fix serge

.gitignore

@@ -12,7 +12,7 @@ data/matrix
 data/heimdall
 data/pihole/etc-pihole
 data/pxe
-data/postgres
+data/postgres/certs
 data/wireguard
 data/vaultwarden
 data/filebrowser

data/openssl/openssl.conf

@@ -0,0 +1,35 @@
+ [ req ]
+ default_bits           = 8192
+ default_keyfile        = privkey.pem
+ distinguished_name     = req_distinguished_name
+ attributes             = req_attributes
+ x509_extensions        = v3_ca
+
+ dirstring_type = nobmp
+
+ [ req_distinguished_name ]
+ countryName                    = FR
+ countryName_default            = FR
+ countryName_min                = 2
+ countryName_max                = 2
+
+ localityName                   = Europe/Paris
+
+ organizationalUnitName         = Marc Partensky Corp
+
+ commonName                     = Marc Partensky
+ commonName_max                 = 64
+
+ emailAddress                   = marc@marcpartensky.com
+ emailAddress_max               = 40
+
+ # [ req_attributes ]
+ # challengePassword              = A challenge password
+ # challengePassword_min          = 4
+ # challengePassword_max          = 20
+
+ [ v3_ca ]
+
+ subjectKeyIdentifier=hash
+ authorityKeyIdentifier=keyid:always,issuer:always
+ basicConstraints = CA:true

data/postgres/initdb.d/create-marc-user.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+set -e
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+	CREATE USER marc PASSWORD ZGQ4ZDk5OWEwYjNlMDJlNmQ5NmE1NjM5;
+	GRANT ALL PRIVILEGES ON DATABASE * TO marc;
+EOSQL
+

data/postgres/initdb.d/create-ssl-keys.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+cd /var/lib/postgresql/certs
+
+# private key and certificate from it
+openssl req -new -text -newkey rsa:8192 -passout pass:$POSTGRES_PASSWORD -subj /CN=localhost -out server.req -keyout privkey.pem
+# self signed root certificate
+openssl rsa -in privkey.pem -passin pass:$POSTGRES_PASSWORD -out server.key
+# derived certificate
+openssl req -x509 -in server.req -text -key server.key -out server.crt
+
+# change permissions to the root certificate for postgres
+chmod 600 server.key
+chown postgres:postgres server.key

services/cloudflare.yml

@@ -0,0 +1,11 @@
+version: "3.9"
+services:
+  cloudflare:
+    image: cloudflare/cloudflared:latest
+    env_file: ../data/secrets/cloudflare.env
+    command: tunnel --no-autoupdate run
+    networks:
+      - caddy
+networks:
+  caddy:
+    external: true

services/discord.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   bot:
-    image: marcpartensky/discord-bot
+    image: marcpartensky/discord-bot:v107.be20e90.2022-05-21
     restart: unless-stopped
     ports:
       - "7010:8000"

services/logseq.yml

@@ -0,0 +1,29 @@
+version: "3.9"
+services:
+  logseq:
+    image: ghcr.io/logseq/logseq-webapp:latest
+    # volumes:
+    networks:
+      - traefik
+      - postgres
+    labels:
+      traefik.enable: "true"
+      # traefik.http.routers.focalboard.rule: >
+      #   Host(`board.marcpartensky.com`) || Host(`board.marcpartensky.fr`)
+      traefik.http.routers.logseq.service: logseq
+      traefik.http.routers.logseq.rule: >
+        Host(`logseq.marcpartensky.com`)
+      traefik.http.routers.logseq.tls: true
+      traefik.http.routers.logseq.entrypoints: web-secure
+      traefik.http.routers.logseq.tls.certresolver: default
+      traefik.http.services.logseq.loadbalancer.server.port: 80
+      # traefik.http.routers.focalboard.middlewares: ldap_auth
+
+volumes:
+  data:
+  pack:
+networks:
+  postgres:
+    external: true
+  traefik:
+    external: true

services/postgres.yml

@@ -4,17 +4,15 @@ services:
     image: postgres:14
     restart: unless-stopped
     # user: postgres:postgres
-    # user: "966:966"
-    user: 1000:1000
+    # user: "974:974"
     ports:
       - target: 5432
         published: 5432
         mode: host
     volumes:
-      - ../data/postgres:/docker-entrypoint-initdb.d
-      - /home/marc/srv/postgres:/var/lib/postgresql/data
-      - ../data/postgres/server.crt:/var/lib/postgresql/server.crt
-      - ../data/postgres/server.key:/var/lib/postgresql/server.key
+      - postgres:/var/lib/postgresql/data
+      - ../data/postgres/initdb.d:/initdb.d
+      - ../data/postgres/certs:/var/lib/postgresql/certs
     env_file:
       - ../data/secrets/postgres.env
     command: |
@@ -22,22 +20,35 @@ services:
       -c log_statement=all
       -c log_destination=stderr
       -c ssl=on
-      -c ssl_cert_file=/var/lib/postgresql/server.crt
-      -c ssl_key_file=/var/lib/postgresql/server.key
-    # networks:
-    #   - postgres
+      -c ssl_cert_file=/var/lib/postgresql/certs/server.crt
+      -c ssl_key_file=/var/lib/postgresql/certs/server.key
+    networks:
+      - postgres
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -q || exit 1"]
       interval: 10s
       timeout: 3s
       retries: 3
 
+  pgagent:
+    image: chiavegatto/postgres-pgagent
+    entrypoint: /bin/sh -c
+                "/tmp/wait-for-it.sh postgres:5432 --timeout=30 &&
+                psql -U postgres -h postgres -p 5432 -d postgres -c 'CREATE EXTENSION IF NOT EXISTS pgagent;' &&
+                pgagent -f hostaddr=postgres dbname=postgres user=postgres port=5432"
+    environment:
+      TIMEZONE: Europe/Paris
+    env_file:
+      - ../data/secrets/postgres.env
+    networks:
+      - postgres
+
   backup:
     image: kartoza/pg-backup:14-3.1
     env_file:
       - ../data/secrets/pg_backup.env
-    # networks:
-    #   - postgres
+    networks:
+      - postgres
     volumes:
       - /srv/pg-backup:/backups
 
@@ -51,14 +62,14 @@ services:
     #   - postgres
     # depends_on:
     #   - postgres
-    # networks:
-    #   - postgres
+    networks:
+      - postgres
     env_file:
       - ../data/secrets/pgbackups.env
 
 volumes:
   postgres:
 
-# networks:
-#   postgres:
-#     external: true
+networks:
+  postgres:
+    external: true

services/resume.yml

@@ -6,6 +6,9 @@ services:
     restart: unless-stopped
     env_file:
       - ../data/secrets/resume.env
+    environment:
+      PUBLIC_URL: https://cv.marcpartensky.fr
+      PUBLIC_SERVER_URL: https://cv.marcpartensky.fr/api
     networks:
       - caddy
       - postgres
@@ -29,6 +32,9 @@ services:
     restart: unless-stopped
     env_file:
      - ../data/secrets/resume.env
+    environment:
+      PUBLIC_URL: https://cv.marcpartensky.fr
+      PUBLIC_SERVER_URL: https://cv.marcpartensky.fr/api
     networks:
       - caddy
     deploy:

services/syncthing.yml

@@ -0,0 +1,17 @@
+version: "3.9"
+services:
+  syncthing:
+    image: lscr.io/linuxserver/syncthing:latest
+    restart: unless-stopped
+    environment:
+      PUID: 1000
+      PGID: 1000
+      TZ: Etc/UTC
+    volumes:
+      - /path/to/appdata/config:/config
+      - /path/to/data1:/data1
+      - /path/to/data2:/data2
+    ports:
+      - 8384:8384
+      - 22000:22000
+      - 21027:21027/udp

services/website.yml

@@ -2,7 +2,7 @@ version: "3.9"
 
 services:
   website:
-    image: marcpartensky/website
+    image: marcpartensky/website:v140.f211658.2023-11-01
     restart: unless-stopped
     env_file:
       - ../data/secrets/website.env

services/yt-dlp.yml

@@ -9,6 +9,7 @@ services:
       - ~/Videos/Youtube:/srv
     env_file:
       - ../data/secrets/yt-dlp.env
+    network_mode: none
 
   webui:
     image: ghcr.io/marcopeocchi/yt-dlp-web-ui:latest