homelab/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
249 Commits 1 Branch 0 Tags
98d64139fe2a19e8086795bae40ca28197ddce87
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
poprhythm 98d64139fe couchdb: mount persistent CORS config to survive container updates 2026-04-26 23:20:59 +00:00
poprhythm ca170af736 watchtower: remove debug logging now that scan/update/cleanup is confirmed working 2026-04-26 22:08:21 +00:00
poprhythm a925d61e83 watchtower: add debug logging + disable self-update to diagnose scanned=0 2026-04-26 17:18:05 +00:00
poprhythm 2c90e4218b watchtower: switch to nickfedor/watchtower fork (containrrr archived Dec 2025, Docker API 1.25 incompatible) 2026-04-26 17:02:34 +00:00
poprhythm ba8f1f7668 minecraft: update battle server seed to 9037888329883360986 2026-04-05 22:38:42 +00:00
poprhythm c1c86e3ab2 minecraft: add ViaVersion to battle server for cross-version client support 2026-04-03 16:22:08 +00:00
poprhythm 26c89ebb39 minecraft: fix MODRINTH_PROJECTS separator (comma not space) 2026-04-03 16:18:22 +00:00
poprhythm d4a23d0d6f minecraft: add Paper + EzCountdown + WorldResetPlugin to battle server 2026-04-03 16:16:09 +00:00
poprhythm 5353df05fb minecraft: add battle server on port 25573 for kids PVP 
Survival mode, seed 854721609616927000, PVP enabled.
30-min resource gather then battle.
 2026-04-03 16:10:09 +00:00
poprhythm 76e02bf26d authelia: add ownCloud iOS OIDC client to git config 2026-03-29 18:59:51 +00:00
poprhythm c58ffb1b68 romm: pass ScreenScraper credentials via Portainer env vars 2026-03-20 22:03:49 +00:00
poprhythm 03d4dae8b5 inbox-zero: add REDIS_URL env var for email-stream / Deep Clean 
REDIS_URL was not set, causing "REDIS_URL is not set" errors in
/api/email-stream which powers the Deep Clean full-inbox scan.
 2026-03-14 14:34:45 +00:00
poprhythm 9dee75e2a0 docs: update NAS connection strategies for Immich and nas_library/nas_family mounts 2026-03-14 02:10:52 +00:00
poprhythm b2d7f82c53 immich: migrate upload volume from NFS named volume to CIFS systemd bind mount 
Replace fragile Docker NFS named volume with /mnt/nas_family/immich-library
bind mount backed by systemd mnt-nas_family.mount (permanent CIFS).
 2026-03-14 02:04:33 +00:00
poprhythm f1a9346861 map-frontend: fix @protomaps/basemaps version (4 doesn't exist, use 5) 2026-03-13 14:24:44 +00:00
poprhythm a483c2e7fc map-frontend: use absolute /srv paths for nginx config and html mounts 2026-03-13 14:19:57 +00:00
poprhythm cd232d93ac map-frontend: fix nginx config mount (dir instead of file) 2026-03-13 14:14:55 +00:00
poprhythm ef1d136a3e Add map-frontend (nginx + MapLibre GL), make pmtiles internal-only 
- map-frontend: nginx serves MapLibre GL static app, proxies /tiles/ to pmtiles internally
- pmtiles: remove host port binding (internal to npm-network only), update public-url
- 5 themes: light, dark, grayscale, white, black
 2026-03-13 14:14:16 +00:00
poprhythm 662b558d21 torrents: document NPM web UI instance labels (OPEN/VPN badges) 2026-03-13 03:36:52 +00:00
poprhythm d7d20cd080 torrents: add nas_library bind mount to qbittorrent_open 2026-03-12 20:53:36 +00:00
poprhythm 0b4571205a Add kiwix and pmtiles services with NAS library share mounts 2026-03-12 19:50:18 +00:00
poprhythm 97ff83a246 romm: add arcade (FBNeo) to populate-roms, add IGDB credentials 
100 arcade titles spanning Pac-Man/Namco classics, Street Fighter,
Mortal Kombat, Metal Slug, King of Fighters, Samurai Shodown,
Fatal Fury, beat-em-ups (TMNT, Simpsons, X-Men), and more.

Also adds IGDB_CLIENT_ID/SECRET env vars for metadata scraping.
 2026-03-10 01:54:53 +00:00
poprhythm 0fe632e1b5 stable-diffusion: disable ai-dock service portal auth 2026-03-09 03:09:44 +00:00
poprhythm aa686d0827 romm: add GB, GBA, and Amiga to populate-roms script 
32 Game Boy, 36 GBA, and 41 Amiga titles. Amiga includes the full
Lemmings trilogy plus Turrican, Monkey Island, Chaos Engine, Worms,
Sensible Soccer, and more. Note: Amiga requires Kickstart firmware
(not in No-Intro) to actually run.
 2026-03-09 02:13:53 +00:00
poprhythm 597ed26f89 romm: add IGDB credentials, add populate-roms script 2026-03-08 23:56:44 +00:00
poprhythm 9d084f3f19 Add RomM retro game library manager 
MariaDB backend, library on NAS via /mnt/nas_games CIFS automount,
EmulatorJS built-in for browser-based play.
 2026-03-08 22:06:53 +00:00
poprhythm adcaa39e41 calibre: move SQLite DBs to local SSD, sync library to NAS via lsyncd 2026-03-08 00:03:17 +00:00
poprhythm 964c8bedf3 Configure Ollama to bind on all interfaces for remote access 2026-03-07 03:41:52 +00:00
poprhythm 35a6715f01 Add Firefly III data import plan 
Documents FIDI + SimpleFIN approach for Capital One and Citi bank import,
including OFX Direct Connect option for Citi and the FIDI compose snippet.
 2026-03-06 20:06:22 +00:00
poprhythm 2925305ded Add Firefly III personal finance manager 
PostgreSQL backend, npm-network integration, uploads/db on /srv/firefly-iii/.
 2026-03-06 19:47:04 +00:00
poprhythm a92d4d21d5 Add Gmail filter cleanup script to remove dead/redundant filters 2026-03-06 18:47:10 +00:00
poprhythm 06646b5dee Fix gmail-label-cleanup: reduce batch size to 100 (API limit) 2026-03-06 16:04:15 +00:00
poprhythm 1bb41f5cc9 Fix gmail-label-cleanup: use GmailLabel methods instead of GmailApp 2026-03-06 16:03:20 +00:00
poprhythm 3c6e1588e7 Add Gmail label cleanup script for inbox-zero migration 2026-03-06 16:00:22 +00:00
poprhythm d50e696162 minecraft: disable hardcore+survival, add mem_limits, keep terra active 2026-03-06 13:09:19 +00:00
poprhythm 9bd4b70960 Fix inbox-zero: OLLAMA_BASE_URL must include /api path prefix 2026-03-06 04:27:59 +00:00
poprhythm 1e13be7739 Fix inbox-zero: bind web server to 0.0.0.0 for npm-network access 2026-03-06 04:02:04 +00:00
poprhythm b7b9dc91b4 Fix portainer.sh deploy: forward extra args (env vars) to cmd_deploy 2026-03-06 03:55:53 +00:00
poprhythm a08c7ffbcb Add inbox-zero service (Gmail AI assistant, Ollama backend) 2026-03-06 03:46:45 +00:00
poprhythm b615c503cd Fix clue-picker: remove host port binding (NPM handles ingress) 2026-03-04 20:11:40 +00:00
poprhythm 460afd7221 Add clue-picker service (docker-registry image, port 3001) 2026-03-04 20:07:33 +00:00
poprhythm 9a9d0562ae Fix ocis: replace Docker NFS volume with systemd automount bind mount 
Same pattern as calibre fix — Docker NFS named volumes with soft mount
fail when unRAID drives spin down. Use systemd NFS automount at
/mnt/nas_owncloud instead; hard mount blocks on spin-up rather than EIO.
 2026-03-02 03:59:43 +00:00
poprhythm aee517463d Fix calibre: switch to NFS systemd automount bind mounts 
CIFS uid/gid mismatch caused Permission denied on files created via NFS
(cert.key, .gnupg, etc. owned by uid=99 with mode 600/700; SMB user
can't access them server-side). NFS maps uid/gid directly, avoiding the
issue. Use hard mount so spin-up blocks briefly instead of returning EIO.
 2026-03-02 03:45:31 +00:00
poprhythm eb5f9117c8 Fix calibre: use /mnt/media (consolidate with existing mount point) 
/mnt/media already existed; no need for a separate /mnt/nas_media.
Same CIFS share (//192.168.1.192/media), shorter bind mount paths.
 2026-03-02 01:15:19 +00:00
poprhythm ebd813afcc Fix calibre: replace NFS volumes with systemd automount bind mounts 
SQLite (Calibre Notes DB) fails with SQLITE_IOERR on soft NFS when unRAID
drives spin down. Replace Docker NFS named volumes with bind mounts to
/mnt/nas_media (CIFS via systemd automount), same pattern as backrest and
filebrowser-colleen-hd. systemd handles drive reconnection independently.
 2026-03-02 01:06:29 +00:00
poprhythm d186aec6e5 Switch ocis NAS share from SMB to NFS Docker named volume 
Replace /mnt/nas_owncloud CIFS bind mount with nas_owncloud external
NFS volume (192.168.1.192:/mnt/user/owncloud). Removes dependency on
systemd CIFS automount units.
 2026-03-01 14:56:25 +00:00
poprhythm e2050fee96 Fix Spoolman: remove user override, add PUID/PGID env vars 2026-03-01 04:29:31 +00:00
poprhythm 860b7772cc Add Spoolman filament spool manager 2026-03-01 04:27:40 +00:00
poprhythm 0cd293e763 Fix ownCloud Desktop OIDC client config in Authelia 
- Change public: true → false (desktop app sends client_secret_basic)
- Add client_secret reference to secrets file
- Add token_endpoint_auth_method: client_secret_basic
- Add response_types: [code] (required for offline_access scope)
- Add grant_types: [authorization_code, refresh_token] (required to issue refresh_token)
 2026-03-01 02:53:14 +00:00
poprhythm ec56e1f68e Fix ownCloud Desktop client_id (missing '69' suffix) 2026-03-01 01:12:12 +00:00
poprhythm 9d5f5cec43 Add ownCloud Desktop OIDC client to Authelia 
Uses the well-known desktop app client_id with localhost redirect URI
for PKCE authentication flow (RFC 8252 loopback).
 2026-03-01 01:11:13 +00:00
poprhythm 650be93503 Add get-env/set-env commands to portainer.sh; fix redeploy env var wipe 
- get-env: display env vars for a named stack
- set-env: merge KEY=VALUE pairs into a stack's env vars and redeploy
  (uses git/redeploy endpoint with pullImage:false for git-linked stacks)
- redeploy: now preserves existing env vars by including them in the
  git/redeploy payload (previously wiped them when env was omitted)
 2026-03-01 01:02:49 +00:00
poprhythm 6ad7e74c39 Add portainer.sh management script (list/redeploy/deploy) 2026-03-01 00:46:48 +00:00
poprhythm 4f1c422d4d Store oCIS user files on unRAID owncloud share 2026-03-01 00:40:38 +00:00
poprhythm f03033b176 Set OCIS_ADMIN_USER_ID for poprhythm 2026-02-28 23:42:52 +00:00
poprhythm 294bbde259 Add CSP config to allow Authelia OIDC connections from browser 2026-02-28 23:39:08 +00:00
poprhythm dab1267e90 Add CORS config to Authelia OIDC for browser-based PKCE clients 2026-02-28 23:33:12 +00:00
poprhythm fc886e89e0 Fix oCIS init: pipe answer to avoid interactive prompt 2026-02-28 23:22:28 +00:00
poprhythm 827675d847 Add oCIS cloud storage with Authelia OIDC 
Deploy ownCloud Infinite Scale as a self-hosted cloud storage service
at cloud.kolpacksoftware.com using Authelia as the external OIDC IdP.
Configures a PKCE public client (no secret required).
 2026-02-28 23:19:28 +00:00
poprhythm 1c8547d5da Remove picoshare and dashy (unused services) 2026-02-28 23:00:39 +00:00
poprhythm 44c773c943 Mount Docker config into Watchtower for private registry auth 2026-02-28 16:22:07 +00:00
poprhythm 3417fdcfaa Exclude unupdatable containers from Watchtower 
- dns-updateip: local image not on any registry
- immich redis/postgres: pinned by digest, no floating tag
 2026-02-28 16:07:23 +00:00
poprhythm dce25c6ed4 Add Telegram notifications to Watchtower via Shoutrrr 2026-02-28 15:57:43 +00:00
poprhythm acfde6f040 Upgrade Uptime Kuma from v1 to v2 2026-02-28 14:58:33 +00:00
poprhythm 10d008636c Enable watchtower image cleanup after updates 2026-02-28 14:50:11 +00:00
poprhythm 66664a5925 Fix open-webui OIDC token auth method to client_secret_basic 
Open WebUI (authlib) sends credentials in the Authorization header
(client_secret_basic), not the POST body. Authelia was rejecting it.
 2026-02-27 03:08:30 +00:00
poprhythm bfb71d67d2 Add Immich OIDC client to Authelia 2026-02-27 03:01:56 +00:00
poprhythm 696398a863 Document OIDC JWK key handling in git config 
path:// scheme not supported for key field in Authelia 4.38.
Host copy inlines the PEM as a YAML block scalar written via Python.
 2026-02-26 20:49:19 +00:00
poprhythm e6d4b0a349 Revert OIDC client secrets to file-based approach 
Bcrypt hashes contain $ signs which Portainer interpolates when storing
as env vars, truncating the values. Use {{ secret "file" }} template
syntax instead — hashes live in /srv/authelia/config/secrets/ on the
host, written via Python to avoid shell interpolation.

Only $ -safe values (hex strings) remain as env vars.
 2026-02-26 20:03:03 +00:00
poprhythm 39f6ca8530 Fix Authelia OIDC client secret syntax to use template filter 
expand-env double-processes substituted values so $ in bcrypt hashes
get re-expanded. Switch back to template filter with {{ env "VAR" }}
syntax which returns values as-is.
 2026-02-26 20:00:44 +00:00
poprhythm 907d214b5c Fix Authelia OIDC config to use expand-env filter with ${VAR} substitution 
- Switch X_AUTHELIA_CONFIG_FILTERS from template to expand-env so ${VAR}
  syntax in config files is actually substituted
- Add missing env var pass-throughs for OIDC HMAC secret and client secrets
- Update git config client_secret fields to use ${VAR} syntax (matching host)
- Update .env.example to document all required Portainer env vars
 2026-02-26 19:57:55 +00:00
poprhythm 6e62d9ba2f Fix obico model_cache mount path to /model_cache/ml_api 2026-02-26 17:04:22 +00:00
poprhythm a6f2d4c4b2 Mount model_cache volume for Obico ML model weights 
Model weights (~193MB each, darknet + onnx) are stored at
/srv/obico/config/model_cache/ and mounted at /model_cache in the
container since they are not baked into the imagegenius image.
 2026-02-26 16:46:28 +00:00
poprhythm 196613f684 Add Obico server for 3D printer failure detection 
imagegenius monolithic image with NVIDIA GPU (GTX 1660 SUPER) via cuda tag.
Includes internal Redis, npm-network for reverse proxy, DJANGO_SECRET_KEY
as env var placeholder for Portainer.
 2026-02-26 16:26:34 +00:00
poprhythm 5e91f0c68b Fix Authelia OIDC client secrets using template secret files 
- Switch from unsupported \${VAR} substitution to {{ secret "..." }} template syntax
- Enable X_AUTHELIA_CONFIG_FILTERS=template in compose
- Client secrets now loaded from /config/secrets/oidc_* files on host
- Use PBKDF2-SHA512 hashes (not bcrypt, not plaintext)
 2026-02-26 02:04:52 +00:00
poprhythm 0ce030275b Add OIDC secret placeholders to .env.example files 
- Add OIDC HMAC and client secrets to authelia/.env.example
- Create ollama/.env.example with OIDC client secret placeholder
 2026-02-26 01:42:34 +00:00
poprhythm 645d908ca5 Add Authelia OIDC SSO to Open WebUI 
- Add open-webui OIDC client to Authelia config
- Configure open-webui with OIDC env vars pointing to Authelia
- Secret managed via AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI env var in Portainer
 2026-02-26 01:37:28 +00:00
poprhythm 94819639dd Add LiveSync synchronization method step to Obsidian setup guide 2026-02-24 18:02:18 +00:00
poprhythm e923fe0655 Add Obsidian LiveSync setup guide with verified step-by-step instructions 2026-02-24 17:55:10 +00:00
poprhythm fecb4831ad Add Brave API key to openclaw, fix uptime-kuma auth and TCP monitors 
- openclaw: expose BRAVE_API_KEY env var for web search tool
- uptime-kuma: prefer username/password auth (API key token auth unreliable)
- uptime-kuma: add TCP monitor type support to manage_monitors.py
 2026-02-23 19:14:01 +00:00
poprhythm c4157023f6 Add token_endpoint_auth_method: client_secret_post to linkding OIDC client 2026-02-23 19:00:11 +00:00
poprhythm 38d5edc37f Fix linkding OIDC env var names: drop LD_ prefix from provider settings 2026-02-23 18:56:00 +00:00
poprhythm d0037cf4cd Add Linkding OIDC via Authelia, fix jwks key name in config 
- linkding: add OIDC env vars pointing to Authelia as identity provider
- authelia/config: fix issuer_private_keys → jwks (correct key for 4.38.x)
  and replace non-functional template function with host-managed note
 2026-02-23 18:45:33 +00:00
poprhythm 4c838e1989 code-server: mount /srv/authelia/config for editing users_database.yaml 2026-02-23 15:25:26 +00:00
poprhythm 3ec74c1f69 Restrict wildcard rule to admins; jsmith (guests) can only access ultralytics 2026-02-23 14:41:18 +00:00
poprhythm 4ec70062ce revert 877d916c15 
revert Update ultralytics/docker-compose.yml
 2026-02-23 13:43:05 +00:00
poprhythm 877d916c15 Update ultralytics/docker-compose.yml 2026-02-23 13:40:28 +00:00
poprhythm 4293022561 Fix authelia: default_redirection_url must differ from authelia_url 2026-02-22 20:26:00 +00:00
poprhythm 9f98a4081e Add Authelia SSO, remove authentik, restrict ultralytics port 
- Add authelia/ stack: Authelia 4.38 + Redis 7-alpine on isolated
  authelia-internal bridge; Authelia also on npm-network for NPM
  forward-auth. Secrets via env vars (not committed).
- Add authelia/config/configuration.yaml: file-based users, SQLite
  storage, one_factor policy for *.kolpacksoftware.com
- Add **/users_database.yaml to .gitignore (host-only secret)
- Remove authentik/ (non-functional leftover)
- ultralytics: bind port 8501 to 127.0.0.1 only (auth enforced via NPM)
 2026-02-22 20:21:11 +00:00
poprhythm 717ba151e5 Rename leafweb-vision to ultralytics 2026-02-22 19:50:12 +00:00
poprhythm 7ef6d248da Load yolo-plant-leaf-detection model as default in Streamlit UI 
Run streamlit directly to pass model path via -- arg, loading
yolo11x_leaf.pt as the preselected model in the sidebar dropdown.
 2026-02-21 19:58:49 +00:00
poprhythm aa9560569f Fix leafweb-vision: use YAML list form for command to avoid parse errors 2026-02-21 19:53:32 +00:00
poprhythm 697818845d Fix leafweb-vision: patch cv2.destroyAllWindows via sed at startup 
opencv-python-headless swap doesn't override conda's cv2. Instead,
sed-patch the one offending line in streamlit_inference.py directly.
 2026-02-21 19:51:49 +00:00
poprhythm eebb5d11d0 Fix leafweb-vision OpenCV headless error on cv2.destroyAllWindows 
Replace opencv-python with opencv-python-headless so GUI calls are
no-ops instead of crashing in a display-less container.
 2026-02-21 19:49:00 +00:00
poprhythm 3eeaa8ff6d Fix leafweb-vision: use yolo solutions inference + install streamlit at startup 
streamlit-predict was removed in newer ultralytics; yolo solutions inference
is the current equivalent. Installs streamlit on startup via pip cache volume.
 2026-02-21 19:46:00 +00:00
poprhythm 0aae4324a8 Add leafweb-vision service with YOLO Streamlit web UI 
Runs ultralytics/ultralytics with yolo streamlit-predict on port 8501,
NVIDIA GPU passthrough, and npm-network for reverse proxy access.
 2026-02-21 19:39:59 +00:00
poprhythm 1944589989 Revert OLLAMA_NUM_CTX (not a valid env var; using Modelfile instead) 2026-02-20 22:27:49 +00:00
poprhythm 03bf4bc05c Set OLLAMA_NUM_CTX=16384 to prevent prompt truncation for openclaw 2026-02-20 22:23:15 +00:00
poprhythm 2ab1cccdc8 Switch openclaw default model to qwen2.5:7b (supports tools) 2026-02-20 22:11:54 +00:00
poprhythm 0b38b19d20 Fix openclaw model contextWindow to 32768 (minimum is 16000) 2026-02-20 22:08:29 +00:00