Plenty changes

2 VM one CPU and one GPU
Also have a simple UI for the registry
Added readTimeout because big layers take too long to transfert

.gitignore

@@ -6,3 +6,6 @@ letsencrypt
 website-pro
 config/gitea/conf
 config/affine/private.key
+kopia-gcp-key.json
+config/garage
+DragnCards

Dockerfile.arch-ttyd-cpu

@@ -9,7 +9,6 @@ RUN pacman -Syu --noconfirm && \
         vim \
         nvim \
         nano \
-        htop \
         lazygit \
         ttyd \
         sudo \
@@ -17,24 +16,28 @@ RUN pacman -Syu --noconfirm && \
         net-tools \
         iputils \
         bind-tools \
+        unzip \
+        yazi \
+        go \
+        zig \
+        ripgrep \
         openssh && \
     pacman -Scc --noconfirm
 
 # Create a workspace directory
 RUN mkdir -p /data
 
-# Create entrypoint script
-RUN echo '#!/bin/bash' > /entrypoint.sh && \
-    echo 'chmod 600 /root/.ssh/id_rsa' >> /entrypoint.sh && \
-    echo 'exec ttyd -c $TTYD_USERNAME:$TTYD_PASSWORD -W -p 7681 bash' >> /entrypoint.sh && \
-    chmod +x /entrypoint.sh
-
 # Install Astronvim
 RUN git clone --depth 1 https://github.com/AstroNvim/template ~/.config/nvim && \
     rm -rf ~/.config/nvim/.git
 
+# Setup Git
+RUN git config --global user.email "git@bouvais.lu"
+RUN git config --global user.name "adrien"
+
+# Add Gopls
+RUN go install golang.org/x/tools/gopls@latest
+
 WORKDIR /data
 
 EXPOSE 7681
-
-ENTRYPOINT ["/entrypoint.sh"]

Dockerfile.arch-ttyd-gpu

@@ -0,0 +1,8 @@
+FROM registry.bouvais.lu/vms/arch-ttyd-cpu:1.0.0
+
+RUN pacman -Syu --noconfirm && \
+    pacman -S --noconfirm \
+        nvidia \
+        cuda \
+        nvidia-utils && \
+    pacman -Scc --noconfirm

README.md

@@ -1,36 +1,35 @@
 # Self-Hosted Services
 
-This repository contains my personal Docker Compose configuration for various self-hosted services, all exposed via Traefik.
-It serves primarily as a personal deployment configuration and a reference for others.
+This repository contains my personal Docker Compose configuration for various self-hosted services, all exposed via Traefik. It serves primarily as a personal deployment configuration and a reference for others.
 
----
+***
 
 ### Services Included:
 
--   **Traefik:** Reverse proxy and load balancer with automatic HTTPS, now also handling SSH entry points and `bouvais.lu` redirection.
--   **Prometheus:** Monitoring system.
--   **Grafana:** Data visualization and dashboarding for Prometheus.
--   **cAdvisor:** Container resource usage and performance analysis.
--   **Node Exporter:** Exposes hardware and OS metrics for Prometheus.
--   **Nvidia GPU Exporter:** Exposes NVIDIA GPU metrics for Prometheus.
--   **Fail2Ban:** Intrusion prevention for various services, specifically configured to monitor Docker logs.
--   **Vaultwarden:** Unofficial Bitwarden server implementation, with an added secure admin interface.
--   **Kopia:** Fast, secure, and incremental backups, with a web UI.
--   **Siyuan:** A local-first personal knowledge management system (replaces Memos).
--   **Jellyfin:** Free software media system.
--   **Filebrowser:** Web interface to browse and manage files.
--   **Gitea:** Lightweight Git service (this repository is hosted on it!), also serving documentation via MkDocs.
--   **Gitea Runner:** A runner for Gitea actions.
--   **MkDocs ZipponDB:** Serves documentation generated by MkDocs.
--   **Actual Budget:** Local-first personal finance app.
--   **MinIO:** High performance, S3 compatible object storage.
--   **Open WebUI:** A user-friendly interface for interacting with large language models.
--   **Ollama:** A framework for running large language models locally, with GPU support.
--   **Personal Website (website-pro):** A custom-built professional website.
+*   **Traefik:** Reverse proxy and load balancer with automatic HTTPS, now also handling SSH entry points and `bouvais.lu` redirection.
+*   **Monitoring Stack:**
+    *   **Prometheus:** Monitoring system.
+    *   **Grafana:** Data visualization and dashboarding for Prometheus.
+    *   **cAdvisor:** Container resource usage and performance analysis.
+    *   **Node Exporter:** Exposes hardware and OS metrics for Prometheus.
+    *   **Nvidia GPU Exporter:** Exposes NVIDIA GPU metrics for Prometheus.
+*   **Fail2Ban:** Intrusion prevention for various services, specifically configured to monitor Traefik's access logs.
+*   **Vaultwarden:** Unofficial Bitwarden server implementation, with an added secure admin interface.
+*   **Kopia:** Two instances for fast, secure, and incremental backups: one for local backups (`kopia`) and another for off-site backups to Google Cloud Platform (`kopia-gcp`).
+*   **Siyuan:** A local-first personal knowledge management system.
+*   **Jellyfin:** Free software media system.
+*   **Filebrowser:** Web interface to browse and manage files.
+*   **LibreOffice Online:** A web-based version of the LibreOffice suite for in-browser document editing.
+*   **Gitea & Gitea Runner:** A lightweight Git service and a runner for Gitea actions.
+*   **MkDocs:** Serves a static documentation site generated by MkDocs.
+*   **Docker Registry & UI:** A private Docker registry to store custom images, complete with a web interface for management.
+*   **Actual Budget:** Local-first personal finance app.
+*   **MinIO:** High performance, S3 compatible object storage. For DVC.
+*   **Open WebUI & Pipelines:** A user-friendly interface for interacting with large language models, supported by a backend pipeline service.
+*   **Web-based Arch Linux Terminals:** Two `ttyd`-based containers (`arch-cpu` and `arch-gpu`) providing persistent Arch Linux environments accessible through a web browser, with one configured for GPU access.
 
----
+***
 
 ### Usage
 
-This repository is not intended for direct cloning and deployment as-is. It is highly tailored to my specific setup, including domain names (`bouvais.lu`), paths, and personal configurations.
-However, you can use this repository as an example or reference.
+This repository is not intended for direct cloning and deployment as-is. It is highly tailored to my specific setup, including domain names (`bouvais.lu`), paths, and personal configurations. However, you can use this repository as an example or reference.

apps.yml

@@ -1,17 +1,4 @@
 services:
-  #memos:
-  #  image: neosmemo/memos:stable
-  #  container_name: memos
-  #  restart: unless-stopped
-  #  volumes:
-  #    - "./hdd0/memos:/var/opt/memos"
-  #  labels:
-  #    - "traefik.enable=true"
-  #    - "traefik.http.routers.memos.rule=Host(`notes.bouvais.lu`)"
-  #    - "traefik.http.routers.memos.entrypoints=websecure"
-  #    - "traefik.http.routers.memos.tls.certresolver=myresolver"
-  #    - "traefik.http.services.memos.loadbalancer.server.port=5230"
-
   jellyfin:
     image: jellyfin/jellyfin
     container_name: jellyfin
@@ -20,17 +7,17 @@ services:
       - '107' #render
       - '44' #video
     volumes:
-      - "./cache/jellyfin/cache:/cache"
-      - "./hdd0/jellyfin/config:/config"
+      - ./cache/jellyfin/cache:/cache
+      - ./hdd0/jellyfin/config:/config
       - type: bind
         source: ./hdd0/media
         target: /media
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.bouvais.lu`)"
-      - "traefik.http.routers.jellyfin.entrypoints=websecure"
-      - "traefik.http.routers.jellyfin.tls.certresolver=myresolver"
-      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
+      - traefik.enable=true
+      - traefik.http.routers.jellyfin.rule=Host(`jellyfin.bouvais.lu`)
+      - traefik.http.routers.jellyfin.entrypoints=websecure
+      - traefik.http.routers.jellyfin.tls.certresolver=myresolver
+      - traefik.http.services.jellyfin.loadbalancer.server.port=8096
 
   filebrowser:
     image: filebrowser/filebrowser:latest
@@ -40,70 +27,41 @@ services:
       TZ: Europe/Luxembourg
       FB_BASEURL: /
     volumes:
-      - "./config/filebrowser/filebrowser.json:/.filebrowser.json"
-      - "./hdd0/filebrowser/filebrowser.db:/database.db" 
-      - "./hdd0/my_files:/srv"
+      - ./config/filebrowser/filebrowser.json:/.filebrowser.json
+      - ./hdd0/filebrowser/filebrowser.db:/database.db 
+      - ./hdd0/my_files:/srv
+      - ./hdd0/media:/srv/media
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.filebrowser.rule=Host(`files.bouvais.lu`)"
-      - "traefik.http.routers.filebrowser.entrypoints=websecure"
-      - "traefik.http.routers.filebrowser.tls.certresolver=myresolver"
-      - "traefik.http.services.filebrowser.loadbalancer.server.port=80"
-
-  actualbudget:
-    image: actualbudget/actual-server:latest
-    container_name: actualbudget
-    restart: unless-stopped
-    volumes:
-      - "./hdd0/actualbudget:/data"
-    environment:
-      - TZ=Europe/Luxembourg
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.actualbudget.rule=Host(`budget.bouvais.lu`)"
-      - "traefik.http.routers.actualbudget.entrypoints=websecure"
-      - "traefik.http.routers.actualbudget.tls.certresolver=myresolver"
-      - "traefik.http.services.actualbudget.loadbalancer.server.port=5006"
+      - traefik.enable=true
+      - traefik.http.routers.filebrowser.rule=Host(`files.bouvais.lu`)
+      - traefik.http.routers.filebrowser.entrypoints=websecure
+      - traefik.http.routers.filebrowser.tls.certresolver=myresolver
+      - traefik.http.services.filebrowser.loadbalancer.server.port=80
 
   vaultwarden:
-    image: vaultwarden/server:1.33.2
+    image: vaultwarden/server:latest
     container_name: vaultwarden
     restart: unless-stopped
     environment:
-      DOMAIN: "https://vault.bouvais.lu"
-      SIGNUPS_ALLOWED: false
+      DOMAIN: https://vault.bouvais.lu
+      SIGNUPS_ALLOWED: true
+      ADMIN_TOKEN: ${ADMIN_PASSWORD}
+    ports:
+      - "80:80"
     volumes:
-      - "./hdd0/vaultwarden:/data/"
+      - ./hdd0/vaultwarden:/data/
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.my-vaultwarden-service.loadbalancer.server.port=80"
-      - "traefik.http.routers.vaultwarden.rule=Host(`vault.bouvais.lu`)"
-      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
-      - "traefik.http.routers.vaultwarden.tls.certresolver=myresolver"
-      - "traefik.http.routers.vaultwarden.service=my-vaultwarden-service@docker"
-      - "traefik.http.routers.vaultwarden-admin.rule=Host(`vault.bouvais.lu`) && PathPrefix(`/admin`)"
-      - "traefik.http.routers.vaultwarden-admin.entrypoints=websecure"
-      - "traefik.http.routers.vaultwarden-admin.tls.certresolver=myresolver"
-      - "traefik.http.routers.vaultwarden-admin.middlewares=auth@docker"
-      - "traefik.http.routers.vaultwarden-admin.service=my-vaultwarden-service@docker"
-
-  siyuan:
-    image: b3log/siyuan
-    container_name: siyuan
-    command: ['--workspace=/siyuan/workspace/']
-    volumes:
-      - /siyuan/workspace:/siyuan/workspace
-      - "./hdd0/siyuan/workspace:/siyuan/workspace"
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Luxembourg
-      - SIYUAN_ACCESS_AUTH_CODE=${SIYUAN_ACCESS_AUTH_CODE}
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.siyuan.rule=Host(`notes.bouvais.lu`)"
-      - "traefik.http.routers.siyuan.entrypoints=websecure"
-      - "traefik.http.routers.siyuan.tls.certresolver=myresolver"
-      - "traefik.http.services.siyuan.loadbalancer.server.port=6806"
+      - traefik.enable=true
+      - traefik.http.services.my-vaultwarden-service.loadbalancer.server.port=80
+      - traefik.http.routers.vaultwarden.rule=Host(`vault.bouvais.lu`)
+      - traefik.http.routers.vaultwarden.entrypoints=websecure
+      - traefik.http.routers.vaultwarden.tls.certresolver=myresolver
+      - traefik.http.routers.vaultwarden.service=my-vaultwarden-service@docker
+      - traefik.http.routers.vaultwarden-admin.rule=Host(`vault.bouvais.lu`) && PathPrefix(`/admin`)
+      - traefik.http.routers.vaultwarden-admin.entrypoints=websecure
+      - traefik.http.routers.vaultwarden-admin.tls.certresolver=myresolver
+      - traefik.http.routers.vaultwarden-admin.middlewares=auth@docker
+      - traefik.http.routers.vaultwarden-admin.service=my-vaultwarden-service@docker
 
   libreoffice:
     image: lscr.io/linuxserver/libreoffice:latest
@@ -115,14 +73,43 @@ services:
       - PASSWORD=${MASTER_PASSWORD}
       - TZ=Europe/Luxembourg
     ports:
-      - "3000:3000"
-      - "3001:3001"
+      - 3000:3000
+      - 3001:3001
     volumes:
       - ./hdd0/libreoffice:/config
+      - ./hdd0/my_files/:/data
     restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.libreoffice.rule=Host(`libreoffice.bouvais.lu`)
+      - traefik.http.routers.libreoffice.entrypoints=websecure
+      - traefik.http.routers.libreoffice.tls.certresolver=myresolver
+      - traefik.http.services.libreoffice.loadbalancer.server.port=3000
+
+  home:
+    image: registry.bouvais.lu/home:v0.1.4
+    container_name: home
+    restart: unless-stopped
+    depends_on:
+      - registry
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.libreoffice.rule=Host(`libreoffice.bouvais.lu`)"
-      - "traefik.http.routers.libreoffice.entrypoints=websecure"
-      - "traefik.http.routers.libreoffice.tls.certresolver=myresolver"
-      - "traefik.http.services.libreoffice.loadbalancer.server.port=3000"
+      - "traefik.http.routers.myapp.rule=Host(`home.bouvais.lu`)"
+      - "traefik.http.routers.myapp.entrypoints=websecure"
+      - "traefik.http.routers.myapp.tls.certresolver=myresolver"
+      - "traefik.http.services.myapp.loadbalancer.server.port=8080"
+
+  drawio:
+    image: jgraph/drawio:latest
+    container_name: drawio
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Luxembourg
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.drawio.rule=Host(`draw.bouvais.lu`)"
+      - "traefik.http.routers.drawio.entrypoints=websecure"
+      - "traefik.http.routers.drawio.tls.certresolver=myresolver"
+      - "traefik.http.services.drawio.loadbalancer.server.port=8080"
+
+

developer.yml

@@ -0,0 +1,126 @@
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.23.8
+    container_name: gitea
+    restart: always
+    environment:
+      - GITEA_CUSTOM=/etc/gitea
+    volumes:
+      - ./hdd0/gitea:/data
+      - ./config/gitea:/etc/gitea
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    labels:
+      - traefik.enable=true
+      # HTTP/S
+      - traefik.http.routers.gitea.rule=Host(`git.bouvais.lu`)
+      - traefik.http.routers.gitea.entrypoints=websecure
+      - traefik.http.routers.gitea.tls.certresolver=myresolver
+      - traefik.http.services.gitea.loadbalancer.server.port=3000
+      # SSH
+      - traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)
+      - traefik.tcp.routers.gitea-ssh.entrypoints=ssh
+      - traefik.tcp.services.gitea-ssh.loadbalancer.server.port=22
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+          cpus: 2
+        reservations:
+          memory: 512M
+          cpus: 1
+
+  gitea-runner:
+    image: docker.io/gitea/act_runner:latest
+    container_name: gitea-runner
+    restart: unless-stopped
+    environment:
+      CONFIG_FILE: /config.yaml
+      GITEA_INSTANCE_URL: https://git.bouvais.lu/
+      GITEA_RUNNER_REGISTRATION_TOKEN: jBEK4cLzDp2wqv1Ru3SHyzC0xzl1FV94IcsGe5kd
+    volumes:
+      - ./config/gitea-runner/config.yaml:/config.yaml
+      - ./hdd0/gitea-runner:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./hdd0/mkdocs-sites:/sites
+
+  registry:
+    image: registry:2
+    container_name: registry
+    restart: unless-stopped
+    environment:
+      - REGISTRY_AUTH_HTPASSWD_REALM=Bouvais Registry
+      - REGISTRY_AUTH_HTPASSWD_PATH=/etc/docker/registry/htpasswd
+      - REGISTRY_HTTP_SECRET=${MASTER_PASSWORD}
+      - REGISTRY_HEALTH_STORAGEDRIVER_ENABLED=true
+      - REGISTRY_STORAGE_DELETE_ENABLED=true
+    volumes:
+      - ./hdd0/registry/data:/var/lib/registry
+      - ./hdd0/registry/htpasswd:/etc/docker/registry/htpasswd:ro
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.registry.rule=Host(`registry.bouvais.lu`)
+      - traefik.http.routers.registry.entrypoints=websecure
+      - traefik.http.routers.registry.tls.certresolver=myresolver 
+      - traefik.http.services.registry.loadbalancer.server.port=5000 
+
+  registry-ui:
+    image: joxit/docker-registry-ui:latest
+    container_name: registry-ui
+    depends_on: [registry]
+    restart: unless-stopped
+    environment:
+      - DELETE_IMAGES=true
+      - REGISTRY_TITLE=Bouvais Docker Registry
+      - NGINX_PROXY_PASS_URL=http://registry:5000
+      - SINGLE_REGISTRY=true
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.registry_ui.rule=Host(`registry-ui.bouvais.lu`)
+      - traefik.http.routers.registry_ui.entrypoints=websecure
+      - traefik.http.routers.registry_ui.tls.certresolver=myresolver 
+      - traefik.http.services.registry_ui.loadbalancer.server.port=80
+
+  garage:
+    image: dxflrs/garage:v2.1.0
+    container_name: garage
+    restart: unless-stopped
+    volumes:
+      - ./config/garage/garage.toml:/etc/garage.toml
+      - ./hdd0/garage/meta:/var/lib/garage/meta
+      - ./hdd0/garage/data:/var/lib/garage/data
+    environment:
+      - RUST_LOG=garage=info
+    labels:
+      - traefik.enable=true
+
+      # S3 API
+      - traefik.http.routers.garages3.rule=Host(`s3.garage.bouvais.lu`)
+      - traefik.http.routers.garages3.entrypoints=websecure
+      - traefik.http.routers.garages3.tls.certresolver=myresolver
+      - traefik.http.routers.garages3.service=garages3
+      - traefik.http.services.garages3.loadbalancer.server.port=3900
+
+      # Admin API
+      - traefik.http.routers.garageadmin.rule=Host(`admin.garage.bouvais.lu`)
+      - traefik.http.routers.garageadmin.entrypoints=websecure
+      - traefik.http.routers.garageadmin.tls.certresolver=myresolver
+      - traefik.http.routers.garageadmin.service=garageadmin
+      - traefik.http.services.garageadmin.loadbalancer.server.port=3903
+
+      # Web (Garage's internal web endpoint)
+      - traefik.http.routers.garageweb.rule=Host(`web.garage.bouvais.lu`)
+      - traefik.http.routers.garageweb.entrypoints=websecure
+      - traefik.http.routers.garageweb.tls.certresolver=myresolver
+      - traefik.http.routers.garageweb.service=garageweb_svc
+      - traefik.http.services.garageweb_svc.loadbalancer.server.port=3902
+      
+      - traefik.http.routers.mystaticsite.rule=Host(`zig-dimal.bouvais.lu`)
+      - traefik.http.routers.mystaticsite.entrypoints=websecure
+      - traefik.http.routers.mystaticsite.tls.certresolver=myresolver
+      - traefik.http.routers.mystaticsite.service=garageweb_svc
+      
+      - traefik.http.routers.mystaticsite.rule=Host(`zigma.bouvais.lu`)
+      - traefik.http.routers.mystaticsite.entrypoints=websecure
+      - traefik.http.routers.mystaticsite.tls.certresolver=myresolver
+      - traefik.http.routers.mystaticsite.service=garageweb_svc

docker-compose.yml

@@ -1,33 +1,33 @@
 include:
   - apps.yml
-  - gitea.yml
+  - developer.yml
   - llm.yml
-  - monitoring.yml
-  - vms.yml
 
 services:
   traefik:
-    image: "traefik:v3.4"
-    container_name: "traefik"
+    image: traefik:latest
+    container_name: traefik
     restart: unless-stopped
     command:
       # HTTPS TSL stuff
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--entryPoints.websecure.address=:443"
-      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
-      - "--certificatesresolvers.myresolver.acme.email=adrien.bouvais.pro@gmail.com"
-      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json" # Relative path on SSD
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --entryPoints.websecure.address=:443
+      - --certificatesresolvers.myresolver.acme.tlschallenge=true
+      - --certificatesresolvers.myresolver.acme.email=adrien.bouvais.pro@gmail.com
+      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
       # Enable Traefik API and Dashboard (securely)
-      - "--api.dashboard=true"
-      - "--metrics.prometheus=true"
-      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
-      - "--entryPoints.ssh.address=:2101"
+      - --api.dashboard=true
+      - --metrics.prometheus=true
+      - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
+      - --entryPoints.ssh.address=:2101
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=180m
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=180m
       # Logs - Traefik will write its logs to /logs within the container, which maps to /data/logs on host
-      - "--accesslog=true"
-      - "--accesslog.format=json"
-      - "--accesslog.filepath=/logs/access.log"
-      - "--accesslog.bufferingSize=0"
+      - --accesslog=true
+      - --accesslog.format=json
+      - --accesslog.filepath=/logs/access.log
+      - --accesslog.bufferingSize=0
     ports:
       - target: 443
         published: 443
@@ -38,30 +38,30 @@ services:
         protocol: tcp
         mode: host
     volumes:
-      - "./letsencrypt:/letsencrypt"
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./config/users.cred:/users.cred"
-      - "./hdd0/logs:/logs"
+      - ./letsencrypt:/letsencrypt
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./config/users.cred:/users.cred
+      - ./hdd0/logs:/logs
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
       # Dashboard Router
-      - "traefik.http.routers.dashboard.rule=Host(`traefik.bouvais.lu`)"
-      - "traefik.http.routers.dashboard.entrypoints=websecure"
-      - "traefik.http.routers.dashboard.service=api@internal"
-      - "traefik.http.routers.dashboard.middlewares=auth@docker"
-      - "traefik.http.routers.dashboard.tls.certresolver=myresolver"
+      - traefik.http.routers.dashboard.rule=Host(`traefik.bouvais.lu`)
+      - traefik.http.routers.dashboard.entrypoints=websecure
+      - traefik.http.routers.dashboard.service=api@internal
+      - traefik.http.routers.dashboard.middlewares=auth@docker
+      - traefik.http.routers.dashboard.tls.certresolver=myresolver
       # Traefik Middleware
-      - "traefik.http.middlewares.auth.basicauth.usersfile=/users.cred"
-      - "traefik.http.middlewares.ratelimit.ratelimit.average=20"
-      - "traefik.http.middlewares.ratelimit.ratelimit.burst=40"
+      - traefik.http.middlewares.auth.basicauth.usersfile=/users.cred
+      - traefik.http.middlewares.ratelimit.ratelimit.average=20
+      - traefik.http.middlewares.ratelimit.ratelimit.burst=40
         # bouvais.lu redirection
-      - "traefik.http.routers.bouvais-redirect.rule=Host(`bouvais.lu`)"
-      - "traefik.http.routers.bouvais-redirect.entrypoints=websecure"
-      - "traefik.http.routers.bouvais-redirect.middlewares=redirect-to-gitea@docker"
-      - "traefik.http.routers.bouvais-redirect.tls.certresolver=myresolver"
-      - "traefik.http.middlewares.redirect-to-gitea.redirectregex.regex=^https?://(www\\.)?bouvais\\.lu(.*)"
-      - "traefik.http.middlewares.redirect-to-gitea.redirectregex.replacement=https://git.bouvais.lu$${2}"
-      - "traefik.http.middlewares.redirect-to-gitea.redirectregex.permanent=true"
+      - traefik.http.routers.bouvais-redirect.rule=Host(`bouvais.lu`)
+      - traefik.http.routers.bouvais-redirect.entrypoints=websecure
+      - traefik.http.routers.bouvais-redirect.middlewares=redirect-to-gitea@docker
+      - traefik.http.routers.bouvais-redirect.tls.certresolver=myresolver
+      - traefik.http.middlewares.redirect-to-gitea.redirectregex.regex=^https?://(www\\.)?bouvais\\.lu(.*)
+      - traefik.http.middlewares.redirect-to-gitea.redirectregex.replacement=https://git.bouvais.lu$${2}
+      - traefik.http.middlewares.redirect-to-gitea.redirectregex.permanent=true
 
   fail2ban:
     image: crazymax/fail2ban:1.1.0
@@ -72,11 +72,11 @@ services:
       - NET_RAW
     network_mode: host
     volumes:
-      - "./hdd0/fail2ban/data:/data"
-      - "./hdd0/fail2ban/log:/var/log"
-      - "./hdd0/logs:/logs:ro"
-      - "/etc/localtime:/etc/localtime:ro"
-      - "/etc/timezone:/etc/timezone:ro"
+      - ./hdd0/fail2ban/data:/data
+      - ./hdd0/fail2ban/log:/var/log
+      - ./hdd0/logs:/logs:ro
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/timezone:/etc/timezone:ro
     environment:
       - F2B_IPTABLES_CHAIN=DOCKER-USER
 
@@ -84,56 +84,53 @@ services:
     image: kopia/kopia:latest
     container_name: kopia
     restart: unless-stopped
-    ports:
-        - 51515:51515
     command:
-        - server
-        - start
-        #- --disable-csrf-token-checks
-        - --insecure
-        - --address=0.0.0.0:51515
-        - --server-username=adrien
-        - --server-password=${MASTER_PASSWORD}
+      - server
+      - start
+      - --insecure
+      - --address=0.0.0.0:51515
+      - --server-username=adrien
+      - --server-password=${MASTER_PASSWORD}
     environment:
-        KOPIA_PASSWORD: ${MASTER_PASSWORD}
-        USER: "adrien"
+      - KOPIA_PASSWORD=${MASTER_PASSWORD}
+      - USER=adrien
     volumes:
-        # Mount local folders needed by kopia
-        - ./config/kopia:/app/config
-        - ./cache/kopia:/app/cache
-        - ./hdd0/logs/:/app/logs
-        - ./hdd0:/hdd0 # Mount local folders to snapshot
-        - ./hdd0_backups/kopia/dir:/repository # Mount repository location
-        - ./hdd0_backups/kopia/shared:/tmp:shared # Mount path for browsing mounted snaphots
+      - ./config/kopia:/app/config
+      - ./cache/kopia:/app/cache
+      - ./hdd0/logs/:/app/logs
+      - ./hdd0:/hdd0
+      - ./hdd0_backups/kopia/dir:/repository
+      - ./hdd0_backups/kopia/shared:/tmp:shared
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.kopia.rule=Host(`kopia.bouvais.lu`)"
-      - "traefik.http.routers.kopia.entrypoints=websecure"
-      - "traefik.http.routers.kopia.tls.certresolver=myresolver"
-      - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+      - traefik.enable=true
+      - traefik.http.routers.kopia.rule=Host(`kopia.bouvais.lu`)
+      - traefik.http.routers.kopia.entrypoints=websecure
+      - traefik.http.routers.kopia.tls.certresolver=myresolver
+      - traefik.http.services.kopia.loadbalancer.server.port=51515
 
-  minio:
-    image: minio/minio:latest
-    container_name: minio
-    restart: unless-stopped
-    environment:
-      MINIO_ROOT_USER: adrien
-      MINIO_ROOT_PASSWORD: ${MASTER_PASSWORD}
-    command: server /data --console-address ":9001"
-    volumes:
-      - ./hdd0/minio_data:/data
-    labels:
-      - "traefik.enable=true"
-      # Router and service for the MinIO API
-      - "traefik.http.routers.minio-api.rule=Host(`minio-api.bouvais.lu`)"
-      - "traefik.http.routers.minio-api.entrypoints=websecure"
-      - "traefik.http.routers.minio-api.tls.certresolver=myresolver"
-      - "traefik.http.services.minio-api-service.loadbalancer.server.port=9000"
-      - "traefik.http.routers.minio-api.service=minio-api-service"
-
-      # Router and service for the MinIO Console (WebUI)
-      - "traefik.http.routers.minio-console.rule=Host(`minio-console.bouvais.lu`)"
-      - "traefik.http.routers.minio-console.entrypoints=websecure"
-      - "traefik.http.routers.minio-console.tls.certresolver=myresolver"
-      - "traefik.http.services.minio-console-service.loadbalancer.server.port=9001"
-      - "traefik.http.routers.minio-console.service=minio-console-service"
+  # kopia-cloud:
+  #   image: kopia/kopia:latest
+  #   container_name: kopia-cloud
+  #   restart: unless-stopped
+  #   command:
+  #     - server
+  #     - start
+  #     - --insecure
+  #     - --address=0.0.0.0:51516
+  #     - --server-username=adrien
+  #     - --server-password=${MASTER_PASSWORD}
+  #   environment:
+  #       KOPIA_PASSWORD: ${MASTER_PASSWORD}
+  #       USER: "adrien"
+  #   volumes:
+  #     - ./config/kopia-cloud:/app/config
+  #     - ./cache/kopia-cloud:/app/cache
+  #     - ./hdd0/logs/kopia-cloud:/app/logs
+  #     - ./hdd0:/hdd0
+  #     - ./kopia-gcp-key.json:/cred.json
+  #   labels:
+  #     - traefik.enable=true
+  #     - traefik.http.routers.kopia_gcp.rule=Host(`kopia-cloud.bouvais.lu`)
+  #     - traefik.http.routers.kopia_gcp.entrypoints=websecure
+  #     - traefik.http.routers.kopia_gcp.tls.certresolver=myresolver
+  #     - traefik.http.services.kopia_gcp.loadbalancer.server.port=51516

gitea.yml

@@ -1,51 +0,0 @@
-services:
-  gitea:
-    image: "docker.gitea.com/gitea:1.23.8"
-    container_name: gitea
-    restart: unless-stopped
-    environment:
-      - GITEA_CUSTOM=/etc/gitea
-    volumes:
-      - "./hdd0/gitea:/data"
-      - "./config/gitea:/etc/gitea"
-      - "/etc/timezone:/etc/timezone:ro"
-      - "/etc/localtime:/etc/localtime:ro"
-    labels:
-      - "traefik.enable=true"
-      # HTTP/S
-      - "traefik.http.routers.gitea.rule=Host(`git.bouvais.lu`)"
-      - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.tls.certresolver=myresolver"
-      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-      # SSH
-      - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
-      - "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
-      - "traefik.tcp.services.gitea-ssh.loadbalancer.server.port=22"
-
-  gitea-runner:
-    image: docker.io/gitea/act_runner:latest
-    container_name: gitea-runner
-    restart: unless-stopped
-    environment:
-      CONFIG_FILE: /config.yaml
-      GITEA_INSTANCE_URL: https://git.bouvais.lu/
-      GITEA_RUNNER_REGISTRATION_TOKEN: jBEK4cLzDp2wqv1Ru3SHyzC0xzl1FV94IcsGe5kd
-    volumes:
-      - ./config/gitea-runner/config.yaml:/config.yaml
-      - ./hdd0/gitea-runner:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./hdd0/mkdocs-sites:/sites
-
-  mkdocs-zippondb:
-    image: squidfunk/mkdocs-material
-    container_name: mkdocs-zippondb
-    restart: unless-stopped
-    volumes:
-      - ./hdd0/mkdocs-sites/zippondb:/docs
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.gitea.rule=Host(`docs.bouvais.lu`)"
-      - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.tls.certresolver=myresolver"
-      - "traefik.http.routers.gitea.middlewares=auth@docker"
-      - "traefik.http.services.gitea.loadbalancer.server.port=3000"

llm.yml

@@ -6,32 +6,35 @@ services:
     volumes:
       - ./hdd0/openwebui:/app/backend/data
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.openwebui.rule=Host(`openwebui.bouvais.lu`)"
-      - "traefik.http.routers.openwebui.entrypoints=websecure"
-      - "traefik.http.routers.openwebui.tls.certresolver=myresolver"
-      - "traefik.http.services.openwebui.loadbalancer.server.port=8080"
+      - traefik.enable=true
+      - traefik.http.routers.openwebui.rule=Host(`openwebui.bouvais.lu`)
+      - traefik.http.routers.openwebui.entrypoints=websecure
+      - traefik.http.routers.openwebui.tls.certresolver=myresolver
+      - traefik.http.services.openwebui.loadbalancer.server.port=8080
     environment:
       OLLAMA_BASE_URLS: http://ollama:11434
 
-  ollama:
-    image: ollama/ollama:latest
-    container_name: ollama
-    volumes:
-      - ./hdd0/ollama:/root/.ollama
-    deploy:
-      resources:
-        reservations:
-          devices:
-            - driver: nvidia
-              capabilities: ["gpu"]
-              count: all
-
   openwebui-pipeline:
     image: ghcr.io/open-webui/pipelines:main
     container_name: openwebui-pipelines
     restart: unless-stopped
     ports:
-      - "9099:9099"
+      - 9099:9099
     volumes:
       - ./hdd0/openwebui-pipelines:/app/pipelines
+
+  ollama:
+    image: ollama/ollama:latest
+    container_name: ollama
+    restart: unless-stopped
+    volumes:
+      - ./usb1/ollama:/root/.ollama
+    environment:
+      - OLLAMA_CONTEXT_LENGTH=64000
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]

monitoring.yml

@@ -9,22 +9,19 @@ services:
       - ./config/prometheus:/etc/prometheus
       - ./hdd0/prometheus:/prometheus
     command:
-      - '--config.file=/etc/prometheus/prometheus.yml'
-      - '--storage.tsdb.path=/prometheus'
-      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
-      - '--web.console.templates=/usr/share/prometheus/consoles'
-      - '--web.enable-lifecycle'
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --storage.tsdb.path=/prometheus
+      - --web.console.libraries=/usr/share/prometheus/console_libraries
+      - --web.console.templates=/usr/share/prometheus/consoles
+      - --web.enable-lifecycle
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.prometheus.rule=Host(`prometheus.bouvais.lu`)"
-      - "traefik.http.routers.prometheus.entrypoints=websecure"
-      - "traefik.http.routers.prometheus.tls.certresolver=myresolver"
-      - "traefik.http.routers.prometheus.service=prometheus"
-      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
-      - "traefik.http.routers.prometheus.middlewares=auth@docker"
-    depends_on:
-      - cadvisor
-      - node-exporter
+      - traefik.enable=true
+      - traefik.http.routers.prometheus.rule=Host(`prometheus.bouvais.lu`)
+      - traefik.http.routers.prometheus.entrypoints=websecure
+      - traefik.http.routers.prometheus.tls.certresolver=myresolver
+      - traefik.http.routers.prometheus.service=prometheus
+      - traefik.http.services.prometheus.loadbalancer.server.port=9090
+      - traefik.http.routers.prometheus.middlewares=auth@docker
 
   grafana:
     image: grafana/grafana:12.0.1
@@ -39,30 +36,16 @@ services:
       - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_MY_PASSWORD}
       - GF_SERVER_ROOT_URL=https://grafana.bouvais.lu
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.grafana.rule=Host(`grafana.bouvais.lu`)"
-      - "traefik.http.routers.grafana.entrypoints=websecure"
-      - "traefik.http.routers.grafana.tls.certresolver=myresolver"
-      - "traefik.http.routers.grafana.service=grafana"
-      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
-      - "traefik.http.routers.grafana.middlewares=auth@docker"
+      - traefik.enable=true
+      - traefik.http.routers.grafana.rule=Host(`grafana.bouvais.lu`)
+      - traefik.http.routers.grafana.entrypoints=websecure
+      - traefik.http.routers.grafana.tls.certresolver=myresolver
+      - traefik.http.routers.grafana.service=grafana
+      - traefik.http.services.grafana.loadbalancer.server.port=3000
+      - traefik.http.routers.grafana.middlewares=auth@docker
     depends_on:
       - prometheus
-
-  cadvisor:
-    image: gcr.io/cadvisor/cadvisor:v0.52.0
-    container_name: cadvisor
-    privileged: true
-    restart: unless-stopped
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:rw
-      - /sys:/sys:ro
-      - /var/lib/docker/:/var/lib/docker:ro
-      - /dev/disk/:/dev/disk:ro
-    devices:
-      - /dev/kmsg:/dev/kmsg
-
+  #
   node-exporter:
     image: prom/node-exporter:v1.9.1
     container_name: node-exporter
@@ -73,26 +56,7 @@ services:
       - /sys:/host/sys:ro
       - /:/rootfs:ro
     command:
-      - '--path.procfs=/host/proc'
-      - '--path.sysfs=/host/sys'
-      - '--path.rootfs=/rootfs'
-      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)'
-
-  nvidia-gpu-exporter:
-    image: utkuozdemir/nvidia_gpu_exporter:1.3.1
-    container_name: nvidia-gpu-exporter
-    restart: unless-stopped
-    privileged: true # This might be needed for full access to devices, or try without first
-    devices:
-      - /dev/nvidia0:/dev/nvidia0
-    volumes:
-      - /usr/bin/nvidia-smi:/usr/bin/nvidia-smi:ro
-      - /usr/lib/x86_64-linux-gnu/libnvidia-ml.so:/usr/lib/x86_64-linux-gnu/libnvidia-ml.so:ro
-      - /usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1:/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1:ro
-    command:
-      - --web.listen-address=:9835
-      - --web.telemetry-path=/metrics
-      - --nvidia-smi-command=nvidia-smi
-      - --log.level=info
-      - --query-field-names=AUTO
-      - --log.format=logfmt
+      - --path.procfs=/host/proc
+      - --path.sysfs=/host/sys
+      - --path.rootfs=/rootfs
+      - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)

vms.yml

@@ -1,28 +0,0 @@
-services:
-  arch-ttyd:
-    build: 
-      context: .
-      dockerfile: Dockerfile.arch-ttyd
-    container_name: arch-ttyd
-    restart: unless-stopped
-    volumes:
-      - ./hdd0/vms/arch/data:/data
-      - ./hdd0/vms/arch/root:/root
-      - ~/.ssh/id_rsa:/root/.ssh/id_rsa:ro
-    environment:
-      - TTYD_USERNAME=${TTYD_USERNAME:-admin}
-      - TTYD_PASSWORD=${MASTER_PASSWORD:-changeme}
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.arch.rule=Host(`arch.bouvais.lu`)"
-      - "traefik.http.routers.arch.entrypoints=websecure"
-      - "traefik.http.routers.arch.tls.certresolver=myresolver"
-      - "traefik.http.services.arch.loadbalancer.server.port=7681"
-    deploy:
-      resources:
-        limits:
-          cpus: '1.0'
-          memory: 512M
-        reservations:
-          cpus: '0.5'
-          memory: 256M

website.yml

@@ -1,13 +0,0 @@
-services:
-  website-pro:
-    build:
-      context: ./website-pro
-      dockerfile: Dockerfile
-    container_name: website-pro
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.www.rule=Host(`www.bouvais.lu`)"
-      - "traefik.http.routers.www.entrypoints=websecure"
-      - "traefik.http.routers.www.tls.certresolver=myresolver"
-      - "traefik.http.services.www.loadbalancer.server.port=8080"