il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2026-AUG-29

Browse Source
This commit is contained in:
il
2026-08-29 20:31:53 +09:00
parent ea8dfc8c20
commit 9226043696
41 changed files with 426 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/inventory/group_vars/all.yaml
+6 -42
View File
@@ -178,12 +178,13 @@ services:
dependency:
web: "app-public"
db: "postgresql"
linkwarden:
linkding:
domain:
public: "link"
internal: "link.app"
public: "linkding"
internal: "linkding.app"
ports:
http: "3005"
http: "9090"
subuid: "100032"
dependency:
web: "app-public"
db: "postgresql"
@@ -244,19 +245,6 @@ services:
immich-ml:
ports:
http: "3003"
booklogr:
domain:
public: "booklogr"
internal: "booklogr.app"
ports:
http: "5150"
api: "5000"
route:
api: "/v1 /v1/*"
deny: "/v1/login /v1/login/* /v1/register /v1/register/*"
dependency:
web: "app-public"
db: "postgresql"
outline:
domain:
public: "outline"
@@ -298,16 +286,6 @@ services:
subuid: "100998"
dependency:
web: "app-public"
mealie:
domain:
public: "mealie"
internal: "mealie.app"
ports:
http: "9000"
subuid: "100910"
dependency:
web: "app-public"
db: "postgresql"
tandoor:
domain:
public: "tandoor"
@@ -326,17 +304,6 @@ services:
dependency:
web: "app-public"
db: "postgresql"
romm:
domain:
public: "romm"
internal: "romm.app"
ports:
http: "8002"
redis: "6384"
subuid: "100999"
dependency:
web: "app-public"
db: "postgresql"
version:
packages:
@@ -375,14 +342,11 @@ version:
collabora: "26.04.3.1.1"
sure: "0.7.3"
outline: "1.9.2"
mealie: "v3.22.0"
homebox: "0.26.2"
homepage: "v2.0.0"
snappymail: "v2.38.2"
mastodon: "v4.6.6"
booklogr: "v1.11.1"
papra: "26.6.1-rootless"
romm: "5.1.0"
tandoor: "2.6.13"
bookstack: "26.5.3"
linkwarden: "v2.16.1"
linkding: "1.46.2"
ansible/inventory/host_vars/app.yaml
+1 -1
View File
@@ -20,7 +20,7 @@ vm:
<vcpupin vcpu='5' cpuset='11'/>
<emulatorpin cpuset='10-11'/>
shares: 1024
memory: 16
memory: 48
storage: 256
data_storage:
name: "vdb"
ansible/inventory/host_vars/bk.yaml
+1 -1
View File
@@ -17,7 +17,7 @@ vm:
<emulatorpin cpuset='6-7'/>
shares: 512
memory: 2
storage: 32
storage: 64
data_storage:
name: "vdb"
pool: "backup"
ansible/playbooks/app/site.yaml
+21 -28
View File
@@ -102,10 +102,27 @@
- "jq"
- "netcat-openbsd"
- "dbus-user-session"
- "ksmtuned"
state: "present"
become: true
tags: ["init", "site", "install-packages"]
- name: Enable ksm.service
ansible.builtin.systemd:
name: "ksm.service"
state: "started"
enabled: true
become: true
tags: ["init", "site", "install-packages"]
- name: Disable ksmtuned.service
ansible.builtin.systemd:
name: "ksmtuned.service"
state: "stopped"
enabled: false
become: true
tags: ["init", "site", "install-packages"]
- name: Set data volume
ansible.builtin.include_role:
name: "common"
@@ -234,14 +251,6 @@
tags: ["site", "outline"]
tags: ["site", "outline"]
- name: Set mealie
ansible.builtin.include_role:
name: "app"
tasks_from: "services/set_mealie"
apply:
tags: ["site", "mealie"]
tags: ["site", "mealie"]
- name: Set homebox
ansible.builtin.include_role:
name: "app"
@@ -258,14 +267,6 @@
tags: ["site", "mastodon"]
tags: ["site", "mastodon"]
- name: Set booklogr
ansible.builtin.include_role:
name: "app"
tasks_from: "services/set_booklogr"
apply:
tags: ["site", "booklogr"]
tags: ["site", "booklogr"]
- name: Set papra
ansible.builtin.include_role:
name: "app"
@@ -290,21 +291,13 @@
tags: ["site", "bookstack"]
tags: ["site", "bookstack"]
- name: Set romm
- name: Set linkding
ansible.builtin.include_role:
name: "app"
tasks_from: "services/set_romm"
tasks_from: "services/set_linkding"
apply:
tags: ["site", "romm"]
tags: ["site", "romm"]
- name: Set linkwarden
ansible.builtin.include_role:
name: "app"
tasks_from: "services/set_linkwarden"
apply:
tags: ["site", "linkwarden"]
tags: ["site", "linkwarden"]
tags: ["site", "linkding"]
tags: ["site", "linkding"]
- name: Set homepage
ansible.builtin.include_role:
ansible/roles/app/handlers/main.yaml
+3 -39
View File
@@ -92,17 +92,6 @@
listen: "notification_restart_outline"
ignore_errors: true # noqa: ignore-errors
- name: Restart mealie
ansible.builtin.systemd:
name: "mealie.service"
state: "restarted"
enabled: true
scope: "user"
daemon_reload: true
changed_when: false
listen: "notification_restart_mealie"
ignore_errors: true # noqa: ignore-errors
- name: Restart homebox
ansible.builtin.systemd:
name: "homebox.service"
@@ -151,20 +140,6 @@
listen: "notification_restart_mastodon"
ignore_errors: true # noqa: ignore-errors
- name: Restart booklogr
ansible.builtin.systemd:
name: "{{ item }}"
state: "restarted"
enabled: true
scope: "user"
daemon_reload: true
loop:
- "booklogr-api.service"
- "booklogr-web.service"
changed_when: false
listen: "notification_restart_booklogr"
ignore_errors: true # noqa: ignore-errors
- name: Restart papra
ansible.builtin.systemd:
name: "papra.service"
@@ -176,17 +151,6 @@
listen: "notification_restart_papra"
ignore_errors: true # noqa: ignore-errors
- name: Restart romm
ansible.builtin.systemd:
name: "romm.service"
state: "restarted"
enabled: true
scope: "user"
daemon_reload: true
changed_when: false
listen: "notification_restart_romm"
ignore_errors: true # noqa: ignore-errors
- name: Restart tandoor
ansible.builtin.systemd:
name: "tandoor.service"
@@ -209,13 +173,13 @@
listen: "notification_restart_bookstack"
ignore_errors: true # noqa: ignore-errors
- name: Restart linkwarden
- name: Restart linkding
ansible.builtin.systemd:
name: "linkwarden.service"
name: "linkding.service"
state: "restarted"
enabled: true
scope: "user"
daemon_reload: true
changed_when: false
listen: "notification_restart_linkwarden"
listen: "notification_restart_linkding"
ignore_errors: true # noqa: ignore-errors
ansible/roles/app/tasks/services/set_bookstack.yaml
-1
View File
@@ -14,7 +14,6 @@
- "containers/bookstack/ssl"
become: true
- name: Deploy root certificate
ansible.builtin.copy:
content: |
ansible/roles/app/tasks/services/set_linkding.yaml
+84
View File
@@ -0,0 +1,84 @@
---
- name: Create linkding directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['linkding']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/linkding"
- "data/containers/linkding/data"
- "containers/linkding"
- "containers/linkding/ssl"
become: true
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/linkding/ssl/{{ root_cert_filename }}"
owner: "{{ services['linkding']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_linkding"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "LINKDING_DB_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['linkding'] }}"
- name: "LINKDING_OIDC_CLIENT_SECRET"
value: "{{ hostvars['console']['linkding']['oidc']['secret'] }}"
notify: "notification_restart_linkding"
no_log: true
- name: Pull image
containers.podman.podman_image:
name: "ghcr.io/sissbruecker/linkding"
tag: "{{ version['containers']['linkding'] }}"
state: "present"
pull: true
- name: Deploy linkding.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/linkding/linkding.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/linkding.container"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_linkding"
- name: Enable linkding.service
ansible.builtin.systemd:
name: "linkding.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/ghcr.io_sissbruecker_linkding_{{ version['containers']['linkding'] }}.tar"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "ghcr.io/sissbruecker/linkding:{{ version['containers']['linkding'] }}"
dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_sissbruecker_linkding_{{ version['containers']['linkding'] }}.tar"
format: "oci-archive"
force: false
when: not container_archive_images.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/ghcr.io_sissbruecker_linkding_{{ version['containers']['linkding'] }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
config/secrets/secrets.yaml
+12 -37
View File
@@ -135,13 +135,10 @@ postgresql:
nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str]
mealie: ENC[AES256_GCM,data:XbYHQv6HBWCXUBRmcbQZN5Y1Gw+V+Wra28Mp+m+ZGl8VRXsKMu5507vGHQM=,iv:zp4ZarqG9KshiBV8F8UksfI2QXmXHwqPw631r/5bYy8=,tag:jvsvXrUsCvpQGIbLV9jTYQ==,type:str]
homebox: ENC[AES256_GCM,data:EhNnltOBwLai5vEMt7Dih5Ug6h3ojrdbwhq4Vr0tg/p/0nqI9L7O/Le0B4w=,iv:14oyl916t0inr+W/lztQCjYiSQ0vIIwC9NmbezDuvvY=,tag:IiXZd3NU+dUvDrHpxJXFew==,type:str]
mastodon: ENC[AES256_GCM,data:hq1ETBK9iUI7kWFO+9pZwMQMbmyLExGk7/VzBwDdLFbzptXL2KEi6oYRCS0=,iv:hF1C8lsnP2i3LxDIuOA6op4qKXQKjJ7gqznDst7hVAU=,tag:maR7Jvsv3DJGrO77EzmBDA==,type:str]
booklogr: ENC[AES256_GCM,data:K+9Bb/GMbaviYIIesimugQg2RXF590L2T2XNlRI/bjc9BBb9/iivFlhLwa4=,iv:E/MGt0bKlITYKMYZjlmTZ2YonYTvNTaRI23n5xazyeE=,tag:Y3WUSHBHQiF1MVD/zQr5RQ==,type:str]
romm: ENC[AES256_GCM,data:nizBKAPWPRTxKZRPGOoff6WrbpK9z3s1RDhJmKghO4BhmgguH2C/5DlQ6V0=,iv:uiscRdOoS//Mxs8Lmw6sA+/YtcVhhuJoxP7AxQGJHNA=,tag:UM89ocQFBK3zVDsS8LhAiw==,type:str]
tandoor: ENC[AES256_GCM,data:+5g/jzRMQoxocZntoE+1BU0MS00yEp0tyVNxriEIJ0pW2V1bsLhUAkwQ748=,iv:feNbpOhkdjmKS7Ovy0KGioOTyjQ4sflfH+50niP7Y8Y=,tag:51/u+EE3Pp5o7jnlj0AWIw==,type:str]
linkwarden: ENC[AES256_GCM,data:Prymyz9b8ePaAGY/0/bQYzQ9olb9u6NfQ/urKB9XvWRanJB/4dapM7kE/us=,iv:kQNlbBkJUTq5SGhmmbxjKQ71Pde8UZJlOxm/Wy3IFmw=,tag:Q0iRehhuAgK4owNypEo/BQ==,type:str]
linkding: ENC[AES256_GCM,data:+diOqVjK5RkDOpxCrb0M0sLWEufXEwhTNo0x5qH4FkteN8zaUAZfO8lD13I=,iv:jHQANXC1tamiphm33RpTKpEB3niLFx6IKzcdq8/KNCg=,tag:NwkkmUPOS9K0IKtUBVRWqg==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
@@ -289,14 +286,6 @@ outline:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:ATLTbBi1RsBr2ldHDDH4,iv:RFbPz/46BIGYv9Wo5Jxw5Swi4Xo2JgIEI4IsO4rCQoQ=,tag:i7/2ItQSFurrmdNaBWwWAA==,type:comment]
mealie:
oidc:
secret: ENC[AES256_GCM,data:ldsfwWnexNNM4r+aP2h+woQROwbp9MpxAz8E/o1Q53GxcEwtixqvP6QZGoo=,iv:6M/lfuDU3IOd0nxLi2l02OD5FopErhSCp6AhxBGTI1k=,tag:3w0p+wi9T1PqNmgoM59gug==,type:str]
hash: ENC[AES256_GCM,data:YmziHxsFPJ93uMNG6/EUiPEfMvvAZM8/S5854GJ/fPPTMvXj9cM2sovkSrcNd7H0ac5KDJIcJoD9SC5lWKCAbjKzxHvI6CdI63SM8bExrDL2PVSGAf29VLU/cz8rQtZS39GWz2v5GWlpk67Emy0T115vruIGfDlan8zgQKK7YIWyVMs=,iv:xmnBYjBIWq6P2g5DyMh+wYskmJRcVDREGL/yYhJHyRs=,tag:qMWXHiLmAy5UvWFvv3Ct8g==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:b74wua/tFSoef2fq5jZhNQ==,iv:RDtz7Y6eFQKiVVnNvoLAfzE4xo8t7RFiKjLTbd0xo80=,tag:iUS7ofvuVj6ZTsy8zA6KSg==,type:comment]
homebox:
api_secret: ENC[AES256_GCM,data:BT6m0D9Xwa1tnQQRzpUnEF4bjLFne297oS3p8HM8Q/1Vakrf+uFcfS0C4MU=,iv:5WeWyfe8kt+AWwsV3YXxfLVuSEE8lYmNFxrXyRZzISc=,tag:cYd6U3BxqyGst+UsMpRypA==,type:str]
@@ -323,15 +312,6 @@ mastodon:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:I6O+AZ4EGMl6dXBowhMBG+c=,iv:bQ5mvEfVHDyTwNI+5hCsUkWEowP8fqir6lqLYPmsnbY=,tag:ta69wItzleRbky3vjU4+WA==,type:comment]
booklogr:
secret_key: ENC[AES256_GCM,data:yImb0UKqDIeyCmThb3upJPIxZVF7wiaLboP8PO/K2yjCjI0qXOgSkXJbrlw=,iv:yQjqT4831bqbRYgjQ72Vcg6omweWWPTgj6ZUHeaSGWA=,tag:y0BQxLTQklFP5hmJjBNAMw==,type:str]
oidc:
secret: ENC[AES256_GCM,data:iLFtafeePxJuC2NyV9hPzkxqgR+67k23Szgl1SPZtuOE1wS6a9YVroTQKMo=,iv:1w0Jy0N4pu5O1h+DYtzAUv0Qd75pRNxV5l38fyrDIWI=,tag:mZ11TOrJzC1sxBxjcOEagQ==,type:str]
hash: ENC[AES256_GCM,data:0ShwGvr69/J+mNZ8+ALL4hEbouABbWXcj1kMV9M8jbyhe48FwikaeKY1SKTQRDB3XFMdRhOR+NFRDQhLvNN/7RW16ZPF2jkj/am4MEUQ0z8jd+imK98cpb7XuXb6DuU1cqtuKhG0lJcFQaHOCNXqSWoPi8oRUwHIpvGjXa3Wr4hC/pw=,iv:iPXaqonARTWV19E0RUIPt05DJ9iDKSS8skcT4xf8wYc=,tag:n6S6x5Qeh+M3itRopj9SbQ==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:BmZppA02YtiTykTtUnk=,iv:zV2x6W1yWhMegE+h7zdQNRxVrN7C16Lq4xpDkkZPcBw=,tag:MPGH1vjS1IYuZo2qf30qwA==,type:comment]
papra:
secret_key: ENC[AES256_GCM,data:AoqqUS2OUb11UwWNteZHqU6FF1eJVbmvANfZRvcwnvU+/cbYtPC8cHyRcBQ=,iv:6eWM/9NDApVMpTviYw2X1p91VItG3qlkGocjrkLyBq8=,tag:STXAVUqQEHGW+ijRQOZLrA==,type:str]
@@ -341,15 +321,6 @@ papra:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:5KE0gQZnd8NY49wg9A==,iv:L5SdkwVrYxujpgHMHgL6U8fNP7v+qMHBpfRyDAa8/Ds=,tag:mWwHMiR48Shu5DOssdMuNA==,type:comment]
romm:
secret_key: ENC[AES256_GCM,data:i+Dltol9oS9r+kIFoPUJ8sJsIkgDyW3W9C9SVWetZoFhC3b2UWwBpyJO+ZM=,iv:TDkP+D0jWkh/d6wgsOcyOfyCOvGud8L8hIEKtpvMThY=,tag:n/Hl0KEbauZVpixrfrTakg==,type:str]
oidc:
secret: ENC[AES256_GCM,data:G0knyOyj3oNuUCIQF0cb+/UkiZlk7/7FxABuqdbybXgJoC2xYkbGgesedaw=,iv:Wd3+phjBsdYSYV4+y+KPIFlX6sWVFGvJCdkyiIa0tII=,tag:1joAPQUXiKfvhyhj+DM+Uw==,type:str]
hash: ENC[AES256_GCM,data:Z36CsPTYBLC/qM3uiSkSjll2CL3+HwHxyu3k/JWpg/cquz1kkYE6jHzdSSPYR28uQiAxB28CVRV0zhgAFjhsloIV3MTzkTKRkTwHibJmkFUxRjkmynhUTOFqkKH88s+WMM3bZvIwrauvYnVtSknxg6lwmmUOaAdXZh/bdbW3bVChHXE=,iv:5p55hVvFrdWFjbjVjooLWhFSqSVInTAsfQlgyOvF4ls=,tag:YW6SSxEvQOOkLbaKNmGPvQ==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:7nupd3g2GlsjuxZFFdXiyw==,iv:vdwhjZTOhHPp14Z0oGdZV9zs9IAebjrxuE7ih66mgr8=,tag:lzbMg8K/yYEuUD+Q9OgbWw==,type:comment]
tandoor:
secret_key: ENC[AES256_GCM,data:RZc91Ji9x7A2PQF+lw47B6tlczWO7e8hRfUJIlNd0BtkPIacDvztR7/VbCc=,iv:IlpZcvR70XvNc46KrrNls5RbndnWeobU0k9qQMIhA0Q=,tag:d0weqGUUFa5bH5tEDzPDYg==,type:str]
@@ -371,12 +342,16 @@ bookstack:
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:VB33s2MIpiqDCWk0mQBaJ1V6bw==,iv:TPOStXHgCzlH+nVnP68TUYz8oqz9QHTeA4pmWBkWm8k=,tag:44hcNctYypx1SAK1J2BgfQ==,type:comment]
linkwarden:
secret_key: ENC[AES256_GCM,data:V39FR9x5vCM/DE6BDY4VpG3pEs5sW/oPrNeO5u1POwMiu8Y4u7Wv4fg+hcw=,iv:PxntxFkVDYZJmuzvNzYYmiYxFLwFI61sHxkH9rTv1r8=,tag:dgNV7sp06hqYFdErK65z5g==,type:str]
#ENC[AES256_GCM,data:YSPB2SN7qm10qtJTDf1aI5k=,iv:Q1xcZboMd3zyDfpgNG+MzOAUwWY0iKP2uXo6oN4kbfI=,tag:p+DNn5p5SwXFvCWj++74xg==,type:comment]
linkding:
admin:
password: ENC[AES256_GCM,data:f3i2LGaDbC+qAVXouPL3odRCRxNjYayBMqY4IXkRm7WMCz/AtM+/C/4uOOE=,iv:FZVx42qbcb9neoVuS0wzXGJdHlkYOCG7A6I4vQFNdXI=,tag:OY5onMh0ia0CvlJNJS5XEQ==,type:str]
oidc:
secret: ENC[AES256_GCM,data:JEm+Kam2bRXf1YTJIKNurZNcovyGHG1mUqlQC8iYyo65yX1XDFuEv7gWALM=,iv:3c/0RsMtUvawe5Sh0R18uSOi0HhRBEU+0aFoUELV5Ko=,tag:hBlrksgQ5If6WdcZZ+wSjw==,type:str]
hash: ENC[AES256_GCM,data:kTtyKn+B44B1Qunxy9xt9lWoXg4y13rxnD99P8F0qdoBl11l99Ry5IcbHUszuhEptR+wkcw4M/C9iBhVvtghdr5XcTP4HcsbZmqSGB1tM6LDpc17bf4QaCO7zQIBvr5Ef3jcsRpGGiVtucft5wajDUqN1dAokOCFPq2NBa2XbzNBph4=,iv:mmT++FErqB80CsiRPlpbuGbWVhTraYcauTu0zKnxags=,tag:1QaqFGCZJcr656EfMLGd6g==,type:str]
secret: ENC[AES256_GCM,data:Z+990MZgGw0kFLZNz97dZzdN2azGHSBe1QMB+81xRz+7kqA9dyYmnrMRZK4=,iv:t2BN7kSKhA1DOMqEcXzDAoVnywC9yJWxfWG31W11Y9M=,tag:Cybo+cTgPc/hgT3rKeFl1A==,type:str]
hash: ENC[AES256_GCM,data:0XBUGG83pACnTxKgqh0ehNL2vupNxDJ3aD46sEbBNwetZdWHvTwG+WA5Y04o1CBEqR3PqTuvSageNzKGPAvPeI+Tf12dKuwEqjaqy69EbszVFTFA45JosDzUHEdF6HmOFRAOWZVqeMKYEZqql/gpzrEXBYYmsdCrCy8yzeC/ozfvcnU=,iv:ytR01gmnOCdkmjNKcmcXSVLirilsSkN2hkFrwbX/SQM=,tag:Mqa2Mv+Jbut4nKg/UIqAXQ==,type:str]
#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
#
#
#ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
switch:
admin:
@@ -393,7 +368,7 @@ sops:
k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
-----END AGE ENCRYPTED FILE-----
recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
lastmodified: "2026-08-26T10:50:28Z"
mac: ENC[AES256_GCM,data:NrbfZDqynKH5+NtC2JSf2O4fvrjpuO3UJNS4jiMiJ0GQvmB7aUOBZcM8dP/4CljI/bmOXTkI7YYtLrSp1Njql1ot1OSb/Vu8T9qg0xI/+8QQa2gnTvUFdqNkLtyGXvmNgl2KZPAi1yeI+ROdYLRtpMCW+dn1ZhaxLxYFLBKpAFk=,iv:cLJjHjx8d+qEYaCLGo7/YswgcIp+4acGd0k3vgKOvLM=,tag:/TNmrxg1zWUpiu+jZPkxpw==,type:str]
lastmodified: "2026-08-27T14:09:38Z"
mac: ENC[AES256_GCM,data:K+SwIrdo62opVGnsrMH7FysC8GtMN1RGPGmtUxRKLoNy/Yi/tKxjVH1xiu1ePCWXWqpGjuC7btJdel3SZmwDi4jMhN87DadOh1Kf0sIGDe8+Ff1LrLLl0I4+NWpu/RJicXwxOXkZUwdEZ0sqTW2Qm1S7aknPpSoD9vc44epv1AA=,iv:npBPZiCeb3+7s+xHd/XhOhEnxvAJzeZWGFzW98uFSK0=,tag:KhQcf6/SVDtbgpiZO/7VNA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.2
config/services/containers/app/collabora/collabora.container.j2
+1
View File
@@ -17,6 +17,7 @@ Environment="aliasgroup1=https://{{ services['nextcloud']['domain']['public'] }}
Environment="extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:server_name={{ services['collabora']['domain']['public'] }}.{{ domain['public'] }} --o:admin_console.enable=false"
[Service]
MemoryKSM=yes
Restart=always
RestartSec=10s
TimeoutStopSec=120
config/services/containers/app/linkding/linkding.container.j2
+58
View File
@@ -0,0 +1,58 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=Linkding
[Container]
Image=ghcr.io/sissbruecker/linkding:{{ version['containers']['linkding'] }}
ContainerName=linkding
HostName=linkding
PublishPort={{ services['linkding']['ports']['http'] }}:9090/tcp
# Persistent data
Volume=%h/data/containers/linkding/data:/etc/linkding/data:rw
Volume=%h/containers/linkding/ssl:/etc/ssl/linkding:ro
# General
Environment="TZ={{ timezone }}"
Environment="LD_DISABLE_BACKGROUND_TASKS=False"
Environment="LD_REQUEST_MAX_CONTENT_LENGTH=268435456"
# PostgreSQL
Environment="LD_DB_ENGINE=postgres"
Environment="LD_DB_DATABASE=linkding_db"
Environment="LD_DB_USER=linkding"
Environment="LD_DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
Environment="LD_DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
Environment="PGSSLMODE=verify-full"
Environment="PGSSLROOTCERT=/etc/ssl/linkding/{{ root_cert_filename }}"
Environment="PGSSLCERTMODE=disable"
Secret=LINKDING_DB_PASSWORD,type=env,target=LD_DB_PASSWORD
# OIDC
Environment="LD_ENABLE_OIDC=True"
Environment="LD_DISABLE_LOGIN_FORM=True"
Environment="OIDC_OP_AUTHORIZATION_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/api/oidc/authorization"
Environment="OIDC_OP_TOKEN_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/api/oidc/token"
Environment="OIDC_OP_USER_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/api/oidc/userinfo"
Environment="OIDC_OP_JWKS_ENDPOINT=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/jwks.json"
Environment="OIDC_RP_CLIENT_ID=linkding"
Environment="OIDC_RP_SCOPES=openid email profile"
Environment="OIDC_USERNAME_CLAIM=preferred_username"
Environment="OIDC_USE_PKCE=True"
Environment="OIDC_VERIFY_SSL=True"
Secret=LINKDING_OIDC_CLIENT_SECRET,type=env,target=OIDC_RP_CLIENT_SECRET
# Reverse proxy
Environment="LD_CSRF_TRUSTED_ORIGINS=https://{{ services['linkding']['domain']['public'] }}.{{ domain['public'] }}"
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=60
[Install]
WantedBy=default.target
config/services/containers/app/mastodon/mastodon-streaming.container.j2
+1
View File
@@ -38,6 +38,7 @@ Environment="REDIS_URL=redis://host.containers.internal:{{ services['mastodon'][
Exec=node ./streaming/index.js
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/app/mastodon/mastodon-web.container.j2
+1
View File
@@ -66,6 +66,7 @@ Secret=MASTODON_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
Exec=bundle exec puma -C config/puma.rb
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/app/mastodon/mastodon-worker.container.j2
+1
View File
@@ -48,6 +48,7 @@ Secret=MASTODON_VAPID_PUBLIC_KEY,type=env,target=VAPID_PUBLIC_KEY
Exec=bundle exec sidekiq
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/app/outline/outline.container.j2
+1
View File
@@ -69,6 +69,7 @@ Secret=OUTLINE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
Environment="LOG_LEVEL=warn"
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/app/papra/papra.container.j2
+2
View File
@@ -35,6 +35,8 @@ Environment="DOCUMENTS_CONTENT_EXTRACTION_ENABLED=true"
Environment="DOCUMENTS_OCR_LANGUAGES=eng,kor"
Environment="DOCUMENT_STORAGE_MAX_UPLOAD_SIZE=0"
RunInit=true
[Service]
Restart=always
RestartSec=10s
config/services/containers/app/sure/sure-web.container.j2
+1
View File
@@ -58,6 +58,7 @@ Environment="EXCHANGE_RATE_PROVIDER=yahoo_finance"
Environment="SECURITIES_PROVIDER=yahoo_finance"
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/app/sure/sure-worker.container.j2
+1
View File
@@ -41,6 +41,7 @@ Environment="SECURITIES_PROVIDER=yahoo_finance"
Exec=bundle exec sidekiq
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/app/tandoor/tandoor.container.j2
+1
View File
@@ -52,6 +52,7 @@ Environment="SOCIAL_DEFAULT_GROUP=user"
Secret=TANDOOR_SOCIALACCOUNT_PROVIDERS,type=env,target=SOCIALACCOUNT_PROVIDERS
[Service]
MemoryKSM=yes
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
config/services/containers/auth/authelia/config/authelia.yaml.j2
+9 -108
View File
@@ -118,30 +118,6 @@ identity_providers:
access_token: '1h'
id_token: '1h'
refresh_token: '720h'
cors:
# booklogr cors configuration
endpoints:
- 'authorization'
- 'token'
- 'userinfo'
allowed_origins:
- 'https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}'
claims_policies:
romm:
id_token:
- 'email'
- 'email_verified'
- 'alt_emails'
- 'preferred_username'
- 'name'
- 'groups'
linkwarden:
id_token:
- 'preferred_username'
- 'name'
- 'email'
- 'email_verified'
- 'groups'
clients:
# https://www.authelia.com/integration/openid-connect/clients/gitea/
- client_id: 'gitea'
@@ -191,7 +167,7 @@ identity_providers:
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/nextcloud/#openid-connect-user-backend-app
- client_id: 'nextcloud'
client_name: 'Nextcloud'
client_name: 'nextcloud'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['nextcloud']['oidc']['hash'] }}'
public: false
@@ -214,7 +190,7 @@ identity_providers:
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/sure/
- client_id: 'sure'
client_name: 'Sure'
client_name: 'sure'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['sure']['oidc']['hash'] }}'
public: false
@@ -237,7 +213,7 @@ identity_providers:
token_endpoint_auth_method: 'client_secret_basic'
# https://www.authelia.com/integration/openid-connect/clients/outline/
- client_id: 'outline'
client_name: 'Outline'
client_name: 'outline'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['outline']['oidc']['hash'] }}'
public: false
@@ -259,29 +235,6 @@ identity_providers:
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/mealie/
- client_id: 'mealie'
client_name: 'Mealie'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['mealie']['oidc']['hash'] }}'
public: false
authorization_policy: 'one_factor'
require_pkce: true
pkce_challenge_method: 'S256'
redirect_uris:
- 'https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}/login'
scopes:
- 'openid'
- 'email'
- 'profile'
- 'groups'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
# https://www.authelia.com/integration/openid-connect/clients/homebox/
- client_id: 'homebox'
client_name: 'homebox'
@@ -324,28 +277,6 @@ identity_providers:
grant_types:
- 'authorization_code'
token_endpoint_auth_method: 'client_secret_basic'
# https://booklogr.app/docs/Configuration/OIDC-sign-in
- client_id: 'booklogr'
client_name: 'booklogr'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['booklogr']['oidc']['hash'] }}'
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/papra/
- client_id: 'papra'
client_name: 'papra'
@@ -368,30 +299,6 @@ identity_providers:
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
# https://www.authelia.com/integration/openid-connect/clients/romm/
- client_id: 'romm'
claims_policy: 'romm'
client_name: 'romm'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['romm']['oidc']['hash'] }}'
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://{{ services['romm']['domain']['public'] }}.{{ domain['public'] }}/api/oauth/openid'
scopes:
- 'openid'
- 'groups'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
# https://www.authelia.com/integration/openid-connect/clients/tandoor/
- client_id: 'tandoor'
client_name: 'tandoor'
@@ -437,27 +344,21 @@ identity_providers:
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
# https://www.authelia.com/integration/openid-connect/clients/linkwarden/
- client_id: 'linkwarden'
claims_policy: 'linkwarden'
client_name: 'linkwarden'
# https://www.authelia.com/integration/openid-connect/clients/linkding/
- client_id: 'linkding'
client_name: 'linkding'
consent_mode: 'implicit'
client_secret: '{{ hostvars['console']['linkwarden']['oidc']['hash'] }}'
client_secret: '{{ hostvars['console']['linkding']['oidc']['hash'] }}'
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://{{ services['linkwarden']['domain']['public'] }}.{{ domain['public'] }}/api/v1/auth/callback/oidc'
- 'https://{{ services['linkding']['domain']['public'] }}.{{ domain['public'] }}/oidc/callback/'
scopes:
- 'openid'
- 'groups'
- 'email'
- 'profile'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
token_endpoint_auth_method: 'client_secret_post'
data/images/memtest86-usb.img
BIN
View File
Binary file not shown.
docs/archives/services/app/booklogr/authelia.yaml
+33
View File
@@ -0,0 +1,33 @@
identity_providers:
oidc:
cors:
# booklogr cors configuration
endpoints:
- 'authorization'
- 'token'
- 'userinfo'
allowed_origins:
- 'https://booklogr.example.com'
clients:
# https://booklogr.app/docs/Configuration/OIDC-sign-in
- client_id: 'booklogr'
client_name: 'booklogr'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://booklogr.example.com/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
config/services/containers/app/booklogr/booklogr-api.container.j2 → docs/archives/services/app/booklogr/booklogr-api.container.j2
View File
config/services/containers/app/booklogr/booklogr-web.container.j2 → docs/archives/services/app/booklogr/booklogr-web.container.j2
View File
docs/archives/services/app/booklogr/group_vars.yaml
+17
View File
@@ -0,0 +1,17 @@
services:
booklogr:
domain:
public: "booklogr"
internal: "booklogr.app"
ports:
http: "5150"
api: "5000"
route:
api: "/v1 /v1/*"
deny: "/v1/login /v1/login/* /v1/register /v1/register/*"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
booklogr: "v1.11.1"
docs/archives/services/app/booklogr/secret.example.yaml
+8
View File
@@ -0,0 +1,8 @@
postgresql:
password:
booklogr: ""
booklogr:
secret_key: ""
oidc:
secret: ""
hash: ""
ansible/roles/app/tasks/services/set_booklogr.yaml → docs/archives/services/app/booklogr/set_booklogr.yaml
View File
docs/archives/services/app/linkwarden/authelia.yaml
+35
View File
@@ -0,0 +1,35 @@
identity_providers:
oidc:
claims_policies:
linkwarden:
id_token:
- 'preferred_username'
- 'name'
- 'email'
- 'email_verified'
- 'groups'
clients:
# https://www.authelia.com/integration/openid-connect/clients/linkwarden/
- client_id: 'linkwarden'
claims_policy: 'linkwarden'
client_name: 'linkwarden'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://linkwarden.example.com/api/v1/auth/callback/oidc'
scopes:
- 'openid'
- 'groups'
- 'email'
- 'profile'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
docs/archives/services/app/linkwarden/group_vars.yaml
+13
View File
@@ -0,0 +1,13 @@
services:
linkwarden:
domain:
public: "link"
internal: "link.app"
ports:
http: "3005"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
linkwarden: "v2.16.1"
config/services/containers/app/linkwarden/linkwarden.container.j2 → docs/archives/services/app/linkwarden/linkwarden.container.j2
+1 -7
View File
@@ -37,14 +37,8 @@ Environment="DISABLE_NEW_SSO_USERS=false"
Secret=LINKWARDEN_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
# Archiving
Environment="DISABLE_BROWSER=false"
Environment="BROWSER_LIFECYCLE=on-demand"
Environment="ARCHIVE_TAKE_COUNT=2"
Environment="DISABLE_BROWSER=true"
Environment="NEXT_PUBLIC_MAX_FILE_BUFFER=250"
Environment="MONOLITH_MAX_BUFFER=250"
Environment="PDF_MAX_BUFFER=100"
Environment="SCREENSHOT_MAX_BUFFER=100"
# Meili search
# Environment=MEILI_HOST=""
# Environment=MEILI_MASTER_KEY=""
docs/archives/services/app/linkwarden/secrets.example.yaml
+8
View File
@@ -0,0 +1,8 @@
postgresql:
password:
linkwarden: ""
linkwarden:
secret_key: ""
oidc:
secret: ""
hash: ""
ansible/roles/app/tasks/services/set_linkwarden.yaml → docs/archives/services/app/linkwarden/set_linkwarden.yaml
View File
docs/archives/services/app/mealie/authelia.yaml
+26
View File
@@ -0,0 +1,26 @@
identity_providers:
oidc:
clients:
# https://www.authelia.com/integration/openid-connect/clients/mealie/
- client_id: 'mealie'
client_name: 'Mealie'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: true
pkce_challenge_method: 'S256'
redirect_uris:
- 'https://mealie.example.com/login'
scopes:
- 'openid'
- 'email'
- 'profile'
- 'groups'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
docs/archives/services/app/mealie/group_vars.yaml
+14
View File
@@ -0,0 +1,14 @@
services:
mealie:
domain:
public: "mealie"
internal: "mealie.app"
ports:
http: "9000"
subuid: "100910"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
mealie: "v3.22.0"
config/services/containers/app/mealie/mealie.container.j2 → docs/archives/services/app/mealie/mealie.container.j2
View File
docs/archives/services/app/mealie/secret.example.yaml
+7
View File
@@ -0,0 +1,7 @@
postgresql:
password:
mealie: ""
mealie:
oidc:
secret: ""
hash: ""
ansible/roles/app/tasks/services/set_mealie.yaml → docs/archives/services/app/mealie/set_mealie.yaml
View File
docs/archives/services/app/romm/authelia.yaml
+36
View File
@@ -0,0 +1,36 @@
identity_providers:
oidc:
claims_policies:
romm:
id_token:
- 'email'
- 'email_verified'
- 'alt_emails'
- 'preferred_username'
- 'name'
- 'groups'
clients:
# https://www.authelia.com/integration/openid-connect/clients/romm/
- client_id: 'romm'
claims_policy: 'romm'
client_name: 'romm'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://romm.example.com/api/oauth/openid'
scopes:
- 'openid'
- 'groups'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
docs/archives/services/app/romm/group_vars.yaml
+15
View File
@@ -0,0 +1,15 @@
services:
romm:
domain:
public: "romm"
internal: "romm.app"
ports:
http: "8002"
redis: "6384"
subuid: "100999"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
romm: "5.1.0"
config/services/containers/app/romm/romm.container.j2 → docs/archives/services/app/romm/romm.container.j2
View File
docs/archives/services/app/romm/secret.example.yaml
+8
View File
@@ -0,0 +1,8 @@
postgresql:
password:
romm: ""
romm:
secret_key: ""
oidc:
secret: ""
hash: ""
ansible/roles/app/tasks/services/set_romm.yaml → docs/archives/services/app/romm/set_romm.yaml
View File