il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2026-AUG-23

Browse Source
This commit is contained in:
il
2026-08-23 21:55:12 +09:00
parent ada7e751d8
commit 56fb5716b5
19 changed files with 412 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/node/infra/nftables.conf.j2
+1 -1
View File
@@ -8,7 +8,7 @@ define NET6_SERVER = {{ hostvars['fw']['network']['subnet']['ipv6']['server'] }}
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv4'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network']['console']['ipv6'] | dict2items | rejectattr('key', 'equalto', 'reverse') | map(attribute='value') | join(', ')}} }
define PORTS_SSH = 22
define PORTS_DB = 5432
define PORTS_DB = { 5432, 3306 }
define PORTS_CA = {{ services['ca']['ports']['https'] }}
define PORTS_LDAPS = 636
define PORTS_LDAPS_FORWARD = {{ services['ldap']['ports']['ldaps'] }}
config/secrets/secrets.yaml
+10 -11
View File
@@ -135,7 +135,6 @@ postgresql:
nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str]
memos: ENC[AES256_GCM,data:BaNTnZFZH4oMTnDkgrf2/fMTkO43rc9bSsgnDWrHJ/Z6+MZdMitpIMkrMN4=,iv:JsG3B0YweZYO96MW9NmoSsIG++gFq+jRUsozwJtWl3M=,tag:orLTUiW0inOJdD4YSp4baQ==,type:str]
mealie: ENC[AES256_GCM,data:XbYHQv6HBWCXUBRmcbQZN5Y1Gw+V+Wra28Mp+m+ZGl8VRXsKMu5507vGHQM=,iv:zp4ZarqG9KshiBV8F8UksfI2QXmXHwqPw631r/5bYy8=,tag:jvsvXrUsCvpQGIbLV9jTYQ==,type:str]
homebox: ENC[AES256_GCM,data:EhNnltOBwLai5vEMt7Dih5Ug6h3ojrdbwhq4Vr0tg/p/0nqI9L7O/Le0B4w=,iv:14oyl916t0inr+W/lztQCjYiSQ0vIIwC9NmbezDuvvY=,tag:IiXZd3NU+dUvDrHpxJXFew==,type:str]
mastodon: ENC[AES256_GCM,data:hq1ETBK9iUI7kWFO+9pZwMQMbmyLExGk7/VzBwDdLFbzptXL2KEi6oYRCS0=,iv:hF1C8lsnP2i3LxDIuOA6op4qKXQKjJ7gqznDst7hVAU=,tag:maR7Jvsv3DJGrO77EzmBDA==,type:str]
@@ -145,6 +144,14 @@ postgresql:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:n2lt/VhdDjqfcwYN5OUjTg==,iv:QidjK4AzjisEzaDmXhYZKWyx/BrHOsgGcxxcirQOlQo=,tag:0ViayyRFg5E3kQ5vPgV5fA==,type:comment]
mariadb:
key: ENC[AES256_GCM,data:JsEzdgp0RdLRuZ6vfOugPGjz5+tBlpZpWhFOSkKSbEeUCU9D/IkAFUcZGwCBR4XBl2cOx8uszCryi6Cxm2L1fT+x6N9auMiM07W0A34kT5PMT3w+n+wQx48Ss0fZRH1kfH2tg8G4J5ASvl0dylGnuv1aIGFsmD+6Ygj+F2AFef6Y/+Sje24QKeyISU9+2tsfTNoRAH9ECxdIk2cI14ayQbISaTlBhlzciL/bzvRqqtz6KoB2HYj2YX5EK/zVRpBwkssbMsGR/LMepUWyg2hic78gc+UGK9FAkfCd1ctFQyUgsck=,iv:dSvRa+wdKPXhz+SI+69eT/YDAIoWMTcouZJQHgRIdRU=,tag:pEz/doDqhB+hnDMRMS5CqQ==,type:str]
crt: ENC[AES256_GCM,data:D9/6WbvHwaetFQY/MQMq7F3Oprz8aiY2B6urDCXhwqDD1ipqDaVT/g3Q87LsauCJiwaflCcTms7I0ulQIHUyiqHUrDmE+yxzeEIAwFHVaxr34FURnGHLKFPlKvvBcLC28WjWIYbdaNbfjtZTORZwiLVqZgNoM91rFJDDbTlo+a4OBip40nk8/UPv5NGIApGzJlcc3UZevGsbEeu5g12KfbfaW7mMnor5my7zsvUQclNdWFyOlCUmWDHjHvjwWSPom9AlTnDVoGnePdigfeEEbz19kxGGjL+li48buskbnXPTR8/4G9OHT+yiQtszNq9mZTxyTXRagzpIzYQjBK4/Ww+lLOHgaKG4awrSR2Y8NLZfPsbaJVWg+XvkI9E9s1LfXs/hBsRD6f26joFzXVQpZgzuWqrwSBtnP3LY10KygxVN+kbLHCxIxohM6SH/rM5eMRGftZlPQMZTIxzirjF7YZcdtvRFtd8BYmksYaEuQ6PnFroh7xv9M/5GDaEpkkQngiRkxrXfHaExjOBZvgtUV2R+7Tzd5odu8Rj7nfZOySlPy0qifVODSFbIKYN0HVqYur0PxLZD10xzx1PfwBWvnR1U0QzTVbbxGD2vDPf9SJEuREcWsOwNzM9snuuR7S3uzDX28MwvyAeALYz7PWhC6jEhgUyEShuzAn7BNsJySgPrRcgrP5s5fQU3Fkjfg/s8DYXFxFCRELT0pNf7TjFsW/tevxonlhzAbGXMnNiB3vwHyh/dPLQA8Lq0MDsLPWuiDy+cuoq9k22hIOJOrmnoEIEqErp2W5VAliFYBj6QKav/f+2XxK4iNA/vcZcFdp5w4tC8h3GNVXHVmJrgPT0wkajOE1UBgHwTxns0EJtUTGNDY4B8kdKHONDqFscq+1WCHah69Dq1UD1rOQDeSlfyso+N5w0f2GsxPmGnROXWLxm+VMQfe4PQPdSrrRcW,iv:LuX8l49se20frOc6qIBopqn99DRFzi2o9BfHqfL+CBg=,tag:sq8Wei7DZJPgPMSK1IlJSw==,type:str]
password: ""
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:VuOcF5INAvCNDvXhcAc=,iv:zdTFTKaII606RjjDJbdUyv8jGba8abL7lJNTsPH5C74=,tag:cYSefZHKIuvHmAzoxierQg==,type:comment]
ldap:
key: ENC[AES256_GCM,data:PwQ/AtsQbbM454iM0wpUjGRfxyxNY5lGDARv/XOdk0yMCHRsf9qHKaW37EwcqNe+MVTJH+sx8lHDdxRYF1gO1yj6kasEIbMeo9cIaGQHvey5dYdber/qUkcjuAXyhSZGSUXI3PR1CuAsiqNUEruh/eKyDZAvHTTY0Rc5jk4HLFzPqqBjBOMkA6VQXJ2I+v4s8W0T8/JEQ5l6avwYbaaInIIY+uPV+sY0mBczAuaHLyeA3V7VQNTxQ9lUgdfH/TpgBn9EBH2wWqIGk2zQ6XmVrmOarCo/+JqwLQVEyY5TTrNuBto=,iv:iYzoRXjH8NjPnX5nBhU2gTQXOekXMirjTGhmpGt3YAs=,tag:IxwtGNXx1i54Jnhn1aZx3w==,type:str]
@@ -280,14 +287,6 @@ outline:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:Fis0K+QOQwUfHItGI5U=,iv:kRmt4WhV6bBwN7Xl2xLrbxnKuLKTBC5nI9ZnQSIgIwo=,tag:whb1oOEX+fry9GS1+RlPrA==,type:comment]
memos:
oidc:
secret: ENC[AES256_GCM,data:+rX8znej0jjXybmUjoI7DkybNkNeg15Py7bav665Uej48I5ZAZbUiKwccNo=,iv:UzcCqXxvweosRL8afhyRBB2ERm1PNs+tuxeDwL7Mcu8=,tag:+gJWSAq2BpSlSw/iwhIbpA==,type:str]
hash: ENC[AES256_GCM,data:D7+37XTpDFRabT5YEh9nfxO1Q9Sdc98jAxPsjkPzj7bthn1H0dlLYZSJ2Fy8Ye4vjIFO+TZ6HWx8N4cSwHTfgls3EYFh1TW0FUnyCY1kYd/+ljfZB9Y6M+i5zb5nEIBHI32Sk7/B20cGnr0SUb3EKU+SmnACgZ0fjKKyUpSzGu75MH8=,iv:3RkTpgy85JPJqu6AEKrw8RY2O+L/CldPuPpN9ln54u8=,tag:Nl0DL5tVenA/fdRNOGyPkA==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:ATLTbBi1RsBr2ldHDDH4,iv:RFbPz/46BIGYv9Wo5Jxw5Swi4Xo2JgIEI4IsO4rCQoQ=,tag:i7/2ItQSFurrmdNaBWwWAA==,type:comment]
mealie:
oidc:
@@ -377,7 +376,7 @@ sops:
k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
-----END AGE ENCRYPTED FILE-----
recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
lastmodified: "2026-08-21T05:32:45Z"
mac: ENC[AES256_GCM,data:VED6JYuDQlmXl6buMuPEkF4LRbVL8RmlQhNYguHRvrUEbAYZn4iB5bUCoZuLhklsBc5b9Y+Xzgd4Gixk0puS85K2FxQ1jXazq/pVvKl3UPn3XFbqhXFtwLxq1Rqj1iY69E+pgiI31/pflcGwmJbzOFNO8SZ2jMTrH690P3XsCAM=,iv:6HR/+VC2Or+RMMdrHD7r6sp4oUR4g/MsNudg+J7iPe0=,tag:DrH6lcpptXn1OOucxfzK/g==,type:str]
lastmodified: "2026-08-23T12:15:15Z"
mac: ENC[AES256_GCM,data:EKc4Ifpl/NIaPJ/QqGc3Bw+KDMtiZpi7dK1Um/axitORcdOCR0gfTAbtuaFp88Ss9hpHu1+hJYL3yYihELZz+7MDyiydSAC7QdGPeARwWa4XlCap//K7+W5Wpu+SRC8H/IE6jejuCF2LwsrnXYMssAlujLSXI65JIaOIrgn9nT8=,iv:iuQcoJdacW9OTRP05C25/BKaiqRUjEQl8ZhPKQavzIs=,tag:GDDJFqWOso34QN5oIwWung==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.2
config/services/containers/app/memos/memos.container.j2
-34
View File
@@ -1,34 +0,0 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=Memos
[Container]
Image=docker.io/neosmemo/memos:{{ version['containers']['memos'] }}
ContainerName=memos
HostName=memos
PublishPort={{ services['memos']['ports']['http'] }}:5230/tcp
# Volumes
Volume=%h/data/containers/memos/data:/var/opt/memos:rw
Volume=%h/containers/memos/ssl:/etc/ssl/memos:ro
# General
Environment="TZ={{ timezone }}"
Environment="MEMOS_MODE=prod"
Environment="MEMOS_PORT=5230"
Environment="MEMOS_INSTANCE_URL=https://{{ services['memos']['domain']['public'] }}.{{ domain['public'] }}"
# Database (PostgreSQL)
Environment="MEMOS_DRIVER=postgres"
Secret=MEMOS_DSN,type=env
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
config/services/containers/app/tandoor/tandoor.container.j2
+3
View File
@@ -22,6 +22,9 @@ Environment="ALLOWED_HOSTS={{ services['tandoor']['domain']['public'] }}.{{ doma
Environment="CSRF_TRUSTED_ORIGINS=https://{{ services['tandoor']['domain']['public'] }}.{{ domain['public'] }}"
# auth Caddy -> app Caddy -> Tandoor built-in nginx
Environment="ALLAUTH_TRUSTED_PROXY_COUNT=3"
# Set Django gunicorn worker as 1, and threads as 2
Environment="GUNICORN_WORKERS=1"
Environment="GUNICORN_THREADS=2"
# Secrets
Secret=TANDOOR_SECRET_KEY,type=env,target=SECRET_KEY
config/services/containers/auth/authelia/config/authelia.yaml.j2
-22
View File
@@ -252,28 +252,6 @@ identity_providers:
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/memos/
- client_id: 'memos'
client_name: 'Memos'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['memos']['oidc']['hash'] }}'
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://{{ services['memos']['domain']['public'] }}.{{ domain['public'] }}/auth/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/mealie/
- client_id: 'mealie'
client_name: 'Mealie'
config/services/containers/infra/mariadb/config/mariadb.cnf.j2
+39
View File
@@ -0,0 +1,39 @@
#------------------------------------------------------------------------------
# CUSTOMIZED OPTIONS
#------------------------------------------------------------------------------
[mariadb]
# Listen address
bind-address = 0.0.0.0
# Max connections
max_connections = 250
# Listen port
port = {{ services['mariadb']['ports']['tcp'] }}
# SSL
ssl-ca = /etc/ssl/mariadb/{{ root_cert_filename }}
ssl-cert = /etc/ssl/mariadb/mariadb.crt
ssl-key = /etc/ssl/mariadb/mariadb.key
ssl-cipher = HIGH:!aNULL:!MD5
require_secure_transport = ON
# InnoDB
innodb_buffer_pool_size = 512M
innodb_log_file_size = 5G
innodb_flush_log_at_trx_commit = 1
# Temporary memory
tmp_table_size = 16M
max_heap_table_size = 16M
# IO
innodb_io_capacity = 200
# SSD
innodb_flush_neighbors = 0
[client]
protocol=socket
skip-ssl
config/services/containers/infra/mariadb/mariadb.container.j2
+37
View File
@@ -0,0 +1,37 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=MariaDB
After=network-online.target
Wants=network-online.target
[Container]
Image=docker.io/library/mariadb:{{ version['containers']['mariadb'] }}
ContainerName=mariadb
HostName=mariadb
PublishPort={{ services['mariadb']['ports']['tcp'] }}:3306/tcp
Volume=%h/containers/mariadb/data:/var/lib/mysql:rw
Volume=%h/containers/mariadb/config:/etc/mysql/conf.d/:ro
Volume=%h/containers/mariadb/ssl:/etc/ssl/mariadb:ro
Volume=%h/containers/mariadb/init:/docker-entrypoint-initdb.d/:ro
Volume=%h/data/containers/mariadb/backups:/backups:rw
# General
Environment="TZ={{ timezone }}"
# root is only available in container (localhost)
Environment="MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=1"
Environment="MARIADB_ROOT_HOST=localhost"
[Service]
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
config/services/containers/infra/mariadb/services/mariadb-data-backup@.service
+26
View File
@@ -0,0 +1,26 @@
[Unit]
Description=MariaDB Data %i Backup Service
After=mariadb.service
BindsTo=mariadb.service
[Service]
Type=oneshot
# logging
StandardOutput=journal
StandardError=journal
ExecStartPre=/usr/bin/podman exec mariadb sh -c "mkdir -p /backups/%i && chown mysql:root /backups/%i && chmod 770 /backups/%i"
ExecStartPre=/usr/bin/podman exec mariadb sh -c "mkdir -p /backups/sql && chown mysql:root /backups/sql && chmod 770 /backups/sql"
# Run the script
## User SQL
ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'mariadb -uroot -N -B -e \"SHOW CREATE USER \'%i\'@\'%%\';\" | sed "s/$/;/" > /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql'
## Database SQL
ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'mariadb-dump -uroot --single-transaction --routines --events --triggers --databases %i_db >> /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql'
## Grant SQL
ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'mariadb -uroot -N -B -e \"SHOW GRANTS FOR \'%i\'@\'%%\';\" | sed "s/$/;/" >> /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql'
ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'cp -a /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql /backups/sql/mariadb_%i.sql'
ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c "find /backups/%i -maxdepth 1 -type f -name 'mariadb_%i_*.sql' -mtime +7 -delete"
ExecStart=/usr/bin/podman exec mariadb sh -c "chown -R mysql:root /backups/%i && chmod 660 /backups/%i/*"
ExecStart=/usr/bin/podman exec mariadb sh -c "chown -R mysql:root /backups/sql && chmod 660 /backups/sql/mariadb_%i.sql"
config/services/containers/infra/mariadb/services/mariadb-data-backup@.timer
+17
View File
@@ -0,0 +1,17 @@
[Unit]
Description=Run %i Data Backup service every day
[Timer]
# Execute service after 1 min on booting
OnBootSec=1min
# Execute service every day 00:00
OnCalendar=*-*-* 00:00:00
# Random time to postpone the timer
RandomizedDelaySec=15min
# When timer is activated, Service also starts.
Persistent=true
[Install]
WantedBy=timers.target