2026-AUG-29

ansible/inventory/group_vars/all.yaml

@@ -178,12 +178,13 @@ services:
     dependency:
       web: "app-public"
       db: "postgresql"
-  linkwarden:
+  linkding:
     domain:
-      public: "link"
+      public: "linkding"
-      internal: "link.app"
+      internal: "linkding.app"
     ports:
-      http: "3005"
+      http: "9090"
+    subuid: "100032"
     dependency:
       web: "app-public"
       db: "postgresql"
@@ -244,19 +245,6 @@ services:
   immich-ml:
     ports:
       http: "3003"
-  booklogr:
-    domain:
-      public: "booklogr"
-      internal: "booklogr.app"
-    ports:
-      http: "5150"
-      api: "5000"
-    route:
-      api: "/v1 /v1/*"
-      deny: "/v1/login /v1/login/* /v1/register /v1/register/*"
-    dependency:
-      web: "app-public"
-      db: "postgresql"
   outline:
     domain:
       public: "outline"
@@ -298,16 +286,6 @@ services:
     subuid: "100998"
     dependency:
       web: "app-public"
-  mealie:
-    domain:
-      public: "mealie"
-      internal: "mealie.app"
-    ports:
-      http: "9000"
-    subuid: "100910"
-    dependency:
-      web: "app-public"
-      db: "postgresql"
   tandoor:
     domain:
       public: "tandoor"
@@ -326,17 +304,6 @@ services:
     dependency:
       web: "app-public"
       db: "postgresql"
-  romm:
-    domain:
-      public: "romm"
-      internal: "romm.app"
-    ports:
-      http: "8002"
-      redis: "6384"
-    subuid: "100999"
-    dependency:
-      web: "app-public"
-      db: "postgresql"
 
 version:
   packages:
@@ -375,14 +342,11 @@ version:
     collabora: "26.04.3.1.1"
     sure: "0.7.3"
     outline: "1.9.2"
-    mealie: "v3.22.0"
     homebox: "0.26.2"
     homepage: "v2.0.0"
     snappymail: "v2.38.2"
     mastodon: "v4.6.6"
-    booklogr: "v1.11.1"
     papra: "26.6.1-rootless"
-    romm: "5.1.0"
     tandoor: "2.6.13"
     bookstack: "26.5.3"
-    linkwarden: "v2.16.1"
+    linkding: "1.46.2"

ansible/inventory/host_vars/app.yaml

@@ -20,7 +20,7 @@ vm:
     <vcpupin vcpu='5' cpuset='11'/>
     <emulatorpin cpuset='10-11'/>
   shares: 1024
-  memory: 16
+  memory: 48
   storage: 256
   data_storage:
     name: "vdb"

ansible/inventory/host_vars/bk.yaml

@@ -17,7 +17,7 @@ vm:
     <emulatorpin cpuset='6-7'/>
   shares: 512
   memory: 2
-  storage: 32
+  storage: 64
   data_storage:
     name: "vdb"
     pool: "backup"

ansible/playbooks/app/site.yaml

@@ -102,10 +102,27 @@
           - "jq"
           - "netcat-openbsd"
           - "dbus-user-session"
+          - "ksmtuned"
         state: "present"
       become: true
       tags: ["init", "site", "install-packages"]
 
+    - name: Enable ksm.service
+      ansible.builtin.systemd:
+        name: "ksm.service"
+        state: "started"
+        enabled: true
+      become: true
+      tags: ["init", "site", "install-packages"]
+
+    - name: Disable ksmtuned.service
+      ansible.builtin.systemd:
+        name: "ksmtuned.service"
+        state: "stopped"
+        enabled: false
+      become: true
+      tags: ["init", "site", "install-packages"]
+
     - name: Set data volume
       ansible.builtin.include_role:
         name: "common"
@@ -234,14 +251,6 @@
           tags: ["site", "outline"]
       tags: ["site", "outline"]
 
-    - name: Set mealie
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_mealie"
-        apply:
-          tags: ["site", "mealie"]
-      tags: ["site", "mealie"]
-
     - name: Set homebox
       ansible.builtin.include_role:
         name: "app"
@@ -258,14 +267,6 @@
           tags: ["site", "mastodon"]
       tags: ["site", "mastodon"]
 
-    - name: Set booklogr
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_booklogr"
-        apply:
-          tags: ["site", "booklogr"]
-      tags: ["site", "booklogr"]
-
     - name: Set papra
       ansible.builtin.include_role:
         name: "app"
@@ -290,21 +291,13 @@
           tags: ["site", "bookstack"]
       tags: ["site", "bookstack"]
 
-    - name: Set romm
+    - name: Set linkding
       ansible.builtin.include_role:
         name: "app"
-        tasks_from: "services/set_romm"
+        tasks_from: "services/set_linkding"
         apply:
-          tags: ["site", "romm"]
+          tags: ["site", "linkding"]
-      tags: ["site", "romm"]
+      tags: ["site", "linkding"]
-
-    - name: Set linkwarden
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_linkwarden"
-        apply:
-          tags: ["site", "linkwarden"]
-      tags: ["site", "linkwarden"]
 
     - name: Set homepage
       ansible.builtin.include_role:

ansible/roles/app/handlers/main.yaml

@@ -92,17 +92,6 @@
   listen: "notification_restart_outline"
   ignore_errors: true # noqa: ignore-errors
 
-- name: Restart mealie
-  ansible.builtin.systemd:
-    name: "mealie.service"
-    state: "restarted"
-    enabled: true
-    scope: "user"
-    daemon_reload: true
-  changed_when: false
-  listen: "notification_restart_mealie"
-  ignore_errors: true # noqa: ignore-errors
-
 - name: Restart homebox
   ansible.builtin.systemd:
     name: "homebox.service"
@@ -151,20 +140,6 @@
   listen: "notification_restart_mastodon"
   ignore_errors: true # noqa: ignore-errors
 
-- name: Restart booklogr
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    state: "restarted"
-    enabled: true
-    scope: "user"
-    daemon_reload: true
-  loop:
-    - "booklogr-api.service"
-    - "booklogr-web.service"
-  changed_when: false
-  listen: "notification_restart_booklogr"
-  ignore_errors: true # noqa: ignore-errors
-
 - name: Restart papra
   ansible.builtin.systemd:
     name: "papra.service"
@@ -176,17 +151,6 @@
   listen: "notification_restart_papra"
   ignore_errors: true # noqa: ignore-errors
 
-- name: Restart romm
-  ansible.builtin.systemd:
-    name: "romm.service"
-    state: "restarted"
-    enabled: true
-    scope: "user"
-    daemon_reload: true
-  changed_when: false
-  listen: "notification_restart_romm"
-  ignore_errors: true # noqa: ignore-errors
-
 - name: Restart tandoor
   ansible.builtin.systemd:
     name: "tandoor.service"
@@ -209,13 +173,13 @@
   listen: "notification_restart_bookstack"
   ignore_errors: true # noqa: ignore-errors
 
-- name: Restart linkwarden
+- name: Restart linkding
   ansible.builtin.systemd:
-    name: "linkwarden.service"
+    name: "linkding.service"
     state: "restarted"
     enabled: true
     scope: "user"
     daemon_reload: true
   changed_when: false
-  listen: "notification_restart_linkwarden"
+  listen: "notification_restart_linkding"
   ignore_errors: true # noqa: ignore-errors

ansible/roles/app/tasks/services/set_bookstack.yaml

@@ -14,7 +14,6 @@
     - "containers/bookstack/ssl"
   become: true
 
-
 - name: Deploy root certificate
   ansible.builtin.copy:
     content: |

ansible/roles/app/tasks/services/set_linkding.yaml

@@ -0,0 +1,84 @@
+---
+- name: Create linkding directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ services['linkding']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  loop:
+    - "data/containers/linkding"
+    - "data/containers/linkding/data"
+    - "containers/linkding"
+    - "containers/linkding/ssl"
+  become: true
+
+- name: Deploy root certificate
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ca']['root']['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/linkding/ssl/{{ root_cert_filename }}"
+    owner: "{{ services['linkding']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0440"
+  become: true
+  notify: "notification_restart_linkding"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    - name: "LINKDING_DB_PASSWORD"
+      value: "{{ hostvars['console']['postgresql']['password']['linkding'] }}"
+    - name: "LINKDING_OIDC_CLIENT_SECRET"
+      value: "{{ hostvars['console']['linkding']['oidc']['secret'] }}"
+  notify: "notification_restart_linkding"
+  no_log: true
+
+- name: Pull image
+  containers.podman.podman_image:
+    name: "ghcr.io/sissbruecker/linkding"
+    tag: "{{ version['containers']['linkding'] }}"
+    state: "present"
+    pull: true
+
+- name: Deploy linkding.container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/linkding/linkding.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/linkding.container"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0644"
+  notify: "notification_restart_linkding"
+
+- name: Enable linkding.service
+  ansible.builtin.systemd:
+    name: "linkding.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Check container archive images
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/archives/containers/ghcr.io_sissbruecker_linkding_{{ version['containers']['linkding'] }}.tar"
+  register: container_archive_images
+
+- name: Save container archive images
+  containers.podman.podman_save:
+    image:
+      - "ghcr.io/sissbruecker/linkding:{{ version['containers']['linkding'] }}"
+    dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_sissbruecker_linkding_{{ version['containers']['linkding'] }}.tar"
+    format: "oci-archive"
+    force: false
+  when: not container_archive_images.stat.exists
+
+- name: Fetch container archive images
+  ansible.builtin.fetch:
+    src: "{{ node['home_path'] }}/archives/containers/ghcr.io_sissbruecker_linkding_{{ version['containers']['linkding'] }}.tar"
+    dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
+    flat: true

config/secrets/secrets.yaml

@@ -135,13 +135,10 @@ postgresql:
         nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
         sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
         outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str]
-        mealie: ENC[AES256_GCM,data:XbYHQv6HBWCXUBRmcbQZN5Y1Gw+V+Wra28Mp+m+ZGl8VRXsKMu5507vGHQM=,iv:zp4ZarqG9KshiBV8F8UksfI2QXmXHwqPw631r/5bYy8=,tag:jvsvXrUsCvpQGIbLV9jTYQ==,type:str]
         homebox: ENC[AES256_GCM,data:EhNnltOBwLai5vEMt7Dih5Ug6h3ojrdbwhq4Vr0tg/p/0nqI9L7O/Le0B4w=,iv:14oyl916t0inr+W/lztQCjYiSQ0vIIwC9NmbezDuvvY=,tag:IiXZd3NU+dUvDrHpxJXFew==,type:str]
         mastodon: ENC[AES256_GCM,data:hq1ETBK9iUI7kWFO+9pZwMQMbmyLExGk7/VzBwDdLFbzptXL2KEi6oYRCS0=,iv:hF1C8lsnP2i3LxDIuOA6op4qKXQKjJ7gqznDst7hVAU=,tag:maR7Jvsv3DJGrO77EzmBDA==,type:str]
-        booklogr: ENC[AES256_GCM,data:K+9Bb/GMbaviYIIesimugQg2RXF590L2T2XNlRI/bjc9BBb9/iivFlhLwa4=,iv:E/MGt0bKlITYKMYZjlmTZ2YonYTvNTaRI23n5xazyeE=,tag:Y3WUSHBHQiF1MVD/zQr5RQ==,type:str]
-        romm: ENC[AES256_GCM,data:nizBKAPWPRTxKZRPGOoff6WrbpK9z3s1RDhJmKghO4BhmgguH2C/5DlQ6V0=,iv:uiscRdOoS//Mxs8Lmw6sA+/YtcVhhuJoxP7AxQGJHNA=,tag:UM89ocQFBK3zVDsS8LhAiw==,type:str]
         tandoor: ENC[AES256_GCM,data:+5g/jzRMQoxocZntoE+1BU0MS00yEp0tyVNxriEIJ0pW2V1bsLhUAkwQ748=,iv:feNbpOhkdjmKS7Ovy0KGioOTyjQ4sflfH+50niP7Y8Y=,tag:51/u+EE3Pp5o7jnlj0AWIw==,type:str]
-        linkwarden: ENC[AES256_GCM,data:Prymyz9b8ePaAGY/0/bQYzQ9olb9u6NfQ/urKB9XvWRanJB/4dapM7kE/us=,iv:kQNlbBkJUTq5SGhmmbxjKQ71Pde8UZJlOxm/Wy3IFmw=,tag:Q0iRehhuAgK4owNypEo/BQ==,type:str]
+        linkding: ENC[AES256_GCM,data:+diOqVjK5RkDOpxCrb0M0sLWEufXEwhTNo0x5qH4FkteN8zaUAZfO8lD13I=,iv:jHQANXC1tamiphm33RpTKpEB3niLFx6IKzcdq8/KNCg=,tag:NwkkmUPOS9K0IKtUBVRWqg==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -289,14 +286,6 @@ outline:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:ATLTbBi1RsBr2ldHDDH4,iv:RFbPz/46BIGYv9Wo5Jxw5Swi4Xo2JgIEI4IsO4rCQoQ=,tag:i7/2ItQSFurrmdNaBWwWAA==,type:comment]
-mealie:
-    oidc:
-        secret: ENC[AES256_GCM,data:ldsfwWnexNNM4r+aP2h+woQROwbp9MpxAz8E/o1Q53GxcEwtixqvP6QZGoo=,iv:6M/lfuDU3IOd0nxLi2l02OD5FopErhSCp6AhxBGTI1k=,tag:3w0p+wi9T1PqNmgoM59gug==,type:str]
-        hash: ENC[AES256_GCM,data:YmziHxsFPJ93uMNG6/EUiPEfMvvAZM8/S5854GJ/fPPTMvXj9cM2sovkSrcNd7H0ac5KDJIcJoD9SC5lWKCAbjKzxHvI6CdI63SM8bExrDL2PVSGAf29VLU/cz8rQtZS39GWz2v5GWlpk67Emy0T115vruIGfDlan8zgQKK7YIWyVMs=,iv:xmnBYjBIWq6P2g5DyMh+wYskmJRcVDREGL/yYhJHyRs=,tag:qMWXHiLmAy5UvWFvv3Ct8g==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
 #ENC[AES256_GCM,data:b74wua/tFSoef2fq5jZhNQ==,iv:RDtz7Y6eFQKiVVnNvoLAfzE4xo8t7RFiKjLTbd0xo80=,tag:iUS7ofvuVj6ZTsy8zA6KSg==,type:comment]
 homebox:
     api_secret: ENC[AES256_GCM,data:BT6m0D9Xwa1tnQQRzpUnEF4bjLFne297oS3p8HM8Q/1Vakrf+uFcfS0C4MU=,iv:5WeWyfe8kt+AWwsV3YXxfLVuSEE8lYmNFxrXyRZzISc=,tag:cYd6U3BxqyGst+UsMpRypA==,type:str]
@@ -323,15 +312,6 @@ mastodon:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:I6O+AZ4EGMl6dXBowhMBG+c=,iv:bQ5mvEfVHDyTwNI+5hCsUkWEowP8fqir6lqLYPmsnbY=,tag:ta69wItzleRbky3vjU4+WA==,type:comment]
-booklogr:
-    secret_key: ENC[AES256_GCM,data:yImb0UKqDIeyCmThb3upJPIxZVF7wiaLboP8PO/K2yjCjI0qXOgSkXJbrlw=,iv:yQjqT4831bqbRYgjQ72Vcg6omweWWPTgj6ZUHeaSGWA=,tag:y0BQxLTQklFP5hmJjBNAMw==,type:str]
-    oidc:
-        secret: ENC[AES256_GCM,data:iLFtafeePxJuC2NyV9hPzkxqgR+67k23Szgl1SPZtuOE1wS6a9YVroTQKMo=,iv:1w0Jy0N4pu5O1h+DYtzAUv0Qd75pRNxV5l38fyrDIWI=,tag:mZ11TOrJzC1sxBxjcOEagQ==,type:str]
-        hash: ENC[AES256_GCM,data:0ShwGvr69/J+mNZ8+ALL4hEbouABbWXcj1kMV9M8jbyhe48FwikaeKY1SKTQRDB3XFMdRhOR+NFRDQhLvNN/7RW16ZPF2jkj/am4MEUQ0z8jd+imK98cpb7XuXb6DuU1cqtuKhG0lJcFQaHOCNXqSWoPi8oRUwHIpvGjXa3Wr4hC/pw=,iv:iPXaqonARTWV19E0RUIPt05DJ9iDKSS8skcT4xf8wYc=,tag:n6S6x5Qeh+M3itRopj9SbQ==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
 #ENC[AES256_GCM,data:BmZppA02YtiTykTtUnk=,iv:zV2x6W1yWhMegE+h7zdQNRxVrN7C16Lq4xpDkkZPcBw=,tag:MPGH1vjS1IYuZo2qf30qwA==,type:comment]
 papra:
     secret_key: ENC[AES256_GCM,data:AoqqUS2OUb11UwWNteZHqU6FF1eJVbmvANfZRvcwnvU+/cbYtPC8cHyRcBQ=,iv:6eWM/9NDApVMpTviYw2X1p91VItG3qlkGocjrkLyBq8=,tag:STXAVUqQEHGW+ijRQOZLrA==,type:str]
@@ -341,15 +321,6 @@ papra:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:5KE0gQZnd8NY49wg9A==,iv:L5SdkwVrYxujpgHMHgL6U8fNP7v+qMHBpfRyDAa8/Ds=,tag:mWwHMiR48Shu5DOssdMuNA==,type:comment]
-romm:
-    secret_key: ENC[AES256_GCM,data:i+Dltol9oS9r+kIFoPUJ8sJsIkgDyW3W9C9SVWetZoFhC3b2UWwBpyJO+ZM=,iv:TDkP+D0jWkh/d6wgsOcyOfyCOvGud8L8hIEKtpvMThY=,tag:n/Hl0KEbauZVpixrfrTakg==,type:str]
-    oidc:
-        secret: ENC[AES256_GCM,data:G0knyOyj3oNuUCIQF0cb+/UkiZlk7/7FxABuqdbybXgJoC2xYkbGgesedaw=,iv:Wd3+phjBsdYSYV4+y+KPIFlX6sWVFGvJCdkyiIa0tII=,tag:1joAPQUXiKfvhyhj+DM+Uw==,type:str]
-        hash: ENC[AES256_GCM,data:Z36CsPTYBLC/qM3uiSkSjll2CL3+HwHxyu3k/JWpg/cquz1kkYE6jHzdSSPYR28uQiAxB28CVRV0zhgAFjhsloIV3MTzkTKRkTwHibJmkFUxRjkmynhUTOFqkKH88s+WMM3bZvIwrauvYnVtSknxg6lwmmUOaAdXZh/bdbW3bVChHXE=,iv:5p55hVvFrdWFjbjVjooLWhFSqSVInTAsfQlgyOvF4ls=,tag:YW6SSxEvQOOkLbaKNmGPvQ==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
 #ENC[AES256_GCM,data:7nupd3g2GlsjuxZFFdXiyw==,iv:vdwhjZTOhHPp14Z0oGdZV9zs9IAebjrxuE7ih66mgr8=,tag:lzbMg8K/yYEuUD+Q9OgbWw==,type:comment]
 tandoor:
     secret_key: ENC[AES256_GCM,data:RZc91Ji9x7A2PQF+lw47B6tlczWO7e8hRfUJIlNd0BtkPIacDvztR7/VbCc=,iv:IlpZcvR70XvNc46KrrNls5RbndnWeobU0k9qQMIhA0Q=,tag:d0weqGUUFa5bH5tEDzPDYg==,type:str]
@@ -371,12 +342,16 @@ bookstack:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:VB33s2MIpiqDCWk0mQBaJ1V6bw==,iv:TPOStXHgCzlH+nVnP68TUYz8oqz9QHTeA4pmWBkWm8k=,tag:44hcNctYypx1SAK1J2BgfQ==,type:comment]
+#ENC[AES256_GCM,data:YSPB2SN7qm10qtJTDf1aI5k=,iv:Q1xcZboMd3zyDfpgNG+MzOAUwWY0iKP2uXo6oN4kbfI=,tag:p+DNn5p5SwXFvCWj++74xg==,type:comment]
-linkwarden:
+linkding:
-    secret_key: ENC[AES256_GCM,data:V39FR9x5vCM/DE6BDY4VpG3pEs5sW/oPrNeO5u1POwMiu8Y4u7Wv4fg+hcw=,iv:PxntxFkVDYZJmuzvNzYYmiYxFLwFI61sHxkH9rTv1r8=,tag:dgNV7sp06hqYFdErK65z5g==,type:str]
+    admin:
+        password: ENC[AES256_GCM,data:f3i2LGaDbC+qAVXouPL3odRCRxNjYayBMqY4IXkRm7WMCz/AtM+/C/4uOOE=,iv:FZVx42qbcb9neoVuS0wzXGJdHlkYOCG7A6I4vQFNdXI=,tag:OY5onMh0ia0CvlJNJS5XEQ==,type:str]
     oidc:
-        secret: ENC[AES256_GCM,data:JEm+Kam2bRXf1YTJIKNurZNcovyGHG1mUqlQC8iYyo65yX1XDFuEv7gWALM=,iv:3c/0RsMtUvawe5Sh0R18uSOi0HhRBEU+0aFoUELV5Ko=,tag:hBlrksgQ5If6WdcZZ+wSjw==,type:str]
+        secret: ENC[AES256_GCM,data:Z+990MZgGw0kFLZNz97dZzdN2azGHSBe1QMB+81xRz+7kqA9dyYmnrMRZK4=,iv:t2BN7kSKhA1DOMqEcXzDAoVnywC9yJWxfWG31W11Y9M=,tag:Cybo+cTgPc/hgT3rKeFl1A==,type:str]
-        hash: ENC[AES256_GCM,data:kTtyKn+B44B1Qunxy9xt9lWoXg4y13rxnD99P8F0qdoBl11l99Ry5IcbHUszuhEptR+wkcw4M/C9iBhVvtghdr5XcTP4HcsbZmqSGB1tM6LDpc17bf4QaCO7zQIBvr5Ef3jcsRpGGiVtucft5wajDUqN1dAokOCFPq2NBa2XbzNBph4=,iv:mmT++FErqB80CsiRPlpbuGbWVhTraYcauTu0zKnxags=,tag:1QaqFGCZJcr656EfMLGd6g==,type:str]
+        hash: ENC[AES256_GCM,data:0XBUGG83pACnTxKgqh0ehNL2vupNxDJ3aD46sEbBNwetZdWHvTwG+WA5Y04o1CBEqR3PqTuvSageNzKGPAvPeI+Tf12dKuwEqjaqy69EbszVFTFA45JosDzUHEdF6HmOFRAOWZVqeMKYEZqql/gpzrEXBYYmsdCrCy8yzeC/ozfvcnU=,iv:ytR01gmnOCdkmjNKcmcXSVLirilsSkN2hkFrwbX/SQM=,tag:Mqa2Mv+Jbut4nKg/UIqAXQ==,type:str]
+#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
+#
+#
 #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
 switch:
     admin:
@@ -393,7 +368,7 @@ sops:
             k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
-    lastmodified: "2026-08-26T10:50:28Z"
+    lastmodified: "2026-08-27T14:09:38Z"
-    mac: ENC[AES256_GCM,data:NrbfZDqynKH5+NtC2JSf2O4fvrjpuO3UJNS4jiMiJ0GQvmB7aUOBZcM8dP/4CljI/bmOXTkI7YYtLrSp1Njql1ot1OSb/Vu8T9qg0xI/+8QQa2gnTvUFdqNkLtyGXvmNgl2KZPAi1yeI+ROdYLRtpMCW+dn1ZhaxLxYFLBKpAFk=,iv:cLJjHjx8d+qEYaCLGo7/YswgcIp+4acGd0k3vgKOvLM=,tag:/TNmrxg1zWUpiu+jZPkxpw==,type:str]
+    mac: ENC[AES256_GCM,data:K+SwIrdo62opVGnsrMH7FysC8GtMN1RGPGmtUxRKLoNy/Yi/tKxjVH1xiu1ePCWXWqpGjuC7btJdel3SZmwDi4jMhN87DadOh1Kf0sIGDe8+Ff1LrLLl0I4+NWpu/RJicXwxOXkZUwdEZ0sqTW2Qm1S7aknPpSoD9vc44epv1AA=,iv:npBPZiCeb3+7s+xHd/XhOhEnxvAJzeZWGFzW98uFSK0=,tag:KhQcf6/SVDtbgpiZO/7VNA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

config/services/containers/app/collabora/collabora.container.j2

@@ -17,6 +17,7 @@ Environment="aliasgroup1=https://{{ services['nextcloud']['domain']['public'] }}
 Environment="extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:server_name={{ services['collabora']['domain']['public'] }}.{{ domain['public'] }} --o:admin_console.enable=false"
 
 [Service]
+MemoryKSM=yes
 Restart=always
 RestartSec=10s
 TimeoutStopSec=120

config/services/containers/app/linkding/linkding.container.j2

@@ -0,0 +1,58 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Linkding
+
+[Container]
+Image=ghcr.io/sissbruecker/linkding:{{ version['containers']['linkding'] }}
+ContainerName=linkding
+HostName=linkding
+
+PublishPort={{ services['linkding']['ports']['http'] }}:9090/tcp
+
+# Persistent data
+Volume=%h/data/containers/linkding/data:/etc/linkding/data:rw
+Volume=%h/containers/linkding/ssl:/etc/ssl/linkding:ro
+
+# General
+Environment="TZ={{ timezone }}"
+Environment="LD_DISABLE_BACKGROUND_TASKS=False"
+Environment="LD_REQUEST_MAX_CONTENT_LENGTH=268435456"
+
+# PostgreSQL
+Environment="LD_DB_ENGINE=postgres"
+Environment="LD_DB_DATABASE=linkding_db"
+Environment="LD_DB_USER=linkding"
+Environment="LD_DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
+Environment="LD_DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
+Environment="PGSSLMODE=verify-full"
+Environment="PGSSLROOTCERT=/etc/ssl/linkding/{{ root_cert_filename }}"
+Environment="PGSSLCERTMODE=disable"
+Secret=LINKDING_DB_PASSWORD,type=env,target=LD_DB_PASSWORD
+
+# OIDC
+Environment="LD_ENABLE_OIDC=True"
+Environment="LD_DISABLE_LOGIN_FORM=True"
+Environment="OIDC_OP_AUTHORIZATION_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/api/oidc/authorization"
+Environment="OIDC_OP_TOKEN_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/api/oidc/token"
+Environment="OIDC_OP_USER_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/api/oidc/userinfo"
+Environment="OIDC_OP_JWKS_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/jwks.json"
+Environment="OIDC_RP_CLIENT_ID=linkding"
+Environment="OIDC_RP_SCOPES=openid email profile"
+Environment="OIDC_USERNAME_CLAIM=preferred_username"
+Environment="OIDC_USE_PKCE=True"
+Environment="OIDC_VERIFY_SSL=True"
+Secret=LINKDING_OIDC_CLIENT_SECRET,type=env,target=OIDC_RP_CLIENT_SECRET
+
+# Reverse proxy
+Environment="LD_CSRF_TRUSTED_ORIGINS=https://{{ services['linkding']['domain']['public'] }}.{{ domain['public'] }}"
+
+[Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
+Restart=always
+RestartSec=10s
+TimeoutStopSec=60
+
+[Install]
+WantedBy=default.target

config/services/containers/app/mastodon/mastodon-streaming.container.j2

@@ -38,6 +38,7 @@ Environment="REDIS_URL=redis://host.containers.internal:{{ services['mastodon'][
 Exec=node ./streaming/index.js
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/app/mastodon/mastodon-web.container.j2

@@ -66,6 +66,7 @@ Secret=MASTODON_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
 Exec=bundle exec puma -C config/puma.rb
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/app/mastodon/mastodon-worker.container.j2

@@ -48,6 +48,7 @@ Secret=MASTODON_VAPID_PUBLIC_KEY,type=env,target=VAPID_PUBLIC_KEY
 Exec=bundle exec sidekiq
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/app/outline/outline.container.j2

@@ -69,6 +69,7 @@ Secret=OUTLINE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
 Environment="LOG_LEVEL=warn"
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/app/papra/papra.container.j2

@@ -35,6 +35,8 @@ Environment="DOCUMENTS_CONTENT_EXTRACTION_ENABLED=true"
 Environment="DOCUMENTS_OCR_LANGUAGES=eng,kor"
 Environment="DOCUMENT_STORAGE_MAX_UPLOAD_SIZE=0"
 
+RunInit=true
+
 [Service]
 Restart=always
 RestartSec=10s

config/services/containers/app/sure/sure-web.container.j2

@@ -58,6 +58,7 @@ Environment="EXCHANGE_RATE_PROVIDER=yahoo_finance"
 Environment="SECURITIES_PROVIDER=yahoo_finance"
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/app/sure/sure-worker.container.j2

@@ -41,6 +41,7 @@ Environment="SECURITIES_PROVIDER=yahoo_finance"
 Exec=bundle exec sidekiq
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/app/tandoor/tandoor.container.j2

@@ -52,6 +52,7 @@ Environment="SOCIAL_DEFAULT_GROUP=user"
 Secret=TANDOOR_SOCIALACCOUNT_PROVIDERS,type=env,target=SOCIALACCOUNT_PROVIDERS
 
 [Service]
+MemoryKSM=yes
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 Restart=always
 RestartSec=10s

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -118,30 +118,6 @@ identity_providers:
       access_token: '1h'
       id_token: '1h'
       refresh_token: '720h'
-    cors:
-      # booklogr cors configuration
-      endpoints:
-        - 'authorization'
-        - 'token'
-        - 'userinfo'
-      allowed_origins:
-        - 'https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}'
-    claims_policies:
-      romm:
-        id_token:
-          - 'email'
-          - 'email_verified'
-          - 'alt_emails'
-          - 'preferred_username'
-          - 'name'
-          - 'groups'
-      linkwarden:
-        id_token:
-          - 'preferred_username'
-          - 'name'
-          - 'email'
-          - 'email_verified'
-          - 'groups'
     clients:
       # https://www.authelia.com/integration/openid-connect/clients/gitea/
       - client_id: 'gitea'
@@ -191,7 +167,7 @@ identity_providers:
         token_endpoint_auth_method: 'client_secret_post'
       # https://www.authelia.com/integration/openid-connect/clients/nextcloud/#openid-connect-user-backend-app
       - client_id: 'nextcloud'
-        client_name: 'Nextcloud'
+        client_name: 'nextcloud'
         consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['nextcloud']['oidc']['hash'] }}'
         public: false
@@ -214,7 +190,7 @@ identity_providers:
         token_endpoint_auth_method: 'client_secret_post'
       # https://www.authelia.com/integration/openid-connect/clients/sure/
       - client_id: 'sure'
-        client_name: 'Sure'
+        client_name: 'sure'
         consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['sure']['oidc']['hash'] }}'
         public: false
@@ -237,7 +213,7 @@ identity_providers:
         token_endpoint_auth_method: 'client_secret_basic'
       # https://www.authelia.com/integration/openid-connect/clients/outline/
       - client_id: 'outline'
-        client_name: 'Outline'
+        client_name: 'outline'
         consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['outline']['oidc']['hash'] }}'
         public: false
@@ -259,29 +235,6 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
-      # https://www.authelia.com/integration/openid-connect/clients/mealie/
-      - client_id: 'mealie'
-        client_name: 'Mealie'
-        consent_mode: 'implicit'
-        client_secret: '{{ hostvars['console']['mealie']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: true
-        pkce_challenge_method: 'S256'
-        redirect_uris:
-          - 'https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}/login'
-        scopes:
-          - 'openid'
-          - 'email'
-          - 'profile'
-          - 'groups'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_basic'
       # https://www.authelia.com/integration/openid-connect/clients/homebox/
       - client_id: 'homebox'
         client_name: 'homebox'
@@ -324,28 +277,6 @@ identity_providers:
         grant_types:
           - 'authorization_code'
         token_endpoint_auth_method: 'client_secret_basic'
-      # https://booklogr.app/docs/Configuration/OIDC-sign-in
-      - client_id: 'booklogr'
-        client_name: 'booklogr'
-        consent_mode: 'implicit'
-        client_secret: '{{ hostvars['console']['booklogr']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: false
-        pkce_challenge_method: ''
-        redirect_uris:
-          - 'https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}/callback'
-        scopes:
-          - 'openid'
-          - 'profile'
-          - 'email'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'
       # https://www.authelia.com/integration/openid-connect/clients/papra/
       - client_id: 'papra'
         client_name: 'papra'
@@ -368,30 +299,6 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
-      # https://www.authelia.com/integration/openid-connect/clients/romm/
-      - client_id: 'romm'
-        claims_policy: 'romm'
-        client_name: 'romm'
-        consent_mode: 'implicit'
-        client_secret: '{{ hostvars['console']['romm']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: false
-        pkce_challenge_method: ''
-        redirect_uris:
-          - 'https://{{ services['romm']['domain']['public'] }}.{{ domain['public'] }}/api/oauth/openid'
-        scopes:
-          - 'openid'
-          - 'groups'
-          - 'profile'
-          - 'email'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_basic'
       # https://www.authelia.com/integration/openid-connect/clients/tandoor/
       - client_id: 'tandoor'
         client_name: 'tandoor'
@@ -437,27 +344,21 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_basic'
-      # https://www.authelia.com/integration/openid-connect/clients/linkwarden/
+      # https://www.authelia.com/integration/openid-connect/clients/linkding/
-      - client_id: 'linkwarden'
+      - client_id: 'linkding'
-        claims_policy: 'linkwarden'
+        client_name: 'linkding'
-        client_name: 'linkwarden'
         consent_mode: 'implicit'
-        client_secret: '{{ hostvars['console']['linkwarden']['oidc']['hash'] }}'
+        client_secret: '{{ hostvars['console']['linkding']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
         require_pkce: false
         pkce_challenge_method: ''
         redirect_uris:
-          - 'https://{{ services['linkwarden']['domain']['public'] }}.{{ domain['public'] }}/api/v1/auth/callback/oidc'
+          - 'https://{{ services['linkding']['domain']['public'] }}.{{ domain['public'] }}/oidc/callback/'
         scopes:
           - 'openid'
-          - 'groups'
           - 'email'
           - 'profile'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_basic'
+        token_endpoint_auth_method: 'client_secret_post'

docs/archives/services/app/booklogr/authelia.yaml

@@ -0,0 +1,33 @@
+identity_providers:
+  oidc:
+    cors:
+      # booklogr cors configuration
+      endpoints:
+        - 'authorization'
+        - 'token'
+        - 'userinfo'
+      allowed_origins:
+        - 'https://booklogr.example.com'
+    clients:
+      # https://booklogr.app/docs/Configuration/OIDC-sign-in
+      - client_id: 'booklogr'
+        client_name: 'booklogr'
+        consent_mode: 'implicit'
+        client_secret: ''
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://booklogr.example.com/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_post'

docs/archives/services/app/booklogr/group_vars.yaml

@@ -0,0 +1,17 @@
+services:
+  booklogr:
+    domain:
+      public: "booklogr"
+      internal: "booklogr.app"
+    ports:
+      http: "5150"
+      api: "5000"
+    route:
+      api: "/v1 /v1/*"
+      deny: "/v1/login /v1/login/* /v1/register /v1/register/*"
+    dependency:
+      web: "app-public"
+      db: "postgresql"
+version:
+  containers:
+    booklogr: "v1.11.1"

docs/archives/services/app/booklogr/secret.example.yaml

@@ -0,0 +1,8 @@
+postgresql:
+  password:
+    booklogr: ""
+booklogr:
+    secret_key: ""
+    oidc:
+        secret: ""
+        hash: ""

docs/archives/services/app/linkwarden/authelia.yaml

@@ -0,0 +1,35 @@
+identity_providers:
+  oidc:
+    claims_policies:
+      linkwarden:
+        id_token:
+          - 'preferred_username'
+          - 'name'
+          - 'email'
+          - 'email_verified'
+          - 'groups'
+    clients:
+      # https://www.authelia.com/integration/openid-connect/clients/linkwarden/
+      - client_id: 'linkwarden'
+        claims_policy: 'linkwarden'
+        client_name: 'linkwarden'
+        consent_mode: 'implicit'
+        client_secret: ''
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://linkwarden.example.com/api/v1/auth/callback/oidc'
+        scopes:
+          - 'openid'
+          - 'groups'
+          - 'email'
+          - 'profile'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'

docs/archives/services/app/linkwarden/group_vars.yaml

@@ -0,0 +1,13 @@
+services:
+  linkwarden:
+    domain:
+      public: "link"
+      internal: "link.app"
+    ports:
+      http: "3005"
+    dependency:
+      web: "app-public"
+      db: "postgresql"
+version:
+  containers:
+    linkwarden: "v2.16.1"

docs/archives/services/app/linkwarden/linkwarden.container.j2

@@ -37,14 +37,8 @@ Environment="DISABLE_NEW_SSO_USERS=false"
 Secret=LINKWARDEN_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
 
 # Archiving
-Environment="DISABLE_BROWSER=false"
+Environment="DISABLE_BROWSER=true"
-Environment="BROWSER_LIFECYCLE=on-demand"
-Environment="ARCHIVE_TAKE_COUNT=2"
 Environment="NEXT_PUBLIC_MAX_FILE_BUFFER=250"
-Environment="MONOLITH_MAX_BUFFER=250"
-Environment="PDF_MAX_BUFFER=100"
-Environment="SCREENSHOT_MAX_BUFFER=100"
-
 # Meili search
 # Environment=MEILI_HOST=""
 # Environment=MEILI_MASTER_KEY=""

docs/archives/services/app/linkwarden/secrets.example.yaml

@@ -0,0 +1,8 @@
+postgresql:
+  password:
+    linkwarden: ""
+linkwarden:
+    secret_key: ""
+    oidc:
+        secret: ""
+        hash: ""

docs/archives/services/app/mealie/authelia.yaml

@@ -0,0 +1,26 @@
+identity_providers:
+  oidc:
+    clients:
+      # https://www.authelia.com/integration/openid-connect/clients/mealie/
+      - client_id: 'mealie'
+        client_name: 'Mealie'
+        consent_mode: 'implicit'
+        client_secret: ''
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: true
+        pkce_challenge_method: 'S256'
+        redirect_uris:
+          - 'https://mealie.example.com/login'
+        scopes:
+          - 'openid'
+          - 'email'
+          - 'profile'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'

docs/archives/services/app/mealie/group_vars.yaml

@@ -0,0 +1,14 @@
+services:
+  mealie:
+    domain:
+      public: "mealie"
+      internal: "mealie.app"
+    ports:
+      http: "9000"
+    subuid: "100910"
+    dependency:
+      web: "app-public"
+      db: "postgresql"
+version:
+  containers:
+    mealie: "v3.22.0"

docs/archives/services/app/mealie/secret.example.yaml

@@ -0,0 +1,7 @@
+postgresql:
+  password:
+    mealie: ""
+mealie:
+    oidc:
+        secret: ""
+        hash: ""

docs/archives/services/app/romm/authelia.yaml

@@ -0,0 +1,36 @@
+identity_providers:
+  oidc:
+    claims_policies:
+      romm:
+        id_token:
+          - 'email'
+          - 'email_verified'
+          - 'alt_emails'
+          - 'preferred_username'
+          - 'name'
+          - 'groups'
+    clients:
+      # https://www.authelia.com/integration/openid-connect/clients/romm/
+      - client_id: 'romm'
+        claims_policy: 'romm'
+        client_name: 'romm'
+        consent_mode: 'implicit'
+        client_secret: ''
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://romm.example.com/api/oauth/openid'
+        scopes:
+          - 'openid'
+          - 'groups'
+          - 'profile'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'

docs/archives/services/app/romm/group_vars.yaml

@@ -0,0 +1,15 @@
+services:
+  romm:
+    domain:
+      public: "romm"
+      internal: "romm.app"
+    ports:
+      http: "8002"
+      redis: "6384"
+    subuid: "100999"
+    dependency:
+      web: "app-public"
+      db: "postgresql"
+version:
+  containers:
+    romm: "5.1.0"

docs/archives/services/app/romm/secret.example.yaml

@@ -0,0 +1,8 @@
+postgresql:
+  password:
+    romm: ""
+romm:
+    secret_key: ""
+    oidc:
+        secret: ""
+        hash: ""