chore: replace placeholder deploy config with actual production files
- deploy/compose.yaml: replace generated placeholder with actual monolith compose (Foundry, Caddy, media stack, famapp, Authentik, Watchtower, etc.) - deploy/Caddyfile.snippet: replace with full production Caddyfile - .env.production.example: update variable names to match production (famapp_MINIO_ROOT_USER/PASSWORD/BUCKET, CF_API_TOKEN, etc.) - scripts/apply-compose.ps1: add -Compose/-Caddy flags; push Caddyfile and reload caddy in addition to compose restart
This commit is contained in:
ginnoir
+21
-14
@@ -1,24 +1,25 @@
|
||||
# ── famapp ────────────────────────────────────────────────────────────────────
|
||||
# These vars are consumed by the famapp service in docker-compose.yml.
|
||||
# The production .env lives on valhalla at ~/htpc-download-box/.env
|
||||
|
||||
# Image tag to deploy. Pin to a specific version after first deploy
|
||||
# (e.g. ghcr.io/ginnoir/famapp:v0.1.0). `latest` is fine for staging/initial.
|
||||
FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
|
||||
# `always` pulls on every `up`; set `missing` if you want to skip pulls.
|
||||
FAMAPP_PULL_POLICY=always
|
||||
# Authentik image tag. Bump in lockstep with Authentik release notes.
|
||||
AUTHENTIK_IMAGE_TAG=2024.12.3
|
||||
# Run drizzle migrations on container start. Leave true.
|
||||
RUN_MIGRATIONS=true
|
||||
|
||||
# Public URL for the app — used by Auth.js for OIDC redirect URIs.
|
||||
# Public URL for the app
|
||||
AUTH_URL=https://fam.ginnoir.com
|
||||
|
||||
# famapp Postgres credentials (used to build DATABASE_URL inside compose.yaml)
|
||||
# famapp Postgres
|
||||
FAMAPP_DB_USER=famapp
|
||||
FAMAPP_DB_PASSWORD=replace-with-strong-password
|
||||
FAMAPP_DB_NAME=famapp
|
||||
|
||||
# Auth.js session secret — generate with: openssl rand -base64 32
|
||||
# NOTE: the monolith .env also uses AUTH_SECRET for Reactive Resume.
|
||||
# Docker Compose uses the last occurrence. Keep famapp's entry last.
|
||||
AUTH_SECRET=replace-with-openssl-rand-base64-32
|
||||
|
||||
# OIDC provider (Authentik) — fill in after bootstrapping Authentik
|
||||
@@ -26,26 +27,32 @@ AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
|
||||
AUTH_OIDC_CLIENT_ID=replace-me
|
||||
AUTH_OIDC_CLIENT_SECRET=replace-me
|
||||
|
||||
# Web Push VAPID keys — generate with: pnpm vapid:generate (run from the repo)
|
||||
# Web Push VAPID keys — generate with: pnpm vapid:generate
|
||||
VAPID_PUBLIC_KEY=
|
||||
VAPID_PRIVATE_KEY=
|
||||
# Must be "mailto:<address>" or a URL
|
||||
VAPID_SUBJECT=mailto:3nigma.matt@gmail.com
|
||||
VAPID_SUBJECT=mailto:your-email@example.com
|
||||
|
||||
# ntfy push fallback — uses your existing ntfy instance at ntfy.ginnoir.com
|
||||
# Leave NTFY_URL blank to disable ntfy fanout.
|
||||
# ntfy push fallback
|
||||
NTFY_URL=https://ntfy.ginnoir.com
|
||||
NTFY_TOPIC=famapp
|
||||
|
||||
# Log level: error | warn | info | debug
|
||||
LOG_LEVEL=info
|
||||
|
||||
# ── Authentik ─────────────────────────────────────────────────────────────────
|
||||
# MinIO object storage (garden image uploads)
|
||||
famapp_MINIO_ROOT_USER=famapp
|
||||
famapp_MINIO_ROOT_PASSWORD=replace-with-strong-password
|
||||
famapp_MINIO_BUCKET=garden
|
||||
|
||||
# Authentik Postgres credentials (separate DB per Matt's rule)
|
||||
# OpenPlantBook API (optional — used for plant species lookup)
|
||||
famapp_OPENPLANTBOOK_CLIENT_ID=
|
||||
famapp_OPENPLANTBOOK_CLIENT_SECRET=
|
||||
|
||||
# ── Authentik ─────────────────────────────────────────────────────────────────
|
||||
AUTHENTIK_DB_USER=authentik
|
||||
AUTHENTIK_DB_PASSWORD=replace-with-strong-password
|
||||
AUTHENTIK_DB_NAME=authentik
|
||||
|
||||
# Authentik secret key — generate with: openssl rand -base64 60
|
||||
AUTHENTIK_SECRET_KEY=replace-with-openssl-rand-base64-60
|
||||
|
||||
# ── Cloudflare (Caddy DNS-01 TLS) ─────────────────────────────────────────────
|
||||
CF_API_TOKEN=replace-with-cloudflare-api-token
|
||||
|
||||
+219
-4
@@ -1,10 +1,225 @@
|
||||
# famapp — paste into your existing Caddyfile.
|
||||
# famapp runs on 3010, authentik-server on 9200 (both bound to the host by deploy/compose.yaml).
|
||||
# =============================================================
|
||||
# GLOBAL OPTIONS
|
||||
# =============================================================
|
||||
{
|
||||
acme_dns cloudflare {env.CF_API_TOKEN}
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# SNIPPETS
|
||||
# =============================================================
|
||||
# Reusable matcher — blocks anything not on the LAN.
|
||||
# Usage: import internal_only inside any site block.
|
||||
(internal_only) {
|
||||
@blocked not remote_ip 192.168.1.0/24
|
||||
respond @blocked "Access denied" 403
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# FOUNDRY VTT — public
|
||||
# =============================================================
|
||||
foundry.ginnoir.com {
|
||||
reverse_proxy foundry:30000
|
||||
}
|
||||
|
||||
foundry2.ginnoir.com {
|
||||
reverse_proxy foundry2:30000
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# TABLETOP TOOLS — public
|
||||
# =============================================================
|
||||
5etools.ginnoir.com {
|
||||
reverse_proxy 5etools:80
|
||||
}
|
||||
|
||||
pf2e.ginnoir.com {
|
||||
root * /srv/aon
|
||||
file_server
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# FILE STORAGE — public
|
||||
# =============================================================
|
||||
files.ginnoir.com {
|
||||
reverse_proxy owncloud:8080
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# STATIC SITES — public
|
||||
# =============================================================
|
||||
ffttsystems.ginnoir.com {
|
||||
root * /srv/ffttsystems
|
||||
file_server
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# MEDIA REQUESTS — public
|
||||
# =============================================================
|
||||
requests.ginnoir.com {
|
||||
reverse_proxy overseerr:5055
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# MEDIA MANAGEMENT — internal only
|
||||
# =============================================================
|
||||
sonarr.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy sonarr:8989
|
||||
}
|
||||
|
||||
radarr.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy radarr:7878
|
||||
}
|
||||
|
||||
bazarr.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy bazarr:6767
|
||||
}
|
||||
|
||||
jackett.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy jackett:9117
|
||||
}
|
||||
|
||||
prowlarr.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy prowlarr:9696
|
||||
}
|
||||
|
||||
tautulli.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy tautulli:8181
|
||||
}
|
||||
|
||||
hydra.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy nzbhydra2:5076
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# DOWNLOAD CLIENTS — internal only
|
||||
# =============================================================
|
||||
qbittorrent.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy qbittorrent:3232
|
||||
}
|
||||
|
||||
deluge.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy deluge:8112
|
||||
}
|
||||
|
||||
nzbget.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy nzbget:6789
|
||||
}
|
||||
|
||||
whisparr.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy whisparr:6969
|
||||
}
|
||||
|
||||
stash.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy stash:6970
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# NOTIFICATIONS & RSS — public
|
||||
# =============================================================
|
||||
ntfy.ginnoir.com, http://ntfy.ginnoir.com {
|
||||
reverse_proxy ntfy:80
|
||||
@httpget {
|
||||
protocol http
|
||||
method GET
|
||||
path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
|
||||
}
|
||||
redir @httpget https://{host}{uri}
|
||||
}
|
||||
|
||||
freshrss.ginnoir.com {
|
||||
reverse_proxy freshrss:80
|
||||
@httpget {
|
||||
protocol http
|
||||
method GET
|
||||
path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
|
||||
}
|
||||
redir @httpget https://{host}{uri}
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# RESUME / PORTFOLIO — public
|
||||
# =============================================================
|
||||
resume.ginnoir.com, https://resume.ginnoir.com {
|
||||
reverse_proxy app:3000
|
||||
@httpget {
|
||||
protocol http
|
||||
method GET
|
||||
path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
|
||||
}
|
||||
redir @httpget https://{host}{uri}
|
||||
}
|
||||
|
||||
j-costa.com, https://j-costa.com {
|
||||
tls {
|
||||
issuer acme {
|
||||
disable_tlsalpn_challenge
|
||||
}
|
||||
}
|
||||
redir * https://resume.ginnoir.com/ginnoir/resume permanent
|
||||
}
|
||||
|
||||
storage.j-costa.com, https://storage.j-costa.com {
|
||||
tls {
|
||||
issuer acme {
|
||||
disable_tlsalpn_challenge
|
||||
}
|
||||
}
|
||||
reverse_proxy resume-minio:9000
|
||||
@httpget {
|
||||
protocol http
|
||||
method GET
|
||||
path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
|
||||
}
|
||||
redir @httpget https://{host}{uri}
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# MINIO CONSOLE — internal only
|
||||
# =============================================================
|
||||
minio.ginnoir.com {
|
||||
import internal_only
|
||||
reverse_proxy resume-minio:9001
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# MATRIX — public
|
||||
# =============================================================
|
||||
ginnoir.com {
|
||||
header /.well-known/matrix/* Content-Type application/json
|
||||
header /.well-known/matrix/* Access-Control-Allow-Origin *
|
||||
respond /.well-known/matrix/server `{"m.server": "matrix.ginnoir.com:443"}`
|
||||
respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://matrix.ginnoir.com"},"m.identity_server":{"base_url":"https://identity.ginnoir.com"}}`
|
||||
}
|
||||
|
||||
matrix.ginnoir.com {
|
||||
reverse_proxy /_matrix/* localhost:8008
|
||||
reverse_proxy /_synapse/client/* localhost:8008
|
||||
}
|
||||
|
||||
# =============================================================
|
||||
# FAMAPP & AUTH — public
|
||||
# =============================================================
|
||||
fam.ginnoir.com {
|
||||
reverse_proxy 192.168.1.69:3010
|
||||
reverse_proxy famapp:3000
|
||||
}
|
||||
|
||||
auth.ginnoir.com {
|
||||
reverse_proxy 192.168.1.69:9200
|
||||
reverse_proxy authentik-server:9000
|
||||
}
|
||||
|
||||
dev.ginnoir.com {
|
||||
reverse_proxy 192.168.1.74:3000
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user