feat(repo): IaaS baseline

2026-06-17 13:17:24 +09:00
parent a6bba986a5
commit 927b5b4934
250 changed files with 1074 additions and 28750 deletions
@@ -1,10 +1,10 @@
-.ansible
 data/bin/*
-data/volumes/*
-data/images/*
-!data/images/containers
 data/images/containers/*
-docs/archives/textfiles/
-docs/notes/*
+data/images/seeds/*
+data/vmm_init/*
+*.raw
+*.tar
+*.qcow2
 *.sql
+*.iso
 !.gitkeep
@@ -1,35 +0,0 @@
-# ilnmors homelab README
-
-This homelab project implements single-node On-premise IaaS system. The homelab contains virtual machines which are divided by their roles, such as private firewall, DNS, PKI, LDAP and database, SSO(OIDC). The standard domain is used to implement this system without specific vendors. All components are defined as code and initiated by IaC (Ansible) except hypervisor initial configuration.
-
-## RTO and RPO
-
-### RPO
- Each backup guarantees 24 hours RPO
-    - DB dumps are backed up at 12:00 AM
-    - Stateful data in app vm is backed up at 03:00 AM
- The maximum inconsistency window between DB dumps and stateful data can be 27 hours.
-    - The different backup time.
-
-### RTO
- Feb/25/2026 - Reprovisioning Hypervisor and vms
-    - RTO: 1 hour 30 min - verified
-        - Manual install and set vmm: 20 min
-        - Create and reprovision fw including services: 15 min
-        - Create and reprovision infra including services: 20 min
-        - Create and reprovision auth including services: 10 min
-        - Create and reprovision app except services: 10 min
-        - Intermediate tasks (ACME issuance, DNS propagation, etc.): 15 min
-
- Mar/5/2026 - Reprovisioning Hardware and Hypervisor and vms
-    - RTO: 2 hour 20 min
-        - console: 15min - verified
-        - certificate: 0 min (When it needs to be created, RTO will be 20 min) - not verified
-        - wireguard: 0 min (When it needs to be created, RTO will be 1 min) - not verified
-        - hypervisor(+fw): 45 min - verified
-        - switch: 1 min - verified
-        - dsm: 30 min - verified
-        - kopia: 0 min (When it needs to be created, RTO will be 10 min) - verified
-        - Extra vms: 30 min - verified
-        - Etc: 30 min
-
@@ -1,27 +1,28 @@
 ---
-# `""` should be used for every string values
-# except name, boolean, varible(environment) name, number (only for decimal)
+# String values need `""`
+# Task names, boolean values, environment names, decimal numbers don't need `""`
 - name: Convention task
  delegate_to: "host"
  delegate_facts: true
  environment:
-    env: "environment"
+    env: "value"
  ansible.builtin.file:
-    # Identifier: name:, src, dest, url
-    path: "/path/of/example"
-    # State
+    # Identifier: name, src, dest, url, etc.
+    path: "/example/path"
+    # state parameters
    state: "directory"
    owner: "root"
    group: "root"
    mode: "0640"
-    # optional data
+    # optional parameters
    recurse: true
  loop:
    - "list"
  loop_control:
    label: "{{ item }}"
  become: true
-  # become_user: "root"
+  # default become user is root
+  become_user: "user"
  when: condition.stat.exists
  changed_when: condition.rc != 0
  failed_when: condition.rc == 0
@@ -30,6 +31,8 @@
  listen: "notification_example"
  no_log: true
  run_once: true
+  # Ensure execution even if it fails (it prints errors on the screen, but it ignores them)
+  ignore_errors: true
  tags:
    - "always"
    - "init"
@@ -1,15 +1,14 @@
 ---
 # Global vars
-ansible_ssh_private_key_file: "/etc/secrets/{{ hostvars['console']['node']['uid'] }}/id_console"
 timezone: "Asia/Seoul"
+ansible_ssh_private_key_file: "/etc/secrets/{{ hostvars['console']['node']['uid'] }}/id_console"

 # CA
 root_cert_filename: "ilnmors_root_ca.crt"
 intermediate_cert_filename: "ilnmors_intermediate_ca.crt"
 intermediate_key_filename: "ilnmors_intermediate_ca.key"

-
-# local SAN and SSH SAN should be updated manually on host_vars
+# Domains
 domain:
  public: "ilnmors.com"
  internal: "ilnmors.internal"
@@ -67,7 +66,7 @@ services:
  grafana:
    domain: "grafana"
    ports:
-      http: "3000" # Infra server: Internal ports
+      http: "3000"
    subuid: "100471"
  caddy:
    ports:
@@ -98,7 +97,7 @@ services:
      public: "gitea"
      internal: "gitea.app"
    ports:
-      http: "3000" # App server: Public ports
+      http: "3001"
    subuid: "100999"
  immich:
    domain:
@@ -118,16 +117,6 @@ services:
      http: "8001"
      redis: "6380"
    subuid: "100999"
-  manticore:
-    subuid: "100998"
-  affine:
-    domain:
-      public: "affine"
-      internal: "affine.app"
-    ports:
-      http: "3010"
-      redis: "6381"
-      manticore: "9308"
  nextcloud:
    domain:
      public: "nextcloud"
@@ -148,7 +137,7 @@ services:
      public: "sure"
      internal: "sure.app"
    ports:
-      http: "3001"
+      http: "3002"
      redis: "6383"
    subuid: "100999"
  outline:
@@ -156,7 +145,7 @@ services:
      public: "outline"
      internal: "outline.app"
    ports:
-      http: "3002"
+      http: "3004"
      redis: "6384"
    subuid: "101000"
  memos:
@@ -164,43 +153,49 @@ services:
      public: "memos"
      internal: "memos.app"
    ports:
-      http: "3004"
+      http: "3005"
    subuid: "110000"
+  mealie:
+    domain:
+      public: "mealie"
+      internal: "mealie.app"
+    ports:
+      http: "9001"
+    subuid: "100910"

 version:
  packages:
-    sops: "3.12.1"
+    sops: "3.13.1"
    step: "0.30.2"
-    kopia: "0.22.3"
+    kopia: "0.23.0"
    blocky: "0.29.0"
    alloy: "1.16.1"
  containers:
    # common
-    caddy: "2.11.2"
+    caddy: "2.11.4"
    # infra
    step: "0.30.2"
    ldap: "v0.6.3"
    x509-exporter: "4.1.0"
-    prometheus: "v3.11.3"
+    prometheus: "v3.12.0"
    loki: "3.7.1"
    grafana: "13.0.1"
    ## Postgresql
-    postgresql: "18.3"
+    postgresql: "18.4"
    # For immich - https://github.com/immich-app/base-images/blob/main/postgres/versions.yaml
 #    pgvector: "v0.8.1"
    vectorchord: "1.1.1"
    # Auth
-    authelia: "4.39.19"
+    authelia: "4.39.20"
    # App
    vaultwarden: "1.36.0"
    gitea: "1.26.1"
-    redis: "8.6.3"
+    redis: "8.8.0"
    immich: "v2.7.5"
    paperless: "2.20.15"
-    manticore: "25.0.0"
-    affine: "0.26.3"
-    nextcloud: "33.0.3"
-    collabora: "25.04.9.4.1"
-    sure: "0.7.0-hotfix.2"
-    outline: "1.7.1"
-    memos: "0.28.0"
+    nextcloud: "33.0.5"
+    collabora: "25.04.10.3.1"
+    sure: "0.7.1"
+    outline: "1.8.1"
+    memos: "0.29.1"
+    mealie: "v3.19.2"
@@ -1,7 +1,33 @@
 ---
 node:
  name: "vmm"
+  group: "svadmins"
  uid: 2000
  home_path: "/home/vmm"
-  ssh_san: "vmm,vmm_init,vmm.ilnmors.internal,init.vmm.ilnmors.internal"
-  local_san: "localhost vmm.ilnmors.internal"
+  libvirt_path: "/var/lib/libvirt"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}_init,{{ node['name'] }}.{{ domain['internal'] }},init.{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
+
+hardware:
+  mac:
+    nic0: "c8:ff:bf:07:02:34"
+    nic1: "c8:ff:bf:07:02:33"
+    sfpp0: "c8:ff:bf:07:02:31"
+    sfpp1: "c8:ff:bf:07:02:32"
+  igpu:
+    id: "8086:4628"
+    address: "0000:00:02.0"
+    domain: "0x0000"
+    bus: "0x00"
+    slot: "0x02"
+    function: "0x0"
+  hdd:
+    data:
+      hdd0: "WMC6N0E617S8"
+      hdd1: "P6HVTL0W"
+      hdd2: "P2GH354H"
+      hdd3: "P6GJKSMP"
+  btrfs:
+    label: "DATA"
+    level: "raid10"
+    mount_point: "{{ node['libvirt_path'] }}/data"
@@ -2,17 +2,29 @@
 # Node Factors
 node:
  name: "app"
+  group: "svadmins"
  uid: 2004
  home_path: "/home/app"
-  ssh_san: "app,app.ilnmors.internal"
-  local_san: "localhost app.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
 # VM Factors
 vm:
  name: "app"
-  cpu: 4
+  cpu: 6
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='0'/>
+    <vcpupin vcpu='1' cpuset='1'/>
+    <vcpupin vcpu='2' cpuset='2'/>
+    <vcpupin vcpu='3' cpuset='3'/>
+    <vcpupin vcpu='4' cpuset='10'/>
+    <vcpupin vcpu='5' cpuset='11'/>
+    <emulatorpin cpuset='10-11'/>
  shares: 1024
  memory: 16
  storage: 256
+  data_storage:
+    name: "vdb"
+    size: 3.5
  lan_mac: "0a:49:6e:4d:03:00"
  lan_net: "lan-net"
  lan_group: "vlan10-access"
@@ -26,16 +38,3 @@ vm:
      bus: "0x00"
      slot: "0x02"
      function: "0x0"
-    sata_controller: # Additional SATA Controller
-      address: "0000:04:00.0"
-      domain: "0x0000"
-      bus: "0x04"
-      slot: "0x00"
-      function: "0x0"
-
-# BTRFS configuration for hdd which is passthroughed
-storage:
-  btrfs:
-    label: "APP_DATA"
-    level: "raid10"
-    mount_point: "/home/app/data"
@@ -2,15 +2,20 @@
 # Node Factors
 node:
  name: "auth"
+  group: "svadmins"
  uid: 2003
  home_path: "/home/auth"
-  ssh_san: "auth,auth.ilnmors.internal"
-  local_san: "localhost auth.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"
 # VM Factors
 vm:
  name: "auth"
  cpu: 2
-  shares: 512
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='8'/>
+    <vcpupin vcpu='1' cpuset='9'/>
+    <emulatorpin cpuset='8-9'/>
+  shares: 1024
  memory: 2
  storage: 64
  lan_mac: "0a:49:6e:4d:02:00"
@@ -10,17 +10,17 @@ age_key: !vault |
          33653638373537323363316363646534323362353836373665636265663939353862663532313230
          30643038313138626464626161373835646665326334393834616234643931656536343130316238
          61656264643830616639
-# Node Factors
+
 node:
  name: "console"
+  group: "svadmins"
  uid: 2999
  home_path: "/home/console"
-  workspace_path: "{{ node.home_path }}/workspace"
-  homelab_path: "{{ node.home_path }}/workspace/homelab"
-  data_path: "{{ node.homelab_path }}/data"
-  config_path: "{{ node.homelab_path }}/config"
-  ssh_san: "console,console.ilnmors.internal"
+  workspace_path: "{{ node['home_path'] }}/workspace"
+  homelab_path: "{{ node['home_path'] }}/workspace/homelab"
+  data_path: "{{ node['homelab_path'] }}/data"
+  config_path: "{{ node['homelab_path'] }}/config"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
  ssh_users: "vmm,fw,infra,auth,app"
  # add the hostname of wsl, it is needed to improve the sudo problem
-  local_san: "localhost console.ilnmors.internal surface"
-# ansible_python_interpreter: "{{ ansible_playbook_python }}"
+  local_san: "localhost {{ node['name'] }} {{ node['name'] }}.{{ domain['internal'] }}"
@@ -2,15 +2,22 @@
 # Node Factors
 node:
  name: "fw"
+  group: "svadmins"
  uid: 2001
  home_path: "/home/fw"
-  ssh_san: "fw,fw.ilnmors.internal"
-  local_san: "localhost fw.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"

 # VM Factors
 vm:
  name: "fw"
-  cpu: 2
+  cpu: 4
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='0'/>
+    <vcpupin vcpu='1' cpuset='1'/>
+    <vcpupin vcpu='2' cpuset='4'/>
+    <vcpupin vcpu='3' cpuset='5'/>
+    <emulatorpin cpuset='4-5'/>
  shares: 2048
  memory: 4
  storage: 64
@@ -21,7 +28,7 @@ vm:
  lan_group: "vlan-trunk"

 # Network Factors
-# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to seperate network.
+# LLA is like MAC address for L3 (Network layer). Usually, subnet is used to separate network.
 network4:
  subnet:
    client: "192.168.1.0/24"
@@ -2,16 +2,23 @@
 # Node Factors
 node:
  name: "infra"
+  group: "svadmins"
  uid: 2002
  home_path: "/home/infra"
-  ssh_san: "infra,infra.ilnmors.internal"
-  local_san: "localhost infra.ilnmors.internal"
+  ssh_san: "{{ node['name'] }},{{ node['name'] }}.{{ domain['internal'] }}"
+  local_san: "localhost {{ node['name'] }}.{{ domain['internal'] }}"

 # VM Factors
 vm:
  name: "infra"
-  cpu: 2
-  shares: 1024
+  cpu: 4
+  cpu_pin: |
+    <vcpupin vcpu='0' cpuset='2'/>
+    <vcpupin vcpu='1' cpuset='3'/>
+    <vcpupin vcpu='2' cpuset='6'/>
+    <vcpupin vcpu='3' cpuset='7'/>
+    <emulatorpin cpuset='6-7'/>
+  shares: 2048
  memory: 6
  storage: 256
  lan_mac: "0a:49:6e:4d:01:00"
@@ -11,4 +11,4 @@ vmm ansible_host=vmm.ilnmors.internal ansible_user=vmm
 fw ansible_host=fw.ilnmors.internal ansible_user=fw
 infra ansible_host=infra.ilnmors.internal ansible_user=infra
 auth  ansible_host=auth.ilnmors.internal ansible_user=auth
-app   ansible_host=app.ilnmors.internal ansible_user=app
+app   ansible_host=app.ilnmors.internal ansible_user=app
@@ -20,6 +20,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['app'] }}"
+      no_log: true
      tags: ["always"]

  tasks:
@@ -97,10 +98,10 @@
      become: true
      tags: ["init", "install-packages"]

-    - name: Set raid
+    - name: Set data volume
      ansible.builtin.include_role:
        name: "app"
-        tasks_from: "node/set_raid"
+        tasks_from: "node/set_data_volume"
        apply:
          tags: ["init", "raid"]
      tags: ["init", "raid"]
@@ -193,14 +194,6 @@
          tags: ["site", "paperless"]
      tags: ["site", "paperless"]

-    - name: Set affine
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_affine"
-        apply:
-          tags: ["site", "affine"]
-      tags: ["site", "affine"]
-
    - name: Set nextcloud
      ansible.builtin.include_role:
        name: "app"
@@ -241,6 +234,14 @@
          tags: ["site", "memos"]
      tags: ["site", "memos"]

+    - name: Set mealie
+      ansible.builtin.include_role:
+        name: "app"
+        tasks_from: "services/set_mealie"
+        apply:
+          tags: ["site", "mealie"]
+      tags: ["site", "mealie"]
+
    - name: Flush handlers right now
      ansible.builtin.meta: "flush_handlers"

@@ -20,6 +20,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['auth'] }}"
+      no_log: true
      tags: ["always"]

  tasks:
@@ -20,6 +20,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['console'] }}"
+      no_log: true
      tags: ["always"]

  tasks:
@@ -70,32 +71,6 @@
          tags: ["init", "ssh_client"]
      tags: ["init", "ssh_client"]

-    - name: Check file permissions
-      ansible.builtin.file:
-        path: "{{ node['workspace_path'] }}/{{ item }}"
-        state: "directory"
-        owner: "{{ ansible_user }}"
-        group: "svadmins"
-        mode: "u=rwX,g=,o="
-        recurse: true
-      loop:
-        - "homelab/ansible"
-        - "homelab/config"
-        - "homelab/docs"
-        - "university"
-      tags: ["init", "site", "file_permission"]
-      # kopia snashot is mounted on homelab/data/volumes.
-      # NEVER CHANGE permission and owners
-
-    - name: Download vm cloud-init
-      ansible.builtin.get_url:
-        url: "https://cdimage.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
-        dest: "{{ node['data_path'] }}/images/debian-13-generic-amd64.qcow2"
-        owner: "console"
-        group: "svadmins"
-        mode: "0600"
-      tags: ["init", "site", "cloud-init-image"]
-
    - name: Install packages
      ansible.builtin.apt:
        name:
@@ -108,8 +83,6 @@
          - "logrotate"
          - "nftables"
          - "build-essential"
-          - "g++"
-          - "gcc"
          - "fuse3"
        state: "present"
      become: true
@@ -123,6 +96,23 @@
          tags: ["init", "site", "tools"]
      tags: ["init", "site", "tools"]

+    - name: Set vmm_init config
+      ansible.builtin.include_role:
+        name: "console"
+        tasks_from: "node/create_vmm_init"
+        apply:
+          tags: ["site", "vmm_init"]
+      tags: ["site", "vmm_init"]
+
+    - name: Download vm cloud-init
+      ansible.builtin.get_url:
+        url: "https://cdimage.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
+        dest: "{{ node['data_path'] }}/images/debian-13-generic-amd64.qcow2"
+        owner: "console"
+        group: "svadmins"
+        mode: "0600"
+      tags: ["init", "site", "cloud-init-image"]
+
    - name: Set kopia
      ansible.builtin.include_role:
        name: "common"
@@ -20,6 +20,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['fw'] }}"
+      no_log: true
      tags: ["always"]

  tasks:
@@ -20,6 +20,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['infra'] }}"
+      no_log: true
      tags: ["always"]

  tasks:
@@ -36,6 +36,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['vmm'] }}"
+      no_log: true

    - name: Create seed file
      ansible.builtin.include_role:
@@ -27,6 +27,7 @@
    - name: Set become password
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ hostvars['console']['sudo']['password']['vmm'] }}"
+      no_log: true
      tags: ["always"]
  tasks:
    # init
@@ -100,6 +101,14 @@
          tags: ["init", "linger"]
      tags: ["init", "linger"]

+    - name: Set raid
+      ansible.builtin.include_role:
+        name: "vmm"
+        tasks_from: "node/set_raid"
+        apply:
+          tags: ["init", "raid"]
+      tags: ["init", "raid"]
+
    - name: Set libvirt
      ansible.builtin.include_role:
        name: "vmm"
@@ -155,6 +164,7 @@
          - ksmtuned
          - libvirt-daemon-system
          - virt-top
+          - btrfs-progs
          - python3
          - python3-apt
          - python3-libvirt
@@ -54,18 +54,6 @@
  listen: "notification_restart_paperless"
  ignore_errors: true # noqa: ignore-errors

- name: Restart affine
-  ansible.builtin.systemd:
-    name: "affine.service"
-    state: "restarted"
-    enabled: true
-    daemon_reload: true
-    scope: "user"
-  when: is_affine_init.stat.exists
-  changed_when: false
-  listen: "notification_restart_affine"
-  ignore_errors: true # noqa: ignore-errors
-
 - name: Restart nextcloud
  ansible.builtin.systemd:
    name: "nextcloud.service"
@@ -125,3 +113,14 @@
  changed_when: false
  listen: "notification_restart_memos"
  ignore_errors: true # noqa: ignore-errors
+
+- name: Restart mealie
+  ansible.builtin.systemd:
+    name: "mealie.service"
+    state: "restarted"
+    enabled: true
+    scope: "user"
+    daemon_reload: true
+  changed_when: false
+  listen: "notification_restart_mealie"
+  ignore_errors: true # noqa: ignore-errors
@@ -0,0 +1,41 @@
+---
+- name: Check app data volume filesystem already exists
+  ansible.builtin.command:
+    cmd: "blkid /dev/{{ vm['data_storage']['name'] }}"
+  register: is_app_data
+  changed_when: false
+  failed_when: false
+  become: true
+
+- name: Create ext4 filesystem on app data raw
+  ansible.builtin.command:
+    cmd: "mkfs.ext4 -F /dev/{{ vm['data_storage']['name'] }}"
+  when: is_app_data.rc != 0
+  changed_when: true
+  become: true
+
+- name: Set data volume path
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/data"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+
+- name: Mount app data volume
+  ansible.posix.mount:
+    path: "{{ node['home_path'] }}/data"
+    src: "/dev/{{ vm['data_storage']['name'] }}"
+    opts: "noatime"
+    state: "mounted"
+    fstype: "ext4"
+  become: true
+
+- name: Set app data volume path permissions
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/data"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  become: true
@@ -4,7 +4,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/collabora/collabora.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/collabora.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_collabora"

@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['gitea']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/gitea"
@@ -18,7 +18,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/gitea/ssl/{{ root_cert_filename }}"
    owner: "{{ services['gitea']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_gitea"
@@ -38,7 +38,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/gitea/gitea.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/gitea.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_gitea"

@@ -8,7 +8,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "containers/redis"
@@ -21,7 +21,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
    dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_conf"

@@ -30,7 +30,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_containerfile"

@@ -56,7 +56,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/immich"
@@ -71,7 +71,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/immich/ssl/{{ root_cert_filename }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  notify: "notification_restart_immich"
  no_log: true
@@ -90,7 +90,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/immich.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_immich"

@@ -99,7 +99,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich-ml.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/immich-ml.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_immich-ml"

@@ -0,0 +1,77 @@
+---
+- name: Create mealie directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ services['mealie']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  loop:
+    - "data/containers/mealie"
+    - "data/containers/mealie/data"
+    - "containers/mealie"
+    - "containers/mealie/ssl"
+  become: true
+
+- name: Deploy root certificate
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ca']['root']['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/mealie/ssl/{{ root_cert_filename }}"
+    owner: "{{ services['mealie']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0440"
+  become: true
+  notify: "notification_restart_mealie"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    - name: "MEALIE_POSTGRES_PASSWORD"
+      value: "{{ hostvars['console']['postgresql']['password']['mealie'] }}"
+    - name: "MEALIE_OIDC_CLIENT_SECRET"
+      value: "{{ hostvars['console']['mealie']['oidc']['secret'] }}"
+  notify: "notification_restart_mealie"
+  no_log: true
+
+- name: Deploy mealie.container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/mealie/mealie.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/mealie.container"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0644"
+  notify: "notification_restart_mealie"
+
+- name: Enable mealie.service
+  ansible.builtin.systemd:
+    name: "mealie.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Check container archive images
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
+  register: container_archive_images
+
+- name: Save container archive images
+  containers.podman.podman_save:
+    image:
+      - "ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}"
+    dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
+    format: "oci-archive"
+    force: false
+  when: not container_archive_images.stat.exists
+
+- name: Fetch container archive images
+  ansible.builtin.fetch:
+    src: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
+    dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
+    flat: true
@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['memos']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/memos"
@@ -19,7 +19,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/memos/ssl/{{ root_cert_filename }}"
    owner: "{{ services['memos']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_memos"
@@ -33,6 +33,7 @@
        sslrootcert=/etc/ssl/memos/{{ root_cert_filename }}"
    state: "present"
    force: true
+  no_log: true
  notify: "notification_restart_memos"

 - name: Deploy memos.container file
@@ -40,7 +41,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/memos/memos.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/memos.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_memos"

@@ -8,7 +8,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "containers/redis"
@@ -21,7 +21,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
    dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_conf"

@@ -30,7 +30,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_containerfile"

@@ -48,7 +48,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['nextcloud']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/nextcloud"
@@ -69,7 +69,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/nextcloud/ssl/{{ root_cert_filename }}"
    owner: "{{ services['nextcloud']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_nextcloud"
@@ -88,8 +88,8 @@
        detach: false
        env:
          NEXTCLOUD_UPDATE: "1"
-          NEXTCLOUD_ADMIN_USER: "admin-local"
-          NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin-local']['password'] }}"
+          NEXTCLOUD_ADMIN_USER: "{{ hostvars['console']['nextcloud']['admin']['id'] }}"
+          NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin']['password'] }}"
          POSTGRES_HOST: "{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
          POSTGRES_DB: "nextcloud_db"
          POSTGRES_USER: "nextcloud"
@@ -110,14 +110,14 @@
        state: "touch"
        mode: "0644"
        owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"

 - name: Deploy config files
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/config/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/data/containers/nextcloud/html/config/{{ item }}"
    owner: "{{ services['nextcloud']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0640"
  loop:
    - "background.config.php"
@@ -132,7 +132,7 @@
  ansible.builtin.copy:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/ini/{{ item }}"
    dest: "{{ node['home_path'] }}/containers/nextcloud/ini/{{ item }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  loop:
    - "opcache.ini"
@@ -144,7 +144,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/nextcloud.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/nextcloud.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_nextcloud"

@@ -153,7 +153,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/systemd/{{ item }}"
    dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  loop:
    - "nextcloud-cron.service"
@@ -8,7 +8,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "containers/redis"
@@ -21,7 +21,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
    dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_conf"

@@ -30,7 +30,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_containerfile"

@@ -48,7 +48,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['outline']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/outline"
@@ -68,7 +68,7 @@
    state: "touch"
    mode: "0644"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
  when: not is_outline_init.stat.exists

 - name: Deploy root certificate
@@ -77,7 +77,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/outline/ssl/{{ root_cert_filename }}"
    owner: "{{ services['outline']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_outline"
@@ -106,7 +106,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/outline/outline.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/outline.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_outline"

@@ -8,7 +8,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "containers/redis"
@@ -21,7 +21,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
    dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_conf"

@@ -30,7 +30,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_containerfile"

@@ -48,7 +48,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['paperless']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/paperless"
@@ -65,7 +65,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/paperless/build/paperless.containerfile.j2"
    dest: "{{ node['home_path'] }}/containers/paperless/build/Containerfile"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0640"

 - name: Deploy root certificate
@@ -74,7 +74,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/paperless/ssl/{{ root_cert_filename }}"
    owner: "{{ services['paperless']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_paperless"
@@ -131,7 +131,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/paperless/paperless.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/paperless.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_paperless"

@@ -8,7 +8,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "containers/redis"
@@ -21,7 +21,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
    dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_conf"

@@ -30,7 +30,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  register: "is_redis_containerfile"

@@ -48,7 +48,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['sure']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/sure"
@@ -64,7 +64,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/sure/ssl/{{ root_cert_filename }}"
    owner: "{{ services['sure']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_sure"
@@ -91,7 +91,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/sure/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/{{ item }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  loop:
    - "sure-web.container"
@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "data/containers/vaultwarden"
@@ -17,7 +17,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/vaultwarden/ssl/{{ root_cert_filename }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_vaultwarden"
@@ -44,7 +44,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/vaultwarden/vaultwarden.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/vaultwarden.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_vaultwarden"

@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    state: "directory"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "authelia"
@@ -17,7 +17,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/auth/authelia/config/authelia.yaml.j2"
    dest: "{{ node['home_path'] }}/containers/authelia/config/authelia.yaml"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  become: true
  notify: "notification_restart_authelia"
@@ -29,7 +29,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/authelia/certs/{{ root_cert_filename }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  no_log: true
@@ -65,7 +65,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/auth/authelia/authelia.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/authelia.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_authelia"

@@ -22,7 +22,7 @@
    path: "{{ node['home_path'] }}/.config/systemd/user"
    state: "directory"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0700"

 - name: Create quadlet directory
@@ -30,5 +30,14 @@
    path: "{{ node['home_path'] }}/.config/containers/systemd"
    state: "directory"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0700"
+
+- name: Set data volume path
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/data"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  when: node['name'] in ["infra", "app"]
@@ -11,7 +11,7 @@
 - name: Deploy networkd files
  ansible.builtin.template:
    src: "{{ item }}"
-    dest: "/etc/systemd/network/{{ item | basename }}"
+    dest: "/etc/systemd/network/{{ item | basename | replace('.j2', '') }}"
    owner: "root"
    group: "systemd-network"
    mode: "0640"
@@ -1,5 +1,5 @@
 ---
- name: Gather system facts (hardware)
+- name: Gather ystem facts (hardware)
  ansible.builtin.setup:
    gather_subset:
      - hardware
@@ -67,6 +67,19 @@
  become: true
  notify: "notification_restart_alloy"

+- name: Set ACL for data directory
+  ansible.posix.acl:
+    path: "{{ item }}"
+    entity: "alloy"
+    etype: "user"
+    permissions: "x"
+    state: "present"
+  loop:
+    - "{{ node['home_path'] }}"
+    - "{{ node['home_path'] }}/data"
+  become: true
+  when: node['name'] == "app"
+
 - name: Enable alloy service
  ansible.builtin.systemd:
    name: "alloy.service"
@@ -4,7 +4,7 @@
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0770"
  loop:
@@ -18,7 +18,7 @@
  ansible.builtin.file:
    path: /var/log/caddy
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0755"
  become: true
@@ -48,7 +48,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/build/caddy.containerfile.j2"
    dest: "{{ node['home_path'] }}/containers/caddy/build/Containerfile"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0640"

 - name: Deploy root crt for build
@@ -56,7 +56,7 @@
    content: "{{ hostvars['console']['ca']['root']['crt'] }}"
    dest: "{{ node['home_path'] }}/containers/caddy/build/{{ root_cert_filename }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0640"
  no_log: true

@@ -77,7 +77,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/etc/{{ node['name'] }}/Caddyfile.j2"
    dest: "{{ node['home_path'] }}/containers/caddy/etc/Caddyfile"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  notify: "notification_restart_caddy"

@@ -86,7 +86,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/caddy.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/caddy.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_caddy"

@@ -315,7 +315,3 @@
    enabled: true
    daemon_reload: true
  become: true
-
-# cscli bouncers list
-# cscli machines list
-# cscli metrics
@@ -14,7 +14,7 @@
          kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
        dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
        owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
        mode: "0600"
      loop:
        - "amd64"
@@ -36,7 +36,7 @@

    - name: Connect console kopia server
      environment:
-        KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['user']['console'] }}"
+        KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['users']['console'] }}"
      ansible.builtin.shell: |
        /usr/bin/kopia repository connect server \
        --url=https://{{ services['kopia']['domain'] }}.{{ domain['internal'] }}:{{ services['kopia']['ports']['https'] }} \
@@ -11,7 +11,7 @@
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/containers"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0700"

@@ -19,7 +19,7 @@
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/data/containers"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0770"
  when: node['name'] == "app"
@@ -28,7 +28,7 @@
  ansible.builtin.file:
    path: "{{ item }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0700"
  loop:
@@ -0,0 +1,90 @@
+---
+- name: Create vmm_init directory
+  ansible.builtin.file:
+    path: "{{ node['data_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0750"
+  loop:
+    - "vmm_init"
+    - "vmm_init/grub.d"
+    - "vmm_init/modprobe.d"
+    - "vmm_init/networkd"
+    - "vmm_init/ssh"
+    - "vmm_init/ssh/sshd_config.d"
+    - "vmm_init/sysctl.d"
+
+- name: Create nftables.conf
+  ansible.builtin.template:
+    src: "{{ node['config_path'] }}/node/vmm/nftables.conf.j2"
+    dest: "{{ node['data_path'] }}/vmm_init/nftables.conf"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create grub.d iommu config
+  ansible.builtin.copy:
+    content: |
+      GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt"
+    dest: "{{ node['data_path'] }}/vmm_init/grub.d/iommu.cfg"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create modprobe.d vfio config
+  ansible.builtin.copy:
+    content: |
+      options vfio-pci ids={{ hostvars['vmm']['hardware']['igpu']['id'] }}
+      softdep i915 pre: vfio-pci
+      # softdep ahci pre: vfio-pci # sata controller
+    dest: "{{ node['data_path'] }}/vmm_init/modprobe.d/vfio.conf"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create networkd network config
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "{{ node['data_path'] }}/vmm_init/networkd/{{ item | basename | replace('.j2', '') }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+  loop: "{{ query('fileglob', hostvars['console']['node']['config_path'] + '/node/vmm/networkd/*') | sort }}"
+
+- name: Create ssh CA
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ssh']['ca']['pub'] }}
+    dest: "{{ node['data_path'] }}/vmm_init/ssh/local_ssh_ca.pub"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+
+- name: Create ssh config
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "{{ node['data_path'] }}/vmm_init/ssh/sshd_config.d/{{ item.name }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
+  loop:
+    - name: "prohibit_root.conf"
+      value: |
+        PermitRootLogin no
+    - name: "ssh_ca.conf"
+      value: |
+        TrustedUserCAKeys /etc/ssh/local_ssh_ca.pub
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Create sysctl.d bridge config
+  ansible.builtin.copy:
+    content: |
+      net.bridge.bridge-nf-call-ip6tables = 0
+      net.bridge.bridge-nf-call-iptables = 0
+      net.bridge.bridge-nf-call-arptables = 0
+    dest: "{{ node['data_path'] }}/vmm_init/sysctl.d/bridge.conf"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0640"
@@ -22,7 +22,7 @@
  run_once: true
  no_log: true

- name: Load decrypted secret vaules in console
+- name: Load decrypted secret values in console
  ansible.builtin.set_fact:
    "{{ item.key }}": "{{ item.value }}"
  loop: "{{ decrypted_secrets.stdout | from_yaml | dict2items }}"
@@ -66,8 +66,8 @@
        content: |
          {{ hostvars['console']['ssh']['ca']['key'] }}
        dest: "/run/user/{{ node['uid'] }}/local_ssh_ca_private_key"
-        owner: "console"
-        group: "svadmins"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
        mode: "0400"
      no_log: true
    - name: Sign on ssh console key (pub file)
@@ -91,7 +91,7 @@
    path: "{{ node['home_path'] }}/.ssh"
    state: "directory"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0700"

 - name: Create ssh config file
@@ -105,5 +105,5 @@
      {% endfor %}
    dest: "{{ node['home_path'] }}/.ssh/config"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
@@ -31,7 +31,7 @@
      sops_{{ version['packages']['sops'] }}_{{ item }}.deb"
    dest: "{{ node['data_path'] }}/bin/sops-{{ version['packages']['sops'] }}-{{ item }}.deb"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  loop:
    - "amd64"
@@ -43,7 +43,7 @@
      step-cli_{{ version['packages']['step'] }}-1_{{ item }}.deb"
    dest: "{{ node['data_path'] }}/bin/step-{{ version['packages']['step'] }}-{{ item }}.deb"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  loop:
    - "amd64"
@@ -44,7 +44,7 @@
  ansible.builtin.systemd:
    name: "blocky.service"
    state: "restarted"
-    enabled: "true"
+    enabled: true
    daemon_reload: true
  become: true
  changed_when: false
@@ -25,7 +25,7 @@
  become: true
  when: is_bind_installed.rc != 0

- name: Deploy acem.key
+- name: Deploy acme.key
  ansible.builtin.copy:
    content: "{{ hostvars['console']['bind']['acme_key'] }}"
    dest: "/etc/bind/acme.key"
@@ -6,7 +6,7 @@
      API_KEY={{ hostvars['console']['ddns']['api_key'] }}
    dest: "/etc/secrets/{{ node['uid'] }}/ddns.env"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0400"
  become: true
  no_log: true
@@ -16,7 +16,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/ddns/ddns.sh"
    dest: "/usr/local/bin"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0711"
  become: true

@@ -25,7 +25,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/fw/ddns/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
    validate: "/usr/bin/systemd-analyze verify %s"
  loop:
@@ -26,7 +26,7 @@
  become: true
  notify: "notification_restart_kea4"

- name: Create kea-dhcp-server.service.d
+- name: Create kea-dhcp4-server.service.d
  ansible.builtin.file:
    path: "/etc/systemd/system/kea-dhcp4-server.service.d"
    state: "directory"
@@ -35,7 +35,7 @@
    mode: "0755"
  become: true

- name: Set kea-dhcp-server.service.d/override.conf
+- name: Set kea-dhcp4-server.service.d/override.conf
  ansible.builtin.copy:
    dest: "/etc/systemd/system/kea-dhcp4-server.service.d/override.conf"
    content: |
@@ -2,7 +2,7 @@
  ansible.builtin.systemd:
    name: "ca.service"
    state: "restarted"
-    enabled: "true"
+    enabled: true
    daemon_reload: true
    scope: "user"
  changed_when: false
@@ -3,7 +3,7 @@
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0770"
  loop:
@@ -29,7 +29,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/containers/ca/config/{{ item }}"
    owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0400"
  loop:
    - "ca.json"
@@ -43,7 +43,7 @@
      {{ item.value }}
    dest: "{{ item.path }}/{{ item.name }}"
    owner: "{{ services['ca']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "{{ item.mode }}"
  loop:
    - name: "{{ root_cert_filename }}"
@@ -67,7 +67,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/ca.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/ca.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_ca"

@@ -3,7 +3,7 @@
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0770"
  loop:
@@ -11,6 +11,7 @@
    - "grafana/data"
    - "grafana/etc"
    - "grafana/etc/provisioning"
+    - "grafana/etc/provisioning/datasources"
    - "grafana/etc/dashboards"
    - "grafana/ssl"
  become: true
@@ -21,7 +22,7 @@
      {{ hostvars['console']['ca']['root']['crt'] }}
    dest: "{{ node['home_path'] }}/containers/grafana/ssl/{{ root_cert_filename }}"
    owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0400"
  become: true
  notify: "notification_restart_grafana"
@@ -39,16 +40,16 @@
    - name: "LDAP_BIND_PASSWORD"
      value: "{{ hostvars['console']['ldap']['password']['grafana'] }}"
    - name: "GF_ADMIN_PASSWORD"
-      value: "{{ hostvars['console']['grafana']['user']['password'] }}"
+      value: "{{ hostvars['console']['grafana']['admin']['password'] }}"
  notify: "notification_restart_grafana"
  no_log: true

- name: Deploy configruation files
+- name: Deploy configuration files
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/containers/grafana/etc/{{ item }}"
    owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0400"
  loop:
    - "grafana.ini"
@@ -62,7 +63,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/etc/provisioning/datasources/datasources.yaml.j2"
    dest: "{{ node['home_path'] }}/containers/grafana/etc/provisioning/datasources/datasources.yaml"
    owner: "{{ services['grafana']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0400"
  become: true
  notify: "notification_restart_grafana"
@@ -72,7 +73,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/grafana.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/grafana.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_grafana"

@@ -3,7 +3,7 @@
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    owner: "{{ services['ldap']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0770"
  loop:
@@ -18,7 +18,7 @@
      {{ item.value }}
    dest: "{{ node['home_path'] }}/containers/ldap/ssl/{{ item.name }}"
    owner: "{{ services['ldap']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "{{ item.mode }}"
  loop:
    - name: "{{ root_cert_filename }}"
@@ -33,8 +33,8 @@
      value: "{{ hostvars['console']['ldap']['key'] }}"
      mode: "0400"
  become: true
-  notify: "notification_restart_ldap"
  no_log: true
+  notify: "notification_restart_ldap"

 - name: Register secret value to podman secret
  containers.podman.podman_secret:
@@ -51,14 +51,15 @@
      value: "{{ hostvars['console']['ldap']['seed_key'] }}"
    - name: "LLDAP_JWT_SECRET"
      value: "{{ hostvars['console']['ldap']['jwt_secret'] }}"
-  notify: "notification_restart_ldap"
  no_log: true
+  notify: "notification_restart_ldap"

 - name: Initiate ldap (When = false, If DB data does not exist in postgresql, activate this block)
 # The reason why this task doesn't use the way to check ".init" file is this tasks can override original database.
 # Absent of ".init" file cannot guarantee DB is empty.
  when: false
  become: true
+  no_log: true
  block:
    - name: Register extra secret value to podman secret
      containers.podman.podman_secret:
@@ -97,7 +98,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ldap/ldap.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/ldap.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_ldap"

@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    state: "directory"
    owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "loki"
@@ -18,7 +18,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/etc/loki.yaml.j2"
    dest: "{{ node['home_path'] }}/containers/loki/etc/loki.yaml"
    owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  become: true
  notify: "notification_restart_loki"
@@ -30,7 +30,7 @@
      {{ item.value }}
    dest: "{{ node['home_path'] }}/containers/loki/ssl/{{ item.name }}"
    owner: "{{ services['loki']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "{{ item.mode }}"
  loop:
    - name: "{{ root_cert_filename }}"
@@ -53,7 +53,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/loki.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/loki.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_loki"

@@ -3,33 +3,33 @@
  ansible.builtin.set_fact:
    connected_services:
      - "ldap"
-      - "authelia"
      - "grafana"
+      - "authelia"
      - "vaultwarden"
      - "gitea"
      - "immich"
      - "paperless"
-      - "affine"
      - "nextcloud"
      - "sure"
      - "outline"
      - "memos"
+      - "mealie"

 - name: Create postgresql directory
  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/containers/{{ item }}"
+    path: "{{ node['home_path'] }}/{{ item }}"
    state: "directory"
    owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
-    - "postgresql"
-    - "postgresql/data"
-    - "postgresql/config"
-    - "postgresql/ssl"
-    - "postgresql/init"
-    - "postgresql/backups"
-    - "postgresql/build"
+    - "data/containers/postgresql/backups"
+    - "containers/postgresql"
+    - "containers/postgresql/data"
+    - "containers/postgresql/config"
+    - "containers/postgresql/ssl"
+    - "containers/postgresql/init"
+    - "containers/postgresql/build"
  become: true

 - name: Deploy containerfile for build
@@ -37,7 +37,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/build/postgresql.containerfile.j2"
    dest: "{{ node['home_path'] }}/containers/postgresql/build/Containerfile"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0640"

 - name: Build postgresql container image
@@ -57,7 +57,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/config/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/containers/postgresql/config/{{ item }}"
    owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  loop:
    - "postgresql.conf"
@@ -72,7 +72,7 @@
      {{ item.value }}
    dest: "{{ node['home_path'] }}/containers/postgresql/ssl/{{ item.name }}"
    owner: "{{ services['postgresql']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "{{ item.mode }}"
  loop:
    - name: "{{ root_cert_filename }}"
@@ -97,24 +97,26 @@
  register: "is_postgresql_init"

 - name: Prepare initiating DB
-  when: not is_postgresql_init.stat.exists
+  when:
+    - not is_postgresql_init.stat.exists
+    - (connected_services | default([]) | length) > 0
  become: true
  block:
    # `init/pg_cluster.sql` should be fetched from postgresql's backup directory before running initiating
    - name: Deploy init cluster sql file
      ansible.builtin.copy:
        src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_cluster.sql"
-        dest: "{{ node['home_path'] }}/containers/postgresql/init/0_pg_cluster.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/00_pg_cluster.sql"
        owner: "{{ services['postgresql']['subuid'] }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
        mode: "0600"

    - name: Deploy restoring data sql files
      ansible.builtin.copy:
        src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_{{ item }}.sql"
-        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ index_num + 1 }}_pg_{{ item }}.sql"
+        dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ '%02d' | format(index_num + 1) }}_pg_{{ item }}.sql"
        owner: "{{ services['postgresql']['subuid'] }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"
        mode: "0600"
      loop: "{{ connected_services }}"
      loop_control:
@@ -126,14 +128,14 @@
        state: "touch"
        mode: "0644"
        owner: "{{ ansible_user }}"
-        group: "svadmins"
+        group: "{{ node['group'] }}"

 - name: Deploy container file
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/postgresql.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/postgresql.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_postgresql"

@@ -142,7 +144,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/services/{{ item }}"
    dest: "{{ node['home_path'] }}/.config/systemd/user/{{ item }}"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  loop:
    - "postgresql-cluster-backup.service"
@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    state: "directory"
    owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "prometheus"
@@ -18,7 +18,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/etc/{{ item }}.j2"
    dest: "{{ node['home_path'] }}/containers/prometheus/etc/{{ item }}"
    owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0600"
  loop:
    - "prometheus.yaml"
@@ -34,7 +34,7 @@
      {{ item.value }}
    dest: "{{ node['home_path'] }}/containers/prometheus/ssl/{{ item.name }}"
    owner: "{{ services['prometheus']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "{{ item.mode }}"
  loop:
    - name: "{{ root_cert_filename }}"
@@ -57,7 +57,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/prometheus.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/prometheus.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_prometheus"

@@ -4,7 +4,7 @@
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    state: "directory"
    owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0770"
  loop:
    - "x509-exporter"
@@ -17,7 +17,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/config/config.yaml"
    dest: "{{ node['home_path'] }}/containers/x509-exporter/config/config.yaml"
    owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  become: true
  notify: "notification_restart_x509-exporter"
@@ -28,7 +28,7 @@
      {{ item.value }}
    dest: "{{ node['home_path'] }}/containers/x509-exporter/certs/{{ item.name }}"
    owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0440"
  loop:
    - name: "root.crt"
@@ -57,7 +57,7 @@
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/x509-exporter.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/x509-exporter.container"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_x509-exporter"

@@ -9,15 +9,16 @@

 - name: Check libvirt directory
  ansible.builtin.stat:
-    path: "/var/lib/libvirt/{{ item }}"
+    path: "{{ node['libvirt_path'] }}/{{ item }}"
  loop:
    - "images"
    - "seeds"
+    - "data"
  register: "is_libvirt_dir"

 - name: Create libvirt directory
  ansible.builtin.file:
-    path: "/var/lib/libvirt/{{ item.item }}"
+    path: "{{ node['libvirt_path'] }}/{{ item.item }}"
    state: "directory"
    owner: "root"
    group: "root"
@@ -72,6 +73,7 @@
  loop:
    - "images-pool"
    - "seeds-pool"
+    - "data-pool"

 - name: Start virtual storage pool
  community.libvirt.virt_pool:
@@ -81,6 +83,7 @@
  loop:
    - "images-pool"
    - "seeds-pool"
+    - "data-pool"

 - name: Autostart virtual storage pool
  community.libvirt.virt_pool:
@@ -90,3 +93,4 @@
  loop:
    - "images-pool"
    - "seeds-pool"
+    - "data-pool"
@@ -18,16 +18,17 @@
 - name: Set hard disk path
  ansible.builtin.shell: |
    set -o pipefail
-    ls -1 /dev/disk/by-path/*{{ vm['pass_through']['sata_controller']['address'] }}* | \
-    grep -v '\.0$' | \
+    ls -1 /dev/disk/by-id/ata-* | \
+    grep -F -e "{{ hardware['hdd']['data'].values() | join('" -e "') }}" | \
+    grep -vE -- '-part[0-9]+$' | \
    sort
  changed_when: false
  register: "hdd_path_list"

- name: Check app_hdd filesystem already exists
+- name: Check vmm_hdd filesystem already exists
  ansible.builtin.command: |
-    blkid -L {{ storage['btrfs']['label'] }}
-  register: is_app_data
+    blkid -L {{ hardware['btrfs']['label'] }}
+  register: is_vmm_data
  changed_when: false
  failed_when: false
  become: true
@@ -40,38 +41,47 @@
 - name: Set btrfs raid10 volume
  ansible.builtin.shell: |
    mkfs.btrfs -f \
-    -L {{ storage['btrfs']['label'] }} \
-    -d {{ storage['btrfs']['level'] }} \
-    -m {{ storage['btrfs']['level'] }} \
+    -L {{ hardware['btrfs']['label'] }} \
+    -d {{ hardware['btrfs']['level'] }} \
+    -m {{ hardware['btrfs']['level'] }} \
    {{ hdd_path_list.stdout_lines | join(' ') }}
  become: true
  when:
-    - is_app_data.rc != 0
+    - is_vmm_data.rc != 0
    - (hdd_path_list.stdout_lines | length) >= 4
  changed_when: is_mkfs.rc == 0
  register: "is_mkfs"

- name: Mount btrfs raid10 volume
-  ansible.posix.mount:
-    path: "{{ storage['btrfs']['mount_point'] }}"
-    src: "LABEL={{ storage['btrfs']['label'] }}"
-    state: "mounted"
-    fstype: "btrfs"
-    opts: "defaults,noatime,compress=zstd:3,autodefrag,degraded,nofail"
+- name: Create mount volume
+  ansible.builtin.file:
+    path: "{{ hardware['btrfs']['mount_point'] }}"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0711"
  become: true

- name: Set hard disk path permissions
+- name: Mount btrfs raid10 volume
+  ansible.posix.mount:
+    path: "{{ hardware['btrfs']['mount_point'] }}"
+    src: "LABEL={{ hardware['btrfs']['label'] }}"
+    state: "mounted"
+    fstype: "btrfs"
+    opts: "defaults,noatime,nodatacow,degraded,nofail"
+  become: true
+
+- name: Set mounted btrfs volume permissions
  ansible.builtin.file:
-    path: "{{ storage['btrfs']['mount_point'] }}"
+    path: "{{ hardware['btrfs']['mount_point'] }}"
    state: "directory"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0770"
+    owner: "root"
+    group: "root"
+    mode: "0711"
  become: true

 - name: Deploy btrfs scrub service and timer
  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/app/btrfs/{{ item }}.j2"
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/vmm/btrfs/{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: "root"
    group: "root"
@@ -1,13 +1,13 @@
 ---
 # This task is located in vmm roles because of its attributes,
 # but all process should be run in "console".
-# At the playbook, `delegate_to: "console"` option is applyed by `apply:`.
+# At the playbook, `delegate_to: "console"` option is applied by `apply:`.
 - name: Create images directory
  ansible.builtin.file:
    path: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}"
    state: "directory"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
    mode: "0700"

 - name: Create temp meta-data
@@ -16,8 +16,8 @@
      instance-id: vm-{{ target_vm }}
      local-hostname: {{ target_vm }}
    dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/meta-data"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
    mode: "0600"
  register: "vm_meta_data"
  no_log: true
@@ -26,8 +26,8 @@
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/vmm/libvirt/seeds/user-data.j2"
    dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/user-data"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
    mode: "0600"
  register: "vm_user_data"
  no_log: true
@@ -37,8 +37,8 @@
    content: |
      network: {config: disabled}
    dest: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/network-config"
-    owner: "console"
-    group: "svadmins"
+    owner: "{{ hostvars['console']['node']['name'] }}"
+    group: "{{ hostvars['console']['node']['group'] }}"
    mode: "0600"
  register: "vm_network_config"
  no_log: true
@@ -1,16 +1,16 @@
 ---
 - name: Check vm cloud-init
  ansible.builtin.stat:
-    path: "/var/lib/libvirt/images/debian-13.qcow2"
+    path: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
  become: true
  register: is_cloud_init_file

 - name: Deploy vm cloud-init
  ansible.builtin.copy:
    src: "{{ hostvars['console']['node']['data_path'] }}/images/debian-13-generic-amd64.qcow2"
-    dest: "/var/lib/libvirt/images/debian-13.qcow2"
+    dest: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
    force: false
  become: true
@@ -18,10 +18,10 @@

 - name: Remote copy vm cloud-init file
  ansible.builtin.copy:
-    src: "/var/lib/libvirt/images/debian-13.qcow2"
-    dest: "/var/lib/libvirt/images/{{ target_vm }}.qcow2"
+    src: "{{ node['libvirt_path'] }}/images/debian-13.qcow2"
+    dest: "{{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
    remote_src: true
    force: false
@@ -29,7 +29,7 @@

 - name: Check deployed cloud-init file info
  ansible.builtin.command:
-    cmd: "qemu-img info /var/lib/libvirt/images/{{ target_vm }}.qcow2 --output json"
+    cmd: "qemu-img info {{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2 --output json"
  changed_when: false
  failed_when:
    - deployed_cloudfile_info.rc != 0
@@ -38,18 +38,37 @@

 - name: Resize deployed cloud-init file
  ansible.builtin.command:
-    cmd: "qemu-img resize /var/lib/libvirt/images/{{ target_vm }}.qcow2 {{ hostvars[target_vm]['vm']['storage'] }}G"
+    cmd: "qemu-img resize {{ node['libvirt_path'] }}/images/{{ target_vm }}.qcow2 {{ hostvars[target_vm]['vm']['storage'] }}G"
  when:
    - deployed_cloudfile_info.rc == 0
    - (deployed_cloudfile_info.stdout | from_json)['virtual-size'] < (hostvars[target_vm]['vm']['storage'] | int * 1024 * 1024 * 1024)
  changed_when: true

+- name: Check app data raw image
+  ansible.builtin.stat:
+    path: "{{ hardware['btrfs']['mount_point'] }}/{{ target_vm }}.raw"
+    get_checksum: false
+    get_mime: false
+    get_attributes: false
+  when: target_vm == "app"
+  register: "is_app_data"
+
+- name: Create app data raw image
+  ansible.builtin.command:
+    # 3.5T
+    cmd: "qemu-img create -f raw {{ hardware['btrfs']['mount_point'] }}/{{ target_vm }}.raw {{ hostvars[target_vm]['vm']['data_storage']['size'] }}T"
+  become: true
+  when:
+    - target_vm == "app"
+    - not is_app_data.stat.exists
+  changed_when: true
+
 - name: Deploy vm seed.iso
  ansible.builtin.copy:
    src: "{{ hostvars['console']['node']['data_path'] }}/images/seeds/{{ target_vm }}/seed.iso"
-    dest: "/var/lib/libvirt/seeds/{{ target_vm }}_seed.iso"
+    dest: "{{ node['libvirt_path'] }}/seeds/{{ target_vm }}_seed.iso"
    owner: "{{ ansible_user }}"
-    group: "svadmins"
+    group: "{{ node['group'] }}"
    mode: "0644"
  become: true
  when: deployed_cloudfile_info.rc == 0
@@ -16,6 +16,9 @@
 {{ hostvars['fw']['network6']['infra']['server'] }} infra.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['auth']['server'] }} auth.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['app']['server'] }} app.{{ domain['internal'] }}
+# kopia repository
+{{ hostvars['fw']['network4']['nas']['client'] }} nas.{{ domain['internal'] }}
+{{ hostvars['fw']['network6']['nas']['client'] }} nas.{{ domain['internal'] }}
 {% else %}
 # IPv4
 # Crowdsec, blocky, bind(fw)
@@ -78,7 +78,7 @@ table inet filter {
        set crowdsec6-blacklists {
                type ipv6_addr
                flags timeout
-        }        
+        }
        chain global {
                # invalid packets
                ct state invalid drop comment "deny invalid connection"
@@ -114,7 +114,7 @@ table inet filter {
                iifname "lo" accept comment "allow local connection: FW > FW"
                udp dport $PORTS_VPN accept comment "allow vpn connection: > FW"
                iifname { $IF_CLIENT, $IF_SERVER, $IF_USER, $IF_WG } meta l4proto { icmp, icmpv6 } accept comment "allow icmp, icmpv6 connection: CLIENT/SERVER/USER/WG > FW"
-                iifname { $IF_CLIENT, $IF_SERVER, $IF_USER, $IF_WG } udp dport $PORTS_NTP accept comment "allow ntp connection: CLIENT/SERVER/USER/WG > FW"
+                iifname { $IF_CLIENT, $IF_SERVER, $IF_WG } udp dport $PORTS_NTP accept comment "allow ntp connection: CLIENT/SERVER/USER/WG > FW"
                # Global chain contains "WAN !> :SSH_PORT"
                ip saddr $HOSTS4_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv4 ssh connection: CONSOLE > FW"
                ip6 saddr $HOSTS6_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv6 ssh connection: CONSOLE > FW"
@@ -1,5 +0,0 @@
-[Match]
-MACAddress=c8:ff:bf:05:aa:b0
-
-[Link]
-Name=eth0
@@ -0,0 +1,5 @@
+[Match]
+MACAddress={{ hostvars['vmm']['hardware']['mac']['nic0'] }}
+
+[Link]
+Name=eth0
@@ -1,5 +0,0 @@
-[Match]
-MACAddress=c8:ff:bf:05:aa:b1
-
-[Link]
-Name=eth1
@@ -0,0 +1,5 @@
+[Match]
+MACAddress={{ hostvars['vmm']['hardware']['mac']['nic1'] }}
+
+[Link]
+Name=eth1
@@ -1,28 +0,0 @@
-[Match]
-Name=vlan1
-
-[Network]
-# IPv4
-Address=192.168.1.10/24
-# IPv6
-Address=fd00:1::10/64
-
-[RoutingPolicyRule]
-From=192.168.1.10/32
-Table=1
-Priority=100
-
-[Route]
-Destination=192.168.1.0/24
-Scope=link
-Table=1
-
-[RoutingPolicyRule]
-From=fd00:1::10/128
-Table=61
-Priority=100
-
-[Route]
-Destination=fd00:1::/64
-Scope=link
-Table=61
@@ -0,0 +1,28 @@
+[Match]
+Name=vlan1
+
+[Network]
+# IPv4
+Address={{ hostvars['fw']['network4']['vmm']['client'] }}/24
+# IPv6
+Address={{ hostvars['fw']['network6']['vmm']['client'] }}/64
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network4']['vmm']['client'] }}/32
+Table=1
+Priority=100
+
+[Route]
+Destination={{ hostvars['fw']['network4']['subnet']['client'] }}
+Scope=link
+Table=1
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network6']['vmm']['client'] }}/128
+Table=61
+Priority=100
+
+[Route]
+Destination={{ hostvars['fw']['network6']['subnet']['client'] }}
+Scope=link
+Table=61
@@ -1,32 +0,0 @@
-[Match]
-Name=vlan10
-[Network]
-RequiredForOnline=false
-# IPv4
-Address=192.168.10.10/24
-Gateway=192.168.10.1
-DNS=192.168.10.2
-# IPv6
-Address=fd00:10::10/64
-Gateway=fd00:10::1
-DNS=fd00:10::2
-
-[RoutingPolicyRule]
-From=192.168.10.10/32
-Table=2
-Priority=100
-
-[Route]
-Destination=0.0.0.0/0
-Gateway=192.168.10.1
-Table=2
-
-[RoutingPolicyRule]
-From=fd00:10::10/128
-Table=62
-Priority=100
-
-[Route]
-Destination=::/0
-Gateway=fd00:10::1
-Table=62
@@ -0,0 +1,32 @@
+[Match]
+Name=vlan10
+[Network]
+RequiredForOnline=false
+# IPv4
+Address={{ hostvars['fw']['network4']['vmm']['server'] }}/24
+Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
+DNS={{ hostvars['fw']['network4']['blocky']['server'] }}
+# IPv6
+Address={{ hostvars['fw']['network6']['vmm']['server'] }}/64
+Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
+DNS={{ hostvars['fw']['network6']['blocky']['server'] }}
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network4']['vmm']['server'] }}/32
+Table=2
+Priority=100
+
+[Route]
+Destination=0.0.0.0/0
+Gateway={{ hostvars['fw']['network4']['firewall']['server'] }}
+Table=2
+
+[RoutingPolicyRule]
+From={{ hostvars['fw']['network6']['vmm']['server'] }}/128
+Table=62
+Priority=100
+
+[Route]
+Destination=::/0
+Gateway={{ hostvars['fw']['network6']['firewall']['server'] }}
+Table=62
@@ -3,7 +3,7 @@

 set -e

-# Varibles
+# Variables
 KEY_PATH="$HOME/workspace/homelab/config/secrets"
 TMP_PATH="/run/user/$UID"
 SECRET_FILE="$1"
@@ -72,7 +72,7 @@ echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
 --decrypt "$KEY_PATH/age-key.gpg" &&\
 chmod 600 "$TMP_PATH/age-key"

-# Unset environment varibles
+# Unset environment Variables
 unset GPG_PASSPHRASE

 # Check the key on memory
@@ -59,10 +59,10 @@ wireguard:
 #ENC[AES256_GCM,data:+kiy17Z7q3EiPgo4Ykk=,iv:vOi54XHHLNIO9U0ybpU9Cn68Ymj5W4vtQ2OhTkGAmRo=,tag:h3wdCo5UfNGlHqMpeeBf/A==,type:comment]
 kopia:
    repository: ENC[AES256_GCM,data:16V50bVVtecbF+TJcXHCx46ZPGNMgAhUOA0YbZHVTsCrOWQvTvcK2k8Iq3E=,iv:/wNbrE5GaFiQPNEp8wZ0JehbXkmah/gPm5ywNE6WVVM=,tag:vW82KTKtJ44++tqXON/SYw==,type:str]
-    user:
-        console: ENC[AES256_GCM,data:LZQEz7JS8CMMSlGB2/FS15VHAbko6YpCaWDZDa9tXVnmYLwFs8F39/u8kLI=,iv:WrYox/3LweqafWl96fxmezTFhKHB/2XSDSLwHljdpw0=,tag:bPwqkdeexXItkbpPQQ6klg==,type:str]
-        infra: ENC[AES256_GCM,data:fwvu96Zhao5RthZptxhuv2NobY1riQzpvD4Ardc8UTwN6+HyfFVR31yTTqk=,iv:jqFEKsP2npZgeRL3E3Va7oLzbHShBO4FxLRYwnfLtys=,tag:qXescWki6oPaaSrhMsUw9g==,type:str]
-        app: ENC[AES256_GCM,data:VVs8lfo8ZsbYfeKIwtaFCrpV82SguR/xxNnMZXXp8YOBP+6F2Vs5jeDtTTs=,iv:L2mS2RhiUlB9Oq4gwVs8WNF4r8vYv6zg6Fqnpe9hSoM=,tag:WYjtPdD2Lny9Kc+dWVupjw==,type:str]
+    users:
+        console: ENC[AES256_GCM,data:v1QY7h6vMmzYq/PTmnLg3M5Iwc/Ljr/1M3nJGuUJMfPN2ATY+GIMUyhYu+0=,iv:32c4YrZfTiu7sv/c9tDItmAE8G1lvc1sm6JD1GRkYr0=,tag:kj1a32+bMUsRdusadoXDvg==,type:str]
+        infra: ENC[AES256_GCM,data:WdugcvTJEy3/kxjCMeN16u96XM+59sOBF/z88p9f0lPVzi78ZmIZPjf835M=,iv:6G4rry8fCjhB+MF5B3TVf1w0LDSA6farVwyxAp8nKQE=,tag:+mCSrVmo7zuj782swmRFPw==,type:str]
+        app: ENC[AES256_GCM,data:5A17rXYUBPkFRpcHTOBCGmm9j6uMHtvKkLTpHsYZeRJkoSrA4k9IhVpjNA0=,iv:kJzowaheVckLUKae6xXeIVi+Jc+Mhee/jjmS91im9dc=,tag:f1uXU6JRD4mxAYMlFTWoew==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -117,11 +117,11 @@ postgresql:
        gitea: ENC[AES256_GCM,data:l+pBCzyQa3000SE9z1R4htD0V0ONsBtKy92dfgsVYsZ3XlEyVJDIBOsugwM=,iv:5t/oHW1vFAmV/s2Ze/cV9Vuqo96Qu6QvZeRbio7VX2s=,tag:4zeQaXiXIzBpy+tXsxmN7Q==,type:str]
        immich: ENC[AES256_GCM,data:11jvxTKA/RL0DGL6y2/X092hnDohj6yTrYGK4IVojqBd1gCOBnDvUjgmx14=,iv:oBfHxsx9nxhyKY/WOuWfybxEX2bf+lHEtsaifFRS9lg=,tag:tAfkBdgQ8ZEkLIFcDICKDw==,type:str]
        paperless: ENC[AES256_GCM,data:6VBrBbjVoam7SkZCSvoBTdrfkUoDghdGTiBmFLul04X/okXOHeC5zusJffY=,iv:iZumcJ3TWwZD77FzYx8THwCqC+EbnXUBrEKuPh3zgV8=,tag:u2m8SppAdxZ/duNdpuS3oQ==,type:str]
-        affine: ENC[AES256_GCM,data:XPXrcszsV06YqCJZ7CDqc4rCwqqNlbtLCFYfLAQ8jamLtft8L2UVrMA4WZo=,iv:vrWdBeckxB9tmEE628j4jhU+hSpE6TXYMGt0hh1Cg84=,tag:hlWwWUGht8NqWTZREMsa1Q==,type:str]
        nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
        sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
        outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str]
        memos: ENC[AES256_GCM,data:BaNTnZFZH4oMTnDkgrf2/fMTkO43rc9bSsgnDWrHJ/Z6+MZdMitpIMkrMN4=,iv:JsG3B0YweZYO96MW9NmoSsIG++gFq+jRUsozwJtWl3M=,tag:orLTUiW0inOJdD4YSp4baQ==,type:str]
+        mealie: ENC[AES256_GCM,data:XbYHQv6HBWCXUBRmcbQZN5Y1Gw+V+Wra28Mp+m+ZGl8VRXsKMu5507vGHQM=,iv:zp4ZarqG9KshiBV8F8UksfI2QXmXHwqPw631r/5bYy8=,tag:jvsvXrUsCvpQGIbLV9jTYQ==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -139,8 +139,9 @@ ldap:
        user: ENC[AES256_GCM,data:DT9h51o6z70A4QeoKvCbUo98JFxILgB5tkHeX60CZuCl0GHTa//mRpIUEvo=,iv:Pa9iqXeKDHHBz524zeRImYEkXmY50s7Z+Z4KYt3sNT4=,tag:UTS5VIqbRA66UVDrDXwuPQ==,type:str]
        authelia: ENC[AES256_GCM,data:G8ZGsLKqEmMzQ5NMAgirF5BQraHNqixtI6dyyaeNhTdXebjJZML52xL36p4=,iv:ZtHAsFYmrQxr+qoQLPW/eme0+nsT148KRsXmW/LNLlU=,tag:Pvjs/eylkgxJpmGBsRmjcw==,type:str]
        grafana: ENC[AES256_GCM,data:vWmU3ZKcolETWAY74C3OMD8gMXDeYk+DqssACL0xefIPi5IkbrhYWmnWAnA=,iv:wcRms3Zp8kPM4USRPVa0UHpCTK36SWhK9C8yHSWu2Cs=,tag:gU5S/6fdMZVd/ih3Yd5uJA==,type:str]
-        il: ENC[AES256_GCM,data:/CyMeo1+rIUAYiB25nI0,iv:jsyiiRN5z9GqcUnTZ0CZo4s+umTc2zeY2FPp+tVOC9o=,tag:cwOHcqMysCxX57w3a+Pzpg==,type:str]
-        morsalin: ENC[AES256_GCM,data:YryNch8hF6rx,iv:bNIBur3Jcib8BvKjJ0MejpemsurYTP8rCxo6b2R5yEo=,tag:9dIIgqEPtbeixtgJ1OtMnQ==,type:str]
+    users:
+        il: ENC[AES256_GCM,data:9b9OU4Nt60/XdUrwnhJh,iv:7ZqOYqM2aibgcFRxw1ZvOdBJMZUfOVbNa+2sMzrXAns=,tag:x87IG/HETASiC9/HwyW1Ig==,type:str]
+        morsalin: ENC[AES256_GCM,data:rERjBNLZXSKT,iv:VuD8ZGfrd0wQ/5TCgLhLN459ZHPepcZyv8Kdl7TsMc4=,tag:Xp/fjve1xn0Wjk7ExShCLw==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -160,9 +161,9 @@ loki:
 #
 #ENC[AES256_GCM,data:yHgd8KBDPYeMjKzUOimdOA==,iv:ozyRymtPEII2luBads2GHyLf4Vdhf4EXNaF82SNmQm4=,tag:1mOJAmR5kVRBjm0SbQkqlw==,type:comment]
 grafana:
-    user:
-        id: ENC[AES256_GCM,data:32LNqOb8pzi0/18=,iv:YJrYaQRE+veDhaEUefGWLbNJo1toHGmEOpqrNV3IDfg=,tag:ENryvH9ec3EbDhBB2bdHug==,type:str]
-        password: ENC[AES256_GCM,data:MFw7TAvzpL0EW2o+w6hF5qrLYVkn0HsQOXqBk9AQq7GxK4uAEDCi/YL3goI=,iv:HSpJL2CZKXHQYhOJLy6HzWARootl8Y1yMGhaMT0XRfM=,tag:t0VHDYHCZJwDcR1VcRFdCw==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:qwz/L8jQXvZKlic=,iv:s0PL4GwTvr/SfzuFgZESADnepagt+QKwt8XmqsMLr0c=,tag:2ozh3jpPFuqXJAx/DpgF6A==,type:str]
+        password: ENC[AES256_GCM,data:BDTWzGBsyr6dw3tQSCn5tFDk0IZxNc/Y6LYX6ytn1EpLhBr2CW3YE5Dsk7g=,iv:cbYmvG3EZO5ytYtoIAKpewdE81NMqP4YXrdsj7n87SA=,tag:wuFamPPldQYJAKeX7zLFnA==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -184,18 +185,25 @@ vaultwarden:
    admin:
        password: ENC[AES256_GCM,data:FzD80H5lPNyjTRGd/IcIGir35KLF8gN3qmTzEQrlfutHh08mk0Vh9X8irHA=,iv:cfn5432g2MvkuBJLB2zDJmU0sLgMefVvpy0bP/4/oPY=,tag:7MHEv8XswdQZNTARvxs55g==,type:str]
        hash: ENC[AES256_GCM,data:Ae7bhnL5pxfNV3+r/PCDIpxx0tHcNiB/s4sm7OoxVpp+tcEpXZ9vsv38sZjx+Z8t2vlmiYHc72PEdapcAihleuLMBPM1dAVn8LqzzWtVhfmCOoUZI8Z5L3VL8eyyz6npiw==,iv:c2MEIbrnVsR+bUx3zLLTnKSElFTH7JRl23HmmTlWEBg=,tag:mnMrER9pQEKAdloYMeRa3g==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:mhLb55ENatpE59Rbzk2Uq6iBKc0Jj/9x4fOANJOHR0WvSxTQRKJ94cCq9Ykp/chWbdgYYPrwU5oD0Yo17zqb,iv:6bzKq5WaKhuOsQ8zSSH9ZrQYbDPB1nv/bFoQou1ycL4=,tag:bSmuUodl+/9nzxZ7YBoezA==,type:str]
-    morsalin:
-        password: ENC[AES256_GCM,data:ibg5/MfLH7pSY2pEmjM=,iv:+aV5muP/9BYoKwTGQxKEL+IGY9P+O3GVKGgSuTzT+U0=,tag:rgqcmJvd1RtvWJ91PCxYIg==,type:str]
+    users:
+        il:
+            id: ENC[AES256_GCM,data:V4kWLbzhIM7ONCt7PtxB56oilw==,iv:b9mkOmmOmyvlYI11ASRh4GQl3NxnvtoC9jAx5DuRSwM=,tag:Eo5a5UnvGVXY1jofbMgqQQ==,type:str]
+            password: ENC[AES256_GCM,data:Ay0aPgrP75z3n/xyELAPhi4Ov4a62M3lhtpByDkc++TGq+a2bmpdt0OhBfsCSjY/6ads1EUhqQYscTE86Eln,iv://EEyABWzFn9kiKxjz92zKbzUtbnAPf9oNxf9s0nlLo=,tag:cZpqyTXJuO2yQByHMTWwtA==,type:str]
+        morsalin:
+            id: ENC[AES256_GCM,data:fXTVMR2iUa1lfyLjG3UI1Xuys80ylFEQ+A==,iv:KqRhjFULUc9BjGEepBu9I3aZparaxRhLos8Ztz3jPyE=,tag:1E8DgiXt810B7UYZLE+0yw==,type:str]
+            password: ENC[AES256_GCM,data:e8H0wYtCbVEDDXctbJQ=,iv:Bewk1rEsDPD5NVzZfEM2QfzNttwklI6KL7kFgFU3qvY=,tag:0U8Vg39ZD05AWMp6hQkkzA==,type:str]
+        eunkyoung:
+            id: ENC[AES256_GCM,data:OubNz5ueQU/KksljCvS/X29rhDjvipkgzik=,iv:mULicCrst9ciC7lAJrYIPV8Kx4Z/JAEbupO/Kti5DoA=,tag:0U/WQnZ8ZCL5yfkbd7Y6oA==,type:str]
+            password: ENC[AES256_GCM,data:M3MqxQTZdd+SS/nd,iv:KEBZ8eBAwVm0mTwDf3bJRWwtUN/M+an6BMV9N34pXq4=,tag:Qxxca3kq5NH6YbJWK002Gg==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
 #ENC[AES256_GCM,data:HAN9BBEl1CW11LAf3x8=,iv:hwqCErtmPqGJ+y86D9MoxJwixvbcJONlyT900Y5DOug=,tag:kCxsG353ltbOCKLe85adCg==,type:comment]
 gitea:
-    il:
-        password: ENC[AES256_GCM,data:Bs5/t5mNbSv5+ek9gNHZp5qqxitM4Kq0Xgh2JV6LiFw9lZJSOVT4JPLRP5M=,iv:z50+naWOTVL8lEgBgm51j6hLjS8ve2UcRRKukvtykM0=,tag:TF9rPxjoLe/vAyvl23PiCg==,type:str]
-        token: ENC[AES256_GCM,data:CiYEXEKLLRDp++iga5YmhyPB2bSvqhhDgSOhmiulp9n9SsBVQ3s5MQ==,iv:+oetgEH/IORz74Xoz5zgDjD3BLyledZTqlYlCWaDrRk=,tag:S9O09YEMuSexuNW3ojEw5Q==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:PtE=,iv:44l071j9ZLt3T2BbpAho70soiHxzBqp4KeITxrjdem8=,tag:yQt8jyEadk/GnrxnCPVKdA==,type:str]
+        password: ENC[AES256_GCM,data:EazzQF9D/s5TtYKBApzLQT3S7a0itGm7wGtHRMi6J0C3I/gBNhpgeF6dk8k=,iv:SGSiAlqOO7LvTlyVmOHU13Vq7OANo3eAeBCwioFpi3Y=,tag:4Vz8FRHEv9G+at/zZq4YMg==,type:str]
+        token: ENC[AES256_GCM,data:z12Oq4OFCCjCXn85cVSfSzxWt7b0ytuA6TAn3Xf5CIhvKuoQD43WnA==,iv:BP8WDOAXkuA9fMjfLR7BTyTqjEbjSmwgSrJfqCutwmQ=,tag:s7ys3V+QnU/Nmkccm3rcDw==,type:str]
    oidc:
        secret: ENC[AES256_GCM,data:qjQosi83oaK47wX4VtDktDFlIU3FQgmDpwyiSgJNPDq2Dtc/QEKzdv5/ZpQ=,iv:aUJx5a6Wj7lhaD19aPiZWIE/MWKUgH0muxtTSkwfg8M=,tag:DttjXee7ntxRAbqbFq6qeQ==,type:str]
        hash: ENC[AES256_GCM,data:iVls8UzdP6JTfRosET6nsk3RcEtFQ8ak6GtPuBjcqAv3lyA9oSLwvvC8MvGaT1aHCB+5y/lspuloHEaAcVGNuzGCIVLg9Adut4a7LYDTHNOZnJIKLj8ldL1ytD5XVdbeBhZGCqoTs088oO0HVCQiDzpJL5NdmM3Ru6egyYBCLLUOlPA=,iv:er63GEC+kxNDscvspvvLiq17VSg0GeZ2w3jmGojF9PM=,tag:F1pDpaQrVdomIlZ8psVpAw==,type:str]
@@ -204,8 +212,9 @@ gitea:
 #
 #ENC[AES256_GCM,data:HvMeGuC8JwK50pO1E/nm,iv:5NFTyjesMX0ZnBpH+hEv8jQ0G2NvrDtT23CUyLbQcUo=,tag:qWmPvQpADTeD+W8nWXRQvA==,type:comment]
 immich:
-    il:
-        password: ENC[AES256_GCM,data:PbDFc4m7rNPPN1mCjcvhbKwf/EbiJxdvO/iMspf9jMuCqQyGv7h6VrZqk98=,iv:hlMAp5wXXkFO9+ekq3A2/ioF/EX8Uau0puhb4TAHkRQ=,tag:pfS0W2JNaFNMpBlKgZ3Pjw==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:DclWIxkt7yZl/8EXSWpOKhVR8g==,iv:ekuWHM9tzQEGRj5Dz6txgh5H89dWVRojjICd7td3QSo=,tag:ZSBvlXtGrNn9T82Agn/vtg==,type:str]
+        password: ENC[AES256_GCM,data:AcaAeRVzeKCp9Hhx202DMuVTOmoPdXrUqpgwg6Nj/F7b9rCnQRwpsGGmuw0=,iv:z/PhfW75B08K+zbxBrEtBKFYWxTdRdgaicSYHe6yyJ0=,tag:8K+9QHjUF6lHhwnNDT9L8A==,type:str]
    oidc:
        secret: ENC[AES256_GCM,data:9ENcp2Ns21OLXDY05zRoSdP+93EiwSH8MGzZZpxK7sToe4QLUXWt9w6xQIE=,iv:Q/VcnArZHs/J2YLRVFXt3Mp+LYfuq4PD/trqO8Simig=,tag:BY/mOyZpYmoAc7NrASlmSA==,type:str]
        hash: ENC[AES256_GCM,data:mrML2CWFFtGjq8wfWipVpv+pjJRSHe74VGC7Eoa6588R5C/sCnC3W5aI+dsRCZN3LRCjHAkOJJgjeYrwcXYdKRauXsAYR51dNSsHqqSN3WebLxapRDwcYu5e4j5RN1aPHsysr7GaQ4hhe5rKW4ORCGC3Cp3Ob+LChPy4bdCAZG3bN9k=,iv:Q4hmqhq+dvIr7DxCpcqP4E0NKyFZkOeTnDpGctmCxXM=,tag:/gji6AFkHnYwkQf3FSQUxA==,type:str]
@@ -215,29 +224,20 @@ immich:
 #ENC[AES256_GCM,data:McPUAbIUvtC1gdPaxTgAxAMCMWcLfg==,iv:Tp6idRf7he3sYzo8LW596C905JAaoTIhIoDUzSyRT0k=,tag:4mZQ0Swu1X9uuwjsRNhr2A==,type:comment]
 paperless:
    session_secret: ENC[AES256_GCM,data:siwCs2noeVpg9DCEZybnmo/oz11BdrHSTnHciMOu/6g=,iv:XVjhu10TIujIdUopN9+TVVqRade9EvItDWxym6YXnZs=,tag:TxLYm+4Bo7IMaTQBtMg9pQ==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:9bJHf+chTg1rppgNVafNgEuvwQ69Gx+w5d65hu68q9XeeaVb2pO9HE4BOgg=,iv:1kaXBg/iOoIZxDjEVEdaMJLDtp6zQjep3vxLmIgQN5o=,tag:+MgX8Oa3tmhjx6u9aHkDfQ==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:8uo=,iv:f/qtpDb1Xe0M6Gd2VFP2vXULCd7WOn7TCxLlaK1dDbA=,tag:eNRMPJtLlA3Vjj79bSFxuA==,type:str]
+        password: ENC[AES256_GCM,data:TAA+TRTYRUSw47nE7oPDQmOtCBZpf2WyxUIIzftWq16wQhseODhH0R74X+Q=,iv:V0tzSvW5iYzEUgcxempmyD9ermVAqg673liiysT4jJ4=,tag:GuxtZ7EvgwvlFWwg+C6Jsg==,type:str]
    oidc:
        secret: ENC[AES256_GCM,data:wjRDVCJsINM4z5946a6uZD+6bhN5BChLMdRzgMEJFGRGFNcXd7A1p2Iqn4I=,iv:Y4QDA09L8ULKr4hhvoiduzCD8Hifo1gAnpzjCr8e520=,tag:R0RvGxYnXo3zwykXJykRug==,type:str]
        hash: ENC[AES256_GCM,data:pali6WwPNhJA+6QL4O+tKv42PnpGqmojb8JQUZLqxGizv1bJSCgdUN8upCy5Ke0DYZs5P+JY5vh23xfMZFnHduGxGwOuPX6J5lYgvJRV58LqS3/+yIBBprTJyro3MwsurTTEWesgKMr8/2H9lirhaLjWUOSPxAmQ6e4wPNpHycDVyj4=,iv:cg2trI7t1MfIcMo1/M+IY6JEl2msDoKRGgAx/Y5nyGk=,tag:gnOq7sBq9z5zrRY0yhIabg==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:k55osvepVeB1RC5hZ4IF,iv:AlhfmWwn/DiSESWc+ULJSOLUhnrKAIfWr7MeiwV8qc8=,tag:hOgptwUcY6nVxPIhu+DYgw==,type:comment]
-affine:
-    secret_key: ENC[AES256_GCM,data:LLX78DpYnha1JWhgw0sHLzIVq/oIzvT+nB7zgli4mroGbnt7WZaXCx34zKkYRwYj/+0L4IFFVdkzKtK5DO84SgFkS2Bk2iNdCMqIx80CpyiD8IWAcyRu5d6hh82PlgyxU80T/4nbLbIn0GLubPTTeUX8GC3VxRU=,iv:DnmvbhlygSHes0jAkIm4+WXMUQLzr4R4dNa33rO67v8=,tag:+2wlh+/ekiTyShWM4XBbUw==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:4zxiQAzXTR+fraRjYT657BIwSqrih3lMPFFSibQdardRMjskAbuRYIQA6mo=,iv:ub3giRG9vCFSuwRXDazYTqWbjENzQUWR36290Kruj1o=,tag:C2Ixd2eTEgzBvUNCNBtJuA==,type:str]
-    oidc:
-        secret: ENC[AES256_GCM,data:eRDBrqLZR7MFLlsUwk7Wg7FzxDov7vJLIWQRuKq7vrXbPSJkMcy9jfG2rL4=,iv:UaSoi7gODXgjzihJIDVIdDHJcSAZNV8UKfGeM6YzxqI=,tag:cOUDblcMStP8E4fp+s1WRQ==,type:str]
-        hash: ENC[AES256_GCM,data:jE1CvFo+mjb/Xc3Ft5ky7on03vcnv79cw/5g/xaldXsv94VRrIjmfGMgHAj07r8j5mDpP34A5bYO1PSe9DYrwRcsXa9OUQuzm/8avFy9wVZDhBUUAGR+jiW1BP9hc6nmSpPVPtle+3sbqOB0ZMjXWwlcAcuknOtuhH1mzwmaDP9yf+M=,iv:CSSaXY/6MpHBMhPLUWPkabIeJ9zpZkcVjiEhxVF0zJM=,tag:f72ekkjJs7Qmh1K9wC8L9w==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
 #ENC[AES256_GCM,data:PZS7EbvMHqHGorNUGAWj4dk1,iv:vOE+djRAvBTMM51kHi6kG5Arw3uPXlJt1d/BpcEaD0c=,tag:AuoCHLQz42CYvVVdKFWu1Q==,type:comment]
 nextcloud:
-    admin-local:
-        password: ENC[AES256_GCM,data:mIwF5A09oqYbdK3bOKid9A896Q5J5Q6Ax+vDNqEJFGNdzd/mJ4oQS6rva+s=,iv:QroUMST2wnEJzk6DySe9tPZaWuqdxzJZ0+oi6mW6x00=,tag:3UTzjupK7+omrI3Hvyr8bA==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:uSov7SN1yB1PhTc=,iv:5yxabQcY/XsBhn531xZg3XYsnxl3K59WuN7Vz9M4XG0=,tag:BBnfZPppw+SDGsV8dK2F+Q==,type:str]
+        password: ENC[AES256_GCM,data:j/wFr5EV00WegWxIGj1k3U13sQjf1GgUofGbh9+i916uudfdklhcurujhiY=,iv:aHEKjLvS5lnayRX/NJ98DxQ40mfqssidubDaP2RVb3k=,tag:zQRE9AsiAlXe58r4VFJiaQ==,type:str]
    oidc:
        secret: ENC[AES256_GCM,data:Sr4KkKkYdkU0UWdpfUF7PyiGoerjBiw+sOFcENyLxw0FRXGG0Y8gv5uGb4Q=,iv:LbGsNM3+iY7bWFQe88TepVKUdiRQWZ+K7Ubn6ze6lV4=,tag:SbcfIAMW9ZprgahOFU4IQQ==,type:str]
        hash: ENC[AES256_GCM,data:CkstbIYQmi72QhsbJZN0lQedgCn7TmGpYcYj0n+NvJIoTlol8G9N/88cwGbVoGK9nEISv54FL94cEJFppnMIuj0BHrhasrZsyI2/Lj52YLWdwNJWNQ+iYt+Ifp/1kI0zqmdoajzZ5DS2w/1evCBC1+JdfTRlpVXmSsHUIPIHelBRj90=,iv:vwvT5TTkF4woxXOvrRRqmrdLXf19s47NIDtdT+zLp0U=,tag:KC0MS0DTH6j3zIHOjCFOSA==,type:str]
@@ -271,9 +271,18 @@ memos:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
+#ENC[AES256_GCM,data:ATLTbBi1RsBr2ldHDDH4,iv:RFbPz/46BIGYv9Wo5Jxw5Swi4Xo2JgIEI4IsO4rCQoQ=,tag:i7/2ItQSFurrmdNaBWwWAA==,type:comment]
+mealie:
+    oidc:
+        secret: ENC[AES256_GCM,data:ldsfwWnexNNM4r+aP2h+woQROwbp9MpxAz8E/o1Q53GxcEwtixqvP6QZGoo=,iv:6M/lfuDU3IOd0nxLi2l02OD5FopErhSCp6AhxBGTI1k=,tag:3w0p+wi9T1PqNmgoM59gug==,type:str]
+        hash: ENC[AES256_GCM,data:YmziHxsFPJ93uMNG6/EUiPEfMvvAZM8/S5854GJ/fPPTMvXj9cM2sovkSrcNd7H0ac5KDJIcJoD9SC5lWKCAbjKzxHvI6CdI63SM8bExrDL2PVSGAf29VLU/cz8rQtZS39GWz2v5GWlpk67Emy0T115vruIGfDlan8zgQKK7YIWyVMs=,iv:xmnBYjBIWq6P2g5DyMh+wYskmJRcVDREGL/yYhJHyRs=,tag:qMWXHiLmAy5UvWFvv3Ct8g==,type:str]
+#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
+#
+#
 #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
 switch:
-    password: ENC[AES256_GCM,data:qu0f9L7A0eFq/UCpaRs=,iv:W8LLOp3MSfd/+EfNEZNf91K8GgI5eUfVPoWTRES2C0Y=,tag:Q5FlAOfwqwJwPvd7k6i+0g==,type:str]
+    admin:
+        password: ENC[AES256_GCM,data:cwBJRIO3eUgezyN60dU=,iv:Ab+EpURW+MYT7RTcPHi4FvQiv4m6TDhAb1/xexkIHCE=,tag:JEWZ3cqoAfAPfwXz7KmINQ==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -281,8 +290,9 @@ switch:
 dsm:
    key: ENC[AES256_GCM,data:jxQRPNuioZbznadJa7sdhbntABsi+nc6Y5TJsyMXwKRvVUbQw8p3snp75d9WVmOfq4uj8wBGen0noa/6xtWo4ZiHsIg1Svh/5xAN37zueB6NmK/z+BW2y8HaIkNhjcinusnT2SWE2ahguizMNM90FpXgmTt9Zv7wVwRkifDLWpH+rs5zmyMWPtpT2RN3+k7tVh8XWVevek/DxG4h+jtoYhTVzndMC5oe/A60MHBJCj6kaksGlX3vIDbRo5A0FEKX8uWI6k6U2osFc4SHIvpljYmPagj3EwPaTc3mbl8IJsXFVH4=,iv:7O5oQa1fELjIt6f3nQ+fWDFirAexgioS36/Nozh656o=,tag:t1RHmY8QC6mE9PVPJg426Q==,type:str]
    crt: ENC[AES256_GCM,data:N32+8CItiwbW8drpnL65weS35SY8uP8vcw9wBDFOxGFQjs6EyEwsMUVh1ndMpmDSUKWz7c7ji0HisC710RqnZw9l2NMg6R57DeXR/WsLW4LiAT7sFuDBcqorTB+6Nk0K9wLLdnsKpUQgl8oV9ffnWXZdfI5skKCDMNB40WJAYY/3wx9iT3wDQWaunq/1NT0SZHrtXXTj1JYiLbfDaTwTvkuqqUv1cXvOjonL2Cp4aNT/zjwK6c/TRbKdhIs/7tnUUE/lJx74eARfrMQy/3y6h2xK9pgruASuJxMw9Tyaj6Ya0FMNMIezO3GPQbFCE/IRfmCE6vX2RXUjVqX8wd/d4m4KNuMsN3hbwC3vQ6r+DcYdaTUfGIu96xfKSiSax/ZPQ4JhTyqthkGgpE0Ob67aVELrZkyhc/kvvSxafVSvP63C/nHPQnXMgitdRddYFq7487Vbq03frxiyID1WkqeUavc+Tn3dyA8c7aqVvbW6vZCAwUzbKD0nwPuBUtKZQpJKxHvtx2390PW7a214zkPLcw5LH3FnNacopiNfs6dNEeW/UsGysYkoBRXfrAPMX4UL53TvUTrpuCBhthJ4rgqjhgTfq9GtomP7piuf/tnMAO33qSHPM3w2ocLWeLyOiqYESFmXoBAsiu33LVzuVryFVw75pgrGAsc2wwKhcu4JC0cNgUE44ENIIjffVQX/mcvPvHxuI05vtzM0N8kOFPwG7iAVrO1eUEpwUjZwUwkk8QRsuIhZ6W7aYx7TLdPDpjmy6XCYGNHZgHg6jU7v18KkPep1YarAnsVYFzHQwfZIMOzW7DHlHq38NJW8lWq7zkg+kY6JDVy0nttlAUSskWNeCHdI5Xy3Rz3t7V6t1+UxkSy3roQCZOYjiaknwrXSctsgqucKaJCq4w0Tty36kaIXwOQYVm9JqDIztOmer4fW8Es7OEbLwA==,iv:26fGb288JEbtA0UcAmiYcN+UunrUOw2S6fKjGMetgwE=,tag:GmUJb9LJ186HNOF4AhfmLg==,type:str]
-    il:
-        password: ENC[AES256_GCM,data:6LiNif7aIGgGBBdVYpl4K8L8ev6EPru5x6HvX2yJ0oiDQb6G9AI+ZsaKamc=,iv:Y+eijt1PmNZR9c9uCzBnzJT9BDc3w/P4VzsbvrPRU64=,tag:2KKRtTSYzrJKy9VX/2J5eQ==,type:str]
+    admin:
+        id: ENC[AES256_GCM,data:/Js=,iv:GyEcag6KxEHy6xApfzEo+dZF9NOtkOoYaJZEzPa8ing=,tag:W/4zaDxdw42Ap4DVE9ogAQ==,type:str]
+        password: ENC[AES256_GCM,data:/rgn1Eogw3F2EqArMJXL8Ri4y1W04hGzxy4w1Ct5/ysBjjHGgRbxd9tXSf0=,iv:PISJ0a113rlEL0z0yo+nBYNQNU6Ht0PgFWZzooxIgi0=,tag:UZl0EiVcaVPq1v0MtNCXFQ==,type:str]
    oidc:
        secret: ENC[AES256_GCM,data:IXJNy9PmMPn9uowSMMrNPYqaW5PZ13JTeu1t7eNlapxmnV3EAl3I3xbMK5A=,iv:UcG2E6zgoKkPfUiHr0A+gvnApCkBJG2GROfacwD634Q=,tag:nSFn9yaCadJGlGy/aCvc2A==,type:str]
        hash: ENC[AES256_GCM,data:Y2/FNYbID0trRS5UpP2MX6UcLWxlRoXu9VLeU9DU9whEwNLbf4gYrxI7Q7etQe6HidBuoIJNxKajf3t0fI0ptbXnJaxzMh/v/CsiDg2p568o3KIyfB1PruGRKUrTuJneREUHg5jRXMYCwcRUQ4C5WgAyjd2spGlTQO0OLEqh0wkTtvs=,iv:YTYoaBy3QwlSrmx/K5woiXAHrh0RkawF+uQ4rQuP7WU=,tag:Ej6ZjTFvKjw6BrXbd0lf0g==,type:str]
@@ -291,8 +301,7 @@ dsm:
 #
 sops:
    age:
-        - recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
-          enc: |
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TVVta2V6UHB4V3NmV0tR
            V0hmbUw1bUpSSk4zQXZ4MHlaVzdJU0VSWm1VCnZaMUg1cjJyOEFyOWxPNm9lWkVm
@@ -300,7 +309,8 @@ sops:
            UmliaFNxVTBqRkI1QWJpWGpTRWxETW8KEY/8AfU73UOzCGhny1cNnd5dCNv7bHXt
            k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-16T11:08:23Z"
-    mac: ENC[AES256_GCM,data:FprpwGfSw+KObEthT41tD8qgawQPpRlHw0ZxcyH74Nzk+47AbkDR3dWUPmZGPTePcQM4WI3e1IzE0ptJA7Hpcsnq/wHdo+uTW8nozYxzDU7JhjG2Xn6CPov2mV3o0SCegiCpfvE4A3bXiBOPapUIIs+ySBUMmyyW6m5ravElxsA=,iv:wt/3nFmVfodxActWBNvli2M2LLQZG8bkuagA/Fc6iuk=,tag:z1QWaMrGN/8kBrmZ8mPJUA==,type:str]
+          recipient: age120wuwcmsm845ztsvsz46pswj5je53uc2n35vadklrfqudu6cxuusxetk7y
+    lastmodified: "2026-06-12T13:44:23Z"
+    mac: ENC[AES256_GCM,data:FMOY7qMDSCzvOUL44zmwLwUVAXfYkat1JbiNeBVQFuUrC4lAwuukxW9MCPs5plj84LOAUMVgMofyudFJh5VKTR6Y0EnB5ft0NnbGgwMwzQnQn7d9Mcg9xPca3ccSbSGNx0UrC+8lTjXuzhoawMQ5ZXZ3ZK0k7JrFQ2El7UUwxEA=,iv:+oj0bvsDo8gidUn6m0FOeWsJOxIXPHhzvtiIbQ1VgcY=,tag:8xLcthizKqWjqg2eQvJlRA==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.1
@@ -0,0 +1,49 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Mealie
+
+[Container]
+Image=ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}
+ContainerName=mealie
+HostName=mealie
+PublishPort={{ services['mealie']['ports']['http'] }}:9000/tcp
+
+# Volumes
+Volume=%h/data/containers/mealie/data:/app/data:rw
+Volume=%h/containers/mealie/ssl:/etc/ssl/mealie:ro
+
+# General
+Environment="TZ={{ timezone }}"
+Environment="BASE_URL=https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}"
+Environment="ALLOW_PASSWORD_LOGIN=false"
+
+# Database (PostgreSQL)
+Environment="DB_ENGINE=postgres"
+Environment="POSTGRES_SERVER={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}"
+Environment="POSTGRES_PORT={{ services['postgresql']['ports']['tcp'] }}"
+Environment="POSTGRES_USER=mealie"
+Environment="POSTGRES_DB=mealie_db"
+Environment="PGSSLMODE=verify-full"
+Environment="PGSSLROOTCERT=/etc/ssl/mealie/{{ root_cert_filename }}"
+Secret=MEALIE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
+
+# OIDC
+Environment="OIDC_AUTH_ENABLED=true"
+Environment="OIDC_SIGNUP_ENABLED=true"
+Environment="OIDC_CONFIGURATION_URL=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}/.well-known/openid-configuration"
+Environment="OIDC_CLIENT_ID=mealie"
+Environment="OIDC_AUTO_REDIRECT=false"
+Environment="OIDC_ADMIN_GROUP=admins"
+Environment="OIDC_USER_GROUP=users"
+Secret=MEALIE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
+
+[Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target
@@ -11,4 +11,4 @@ opcache.revalidate_freq=60
 opcache.fast_shutdown=1

 ; APCu CLI activate
-apc.enable_cli=1
+apc.enable_cli=1
@@ -3,4 +3,4 @@ upload_max_filesize=16G
 post_max_size=16G
 memory_limit=1024M
 max_execution_time=3600
-max_input_time=3600
+max_input_time=3600
@@ -53,6 +53,7 @@ Environment="OIDC_USERINFO_URI=https://{{ services['authelia']['domain'] }}.{{ d
 Environment="OIDC_USERNAME_CLAIM=preferred_username"
 Environment="OIDC_DISPLAY_NAME=Authelia"
 Environment="OIDC_SCOPES=openid offline_access profile email"
+Environment="OIDC_DISABLE_REDIRECT=true"
 Secret=OUTLINE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET

 # Mail
@@ -54,8 +54,8 @@ Exec=--config /config/authelia.yaml

 [Service]
 # Wait for dependency
-# They run as rootless podman container, so their port is not opened until they are normaly running
-# Check their ports with nc command 
+# They run as rootless podman container, so their port is not opened until they are normally running
+# Check their ports with nc command
 ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
 # services['ldap']['ports']['ldaps'] is 6360, but nftables works on 636 the original port
 ExecStartPre=/usr/bin/nc -zv {{ services['ldap']['domain'] }}.{{ domain['internal'] }} 636
@@ -4,7 +4,7 @@
 # certificates setting
 certificates_directory: '/etc/ssl/authelia/'

-# them setting - light, dark, grey, auto.
+# theme setting - light, dark, grey, auto.
 theme: 'auto'

 # Server configuration
@@ -22,7 +22,7 @@ totp:
  # issure option is for 2FA app. It works as identifier. "My homelab' or 'ilnmors.internal', 'Authelia - ilnmors'
  issuer: '{{ domain['internal'] }}'

-# Identity validation confituration
+# Identity validation configuration
 identity_validation:
  reset_password:
    jwt_secret: '' # $AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE option is designated in container file
@@ -33,7 +33,7 @@ authentication_backend:
    # ldaps uses 636 -> NAT automatically change port 636 in output packet -> 2636 which lldap server uses.
    address: 'ldaps://{{ services['ldap']['domain'] }}.{{ domain['internal'] }}'
    implementation: 'lldap'
-    # tls configruation, it uses certificates_directory's /etc/ssl/authelia/{{ root_cert_filename }}
+    # tls configuration, it uses certificates_directory's /etc/ssl/authelia/{{ root_cert_filename }}
    tls:
      server_name: '{{ services['ldap']['domain'] }}.{{ domain['internal'] }}'
      skip_verify: false
@@ -59,6 +59,7 @@ access_control:
 #      policy: 'one_factor'
 #      subject:
 #        - 'group:admins'
+
 # Session provider configuration
 session:
  secret: '' # $AUTHELIA_SESSION_SECRET_FILE  is designated in container file
@@ -99,15 +100,20 @@ identity_providers:
        key: {{ secret "/run/secrets/AUTHELIA_JWKS_RS256" | mindent 10 "|" | msquote }}
      - algorithm: 'ES256'
        use: 'sig'
-        key: {{ secret "/run/secrets/AUTHELIA_JWKS_ES256" | mindent 10 "|" | msquote }}{% endraw %} 
+        key: {{ secret "/run/secrets/AUTHELIA_JWKS_ES256" | mindent 10 "|" | msquote }}{% endraw %}
+    lifespans:
+      access_token: '1h'
+      id_token: '1h'
+      refresh_token: '720h'
    clients:
      # https://www.authelia.com/integration/openid-connect/clients/synology-dsm/
      - client_id: 'dsm'
        client_name: 'dsm'
+        consent_mode: 'implicit'
        # It depends on application
-        # hash vaule generate: 
-	      # podman exec -it authelia sh
-	      # authelia crypto hash generate pbkdf2 --password 'password'
+        # hash value generate:
+        # podman exec -it authelia sh
+        # authelia crypto hash generate pbkdf2 --password 'password'
        client_secret: '{{ hostvars['console']['dsm']['oidc']['hash'] }}'
        # If there were not client secret, public should be `true` [true | false]
        public: false
@@ -132,6 +138,7 @@ identity_providers:
      # https://www.authelia.com/integration/openid-connect/clients/gitea/
      - client_id: 'gitea'
        client_name: 'gitea'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['gitea']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -153,6 +160,7 @@ identity_providers:
      # https://www.authelia.com/integration/openid-connect/clients/immich/
      - client_id: 'immich'
        client_name: 'immich'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['immich']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -176,6 +184,7 @@ identity_providers:
      # https://www.authelia.com/integration/openid-connect/clients/paperless/
      - client_id: 'paperless'
        client_name: 'Paperless'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['paperless']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -195,30 +204,10 @@ identity_providers:
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
-      # https://docs.affine.pro/self-host-affine/administer/oauth-2-0
-      - client_id: 'affine'
-        client_name: 'Affine'
-        client_secret: '{{ hostvars['console']['affine']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: false
-        pkce_challenge_method: ''
-        redirect_uris:
-          - 'https://{{ services['affine']['domain']['public'] }}.{{ domain['public'] }}/oauth/callback'
-        scopes:
-          - 'openid'
-          - 'profile'
-          - 'email'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'
      # https://www.authelia.com/integration/openid-connect/clients/nextcloud/#openid-connect-user-backend-app
      - client_id: 'nextcloud'
        client_name: 'Nextcloud'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['nextcloud']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -241,6 +230,7 @@ identity_providers:
      # https://www.authelia.com/integration/openid-connect/clients/sure/
      - client_id: 'sure'
        client_name: 'Sure'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['sure']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -263,6 +253,7 @@ identity_providers:
      # https://www.authelia.com/integration/openid-connect/clients/outline/
      - client_id: 'outline'
        client_name: 'Outline'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['outline']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -286,6 +277,7 @@ identity_providers:
      # https://www.authelia.com/integration/openid-connect/clients/memos/
      - client_id: 'memos'
        client_name: 'Memos'
+        consent_mode: 'implicit'
        client_secret: '{{ hostvars['console']['memos']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
@@ -304,3 +296,26 @@ identity_providers:
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
+      # https://www.authelia.com/integration/openid-connect/clients/mealie/
+      - client_id: 'mealie'
+        client_name: 'Mealie'
+        consent_mode: 'implicit'
+        client_secret: '{{ hostvars['console']['mealie']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: true
+        pkce_challenge_method: 'S256'
+        redirect_uris:
+          - 'https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}/login'
+        scopes:
+          - 'openid'
+          - 'email'
+          - 'profile'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'
@@ -53,12 +53,6 @@
                header_up Host {http.request.header.X-Forwarded-Host}
        }
 }
-{{ services['affine']['domain']['internal'] }}.{{ domain['internal'] }} {
-        import private_tls
-        reverse_proxy host.containers.internal:{{ services['affine']['ports']['http'] }} {
-                header_up Host {http.request.header.X-Forwarded-Host}
-        }
-}
 {{ services['nextcloud']['domain']['internal'] }}.{{ domain['internal'] }} {
        import private_tls
        reverse_proxy host.containers.internal:{{ services['nextcloud']['ports']['http'] }} {
@@ -89,3 +83,9 @@
                header_up Host {http.request.header.X-Forwarded-Host}
        }
 }
+{{ services['mealie']['domain']['internal'] }}.{{ domain['internal'] }} {
+        import private_tls
+        reverse_proxy host.containers.internal:{{ services['mealie']['ports']['http'] }} {
+                header_up Host {http.request.header.X-Forwarded-Host}
+        }
+}
@@ -1,7 +1,7 @@
 {
        # CrowdSec LAPI connection
        crowdsec {
-                api_url https://{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }} 
+                api_url https://{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
                api_key "{file./run/secrets/CADDY_CROWDSEC_KEY}"
        }
 }
@@ -98,15 +98,6 @@
                reverse_proxy https://{{ services['paperless']['domain']['internal'] }}.{{ domain['internal'] }} {
                        header_up Host {http.reverse_proxy.upstream.host}
                }
-        }  
-}
-{{ services['affine']['domain']['public'] }}.{{ domain['public'] }} {
-        import crowdsec_log
-        route {
-                crowdsec
-                reverse_proxy https://{{ services['affine']['domain']['internal'] }}.{{ domain['internal'] }} {
-                        header_up Host {http.reverse_proxy.upstream.host}
-                }
        }
 }
 {{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }} {
@@ -154,6 +145,15 @@
                }
        }
 }
+{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }} {
+        import crowdsec_log
+        route {
+                crowdsec
+                reverse_proxy https://{{services['mealie']['domain']['internal'] }}.{{ domain['internal'] }} {
+                        header_up Host {http.reverse_proxy.upstream.host}
+                }
+        }
+}

 # Internal domain
 {{ node['name'] }}.{{ domain['internal'] }} {
@@ -1,28 +1,29 @@
 # @authcomment@
-# TYPE  DATABASE    USER    ADDRESS METHOD
+# TYPE  DATABASE  USER   ADDRESS                                      METHOD
+
 # Local host `trust`
-local   all all     trust
+local   all       all                                                 trust

 # Local monitoring connection (host - infra VM) `trust`
-hostssl postgres    alloy   {{ hostvars['fw']['network4']['infra']['server'] }}/32  trust
-hostssl postgres    alloy   {{ hostvars['fw']['network6']['infra']['server'] }}/128 trust
-hostssl postgres    alloy   {{ hostvars['fw']['network4']['subnet']['lla'] }}   trust
-hostssl postgres    alloy   {{ hostvars['fw']['network6']['subnet']['lla'] }}   trust
+hostssl postgres  alloy  {{ hostvars['fw']['network4']['infra']['server'] }}/32   trust
+hostssl postgres  alloy  {{ hostvars['fw']['network6']['infra']['server'] }}/128  trust
+hostssl postgres  alloy  {{ hostvars['fw']['network4']['subnet']['lla'] }}        trust
+hostssl postgres  alloy  {{ hostvars['fw']['network6']['subnet']['lla'] }}        trust

 # Local connection (in postgresql container) needs password (127.0.0.1 - container loopback)
-host    all all 127.0.0.1/32    scram-sha-256
-host    all all ::1/128 scram-sha-256
+host    all       all    127.0.0.1/32                                scram-sha-256
+host    all       all    ::1/128                                      scram-sha-256

 # Local connection (host - infra VM) needs password (169.254.1.0/24 - link_local subnet for containers in pasta mode)
-hostssl all all {{ hostvars['fw']['network4']['infra']['server'] }}/32  scram-sha-256
-hostssl all all {{ hostvars['fw']['network6']['infra']['server'] }}/128 scram-sha-256
-hostssl all all {{ hostvars['fw']['network4']['subnet']['lla'] }}   scram-sha-256
-hostssl all all {{ hostvars['fw']['network6']['subnet']['lla'] }}   scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network4']['infra']['server'] }}/32   scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network6']['infra']['server'] }}/128  scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network4']['subnet']['lla'] }}        scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network6']['subnet']['lla'] }}        scram-sha-256

 # auth VM
-hostssl all all {{ hostvars['fw']['network4']['auth']['server'] }}/32   scram-sha-256
-hostssl all all {{ hostvars['fw']['network6']['auth']['server'] }}/128  scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network4']['auth']['server'] }}/32    scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network6']['auth']['server'] }}/128   scram-sha-256

-# app VM (Applications, 192.168.10.13) 
-hostssl all all	{{ hostvars['fw']['network4']['app']['server'] }}/32    scram-sha-256
-hostssl all all	{{ hostvars['fw']['network6']['app']['server'] }}/128   scram-sha-256
+# app VM (Applications, 192.168.10.13)
+hostssl all       all    {{ hostvars['fw']['network4']['app']['server'] }}/32     scram-sha-256
+hostssl all       all    {{ hostvars['fw']['network6']['app']['server'] }}/128    scram-sha-256
@@ -3,11 +3,14 @@
 #------------------------------------------------------------------------------

 # Add settings for extensions here
-# Listen_address
+
+# Listen address
 listen_addresses = '*'
+
 # Max connections
 max_connections = 250
-# listen_port
+
+# Listen port
 port = {{ services['postgresql']['ports']['tcp'] }}

 # SSL
@@ -18,7 +21,7 @@ ssl_key_file = '/etc/ssl/postgresql/postgresql.key'
 ssl_ciphers = 'HIGH:!aNULL:!MD5'
 ssl_prefer_server_ciphers = on

-# log
+# Log
 log_destination = 'stderr'
 log_checkpoints = on
 log_temp_files = 0
@@ -27,7 +30,7 @@ log_min_duration_statement = 500
 # IO
 track_io_timing = on

-## immich_config
+# immich_config
 shared_preload_libraries = 'vchord.so'
 search_path = '"$user", public'
 max_wal_size = 5GB
@@ -38,4 +41,4 @@ autovacuum_vacuum_scale_factor = 0.1
 autovacuum_analyze_scale_factor = 0.05
 autovacuum_vacuum_cost_limit = 1000
 effective_io_concurrency = 200
-random_page_cost = 1.2
+random_page_cost = 1.2
@@ -19,7 +19,7 @@ Volume=%h/containers/postgresql/data:/var/lib/postgresql:rw
 Volume=%h/containers/postgresql/config:/config:ro
 Volume=%h/containers/postgresql/ssl:/etc/ssl/postgresql:ro
 Volume=%h/containers/postgresql/init:/docker-entrypoint-initdb.d/:ro
-Volume=%h/containers/postgresql/backups:/backups:rw
+Volume=%h/data/containers/postgresql/backups:/backups:rw

 Environment="TZ={{ timezone }}"
 # This option is only for init process, after init custom config file `pg_hba.conf` will control this option.
@@ -13,7 +13,13 @@ StandardError=journal
 ExecStartPre=/usr/bin/podman exec postgresql sh -c "mkdir -p /backups/%i && chown postgres:root /backups/%i && chmod 770 /backups/%i"

 # Run the script
+## DB Connection
 ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'printf "\\connect %i_db\n" > /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
+## Avoiding FK/trigger checks
+ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'printf "SET session_replication_role = replica;\n" >> /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
+## Data
 ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'pg_dump -U postgres -d %i_db --data-only >> /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
+## reset session replication role
+ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c 'printf "SET session_replication_role = origin;\n" >> /backups/%i/pg_%i_$(date "+%%Y-%%m-%%d").sql'
 ExecStart=/usr/bin/podman exec -u postgres postgresql sh -c "find /backups/%i -maxdepth 1 -type f -mtime +7 -delete"
 ExecStart=/usr/bin/podman exec postgresql sh -c "chown -R postgres:root /backups/%i && chmod 660 /backups/%i/*"
@@ -1,10 +0,0 @@
-[Unit]
-Description=BTRFS auto scrub
-ConditionPathIsMountPoint={{ storage['btrfs']['mount_point'] }}
-RequiresMountsFor={{ storage['btrfs']['mount_point'] }}
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/btrfs scrub start -Bd {{ storage['btrfs']['mount_point'] }}
-Nice=19
-IOSchedulingClass=idle
@@ -207,7 +207,7 @@ loki.process "journal_parser" {
            // Regex to extract the log level from the content.
            expression = "(?i)(?:level[\"\\s:=]+|\\[|\\s|^)(?P<content_level>info|warn|warning|error|debug|fatal|critical|trace)(?:[\"\\]\\s]|$)"
        }
-        
+
        stage.labels {
            values = {
                "level" = "content_level",
@@ -237,7 +237,7 @@ loki.process "journal_parser" {
 loki.process "suricata_json" {
    forward_to = [loki.write.loki.receiver]
    stage.json {
-        expressions = { 
+        expressions = {
            event_type = "event_type",
            src_ip     = "src_ip",
            severity   = "alert.severity",
@@ -253,7 +253,7 @@ loki.process "suricata_json" {
 loki.process "caddy_json" {
    forward_to = [loki.write.loki.receiver]
    stage.json {
-        expressions = { 
+        expressions = {
            status      = "status",
            method      = "method",
            remote_ip   = "remote_ip",
@@ -2,4 +2,4 @@
 filenames:
  - /var/log/suricata/eve.json
 labels:
-  type: suricata
+  type: suricata-evelogs
@@ -27,7 +27,7 @@ db_config:
  type: sqlite
  db_path: /var/lib/crowdsec/data/crowdsec.db
  #max_open_conns: 100
-  #user: 
+  #user:
  #password:
  #db_name:
  #host:
@@ -20,11 +20,8 @@ ProtectSystem=strict
 ProtectHome=tmpfs
 InaccessiblePaths=/boot /root

-{% if node['name'] == 'infra' %}
-BindReadOnlyPaths={{ node['home_path'] }}/containers/postgresql/backups
-{% elif node['name'] == 'app' %}
 BindReadOnlyPaths={{ node['home_path'] }}/data
-{% endif %}
+
 # In root namescope, %u always bring 0
 BindPaths=/etc/kopia
 BindPaths=/etc/secrets/{{ kopia_uid }}
@@ -36,14 +33,8 @@ ExecStartPre=/usr/bin/kopia repository connect server \
    --override-username={{ node['name'] }} \
    --override-hostname={{ node['name'] }}.{{ domain['internal'] }}

-{% if node['name'] == 'infra' %}
-ExecStart=/usr/bin/kopia snapshot create \
-    {{ node['home_path'] }}/containers/postgresql/backups
-{% elif node['name'] == 'app' %}
 ExecStart=/usr/bin/kopia snapshot create \
    {{ node['home_path'] }}/data
-{% endif %}
-

 [Install]
 WantedBy=multi-user.target
@@ -1,4 +1,4 @@
-KOPIA_PASSWORD={{ hostvars['console']['kopia']['user'][node['name']] }}
+KOPIA_PASSWORD={{ hostvars['console']['kopia']['users'][node['name']] }}
 KOPIA_CONFIG_PATH=/etc/kopia/repository.config
 KOPIA_CACHE_DIRECTORY=/var/cache/kopia
 KOPIA_LOG_DIR=/var/cache/kopia/logs
@@ -0,0 +1,28 @@
+{
+    "python.useEnvironmentsExtension": false,
+    "ansible.lightspeed.enabled": false,
+    "ansible.lightspeed.suggestions.enabled": false,
+    "ansible.validation.enabled": true,
+    "ansible.validation.lint.enabled": true,
+    "files.associations": {
+        "**/ansible/**/*.yaml": "ansible",
+        "*.container*": "ini",
+        "*.service*": "ini",
+        "*.timer*": "ini",
+        "*containerfile*": "dockerfile",
+        "*.link*": "ini",
+        "*.netdev*": "ini",
+        "*.network*": "ini",
+        "*.xml*": "xml",
+        "named.conf*": "cpp",
+        "*.conf*": "ini",
+        "*.toml": "ini",
+        "*.json.*": "json",
+        "*.alloy.*": "cpp"
+    },
+    "ansible.python.interpreterPath": "/bin/python3",
+    "yaml.customTags": [
+        "!vault scalar"
+    ],
+    "workbench.hover.delay": 9999999,
+}
@@ -0,0 +1,14 @@
+[Unit]
+Description=code-server user service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/code-server \
+  --auth none \
+  --bind-addr 127.0.0.1:2080 \
+  %h/workspace
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
--- a/Show More
+++ b/Show More