feat(repo): IaaS baseline

.gitignore

@@ -1,10 +1,10 @@
-.ansible
 data/bin/*
-data/volumes/*
-data/images/*
-!data/images/containers
 data/images/containers/*
-docs/archives/textfiles/
-docs/notes/*
+data/images/seeds/*
+data/vmm_init/*
+*.raw
+*.tar
+*.qcow2
 *.sql
+*.iso
 !.gitkeep

README.md

@@ -1,35 +0,0 @@
-# ilnmors homelab README
-
-This homelab project implements single-node On-premise IaaS system. The homelab contains virtual machines which are divided by their roles, such as private firewall, DNS, PKI, LDAP and database, SSO(OIDC). The standard domain is used to implement this system without specific vendors. All components are defined as code and initiated by IaC (Ansible) except hypervisor initial configuration.
-
-## RTO and RPO
-
-### RPO
-- Each backup guarantees 24 hours RPO
-    - DB dumps are backed up at 12:00 AM
-    - Stateful data in app vm is backed up at 03:00 AM
-- The maximum inconsistency window between DB dumps and stateful data can be 27 hours.
-    - The different backup time.
-
-### RTO
-- Feb/25/2026 - Reprovisioning Hypervisor and vms
-    - RTO: 1 hour 30 min - verified
-        - Manual install and set vmm: 20 min
-        - Create and reprovision fw including services: 15 min
-        - Create and reprovision infra including services: 20 min
-        - Create and reprovision auth including services: 10 min
-        - Create and reprovision app except services: 10 min
-        - Intermediate tasks (ACME issuance, DNS propagation, etc.): 15 min
-
-- Mar/5/2026 - Reprovisioning Hardware and Hypervisor and vms
-    - RTO: 2 hour 20 min
-        - console: 15min - verified
-        - certificate: 0 min (When it needs to be created, RTO will be 20 min) - not verified
-        - wireguard: 0 min (When it needs to be created, RTO will be 1 min) - not verified
-        - hypervisor(+fw): 45 min - verified
-        - switch: 1 min - verified
-        - dsm: 30 min - verified
-        - kopia: 0 min (When it needs to be created, RTO will be 10 min) - verified
-        - Extra vms: 30 min - verified
-        - Etc: 30 min
-

ansible/convention.yaml

@@ -1,27 +1,28 @@
 ---
-# `""` should be used for every string values
-# except name, boolean, varible(environment) name, number (only for decimal)
+# String values need `""`
+# Task names, boolean values, environment names, decimal numbers don't need `""`
 - name: Convention task
   delegate_to: "host"
   delegate_facts: true
   environment:
-    env: "environment"
+    env: "value"
   ansible.builtin.file:
-    # Identifier: name:, src, dest, url
-    path: "/path/of/example"
-    # State
+    # Identifier: name, src, dest, url, etc.
+    path: "/example/path"
+    # state parameters
     state: "directory"
     owner: "root"
     group: "root"
     mode: "0640"
-    # optional data
+    # optional parameters
     recurse: true
   loop:
     - "list"
   loop_control:
     label: "{{ item }}"
   become: true
-  # become_user: "root"
+  # default become user is root
+  become_user: "user"
   when: condition.stat.exists
   changed_when: condition.rc != 0
   failed_when: condition.rc == 0
@@ -30,6 +31,8 @@
   listen: "notification_example"
   no_log: true
   run_once: true
+  # Ensure execution even if it fails (it prints errors on the screen, but it ignores them)
+  ignore_errors: true
   tags:
     - "always"
     - "init"

ansible/inventory/group_vars/all.yaml

@@ -1,15 +1,14 @@
 ---
 # Global vars
-ansible_ssh_private_key_file: "/etc/secrets/{{ hostvars['console']['node']['uid'] }}/id_console"
 timezone: "Asia/Seoul"
+ansible_ssh_private_key_file: "/etc/secrets/{{ hostvars['console']['node']['uid'] }}/id_console"
 
 # CA
 root_cert_filename: "ilnmors_root_ca.crt"
 intermediate_cert_filename: "ilnmors_intermediate_ca.crt"
 intermediate_key_filename: "ilnmors_intermediate_ca.key"
 
-
-# local SAN and SSH SAN should be updated manually on host_vars
+# Domains
 domain:
   public: "ilnmors.com"
   internal: "ilnmors.internal"
@@ -67,7 +66,7 @@ services:
   grafana:
     domain: "grafana"
     ports:
-      http: "3000" # Infra server: Internal ports
+      http: "3000"
     subuid: "100471"
   caddy:
     ports:
@@ -98,7 +97,7 @@ services:
       public: "gitea"
       internal: "gitea.app"
     ports:
-      http: "3000" # App server: Public ports
+      http: "3001"
     subuid: "100999"
   immich:
     domain:
@@ -118,16 +117,6 @@ services:
       http: "8001"
       redis: "6380"
     subuid: "100999"
-  manticore:
-    subuid: "100998"
-  affine:
-    domain:
-      public: "affine"
-      internal: "affine.app"
-    ports:
-      http: "3010"
-      redis: "6381"
-      manticore: "9308"
   nextcloud:
     domain:
       public: "nextcloud"
@@ -148,7 +137,7 @@ services:
       public: "sure"
       internal: "sure.app"
     ports:
-      http: "3001"
+      http: "3002"
       redis: "6383"
     subuid: "100999"
   outline:
@@ -156,7 +145,7 @@ services:
       public: "outline"
       internal: "outline.app"
     ports:
-      http: "3002"
+      http: "3004"
       redis: "6384"
     subuid: "101000"
   memos:
@@ -164,43 +153,49 @@ services:
       public: "memos"
       internal: "memos.app"
     ports:
-      http: "3004"
+      http: "3005"
     subuid: "110000"
+  mealie:
+    domain:
+      public: "mealie"
+      internal: "mealie.app"
+    ports:
+      http: "9001"
+    subuid: "100910"
 
 version:
   packages:
-    sops: "3.12.1"
+    sops: "3.13.1"
     step: "0.30.2"
-    kopia: "0.22.3"
+    kopia: "0.23.0"
     blocky: "0.29.0"
     alloy: "1.16.1"
   containers:
     # common
-    caddy: "2.11.2"
+    caddy: "2.11.4"
     # infra
     step: "0.30.2"
     ldap: "v0.6.3"
     x509-exporter: "4.1.0"
-    prometheus: "v3.11.3"
+    prometheus: "v3.12.0"
     loki: "3.7.1"
     grafana: "13.0.1"
     ## Postgresql
-    postgresql: "18.3"
+    postgresql: "18.4"
     # For immich - https://github.com/immich-app/base-images/blob/main/postgres/versions.yaml
 #    pgvector: "v0.8.1"
     vectorchord: "1.1.1"
     # Auth
-    authelia: "4.39.19"
+    authelia: "4.39.20"
     # App
     vaultwarden: "1.36.0"
     gitea: "1.26.1"
-    redis: "8.6.3"
+    redis: "8.8.0"
     immich: "v2.7.5"
     paperless: "2.20.15"
-    manticore: "25.0.0"
-    affine: "0.26.3"
-    nextcloud: "33.0.3"
-    collabora: "25.04.9.4.1"
-    sure: "0.7.0-hotfix.2"
-    outline: "1.7.1"
-    memos: "0.28.0"
+    nextcloud: "33.0.5"
+    collabora: "25.04.10.3.1"
+    sure: "0.7.1"
+    outline: "1.8.1"
+    memos: "0.29.1"
+    mealie: "v3.19.2"

ansible/inventory/group_vars/hypervisor.yaml

@@ -1,7 +1,33 @@
 ---
 node:
   name: "vmm"
+  group: "svadmins"
   uid: 2000
   home_path: "/home/vmm"
-  ssh_san: "vmm,vmm_init,vmm.ilnmors.internal,init.vmm.ilnmors.internal"
-  local_san: "localhost vmm.ilnmors.internal"
+  libvirt_path: "/var/lib/libvirt"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}_init,{{ node['name'] }}.{{ domain['internal'] }},init.{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
+
+hardware:
+  mac:
+    nic0: "c8:ff:bf:07:02:34"
+    nic1: "c8:ff:bf:07:02:33"
+    sfpp0: "c8:ff:bf:07:02:31"
+    sfpp1: "c8:ff:bf:07:02:32"
+  igpu:
+    id: "8086:4628"
+    address: "0000:00:02.0"
+    domain: "0x0000"
+    bus: "0x00"
+    slot: "0x02"
+    function: "0x0"
+  hdd:
+    data:
+      hdd0: "WMC6N0E617S8"
+      hdd1: "P6HVTL0W"
+      hdd2: "P2GH354H"
+      hdd3: "P6GJKSMP"
+  btrfs:
+    label: "DATA"
+    level: "raid10"
+    mount_point: "{{ node['libvirt_path'] }}/data"

ansible/inventory/host_vars/app.yaml

@@ -2,17 +2,29 @@
 # Node Factors
 node:
   name: "app"
+  group: "svadmins"
   uid: 2004
   home_path: "/home/app"
-  ssh_san: "app,app.ilnmors.internal"
-  local_san: "localhost app.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
 # VM Factors
 vm:
   name: "app"
-  cpu: 4
+  cpu: 6
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='0'/>
+    <vcpupin vcpu='1' cpuset='1'/>
+    <vcpupin vcpu='2' cpuset='2'/>
+    <vcpupin vcpu='3' cpuset='3'/>
+    <vcpupin vcpu='4' cpuset='10'/>
+    <vcpupin vcpu='5' cpuset='11'/>
+    <emulatorpin cpuset='10-11'/>
   shares: 1024
   memory: 16
   storage: 256
+  data_storage:
+    name: "vdb"
+    size: 3.5
   lan_mac: "0a:49:6e:4d:03:00"
   lan_net: "lan-net"
   lan_group: "vlan10-access"
@@ -26,16 +38,3 @@ vm:
       bus: "0x00"
       slot: "0x02"
       function: "0x0"
-    sata_controller: # Additional SATA Controller
-      address: "0000:04:00.0"
-      domain: "0x0000"
-      bus: "0x04"
-      slot: "0x00"
-      function: "0x0"
-
-# BTRFS configuration for hdd which is passthroughed
-storage:
-  btrfs:
-    label: "APP_DATA"
-    level: "raid10"
-    mount_point: "/home/app/data"

ansible/inventory/host_vars/auth.yaml

@@ -2,15 +2,20 @@
 # Node Factors
 node:
   name: "auth"
+  group: "svadmins"
   uid: 2003
   home_path: "/home/auth"
-  ssh_san: "auth,auth.ilnmors.internal"
-  local_san: "localhost auth.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
 # VM Factors
 vm:
   name: "auth"
   cpu: 2
-  shares: 512
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='8'/>
+    <vcpupin vcpu='1' cpuset='9'/>
+    <emulatorpin cpuset='8-9'/>
+  shares: 1024
   memory: 2
   storage: 64
   lan_mac: "0a:49:6e:4d:02:00"

ansible/inventory/host_vars/console.yaml

@@ -10,17 +10,17 @@ age_key: !vault |
           33653638373537323363316363646534323362353836373665636265663939353862663532313230
           30643038313138626464626161373835646665326334393834616234643931656536343130316238
           61656264643830616639
-# Node Factors
+
 node:
   name: "console"
+  group: "svadmins"
   uid: 2999
   home_path: "/home/console"
-  workspace_path: "{{ node.home_path }}/workspace"
-  homelab_path: "{{ node.home_path }}/workspace/homelab"
-  data_path: "{{ node.homelab_path }}/data"
-  config_path: "{{ node.homelab_path }}/config"
-  ssh_san: "console,console.ilnmors.internal"
+  workspace_path: "{{ node['home_path'] }}/workspace"
+  homelab_path: "{{ node['home_path'] }}/workspace/homelab"
+  data_path: "{{ node['homelab_path'] }}/data"
+  config_path: "{{ node['homelab_path'] }}/config"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
   ssh_users: "vmm,fw,infra,auth,app"
   # add the hostname of wsl, it is needed to improve the sudo problem
-  local_san: "localhost console.ilnmors.internal surface"
-# ansible_python_interpreter: "{{ ansible_playbook_python }}"
+  local_san: "localhost {{ node['name'] }} {{ node['name'] }}.{{ domain['internal'] }}"

ansible/inventory/host_vars/fw.yaml

@@ -2,15 +2,22 @@
 # Node Factors
 node:
   name: "fw"
+  group: "svadmins"
   uid: 2001
   home_path: "/home/fw"
-  ssh_san: "fw,fw.ilnmors.internal"
-  local_san: "localhost fw.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
 
 # VM Factors
 vm:
   name: "fw"
-  cpu: 2
+  cpu: 4
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='0'/>
+    <vcpupin vcpu='1' cpuset='1'/>
+    <vcpupin vcpu='2' cpuset='4'/>
+    <vcpupin vcpu='3' cpuset='5'/>
+    <emulatorpin cpuset='4-5'/>
   shares: 2048
   memory: 4
   storage: 64
@@ -21,7 +28,7 @@ vm:
   lan_group: "vlan-trunk"
 
 # Network Factors
-# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to seperate network.
+# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to separate network.
 network4:
   subnet:
     client: "192.168.1.0/24"

ansible/inventory/host_vars/infra.yaml

@@ -2,16 +2,23 @@
 # Node Factors
 node:
   name: "infra"
+  group: "svadmins"
   uid: 2002
   home_path: "/home/infra"
-  ssh_san: "infra,infra.ilnmors.internal"
-  local_san: "localhost infra.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
 
 # VM Factors
 vm:
   name: "infra"
-  cpu: 2
-  shares: 1024
+  cpu: 4
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='2'/>
+    <vcpupin vcpu='1' cpuset='3'/>
+    <vcpupin vcpu='2' cpuset='6'/>
+    <vcpupin vcpu='3' cpuset='7'/>
+    <emulatorpin cpuset='6-7'/>
+  shares: 2048
   memory: 6
   storage: 256
   lan_mac: "0a:49:6e:4d:01:00"

ansible/playbooks/app/site.yaml

@@ -20,6 +20,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['app'] }}"
+      no_log: true
       tags: ["always"]
 
   tasks:
@@ -97,10 +98,10 @@
       become: true
       tags: ["init", "install-packages"]
 
-    - name: Set raid
+    - name: Set data volume
       ansible.builtin.include_role:
         name: "app"
-        tasks_from: "node/set_raid"
+        tasks_from: "node/set_data_volume"
         apply:
           tags: ["init", "raid"]
       tags: ["init", "raid"]
@@ -193,14 +194,6 @@
           tags: ["site", "paperless"]
       tags: ["site", "paperless"]
 
-    - name: Set affine
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_affine"
-        apply:
-          tags: ["site", "affine"]
-      tags: ["site", "affine"]
-
     - name: Set nextcloud
       ansible.builtin.include_role:
         name: "app"
@@ -241,6 +234,14 @@
           tags: ["site", "memos"]
       tags: ["site", "memos"]
 
+    - name: Set mealie
+      ansible.builtin.include_role:
+        name: "app"
+        tasks_from: "services/set_mealie"
+        apply:
+          tags: ["site", "mealie"]
+      tags: ["site", "mealie"]
+
     - name: Flush handlers right now
       ansible.builtin.meta: "flush_handlers"
 

ansible/playbooks/auth/site.yaml

@@ -20,6 +20,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['auth'] }}"
+      no_log: true
       tags: ["always"]
 
   tasks:

ansible/playbooks/console/site.yaml

@@ -20,6 +20,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['console'] }}"
+      no_log: true
       tags: ["always"]
 
   tasks:
@@ -70,32 +71,6 @@
           tags: ["init", "ssh_client"]
       tags: ["init", "ssh_client"]
 
-    - name: Check file permissions
-      ansible.builtin.file:
-        path: "{{ node['workspace_path'] }}/{{ item }}"
-        state: "directory"
-        owner: "{{ ansible_user }}"
-        group: "svadmins"
-        mode: "u=rwX,g=,o="
-        recurse: true
-      loop:
-        - "homelab/ansible"
-        - "homelab/config"
-        - "homelab/docs"
-        - "university"
-      tags: ["init", "site", "file_permission"]
-      # kopia snashot is mounted on homelab/data/volumes.
-      # NEVER CHANGE permission and owners
-
-    - name: Download vm cloud-init
-      ansible.builtin.get_url:
-        url: "https://cdimage.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
-        dest: "{{ node['data_path'] }}/images/debian-13-generic-amd64.qcow2"
-        owner: "console"
-        group: "svadmins"
-        mode: "0600"
-      tags: ["init", "site", "cloud-init-image"]
-
     - name: Install packages
       ansible.builtin.apt:
         name:
@@ -108,8 +83,6 @@
           - "logrotate"
           - "nftables"
           - "build-essential"
-          - "g++"
-          - "gcc"
           - "fuse3"
         state: "present"
       become: true
@@ -123,6 +96,23 @@
           tags: ["init", "site", "tools"]
       tags: ["init", "site", "tools"]
 
+    - name: Set vmm_init config
+      ansible.builtin.include_role:
+        name: "console"
+        tasks_from: "node/create_vmm_init"
+        apply:
+          tags: ["site", "vmm_init"]
+      tags: ["site", "vmm_init"]
+
+    - name: Download vm cloud-init
+      ansible.builtin.get_url:
+        url: "https://cdimage.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
+        dest: "{{ node['data_path'] }}/images/debian-13-generic-amd64.qcow2"
+        owner: "console"
+        group: "svadmins"
+        mode: "0600"
+      tags: ["init", "site", "cloud-init-image"]
+
     - name: Set kopia
       ansible.builtin.include_role:
         name: "common"

ansible/playbooks/fw/site.yaml

@@ -20,6 +20,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['fw'] }}"
+      no_log: true
       tags: ["always"]
 
   tasks:

ansible/playbooks/infra/site.yaml

@@ -20,6 +20,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['infra'] }}"
+      no_log: true
       tags: ["always"]
 
   tasks:

ansible/playbooks/vmm/create_vm.yaml

@@ -36,6 +36,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['vmm'] }}"
+      no_log: true
 
     - name: Create seed file
       ansible.builtin.include_role:

ansible/playbooks/vmm/site.yaml

@@ -27,6 +27,7 @@
     - name: Set become password
       ansible.builtin.set_fact:
         ansible_become_pass: "{{ hostvars['console']['sudo']['password']['vmm'] }}"
+      no_log: true
       tags: ["always"]
   tasks:
     # init
@@ -100,6 +101,14 @@
           tags: ["init", "linger"]
       tags: ["init", "linger"]
 
+    - name: Set raid
+      ansible.builtin.include_role:
+        name: "vmm"
+        tasks_from: "node/set_raid"
+        apply:
+          tags: ["init", "raid"]
+      tags: ["init", "raid"]
+
     - name: Set libvirt
       ansible.builtin.include_role:
         name: "vmm"
@@ -155,6 +164,7 @@
           - ksmtuned
           - libvirt-daemon-system
           - virt-top
+          - btrfs-progs
           - python3
           - python3-apt
           - python3-libvirt

ansible/roles/app/handlers/main.yaml

@@ -54,18 +54,6 @@
   listen: "notification_restart_paperless"
   ignore_errors: true # noqa: ignore-errors
 
-- name: Restart affine
-  ansible.builtin.systemd:
-    name: "affine.service"
-    state: "restarted"
-    enabled: true
-    daemon_reload: true
-    scope: "user"
-  when: is_affine_init.stat.exists
-  changed_when: false
-  listen: "notification_restart_affine"
-  ignore_errors: true # noqa: ignore-errors
-
 - name: Restart nextcloud
   ansible.builtin.systemd:
     name: "nextcloud.service"
@@ -125,3 +113,14 @@
   changed_when: false
   listen: "notification_restart_memos"
   ignore_errors: true # noqa: ignore-errors
+
+- name: Restart mealie
+  ansible.builtin.systemd:
+    name: "mealie.service"
+    state: "restarted"
+    enabled: true
+    scope: "user"
+    daemon_reload: true
+  changed_when: false
+  listen: "notification_restart_mealie"
+  ignore_errors: true # noqa: ignore-errors

ansible/roles/app/tasks/node/set_data_volume.yaml

@@ -0,0 +1,41 @@
+---
+- name: Check app data volume filesystem already exists
+  ansible.builtin.command:
+    cmd: "blkid /dev/{{ vm['data_storage']['name'] }}"
+  register: is_app_data
+  changed_when: false
+  failed_when: false
+  become: true
+
+- name: Create ext4 filesystem on app data raw
+  ansible.builtin.command:
+    cmd: "mkfs.ext4 -F /dev/{{ vm['data_storage']['name'] }}"
+  when: is_app_data.rc != 0
+  changed_when: true
+  become: true
+
+- name: Set data volume path
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/data"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+
+- name: Mount app data volume
+  ansible.posix.mount:
+    path: "{{ node['home_path'] }}/data"
+    src: "/dev/{{ vm['data_storage']['name'] }}"
+    opts: "noatime"
+    state: "mounted"
+    fstype: "ext4"
+  become: true
+
+- name: Set app data volume path permissions
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/data"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  become: true

ansible/roles/app/tasks/services/set_collabora.yaml

@@ -4,7 +4,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/collabora/collabora.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/collabora.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_collabora"
 

ansible/roles/app/tasks/services/set_gitea.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['gitea']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/gitea"
@@ -18,7 +18,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/gitea/ssl/{{ root_cert_filename }}"
     owner: "{{ services['gitea']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_gitea"
@@ -38,7 +38,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/gitea/gitea.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/gitea.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_gitea"
 

ansible/roles/app/tasks/services/set_immich.yaml

@@ -8,7 +8,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "containers/redis"
@@ -21,7 +21,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
     dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_conf"
 
@@ -30,7 +30,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_containerfile"
 
@@ -56,7 +56,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/immich"
@@ -71,7 +71,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/immich/ssl/{{ root_cert_filename }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   notify: "notification_restart_immich"
   no_log: true
@@ -90,7 +90,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/immich.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_immich"
 
@@ -99,7 +99,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich-ml.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/immich-ml.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_immich-ml"
 

ansible/roles/app/tasks/services/set_mealie.yaml

@@ -0,0 +1,77 @@
+---
+- name: Create mealie directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ services['mealie']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  loop:
+    - "data/containers/mealie"
+    - "data/containers/mealie/data"
+    - "containers/mealie"
+    - "containers/mealie/ssl"
+  become: true
+
+- name: Deploy root certificate
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ca']['root']['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/mealie/ssl/{{ root_cert_filename }}"
+    owner: "{{ services['mealie']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0440"
+  become: true
+  notify: "notification_restart_mealie"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    - name: "MEALIE_POSTGRES_PASSWORD"
+      value: "{{ hostvars['console']['postgresql']['password']['mealie'] }}"
+    - name: "MEALIE_OIDC_CLIENT_SECRET"
+      value: "{{ hostvars['console']['mealie']['oidc']['secret'] }}"
+  notify: "notification_restart_mealie"
+  no_log: true
+
+- name: Deploy mealie.container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/mealie/mealie.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/mealie.container"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0644"
+  notify: "notification_restart_mealie"
+
+- name: Enable mealie.service
+  ansible.builtin.systemd:
+    name: "mealie.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Check container archive images
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
+  register: container_archive_images
+
+- name: Save container archive images
+  containers.podman.podman_save:
+    image:
+      - "ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}"
+    dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
+    format: "oci-archive"
+    force: false
+  when: not container_archive_images.stat.exists
+
+- name: Fetch container archive images
+  ansible.builtin.fetch:
+    src: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
+    dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
+    flat: true

ansible/roles/app/tasks/services/set_memos.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['memos']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/memos"
@@ -19,7 +19,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/memos/ssl/{{ root_cert_filename }}"
     owner: "{{ services['memos']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_memos"
@@ -33,6 +33,7 @@
         sslrootcert=/etc/ssl/memos/{{ root_cert_filename }}"
     state: "present"
     force: true
+  no_log: true
   notify: "notification_restart_memos"
 
 - name: Deploy memos.container file
@@ -40,7 +41,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/memos/memos.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/memos.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_memos"
 

ansible/roles/app/tasks/services/set_nextcloud.yaml

@@ -8,7 +8,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "containers/redis"
@@ -21,7 +21,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
     dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_conf"
 
@@ -30,7 +30,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_containerfile"
 
@@ -48,7 +48,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['nextcloud']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/nextcloud"
@@ -69,7 +69,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/nextcloud/ssl/{{ root_cert_filename }}"
     owner: "{{ services['nextcloud']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_nextcloud"
@@ -88,8 +88,8 @@
         detach: false
         env:
           NEXTCLOUD_UPDATE: "1"
-          NEXTCLOUD_ADMIN_USER: "admin-local"
-          NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin-local']['password'] }}"
+          NEXTCLOUD_ADMIN_USER: "{{ hostvars['console']['nextcloud']['admin']['id'] }}"
+          NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin']['password'] }}"
           POSTGRES_HOST: "{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
           POSTGRES_DB: "nextcloud_db"
           POSTGRES_USER: "nextcloud"
@@ -110,14 +110,14 @@
         state: "touch"
         mode: "0644"
         owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
 
 - name: Deploy config files
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/config/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/data/containers/nextcloud/html/config/{{ item }}"
     owner: "{{ services['nextcloud']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0640"
   loop:
     - "background.config.php"
@@ -132,7 +132,7 @@
   ansible.builtin.copy:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/ini/{{ item }}"
     dest: "{{ node['home_path'] }}/containers/nextcloud/ini/{{ item }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   loop:
     - "opcache.ini"
@@ -144,7 +144,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/nextcloud.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/nextcloud.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_nextcloud"
 
@@ -153,7 +153,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/systemd/{{ item }}"
     dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   loop:
     - "nextcloud-cron.service"

ansible/roles/app/tasks/services/set_outline.yaml

@@ -8,7 +8,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "containers/redis"
@@ -21,7 +21,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
     dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_conf"
 
@@ -30,7 +30,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_containerfile"
 
@@ -48,7 +48,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['outline']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/outline"
@@ -68,7 +68,7 @@
     state: "touch"
     mode: "0644"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
   when: not is_outline_init.stat.exists
 
 - name: Deploy root certificate
@@ -77,7 +77,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/outline/ssl/{{ root_cert_filename }}"
     owner: "{{ services['outline']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_outline"
@@ -106,7 +106,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/outline/outline.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/outline.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_outline"
 

ansible/roles/app/tasks/services/set_paperless.yaml

@@ -8,7 +8,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "containers/redis"
@@ -21,7 +21,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
     dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_conf"
 
@@ -30,7 +30,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_containerfile"
 
@@ -48,7 +48,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['paperless']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/paperless"
@@ -65,7 +65,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/paperless/build/paperless.containerfile.j2"
     dest: "{{ node['home_path'] }}/containers/paperless/build/Containerfile"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0640"
 
 - name: Deploy root certificate
@@ -74,7 +74,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/paperless/ssl/{{ root_cert_filename }}"
     owner: "{{ services['paperless']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_paperless"
@@ -131,7 +131,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/paperless/paperless.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/paperless.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_paperless"
 

ansible/roles/app/tasks/services/set_sure.yaml

@@ -8,7 +8,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "containers/redis"
@@ -21,7 +21,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
     dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_conf"
 
@@ -30,7 +30,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   register: "is_redis_containerfile"
 
@@ -48,7 +48,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['sure']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/sure"
@@ -64,7 +64,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/sure/ssl/{{ root_cert_filename }}"
     owner: "{{ services['sure']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_sure"
@@ -91,7 +91,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/sure/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   loop:
     - "sure-web.container"

ansible/roles/app/tasks/services/set_vaultwarden.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "data/containers/vaultwarden"
@@ -17,7 +17,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/vaultwarden/ssl/{{ root_cert_filename }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_vaultwarden"
@@ -44,7 +44,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/vaultwarden/vaultwarden.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/vaultwarden.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_vaultwarden"
 

ansible/roles/auth/tasks/services/set_authelia.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "authelia"
@@ -17,7 +17,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/auth/authelia/config/authelia.yaml.j2"
     dest: "{{ node['home_path'] }}/containers/authelia/config/authelia.yaml"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   become: true
   notify: "notification_restart_authelia"
@@ -29,7 +29,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/authelia/certs/{{ root_cert_filename }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   no_log: true
@@ -65,7 +65,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/auth/authelia/authelia.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/authelia.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_authelia"
 

ansible/roles/common/tasks/node/create_default_dir.yaml

@@ -22,7 +22,7 @@
     path: "{{ node['home_path'] }}/.config/systemd/user"
     state: "directory"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0700"
 
 - name: Create quadlet directory
@@ -30,5 +30,14 @@
     path: "{{ node['home_path'] }}/.config/containers/systemd"
     state: "directory"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0700"
+
+- name: Set data volume path
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/data"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  when: node['name'] in ["infra", "app"]

ansible/roles/common/tasks/node/set_networkd.yaml

@@ -11,7 +11,7 @@
 - name: Deploy networkd files
   ansible.builtin.template:
     src: "{{ item }}"
-    dest: "/etc/systemd/network/{{ item | basename }}"
+    dest: "/etc/systemd/network/{{ item | basename | replace('.j2', '') }}"
     owner: "root"
     group: "systemd-network"
     mode: "0640"

ansible/roles/common/tasks/services/set_alloy.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Gather system facts (hardware)
+- name: Gather ystem facts (hardware)
   ansible.builtin.setup:
     gather_subset:
       - hardware
@@ -67,6 +67,19 @@
   become: true
   notify: "notification_restart_alloy"
 
+- name: Set ACL for data directory
+  ansible.posix.acl:
+    path: "{{ item }}"
+    entity: "alloy"
+    etype: "user"
+    permissions: "x"
+    state: "present"
+  loop:
+    - "{{ node['home_path'] }}"
+    - "{{ node['home_path'] }}/data"
+  become: true
+  when: node['name'] == "app"
+
 - name: Enable alloy service
   ansible.builtin.systemd:
     name: "alloy.service"

ansible/roles/common/tasks/services/set_caddy.yaml

@@ -4,7 +4,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -18,7 +18,7 @@
   ansible.builtin.file:
     path: /var/log/caddy
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0755"
   become: true
@@ -48,7 +48,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/build/caddy.containerfile.j2"
     dest: "{{ node['home_path'] }}/containers/caddy/build/Containerfile"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0640"
 
 - name: Deploy root crt for build
@@ -56,7 +56,7 @@
     content: "{{ hostvars['console']['ca']['root']['crt'] }}"
     dest: "{{ node['home_path'] }}/containers/caddy/build/{{ root_cert_filename }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0640"
   no_log: true
 
@@ -77,7 +77,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/etc/{{ node['name'] }}/Caddyfile.j2"
     dest: "{{ node['home_path'] }}/containers/caddy/etc/Caddyfile"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   notify: "notification_restart_caddy"
 
@@ -86,7 +86,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/caddy.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/caddy.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_caddy"
 

ansible/roles/common/tasks/services/set_crowdsec.yaml

@@ -315,7 +315,3 @@
     enabled: true
     daemon_reload: true
   become: true
-
-# cscli bouncers list
-# cscli machines list
-# cscli metrics

ansible/roles/common/tasks/services/set_kopia.yaml

@@ -14,7 +14,7 @@
           kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
         dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
         owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
         mode: "0600"
       loop:
         - "amd64"
@@ -36,7 +36,7 @@
 
     - name: Connect console kopia server
       environment:
-        KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['user']['console'] }}"
+        KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['users']['console'] }}"
       ansible.builtin.shell: |
         /usr/bin/kopia repository connect server \
         --url=https://{{ services['kopia']['domain'] }}.{{ domain['internal'] }}:{{ services['kopia']['ports']['https'] }} \

ansible/roles/common/tasks/services/set_podman.yaml

@@ -11,7 +11,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0700"
 
@@ -19,7 +19,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/data/containers"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   when: node['name'] == "app"
@@ -28,7 +28,7 @@
   ansible.builtin.file:
     path: "{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0700"
   loop:

ansible/roles/console/tasks/node/create_vmm_init.yaml

@@ -0,0 +1,90 @@
+---
+- name: Create vmm_init directory
+  ansible.builtin.file:
+    path: "{{ node['data_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0750"
+  loop:
+    - "vmm_init"
+    - "vmm_init/grub.d"
+    - "vmm_init/modprobe.d"
+    - "vmm_init/networkd"
+    - "vmm_init/ssh"
+    - "vmm_init/ssh/sshd_config.d"
+    - "vmm_init/sysctl.d"
+
+- name: Create nftables.conf
+  ansible.builtin.template:
+    src: "{{ node['config_path'] }}/node/vmm/nftables.conf.j2"
+    dest: "{{ node['data_path'] }}/vmm_init/nftables.conf"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create grub.d iommu config
+  ansible.builtin.copy:
+    content: |
+      GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt"
+    dest: "{{ node['data_path'] }}/vmm_init/grub.d/iommu.cfg"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create modprobe.d vfio config
+  ansible.builtin.copy:
+    content: |
+      options vfio-pci ids={{ hostvars['vmm']['hardware']['igpu']['id'] }}
+      softdep i915 pre: vfio-pci
+      # softdep ahci pre: vfio-pci # sata controller
+    dest: "{{ node['data_path'] }}/vmm_init/modprobe.d/vfio.conf"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create networkd network config
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "{{ node['data_path'] }}/vmm_init/networkd/{{ item | basename | replace('.j2', '') }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+  loop: "{{ query('fileglob', hostvars['console']['node']['config_path'] + '/node/vmm/networkd/*') | sort }}"
+
+- name: Create ssh CA
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ssh']['ca']['pub'] }}
+    dest: "{{ node['data_path'] }}/vmm_init/ssh/local_ssh_ca.pub"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create ssh config
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "{{ node['data_path'] }}/vmm_init/ssh/sshd_config.d/{{ item.name }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+  loop:
+    - name: "prohibit_root.conf"
+      value: |
+        PermitRootLogin no
+    - name: "ssh_ca.conf"
+      value: |
+        TrustedUserCAKeys /etc/ssh/local_ssh_ca.pub
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Create sysctl.d bridge config
+  ansible.builtin.copy:
+    content: |
+      net.bridge.bridge-nf-call-ip6tables = 0
+      net.bridge.bridge-nf-call-iptables = 0
+      net.bridge.bridge-nf-call-arptables = 0
+    dest: "{{ node['data_path'] }}/vmm_init/sysctl.d/bridge.conf"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"

ansible/roles/console/tasks/node/load_secret_vars.yaml

@@ -22,7 +22,7 @@
   run_once: true
   no_log: true
 
-- name: Load decrypted secret vaules in console
+- name: Load decrypted secret values in console
   ansible.builtin.set_fact:
     "{{ item.key }}": "{{ item.value }}"
   loop: "{{ decrypted_secrets.stdout | from_yaml | dict2items }}"

ansible/roles/console/tasks/node/set_ssh_client.yaml

@@ -66,8 +66,8 @@
         content: |
           {{ hostvars['console']['ssh']['ca']['key'] }}
         dest: "/run/user/{{ node['uid'] }}/local_ssh_ca_private_key"
-        owner: "console"
-        group: "svadmins"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
         mode: "0400"
       no_log: true
     - name: Sign on ssh console key (pub file)
@@ -91,7 +91,7 @@
     path: "{{ node['home_path'] }}/.ssh"
     state: "directory"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0700"
 
 - name: Create ssh config file
@@ -105,5 +105,5 @@
       {% endfor %}
     dest: "{{ node['home_path'] }}/.ssh/config"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"

ansible/roles/console/tasks/services/set_cli_tools.yaml

@@ -31,7 +31,7 @@
       sops_{{ version['packages']['sops'] }}_{{ item }}.deb"
     dest: "{{ node['data_path'] }}/bin/sops-{{ version['packages']['sops'] }}-{{ item }}.deb"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   loop:
     - "amd64"
@@ -43,7 +43,7 @@
       step-cli_{{ version['packages']['step'] }}-1_{{ item }}.deb"
     dest: "{{ node['data_path'] }}/bin/step-{{ version['packages']['step'] }}-{{ item }}.deb"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   loop:
     - "amd64"

ansible/roles/fw/handlers/main.yaml

@@ -44,7 +44,7 @@
   ansible.builtin.systemd:
     name: "blocky.service"
     state: "restarted"
-    enabled: "true"
+    enabled: true
     daemon_reload: true
   become: true
   changed_when: false

ansible/roles/fw/tasks/services/set_bind.yaml

@@ -25,7 +25,7 @@
   become: true
   when: is_bind_installed.rc != 0
 
-- name: Deploy acem.key
+- name: Deploy acme.key
   ansible.builtin.copy:
     content: "{{ hostvars['console']['bind']['acme_key'] }}"
     dest: "/etc/bind/acme.key"

ansible/roles/fw/tasks/services/set_ddns.yaml

@@ -6,7 +6,7 @@
       API_KEY={{ hostvars['console']['ddns']['api_key'] }}
     dest: "/etc/secrets/{{ node['uid'] }}/ddns.env"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   become: true
   no_log: true
@@ -16,7 +16,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/ddns/ddns.sh"
     dest: "/usr/local/bin"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0711"
   become: true
 
@@ -25,7 +25,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/ddns/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
     validate: "/usr/bin/systemd-analyze verify %s"
   loop:

ansible/roles/fw/tasks/services/set_kea.yaml

@@ -26,7 +26,7 @@
   become: true
   notify: "notification_restart_kea4"
 
-- name: Create kea-dhcp-server.service.d
+- name: Create kea-dhcp4-server.service.d
   ansible.builtin.file:
     path: "/etc/systemd/system/kea-dhcp4-server.service.d"
     state: "directory"
@@ -35,7 +35,7 @@
     mode: "0755"
   become: true
 
-- name: Set kea-dhcp-server.service.d/override.conf
+- name: Set kea-dhcp4-server.service.d/override.conf
   ansible.builtin.copy:
     dest: "/etc/systemd/system/kea-dhcp4-server.service.d/override.conf"
     content: |

ansible/roles/infra/handlers/main.yaml

@@ -2,7 +2,7 @@
   ansible.builtin.systemd:
     name: "ca.service"
     state: "restarted"
-    enabled: "true"
+    enabled: true
     daemon_reload: true
     scope: "user"
   changed_when: false

ansible/roles/infra/tasks/services/set_ca_server.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -29,7 +29,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/ca/config/{{ item }}"
     owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   loop:
     - "ca.json"
@@ -43,7 +43,7 @@
       {{ item.value }}
     dest: "{{ item.path }}/{{ item.name }}"
     owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -67,7 +67,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/ca.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/ca.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_ca"
 

ansible/roles/infra/tasks/services/set_grafana.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -11,6 +11,7 @@
     - "grafana/data"
     - "grafana/etc"
     - "grafana/etc/provisioning"
+    - "grafana/etc/provisioning/datasources"
     - "grafana/etc/dashboards"
     - "grafana/ssl"
   become: true
@@ -21,7 +22,7 @@
       {{ hostvars['console']['ca']['root']['crt'] }}
     dest: "{{ node['home_path'] }}/containers/grafana/ssl/{{ root_cert_filename }}"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   become: true
   notify: "notification_restart_grafana"
@@ -39,16 +40,16 @@
     - name: "LDAP_BIND_PASSWORD"
       value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
     - name: "GF_ADMIN_PASSWORD"
-      value: "{{ hostvars['console']['grafana']['user']['password'] }}"
+      value: "{{ hostvars['console']['grafana']['admin']['password'] }}"
   notify: "notification_restart_grafana"
   no_log: true
 
-- name: Deploy configruation files
+- name: Deploy configuration files
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/grafana/etc/{{ item }}"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   loop:
     - "grafana.ini"
@@ -62,7 +63,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/provisioning/datasources/datasources.yaml.j2"
     dest: "{{ node['home_path'] }}/containers/grafana/etc/provisioning/datasources/datasources.yaml"
     owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0400"
   become: true
   notify: "notification_restart_grafana"
@@ -72,7 +73,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/grafana.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/grafana.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_grafana"
 

ansible/roles/infra/tasks/services/set_ldap.yaml

@@ -3,7 +3,7 @@
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     owner: "{{ services['ldap']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     state: "directory"
     mode: "0770"
   loop:
@@ -18,7 +18,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/ldap/ssl/{{ item.name }}"
     owner: "{{ services['ldap']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -33,8 +33,8 @@
       value: "{{ hostvars['console']['ldap']['key'] }}"
       mode: "0400"
   become: true
-  notify: "notification_restart_ldap"
   no_log: true
+  notify: "notification_restart_ldap"
 
 - name: Register secret value to podman secret
   containers.podman.podman_secret:
@@ -51,14 +51,15 @@
       value: "{{ hostvars['console']['ldap']['seed_key'] }}"
     - name: "LLDAP_JWT_SECRET"
       value: "{{ hostvars['console']['ldap']['jwt_secret'] }}"
-  notify: "notification_restart_ldap"
   no_log: true
+  notify: "notification_restart_ldap"
 
 - name: Initiate ldap (When = false, If DB data does not exist in postgresql, activate this block)
 # The reason why this task doesn't use the way to check ".init" file is this tasks can override original database.
 # Absent of ".init" file cannot guarantee DB is empty.
   when: false
   become: true
+  no_log: true
   block:
     - name: Register extra secret value to podman secret
       containers.podman.podman_secret:
@@ -97,7 +98,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ldap/ldap.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/ldap.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_ldap"
 

ansible/roles/infra/tasks/services/set_loki.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "loki"
@@ -18,7 +18,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/loki.yaml.j2"
     dest: "{{ node['home_path'] }}/containers/loki/etc/loki.yaml"
     owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   become: true
   notify: "notification_restart_loki"
@@ -30,7 +30,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/loki/ssl/{{ item.name }}"
     owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -53,7 +53,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/loki.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/loki.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_loki"
 

ansible/roles/infra/tasks/services/set_postgresql.yaml

@@ -3,33 +3,33 @@
   ansible.builtin.set_fact:
     connected_services:
       - "ldap"
-      - "authelia"
       - "grafana"
+      - "authelia"
       - "vaultwarden"
       - "gitea"
       - "immich"
       - "paperless"
-      - "affine"
       - "nextcloud"
       - "sure"
       - "outline"
       - "memos"
+      - "mealie"
 
 - name: Create postgresql directory
   ansible.builtin.file:
-    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    path: "{{ node['home_path'] }}/{{ item }}"
     state: "directory"
     owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
-    - "postgresql"
-    - "postgresql/data"
-    - "postgresql/config"
-    - "postgresql/ssl"
-    - "postgresql/init"
-    - "postgresql/backups"
-    - "postgresql/build"
+    - "data/containers/postgresql/backups"
+    - "containers/postgresql"
+    - "containers/postgresql/data"
+    - "containers/postgresql/config"
+    - "containers/postgresql/ssl"
+    - "containers/postgresql/init"
+    - "containers/postgresql/build"
   become: true
 
 - name: Deploy containerfile for build
@@ -37,7 +37,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/build/postgresql.containerfile.j2"
     dest: "{{ node['home_path'] }}/containers/postgresql/build/Containerfile"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0640"
 
 - name: Build postgresql container image
@@ -57,7 +57,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/config/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/postgresql/config/{{ item }}"
     owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   loop:
     - "postgresql.conf"
@@ -72,7 +72,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/postgresql/ssl/{{ item.name }}"
     owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -97,24 +97,26 @@
   register: "is_postgresql_init"
 
 - name: Prepare initiating DB
-  when: not is_postgresql_init.stat.exists
+  when:
+    - not is_postgresql_init.stat.exists
+    - (connected_services | default([]) | length) > 0
   become: true
   block:
     # `init/pg_cluster.sql` should be fetched from postgresql's backup directory before running initiating
     - name: Deploy init cluster sql file
       ansible.builtin.copy:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_cluster.sql"
-        dest: "{{ node['home_path'] }}/containers/postgresql/init/0_pg_cluster.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/00_pg_cluster.sql"
         owner: "{{ services['postgresql']['subuid'] }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
         mode: "0600"
 
     - name: Deploy restoring data sql files
       ansible.builtin.copy:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_{{ item }}.sql"
-        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ index_num + 1 }}_pg_{{ item }}.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ '%02d' | format(index_num + 1) }}_pg_{{ item }}.sql"
         owner: "{{ services['postgresql']['subuid'] }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
         mode: "0600"
       loop: "{{ connected_services }}"
       loop_control:
@@ -126,14 +128,14 @@
         state: "touch"
         mode: "0644"
         owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
 
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/postgresql.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/postgresql.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_postgresql"
 
@@ -142,7 +144,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/services/{{ item }}"
     dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   loop:
     - "postgresql-cluster-backup.service"

ansible/roles/infra/tasks/services/set_prometheus.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "prometheus"
@@ -18,7 +18,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/etc/{{ item }}.j2"
     dest: "{{ node['home_path'] }}/containers/prometheus/etc/{{ item }}"
     owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0600"
   loop:
     - "prometheus.yaml"
@@ -34,7 +34,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/prometheus/ssl/{{ item.name }}"
     owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "{{ item.mode }}"
   loop:
     - name: "{{ root_cert_filename }}"
@@ -57,7 +57,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/prometheus.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/prometheus.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_prometheus"
 

ansible/roles/infra/tasks/services/set_x509-exporter.yaml

@@ -4,7 +4,7 @@
     path: "{{ node['home_path'] }}/containers/{{ item }}"
     state: "directory"
     owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0770"
   loop:
     - "x509-exporter"
@@ -17,7 +17,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/config/config.yaml"
     dest: "{{ node['home_path'] }}/containers/x509-exporter/config/config.yaml"
     owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   become: true
   notify: "notification_restart_x509-exporter"
@@ -28,7 +28,7 @@
       {{ item.value }}
     dest: "{{ node['home_path'] }}/containers/x509-exporter/certs/{{ item.name }}"
     owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0440"
   loop:
     - name: "root.crt"
@@ -57,7 +57,7 @@
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/x509-exporter.container.j2"
     dest: "{{ node['home_path'] }}/.config/containers/systemd/x509-exporter.container"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   notify: "notification_restart_x509-exporter"
 

ansible/roles/vmm/tasks/node/set_libvirt.yaml

@@ -9,15 +9,16 @@
 
 - name: Check libvirt directory
   ansible.builtin.stat:
-    path: "/var/lib/libvirt/{{ item }}"
+    path: "{{ node['libvirt_path'] }}/{{ item }}"
   loop:
     - "images"
     - "seeds"
+    - "data"
   register: "is_libvirt_dir"
 
 - name: Create libvirt directory
   ansible.builtin.file:
-    path: "/var/lib/libvirt/{{ item.item }}"
+    path: "{{ node['libvirt_path'] }}/{{ item.item }}"
     state: "directory"
     owner: "root"
     group: "root"
@@ -72,6 +73,7 @@
   loop:
     - "images-pool"
     - "seeds-pool"
+    - "data-pool"
 
 - name: Start virtual storage pool
   community.libvirt.virt_pool:
@@ -81,6 +83,7 @@
   loop:
     - "images-pool"
     - "seeds-pool"
+    - "data-pool"
 
 - name: Autostart virtual storage pool
   community.libvirt.virt_pool:
@@ -90,3 +93,4 @@
   loop:
     - "images-pool"
     - "seeds-pool"
+    - "data-pool"

ansible/roles/vmm/tasks/node/set_raid.yaml

@@ -18,16 +18,17 @@
 - name: Set hard disk path
   ansible.builtin.shell: |
     set -o pipefail
-    ls -1 /dev/disk/by-path/*{{ vm['pass_through']['sata_controller']['address'] }}* | \
-    grep -v '\.0$' | \
+    ls -1 /dev/disk/by-id/ata-* | \
+    grep -F -e "{{ hardware['hdd']['data'].values() | join('" -e "') }}" | \
+    grep -vE -- '-part[0-9]+$' | \
     sort
   changed_when: false
   register: "hdd_path_list"
 
-- name: Check app_hdd filesystem already exists
+- name: Check vmm_hdd filesystem already exists
   ansible.builtin.command: |
-    blkid -L {{ storage['btrfs']['label'] }}
-  register: is_app_data
+    blkid -L {{ hardware['btrfs']['label'] }}
+  register: is_vmm_data
   changed_when: false
   failed_when: false
   become: true
@@ -40,38 +41,47 @@
 - name: Set btrfs raid10 volume
   ansible.builtin.shell: |
     mkfs.btrfs -f \
-    -L {{ storage['btrfs']['label'] }} \
-    -d {{ storage['btrfs']['level'] }} \
-    -m {{ storage['btrfs']['level'] }} \
+    -L {{ hardware['btrfs']['label'] }} \
+    -d {{ hardware['btrfs']['level'] }} \
+    -m {{ hardware['btrfs']['level'] }} \
     {{ hdd_path_list.stdout_lines | join(' ') }}
   become: true
   when:
-    - is_app_data.rc != 0
+    - is_vmm_data.rc != 0
     - (hdd_path_list.stdout_lines | length) >= 4
   changed_when: is_mkfs.rc == 0
   register: "is_mkfs"
 
-- name: Mount btrfs raid10 volume
-  ansible.posix.mount:
-    path: "{{ storage['btrfs']['mount_point'] }}"
-    src: "LABEL={{ storage['btrfs']['label'] }}"
-    state: "mounted"
-    fstype: "btrfs"
-    opts: "defaults,noatime,compress=zstd:3,autodefrag,degraded,nofail"
+- name: Create mount volume
+  ansible.builtin.file:
+    path: "{{ hardware['btrfs']['mount_point'] }}"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0711"
   become: true
 
-- name: Set hard disk path permissions
+- name: Mount btrfs raid10 volume
+  ansible.posix.mount:
+    path: "{{ hardware['btrfs']['mount_point'] }}"
+    src: "LABEL={{ hardware['btrfs']['label'] }}"
+    state: "mounted"
+    fstype: "btrfs"
+    opts: "defaults,noatime,nodatacow,degraded,nofail"
+  become: true
+
+- name: Set mounted btrfs volume permissions
   ansible.builtin.file:
-    path: "{{ storage['btrfs']['mount_point'] }}"
+    path: "{{ hardware['btrfs']['mount_point'] }}"
     state: "directory"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0770"
+    owner: "root"
+    group: "root"
+    mode: "0711"
   become: true
 
 - name: Deploy btrfs scrub service and timer
   ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/app/btrfs/{{ item }}.j2"
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/vmm/btrfs/{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
     owner: "root"
     group: "root"

ansible/roles/vmm/tasks/vm/create_seed.yaml

@@ -1,13 +1,13 @@
 ---
 # This task is located in vmm roles because of its attributes,
 # but all process should be run in "console".
-# At the playbook, `delegate_to: "console"` option is applyed by `apply:`.
+# At the playbook, `delegate_to: "console"` option is applied by `apply:`.
 - name: Create images directory
   ansible.builtin.file:
     path: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}"
     state: "directory"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
     mode: "0700"
 
 - name: Create temp meta-data
@@ -16,8 +16,8 @@
       instance-id: vm-{{ target_vm }}
       local-hostname: {{ target_vm }}
     dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/meta-data"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
     mode: "0600"
   register: "vm_meta_data"
   no_log: true
@@ -26,8 +26,8 @@
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/vmm/libvirt/seeds/user-data.j2"
     dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/user-data"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
     mode: "0600"
   register: "vm_user_data"
   no_log: true
@@ -37,8 +37,8 @@
     content: |
       network: {config: disabled}
     dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/network-config"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
     mode: "0600"
   register: "vm_network_config"
   no_log: true

ansible/roles/vmm/tasks/vm/deploy_vm_init.yaml

@@ -1,16 +1,16 @@
 ---
 - name: Check vm cloud-init
   ansible.builtin.stat:
-    path: "/var/lib/libvirt/images/debian-13.qcow2"
+    path: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
   become: true
   register: is_cloud_init_file
 
 - name: Deploy vm cloud-init
   ansible.builtin.copy:
     src: "{{ hostvars['console']['node']['data_path'] }}/images/debian-13-generic-amd64.qcow2"
-    dest: "/var/lib/libvirt/images/debian-13.qcow2"
+    dest: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
     force: false
   become: true
@@ -18,10 +18,10 @@
 
 - name: Remote copy vm cloud-init file
   ansible.builtin.copy:
-    src: "/var/lib/libvirt/images/debian-13.qcow2"
-    dest: "/var/lib/libvirt/images/{{ target_vm }}.qcow2"
+    src: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
+    dest: "{{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
     remote_src: true
     force: false
@@ -29,7 +29,7 @@
 
 - name: Check deployed cloud-init file info
   ansible.builtin.command:
-    cmd: "qemu-img info /var/lib/libvirt/images/{{ target_vm }}.qcow2 --output json"
+    cmd: "qemu-img info {{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2 --output json"
   changed_when: false
   failed_when:
     - deployed_cloudfile_info.rc != 0
@@ -38,18 +38,37 @@
 
 - name: Resize deployed cloud-init file
   ansible.builtin.command:
-    cmd: "qemu-img resize /var/lib/libvirt/images/{{ target_vm }}.qcow2 {{ hostvars[target_vm]['vm']['storage'] }}G"
+    cmd: "qemu-img resize {{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2 {{ hostvars[target_vm]['vm']['storage'] }}G"
   when:
     - deployed_cloudfile_info.rc == 0
     - (deployed_cloudfile_info.stdout | from_json)['virtual-size'] < (hostvars[target_vm]['vm']['storage'] | int * 1024 * 1024 * 1024)
   changed_when: true
 
+- name: Check app data raw image
+  ansible.builtin.stat:
+    path: "{{ hardware['btrfs']['mount_point'] }}/{{ target_vm }}.raw"
+    get_checksum: false
+    get_mime: false
+    get_attributes: false
+  when: target_vm == "app"
+  register: "is_app_data"
+
+- name: Create app data raw image
+  ansible.builtin.command:
+    # 3.5T
+    cmd: "qemu-img create -f raw {{ hardware['btrfs']['mount_point'] }}/{{ target_vm }}.raw {{ hostvars[target_vm]['vm']['data_storage']['size'] }}T"
+  become: true
+  when:
+    - target_vm == "app"
+    - not is_app_data.stat.exists
+  changed_when: true
+
 - name: Deploy vm seed.iso
   ansible.builtin.copy:
     src: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/seed.iso"
-    dest: "/var/lib/libvirt/seeds/{{ target_vm }}_seed.iso"
+    dest: "{{ node['libvirt_path'] }}/seeds/{{ target_vm }}_seed.iso"
     owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
     mode: "0644"
   become: true
   when: deployed_cloudfile_info.rc == 0

config/node/common/hosts.j2

@@ -16,6 +16,9 @@
 {{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }}
+# kopia repository
+{{ hostvars['fw']['network4']['nas']['client'] }} nas.{{ domain['internal'] }}
+{{ hostvars['fw']['network6']['nas']['client'] }} nas.{{ domain['internal'] }}
 {% else %}
 # IPv4
 # Crowdsec, blocky, bind(fw)

config/node/fw/nftables.conf.j2

@@ -114,7 +114,7 @@ table inet filter {
                 iifname "lo" accept comment "allow local connection: FW > FW"
                 udp dport $PORTS_VPN accept comment "allow vpn connection: > FW"
                 iifname { $IF_CLIENT, $IF_SERVER, $IF_USER, $IF_WG } meta l4proto { icmp, icmpv6 } accept comment "allow icmp, icmpv6 connection: CLIENT/SERVER/USER/WG > FW"
-                iifname { $IF_CLIENT, $IF_SERVER, $IF_USER, $IF_WG } udp dport $PORTS_NTP accept comment "allow ntp connection: CLIENT/SERVER/USER/WG > FW"
+                iifname { $IF_CLIENT, $IF_SERVER, $IF_WG } udp dport $PORTS_NTP accept comment "allow ntp connection: CLIENT/SERVER/USER/WG > FW"
                 # Global chain contains "WAN !> :SSH_PORT"
                 ip saddr $HOSTS4_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv4 ssh connection: CONSOLE > FW"
                 ip6 saddr $HOSTS6_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv6 ssh connection: CONSOLE > FW"

config/node/vmm/networkd/00-vmm-eth0.link

@@ -1,5 +0,0 @@
-[Match]
-MACAddress=c8:ff:bf:05:aa:b0
-
-[Link]
-Name=eth0

config/node/vmm/networkd/00-vmm-eth0.link.j2

@@ -0,0 +1,5 @@
+[Match]
+MACAddress={{ hostvars['vmm']['hardware']['mac']['nic0'] }}
+
+[Link]
+Name=eth0

config/node/vmm/networkd/01-vmm-eth1.link

@@ -1,5 +0,0 @@
-[Match]
-MACAddress=c8:ff:bf:05:aa:b1
-
-[Link]
-Name=eth1

config/node/vmm/networkd/01-vmm-eth1.link.j2

@@ -0,0 +1,5 @@
+[Match]
+MACAddress={{ hostvars['vmm']['hardware']['mac']['nic1'] }}
+
+[Link]
+Name=eth1

config/node/vmm/networkd/24-vmm-vlan1.network

@@ -1,28 +0,0 @@
-[Match]
-Name=vlan1
-
-[Network]
-# IPv4
-Address=192.168.1.10/24
-# IPv6
-Address=fd00:1::10/64
-
-[RoutingPolicyRule]
-From=192.168.1.10/32
-Table=1
-Priority=100
-
-[Route]
-Destination=192.168.1.0/24
-Scope=link
-Table=1
-
-[RoutingPolicyRule]
-From=fd00:1::10/128
-Table=61
-Priority=100
-
-[Route]
-Destination=fd00:1::/64
-Scope=link
-Table=61

config/node/vmm/networkd/24-vmm-vlan1.network.j2

@@ -0,0 +1,28 @@
+[Match]
+Name=vlan1
+
+[Network]
+# IPv4
+Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24
+# IPv6
+Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network4']['vmm']['client'] }}/32
+Table=1
+Priority=100
+
+[Route]
+Destination={{ hostvars['fw']['network4']['subnet']['client'] }}
+Scope=link
+Table=1
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network6']['vmm']['client'] }}/128
+Table=61
+Priority=100
+
+[Route]
+Destination={{ hostvars['fw']['network6']['subnet']['client'] }}
+Scope=link
+Table=61

config/node/vmm/networkd/25-vmm-vlan10.network

@@ -1,32 +0,0 @@
-[Match]
-Name=vlan10
-[Network]
-RequiredForOnline=false
-# IPv4
-Address=192.168.10.10/24
-Gateway=192.168.10.1
-DNS=192.168.10.2
-# IPv6
-Address=fd00:10::10/64
-Gateway=fd00:10::1
-DNS=fd00:10::2
-
-[RoutingPolicyRule]
-From=192.168.10.10/32
-Table=2
-Priority=100
-
-[Route]
-Destination=0.0.0.0/0
-Gateway=192.168.10.1
-Table=2
-
-[RoutingPolicyRule]
-From=fd00:10::10/128
-Table=62
-Priority=100
-
-[Route]
-Destination=::/0
-Gateway=fd00:10::1
-Table=62

config/node/vmm/networkd/25-vmm-vlan10.network.j2

@@ -0,0 +1,32 @@
+[Match]
+Name=vlan10
+[Network]
+RequiredForOnline=false
+# IPv4
+Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24
+Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
+DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
+# IPv6
+Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64
+Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
+DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network4']['vmm']['server'] }}/32
+Table=2
+Priority=100
+
+[Route]
+Destination=0.0.0.0/0
+Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
+Table=2
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network6']['vmm']['server'] }}/128
+Table=62
+Priority=100
+
+[Route]
+Destination=::/0
+Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
+Table=62

config/secrets/edit_secret.sh

@@ -3,7 +3,7 @@
 
 set -e
 
-# Varibles
+# Variables
 KEY_PATH="$HOME/workspace/homelab/config/secrets"
 TMP_PATH="/run/user/$UID"
 SECRET_FILE="$1"
@@ -72,7 +72,7 @@ echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
 --decrypt "$KEY_PATH/age-key.gpg" &&\
 chmod 600 "$TMP_PATH/age-key"
 
-# Unset environment varibles
+# Unset environment Variables
 unset GPG_PASSPHRASE
 
 # Check the key on memory

config/secrets/secrets.yaml

@@ -59,10 +59,10 @@ wireguard:
 #ENC[AES256_GCM,data:+kiy17Z7q3EiPgo4Ykk=,iv:vOi54XHHLNIO9U0ybpU9Cn68Ymj5W4vtQ2OhTkGAmRo=,tag:h3wdCo5UfNGlHqMpeeBf/A==,type:comment]
 kopia:
     repository: ENC[AES256_GCM,data:16V50bVVtecbF+TJcXHCx46ZPGNMgAhUOA0YbZHVTsCrOWQvTvcK2k8Iq3E=,iv:/wNbrE5GaFiQPNEp8wZ0JehbXkmah/gPm5ywNE6WVVM=,tag:vW82KTKtJ44++tqXON/SYw==,type:str]
-    user:
-        console: ENC[AES256_GCM,data:LZQEz7JS8CMMSlGB2/FS15VHAbko6YpCaWDZDa9tXVnmYLwFs8F39/u8kLI=,iv:WrYox/3LweqafWl96fxmezTFhKHB/2XSDSLwHljdpw0=,tag:bPwqkdeexXItkbpPQQ6klg==,type:str]
-        infra: ENC[AES256_GCM,data:fwvu96Zhao5RthZptxhuv2NobY1riQzpvD4Ardc8UTwN6+HyfFVR31yTTqk=,iv:jqFEKsP2npZgeRL3E3Va7oLzbHShBO4FxLRYwnfLtys=,tag:qXescWki6oPaaSrhMsUw9g==,type:str]
-        app: ENC[AES256_GCM,data:VVs8lfo8ZsbYfeKIwtaFCrpV82SguR/xxNnMZXXp8YOBP+6F2Vs5jeDtTTs=,iv:L2mS2RhiUlB9Oq4gwVs8WNF4r8vYv6zg6Fqnpe9hSoM=,tag:WYjtPdD2Lny9Kc+dWVupjw==,type:str]
+    users:
+        console: ENC[AES256_GCM,data:v1QY7h6vMmzYq/PTmnLg3M5Iwc/Ljr/1M3nJGuUJMfPN2ATY+GIMUyhYu+0=,iv:32c4YrZfTiu7sv/c9tDItmAE8G1lvc1sm6JD1GRkYr0=,tag:kj1a32+bMUsRdusadoXDvg==,type:str]
+        infra: ENC[AES256_GCM,data:WdugcvTJEy3/kxjCMeN16u96XM+59sOBF/z88p9f0lPVzi78ZmIZPjf835M=,iv:6G4rry8fCjhB+MF5B3TVf1w0LDSA6farVwyxAp8nKQE=,tag:+mCSrVmo7zuj782swmRFPw==,type:str]
+        app: ENC[AES256_GCM,data:5A17rXYUBPkFRpcHTOBCGmm9j6uMHtvKkLTpHsYZeRJkoSrA4k9IhVpjNA0=,iv:kJzowaheVckLUKae6xXeIVi+Jc+Mhee/jjmS91im9dc=,tag:f1uXU6JRD4mxAYMlFTWoew==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -117,11 +117,11 @@ postgresql:
         gitea: ENC[AES256_GCM,data:l+pBCzyQa3000SE9z1R4htD0V0ONsBtKy92dfgsVYsZ3XlEyVJDIBOsugwM=,iv:5t/oHW1vFAmV/s2Ze/cV9Vuqo96Qu6QvZeRbio7VX2s=,tag:4zeQaXiXIzBpy+tXsxmN7Q==,type:str]
         immich: ENC[AES256_GCM,data:11jvxTKA/RL0DGL6y2/X092hnDohj6yTrYGK4IVojqBd1gCOBnDvUjgmx14=,iv:oBfHxsx9nxhyKY/WOuWfybxEX2bf+lHEtsaifFRS9lg=,tag:tAfkBdgQ8ZEkLIFcDICKDw==,type:str]
         paperless: ENC[AES256_GCM,data:6VBrBbjVoam7SkZCSvoBTdrfkUoDghdGTiBmFLul04X/okXOHeC5zusJffY=,iv:iZumcJ3TWwZD77FzYx8THwCqC+EbnXUBrEKuPh3zgV8=,tag:u2m8SppAdxZ/duNdpuS3oQ==,type:str]
-        affine: ENC[AES256_GCM,data:XPXrcszsV06YqCJZ7CDqc4rCwqqNlbtLCFYfLAQ8jamLtft8L2UVrMA4WZo=,iv:vrWdBeckxB9tmEE628j4jhU+hSpE6TXYMGt0hh1Cg84=,tag:hlWwWUGht8NqWTZREMsa1Q==,type:str]
         nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
         sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
         outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str]
         memos: ENC[AES256_GCM,data:BaNTnZFZH4oMTnDkgrf2/fMTkO43rc9bSsgnDWrHJ/Z6+MZdMitpIMkrMN4=,iv:JsG3B0YweZYO96MW9NmoSsIG++gFq+jRUsozwJtWl3M=,tag:orLTUiW0inOJdD4YSp4baQ==,type:str]
+        mealie: ENC[AES256_GCM,data:XbYHQv6HBWCXUBRmcbQZN5Y1Gw+V+Wra28Mp+m+ZGl8VRXsKMu5507vGHQM=,iv:zp4ZarqG9KshiBV8F8UksfI2QXmXHwqPw631r/5bYy8=,tag:jvsvXrUsCvpQGIbLV9jTYQ==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -139,8 +139,9 @@ ldap:
         user: ENC[AES256_GCM,data:DT9h51o6z70A4QeoKvCbUo98JFxILgB5tkHeX60CZuCl0GHTa//mRpIUEvo=,iv:Pa9iqXeKDHHBz524zeRImYEkXmY50s7Z+Z4KYt3sNT4=,tag:UTS5VIqbRA66UVDrDXwuPQ==,type:str]
         authelia: ENC[AES256_GCM,data:G8ZGsLKqEmMzQ5NMAgirF5BQraHNqixtI6dyyaeNhTdXebjJZML52xL36p4=,iv:ZtHAsFYmrQxr+qoQLPW/eme0+nsT148KRsXmW/LNLlU=,tag:Pvjs/eylkgxJpmGBsRmjcw==,type:str]
         grafana: ENC[AES256_GCM,data:vWmU3ZKcolETWAY74C3OMD8gMXDeYk+DqssACL0xefIPi5IkbrhYWmnWAnA=,iv:wcRms3Zp8kPM4USRPVa0UHpCTK36SWhK9C8yHSWu2Cs=,tag:gU5S/6fdMZVd/ih3Yd5uJA==,type:str]
-        il: ENC[AES256_GCM,data:/CyMeo1+rIUAYiB25nI0,iv:jsyiiRN5z9GqcUnTZ0CZo4s+umTc2zeY2FPp+tVOC9o=,tag:cwOHcqMysCxX57w3a+Pzpg==,type:str]
-        morsalin: ENC[AES256_GCM,data:YryNch8hF6rx,iv:bNIBur3Jcib8BvKjJ0MejpemsurYTP8rCxo6b2R5yEo=,tag:9dIIgqEPtbeixtgJ1OtMnQ==,type:str]
+    users:
+        il: ENC[AES256_GCM,data:9b9OU4Nt60/XdUrwnhJh,iv:7ZqOYqM2aibgcFRxw1ZvOdBJMZUfOVbNa+2sMzrXAns=,tag:x87IG/HETASiC9/HwyW1Ig==,type:str]
+        morsalin: ENC[AES256_GCM,data:rERjBNLZXSKT,iv:VuD8ZGfrd0wQ/5TCgLhLN459ZHPepcZyv8Kdl7TsMc4=,tag:Xp/fjve1xn0Wjk7ExShCLw==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -160,9 +161,9 @@ loki:
 #
 #ENC[AES256_GCM,data:yHgd8KBDPYeMjKzUOimdOA==,iv:ozyRymtPEII2luBads2GHyLf4Vdhf4EXNaF82SNmQm4=,tag:1mOJAmR5kVRBjm0SbQkqlw==,type:comment]
 grafana:
-    user:
-        id: ENC[AES256_GCM,data:32LNqOb8pzi0/18=,iv:YJrYaQRE+veDhaEUefGWLbNJo1toHGmEOpqrNV3IDfg=,tag:ENryvH9ec3EbDhBB2bdHug==,type:str]
-        password: ENC[AES256_GCM,data:MFw7TAvzpL0EW2o+w6hF5qrLYVkn0HsQOXqBk9AQq7GxK4uAEDCi/YL3goI=,iv:HSpJL2CZKXHQYhOJLy6HzWARootl8Y1yMGhaMT0XRfM=,tag:t0VHDYHCZJwDcR1VcRFdCw==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:qwz/L8jQXvZKlic=,iv:s0PL4GwTvr/SfzuFgZESADnepagt+QKwt8XmqsMLr0c=,tag:2ozh3jpPFuqXJAx/DpgF6A==,type:str]
+        password: ENC[AES256_GCM,data:BDTWzGBsyr6dw3tQSCn5tFDk0IZxNc/Y6LYX6ytn1EpLhBr2CW3YE5Dsk7g=,iv:cbYmvG3EZO5ytYtoIAKpewdE81NMqP4YXrdsj7n87SA=,tag:wuFamPPldQYJAKeX7zLFnA==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -184,18 +185,25 @@ vaultwarden:
     admin:
         password: ENC[AES256_GCM,data:FzD80H5lPNyjTRGd/IcIGir35KLF8gN3qmTzEQrlfutHh08mk0Vh9X8irHA=,iv:cfn5432g2MvkuBJLB2zDJmU0sLgMefVvpy0bP/4/oPY=,tag:7MHEv8XswdQZNTARvxs55g==,type:str]
         hash: ENC[AES256_GCM,data:Ae7bhnL5pxfNV3+r/PCDIpxx0tHcNiB/s4sm7OoxVpp+tcEpXZ9vsv38sZjx+Z8t2vlmiYHc72PEdapcAihleuLMBPM1dAVn8LqzzWtVhfmCOoUZI8Z5L3VL8eyyz6npiw==,iv:c2MEIbrnVsR+bUx3zLLTnKSElFTH7JRl23HmmTlWEBg=,tag:mnMrER9pQEKAdloYMeRa3g==,type:str]
+    users:
         il:
-        password: ENC[AES256_GCM,data:mhLb55ENatpE59Rbzk2Uq6iBKc0Jj/9x4fOANJOHR0WvSxTQRKJ94cCq9Ykp/chWbdgYYPrwU5oD0Yo17zqb,iv:6bzKq5WaKhuOsQ8zSSH9ZrQYbDPB1nv/bFoQou1ycL4=,tag:bSmuUodl+/9nzxZ7YBoezA==,type:str]
+            id: ENC[AES256_GCM,data:V4kWLbzhIM7ONCt7PtxB56oilw==,iv:b9mkOmmOmyvlYI11ASRh4GQl3NxnvtoC9jAx5DuRSwM=,tag:Eo5a5UnvGVXY1jofbMgqQQ==,type:str]
+            password: ENC[AES256_GCM,data:Ay0aPgrP75z3n/xyELAPhi4Ov4a62M3lhtpByDkc++TGq+a2bmpdt0OhBfsCSjY/6ads1EUhqQYscTE86Eln,iv://EEyABWzFn9kiKxjz92zKbzUtbnAPf9oNxf9s0nlLo=,tag:cZpqyTXJuO2yQByHMTWwtA==,type:str]
         morsalin:
-        password: ENC[AES256_GCM,data:ibg5/MfLH7pSY2pEmjM=,iv:+aV5muP/9BYoKwTGQxKEL+IGY9P+O3GVKGgSuTzT+U0=,tag:rgqcmJvd1RtvWJ91PCxYIg==,type:str]
+            id: ENC[AES256_GCM,data:fXTVMR2iUa1lfyLjG3UI1Xuys80ylFEQ+A==,iv:KqRhjFULUc9BjGEepBu9I3aZparaxRhLos8Ztz3jPyE=,tag:1E8DgiXt810B7UYZLE+0yw==,type:str]
+            password: ENC[AES256_GCM,data:e8H0wYtCbVEDDXctbJQ=,iv:Bewk1rEsDPD5NVzZfEM2QfzNttwklI6KL7kFgFU3qvY=,tag:0U8Vg39ZD05AWMp6hQkkzA==,type:str]
+        eunkyoung:
+            id: ENC[AES256_GCM,data:OubNz5ueQU/KksljCvS/X29rhDjvipkgzik=,iv:mULicCrst9ciC7lAJrYIPV8Kx4Z/JAEbupO/Kti5DoA=,tag:0U/WQnZ8ZCL5yfkbd7Y6oA==,type:str]
+            password: ENC[AES256_GCM,data:M3MqxQTZdd+SS/nd,iv:KEBZ8eBAwVm0mTwDf3bJRWwtUN/M+an6BMV9N34pXq4=,tag:Qxxca3kq5NH6YbJWK002Gg==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
 #ENC[AES256_GCM,data:HAN9BBEl1CW11LAf3x8=,iv:hwqCErtmPqGJ+y86D9MoxJwixvbcJONlyT900Y5DOug=,tag:kCxsG353ltbOCKLe85adCg==,type:comment]
 gitea:
-    il:
-        password: ENC[AES256_GCM,data:Bs5/t5mNbSv5+ek9gNHZp5qqxitM4Kq0Xgh2JV6LiFw9lZJSOVT4JPLRP5M=,iv:z50+naWOTVL8lEgBgm51j6hLjS8ve2UcRRKukvtykM0=,tag:TF9rPxjoLe/vAyvl23PiCg==,type:str]
-        token: ENC[AES256_GCM,data:CiYEXEKLLRDp++iga5YmhyPB2bSvqhhDgSOhmiulp9n9SsBVQ3s5MQ==,iv:+oetgEH/IORz74Xoz5zgDjD3BLyledZTqlYlCWaDrRk=,tag:S9O09YEMuSexuNW3ojEw5Q==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:PtE=,iv:44l071j9ZLt3T2BbpAho70soiHxzBqp4KeITxrjdem8=,tag:yQt8jyEadk/GnrxnCPVKdA==,type:str]
+        password: ENC[AES256_GCM,data:EazzQF9D/s5TtYKBApzLQT3S7a0itGm7wGtHRMi6J0C3I/gBNhpgeF6dk8k=,iv:SGSiAlqOO7LvTlyVmOHU13Vq7OANo3eAeBCwioFpi3Y=,tag:4Vz8FRHEv9G+at/zZq4YMg==,type:str]
+        token: ENC[AES256_GCM,data:z12Oq4OFCCjCXn85cVSfSzxWt7b0ytuA6TAn3Xf5CIhvKuoQD43WnA==,iv:BP8WDOAXkuA9fMjfLR7BTyTqjEbjSmwgSrJfqCutwmQ=,tag:s7ys3V+QnU/Nmkccm3rcDw==,type:str]
     oidc:
         secret: ENC[AES256_GCM,data:qjQosi83oaK47wX4VtDktDFlIU3FQgmDpwyiSgJNPDq2Dtc/QEKzdv5/ZpQ=,iv:aUJx5a6Wj7lhaD19aPiZWIE/MWKUgH0muxtTSkwfg8M=,tag:DttjXee7ntxRAbqbFq6qeQ==,type:str]
         hash: ENC[AES256_GCM,data:iVls8UzdP6JTfRosET6nsk3RcEtFQ8ak6GtPuBjcqAv3lyA9oSLwvvC8MvGaT1aHCB+5y/lspuloHEaAcVGNuzGCIVLg9Adut4a7LYDTHNOZnJIKLj8ldL1ytD5XVdbeBhZGCqoTs088oO0HVCQiDzpJL5NdmM3Ru6egyYBCLLUOlPA=,iv:er63GEC+kxNDscvspvvLiq17VSg0GeZ2w3jmGojF9PM=,tag:F1pDpaQrVdomIlZ8psVpAw==,type:str]
@@ -204,8 +212,9 @@ gitea:
 #
 #ENC[AES256_GCM,data:HvMeGuC8JwK50pO1E/nm,iv:5NFTyjesMX0ZnBpH+hEv8jQ0G2NvrDtT23CUyLbQcUo=,tag:qWmPvQpADTeD+W8nWXRQvA==,type:comment]
 immich:
-    il:
-        password: ENC[AES256_GCM,data:PbDFc4m7rNPPN1mCjcvhbKwf/EbiJxdvO/iMspf9jMuCqQyGv7h6VrZqk98=,iv:hlMAp5wXXkFO9+ekq3A2/ioF/EX8Uau0puhb4TAHkRQ=,tag:pfS0W2JNaFNMpBlKgZ3Pjw==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:DclWIxkt7yZl/8EXSWpOKhVR8g==,iv:ekuWHM9tzQEGRj5Dz6txgh5H89dWVRojjICd7td3QSo=,tag:ZSBvlXtGrNn9T82Agn/vtg==,type:str]
+        password: ENC[AES256_GCM,data:AcaAeRVzeKCp9Hhx202DMuVTOmoPdXrUqpgwg6Nj/F7b9rCnQRwpsGGmuw0=,iv:z/PhfW75B08K+zbxBrEtBKFYWxTdRdgaicSYHe6yyJ0=,tag:8K+9QHjUF6lHhwnNDT9L8A==,type:str]
     oidc:
         secret: ENC[AES256_GCM,data:9ENcp2Ns21OLXDY05zRoSdP+93EiwSH8MGzZZpxK7sToe4QLUXWt9w6xQIE=,iv:Q/VcnArZHs/J2YLRVFXt3Mp+LYfuq4PD/trqO8Simig=,tag:BY/mOyZpYmoAc7NrASlmSA==,type:str]
         hash: ENC[AES256_GCM,data:mrML2CWFFtGjq8wfWipVpv+pjJRSHe74VGC7Eoa6588R5C/sCnC3W5aI+dsRCZN3LRCjHAkOJJgjeYrwcXYdKRauXsAYR51dNSsHqqSN3WebLxapRDwcYu5e4j5RN1aPHsysr7GaQ4hhe5rKW4ORCGC3Cp3Ob+LChPy4bdCAZG3bN9k=,iv:Q4hmqhq+dvIr7DxCpcqP4E0NKyFZkOeTnDpGctmCxXM=,tag:/gji6AFkHnYwkQf3FSQUxA==,type:str]
@@ -215,29 +224,20 @@ immich:
 #ENC[AES256_GCM,data:McPUAbIUvtC1gdPaxTgAxAMCMWcLfg==,iv:Tp6idRf7he3sYzo8LW596C905JAaoTIhIoDUzSyRT0k=,tag:4mZQ0Swu1X9uuwjsRNhr2A==,type:comment]
 paperless:
     session_secret: ENC[AES256_GCM,data:siwCs2noeVpg9DCEZybnmo/oz11BdrHSTnHciMOu/6g=,iv:XVjhu10TIujIdUopN9+TVVqRade9EvItDWxym6YXnZs=,tag:TxLYm+4Bo7IMaTQBtMg9pQ==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:9bJHf+chTg1rppgNVafNgEuvwQ69Gx+w5d65hu68q9XeeaVb2pO9HE4BOgg=,iv:1kaXBg/iOoIZxDjEVEdaMJLDtp6zQjep3vxLmIgQN5o=,tag:+MgX8Oa3tmhjx6u9aHkDfQ==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:8uo=,iv:f/qtpDb1Xe0M6Gd2VFP2vXULCd7WOn7TCxLlaK1dDbA=,tag:eNRMPJtLlA3Vjj79bSFxuA==,type:str]
+        password: ENC[AES256_GCM,data:TAA+TRTYRUSw47nE7oPDQmOtCBZpf2WyxUIIzftWq16wQhseODhH0R74X+Q=,iv:V0tzSvW5iYzEUgcxempmyD9ermVAqg673liiysT4jJ4=,tag:GuxtZ7EvgwvlFWwg+C6Jsg==,type:str]
     oidc:
         secret: ENC[AES256_GCM,data:wjRDVCJsINM4z5946a6uZD+6bhN5BChLMdRzgMEJFGRGFNcXd7A1p2Iqn4I=,iv:Y4QDA09L8ULKr4hhvoiduzCD8Hifo1gAnpzjCr8e520=,tag:R0RvGxYnXo3zwykXJykRug==,type:str]
         hash: ENC[AES256_GCM,data:pali6WwPNhJA+6QL4O+tKv42PnpGqmojb8JQUZLqxGizv1bJSCgdUN8upCy5Ke0DYZs5P+JY5vh23xfMZFnHduGxGwOuPX6J5lYgvJRV58LqS3/+yIBBprTJyro3MwsurTTEWesgKMr8/2H9lirhaLjWUOSPxAmQ6e4wPNpHycDVyj4=,iv:cg2trI7t1MfIcMo1/M+IY6JEl2msDoKRGgAx/Y5nyGk=,tag:gnOq7sBq9z5zrRY0yhIabg==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:k55osvepVeB1RC5hZ4IF,iv:AlhfmWwn/DiSESWc+ULJSOLUhnrKAIfWr7MeiwV8qc8=,tag:hOgptwUcY6nVxPIhu+DYgw==,type:comment]
-affine:
-    secret_key: ENC[AES256_GCM,data:LLX78DpYnha1JWhgw0sHLzIVq/oIzvT+nB7zgli4mroGbnt7WZaXCx34zKkYRwYj/+0L4IFFVdkzKtK5DO84SgFkS2Bk2iNdCMqIx80CpyiD8IWAcyRu5d6hh82PlgyxU80T/4nbLbIn0GLubPTTeUX8GC3VxRU=,iv:DnmvbhlygSHes0jAkIm4+WXMUQLzr4R4dNa33rO67v8=,tag:+2wlh+/ekiTyShWM4XBbUw==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:4zxiQAzXTR+fraRjYT657BIwSqrih3lMPFFSibQdardRMjskAbuRYIQA6mo=,iv:ub3giRG9vCFSuwRXDazYTqWbjENzQUWR36290Kruj1o=,tag:C2Ixd2eTEgzBvUNCNBtJuA==,type:str]
-    oidc:
-        secret: ENC[AES256_GCM,data:eRDBrqLZR7MFLlsUwk7Wg7FzxDov7vJLIWQRuKq7vrXbPSJkMcy9jfG2rL4=,iv:UaSoi7gODXgjzihJIDVIdDHJcSAZNV8UKfGeM6YzxqI=,tag:cOUDblcMStP8E4fp+s1WRQ==,type:str]
-        hash: ENC[AES256_GCM,data:jE1CvFo+mjb/Xc3Ft5ky7on03vcnv79cw/5g/xaldXsv94VRrIjmfGMgHAj07r8j5mDpP34A5bYO1PSe9DYrwRcsXa9OUQuzm/8avFy9wVZDhBUUAGR+jiW1BP9hc6nmSpPVPtle+3sbqOB0ZMjXWwlcAcuknOtuhH1mzwmaDP9yf+M=,iv:CSSaXY/6MpHBMhPLUWPkabIeJ9zpZkcVjiEhxVF0zJM=,tag:f72ekkjJs7Qmh1K9wC8L9w==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
 #ENC[AES256_GCM,data:PZS7EbvMHqHGorNUGAWj4dk1,iv:vOE+djRAvBTMM51kHi6kG5Arw3uPXlJt1d/BpcEaD0c=,tag:AuoCHLQz42CYvVVdKFWu1Q==,type:comment]
 nextcloud:
-    admin-local:
-        password: ENC[AES256_GCM,data:mIwF5A09oqYbdK3bOKid9A896Q5J5Q6Ax+vDNqEJFGNdzd/mJ4oQS6rva+s=,iv:QroUMST2wnEJzk6DySe9tPZaWuqdxzJZ0+oi6mW6x00=,tag:3UTzjupK7+omrI3Hvyr8bA==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:uSov7SN1yB1PhTc=,iv:5yxabQcY/XsBhn531xZg3XYsnxl3K59WuN7Vz9M4XG0=,tag:BBnfZPppw+SDGsV8dK2F+Q==,type:str]
+        password: ENC[AES256_GCM,data:j/wFr5EV00WegWxIGj1k3U13sQjf1GgUofGbh9+i916uudfdklhcurujhiY=,iv:aHEKjLvS5lnayRX/NJ98DxQ40mfqssidubDaP2RVb3k=,tag:zQRE9AsiAlXe58r4VFJiaQ==,type:str]
     oidc:
         secret: ENC[AES256_GCM,data:Sr4KkKkYdkU0UWdpfUF7PyiGoerjBiw+sOFcENyLxw0FRXGG0Y8gv5uGb4Q=,iv:LbGsNM3+iY7bWFQe88TepVKUdiRQWZ+K7Ubn6ze6lV4=,tag:SbcfIAMW9ZprgahOFU4IQQ==,type:str]
         hash: ENC[AES256_GCM,data:CkstbIYQmi72QhsbJZN0lQedgCn7TmGpYcYj0n+NvJIoTlol8G9N/88cwGbVoGK9nEISv54FL94cEJFppnMIuj0BHrhasrZsyI2/Lj52YLWdwNJWNQ+iYt+Ifp/1kI0zqmdoajzZ5DS2w/1evCBC1+JdfTRlpVXmSsHUIPIHelBRj90=,iv:vwvT5TTkF4woxXOvrRRqmrdLXf19s47NIDtdT+zLp0U=,tag:KC0MS0DTH6j3zIHOjCFOSA==,type:str]
@@ -271,9 +271,18 @@ memos:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
+#ENC[AES256_GCM,data:ATLTbBi1RsBr2ldHDDH4,iv:RFbPz/46BIGYv9Wo5Jxw5Swi4Xo2JgIEI4IsO4rCQoQ=,tag:i7/2ItQSFurrmdNaBWwWAA==,type:comment]
+mealie:
+    oidc:
+        secret: ENC[AES256_GCM,data:ldsfwWnexNNM4r+aP2h+woQROwbp9MpxAz8E/o1Q53GxcEwtixqvP6QZGoo=,iv:6M/lfuDU3IOd0nxLi2l02OD5FopErhSCp6AhxBGTI1k=,tag:3w0p+wi9T1PqNmgoM59gug==,type:str]
+        hash: ENC[AES256_GCM,data:YmziHxsFPJ93uMNG6/EUiPEfMvvAZM8/S5854GJ/fPPTMvXj9cM2sovkSrcNd7H0ac5KDJIcJoD9SC5lWKCAbjKzxHvI6CdI63SM8bExrDL2PVSGAf29VLU/cz8rQtZS39GWz2v5GWlpk67Emy0T115vruIGfDlan8zgQKK7YIWyVMs=,iv:xmnBYjBIWq6P2g5DyMh+wYskmJRcVDREGL/yYhJHyRs=,tag:qMWXHiLmAy5UvWFvv3Ct8g==,type:str]
+#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
+#
+#
 #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
 switch:
-    password: ENC[AES256_GCM,data:qu0f9L7A0eFq/UCpaRs=,iv:W8LLOp3MSfd/+EfNEZNf91K8GgI5eUfVPoWTRES2C0Y=,tag:Q5FlAOfwqwJwPvd7k6i+0g==,type:str]
+    admin:
+        password: ENC[AES256_GCM,data:cwBJRIO3eUgezyN60dU=,iv:Ab+EpURW+MYT7RTcPHi4FvQiv4m6TDhAb1/xexkIHCE=,tag:JEWZ3cqoAfAPfwXz7KmINQ==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -281,8 +290,9 @@ switch:
 dsm:
     key: ENC[AES256_GCM,data:jxQRPNuioZbznadJa7sdhbntABsi+nc6Y5TJsyMXwKRvVUbQw8p3snp75d9WVmOfq4uj8wBGen0noa/6xtWo4ZiHsIg1Svh/5xAN37zueB6NmK/z+BW2y8HaIkNhjcinusnT2SWE2ahguizMNM90FpXgmTt9Zv7wVwRkifDLWpH+rs5zmyMWPtpT2RN3+k7tVh8XWVevek/DxG4h+jtoYhTVzndMC5oe/A60MHBJCj6kaksGlX3vIDbRo5A0FEKX8uWI6k6U2osFc4SHIvpljYmPagj3EwPaTc3mbl8IJsXFVH4=,iv:7O5oQa1fELjIt6f3nQ+fWDFirAexgioS36/Nozh656o=,tag:t1RHmY8QC6mE9PVPJg426Q==,type:str]
     crt: ENC[AES256_GCM,data:N32+8CItiwbW8drpnL65weS35SY8uP8vcw9wBDFOxGFQjs6EyEwsMUVh1ndMpmDSUKWz7c7ji0HisC710RqnZw9l2NMg6R57DeXR/WsLW4LiAT7sFuDBcqorTB+6Nk0K9wLLdnsKpUQgl8oV9ffnWXZdfI5skKCDMNB40WJAYY/3wx9iT3wDQWaunq/1NT0SZHrtXXTj1JYiLbfDaTwTvkuqqUv1cXvOjonL2Cp4aNT/zjwK6c/TRbKdhIs/7tnUUE/lJx74eARfrMQy/3y6h2xK9pgruASuJxMw9Tyaj6Ya0FMNMIezO3GPQbFCE/IRfmCE6vX2RXUjVqX8wd/d4m4KNuMsN3hbwC3vQ6r+DcYdaTUfGIu96xfKSiSax/ZPQ4JhTyqthkGgpE0Ob67aVELrZkyhc/kvvSxafVSvP63C/nHPQnXMgitdRddYFq7487Vbq03frxiyID1WkqeUavc+Tn3dyA8c7aqVvbW6vZCAwUzbKD0nwPuBUtKZQpJKxHvtx2390PW7a214zkPLcw5LH3FnNacopiNfs6dNEeW/UsGysYkoBRXfrAPMX4UL53TvUTrpuCBhthJ4rgqjhgTfq9GtomP7piuf/tnMAO33qSHPM3w2ocLWeLyOiqYESFmXoBAsiu33LVzuVryFVw75pgrGAsc2wwKhcu4JC0cNgUE44ENIIjffVQX/mcvPvHxuI05vtzM0N8kOFPwG7iAVrO1eUEpwUjZwUwkk8QRsuIhZ6W7aYx7TLdPDpjmy6XCYGNHZgHg6jU7v18KkPep1YarAnsVYFzHQwfZIMOzW7DHlHq38NJW8lWq7zkg+kY6JDVy0nttlAUSskWNeCHdI5Xy3Rz3t7V6t1+UxkSy3roQCZOYjiaknwrXSctsgqucKaJCq4w0Tty36kaIXwOQYVm9JqDIztOmer4fW8Es7OEbLwA==,iv:26fGb288JEbtA0UcAmiYcN+UunrUOw2S6fKjGMetgwE=,tag:GmUJb9LJ186HNOF4AhfmLg==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:6LiNif7aIGgGBBdVYpl4K8L8ev6EPru5x6HvX2yJ0oiDQb6G9AI+ZsaKamc=,iv:Y+eijt1PmNZR9c9uCzBnzJT9BDc3w/P4VzsbvrPRU64=,tag:2KKRtTSYzrJKy9VX/2J5eQ==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:/Js=,iv:GyEcag6KxEHy6xApfzEo+dZF9NOtkOoYaJZEzPa8ing=,tag:W/4zaDxdw42Ap4DVE9ogAQ==,type:str]
+        password: ENC[AES256_GCM,data:/rgn1Eogw3F2EqArMJXL8Ri4y1W04hGzxy4w1Ct5/ysBjjHGgRbxd9tXSf0=,iv:PISJ0a113rlEL0z0yo+nBYNQNU6Ht0PgFWZzooxIgi0=,tag:UZl0EiVcaVPq1v0MtNCXFQ==,type:str]
     oidc:
         secret: ENC[AES256_GCM,data:IXJNy9PmMPn9uowSMMrNPYqaW5PZ13JTeu1t7eNlapxmnV3EAl3I3xbMK5A=,iv:UcG2E6zgoKkPfUiHr0A+gvnApCkBJG2GROfacwD634Q=,tag:nSFn9yaCadJGlGy/aCvc2A==,type:str]
         hash: ENC[AES256_GCM,data:Y2/FNYbID0trRS5UpP2MX6UcLWxlRoXu9VLeU9DU9whEwNLbf4gYrxI7Q7etQe6HidBuoIJNxKajf3t0fI0ptbXnJaxzMh/v/CsiDg2p568o3KIyfB1PruGRKUrTuJneREUHg5jRXMYCwcRUQ4C5WgAyjd2spGlTQO0OLEqh0wkTtvs=,iv:YTYoaBy3QwlSrmx/K5woiXAHrh0RkawF+uQ4rQuP7WU=,tag:Ej6ZjTFvKjw6BrXbd0lf0g==,type:str]
@@ -291,8 +301,7 @@ dsm:
 #
 sops:
     age:
-        - recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TVVta2V6UHB4V3NmV0tR
             V0hmbUw1bUpSSk4zQXZ4MHlaVzdJU0VSWm1VCnZaMUg1cjJyOEFyOWxPNm9lWkVm
@@ -300,7 +309,8 @@ sops:
             UmliaFNxVTBqRkI1QWJpWGpTRWxETW8KEY/8AfU73UOzCGhny1cNnd5dCNv7bHXt
             k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-16T11:08:23Z"
-    mac: ENC[AES256_GCM,data:FprpwGfSw+KObEthT41tD8qgawQPpRlHw0ZxcyH74Nzk+47AbkDR3dWUPmZGPTePcQM4WI3e1IzE0ptJA7Hpcsnq/wHdo+uTW8nozYxzDU7JhjG2Xn6CPov2mV3o0SCegiCpfvE4A3bXiBOPapUIIs+ySBUMmyyW6m5ravElxsA=,iv:wt/3nFmVfodxActWBNvli2M2LLQZG8bkuagA/Fc6iuk=,tag:z1QWaMrGN/8kBrmZ8mPJUA==,type:str]
+          recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
+    lastmodified: "2026-06-12T13:44:23Z"
+    mac: ENC[AES256_GCM,data:FMOY7qMDSCzvOUL44zmwLwUVAXfYkat1JbiNeBVQFuUrC4lAwuukxW9MCPs5plj84LOAUMVgMofyudFJh5VKTR6Y0EnB5ft0NnbGgwMwzQnQn7d9Mcg9xPca3ccSbSGNx0UrC+8lTjXuzhoawMQ5ZXZ3ZK0k7JrFQ2El7UUwxEA=,iv:+oj0bvsDo8gidUn6m0FOeWsJOxIXPHhzvtiIbQ1VgcY=,tag:8xLcthizKqWjqg2eQvJlRA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.1

config/services/containers/app/mealie/mealie.container.j2

@@ -0,0 +1,49 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Mealie
+
+[Container]
+Image=ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}
+ContainerName=mealie
+HostName=mealie
+PublishPort={{ services['mealie']['ports']['http'] }}:9000/tcp
+
+# Volumes
+Volume=%h/data/containers/mealie/data:/app/data:rw
+Volume=%h/containers/mealie/ssl:/etc/ssl/mealie:ro
+
+# General
+Environment="TZ={{ timezone }}"
+Environment="BASE_URL=https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}"
+Environment="ALLOW_PASSWORD_LOGIN=false"
+
+# Database (PostgreSQL)
+Environment="DB_ENGINE=postgres"
+Environment="POSTGRES_SERVER={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}"
+Environment="POSTGRES_PORT={{ services['postgresql']['ports']['tcp'] }}"
+Environment="POSTGRES_USER=mealie"
+Environment="POSTGRES_DB=mealie_db"
+Environment="PGSSLMODE=verify-full"
+Environment="PGSSLROOTCERT=/etc/ssl/mealie/{{ root_cert_filename }}"
+Secret=MEALIE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
+
+# OIDC
+Environment="OIDC_AUTH_ENABLED=true"
+Environment="OIDC_SIGNUP_ENABLED=true"
+Environment="OIDC_CONFIGURATION_URL=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}/.well-known/openid-configuration"
+Environment="OIDC_CLIENT_ID=mealie"
+Environment="OIDC_AUTO_REDIRECT=false"
+Environment="OIDC_ADMIN_GROUP=admins"
+Environment="OIDC_USER_GROUP=users"
+Secret=MEALIE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
+
+[Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target

config/services/containers/app/outline/outline.container.j2

@@ -53,6 +53,7 @@ Environment="OIDC_USERINFO_URI=https://{{ services['authelia']['domain'] }}.{{ d
 Environment="OIDC_USERNAME_CLAIM=preferred_username"
 Environment="OIDC_DISPLAY_NAME=Authelia"
 Environment="OIDC_SCOPES=openid offline_access profile email"
+Environment="OIDC_DISABLE_REDIRECT=true"
 Secret=OUTLINE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
 
 # Mail

config/services/containers/auth/authelia/authelia.container.j2

@@ -54,7 +54,7 @@ Exec=--config /config/authelia.yaml
 
 [Service]
 # Wait for dependency
-# They run as rootless podman container, so their port is not opened until they are normaly running
+# They run as rootless podman container, so their port is not opened until they are normally running
 # Check their ports with nc command
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 # services['ldap']['ports']['ldaps'] is 6360, but nftables works on 636 the original port

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -4,7 +4,7 @@
 # certificates setting
 certificates_directory: '/etc/ssl/authelia/'
 
-# them setting - light, dark, grey, auto.
+# theme setting - light, dark, grey, auto.
 theme: 'auto'
 
 # Server configuration
@@ -22,7 +22,7 @@ totp:
   # issure option is for 2FA app. It works as identifier. "My homelab' or 'ilnmors.internal', 'Authelia - ilnmors'
   issuer: '{{ domain['internal'] }}'
 
-# Identity validation confituration
+# Identity validation configuration
 identity_validation:
   reset_password:
     jwt_secret: '' # $AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE option is designated in container file
@@ -33,7 +33,7 @@ authentication_backend:
     # ldaps uses 636 -> NAT automatically change port 636 in output packet -> 2636 which lldap server uses.
     address: 'ldaps://{{ services['ldap']['domain'] }}.{{ domain['internal'] }}'
     implementation: 'lldap'
-    # tls configruation, it uses certificates_directory's /etc/ssl/authelia/{{ root_cert_filename }}
+    # tls configuration, it uses certificates_directory's /etc/ssl/authelia/{{ root_cert_filename }}
     tls:
       server_name: '{{ services['ldap']['domain'] }}.{{ domain['internal'] }}'
       skip_verify: false
@@ -59,6 +59,7 @@ access_control:
 #      policy: 'one_factor'
 #      subject:
 #        - 'group:admins'
+
 # Session provider configuration
 session:
   secret: '' # $AUTHELIA_SESSION_SECRET_FILE  is designated in container file
@@ -100,12 +101,17 @@ identity_providers:
       - algorithm: 'ES256'
         use: 'sig'
         key: {{ secret "/run/secrets/AUTHELIA_JWKS_ES256" | mindent 10 "|" | msquote }}{% endraw %}
+    lifespans:
+      access_token: '1h'
+      id_token: '1h'
+      refresh_token: '720h'
     clients:
       # https://www.authelia.com/integration/openid-connect/clients/synology-dsm/
       - client_id: 'dsm'
         client_name: 'dsm'
+        consent_mode: 'implicit'
         # It depends on application
-        # hash vaule generate: 
+        # hash value generate:
         # podman exec -it authelia sh
         # authelia crypto hash generate pbkdf2 --password 'password'
         client_secret: '{{ hostvars['console']['dsm']['oidc']['hash'] }}'
@@ -132,6 +138,7 @@ identity_providers:
       # https://www.authelia.com/integration/openid-connect/clients/gitea/
       - client_id: 'gitea'
         client_name: 'gitea'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['gitea']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -153,6 +160,7 @@ identity_providers:
       # https://www.authelia.com/integration/openid-connect/clients/immich/
       - client_id: 'immich'
         client_name: 'immich'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['immich']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -176,6 +184,7 @@ identity_providers:
       # https://www.authelia.com/integration/openid-connect/clients/paperless/
       - client_id: 'paperless'
         client_name: 'Paperless'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['paperless']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -195,30 +204,10 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
-      # https://docs.affine.pro/self-host-affine/administer/oauth-2-0
-      - client_id: 'affine'
-        client_name: 'Affine'
-        client_secret: '{{ hostvars['console']['affine']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: false
-        pkce_challenge_method: ''
-        redirect_uris:
-          - 'https://{{ services['affine']['domain']['public'] }}.{{ domain['public'] }}/oauth/callback'
-        scopes:
-          - 'openid'
-          - 'profile'
-          - 'email'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'
       # https://www.authelia.com/integration/openid-connect/clients/nextcloud/#openid-connect-user-backend-app
       - client_id: 'nextcloud'
         client_name: 'Nextcloud'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['nextcloud']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -241,6 +230,7 @@ identity_providers:
       # https://www.authelia.com/integration/openid-connect/clients/sure/
       - client_id: 'sure'
         client_name: 'Sure'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['sure']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -263,6 +253,7 @@ identity_providers:
       # https://www.authelia.com/integration/openid-connect/clients/outline/
       - client_id: 'outline'
         client_name: 'Outline'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['outline']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -286,6 +277,7 @@ identity_providers:
       # https://www.authelia.com/integration/openid-connect/clients/memos/
       - client_id: 'memos'
         client_name: 'Memos'
+        consent_mode: 'implicit'
         client_secret: '{{ hostvars['console']['memos']['oidc']['hash'] }}'
         public: false
         authorization_policy: 'one_factor'
@@ -304,3 +296,26 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
+      # https://www.authelia.com/integration/openid-connect/clients/mealie/
+      - client_id: 'mealie'
+        client_name: 'Mealie'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['mealie']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: true
+        pkce_challenge_method: 'S256'
+        redirect_uris:
+          - 'https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}/login'
+        scopes:
+          - 'openid'
+          - 'email'
+          - 'profile'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'

config/services/containers/common/caddy/etc/app/Caddyfile.j2

@@ -53,12 +53,6 @@
                 header_up Host {http.request.header.X-Forwarded-Host}
         }
 }
-{{ services['affine']['domain']['internal'] }}.{{ domain['internal'] }} {
-        import private_tls
-        reverse_proxy host.containers.internal:{{ services['affine']['ports']['http'] }} {
-                header_up Host {http.request.header.X-Forwarded-Host}
-        }
-}
 {{ services['nextcloud']['domain']['internal'] }}.{{ domain['internal'] }} {
         import private_tls
         reverse_proxy host.containers.internal:{{ services['nextcloud']['ports']['http'] }} {
@@ -89,3 +83,9 @@
                 header_up Host {http.request.header.X-Forwarded-Host}
         }
 }
+{{ services['mealie']['domain']['internal'] }}.{{ domain['internal'] }} {
+        import private_tls
+        reverse_proxy host.containers.internal:{{ services['mealie']['ports']['http'] }} {
+                header_up Host {http.request.header.X-Forwarded-Host}
+        }
+}

config/services/containers/common/caddy/etc/auth/Caddyfile.j2

@@ -100,15 +100,6 @@
                 }
         }
 }
-{{ services['affine']['domain']['public'] }}.{{ domain['public'] }} {
-        import crowdsec_log
-        route {
-                crowdsec
-                reverse_proxy https://{{ services['affine']['domain']['internal'] }}.{{ domain['internal'] }} {
-                        header_up Host {http.reverse_proxy.upstream.host}
-                }
-        }
-}
 {{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }} {
         import crowdsec_log
         route {
@@ -154,6 +145,15 @@
                 }
         }
 }
+{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }} {
+        import crowdsec_log
+        route {
+                crowdsec
+                reverse_proxy https://{{services['mealie']['domain']['internal'] }}.{{ domain['internal'] }} {
+                        header_up Host {http.reverse_proxy.upstream.host}
+                }
+        }
+}
 
 # Internal domain
 {{ node['name'] }}.{{ domain['internal'] }} {

config/services/containers/infra/postgresql/config/pg_hba.conf.j2

@@ -1,5 +1,6 @@
 # @authcomment@
 # TYPE  DATABASE  USER   ADDRESS                                      METHOD
+
 # Local host `trust`
 local   all       all                                                 trust
 

config/services/containers/infra/postgresql/config/postgresql.conf.j2

@@ -3,11 +3,14 @@
 #------------------------------------------------------------------------------
 
 # Add settings for extensions here
-# Listen_address
+
+# Listen address
 listen_addresses = '*'
+
 # Max connections
 max_connections = 250
-# listen_port
+
+# Listen port
 port = {{ services['postgresql']['ports']['tcp'] }}
 
 # SSL
@@ -18,7 +21,7 @@ ssl_key_file = '/etc/ssl/postgresql/postgresql.key'
 ssl_ciphers = 'HIGH:!aNULL:!MD5'
 ssl_prefer_server_ciphers = on
 
-# log
+# Log
 log_destination = 'stderr'
 log_checkpoints = on
 log_temp_files = 0
@@ -27,7 +30,7 @@ log_min_duration_statement = 500
 # IO
 track_io_timing = on
 
-## immich_config
+# immich_config
 shared_preload_libraries = 'vchord.so'
 search_path = '"$user", public'
 max_wal_size = 5GB

config/services/containers/infra/postgresql/postgresql.container.j2

@@ -19,7 +19,7 @@ Volume=%h/containers/postgresql/data:/var/lib/postgresql:rw
 Volume=%h/containers/postgresql/config:/config:ro
 Volume=%h/containers/postgresql/ssl:/etc/ssl/postgresql:ro
 Volume=%h/containers/postgresql/init:/docker-entrypoint-initdb.d/:ro
-Volume=%h/containers/postgresql/backups:/backups:rw
+Volume=%h/data/containers/postgresql/backups:/backups:rw
 
 Environment="TZ={{ timezone }}"
 # This option is only for init process, after init custom config file `pg_hba.conf` will control this option.

config/services/containers/infra/postgresql/services/postgresql-data-backup@.service

@@ -13,7 +13,13 @@ StandardError=journal
 ExecStartPre=/usr/bin/podman exec postgresql sh -c "mkdir -p /backups/%i && chown postgres:root /backups/%i && chmod 770 /backups/%i"
 
 # Run the script
+## DB Connection
 ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'printf "\\connect %i_db\n" > /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
+## Avoiding FK/trigger checks
+ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'printf "SET session_replication_role = replica;\n" >> /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
+## Data
 ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'pg_dump -U postgres -d %i_db --data-only >> /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
+## reset session replication role
+ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'printf "SET session_replication_role = origin;\n" >> /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
 ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c "find /backups/%i -maxdepth 1 -type f -mtime +7 -delete"
 ExecStart=/usr/bin/podman exec postgresql sh -c "chown -R postgres:root /backups/%i && chmod 660 /backups/%i/*"

config/services/systemd/app/btrfs/btrfs-scrub.service.j2

@@ -1,10 +0,0 @@
-[Unit]
-Description=BTRFS auto scrub
-ConditionPathIsMountPoint={{ storage['btrfs']['mount_point'] }}
-RequiresMountsFor={{ storage['btrfs']['mount_point'] }}
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/btrfs scrub start -Bd {{ storage['btrfs']['mount_point'] }}
-Nice=19
-IOSchedulingClass=idle

config/services/systemd/common/crowdsec/acquis.d/suricata.yaml

@@ -2,4 +2,4 @@
 filenames:
   - /var/log/suricata/eve.json
 labels:
-  type: suricata
+  type: suricata-evelogs

config/services/systemd/common/kopia/kopia-backup.service.j2

@@ -20,11 +20,8 @@ ProtectSystem=strict
 ProtectHome=tmpfs
 InaccessiblePaths=/boot /root
 
-{% if node['name'] == 'infra' %}
-BindReadOnlyPaths={{ node['home_path'] }}/containers/postgresql/backups
-{% elif node['name'] == 'app' %}
 BindReadOnlyPaths={{ node['home_path'] }}/data
-{% endif %}
+
 # In root namescope, %u always bring 0
 BindPaths=/etc/kopia
 BindPaths=/etc/secrets/{{ kopia_uid }}
@@ -36,14 +33,8 @@ ExecStartPre=/usr/bin/kopia repository connect server \
     --override-username={{ node['name'] }} \
     --override-hostname={{ node['name'] }}.{{ domain['internal'] }}
 
-{% if node['name'] == 'infra' %}
-ExecStart=/usr/bin/kopia snapshot create \
-    {{ node['home_path'] }}/containers/postgresql/backups
-{% elif node['name'] == 'app' %}
 ExecStart=/usr/bin/kopia snapshot create \
     {{ node['home_path'] }}/data
-{% endif %}
-
 
 [Install]
 WantedBy=multi-user.target

config/services/systemd/common/kopia/kopia.env.j2

@@ -1,4 +1,4 @@
-KOPIA_PASSWORD={{ hostvars['console']['kopia']['user'][node['name']] }}
+KOPIA_PASSWORD={{ hostvars['console']['kopia']['users'][node['name']] }}
 KOPIA_CONFIG_PATH=/etc/kopia/repository.config
 KOPIA_CACHE_DIRECTORY=/var/cache/kopia
 KOPIA_LOG_DIR=/var/cache/kopia/logs

config/services/systemd/console/code-server/.vscode/settings.json

@@ -0,0 +1,28 @@
+{
+    "python.useEnvironmentsExtension": false,
+    "ansible.lightspeed.enabled": false,
+    "ansible.lightspeed.suggestions.enabled": false,
+    "ansible.validation.enabled": true,
+    "ansible.validation.lint.enabled": true,
+    "files.associations": {
+        "**/ansible/**/*.yaml": "ansible",
+        "*.container*": "ini",
+        "*.service*": "ini",
+        "*.timer*": "ini",
+        "*containerfile*": "dockerfile",
+        "*.link*": "ini",
+        "*.netdev*": "ini",
+        "*.network*": "ini",
+        "*.xml*": "xml",
+        "named.conf*": "cpp",
+        "*.conf*": "ini",
+        "*.toml": "ini",
+        "*.json.*": "json",
+        "*.alloy.*": "cpp"
+    },
+    "ansible.python.interpreterPath": "/bin/python3",
+    "yaml.customTags": [
+        "!vault scalar"
+    ],
+    "workbench.hover.delay": 9999999,
+}

config/services/systemd/console/code-server/code-server.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=code-server user service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/code-server \
+  --auth none \
+  --bind-addr 127.0.0.1:2080 \
+  %h/workspace
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target

config/services/systemd/console/wsl-alive/wsl-alive.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Keep Distro Alive
+
+[Service]
+ExecStart=/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe -WindowStyle Hidden -NonInteractive -NoProfile -Command "while ($true) { Start-Sleep -Seconds 3600 }"
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

config/services/systemd/fw/ddns/ddns.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 ## Change Log format as logfmt (refactoring)
-# ddns.sh -d domain [-t <ttl>] [-p] [-r] [-c]
+# ddns.sh -d domain [-t <ttl>] [-p] [-r]
 
 # Default Information
 DOMAIN=""
@@ -17,7 +17,7 @@ CURRENT_IP=""
 
 # usage() function
 usage() {
-        echo "Usage: $0 -d \"domain\" [-t \"ttl\"] [-p] [-r] [-c]"
+        echo "Usage: $0 -d \"domain\" [-t \"ttl\"] [-p] [-r]"
         echo "-d <domain>: Specify the domain to update"
         echo "-t <ttl>: Specify the TTL(Time to live)"
         echo "-p: Specify the cloudflare proxy to use"
@@ -109,7 +109,7 @@ if [[ -z "$CURRENT_IP" || "$CURRENT_IP" =~ ^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|
     CURRENT_IP=$(curl -sf "https://api.ipify.org")
 fi
 if [ "$CURRENT_IP" == "" ]; then
-    log "Error" "Can't get an IP"
+    log "error" "Can't get an IP"
     exit 1
 fi
 
@@ -218,8 +218,8 @@ delete_dns_record()
 
 # Get DNS A, and CNAME record
 A_DNS_RECORD=$(get_dns_record "A" "$DOMAIN")
-S_DNS_RECORD=$(get_dns_record "cname" "*.$DOMAIN")
-W_DNS_RECORD=$(get_dns_record "cname" "www.$DOMAIN")
+S_DNS_RECORD=$(get_dns_record "CNAME" "*.$DOMAIN")
+W_DNS_RECORD=$(get_dns_record "CNAME" "www.$DOMAIN")
 
 # Delete DNS record with Delete flag
 if [ "$DELETE_FLAG" == "true" ]; then
@@ -232,13 +232,13 @@ if [ "$DELETE_FLAG" == "true" ]; then
     fi
     if [ "$(echo $S_DNS_RECORD | jq -r '.result | length')" -eq 1 ]; then
         S_DNS_ID="$(echo $S_DNS_RECORD | jq -r '.result[0].id')"
-        delete_dns_record "cname" "$S_DNS_ID"
+        delete_dns_record "CNAME" "$S_DNS_ID"
         log "info" "sub DNS record is deleted"
         FLAG="true"
     fi
     if [ "$(echo $W_DNS_RECORD | jq -r '.result | length')" -eq 1 ]; then
         W_DNS_ID="$(echo $W_DNS_RECORD | jq -r '.result[0].id')"
-        delete_dns_record "cname" "$W_DNS_ID"
+        delete_dns_record "CNAME" "$W_DNS_ID"
         log "info" "www DNS record is deleted"
         FLAG="true"
     fi
@@ -272,14 +272,14 @@ if [ "$(echo $S_DNS_RECORD | jq -r '.result | length')" -eq 1 ]; then # sub DNS
     S_DNS_TTL="$(echo $S_DNS_RECORD | jq -r '.result[0].ttl')"
     S_DNS_PROXIED="$(echo $S_DNS_RECORD | jq -r '.result[0].proxied')"
     if [ "$S_DNS_CONTENT" != "$DOMAIN" -o "$S_DNS_TTL" != "$C_TTL" -o "$S_DNS_PROXIED" != "$PROXIED" ]; then
-        update_dns_record "cname" "*.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): sub domain from ddns.sh" "$DOMAIN" "$S_DNS_ID"
-        log "info" "Sub DNS record is successfully changed Domain: $S_DNS_CONTENT to *.$DOMAIN cname: $DOMAIN  TTL: $S_DNS_TTL to $C_TTL proxied: $S_DNS_PROXIED to $PROXIED"
+        update_dns_record "CNAME" "*.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): sub domain from ddns.sh" "$DOMAIN" "$S_DNS_ID"
+        log "info" "Sub DNS record is successfully changed Domain: $S_DNS_CONTENT to *.$DOMAIN CNAME: $DOMAIN  TTL: $S_DNS_TTL to $C_TTL proxied: $S_DNS_PROXIED to $PROXIED"
     else
-        log "info" "Sub DNS record is not changed Domain: *.$DOMAIN cname: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
+        log "info" "Sub DNS record is not changed Domain: *.$DOMAIN CNAME: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
     fi
 else # sub DNS record does not exist
-    create_dns_record "cname" "*.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): sub domain from ddns.sh" "$DOMAIN"
-    log "info" "Sub DNS record is successfully created Domain: *.$DOMAIN cname: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
+    create_dns_record "CNAME" "*.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): sub domain from ddns.sh" "$DOMAIN"
+    log "info" "Sub DNS record is successfully created Domain: *.$DOMAIN CNAME: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
 fi
 
 if [ "$(echo $W_DNS_RECORD | jq -r '.result | length')" -eq 1 ]; then # www DNS record exist
@@ -288,12 +288,12 @@ if [ "$(echo $W_DNS_RECORD | jq -r '.result | length')" -eq 1 ]; then # www DNS
     W_DNS_TTL="$(echo $W_DNS_RECORD | jq -r '.result[0].ttl')"
     W_DNS_PROXIED="$(echo $W_DNS_RECORD | jq -r '.result[0].proxied')"
     if [ "$W_DNS_CONTENT" != "$DOMAIN" -o "$W_DNS_TTL" != "$C_TTL" -o "$W_DNS_PROXIED" != "$PROXIED" ]; then
-        update_dns_record "cname" "www.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): www domain from ddns.sh" "$DOMAIN" "$W_DNS_ID"
-        log "info" "www DNS record is successfully changed Domain: $W_DNS_CONTENT to www.$DOMAIN cname: $DOMAIN TTL: $W_DNS_TTL to $C_TTL proxied: $W_DNS_PROXIED to $PROXIED"
+        update_dns_record "CNAME" "www.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): www domain from ddns.sh" "$DOMAIN" "$W_DNS_ID"
+        log "info" "www DNS record is successfully changed Domain: $W_DNS_CONTENT to www.$DOMAIN CNAME: $DOMAIN TTL: $W_DNS_TTL to $C_TTL proxied: $W_DNS_PROXIED to $PROXIED"
     else
-        log "info" "www DNS record is not changed Domain: www.$DOMAIN cname: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
+        log "info" "www DNS record is not changed Domain: www.$DOMAIN CNAME: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
     fi
 else # www DNS record does not exist
-    create_dns_record "cname" "www.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): www domain from ddns.sh" "$DOMAIN"
-    log "info" "www DNS record is successfully created Domain: www.$DOMAIN cname: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
+    create_dns_record "CNAME" "www.$DOMAIN" "$C_TTL" "$(date "+%Y-%m-%d %H:%M:%S"): www domain from ddns.sh" "$DOMAIN"
+    log "info" "www DNS record is successfully created Domain: www.$DOMAIN CNAME: $DOMAIN TTL: $C_TTL proxied: $PROXIED"
 fi

config/services/systemd/vmm/btrfs/btrfs-scrub.service.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=BTRFS auto scrub
+ConditionPathIsMountPoint={{ hardware['btrfs']['mount_point'] }}
+RequiresMountsFor={{ hardware['btrfs']['mount_point'] }}
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/btrfs scrub start -Bd {{ hardware['btrfs']['mount_point'] }}
+Nice=19
+IOSchedulingClass=idle

config/services/systemd/vmm/libvirt/seeds/user-data.j2

@@ -11,7 +11,7 @@ users:
     - name: {{ target_vm }}
       uid: {{ hostvars[target_vm]['node']['uid'] }}
       gecos: {{ target_vm }}
-      primary_group: svadmins
+      primary_group: {{ hostvars[target_vm]['node']['group'] }}
       groups: sudo
       lock_passwd: false
       passwd: {{ hostvars['console']['sudo']['hash'][target_vm] }}