2026-AUG-25

config/services/containers/app/bookstack/bookstack.container.j2

@@ -0,0 +1,60 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Bookstack
+
+[Container]
+Image=docker.io/solidnerd/bookstack:{{ version['containers']['bookstack'] }}
+
+ContainerName=bookstack
+HostName=bookstack
+
+PublishPort={{ services['bookstack']['ports']['http'] }}:8080/tcp
+
+# Volumes
+Volume=%h/data/containers/bookstack/public:/var/www/bookstack/public/uploads:rw
+Volume=%h/data/containers/bookstack/storage:/var/www/bookstack/storage/uploads:rw
+Volume=%h/containers/bookstack/ssl:/etc/ssl/bookstack:ro
+
+# General
+Environment="TZ={{ timezone }}"
+Environment="APP_ENV=production"
+Environment="APP_DEBUG=false"
+Environment="APP_URL=https://{{ services['bookstack']['domain']['public'] }}.{{ domain['public'] }}"
+# 169.254.1.2 is podman pasta APIPA ip address to communicate the other container in the same host
+Environment="APP_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
+
+# Secrets
+Secret=BOOKSTACK_SECRET_KEY,type=env,target=APP_KEY
+
+# Database (MariaDB)
+Environment="DB_HOST={{ services['mariadb']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['mariadb']['ports']['tcp'] }}"
+Environment="DB_DATABASE=bookstack_db"
+Environment="DB_USERNAME=bookstack"
+Environment="MYSQL_ATTR_SSL_CA=/etc/ssl/bookstack/{{ root_cert_filename }}"
+Secret=BOOKSTACK_DB_PASSWORD,type=env,target=DB_PASSWORD
+
+# OIDC
+Environment="AUTH_METHOD=oidc"
+Environment="AUTH_AUTO_INITIATE=false"
+Environment="OIDC_NAME=Authelia"
+Environment="OIDC_ISSUER=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}"
+Environment="OIDC_ISSUER_DISCOVER=true"
+Environment="OIDC_CLIENT_ID=bookstack"
+Environment="OIDC_ADDITIONAL_SCOPES=groups"
+Environment="OIDC_DISPLAY_NAME_CLAIMS=name"
+Environment="OIDC_GROUPS_CLAIM=groups"
+Environment="OIDC_USER_TO_GROUPS=true"
+Environment="OIDC_REMOVE_FROM_GROUPS=true"
+Environment="OIDC_END_SESSION_ENDPOINT=false"
+Secret=BOOKSTACK_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
+
+[Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['mariadb']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['mariadb']['ports']['tcp'] }}
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target

config/services/containers/app/gitea/gitea.container.j2

@@ -21,6 +21,8 @@ Volume=%h/containers/gitea/ssl:/etc/ssl/gitea:ro
 # General
 Environment="TZ={{ timezone }}"
 Environment="GITEA__server__DISABLE_SSH=true"
+Environment="GITEA__server__REVERSE_PROXY_LIMIT=2"
+Environment="GITEA__server__REVERSE_PROXY_TRUSTED_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 # Database
 Environment="GITEA__database__DB_TYPE=postgres"
 Environment="GITEA__database__HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"

config/services/containers/app/immich/immich.container.j2

@@ -27,6 +27,7 @@ Volume=%h/containers/immich/ssl:/etc/ssl/immich:ro
 Environment="TZ={{ timezone }}"
 # The new environment from version 2.7.0 to enable CSP
 Environment="IMMICH_HELMET_FILE=true"
+Environment="IMMICH_TRUSTED_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 
 # Redis
 Environment="REDIS_HOSTNAME=host.containers.internal"

config/services/containers/app/mastodon/mastodon-streaming.container.j2

@@ -20,6 +20,7 @@ Volume=%h/containers/mastodon/ssl:/etc/ssl/mastodon:ro
 Environment="TZ={{ timezone }}"
 Environment="LOCAL_DOMAIN={{ services['mastodon']['domain']['public'] }}.{{ domain['public'] }}"
 Environment="LOG_LEVEL=info"
+Environment="TRUSTED_PROXY_IP={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 
 # PostgreSQL
 Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"

config/services/containers/app/mastodon/mastodon-web.container.j2

@@ -25,6 +25,7 @@ Environment="LIMITED_FEDERATION_MODE=true"
 Environment="DISALLOW_UNAUTHENTICATED_API_ACCESS=true"
 Environment="ES_ENABLED=false"
 Environment="RAILS_LOG_LEVEL=info"
+Environment="TRUSTED_PROXY_IP={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }},{{ hostvars['fw']['network']['auth']['ipv4']['server'] }},{{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 
 # PostgreSQL
 Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"

config/services/containers/app/nextcloud/nextcloud.container.j2

@@ -21,6 +21,8 @@ Volume=%h/data/containers/nextcloud/html:/var/www/html:rw
 
 # General
 Environment="TZ={{ timezone }}"
+Environment="APACHE_DISABLE_REWRITE_IP=1"
+Environment="TRUSTED_PROXIES={{ hostvars['fw']['network']['podman']['ipv4']['lla'] }} {{ hostvars['fw']['network']['auth']['ipv4']['server'] }} {{ hostvars['fw']['network']['auth']['ipv6']['server'] }}"
 # PostgreSQL
 Environment="PGSSLMODE=verify-full"
 Environment="PGSSLROOTCERT=/etc/ssl/nextcloud/{{ root_cert_filename }}"

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -389,7 +389,7 @@ identity_providers:
       - client_id: 'tandoor'
         client_name: 'tandoor'
         consent_mode: 'implicit'
-        client_secret: '$pbkdf2-sha512$310000$IOvwfqSgUvMZ5nxZ.dEDTw$FX3x1XaH3.S9gNFHiv0DdcCSCEomFMdoxd.yA3PEmVksRyd7D8LuSdooN.DA3B.jyVDVLFSJ9isIChEbJSmEvw'
+        client_secret: '{{ hostvars['console']['tandoor']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
         require_pkce: false
@@ -407,3 +407,26 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_basic'
+      # https://www.authelia.com/integration/openid-connect/clients/bookstack/
+      - client_id: 'bookstack'
+        client_name: 'bookstack'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['bookstack']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: true
+        pkce_challenge_method: 'S256'
+        redirect_uris:
+          - 'https://{{ services['bookstack']['domain']['public'] }}.{{ domain['public'] }}/oidc/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'

config/services/containers/infra/mariadb/config/mariadb.cnf.j2

@@ -4,7 +4,7 @@
 [mariadb]
 
 # Listen address
-bind-address = 0.0.0.0
+bind-address = 0.0.0.0,::
 
 # Max connections
 max_connections = 250