From 23a14e1650eb38ed86fb391f8790c993e5050937 Mon Sep 17 00:00:00 2001 From: ginnoir Date: Tue, 2 Jun 2026 19:03:53 -0500 Subject: [PATCH] chore: replace placeholder deploy config with actual production files - deploy/compose.yaml: replace generated placeholder with actual monolith compose (Foundry, Caddy, media stack, famapp, Authentik, Watchtower, etc.) - deploy/Caddyfile.snippet: replace with full production Caddyfile - .env.production.example: update variable names to match production (famapp_MINIO_ROOT_USER/PASSWORD/BUCKET, CF_API_TOKEN, etc.) - scripts/apply-compose.ps1: add -Compose/-Caddy flags; push Caddyfile and reload caddy in addition to compose restart --- .env.production.example | 35 +++--- deploy/Caddyfile.snippet | 223 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 240 insertions(+), 18 deletions(-) diff --git a/.env.production.example b/.env.production.example index c7d187c..4a21816 100644 --- a/.env.production.example +++ b/.env.production.example @@ -1,24 +1,25 @@ # ── famapp ──────────────────────────────────────────────────────────────────── +# These vars are consumed by the famapp service in docker-compose.yml. +# The production .env lives on valhalla at ~/htpc-download-box/.env # Image tag to deploy. Pin to a specific version after first deploy # (e.g. ghcr.io/ginnoir/famapp:v0.1.0). `latest` is fine for staging/initial. FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest -# `always` pulls on every `up`; set `missing` if you want to skip pulls. FAMAPP_PULL_POLICY=always -# Authentik image tag. Bump in lockstep with Authentik release notes. AUTHENTIK_IMAGE_TAG=2024.12.3 -# Run drizzle migrations on container start. Leave true. RUN_MIGRATIONS=true -# Public URL for the app — used by Auth.js for OIDC redirect URIs. +# Public URL for the app AUTH_URL=https://fam.ginnoir.com -# famapp Postgres credentials (used to build DATABASE_URL inside compose.yaml) +# famapp Postgres FAMAPP_DB_USER=famapp FAMAPP_DB_PASSWORD=replace-with-strong-password FAMAPP_DB_NAME=famapp # Auth.js session secret — generate with: openssl rand -base64 32 +# NOTE: the monolith .env also uses AUTH_SECRET for Reactive Resume. +# Docker Compose uses the last occurrence. Keep famapp's entry last. AUTH_SECRET=replace-with-openssl-rand-base64-32 # OIDC provider (Authentik) — fill in after bootstrapping Authentik @@ -26,26 +27,32 @@ AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/ AUTH_OIDC_CLIENT_ID=replace-me AUTH_OIDC_CLIENT_SECRET=replace-me -# Web Push VAPID keys — generate with: pnpm vapid:generate (run from the repo) +# Web Push VAPID keys — generate with: pnpm vapid:generate VAPID_PUBLIC_KEY= VAPID_PRIVATE_KEY= -# Must be "mailto:
" or a URL -VAPID_SUBJECT=mailto:3nigma.matt@gmail.com +VAPID_SUBJECT=mailto:your-email@example.com -# ntfy push fallback — uses your existing ntfy instance at ntfy.ginnoir.com -# Leave NTFY_URL blank to disable ntfy fanout. +# ntfy push fallback NTFY_URL=https://ntfy.ginnoir.com NTFY_TOPIC=famapp # Log level: error | warn | info | debug LOG_LEVEL=info -# ── Authentik ───────────────────────────────────────────────────────────────── +# MinIO object storage (garden image uploads) +famapp_MINIO_ROOT_USER=famapp +famapp_MINIO_ROOT_PASSWORD=replace-with-strong-password +famapp_MINIO_BUCKET=garden -# Authentik Postgres credentials (separate DB per Matt's rule) +# OpenPlantBook API (optional — used for plant species lookup) +famapp_OPENPLANTBOOK_CLIENT_ID= +famapp_OPENPLANTBOOK_CLIENT_SECRET= + +# ── Authentik ───────────────────────────────────────────────────────────────── AUTHENTIK_DB_USER=authentik AUTHENTIK_DB_PASSWORD=replace-with-strong-password AUTHENTIK_DB_NAME=authentik - -# Authentik secret key — generate with: openssl rand -base64 60 AUTHENTIK_SECRET_KEY=replace-with-openssl-rand-base64-60 + +# ── Cloudflare (Caddy DNS-01 TLS) ───────────────────────────────────────────── +CF_API_TOKEN=replace-with-cloudflare-api-token diff --git a/deploy/Caddyfile.snippet b/deploy/Caddyfile.snippet index dd4b92b..950209f 100644 --- a/deploy/Caddyfile.snippet +++ b/deploy/Caddyfile.snippet @@ -1,10 +1,225 @@ -# famapp — paste into your existing Caddyfile. -# famapp runs on 3010, authentik-server on 9200 (both bound to the host by deploy/compose.yaml). +# ============================================================= +# GLOBAL OPTIONS +# ============================================================= +{ + acme_dns cloudflare {env.CF_API_TOKEN} +} +# ============================================================= +# SNIPPETS +# ============================================================= +# Reusable matcher — blocks anything not on the LAN. +# Usage: import internal_only inside any site block. +(internal_only) { + @blocked not remote_ip 192.168.1.0/24 + respond @blocked "Access denied" 403 +} + +# ============================================================= +# FOUNDRY VTT — public +# ============================================================= +foundry.ginnoir.com { + reverse_proxy foundry:30000 +} + +foundry2.ginnoir.com { + reverse_proxy foundry2:30000 +} + +# ============================================================= +# TABLETOP TOOLS — public +# ============================================================= +5etools.ginnoir.com { + reverse_proxy 5etools:80 +} + +pf2e.ginnoir.com { + root * /srv/aon + file_server +} + +# ============================================================= +# FILE STORAGE — public +# ============================================================= +files.ginnoir.com { + reverse_proxy owncloud:8080 +} + +# ============================================================= +# STATIC SITES — public +# ============================================================= +ffttsystems.ginnoir.com { + root * /srv/ffttsystems + file_server +} + +# ============================================================= +# MEDIA REQUESTS — public +# ============================================================= +requests.ginnoir.com { + reverse_proxy overseerr:5055 +} + +# ============================================================= +# MEDIA MANAGEMENT — internal only +# ============================================================= +sonarr.ginnoir.com { + import internal_only + reverse_proxy sonarr:8989 +} + +radarr.ginnoir.com { + import internal_only + reverse_proxy radarr:7878 +} + +bazarr.ginnoir.com { + import internal_only + reverse_proxy bazarr:6767 +} + +jackett.ginnoir.com { + import internal_only + reverse_proxy jackett:9117 +} + +prowlarr.ginnoir.com { + import internal_only + reverse_proxy prowlarr:9696 +} + +tautulli.ginnoir.com { + import internal_only + reverse_proxy tautulli:8181 +} + +hydra.ginnoir.com { + import internal_only + reverse_proxy nzbhydra2:5076 +} + +# ============================================================= +# DOWNLOAD CLIENTS — internal only +# ============================================================= +qbittorrent.ginnoir.com { + import internal_only + reverse_proxy qbittorrent:3232 +} + +deluge.ginnoir.com { + import internal_only + reverse_proxy deluge:8112 +} + +nzbget.ginnoir.com { + import internal_only + reverse_proxy nzbget:6789 +} + +whisparr.ginnoir.com { + import internal_only + reverse_proxy whisparr:6969 +} + +stash.ginnoir.com { + import internal_only + reverse_proxy stash:6970 +} + +# ============================================================= +# NOTIFICATIONS & RSS — public +# ============================================================= +ntfy.ginnoir.com, http://ntfy.ginnoir.com { + reverse_proxy ntfy:80 + @httpget { + protocol http + method GET + path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) + } + redir @httpget https://{host}{uri} +} + +freshrss.ginnoir.com { + reverse_proxy freshrss:80 + @httpget { + protocol http + method GET + path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) + } + redir @httpget https://{host}{uri} +} + +# ============================================================= +# RESUME / PORTFOLIO — public +# ============================================================= +resume.ginnoir.com, https://resume.ginnoir.com { + reverse_proxy app:3000 + @httpget { + protocol http + method GET + path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) + } + redir @httpget https://{host}{uri} +} + +j-costa.com, https://j-costa.com { + tls { + issuer acme { + disable_tlsalpn_challenge + } + } + redir * https://resume.ginnoir.com/ginnoir/resume permanent +} + +storage.j-costa.com, https://storage.j-costa.com { + tls { + issuer acme { + disable_tlsalpn_challenge + } + } + reverse_proxy resume-minio:9000 + @httpget { + protocol http + method GET + path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) + } + redir @httpget https://{host}{uri} +} + +# ============================================================= +# MINIO CONSOLE — internal only +# ============================================================= +minio.ginnoir.com { + import internal_only + reverse_proxy resume-minio:9001 +} + +# ============================================================= +# MATRIX — public +# ============================================================= +ginnoir.com { + header /.well-known/matrix/* Content-Type application/json + header /.well-known/matrix/* Access-Control-Allow-Origin * + respond /.well-known/matrix/server `{"m.server": "matrix.ginnoir.com:443"}` + respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://matrix.ginnoir.com"},"m.identity_server":{"base_url":"https://identity.ginnoir.com"}}` +} + +matrix.ginnoir.com { + reverse_proxy /_matrix/* localhost:8008 + reverse_proxy /_synapse/client/* localhost:8008 +} + +# ============================================================= +# FAMAPP & AUTH — public +# ============================================================= fam.ginnoir.com { - reverse_proxy 192.168.1.69:3010 + reverse_proxy famapp:3000 } auth.ginnoir.com { - reverse_proxy 192.168.1.69:9200 + reverse_proxy authentik-server:9000 +} + +dev.ginnoir.com { + reverse_proxy 192.168.1.74:3000 }