nextcloud

.gitignore

@@ -12,7 +12,7 @@ data/matrix
 data/heimdall
 data/pihole/etc-pihole
 data/pxe
-data/postgres
+data/postgres/certs
 data/wireguard
 data/vaultwarden
 data/filebrowser

Makefile

@@ -12,8 +12,11 @@ pull:
 	for file in services/*; do docker-compose -f $$file pull; done
 export:
 	7z a -p data.7z data
+import:
+	7z x -p data.7z
+sign:
 	gpg --encrypt --sign --recipient 'marc@marcpartensky.com' data.7z
-	rm data.tgz
+	# rm data.tgz
 networks:
 	docker network create --driver overlay --attachable caddy || true
 	docker network create --driver overlay --attachable ldap || true

data/openssl/openssl.conf

@@ -0,0 +1,35 @@
+ [ req ]
+ default_bits           = 8192
+ default_keyfile        = privkey.pem
+ distinguished_name     = req_distinguished_name
+ attributes             = req_attributes
+ x509_extensions        = v3_ca
+
+ dirstring_type = nobmp
+
+ [ req_distinguished_name ]
+ countryName                    = FR
+ countryName_default            = FR
+ countryName_min                = 2
+ countryName_max                = 2
+
+ localityName                   = Europe/Paris
+
+ organizationalUnitName         = Marc Partensky Corp
+
+ commonName                     = Marc Partensky
+ commonName_max                 = 64
+
+ emailAddress                   = marc@marcpartensky.com
+ emailAddress_max               = 40
+
+ # [ req_attributes ]
+ # challengePassword              = A challenge password
+ # challengePassword_min          = 4
+ # challengePassword_max          = 20
+
+ [ v3_ca ]
+
+ subjectKeyIdentifier=hash
+ authorityKeyIdentifier=keyid:always,issuer:always
+ basicConstraints = CA:true

data/postgres/initdb.d/create-marc-user.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+set -e
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+	CREATE USER marc PASSWORD ZGQ4ZDk5OWEwYjNlMDJlNmQ5NmE1NjM5;
+	GRANT ALL PRIVILEGES ON DATABASE * TO marc;
+EOSQL
+

data/postgres/initdb.d/create-ssl-keys.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+cd /var/lib/postgresql/certs
+
+# private key and certificate from it
+openssl req -new -text -newkey rsa:8192 -passout pass:$POSTGRES_PASSWORD -subj /CN=localhost -out server.req -keyout privkey.pem
+# self signed root certificate
+openssl rsa -in privkey.pem -passin pass:$POSTGRES_PASSWORD -out server.key
+# derived certificate
+openssl req -x509 -in server.req -text -key server.key -out server.crt
+
+# change permissions to the root certificate for postgres
+chmod 600 server.key
+chown postgres:postgres server.key

services/cloudflare.yml

@@ -0,0 +1,11 @@
+version: "3.9"
+services:
+  cloudflare:
+    image: cloudflare/cloudflared:latest
+    env_file: ../data/secrets/cloudflare.env
+    command: tunnel --no-autoupdate run
+    networks:
+      - caddy
+networks:
+  caddy:
+    external: true

services/discord.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   bot:
-    image: marcpartensky/discord-bot
+    image: marcpartensky/discord-bot:v107.be20e90.2022-05-21
     restart: unless-stopped
     ports:
       - "7010:8000"

services/focalboard.yml

@@ -9,17 +9,9 @@ services:
     environment:
       EXCLUDE_ENTERPRISE: "1"
     networks:
-      - caddy
       - postgres
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.focalboard.rule: >
-          Host(`board.marcpartensky.com`) || Host(`board.marcpartensky.fr`)
-        traefik.http.routers.focalboard.entrypoints: websecure
-        # traefik.http.routers.focalboard.tls.certresolver: tls
-        traefik.http.services.focalboard.loadbalancer.server.port: 8000
-        # traefik.http.routers.focalboard.middlewares: ldap_auth
+    ports:
+      - "8000:8000"
 
 volumes:
   data:
@@ -27,5 +19,3 @@ volumes:
 networks:
   postgres:
     external: true
-  caddy:
-    external: true

services/logseq.yml

@@ -0,0 +1,29 @@
+version: "3.9"
+services:
+  logseq:
+    image: ghcr.io/logseq/logseq-webapp:latest
+    # volumes:
+    networks:
+      - traefik
+      - postgres
+    labels:
+      traefik.enable: "true"
+      # traefik.http.routers.focalboard.rule: >
+      #   Host(`board.marcpartensky.com`) || Host(`board.marcpartensky.fr`)
+      traefik.http.routers.logseq.service: logseq
+      traefik.http.routers.logseq.rule: >
+        Host(`logseq.marcpartensky.com`)
+      traefik.http.routers.logseq.tls: true
+      traefik.http.routers.logseq.entrypoints: web-secure
+      traefik.http.routers.logseq.tls.certresolver: default
+      traefik.http.services.logseq.loadbalancer.server.port: 80
+      # traefik.http.routers.focalboard.middlewares: ldap_auth
+
+volumes:
+  data:
+  pack:
+networks:
+  postgres:
+    external: true
+  traefik:
+    external: true

services/nextcloud.yml

@@ -5,30 +5,35 @@ services:
     image: nextcloud
     restart: unless-stopped
     volumes:
-      # - nextcloud:/var/www/html
-      - data:/var/www/html/data
-      - config:/var/www/html/config
-      - themes:/var/www/html/themes
-      - apps:/var/www/html/custom_apps
+      - /home/marc/srv/nextcloud:/var/www/html
+      # - ../data/nextcloud/config:/var/www/html/config
+      # - ../data/nextcloud/version.php:/var/www/html/version.php
+      # - /srv/nextcloud/data:/var/www/html/data
+      # - /srv/nextcloud/themes:/var/www/html/themes
+      # - /srv/nextcloud/apps:/var/www/html/custom_apps
+      # - ../data/nextcloud/test:/test
+      #
+    ports:
+      - 8006:80
+
     env_file:
       - ../data/secrets/nextcloud.env
     networks:
-      - caddy
+      # - caddy
       - postgres
-      - ldap
+      # - redis
+      # - ldap
         # depends_on:
         #   - nextcloud_mariadb
-    deploy:
-      labels:
-        caddy: cloud.marcpartensky.com
-        caddy.reverse_proxy: "{{upstreams http 80}}"
-        traefik.enable: "true"
-        traefik.http.routers.nextcloud.rule: >
-          Host(`cloud.marcpartensky.com`) ||
-          Host(`cloud.marcpartensky.fr`)
-        traefik.http.routers.nextcloud.entrypoints: websecure
-        traefik.http.routers.nextcloud.tls.certresolver: tls
-        traefik.http.services.nextcloud.loadbalancer.server.port: 80
+    # labels:
+    #   # caddy: cloud.marcpartensky.com
+    #   # caddy.reverse_proxy: "{{upstreams http 80}}"
+    #   traefik.enable: "true"
+    #   traefik.http.routers.nextcloud.rule: >
+    #     Host(`cloud.marcpartensky.com`)
+    #   traefik.http.routers.nextcloud.entrypoints: web
+    #   # traefik.http.routers.nextcloud.tls.certresolver: tls
+    #   traefik.http.services.nextcloud.loadbalancer.server.port: 80
 
 volumes:
   data:

services/postgres.yml

@@ -5,25 +5,27 @@ services:
     restart: unless-stopped
     # user: postgres:postgres
     # user: "966:966"
-    user: 1000:1000
+    # user: 1000:1000
     ports:
       - target: 5432
         published: 5432
         mode: host
+    networks:
+      - postgres
     volumes:
       - ../data/postgres:/docker-entrypoint-initdb.d
       - /home/marc/srv/postgres:/var/lib/postgresql/data
-      - ../data/postgres/server.crt:/var/lib/postgresql/server.crt
-      - ../data/postgres/server.key:/var/lib/postgresql/server.key
+      # - ../data/postgres/server.crt:/var/lib/postgresql/server.crt
+      # - ../data/postgres/server.key:/var/lib/postgresql/server.key
     env_file:
       - ../data/secrets/postgres.env
     command: |
       postgres
       -c log_statement=all
       -c log_destination=stderr
-      -c ssl=on
-      -c ssl_cert_file=/var/lib/postgresql/server.crt
-      -c ssl_key_file=/var/lib/postgresql/server.key
+    # -c ssl=on
+    # -c ssl_cert_file=/var/lib/postgresql/server.crt
+    # -c ssl_key_file=/var/lib/postgresql/server.key
     # networks:
     #   - postgres
     healthcheck:
@@ -32,6 +34,19 @@ services:
       timeout: 3s
       retries: 3
 
+  pgagent:
+    image: chiavegatto/postgres-pgagent
+    entrypoint: /bin/sh -c
+                "/tmp/wait-for-it.sh postgres:5432 --timeout=30 &&
+                psql -U postgres -h postgres -p 5432 -d postgres -c 'CREATE EXTENSION IF NOT EXISTS pgagent;' &&
+                pgagent -f hostaddr=postgres dbname=postgres user=postgres port=5432"
+    environment:
+      TIMEZONE: Europe/Paris
+    env_file:
+      - ../data/secrets/postgres.env
+    networks:
+      - postgres
+
   backup:
     image: kartoza/pg-backup:14-3.1
     env_file:
@@ -59,6 +74,6 @@ services:
 volumes:
   postgres:
 
-# networks:
-#   postgres:
-#     external: true
+networks:
+  postgres:
+    external: true

services/rancher.yml

@@ -7,7 +7,11 @@ services:
     volumes:
         - /var/run/docker.sock:/var/run/docker.sock
     networks:
-        - caddy
+      - caddy
+    privileged: true
+      # user: root
+    environment:
+      CATTLE_SYSTEM_CATALOG: bundled
     labels:
       caddy: rancher.marcpartensky.com
       caddy.reverse_proxy: "{{upstreams 8080}}"

services/resume.yml

@@ -1,54 +1,35 @@
 version: "3.9"
 
 services:
-  server:
-    image: amruthpillai/reactive-resume:server-latest
+  resume:
+    image: amruthpillai/reactive-resume:latest
     restart: unless-stopped
     env_file:
       - ../data/secrets/resume.env
+        # environment:
+        #   PUBLIC_URL: https://cv.marcpartensky.com
     networks:
-      - caddy
       - postgres
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.server.loadbalancer.server.port: 3100
-        traefik.http.routers.server.rule: Host(`api.cv.marcpartensky.fr`)
-        # traefik.http.routers.server.rule: "Host(`cv.marcpartensky.fr`) && PathPrefix(`/api`)"
-        # traefik.http.routers.server.rule: >
-        #   Host(`cv.marcpartensky.com`) &&
-        #   PathPrefix(`/api`) ||
-        #   Host(`cv.marcpartensky.fr`) &&
-        #   PathPrefix(`/api`)
-        traefik.http.routers.server.entrypoints: websecure
-        # traefik.http.routers.server.tls.certresolver: cloudflare
-        traefik.http.routers.server.tls.certresolver: tls
+      - redis
+    ports:
+      - 8002:3000
 
-  client:
-    image: amruthpillai/reactive-resume:client-latest
+  printer:
+    image: browserless/chrome:1.61.0-puppeteer-21.4.1
     restart: unless-stopped
     env_file:
-     - ../data/secrets/resume.env
-    networks:
-      - caddy
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.services.client.loadbalancer.server.port: 3000
-        # traefik.http.routers.client.rule: Host(`cv.marcpartensky.fr`)
-        traefik.http.routers.client.rule: >
-          Host(`cv.marcpartensky.fr`)
-          # Host(`cv.marcpartensky.com`) &&
-          # Path(`/`) ||
-          # Host(`cv.marcpartensky.fr`) &&
-          # Path(`/`)
-        traefik.http.routers.client.entrypoints: websecure
-        # traefik.http.routers.client.tls.certresolver: cloudflare
-        traefik.http.routers.server.tls.certresolver: tls
-        # traefik.http.routers.client.middlewares: ldap_auth
+      - ../data/secrets/resume.env
+    ports:
+      - 8003:3000
+    environment:
+        #   TOKEN: chrome_token
+      EXIT_ON_HEALTH_FAILURE: true
+      PRE_REQUEST_HEALTH_CHECK: true
+
 networks:
   postgres:
     external: true
   caddy:
     external: true
-
+  redis:
+    external: true

services/serge.yml

@@ -2,20 +2,22 @@ version: "3"
 
 services:
   serge:
-    image: ghcr.io/nsarrazin/serge:latest
-    networks:
-      - caddy
+    # image: ghcr.io/nsarrazin/serge:latest
+    image: ghcr.io/serge-chat/serge:latest
+    # network_mode: host
     volumes:
       - weights:/usr/src/app/weights
       - data:/data/db/
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.serge.rule: >
-          Host(`serge.marcpartensky.fr`) ||
-          Host(`serge.marcpartensky.com`)
-        traefik.http.routers.serge.entrypoints: websecure
-        traefik.http.services.serge.loadbalancer.server.port: 8008
+    ports:
+      - "8004:8008"
+    # deploy:
+    #   labels:
+    #     traefik.enable: "true"
+    #     traefik.http.routers.serge.rule: >
+    #       Host(`serge.marcpartensky.fr`) ||
+    #       Host(`serge.marcpartensky.com`)
+    #     traefik.http.routers.serge.entrypoints: websecure
+    #     traefik.http.services.serge.loadbalancer.server.port: 8008
 
 networks:
   caddy:

services/syncthing.yml

@@ -0,0 +1,17 @@
+version: "3.9"
+services:
+  syncthing:
+    image: lscr.io/linuxserver/syncthing:latest
+    restart: unless-stopped
+    environment:
+      PUID: 1000
+      PGID: 1000
+      TZ: Etc/UTC
+    volumes:
+      - /path/to/appdata/config:/config
+      - /path/to/data1:/data1
+      - /path/to/data2:/data2
+    ports:
+      - 8384:8384
+      - 22000:22000
+      - 21027:21027/udp

services/vaultwarden.yml

@@ -31,6 +31,8 @@ services:
       - caddy
       - vaultwarden
       - postgres
+    ports:
+      - "8001:80"
     # labels:
     #   caddy: vault.marcpartensky.com
     #   caddy.reverse_proxy: "{{upstreams 80}}"

services/website.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   website:
-    image: marcpartensky/website
+    image: marcpartensky/website:v140.f211658.2023-11-01
     restart: unless-stopped
     env_file:
       - ../data/secrets/website.env

services/yt-dlp.yml

@@ -9,10 +9,13 @@ services:
       - ~/Videos/Youtube:/srv
     env_file:
       - ../data/secrets/yt-dlp.env
+    network_mode: none
 
   webui:
     image: ghcr.io/marcopeocchi/yt-dlp-web-ui:latest
     restart: unless-stopped
+    ports:
+      - "8004:3033"
     volumes:
       - ~/Videos/Youtube:/downloads
     networks: