From 85588723620ff6a0160e76c91d21de95a1fb607f Mon Sep 17 00:00:00 2001 From: ginnoir Date: Wed, 3 Jun 2026 22:22:35 -0500 Subject: [PATCH] =?UTF-8?q?chore:=20consistency=20pass=20=E2=80=94=20resta?= =?UTF-8?q?rt=20policies,=20backdoor=20ports,=20remove=20dead=20services?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docker-compose.yml: - Remove jackett and nzbhydra2 services - Fix restart: "no" → unless-stopped on deluge, nzbget, sonarr, radarr, bazarr, tautulli - Fix restart: always → unless-stopped on owncloud, mariadb (owncloud), redis (owncloud) - Add backdoor host ports: portainer 9100:9000, uptime-kuma 3001:3001, homarr 7575:7575 Caddyfile: - Remove jackett.ginnoir.com and hydra.ginnoir.com blocks - Drop stray @httpget redirect blocks from freshrss, resume, storage.j-costa.com - Simplify resume.ginnoir.com (drop redundant https:// host alias) - Fix tab indentation in j-costa.com and storage.j-costa.com tls blocks - Fix space indent in dev.ginnoir.com .env: - Remove unused famapp_MINIO_ENDPOINT (hardcoded in compose) - Remove unused NEXT_PUBLIC_APP_URL --- .env | 1 - Caddyfile | 44 +++++++----------------------------- docker-compose.yml | 56 +++++++++++++--------------------------------- 3 files changed, 23 insertions(+), 78 deletions(-) diff --git a/.env b/.env index 974d860..dda3a96 100644 --- a/.env +++ b/.env @@ -82,7 +82,6 @@ AUTHENTIK_DB_NAME=authentik AUTHENTIK_SECRET_KEY=C33S/oXOVOLrlLnWGMRYadgH9zfEC7Bm1vHtbczkFxHcTOj9j6io397c/OGb # MinIO object storage (used for plant/container image uploads) -famapp_MINIO_ENDPOINT=http://minio:9000 famapp_MINIO_ROOT_USER=famapp famapp_MINIO_ROOT_PASSWORD=d0fet0th3x famapp_MINIO_BUCKET=garden diff --git a/Caddyfile b/Caddyfile index 6467e75..e4be04f 100644 --- a/Caddyfile +++ b/Caddyfile @@ -78,11 +78,6 @@ bazarr.ginnoir.com { reverse_proxy bazarr:6767 } -jackett.ginnoir.com { - import internal_only - reverse_proxy jackett:9117 -} - prowlarr.ginnoir.com { import internal_only reverse_proxy prowlarr:9696 @@ -93,11 +88,6 @@ tautulli.ginnoir.com { reverse_proxy tautulli:8181 } -hydra.ginnoir.com { - import internal_only - reverse_proxy nzbhydra2:5076 -} - # ============================================================= # DOWNLOAD CLIENTS — internal only # ============================================================= @@ -141,49 +131,31 @@ ntfy.ginnoir.com, http://ntfy.ginnoir.com { freshrss.ginnoir.com { reverse_proxy freshrss:80 - @httpget { - protocol http - method GET - path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) - } - redir @httpget https://{host}{uri} } # ============================================================= # RESUME / PORTFOLIO — public # ============================================================= -resume.ginnoir.com, https://resume.ginnoir.com { +resume.ginnoir.com { reverse_proxy app:3000 - @httpget { - protocol http - method GET - path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) - } - redir @httpget https://{host}{uri} } j-costa.com, https://j-costa.com { tls { - issuer acme { - disable_tlsalpn_challenge - } + issuer acme { + disable_tlsalpn_challenge + } } redir * https://resume.ginnoir.com/ginnoir/resume permanent } storage.j-costa.com, https://storage.j-costa.com { tls { - issuer acme { - disable_tlsalpn_challenge - } + issuer acme { + disable_tlsalpn_challenge + } } reverse_proxy resume-minio:9000 - @httpget { - protocol http - method GET - path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/) - } - redir @httpget https://{host}{uri} } # ============================================================= @@ -206,7 +178,7 @@ auth.ginnoir.com { } dev.ginnoir.com { - reverse_proxy 192.168.1.74:3000 + reverse_proxy 192.168.1.74:3000 } # ============================================================= diff --git a/docker-compose.yml b/docker-compose.yml index 38905df..b7a6054 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -94,7 +94,7 @@ services: deluge: container_name: deluge image: lscr.io/linuxserver/deluge:latest - restart: "no" + restart: unless-stopped networks: - media environment: @@ -110,7 +110,7 @@ services: nzbget: container_name: nzbget image: lscr.io/linuxserver/nzbget:latest - restart: "no" + restart: unless-stopped networks: - media environment: @@ -126,7 +126,7 @@ services: sonarr: container_name: sonarr image: lscr.io/linuxserver/sonarr:latest - restart: "no" + restart: unless-stopped networks: - media environment: @@ -145,7 +145,7 @@ services: radarr: container_name: radarr image: lscr.io/linuxserver/radarr:latest - restart: "no" + restart: unless-stopped networks: - media environment: @@ -163,7 +163,7 @@ services: bazarr: container_name: bazarr image: lscr.io/linuxserver/bazarr:latest - restart: "no" + restart: unless-stopped networks: - media environment: @@ -179,22 +179,6 @@ services: ports: - "6767:6767" - jackett: - container_name: jackett - image: ghcr.io/hotio/jackett:latest - restart: unless-stopped - networks: - - media - environment: - - PUID=1000 - - PGID=1000 - - UMASK=002 - - TZ=${TZ} - volumes: - - /config/jackett:/config - ports: - - "9117:9117" - prowlarr: container_name: prowlarr image: ghcr.io/hotio/prowlarr:latest @@ -233,7 +217,7 @@ services: tautulli: image: ghcr.io/linuxserver/tautulli:latest container_name: tautulli - restart: "no" + restart: unless-stopped networks: - media environment: @@ -246,22 +230,6 @@ services: ports: - "8181:8181" - nzbhydra2: - image: ghcr.io/linuxserver/nzbhydra2:latest - container_name: nzbhydra2 - restart: "no" - networks: - - media - environment: - - PUID=${PUID} - - PGID=${PGID} - - TZ=${TZ} - volumes: - - ${ROOT}/config/nzbhydra:/config - - ${ROOT}/storage1/complete:/downloads - ports: - - "5076:5076" - qbittorrent: image: lscr.io/linuxserver/qbittorrent:latest container_name: qbittorrent @@ -336,7 +304,7 @@ services: owncloud: image: owncloud/server:latest container_name: owncloud_server - restart: always + restart: unless-stopped networks: - owncloud ports: @@ -372,7 +340,7 @@ services: mariadb: image: mariadb:latest container_name: owncloud_mariadb - restart: always + restart: unless-stopped networks: - owncloud environment: @@ -392,7 +360,7 @@ services: redis: image: redis:latest container_name: owncloud_redis - restart: always + restart: unless-stopped networks: - owncloud command: ["--databases", "1"] @@ -604,6 +572,8 @@ services: restart: unless-stopped networks: - management + ports: + - "9100:9000" volumes: - /var/run/docker.sock:/var/run/docker.sock - /config/portainer:/data @@ -614,6 +584,8 @@ services: restart: unless-stopped networks: - management + ports: + - "3001:3001" volumes: - /config/uptime-kuma:/app/data - /var/run/docker.sock:/var/run/docker.sock:ro @@ -626,6 +598,8 @@ services: - SECRET_ENCRYPTION_KEY=${HOMARR_SECRET_ENCRYPTION_KEY} networks: - management + ports: + - "7575:7575" volumes: - /var/run/docker.sock:/var/run/docker.sock - /config/homarr/configs:/app/data/configs