chore: initial homelab stack config and sync tooling

Mirror the three production files (docker-compose.yml, .env, Caddyfile) that live on valhalla, plus the push/pull PowerShell scripts, CLAUDE.md, .gitignore/.gitattributes, and .claude/skills for ssh/apply/sync.
2026-06-02 22:12:07 -05:00
commit 56d834ede9
11 changed files with 1426 additions and 0 deletions
@@ -0,0 +1,99 @@
+# =============================================================
+# BASE CONFIG
+# =============================================================
+# Timezone: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+TZ=America/Chicago
+# UNIX PUID and PGID — find with: id $USER
+PUID=1000
+PGID=1000
+# Root path prefix for volume mounts
+ROOT=/
+
+# =============================================================
+# FOUNDRY VTT
+# =============================================================
+FOUNDRY_USERNAME=ginnoir
+FOUNDRY_PASSWORD=agt-UAU!uky_ykh3juy
+FOUNDRY_ADMIN_KEY=fuckyouben
+FOUNDRY_PATCH_URLS=https://gist.githubusercontent.com/ginnoir/898b152a09369f9089770daa71887262/raw/a354e4284f2b1feb616910f65bfe65a4ffdb5473/plutonium-12.x.sh
+
+# =============================================================
+# OWNCLOUD
+# =============================================================
+OWNCLOUD_DOMAIN=files.ginnoir.com
+OWNCLOUD_DB_USER=ginnoir
+OWNCLOUD_DB_PASSWORD=d0fet0th3x
+OWNCLOUD_ADMIN_USER=ginnoir
+OWNCLOUD_ADMIN_PASSWORD=d0fet0th3x
+
+# =============================================================
+# MARIADB
+# =============================================================
+MYSQL_ROOT_PASSWORD=d0fet0th3x
+
+# =============================================================
+# REACTIVE RESUME
+# =============================================================
+POSTGRES_PASSWORD=postgres
+MINIO_ROOT_USER=minioadmin
+MINIO_ROOT_PASSWORD=minioadmin
+CHROME_TOKEN=chrome_token
+# IMPORTANT: Replace this before exposing resume.ginnoir.com publicly.
+# Generate with: openssl rand -hex 64
+AUTH_SECRET=CHANGE_ME_USE_openssl_rand_hex_64
+
+# =============================================================
+# FRESHRSS
+# =============================================================
+FRESHRSS_API_PASSWORD=d0fet0th3x
+FRESHRSS_PASSWORD=d0fet0th3x
+FRESHRSS_EMAIL=3nigma.matt@gmail.com
+
+AUTH_SECRET=b4c032c8475cdd21e9138f2178c862f79cb6302ebf90e561cdea4cd6efcfe61e4ee03f5a4b3405c3c99239b734c8f387c6c3547d6c5b8f1c7d7db2b81c01ce0b
+
+# ── famapp ────────────────────────────────────────────────────────────────────
+FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
+FAMAPP_PULL_POLICY=always
+AUTHENTIK_IMAGE_TAG=2024.12.3
+RUN_MIGRATIONS=true
+
+AUTH_URL=https://fam.ginnoir.com
+FAMAPP_DB_USER=famapp
+FAMAPP_DB_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
+FAMAPP_DB_NAME=famapp
+
+AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
+
+# Fill in after Authentik bootstrap
+AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
+AUTH_OIDC_CLIENT_ID=6uOZ8yjTR9Z2m1RZU1cLHYXHV2Lv6zZtfuJcrsdq
+AUTH_OIDC_CLIENT_SECRET=CPcNM8jXaJ2jHFKxRwGuuKyMKJsT502l3FztO1AOcFqDzWqlWu5x7Ox52Q6zyBa2v33YzoA9igrXW8FFjd1Gp7wrZV4PGTwvXmOd7pIMOY93gNotAgJaewT8WHW1F3YD
+
+VAPID_PUBLIC_KEY=BNED_UgfPhyoG6_JOabhpQpN3nr6QM5tO0PDiAadMGCcZROn8LM7tnsBrKaB1E5kfuDFb1rC_M86cT3uCvBqSBk
+VAPID_PRIVATE_KEY=QyJiyCI2TJa_QWVXznfj4vjpWTBsyFfSCtn1brpE9aI
+VAPID_SUBJECT=mailto:3nigma.matt@gmail.com
+
+NTFY_URL=https://ntfy.ginnoir.com
+NTFY_TOPIC=famapp
+
+AUTHENTIK_DB_USER=authentik
+AUTHENTIK_DB_PASSWORD=ebb7d34ecbc4fc8f95cd16ef491d2162cdf8
+AUTHENTIK_DB_NAME=authentik
+AUTHENTIK_SECRET_KEY=C33S/oXOVOLrlLnWGMRYadgH9zfEC7Bm1vHtbczkFxHcTOj9j6io397c/OGb
+
+# MinIO object storage (used for plant/container image uploads)
+famapp_MINIO_ENDPOINT=http://minio:9000
+famapp_MINIO_ROOT_USER=famapp
+famapp_MINIO_ROOT_PASSWORD=d0fet0th3x
+famapp_MINIO_BUCKET=garden
+
+famapp_OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
+famapp_OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP
+
+# =============================================================
+# CLOUDFLARE DNS (for Caddy DNS-01 TLS challenge)
+# =============================================================
+# Create a scoped API token at: https://dash.cloudflare.com/profile/api-tokens
+# Required permissions: Zone > DNS > Edit  (for ginnoir.com zone only)
+# This is NOT the Zone ID or Account ID — it's the API Token secret value.
+CF_API_TOKEN=cfut_ijIT9HDjXWKgd0dtnyLqxv8L3deB7hSDivSqquwp905a6c51