Merge pull request 'Adding the Shield Project' (#1 ) from test into main

Reviewed-on: http://192.168.122.228:3000/NinjaSurge/TheGreatCompose/pulls/1
2025-09-12 10:11:31 -05:00
16 changed files with 5 additions and 525 deletions
@@ -1 +0,0 @@
-*.env
@@ -1,101 +0,0 @@
-services:
-  postgresql:
-    env_file:
-      - .env
-    environment:
-      POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-    healthcheck:
-      interval: 30s
-      retries: 5
-      start_period: 20s
-      test:
-        - CMD-SHELL
-        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
-      timeout: 5s
-    image: docker.io/library/postgres:16-alpine
-    restart: unless-stopped
-    networks:
-      - default
-    volumes:
-      - /mnt/appdata/authentik/database:/var/lib/postgresql/data
-  redis:
-    command: --save 60 1 --loglevel warning
-    healthcheck:
-      interval: 30s
-      retries: 5
-      start_period: 20s
-      test:
-        - CMD-SHELL
-        - redis-cli ping | grep PONG
-      timeout: 3s
-    image: docker.io/library/redis:alpine
-    restart: unless-stopped
-    networks:
-      - default
-    volumes:
-      - /mnt/appdata/authentik/redis:/data
-  server:
-    container_name: authentik-server
-    command: server
-    depends_on:
-      postgresql:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    env_file:
-      - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ghcr.io/goauthentik/server:2025.8.3
-    # ports:
-    #   - ${COMPOSE_PORT_HTTP:-8005}:9000
-    #   - ${COMPOSE_PORT_HTTPS:-8443}:9443
-    restart: unless-stopped
-    networks:
-      - default
-      - proxy
-    labels:
-      traefik.enable: true
-      traefik.http.routers.authentik.rule: Host(`authentik.homelab.local`)
-      traefik.http.routers.authentik.entrypoints: http
-    volumes:
-      - /mnt/appdata/authentik/data/media:/media
-      - /mnt/appdata/authentik/data/custom-templates:/templates
-  worker:
-    command: worker
-    depends_on:
-      postgresql:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    env_file:
-      - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ghcr.io/goauthentik/server:2025.8.3
-    restart: unless-stopped
-    user: root
-    networks:
-      - default
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /mnt/appdata/authentik/data/media:/media
-      - /mnt/appdata/authentik/data/certs:/certs
-      - /mnt/appdata/authentik/data/custom-templates:/templates
-
-networks:
-  default:
-  proxy:
-    external: true
@@ -1,132 +0,0 @@
-services:
-  gitea-mirror:
-    container_name: gitea-mirror
-    image: ghcr.io/raylabshq/gitea-mirror:v3.7.0
-    restart: unless-stopped
-    ports:
-      - 4321:4321
-    volumes:
-      - /mnt/appdata/gitea-mirror/data:/app/data
-      # Mount custom CA certificates - choose one option:
-      # Option 1: Mount individual CA certificates from certs directory
-      # - ./certs:/app/certs:ro
-      # Option 2: Mount system CA bundle (if your CA is already in system store)
-      # - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
-    environment:
-      # For a complete list of all supported environment variables, see:
-      # docs/ENVIRONMENT_VARIABLES.md or .env.example
-      - NODE_ENV=production
-      - DATABASE_URL=file:data/gitea-mirror.db
-      - HOST=0.0.0.0
-      - PORT=4321
-      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
-      - BETTER_AUTH_URL=http://gitea-mirror
-      # Optional: ENCRYPTION_SECRET will be auto-generated if not provided
-      # - ENCRYPTION_SECRET=
-      # GitHub/Gitea Mirror Config
-      - GITHUB_USERNAME=NinjaSurge
-      - GITHUB_TOKEN=${GITHUB_TOKEN}
-      - GITHUB_TYPE=personal
-      - GITHUB_EXCLUDED_ORGS=
-      - SKIP_FORKS=false
-      - PRIVATE_REPOSITORIES=true
-      - MIRROR_METADATA=true
-      - MIRROR_ISSUES=true
-      - MIRROR_WIKI=true
-      - MIRROR_STARRED=true
-      - MIRROR_ORGANIZATIONS=false
-      - PRESERVE_ORG_STRUCTURE=false
-      - ONLY_MIRROR_ORGS=false
-      - SKIP_STARRED_ISSUES=false
-      - GITEA_URL=http://gitea.homelab.local
-      - GITEA_TOKEN=${GITEA_TOKEN}
-      - GITEA_USERNAME=NinjaSurge
-      - GITEA_ORGANIZATION=github-mirrors
-      - GITEA_ORG_VISIBILITY=public
-      - DELAY=3600 # Legacy: same as SCHEDULE_INTERVAL, kept for backward compatibility
-      # Scheduling and Sync Configuration (Issue #72 fixes)
-      - SCHEDULE_ENABLED=false # When true, auto-imports and mirrors all repos on startup (v3.5.3+)
-      - GITEA_MIRROR_INTERVAL=8h # Mirror sync interval (5m, 30m, 1h, 8h, 24h, 1d, 7d) - also triggers auto-start, automatically enables scheduler
-      - AUTO_IMPORT_REPOS=true
-      # Repository Cleanup Configuration
-      - CLEANUP_DELETE_IF_NOT_IN_GITHUB=false # Auto-remove repos that no longer exist in GitHub
-      - CLEANUP_ORPHANED_REPO_ACTION=archive # Options: skip, archive, delete
-      - CLEANUP_DRY_RUN=true # Test mode without actual deletion (set to false for production)
-      # Header Authentication (for Reverse Proxy SSO)
-      - HEADER_AUTH_ENABLED=false
-      - HEADER_AUTH_USER_HEADER=X-Authentik-Username
-      - HEADER_AUTH_EMAIL_HEADER=X-Authentik-Email
-      - HEADER_AUTH_NAME_HEADER=X-Authentik-Name
-      - HEADER_AUTH_AUTO_PROVISION=false
-      - HEADER_AUTH_ALLOWED_DOMAINS=
-      # Optional: Skip TLS verification (insecure, use only for testing)
-      - GITEA_SKIP_TLS_VERIFY=true # WARNING: Only use for testing
-      - MIRROR_RELEASES=true # Mirror GitHub releases
-      - INCLUDE_ARCHIVED=true
-      - MIRROR_STRATEGY=single-org # Options: preserve, single-org, flat-user, mixed
-      - GITEA_LFS=true # Enable LFS support
-      - MIRROR_PULL_REQUESTS=true # Mirror pull requests
-      - MIRROR_LABELS=true # Mirror labels
-      - MIRROR_MILESTONES=true # Mirror milestones
-      # Cleanup Execution
-      - CLEANUP_BATCH_SIZE=10
-      - CLEANUP_PAUSE_BETWEEN_DELETES=2000 # Pause between deletions (ms)
-      # Protected Repositories (comma-separated)
-      - CLEANUP_PROTECTED_REPOS=important-repo,critical-project
-      # Repository Cleanup (v3.4.0+)
-      - CLEANUP_DELETE_FROM_GITEA=false # Delete repos from Gitea
-      # Basic Cleanup Settings
-      - CLEANUP_ENABLED=false
-      - CLEANUP_RETENTION_DAYS=7 # Days to keep events
-      # Notifications
-      - SCHEDULE_NOTIFY_ON_FAILURE=true
-      - SCHEDULE_NOTIFY_ON_SUCCESS=false
-      - SCHEDULE_LOG_LEVEL=info # Options: error, warn, info, debug
-      - SCHEDULE_TIMEZONE=UTC
-      # Maintenance
-      - SCHEDULE_CLEANUP_BEFORE_MIRROR=false # Run cleanup before mirroring
-      # Update Detection
-      - SCHEDULE_ONLY_MIRROR_UPDATED=false # Only mirror repos with updates
-      - SCHEDULE_UPDATE_INTERVAL=86400000 # Check for updates interval (ms)
-      - SCHEDULE_SKIP_RECENTLY_MIRRORED=true
-      - SCHEDULE_RECENT_THRESHOLD=3600000 # Skip if mirrored within this time (ms)
-      # Retry Configuration
-      - SCHEDULE_RETRY_ATTEMPTS=3
-      - SCHEDULE_RETRY_DELAY=60000 # Delay between retries (ms)
-      - SCHEDULE_TIMEOUT=3600000 # Max time for a mirror operation (ms)
-      - SCHEDULE_AUTO_RETRY=true
-      # Execution Settings
-      - SCHEDULE_CONCURRENT=false # Allow concurrent mirror operations
-      - SCHEDULE_BATCH_SIZE=10 # Number of repos to process in parallel
-      - SCHEDULE_PAUSE_BETWEEN_BATCHES=5000 # Pause between batches (ms)
-      # Basic Schedule Settings
-      - SCHEDULE_INTERVAL=3600 # Interval in seconds or cron expression (e.g., "0 2 * * *")
-      # Release and Metadata
-      - RELEASE_LIMIT=10 # Maximum number of releases to mirror per repository
-      # Fork Handling
-      - GITEA_FORK_STRATEGY=reference # Options: skip, reference, full-copy
-      # Topic Settings
-      - GITEA_ADD_TOPICS=true # Add topics to repositories
-      - GITEA_TOPIC_PREFIX=gh- # Prefix for topics
-      # Template Settings (for using repository templates)
-      - GITEA_TEMPLATE_OWNER=template-owner
-      - GITEA_TEMPLATE_REPO=template-repo
-      - GITEA_PRESERVE_VISIBILITY=false # Preserve GitHub repo visibility in Gitea
-    labels:
-      traefik.enable: true
-      traefik.http.routers.gitea-mirror.rule: Host(`gitea-mirror.homelab.local`)
-      traefik.http.routers.gitea-mirror.entrypoints: http
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "wget",
-          "--no-verbose",
-          "--tries=3",
-          "--spider",
-          "http://localhost:4321/api/health",
-        ]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-      start_period: 15s
@@ -1,66 +0,0 @@
-services:
-  server:
-    image: docker.gitea.com/gitea:1.24.6
-    container_name: gitea-server
-    environment:
-      - TZ=${TIMEZONE}
-      - GITEA__database__DB_TYPE=postgres
-      - GITEA__database__HOST=db:5432
-      - GITEA__database__NAME=${DB_NAME}
-      - GITEA__database__USER=${DB_USER}
-      - GITEA__database__PASSWD=${DB_PASSWORD}
-      - GITEA__server__HTTP_PORT=80
-      - GITEA__server__PROTOCOL=http
-      - GITEA__server__DOMAIN=gitea.homelab.local
-      - GITEA__webhook__ALLOWED_HOST_LIST=gitea.homelab.local,192.168.122.228,gitea-server
-    restart: always
-    volumes:
-      - /mnt/appdata/gitea/data:/data
-    depends_on:
-      - db
-    networks:
-      - default
-      - proxy
-    labels:
-      traefik.enable: true
-      traefik.http.routers.gitea.rule: Host(`gitea.homelab.local`)
-      traefik.http.routers.gitea.entrypoints: http
-      traefik.http.services.gitea.loadbalancer.server.port: 80
-
-  db:
-    image: docker.io/library/postgres:14.19
-    restart: always
-    environment:
-      - TZ=${TIMEZONE}
-      - POSTGRES_DB=${DB_NAME}
-      - POSTGRES_USER=${DB_USER}
-      - POSTGRES_PASSWORD=${DB_PASSWORD}
-    volumes:
-      - /mnt/appdata/gitea/db:/var/lib/postgresql/data
-    networks:
-      - default
-
-  runner:
-    image: gitea/act_runner:0.2.13
-    container_name: gitea-runner
-    restart: always
-    depends_on:
-      - server
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /mnt/appdata/gitea/runner/config.yaml:/config.yaml
-      - /mnt/appdata/gitea/runner/data:/data
-    environment:
-      - TZ=${TIMEZONE}
-      - CONFIG_FILE=/config.yaml
-      - GITEA_INSTANCE_URL=http://gitea-server
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_GITEA_TOKEN}
-      - GITEA_RUNNER_NAME=local-machine
-    networks:
-      - default
-      - proxy
-
-networks:
-  default:
-  proxy:
-    external: true
@@ -1,15 +0,0 @@
-services:
-  corentinth:
-    container_name: it-tools
-    image: ghcr.io/corentinth/it-tools:nightly
-    # ports:
-    #   - 8084:80
-    restart: unless-stopped
-    labels:
-      traefik.enable: true
-      traefik.http.routers.it-tools.rule: Host(`it-tools.homelab.local`)
-      traefik.http.routers.it-tools.entrypoints: http
-networks:
-  default:
-    external: true
-    name: proxy
@@ -1,15 +0,0 @@
-services:
-  minio:
-    command: 'server /data --console-address ":9001"'
-    image: quay.io/minio/minio
-    ports:
-      - "9001:9001"
-      - "9000:9000"
-    labels:
-      traefik.enable: true
-      traefik.http.routers.minio.rule: Host(`minio.homelab.local`)
-      traefik.http.routers.minio.entrypoints: http
-networks:
-  default:
-    external: true
-    name: proxy
@@ -1,23 +1,14 @@
 services:
  ntfy:
-    container_name: ntfy
-    image: binwiederhier/ntfy:v2.14.0
+    image: binwiederhier/ntfy
    restart: unless-stopped
    environment:
-      NTFY_BASE_URL: http://ntfy.homelab.local
+      NTFY_BASE_URL: http://192.168.122.228:3001
      NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
      NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
      NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
    volumes:
      - ./:/var/lib/ntfy
-    # ports:
-    #   - 3001:80
+    ports:
+      - 3001:80
    command: serve
-    labels:
-      traefik.enable: true
-      traefik.http.routers.ntfy.rule: Host(`ntfy.homelab.local`)
-      traefik.http.routers.ntfy.entrypoints: http
-networks:
-  default:
-    external: true
-    name: proxy
@@ -1,7 +0,0 @@
-services:
-  radicale:
-    container_name: radicale
-    image: homelab.local:3105/starred/radicale:latest
-    restart: unless-stopped
-    ports:
-      - 5232:5232
@@ -1,16 +0,0 @@
-services:
-  Restfox:
-    image: flawiddsouza/restfox:0.40.0
-    container_name: restfox
-    restart: unless-stopped
-    # ports:
-    #   - 4004:4004
-    labels:
-      traefik.enable: true
-      traefik.http.routers.restfox.rule: Host(`restfox.homelab.local`)
-      traefik.http.routers.restfox.entrypoints: http
-      traefik.http.services.restfox.loadbalancer.server.port: 4004
-networks:
-  default:
-    external: true
-    name: proxy
@@ -1,10 +1,5 @@
 services:
  shield:
-    image: ghcr.io/badges/shields:server-2025-09-02
+    image: ghcr.io/badges/shields:next
    ports:
      - 8083:80
-    restart: unless-stopped
-    labels:
-      traefik.enable: true
-      traefik.http.routers.shield.rule: Host(`shield.homelab.local`)
-      traefik.http.routers.shield.entrypoints: http
@@ -1,32 +0,0 @@
-services:
-  db_recipes:
-    restart: always
-    image: postgres:16-alpine
-    volumes:
-      - /mnt/appdata/tandoor/postgresql:/var/lib/postgresql/data
-    env_file:
-      - ./.env
-    networks:
-      - default
-
-  web_recipes:
-    restart: always
-    image: vabene1111/recipes:tandoor-v1-20250916
-    env_file:
-      - ./.env
-    volumes:
-      - /mnt/appdata/tandoor/staticfiles:/opt/recipes/staticfiles
-      - /mnt/appdata/tandoor/mediafiles:/opt/recipes/mediafiles
-    depends_on:
-      - db_recipes
-    labels:
-      traefik.enable: true
-      traefik.http.routers.tandoor.rule: Host(`tandoor.homelab.local`)
-      traefik.http.routers.tandoor.entrypoints: http
-    networks:
-      - proxy
-      - default
-networks:
-  default:
-  proxy:
-    external: true
@@ -1,21 +0,0 @@
-services:
-  traefik:
-    restart: always
-    image: traefik:v3.5
-    ports:
-      - 80:80
-      - 443:443
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - /mnt/appdata/traefik/certs:/certs:ro
-      - ./traefik.yaml:/traefik.yml:ro
-    labels:
-      traefik.enable: true
-      traefik.http.routers.traefik.entrypoints: http
-      traefik.http.routers.traefik.rule: Host(`traefik.homelab.local`)
-    networks:
-      - proxy
-
-networks:
-  proxy:
-    external: true
@@ -1,20 +0,0 @@
-entryPoints:
-  http:
-    address: :80
-
-providers:
-  providersThrottleDuration: 2s
-  docker:
-    endpoint: unix:///var/run/docker.sock
-    watch: true
-    network: proxy
-    exposedByDefault: false
-
-api:
-  dashboard: true
-  insecure: true
-  debug: false
-
-log:
-  level: INFO
-accessLog: true
@@ -1,20 +0,0 @@
-services:
-  vaultwarden:
-    image: vaultwarden/server:latest
-    container_name: vaultwarden
-    restart: unless-stopped
-    environment:
-      DOMAIN: "http://homelab.local:8000"
-      SSO_ENABLED: true
-      SSO_AUTHORITY: https://homelab.local:8005/application/o/vaultwarden/
-      SSO_CLIENT_ID: 8QGk6TXr0FxndMFu97Y0G2HESxdUm6wRiwTYTNNF
-      SSO_CLIENT_SECRET: 2MEJi5PSGNoD2y4ZVqoVeowg3OPovHh9nL4aNZU8ors1sd3fYCNb2SRGw2udsP6TubgmsMrQqM8U8gJ8Rm4UcAzhsaNsu9DhZzQkO0uoR7SKNnrsy7Swsf4m4rNdvpKy
-      SSO_SCOPES: "openid email profile offline_access"
-      SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION: false
-      SSO_CLIENT_CACHE_EXPIRATION: 0
-      SSO_ONLY: false # Set to true to disable email+master password login and require SSO
-      SSO_SIGNUPS_MATCH_EMAIL: true # Match first SSO login to existing account by email
-    volumes:
-      - /mnt/appdata/vaultwarden/vw-data/:/data/
-    ports:
-      - 8000:80
@@ -1,18 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "dependencyDashboard": true,
-  "dependencyDashboardTitle": "Renovate Dashboard",
-  "assignees": ["NinjaSurge"],
-  "labels": ["renovate"],
-  "configMigration": true,
-  "prHourlyLimit": 0,
-  "docker-compose": {
-    "hostRules": [
-      {
-        "matchHost": "docker.io",
-        "concurrentRequestLimit": 2
-      }
-    ]
-  }
-}
@@ -1,42 +0,0 @@
-services:
-  vikunja:
-    image: vikunja/vikunja
-    environment:
-      VIKUNJA_SERVICE_PUBLICURL: http://vikunja.computersurge.dev
-      VIKUNJA_DATABASE_HOST: db
-      VIKUNJA_DATABASE_PASSWORD: changeme
-      VIKUNJA_DATABASE_TYPE: postgres
-      VIKUNJA_DATABASE_USER: vikunja
-      VIKUNJA_DATABASE_DATABASE: vikunja
-      VIKUNJA_SERVICE_JWTSECRET: a_super_secure_random_secret
-      VIKUNJA_CORS_ENABLE: false
-    volumes:
-      - /mnt/appdata/vikunja/files:/app/vikunja/files
-    networks:
-      - proxy
-      - default
-    depends_on:
-      db:
-        condition: service_healthy
-    restart: unless-stopped
-    labels:
-      traefik.enable: true
-      traefik.docker.network: http
-      traefik.http.routers.vikunja.rule: Host(`vikunja.homelab.local`)
-      traefik.http.routers.vikunja.entrypoints: http
-  db:
-    image: postgres:17
-    environment:
-      POSTGRES_PASSWORD: changeme
-      POSTGRES_USER: vikunja
-    volumes:
-      - /mnt/appdata/vikunja/db:/var/lib/postgresql/data
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -h localhost -U $$POSTGRES_USER"]
-      interval: 2s
-      start_period: 30s
-
-networks:
-  proxy:
-    external: true