Vault warden and backup

backup/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:latest
+RUN apk add --no-cache rsync tzdata
+
+COPY backup.sh /usr/local/bin/backup.sh
+RUN chmod +x /usr/local/bin/backup.sh
+
+CMD ["crond", "-f", "-l", "2"]

backup/backup.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Format the current date
+NOW=$(date +"%Y-%m-%d")
+
+# Create the archive directory if it does not exist
+mkdir -p /backup/archive
+
+# Run rsync with an exclude file and a backup directory for changed/deleted files
+rsync -av --delete \
+  --exclude-from=/config/exclude.txt \
+  --backup --backup-dir=/backup/archive/$NOW \
+  /data/ /backup/latest/
+
+# Find and delete archive directories older than 7 days
+find /backup/archive/ -mindepth 1 -maxdepth 1 -type d -mtime +7 -exec rm -rf {} +

backup/crontab.txt

@@ -0,0 +1,2 @@
+# Run the backup every day at 2:00 AM
+0 2 * * * /usr/local/bin/backup.sh

backup/exclude.txt

@@ -0,0 +1,4 @@
+*.log
+.backups
+.DS_Store
+._*

docker-compose.yml

@@ -5,16 +5,12 @@ x-logging: &logging
       max-size: "5m"
       max-file: "2"
 
-#x-firecrawl-service: &firecrawl-service
-#  image: ghcr.io/mendableai/firecrawl
-#
-#x-firecrawl-env: &firecrawl-env
-#  REDIS_URL: redis://redis:6379
-#  REDIS_RATE_LIMIT_URL: redis://redis:6379
-#  PLAYWRIGHT_MICROSERVICE_URL: http://playwright:3000/scrape
-
 services:
 
+  ###################################
+  #             FOUNDRY             #
+  # https://rec.scarif.space/foundy #
+  ###################################
   foundry:
     profiles: ["prod"]
     <<: *logging
@@ -44,6 +40,10 @@ services:
     networks:
       - nginx
 
+  ###################################
+  #            NEXTCLOUD            #
+  #   https://tower.scarif.space    #
+  ###################################
   nextcloud:
     profiles: ["prod", "dev"]
     <<: *logging
@@ -119,6 +119,25 @@ services:
       - "tower.${DOMAIN}:${LOCAL_IP}"
       - "office.${DOMAIN}:${LOCAL_IP}"
 
+  ###################################
+  #           VAULTWARDEN           #
+  #   https://vault.scarif.space    #
+  ###################################
+  vaultwarden:
+    image: vaultwarden/server:latest
+    restart: unless-stopped
+    environment:
+      - "DOMAIN=https://vault.${DOMAIN}"
+      - VIRTUAL_HOST=vault.${DOMAIN}
+      - LETSENCRYPT_HOST=vault.${DOMAIN}
+      - VIRTUAL_PORT=80
+    volumes:
+      - /mnt/tower/containers/vaultwarden:/data/
+
+  ###################################
+  #              GITEA              #
+  #    https://labs.scarif.space    #
+  ###################################
   gitea:
     profiles: ["prod", "dev"]
     <<: *logging
@@ -155,6 +174,10 @@ services:
     depends_on:
       - db
       
+  ###################################
+  #          AUDIOBOOKSHELF         #
+  #    https://echo.scarif.space    #
+  ###################################
   audiobookshelf:
     image: ghcr.io/advplyr/audiobookshelf:latest
     volumes:
@@ -170,6 +193,10 @@ services:
     networks:
       - nginx
 
+  ###################################
+  #              GROCY              #
+  #  https://supplies.scarif.space  #
+  ###################################
   grocy:
     image: lscr.io/linuxserver/grocy:latest
     environment:
@@ -188,6 +215,10 @@ services:
     networks:
       - nginx
 
+  ###################################
+  #             HOMEBOX             #
+  #   https://assets.scarif.space   #
+  ###################################
   homebox:
     image: ghcr.io/sysadminsmedia/homebox:latest
     restart: always
@@ -195,9 +226,7 @@ services:
       - HBOX_LOG_LEVEL=info
       - HBOX_LOG_FORMAT=text
       - HBOX_WEB_MAX_UPLOAD_SIZE=20
-      # Please consider allowing analytics to help us improve Homebox (basic computer information, no personal data)
       - HBOX_OPTIONS_ALLOW_ANALYTICS=false
-      # Use a strong random string for the pepper in production, it will be used to hash API keys and make them more secure
       - HBOX_AUTH_API_KEY_PEPPER=${HOMEBOX_API_KEY_PEPPER}
       - HBOX_OPTIONS_ALLOW_REGISTRATION=true
       - VIRTUAL_HOST=assets.${DOMAIN}
@@ -208,6 +237,10 @@ services:
     networks:
       - nginx
 
+  ###################################
+  #             SEARXNG             #
+  #  https://holocron.scarif.space  #
+  ###################################
   searxng:
     image: docker.io/searxng/searxng:latest
     restart: unless-stopped
@@ -226,6 +259,9 @@ services:
       - CERT_NAME=${DOMAIN}
     <<: *logging
 
+  ###################################
+  #           MINECRAFT             #
+  ###################################
   minecraft:
     profiles: ["prod"]
     <<: *logging
@@ -262,8 +298,12 @@ services:
       - PRUNE_BACKUPS_DAYS=30
     volumes:
       - /mnt/tower/containers/minecraft:/data
-      - /mnt/backups/minecraft:/backups
+      - /mnt/tower/containers/minecraft/backup:/backups
 
+  ###################################
+  #            NAVIDROME            #
+  #    https://radio.scarif.space   #
+  ###################################
   navidrome:
     profiles: ["prod"]
     <<: *logging
@@ -284,6 +324,10 @@ services:
     networks:
       - nginx
 
+  ###################################
+  #             PIHOLE              #
+  #     https://net.scarif.space    #
+  ###################################
   pihole:
     profiles: ["prod"]
     <<: *logging
@@ -297,129 +341,194 @@ services:
       - TZ="Europe/London"
       - WEBPASSWORD=${PIHOLE_PASSWORD}
     volumes:
-      - "/docker/pihole/etc-pihole:/etc/pihole"
+      - "/mnt/tower/containers/pihole/etc-pihole:/etc/pihole"
-      - "/docker/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
+      - "./pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
     restart: unless-stopped
     networks:
       - nginx
 
-  # jitsi:
+  ###################################
-  #   profiles: ["prod"]
+  #            DAWARICH             #
-  #   <<: *logging
+  #     https://map.scarif.space    #
-  #   image: jitsi/web:stable
+  ###################################
-  #   restart: unless-stopped
+  dawarich_app:
-  #   volumes:
+    image: freikin/dawarich:latest
-  #     - ${CONFIG}/web:/config:Z
+    container_name: dawarich_app
-  #     - ${CONFIG}/web/crontabs:/var/spool/cron/crontabs:Z
+    volumes:
-  #     - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
+      - /mnt/tower/containers/dawarich/public:/var/app/public
-  #   environment:
+      - /mnt/tower/containers/dawarich/watched:/var/app/tmp/imports/watched
-  #     - VIRTUAL_HOST=comms.${DOMAIN}
+      - /mnt/tower/containers/dawarich/storage:/var/app/storage
-  #     - LETSENCRYPT_HOST=comms.${DOMAIN}
+      - /mnt/tower/containers/dawarich/data:/dawarich_db_data
-  #     - VIRTUAL_PORT=80
+    networks:
-  #     - CERT_NAME=${DOMAIN}
+      - dawarich
-  #     - ENABLE_AUTH=1
+      - redis
-  #     - ENABLE_GUESTS=1
+      - nginx
-  #     - ENABLE_PREJOIN_PAGE=1
+    stdin_open: true
-  #     - ENABLE_WELCOME_PAGE=1
+    tty: true
-  #     - ENABLE_CLOSE_PAGE=1
+    entrypoint: web-entrypoint.sh
-  #     - ENABLE_NOISY_MIC_DETECTION=1
+    command: ['bin/rails', 'server', '-p', '3000', '-b', '::']
-  #     - ETHERPAD_TITLE="Video Chat"
+    restart: unless-stopped
-  #     - ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
+    environment:
-  #     - ETHERPAD_SKIN_NAME="colibris"
+      VIRTUAL_HOST: maps.${DOMAIN}
-  #     - ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
+      VIRTUAL_PORT: 3000
-  #     - XMPP_BOSH_URL_BASE=https://xmpp.meet.jitsi:5280
+      LETSENCRYPT_HOST: maps.${DOMAIN}
-  #     - XMPP_AUTH_DOMAIN
+      RAILS_ENV: ${RAILS_ENV:-production}
-  #     - XMPP_MUC_DOMAIN
+      PUID: ${PUID:-1000}
-  #     - XMPP_GUEST_DOMAIN
+      PGID: ${PGID:-1000}
-  #     - XMPP_RECORDER_DOMAIN
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
-  #   networks:
+      DATABASE_HOST: ${DATABASE_HOST:-dawarich_db}
-  #     nginx:
+      DATABASE_PORT: ${DATABASE_PORT:-5432}
-  #     meet.jitsi:
+      DATABASE_USERNAME: ${DATABASE_USERNAME:-postgres}
-  #
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
-  # prosody:
+      DATABASE_NAME: ${DATABASE_NAME:-dawarich_development}
-  #   profiles: ["prod"]
+      APPLICATION_HOSTS: maps.${DOMAIN},localhost,::1,127.0.0.1
-  #   <<: *logging
+      TIME_ZONE: ${TIME_ZONE:-Europe/London}
-  #   image: jitsi/prosody:stable
+      APPLICATION_PROTOCOL: ${APPLICATION_PROTOCOL:-http}
-  #   restart: unless-stopped
+      PROMETHEUS_EXPORTER_ENABLED: ${PROMETHEUS_EXPORTER_ENABLED:-false}
-  #   expose:
+      SECRET_KEY_BASE: ${DAWARICH_SECRET_KEY}
-  #     - '${XMPP_PORT:-52222}'
+      RAILS_LOG_TO_STDOUT: ${RAILS_LOG_TO_STDOUT:-true}
-  #     - '5347'
+      SELF_HOSTED: ${SELF_HOSTED:-true}
-  #     - '5280'
+      STORE_GEODATA: ${STORE_GEODATA:-true}
-  #   volumes:
+      WEB_CONCURRENCY: ${WEB_CONCURRENCY:-1}
-  #     - ${CONFIG}/prosody/config:/config:Z
+    <<: *logging
-  #     - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
+    depends_on:
-  #   environment:
+      - dawarich_db
-  #     - ENABLE_NOISY_MIC_DETECTION=1
+      - redis
-  #     - ENABLE_AUTH=1
+    deploy:
-  #     - ENABLE_GUESTS=1
+      resources:
-  #     - ENABLE_LOBBY=1
+        limits:
-  #     - XMPP_DOMAIN
+          cpus: ${APP_CPU_LIMIT:-0.50}
-  #     - XMPP_AUTH_DOMAIN
+          memory: ${APP_MEMORY_LIMIT:-4G}
-  #     - XMPP_MUC_DOMAIN
-  #     - XMPP_INTERNAL_MUC_DOMAIN
-  #     - XMPP_GUEST_DOMAIN
-  #     - JVB_AUTH_USER
-  #     - JIGASI_XMPP_USER=jigasi
-  #     - XMPP_RECORDER_DOMAIN
-  #     - JIBRI_RECORDER_USER=recorder
-  #     - JIBRI_XMPP_USER=jibri
-  #     - JICOFO_AUTH_PASSWORD=
-  #   networks:
-  #     meet.jitsi:
-  #       aliases:
-  #         - ${XMPP_SERVER:-xmpp.meet.jitsi}
-  #
-  # # Focus component
-  # jicofo:
-  #   profiles: ["prod"]
-  #   <<: *logging
-  #   image: jitsi/jicofo:stable
-  #   restart: unless-stopped
-  #   volumes:
-  #     - ${CONFIG}/jicofo:/config:Z
-  #   depends_on:
-  #     - prosody
-  #   environment:
-  #     - ENABLE_AUTH=1
-  #     - XMPP_DOMAIN
-  #     - XMPP_MUC_DOMAIN
-  #     - XMPP_INTERNAL_MUC_DOMAIN
-  #     - JVB_BREWERY_MUC
-  #     - JIGASI_BREWERY_MUC=jigasibrewery
-  #     - XMPP_RECORDER_DOMAIN
-  #     - JIBRI_BREWERY_MUC=jibribrewery
-  #     - JIBRI_PENDING_TIMEOUT=90
-  #     - JICOFO_AUTH_PASSWORD=
-  #   networks:
-  #     meet.jitsi:
-  #
-  # # Video bridge
-  # jvb:
-  #   profiles: ["prod"]
-  #   <<: *logging
-  #   image: jitsi/jvb:stable
-  #   restart: unless-stopped
-  #   ports:
-  #     - '${JVB_PORT:-10000}:${JVB_PORT:-10000}/udp'
-  #     - '127.0.0.1:${JVB_COLIBRI_PORT:-8080}:8080'
-  #   volumes:
-  #     - ${CONFIG}/jvb:/config:Z
-  #   depends_on:
-  #     - prosody
-  #   environment:
-  #     - DOCKER_HOST_ADDRESS=${LOCAL_IP}
-  #     - XMPP_SERVER
-  #     - XMPP_AUTH_DOMAIN
-  #     - XMPP_INTERNAL_MUC_DOMAIN
-  #     - JVB_BREWERY_MUC
-  #     - JVB_AUTH_USER
-  #     - JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443
-  #     - JVB_PORT
-  #   networks:
-  #     meet.jitsi:
-  #       aliases:
-  #         - jvb.meet.jitsi
 
+  dawarich_sidekiq:
+    image: freikin/dawarich:latest
+    container_name: dawarich_sidekiq
+    volumes:
+      - /mnt/tower/containers/dawarich/public:/var/app/public
+      - /mnt/tower/containers/dawarich/watched:/var/app/tmp/imports/watched
+      - /mnt/tower/containers/dawarich/storage:/var/app/storage
+    networks:
+      - dawarich
+      - redis
+    stdin_open: true
+    tty: true
+    entrypoint: sidekiq-entrypoint.sh
+    command: ['sidekiq']
+    restart: unless-stopped
+    environment:
+      RAILS_ENV: ${RAILS_ENV:-production}
+      ### To run under a non-root user, set PUID/PGID here (do NOT use `user:`).
+      # PUID: ${PUID:-1000}
+      # PGID: ${PGID:-1000}
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
+      DATABASE_HOST: ${DATABASE_HOST:-dawarich_db}
+      DATABASE_PORT: ${DATABASE_PORT:-5432}
+      DATABASE_USERNAME: ${DATABASE_USERNAME:-postgres}
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
+      DATABASE_NAME: ${DATABASE_NAME:-dawarich_development}
+      APPLICATION_HOSTS: maps.${DOMAIN},localhost,::1,127.0.0.1
+      BACKGROUND_PROCESSING_CONCURRENCY: ${BACKGROUND_PROCESSING_CONCURRENCY:-3}
+      APPLICATION_PROTOCOL: ${APPLICATION_PROTOCOL:-http}
+      PROMETHEUS_EXPORTER_ENABLED: ${PROMETHEUS_EXPORTER_ENABLED:-false}
+      SECRET_KEY_BASE: ${DAWARICH_SECRET_KEY}
+      RAILS_LOG_TO_STDOUT: ${RAILS_LOG_TO_STDOUT:-true}
+      SELF_HOSTED: ${SELF_HOSTED:-true}
+      STORE_GEODATA: ${STORE_GEODATA:-true}
+    <<: *logging
+    depends_on:
+      - dawarich_db
+      - redis
+      - dawarich_app
+
+  dawarich_db:
+    image: postgis/postgis:17-3.5-alpine
+    shm_size: 1G
+    container_name: dawarich_db
+    volumes:
+      - /mnt/tower/containers/dawarich/db:/var/lib/postgresql/data
+    networks:
+      - dawarich
+    <<: *logging
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-password}
+      POSTGRES_DB: ${POSTGRES_DB:-dawarich_development}
+    restart: always
+
+  ###################################
+  #              SURE               #
+  #  https://credits.scarif.space   #
+  ###################################
+
+  sure_app:
+    image: ghcr.io/we-promise/sure:stable
+    volumes:
+      - /mnt/tower/containers/sure:/rails/storage
+    restart: unless-stopped
+    <<: *logging
+    environment:
+      VIRTUAL_HOST: credits.${DOMAIN}
+      VIRTUAL_PORT: 3000
+      LETSENCRYPT_HOST: credits.${DOMAIN}
+      POSTGRES_USER: ${POSTGRES_USER:-sure_user}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
+      POSTGRES_DB: ${POSTGRES_DB:-sure_production}
+      SECRET_KEY_BASE: ${SURE_SECRET_KEY}
+      SELF_HOSTED: "true"
+      RAILS_FORCE_SSL: "false"
+      RAILS_ASSUME_SSL: "false"
+      DB_HOST: sure_db
+      DB_PORT: 5432
+      REDIS_URL: redis://redis:6379/1
+    depends_on:
+      - sure_db
+      - redis
+    networks:
+      - sure
+      - nginx
+      - redis
+
+  sure_worker:
+    image: ghcr.io/we-promise/sure:stable
+    command: bundle exec sidekiq
+    <<: *logging
+    volumes:
+      - /mnt/tower/containers/sure:/rails/storage
+    restart: unless-stopped
+    depends_on:
+      - sure_db
+      - redis
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-sure_user}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
+      POSTGRES_DB: ${POSTGRES_DB:-sure_production}
+      SECRET_KEY_BASE: ${SURE_SECRET_KEY}
+      SELF_HOSTED: "true"
+      RAILS_FORCE_SSL: "false"
+      RAILS_ASSUME_SSL: "false"
+      DB_HOST: sure_db
+      DB_PORT: 5432
+      REDIS_URL: redis://redis:6379/1
+    networks:
+      - sure
+      - redis
+
+  sure_db:
+    image: postgres:16
+    <<: *logging
+    restart: unless-stopped
+    volumes:
+      - /mnt/tower/containers/sure/db:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-sure_user}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
+      POSTGRES_DB: ${POSTGRES_DB:-sure_production}
+    networks:
+      - sure
+
+  ###################################
+  #            UTILITIES            #
+  ###################################
   db:
     profiles: ["prod", "dev"]
     <<: *logging
@@ -445,6 +554,7 @@ services:
       - redis
 
   mongodb:
+    <<: *logging
     profiles: ["prod", "dev"]
     image: mongo
     restart: always
@@ -456,7 +566,16 @@ services:
     environment:
       - MONGO_INITDB_ROOT_USERNAME=${DB_USER}
       - MONGO_INITDB_ROOT_PASSWORD=${DB_PASSWORD}
+
+  rsync-backup:
     <<: *logging
+    build: ./backup
+    volumes:
+      - /mnt/tower:/data:ro
+      - /mnt/backup/tower:/backup
+      - ./backup/crontab.txt:/etc/crontabs/root:ro
+      - ./backup/exclude.txt:/config/exclude.txt:ro
+    restart: unless-stopped
 
   nginx:
     <<: *logging
@@ -525,5 +644,7 @@ networks:
   db:
   nginx:
   redis:
+  sure:
+  dawarich:
   meet.jitsi:
 

pihole/etc-dnsmasq.d/02-wildcard.conf

@@ -0,0 +1 @@
+address=/scarif.space/192.168.2.158