feat!: a few (important) changes

- move core configuratiion (authelia, traefik) to main .env - move all hostname definitions to main .env - add cloudflare ddns to automatically create DNS records - automatically determine stremio addon hostnames for authelia using predefined hostname environment variables - give all services a profile, including the previously implicit "default" services. Instead provide an explicit "required" profile that contains traefik and authelia. Allowing you to restart a specific profile without including the previous default services and also allowing you to have more control.
2025-12-01 23:17:00 +01:00 · 2025-04-18 20:14:28 +01:00
parent 7d54f12edc
commit ec66655997
57 changed files with 215 additions and 187 deletions
@@ -1,5 +1,5 @@
-# This file is used to store the common configuration that applies to either most containers or 
-# configuration for the compose project itself.
+# This file is used to store the core configuration for this template. Filling this .env in is the minimum requirement to get the template up and running.
+# It will set up Traefik and Authelia

 # The timezone to use, find your timezone database name from 
 # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
@@ -7,11 +7,11 @@
 TZ=Etc/UTC

 # Directory configuration. This .env file should be in $DOCKER_APP_DIR/.env
+# You MUST use absolute paths, otherwise each bind mount would be created relative to each compose file, and not 
+# the current directory
 DOCKER_DATA_DIR=/opt/docker/data
 DOCKER_APP_DIR=/opt/docker/apps

-
-
 # The process user ID and group ID to use for applicable containers. 
 # Run 'id' to see your UID and GID
 # Ensure that any pre-existing folders within the DOCKER_DATA_DIR (i.e. folders that were included within the template repository)
@@ -26,37 +26,26 @@ PGID=1000
 # =========================================================
 #                 PROFILE CONFIGURATION
 # =========================================================
+
+# This compose project is split up into profiles to allow you to only run the services you want to use.
+# Every single service in this project has its own profile, there are also profiles for a group of services. 
+
+# There is a 'required' profile that contains services that are considered required and you should not remove this
+# profile. This profile contains authelia and traefik. These two services are the core of the template as traefik
+# allows external access while authelia provides authentication. 
+
+# From there, you can add other apps by adding the relevant profile to the COMPOSE_PROFILES variable below.
+# e.g. If you wanted to add aiostreams and mediaflow proxy, you would add the 'aiostreams' and 'mediaflow' profiles to the COMPOSE_PROFILES variable.
+# like so: COMPOSE_PROFILES="required,aiostreams,mediaflow"
+
+# You can also add the 'all' profile which will include every service in the template.
+# This can be useful if you prefer to manually edit the root compose.yaml file to remove services from the include list or removing the profiles. 
 #
-# As this compose.yaml is split up into profiles, you can choose which services you want to run by using profiles.
-# If you only run 
-#     docker compose up -d
-# it will only start the default profile. 
-#
-# If you only want to use the default profile, you can leave the COMPOSE_PROFILES variable empty.
-# This will only include some basic services used for monitoring and managing the other services and server management.
-# This is useful if you aren't interested in any of the additional services I have included in this template. 
-#
-# If you want to make use of the additional profiles, you can do one of the following:
-#
-# You should set the profiles that you want to use by setting the COMPOSE_PROFILES variable below using a comma separated list.
-# e.g. COMPOSE_PROFILES="stremio,seanime"
-#
-# You can also use the --profile flag to specify which profile you want to use when running the compose file, but this will need to be specified
-# each time, even when you want to compose down the containers.
-# 
-# Note: For the profiles you are using, it is REQUIRED for you to fill in every environment variable that is needed by that profile. 
-# You can edit the compose.yaml to remove a service from a profile by just removing the profile from the profiles list for that service
-# e.g. profiles: ["stremio", "all"] -> profiles: ["all"]
-# Now, when you use the --profile flag with stremio, that service will not be started.
-# If you remove the profiles list altogether, the service will always be started, regardless of the profile(s) you use or do not use
-# 
-# Find a list of the available profiles and the services they include at: https://guides.viren070.me/selfhosting/template
-# You can also look at the compose.yaml file to see which services are included in each profile.
-# 
-# TL;DR, each folder in the apps directory is a profile.
-# And additional profiles are as follows: stremio, indexers, debrid_media_server
-# A final profile - all - is provided that includes every service in the template.
-COMPOSE_PROFILES="all"
+# If you set the COMPOSE_PROFILES variable here, all future 'docker compose' commands will abide by this variable.
+# You can, however, override this variable by using the --profile flag with docker compose commands.
+# This is useful when you want to run commands for a specific service e.g. restarting mediafusion only with docker compose --profile mediafusion restart 
+# That command will only restart mediafusion and its related services (scheduler, browserless, redis, mongo) 
+COMPOSE_PROFILES="required"

 # Other than modifying the profiles, you may also look at the compose.yaml file in the root of $DOCKER_APP_DIR
 # This file 'includes' all the other compose.yaml files. You can remove a specific file from the list to remove that from the final
@@ -64,6 +53,116 @@ COMPOSE_PROFILES="all"
 # in the compose.
 # Ensure that you don't remove files that other included files may rely on. 

+
+# ============================================================
+#                        TRAEFIK
+# ============================================================
+# Traefik is the reverse proxy which provides external access to our apps. 
+
+# Email provided to Let's Encrypt for notifications
+LETSENCRYPT_EMAIL=
+# The domain name to use for all services that are going to be exposed with Traefik.
+# This will be the default domain used for all services that are exposed with Traefik.
+# You can override this by setting a 'DOMAIN' variable in the .env file for that service.
+DOMAIN=example.com
+
+
+# =========================================================
+#                       AUTHELIA
+# =========================================================
+# Authelia provides authentication for our apps. It supports access control policies, passkeys, webauthn and 2FA.
+
+# These should all be different random strings of at least 64 characters.
+# You can use the following command to generate them:
+# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')"
+AUTHELIA_SESSION_SECRET=""
+AUTHELIA_STORAGE_ENCRYPTION_KEY=""
+AUTHELIA_JWT_SECRET=""
+
+# You can find additional configuration for Authelia in Authelia's .env file which will also
+# tell you how to add users 
+# Currently there is only one user (user1 with password 'password') and it has access to everything.
+# If you would like to configure access control policies, you will need to edit the access_control key 
+# in the ${DOCKER_DATA_DIR}/data/authelia/config/configuration.yml file.
+
+# ==========================================================
+#                    CLOUDFLARE DDNS
+# ==========================================================
+# If you would like to use the Cloudflare DDNS service to automatically create the DNS A/AAAA records for your services,
+# you must:
+  # - Be using your own domain (This will NOT work with services like Afraid.org and DuckDNS).
+  # - Have a Cloudflare account and have your domain added to it
+  # - Have your domain set to use Cloudflare's nameservers.
+  # - Add 'cloudflare-ddns' to the 'COMPOSE_PROFILES' variable above. (or use the 'all' profile)
+# Then, obtain a cloudflare API token at (https://dash.cloudflare.com/profile/api-tokens) using the 'Edit zone DNS' template and
+# provide it here.
+CLOUDFLARE_API_TOKEN=
+
+# WARNING: if you do not want to use Cloudflare DDNS, you must make sure to manually add the DNS A records for each subdomain you choose to use.
+
+
+# The required configuration for this .env is now done, you can add other services to the COMPOSE_PROFILES variable above.
+# Some apps will require additional configuration in their own .env files - which will be located in the same directory as their compose.yaml file in the app's folder
+# You can optionally also edit the subdomains below
+
+# These values are the subdomains that Traefik will use to route traffic to the services. 
+# You can modify these values to suit your needs, but ensure that they are unique and do not conflict with other services.
+ADDON_MANAGER_HOSTNAME=addon-manager.${DOMAIN?}
+AIOSTREAMS_HOSTNAME=aiostreams.${DOMAIN}
+AIOSTREMIO_HOSTNAME=aiostremio.${DOMAIN}
+AUTHELIA_HOSTNAME=auth.${DOMAIN}
+AUTOSYNC_HOSTNAME=autosync.${DOMAIN}
+BAZARR_HOSTNAME=bazarr.${DOMAIN}
+BAZARR4K_HOSTNAME=4k.bazarr.${DOMAIN}
+BESZEL_HOSTNAME=beszel.${DOMAIN}
+COMET_HOSTNAME=comet.${DOMAIN}
+DASHDOT_HOSTNAME=dash.${DOMAIN}
+DOCKGE_HOSTNAME=dockge.${DOMAIN}
+DOZZLE_HOSTNAME=dozzle.${DOMAIN}
+EASYNEWS_PLUS_HOSTNAME=easynews-plus.${DOMAIN}
+HONEY_HOSTNAME=${DOMAIN}
+JACKETT_HOSTNAME=jackett.${DOMAIN}
+JACKETTIO_HOSTNAME=jackettio.${DOMAIN}
+JELLYFIN_HOSTNAME=jellyfin.${DOMAIN}
+JELLYSEER_HOSTNAME=jellyseer.${DOMAIN}
+LIBRESPEED_HOSTNAME=speedtest.${DOMAIN}
+MEDIAFLOW_PROXY_HOSTNAME=mediaflow-proxy.${DOMAIN}
+MEDIAFUSION_HOSTNAME=mediafusion.${DOMAIN}
+MINECRAFT_HOSTNAME=mc.${DOMAIN}
+NZBHYDRA2_HOSTNAME=nzbhydra2.${DOMAIN}
+OMG_TV_STREMIO_ADDON_HOSTNAME=omg-tv-addon.${DOMAIN}
+OVERSEERR_HOSTNAME=overseerr.${DOMAIN}
+PLAUSIBLE_HOSTNAME=plausible.${DOMAIN}
+PLEX_HOSTNAME=plex.${DOMAIN}
+PORTAINER_HOSTNAME=portainer.${DOMAIN}
+PROWLARR_HOSTNAME=prowlarr.${DOMAIN}
+RADARR_HOSTNAME=radarr.${DOMAIN}
+RADARR4K_HOSTNAME=4k.radarr.${DOMAIN}
+RADARRANIME_HOSTNAME=anime.radarr.${DOMAIN}
+SEANIME_HOSTNAME=seanime.${DOMAIN}
+SEARXNG_HOSTNAME=searxng.${DOMAIN}
+SONARR_HOSTNAME=sonarr.${DOMAIN}
+SONARR4K_HOSTNAME=4k.sonarr.${DOMAIN}
+SONARRANIME_HOSTNAME=anime.sonarr.${DOMAIN}
+SPEEDTEST_TRACKER_HOSTNAME=speedtest-tracker.${DOMAIN}
+STREMIO_CATALOG_PROVIDERS_HOSTNAME=stremio-catalogues.${DOMAIN}
+STREMIO_JACKETT_HOSTNAME=stremio-jackett.${DOMAIN}
+STREMIO_SERVER_HOSTNAME=stremio-server.${DOMAIN}
+STREMIO_TRAKT_ADDON_HOSTNAME=stremio-trakt.${DOMAIN}
+STREMTHRU_HOSTNAME=stremthru.${DOMAIN}
+TAUTULLI_HOSTNAME=tautulli.${DOMAIN}
+TMDB_ADDON_HOSTNAME=tmdb.${DOMAIN}
+TORBOX_MANAGER_HOSTNAME=tbm.${DOMAIN}
+TRAEFIK_HOSTNAME=traefik.${DOMAIN}
+UPTIME_KUMA_HOSTNAME=status.${DOMAIN}
+VAULTWARDEN_HOSTNAME=vaultwarden.${DOMAIN}
+ZILEAN_HOSTNAME=zilean.${DOMAIN}
+ZIPLINE_HOSTNAME=zipline.${DOMAIN}
+ZURG_HOSTNAME=zurg.${DOMAIN}
+
+# This is the list of all the domains for which Cloudflare DDNS will create A/AAAA records for. 
+DOMAINS=${ADDON_MANAGER_HOSTNAME},${AIOSTREAMS_HOSTNAME},${AIOSTREMIO_HOSTNAME},${AUTHELIA_HOSTNAME},${AUTOSYNC_HOSTNAME},${BAZARR_HOSTNAME},${BAZARR4K_HOSTNAME},${BESZEL_HOSTNAME},${COMET_HOSTNAME},${DASHDOT_HOSTNAME},${DOCKGE_HOSTNAME},${DOZZLE_HOSTNAME},${EASYNEWS_PLUS_HOSTNAME},${HONEY_HOSTNAME},${JACKETT_HOSTNAME},${JACKETTIO_HOSTNAME},${JELLYFIN_HOSTNAME},${JELLYSEER_HOSTNAME},${LIBRESPEED_HOSTNAME},${MEDIAFLOW_PROXY_HOSTNAME},${MEDIAFUSION_HOSTNAME},${MINECRAFT_HOSTNAME},${NZBHYDRA2_HOSTNAME},${OMG_TV_STREMIO_ADDON_HOSTNAME},${OVERSEERR_HOSTNAME},${PLAUSIBLE_HOSTNAME},${PLEX_HOSTNAME},${PORTAINER_HOSTNAME},${PROWLARR_HOSTNAME},${RADARR_HOSTNAME},${RADARR4K_HOSTNAME},${RADARRANIME_HOSTNAME},${SEANIME_HOSTNAME},${SEARXNG_HOSTNAME},${SONARR_HOSTNAME},${SONARR4K_HOSTNAME},${SONARRANIME_HOSTNAME},${SPEEDTEST_TRACKER_HOSTNAME},${STREMIO_CATALOG_PROVIDERS_HOSTNAME},${STREMIO_JACKETT_HOSTNAME},${STREMIO_SERVER_HOSTNAME},${STREMIO_TRAKT_ADDON_HOSTNAME},${STREMTHRU_HOSTNAME},${TAUTULLI_HOSTNAME},${TMDB_ADDON_HOSTNAME},${TORBOX_MANAGER_HOSTNAME},${TRAEFIK_HOSTNAME},${UPTIME_KUMA_HOSTNAME},${VAULTWARDEN_HOSTNAME},${ZILEAN_HOSTNAME},${ZURG_HOSTNAME}
+
 # ====================================================
 #               DOCKER COMPOSE CONFIGURATION
 # ====================================================
@@ -79,10 +178,3 @@ COMPOSE_BAKE=true
 # Reference: https://docs.docker.com/compose/how-tos/networking/#use-a-pre-existing-network
 DOCKER_NETWORK=aio_network
 DOCKER_NETWORK_EXTERNAL=false
-
-# Now, you need to fill in the other .env files within each folder for the apps you are using. 
-# You must, at least, fill out the .env in the default profile. 
-
-# This includes: authelia, dash, dozzle, flame, honey, traefik, uptime kuma, watchtower
-# As mentioned before, you can remove the relevant line in the root compose if you don't want to use some of these.
-# e.g. you can get rid of/comment out the '- flame/compose.yaml' line if you don't want to use flame. 
@@ -1 +0,0 @@
-ADDON_MANAGER_HOSTNAME=
@@ -1,7 +1,6 @@
 # ---------------------------------------------------------
 #                     AIOSTREMIO
 # ---------------------------------------------------------
-# Profiles: all, stremio
 #
 # The AIOSTREMIO_ADMIN_USERNAME and AIOSTREMIO_ADMIN_PASSWORD are the credentials that you will use to access the AIOStremio dashboard.
 # 
@@ -13,8 +12,6 @@
 # The DEBRID_API_KEY is the API key for the debrid service you want to use by default. 
 # You can also set addon specific debrid API keys through the config.json file.
 # ---------------------------------------------------------
-AIOSTREMIO_HOSTNAME=
-
 ADMIN_USERNAME=
 ADMIN_PASSWORD=
 MEDIAFLOW_API_PASSWORD=
@@ -19,23 +19,9 @@
 # Note: Due to the way Stremio addons work, they cannot be protected by Authelia.
 # This is because the addons need to be publicly accessible in order for Stremio (and other stremio addon clients) to be able to access them.

-
-# Your domain without the protocol (e.g. example.com)
-DOMAIN=
 # The display name for WebAuthn that shows in the browser. 
 AUTHELIA_WEBAUTHN_DISPLAY_NAME="Authelia"

-# These should all be different random strings of at least 64 characters.
-# You can use the following command to generate them:
-# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')"
-AUTHELIA_SESSION_SECRET=""
-AUTHELIA_STORAGE_ENCRYPTION_KEY=""
-AUTHELIA_JWT_SECRET=""
-
-# The subdomain that Authelia uses. 
-# This is the subdomain that users are redirected to when they need to authenticate.
-AUTHELIA_SUBDOMAIN=auth
-
 # The valid users for Authelia are stored in the users.yml file.
 # This is located in `${DOCKER_DATA_DIR}/data/authelia/config/users.yml`
 # You must add your users to this file in order to be able to access secured services.
@@ -45,10 +31,8 @@ AUTHELIA_SUBDOMAIN=auth
 # You can run this command to view the file, replacing ${DOCKER_DATA_DIR} with its actual value:
 # cat ${DOCKER_DATA_DIR}/data/authelia/config/notification.txt

-# To protect your Stremio addon configure pages, set the value below to a list of subdomains of your stremio addons separated by a |
-# Any subdomains that match the below will only have specific pages protected by Authelia (e.g. /configure). The resources that are protected
-# will work for all the addons in this template, and will protect the pages used to configure the addon while leaving the core addon unprotected, 
-# allowing apps to use the addon.
-# so DO NOT include subdomains for your other apps here, as it would mean those other apps would not have all resources protected by Authelia.
-# If you aren't using any stremio addons, you can set this to a random string that won't match any subdomains.
-STREMIO_ADDON_SUBDOMAINS=aio|aiostremio|comet|easynews|mediafusion|jackettio|stremio-jackett|stremthru|omgtv|stremio-catalogues|stremio-trakt
+# A list of domains to apply page specific rules to.
+# Although we can't fully protect Stremio addons, we can still add authentication to specific pages like the configuration pages. 
+# All the domains within this comma separated list will have specific pages protected with Authelia.
+# Do NOT include non-stremio addon domains here. It would mean that those services would not be fully protected, or in most cases not protected at all.
+STREMIO_ADDON_HOSTNAMES=${AIOSTREAMS_HOSTNAME},${AIOSTREMIO_HOSTNAME},${COMET_HOSTNAME},${EASYNEWS_PLUS_HOSTNAME},${MEDIAFUSION_HOSTNAME},${JACKETTIO_HOSTNAME},${STREMIO_JACKETT_HOSTNAME},${STREMTHRU_HOSTNAME},${OMG_TV_STREMIO_ADDON_HOSTNAME},${STREMIO_CATALOG_PROVIDERS_HOSTNAME},${STREMIO_TRAKT_ADDON_HOSTNAME},${TMDB_ADDON_HOSTNAME}
@@ -9,14 +9,14 @@ services:
      X_AUTHELIA_CONFIG_FILTERS: template
      TEMPLATE_AUTHELIA_SESSION_SECRET: ${AUTHELIA_SESSION_SECRET?}
      TEMPLATE_DOMAIN: ${DOMAIN?}
-      TEMPLATE_AUTHELIA_SUBDOMAIN: ${AUTHELIA_SUBDOMAIN?}
+      TEMPLATE_AUTHELIA_HOSTNAME: ${AUTHELIA_HOSTNAME?}
      TEMPLATE_AUTHELIA_STORAGE_ENCRYPTION_KEY: ${AUTHELIA_STORAGE_ENCRYPTION_KEY?}
      TEMPLATE_AUTHELIA_WEBAUTHN_DISPLAY_NAME: ${AUTHELIA_WEBAUTHN_DISPLAY_NAME?}
      TEMPLATE_AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET?}
-      TEMPLATE_STREMIO_ADDON_SUBDOMAINS: ${STREMIO_ADDON_SUBDOMAINS?}
+      TEMPLATE_STREMIO_ADDON_HOSTNAMES: ${STREMIO_ADDON_HOSTNAMES?}
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.authelia.rule=Host(`${AUTHELIA_SUBDOMAIN?}.${DOMAIN}`)"
+      - "traefik.http.routers.authelia.rule=Host(`${AUTHELIA_HOSTNAME?}`)"
      - "traefik.http.routers.authelia.entryPoints=websecure"
      - "traefik.http.routers.authelia.tls.certresolver=letsencrypt"
      - "traefik.http.services.authelia.loadbalancer.server.port=9091"
@@ -30,6 +30,10 @@ services:
        condition: service_healthy
      authelia_postgres:
        condition: service_healthy
+    profiles:
+      - authelia
+      - required
+      - all
  
  authelia_redis:
    image: redis:latest
@@ -43,6 +47,10 @@ services:
      interval: 10s
      timeout: 5s
      retries: 5
+    profiles:
+      - authelia
+      - required
+      - all

  authelia_postgres:
    image: postgres:17-alpine
@@ -60,3 +68,7 @@ services:
      interval: 20s
      timeout: 5s
      retries: 5
+    profiles:
+      - authelia
+      - required
+      - all
@@ -1,10 +0,0 @@
-# AutoSync allows you to sync your libraries across multiple instances of Sonarr and Radarr.
-# It also functions as an autoscan for your media servers, as it can send a scan to your media servers when a new file is added to the library 
-# through Sonarr/Radarr.
-# 
-#
-# However, you need to configure the config.yaml file in ${DOCKER_DATA_DIR}/data/autosync/config.yaml
-# This can be done after starting up your sonarr/radarr instances. 
-# 
-# You can alternatively use the web interface to configure it.
-AUTOSYNC_HOSTNAME=
@@ -1,2 +0,0 @@
-BAZARR_HOSTNAME=
-BAZARR4K_HOSTNAME=
@@ -1,8 +1,5 @@
-# Beszel is a tool for monitoring status (CPU, RAM, Disk, Network) of your VPS in detail.
-BESZEL_HOSTNAME=
-
 # For beszel to work correctly, you first need to start the hub only.
-# Do this by running:
+# Do this by running (you must already have traefik and authelia running):
 # docker compose up -d beszel

 # After the hub is up, you need to go to the web interface and click '+ Add System' in the top right corner.
@@ -0,0 +1,20 @@
+services:
+  cloudflare-ddns:
+    image: favonia/cloudflare-ddns:1
+    container_name: cloudflare-ddns
+    restart: unless-stopped
+    user: "${PUID}:${PGID}"
+    network_mode: host
+    read_only: true
+    cap_drop: [all]
+    security_opt: [no-new-privileges:true]
+    environment:
+      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
+        # Your Cloudflare API token
+      - DOMAINS=${DOMAINS}
+        # Your domains (separated by commas)
+      - PROXIED=false
+        # Tell Cloudflare to cache webpages and hide your IP (optional)
+    profiles:
+      - cloudflare-ddns
+      - all
@@ -7,12 +7,6 @@
 #   ╚═════╝ ╚═════╝ ╚═╝     ╚═╝╚══════╝   ╚═╝     #
 #=================================================#

-# =============================== #
-# Traefik Configuration           #
-# =============================== #
-# The domain to use for Comet.
-COMET_HOSTNAME=
-
 # ============================== #
 # Stremio Addon Configuration    #
 # ============================== #
@@ -9,6 +9,7 @@ include:
  - bazarr/compose.yaml
  - beszel/compose.yaml
  - byparr/compose.yaml
+  - cloudflare-ddns/compose.yaml
  - comet/compose.yaml
  - dash/compose.yaml
  - dockge/compose.yaml
@@ -4,8 +4,6 @@
 # Dash Dot is a dashboard that you can use to monitor your VPS. It provides information about the CPU, RAM, Disk, and Network usage.
 # You will be able to access the dashboard at https://${DASHDOT_HOSTNAME}
 # ---------------------------------------------------------
-# e.g. dash.example.com
-DASHDOT_HOSTNAME=
 # This is the title of the page that shows up in the browser tab
 DASHDOT_PAGE_TITLE=dash.
 # Whether you want your domain name to show up in the dashboard
@@ -17,3 +17,6 @@ services:
      - "traefik.http.routers.dash.entrypoints=websecure"
      - "traefik.http.routers.dash.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dash.middlewares=authelia@docker"
+    profiles:
+      - dash
+      - all
@@ -1,9 +0,0 @@
-# Dockge is a management interface for Docker compose applications. 
-#
-# Note that with the way this template is setup, dockge will not work for running compose files. 
-# It detects the individual compose files and tries to run them as a separate compose project
-# But our compose.yaml file is a single compose project that includes all the other compose files.
-# Dockge does not detect this single compose project and tries to run each of the included compose files as a separate project.
-#
-# You should only use dockge for editing the compose.yaml files and the terminal.
-DOCKGE_HOSTNAME=
@@ -1,9 +0,0 @@
-# ---------------------------------------------------------
-#                       DOZZLE
-# ---------------------------------------------------------
-# Dozzle is a log viewer for Docker. It is used to view the logs of the containers.
-# This will be helpful for debugging purposes. 
-# You will be able to access the logs at https://${DOZZLE_HOSTNAME}
-# ---------------------------------------------------------
-
-DOZZLE_HOSTNAME=
@@ -22,3 +22,6 @@ services:
      timeout: 30s
      retries: 5
      start_period: 30s
+    profiles:
+      - dozzle
+      - all
@@ -1 +0,0 @@
-EASYNEWS_PLUS_HOSTNAME=
@@ -1,5 +0,0 @@
-# Honey is one of the start page services included in this template. The other is flame. I recommend honey.
-
-# The domain to access honey at. I set the hostname for my start page to the root of my domain (e.g. example.com)
-# but you can set it to a subdomain if you want.
-HONEY_HOSTNAME=
@@ -15,3 +15,6 @@ services:
      - "traefik.http.routers.honey.entrypoints=websecure"
      - "traefik.http.routers.honey.tls.certresolver=letsencrypt"
      - "traefik.http.routers.honey.middlewares=authelia@docker"
+    profiles:
+      - honey
+      - all
@@ -1 +0,0 @@
-JACKETT_HOSTNAME=
@@ -1,5 +1,3 @@
-JACKETTIO_HOSTNAME=
-
 # Jackett instance details. If you haven't run your instance yet, you can leave these blank.
 # Once jackett is running you can find the API key in the web UI at the top right corner of the page.
 JACKETT_URL=http://jackett:9117
@@ -1 +0,0 @@
-JELLYFIN_HOSTNAME=
@@ -1 +0,0 @@
-JELLYSEER_HOSTNAME=
@@ -1,2 +1 @@
-LIBRESPEED_HOSTNAME=
 LIBRESPEED_TITLE=LibreSpeed
@@ -1,5 +1,7 @@
-MEDIAFLOW_HOSTNAME=
-
 API_PASSWORD=
+# Whether to use a proxy or not. 
+# You can use http://warp:8080 for warp and http://gluetun:8080 for gluetun.
 PROXY_URL=http://warp:1080
+# Whether to route ALL traffic through the proxy.
+# ALL_PROXY=true
 TRANSPORT_ROUTES={ "https://torrentio.strem.fun": { "proxy": true } }
@@ -9,7 +9,7 @@ services:
      - .env
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.mediaflow.rule=Host(`${MEDIAFLOW_HOSTNAME?}`)"
+      - "traefik.http.routers.mediaflow.rule=Host(`${MEDIAFLOW_PROXY_HOSTNAME?}`)"
      - "traefik.http.routers.mediaflow.entrypoints=websecure"
      - "traefik.http.routers.mediaflow.tls.certresolver=letsencrypt"
      - "traefik.http.services.mediaflow.loadbalancer.server.port=8888"
@@ -13,11 +13,10 @@



-MEDIAFUSION_HOSTNAME=
 # ========================================================
 #             CORE APPLICATION SETTINGS 
 # ========================================================
-HOST_URL=https://${MEDIAFUSION_HOSTNAME}
+HOST_URL=https://${MEDIAFUSION_HOSTNAME?}
 POSTER_HOST_URL=https://${MEDIAFUSION_HOSTNAME}
 #  # openssl rand -hex 16
 SECRET_KEY=
@@ -1 +0,0 @@
-NZBHYDRA2_HOSTNAME=
@@ -1 +0,0 @@
-OMG_TV_STREMIO_ADDON_HOSTNAME=
@@ -1 +0,0 @@
-OVERSEERR_HOSTNAME=
@@ -7,7 +7,6 @@
 # openssl rand -base64 48 
 # ---------------------------------------------------------

-PLAUSIBLE_HOSTNAME=
 PLAUSIBLE_SECRET_KEY_BASE=

 # When you first run the container, it will be stuck on a crash loop due to some permission issues as a result of using bind mounts.
@@ -1,5 +1,3 @@
-PLEX_HOSTNAME=
-
 # Claim token for Plex. You can get it from https://www.plex.tv/claim
 # It is only valid for 5 minutes, so after generating one, you must set it here and start your container.
 # For the inital setup, you may need to have port 32400 open to access the web interface through the server IP, rather 
@@ -1 +0,0 @@
-PROWLARR_HOSTNAME=
@@ -1,3 +0,0 @@
-RADARR_HOSTNAME=
-RADARR4K_HOSTNAME=
-RADARRANIME_HOSTNAME=
@@ -1,17 +1,9 @@
-# ---------------------------------------------------------
-#                     SEANIME
-# ---------------------------------------------------------
-# Profiles: seanime, all
-# Protected by authelia.
-#
-# IMPORTANT: Once you have the container running, you need to edit Seanime's config.toml file in order to set the correct host. 
-# Run the following command to do this. 
-# sudo sed -i 's/127.0.0.1/0.0.0.0/' ./data/seanime/config.toml
-# Then, restart the container by running `sudo docker restart seanime
+# Seanime requires no extra environment variables. 
+# However, after running the container, you will have to edit the host within the config.toml file.
+# As otherwise, it only binds to localhost and will not be accessible.
 #
+# You can do this by running the following command:
+# sudo sed -i 's/127.0.0.1/0.0.0.0/' ${DOCKER_DATA_DIR}/seanime/config.toml
+
 # Note: If you are planning on using this for local media, you will not be able to use an external player
 # as we have set up a password for seanime. 
-# ---------------------------------------------------------
-
-SEANIME_HOSTNAME=
-
@@ -1 +0,0 @@
-SEARXNG_HOSTNAME=
@@ -1,3 +0,0 @@
-SONARR_HOSTNAME=
-SONARR4K_HOSTNAME=
-SONARRANIME_HOSTNAME=
@@ -1,4 +1,3 @@
-SPEEDTEST_TRACKER_HOSTNAME=
 # Run this command to generate one, include the base64 prefix:
 # echo -n 'base64:'; openssl rand -base64 32;
 APP_KEY=""
@@ -1,5 +1,3 @@
-STREMIO_CATALOG_PROVIDERS_HOSTNAME=
-
 # We need to obtain a Trakt Client ID and secret in order for the addons to work.
 # To obtain these credentials:
 # 1. Create an account/Log in on Trakt.tv/ (https://trakt.tv).
@@ -1 +0,0 @@
-STREMIO_JACKETT_HOSTNAME=
@@ -1 +0,0 @@
-STREMIO_SERVER_HOSTNAME=
@@ -1,6 +1,3 @@
-STREMIO_TRAKT_ADDON_HOSTNAME=
-
-
 # We need to obtain a Trakt Client ID and secret in order for the addons to work.
 # To obtain these credentials:
 # 1. Create an account/Log in on Trakt.tv/ (https://trakt.tv).
@@ -1 +0,0 @@
-STREMTHRU_HOSTNAME=
@@ -1 +0,0 @@
-TAUTULLI_HOSTNAME=
@@ -1,4 +1,3 @@
-TMDB_ADDON_HOSTNAME=
 # Get your API key from https://www.themoviedb.org/settings/api
 TMDB_API_KEY=
 # Get your API key from https://fanart.tv/get-an-api-key/
@@ -1 +0,0 @@
-TBM_HOSTNAME=
@@ -49,7 +49,7 @@ services:
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.tbm.rule=Host(`${TBM_HOSTNAME?}`)"
+      - "traefik.http.routers.tbm.rule=Host(`${TORBOX_MANAGER_HOSTNAME?}`)"
      - "traefik.http.routers.tbm.entrypoints=websecure"
      - "traefik.http.routers.tbm.tls.certresolver=letsencrypt"
      - "traefik.http.routers.tbm.middlewares=authelia@docker"
@@ -1,5 +1,2 @@
-# Email provided to Let's Encrypt for notifications
-LETSENCRYPT_EMAIL=
-TRAEFIK_HOSTNAME=
 # https://www.authelia.com/integration/proxies/traefik/#trusted-proxies
 TRUSTED_IPS=192.168.1.1
@@ -60,3 +60,7 @@ services:
    depends_on:
      authelia:
        condition: service_healthy
+    profiles:
+      - traefik
+      - required
+      - all
@@ -1 +0,0 @@
-UPTIME_KUMA_HOSTNAME=
@@ -17,3 +17,6 @@ services:
    volumes:
      - ${DOCKER_DATA_DIR}/uptime-kuma:/app/data
      - /var/run/docker.sock:/var/run/docker.sock
+    profiles:
+      - uptime-kuma
+      - all
@@ -1,5 +1,4 @@
-VAULTWARDEN_HOSTNAME=
 VAULTWARDEN_ADMIN_TOKEN=
 # Whether to allow signups or not. Set to true to allow signups, false to disable signups.
 # You can set it to false after you have created your account.
-VAULTWARDEN_SIGNUPS_ALLOWED=true
+VAULTWARDEN_SIGNUPS_ALLOWED=true
@@ -30,3 +30,6 @@ services:
        {{- end -}}
    volumes:  
      - /var/run/docker.sock:/var/run/docker.sock
+    profiles:
+      - watchtower
+      - all
@@ -1 +0,0 @@
-ZILEAN_HOSTNAME=
@@ -12,7 +12,6 @@
 # Most of the configuration for Zipline is done through the web interface. 
 #
 # Within the server settings
-# Set the 'Default domain' under 'Core' to the value you set for ZIPLINE_HOSTNAME
+# Set the 'Default domain' under 'Core' to the value you set for ZIPLINE_HOSTNAME in the root .env which is zipline.${DOMAIN} by default
 # Also enable Return HTTPS URLs
-ZIPLINE_HOSTNAME=
 ZIPLINE_CORE_SECRET=
@@ -16,6 +16,3 @@ ZURG_CONFIG_VERSION=v0.9
 # To pull from a private repo, you can run the following command after creating a github token (classic) with the read:packages scope:
 # echo "${GITHUB_TOKEN}" | docker login ghcr.io -u "${GITHUB_USERNAME}" --password-stdin && docker pull ghcr.io/debridmediamanager/zurg:${ZURG_VERSION}
 # (replace ${GITHUB_TOKEN} and ${GITHUB_USERNAME} with your github token and username respectively, and ${ZURG_VERSION} with the version you want to pull)
-
-
-ZURG_HOSTNAME=
@@ -720,18 +720,18 @@ access_control:
  default_policy: 'deny'

  rules:
-    ## Rules for stremio addon subdomains
-    ## Protect certain pages (e.g /configure) only
-    ## but leave api routes unprotected so apps can use them.

-    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_SUBDOMAINS" }}).{{ env "TEMPLATE_DOMAIN" }}$'
+    ## Apply page specific protection to stremio addons after escaping dots and replacing commans with pipes in the 
+    ## comma separated list of hostnames defined in the environment variable TEMPLATE_STREMIO_ADDON_HOSTNAMES.
+    ## This ensures that addons are still usable while protecting important pages.
+    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_HOSTNAMES" | replace "," "|" | replace "." "\\." }})$'
      resources:
        - '.*?/configure($|/.*$|\?.*$)'  # rule for prtecting any resource that has the component somewhere in the path
        - '.*?/(stremio|sidekick|admin|watch)($|\?.*$)' # rule for protecting any resource that ends with the component.
        - '^/$' # rule for protecting the root path
      policy: 'two_factor'
-
-    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_SUBDOMAINS" }}).{{ env "TEMPLATE_DOMAIN" }}$'
+    ## ensure other resources for stremio addons bypass authentication
+    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_HOSTNAMES" | replace "," "|" | replace "." "\\." }})$'
      policy: 'bypass'

    - domain: '*.{{ env "TEMPLATE_DOMAIN" }}'