homelab/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
254 Commits 1 Branch 0 Tags
82cc6117fb2701b301da7e7a9ee14e6272311448
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
poprhythm 82cc6117fb homebox: add HBOX_AUTH_API_KEY_PEPPER env var (required by new version) 2026-06-15 01:36:40 +00:00
poprhythm 8087d19d7f nginx-proxy-acme: replace broken symlinks with empty files 
These vhost.d entries were symlinks to a non-existent 'public' file.
Portainer refuses to clone repos containing symlinks, blocking all
git-based stack redeployments. Replace with empty regular files
(equivalent behavior: no extra nginx config = public access).
 2026-06-15 01:33:20 +00:00
poprhythm 8871c8354b audiobookshelf: switch audiobooks mount from Docker NFS volume to systemd automount bind mount 
NFS named volumes go ESTALE when unRAID drives spin down and Docker cannot recover.
systemd automount handles NFS reconnection transparently; Docker just sees a bind mount.
 2026-05-05 20:27:13 +00:00
poprhythm 1ac9f06e29 ollama: restrict port 11434 to 127.0.0.1 (LAN security audit) 2026-05-03 01:40:33 +00:00
poprhythm cb17443ab6 couchdb: mount local.ini for persistent CORS config (entrypoint chowns config files, :ro breaks startup) 2026-04-26 23:39:08 +00:00
poprhythm 98d64139fe couchdb: mount persistent CORS config to survive container updates 2026-04-26 23:20:59 +00:00
poprhythm ca170af736 watchtower: remove debug logging now that scan/update/cleanup is confirmed working 2026-04-26 22:08:21 +00:00
poprhythm a925d61e83 watchtower: add debug logging + disable self-update to diagnose scanned=0 2026-04-26 17:18:05 +00:00
poprhythm 2c90e4218b watchtower: switch to nickfedor/watchtower fork (containrrr archived Dec 2025, Docker API 1.25 incompatible) 2026-04-26 17:02:34 +00:00
poprhythm ba8f1f7668 minecraft: update battle server seed to 9037888329883360986 2026-04-05 22:38:42 +00:00
poprhythm c1c86e3ab2 minecraft: add ViaVersion to battle server for cross-version client support 2026-04-03 16:22:08 +00:00
poprhythm 26c89ebb39 minecraft: fix MODRINTH_PROJECTS separator (comma not space) 2026-04-03 16:18:22 +00:00
poprhythm d4a23d0d6f minecraft: add Paper + EzCountdown + WorldResetPlugin to battle server 2026-04-03 16:16:09 +00:00
poprhythm 5353df05fb minecraft: add battle server on port 25573 for kids PVP 
Survival mode, seed 854721609616927000, PVP enabled.
30-min resource gather then battle.
 2026-04-03 16:10:09 +00:00
poprhythm 76e02bf26d authelia: add ownCloud iOS OIDC client to git config 2026-03-29 18:59:51 +00:00
poprhythm c58ffb1b68 romm: pass ScreenScraper credentials via Portainer env vars 2026-03-20 22:03:49 +00:00
poprhythm 03d4dae8b5 inbox-zero: add REDIS_URL env var for email-stream / Deep Clean 
REDIS_URL was not set, causing "REDIS_URL is not set" errors in
/api/email-stream which powers the Deep Clean full-inbox scan.
 2026-03-14 14:34:45 +00:00
poprhythm 9dee75e2a0 docs: update NAS connection strategies for Immich and nas_library/nas_family mounts 2026-03-14 02:10:52 +00:00
poprhythm b2d7f82c53 immich: migrate upload volume from NFS named volume to CIFS systemd bind mount 
Replace fragile Docker NFS named volume with /mnt/nas_family/immich-library
bind mount backed by systemd mnt-nas_family.mount (permanent CIFS).
 2026-03-14 02:04:33 +00:00
poprhythm f1a9346861 map-frontend: fix @protomaps/basemaps version (4 doesn't exist, use 5) 2026-03-13 14:24:44 +00:00
poprhythm a483c2e7fc map-frontend: use absolute /srv paths for nginx config and html mounts 2026-03-13 14:19:57 +00:00
poprhythm cd232d93ac map-frontend: fix nginx config mount (dir instead of file) 2026-03-13 14:14:55 +00:00
poprhythm ef1d136a3e Add map-frontend (nginx + MapLibre GL), make pmtiles internal-only 
- map-frontend: nginx serves MapLibre GL static app, proxies /tiles/ to pmtiles internally
- pmtiles: remove host port binding (internal to npm-network only), update public-url
- 5 themes: light, dark, grayscale, white, black
 2026-03-13 14:14:16 +00:00
poprhythm 662b558d21 torrents: document NPM web UI instance labels (OPEN/VPN badges) 2026-03-13 03:36:52 +00:00
poprhythm d7d20cd080 torrents: add nas_library bind mount to qbittorrent_open 2026-03-12 20:53:36 +00:00
poprhythm 0b4571205a Add kiwix and pmtiles services with NAS library share mounts 2026-03-12 19:50:18 +00:00
poprhythm 97ff83a246 romm: add arcade (FBNeo) to populate-roms, add IGDB credentials 
100 arcade titles spanning Pac-Man/Namco classics, Street Fighter,
Mortal Kombat, Metal Slug, King of Fighters, Samurai Shodown,
Fatal Fury, beat-em-ups (TMNT, Simpsons, X-Men), and more.

Also adds IGDB_CLIENT_ID/SECRET env vars for metadata scraping.
 2026-03-10 01:54:53 +00:00
poprhythm 0fe632e1b5 stable-diffusion: disable ai-dock service portal auth 2026-03-09 03:09:44 +00:00
poprhythm aa686d0827 romm: add GB, GBA, and Amiga to populate-roms script 
32 Game Boy, 36 GBA, and 41 Amiga titles. Amiga includes the full
Lemmings trilogy plus Turrican, Monkey Island, Chaos Engine, Worms,
Sensible Soccer, and more. Note: Amiga requires Kickstart firmware
(not in No-Intro) to actually run.
 2026-03-09 02:13:53 +00:00
poprhythm 597ed26f89 romm: add IGDB credentials, add populate-roms script 2026-03-08 23:56:44 +00:00
poprhythm 9d084f3f19 Add RomM retro game library manager 
MariaDB backend, library on NAS via /mnt/nas_games CIFS automount,
EmulatorJS built-in for browser-based play.
 2026-03-08 22:06:53 +00:00
poprhythm adcaa39e41 calibre: move SQLite DBs to local SSD, sync library to NAS via lsyncd 2026-03-08 00:03:17 +00:00
poprhythm 964c8bedf3 Configure Ollama to bind on all interfaces for remote access 2026-03-07 03:41:52 +00:00
poprhythm 35a6715f01 Add Firefly III data import plan 
Documents FIDI + SimpleFIN approach for Capital One and Citi bank import,
including OFX Direct Connect option for Citi and the FIDI compose snippet.
 2026-03-06 20:06:22 +00:00
poprhythm 2925305ded Add Firefly III personal finance manager 
PostgreSQL backend, npm-network integration, uploads/db on /srv/firefly-iii/.
 2026-03-06 19:47:04 +00:00
poprhythm a92d4d21d5 Add Gmail filter cleanup script to remove dead/redundant filters 2026-03-06 18:47:10 +00:00
poprhythm 06646b5dee Fix gmail-label-cleanup: reduce batch size to 100 (API limit) 2026-03-06 16:04:15 +00:00
poprhythm 1bb41f5cc9 Fix gmail-label-cleanup: use GmailLabel methods instead of GmailApp 2026-03-06 16:03:20 +00:00
poprhythm 3c6e1588e7 Add Gmail label cleanup script for inbox-zero migration 2026-03-06 16:00:22 +00:00
poprhythm d50e696162 minecraft: disable hardcore+survival, add mem_limits, keep terra active 2026-03-06 13:09:19 +00:00
poprhythm 9bd4b70960 Fix inbox-zero: OLLAMA_BASE_URL must include /api path prefix 2026-03-06 04:27:59 +00:00
poprhythm 1e13be7739 Fix inbox-zero: bind web server to 0.0.0.0 for npm-network access 2026-03-06 04:02:04 +00:00
poprhythm b7b9dc91b4 Fix portainer.sh deploy: forward extra args (env vars) to cmd_deploy 2026-03-06 03:55:53 +00:00
poprhythm a08c7ffbcb Add inbox-zero service (Gmail AI assistant, Ollama backend) 2026-03-06 03:46:45 +00:00
poprhythm b615c503cd Fix clue-picker: remove host port binding (NPM handles ingress) 2026-03-04 20:11:40 +00:00
poprhythm 460afd7221 Add clue-picker service (docker-registry image, port 3001) 2026-03-04 20:07:33 +00:00
poprhythm 9a9d0562ae Fix ocis: replace Docker NFS volume with systemd automount bind mount 
Same pattern as calibre fix — Docker NFS named volumes with soft mount
fail when unRAID drives spin down. Use systemd NFS automount at
/mnt/nas_owncloud instead; hard mount blocks on spin-up rather than EIO.
 2026-03-02 03:59:43 +00:00
poprhythm aee517463d Fix calibre: switch to NFS systemd automount bind mounts 
CIFS uid/gid mismatch caused Permission denied on files created via NFS
(cert.key, .gnupg, etc. owned by uid=99 with mode 600/700; SMB user
can't access them server-side). NFS maps uid/gid directly, avoiding the
issue. Use hard mount so spin-up blocks briefly instead of returning EIO.
 2026-03-02 03:45:31 +00:00
poprhythm eb5f9117c8 Fix calibre: use /mnt/media (consolidate with existing mount point) 
/mnt/media already existed; no need for a separate /mnt/nas_media.
Same CIFS share (//192.168.1.192/media), shorter bind mount paths.
 2026-03-02 01:15:19 +00:00
poprhythm ebd813afcc Fix calibre: replace NFS volumes with systemd automount bind mounts 
SQLite (Calibre Notes DB) fails with SQLITE_IOERR on soft NFS when unRAID
drives spin down. Replace Docker NFS named volumes with bind mounts to
/mnt/nas_media (CIFS via systemd automount), same pattern as backrest and
filebrowser-colleen-hd. systemd handles drive reconnection independently.
 2026-03-02 01:06:29 +00:00
poprhythm d186aec6e5 Switch ocis NAS share from SMB to NFS Docker named volume 
Replace /mnt/nas_owncloud CIFS bind mount with nas_owncloud external
NFS volume (192.168.1.192:/mnt/user/owncloud). Removes dependency on
systemd CIFS automount units.
 2026-03-01 14:56:25 +00:00
poprhythm e2050fee96 Fix Spoolman: remove user override, add PUID/PGID env vars 2026-03-01 04:29:31 +00:00
poprhythm 860b7772cc Add Spoolman filament spool manager 2026-03-01 04:27:40 +00:00
poprhythm 0cd293e763 Fix ownCloud Desktop OIDC client config in Authelia 
- Change public: true → false (desktop app sends client_secret_basic)
- Add client_secret reference to secrets file
- Add token_endpoint_auth_method: client_secret_basic
- Add response_types: [code] (required for offline_access scope)
- Add grant_types: [authorization_code, refresh_token] (required to issue refresh_token)
 2026-03-01 02:53:14 +00:00
poprhythm ec56e1f68e Fix ownCloud Desktop client_id (missing '69' suffix) 2026-03-01 01:12:12 +00:00
poprhythm 9d5f5cec43 Add ownCloud Desktop OIDC client to Authelia 
Uses the well-known desktop app client_id with localhost redirect URI
for PKCE authentication flow (RFC 8252 loopback).
 2026-03-01 01:11:13 +00:00
poprhythm 650be93503 Add get-env/set-env commands to portainer.sh; fix redeploy env var wipe 
- get-env: display env vars for a named stack
- set-env: merge KEY=VALUE pairs into a stack's env vars and redeploy
  (uses git/redeploy endpoint with pullImage:false for git-linked stacks)
- redeploy: now preserves existing env vars by including them in the
  git/redeploy payload (previously wiped them when env was omitted)
 2026-03-01 01:02:49 +00:00
poprhythm 6ad7e74c39 Add portainer.sh management script (list/redeploy/deploy) 2026-03-01 00:46:48 +00:00
poprhythm 4f1c422d4d Store oCIS user files on unRAID owncloud share 2026-03-01 00:40:38 +00:00
poprhythm f03033b176 Set OCIS_ADMIN_USER_ID for poprhythm 2026-02-28 23:42:52 +00:00
poprhythm 294bbde259 Add CSP config to allow Authelia OIDC connections from browser 2026-02-28 23:39:08 +00:00
poprhythm dab1267e90 Add CORS config to Authelia OIDC for browser-based PKCE clients 2026-02-28 23:33:12 +00:00
poprhythm fc886e89e0 Fix oCIS init: pipe answer to avoid interactive prompt 2026-02-28 23:22:28 +00:00
poprhythm 827675d847 Add oCIS cloud storage with Authelia OIDC 
Deploy ownCloud Infinite Scale as a self-hosted cloud storage service
at cloud.kolpacksoftware.com using Authelia as the external OIDC IdP.
Configures a PKCE public client (no secret required).
 2026-02-28 23:19:28 +00:00
poprhythm 1c8547d5da Remove picoshare and dashy (unused services) 2026-02-28 23:00:39 +00:00
poprhythm 44c773c943 Mount Docker config into Watchtower for private registry auth 2026-02-28 16:22:07 +00:00
poprhythm 3417fdcfaa Exclude unupdatable containers from Watchtower 
- dns-updateip: local image not on any registry
- immich redis/postgres: pinned by digest, no floating tag
 2026-02-28 16:07:23 +00:00
poprhythm dce25c6ed4 Add Telegram notifications to Watchtower via Shoutrrr 2026-02-28 15:57:43 +00:00
poprhythm acfde6f040 Upgrade Uptime Kuma from v1 to v2 2026-02-28 14:58:33 +00:00
poprhythm 10d008636c Enable watchtower image cleanup after updates 2026-02-28 14:50:11 +00:00
poprhythm 66664a5925 Fix open-webui OIDC token auth method to client_secret_basic 
Open WebUI (authlib) sends credentials in the Authorization header
(client_secret_basic), not the POST body. Authelia was rejecting it.
 2026-02-27 03:08:30 +00:00
poprhythm bfb71d67d2 Add Immich OIDC client to Authelia 2026-02-27 03:01:56 +00:00
poprhythm 696398a863 Document OIDC JWK key handling in git config 
path:// scheme not supported for key field in Authelia 4.38.
Host copy inlines the PEM as a YAML block scalar written via Python.
 2026-02-26 20:49:19 +00:00
poprhythm e6d4b0a349 Revert OIDC client secrets to file-based approach 
Bcrypt hashes contain $ signs which Portainer interpolates when storing
as env vars, truncating the values. Use {{ secret "file" }} template
syntax instead — hashes live in /srv/authelia/config/secrets/ on the
host, written via Python to avoid shell interpolation.

Only $ -safe values (hex strings) remain as env vars.
 2026-02-26 20:03:03 +00:00
poprhythm 39f6ca8530 Fix Authelia OIDC client secret syntax to use template filter 
expand-env double-processes substituted values so $ in bcrypt hashes
get re-expanded. Switch back to template filter with {{ env "VAR" }}
syntax which returns values as-is.
 2026-02-26 20:00:44 +00:00
poprhythm 907d214b5c Fix Authelia OIDC config to use expand-env filter with ${VAR} substitution 
- Switch X_AUTHELIA_CONFIG_FILTERS from template to expand-env so ${VAR}
  syntax in config files is actually substituted
- Add missing env var pass-throughs for OIDC HMAC secret and client secrets
- Update git config client_secret fields to use ${VAR} syntax (matching host)
- Update .env.example to document all required Portainer env vars
 2026-02-26 19:57:55 +00:00
poprhythm 6e62d9ba2f Fix obico model_cache mount path to /model_cache/ml_api 2026-02-26 17:04:22 +00:00
poprhythm a6f2d4c4b2 Mount model_cache volume for Obico ML model weights 
Model weights (~193MB each, darknet + onnx) are stored at
/srv/obico/config/model_cache/ and mounted at /model_cache in the
container since they are not baked into the imagegenius image.
 2026-02-26 16:46:28 +00:00
poprhythm 196613f684 Add Obico server for 3D printer failure detection 
imagegenius monolithic image with NVIDIA GPU (GTX 1660 SUPER) via cuda tag.
Includes internal Redis, npm-network for reverse proxy, DJANGO_SECRET_KEY
as env var placeholder for Portainer.
 2026-02-26 16:26:34 +00:00
poprhythm 5e91f0c68b Fix Authelia OIDC client secrets using template secret files 
- Switch from unsupported \${VAR} substitution to {{ secret "..." }} template syntax
- Enable X_AUTHELIA_CONFIG_FILTERS=template in compose
- Client secrets now loaded from /config/secrets/oidc_* files on host
- Use PBKDF2-SHA512 hashes (not bcrypt, not plaintext)
 2026-02-26 02:04:52 +00:00
poprhythm 0ce030275b Add OIDC secret placeholders to .env.example files 
- Add OIDC HMAC and client secrets to authelia/.env.example
- Create ollama/.env.example with OIDC client secret placeholder
 2026-02-26 01:42:34 +00:00
poprhythm 645d908ca5 Add Authelia OIDC SSO to Open WebUI 
- Add open-webui OIDC client to Authelia config
- Configure open-webui with OIDC env vars pointing to Authelia
- Secret managed via AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI env var in Portainer
 2026-02-26 01:37:28 +00:00
poprhythm 94819639dd Add LiveSync synchronization method step to Obsidian setup guide 2026-02-24 18:02:18 +00:00
poprhythm e923fe0655 Add Obsidian LiveSync setup guide with verified step-by-step instructions 2026-02-24 17:55:10 +00:00
poprhythm fecb4831ad Add Brave API key to openclaw, fix uptime-kuma auth and TCP monitors 
- openclaw: expose BRAVE_API_KEY env var for web search tool
- uptime-kuma: prefer username/password auth (API key token auth unreliable)
- uptime-kuma: add TCP monitor type support to manage_monitors.py
 2026-02-23 19:14:01 +00:00
poprhythm c4157023f6 Add token_endpoint_auth_method: client_secret_post to linkding OIDC client 2026-02-23 19:00:11 +00:00
poprhythm 38d5edc37f Fix linkding OIDC env var names: drop LD_ prefix from provider settings 2026-02-23 18:56:00 +00:00
poprhythm d0037cf4cd Add Linkding OIDC via Authelia, fix jwks key name in config 
- linkding: add OIDC env vars pointing to Authelia as identity provider
- authelia/config: fix issuer_private_keys → jwks (correct key for 4.38.x)
  and replace non-functional template function with host-managed note
 2026-02-23 18:45:33 +00:00
poprhythm 4c838e1989 code-server: mount /srv/authelia/config for editing users_database.yaml 2026-02-23 15:25:26 +00:00
poprhythm 3ec74c1f69 Restrict wildcard rule to admins; jsmith (guests) can only access ultralytics 2026-02-23 14:41:18 +00:00
poprhythm 4ec70062ce revert 877d916c15 
revert Update ultralytics/docker-compose.yml
 2026-02-23 13:43:05 +00:00
poprhythm 877d916c15 Update ultralytics/docker-compose.yml 2026-02-23 13:40:28 +00:00
poprhythm 4293022561 Fix authelia: default_redirection_url must differ from authelia_url 2026-02-22 20:26:00 +00:00
poprhythm 9f98a4081e Add Authelia SSO, remove authentik, restrict ultralytics port 
- Add authelia/ stack: Authelia 4.38 + Redis 7-alpine on isolated
  authelia-internal bridge; Authelia also on npm-network for NPM
  forward-auth. Secrets via env vars (not committed).
- Add authelia/config/configuration.yaml: file-based users, SQLite
  storage, one_factor policy for *.kolpacksoftware.com
- Add **/users_database.yaml to .gitignore (host-only secret)
- Remove authentik/ (non-functional leftover)
- ultralytics: bind port 8501 to 127.0.0.1 only (auth enforced via NPM)
 2026-02-22 20:21:11 +00:00
poprhythm 717ba151e5 Rename leafweb-vision to ultralytics 2026-02-22 19:50:12 +00:00
poprhythm 7ef6d248da Load yolo-plant-leaf-detection model as default in Streamlit UI 
Run streamlit directly to pass model path via -- arg, loading
yolo11x_leaf.pt as the preselected model in the sidebar dropdown.
 2026-02-21 19:58:49 +00:00
poprhythm aa9560569f Fix leafweb-vision: use YAML list form for command to avoid parse errors 2026-02-21 19:53:32 +00:00
poprhythm 697818845d Fix leafweb-vision: patch cv2.destroyAllWindows via sed at startup 
opencv-python-headless swap doesn't override conda's cv2. Instead,
sed-patch the one offending line in streamlit_inference.py directly.
 2026-02-21 19:51:49 +00:00
poprhythm eebb5d11d0 Fix leafweb-vision OpenCV headless error on cv2.destroyAllWindows 
Replace opencv-python with opencv-python-headless so GUI calls are
no-ops instead of crashing in a display-less container.
 2026-02-21 19:49:00 +00:00
poprhythm 3eeaa8ff6d Fix leafweb-vision: use yolo solutions inference + install streamlit at startup 
streamlit-predict was removed in newer ultralytics; yolo solutions inference
is the current equivalent. Installs streamlit on startup via pip cache volume.
 2026-02-21 19:46:00 +00:00