Fixing unauthorized??

Reviewed-on: http://gitea.homelab.local/NinjaSurge/TheGreatCompose/pulls/7

.gitignore

@@ -0,0 +1 @@
+*.env

Authentik/compose.yaml

@@ -0,0 +1,101 @@
+services:
+  postgresql:
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+    networks:
+      - default
+    volumes:
+      - /mnt/appdata/authentik/database:/var/lib/postgresql/data
+  redis:
+    command: --save 60 1 --loglevel warning
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - redis-cli ping | grep PONG
+      timeout: 3s
+    image: docker.io/library/redis:alpine
+    restart: unless-stopped
+    networks:
+      - default
+    volumes:
+      - /mnt/appdata/authentik/redis:/data
+  server:
+    container_name: authentik-server
+    command: server
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ghcr.io/goauthentik/server:2025.8.3
+    # ports:
+    #   - ${COMPOSE_PORT_HTTP:-8005}:9000
+    #   - ${COMPOSE_PORT_HTTPS:-8443}:9443
+    restart: unless-stopped
+    networks:
+      - default
+      - proxy
+    labels:
+      traefik.enable: true
+      traefik.http.routers.authentik.rule: Host(`authentik.homelab.local`)
+      traefik.http.routers.authentik.entrypoints: http
+    volumes:
+      - /mnt/appdata/authentik/data/media:/media
+      - /mnt/appdata/authentik/data/custom-templates:/templates
+  worker:
+    command: worker
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ghcr.io/goauthentik/server:2025.8.3
+    restart: unless-stopped
+    user: root
+    networks:
+      - default
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /mnt/appdata/authentik/data/media:/media
+      - /mnt/appdata/authentik/data/certs:/certs
+      - /mnt/appdata/authentik/data/custom-templates:/templates
+
+networks:
+  default:
+  proxy:
+    external: true

Gitea-mirror/compose.yaml

@@ -0,0 +1,132 @@
+services:
+  gitea-mirror:
+    container_name: gitea-mirror
+    image: ghcr.io/raylabshq/gitea-mirror:v3.7.0
+    restart: unless-stopped
+    ports:
+      - 4321:4321
+    volumes:
+      - /mnt/appdata/gitea-mirror/data:/app/data
+      # Mount custom CA certificates - choose one option:
+      # Option 1: Mount individual CA certificates from certs directory
+      # - ./certs:/app/certs:ro
+      # Option 2: Mount system CA bundle (if your CA is already in system store)
+      # - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
+    environment:
+      # For a complete list of all supported environment variables, see:
+      # docs/ENVIRONMENT_VARIABLES.md or .env.example
+      - NODE_ENV=production
+      - DATABASE_URL=file:data/gitea-mirror.db
+      - HOST=0.0.0.0
+      - PORT=4321
+      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
+      - BETTER_AUTH_URL=http://gitea-mirror
+      # Optional: ENCRYPTION_SECRET will be auto-generated if not provided
+      # - ENCRYPTION_SECRET=
+      # GitHub/Gitea Mirror Config
+      - GITHUB_USERNAME=NinjaSurge
+      - GITHUB_TOKEN=${GITHUB_TOKEN}
+      - GITHUB_TYPE=personal
+      - GITHUB_EXCLUDED_ORGS=
+      - SKIP_FORKS=false
+      - PRIVATE_REPOSITORIES=true
+      - MIRROR_METADATA=true
+      - MIRROR_ISSUES=true
+      - MIRROR_WIKI=true
+      - MIRROR_STARRED=true
+      - MIRROR_ORGANIZATIONS=false
+      - PRESERVE_ORG_STRUCTURE=false
+      - ONLY_MIRROR_ORGS=false
+      - SKIP_STARRED_ISSUES=false
+      - GITEA_URL=http://gitea.homelab.local
+      - GITEA_TOKEN=${GITEA_TOKEN}
+      - GITEA_USERNAME=NinjaSurge
+      - GITEA_ORGANIZATION=github-mirrors
+      - GITEA_ORG_VISIBILITY=public
+      - DELAY=3600 # Legacy: same as SCHEDULE_INTERVAL, kept for backward compatibility
+      # Scheduling and Sync Configuration (Issue #72 fixes)
+      - SCHEDULE_ENABLED=false # When true, auto-imports and mirrors all repos on startup (v3.5.3+)
+      - GITEA_MIRROR_INTERVAL=8h # Mirror sync interval (5m, 30m, 1h, 8h, 24h, 1d, 7d) - also triggers auto-start, automatically enables scheduler
+      - AUTO_IMPORT_REPOS=true
+      # Repository Cleanup Configuration
+      - CLEANUP_DELETE_IF_NOT_IN_GITHUB=false # Auto-remove repos that no longer exist in GitHub
+      - CLEANUP_ORPHANED_REPO_ACTION=archive # Options: skip, archive, delete
+      - CLEANUP_DRY_RUN=true # Test mode without actual deletion (set to false for production)
+      # Header Authentication (for Reverse Proxy SSO)
+      - HEADER_AUTH_ENABLED=false
+      - HEADER_AUTH_USER_HEADER=X-Authentik-Username
+      - HEADER_AUTH_EMAIL_HEADER=X-Authentik-Email
+      - HEADER_AUTH_NAME_HEADER=X-Authentik-Name
+      - HEADER_AUTH_AUTO_PROVISION=false
+      - HEADER_AUTH_ALLOWED_DOMAINS=
+      # Optional: Skip TLS verification (insecure, use only for testing)
+      - GITEA_SKIP_TLS_VERIFY=true # WARNING: Only use for testing
+      - MIRROR_RELEASES=true # Mirror GitHub releases
+      - INCLUDE_ARCHIVED=true
+      - MIRROR_STRATEGY=single-org # Options: preserve, single-org, flat-user, mixed
+      - GITEA_LFS=true # Enable LFS support
+      - MIRROR_PULL_REQUESTS=true # Mirror pull requests
+      - MIRROR_LABELS=true # Mirror labels
+      - MIRROR_MILESTONES=true # Mirror milestones
+      # Cleanup Execution
+      - CLEANUP_BATCH_SIZE=10
+      - CLEANUP_PAUSE_BETWEEN_DELETES=2000 # Pause between deletions (ms)
+      # Protected Repositories (comma-separated)
+      - CLEANUP_PROTECTED_REPOS=important-repo,critical-project
+      # Repository Cleanup (v3.4.0+)
+      - CLEANUP_DELETE_FROM_GITEA=false # Delete repos from Gitea
+      # Basic Cleanup Settings
+      - CLEANUP_ENABLED=false
+      - CLEANUP_RETENTION_DAYS=7 # Days to keep events
+      # Notifications
+      - SCHEDULE_NOTIFY_ON_FAILURE=true
+      - SCHEDULE_NOTIFY_ON_SUCCESS=false
+      - SCHEDULE_LOG_LEVEL=info # Options: error, warn, info, debug
+      - SCHEDULE_TIMEZONE=UTC
+      # Maintenance
+      - SCHEDULE_CLEANUP_BEFORE_MIRROR=false # Run cleanup before mirroring
+      # Update Detection
+      - SCHEDULE_ONLY_MIRROR_UPDATED=false # Only mirror repos with updates
+      - SCHEDULE_UPDATE_INTERVAL=86400000 # Check for updates interval (ms)
+      - SCHEDULE_SKIP_RECENTLY_MIRRORED=true
+      - SCHEDULE_RECENT_THRESHOLD=3600000 # Skip if mirrored within this time (ms)
+      # Retry Configuration
+      - SCHEDULE_RETRY_ATTEMPTS=3
+      - SCHEDULE_RETRY_DELAY=60000 # Delay between retries (ms)
+      - SCHEDULE_TIMEOUT=3600000 # Max time for a mirror operation (ms)
+      - SCHEDULE_AUTO_RETRY=true
+      # Execution Settings
+      - SCHEDULE_CONCURRENT=false # Allow concurrent mirror operations
+      - SCHEDULE_BATCH_SIZE=10 # Number of repos to process in parallel
+      - SCHEDULE_PAUSE_BETWEEN_BATCHES=5000 # Pause between batches (ms)
+      # Basic Schedule Settings
+      - SCHEDULE_INTERVAL=3600 # Interval in seconds or cron expression (e.g., "0 2 * * *")
+      # Release and Metadata
+      - RELEASE_LIMIT=10 # Maximum number of releases to mirror per repository
+      # Fork Handling
+      - GITEA_FORK_STRATEGY=reference # Options: skip, reference, full-copy
+      # Topic Settings
+      - GITEA_ADD_TOPICS=true # Add topics to repositories
+      - GITEA_TOPIC_PREFIX=gh- # Prefix for topics
+      # Template Settings (for using repository templates)
+      - GITEA_TEMPLATE_OWNER=template-owner
+      - GITEA_TEMPLATE_REPO=template-repo
+      - GITEA_PRESERVE_VISIBILITY=false # Preserve GitHub repo visibility in Gitea
+    labels:
+      traefik.enable: true
+      traefik.http.routers.gitea-mirror.rule: Host(`gitea-mirror.homelab.local`)
+      traefik.http.routers.gitea-mirror.entrypoints: http
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "wget",
+          "--no-verbose",
+          "--tries=3",
+          "--spider",
+          "http://localhost:4321/api/health",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 15s

Gitea/compose.yaml

@@ -0,0 +1,66 @@
+services:
+  server:
+    image: docker.gitea.com/gitea:1.24.6
+    container_name: gitea-server
+    environment:
+      - TZ=${TIMEZONE}
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=db:5432
+      - GITEA__database__NAME=${DB_NAME}
+      - GITEA__database__USER=${DB_USER}
+      - GITEA__database__PASSWD=${DB_PASSWORD}
+      - GITEA__server__HTTP_PORT=80
+      - GITEA__server__PROTOCOL=http
+      - GITEA__server__DOMAIN=gitea.homelab.local
+      - GITEA__webhook__ALLOWED_HOST_LIST=gitea.homelab.local,192.168.122.228,gitea-server
+    restart: always
+    volumes:
+      - /mnt/appdata/gitea/data:/data
+    depends_on:
+      - db
+    networks:
+      - default
+      - proxy
+    labels:
+      traefik.enable: true
+      traefik.http.routers.gitea.rule: Host(`gitea.homelab.local`)
+      traefik.http.routers.gitea.entrypoints: http
+      traefik.http.services.gitea.loadbalancer.server.port: 80
+
+  db:
+    image: docker.io/library/postgres:14.19
+    restart: always
+    environment:
+      - TZ=${TIMEZONE}
+      - POSTGRES_DB=${DB_NAME}
+      - POSTGRES_USER=${DB_USER}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+    volumes:
+      - /mnt/appdata/gitea/db:/var/lib/postgresql/data
+    networks:
+      - default
+
+  runner:
+    image: gitea/act_runner:0.2.13
+    container_name: gitea-runner
+    restart: always
+    depends_on:
+      - server
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /mnt/appdata/gitea/runner/config.yaml:/config.yaml
+      - /mnt/appdata/gitea/runner/data:/data
+    environment:
+      - TZ=${TIMEZONE}
+      - CONFIG_FILE=/config.yaml
+      - GITEA_INSTANCE_URL=http://gitea-server
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_GITEA_TOKEN}
+      - GITEA_RUNNER_NAME=local-machine
+    networks:
+      - default
+      - proxy
+
+networks:
+  default:
+  proxy:
+    external: true

It-tools/compose.yaml

@@ -0,0 +1,15 @@
+services:
+  corentinth:
+    container_name: it-tools
+    image: ghcr.io/corentinth/it-tools:nightly
+    # ports:
+    #   - 8084:80
+    restart: unless-stopped
+    labels:
+      traefik.enable: true
+      traefik.http.routers.it-tools.rule: Host(`it-tools.homelab.local`)
+      traefik.http.routers.it-tools.entrypoints: http
+networks:
+  default:
+    external: true
+    name: proxy

Minio/compose.yaml

@@ -0,0 +1,15 @@
+services:
+  minio:
+    command: 'server /data --console-address ":9001"'
+    image: quay.io/minio/minio
+    ports:
+      - "9001:9001"
+      - "9000:9000"
+    labels:
+      traefik.enable: true
+      traefik.http.routers.minio.rule: Host(`minio.homelab.local`)
+      traefik.http.routers.minio.entrypoints: http
+networks:
+  default:
+    external: true
+    name: proxy

Ntfy/compose.yaml

@@ -1,14 +1,23 @@
 services:
   ntfy:
-    image: binwiederhier/ntfy
+    container_name: ntfy
+    image: binwiederhier/ntfy:v2.14.0
     restart: unless-stopped
     environment:
-      NTFY_BASE_URL: http://192.168.122.228:3001
+      NTFY_BASE_URL: http://ntfy.homelab.local
       NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
       NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
       NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
     volumes:
       - ./:/var/lib/ntfy
-    ports:
-      - 3001:80
+    # ports:
+    #   - 3001:80
     command: serve
+    labels:
+      traefik.enable: true
+      traefik.http.routers.ntfy.rule: Host(`ntfy.homelab.local`)
+      traefik.http.routers.ntfy.entrypoints: http
+networks:
+  default:
+    external: true
+    name: proxy

Radicale/compose.yaml

@@ -0,0 +1,7 @@
+services:
+  radicale:
+    container_name: radicale
+    image: homelab.local:3105/starred/radicale:latest
+    restart: unless-stopped
+    ports:
+      - 5232:5232

Restfox/compose.yaml

@@ -0,0 +1,16 @@
+services:
+  Restfox:
+    image: flawiddsouza/restfox:0.40.0
+    container_name: restfox
+    restart: unless-stopped
+    # ports:
+    #   - 4004:4004
+    labels:
+      traefik.enable: true
+      traefik.http.routers.restfox.rule: Host(`restfox.homelab.local`)
+      traefik.http.routers.restfox.entrypoints: http
+      traefik.http.services.restfox.loadbalancer.server.port: 4004
+networks:
+  default:
+    external: true
+    name: proxy

Shield/compose.yaml

@@ -1,5 +1,10 @@
 services:
   shield:
-    image: ghcr.io/badges/shields:next
+    image: ghcr.io/badges/shields:server-2025-09-02
     ports:
       - 8083:80
+    restart: unless-stopped
+    labels:
+      traefik.enable: true
+      traefik.http.routers.shield.rule: Host(`shield.homelab.local`)
+      traefik.http.routers.shield.entrypoints: http

Tandoor/compose.yaml

@@ -0,0 +1,32 @@
+services:
+  db_recipes:
+    restart: always
+    image: postgres:16-alpine
+    volumes:
+      - /mnt/appdata/tandoor/postgresql:/var/lib/postgresql/data
+    env_file:
+      - ./.env
+    networks:
+      - default
+
+  web_recipes:
+    restart: always
+    image: vabene1111/recipes:tandoor-v1-20250916
+    env_file:
+      - ./.env
+    volumes:
+      - /mnt/appdata/tandoor/staticfiles:/opt/recipes/staticfiles
+      - /mnt/appdata/tandoor/mediafiles:/opt/recipes/mediafiles
+    depends_on:
+      - db_recipes
+    labels:
+      traefik.enable: true
+      traefik.http.routers.tandoor.rule: Host(`tandoor.homelab.local`)
+      traefik.http.routers.tandoor.entrypoints: http
+    networks:
+      - proxy
+      - default
+networks:
+  default:
+  proxy:
+    external: true

Traefik/compose.yaml

@@ -0,0 +1,21 @@
+services:
+  traefik:
+    restart: always
+    image: traefik:v3.5
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /mnt/appdata/traefik/certs:/certs:ro
+      - ./traefik.yaml:/traefik.yml:ro
+    labels:
+      traefik.enable: true
+      traefik.http.routers.traefik.entrypoints: http
+      traefik.http.routers.traefik.rule: Host(`traefik.homelab.local`)
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true

Traefik/traefik.yaml

@@ -0,0 +1,20 @@
+entryPoints:
+  http:
+    address: :80
+
+providers:
+  providersThrottleDuration: 2s
+  docker:
+    endpoint: unix:///var/run/docker.sock
+    watch: true
+    network: proxy
+    exposedByDefault: false
+
+api:
+  dashboard: true
+  insecure: true
+  debug: false
+
+log:
+  level: INFO
+accessLog: true

Vaultwarden/compose.yaml

@@ -0,0 +1,20 @@
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    container_name: vaultwarden
+    restart: unless-stopped
+    environment:
+      DOMAIN: "http://homelab.local:8000"
+      SSO_ENABLED: true
+      SSO_AUTHORITY: https://homelab.local:8005/application/o/vaultwarden/
+      SSO_CLIENT_ID: 8QGk6TXr0FxndMFu97Y0G2HESxdUm6wRiwTYTNNF
+      SSO_CLIENT_SECRET: 2MEJi5PSGNoD2y4ZVqoVeowg3OPovHh9nL4aNZU8ors1sd3fYCNb2SRGw2udsP6TubgmsMrQqM8U8gJ8Rm4UcAzhsaNsu9DhZzQkO0uoR7SKNnrsy7Swsf4m4rNdvpKy
+      SSO_SCOPES: "openid email profile offline_access"
+      SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION: false
+      SSO_CLIENT_CACHE_EXPIRATION: 0
+      SSO_ONLY: false # Set to true to disable email+master password login and require SSO
+      SSO_SIGNUPS_MATCH_EMAIL: true # Match first SSO login to existing account by email
+    volumes:
+      - /mnt/appdata/vaultwarden/vw-data/:/data/
+    ports:
+      - 8000:80

renovate.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "dependencyDashboard": true,
+  "dependencyDashboardTitle": "Renovate Dashboard",
+  "assignees": ["NinjaSurge"],
+  "labels": ["renovate"],
+  "configMigration": true,
+  "prHourlyLimit": 0,
+  "docker-compose": {
+    "hostRules": [
+      {
+        "matchHost": "docker.io",
+        "concurrentRequestLimit": 2
+      }
+    ]
+  }
+}

vikunja/compose.yaml

@@ -0,0 +1,42 @@
+services:
+  vikunja:
+    image: vikunja/vikunja
+    environment:
+      VIKUNJA_SERVICE_PUBLICURL: http://vikunja.computersurge.dev
+      VIKUNJA_DATABASE_HOST: db
+      VIKUNJA_DATABASE_PASSWORD: changeme
+      VIKUNJA_DATABASE_TYPE: postgres
+      VIKUNJA_DATABASE_USER: vikunja
+      VIKUNJA_DATABASE_DATABASE: vikunja
+      VIKUNJA_SERVICE_JWTSECRET: a_super_secure_random_secret
+      VIKUNJA_CORS_ENABLE: false
+    volumes:
+      - /mnt/appdata/vikunja/files:/app/vikunja/files
+    networks:
+      - proxy
+      - default
+    depends_on:
+      db:
+        condition: service_healthy
+    restart: unless-stopped
+    labels:
+      traefik.enable: true
+      traefik.docker.network: http
+      traefik.http.routers.vikunja.rule: Host(`vikunja.homelab.local`)
+      traefik.http.routers.vikunja.entrypoints: http
+  db:
+    image: postgres:17
+    environment:
+      POSTGRES_PASSWORD: changeme
+      POSTGRES_USER: vikunja
+    volumes:
+      - /mnt/appdata/vikunja/db:/var/lib/postgresql/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h localhost -U $$POSTGRES_USER"]
+      interval: 2s
+      start_period: 30s
+
+networks:
+  proxy:
+    external: true