refactor(cutover): retire monolith — runner + apply script post-split

Application stacks now live in stacks/<domain>/ and are deployed by Portainer's git poll. The runner workflow no longer pushes or applies the monolithic root docker-compose.yml — it just pushes the Caddyfile and reloads Caddy (now via docker exec, since `dc exec` no longer makes sense). apply- compose.ps1 drops its -Compose and -DevStack flags for the same reason. Local docker-compose.yml and dev-compose.yml are deleted; their content has been split into stacks/* and is already running in production. The server copies at /valhalla-lab/docker-compose.yml and /valhalla-lab/dev-compose.yml are now orphan files (no workflow or script writes to them) and will be removed after Caddy is cut over to its own proxy Portainer stack. No live container is touched by this commit. The runner's next invocation runs the new strict-subset workflow (Caddyfile push + reload only).
2026-06-04 17:59:23 -05:00
parent b7f51524d9
commit cee43aa733
2 changed files with 0 additions and 1178 deletions
@@ -1,379 +0,0 @@
-# dev-compose.yml
-# Full developer tooling stack: Git hosting, browser IDE, container registry,
-# database UI, secret management, documentation wiki, and project management.
-#
-# This file creates the `devstack` network. The main docker-compose.yml
-# references it as external so Caddy can reach these services.
-#
-# Fresh-install order:
-#   docker compose -f portainer-compose.yml up -d   # portainer_proxy network
-#   docker compose -f dev-compose.yml up -d          # devstack network + dev tools
-#   dc up -d                                         # application stack
-#
-# Apply changes:
-#   powershell -File apply-compose.ps1 -DevStack
-
-services:
-
-  # ============================================================
-  # GITEA (self-hosted Git)
-  # ============================================================
-  gitea:
-    container_name: gitea
-    image: gitea/gitea:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - GITEA__database__DB_TYPE=postgres
-      - GITEA__database__HOST=postgres_gitea:5432
-      - GITEA__database__NAME=gitea
-      - GITEA__database__USER=gitea
-      - GITEA__database__PASSWD=${GITEA_DB_PASSWORD}
-      - GITEA__server__DOMAIN=gitea.ginnoir.com
-      - GITEA__server__ROOT_URL=https://gitea.ginnoir.com
-      - GITEA__server__SSH_DOMAIN=gitea.ginnoir.com
-      - GITEA__server__SSH_PORT=2222
-    volumes:
-      - /config/gitea:/data
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "3030:3000"
-      - "2222:22"
-    depends_on:
-      postgres_gitea:
-        condition: service_healthy
-
-  postgres_gitea:
-    container_name: postgres_gitea
-    image: postgres:16-alpine
-    restart: unless-stopped
-    networks:
-      - devstack
-    environment:
-      POSTGRES_USER: gitea
-      POSTGRES_PASSWORD: ${GITEA_DB_PASSWORD}
-      POSTGRES_DB: gitea
-    volumes:
-      - gitea_db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U gitea -d gitea"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  # ============================================================
-  # CODE-SERVER (VS Code in browser)
-  # ============================================================
-  code-server:
-    container_name: code_server
-    image: lscr.io/linuxserver/code-server:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=${TZ}
-      - PASSWORD=${CODE_SERVER_PASSWORD}
-      - SUDO_PASSWORD=${CODE_SERVER_PASSWORD}
-      - DEFAULT_WORKSPACE=/workspace
-    volumes:
-      - /config/code-server:/config
-      - /home/ginnoir:/workspace
-    ports:
-      - "8443:8443"
-
-  # ============================================================
-  # PRIVATE CONTAINER REGISTRY
-  # ============================================================
-  registry:
-    container_name: registry
-    image: registry:2
-    restart: unless-stopped
-    networks:
-      - devstack
-    volumes:
-      - /config/registry:/var/lib/registry
-    ports:
-      - "5000:5000"
-
-  # ============================================================
-  # DBX (Multi-database web UI)
-  # https://github.com/t8y2/dbx
-  # ============================================================
-  dbx:
-    container_name: dbx
-    image: t8y2/dbx:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    volumes:
-      - dbx_data:/app/data
-    ports:
-      - "4224:4224"
-
-  # ============================================================
-  # VAULT (Secret management)
-  # One-time setup after first start:
-  #   ssh ginnoir@valhalla
-  #   docker exec -it vault vault operator init
-  #   vault operator unseal  (three times with unseal keys)
-  # ============================================================
-  vault:
-    container_name: vault
-    image: hashicorp/vault:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    cap_add:
-      - IPC_LOCK
-    environment:
-      - VAULT_ADDR=http://0.0.0.0:8200
-    volumes:
-      - /config/vault/config:/vault/config:ro
-      - /config/vault/data:/vault/data
-      - /config/vault/logs:/vault/logs
-    command: vault server -config=/vault/config/vault.hcl
-    ports:
-      - "8200:8200"
-
-  # ============================================================
-  # BOOKSTACK (Documentation / Wiki)
-  # ============================================================
-  bookstack:
-    container_name: bookstack
-    image: lscr.io/linuxserver/bookstack:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=${TZ}
-      - APP_URL=https://docs.ginnoir.com
-      - DB_HOST=mariadb_bookstack
-      - DB_PORT=3306
-      - DB_USER=bookstack
-      - DB_PASS=${BOOKSTACK_DB_PASSWORD}
-      - DB_DATABASE=bookstack
-    volumes:
-      - /config/bookstack:/config
-    ports:
-      - "6875:80"
-    depends_on:
-      mariadb_bookstack:
-        condition: service_healthy
-
-  mariadb_bookstack:
-    container_name: mariadb_bookstack
-    image: lscr.io/linuxserver/mariadb:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=${TZ}
-      - MYSQL_ROOT_PASSWORD=${BOOKSTACK_DB_ROOT_PASSWORD}
-      - MYSQL_DATABASE=bookstack
-      - MYSQL_USER=bookstack
-      - MYSQL_PASSWORD=${BOOKSTACK_DB_PASSWORD}
-    volumes:
-      - /config/bookstack-db:/config
-    healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  # ============================================================
-  # PLANE (Project management)
-  # First start: log into https://plane.ginnoir.com and create a workspace.
-  # Caddy routes /api/ and /auth/ to plane-api, everything else to plane-web.
-  # ============================================================
-  plane-web:
-    container_name: plane_web
-    image: makeplane/plane-frontend:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    command: node web/server.js
-    environment:
-      - NEXT_PUBLIC_API_BASE_URL=https://plane.ginnoir.com
-
-  plane-api:
-    container_name: plane_api
-    image: makeplane/plane-backend:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    command: ./bin/docker-entrypoint-api.sh
-    environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
-      - DEBUG=0
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
-      - REDIS_URL=redis://redis_plane:6379/
-      - USE_MINIO=1
-      - AWS_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=${PLANE_MINIO_USER}
-      - AWS_SECRET_ACCESS_KEY=${PLANE_MINIO_PASSWORD}
-      - AWS_S3_ENDPOINT_URL=http://plane_minio:9000
-      - AWS_S3_BUCKET_NAME=uploads
-      - WEB_URL=https://plane.ginnoir.com
-      - CORS_ALLOWED_ORIGINS=https://plane.ginnoir.com
-      - GUNICORN_WORKERS=2
-    depends_on:
-      postgres_plane:
-        condition: service_healthy
-      redis_plane:
-        condition: service_healthy
-      plane-migrator:
-        condition: service_completed_successfully
-
-  plane-worker:
-    container_name: plane_worker
-    image: makeplane/plane-backend:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    command: ./bin/docker-entrypoint-worker.sh
-    environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
-      - DEBUG=0
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
-      - REDIS_URL=redis://redis_plane:6379/
-      - USE_MINIO=1
-      - AWS_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=${PLANE_MINIO_USER}
-      - AWS_SECRET_ACCESS_KEY=${PLANE_MINIO_PASSWORD}
-      - AWS_S3_ENDPOINT_URL=http://plane_minio:9000
-      - AWS_S3_BUCKET_NAME=uploads
-    depends_on:
-      postgres_plane:
-        condition: service_healthy
-      redis_plane:
-        condition: service_healthy
-      plane-migrator:
-        condition: service_completed_successfully
-
-  plane-beat:
-    container_name: plane_beat
-    image: makeplane/plane-backend:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    command: ./bin/docker-entrypoint-beat.sh
-    environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
-      - DEBUG=0
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
-      - REDIS_URL=redis://redis_plane:6379/
-    depends_on:
-      postgres_plane:
-        condition: service_healthy
-      redis_plane:
-        condition: service_healthy
-      plane-migrator:
-        condition: service_completed_successfully
-
-  plane-migrator:
-    container_name: plane_migrator
-    image: makeplane/plane-backend:latest
-    restart: "no"
-    networks:
-      - devstack
-    command: ./bin/docker-entrypoint-migrator.sh
-    environment:
-      - SECRET_KEY=${PLANE_SECRET_KEY}
-      - DATABASE_URL=postgresql://plane:${PLANE_DB_PASSWORD}@postgres_plane:5432/plane
-      - REDIS_URL=redis://redis_plane:6379/
-    depends_on:
-      postgres_plane:
-        condition: service_healthy
-      redis_plane:
-        condition: service_healthy
-
-  plane-create-bucket:
-    container_name: plane_create_bucket
-    image: minio/mc:latest
-    restart: "no"
-    networks:
-      - devstack
-    depends_on:
-      plane-minio:
-        condition: service_healthy
-    entrypoint: >
-      /bin/sh -c "
-      until /usr/bin/mc alias set plane_minio http://plane_minio:9000 $$MINIO_USER $$MINIO_PASSWORD; do sleep 1; done;
-      /usr/bin/mc mb plane_minio/uploads --ignore-existing;
-      exit 0;
-      "
-    environment:
-      - MINIO_USER=${PLANE_MINIO_USER}
-      - MINIO_PASSWORD=${PLANE_MINIO_PASSWORD}
-
-  postgres_plane:
-    container_name: postgres_plane
-    image: postgres:16-alpine
-    restart: unless-stopped
-    networks:
-      - devstack
-    environment:
-      POSTGRES_USER: plane
-      POSTGRES_PASSWORD: ${PLANE_DB_PASSWORD}
-      POSTGRES_DB: plane
-    volumes:
-      - plane_db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U plane -d plane"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  redis_plane:
-    container_name: redis_plane
-    image: redis:7-alpine
-    restart: unless-stopped
-    networks:
-      - devstack
-    command: --save 60 1 --loglevel warning
-    volumes:
-      - plane_redis_data:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  plane-minio:
-    container_name: plane_minio
-    image: minio/minio:latest
-    restart: unless-stopped
-    networks:
-      - devstack
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: ${PLANE_MINIO_USER}
-      MINIO_ROOT_PASSWORD: ${PLANE_MINIO_PASSWORD}
-    volumes:
-      - plane_minio_data:/data
-    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
-      interval: 30s
-      timeout: 20s
-      retries: 3
-      start_period: 30s
-
-networks:
-  devstack:
-    name: devstack
-
-volumes:
-  gitea_db_data:
-  dbx_data:
-  plane_db_data:
-  plane_redis_data:
-  plane_minio_data:
@@ -1,799 +0,0 @@
-services:
-  # ============================================================
-  # FOUNDRY VTT
-  # ============================================================
-  foundry:
-    container_name: foundry
-    image: felddy/foundryvtt:latest
-    hostname: valhalla-primary
-    init: true
-    restart: unless-stopped
-    networks:
-      - foundry
-    volumes:
-      - /storage1/foundry:/data
-      - /storage1/foundry/updatemain.bash:/home/foundry/updatemain.bash
-      - /storage1/Books/Tabletop:/data/Data/storage
-    environment:
-      - FOUNDRY_USERNAME=${FOUNDRY_USERNAME}
-      - FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}
-      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
-      - CONTAINER_VERBOSE=true
-      - FOUNDRY_HOSTNAME=foundry.ginnoir.com
-      - FOUNDRY_PROXY_PORT=443
-      - FOUNDRY_PROXY_SSL=true
-      - CONTAINER_PRESERVE_OWNER=/data/Data/storage
-      - FOUNDRY_UID=1000
-      - FOUNDRY_GID=1000
-      - CONTAINER_PATCH_URLS=${FOUNDRY_PATCH_URLS}
-    ports:
-      - "30000:30000"
-
-  foundry2:
-    container_name: foundry2
-    image: felddy/foundryvtt:latest
-    hostname: valhalla-secondary
-    init: true
-    restart: unless-stopped
-    networks:
-      - foundry
-    volumes:
-      - /storage1/foundry2:/data
-      - /storage1/foundry/updatemain.bash:/home/foundry/updatemain.bash
-      - /storage1/Books/Tabletop:/data/Data/storage
-    environment:
-      - FOUNDRY_USERNAME=${FOUNDRY_USERNAME}
-      - FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}
-      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
-      - CONTAINER_VERBOSE=true
-      - FOUNDRY_HOSTNAME=foundry2.ginnoir.com
-      - FOUNDRY_PROXY_PORT=443
-      - FOUNDRY_PROXY_SSL=true
-      - CONTAINER_PRESERVE_OWNER=/data/Data/storage
-      - FOUNDRY_UID=1000
-      - FOUNDRY_GID=1000
-      - CONTAINER_PATCH_URLS=${FOUNDRY_PATCH_URLS}
-    ports:
-      - "30001:30000"
-
-  # ============================================================
-  # CADDY (reverse proxy)
-  # serfriz/caddy-cloudflare-ddns bundles:
-  #   - caddy-dns/cloudflare  (DNS-01 ACME challenge)
-  #   - caddy-cloudflare-ip   (trust Cloudflare proxy IPs for real client IPs)
-  #   - caddy-dynamicdns      (keeps DNS records current if WAN IP changes)
-  # ============================================================
-  caddy:
-    container_name: caddy
-    image: serfriz/caddy-cloudflare-ddns:latest
-    restart: unless-stopped
-    networks:
-      - foundry
-      - owncloud
-      - resume
-      - media_external
-      - media
-      - famapp
-      - authentik
-      - management
-      - portainer_proxy
-      - devstack
-      - edge
-    ports:
-      - "80:80"
-      - "443:443"
-    environment:
-      - CF_API_TOKEN=${CF_API_TOKEN}
-    volumes:
-      - /config/caddy/Caddyfile:/etc/caddy/Caddyfile
-      - /config/caddy/site:/srv
-      - /config/caddy/data:/data
-      - /config/caddy/config:/config
-      - /storage1/Books:/srv/Books
-
-  # ============================================================
-  # MEDIA STACK
-  # ============================================================
-  deluge:
-    container_name: deluge
-    image: lscr.io/linuxserver/deluge:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    volumes:
-      - ${ROOT}/storage1/torrents:/downloads
-      - ${ROOT}/config/deluge:/config
-    ports:
-      - "8112:8112"
-
-  nzbget:
-    container_name: nzbget
-    image: lscr.io/linuxserver/nzbget:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    volumes:
-      - ${ROOT}/storage1/complete:/downloads
-      - ${ROOT}/config/nzbget:/config
-    ports:
-      - "6789:6789"
-
-  sonarr:
-    container_name: sonarr
-    image: lscr.io/linuxserver/sonarr:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - ${ROOT}/config/sonarr:/config
-      - ${ROOT}/storage1/Media/TV:/tv
-      - ${ROOT}/storage1/Media/Anime:/anime
-      - ${ROOT}/storage1/complete:/downloads
-    ports:
-      - "8989:8989"
-
-  radarr:
-    container_name: radarr
-    image: lscr.io/linuxserver/radarr:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - ${ROOT}/config/radarr:/config
-      - ${ROOT}/storage1/Media/Movies:/movies
-      - ${ROOT}/storage1/complete:/downloads
-    ports:
-      - "7878:7878"
-
-  bazarr:
-    container_name: bazarr
-    image: lscr.io/linuxserver/bazarr:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-      - UMASK_SET=022
-    volumes:
-      - ${ROOT}/config/bazarr:/config
-      - ${ROOT}/storage1/Media/Movies:/movies
-      - ${ROOT}/storage1/Media/TV:/tv
-      - ${ROOT}/storage1/Media/Anime:/anime
-    ports:
-      - "6767:6767"
-
-  prowlarr:
-    container_name: prowlarr
-    image: ghcr.io/hotio/prowlarr:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - UMASK=002
-      - TZ=${TZ}
-    volumes:
-      - /config/prowlarr:/config
-    ports:
-      - "9696:9696"
-
-  overseerr:
-    container_name: overseerr
-    image: sctx/overseerr:latest
-    networks:
-      - media_external
-    restart: unless-stopped
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - UMASK=002
-      - TZ=${TZ}
-    volumes:
-      - /config/overseerr:/app/config
-    ports:
-      - "5055:5055"
-
-  # ============================================================
-  # MEDIA UTILITIES
-  # ============================================================
-  tautulli:
-    image: ghcr.io/linuxserver/tautulli:latest
-    container_name: tautulli
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    volumes:
-      - ${ROOT}/config/tautulli:/config
-      - ${ROOT}/storage1/PMS:/logs
-    ports:
-      - "8181:8181"
-
-  qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:latest
-    container_name: qbittorrent
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=${TZ}
-      - WEBUI_PORT=3232
-      - TORRENTING_PORT=6881
-    volumes:
-      - /config/qbittorrent:/config
-      - /storage1/complete:/downloads
-    ports:
-      - "3232:3232"
-      - "6881:6881"
-      - "6881:6881/udp"
-
-  whisparr:
-    container_name: whisparr
-    image: ghcr.io/hotio/whisparr:latest
-    restart: unless-stopped
-    networks:
-      - media
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - UMASK=002
-      - TZ=${TZ}
-      - WEBUI_PORTS=6969/tcp
-    volumes:
-      - /config/whisparr:/config
-      - /storage1:/data
-    ports:
-      - "6969:6969"
-
-  stash:
-    image: stashapp/stash:latest
-    container_name: stash
-    restart: unless-stopped
-    networks:
-      - media
-    logging:
-      driver: json-file
-      options:
-        max-file: "10"
-        max-size: "2m"
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - STASH_STASH=/data/
-      - STASH_GENERATED=/generated/
-      - STASH_METADATA=/metadata/
-      - STASH_CACHE=/cache/
-      - STASH_PORT=6970
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - /config/stash:/root/.stash
-      - /storage1/LinuxISOs:/data
-      - /storage1/stash/metadata:/metadata
-      - /storage1/stash/cache:/cache
-      - /storage1/stash/blobs:/blobs
-      - /storage1/stash/generated:/generated
-    ports:
-      - "6971:6970"
-
-  # ============================================================
-  # OWNCLOUD STACK
-  # ============================================================
-  owncloud:
-    image: owncloud/server:latest
-    container_name: owncloud_server
-    restart: unless-stopped
-    networks:
-      - owncloud
-    ports:
-      - "8080:8080"
-    depends_on:
-      mariadb:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    environment:
-      - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN}
-      - OWNCLOUD_DB_TYPE=mysql
-      - OWNCLOUD_DB_NAME=owncloud
-      - OWNCLOUD_DB_USERNAME=${OWNCLOUD_DB_USER}
-      - OWNCLOUD_DB_PASSWORD=${OWNCLOUD_DB_PASSWORD}
-      - OWNCLOUD_DB_HOST=mariadb
-      - OWNCLOUD_ADMIN_USERNAME=${OWNCLOUD_ADMIN_USER}
-      - OWNCLOUD_ADMIN_PASSWORD=${OWNCLOUD_ADMIN_PASSWORD}
-      - OWNCLOUD_MYSQL_UTF8MB4=true
-      - OWNCLOUD_REDIS_ENABLED=true
-      - OWNCLOUD_REDIS_HOST=redis
-    healthcheck:
-      test: ["CMD", "/usr/bin/healthcheck"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-    volumes:
-      - /config/owncloud:/mnt/data
-      - /storage1/Books:/mnt/books
-      - /mnt/dropbox:/mnt/data/files/dropbox
-      - /storage1/ROMs:/mnt/roms
-
-  mariadb:
-    image: mariadb:latest
-    container_name: owncloud_mariadb
-    restart: unless-stopped
-    networks:
-      - owncloud
-    environment:
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
-      - MYSQL_USER=${OWNCLOUD_DB_USER}
-      - MYSQL_PASSWORD=${OWNCLOUD_DB_PASSWORD}
-      - MYSQL_DATABASE=owncloud
-    command: ["--max-allowed-packet=128M", "--innodb-log-file-size=64M"]
-    healthcheck:
-      test: ["CMD", "mariadb-admin", "ping", "-u", "root", "--password=${MYSQL_ROOT_PASSWORD}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    volumes:
-      - /config/mysql:/var/lib/mysql
-
-  redis:
-    image: redis:latest
-    container_name: owncloud_redis
-    restart: unless-stopped
-    networks:
-      - owncloud
-    command: ["--databases", "1"]
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    volumes:
-      - /config/redis:/data
-
-  # ============================================================
-  # REACTIVE RESUME STACK
-  # ============================================================
-  postgres:
-    container_name: postgres_resume
-    image: postgres:16-alpine
-    restart: unless-stopped
-    networks:
-      - resume
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_DB=postgres
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  resume-minio:
-    container_name: minio_resume
-    image: minio/minio:latest
-    restart: unless-stopped
-    networks:
-      - resume
-    command: server /data --console-address :9001
-    ports:
-      - "9000:9000"
-      - "9004:9001"
-    volumes:
-      - minio_data:/data
-    environment:
-      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
-      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
-    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
-      interval: 30s
-      timeout: 20s
-      retries: 3
-      start_period: 30s
-
-  chrome:
-    container_name: chrome
-    image: ghcr.io/browserless/chromium:latest
-    restart: unless-stopped
-    networks:
-      - resume
-    environment:
-      - TIMEOUT=10000
-      - CONCURRENT=10
-      - TOKEN=${CHROME_TOKEN}
-      - EXIT_ON_HEALTH_FAILURE=true
-      - PRE_REQUEST_HEALTH_CHECK=true
-
-  app:
-    container_name: resume
-    image: amruthpillai/reactive-resume:latest
-    restart: unless-stopped
-    networks:
-      - resume
-    ports:
-      - "3000:3000"
-    depends_on:
-      postgres:
-        condition: service_healthy
-      resume-minio:
-        condition: service_healthy
-      chrome:
-        condition: service_started
-    environment:
-      - PORT=3000
-      - NODE_ENV=production
-      - APP_URL=https://resume.ginnoir.com
-      - STORAGE_URL=https://storage.j-costa.com/default
-      - PRINTER_ENDPOINT=http://chrome:3000
-      - PRINTER_TOKEN=${CHROME_TOKEN}
-      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
-      - AUTH_SECRET=${RESUME_AUTH_SECRET}
-      - MAIL_FROM=noreply@localhost
-      - STORAGE_ENDPOINT=resume-minio
-      - STORAGE_PORT=9000
-      - STORAGE_REGION=us-east-1
-      - STORAGE_BUCKET=default
-      - STORAGE_ACCESS_KEY=${MINIO_ROOT_USER}
-      - STORAGE_SECRET_KEY=${MINIO_ROOT_PASSWORD}
-      - STORAGE_USE_SSL=false
-      - STORAGE_SKIP_BUCKET_CHECK=false
-
-  # ============================================================
-  # NOTIFICATIONS & RSS
-  # ============================================================
-  ntfy:
-    image: binwiederhier/ntfy:latest
-    container_name: ntfy
-    command:
-      - serve
-    restart: unless-stopped
-    environment:
-      - TZ=${TZ}
-      - NTFY_DEFAULT_HOST=https://ntfy.ginnoir.com
-      - NTFY_BASE_URL=https://ntfy.ginnoir.com
-      - NTFY_CACHE_FILE=/var/lib/ntfy/cache.db
-      - NTFY_AUTH_FILE=/var/lib/ntfy/auth.db
-      - NTFY_AUTH_DEFAULT_ACCESS=read-write
-      - NTFY_BEHIND_PROXY=true
-      - NTFY_ATTACHMENT_CACHE_DIR=/var/lib/ntfy/attachments
-      - NTFY_ENABLE_LOGIN=true
-    user: 1000:1000
-    networks:
-      - famapp
-    volumes:
-      - /config/ntfy/var/cache/ntfy:/var/cache/ntfy
-      - /config/ntfy/etc/ntfy:/etc/ntfy
-      - /config/ntfy/var/lib/ntfy:/var/lib/ntfy
-    ports:
-      - "8000:80"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1",
-        ]
-      interval: 60s
-      timeout: 10s
-      retries: 3
-      start_period: 40s
-
-  freshrss:
-    image: freshrss/freshrss:latest
-    container_name: freshrss
-    hostname: freshrss
-    restart: unless-stopped
-    networks:
-      - famapp
-    logging:
-      options:
-        max-size: 10m
-    volumes:
-      - /config/freshrss/data:/var/www/FreshRSS/data
-      - /config/freshrss/extensions:/var/www/FreshRSS/extensions
-    ports:
-      - "9999:80"
-    environment:
-      - CRON_MIN=3,33
-      - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
-      - FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
-      - FRESHRSS_USER=--api-password ${FRESHRSS_API_PASSWORD} --email ${FRESHRSS_EMAIL} --password ${FRESHRSS_PASSWORD} --user ginnoir
-
-  vigilant:
-    container_name: vigilant
-    image: ghcr.io/verifiedjoseph/vigilant:latest
-    restart: unless-stopped
-    environment:
-      - VIGILANT_NOTIFICATION_SERVICE=ntfy
-      - VIGILANT_NOTIFICATION_NTFY_URL=https://ntfy.ginnoir.com/
-      - VIGILANT_NOTIFICATION_NTFY_TOPIC=RSS
-    volumes:
-      - /config/vigilant/feeds.yaml:/app/feeds.yaml
-      - cache:/app/cache
-    security_opt:
-      - no-new-privileges:true
-
-  # ============================================================
-  # REMOTE ACCESS
-  # ============================================================
-  hbbr:
-    container_name: hbbr
-    image: rustdesk/rustdesk-server:latest
-    command: hbbr
-    restart: unless-stopped
-    ports:
-      - "21117:21117"
-    volumes:
-      - /config/rustdesk/hbbr/data:/root
-
-  hbbs:
-    container_name: hbbs
-    image: rustdesk/rustdesk-server:latest
-    command: hbbs
-    restart: unless-stopped
-    ports:
-      - "21115:21115"
-      - "21116:21116"
-      - "21116:21116/udp"
-    volumes:
-      - /config/rustdesk/hbbs/data:/root
-    depends_on:
-      - hbbr
-
-  # ============================================================
-  # MANAGEMENT
-  # ============================================================
-  uptime-kuma:
-    container_name: uptime_kuma
-    image: louislam/uptime-kuma:2
-    restart: unless-stopped
-    networks:
-      - management
-    ports:
-      - "3001:3001"
-    volumes:
-      - /config/uptime-kuma:/app/data
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-
-  homarr:
-    container_name: homarr
-    image: ghcr.io/homarr-labs/homarr:latest
-    restart: unless-stopped
-    environment:
-      - SECRET_ENCRYPTION_KEY=${HOMARR_SECRET_ENCRYPTION_KEY}
-    networks:
-      - management
-    ports:
-      - "7575:7575"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /config/homarr/configs:/app/data/configs
-      - /config/homarr/icons:/app/public/icons
-      - /config/homarr/data:/data
-
-  # ============================================================
-  # UTILITIES
-  # ============================================================
-  5etools:
-    container_name: 5etools
-    image: ghcr.io/5etools-mirror-3/5etools-src:latest
-    restart: unless-stopped
-    networks:
-      - foundry
-    ports:
-      - "9009:80"
-
-  # ============================================================
-  # FAMAPP
-  # ============================================================
-  famapp:
-    container_name: famapp
-    image: ${FAMAPP_IMAGE:-ghcr.io/ginnoir/famapp:latest}
-    pull_policy: ${FAMAPP_PULL_POLICY:-always}
-    restart: unless-stopped
-    networks:
-      - famapp
-    environment:
-      NODE_ENV: production
-      AUTH_URL: ${AUTH_URL}
-      DATABASE_URL: postgres://${FAMAPP_DB_USER}:${FAMAPP_DB_PASSWORD}@famapp-db:5432/${FAMAPP_DB_NAME}
-      AUTH_SECRET: ${FAMAPP_AUTH_SECRET}
-      AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER}
-      AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID}
-      AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET}
-      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
-      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
-      VAPID_SUBJECT: ${VAPID_SUBJECT}
-      NTFY_URL: ${NTFY_URL:-}
-      NTFY_TOPIC: ${NTFY_TOPIC:-}
-      LOG_LEVEL: ${LOG_LEVEL:-info}
-      RUN_MIGRATIONS: ${RUN_MIGRATIONS:-true}
-      MINIO_ENDPOINT: http://famapp-minio:9000
-      MINIO_ROOT_USER: ${famapp_MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${famapp_MINIO_ROOT_PASSWORD}
-      MINIO_BUCKET: ${famapp_MINIO_BUCKET}
-      OPENPLANTBOOK_CLIENT_ID: ${famapp_OPENPLANTBOOK_CLIENT_ID}
-      OPENPLANTBOOK_CLIENT_SECRET: ${famapp_OPENPLANTBOOK_CLIENT_SECRET}
-    ports:
-      - "3010:3000"
-    depends_on:
-      famapp-db:
-        condition: service_healthy
-      famapp-minio:
-        condition: service_healthy
-
-  famapp-db:
-    container_name: postgres_famapp
-    image: postgres:16-alpine
-    restart: unless-stopped
-    networks:
-      - famapp
-    environment:
-      POSTGRES_USER: ${FAMAPP_DB_USER}
-      POSTGRES_PASSWORD: ${FAMAPP_DB_PASSWORD}
-      POSTGRES_DB: ${FAMAPP_DB_NAME}
-    volumes:
-      - famapp_db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${FAMAPP_DB_USER} -d ${FAMAPP_DB_NAME}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  famapp-minio:
-    container_name: minio_famapp
-    image: minio/minio:latest
-    command: server /data --console-address ":9003"
-    restart: unless-stopped
-    environment:
-      MINIO_ROOT_USER: ${famapp_MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${famapp_MINIO_ROOT_PASSWORD}
-    volumes:
-      - garden_uploads:/data
-    ports:
-      - "9002:9000"
-      - "9003:9003"
-    healthcheck:
-      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
-      interval: 30s
-      timeout: 20s
-      retries: 3
-      start_period: 30s
-    networks:
-      - famapp
-
-  # ============================================================
-  # AUTHENTIK
-  # ============================================================
-  authentik-server:
-    container_name: authentik_server
-    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2024.12.3}
-    restart: unless-stopped
-    command: server
-    networks:
-      - authentik
-    environment:
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik-db
-      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
-      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
-      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
-    ports:
-      - "9200:9000"
-    depends_on:
-      authentik-db:
-        condition: service_healthy
-      authentik-redis:
-        condition: service_healthy
-
-  authentik-worker:
-    container_name: authentik_worker
-    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2024.12.3}
-    restart: unless-stopped
-    command: worker
-    networks:
-      - authentik
-    environment:
-      AUTHENTIK_REDIS__HOST: authentik-redis
-      AUTHENTIK_POSTGRESQL__HOST: authentik-db
-      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
-      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
-      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
-    depends_on:
-      authentik-db:
-        condition: service_healthy
-      authentik-redis:
-        condition: service_healthy
-
-  authentik-db:
-    container_name: postgres_authentik
-    image: postgres:16-alpine
-    restart: unless-stopped
-    networks:
-      - authentik
-    environment:
-      POSTGRES_USER: ${AUTHENTIK_DB_USER:-authentik}
-      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
-      POSTGRES_DB: ${AUTHENTIK_DB_NAME:-authentik}
-    volumes:
-      - authentik_db_data:/var/lib/postgresql/data
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "pg_isready -U ${AUTHENTIK_DB_USER:-authentik} -d ${AUTHENTIK_DB_NAME:-authentik}",
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  authentik-redis:
-    container_name: redis_authentik
-    image: redis:7-alpine
-    restart: unless-stopped
-    networks:
-      - authentik
-    command: --save 60 1 --loglevel warning
-    volumes:
-      - authentik_redis_data:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-networks:
-  foundry:
-  owncloud:
-  resume:
-  media_external:
-  media:
-  famapp:
-  authentik:
-  management:
-  portainer_proxy:
-    external: true
-  devstack:
-    external: true
-  edge:
-    name: edge
-    external: true
-
-volumes:
-  minio_data:
-  postgres_data:
-  cache:
-  famapp_db_data:
-  authentik_db_data:
-  authentik_redis_data:
-  garden_uploads: