,31 +57,20 @@ dns:
   bogus_nxdomain: []
   aaaa_disabled: false
   enable_dnssec: false
-  edns_client_subnet:
-    custom_ip: ""
-    enabled: false
-    use_custom: false
+  edns_client_subnet: false
   max_goroutines: 300
   handle_ddr: true
   ipset: []
   ipset_file: ""
-  bootstrap_prefer_ipv6: false
   filtering_enabled: true
   filters_update_interval: 24
   parental_enabled: false
+  safesearch_enabled: false
   safebrowsing_enabled: false
   safebrowsing_cache_size: 1048576
   safesearch_cache_size: 1048576
   parental_cache_size: 1048576
   cache_time: 30
-  safe_search:
-    enabled: false
-    bing: true
-    duckduckgo: true
-    google: true
-    pixabay: true
-    yandex: true
-    youtube: true
   rewrites:
     - domain: medium.com
       answer: 0.0.0.0
@@ -88,8 +81,6 @@ dns:
   private_networks: []
   use_private_ptr_resolvers: true
   local_ptr_upstreams: []
-  use_dns64: false
-  dns64_prefixes: []
   serve_http3: false
   use_http3_upstreams: false
 tls:
@@ -107,16 +98,6 @@ tls:
   certificate_path: ""
   private_key_path: ""
   strict_sni_check: false
-querylog:
-  ignored: []
-  interval: 2160h
-  size_memory: 1000
-  enabled: true
-  file_enabled: true
-statistics:
-  ignored: []
-  interval: 24h
-  enabled: true
 filters:
   - enabled: true
     url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
@@ -180,4 +161,4 @@ os:
   group: ""
   user: ""
   rlimit_nofile: 0
-schema_version: 20
+schema_version: 14

data/grafana/grafana.ini

@@ -1,11 +0,0 @@
-[database]
-type = postgres
-host = postgres:5432
-name = grafana
-user = grafana
-password = ZTliY2MwOWQ5ZjNiMzUyMTc5YWMwNmJi
-ssl_mode = disable
-
-[auth.ldap]
-enabled = true
-config_file = /etc/grafana/ldap.toml

data/jupyterhub/jupyterhub_config.py

@@ -14,37 +14,18 @@ network_name = os.environ['DOCKER_NETWORK_NAME']
 c.SwarmSpawner.network_name = network_name
 c.SwarmSpawner.remove_containers = True
 c.SwarmSpawner.debug = True
-# c.SwarmSpawner.image = "jupyterhub/singleuser:latest"
-# c.SwarmSpawner.image = "marcpartensky/jupyterhub-singleuser"
-# c.SwarmSpawner.image = os.environ["DOCKER_IMAGE"]
-# c.SwarmSpawner.host_ip = "juypterhub"
-# c.SwarmSpawner.container_spec = {
-#               # The command to run inside the service
-#               'args' : ['/usr/local/bin/start-singleuser.sh'], # (list)
-#               'Image' : 'juypterhub/singleuser',
-#               # 'mounts' : mounts
-#       }
+c.SwarmSpawner.image = "jupyterhub/singleuser:latest"
 c.SwarmSpawner.host_ip = "0.0.0.0"
 
-# kill old kernels
-# https://opendreamkit.org/2018/10/17/jupyterhub-docker/
-# c.JupyterHub.services = [
-#     {
-#         'name': 'cull_idle',
-#         'admin': True,
-#         'command': 'python3 /srv/jupyterhub/cull_idle_servers.py --timeout=3600'.split(),
-#     },
-# ]
-
 # Persistence
-# notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/jovyan/work'
-# c.DockerSpawner.notebook_dir = notebook_dir
-# c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }
+notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/jovyan/work'
+c.DockerSpawner.notebook_dir = notebook_dir
+c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }
 
 # Authentication
 # c.JupyterHub.authenticator_class = 'dummyauthenticator.DummyAuthenticator'
 c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'
-c.LDAPAuthenticator.server_address = "ldap"
+c.LDAPAuthenticator.server_address = "marcpartensky.com"
 c.LDAPAuthenticator.use_ssl = True
 c.LDAPAuthenticator.bind_dn_template = [
     "uid={username},ou=people,dc=admin,dc=org",

data/prometheus/prometheus.yml

@@ -11,13 +11,9 @@ global:
 scrape_configs:
   # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
   - job_name: 'prometheus'
+
     # Override the global default and scrape targets from this job every 5 seconds.
     scrape_interval: 5s
-    static_configs:
-      - targets: ['node-exporter:9100']
 
-  - job_name: cadvisor
-    scrape_interval: 5s
     static_configs:
-    - targets:
-      - cadvisor:8080
+      - targets: ['localhost:9090']

data/traefik/traefik.yml

@@ -6,8 +6,7 @@ api:
   # insecure: false # = secure
   insecure: true
   dashboard: true
-  # debug: true
-  debug: false
+  debug: true
 providers:
   docker:
     swarmMode: true

env/vps.txt

@@ -4,7 +4,8 @@ valentin
 open-web-calendar
 adguard
 servant
-discord
+discord-bot
+ia
 docker-api
 ialab
 portainer
@@ -19,5 +20,3 @@ pritunl-mongo
 fail2ban
 ldap
 ldap-manager
-vaultwarden
-authentik

services/adguard.yml

@@ -24,14 +24,20 @@ services:
       - ../data/adguard:/opt/adguardhome/conf
     networks:
       - caddy
+    labels:
+      caddy: adguard.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 3000}}"
+      traefik.enable: "true"
+      traefik.http.routers.adguard.rule: Host(`adguard.marcpartensky.com`)
+      traefik.http.routers.adguard.entrypoints: websecure
+      traefik.http.routers.adguard.tls.certresolver: tls
+      traefik.http.services.adguard.loadbalancer.server.port: 3000
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.adguard.rule: >
-          Host(`adguard.marcpartensky.com`) ||
-          Host(`adguard.marcpartensky.fr`)
+        traefik.http.routers.adguard.rule: Host(`adguard.marcpartensky.com`)
         traefik.http.routers.adguard.entrypoints: websecure
-        traefik.http.routers.adguard.tls.certresolver: cloudflare
+        traefik.http.routers.adguard.tls.certresolver: tls
         traefik.http.services.adguard.loadbalancer.server.port: 3000
         traefik.http.routers.adguard.middlewares: ldap_auth
 

services/agenda_militant.yml

@@ -5,10 +5,16 @@ services:
     restart: unless-stopped
     networks:
       - caddy
+    labels:
+      caddy: agenda.militant.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8080}}"
+      traefik.enable: "true"
+      traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
+      traefik.http.routers.agenda_militant.entrypoints: websecure
+      traefik.http.routers.agenda_militant.tls.certresolver: tls
+      traefik.http.services.agenda_militant.loadbalancer.server.port: 8080
     deploy:
       labels:
-        caddy: agenda.militant.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams 8080}}"
         traefik.enable: "true"
         traefik.http.routers.agenda_militant.rule: Host(`agenda.militant.marcpartensky.com`)
         traefik.http.routers.agenda_militant.entrypoints: websecure

services/authentik.yml

@@ -6,66 +6,75 @@ services:
     restart: unless-stopped
     command: server
     environment:
-      AUTHENTIK_DEBUG: "true"
+      AUTHENTIK_REDIS__HOST: authentik_redis
+      AUTHENTIK_POSTGRESQL__HOST: authentik_postgres
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
       AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: admin
       # WORKERS: 2
+    volumes:
+      - authentik_media:/media
+      - authentik_templates:/templates
+      - authentik_geoip:/geoip
     env_file:
       - ../data/secrets/authentik.env
     # ports:
     #   - "0.0.0.0:${AUTHENTIK_PORT_HTTP:-9000}:9000"
     #   - "0.0.0.0:${AUTHENTIK_PORT_HTTPS:-9443}:9443"
-    volumes:
-      - media:/media
-      - templates:/templates
-      - geoip:/geoip
-    # depends_on:
-    #   - postgres
-    #   - redis
-    #   - worker
+    depends_on:
+      - authentik_postgres
+      - authentik_redis
+      - authentik_worker
     networks:
       - authentik
       - caddy
-      - postgres
-      - redis
-      - ldap
     labels:
       caddy: authentik.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 9000}}"
-      # traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.com`)
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.fr`)
-        traefik.http.routers.authentik.entrypoints: websecure
-        traefik.http.routers.authentik.tls.certresolver: cloudflare
-        traefik.http.services.authentik.loadbalancer.server.port: 9000
+      traefik.enable: "true"
+      traefik.http.routers.authentik.rule: Host(`authentik.marcpartensky.com`)
+      traefik.http.routers.authentik.entrypoints: websecure
+      traefik.http.routers.authentik.tls.certresolver: tls
+      traefik.http.services.authentik.loadbalancer.server.port: 9000
 
-  worker:
+  authentik_postgres:
+    image: postgres:alpine
+    restart: unless-stopped
+    volumes:
+      - authentik_postgres:/var/lib/postgresql/data
+    env_file:
+      - ../data/secrets/authentik.env
+    networks:
+      - authentik
+
+  authentik_redis:
+    image: redis:alpine
+    restart: unless-stopped
+    networks:
+      - authentik
+
+  authentik_worker:
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.2.1}
     restart: unless-stopped
     user: root
     command: worker
     environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgres
+      AUTHENTIK_REDIS__HOST: authentik_redis
+      AUTHENTIK_POSTGRESQL__HOST: authentik_postgres
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
     # This is optional, and can be removed. If you remove this, the following will happen
     # - The permissions for the /backups and /media folders aren't fixed, so make sure they are 1000:1000
     # - The docker socket can't be accessed anymore
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - /srv/authentik:/backups
-      - media:/media
-      - certs:/certs
-      - templates:/templates
-      - geoip:/geoip
+      - authentik_backups:/backups
+      - authentik_media:/media
+      - authentik_certs:/certs
+      - authentik_templates:/templates
+      - authentik_geoip:/geoip
     env_file:
       - ../data/secrets/authentik.env
     networks:
       - authentik
-      - postgres
-      - redis
 
   # authentik_geoipupdate:
   #   image: maxmindinc/geoipupdate:latest
@@ -79,41 +88,16 @@ services:
   #   #   - ../data/secrets/authentik.env
   #   networks:
   #     - authentik
-  #     version: "3.5"
-
-  ldap:
-    image: ghcr.io/goauthentik/ldap
-    ports:
-      - 3389:389
-      - 6636:636
-    # Optionally specify which networks the container should be
-    # might be needed to reach the core authentik server
-    networks:
-      - authentik
-    environment:
-      AUTHENTIK_DEBUG: "true"
-      AUTHENTIK_HOST: http://authentik:9000
-      # AUTHENTIK_HOST: https://authentik:9443
-      # AUTHENTIK_HOST: https://authentik.marcpartensky.fr
-      AUTHENTIK_INSECURE: "false"
-    env_file:
-      - ../data/secrets/authentik_ldap.env
 
 volumes:
-  # backups:
-  postgres:
-  media:
-  certs:
-  templates:
-  geoip:
+  authentik_postgres:
+  authentik_backups:
+  authentik_media:
+  authentik_certs:
+  authentik_templates:
+  authentik_geoip:
 
 networks:
   authentik:
-  ldap:
-    external: true
-  redis:
-    external: true
-  postgres:
-    external: true
   caddy:
     external: true

services/beef.yml

@@ -21,8 +21,7 @@ services:
       caddy.@ws.1_header: "Upgrade websocket"
       caddy.0_reverse_proxy: "@ws {{upstreams 61985}}"
       traefik.enable: "true"
-      # traefik.http.routers.beef.rule: Host(`beef.marcpartensky.com`)
-      traefik.http.routers.beef.rule: Host(`beef.marcpartensky.fr`)
+      traefik.http.routers.beef.rule: Host(`beef.marcpartensky.com`)
       traefik.http.routers.beef.entrypoints: websecure
       traefik.http.routers.beef.tls.certresolver: tls
       traefik.http.services.beef.loadbalancer.server.port: 3000

services/cadvisor.yml

@@ -1,54 +0,0 @@
-version: '3'
-
-services:
-  cadvisor:
-    # image: google/cadvisor:v0.39.0
-    # image: google/cadvisor
-    image: gcr.io/cadvisor/cadvisor
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:rw
-      - /sys:/sys:ro
-      - /var/lib/docker:/var/lib/docker:ro
-    command:
-      - '-docker_only'
-      - '-logtostderr'
-    #   - '-storage-driver=influxdb'
-    #   - '-storage-opt=host=swarm-manager1:8086'
-    #   - '-storage-opt=database=cadvisor'
-    #   - '-storage-opt=retention=1d'
-    #   - '-storage-opt=user=root'
-    #   - '-storage-opt=password=yourpassword'
-    #   - '-housekeeping_interval=5s'
-    #   - '-enable_load_reader'
-    #   - '-cpu_global_percentage=true'
-    #   - '-cpu_historic_interval=1m'
-    #   - '-docker_label_enable'
-    networks:
-      - caddy
-    deploy:
-      placement:
-        constraints:
-          - node.role == manager
-      resources:
-        limits:
-          memory: 1g
-        reservations:
-          memory: 512m
-      restart_policy:
-        condition: on-failure
-      mode: global
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.cadvisor.rule: Host(`cadvisor.marcpartensky.fr`)
-        # traefik.http.routers.cadvisor.rule: >
-        #   Host(`cadvisor.marcpartensky.com`) || Host(`cadvisor.marcpartensky.fr`)
-        traefik.http.routers.cadvisor.entrypoints: websecure
-        traefik.http.routers.cadvisor.tls.certresolver: tls
-        traefik.http.services.cadvisor.loadbalancer.server.port: 8080
-        traefik.http.routers.cadvisor.middlewares: ldap_auth
-
-      
-networks:
-  caddy:
-    external: true

services/crafty-controller.yml

@@ -1,21 +0,0 @@
-version: "3.9"
-services:
-  controller:
-    image: cybercube/crafty-controller
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.controller.loadbalancer.server.port: 8000
-        traefik.http.routers.controller.rule: Host(`controller.marcpartensky.fr`)
-        # traefik.http.routers.controller.rule: >
-        #   Host(`controller.marcpartensky.com`) || Host(`controller.marcpartensky.fr`)
-        traefik.http.routers.controller.entrypoints: websecure
-        # traefik.http.routers.controller.tls.certresolver: tls
-        traefik.http.routers.controller.tls.certresolver: cloudflare
-        # traefik.http.routers.controller.middlewares: ldap_auth
-
-networks:
-  caddy:
-    external: true

services/crontab.yml

@@ -1,29 +0,0 @@
-version: "3.9"
-services:
-  ui:
-    image: alseambusher/crontab-ui
-    networks:
-      - caddy
-    # ports:
-    #   - 8000:8000
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - crontabs:/crontab-ui/crontabs
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.ui.loadbalancer.server.port: 8000
-        traefik.http.routers.ui.rule: >
-          Host(`cron.marcpartensky.com`) ||
-          Host(`cron.marcpartensky.fr`)
-        traefik.http.routers.ui.entrypoints: websecure
-        # traefik.http.routers.ui.tls.certresolver: tls
-        traefik.http.routers.ui.tls.certresolver: cloudflare
-        traefik.http.routers.ui.middlewares: ldap_auth
-
-volumes:
-  crontabs:
-
-networks:
-  caddy:
-    external: true

services/duplicati.yml

@@ -15,16 +15,26 @@ services:
       - duplicati_source:/source
     networks:
       - caddy
+    labels:
+      caddy: duplicati.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8200}}"
+      traefik.enable: "true"
+      traefik.http.services.duplicati.loadbalancer.server.port: 8200
+      traefik.http.routers.duplicati.rule: >
+        Host(`duplicati.marcpartensky.com`) || Host(`dupliati.marcpartensky.fr`)
+      traefik.http.routers.duplicati.entrypoints: websecure
+      # traefik.http.routers.duplicati.tls.certresolver: tls
+      traefik.http.routers.duplicati.middlewares: ldap_auth
     deploy:
       labels:
         traefik.enable: "true"
         traefik.http.services.duplicati.loadbalancer.server.port: 8200
+        # traefik.http.routers.duplicati.rule: Host(`duplicati.marcpartensky.com`)
         traefik.http.routers.duplicati.rule: >
-          Host(`duplicati.marcpartensky.com`) ||
-          Host(`duplicati.marcpartensky.fr`)
+          Host(`duplicati.marcpartensky.com`) || Host(`duplicati.marcpartensky.fr`)
         traefik.http.routers.duplicati.entrypoints: websecure
-        traefik.http.routers.duplicati.tls.certresolver: tls
-        # traefik.http.routers.duplicati.tls.certresolver: cloudflare
+        # traefik.http.routers.duplicati.tls.certresolver: tls
+        traefik.http.routers.duplicati.tls.certresolver: cloudflare
         # traefik.http.routers.duplicati.middlewares: ldap_auth
 
 volumes:

services/etesync.yml

@@ -1,34 +0,0 @@
-version: "3.9"
-services:
-  etesync:
-    image: victorrds/etesync
-    restart: unless-stopped
-    networks:
-      - caddy
-      - postgres
-    env_file:
-      - ../data/secrets/etesync.env
-    volumes:
-      - static:/srv/etebase/static
-      - media:/data/media
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.etesync.loadbalancer.server.port: 3735
-        traefik.http.routers.etesync.rule: >
-          # Host(`etesync.marcpartensky.com`) ||
-          Host(`etesync.marcpartensky.fr`)
-        traefik.http.routers.etesync.entrypoints: websecure
-        traefik.http.routers.etesync.tls.certresolver: tls
-        # traefik.http.routers.etesync.tls.certresolver: cloudflare
-        # traefik.http.routers.etesync.middlewares: ldap_auth
-
-networks:
-  postgres:
-    external: true
-  caddy:
-    external: true
-
-volumes:
-  static:
-  media:

services/etherpad.yml

@@ -4,36 +4,27 @@ services:
   etherpad:
     image: etherpad/etherpad
     restart: unless-stopped
-    env_file:
-      - ../data/secrets/etherpad.env
-    # environment:
-    #   SETTINGS_PATH: /etc/etherpad/settings.json
+    environment:
+      ADMIN_PASSWORD: supersecret
     networks:
-      - caddy
-      - postgres
-    # volumes:
-    #   - data:/opt/etherpad-lite/var
-    # volumes:
-    #   - ../data/etherpad/settings.json:/opt/etherpad-lite/settings.json
+        - caddy
+    labels:
+      caddy: etherpad.marcpartensky.com, pad.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 9001}}"
+      traefik.enable: "true"
+      traefik.http.routers.etherpad.rule: Host(`pad.marcpartensky.com`)
+      traefik.http.routers.etherpad.entrypoints: websecure
+      traefik.http.routers.etherpad.tls.certresolver: tls
+      traefik.http.services.etherpad.loadbalancer.server.port: 9001
     deploy:
       labels:
         traefik.enable: "true"
         traefik.http.routers.etherpad.rule: >
-          Host(`pad.marcpartensky.com`) ||
-          Host(`pad.marcpartensky.fr`)
+          Host(`pad.marcpartensky.com`) && Host(`pad.marcpartensky.fr`)
         traefik.http.routers.etherpad.entrypoints: websecure
-        traefik.http.routers.etherpad.tls.certresolver: cloudflare
+        traefik.http.routers.etherpad.tls.certresolver: tls
         traefik.http.services.etherpad.loadbalancer.server.port: 9001
-        traefik.http.middlewares.redirect-pad-com.redirectregex.regex: "^https://etherpad.marcpartensky.com/(.*)"
-        traefik.http.middlewares.redirect-pad-com.redirectregex.replacement: "https://pad.marcpartensky.com/$${1}"
-        traefik.http.middlewares.redirect-pad-fr.redirectregex.regex: "^https://etherpad.marcpartensky.fr/(.*)"
-        traefik.http.middlewares.redirect-pad-fr.redirectregex.replacement: "https://pad.marcpartensky.fr/$${1}"
-
-# volumes:
-#   data:
 
 networks:
   caddy:
     external: true
-  postgres:
-    external: true

services/filebrowser.yml

@@ -6,7 +6,7 @@ services:
     restart: unless-stopped
     # user: "${UID}:${GID}"
     volumes:
-      - /root/Videos:/data
+      - data:/data
       - ../data/filebrowser:/config
     # environment:
       # FB_BASEURL: /filebrowser
@@ -15,9 +15,7 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.filebrowser.rule: >
-          Host(`file.marcpartensky.fr`) ||
-          Host(`file.marcpartensky.com`)
+        traefik.http.routers.filebrowser.rule: Host(`file.marcpartensky.com`)
         traefik.http.routers.filebrowser.entrypoints: websecure
         traefik.http.routers.filebrowser.tls.certresolver: tls
         traefik.http.services.filebrowser.loadbalancer.server.port: 8080

services/fuseki.yml

@@ -1,31 +0,0 @@
-version: "3.9"
-
-services:
-  fuseki:
-    image: stain/jena-fuseki
-    volumes:
-      # - ./config:/fuseki/configuration
-      - data:/fuseki/databases
-    # environment:
-    #   - FUSEKI_HOME=/fuseki
-    #   - FUSEKI_BASE=/fuseki/databases
-    env_file:
-      - ../data/secrets/fuseki.env
-    networks:
-      - caddy
-    deploy:
-      replicas: 1
-      placement:
-        constraints:
-          - node.role == manager
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.fuseki.rule: Host(`fuseki.marcpartensky.com`)
-        traefik.http.services.fuseki.loadbalancer.server.port: 3030
-
-networks:
-  caddy:
-    external: true
-
-volumes:
-  data:

services/gitea-postgres.yml

@@ -0,0 +1,19 @@
+version: "3.9"
+
+services:
+  gitea_postgres:
+    image: postgres
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/gitea.env
+    networks:
+      - caddy
+      - gitea
+    volumes:
+      - gitea_postgres:/var/lib/postgresql/data
+
+volumes:
+  gitea_postgres:
+
+networks:
+  gitea:

services/gitea.yml

@@ -31,9 +31,9 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.gitea.rule: >
-          Host(`git.marcpartensky.com`) ||
-          Host(`git.marcpartensky.fr`)
+        # traefik.http.routers.gitea.rule: >
+        #   Host(`git.marcpartensky.com`) || Host(`git.marcpartensky.fr`)
+        traefik.http.routers.gitea.rule: Host(`git.marcpartensky.fr`)
         traefik.http.routers.gitea.entrypoints: websecure
         # traefik.http.routers.gitea.tls.certresolver: tls
         traefik.http.routers.gitea.tls.certresolver: cloudflare

services/gpg.yml

@@ -1,7 +0,0 @@
-version: "3.9"
-services:
-  gpg:
-    image: marcpartensky/gpg
-    volumes:
-      - /srv:/srv
-      - ../data/gpg:/root/keys

services/grafana.yml

@@ -1,38 +0,0 @@
-version: "3.9"
-services:
-  grafana:
-    image: grafana/grafana
-    restart: unless-stopped
-    env_file:
-      - ../data/secrets/grafana.env
-    # environment:
-      # GF_INSTALL_PLUGINS: grafana-ldap-auth
-    volumes:
-      - ../data/grafana:/etc/grafana
-      - grafana:/var/lib/grafana
-    networks:
-      - caddy
-      - postgres
-      - ldap
-    deploy:
-      labels:
-        caddy: grafana.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams 3000}}"
-        traefik.enable: "true"
-        traefik.http.routers.grafana.rule: >
-          Host(`grafana.marcpartensky.fr`) ||
-          Host(`grafana.marcpartensky.com`)
-        traefik.http.routers.grafana.entrypoints: websecure
-        traefik.http.routers.grafana.tls.certresolver: tls
-        traefik.http.services.grafana.loadbalancer.server.port: 3000
-
-volumes:
-  grafana:
-
-networks:
-  ldap:
-    external: true
-  postgres:
-    external: true
-  caddy:
-    external: true

services/homer.yml

@@ -15,9 +15,7 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.homer.rule: >
-          Host(`homer.marcpartensky.com`) ||
-          Host(`homer.marcpartensky.fr`)
+        traefik.http.routers.homer.rule: Host(`homer.marcpartensky.com`)
         traefik.http.routers.homer.entrypoints: websecure
         traefik.http.routers.homer.tls.certresolver: tls
         traefik.http.services.homer.loadbalancer.server.port: 8080

services/hydra.yml

@@ -1,12 +1,10 @@
 version: "3.9"
 services:
   hydra:
-    image: marcpartensky/hydra:latest
-    network_mode: host
-    env_file:
-      - ../data/secrets/hydra.env
-    # command: -P /rockyou.txt -L /usernames.txt ssh://192.168.252.18
-    # workdir: /root
+    image: marcpartensky/hydra
+    network: host
+    command: -P /rockyou.txt -L /usernames.txt ssh://192.168.252.84
+    workdir: /root
     volumes:
       - ../data/hydra/rockyou.txt:/rockyou.txt
       - ../data/hydra/usernames.txt:/usernames.txt

services/ipfs.yml

@@ -9,7 +9,6 @@ services:
       TZ: Europe/Paris
     volumes:
       - ipfs:/config
-      - /srv/:/srv
     networks:
       - caddy
     ports:
@@ -29,9 +28,8 @@ services:
       labels:
         traefik.enable: "true"
         # traefik.http.routers.ipfs.rule: Host(`ipfs.marcpartensky.com`)
-        traefik.http.routers.ipfs.rule: Host(`ipfs.marcpartensky.fr`)
-        # traefik.http.routers.ipfs.rule: >
-        #   Host(`ipfs.marcpartensky.com`) || Host(`ipfs.marcpartensky.fr`)
+        traefik.http.routers.ipfs.rule: >
+          Host(`ipfs.marcpartensky.com`) || Host(`ipfs.marcpartensky.fr`)
         # traefik.http.routers.ipfs.entrypoints: websecure
         # traefik.http.routers.ipfs.tls.certresolver: tls
         traefik.http.routers.ipfs.tls.certresolver: cloudflare
@@ -45,7 +43,7 @@ services:
         # traefik.http.middlewares.add-context.redirectregex.regex: ^https:\\/\\/([^\\/]+)\\/?$$
         # traefik.http.middlewares.add-context.redirectregex.replacement: https://$$1/webui
         #
-        traefik.http.routers.ipfs.middlewares: custom_repath
+        traefik.http.routers.service_nextcloud.middlewares: custom_repath
         traefik.http.middlewares.custom_repath.replacepathregex.regex: ^/$$
         traefik.http.middlewares.custom_repath.replacepathregex.replacement: /webui
           

services/jellyfin.yml

@@ -26,9 +26,8 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.jellyfin.rule: >
-          Host(`jellyfin.marcpartensky.fr`) ||
-          Host(`jellyfin.marcpartensky.com`)
+        # traefik.http.routers.jellyfin.rule: Host(`jellyfin.marcpartensky.com`)
+        traefik.http.routers.jellyfin.rule: Host(`jellyfin.marcpartensky.fr`)
         traefik.http.routers.jellyfin.entrypoints: websecure
         traefik.http.routers.jellyfin.tls.certresolver: tls
         traefik.http.services.jellyfin.loadbalancer.server.port: 8096

services/jupyterhub.yml

@@ -9,15 +9,12 @@ services:
       - ../data/jupyterhub/jupyterhub_config.py:/srv/jupyterhub/jupyterhub_config.py
       # - jupyterhub:/srv/jupyterhub
     networks:
-      - ldap
-      - caddy
-      - jupyterhub
+    - caddy
+    - jupyterhub
     environment:
-      # DOCKER_IMAGE: marcpartensky/jupyterlab
-      DOCKER_IMAGE: jupyterhub/singleuser
-      DOCKER_NETWORK_NAME: caddy
+      DOCKER_JUPYTER_IMAGE: marcpartensky/jupyterlab
+      DOCKER_NETWORK_NAME: jupyterhub
       HUB_IP: jupyterhub
-      DOCKER_HOST: unix:///var/run/docker.sock
     labels:
       caddy: jupyterhub.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 8000}}"
@@ -26,12 +23,10 @@ services:
       traefik.http.routers.jupyterhub.entrypoints: websecure
       traefik.http.routers.jupyterhub.tls.certresolver: tls
       traefik.http.services.jupyterhub.loadbalancer.server.port: 8000
-      # traefik.docker.network: jupyterhub_default
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.jupyterhub.rule: Host(`jupyterhub.marcpartensky.com`)
-        traefik.http.routers.jupyterhub.rule: Host(`hub.marcpartensky.fr`)
+        traefik.http.routers.jupyterhub.rule: Host(`jupyterhub.marcpartensky.com`)
         traefik.http.routers.jupyterhub.entrypoints: websecure
         traefik.http.routers.jupyterhub.tls.certresolver: tls
         traefik.http.services.jupyterhub.loadbalancer.server.port: 8000
@@ -42,5 +37,3 @@ networks:
     driver: overlay
   caddy:
     external: true
-  ldap:
-    external: true

services/jupyterlab.yml

@@ -2,41 +2,25 @@ version: "3.9"
 
 services:
   jupyterlab:
-    # image: jupyter/datascience-notebook:latest
-    image: marcpartensky/jupyterlab
-    # restart: unless-stopped
+    image: jupyter/datascience-notebook:latest
+    restart: unless-stopped
     environment:
     #   - GEN_CERT=yes
       JUPYTER_ENABLE_LAB: "yes"
       GRANT_SUDO: "yes"
-      JUPYTER_CONFIG_DIR: /home/jupyter/.jupyter
-    # entrypoint: python -m jupyter lab
     # entrypoint: start.sh jupyter lab --user root
     networks:
       - caddy
-    # labels:
-    #   caddy: lab.marcpartensky.com
-    #   caddy.reverse_proxy: "{{upstreams 8888}}"
-    #   traefik.enable: "true"
-    #   traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.com`)
-    #   traefik.http.routers.jupyterlab.entrypoints: websecure
-    #   traefik.http.routers.jupyterlab.tls.certresolver: tls
-    #   traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
-    # volumes:
-      # - jupyterlab:/home/jupyter
-      # - ../data/jupyterlab/:/home/jupyter/.jupyter/
-    deploy:
-      placement:
-        constraints:
-          - node.role == manager
-      labels:
-        traefik.enable: "true"
-        # traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.fr`)
-        traefik.http.routers.jupyterlab.rule: >
-          Host(`lab.marcpartensky.fr`) && Host(`lab.marcpartensky.com`)
-        traefik.http.routers.jupyterlab.entrypoints: websecure
-        traefik.http.routers.jupyterlab.tls.certresolver: cloudflare
-        traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
+    labels:
+      caddy: lab.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 8888}}"
+      traefik.enable: "true"
+      traefik.http.routers.jupyterlab.rule: Host(`lab.marcpartensky.com`)
+      traefik.http.routers.jupyterlab.entrypoints: websecure
+      traefik.http.routers.jupyterlab.tls.certresolver: tls
+      traefik.http.services.jupyterlab.loadbalancer.server.port: 8888
+    volumes:
+      - jupyterlab:/home/jovyan
 # entrypoint: start-notebook.sh \
     #     --NotebookApp.keyfile=key/0000_key-certbot.pem
     #     --NotebookApp.certfile=cert/0000_csr-certbot.pem

services/ldap.yml

@@ -20,13 +20,6 @@ services:
       - ldap:/var/lib/ldap
       - ldap_slapd:/etc/ldap/slapd.d
 
-
-  backup:
-    image: osixia/openldap-backup:1.5.0
-    environment:
-      LDAP_BACKUP_CONFIG_CRON_EXP: "0 5 * * *"
-      LDAP_BACKUP_DATA_CRON_EXP: "0 5 * * *"
-
 volumes:
   ldap:
   ldap_slapd:

services/matrix.yml

@@ -14,8 +14,7 @@ services:
       - ../data/matrix:/data
       # - matrix:/data
     networks:
-      - caddy
-      - postgres
+        - caddy
     healthcheck:
       test: ["CMD", "curl", "-fSs", "http://localhost:8008/health"]
       interval: 15s
@@ -40,7 +39,5 @@ services:
         traefik.http.services.matrix.loadbalancer.server.port: 8008
 
 networks:
-  postgres:
-    external: true
   caddy:
     external: true

services/mc-backup.yml

@@ -1,7 +1,7 @@
 version: "3.9"
 
 services:
-  backup:
+  backups:
     image: itzg/mc-backup
     environment:
       BACKUP_INTERVAL: "1d"
@@ -9,7 +9,7 @@ services:
       SERVE_PORT: 25565
       RCON_HOST: minecraft
       RCON_PORT: 25575
-      PAUSE_IF_NO_PLAYER: "true"
+      PAUSE_IF_NO_PLAYER: true
       PLAYERS_ONLINE_CHECK_INTERVAL: 1h
       TZ: Europe/Paris
       DEST_DIR: /backups
@@ -18,6 +18,6 @@ services:
     - /srv/minecraft/champi:/data:ro
     # use a host attached directory so that it in turn can be backed up
     # to external/cloud storage
-    - /srv/mcbackups:/backups
+    - ./mc-backups:/backups
     # share network namespace with server to simplify rcon access
     # network_mode: "service:mc"

services/mcmyadmin.yml

@@ -20,18 +20,17 @@ services:
       caddy.reverse_proxy: "{{upstreams 8080}}"
       authorize.with: marc
       traefik.enable: "true"
-      traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.com`)
-      traefik.http.routers.mcmyadmin.entrypoints: websecure
-      traefik.http.routers.mcmyadmin.tls.certresolver: tls
-      traefik.http.services.mcmyadmin.loadbalancer.server.port: 8080
+      traefik.http.routers.minecraft.rule: Host(`mcadmin.marcpartensky.com`)
+      traefik.http.routers.minecraft.entrypoints: websecure
+      traefik.http.routers.minecraft.tls.certresolver: tls
+      traefik.http.services.minecraft.loadbalancer.server.port: 8080
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.com`)
-        traefik.http.routers.mcmyadmin.rule: Host(`mcmyadmin.marcpartensky.fr`)
-        traefik.http.routers.mcmyadmin.entrypoints: websecure
-        traefik.http.routers.mcmyadmin.tls.certresolver: tls
-        traefik.http.services.mcmyadmin.loadbalancer.server.port: 8080
+        traefik.http.routers.minecraft.rule: Host(`mcadmin.marcpartensky.com`)
+        traefik.http.routers.minecraft.entrypoints: websecure
+        traefik.http.routers.minecraft.tls.certresolver: tls
+        traefik.http.services.minecraft.loadbalancer.server.port: 8080
 
 volumes:
   mcmyadmin:

services/minecraft_champi.yml

@@ -1,7 +1,7 @@
 version: "3.9"
 
 services:
-  server:
+  minecraft_champi:
     image: itzg/minecraft-server
     restart: unless-stopped
     environment:
@@ -29,29 +29,6 @@ services:
     networks:
       - minecraft
 
-  backup:
-    image: itzg/mc-backup
-    environment:
-      BACKUP_INTERVAL: "1d"
-      # instead of network_mode below, could declare RCON_HOST
-      SERVE_PORT: 25565
-      RCON_HOST: server
-      RCON_PORT: 25575
-      PAUSE_IF_NO_PLAYER: "true"
-      PLAYERS_ONLINE_CHECK_INTERVAL: 1h
-      TZ: Europe/Paris
-      DEST_DIR: /backups
-    networks:
-      - minecraft
-    volumes:
-    # mount the same volume used by server, but read-only
-    - /srv/minecraft/champi:/data:ro
-    # use a host attached directory so that it in turn can be backed up
-    # to external/cloud storage
-    - /srv/mcbackups:/backups
-    # share network namespace with server to simplify rcon access
-    # network_mode: "service:mc"
-
 # volumes:
 #   minecraft:
 

services/minidlna.yml

@@ -1,33 +0,0 @@
-version: "3.9"
-services:
-  minidlna:
-    image: geekduck/minidlna
-    volumes:
-      - music:/opt/Music
-      - videos:/opt/Videos
-      - pictures:/opt/Pictures
-      - db:/var/cache/minidlna
-      # - ../data/minidlna/minidlna.conf:/etc/minidlna.conf
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.minidlna.loadbalancer.server.port: 8200
-        traefik.http.routers.minidlna.rule: Host(`minidlna.marcpartensky.fr`)
-        # traefik.http.routers.minidlna.rule: >
-        #   Host(`minidlna.marcpartensky.com`) || Host(`minidlna.marcpartensky.fr`)
-        traefik.http.routers.minidlna.entrypoints: websecure
-        # traefik.http.routers.minidlna.tls.certresolver: tls
-        traefik.http.routers.minidlna.tls.certresolver: cloudflare
-        # traefik.http.routers.minidlna.middlewares: ldap_auth
-
-volumes:
-  music:
-  videos:
-  pictures:
-  db:
-
-networks:
-  caddy:
-    external: true

services/mongo.yml

@@ -5,8 +5,6 @@ services:
     image: mongo
     restart: unless-stopped
     volumes:
-      - ../data/mongo/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
-      - ../data/mongo/config:/etc/mongo
       - mongo:/data/db
     networks:
       - mongo
@@ -41,10 +39,7 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
-        traefik.http.routers.mongo.rule: >
-          Host(`mongo.marcpartensky.fr`) ||
-          Host(`mongo.marcpartensky.com`)
+        traefik.http.routers.mongo.rule: Host(`mongo.marcpartensky.com`)
         traefik.http.routers.mongo.entrypoints: websecure
         traefik.http.routers.mongo.tls.certresolver: tls
         traefik.http.services.mongo.loadbalancer.server.port: 8081

services/nextcloud.yml

@@ -16,16 +16,22 @@ services:
       - caddy
       - postgres
       - ldap
+      - nextcloud
         # depends_on:
         #   - nextcloud_mariadb
+    labels:
+      caddy: cloud.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams http 80}}"
+      traefik.enable: "true"
+      traefik.http.routers.nextcloud.rule: Host(`cloud.marcpartensky.com`)
+      traefik.http.routers.nextcloud.entrypoints: websecure
+      traefik.http.routers.nextcloud.tls.certresolver: tls
+      traefik.http.services.nextcloud.loadbalancer.server.port: 80
     deploy:
       labels:
-        caddy: cloud.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams http 80}}"
         traefik.enable: "true"
         traefik.http.routers.nextcloud.rule: >
-          Host(`cloud.marcpartensky.com`) ||
-          Host(`cloud.marcpartensky.fr`)
+          Host(`cloud.marcpartensky.com`) && Host(`cloud.marcpartensky.fr`)
         traefik.http.routers.nextcloud.entrypoints: websecure
         traefik.http.routers.nextcloud.tls.certresolver: tls
         traefik.http.services.nextcloud.loadbalancer.server.port: 80
@@ -37,6 +43,7 @@ volumes:
   apps:
 
 networks:
+  nextcloud:
   ldap:
     external: true
   caddy:

services/numeris.yml

@@ -7,14 +7,14 @@ services:
     env_file:
       - ../data/secrets/numeris.env
     links:
-      - mysql:db
+      - numeris:db
     networks:
       - caddy
       - numeris
     deploy:
       labels:
         traefik.enable: "true"
-        traefik.http.routers.phpmyadmin.rule: Host(`phpmyadmin.numeris.marcpartensky.fr`)
+        traefik.http.routers.phpmyadmin.rule: Host(`phpmyadmin.numeris.marcpartensky.com`)
         traefik.http.routers.phpmyadmin.entrypoints: websecure
         traefik.http.routers.phpmyadmin.tls.certresolver: tls
         traefik.http.services.phpmyadmin.loadbalancer.server.port: 80
@@ -42,8 +42,7 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
-        traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.fr`)
+        traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
         traefik.http.routers.back.entrypoints: websecure
         traefik.http.routers.back.tls.certresolver: tls
         traefik.http.services.back.loadbalancer.server.port: 80
@@ -55,40 +54,7 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
-        traefik.http.routers.front.rule: Host(`numeris.marcpartensky.fr`)
-        traefik.http.routers.front.entrypoints: websecure
-        traefik.http.routers.front.tls.certresolver: tls
-        traefik.http.services.front.loadbalancer.server.port: 80
-        traefik.http.routers.front.middlewares: ldap_auth
-
-  back-staging:
-    image: numerisisep/numeris-back:staging
-    networks:
-      - caddy
-      - numeris
-    env_file:
-      - ../data/secrets/numeris.env
-    # volumes:
-    #   - .env:/home/numeris/.env
-    deploy:
-      labels:
-        traefik.enable: "true"
-        # traefik.http.routers.back.rule: Host(`api.numeris.marcpartensky.com`)
-        traefik.http.routers.back.rule: Host(`staging.api.numeris.marcpartensky.fr`)
-        traefik.http.routers.back.entrypoints: websecure
-        traefik.http.routers.back.tls.certresolver: tls
-        traefik.http.services.back.loadbalancer.server.port: 80
-
-  front-staging:
-    image: numerisisep/numeris-front:staging
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        # traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
-        traefik.http.routers.front.rule: Host(`staging.numeris.marcpartensky.fr`)
+        traefik.http.routers.front.rule: Host(`numeris.marcpartensky.com`)
         traefik.http.routers.front.entrypoints: websecure
         traefik.http.routers.front.tls.certresolver: tls
         traefik.http.services.front.loadbalancer.server.port: 80

services/pandoc.yml

@@ -9,13 +9,18 @@ services:
       - ../data/secrets/pandoc.env
     volumes:
       - pandoc:/app/files
+    labels:
+      caddy: pandoc.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 80}}"
+      traefik.enable: "true"
+      traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
+      traefik.http.routers.pandoc.entrypoints: websecure
+      traefik.http.routers.pandoc.tls.certresolver: tls
+      traefik.http.services.pandoc.loadbalancer.server.port: 80
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
-        traefik.http.routers.pandoc.rule: >
-          Host(`pandoc.marcpartensky.com`) ||
-          Host(`pandoc.marcpartensky.fr`)
+        traefik.http.routers.pandoc.rule: Host(`pandoc.marcpartensky.com`)
         traefik.http.routers.pandoc.entrypoints: websecure
         traefik.http.routers.pandoc.tls.certresolver: tls
         traefik.http.services.pandoc.loadbalancer.server.port: 80

services/peertube.yml

@@ -1,28 +1,25 @@
-version: "3.9"
+version: "3.3"
 
 services:
 
   peertube:
     image: chocobozzz/peertube:production-bullseye
     restart: unless-stopped
+    networks:
+      - caddy
     env_file:
       - ../data/secrets/peertube.env
     ports:
      - "1935:1935" # If you don't want to use the live feature, you can comment this line
     #  - "9000:9000" # If you provide your own webserver and reverse-proxy, otherwise not suitable for production
     volumes:
-      - assets:/app/client/dist
-      - data:/data
+      - peertube_assets:/app/client/dist
+      - peertube:/data
       - ../data/peertube:/config
-    networks:
-      - peertube
-      - caddy
-      - postgres
-      - redis
-    # depends_on:
-    #   - peertube_postgres
-    #   - peertube_redis
-    #   - peertube_postfix
+    depends_on:
+      - peertube_postgres
+      - peertube_redis
+      - peertube_postfix
     labels:
       caddy: peertube.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 80}}"
@@ -31,49 +28,36 @@ services:
       traefik.http.routers.peertube.entrypoints: websecure
       traefik.http.routers.peertube.tls.certresolver: tls
       traefik.http.services.peertube.loadbalancer.server.port: 80
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.peertube.rule: Host(`peertube.marcpartensky.fr`)
-        traefik.http.routers.peertube.entrypoints: websecure
-        traefik.http.routers.peertube.tls.certresolver: tls
-        traefik.http.services.peertube.loadbalancer.server.port: 80
 
-  # peertube_postgres:
-  #   image: postgres:13-alpine
-  #   restart: unless-stopped
-  #   env_file:
-  #     - ../data/secrets/peertube.env
-  #   volumes:
-  #     - peertube_postgres:/var/lib/postgresql/data
+  peertube_postgres:
+    image: postgres:13-alpine
+    restart: unless-stopped
+    env_file:
+      - ../data/secrets/peertube.env
+    volumes:
+      - peertube_postgres:/var/lib/postgresql/data
 
-  # peertube_redis:
-  #   image: redis:6-alpine
-  #   restart: unless-stopped
-  #   volumes:
-  #     - peertube_redis:/data
+  peertube_redis:
+    image: redis:6-alpine
+    restart: unless-stopped
+    volumes:
+      - peertube_redis:/data
 
-  # postfix:
-  #   image: mwader/postfix-relay
-  #   restart: unless-stopped
-  #   networks:
-  #     - peertube
-  #   env_file:
-  #     - .env
-  #   volumes:
-  #     - postfix:/etc/opendkim/keys
+  peertube_postfix:
+    image: mwader/postfix-relay
+    restart: unless-stopped
+    env_file:
+      - .env
+    volumes:
+      - peertube_postfix:/etc/opendkim/keys
 
 networks:
-  peertube:
-  postgres:
-    external: true
-  redis:
-    external: true
   caddy:
     external: true
 
 volumes:
-  data:
-  assets:
-  postgres:
-  postfix:
+  peertube:
+  peertube_assets:
+  peertube_postgres:
+  peertube_redis:
+  peertube_postfix:

services/pg-backup.yml

@@ -1,16 +0,0 @@
-version: "3.9"
-services:
-  pg_backup:
-    image: kartoza/pg-backup:14-3.1
-    env_file:
-      - ../data/secrets/pg_backup.env
-    # environment:
-    #   POSTGRES_MAJOR_VERSION: 14
-    networks:
-      - postgres
-    volumes:
-      - /srv/pg-backup:/backups
-
-networks:
-  postgres:
-    external: true

services/pgadmin.yml

@@ -30,8 +30,7 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.com`)
-        traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.fr`)
+        traefik.http.routers.pgadmin.rule: Host(`pgadmin.marcpartensky.com`)
         traefik.http.routers.pgadmin.entrypoints: websecure
         traefik.http.routers.pgadmin.tls.certresolver: tls
         traefik.http.services.pgadmin.loadbalancer.server.port: 80

services/portainer.yml

@@ -1,85 +1,44 @@
 version: "3.9"
 
 services:
-  agent:
-    image: portainer/agent:2.18.2
+  portainer:
+    image: portainer/portainer-ce
+    restart: unless-stopped
+    environment:
+      VIRTUAL_HOST: docker.marcpartensky.com
+      VIRTUAL_PORT: 9000
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - /var/lib/docker/volumes:/var/lib/docker/volumes
-    networks:
-      - portainer
-    # deploy:
-      # mode: global
-      # placement:
-      #   constraints: [node.platform.os == linux]
-
-  portainer:
-    image: portainer/portainer-ce:2.18.2
-    command: -H tcp://agent:9001 --tlsskipverify
-    # ports:
-    #   - "9443:9443"
-    #   - "9000:9000"
-    #   - "8000:8000"
+      - portainer:/data
     networks:
       - caddy
-      - portainer
-    volumes:
-      - data:/data
+    command:
+      - --logo
+      - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
+        # healthcheck:
+        # test: ["CMD", "curl", "-f", "http://localhost:9000"]
+        # test: ["CMD", "portainer", "--healthcheck"]
+    depends_on:
+      - caddy
+    labels:
+      caddy: docker.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams 9000}}"
+      traefik.enable: "true"
+      traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
+      traefik.http.routers.portainer.entrypoints: websecure
+      traefik.http.routers.portainer.tls.certresolver: tls
+      traefik.http.services.portainer.loadbalancer.server.port: 9000
     deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints: [node.role == manager]
       labels:
         traefik.enable: "true"
-        traefik.http.routers.portainer.rule: >
-          Host(`docker.marcpartensky.fr`) && Host(`docker.marcpartensky.com`)
+        traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
         traefik.http.routers.portainer.entrypoints: websecure
-        # traefik.http.routers.portainer.tls.certresolver: tls
-        traefik.http.routers.portainer.tls.certresolver: cloudflare
+        traefik.http.routers.portainer.tls.certresolver: tls
         traefik.http.services.portainer.loadbalancer.server.port: 9000
 
-  # portainer:
-  #   image: portainer/portainer-ce
-  #   restart: unless-stopped
-  #   # environment:
-  #   #   VIRTUAL_HOST: docker.marcpartensky.com
-  #   #   VIRTUAL_PORT: 9000
-  #   volumes:
-  #     - /var/run/docker.sock:/var/run/docker.sock
-  #     - portainer:/data
-  #   networks:
-  #     - caddy
-  #   command:
-  #     - --logo
-  #     - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
-  #       # healthcheck:
-  #       # test: ["CMD", "curl", "-f", "http://localhost:9000"]
-  #       # test: ["CMD", "portainer", "--healthcheck"]
-  #   depends_on:
-  #     - caddy
-  #   labels:
-  #     caddy: docker.marcpartensky.com
-  #     caddy.reverse_proxy: "{{upstreams 9000}}"
-  #     traefik.enable: "true"
-  #     traefik.http.routers.portainer.rule: Host(`docker.marcpartensky.com`)
-  #     traefik.http.routers.portainer.entrypoints: websecure
-  #     traefik.http.routers.portainer.tls.certresolver: tls
-  #     traefik.http.services.portainer.loadbalancer.server.port: 9000
-  #   deploy:
-  #     labels:
-  #       traefik.enable: "true"
-  #       traefik.http.routers.portainer.rule: >
-  #         Host(`docker.marcpartensky.fr`) && Host(`docker.marcpartensky.com`)
-  #       traefik.http.routers.portainer.entrypoints: websecure
-  #       traefik.http.routers.portainer.tls.certresolver: tls
-  #       traefik.http.services.portainer.loadbalancer.server.port: 9000
-  #
 volumes:
-  # portainer:
-  data:
+  portainer:
 
 networks:
-  portainer:
   caddy:
     external: true

services/postgres.yml

@@ -4,15 +4,14 @@ services:
     image: postgres:14
     restart: unless-stopped
     # user: postgres:postgres
-    # user: "966:966"
-    user: 1000:1000
+    # user: "974:974"
     ports:
       - target: 5432
         published: 5432
         mode: host
     volumes:
       - ../data/postgres:/docker-entrypoint-initdb.d
-      - /home/marc/srv/postgres:/var/lib/postgresql/data
+      - postgres:/var/lib/postgresql/data
       - ../data/postgres/server.crt:/var/lib/postgresql/server.crt
       - ../data/postgres/server.key:/var/lib/postgresql/server.key
     env_file:
@@ -24,22 +23,8 @@ services:
       -c ssl=on
       -c ssl_cert_file=/var/lib/postgresql/server.crt
       -c ssl_key_file=/var/lib/postgresql/server.key
-    # networks:
-    #   - postgres
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -q || exit 1"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-
-  backup:
-    image: kartoza/pg-backup:14-3.1
-    env_file:
-      - ../data/secrets/pg_backup.env
-    # networks:
-    #   - postgres
-    volumes:
-      - /srv/pg-backup:/backups
+    networks:
+      - postgres
 
   pgbackups:
     image: prodrigestivill/postgres-backup-local
@@ -47,18 +32,18 @@ services:
     # user: postgres:postgres
     volumes:
       - /srv/pgbackups:/backups
-    # links:
-    #   - postgres
-    # depends_on:
-    #   - postgres
-    # networks:
-    #   - postgres
+    links:
+      - postgres
+    depends_on:
+      - postgres
+    networks:
+      - postgres
     env_file:
       - ../data/secrets/pgbackups.env
 
 volumes:
   postgres:
 
-# networks:
-#   postgres:
-#     external: true
+networks:
+  postgres:
+    external: true

services/pritunl.yml

@@ -6,12 +6,12 @@ services:
     restart: unless-stopped
     ports:
       - "1194-1195:1194-1195/udp"
-    # depends_on:
-    #     - pritunl_mongo
+    depends_on:
+        - pritunl_mongo
     environment:
       REVERSE_PROXY: "true"
       TZ: Europe/Paris
-      MONGODB_URI: mongodb://mongo:27017/pritunl
+      MONGODB_URI: mongodb://pritunl_mongo:27017/pritunl
       PRITUNL_DEBUG: "true"
       # WIREGUARD: true
     privileged: true
@@ -26,17 +26,20 @@ services:
     # volumes:
     #   - /etc/localtime:/etc/localtime:ro
     networks:
-      - mongo
       - caddy
       - pritunl
+    labels:
+      caddy: vpn.marcpartensky.com
+      caddy.reverse_proxy: "{{upstreams http 9700}}"
+      traefik.enable: "true"
+      traefik.http.routers.pritunl.rule: Host(`vpn.marcpartensky.com`)
+      traefik.http.routers.pritunl.entrypoints: websecure
+      traefik.http.routers.pritunl.tls.certresolver: tls
+      traefik.http.services.pritunl.loadbalancer.server.port: 9700
     deploy:
       labels:
-        caddy: vpn.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams http 9700}}"
         traefik.enable: "true"
-        traefik.http.routers.pritunl.rule: >
-          Host(`vpn.marcpartensky.fr`) ||
-          Host(`vpn.marcpartensky.com`)
+        traefik.http.routers.pritunl.rule: Host(`vpn.marcpartensky.com`)
         traefik.http.routers.pritunl.entrypoints: websecure
         traefik.http.routers.pritunl.tls.certresolver: tls
         traefik.http.services.pritunl.loadbalancer.server.port: 9700
@@ -44,13 +47,9 @@ services:
 networks:
   caddy:
     external: true
-  mongo:
-    external: true
   pritunl:
-    external: true
     # internal: true
     # driver: bridge
-    # ipam:
-    #   config:
-        # - subnet: 172.177.0.0/16
-        # - subnet: 10.177.0.0/16
+    ipam:
+      config:
+        - subnet: 172.177.0.0/16

services/prometheus.yml

@@ -1,51 +0,0 @@
-version: "3.9"
-
-services:
-  prometheus:
-    image: prom/prometheus
-    volumes:
-      - ../data/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
-    command:
-      - --config.file=/etc/prometheus/prometheus.yml
-    networks:
-      - prometheus
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.prometheus.rule: >
-          Host(`prometheus.marcpartensky.com`) || Host(`prometheus.marcpartensky.fr`)
-        traefik.http.routers.prometheus.entrypoints: websecure
-        traefik.http.routers.prometheus.tls.certresolver: tls
-        traefik.http.services.prometheus.loadbalancer.server.port: 9090
-
-  node-exporter:
-    image: prom/node-exporter
-    volumes:
-      - /proc:/host/proc:ro
-      - /sys:/host/sys:ro
-      - /:/rootfs:ro
-    command:
-      - --path.procfs=/host/proc
-      - --path.sysfs=/host/sys
-      - --collector.filesystem.ignored-mount-points=\"^/(sys|proc|dev|host|etc)($$|/)\"
-    networks:
-      - prometheus
-
-  # cadvisor:
-  #   image: google/cadvisor
-  #   volumes:
-  #     - /:/rootfs:ro
-  #     - /var/run:/var/run:rw
-  #     - /sys:/sys:ro
-  #     - /var/lib/docker:/var/lib/docker:ro
-  #   ports:
-  #     - "8080:8080"
-  #   networks:
-  #     - prometheus
-  #
-networks:
-  prometheus:
-  caddy:
-    external: true
-

services/pufferpannel.yml

@@ -1,28 +0,0 @@
-version: "3.9"
-services:
-  puffer:
-    image: pufferpanel/pufferpanel
-    networks:
-      - caddy
-    volumes:
-      - ../data/pufferpanel:/etc/pufferpanel
-      - pufferpanel:/var/lib/pufferpanel
-      - /var/run/docker.sock:/var/run/docker.sock
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.puffer.loadbalancer.server.port: 8080
-        traefik.http.routers.puffer.rule: Host(`puffer.marcpartensky.fr`)
-        # traefik.http.routers.puffer.rule: >
-        #   Host(`puffer.marcpartensky.com`) || Host(`puffer.marcpartensky.fr`)
-        traefik.http.routers.puffer.entrypoints: websecure
-        # traefik.http.routers.puffer.tls.certresolver: tls
-        traefik.http.routers.puffer.tls.certresolver: cloudflare
-        # traefik.http.routers.puffer.middlewares: ldap_auth
-
-volumes:
-  pufferpanel:
-
-networks:
-  caddy:
-    external: true

services/redis.yml

@@ -1,22 +0,0 @@
-version: "3.9"
-services:
-  redis:
-    image: redis:alpine
-    command: redis-server --save 60 1 --loglevel warning
-    ports:
-      - "6379:6379"
-    networks:
-      - redis
-    volumes:
-      - ../data/redis:/usr/local/etc/redis
-      - /srv/redis:/data
-    healthcheck:
-       test: ["CMD", "redis-cli","ping"]
-    # deploy:
-    #   placement:
-    #     constraints:
-    #       - node.role == manager
-
-networks:
-  redis:
-    external: true

services/resume.yml

@@ -1,54 +0,0 @@
-version: "3.9"
-
-services:
-  server:
-    image: amruthpillai/reactive-resume:server-latest
-    restart: unless-stopped
-    env_file:
-      - ../data/secrets/resume.env
-    networks:
-      - caddy
-      - postgres
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.server.loadbalancer.server.port: 3100
-        traefik.http.routers.server.rule: Host(`api.cv.marcpartensky.fr`)
-        # traefik.http.routers.server.rule: "Host(`cv.marcpartensky.fr`) && PathPrefix(`/api`)"
-        # traefik.http.routers.server.rule: >
-        #   Host(`cv.marcpartensky.com`) &&
-        #   PathPrefix(`/api`) ||
-        #   Host(`cv.marcpartensky.fr`) &&
-        #   PathPrefix(`/api`)
-        traefik.http.routers.server.entrypoints: websecure
-        # traefik.http.routers.server.tls.certresolver: cloudflare
-        traefik.http.routers.server.tls.certresolver: tls
-
-  client:
-    image: amruthpillai/reactive-resume:client-latest
-    restart: unless-stopped
-    env_file:
-     - ../data/secrets/resume.env
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.client.loadbalancer.server.port: 3000
-        # traefik.http.routers.client.rule: Host(`cv.marcpartensky.fr`)
-        traefik.http.routers.client.rule: >
-          Host(`cv.marcpartensky.fr`)
-          # Host(`cv.marcpartensky.com`) &&
-          # Path(`/`) ||
-          # Host(`cv.marcpartensky.fr`) &&
-          # Path(`/`)
-        traefik.http.routers.client.entrypoints: websecure
-        # traefik.http.routers.client.tls.certresolver: cloudflare
-        traefik.http.routers.server.tls.certresolver: tls
-        # traefik.http.routers.client.middlewares: ldap_auth
-networks:
-  postgres:
-    external: true
-  caddy:
-    external: true
-

services/seafile.yml

@@ -16,6 +16,8 @@ services:
     image: memcached:1.6
     restart: unless-stopped
     entrypoint: memcached -m 256
+    networks:
+      - seafile
     networks:
       seafile:
         aliases:
@@ -35,6 +37,8 @@ services:
     # mem_limit: 2g
     volumes:
       - elasticsearch:/usr/share/elasticsearch/data  # Requested, specifies the path to Elasticsearch data persistent store.
+    networks:
+      - seafile
     networks:
       seafile:
         aliases:

services/serge.yml

@@ -1,25 +0,0 @@
-version: "3"
-
-services:
-  serge:
-    image: ghcr.io/nsarrazin/serge:latest
-    networks:
-      - caddy
-    volumes:
-      - weights:/usr/src/app/weights
-      - data:/data/db/
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.serge.rule: >
-          Host(`serge.marcpartensky.fr`) ||
-          Host(`serge.marcpartensky.com`)
-        traefik.http.routers.serge.entrypoints: websecure
-        traefik.http.services.serge.loadbalancer.server.port: 8008
-
-networks:
-  caddy:
-    external: true
-volumes:
-  data:
-  weights:

services/signoz.yml

@@ -1,248 +0,0 @@
-version: "3.9"
-
-x-clickhouse-defaults: &clickhouse-defaults
-  image: clickhouse/clickhouse-server:22.8.8-alpine
-  tty: true
-  deploy:
-    restart_policy:
-      condition: on-failure
-  depends_on:
-    - zookeeper-1
-    # - zookeeper-2
-    # - zookeeper-3
-  logging:
-    options:
-      max-size: 50m
-      max-file: "3"
-  healthcheck:
-    # "clickhouse", "client", "-u ${CLICKHOUSE_USER}", "--password ${CLICKHOUSE_PASSWORD}", "-q 'SELECT 1'"
-    test: ["CMD", "wget", "--spider", "-q", "localhost:8123/ping"]
-    interval: 30s
-    timeout: 5s
-    retries: 3
-  ulimits:
-    nproc: 65535
-    nofile:
-      soft: 262144
-      hard: 262144
-
-x-clickhouse-depend: &clickhouse-depend
-  depends_on:
-    - clickhouse
-    # - clickhouse-2
-    # - clickhouse-3
-
-services:
-  zookeeper-1:
-    image: bitnami/zookeeper:3.7.0
-    hostname: zookeeper-1
-    user: root
-    ports:
-      - "2181:2181"
-      - "2888:2888"
-      - "3888:3888"
-    volumes:
-      - ./data/zookeeper-1:/bitnami/zookeeper
-    environment:
-      - ZOO_SERVER_ID=1
-      # - ZOO_SERVERS=0.0.0.0:2888:3888,zookeeper-2:2888:3888,zookeeper-3:2888:3888
-      - ALLOW_ANONYMOUS_LOGIN=yes
-      - ZOO_AUTOPURGE_INTERVAL=1
-
-  # zookeeper-2:
-  #   image: bitnami/zookeeper:3.7.0
-  #   hostname: zookeeper-2
-  #   user: root
-  #   ports:
-  #     - "2182:2181"
-  #     - "2889:2888"
-  #     - "3889:3888"
-  #   volumes:
-  #     - ./data/zookeeper-2:/bitnami/zookeeper
-  #   environment:
-  #     - ZOO_SERVER_ID=2
-  #     - ZOO_SERVERS=zookeeper-1:2888:3888,0.0.0.0:2888:3888,zookeeper-3:2888:3888
-  #     - ALLOW_ANONYMOUS_LOGIN=yes
-  #     - ZOO_AUTOPURGE_INTERVAL=1
-
-  # zookeeper-3:
-  #   image: bitnami/zookeeper:3.7.0
-  #   hostname: zookeeper-3
-  #   user: root
-  #   ports:
-  #     - "2183:2181"
-  #     - "2890:2888"
-  #     - "3890:3888"
-  #   volumes:
-  #     - ./data/zookeeper-3:/bitnami/zookeeper
-  #   environment:
-  #     - ZOO_SERVER_ID=3
-  #     - ZOO_SERVERS=zookeeper-1:2888:3888,zookeeper-2:2888:3888,0.0.0.0:2888:3888
-  #     - ALLOW_ANONYMOUS_LOGIN=yes
-  #     - ZOO_AUTOPURGE_INTERVAL=1
-
-  clickhouse:
-    <<: *clickhouse-defaults
-    hostname: clickhouse
-    # ports:
-    #   - "9000:9000"
-    #   - "8123:8123"
-    #   - "9181:9181"
-    volumes:
-      - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
-      - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
-      - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
-      # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
-      - ./data/clickhouse/:/var/lib/clickhouse/
-
-  # clickhouse-2:
-  #   <<: *clickhouse-defaults
-  #   hostname: clickhouse-2
-  #   ports:
-  #     - "9001:9000"
-  #     - "8124:8123"
-  #     - "9182:9181"
-  #   volumes:
-  #     - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
-  #     - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
-  #     - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
-  #     # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
-  #     - ./data/clickhouse-2/:/var/lib/clickhouse/
-
-  # clickhouse-3:
-  #   <<: *clickhouse-defaults
-  #   hostname: clickhouse-3
-  #   ports:
-  #     - "9002:9000"
-  #     - "8125:8123"
-  #     - "9183:9181"
-  #   volumes:
-  #     - ./clickhouse-config.xml:/etc/clickhouse-server/config.xml
-  #     - ./clickhouse-users.xml:/etc/clickhouse-server/users.xml
-  #     - ./clickhouse-cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
-  #     # - ./clickhouse-storage.xml:/etc/clickhouse-server/config.d/storage.xml
-  #     - ./data/clickhouse-3/:/var/lib/clickhouse/
-
-  alertmanager:
-    image: signoz/alertmanager:0.23.0-0.2
-    volumes:
-      - ./data/alertmanager:/data
-    command:
-      - --queryService.url=http://query-service:8085
-      - --storage.path=/data
-    depends_on:
-      - query-service
-    deploy:
-      restart_policy:
-        condition: on-failure
-
-  query-service:
-    image: signoz/query-service:0.17.0
-    command: ["-config=/root/config/prometheus.yml"]
-    # ports:
-    #   - "6060:6060"     # pprof port
-    #   - "8080:8080"     # query-service port
-    volumes:
-      - ./prometheus.yml:/root/config/prometheus.yml
-      - ../dashboards:/root/config/dashboards
-      - ./data/signoz/:/var/lib/signoz/
-    environment:
-      - ClickHouseUrl=tcp://clickhouse:9000/?database=signoz_traces
-      - ALERTMANAGER_API_PREFIX=http://alertmanager:9093/api/
-      - SIGNOZ_LOCAL_DB_PATH=/var/lib/signoz/signoz.db
-      - DASHBOARDS_PATH=/root/config/dashboards
-      - STORAGE=clickhouse
-      - GODEBUG=netdns=go
-      - TELEMETRY_ENABLED=true
-      - DEPLOYMENT_TYPE=docker-swarm
-    healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "localhost:8080/api/v1/health"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    deploy:
-      restart_policy:
-        condition: on-failure
-    <<: *clickhouse-depend
-
-  frontend:
-    image: signoz/frontend:0.17.0
-    deploy:
-      restart_policy:
-        condition: on-failure
-    depends_on:
-      - alertmanager
-      - query-service
-    ports:
-      - "3301:3301"
-    volumes:
-      - ../common/nginx-config.conf:/etc/nginx/conf.d/default.conf
-
-  otel-collector:
-    image: signoz/signoz-otel-collector:0.66.6
-    command: ["--config=/etc/otel-collector-config.yaml"]
-    user: root # required for reading docker container logs
-    volumes:
-      - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml
-      - /var/lib/docker/containers:/var/lib/docker/containers:ro
-    environment:
-      - OTEL_RESOURCE_ATTRIBUTES=host.name={{.Node.Hostname}},os.type={{.Node.Platform.OS}},dockerswarm.service.name={{.Service.Name}},dockerswarm.task.name={{.Task.Name}}
-      - DOCKER_MULTI_NODE_CLUSTER=false
-      - LOW_CARDINAL_EXCEPTION_GROUPING=false
-    ports:
-      # - "1777:1777"     # pprof extension
-      - "4317:4317"     # OTLP gRPC receiver
-      - "4318:4318"     # OTLP HTTP receiver
-      # - "8888:8888"     # OtelCollector internal metrics
-      # - "8889:8889"     # signoz spanmetrics exposed by the agent
-      # - "9411:9411"     # Zipkin port
-      # - "13133:13133"   # Health check extension
-      # - "14250:14250"   # Jaeger gRPC
-      # - "14268:14268"   # Jaeger thrift HTTP
-      # - "55678:55678"   # OpenCensus receiver
-      # - "55679:55679"   # zPages extension
-    deploy:
-      mode: global
-      restart_policy:
-        condition: on-failure
-    <<: *clickhouse-depend
-
-  otel-collector-metrics:
-    image: signoz/signoz-otel-collector:0.66.6
-    command: ["--config=/etc/otel-collector-metrics-config.yaml"]
-    volumes:
-      - ./otel-collector-metrics-config.yaml:/etc/otel-collector-metrics-config.yaml
-    # ports:
-    #   - "1777:1777"     # pprof extension
-    #   - "8888:8888"     # OtelCollector internal metrics
-    #   - "13133:13133"   # Health check extension
-    #   - "55679:55679"   # zPages extension
-    deploy:
-      restart_policy:
-        condition: on-failure
-    <<: *clickhouse-depend
-
-  hotrod:
-    image: jaegertracing/example-hotrod:1.30
-    command: ["all"]
-    environment:
-      - JAEGER_ENDPOINT=http://otel-collector:14268/api/traces
-    logging:
-      options:
-        max-size: 50m
-        max-file: "3"
-
-  load-hotrod:
-    image: "grubykarol/locust:1.2.3-python3.9-alpine3.12"
-    hostname: load-hotrod
-    environment:
-      ATTACKED_HOST: http://hotrod:8080
-      LOCUST_MODE: standalone
-      NO_PROXY: standalone
-      TASK_DELAY_FROM: 5
-      TASK_DELAY_TO: 30
-      QUIET_MODE: "${QUIET_MODE:-false}"
-      LOCUST_OPTS: "--headless -u 10 -r 1"
-    volumes:
-      - ../common/locust-scripts:/locust
-

services/swarm-visualizer.yml

@@ -13,12 +13,9 @@ services:
     deploy:
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.swarm_visualizer.rule: Host(`swarm.marcpartensky.com`)
-        traefik.http.routers.swarm_visualizer.rule: >
-          Host(`swarm.marcpartensky.fr`) && Host(`swarm.marcpartensky.com`)
+        traefik.http.routers.swarm_visualizer.rule: Host(`swarm.marcpartensky.com`)
         traefik.http.routers.swarm_visualizer.entrypoints: websecure
-        # traefik.http.routers.swarm_visualizer.tls.certresolver: tls
-        traefik.http.routers.swarm_visualizer.tls.certresolver: cloudflare
+        traefik.http.routers.swarm_visualizer.tls.certresolver: tls
         traefik.http.services.swarm_visualizer.loadbalancer.server.port: 8080
 
 networks:

services/traefik.yml

@@ -4,8 +4,8 @@ services:
   traefik:
     image: traefik:2.9.1 # https://github.com/wiltonsr/ldapauth/issues/25
     # image: traefik:latest # https://github.com/wiltonsr/ldapauth/issues/25
-    env_file:
-      - ../data/secrets/traefik.env
+    # env_file:
+    #   - ../data/secrets/traefik.env
     # restart: unless-stopped
     # command:
     #   ## Provider Settings - https://docs.traefik.io/providers/docker/#provider-configuration ##
@@ -38,7 +38,8 @@ services:
       - caddy
       - ldap
     volumes:
-      - ../data/traefik:/etc/traefik
+      - ../data/traefik/traefik.yml:/traefik.yml # static configuration
+      - ../data/traefik/dynamic.yml:/dynamic.yml
         # - traefik_letsencrypt:/letsencrypt
       - traefik:/config
       - /var/run/docker.sock:/var/run/docker.sock:ro

services/uptime.yml

@@ -14,7 +14,7 @@ services:
         traefik.http.routers.kuma.rule: >
           Host(`uptime.marcpartensky.com`) || Host(`uptime.marcpartensky.fr`)
         traefik.http.routers.kuma.entrypoints: websecure
-        traefik.http.routers.kuma.tls.certresolver: tls
+        traefik.http.routers.kuma.tls.certresolver: cloudflare
         traefik.http.routers.kuma.middlewares: ldap_auth
 
 networks:

services/vaultwarden.yml

@@ -41,12 +41,16 @@ services:
     #   traefik.http.services.vaultwarden.loadbalancer.server.port: 80
     deploy:
       labels:
+        # traefik.enable: "false"
         traefik.enable: "true"
+        # traefik.http.routers.vaultwarden.rule: >
+        #   Host(`vault.marcpartensky.com`)
         traefik.http.routers.vaultwarden.rule: >
+          Host(`vault.marcpartensky.com`) ||
           Host(`vault.marcpartensky.fr`) ||
-          Host(`vault.marcpartensky.com`)
+          Host(`secret.marcpartensky.fr`)
         traefik.http.routers.vaultwarden.entrypoints: websecure
-        traefik.http.routers.vaultwarden.tls.certresolver: cloudflare
+        traefik.http.routers.vaultwarden.tls.certresolver: tls
         traefik.http.services.vaultwarden.loadbalancer.server.port: 80
 
   # ldap_admin:

services/wallabag.yml

@@ -1,99 +0,0 @@
-version: "3.9"
-services:
-  wallabag:
-    image: wallabag/wallabag
-    volumes:
-      # Volumes for data-related folders
-      - assets:/var/www/html/web/assets
-      - data:/var/www/html/data
-      - cache:/var/www/.cache
-      # Uncomment the following volume if you run rootless Docker
-      # A limitation blocks permissions on root docker, see
-      # https://github.com/moby/moby/issues/40881
-      # - type: tmpfs
-      #   target: /var/www/html/var/cache
-      # Override third-party libraries for dev
-      # - ../graby-site-config:/var/www/html/vendor/j0k3r/graby-site-config
-      # - ../php-readability:/var/www/html/vendor/j0k3r/php-readability
-      # - ../graby:/var/www/html/vendor/j0k3r/graby
-      # - ../HTMLawed:/var/www/html/vendor/fossar/htmlawed
-      # - ../PHPePub:/var/www/html/vendor/wallabag/phpepub
-      # - ../guzzle-site-authenticator:/var/www/html/vendor/bdunogier/guzzle-site-authenticator
-    env_file:
-      # Copy docker/php/env.example to docker/php/env and customize
-      - ../data/secrets/wallabag.env
-      # Uncomment the database engine you want, it will use sqlite if both are commented
-      # - ./docker/mariadb/env
-      # - ./docker/postgres/env
-      # Uncomment to enable Xdebug
-      # - ./docker/php/xdebug
-    # ports:
-      # - 8000:8000
-      # Uncomment to permit Xdebug remote session
-      # - 9000:9000
-    # depends_on:
-      # - mariadb
-      # - postgres
-      # - redis
-    networks:
-      - caddy
-      - postgres
-      - redis
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.wallabag.loadbalancer.server.port: 80
-        traefik.http.routers.wallabag.rule: >
-          Host(`wallabag.marcpartensky.com`) ||
-          Host(`wallabag.marcpartensky.fr`)
-        traefik.http.routers.wallabag.entrypoints: websecure
-        # traefik.http.routers.wallabag.tls.certresolver: tls
-        traefik.http.routers.wallabag.tls.certresolver: cloudflare
-        # traefik.http.routers.wallabag.middlewares: ldap_auth
-
-    # postgres:
-    #     image: postgres:11-alpine
-    #     volumes:
-    #         - db-data:/var/lib/postgresql/data
-    #     env_file:
-    #         - ./docker/postgres/env
-    #     healthcheck:
-    #         test: ["CMD-SHELL", "pg_isready -q || exit 1"]
-    #         interval: 10s
-    #         timeout: 3s
-    #         retries: 3
-
-    # mariadb:
-    #    image: mariadb:10
-    #    ports:
-    #        - "3306:3306"
-    #    volumes:
-    #        - db-data:/var/lib/mysql
-    #    env_file:
-    #        - ./docker/mariadb/env
-
-    # rabbitmq:
-    #     image: rabbitmq:3-management-alpine
-    #     ports:
-    #         - "15672:15672"
-
-  # redis:
-  #   image: redis:6-alpine
-  #   healthcheck:
-  #     test: ["CMD", "redis-cli", "ping"]
-  #     interval: 10s
-  #     timeout: 3s
-  #     retries: 3
-
-volumes:
-  assets:
-  data:
-  cache:
-networks:
-  wallabag:
-  caddy:
-    external: true
-  postgres:
-    external: true
-  redis:
-    external: true

services/website.yml

@@ -17,15 +17,14 @@ services:
     # command:
     #   - "80"
     #   - "0.0.0.0"
-    # depends_on:
-    #   - redis
+    depends_on:
+      - redis
     volumes:
       - media:/app/media
     networks:
+      - postgres
       - website
       - caddy
-      - postgres
-      - redis
     # labels:
     #   caddy: marcpartensky.com
     #   caddy.reverse_proxy: "{{upstreams 80}}"
@@ -61,25 +60,23 @@ services:
         traefik.http.routers.website.tls.certresolver: tls
         traefik.http.services.website.loadbalancer.server.port: 80
 
-  # redis:
-  #   image: redis:alpine
-  #   restart: unless-stopped
-  #   networks:
-  #     - website
-  #   healthcheck:
-  #      test: ["CMD", "redis-cli","ping"]
-  #   deploy:
-  #     placement:
-  #       constraints:
-  #         - node.role == manager
+  redis:
+    image: redis:alpine
+    restart: unless-stopped
+    networks:
+      - website
+    healthcheck:
+       test: ["CMD", "redis-cli","ping"]
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
 
 volumes:
   media:
 
 networks:
   website:
-  redis:
-    external: true
   postgres:
     external: true
   caddy:

services/wger.yml

@@ -1,90 +0,0 @@
-#
-# Please consult the `Deployment` section in the readme if you want to deploy
-# this. You *need* to keep this nginx service, even if you have your own,
-# otherwise the static files will not be served correctly! If you do remove
-# it, configure yours similarly to what's in config/nginx.conf
-# Also take a look at the "Static files" section in the .env file
-
-services:
-  wger:
-    image: wger/server:latest
-    # depends_on:
-    #   db:
-    #     condition: service_healthy
-    #   cache:
-    #     condition: service_healthy
-    env_file:
-      - ../data/secrets/wger.env
-    volumes:
-      - static:/home/wger/static
-      - media:/home/wger/media
-    healthcheck:
-      test: wget --no-verbose --tries=1 --spider http://localhost:8000
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  nginx:
-    image: nginx:stable
-    volumes:
-      - ../data/wger/nginx.conf:/etc/nginx/conf.d/default.conf
-      - static:/wger/static:ro
-      - media:/wger/media:ro
-    ports:
-      - "80:80"
-    healthcheck:
-      test: service nginx status
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  # cache:
-  #   image: redis
-  #   expose:
-  #     - 6379
-  #   healthcheck:
-  #     test: redis-cli ping
-  #     interval: 10s
-  #     timeout: 5s
-  #     retries: 5
-  #   restart: unless-stopped
-
-  celery_worker:
-    image: wger/server:latest
-    container_name: wger_celery_worker
-    command: /start-worker
-    env_file:
-      - ./data/secrets/wger.env
-    # depends_on:
-    #   cache:
-    #     condition: service_healthy
-    #   db:
-    #     condition: service_healthy
-    healthcheck:
-      test: celery -A wger inspect ping
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  celery_beat:
-    image: wger/server:latest
-    command: /start-beat
-    volumes:
-      - celery-beat:/home/wger/beat/
-    env_file:
-      - ./config/.env
-      - ./data/secrets/wger.env
-    # depends_on:
-    #   cache:
-    #     condition: service_healthy
-
-volumes:
-  celery-beat:
-  static:
-  media:
-
-networks:
-  caddy:
-    external: true
-  postgres:
-    external: true

services/whoami.yml

@@ -8,7 +8,6 @@ services:
       # replicas: 0
       labels:
         traefik.enable: "true"
-        # traefik.http.routers.whoami.rule: Host(`whoami.marcpartensky.fr`)
         traefik.http.routers.whoami.rule: >
           Host(`whoami.marcpartensky.com`) || Host(`whoami.marcpartensky.fr`)
         traefik.http.routers.whoami.entrypoints: websecure

services/yt-dlp.yml

@@ -5,7 +5,6 @@ services:
     image: marcpartensky/yt-dlp
     restart: unless-stopped
     volumes:
-      - ../data/yt-dlp:/root/downloads
       - ~/Videos/Youtube:/srv
     env_file:
       - ../data/secrets/yt-dlp.env
@@ -21,10 +20,9 @@ services:
       labels:
         traefik.enable: "true"
         traefik.http.routers.ytdlp.rule: >
-          Host(`yt.marcpartensky.fr`) ||
-          Host(`yt.marcpartensky.com`)
+          Host(`yt.marcpartensky.fr`)
         traefik.http.routers.ytdlp.entrypoints: websecure
-        traefik.http.routers.ytdlp.tls.certresolver: cloudflare
+        traefik.http.routers.ytdlp.tls.certresolver: tls
         traefik.http.services.ytdlp.loadbalancer.server.port: 3033
 
 volumes: