From a38d558e84033b0b104994d6477b91edd123559d Mon Sep 17 00:00:00 2001 From: "steven@rockyserver" Date: Sun, 18 Oct 2026 17:34:28 +0000 Subject: [PATCH 1/7] running compose project with alphamill + vaultwarden --- .gitignore | 4 +++ core/certs/alphamill.gr.crt | 19 ------------- core/certs/alphamill.gr.key | 28 -------------------- core/certs/stvnliu.me.crt | 19 ------------- core/certs/stvnliu.me.key | 28 -------------------- core/docker-compose.yml | 19 ++++++++++--- core/dynamic/tls.yml | 6 ++--- docker-compose.yml | 2 +- domains/alphamill.gr/mail/docker-compose.yml | 2 ++ domains/alphamill.gr/site/docker-compose.yml | 1 + domains/stvnliu.me/docker-compose.yml | 3 +++ domains/stvnliu.me/vault/docker-compose.yml | 10 +++++-- 12 files changed, 37 insertions(+), 104 deletions(-) create mode 100644 .gitignore delete mode 100644 core/certs/alphamill.gr.crt delete mode 100644 core/certs/alphamill.gr.key delete mode 100644 core/certs/stvnliu.me.crt delete mode 100644 core/certs/stvnliu.me.key create mode 100644 domains/stvnliu.me/docker-compose.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e4758d7 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +core/certs/*.key +core/certs/*.crt + +domains/stvnliu.me/vault/data diff --git a/core/certs/alphamill.gr.crt b/core/certs/alphamill.gr.crt deleted file mode 100644 index ef0255b..0000000 --- a/core/certs/alphamill.gr.crt +++ /dev/null @@ -1,19 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDEzCCAfugAwIBAgIUUW/xlTVdPARWwtiddkINl6HE4jcwDQYJKoZIhvcNAQEL -BQAwGTEXMBUGA1UEAwwOKi5hbHBoYW1pbGwuZ3IwHhcNMjYxMDE4MTUyNjI3WhcN -MjcxMDE4MTUyNjI3WjAZMRcwFQYDVQQDDA4qLmFscGhhbWlsbC5ncjCCASIwDQYJ -KoZIhvcNAQEBBQADggEPADCCAQoCggEBANZ3yCtprx4AsOsvpOPq/kK39sLo6oO/ -Fi+Bv/iOSKt03+xKzBhEnjubGMx6qy0jeCpEEfW2jyjXUywG8szzRcp/NbHewthn -58dU4ca3hwXvEvW0iErxawlt7MXcFI5biDaoycbNfL7ovxxvLGeKsL60ND15uSyx -ugfnlQx+c+YfMVh0PKHZ/8LTz/hTMklJc87yT/BH1V/Vs7xjUORbDPfurC2JqeG6 -QZAKk/ew8JrSwJkzHGh5BHnzT8ZjePXUzvD2allWYA5bn3+v/UYc3rvo1WnnmZWz -V7XddJ49mTepVjc5YaL1OW15aMMV8fCYVh4mSiu8/MxzrMHU6Ff/nckCAwEAAaNT -MFEwHQYDVR0OBBYEFOkzSEYt2sC2zm7EqiADyzm48qkuMB8GA1UdIwQYMBaAFOkz -SEYt2sC2zm7EqiADyzm48qkuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL -BQADggEBAA7IZIgYAFoA2ynG5zd+kqUSxvkzZNeYNZQYQ6JbiraylfPLOa04BKKO -05dV+k3YXe1GoXuI9/23SWfFTrtGWxBfvKxhv2CsUHBf3AEYfI9x2pYg1uuutM/5 -o4HTfbej6Pd4CGdGBtSc4BDf7sz4UVNL+nBi6AUts+Ft0fsBPyvbThAC/H7VHIKk -9ibhh4kOmsj3+yZ+GlAGoM/blSXz84nmXGVGAnG4K57PyHhswMrT/sxgAwnAgYVW -R59eUBDnITNB5QHYuX2vsVMlue5UU5Dzi0/crGnKTFTBHOZOjb2cdUN4oibgv+oH -r/5MxWtX0dqXJMam6bhjIVmqDSk3B3E= ------END CERTIFICATE----- diff --git a/core/certs/alphamill.gr.key b/core/certs/alphamill.gr.key deleted file mode 100644 index 63e07ad..0000000 --- a/core/certs/alphamill.gr.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDWd8graa8eALDr -L6Tj6v5Ct/bC6OqDvxYvgb/4jkirdN/sSswYRJ47mxjMeqstI3gqRBH1to8o11Ms -BvLM80XKfzWx3sLYZ+fHVOHGt4cF7xL1tIhK8WsJbezF3BSOW4g2qMnGzXy+6L8c -byxnirC+tDQ9ebkssboH55UMfnPmHzFYdDyh2f/C08/4UzJJSXPO8k/wR9Vf1bO8 -Y1DkWwz37qwtianhukGQCpP3sPCa0sCZMxxoeQR580/GY3j11M7w9mpZVmAOW59/ -r/1GHN676NVp55mVs1e13XSePZk3qVY3OWGi9TlteWjDFfHwmFYeJkorvPzMc6zB -1OhX/53JAgMBAAECggEAZ06WiLblKBYcIoW2LyVkaZ30ysloIaMbnDGrV56uCY0I -Selzq2LuN3cLuH+EUf9qZC2a2xmflwQ1p5kHPssWPKcPJclQYO6YGo/cG50O+MBD -CUD3f+YPcaDWMy7CZhpYIEAoxc74vnsdh6RTpuKLJalnGo+2L33Cxwj55mVJDbjp -/QnW4o33ncVX2MItZ2FuuNdTz1L7klOAd8bsxpNm0sytyGxoYw1UBOw6tCNyhuvl -cgFL856AAdcUVFvJ1pRr9t3W7cfL0ZevuXstCyMpLnZURR15mRKSNqftigJ19F21 -fsjx3Cyy4nc6o0MsA4I84hsUIikw5orn37MZuG/ciwKBgQDwKnRaJlEl5S/X111J -Bqadzk8H21cCYm4xmoNcOlzwCxF18ZDrrbactkSnbtFuzpIvRUM8mbOuChyHdGSr -ltNPxFC9uUVQ2JodTmoRvzq4azrA1GbKHOCYV2VmDXOLK0hl69peE40McYRyScKZ -svXuoRFVFyRAFIdTrWiANBl5nwKBgQDkm5hBhVw5UapUgGQnBD57XsRF8qPNa5f0 -i3zhGrHm8qJGx9LuPT63RvKCFZTLU46tktO9PPxD6poHqbWKcAeBZN7xt0gpYTfI -7+Rt4dP+AbLreFT0DpGxJ9GkstL/8YwsvdbTBlaS6tp039qGepL5GOhKAwRZBjZk -HJgGCX1/lwKBgA3vuL6+eHkFeqhAxBYHv8VqgmWHUd4+jfxs5fCFJn17dvDsKqey -deVUIlnA8YBHlm4Ny+AJX0bbKVqm42ydnPeFAdZwmNgfKZpHwZn0CdlHx6oG6UwT -LulIMQciArFxuorHi+1nnwi40aG8LAG1Q9YsHJBefmkFh/DQID9IRq4rAoGACC0o -fO9wJPyuwub0rhCQy4jQLFBJW4eFn9F9Xe++fSwgcbej67F1FMkM02pCMCOE7uBZ -gmM0ApnZeHyxaYooOpCJCMwtYI2BmUY7PVLeai9VXuam4zPCMjviW6mpsk3JXbBM -hq+rWQXdWmDHSBgKOa6SYFNLTIPUXjBHn6+nNXECgYA2jpehlffbCsaYJogtX9Sd -8iK/OhB2En9a4BucNhJOnRLNsu3UPz6EzqneUmsWXKntEyCQL4Yrj9NqEb2M04hg -pZAj+yftI/roW5zLJHs0AaGI5Fhpk5ntYmX46/WVJFyT+oCHsEIfeV7Q+CqMGoAb -SDR+QrzdJmpTZyaBsVDykw== ------END PRIVATE KEY----- diff --git a/core/certs/stvnliu.me.crt b/core/certs/stvnliu.me.crt deleted file mode 100644 index c57a5bf..0000000 --- a/core/certs/stvnliu.me.crt +++ /dev/null @@ -1,19 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDEzCCAfugAwIBAgIUZYEMkLS+uh5XVPt7P36SR0W12aowDQYJKoZIhvcNAQEL -BQAwGTEXMBUGA1UEAwwOKi5hbHBoYW1pbGwuZ3IwHhcNMjYxMDE4MTUyNjM5WhcN -MjcxMDE4MTUyNjM5WjAZMRcwFQYDVQQDDA4qLmFscGhhbWlsbC5ncjCCASIwDQYJ -KoZIhvcNAQEBBQADggEPADCCAQoCggEBALz/WA6xxxJlZO3ohLhrTXC40BGvl/vv -YKw3CO8kMRFLOgNaFsNq9O6J1E3ZRz6TnGOt/ueoDqFuWhggw0cbmLYlTonCznv+ -vYoLY5oV2ydyH0gqtrSl4aGWGdqmybp2GpK6rk07OR2coUw02H71pyNLwW9u6Axr -Dk3eEiRB76BCsxkolF/sebPen2GXavtp4WI2YOc6ULLzxfVjCOkQUP1/ibh548MT -gQcj9KAxEhzBe5qYAuCpBpQOkgy3htxCO+rYNN175D5nOKnK4Adr+HbA+trK/42v -Rs2/PsWx1ekvrhwroMRWy0slqJu7Nb0eBnV7WE7aMD6x/pmFn4FQkUcCAwEAAaNT -MFEwHQYDVR0OBBYEFGY6PsNoWnm2v9Lb4dmo9Nbxf88AMB8GA1UdIwQYMBaAFGY6 -PsNoWnm2v9Lb4dmo9Nbxf88AMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL -BQADggEBAK1ENKIODGfo+igRm64wzisSW9hw3qG/mTMI7N2kMeKRsGz0K7e/Onal -NXeW7NC3bZMHm6I5DfXHaILUSB+VZ2EuiD6R4kZ4dUANVZ1CTYpij46J/HdbSNoa -YFoJKizIr2W80KHEYRd4z6OCkvBH3seT1Brvko1Vq6v2xJHPnXDHhqgsgtPJ/luv -gCfSo8CXdtzGhTDORJnC5eT+fHSRed+1a0Q3QwArQ2rx3VSmIr3plyG+LTn78mKR -oAkUfZnc7+MWCPioFqLIuYqj/I84MKkFKbIu/Xo/bxQ7iy+eRqE17UDJEnA1BFkb -azwwLE3fNCu7wnwBXJPQ5k91MCkvHdQ= ------END CERTIFICATE----- diff --git a/core/certs/stvnliu.me.key b/core/certs/stvnliu.me.key deleted file mode 100644 index e4afe79..0000000 --- a/core/certs/stvnliu.me.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC8/1gOsccSZWTt -6IS4a01wuNARr5f772CsNwjvJDERSzoDWhbDavTuidRN2Uc+k5xjrf7nqA6hbloY -IMNHG5i2JU6Jws57/r2KC2OaFdsnch9IKra0peGhlhnapsm6dhqSuq5NOzkdnKFM -NNh+9acjS8FvbugMaw5N3hIkQe+gQrMZKJRf7Hmz3p9hl2r7aeFiNmDnOlCy88X1 -YwjpEFD9f4m4eePDE4EHI/SgMRIcwXuamALgqQaUDpIMt4bcQjvq2DTde+Q+Zzip -yuAHa/h2wPrayv+Nr0bNvz7FsdXpL64cK6DEVstLJaibuzW9HgZ1e1hO2jA+sf6Z -hZ+BUJFHAgMBAAECggEACpVqAvilozwWWNRKimFH5uYSkMr6gds32K0ETRADx2ol -B4cF+0+EA8+oGevu92wgt9xIiAR7PUMGvI8pIFRFSv3v1fsYwQzU5GQa4cgTi7Py -WII71QXtCrVzITFx3oU6m7jkheKpIiVhSvkynnl3MJzPakQVroxYMrga3/jpSFob -H1cVlQ4KHeK6epEFNbMnXQFn5GHF5tyCc3br7quwGuGWlsZ/TfpLvqnqQQcdRkdT -FbdSdjTQnITaE0Uryo/9N04+lq7qmbBqjAokiMME7uGQQRrtBm5HGmmIuQesr0UX -aIdamc3be0/PDS9rDn5Jh+gUGV0uiJFRkHV1hl3/gQKBgQDvuu4fsvgDUcQ79wBD -8HNIYlWwzUoXnxRiy9aqvm2sg3BMo+o+mPnugY+5auzft10S5VcSD9E55KzPUM4K -j5uDZYioxztqJAlLZqTDmW43OnujuVgG3bD6kWySJi9WK7bXeb9RwHimBsJPAwV3 -O1JkGD1JSOqIetoLqV1PqpHl4QKBgQDJ0vvAa2lt4Nu5H9kn+BqoDjGKctRNH2xX -BtqsvSWWfHPcp2ON+QU5KzNY/1H8uiwXcN2Y9Sp4vy8Tx9Kr5AjPuoBiB6NMuFw8 -eM/aqFZdWoKBfrLbkynbdrulVElR6kUsLiiRV0MzRqtzedh3FZTx3wN222+XvShM -Gajw2FAMJwKBgDwDGZVJ4hhCodM5FBHt4Y4fP8BQw9mB80KAMK7xmNb02Gn3Jq6g -8QAp4ubRw5aFeoE+dDuLRh8uBayoV8wBAzczdbB6n38EomcDvP9SK2sb8tOblFOz -r5gqS3mSoYr6ynzKd4BppEo7quzInteoPAnen4j2/e9IgckljrxgwMFBAoGBAIFj -4kLamhz3q+ZjpLUbOvvDHb/FHpbTLoIcwtU77n0sDJvKNOkwXUjpiWHlTorYUKw2 -j9sgUrpW17e2xDmvWHbU+rnea7Mj/v5F9fwZMEVpYYHj2IctMgihdmvoPZlmuDI6 -5YdIiqy1AfZmh4DRNUxbzbzFsiV1///J86V1CNzBAoGBAKUDJVMbiVqCb7U5Petv -PaSCm93hGB5yJz92szi+cpY9ro2/j4lnT2KZT7bYpHwr7Q9Us9X4cQJvwV3WVCtW -PYgAf67ydaF0o8SJTk0fomMlTEKW/qW/NmicJFAnwtzd/EaO8KRB7yTE46rK0Dbn -NgSSDbNgg56z0/Vibeq1jSyb ------END PRIVATE KEY----- diff --git a/core/docker-compose.yml b/core/docker-compose.yml index 02d645b..cd1a579 100644 --- a/core/docker-compose.yml +++ b/core/docker-compose.yml @@ -4,10 +4,11 @@ services: container_name: traefik image: traefik:v3.7 command: - - "--api.insecure=true" + - "--api=true" + - "--tracing=true" - "--providers.docker=true" - - "--providers.file.directory=/etc/traefik/apps" - - "--providers.file.watch=true" + - "--providers.docker.exposedByDefault=false" + - "--providers.file.directory=/etc/traefik/dynamic" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--entrypoints.minecraft.address=:25565/tcp" @@ -16,6 +17,11 @@ services: - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - "--entrypoints.web.http.redirections.entrypoint.permanent=true" + - "--entrypoints.websecure.asDefault=true" + - "--entrypoints.websecure.http.tls.domains[0].main=alphamill.gr" + - "--entrypoints.websecure.http.tls.domains[0].sans=*.alphamill.gr" + - "--entrypoints.websecure.http.tls.domains[1].main=stvnliu.me" + - "--entrypoints.websecure.http.tls.domains[1].sans=*.stvnliu.me" security_opt: - no-new-privileges:true ports: @@ -26,7 +32,12 @@ services: - /var/run/docker.sock:/var/run/docker.sock:ro - ./certs:/certs:ro - ./dynamic:/etc/traefik/dynamic:ro - - /srv/docker:/etc/traefik/apps:ro + labels: + - "traefik.enable=true" + - "traefik.http.routers.dashboard.rule=Host(`traefik.stvnliu.me`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))" + - "traefik.http.routers.dashboard.service=api@internal" + - "traefik.http.routers.dashboard.middlewares=auth" + - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$UTCvF4Ic$$.S6iKW534mXL70ndt3L/P1" networks: - proxy_net diff --git a/core/dynamic/tls.yml b/core/dynamic/tls.yml index de298d5..e383cab 100644 --- a/core/dynamic/tls.yml +++ b/core/dynamic/tls.yml @@ -1,6 +1,6 @@ tls: certificates: - - certFile: /certs/alphamill.gr.cert - keyFile: /certs/alphamill.gr.key - - certFile: /certs/stvnliu.me.cert + - certFile: /certs/alphamill.gr.crt keyFile: /certs/alphamill.gr.key + - certFile: /certs/stvnliu.me.crt + keyFile: /certs/stvnliu.me.key diff --git a/docker-compose.yml b/docker-compose.yml index c0aaf13..e7f9d51 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ include: - ./core/docker-compose.yml # stvnliu.me project compose file - # - ./domains/stvnliu.me/docker-compose.yml + - ./domains/stvnliu.me/docker-compose.yml # alphamill.gr project compose file - ./domains/alphamill.gr/docker-compose.yml diff --git a/domains/alphamill.gr/mail/docker-compose.yml b/domains/alphamill.gr/mail/docker-compose.yml index e89f25c..21181e2 100644 --- a/domains/alphamill.gr/mail/docker-compose.yml +++ b/domains/alphamill.gr/mail/docker-compose.yml @@ -27,4 +27,6 @@ services: - ROUNDCUBEMAIL_PLUGINS=carddav, globaladdressbook labels: - traefik.enable=true + - traefik.http.routers.webmail.tls=true + - traefik.http.routers.webmail.entrypoints=websecure - traefik.http.routers.webmail.rule=Host(`webmail.alphamill.gr`) diff --git a/domains/alphamill.gr/site/docker-compose.yml b/domains/alphamill.gr/site/docker-compose.yml index 2d0e250..b2df74b 100644 --- a/domains/alphamill.gr/site/docker-compose.yml +++ b/domains/alphamill.gr/site/docker-compose.yml @@ -12,6 +12,7 @@ services: networks: - proxy_net labels: + - traefik.enable=true - traefik.http.routers.alphamill-site-container.rule=Host(`alphamill.gr`) - traefik.http.services.alphamill-site-service.loadbalancer.server.port=3000 # ports: diff --git a/domains/stvnliu.me/docker-compose.yml b/domains/stvnliu.me/docker-compose.yml new file mode 100644 index 0000000..3b25ff9 --- /dev/null +++ b/domains/stvnliu.me/docker-compose.yml @@ -0,0 +1,3 @@ +include: + - path: ./vault/docker-compose.yml + diff --git a/domains/stvnliu.me/vault/docker-compose.yml b/domains/stvnliu.me/vault/docker-compose.yml index 2ffee3c..504512d 100644 --- a/domains/stvnliu.me/vault/docker-compose.yml +++ b/domains/stvnliu.me/vault/docker-compose.yml @@ -1,5 +1,6 @@ networks: - default_net: + proxy_net: + name: "proxy-net" external: true services: vaultwarden: @@ -11,4 +12,9 @@ services: volumes: - ./data:/data/ networks: - - default_net + - proxy_net + labels: + - traefik.enable=true + - traefik.http.routers.vaultwarden-stvnliu-me.tls=true + - traefik.http.routers.vaultwarden-stvnliu-me.entrypoints=websecure + - traefik.http.routers.vaultwarden-stvnliu-me.rule=Host(`vw.stvnliu.me`) From 3eb031d6ef5714f56efafc797b7c048af2745bcb Mon Sep 17 00:00:00 2001 From: "steven@rockyserver" Date: Sun, 18 Oct 2026 17:56:52 +0000 Subject: [PATCH 2/7] deployed stvnliu.me/git --- domains/stvnliu.me/docker-compose.yml | 2 +- domains/stvnliu.me/git/.gitignore | 3 +++ domains/stvnliu.me/git/docker-compose.yml | 27 +++++++++++++++++++++++ 3 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 domains/stvnliu.me/git/.gitignore create mode 100644 domains/stvnliu.me/git/docker-compose.yml diff --git a/domains/stvnliu.me/docker-compose.yml b/domains/stvnliu.me/docker-compose.yml index 3b25ff9..ee675c2 100644 --- a/domains/stvnliu.me/docker-compose.yml +++ b/domains/stvnliu.me/docker-compose.yml @@ -1,3 +1,3 @@ include: - path: ./vault/docker-compose.yml - + - path: ./git/docker-compose.yml diff --git a/domains/stvnliu.me/git/.gitignore b/domains/stvnliu.me/git/.gitignore new file mode 100644 index 0000000..73b9b36 --- /dev/null +++ b/domains/stvnliu.me/git/.gitignore @@ -0,0 +1,3 @@ +git +gitea +ssh diff --git a/domains/stvnliu.me/git/docker-compose.yml b/domains/stvnliu.me/git/docker-compose.yml new file mode 100644 index 0000000..579137e --- /dev/null +++ b/domains/stvnliu.me/git/docker-compose.yml @@ -0,0 +1,27 @@ +networks: + proxy_net: + external: true +services: + forgejo-server: + image: codeberg.org/forgejo/forgejo:12 + container_name: forgejo + environment: + - USER_UID=1000 + - USER_GID=1000 + restart: always + networks: + - proxy_net + volumes: + - .:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + ports: + - '2222:22' + labels: + - traefik.enable=true + - traefik.http.routers.git-stvnliu-me.tls=true + - traefik.http.routers.git-stvnliu-me.entrypoints=websecure + - traefik.http.routers.git-stvnliu-me.rule=Host(`stvnliu.me`) && PathPrefix(`/git`) + - "traefik.http.middlewares.forgejo-strip.stripprefix.prefixes=/git" + - "traefik.http.routers.git-stvnliu-me.middlewares=forgejo-strip" + - traefik.http.services.git-stvnliu-me.loadbalancer.server.port=3000 From 59a74be250bb2d0628caba9280a20cddc8bde94b Mon Sep 17 00:00:00 2001 From: "steven@rockyserver" Date: Sun, 18 Oct 2026 19:38:14 +0000 Subject: [PATCH 3/7] deployed Authentik SSO --- domains/stvnliu.me/docker-compose.yml | 1 + domains/stvnliu.me/sso/.gitignore | 1 + domains/stvnliu.me/sso/docker-compose.yml | 90 +++++++++++++++++++++++ 3 files changed, 92 insertions(+) create mode 100644 domains/stvnliu.me/sso/.gitignore diff --git a/domains/stvnliu.me/docker-compose.yml b/domains/stvnliu.me/docker-compose.yml index ee675c2..8537a9b 100644 --- a/domains/stvnliu.me/docker-compose.yml +++ b/domains/stvnliu.me/docker-compose.yml @@ -1,3 +1,4 @@ include: - path: ./vault/docker-compose.yml - path: ./git/docker-compose.yml + - path: ./sso/docker-compose.yml diff --git a/domains/stvnliu.me/sso/.gitignore b/domains/stvnliu.me/sso/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/domains/stvnliu.me/sso/.gitignore @@ -0,0 +1 @@ +.env diff --git a/domains/stvnliu.me/sso/docker-compose.yml b/domains/stvnliu.me/sso/docker-compose.yml index e69de29..52f0a1f 100644 --- a/domains/stvnliu.me/sso/docker-compose.yml +++ b/domains/stvnliu.me/sso/docker-compose.yml @@ -0,0 +1,90 @@ +services: + authentik-postgresql: + container_name: authentik_pgsql + env_file: + - .env + environment: + POSTGRES_DB: ${PG_DB:-authentik} + POSTGRES_PASSWORD: ${PG_PASS:?database password required} + POSTGRES_USER: ${PG_USER:-authentik} + networks: + - authentik_net + healthcheck: + interval: 30s + retries: 5 + start_period: 20s + test: + - CMD-SHELL + - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER} + timeout: 5s + image: docker.io/library/postgres:16-alpine + restart: unless-stopped + volumes: + - database:/var/lib/postgresql/data + authentik-server: + container_name: authentik_server + command: server + depends_on: + authentik-postgresql: + condition: service_healthy + env_file: + - .env + environment: + AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.4} + networks: + - authentik_net + - proxy_net + ports: + - ${COMPOSE_PORT_HTTP:-9000}:9000 + # - ${COMPOSE_PORT_HTTPS:-9443}:9443 + restart: unless-stopped + shm_size: 512mb + labels: + - traefik.enable=true + - traefik.http.routers.authentik-stvnliu-me.tls=true + - traefik.http.routers.authentik-stvnliu-me.entrypoints=websecure + - traefik.http.routers.authentik-stvnliu-me.rule=Host(`sso.stvnliu.me`) + - traefik.http.services.authentik-stvnliu-me.loadbalancer.server.port=9000 + volumes: + - ./data:/data + - ./custom-templates:/templates + authentik-worker: + container_name: authentik_worker + command: worker + depends_on: + authentik-postgresql: + condition: service_healthy + env_file: + - .env + networks: + - authentik_net + environment: + AUTHENTIK_POSTGRESQL__HOST: authentik-postgresql + AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} + AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} + AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} + AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.8.4} + restart: unless-stopped + shm_size: 512mb + user: root + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - ./data:/data + - ./certs:/certs + - ./custom-templates:/templates +volumes: + database: + driver: local +networks: + authentik_net: + external: false + driver: bridge + proxy_net: + name: "proxy-net" + external: true From 2ddd3bf15da14979c150e6566e6c4f5ab11c0248 Mon Sep 17 00:00:00 2001 From: Zhongheng Liu Date: Sun, 18 Oct 2026 21:41:04 +0200 Subject: [PATCH 4/7] chore: bump forgejo to version 17 --- domains/stvnliu.me/git/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/domains/stvnliu.me/git/docker-compose.yml b/domains/stvnliu.me/git/docker-compose.yml index 579137e..5e35d8f 100644 --- a/domains/stvnliu.me/git/docker-compose.yml +++ b/domains/stvnliu.me/git/docker-compose.yml @@ -3,7 +3,7 @@ networks: external: true services: forgejo-server: - image: codeberg.org/forgejo/forgejo:12 + image: codeberg.org/forgejo/forgejo:17 container_name: forgejo environment: - USER_UID=1000 From 9d753f67fd1d9f5be6e70d00da63a56fdd4a2423 Mon Sep 17 00:00:00 2001 From: Zhongheng Liu Date: Sun, 18 Oct 2026 22:10:48 +0200 Subject: [PATCH 5/7] provisional deployment caldav with radicale --- domains/stvnliu.me/caldav/docker-compose.yml | 30 ++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/domains/stvnliu.me/caldav/docker-compose.yml b/domains/stvnliu.me/caldav/docker-compose.yml index e69de29..10836b7 100644 --- a/domains/stvnliu.me/caldav/docker-compose.yml +++ b/domains/stvnliu.me/caldav/docker-compose.yml @@ -0,0 +1,30 @@ +networks: + proxy_net: + name: "proxy-net" + external: true +services: + caldav: + image: tomsquest/docker-radicale + container_name: caldav-stvnliu-me + networks: + - proxy_net + init: true + read_only: false + security_opt: + - no-new-privileges: true + cap_drop: + - ALL + cap_add: + - SETUID + - SETGID + - CHOWN + - KILL + deploy: + resources: + limits: + memory: 256M + pids: 50 + restart: unless-stopped + volumes: + - ./data:/data + - ./config:/config:ro From 6d45f18954af34c1ddd1acdb427fd5335efcdb90 Mon Sep 17 00:00:00 2001 From: "steven@rockyserver" Date: Sun, 18 Oct 2026 20:40:30 +0000 Subject: [PATCH 6/7] deployed radicale webdav --- domains/stvnliu.me/caldav/.gitignore | 2 ++ domains/stvnliu.me/caldav/docker-compose.yml | 9 ++++++++- domains/stvnliu.me/docker-compose.yml | 1 + domains/stvnliu.me/sso/docker-compose.yml | 5 +++-- 4 files changed, 14 insertions(+), 3 deletions(-) create mode 100644 domains/stvnliu.me/caldav/.gitignore diff --git a/domains/stvnliu.me/caldav/.gitignore b/domains/stvnliu.me/caldav/.gitignore new file mode 100644 index 0000000..2171176 --- /dev/null +++ b/domains/stvnliu.me/caldav/.gitignore @@ -0,0 +1,2 @@ +config/ +data/ diff --git a/domains/stvnliu.me/caldav/docker-compose.yml b/domains/stvnliu.me/caldav/docker-compose.yml index 10836b7..252170f 100644 --- a/domains/stvnliu.me/caldav/docker-compose.yml +++ b/domains/stvnliu.me/caldav/docker-compose.yml @@ -11,7 +11,7 @@ services: init: true read_only: false security_opt: - - no-new-privileges: true + - no-new-privileges:true cap_drop: - ALL cap_add: @@ -24,6 +24,13 @@ services: limits: memory: 256M pids: 50 + labels: + - "traefik.enable=true" + - "traefik.http.routers.radicale.rule=Host(`cal.stvnliu.me`) && PathPrefix(`/radicale/`)" + - "traefik.http.routers.radicale.entrypoints=websecure" + - "traefik.http.services.radicale.loadbalancer.server.port=5232" + - "traefik.http.middlewares.radicale-scriptname.headers.customrequestheaders.X-Script-Name=/radicale" + - "traefik.http.routers.radicale.middlewares=radicale-scriptname" restart: unless-stopped volumes: - ./data:/data diff --git a/domains/stvnliu.me/docker-compose.yml b/domains/stvnliu.me/docker-compose.yml index 8537a9b..99a7d61 100644 --- a/domains/stvnliu.me/docker-compose.yml +++ b/domains/stvnliu.me/docker-compose.yml @@ -2,3 +2,4 @@ include: - path: ./vault/docker-compose.yml - path: ./git/docker-compose.yml - path: ./sso/docker-compose.yml + - path: ./caldav/docker-compose.yml diff --git a/domains/stvnliu.me/sso/docker-compose.yml b/domains/stvnliu.me/sso/docker-compose.yml index 52f0a1f..fbcbd10 100644 --- a/domains/stvnliu.me/sso/docker-compose.yml +++ b/domains/stvnliu.me/sso/docker-compose.yml @@ -39,13 +39,14 @@ services: networks: - authentik_net - proxy_net - ports: - - ${COMPOSE_PORT_HTTP:-9000}:9000 + # ports: + # - ${COMPOSE_PORT_HTTP:-9000}:9000 # - ${COMPOSE_PORT_HTTPS:-9443}:9443 restart: unless-stopped shm_size: 512mb labels: - traefik.enable=true + - traefik.docker.network=proxy-net - traefik.http.routers.authentik-stvnliu-me.tls=true - traefik.http.routers.authentik-stvnliu-me.entrypoints=websecure - traefik.http.routers.authentik-stvnliu-me.rule=Host(`sso.stvnliu.me`) From fea9254d5f3207cd1d874c98581f92df3ea5e61c Mon Sep 17 00:00:00 2001 From: "steven@rockyserver" Date: Tue, 20 Oct 2026 10:13:43 +0000 Subject: [PATCH 7/7] deployment mc & drasl --- core/docker-compose.yml | 2 +- domains/stvnliu.me/docker-compose.yml | 1 + domains/stvnliu.me/mc/.gitignore | 3 +++ domains/stvnliu.me/mc/docker-compose.yml | 16 ++++++++++++---- domains/stvnliu.me/mc/drasl/docker-compose.yml | 18 +++++++++++------- 5 files changed, 28 insertions(+), 12 deletions(-) create mode 100644 domains/stvnliu.me/mc/.gitignore diff --git a/core/docker-compose.yml b/core/docker-compose.yml index cd1a579..93f9a64 100644 --- a/core/docker-compose.yml +++ b/core/docker-compose.yml @@ -13,7 +13,7 @@ services: - "--entrypoints.websecure.address=:443" - "--entrypoints.minecraft.address=:25565/tcp" - "--entrypoints.websecure.http.tls=true" - - "--log.level=DEBUG" + - "--log.level=INFO" - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - "--entrypoints.web.http.redirections.entrypoint.permanent=true" diff --git a/domains/stvnliu.me/docker-compose.yml b/domains/stvnliu.me/docker-compose.yml index 99a7d61..df4212a 100644 --- a/domains/stvnliu.me/docker-compose.yml +++ b/domains/stvnliu.me/docker-compose.yml @@ -3,3 +3,4 @@ include: - path: ./git/docker-compose.yml - path: ./sso/docker-compose.yml - path: ./caldav/docker-compose.yml + - path: ./mc/docker-compose.yml diff --git a/domains/stvnliu.me/mc/.gitignore b/domains/stvnliu.me/mc/.gitignore new file mode 100644 index 0000000..a3830b7 --- /dev/null +++ b/domains/stvnliu.me/mc/.gitignore @@ -0,0 +1,3 @@ +data/ +drasl/data/ +drasl/config/ diff --git a/domains/stvnliu.me/mc/docker-compose.yml b/domains/stvnliu.me/mc/docker-compose.yml index 7fe25a5..432a687 100644 --- a/domains/stvnliu.me/mc/docker-compose.yml +++ b/domains/stvnliu.me/mc/docker-compose.yml @@ -1,4 +1,8 @@ -includes: +networks: + proxy_net: + name: "proxy-net" + external: true +include: - path: ./drasl/docker-compose.yml services: minecraft: @@ -7,12 +11,16 @@ services: tty: true stdin_open: true networks: - - minecraft - - proxy + - proxy_net environment: EULA: "TRUE" VERSION: 26.3 TYPE: PAPER JVM_OPTS: "-Dminecraft.api.env=custom -Dminecraft.api.auth.host=https://drasl.stvnliu.me/auth -Dminecraft.api.account.host=https://drasl.stvnliu.me/account -Dminecraft.api.profiles.host=https://drasl.stvnliu.me/account -Dminecraft.api.session.host=https://drasl.stvnliu.me/session -Dminecraft.api.services.host=https://drasl.stvnliu.me/services -Dminecraft.api.discovery.host=https://drasl.stvnliu.me/discovery/minecraft/client" - volumes: + volumes: - ./data:/data + labels: + - traefik.enable=true + - traefik.tcp.routers.mc.rule=HostSNI(`*`) + - traefik.tcp.routers.mc.entrypoints=minecraft + - traefik.tcp.services.mc.loadbalancer.server.port=25565 diff --git a/domains/stvnliu.me/mc/drasl/docker-compose.yml b/domains/stvnliu.me/mc/drasl/docker-compose.yml index 6b43eb0..214ccc3 100644 --- a/domains/stvnliu.me/mc/drasl/docker-compose.yml +++ b/domains/stvnliu.me/mc/drasl/docker-compose.yml @@ -1,14 +1,18 @@ networks: - default_net: - - external: true - minecraft_net: - - external: true + proxy_net: + name: "proxy-net" + external: true services: drasl: image: unmojang/drasl networks: - - default_net - - minecraft_net + - proxy_net volumes: - ./config:/etc/drasl - - ./data: /var/lib/drasl + - ./data:/var/lib/drasl + labels: + - traefik.enable=true + - traefik.http.routers.drasl-stvnliu-me.tls=true + - traefik.http.routers.drasl-stvnliu-me.entrypoints=websecure + - traefik.http.routers.drasl-stvnliu-me.rule=Host(`drasl.stvnliu.me`) + - traefik.http.services.drasl-stvnliu-me.loadbalancer.server.port=25585