tga/ignition-pi4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adds firefly and homebox, replaces nginx-proxy/acme-companion with acme

Browse Source
This commit is contained in:
tga
2026-08-15 20:08:35 +02:00
parent 7e87a6cbb9
commit c8af74ad7d
38 changed files with 596 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/install-additional-packages.service
+1 -1
View File
@@ -14,7 +14,7 @@ RemainAfterExit=yes
# if the package is already installed. This is useful if the package is # if the package is already installed. This is useful if the package is
# added to the root image in a future Fedora CoreOS release as it will # added to the root image in a future Fedora CoreOS release as it will
# prevent the service from failing. # prevent the service from failing.
ExecStart=/usr/bin/rpm-ostree install -y --allow-inactive firewalld fail2ban fail2ban-firewalld setroubleshoot-server setools smartmontools ExecStart=/usr/bin/rpm-ostree install -y --allow-inactive firewalld fail2ban fail2ban-firewalld setroubleshoot-server setools smartmontools udisks2
ExecStart=/bin/touch /var/lib/additional-packages.stamp ExecStart=/bin/touch /var/lib/additional-packages.stamp
ExecStart=/bin/usermod -aG dialout homeassistant ExecStart=/bin/usermod -aG dialout homeassistant
ExecStart=/bin/systemctl enable configure-firewalld.service enable-all-quadlets.service move-downloads-nextcloud.timer copy-music.timer defragment-nas.timer scrub-nas.timer ExecStart=/bin/systemctl enable configure-firewalld.service enable-all-quadlets.service move-downloads-nextcloud.timer copy-music.timer defragment-nas.timer scrub-nas.timer
generate-config
+1 -1
View File
@@ -41,7 +41,7 @@ files_template="
files: files:
- path: /var/lib/systemd/linger/__USER__ - path: /var/lib/systemd/linger/__USER__
mode: 0644" mode: 0644"
users=('arr' 'gitea' 'homeassistant' 'immich' 'jdownloader' 'kiwix' 'komga' 'navidrome' 'nextcloud' 'nexus' 'nginx' 'overleaf' 'pairdrop' 'paperless' 'pihole' 'qbittorrent' 'synapse' 'tga' 'vikunja' 'wallabag') users=('arr' 'gitea' 'homeassistant' 'homebox' 'immich' 'firefly' 'jdownloader' 'kiwix' 'komga' 'navidrome' 'nextcloud' 'nexus' 'nginx' 'overleaf' 'pairdrop' 'paperless' 'pihole' 'qbittorrent' 'synapse' 'tga' 'vikunja' 'wallabag')
mkdir -p users mkdir -p users
for user in "${users[@]}"; do for user in "${users[@]}"; do
echo "Generating ${user}" echo "Generating ${user}"
home/firefly/.secrets
+7
View File
@@ -0,0 +1,7 @@
app-key=8d26b9UVzNGWRo66EmLRR21NPCmNENtn
auto-import=F7L2xAS4ysJT8nzh
cron-token=dO1TcxzYxxZ2sVMVXZqytNLQ6DGMY6WU
database-password=1B81gQEZ3qI4dry3Zh3X13NrTAwb0zsu
passport-private-key=IwZB3Yx9WuuMp9wlqnGielWnrwRfyO1b
passport-public-key=20NeELcOlmlSevBv90IAWOBHQjcE3Vt4
redis-password=vKlxKQFDp47cLr9cwpsqZHMP6bPZgXQR
home/homebox/.secrets
+2
View File
@@ -0,0 +1,2 @@
database-password=A33zI2pqP22MnRiAiCD5F13YEQFeljKk
homebox-pepper=BWoYfQ1GT/t9PLZTAftkxjVV5GzpEoY7i+lyECwLf8OtzMmXGqTbVmFklwtNx8y+
home/tga/dyndns
+6 -4
View File
@@ -2,12 +2,14 @@
set -o errexit -o pipefail -o noclobber -o nounset -o errtrace -o functrace set -o errexit -o pipefail -o noclobber -o nounset -o errtrace -o functrace
update_url=https://infomaniak.com/nic/update update_url=https://infomaniak.com/nic/update
subdomains=(git home komga mail matrix mealie navidrome nextcloud nexus odoo paperless photos pihole torrent wallabag) subdomains=(finance git home homebox import.finance komga mail matrix mealie navidrome nextcloud nexus odoo overleaf paperless photos pihole tasks torrent wallabag wiki zigbee)
data_file="${HOME}/.dyndns" data_file="${HOME}/.dyndns"
file="${HOME}/tmp_data.txt" file="${HOME}/tmp_data.txt"
for subdomain in "${subdomains[@]}"; do for subdomain in "${subdomains[@]}"; do
sed "s/gtache.ch/${subdomain}.gtache.ch/" "${data_file}" >| "${file}" sed -e "s/gtache.ch/${subdomain}.gtache.ch/" "${data_file}" >| "${file}"
curl -d "@${file}" -X POST "${update_url}" curl -4 -d "@${file}" -X POST "${update_url}"
curl -6 -d "@${file}" -X POST "${update_url}"
done done
curl -4 -d "@${data_file}" -X POST "${update_url}"
curl -6 -d "@${data_file}" -X POST "${update_url}"
rm -f "${file}" rm -f "${file}"
curl -d "@${data_file}" -X POST "${update_url}"
init/enable-all-quadlets
+5 -1
View File
@@ -6,7 +6,7 @@ setsebool -P openvpn_run_unconfined on
semanage fcontext -a -t container_file_t "/mnt/nas(/.*)?" semanage fcontext -a -t container_file_t "/mnt/nas(/.*)?"
restorecon -vR /mnt/nas restorecon -vR /mnt/nas
users=("gitea" "homeassistant" "immich" "jdownloader" "kiwix" "komga" "navidrome" "nextcloud" "nginx" "overleaf" "pairdrop" "paperless" "pihole" "qbittorrent" "synapse" "wallabag") users=("firefly" "gitea" "homeassistant" "homebox" "immich" "firefly" "jdownloader" "kiwix" "komga" "navidrome" "nextcloud" "nexus" "nginx" "overleaf" "pairdrop" "paperless" "pihole" "qbittorrent" "synapse" "vikunja" "wallabag")
for user in "${users[@]}"; do for user in "${users[@]}"; do
chown -R "${user}:${user}" "/var/home/${user}" chown -R "${user}:${user}" "/var/home/${user}"
secrets_file="/var/home/${user}/.secrets" secrets_file="/var/home/${user}/.secrets"
@@ -29,11 +29,15 @@ systemctl --user -M "nextcloud@" enable "pre-generate-preview.timer"
systemctl --user -M "pihole@" enable "update-hints.timer" systemctl --user -M "pihole@" enable "update-hints.timer"
systemctl --user -M "pihole@" enable "update-root.timer" systemctl --user -M "pihole@" enable "update-root.timer"
systemctl --user -M "firefly@" enable "backup-database.timer"
systemctl --user -M "gitea@" enable "backup-database.timer" systemctl --user -M "gitea@" enable "backup-database.timer"
systemctl --user -M "homebox@" enable "backup-database.timer"
systemctl --user -M "immich@" enable "backup-database.timer" systemctl --user -M "immich@" enable "backup-database.timer"
systemctl --user -M "nextcloud@" enable "backup-database.timer" systemctl --user -M "nextcloud@" enable "backup-database.timer"
systemctl --user -M "nexus@" enable "backup-database.timer"
systemctl --user -M "paperless@" enable "backup-database.timer" systemctl --user -M "paperless@" enable "backup-database.timer"
systemctl --user -M "synapse@" enable "backup-database.timer" systemctl --user -M "synapse@" enable "backup-database.timer"
systemctl --user -M "vikunja@" enable "backup-database.timer"
systemctl --user -M "wallabag@" enable "backup-database.timer" systemctl --user -M "wallabag@" enable "backup-database.timer"
systemctl enable --now "podman-auto-update.timer" || true systemctl enable --now "podman-auto-update.timer" || true
pi4.bu
+7
View File
@@ -4,8 +4,10 @@ ignition:
config: config:
merge: merge:
- local: users/arr.ign - local: users/arr.ign
- local: users/firefly.ign
- local: users/gitea.ign - local: users/gitea.ign
- local: users/homeassistant.ign - local: users/homeassistant.ign
- local: users/homebox.ign
- local: users/immich.ign - local: users/immich.ign
- local: users/jdownloader.ign - local: users/jdownloader.ign
- local: users/kiwix.ign - local: users/kiwix.ign
@@ -141,6 +143,11 @@ storage:
mode: 0644 mode: 0644
contents: contents:
local: files/jail.local local: files/jail.local
- path: /etc/systemd/zram-generator.conf
mode: 0644
contents:
inline: |
[zram0]
systemd: systemd:
units: units:
- name: fstrim.timer - name: fstrim.timer
quadlets/firefly/firefly-cron.container
+105
View File
@@ -0,0 +1,105 @@
[Unit]
Description=FireFly III cron container
After=firefly.container
Requires=firefly.container
[Container]
AutoUpdate=registry
Command=sh -c "apk add tzdata && \
(ln -s /usr/share/zoneinfo/$$TZ /etc/localtime || true) && \
echo \"0 3 * * * wget -qO- http://app:8080/api/v1/cron/$$STATIC_CRON_TOKEN;echo\" \
| crontab - && \
crond -f -L /dev/stdout"
ContainerName=firefly-cron
Environment=APP_DEBUG=false
Environment=APP_ENV=production
Environment=APP_LOG_LEVEL=notice
Environment=APP_NAME=FireflyIII
Environment=APP_URL=https://finance.gtache.ch
Environment=AUDIT_LOG_CHANNEL=
Environment=AUDIT_LOG_LEVEL=emergency
Environment=AUTHENTICATION_GUARD=web
Environment=AUTHENTICATION_GUARD_EMAIL=
Environment=AUTHENTICATION_GUARD_HEADER=REMOTE_USER
Environment=BROADCAST_DRIVER=log
Environment=CACHE_DRIVER=redis
Environment=CACHE_PREFIX=firefly
Environment=COOKIE_DOMAIN=
Environment=COOKIE_PATH="/"
Environment=COOKIE_SAMESITE=lax
Environment=COOKIE_SECURE=false
Environment=CUSTOM_LOGOUT_URL=
Environment=DB_CONNECTION=pgsql
Environment=DB_DATABASE=firefly
Environment=DB_HOST=firefly-database
Environment=DB_PORT=5432
Environment=DB_SOCKET=
Environment=DB_USERNAME=firefly
Environment=DKR_CHECK_SQLITE=false
Environment=DEFAULT_LANGUAGE=en_US
Environment=DEFAULT_LOCALE=equal
Environment=DEMO_PASSWORD=
Environment=DEMO_USERNAME=
Environment=DISABLE_CSP_HEADER=false
Environment=DISABLE_FRAME_HEADER=false
Environment=FIREFLY_III_LAYOUT=v1
Environment=IPINFO_TOKEN=
Environment=LOG_CHANNEL=stack
Environment=MAIL_ALLOW_SELF_SIGNED=false
Environment=MAIL_ENCRYPTION=null
Environment=MAIL_FROM=guillaume@gtache.ch
Environment=MAIL_HOST=null
Environment=MAIL_MAILER=log
Environment=MAIL_PASSWORD=null
Environment=MAIL_PORT=2525
Environment=MAIL_SENDMAIL_COMMAND=
Environment=MAIL_USERNAME=null
Environment=MAIL_VERIFY_PEER=true
Environment=MAIL_VERIFY_PEER_NAME=true
Environment=MAILERSEND_API_KEY=
Environment=MAILGUN_DOMAIN=
Environment=MAILGUN_ENDPOINT=api.eu.mailgun.net
Environment=MAILGUN_SECRET=
Environment=MANDRILL_SECRET=
Environment=MAP_DEFAULT_LAT=46.593555
Environment=MAP_DEFAULT_LONG=6.834227
Environment=MAP_DEFAULT_ZOOM=6
Environment=PAPERTRAIL_HOST=
Environment=PAPERTRAIL_PORT=
Environment=PGSQL_SCHEMA=public
Environment=PGSQL_SSL_CERT=null
Environment=PGSQL_SSL_CRL_FILE=null
Environment=PGSQL_SSL_KEY=null
Environment=PGSQL_SSL_MODE=prefer
Environment=PGSQL_SSL_ROOT_CERT=null
Environment=PUSHER_ID=
Environment=PUSHER_KEY=
Environment=PUSHER_SECRET=
Environment=QUEUE_DRIVER=sync
Environment=REDIS_CACHE_DB="1"
Environment=REDIS_DB="0"
Environment=REDIS_HOST=firefly-redis
Environment=REDIS_PATH=
Environment=REDIS_PORT=6379
Environment=REDIS_SCHEME=tcp
Environment=REDIS_USERNAME=firefly
Environment=SEND_ERROR_MESSAGE=true
Environment=SESSION_DRIVER=file
Environment=SITE_OWNER=guillaume@gtache.ch
Environment=SPARKPOST_SECRET=
Environment=TRACKER_SITE_ID=
Environment=TRACKER_URL=
Environment=TRUSTED_PROXIES=*
Environment=TZ=Europe/Zurich
Image=docker.io/alpine:latest
Label=io.containers.autoupdate=registry
Pod=firefly.pod
Secret=database-password,type=env,target=DB_PASSWORD
StartWithPod=true
Timezone=Europe/Zurich
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/firefly/firefly-database.container
+27
View File
@@ -0,0 +1,27 @@
[Unit]
Description=FireFly III database container
[Container]
AutoUpdate=registry
ContainerName=firefly-database
Environment=POSTGRES_USER=firefly
Environment=POSTGRES_DB=firefly
Environment=TZ=Europe/Zurich
HealthCmd=pg_isready -U firefly
HealthInterval=30s
HealthTimeout=10s
HealthRetries=5
Image=docker.io/postgres:18
Label=io.containers.autoupdate=registry
Pod=firefly.pod
Secret=database-password,type=env,target=POSTGRES_PASSWORD
StartWithPod=true
Timezone=Europe/Zurich
Volume=firefly-database.volume:/var/lib/postgresql
Volume=/var/mnt/nas/containers/firefly/storage/database-backup:/backup
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/firefly/firefly-database.volume
+2
View File
@@ -0,0 +1,2 @@
[Volume]
VolumeName=firefly-database
quadlets/firefly/firefly-importer.container
+113
View File
@@ -0,0 +1,113 @@
[Unit]
Description=FireFly III container
After=firefly.container
Requires=firefly.container
[Container]
AutoUpdate=registry
ContainerName=firefly-importer
Environment=APP_DEBUG=false
Environment=APP_ENV=local
Environment=APP_NAME=DataImporter
Environment=APP_URL=http://localhost
Environment=ASSET_URL=
Environment=BROADCAST_DRIVER=log
Environment=CACHE_DRIVER=file
Environment=CAN_POST_AUTOIMPORT=false
Environment=CAN_POST_FILES=false
Environment=CONNECTION_TIMEOUT=31.41
Environment=ENABLE_BANKING_APP_ID=
Environment=ENABLE_BANKING_IMPORT_IP=autodetect
Environment=ENABLE_BANKING_IMPORT_IP_HEADER=false
Environment=ENABLE_BANKING_PRIVATE_KEY=
Environment=ENABLE_MAIL_REPORT=false
Environment=EXPECT_SECURE_URL=false
Environment=FAKE_DATA=false
Environment=FALLBACK_IN_DIR=false
Environment=FALLBACK_LOCALE=fr_CH
Environment=FCGI_CONNECT=localhost:9001
Environment=FIREFLY_III_ACCESS_TOKEN=
Environment=FIREFLY_III_CLIENT_ID=
Environment=FIREFLY_III_URL=http://firefly:8080
Environment=GOCARDLESS_GET_ACCOUNT_DETAILS=false
Environment=GOCARDLESS_GET_BALANCE_DETAILS=false
Environment=IGNORE_DUPLICATE_ERRORS=false
Environment=IGNORE_NOT_FOUND_TRANSACTIONS=false
Environment=IMPORT_DIR_ALLOWLIST=
Environment=IS_EXTERNAL=false
Environment=JSON_CONFIGURATION_DIR=
Environment=LOG_CHANNEL=stack
Environment=LOG_LEVEL=notice
Environment=LOG_RETURN_JSON=false
Environment=LUNCH_FLOW_API_KEY=
Environment=LUNCH_FLOW_API_URL=https://lunchflow.app/api/v1/
Environment=MAIL_DESTINATION=guillaume@gtache.ch
Environment=MAIL_ENCRYPTION=null
Environment=MAIL_FROM_ADDRESS=guillaume@gtache.ch
Environment=MAIL_HOST=
Environment=MAIL_MAILER=
Environment=MAIL_PASSWORD=
Environment=MAIL_PORT=2525
Environment=MAIL_USERNAME=
Environment=MAILGUN_DOMAIN=
Environment=MAILGUN_ENDPOINT=
Environment=MAILGUN_SECRET=
Environment=NGINX_HTTP_PORT=8081
Environment=NGINX_HTTPS_PORT=8444
Environment=NORDIGEN_ID=
Environment=NORDIGEN_KEY=
Environment=NORDIGEN_SANDBOX=false
Environment=POSTMARK_TOKEN=
Environment=QUEUE_CONNECTION=sync
Environment=REDIS_CACHE_DB="1"
Environment=REDIS_DB="0"
Environment=REDIS_HOST=127.0.0.1
Environment=REDIS_PASSWORD=null
Environment=REDIS_PORT=6379
Environment=RESPOND_TO_GOCARDLESS_LIMIT=wait
Environment=SESSION_DRIVER=file
Environment=SESSION_LIFETIME=120
Environment=SIMPLEFIN_AUTO_CREATE_EXPENSE_ACCOUNTS=true
Environment=SIMPLEFIN_CACHE_DURATION=3600
Environment=SIMPLEFIN_CLUSTERING_SIMILARITY_THRESHOLD=0.7
Environment=SIMPLEFIN_CONNECTION_TIMEOUT=30
Environment=SIMPLEFIN_DEFAULT_DATE_RANGE=90
Environment=SIMPLEFIN_DEMO_TOKEN=
Environment=SIMPLEFIN_DEMO_URL=
Environment=SIMPLEFIN_ENABLE_CACHING=true
Environment=SIMPLEFIN_ENABLE_TRANSACTION_CLUSTERING=true
Environment=SIMPLEFIN_EXPENSE_MATCHING_THRESHOLD=0.7
Environment=SIMPLEFIN_MAX_TRANSACTIONS=10000
Environment=SIMPLEFIN_REQUEST_TIMEOUT=60
Environment=SIMPLEFIN_RETRY_ATTEMPTS=3
Environment=SIMPLEFIN_RETRY_DELAY=
Environment=SIMPLEFIN_SMART_EXPENSE_MATCHING=true
Environment=SIMPLEFIN_TOKEN=
Environment=SOPHTRON_ACCESS_KEY=
Environment=SOPHTRON_SANDBOX=false
Environment=SOPHTRON_USER_ID=
Environment=SPECTRE_APP_ID=
Environment=SPECTRE_SECRET=
Environment=TRACKER_SITE_ID=
Environment=TRACKER_URL=
Environment=TRUSTED_PROXIES=*
Environment=TZ=Europe/Zurich
Environment=USE_CACHE=true
Environment=VANITY_URL=https://finance.gtache.ch
Environment=VERIFY_TLS_SECURITY=true
Image=docker.io/fireflyiii/data-importer:latest
Label=io.containers.autoupdate=registry
Pod=firefly.pod
Secret=auto-import,type=env,target=AUTO_IMPORT_SECRET
StartWithPod=true
Timezone=Europe/Zurich
Volume=firefly-upload.volume:/var/www/html/storage/upload
Volume=/var/mnt/nas/containers/firefly/storage/importer.http.conf.template:/etc/nginx/site-opts.d/http.conf.template
Volume=/var/mnt/nas/containers/firefly/storage/importer.https.conf.template:/etc/nginx/site-opts.d/https.conf.template
Volume=/var/mnt/nas/containers/firefly/storage/importer.www.conf:/usr/local/etc/php-fpm.d/docker-php-serversideup-pool.conf
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/firefly/firefly-redis-config.volume
+7
View File
@@ -0,0 +1,7 @@
[Volume]
Copy=true
Device=/var/mnt/nas/containers/firefly/storage/redis-config
Driver=local
Options=bind
Type=none
VolumeName=firefly-redis-config
quadlets/firefly/firefly-redis-data.volume
+2
View File
@@ -0,0 +1,2 @@
[Volume]
VolumeName=firefly-redis-data
quadlets/firefly/firefly-redis.container
+22
View File
@@ -0,0 +1,22 @@
[Unit]
Description=FireFly III Redis container
[Container]
AutoUpdate=registry
ContainerName=firefly-redis
Environment=TZ=Europe/Zurich
Exec=/bin/sh -c 'redis-server --appendonly yes --requirepass $${REDIS_PASSWORD}'
Image=docker.io/redis:alpine
Label=io.containers.autoupdate=registry
Pod=firefly.pod
Secret=redis-password,type=env,target=REDIS_PASSWORD
StartWithPod=true
Timezone=Europe/Zurich
Volume=firefly-redis-config.volume:/usr/local/etc/redis
Volume=firefly-redis-data.volume:/data
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/firefly/firefly-upload.volume
+7
View File
@@ -0,0 +1,7 @@
[Volume]
Copy=true
Device=/var/mnt/nas/containers/firefly/storage/upload
Driver=local
Options=bind
Type=none
VolumeName=firefly-upload
quadlets/firefly/firefly.container
+108
View File
@@ -0,0 +1,108 @@
[Unit]
Description=FireFly III container
After=firefly-database.container
Requires=firefly-database.container
After=firefly-redis.container
Requires=firefly-redis.container
[Container]
AutoUpdate=registry
ContainerName=firefly
Environment=APP_DEBUG=false
Environment=APP_ENV=production
Environment=APP_LOG_LEVEL=notice
Environment=APP_NAME=FireflyIII
Environment=APP_URL=https://finance.gtache.ch
Environment=AUDIT_LOG_CHANNEL=
Environment=AUDIT_LOG_LEVEL=emergency
Environment=AUTHENTICATION_GUARD=web
Environment=AUTHENTICATION_GUARD_EMAIL=
Environment=AUTHENTICATION_GUARD_HEADER=REMOTE_USER
Environment=BROADCAST_DRIVER=log
Environment=CACHE_DRIVER=redis
Environment=CACHE_PREFIX=firefly
Environment=COOKIE_DOMAIN=
Environment=COOKIE_PATH="/"
Environment=COOKIE_SAMESITE=lax
Environment=COOKIE_SECURE=false
Environment=CUSTOM_LOGOUT_URL=
Environment=DB_CONNECTION=pgsql
Environment=DB_DATABASE=firefly
Environment=DB_HOST=firefly-database
Environment=DB_PORT=5432
Environment=DB_SOCKET=
Environment=DB_USERNAME=firefly
Environment=DKR_CHECK_SQLITE=false
Environment=DEFAULT_LANGUAGE=en_US
Environment=DEFAULT_LOCALE=equal
Environment=DEMO_PASSWORD=
Environment=DEMO_USERNAME=
Environment=DISABLE_CSP_HEADER=false
Environment=DISABLE_FRAME_HEADER=false
Environment=FIREFLY_III_LAYOUT=v1
Environment=IPINFO_TOKEN=
Environment=LOG_CHANNEL=stack
Environment=MAIL_ALLOW_SELF_SIGNED=false
Environment=MAIL_ENCRYPTION=null
Environment=MAIL_FROM=guillaume@gtache.ch
Environment=MAIL_HOST=null
Environment=MAIL_MAILER=log
Environment=MAIL_PASSWORD=null
Environment=MAIL_PORT=2525
Environment=MAIL_SENDMAIL_COMMAND=
Environment=MAIL_USERNAME=null
Environment=MAIL_VERIFY_PEER=true
Environment=MAIL_VERIFY_PEER_NAME=true
Environment=MAILERSEND_API_KEY=
Environment=MAILGUN_DOMAIN=
Environment=MAILGUN_ENDPOINT=api.eu.mailgun.net
Environment=MAILGUN_SECRET=
Environment=MANDRILL_SECRET=
Environment=MAP_DEFAULT_LAT=46.593555
Environment=MAP_DEFAULT_LONG=6.834227
Environment=MAP_DEFAULT_ZOOM=6
Environment=PAPERTRAIL_HOST=
Environment=PAPERTRAIL_PORT=
Environment=PGSQL_SCHEMA=public
Environment=PGSQL_SSL_CERT=null
Environment=PGSQL_SSL_CRL_FILE=null
Environment=PGSQL_SSL_KEY=null
Environment=PGSQL_SSL_MODE=prefer
Environment=PGSQL_SSL_ROOT_CERT=null
Environment=PUSHER_ID=
Environment=PUSHER_KEY=
Environment=PUSHER_SECRET=
Environment=QUEUE_DRIVER=sync
Environment=REDIS_CACHE_DB="1"
Environment=REDIS_DB="0"
Environment=REDIS_HOST=firefly-redis
Environment=REDIS_PATH=
Environment=REDIS_PORT=6379
Environment=REDIS_SCHEME=tcp
Environment=REDIS_USERNAME=firefly
Environment=SEND_ERROR_MESSAGE=true
Environment=SESSION_DRIVER=file
Environment=SITE_OWNER=guillaume@gtache.ch
Environment=SPARKPOST_SECRET=
Environment=TRACKER_SITE_ID=
Environment=TRACKER_URL=
Environment=TRUSTED_PROXIES=**
Environment=TZ=Europe/Zurich
Image=docker.io/fireflyiii/core:latest
Label=io.containers.autoupdate=registry
Pod=firefly.pod
Secret=app-key,type=env,target=APP_KEY
Secret=cron-token,type=env,target=STATIC_CRON_TOKEN
Secret=database-password,type=env,target=DB_PASSWORD
Secret=passport-private-key,type=env,target=PASSPORT_PRIVATE_KEY
Secret=passport-public-key,type=env,target=PASSPORT_PUBLIC_KEY
Secret=redis-password,type=env,target=REDIS_PASSWORD
StartWithPod=true
Timezone=Europe/Zurich
Volume=firefly-upload.volume:/var/www/html/storage/upload
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/firefly/firefly.pod
+4
View File
@@ -0,0 +1,4 @@
[Pod]
PodName=firefly
PublishPort=9028:8080
PublishPort=9029:8081
quadlets/homebox/homebox-data.volume
+7
View File
@@ -0,0 +1,7 @@
[Volume]
Copy=true
Device=/var/mnt/nas/containers/homebox/storage/data
Driver=local
Options=bind
Type=none
VolumeName=homebox-data
quadlets/homebox/homebox-database.container
+27
View File
@@ -0,0 +1,27 @@
[Unit]
Description=HomeBox database container
[Container]
AutoUpdate=registry
ContainerName=homebox-database
Environment=POSTGRES_USER=homebox
Environment=POSTGRES_DB=homebox
Environment=TZ=Europe/Zurich
HealthCmd=pg_isready -U homebox
HealthInterval=30s
HealthTimeout=10s
HealthRetries=5
Image=docker.io/postgres:18
Label=io.containers.autoupdate=registry
Pod=homebox.pod
Secret=database-password,type=env,target=POSTGRES_PASSWORD
StartWithPod=true
Timezone=Europe/Zurich
Volume=homebox-database.volume:/var/lib/postgresql
Volume=/var/mnt/nas/containers/homebox/storage/database-backup:/backup
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/homebox/homebox-database.volume
+2
View File
@@ -0,0 +1,2 @@
[Volume]
VolumeName=homebox-database
quadlets/homebox/homebox.container
+36
View File
@@ -0,0 +1,36 @@
[Unit]
Description=HomeBox container
After=homebox-database.container
Requires=homebox-database.container
[Container]
AutoUpdate=registry
ContainerName=homebox
Environment=HBOX_DATABASE_DATABASE=homebox
Environment=HBOX_DATABASE_DRIVER=postgres
Environment=HBOX_DATABASE_HOST=homebox-database
Environment=HBOX_DATABASE_PORT=5432
Environment=HBOX_DATABASE_SSL_MODE=disable
Environment=HBOX_DATABASE_USERNAME=homebox
Environment=HBOX_LOG_LEVEL=info
Environment=HBOX_LOG_FORMAT=text
Environment=HBOX_MODE=production
Environment=HBOX_OPTIONS_ALLOW_ANALYTICS=false
Environment=HBOX_OPTIONS_ALLOW_REGISTRATION=false
Environment=HBOX_OPTIONS_TRUST_PROXY=true
Environment=HBOX_WEB_MAX_UPLOAD_SIZE=10
Environment=TZ=Europe/Zurich
Image=ghcr.io/sysadminsmedia/homebox:latest-hardened
Label=io.containers.autoupdate=registry
Pod=homebox.pod
Secret=homebox-pepper,type=env,target=HBOX_AUTH_API_KEY_PEPPER
Secret=database-password,type=env,target=HBOX_DATABASE_PASSWORD
StartWithPod=true
Timezone=Europe/Zurich
Volume=homebox-data.volume:/data
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/homebox/homebox.pod
+3
View File
@@ -0,0 +1,3 @@
[Pod]
PodName=homebox
PublishPort=9027:7445
quadlets/nginx/acme.container
+22
View File
@@ -0,0 +1,22 @@
[Unit]
Description=ACME container
[Container]
AutoUpdate=registry
ContainerName=acme
Environment=TZ=Europe/Zurich
Exec=daemon
Image=ghcr.io/acmesh-official/acme.sh:latest
Label=io.containers.autoupdate=registry
Pod=nginx.pod
StartWithPod=true
Timezone=Europe/Zurich
Volume=nginx-certs.volume:/etc/nginx/certs:z
Volume=nginx-html.volume:/usr/share/nginx/html
Volume=acme.volume:/acme.sh
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/nginx/nginx-acme.volume → quadlets/nginx/acme.volume
+1 -1
View File
@@ -4,4 +4,4 @@ Device=/var/mnt/nas/containers/nginx/storage/acme
Driver=local Driver=local
Options=bind Options=bind
Type=none Type=none
VolumeName=nginx-acme VolumeName=acme
quadlets/nginx/nginx-acme.container
-34
View File
@@ -1,34 +0,0 @@
[Unit]
Description=NGINX ACME container
After=nginx.container
Requires=nginx.container
[Container]
AutoUpdate=registry
ContainerName=nginx-acme
Environment=DEFAULT_EMAIL=guillaume.tache@hotmail.com
Environment=TZ=Europe/Zurich
Image=docker.io/nginxproxy/acme-companion:2.2.9
Label=io.containers.autoupdate=registry
Pod=nginx.pod
StartWithPod=true
Timezone=Europe/Zurich
Volume=/var/mnt/nas/containers/nginx/storage/network_internal.conf:/etc/nginx/network_internal.conf:ro
Volume=/var/mnt/nas/containers/nginx/storage/nginx.conf:/etc/nginx/nginx.conf:ro
Volume=nginx-certs.volume:/etc/nginx/certs:z
Volume=nginx-config.volume:/etc/nginx/conf.d
Volume=nginx-html.volume:/usr/share/nginx/html
Volume=nginx-stream.volume:/etc/nginx/stream.d
Volume=nginx-vhost.volume:/etc/nginx/vhost.d
Volume=nginx-acme:/etc/acme.sh:Z
Volume=/var/mnt/nas/containers/nginx/storage/app/entrypoint.sh:/app/entrypoint.sh:ro
Volume=/var/mnt/nas/containers/nginx/storage/app/functions.sh:/app/functions.sh:ro
Volume=/var/mnt/nas/containers/nginx/storage/app/start.sh:/app/start.sh:ro
Volume=/var/mnt/nas/containers/nginx/storage/app/letsencrypt_service:/app/letsencrypt_service:ro
Volume=/var/mnt/nas/containers/nginx/storage/app/letsencrypt_user_data:/app/letsencrypt_user_data:ro
[Service]
Restart=always
[Install]
WantedBy=default.target
quadlets/nginx/nginx-vhost.volume
-7
View File
@@ -1,7 +0,0 @@
[Volume]
Copy=true
Device=/var/mnt/nas/containers/nginx/storage/vhost
Driver=local
Options=bind
Type=none
VolumeName=nginx-vhost
quadlets/overleaf/overleaf.container
+1
View File
@@ -26,6 +26,7 @@ Environment=ENABLE_CRON_RESOURCE_DELETION=true
Environment=MONGO_URL=mongodb://overleaf-database/sharelatex Environment=MONGO_URL=mongodb://overleaf-database/sharelatex
Environment=REDIS_HOST=overleaf-redis Environment=REDIS_HOST=overleaf-redis
Environment=REDIS_PORT=6379 Environment=REDIS_PORT=6379
Environment=TZ=Europe/Zurich
Image=quay.io/sharelatex/sharelatex:latest Image=quay.io/sharelatex/sharelatex:latest
Label=io.containers.autoupdate=registry Label=io.containers.autoupdate=registry
Pod=overleaf.pod Pod=overleaf.pod
quadlets/vikunja/vikunja-database.container
+1 -1
View File
@@ -13,7 +13,7 @@ HealthTimeout=10s
HealthRetries=5 HealthRetries=5
Image=docker.io/postgres:18 Image=docker.io/postgres:18
Label=io.containers.autoupdate=registry Label=io.containers.autoupdate=registry
Pod=nexus.pod Pod=vikunja.pod
Secret=database-password,type=env,target=POSTGRES_PASSWORD Secret=database-password,type=env,target=POSTGRES_PASSWORD
StartWithPod=true StartWithPod=true
Timezone=Europe/Zurich Timezone=Europe/Zurich
quadlets/vikunja/vikunja.container
+1 -2
View File
@@ -14,12 +14,11 @@ Environment=VIKUNJA_DATABASE_HOST=vikunja-database
Environment=VIKUNJA_DATABASE_TYPE=postgres Environment=VIKUNJA_DATABASE_TYPE=postgres
Environment=VIKUNJA_DATABASE_USER=vikunja Environment=VIKUNJA_DATABASE_USER=vikunja
Environment=VIKUNJA_REDIS_ENABLED=true Environment=VIKUNJA_REDIS_ENABLED=true
Environment=VIKUNJA_REDIS_HOST=vikunja-redis Environment=VIKUNJA_REDIS_HOST=vikunja-redis:6379
Environment=VIKUNJA_SENTRY_ENABLED=false Environment=VIKUNJA_SENTRY_ENABLED=false
Environment=VIKUNJA_SENTRY_FRONTENDENABLED=false Environment=VIKUNJA_SENTRY_FRONTENDENABLED=false
Environment=VIKUNJA_SERVICE_ENABLELINKSHARING=false Environment=VIKUNJA_SERVICE_ENABLELINKSHARING=false
Environment=VIKUNJA_SERVICE_ENABLEREGISTRATION=false Environment=VIKUNJA_SERVICE_ENABLEREGISTRATION=false
Environment=VIKUNJA_SERVICE_INTERFACE=8080
Environment=VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=realip Environment=VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=realip
Environment=VIKUNJA_SERVICE_PUBLICURL=https://tasks.gtache.ch Environment=VIKUNJA_SERVICE_PUBLICURL=https://tasks.gtache.ch
Environment=VIKUNJA_SERVICE_TIMEZONE=Europe/Zurich Environment=VIKUNJA_SERVICE_TIMEZONE=Europe/Zurich
services/firefly/backup-database.service
+6
View File
@@ -0,0 +1,6 @@
[Unit]
Description=Backups the firefly database
[Service]
Type=oneshot
ExecStart=/opt/bin/backup-postgres
services/firefly/backup-database.timer
+10
View File
@@ -0,0 +1,10 @@
[Unit]
Description=Timer for the backup-database service
[Timer]
OnCalendar=12:00:00
Persistent=true
Unit=backup-database.service
[Install]
WantedBy=timers.target
services/homebox/backup-database.service
+6
View File
@@ -0,0 +1,6 @@
[Unit]
Description=Backups the homebox database
[Service]
Type=oneshot
ExecStart=/opt/bin/backup-postgres
services/homebox/backup-database.timer
+10
View File
@@ -0,0 +1,10 @@
[Unit]
Description=Timer for the backup-database service
[Timer]
OnCalendar=12:00:00
Persistent=true
Unit=backup-database.service
[Install]
WantedBy=timers.target
services/nginx/create-certificate@.service
+9
View File
@@ -0,0 +1,9 @@
[Unit]
Description=Creates a certificate
[Service]
Type=oneshot
ExecStart=/usr/bin/podman exec -it acme --issue --server https://acme-v02.api.letsencrypt.org/directory --webroot /usr/share/nginx/html \
--cert-file /etc/nginx/certs/%I/cert.pem --key-file /etc/nginx/certs/%I/key.pem \
--ca-file /etc/nginx/certs/%I/chain.pem --fullchain-file /etc/nginx/certs/%I/fullchain.pem \
--domain %I
services/nginx/remove-certificate@.service
+6
View File
@@ -0,0 +1,6 @@
[Unit]
Description=Removes a certificate
[Service]
Type=oneshot
ExecStart=/usr/bin/podman exec -it acme --remove --ecc --domain %I
services/nginx/update-account.service
+6
View File
@@ -0,0 +1,6 @@
[Unit]
Description=Updates the account
[Service]
Type=oneshot
ExecStart=/usr/bin/podman exec -it acme --update-account --server https://acme-v02.api.letsencrypt.org/directory --accountemail guillaume.tache@hotmail.com
services/nginx/update-certificates.service
+6
View File
@@ -0,0 +1,6 @@
[Unit]
Description=Updates the certificates
[Service]
Type=oneshot
ExecStart=/usr/bin/podman exec -it acme --cron
services/nginx/update-certificates.timer
+10
View File
@@ -0,0 +1,10 @@
[Unit]
Description=Timer for the update-certificates service
[Timer]
OnCalendar=01:00:00
Persistent=true
Unit=update-certificates.service
[Install]
WantedBy=timers.target