feat: added ocm , rss, tandoor and wallos (#38)

2025-12-01 23:17:00 +01:00 · 2025-08-16 19:30:19 +05:30
parent 512660d2b8
commit 6d6d904c7b
15 changed files with 304 additions and 5 deletions
@@ -136,6 +136,8 @@ DOCKGE_HOSTNAME=dockge.${DOMAIN}
 DOZZLE_HOSTNAME=dozzle.${DOMAIN}
 EASYNEWS_PLUS_HOSTNAME=easynews-plus.${DOMAIN}
 EASYNEWS_PLUS_PLUS_HOSTNAME=easynews-plus-plus.${DOMAIN}
+FRESHRSS_HOSTNAME=freshrss.${DOMAIN}
+FIVEFILTERS_FULL_TEXT_RSS_HOSTNAME=fivefilters.${DOMAIN}
 HONEY_HOSTNAME=${DOMAIN}
 HUNTARR_HOSTNAME=huntarr.${DOMAIN}
 IMMICH_HOSTNAME=immich.${DOMAIN}
@@ -167,6 +169,7 @@ RADARR_HOSTNAME=radarr.${DOMAIN}
 RADARR4K_HOSTNAME=4k.radarr.${DOMAIN}
 RADARRANIME_HOSTNAME=anime.radarr.${DOMAIN}
 REDLIB_HOSTNAME=redlib.${DOMAIN}
+RSS_BRIDGE_HOSTNAME=rss-bridge.${DOMAIN}
 SEANIME_HOSTNAME=seanime.${DOMAIN}
 SEARXNG_HOSTNAME=searxng.${DOMAIN}
 SONARR_HOSTNAME=sonarr.${DOMAIN}
@@ -185,6 +188,7 @@ STREMIO_STREAMING_CATALOGS_HOSTNAME=streaming-catalogs.${DOMAIN}
 STREMIO_TRAKT_ADDON_HOSTNAME=stremio-trakt.${DOMAIN}
 STREMTHRU_HOSTNAME=stremthru.${DOMAIN}
 SYNCRIBULLET_HOSTNAME=syncribullet.${DOMAIN}
+TANDOOR_HOSTNAME=tandoor.${DOMAIN}
 TAUTULLI_HOSTNAME=tautulli.${DOMAIN}
 THE_LOUNGE_HOSTNAME=thelounge.${DOMAIN}
 TMDB_ADDON_HOSTNAME=tmdb.${DOMAIN}
@@ -194,6 +198,7 @@ TORBOX_MANAGER_HOSTNAME=tbm.${DOMAIN}
 TRAEFIK_HOSTNAME=traefik.${DOMAIN}
 UPTIME_KUMA_HOSTNAME=status.${DOMAIN}
 VAULTWARDEN_HOSTNAME=vaultwarden.${DOMAIN}
+WALLOS_HOSTNAME=wallos.${DOMAIN}
 WEBSTREAMR_HOSTNAME=webstreamr.${DOMAIN}
 YAMTRACK_HOSTNAME=yamtrack.${DOMAIN}
 ZILEAN_HOSTNAME=zilean.${DOMAIN}
@@ -216,4 +221,4 @@ COMPOSE_FILE=${DOCKER_DIR}/compose.yaml
 # Whether to change the name of the network that all containers run on or to connect to an external network.
 # Reference: https://docs.docker.com/compose/how-tos/networking/#use-a-pre-existing-network
 DOCKER_NETWORK=aio_network
-DOCKER_NETWORK_EXTERNAL=false
+DOCKER_NETWORK_EXTERNAL=false
@@ -41,6 +41,10 @@ services:
        ${TMDB_ADDON_REDIS_HOSTNAME},
        ${TMDB_COLLECTIONS_HOSTNAME},
        ${WEBSTREAMR_HOSTNAME}
+      TEMPLATE_FRESHRSS_HOSTNAME: ${FRESHRSS_HOSTNAME?}
+      TEMPLATE_KARAKEEP_HOSTNAME: ${KARAKEEP_HOSTNAME?}
+      TEMPLATE_ACTUAL_BUDGET_HOSTNAME: ${ACTUAL_BUDGET_HOSTNAME?}
+      TEMPLATE_TANDOOR_HOSTNAME: ${TANDOOR_HOSTNAME?}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authelia.rule=Host(`${AUTHELIA_HOSTNAME?}`)"
@@ -98,4 +102,4 @@ services:
    profiles:
      - authelia
      - required
-      - all
+      - all
@@ -734,6 +734,40 @@ access_control:
    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_HOSTNAMES" | replace "," "|" | replace "." "\\." | replace " " "" }})$'
      policy: 'bypass'

+    ## FreshRSS API endpoints bypass authentication for RSS reader apps
+    - domain: '{{ env "TEMPLATE_FRESHRSS_HOSTNAME" }}'
+      resources:
+        - '^/api/.*$'
+        - '^/p/api/.*$'
+      policy: 'bypass'
+
+    ## Karakeep API endpoints bypass authentication for mobile apps and extensions
+    - domain: '{{ env "TEMPLATE_KARAKEEP_HOSTNAME" }}'
+      resources:
+        - '^/api/.*$'
+      policy: 'bypass'
+
+
+    ## Actual Budget API endpoints bypass authentication for sync clients
+    - domain: '{{ env "TEMPLATE_ACTUAL_BUDGET_HOSTNAME" }}'
+      resources:
+        - '^/api/.*$'
+        - '^/sync/.*$'
+        - '^/account/validate$'           # Account validation endpoint for sync
+        - '^/account/bootstrap$'          # Initial account setup only
+        - '^/account/needs-bootstrap$'    # Check if bootstrap is needed
+      policy: 'bypass'
+
+    ## Tandoor API endpoints bypass authentication for mobile apps and integrations
+    - domain: '{{ env "TEMPLATE_TANDOOR_HOSTNAME" }}'
+      resources:
+        - '^/api/.*$'
+        - '^/api-token-auth/.*$'
+        - '^/docs/.*$'
+        - '^/media/.*$'
+        - '^/openapi/.*$' 
+      policy: 'bypass'
+
    - domain: '*.{{ env "TEMPLATE_DOMAIN" }}'
      policy: 'two_factor'

@@ -1677,4 +1711,4 @@ notifier:
              # -----BEGIN CERTIFICATE-----
              # ...
              # -----END CERTIFICATE-----
-...
+...
@@ -35,6 +35,8 @@ services:
        ${DOZZLE_HOSTNAME},
        ${EASYNEWS_PLUS_HOSTNAME},
        ${EASYNEWS_PLUS_PLUS_HOSTNAME},
+        ${FRESHRSS_HOSTNAME},
+        ${FIVEFILTERS_FULL_TEXT_RSS_HOSTNAME}, 
        ${HONEY_HOSTNAME},
        ${HUNTARR_HOSTNAME},
        ${IMMICH_HOSTNAME},
@@ -66,6 +68,7 @@ services:
        ${RADARR4K_HOSTNAME},
        ${RADARRANIME_HOSTNAME},
        ${REDLIB_HOSTNAME},
+        ${RSS_BRIDGE_HOSTNAME},
        ${SEANIME_HOSTNAME},
        ${SEARXNG_HOSTNAME},
        ${SONARR_HOSTNAME},
@@ -84,6 +87,7 @@ services:
        ${STREMIO_TRAKT_ADDON_HOSTNAME},
        ${STREMTHRU_HOSTNAME},
        ${SYNCRIBULLET_HOSTNAME},
+        ${TANDOOR_HOSTNAME},
        ${TAUTULLI_HOSTNAME},
        ${THE_LOUNGE_HOSTNAME},
        ${TMDB_ADDON_HOSTNAME},
@@ -93,6 +97,7 @@ services:
        ${TRAEFIK_HOSTNAME},
        ${UPTIME_KUMA_HOSTNAME},
        ${VAULTWARDEN_HOSTNAME},
+        ${WALLOS_HOSTNAME},
        ${WEBSTREAMR_HOSTNAME},
        ${YAMTRACK_HOSTNAME},
        ${ZILEAN_HOSTNAME},
@@ -100,4 +105,4 @@ services:
        ${ZURG_HOSTNAME}
    profiles:
      - cloudflare-ddns
-      - all
+      - all
@@ -0,0 +1,2 @@
+FIVEFILTERS_ADMIN_PASSWORD=CHANGE_THIS_PASSWORD
+# https://github.com/fivefilters/ftr-site-config Full-Text RSS site config files
@@ -0,0 +1,23 @@
+services:
+  fivefilters-full-text-rss:
+    image: heussd/fivefilters-full-text-rss:latest
+    container_name: fivefilters-full-text-rss
+    restart: unless-stopped
+    expose:
+      - 80
+    environment:
+      - FTR_ADMIN_PASSWORD=${FIVEFILTERS_ADMIN_PASSWORD:-}
+    labels:     
+      - "traefik.enable=true"
+      - "traefik.http.routers.fivefilters-full-text-rss.rule=Host(`${FIVEFILTERS_FULL_TEXT_RSS_HOSTNAME?}`)"
+      - "traefik.http.services.fivefilters-full-text-rss.loadbalancer.server.port=80"
+      - "traefik.http.routers.fivefilters-full-text-rss.entrypoints=websecure"
+      - "traefik.http.routers.fivefilters-full-text-rss.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.fivefilters-full-text-rss.middlewares=authelia@docker"
+    volumes:
+      - ${DOCKER_DATA_DIR}/fivefilters-full-text-rss/cache:/var/www/html/cache/rss
+      - ${DOCKER_DATA_DIR}/fivefilters-full-text-rss/site_config:/var/www/html/site_config/custom
+    profiles:
+      - fivefilters-full-text-rss
+      - rss
+      - all
@@ -0,0 +1,49 @@
+# ================================
+# FreshRSS Configuration
+# ================================
+
+ADMIN_EMAIL=
+
+# =========================================
+# For automatic FreshRSS install (optional)
+# =========================================
+
+ADMIN_PASSWORD=CHANGE_THIS_PASSWORD
+ADMIN_API_PASSWORD=CHANGE_THIS_API_PASSWORD
+
+# Address at which the FreshRSS instance will be reachable:
+BASE_URL=https://${FRESHRSS_HOSTNAME}
+
+# Environment (development/production)
+FRESHRSS_ENV=production
+
+# https://github.com/FreshRSS/Extensions
+# A repository containing all the official FreshRSS extensions
+#
+# =========================================
+# Installing FreshRSS Extensions
+# =========================================
+#
+# Extensions can be installed in two ways:
+#
+# 1. MANUAL INSTALLATION:
+#    - Download extensions from https://github.com/FreshRSS/Extensions
+#    - Extract to: ${DOCKER_DATA_DIR}/freshrss/extensions/
+#    - Restart FreshRSS container
+#    - Enable in FreshRSS web interface: Configuration > Extensions
+#
+# 2. COMPLEMENTARY SERVICES (included in this template):
+#    - fivefilters-full-text-rss: Extracts full article content for feeds
+#      Add to COMPOSE_PROFILES to enable: "fivefilters-full-text-rss"
+#      Access at: https://${FIVEFILTERS_FULL_TEXT_RSS_HOSTNAME}
+#      
+#      To configure in FreshRSS:
+#      1. Install FullTextRss extension from GitHub
+#      2. Go to Configuration > Extensions > FullTextRss
+#      3. Set "Five Filters Host" to: http://fivefilters-full-text-rss:80
+#         (Use internal Docker network hostname, not external URL)
+#    
+#    - rss-bridge: Generates RSS feeds from websites without feeds
+#      Add to COMPOSE_PROFILES to enable: "rss-bridge" 
+#      Access at: https://${RSS_BRIDGE_HOSTNAME}
+#
@@ -0,0 +1,42 @@
+services:
+  freshrss:
+    image: freshrss/freshrss:latest
+    container_name: freshrss
+    restart: unless-stopped
+    logging:
+      options:
+        max-size: 10m
+    expose:
+      - 80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.freshrss.rule=Host(`${FRESHRSS_HOSTNAME?}`)"
+      - "traefik.http.routers.freshrss.entrypoints=websecure"
+      - "traefik.http.routers.freshrss.tls.certresolver=letsencrypt"
+      - "traefik.http.services.freshrss.loadbalancer.server.port=80"
+      - "traefik.http.routers.freshrss.middlewares=authelia@docker"
+    volumes:
+      # Recommended volume for FreshRSS persistent data such as configuration and SQLite databases
+      - ${DOCKER_DATA_DIR}/freshrss/data:/var/www/FreshRSS/data
+      # Optional volume for storing third-party extensions
+      - ${DOCKER_DATA_DIR}/freshrss/extensions:/var/www/FreshRSS/extensions
+    environment:
+      # A timezone http://php.net/timezones (default is UTC)
+      - TZ=${TZ}
+      # Cron job to refresh feeds at specified minutes
+      - CRON_MIN=2,32
+      # 'development' for additional logs; default is 'production'
+      - FRESHRSS_ENV=${FRESHRSS_ENV}
+      # Optional advanced parameter controlling the internal Apache listening port
+      - LISTEN=0.0.0.0:80
+      # Optional parameter, remove for automatic settings, set to 0 to disable,
+      # or (if you use a proxy) to a space-separated list of trusted IP ranges
+      - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
+      # Optional parameter, set to 1 to enable OpenID Connect (only available in our Debian image)
+      - OIDC_ENABLED=0
+      # Optional auto-install parameters (the Web interface install is recommended instead):
+      - FRESHRSS_INSTALL=--api-enabled --base-url ${BASE_URL} --default-user admin --language en
+      - FRESHRSS_USER=--api-password ${ADMIN_API_PASSWORD} --email ${ADMIN_EMAIL} --language en --password ${ADMIN_PASSWORD} --user admin
+    profiles:
+      - freshrss
+      - all
@@ -0,0 +1,25 @@
+# ────────────────────────────────
+# Oracle Cloud API Configuration
+# ────────────────────────────────
+OCI_USER_OCID=
+OCI_TENANCY_OCID=
+OCI_FINGERPRINT=
+OCI_REGION=
+
+# ────────────────────────────────
+# Discord Webhook Configuration
+# ────────────────────────────────
+DISCORD_WEBHOOK_URL=
+
+# ────────────────────────────────
+# Usage Thresholds
+# ────────────────────────────────
+MIN_DAILY_USAGE=0.01
+MAX_DAILY_USAGE=0
+CURRENCY=$
+
+# ────────────────────────────────
+# Schedule (cron format)
+# ────────────────────────────────
+SUMMARY_SCHEDULE=0 0 * * *           
+DAILY_LIMIT_SCHEDULE=0 0 * * *       
@@ -0,0 +1,13 @@
+services:
+  ocm:
+    image: ghcr.io/iamneur0/ocm:latest
+    container_name: ocm
+    restart: unless-stopped
+    platform: linux/arm64
+    env_file:
+      - .env
+    volumes:
+      - ${DOCKER_DATA_DIR}/ocm/key.pem:/app/key.pem:ro
+    profiles:
+      - ocm
+      - all
@@ -0,0 +1,20 @@
+services:
+  rss-bridge:
+    image: rssbridge/rss-bridge:latest
+    container_name: rss-bridge
+    restart: unless-stopped
+    expose:
+      - 80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.rss-bridge.rule=Host(`${RSS_BRIDGE_HOSTNAME?}`)"
+      - "traefik.http.services.rss-bridge.loadbalancer.server.port=80"
+      - "traefik.http.routers.rss-bridge.entrypoints=websecure"
+      - "traefik.http.routers.rss-bridge.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.rss-bridge.middlewares=authelia@docker"
+    volumes:
+      - ${DOCKER_DATA_DIR}/rss-bridge/config:/config
+    profiles:
+      - rss-bridge
+      - rss
+      - all
@@ -0,0 +1,20 @@
+# =============================================================================
+# CRITICAL: SET THESE SECRET VALUES
+# =============================================================================
+
+# CRITICAL: Generate a strong password (e.g., using: openssl rand -base64 32)
+POSTGRES_PASSWORD=
+
+# CRITICAL: Generate a Django secret key (e.g., using: openssl rand -base64 32)
+SECRET_KEY=
+
+# =============================================================================
+# DATABASE CONFIGURATION
+# =============================================================================
+POSTGRES_DB=tandoor
+POSTGRES_USER=tandoor
+DB_ENGINE=django.db.backends.postgresql
+POSTGRES_HOST=tandoor_db
+POSTGRES_PORT=5432
+
+ALLOWED_HOSTS=${TANDOOR_HOSTNAME}
@@ -0,0 +1,32 @@
+services:
+  tandoor_db:
+    container_name: tandoor_db
+    image: postgres:16-alpine
+    restart: always
+    env_file: .env
+    volumes:
+      - ${DOCKER_DATA_DIR}/tandoor/postgresql:/var/lib/postgresql/data
+    profiles:
+      - tandoor
+      - all
+
+  web_recipes:
+    image: ghcr.io/tandoorrecipes/recipes:latest
+    container_name: tandoor
+    restart: always
+    depends_on:
+      - tandoor_db
+    env_file: .env
+    volumes:
+      - ${DOCKER_DATA_DIR}/tandoor/staticfiles:/opt/recipes/staticfiles
+      - ${DOCKER_DATA_DIR}/tandoor/mediafiles:/opt/recipes/mediafiles
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.tandoor-app.rule=Host(`${TANDOOR_HOSTNAME?}`)"
+      - "traefik.http.routers.tandoor-app.entrypoints=websecure"
+      - "traefik.http.routers.tandoor-app.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.tandoor-app.middlewares=authelia@docker"
+      - "traefik.http.services.tandoor-app.loadbalancer.server.port=8080"
+    profiles:
+      - tandoor
+      - all
@@ -0,0 +1,20 @@
+services:
+  wallos:
+    image: bellamy/wallos:latest
+    container_name: wallos
+    restart: unless-stopped
+    expose:
+      - 80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.wallos.rule=Host(`${WALLOS_HOSTNAME?}`)"
+      - "traefik.http.routers.wallos.entrypoints=websecure"
+      - "traefik.http.routers.wallos.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.wallos.middlewares=authelia@docker"
+      - "traefik.http.services.wallos.loadbalancer.server.port=80"
+    volumes:
+      - ${DOCKER_DATA_DIR}/wallos/db:/var/www/html/db
+      - ${DOCKER_DATA_DIR}/wallos/logos:/var/www/html/images/uploads/logos
+    profiles:
+      - wallos
+      - all
@@ -24,6 +24,8 @@ include:
  - apps/dozzle/compose.yaml
  - apps/easynews-plus/compose.yaml
  - apps/easynews-plus-plus/compose.yaml
+  - apps/fivefilters-full-text-rss/compose.yaml
+  - apps/freshrss/compose.yaml
  - apps/gluetun/compose.yaml
  - apps/honey/compose.yaml
  - apps/huntarr/compose.yaml
@@ -58,6 +60,7 @@ include:
  - apps/redlib/compose.yaml
  - apps/realdebrid-account-monitor/compose.yaml
  - apps/recyclarr/compose.yaml
+  - apps/rss-bridge/compose.yaml
  - apps/seanime/compose.yaml
  - apps/searxng/compose.yaml
  - apps/sonarr/compose.yaml
@@ -75,6 +78,7 @@ include:
  - apps/stremio-trakt-addon/compose.yaml
  - apps/stremthru/compose.yaml
  - apps/syncribullet/compose.yaml
+  - apps/tandoor/compose.yaml
  - apps/tautulli/compose.yaml
  - apps/thelounge/compose.yaml
  - apps/tmdb-addon/compose.yaml
@@ -86,6 +90,7 @@ include:
  - apps/tweakio/compose.yaml
  - apps/uptime-kuma/compose.yaml
  - apps/vaultwarden/compose.yaml
+  - apps/wallos/compose.yaml
  - apps/warp/compose.yaml
  - apps/watchtower/compose.yaml
  - apps/webstreamr/compose.yaml
@@ -103,4 +108,4 @@ include:
 networks:
  default:
    name: ${DOCKER_NETWORK:-aio_default}
-    external: ${DOCKER_NETWORK_EXTERNAL:-false}
+    external: ${DOCKER_NETWORK_EXTERNAL:-false}