no build

.gitignore

@@ -1,3 +1,6 @@
-data/secrets/
-data/certbot/
-data/traefik/
+data/openvpn
+data/secrets
+data/certbot
+data/traefik
+data/caddy
+data.tar.gz

Makefile

@@ -0,0 +1,8 @@
+export:
+	tar cvzf /tmp/docker_data.tgz /root/docker/data
+	gpg --encrypt --recipient 'marc.partensky@gmail.com' /tmp/docker_data.tgz
+	mv /tmp/docker_data.tgz.gpg .
+	rm /tmp/docker_data.tgz
+clean:
+	rm ./docker_data.tgz.gpg
+	rm /tmp/docker_data.tgz

README.md

@@ -2,7 +2,6 @@
 
 ## Domains
 - https://marcpartensky.com
-- https://www.marcpartensky.com
 - https://pandoc.marcpartensky.com
 - https://ialab.marcpartensky.com
 - https://notebook.marcpartensky.com
@@ -10,12 +9,26 @@
 - https://cloud.marcpartensky.com
 - https://wordpress.marcpartensky.com
 - https://git.marcpartensky.com
+- https://business.marcpartensky.com
+- https://todolist.marcpartensky.com
+- https://api.todolist.marcpartensky.com
+- https://marc.wp.marcpartensky.com
+- https://alex.wp.marcpartensky.com
+- https://uml.marcpartensky.com
+- https://grafana.marcpartensky.com
+- https://prometheus.marcpartensky.com
+- https://dns.marcpartensky.com
 <!-- - https://dev.marcpartensky.com -->
 <!-- - https://box.marcpartensky.com -->
-<!-- - https://business.marcpartensky.com -->
 <!-- - https://glou.marcpartensky.com -->
 <!-- - https://minecraft.marcpartensky.com -->
 
+## Reverse proxy
+The `docker-compose.yml` configuration is compatible with the following reverse-proxies:
+- traefik
+- caddy
+- nginx
+
 ## Commands
 ```sh
 certbot certonly -d newdomain.com -n --standalone

config/opendkim/KeyTable

@@ -0,0 +1 @@
+mail._domainkey.marcpartensky.com marcpartensky.com:mail:/etc/opendkim/keys/marcpartensky.com/mail.private

config/opendkim/SigningTable

@@ -0,0 +1 @@
+*@marcpartensky.com mail._domainkey.marcpartensky.com

config/opendkim/TrustedHosts

@@ -0,0 +1,2 @@
+127.0.0.1
+localhost

config/opendkim/keys/marcpartensky.com/mail.private

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAouPk5YPodxb41YBVY4xdeJGRCzUXSrVYUZc2ukE2HqIqWsiv
+U7vPgBFlclBzMMJVdrt/NAt3NnulzWyQg6V+A8wSYkCNpevGlsp2TvkL8Mcuf1LV
+GfNScjycJ8nC8LhRgHZZJ876yM97mEK+J4X4k8X1/IWzwUSmOOAB3EpfuQLMVQL8
+KQh5gyAdvokbnmq+r9VqOyiFbZ03JzyW+RPMTQxMu2kid+KH336/j5Tvza8ITN3v
+qZRVfZJjJzCJHvx4iKpWy2iOFxNThlUTbnZ93xFEA+36s+pU2hT22RGN8qzSQFBt
+IXKEqyNJ4KoJ/X53ukYc4ZSmpRAz/PhxX9eIgurUwKXrSwX5127+eCIanRT4aMYS
+obuue7IGlHixNI4dmZW4H0kMs5MwDItYzNQfmsv7HDjkfsRhBlFpV5LMES1g4L4r
+WQ85kKcQYfl60FyReCKrrBGiFi9H8iEK5gDIgOFJ37qNa3yLolll31YdkhONsFyr
+OyGrEAcCzRHOa9jq9KEa5p8QyRekG75aGEfGlRMntkM1KAhdyjuyixle3I7SYywq
+tqJfjAButWJdvhuPf1jWmqzs97AoJZb2mYzgP/ur9sqHR8EBJ8HN9thRgf4Qsyxp
+PTO9tOU+4GtT9YSVSGjXHQ0SnPDAj8YxjOql5RDalmiP91NmAeGUfCbLwUkCAwEA
+AQKCAgBUDv7kYjnomvY2V0+5W4ow2g3blr46U3MMR9h6LYTcMhthVgcEUvs1v8R2
+RYXsN50a9I8kMHaIqy5Y4BmDljd9hiZGhcGTSiTlU/3Rqzu6OU+JbRmDlsmJIjYD
+Yl8zEisc+/XuUSWh01CYtniitMQenh3e/rBQoDiXSSIsqETVmNgRVsUB99mdDUnM
+Nb0G91cILj3v4W1Zr7Pyj5XpW4omiJ5gaFTdQQ2VDDeWxOkrX5QM9sri3CVx88Uv
+SCC62Nbqz9ySg5Yv2k1UGTs52fQC1UogLQMfLWI0WHU6d5ClFwI5Jkfq5soH9uH9
+CkK1ijoG6n+k+a01qTLq7Nq09uj+s6T0BFb6703ZATVxdTNxc3xaFcYm9ZpuDnCr
+U8P6sVClCa9axjMZk1Kjl7OKSyp8LlRWPacxO4GXqlNmhyMUEldKj8cBmmxzC7fj
+1fMXAve3EodVRM5Z6S+c/PO96TuJrSkddImWhPawd35/rrtBA+7ToPNYzy7aWk/N
+UZ9uFkwPMLaDZeRG590natPOUkB0FZ7F8EEjwMbUhf1iyoPvLPiixofVk1NKTWMr
+8DEN6bSH85v/lQaAQhmFFNRjdeyXts9+a7Kmsxos3AfW8hsmNHFxTuoXZ8AjvVAs
+P7hlPFoJultoUwX/ZpMZtsEwFW3FUSw33Onsdblezp7Lb12icQKCAQEAzVKid6vv
+TWGltBkL1XTtzYSNUTBIZfoOjKxTsrqSKNAR6i2lmN2bPKKTksPdloBoaQ/FHK6R
+/+mebfgmnyulY6zWo8EUewi3LFyL9KhXe0K38/jUUokKWSq1Ob5D8Kjq6MuTCfuS
+M5XnYfIZuIAZLE0244+Q8L03mc2f7uvl3KWaAZOVUsfHu/ETzTm6lgG8Liq5a0Fw
+thCVVupKVeSLjRa/RWFVR9E9jvIjplo+SVAUJWyYwlOfPDVr76gqrF5P+4lOQpAQ
+dzwhi4LHhvdgp9Y/Gw3s5vByA/7Ogh3QI5jS36w2EMCFYZpAe4HBQk1UOYVNBpeD
+58m3venG5pBy4wKCAQEAyxglzQhZSBNkkukoRm7zzmNAx9/M0ROu7uwmJ9t02Q94
+/3fpV2zVYA7rQKZcCgW5Dnhe4GaeyASRXq4x3v7F6iLCUjxbJ8e+YRhsNrp0WmYU
+Xk6+06EQgLBICqDQeMDDeR+KQzaJonuMSrGyUb8krR6RB+/W3LqK/0CQSSaHozzN
+6mxejoFoNhf7rfIP9JJD8QwpBsTJBQNCDvHo1lIA8e3nTngFzLJ56tRVwjaP8EPT
+qJ7RfoVxdTyUTZTq/8EGOqNrzLgB/FehXq3eTz89tdlHOTT+mJ8H23AEtepxpLFx
+5kN/eisi4PjUgCp11IHnmG8qnJr48uDlORdrqL424wKCAQBX/DVK+w7NJi8QAjuj
++Tt+enLke8BKkuFxPtePG4xOmPtUUsNHwo8naLO8jNqEB/q2Kt/Y7qX5+G6/yTsj
+slxpXkOMYM0Z/B4ikHYZHZp/Y5PYpKS3yan5k+edGv+aPYiMwc/80yVPnclNm6WR
+/rLK3TvMQFVoFG2jJw6GH+icqQpZ6phupNXen+xQYZCnf47Yac6TO7PFEU4ttLCu
+JgX3K+xDGvakk/HBM9o7Cyjt2bcIYoUDoTn3Xx0l0faXbsLvk2NJ+tpTfh0R37UJ
+DTEKOzFHsqv2OsthEuwDrirnVjHnT7DLdPSzYpqHUo8yjlitXYYocP1BcpuecnOd
+kgDpAoIBAQCtLi4to8zeFQtR6teZF8t2VlRLG5+/ORWWTnBK1GvTG8qFrW6gSgG5
+I3+fZTxen3qpyCK/H0KONLbxEYEdMgr6GCGzlhv00/KXQQglsuC8pQcBVAyM0W8N
+DUShK3gZP+ZvRmHT5pF+p/N9TgFMi71ukf4B0pZZKgiUmC1w8xX+MD82gqouwlJm
+rhTCwwKv/nlI9qGVUABJ8flGXSm6d7qukbsHwnjPj/E+OUnXjkc3Dd9Sjfr99DRH
+UBz1+uJYq/Pv1KJ7svyefOrxnTlQQhERG/IL6hCffBxrFh4uMXgug9EoFK6DMn1P
+cV9i2tIXH56o8UJYwB1Anl1YTYxUG78ZAoIBAD748NDDIj5yxjzW7UzNajLs9iB2
+aiywcxPZCKo38Yi7KIaxIy8YeHqJ6chenvTl5S4ElB+sJ0SnYEvBqxceOXiM9l5i
+HrDxIc3gzwY0lN0h2ZEiSKBQgjCtFW6gZ+6KmPonk98S8l8hbFW0vL+nS4EE9vtO
+3cFhz/HPVB1ZY5ofy7/rLRd7GiISof9WcvrnOvE9BKFF0rNKZUjrf2PM3c2rObvj
+5rgLvUiX/Mn9ND/XHTjT/UVptmkmcnjFyRvQwXXA4ns7gxBWYfYB1bqwh6WRfEU6
+x3ykDol24hgohvpEnKMZDUTmLrxgF8hbJTP/57P2Yyy0faxZ/z/MER1qy28=
+-----END RSA PRIVATE KEY-----

config/opendkim/keys/marcpartensky.com/mail.txt

@@ -0,0 +1,4 @@
+mail._domainkey	IN	TXT	( "v=DKIM1; h=sha256; k=rsa; "
+	  "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAouPk5YPodxb41YBVY4xdeJGRCzUXSrVYUZc2ukE2HqIqWsivU7vPgBFlclBzMMJVdrt/NAt3NnulzWyQg6V+A8wSYkCNpevGlsp2TvkL8Mcuf1LVGfNScjycJ8nC8LhRgHZZJ876yM97mEK+J4X4k8X1/IWzwUSmOOAB3EpfuQLMVQL8KQh5gyAdvokbnmq+r9VqOyiFbZ03Jz"
+	  "yW+RPMTQxMu2kid+KH336/j5Tvza8ITN3vqZRVfZJjJzCJHvx4iKpWy2iOFxNThlUTbnZ93xFEA+36s+pU2hT22RGN8qzSQFBtIXKEqyNJ4KoJ/X53ukYc4ZSmpRAz/PhxX9eIgurUwKXrSwX5127+eCIanRT4aMYSobuue7IGlHixNI4dmZW4H0kMs5MwDItYzNQfmsv7HDjkfsRhBlFpV5LMES1g4L4rWQ85kKcQYfl60FyReCKrrBGi"
+	  "Fi9H8iEK5gDIgOFJ37qNa3yLolll31YdkhONsFyrOyGrEAcCzRHOa9jq9KEa5p8QyRekG75aGEfGlRMntkM1KAhdyjuyixle3I7SYywqtqJfjAButWJdvhuPf1jWmqzs97AoJZb2mYzgP/ur9sqHR8EBJ8HN9thRgf4QsyxpPTO9tOU+4GtT9YSVSGjXHQ0SnPDAj8YxjOql5RDalmiP91NmAeGUfCbLwUkCAwEAAQ==" )  ; ----- DKIM key mail for marcpartensky.com

config/postfix-accounts.cf

@@ -0,0 +1 @@
+marc@marcpartensky.com|{SHA512-CRYPT}$6$G1SLI/9La3kXrkrt$9MdkaLuUEoa2n8mVVZoCwmy0g6MrvlHDL0i2FVrUakAXi3pgPfo/HNz/mLWRFS6nG1oOeP8IMbTGM.JptPR../

data/conf/clamav/whitelist.ign2

@@ -0,0 +1,5 @@
+# Please restart ClamAV after changing signatures
+Example-Signature.Ignore-1
+PUA.Win.Trojan.EmbeddedPDF-1
+PUA.Pdf.Trojan.EmbeddedJavaScript-1
+PUA.Pdf.Trojan.OpenActionObjectwithJavascript-1

data/nginx/mc.conf

@@ -0,0 +1,16 @@
+server {
+	listen 25565;
+	server_name mc.marcpartensky.com;
+
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+	location / {
+		proxy_pass http://marcpartensky.com:7065;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/pihole.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name ialab.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/ialab.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/ialab.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://ialab;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/poiret.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name poiret.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/poiret.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/poiret.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://poiret:8000;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/vnc.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name vnc.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/vnc.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/vnc.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://vnc:6901;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/wordpress_alex.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name alex.wp.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/alex.wp.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/alex.wp.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://wordpress_alex;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/wordpress_marc.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name marc.wp.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/marc.wp.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/marc.wp.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://wordpress_marc;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

docker-compose.yml

@@ -1,6 +1,7 @@
 version: "3.9"
 services:
 
+
   traefik:
     image: traefik
     restart: unless-stopped
@@ -12,39 +13,56 @@ services:
       # - --providers.docker.network=web # <== Operate on the docker network named web
       - --providers.docker=true # <== Enabling docker as the provider for traefik
       ## API Settings - https://docs.traefik.io/operations/api/, endpoints - https://docs.traefik.io/operations/api/#endpoints ##
-      - --api.insecure=true # <== Enabling insecure api, NOT RECOMMENDED FOR PRODUCTION
-      - --api.dashboard=true # <== Enabling the dashboard to view services, middlewares, routers, etc...
+      - --api.insecure=false # <== Enabling insecure api, NOT RECOMMENDED FOR PRODUCTION
+      - --api.dashboard=true
       - --api.debug=true # <== Enabling additional endpoints for debugging and profiling
       ## Entrypoints Settings - https://docs.traefik.io/routing/entrypoints/#configuration ##
+      - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
-      ## Certificate Settings (Let's Encrypt) -  https://docs.traefik.io/https/acme/#configuration-examples ##
       - --certificatesresolvers.tls.acme.tlschallenge=true # <== Enable TLS-ALPN-01 to generate and renew ACME certs
-      - --certificatesresolvers.tls.acme.email=marc.partensky@gmail.com # <== Setting email for certs
-      - --certificatesresolvers.tls.acme.storage=/letsencrypt/acme.json # <== Defining acme file to store cert information
-      ## Log Settings (options: ERROR, DEBUG, PANIC, FATAL, WARN, INFO) - https://docs.traefik.io/observability/logs/ ##
+      - --certificatesresolvers.tls.acme.email=marc.partensky@gmail.com
+      - --certificatesresolvers.tls.acme.storage=/letsencrypt/acme.json # Log Settings (options: ERROR, DEBUG, PANIC, FATAL, WARN, INFO) - https://docs.traefik.io/observability/logs/ ##
       - --log.level=DEBUG # <== Setting the level of the logs from traefik
+      - --entrypoints.web.http.redirections.entryPoint.to=websecure
+      - --entrypoints.web.http.redirections.entryPoint.scheme=https
+      - --entrypoints.web.http.redirections.entrypoint.permanent=true
     ports:
-      - "8081:443"
-      - "8080:8080" # The Web UI (enabled by --api.insecure=true)
+      - "80:80"
+      - "443:443"
+    networks:
+      # - caddy
+      - nginx
     volumes:
       - ./data/traefik/letsencrypt:/letsencrypt
-      - ./data/traefik/dynamic.yaml:/dynamic.yaml
+      # - ./data/traefik/dynamic.yaml:/dynamic.yaml
       - /var/run/docker.sock:/var/run/docker.sock:ro
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.api.rule=Host(`traefik.marcpartensky.com`)"
-      - "traefik.http.routers.api.service=api@internal" # <== Enabling the api to be a service to access
+      - "traefik.http.routers.traefik.rule=Host(`traefik.marcpartensky.com`)"
+      - "traefik.http.routers.traefik.service=api@internal" # <== Enabling the api to be a service to access
       - "traefik.http.routers.traefik.entrypoints=websecure"
       - "traefik.http.routers.traefik.tls.certresolver=tls"
+      - "traefik.docker.network=nginx"
+      # - "traefik.http.routers.redirs.entrypoints=web"
+      # - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      # - "traefik.http.routers.redirs.middlewares=redirect-to-https"
+      # - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
 
   whoami:
     image: traefik/whoami
     restart: unless-stopped
-    user: nobody
+    environment:
+     - VIRTUAL_HOST=whoami.local
     labels:
+      - "caddy=whoami.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams http 80}}"
+      - "traefik.enable=true"
       - "traefik.http.routers.whoami.rule=Host(`whoami.marcpartensky.com`)"
       - "traefik.http.routers.whoami.entrypoints=websecure"
       - "traefik.http.routers.whoami.tls.certresolver=tls"
+    networks:
+      - nginx
+      # - caddy
 
   nginx:
     image: nginx
@@ -52,7 +70,7 @@ services:
     ports:
       - "80:80"
       - "443:443"
-      # - "2222:2222"
+      - "2222:2222"
     volumes:
       - ./data/nginx:/etc/nginx/conf.d
       - /etc/letsencrypt:/etc/letsencrypt
@@ -67,37 +85,93 @@ services:
       - nginx
       - box
 
+  nginx_proxy:
+    image: jwilder/nginx-proxy
+    restart: unless-stopped
+    environment:
+      - ENABLE_IPV6=true
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/tmp/docker.sock:ro
+      # - ./data/nginx:/etc/nginx/conf.d
+      # - /etc/letsencrypt:/etc/letsencrypt
+      # - /var/log/nginx:/var/log/nginx
+      # - ./data/certbot/conf:/etc/letsencrypt
+      # - ./data/certbot/www:/var/www/certbot
+      # - type: bind
+      #   source: /home/my-user/elk-stack/.htpasswd
+        # target: /etc/nginx/.htpasswd
+    # command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
+    networks:
+      - nginx
+      - box
+
+  caddy:
+    image: lucaslorentz/caddy-docker-proxy:ci-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    # environment:
+      # - caddy_INGRESS_NETWORKS=caddy
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./data/caddy:/data
+    networks:
+      - nginx
+      - box
+      # - caddy
+
   portainer:
     image: portainer/portainer-ce
     restart: unless-stopped
+    environment:
+      - VIRTUAL_HOST=docker.marcpartensky.com
+      - VIRTUAL_PORT=9000
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /srv/portainer:/data
     networks:
       - nginx
+      # - caddy
     command:
       - --logo
       - https://marcpartensky.com/static/home/assets/img/white-orchid.svg
     labels:
+      - "caddy=docker.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 9000}}"
+      - "traefik.enable=true"
       - "traefik.http.routers.portainer.rule=Host(`docker.marcpartensky.com`)"
       - "traefik.http.routers.portainer.entrypoints=websecure"
       - "traefik.http.routers.portainer.tls.certresolver=tls"
+      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
 
-  # registry:
-  #   restart: unless-stopped
-  #   image: registry:latest
-  #   ports:
-  #     - 5000:5000
-  #   environment:
-  #     REGISTRY_HTTP_TLS_CERTIFICATE: /certs/domain.crt
-  #     REGISTRY_HTTP_TLS_KEY: /certs/domain.key
-  #     REGISTRY_AUTH: htpasswd
-  #     REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
-  #     REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
-  #   volumes:
-  #     - /path/data:/var/lib/registry
-  #     - /path/certs:/certs
-  #     - /path/auth:/auth
+  registry:
+    restart: unless-stopped
+    image: registry:latest
+    ports:
+      - 5000:5000
+    environment:
+      REGISTRY_HTTP_ADDR: 0.0.0.0:443
+      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/domain.crt
+      REGISTRY_HTTP_TLS_KEY: /certs/domain.key
+      REGISTRY_AUTH: htpasswd
+      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
+      REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
+    volumes:
+      - /srv/registry/data:/var/lib/registry
+      - /srv/registry/certs:/certs
+      - /srv/registry/auth:/auth
+    labels:
+      - "caddy=registry.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 443}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.registry.rule=Host(`registry.marcpartensky.com`)"
+      - "traefik.http.routers.registry.entrypoints=websecure"
+      - "traefik.http.routers.registry.tls.certresolver=tls"
+      - "traefik.http.services.registry.loadbalancer.server.port=443"
 
   # registry:
   #   image: registry:latest
@@ -119,7 +193,11 @@ services:
     env_file:
       - ./data/secrets/website.env
     environment:
-      - DEBUG=false
+      - VIRTUAL_HOST=marcpartensky.com
+      - VIRTUAL_PORT=80
+      # - DEBUG=false
+      - DEBUG=true
+      # - SECURE_SSL_REDIRECT=false
       # - KEY=/app/privkey.pem
       # - CERT=/app/fullchain.pem
     working_dir: /app
@@ -139,9 +217,24 @@ services:
     networks:
       - website
       - nginx
+      # - caddy
     depends_on:
       - redis
       - postgres
+    healthcheck:
+        test: ["CMD", "curl", "-f", "http://localhost/admin"]
+        interval: 1m30s
+        timeout: 10s
+        retries: 3
+        start_period: 40s
+    labels:
+      - "caddy=marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 80}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.website.rule=Host(`marcpartensky.com`)"
+      - "traefik.http.routers.website.entrypoints=websecure"
+      - "traefik.http.routers.website.tls.certresolver=tls"
+      - "traefik.http.services.website.loadbalancer.server.port=80"
 
   postgres:
     image: postgres
@@ -222,11 +315,20 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
     networks:
       - discord
+    # labels:
+    #   - "caddy=api.docker.marcpartensky.com"
+    #   - "caddy.reverse_proxy={{upstreams 80}}"
+    #   - "traefik.enable=true"
+    #   - "traefik.http.routers.docker_api.rule=Host(`api.docker.marcpartensky.com`)"
+    #   - "traefik.http.routers.docker_api.entrypoints=websecure"
+    #   - "traefik.http.routers.docker_api.tls.certresolver=tls"
+    #   - "traefik.http.services.docker_api.loadbalancer.server.port=80"
 
   servant:
     image: marcpartensky/servitor
     restart: unless-stopped
 
+
   pandoc:
     image: marcpartensky/pandoc-api
     restart: unless-stopped
@@ -235,12 +337,21 @@ services:
       - ./data/secrets/pandoc.env
     entrypoint: "flask run --host pandoc --port 80"
     volumes:
-      - /srv/pandoc:/app
+      - /srv/pandoc:/app/files
       - /var/log/nginx:/var/log/nginx
+    labels:
+      - "caddy=pandoc.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 80}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.pandoc.rule=Host(`pandoc.marcpartensky.com`)"
+      - "traefik.http.routers.pandoc.entrypoints=websecure"
+      - "traefik.http.routers.pandoc.tls.certresolver=tls"
+      - "traefik.http.services.pandoc.loadbalancer.server.port=80"
     networks:
       - nginx
+      # - caddy
 
-  # https://github.com/itzg/docker-minecraft-server/blob/master/README.md
+  # https://~.com/itzg/docker-minecraft-server/blob/master/README.md
   # minecraft_aventure:
   #   image: itzg/minecraft-server
   #   restart: always
@@ -304,6 +415,17 @@ services:
       - JUPYTER_ENABLE_LAB=yes
       - GRANT_SUDO=yes
     entrypoint: start.sh jupyter lab --user root
+    networks:
+      # - caddy
+      - nginx
+    labels:
+      - "caddy=notebook.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 8888}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.notebook.rule=Host(`notebook.marcpartensky.com`)"
+      - "traefik.http.routers.notebook.entrypoints=websecure"
+      - "traefik.http.routers.notebook.tls.certresolver=tls"
+      - "traefik.http.services.notebook.loadbalancer.server.port=8888"
     # entrypoint: start-notebook.sh \
     #     --NotebookApp.keyfile=key/0000_key-certbot.pem
     #     --NotebookApp.certfile=cert/0000_csr-certbot.pem
@@ -363,7 +485,7 @@ services:
       # - FLASK_APP=/app/server.py
       # - FLASK_APP=/app/wsgi.py
     # env_file:
-      # - /root/git/ialab/.flaskenv
+      # - ~/git/ialab/.flaskenv
     # working_dir: /app
     entrypoint: flask run --host ialab --port 80
     # entrypoint: "gunicorn server:app"
@@ -371,7 +493,16 @@ services:
     volumes:
       - /srv/ialab:/app
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=ialab.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.ialab.rule=Host(`ialab.marcpartensky.com`)"
+      - "traefik.http.routers.ialab.entrypoints=websecure"
+      - "traefik.http.routers.ialab.tls.certresolver=tls"
+      - "traefik.http.services.ialab.loadbalancer.server.port=80"
 
   open_web_calendar:
     image: marcpartensky/open_web_calendar
@@ -381,8 +512,17 @@ services:
       - HOST=open_web_calendar
       - PORT=80
     networks:
+      # - caddy
       - nginx
     entrypoint: python app.py
+    labels:
+      - "caddy=calendar.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.open_web_calendar.rule=Host(`calendar.marcpartensky.com`)"
+      - "traefik.http.routers.open_web_calendar.entrypoints=websecure"
+      - "traefik.http.routers.open_web_calendar.tls.certresolver=tls"
+      - "traefik.http.services.open_web_calendar.loadbalancer.server.port=80"
 
   # discord_voice_recorder:
   #   image: drv
@@ -393,6 +533,7 @@ services:
     image: wordpress
     restart: unless-stopped
     networks:
+      # - caddy
       - nginx
       - wordpress
     env_file:
@@ -401,6 +542,14 @@ services:
       - /srv/wordpress:/var/www/html
     depends_on:
       - wordpress_mysql
+    labels:
+      - "caddy=wordpress.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.wordpress.rule=Host(`wordpress.marcpartensky.com`)"
+      - "traefik.http.routers.wordpress.entrypoints=websecure"
+      - "traefik.http.routers.wordpress.tls.certresolver=tls"
+      - "traefik.http.services.wordpress.loadbalancer.server.port=80"
 
   wordpress_mysql:
     image: mysql
@@ -408,6 +557,7 @@ services:
     env_file:
       - data/secrets/wordpress.env
     networks:
+      # - caddy
       - wordpress
     volumes:
       - /srv/wordpress_mysql:/var/lib/mysql
@@ -416,6 +566,7 @@ services:
     image: wordpress
     restart: unless-stopped
     networks:
+      # - caddy
       - nginx
       - business
     env_file:
@@ -424,6 +575,14 @@ services:
       - /srv/business:/var/www/html
     depends_on:
       - business_mysql
+    labels:
+      - "caddy=business.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.business.rule=Host(`business.marcpartensky.com`)"
+      - "traefik.http.routers.business.entrypoints=websecure"
+      - "traefik.http.routers.business.tls.certresolver=tls"
+      - "traefik.http.services.business.loadbalancer.server.port=80"
 
   business_mysql:
     image: mysql
@@ -431,6 +590,7 @@ services:
     env_file:
       - data/secrets/business.env
     networks:
+      # - caddy
       - business
     volumes:
       - /srv/business_mysql:/var/lib/mysql
@@ -444,10 +604,19 @@ services:
       - /srv/oxivia:/var/www/html
       - ./data/wordpress/uploads.ini:/usr/local/etc/php/conf.d/uploads.ini
     networks:
+      # - caddy
       - nginx
       - oxivia
     depends_on:
       - oxivia_mysql
+    labels:
+      - "caddy=oxivia.business.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.oxivia.rule=Host(`oxivia.business.marcpartensky.com`)"
+      - "traefik.http.routers.oxivia.entrypoints=websecure"
+      - "traefik.http.routers.oxivia.tls.certresolver=tls"
+      - "traefik.http.services.oxivia.loadbalancer.server.port=80"
 
   oxivia_mysql:
     image: mysql
@@ -459,8 +628,76 @@ services:
     volumes:
       - /srv/oxivia_mysql:/var/lib/mysql
     networks:
+      # - caddy
       - oxivia
 
+  wordpress_alex:
+    image: wordpress
+    restart: unless-stopped
+    networks:
+      # - caddy
+      - nginx
+      - wordpress_alex
+    env_file:
+      - data/secrets/wordpress_alex.env
+    volumes:
+      - /srv/wordpress_alex:/var/www/html
+    depends_on:
+      - wordpress_mysql_alex
+    labels:
+      - "caddy=alex.wp.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.wordpress_alex.rule=Host(`alex.wp.marcpartensky.com`)"
+      - "traefik.http.routers.wordpress_alex.entrypoints=websecure"
+      - "traefik.http.routers.wordpress_alex.tls.certresolver=tls"
+      - "traefik.http.services.wordpress_alex.loadbalancer.server.port=80"
+
+  wordpress_mysql_alex:
+    image: mysql
+    restart: unless-stopped
+    env_file:
+      - data/secrets/wordpress_alex.env
+    networks:
+      # - caddy
+      - wordpress_alex
+    volumes:
+      - /srv/wordpress_mysql_alex:/var/lib/mysql
+
+  wordpress_marc:
+    image: wordpress
+    restart: unless-stopped
+    networks:
+      # - caddy
+      - nginx
+      - wordpress_marc
+    env_file:
+      - data/secrets/wordpress_marc.env
+    volumes:
+      - /srv/wordpress_marc:/var/www/html
+    depends_on:
+      - wordpress_mysql_marc
+    labels:
+      - "caddy=marc.wp.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.wordpress_marc.rule=Host(`marc.wp.marcpartensky.com`)"
+      - "traefik.http.routers.wordpress_marc.entrypoints=websecure"
+      - "traefik.http.routers.wordpress_marc.tls.certresolver=tls"
+      - "traefik.http.services.wordpress_marc.loadbalancer.server.port=80"
+
+  wordpress_mysql_marc:
+    image: mysql
+    restart: unless-stopped
+    env_file:
+      - data/secrets/wordpress_marc.env
+    networks:
+      # - caddy
+      - wordpress_marc
+    volumes:
+      - /srv/wordpress_mysql_marc:/var/lib/mysql
+
+
   samba:
     image: dperson/samba
     restart: unless-stopped
@@ -474,7 +711,16 @@ services:
     image: plantuml/plantuml-server:tomcat
     restart: unless-stopped
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=plantuml.wp.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams http 8080}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.plantuml.rule=Host(`uml.marcpartensky.com`)"
+      - "traefik.http.routers.plantuml.entrypoints=websecure"
+      - "traefik.http.routers.plantuml.tls.certresolver=tls"
+      - "traefik.http.services.plantuml.loadbalancer.server.port=8080"
 
   nextcloud:
     image: nextcloud
@@ -484,10 +730,19 @@ services:
     env_file:
       - ./data/secrets/nextcloud.env
     networks:
+      # - caddy
       - nextcloud
       - nginx
     depends_on:
       - nextcloud_mariadb
+    labels:
+      - "caddy=cloud.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams http 80}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.nextcloud.rule=Host(`cloud.marcpartensky.com`)"
+      - "traefik.http.routers.nextcloud.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud.tls.certresolver=tls"
+      - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
 
   nextcloud_mariadb:
     image: mariadb
@@ -498,6 +753,7 @@ services:
     env_file:
       - ./data/secrets/nextcloud.env
     networks:
+      # - caddy
       - nextcloud
 
   searx:
@@ -509,7 +765,16 @@ services:
     #   - PORT=80
     #   - BASE_URL=http://localhost:$PORT
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=searx.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.searx.rule=Host(`searx.marcpartensky.com`)"
+      - "traefik.http.routers.searx.entrypoints=websecure"
+      - "traefik.http.routers.searx.tls.certresolver=tls"
+      - "traefik.http.services.searx.loadbalancer.server.port=80"
 
   todolist:
     image: marcpartensky/je-todoapp-react
@@ -520,22 +785,36 @@ services:
     depends_on:
       - todolist_api
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=todolist.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.todolist.rule=Host(`todolist.marcpartensky.com`)"
+      - "traefik.http.routers.todolist.entrypoints=websecure"
+      - "traefik.http.routers.todolist.tls.certresolver=tls"
+      - "traefik.http.services.todolist.loadbalancer.server.port=80"
     # entrypoint: ["/bin/sh", "-c", "'SPRING_API_URL=https://api.todolist.marcpartensky.com serve -s build'"]
 
   todolist_api:
     image: marcpartensky/je-todoapp-spring-api
     restart: unless-stopped
-    env_file:
-      - ./data/secrets/todolist.env
-    environment:
-      - PORT=80
       - POSTGRES_HOST=todolist_db
     depends_on:
       - todolist_db
     networks:
+      # - caddy
       - todolist_api
       - nginx
+    labels:
+      - "caddy=api.todolist.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams http 8080}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.todolist_api.rule=Host(`api.todolist.marcpartensky.com`)"
+      - "traefik.http.routers.todolist_api.entrypoints=websecure"
+      - "traefik.http.routers.todolist_api.tls.certresolver=tls"
+      - "traefik.http.services.todolist_api.loadbalancer.server.port=8080"
 
   todolist_db:
     image: postgres
@@ -545,6 +824,7 @@ services:
     env_file:
       - ./data/secrets/todolist.env
     networks:
+      # - caddy
       - todolist_api
 
   openvpn:
@@ -557,6 +837,7 @@ services:
     volumes:
       - /srv/openvpn:/etc/openvpn
     networks:
+      # - caddy
       - nginx
       - nextcloud
       - website
@@ -574,6 +855,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - ~/.docker/config.json:/config.json
     networks:
+      # - caddy
       - nginx
     command: --interval 10 --http-api-metrics --http-api-token demotoken --debug docker_prometheus_1 docker_grafana_1
 
@@ -587,7 +869,16 @@ services:
     #   - "9090:9090"
     user: root
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=prometheus.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 9090}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.prometheus.rule=Host(`prometheus.marcpartensky.com`)"
+      - "traefik.http.routers.prometheus.entrypoints=websecure"
+      - "traefik.http.routers.prometheus.tls.certresolver=tls"
+      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
 
   grafana:
     image: grafana/grafana
@@ -601,7 +892,16 @@ services:
       - ./data/grafana:/etc/grafana/provisioning
       - /srv/grafana:/var/lib/grafana
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=grafana.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 3000}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.grafana.rule=Host(`grafana.marcpartensky.com`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls.certresolver=tls"
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
 
   gitea:
     image: gitea/gitea:1.14.1
@@ -614,17 +914,26 @@ services:
     env_file:
       - ./data/secrets/gitea.env
     networks:
+      # - caddy
       - gitea
       - nginx
     volumes:
       - /home/git/.ssh/:/data/git/.ssh
-      # - /srv/gitea:/data
+      - /srv/gitea:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
       - "7012:22"
     depends_on:
       - gitea_postgres
+    labels:
+      - "caddy=git.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 3000}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.gitea.rule=Host(`git.marcpartensky.com`)"
+      - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.tls.certresolver=tls"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
   gitea_postgres:
     image: postgres
@@ -632,25 +941,42 @@ services:
     env_file:
       - ./data/secrets/gitea.env
     networks:
+      # - caddy
       - gitea
     volumes:
       - /srv/gitea_postgres:/var/lib/postgresql/data
 
   archlinux:
     image: archlinux
+    user: root
     restart: unless-stopped
     stdin_open: true
     tty: true
     volumes:
       - /srv/archlinux:/root
 
+  poiret:
+    image: poiret
+    restart: unless-stopped
+    networks:
+      # - caddy
+      - nginx
+    labels:
+      - "caddy=poiret.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams http 8000}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.poiret.rule=Host(`poiret.marcpartensky.com`)"
+      - "traefik.http.routers.poiret.entrypoints=websecure"
+      - "traefik.http.routers.poiret.tls.certresolver=tls"
+      - "traefik.http.services.poiret.loadbalancer.server.port=8000"
+
   windows:
     image: mcr.microsoft.com/windows:1903
     restart: unless-stopped
     stdin_open: true
     tty: true
     volumes:
-      - /srv/windows:/root
+      - /srv/windows:~
 
   healingpath:
     image: marcpartensky/brainperformer
@@ -658,25 +984,38 @@ services:
     # user: healingpath
     env_file: ./data/secrets/healingpath.env
     networks:
+      # - caddy
       - healingpath
       - nginx
     depends_on:
       - healingpath_db
+    labels:
+      - "caddy=healingpath.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.healingpath.rule=Host(`healingpath.marcpartensky.com`)"
+      - "traefik.http.routers.healingpath.entrypoints=websecure"
+      - "traefik.http.routers.healingpath.tls.certresolver=tls"
+      - "traefik.http.services.healingpath.loadbalancer.server.port=80"
 
   healingpath_db:
     image: mysql
     restart: unless-stopped
     # user: healingpath
     env_file: ./data/secrets/healingpath.env
+    ports:
+      - "8006:3306"
     volumes:
       - /srv/healingpath/db:/var/lib/mysql
     networks:
+      # - caddy
       - healingpath
 
   # jenkins_docker:
   #   image: docker:dind
   #   privileged: true
   #   networks:
+      # # - caddy
   #     - jenkins
   #   environment:
   #     DOCKER_TLS_CERTDIR: certs
@@ -698,31 +1037,212 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - /usr/bin/docker:/usr/bin/docker
     networks:
+      # - caddy
       - nginx
+    labels:
+      - "caddy=jenkins.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 8000}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.jenkins.rule=Host(`jenkins.marcpartensky.com`)"
+      - "traefik.http.routers.jenkins.entrypoints=websecure"
+      - "traefik.http.routers.jenkins.tls.certresolver=tls"
+      - "traefik.http.services.jenkins.loadbalancer.server.port=8000"
 
   tmate:
     image: tmate/tmate-ssh-server
     ports:
       - "7027:22"
     volumes:
-      - ~/.ssh:/root/.ssh:ro
+      - ~/.ssh:~/.ssh:ro
     environment:
       SSH_KEYS_PATH: ~/.ssh
       SSH_HOSTNAME: marcpartensky.com
       SSH_PORT_LISTEN: 22
 
+  vnc:
+    image: consol/centos-xfce-vnc
+    ports:
+      - "5901:5901"
+      # - "6901:6901"
+    # user: root
+    env_file:
+      - "./data/secrets/vnc.env"
+    volumes:
+      - ~:/root
+      # - /usr/bin:/usr/bin
+      # - /usr/local/bin:/usr/local/bin
+    networks:
+      # - caddy
+      - nginx
+    labels:
+      - "caddy=vnc.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 6901}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.vnc.rule=Host(`vnc.marcpartensky.com`)"
+      - "traefik.http.routers.vnc.entrypoints=websecure"
+      - "traefik.http.routers.vnc.tls.certresolver=tls"
+      - "traefik.http.services.vnc.loadbalancer.server.port=6901"
+
+  pihole:
+    image: pihole/pihole:latest
+    restart: unless-stopped
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "67:67/udp"
+      # - "80:80/tcp"
+    environment:
+      TZ: 'France/Paris'
+      # WEBPASSWORD: 'set a secure password here or it will be random'
+    # Volumes store your data between container upgrades
+    volumes:
+      - /srv/pihole/etc-pihole/:/etc/pihole/
+      - /srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/
+    # Recommended but not required (DHCP needs NET_ADMIN)
+    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
+    cap_add:
+      - NET_ADMIN
+    # networks:
+      # - caddy
+    labels:
+      - "caddy=dns.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.pihole.rule=Host(`dns.marcpartensky.com`)"
+      - "traefik.http.routers.pihole.entrypoints=websecure"
+      - "traefik.http.routers.pihole.tls.certresolver=tls"
+      - "traefik.http.services.pihole.loadbalancer.server.port=80"
+
+  smtp:
+    image: namshi/smtp
+    # container_name: smtp_relay
+    restart: unless-stopped
+    ports:
+     - "25:25"
+    # environment:
+      # - MAILNAME="marcpartensky.com"
+      # - GMAIL_USER="contact"
+      # - GMAIL_PASSWORD="contact"
+
+  schtroumpfix:
+    restart: unless-stopped
+    image: marcpartensky/schtroumpfix
+      # dockerfile: ~/git/schtroumpfix/Dockerfile
+    env_file:
+      - data/secrets/schtroumpfix.env
+    environment:
+      - PORT=80
+    networks:
+      # - caddy
+      - nginx
+      # - traefik
+    labels:
+      - "caddy=schtroumpfix.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.schtroupmfix.rule=Host(`schtroumpfix.marcpartensky.com`)"
+      - "traefik.http.routers.schtroupmfix.entrypoints=websecure"
+      - "traefik.http.routers.schtroupmfix.tls.certresolver=tls"
+      - "traefik.http.services.schtroupmfix.loadbalancer.server.port=80"
+
+  fake-smtp:
+    restart: unless-stopped
+    image: mailhog/mailhog
+    networks:
+      # - caddy
+      - nginx
+    ports:
+      - "1025:1025"
+    labels:
+      - "caddy=mail.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams 8025}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.mail.rule=Host(`mail.marcpartensky.com`)"
+      - "traefik.http.routers.mail.entrypoints=websecure"
+      - "traefik.http.routers.mail.tls.certresolver=tls"
+      - "traefik.http.services.mail.loadbalancer.server.port=8025"
+
+  samy:
+    restart: unless-stopped
+    image: marcpartensky/samy.github.io
+    networks:
+      # - caddy
+      - nginx
+    labels:
+      - "caddy=samy.marcpartensky.com"
+      - "caddy.reverse_proxy={{upstreams http 80}}"
+      - "traefik.enable=true"
+      - "traefik.http.routers.samy.rule=Host(`samy.marcpartensky.com`)"
+      - "traefik.http.routers.samy.entrypoints=websecure"
+      - "traefik.http.routers.samy.tls.certresolver=tls"
+      - "traefik.http.services.samy.loadbalancer.server.port=80"
+
+
+  mailserver:
+    image: docker.io/mailserver/docker-mailserver:latest
+    hostname: mail
+    domainname: marcpartensky.com
+    restart: unless-stopped
+    ports:
+      - "25:25"
+      - "143:143"
+      - "587:587"
+      - "993:993"
+    volumes:
+      - /srv/mailserver/maildata:/var/mail
+      - /srv/mailserver/mailstate:/var/mail-state
+      - /srv/mailserver/maillogs:/var/log/mail
+      - /srv/mailserver/config/:/tmp/docker-mailserver/
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      - ENABLE_SPAMASSASSIN=1
+      - SPAMASSASSIN_SPAM_TO_INBOX=1
+      - ENABLE_CLAMAV=1
+      - ENABLE_FAIL2BAN=1
+      - ENABLE_POSTGREY=1
+      - ONE_DIR=1
+      - DMS_DEBUG=0
+      - ENABLE_LDAP=1
+      - LDAP_SERVER_HOST=ldap # your ldap container/IP/ServerName
+      - LDAP_SEARCH_BASE=ou=people,dc=localhost,dc=localdomain
+      - LDAP_BIND_DN=cn=admin,dc=localhost,dc=localdomain
+      - LDAP_BIND_PW=admin
+      - LDAP_QUERY_FILTER_USER=(&(mail=%s)(mailEnabled=TRUE))
+      - LDAP_QUERY_FILTER_GROUP=(&(mailGroupMember=%s)(mailEnabled=TRUE))
+      - LDAP_QUERY_FILTER_ALIAS=(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))
+      - LDAP_QUERY_FILTER_DOMAIN=(|(&(mail=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailGroupMember=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailalias=*@%s)(objectClass=PostfixBookMailForward)))
+      - DOVECOT_PASS_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))
+      - DOVECOT_USER_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))
+      - ENABLE_SASLAUTHD=1
+      - SASLAUTHD_MECHANISMS=ldap
+      - SASLAUTHD_LDAP_SERVER=ldap
+      - SASLAUTHD_LDAP_BIND_DN=cn=admin,dc=localhost,dc=localdomain
+      - SASLAUTHD_LDAP_PASSWORD=admin
+      - SASLAUTHD_LDAP_SEARCH_BASE=ou=people,dc=localhost,dc=localdomain
+      - SASLAUTHD_LDAP_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%U))
+      - POSTMASTER_ADDRESS=postmaster@localhost.localdomain
+      - POSTFIX_MESSAGE_SIZE_LIMIT=100000000
+    cap_add:
+      - NET_ADMIN
+      - SYS_PTRACE
+
+
 volumes:
   letsencrypt:
   nextcloud:
   nextcloud_mariadb:
 
 networks:
+  caddy:
+    external: true
   healingpath:
   nextcloud:
   website:
   nginx:
   wordpress:
   business:
+  wordpress_alex:
+  wordpress_marc:
   gitea:
   elk:
   box: