From ec66655997f8d85a9fe6d5cbf5356ee82e57ef86 Mon Sep 17 00:00:00 2001 From: Viren070 Date: Fri, 18 Apr 2025 20:14:28 +0100 Subject: [PATCH] feat!: a few (important) changes - move core configuratiion (authelia, traefik) to main .env - move all hostname definitions to main .env - add cloudflare ddns to automatically create DNS records - automatically determine stremio addon hostnames for authelia using predefined hostname environment variables - give all services a profile, including the previously implicit "default" services. Instead provide an explicit "required" profile that contains traefik and authelia. Allowing you to restart a specific profile without including the previous default services and also allowing you to have more control. --- apps/.env | 174 +++++++++++++++++++------ apps/addon-manager/.env | 1 - apps/aiostremio/.env | 3 - apps/authelia/.env | 26 +--- apps/authelia/compose.yaml | 18 ++- apps/autosync/.env | 10 -- apps/bazarr/.env | 2 - apps/beszel/.env | 5 +- apps/cloudflare-ddns/compose.yaml | 20 +++ apps/comet/.env | 6 - apps/compose.yaml | 1 + apps/dash/.env | 2 - apps/dash/compose.yaml | 3 + apps/dockge/.env | 9 -- apps/dozzle/.env | 9 -- apps/dozzle/compose.yaml | 3 + apps/easynews-plus/.env | 1 - apps/honey/.env | 5 - apps/honey/compose.yaml | 3 + apps/jackett/.env | 1 - apps/jackettio/.env | 2 - apps/jellyfin/.env | 1 - apps/jellyseer/.env | 1 - apps/librespeed/.env | 1 - apps/mediaflow-proxy/.env | 6 +- apps/mediaflow-proxy/compose.yaml | 2 +- apps/mediafusion/.env | 3 +- apps/nzbhydra2/.env | 1 - apps/omg-tv-addon/.env | 1 - apps/overseerr/.env | 1 - apps/plausible/.env | 1 - apps/plex/.env | 2 - apps/prowlarr/.env | 1 - apps/radarr/.env | 3 - apps/seanime/.env | 20 +-- apps/searxng/.env | 1 - apps/sonarr/.env | 3 - apps/speedtest-tracker/.env | 1 - apps/stremio-catalog-providers/.env | 2 - apps/stremio-jackett/.env | 1 - apps/stremio-server/.env | 1 - apps/stremio-trakt-addon/.env | 3 - apps/stremthru/.env | 1 - apps/tautulli/.env | 1 - apps/tmdb-addon/.env | 1 - apps/torbox-manager/.env | 1 - apps/torbox-manager/compose.yaml | 2 +- apps/traefik/.env | 3 - apps/traefik/compose.yaml | 4 + apps/uptime-kuma/.env | 1 - apps/uptime-kuma/compose.yaml | 3 + apps/vaultwarden/.env | 3 +- apps/watchtower/compose.yaml | 3 + apps/zilean/.env | 1 - apps/zipline/.env | 3 +- apps/zurg/.env | 3 - data/authelia/config/configuration.yml | 12 +- 57 files changed, 215 insertions(+), 187 deletions(-) delete mode 100644 apps/addon-manager/.env delete mode 100644 apps/autosync/.env delete mode 100644 apps/bazarr/.env create mode 100644 apps/cloudflare-ddns/compose.yaml delete mode 100644 apps/dockge/.env delete mode 100644 apps/dozzle/.env delete mode 100644 apps/easynews-plus/.env delete mode 100644 apps/honey/.env delete mode 100644 apps/jackett/.env delete mode 100644 apps/jellyfin/.env delete mode 100644 apps/jellyseer/.env delete mode 100644 apps/nzbhydra2/.env delete mode 100644 apps/omg-tv-addon/.env delete mode 100644 apps/overseerr/.env delete mode 100644 apps/prowlarr/.env delete mode 100644 apps/radarr/.env delete mode 100644 apps/searxng/.env delete mode 100644 apps/sonarr/.env delete mode 100644 apps/stremio-jackett/.env delete mode 100644 apps/stremio-server/.env delete mode 100644 apps/stremthru/.env delete mode 100644 apps/tautulli/.env delete mode 100644 apps/torbox-manager/.env delete mode 100644 apps/uptime-kuma/.env delete mode 100644 apps/zilean/.env diff --git a/apps/.env b/apps/.env index 6c49c1a..fd3ed08 100644 --- a/apps/.env +++ b/apps/.env @@ -1,5 +1,5 @@ -# This file is used to store the common configuration that applies to either most containers or -# configuration for the compose project itself. +# This file is used to store the core configuration for this template. Filling this .env in is the minimum requirement to get the template up and running. +# It will set up Traefik and Authelia # The timezone to use, find your timezone database name from # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -7,11 +7,11 @@ TZ=Etc/UTC # Directory configuration. This .env file should be in $DOCKER_APP_DIR/.env +# You MUST use absolute paths, otherwise each bind mount would be created relative to each compose file, and not +# the current directory DOCKER_DATA_DIR=/opt/docker/data DOCKER_APP_DIR=/opt/docker/apps - - # The process user ID and group ID to use for applicable containers. # Run 'id' to see your UID and GID # Ensure that any pre-existing folders within the DOCKER_DATA_DIR (i.e. folders that were included within the template repository) @@ -26,37 +26,26 @@ PGID=1000 # ========================================================= # PROFILE CONFIGURATION # ========================================================= + +# This compose project is split up into profiles to allow you to only run the services you want to use. +# Every single service in this project has its own profile, there are also profiles for a group of services. + +# There is a 'required' profile that contains services that are considered required and you should not remove this +# profile. This profile contains authelia and traefik. These two services are the core of the template as traefik +# allows external access while authelia provides authentication. + +# From there, you can add other apps by adding the relevant profile to the COMPOSE_PROFILES variable below. +# e.g. If you wanted to add aiostreams and mediaflow proxy, you would add the 'aiostreams' and 'mediaflow' profiles to the COMPOSE_PROFILES variable. +# like so: COMPOSE_PROFILES="required,aiostreams,mediaflow" + +# You can also add the 'all' profile which will include every service in the template. +# This can be useful if you prefer to manually edit the root compose.yaml file to remove services from the include list or removing the profiles. # -# As this compose.yaml is split up into profiles, you can choose which services you want to run by using profiles. -# If you only run -# docker compose up -d -# it will only start the default profile. -# -# If you only want to use the default profile, you can leave the COMPOSE_PROFILES variable empty. -# This will only include some basic services used for monitoring and managing the other services and server management. -# This is useful if you aren't interested in any of the additional services I have included in this template. -# -# If you want to make use of the additional profiles, you can do one of the following: -# -# You should set the profiles that you want to use by setting the COMPOSE_PROFILES variable below using a comma separated list. -# e.g. COMPOSE_PROFILES="stremio,seanime" -# -# You can also use the --profile flag to specify which profile you want to use when running the compose file, but this will need to be specified -# each time, even when you want to compose down the containers. -# -# Note: For the profiles you are using, it is REQUIRED for you to fill in every environment variable that is needed by that profile. -# You can edit the compose.yaml to remove a service from a profile by just removing the profile from the profiles list for that service -# e.g. profiles: ["stremio", "all"] -> profiles: ["all"] -# Now, when you use the --profile flag with stremio, that service will not be started. -# If you remove the profiles list altogether, the service will always be started, regardless of the profile(s) you use or do not use -# -# Find a list of the available profiles and the services they include at: https://guides.viren070.me/selfhosting/template -# You can also look at the compose.yaml file to see which services are included in each profile. -# -# TL;DR, each folder in the apps directory is a profile. -# And additional profiles are as follows: stremio, indexers, debrid_media_server -# A final profile - all - is provided that includes every service in the template. -COMPOSE_PROFILES="all" +# If you set the COMPOSE_PROFILES variable here, all future 'docker compose' commands will abide by this variable. +# You can, however, override this variable by using the --profile flag with docker compose commands. +# This is useful when you want to run commands for a specific service e.g. restarting mediafusion only with docker compose --profile mediafusion restart +# That command will only restart mediafusion and its related services (scheduler, browserless, redis, mongo) +COMPOSE_PROFILES="required" # Other than modifying the profiles, you may also look at the compose.yaml file in the root of $DOCKER_APP_DIR # This file 'includes' all the other compose.yaml files. You can remove a specific file from the list to remove that from the final @@ -64,6 +53,116 @@ COMPOSE_PROFILES="all" # in the compose. # Ensure that you don't remove files that other included files may rely on. + +# ============================================================ +# TRAEFIK +# ============================================================ +# Traefik is the reverse proxy which provides external access to our apps. + +# Email provided to Let's Encrypt for notifications +LETSENCRYPT_EMAIL= +# The domain name to use for all services that are going to be exposed with Traefik. +# This will be the default domain used for all services that are exposed with Traefik. +# You can override this by setting a 'DOMAIN' variable in the .env file for that service. +DOMAIN=example.com + + +# ========================================================= +# AUTHELIA +# ========================================================= +# Authelia provides authentication for our apps. It supports access control policies, passkeys, webauthn and 2FA. + +# These should all be different random strings of at least 64 characters. +# You can use the following command to generate them: +# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')" +AUTHELIA_SESSION_SECRET="" +AUTHELIA_STORAGE_ENCRYPTION_KEY="" +AUTHELIA_JWT_SECRET="" + +# You can find additional configuration for Authelia in Authelia's .env file which will also +# tell you how to add users +# Currently there is only one user (user1 with password 'password') and it has access to everything. +# If you would like to configure access control policies, you will need to edit the access_control key +# in the ${DOCKER_DATA_DIR}/data/authelia/config/configuration.yml file. + +# ========================================================== +# CLOUDFLARE DDNS +# ========================================================== +# If you would like to use the Cloudflare DDNS service to automatically create the DNS A/AAAA records for your services, +# you must: + # - Be using your own domain (This will NOT work with services like Afraid.org and DuckDNS). + # - Have a Cloudflare account and have your domain added to it + # - Have your domain set to use Cloudflare's nameservers. + # - Add 'cloudflare-ddns' to the 'COMPOSE_PROFILES' variable above. (or use the 'all' profile) +# Then, obtain a cloudflare API token at (https://dash.cloudflare.com/profile/api-tokens) using the 'Edit zone DNS' template and +# provide it here. +CLOUDFLARE_API_TOKEN= + +# WARNING: if you do not want to use Cloudflare DDNS, you must make sure to manually add the DNS A records for each subdomain you choose to use. + + +# The required configuration for this .env is now done, you can add other services to the COMPOSE_PROFILES variable above. +# Some apps will require additional configuration in their own .env files - which will be located in the same directory as their compose.yaml file in the app's folder +# You can optionally also edit the subdomains below + +# These values are the subdomains that Traefik will use to route traffic to the services. +# You can modify these values to suit your needs, but ensure that they are unique and do not conflict with other services. +ADDON_MANAGER_HOSTNAME=addon-manager.${DOMAIN?} +AIOSTREAMS_HOSTNAME=aiostreams.${DOMAIN} +AIOSTREMIO_HOSTNAME=aiostremio.${DOMAIN} +AUTHELIA_HOSTNAME=auth.${DOMAIN} +AUTOSYNC_HOSTNAME=autosync.${DOMAIN} +BAZARR_HOSTNAME=bazarr.${DOMAIN} +BAZARR4K_HOSTNAME=4k.bazarr.${DOMAIN} +BESZEL_HOSTNAME=beszel.${DOMAIN} +COMET_HOSTNAME=comet.${DOMAIN} +DASHDOT_HOSTNAME=dash.${DOMAIN} +DOCKGE_HOSTNAME=dockge.${DOMAIN} +DOZZLE_HOSTNAME=dozzle.${DOMAIN} +EASYNEWS_PLUS_HOSTNAME=easynews-plus.${DOMAIN} +HONEY_HOSTNAME=${DOMAIN} +JACKETT_HOSTNAME=jackett.${DOMAIN} +JACKETTIO_HOSTNAME=jackettio.${DOMAIN} +JELLYFIN_HOSTNAME=jellyfin.${DOMAIN} +JELLYSEER_HOSTNAME=jellyseer.${DOMAIN} +LIBRESPEED_HOSTNAME=speedtest.${DOMAIN} +MEDIAFLOW_PROXY_HOSTNAME=mediaflow-proxy.${DOMAIN} +MEDIAFUSION_HOSTNAME=mediafusion.${DOMAIN} +MINECRAFT_HOSTNAME=mc.${DOMAIN} +NZBHYDRA2_HOSTNAME=nzbhydra2.${DOMAIN} +OMG_TV_STREMIO_ADDON_HOSTNAME=omg-tv-addon.${DOMAIN} +OVERSEERR_HOSTNAME=overseerr.${DOMAIN} +PLAUSIBLE_HOSTNAME=plausible.${DOMAIN} +PLEX_HOSTNAME=plex.${DOMAIN} +PORTAINER_HOSTNAME=portainer.${DOMAIN} +PROWLARR_HOSTNAME=prowlarr.${DOMAIN} +RADARR_HOSTNAME=radarr.${DOMAIN} +RADARR4K_HOSTNAME=4k.radarr.${DOMAIN} +RADARRANIME_HOSTNAME=anime.radarr.${DOMAIN} +SEANIME_HOSTNAME=seanime.${DOMAIN} +SEARXNG_HOSTNAME=searxng.${DOMAIN} +SONARR_HOSTNAME=sonarr.${DOMAIN} +SONARR4K_HOSTNAME=4k.sonarr.${DOMAIN} +SONARRANIME_HOSTNAME=anime.sonarr.${DOMAIN} +SPEEDTEST_TRACKER_HOSTNAME=speedtest-tracker.${DOMAIN} +STREMIO_CATALOG_PROVIDERS_HOSTNAME=stremio-catalogues.${DOMAIN} +STREMIO_JACKETT_HOSTNAME=stremio-jackett.${DOMAIN} +STREMIO_SERVER_HOSTNAME=stremio-server.${DOMAIN} +STREMIO_TRAKT_ADDON_HOSTNAME=stremio-trakt.${DOMAIN} +STREMTHRU_HOSTNAME=stremthru.${DOMAIN} +TAUTULLI_HOSTNAME=tautulli.${DOMAIN} +TMDB_ADDON_HOSTNAME=tmdb.${DOMAIN} +TORBOX_MANAGER_HOSTNAME=tbm.${DOMAIN} +TRAEFIK_HOSTNAME=traefik.${DOMAIN} +UPTIME_KUMA_HOSTNAME=status.${DOMAIN} +VAULTWARDEN_HOSTNAME=vaultwarden.${DOMAIN} +ZILEAN_HOSTNAME=zilean.${DOMAIN} +ZIPLINE_HOSTNAME=zipline.${DOMAIN} +ZURG_HOSTNAME=zurg.${DOMAIN} + +# This is the list of all the domains for which Cloudflare DDNS will create A/AAAA records for. +DOMAINS=${ADDON_MANAGER_HOSTNAME},${AIOSTREAMS_HOSTNAME},${AIOSTREMIO_HOSTNAME},${AUTHELIA_HOSTNAME},${AUTOSYNC_HOSTNAME},${BAZARR_HOSTNAME},${BAZARR4K_HOSTNAME},${BESZEL_HOSTNAME},${COMET_HOSTNAME},${DASHDOT_HOSTNAME},${DOCKGE_HOSTNAME},${DOZZLE_HOSTNAME},${EASYNEWS_PLUS_HOSTNAME},${HONEY_HOSTNAME},${JACKETT_HOSTNAME},${JACKETTIO_HOSTNAME},${JELLYFIN_HOSTNAME},${JELLYSEER_HOSTNAME},${LIBRESPEED_HOSTNAME},${MEDIAFLOW_PROXY_HOSTNAME},${MEDIAFUSION_HOSTNAME},${MINECRAFT_HOSTNAME},${NZBHYDRA2_HOSTNAME},${OMG_TV_STREMIO_ADDON_HOSTNAME},${OVERSEERR_HOSTNAME},${PLAUSIBLE_HOSTNAME},${PLEX_HOSTNAME},${PORTAINER_HOSTNAME},${PROWLARR_HOSTNAME},${RADARR_HOSTNAME},${RADARR4K_HOSTNAME},${RADARRANIME_HOSTNAME},${SEANIME_HOSTNAME},${SEARXNG_HOSTNAME},${SONARR_HOSTNAME},${SONARR4K_HOSTNAME},${SONARRANIME_HOSTNAME},${SPEEDTEST_TRACKER_HOSTNAME},${STREMIO_CATALOG_PROVIDERS_HOSTNAME},${STREMIO_JACKETT_HOSTNAME},${STREMIO_SERVER_HOSTNAME},${STREMIO_TRAKT_ADDON_HOSTNAME},${STREMTHRU_HOSTNAME},${TAUTULLI_HOSTNAME},${TMDB_ADDON_HOSTNAME},${TORBOX_MANAGER_HOSTNAME},${TRAEFIK_HOSTNAME},${UPTIME_KUMA_HOSTNAME},${VAULTWARDEN_HOSTNAME},${ZILEAN_HOSTNAME},${ZURG_HOSTNAME} + # ==================================================== # DOCKER COMPOSE CONFIGURATION # ==================================================== @@ -79,10 +178,3 @@ COMPOSE_BAKE=true # Reference: https://docs.docker.com/compose/how-tos/networking/#use-a-pre-existing-network DOCKER_NETWORK=aio_network DOCKER_NETWORK_EXTERNAL=false - -# Now, you need to fill in the other .env files within each folder for the apps you are using. -# You must, at least, fill out the .env in the default profile. - -# This includes: authelia, dash, dozzle, flame, honey, traefik, uptime kuma, watchtower -# As mentioned before, you can remove the relevant line in the root compose if you don't want to use some of these. -# e.g. you can get rid of/comment out the '- flame/compose.yaml' line if you don't want to use flame. \ No newline at end of file diff --git a/apps/addon-manager/.env b/apps/addon-manager/.env deleted file mode 100644 index 3598fef..0000000 --- a/apps/addon-manager/.env +++ /dev/null @@ -1 +0,0 @@ -ADDON_MANAGER_HOSTNAME= diff --git a/apps/aiostremio/.env b/apps/aiostremio/.env index 2b18c85..6d5fd6f 100644 --- a/apps/aiostremio/.env +++ b/apps/aiostremio/.env @@ -1,7 +1,6 @@ # --------------------------------------------------------- # AIOSTREMIO # --------------------------------------------------------- -# Profiles: all, stremio # # The AIOSTREMIO_ADMIN_USERNAME and AIOSTREMIO_ADMIN_PASSWORD are the credentials that you will use to access the AIOStremio dashboard. # @@ -13,8 +12,6 @@ # The DEBRID_API_KEY is the API key for the debrid service you want to use by default. # You can also set addon specific debrid API keys through the config.json file. # --------------------------------------------------------- -AIOSTREMIO_HOSTNAME= - ADMIN_USERNAME= ADMIN_PASSWORD= MEDIAFLOW_API_PASSWORD= diff --git a/apps/authelia/.env b/apps/authelia/.env index 8375f3c..9bac48c 100644 --- a/apps/authelia/.env +++ b/apps/authelia/.env @@ -19,23 +19,9 @@ # Note: Due to the way Stremio addons work, they cannot be protected by Authelia. # This is because the addons need to be publicly accessible in order for Stremio (and other stremio addon clients) to be able to access them. - -# Your domain without the protocol (e.g. example.com) -DOMAIN= # The display name for WebAuthn that shows in the browser. AUTHELIA_WEBAUTHN_DISPLAY_NAME="Authelia" -# These should all be different random strings of at least 64 characters. -# You can use the following command to generate them: -# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')" -AUTHELIA_SESSION_SECRET="" -AUTHELIA_STORAGE_ENCRYPTION_KEY="" -AUTHELIA_JWT_SECRET="" - -# The subdomain that Authelia uses. -# This is the subdomain that users are redirected to when they need to authenticate. -AUTHELIA_SUBDOMAIN=auth - # The valid users for Authelia are stored in the users.yml file. # This is located in `${DOCKER_DATA_DIR}/data/authelia/config/users.yml` # You must add your users to this file in order to be able to access secured services. @@ -45,10 +31,8 @@ AUTHELIA_SUBDOMAIN=auth # You can run this command to view the file, replacing ${DOCKER_DATA_DIR} with its actual value: # cat ${DOCKER_DATA_DIR}/data/authelia/config/notification.txt -# To protect your Stremio addon configure pages, set the value below to a list of subdomains of your stremio addons separated by a | -# Any subdomains that match the below will only have specific pages protected by Authelia (e.g. /configure). The resources that are protected -# will work for all the addons in this template, and will protect the pages used to configure the addon while leaving the core addon unprotected, -# allowing apps to use the addon. -# so DO NOT include subdomains for your other apps here, as it would mean those other apps would not have all resources protected by Authelia. -# If you aren't using any stremio addons, you can set this to a random string that won't match any subdomains. -STREMIO_ADDON_SUBDOMAINS=aio|aiostremio|comet|easynews|mediafusion|jackettio|stremio-jackett|stremthru|omgtv|stremio-catalogues|stremio-trakt \ No newline at end of file +# A list of domains to apply page specific rules to. +# Although we can't fully protect Stremio addons, we can still add authentication to specific pages like the configuration pages. +# All the domains within this comma separated list will have specific pages protected with Authelia. +# Do NOT include non-stremio addon domains here. It would mean that those services would not be fully protected, or in most cases not protected at all. +STREMIO_ADDON_HOSTNAMES=${AIOSTREAMS_HOSTNAME},${AIOSTREMIO_HOSTNAME},${COMET_HOSTNAME},${EASYNEWS_PLUS_HOSTNAME},${MEDIAFUSION_HOSTNAME},${JACKETTIO_HOSTNAME},${STREMIO_JACKETT_HOSTNAME},${STREMTHRU_HOSTNAME},${OMG_TV_STREMIO_ADDON_HOSTNAME},${STREMIO_CATALOG_PROVIDERS_HOSTNAME},${STREMIO_TRAKT_ADDON_HOSTNAME},${TMDB_ADDON_HOSTNAME} \ No newline at end of file diff --git a/apps/authelia/compose.yaml b/apps/authelia/compose.yaml index 74c5f59..4718bf5 100644 --- a/apps/authelia/compose.yaml +++ b/apps/authelia/compose.yaml @@ -9,14 +9,14 @@ services: X_AUTHELIA_CONFIG_FILTERS: template TEMPLATE_AUTHELIA_SESSION_SECRET: ${AUTHELIA_SESSION_SECRET?} TEMPLATE_DOMAIN: ${DOMAIN?} - TEMPLATE_AUTHELIA_SUBDOMAIN: ${AUTHELIA_SUBDOMAIN?} + TEMPLATE_AUTHELIA_HOSTNAME: ${AUTHELIA_HOSTNAME?} TEMPLATE_AUTHELIA_STORAGE_ENCRYPTION_KEY: ${AUTHELIA_STORAGE_ENCRYPTION_KEY?} TEMPLATE_AUTHELIA_WEBAUTHN_DISPLAY_NAME: ${AUTHELIA_WEBAUTHN_DISPLAY_NAME?} TEMPLATE_AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET?} - TEMPLATE_STREMIO_ADDON_SUBDOMAINS: ${STREMIO_ADDON_SUBDOMAINS?} + TEMPLATE_STREMIO_ADDON_HOSTNAMES: ${STREMIO_ADDON_HOSTNAMES?} labels: - "traefik.enable=true" - - "traefik.http.routers.authelia.rule=Host(`${AUTHELIA_SUBDOMAIN?}.${DOMAIN}`)" + - "traefik.http.routers.authelia.rule=Host(`${AUTHELIA_HOSTNAME?}`)" - "traefik.http.routers.authelia.entryPoints=websecure" - "traefik.http.routers.authelia.tls.certresolver=letsencrypt" - "traefik.http.services.authelia.loadbalancer.server.port=9091" @@ -30,6 +30,10 @@ services: condition: service_healthy authelia_postgres: condition: service_healthy + profiles: + - authelia + - required + - all authelia_redis: image: redis:latest @@ -43,6 +47,10 @@ services: interval: 10s timeout: 5s retries: 5 + profiles: + - authelia + - required + - all authelia_postgres: image: postgres:17-alpine @@ -60,3 +68,7 @@ services: interval: 20s timeout: 5s retries: 5 + profiles: + - authelia + - required + - all diff --git a/apps/autosync/.env b/apps/autosync/.env deleted file mode 100644 index 8729ab4..0000000 --- a/apps/autosync/.env +++ /dev/null @@ -1,10 +0,0 @@ -# AutoSync allows you to sync your libraries across multiple instances of Sonarr and Radarr. -# It also functions as an autoscan for your media servers, as it can send a scan to your media servers when a new file is added to the library -# through Sonarr/Radarr. -# -# -# However, you need to configure the config.yaml file in ${DOCKER_DATA_DIR}/data/autosync/config.yaml -# This can be done after starting up your sonarr/radarr instances. -# -# You can alternatively use the web interface to configure it. -AUTOSYNC_HOSTNAME= \ No newline at end of file diff --git a/apps/bazarr/.env b/apps/bazarr/.env deleted file mode 100644 index 73c66eb..0000000 --- a/apps/bazarr/.env +++ /dev/null @@ -1,2 +0,0 @@ -BAZARR_HOSTNAME= -BAZARR4K_HOSTNAME= diff --git a/apps/beszel/.env b/apps/beszel/.env index aecd5d0..094ef09 100644 --- a/apps/beszel/.env +++ b/apps/beszel/.env @@ -1,8 +1,5 @@ -# Beszel is a tool for monitoring status (CPU, RAM, Disk, Network) of your VPS in detail. -BESZEL_HOSTNAME= - # For beszel to work correctly, you first need to start the hub only. -# Do this by running: +# Do this by running (you must already have traefik and authelia running): # docker compose up -d beszel # After the hub is up, you need to go to the web interface and click '+ Add System' in the top right corner. diff --git a/apps/cloudflare-ddns/compose.yaml b/apps/cloudflare-ddns/compose.yaml new file mode 100644 index 0000000..a9cfad8 --- /dev/null +++ b/apps/cloudflare-ddns/compose.yaml @@ -0,0 +1,20 @@ +services: + cloudflare-ddns: + image: favonia/cloudflare-ddns:1 + container_name: cloudflare-ddns + restart: unless-stopped + user: "${PUID}:${PGID}" + network_mode: host + read_only: true + cap_drop: [all] + security_opt: [no-new-privileges:true] + environment: + - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} + # Your Cloudflare API token + - DOMAINS=${DOMAINS} + # Your domains (separated by commas) + - PROXIED=false + # Tell Cloudflare to cache webpages and hide your IP (optional) + profiles: + - cloudflare-ddns + - all diff --git a/apps/comet/.env b/apps/comet/.env index dd0f5d5..292ba31 100644 --- a/apps/comet/.env +++ b/apps/comet/.env @@ -7,12 +7,6 @@ # ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝ ╚═╝ # #=================================================# -# =============================== # -# Traefik Configuration # -# =============================== # -# The domain to use for Comet. -COMET_HOSTNAME= - # ============================== # # Stremio Addon Configuration # # ============================== # diff --git a/apps/compose.yaml b/apps/compose.yaml index ea08b9d..d330d75 100644 --- a/apps/compose.yaml +++ b/apps/compose.yaml @@ -9,6 +9,7 @@ include: - bazarr/compose.yaml - beszel/compose.yaml - byparr/compose.yaml + - cloudflare-ddns/compose.yaml - comet/compose.yaml - dash/compose.yaml - dockge/compose.yaml diff --git a/apps/dash/.env b/apps/dash/.env index 73b948e..27cb028 100644 --- a/apps/dash/.env +++ b/apps/dash/.env @@ -4,8 +4,6 @@ # Dash Dot is a dashboard that you can use to monitor your VPS. It provides information about the CPU, RAM, Disk, and Network usage. # You will be able to access the dashboard at https://${DASHDOT_HOSTNAME} # --------------------------------------------------------- -# e.g. dash.example.com -DASHDOT_HOSTNAME= # This is the title of the page that shows up in the browser tab DASHDOT_PAGE_TITLE=dash. # Whether you want your domain name to show up in the dashboard diff --git a/apps/dash/compose.yaml b/apps/dash/compose.yaml index 94cef4f..6132315 100644 --- a/apps/dash/compose.yaml +++ b/apps/dash/compose.yaml @@ -17,3 +17,6 @@ services: - "traefik.http.routers.dash.entrypoints=websecure" - "traefik.http.routers.dash.tls.certresolver=letsencrypt" - "traefik.http.routers.dash.middlewares=authelia@docker" + profiles: + - dash + - all diff --git a/apps/dockge/.env b/apps/dockge/.env deleted file mode 100644 index 95e42e4..0000000 --- a/apps/dockge/.env +++ /dev/null @@ -1,9 +0,0 @@ -# Dockge is a management interface for Docker compose applications. -# -# Note that with the way this template is setup, dockge will not work for running compose files. -# It detects the individual compose files and tries to run them as a separate compose project -# But our compose.yaml file is a single compose project that includes all the other compose files. -# Dockge does not detect this single compose project and tries to run each of the included compose files as a separate project. -# -# You should only use dockge for editing the compose.yaml files and the terminal. -DOCKGE_HOSTNAME= \ No newline at end of file diff --git a/apps/dozzle/.env b/apps/dozzle/.env deleted file mode 100644 index b0bffa5..0000000 --- a/apps/dozzle/.env +++ /dev/null @@ -1,9 +0,0 @@ -# --------------------------------------------------------- -# DOZZLE -# --------------------------------------------------------- -# Dozzle is a log viewer for Docker. It is used to view the logs of the containers. -# This will be helpful for debugging purposes. -# You will be able to access the logs at https://${DOZZLE_HOSTNAME} -# --------------------------------------------------------- - -DOZZLE_HOSTNAME= diff --git a/apps/dozzle/compose.yaml b/apps/dozzle/compose.yaml index 1a7d2cb..001df40 100644 --- a/apps/dozzle/compose.yaml +++ b/apps/dozzle/compose.yaml @@ -22,3 +22,6 @@ services: timeout: 30s retries: 5 start_period: 30s + profiles: + - dozzle + - all diff --git a/apps/easynews-plus/.env b/apps/easynews-plus/.env deleted file mode 100644 index ae8d173..0000000 --- a/apps/easynews-plus/.env +++ /dev/null @@ -1 +0,0 @@ -EASYNEWS_PLUS_HOSTNAME= \ No newline at end of file diff --git a/apps/honey/.env b/apps/honey/.env deleted file mode 100644 index 5d3c085..0000000 --- a/apps/honey/.env +++ /dev/null @@ -1,5 +0,0 @@ -# Honey is one of the start page services included in this template. The other is flame. I recommend honey. - -# The domain to access honey at. I set the hostname for my start page to the root of my domain (e.g. example.com) -# but you can set it to a subdomain if you want. -HONEY_HOSTNAME= \ No newline at end of file diff --git a/apps/honey/compose.yaml b/apps/honey/compose.yaml index ca668fa..a523b0c 100644 --- a/apps/honey/compose.yaml +++ b/apps/honey/compose.yaml @@ -15,3 +15,6 @@ services: - "traefik.http.routers.honey.entrypoints=websecure" - "traefik.http.routers.honey.tls.certresolver=letsencrypt" - "traefik.http.routers.honey.middlewares=authelia@docker" + profiles: + - honey + - all diff --git a/apps/jackett/.env b/apps/jackett/.env deleted file mode 100644 index 3515d5f..0000000 --- a/apps/jackett/.env +++ /dev/null @@ -1 +0,0 @@ -JACKETT_HOSTNAME= diff --git a/apps/jackettio/.env b/apps/jackettio/.env index 008aab3..94ace9b 100644 --- a/apps/jackettio/.env +++ b/apps/jackettio/.env @@ -1,5 +1,3 @@ -JACKETTIO_HOSTNAME= - # Jackett instance details. If you haven't run your instance yet, you can leave these blank. # Once jackett is running you can find the API key in the web UI at the top right corner of the page. JACKETT_URL=http://jackett:9117 diff --git a/apps/jellyfin/.env b/apps/jellyfin/.env deleted file mode 100644 index 91c9e0c..0000000 --- a/apps/jellyfin/.env +++ /dev/null @@ -1 +0,0 @@ -JELLYFIN_HOSTNAME= diff --git a/apps/jellyseer/.env b/apps/jellyseer/.env deleted file mode 100644 index f4d1948..0000000 --- a/apps/jellyseer/.env +++ /dev/null @@ -1 +0,0 @@ -JELLYSEER_HOSTNAME= diff --git a/apps/librespeed/.env b/apps/librespeed/.env index 7ce03ff..cc7faa2 100644 --- a/apps/librespeed/.env +++ b/apps/librespeed/.env @@ -1,2 +1 @@ -LIBRESPEED_HOSTNAME= LIBRESPEED_TITLE=LibreSpeed \ No newline at end of file diff --git a/apps/mediaflow-proxy/.env b/apps/mediaflow-proxy/.env index 1cebe2c..44b50b7 100644 --- a/apps/mediaflow-proxy/.env +++ b/apps/mediaflow-proxy/.env @@ -1,5 +1,7 @@ -MEDIAFLOW_HOSTNAME= - API_PASSWORD= +# Whether to use a proxy or not. +# You can use http://warp:8080 for warp and http://gluetun:8080 for gluetun. PROXY_URL=http://warp:1080 +# Whether to route ALL traffic through the proxy. +# ALL_PROXY=true TRANSPORT_ROUTES={ "https://torrentio.strem.fun": { "proxy": true } } diff --git a/apps/mediaflow-proxy/compose.yaml b/apps/mediaflow-proxy/compose.yaml index de6bab6..76520de 100644 --- a/apps/mediaflow-proxy/compose.yaml +++ b/apps/mediaflow-proxy/compose.yaml @@ -9,7 +9,7 @@ services: - .env labels: - "traefik.enable=true" - - "traefik.http.routers.mediaflow.rule=Host(`${MEDIAFLOW_HOSTNAME?}`)" + - "traefik.http.routers.mediaflow.rule=Host(`${MEDIAFLOW_PROXY_HOSTNAME?}`)" - "traefik.http.routers.mediaflow.entrypoints=websecure" - "traefik.http.routers.mediaflow.tls.certresolver=letsencrypt" - "traefik.http.services.mediaflow.loadbalancer.server.port=8888" diff --git a/apps/mediafusion/.env b/apps/mediafusion/.env index ab4f6b3..f874249 100644 --- a/apps/mediafusion/.env +++ b/apps/mediafusion/.env @@ -13,11 +13,10 @@ -MEDIAFUSION_HOSTNAME= # ======================================================== # CORE APPLICATION SETTINGS # ======================================================== -HOST_URL=https://${MEDIAFUSION_HOSTNAME} +HOST_URL=https://${MEDIAFUSION_HOSTNAME?} POSTER_HOST_URL=https://${MEDIAFUSION_HOSTNAME} # # openssl rand -hex 16 SECRET_KEY= diff --git a/apps/nzbhydra2/.env b/apps/nzbhydra2/.env deleted file mode 100644 index 38fecb2..0000000 --- a/apps/nzbhydra2/.env +++ /dev/null @@ -1 +0,0 @@ -NZBHYDRA2_HOSTNAME= diff --git a/apps/omg-tv-addon/.env b/apps/omg-tv-addon/.env deleted file mode 100644 index e7b039a..0000000 --- a/apps/omg-tv-addon/.env +++ /dev/null @@ -1 +0,0 @@ -OMG_TV_STREMIO_ADDON_HOSTNAME= diff --git a/apps/overseerr/.env b/apps/overseerr/.env deleted file mode 100644 index 0272dd9..0000000 --- a/apps/overseerr/.env +++ /dev/null @@ -1 +0,0 @@ -OVERSEERR_HOSTNAME= diff --git a/apps/plausible/.env b/apps/plausible/.env index c2fa7f8..0fa7125 100644 --- a/apps/plausible/.env +++ b/apps/plausible/.env @@ -7,7 +7,6 @@ # openssl rand -base64 48 # --------------------------------------------------------- -PLAUSIBLE_HOSTNAME= PLAUSIBLE_SECRET_KEY_BASE= # When you first run the container, it will be stuck on a crash loop due to some permission issues as a result of using bind mounts. diff --git a/apps/plex/.env b/apps/plex/.env index 1b2aec3..311937e 100644 --- a/apps/plex/.env +++ b/apps/plex/.env @@ -1,5 +1,3 @@ -PLEX_HOSTNAME= - # Claim token for Plex. You can get it from https://www.plex.tv/claim # It is only valid for 5 minutes, so after generating one, you must set it here and start your container. # For the inital setup, you may need to have port 32400 open to access the web interface through the server IP, rather diff --git a/apps/prowlarr/.env b/apps/prowlarr/.env deleted file mode 100644 index 86dd72e..0000000 --- a/apps/prowlarr/.env +++ /dev/null @@ -1 +0,0 @@ -PROWLARR_HOSTNAME= diff --git a/apps/radarr/.env b/apps/radarr/.env deleted file mode 100644 index dfa3eda..0000000 --- a/apps/radarr/.env +++ /dev/null @@ -1,3 +0,0 @@ -RADARR_HOSTNAME= -RADARR4K_HOSTNAME= -RADARRANIME_HOSTNAME= diff --git a/apps/seanime/.env b/apps/seanime/.env index 6424f18..bdd2bf9 100644 --- a/apps/seanime/.env +++ b/apps/seanime/.env @@ -1,17 +1,9 @@ -# --------------------------------------------------------- -# SEANIME -# --------------------------------------------------------- -# Profiles: seanime, all -# Protected by authelia. -# -# IMPORTANT: Once you have the container running, you need to edit Seanime's config.toml file in order to set the correct host. -# Run the following command to do this. -# sudo sed -i 's/127.0.0.1/0.0.0.0/' ./data/seanime/config.toml -# Then, restart the container by running `sudo docker restart seanime +# Seanime requires no extra environment variables. +# However, after running the container, you will have to edit the host within the config.toml file. +# As otherwise, it only binds to localhost and will not be accessible. # +# You can do this by running the following command: +# sudo sed -i 's/127.0.0.1/0.0.0.0/' ${DOCKER_DATA_DIR}/seanime/config.toml + # Note: If you are planning on using this for local media, you will not be able to use an external player # as we have set up a password for seanime. -# --------------------------------------------------------- - -SEANIME_HOSTNAME= - diff --git a/apps/searxng/.env b/apps/searxng/.env deleted file mode 100644 index c8e5536..0000000 --- a/apps/searxng/.env +++ /dev/null @@ -1 +0,0 @@ -SEARXNG_HOSTNAME= diff --git a/apps/sonarr/.env b/apps/sonarr/.env deleted file mode 100644 index d4aa105..0000000 --- a/apps/sonarr/.env +++ /dev/null @@ -1,3 +0,0 @@ -SONARR_HOSTNAME= -SONARR4K_HOSTNAME= -SONARRANIME_HOSTNAME= diff --git a/apps/speedtest-tracker/.env b/apps/speedtest-tracker/.env index ffdf9de..57cfd12 100644 --- a/apps/speedtest-tracker/.env +++ b/apps/speedtest-tracker/.env @@ -1,4 +1,3 @@ -SPEEDTEST_TRACKER_HOSTNAME= # Run this command to generate one, include the base64 prefix: # echo -n 'base64:'; openssl rand -base64 32; APP_KEY="" \ No newline at end of file diff --git a/apps/stremio-catalog-providers/.env b/apps/stremio-catalog-providers/.env index 3cd0465..c90949a 100644 --- a/apps/stremio-catalog-providers/.env +++ b/apps/stremio-catalog-providers/.env @@ -1,5 +1,3 @@ -STREMIO_CATALOG_PROVIDERS_HOSTNAME= - # We need to obtain a Trakt Client ID and secret in order for the addons to work. # To obtain these credentials: # 1. Create an account/Log in on Trakt.tv/ (https://trakt.tv). diff --git a/apps/stremio-jackett/.env b/apps/stremio-jackett/.env deleted file mode 100644 index 55c39c4..0000000 --- a/apps/stremio-jackett/.env +++ /dev/null @@ -1 +0,0 @@ -STREMIO_JACKETT_HOSTNAME= diff --git a/apps/stremio-server/.env b/apps/stremio-server/.env deleted file mode 100644 index c84ae97..0000000 --- a/apps/stremio-server/.env +++ /dev/null @@ -1 +0,0 @@ -STREMIO_SERVER_HOSTNAME= diff --git a/apps/stremio-trakt-addon/.env b/apps/stremio-trakt-addon/.env index df2a702..32aafea 100644 --- a/apps/stremio-trakt-addon/.env +++ b/apps/stremio-trakt-addon/.env @@ -1,6 +1,3 @@ -STREMIO_TRAKT_ADDON_HOSTNAME= - - # We need to obtain a Trakt Client ID and secret in order for the addons to work. # To obtain these credentials: # 1. Create an account/Log in on Trakt.tv/ (https://trakt.tv). diff --git a/apps/stremthru/.env b/apps/stremthru/.env deleted file mode 100644 index 65a0026..0000000 --- a/apps/stremthru/.env +++ /dev/null @@ -1 +0,0 @@ -STREMTHRU_HOSTNAME= diff --git a/apps/tautulli/.env b/apps/tautulli/.env deleted file mode 100644 index 7709aab..0000000 --- a/apps/tautulli/.env +++ /dev/null @@ -1 +0,0 @@ -TAUTULLI_HOSTNAME= diff --git a/apps/tmdb-addon/.env b/apps/tmdb-addon/.env index 53340be..98dcafc 100644 --- a/apps/tmdb-addon/.env +++ b/apps/tmdb-addon/.env @@ -1,4 +1,3 @@ -TMDB_ADDON_HOSTNAME= # Get your API key from https://www.themoviedb.org/settings/api TMDB_API_KEY= # Get your API key from https://fanart.tv/get-an-api-key/ diff --git a/apps/torbox-manager/.env b/apps/torbox-manager/.env deleted file mode 100644 index c2c2f12..0000000 --- a/apps/torbox-manager/.env +++ /dev/null @@ -1 +0,0 @@ -TBM_HOSTNAME= diff --git a/apps/torbox-manager/compose.yaml b/apps/torbox-manager/compose.yaml index 9e4d69f..3ab33d1 100644 --- a/apps/torbox-manager/compose.yaml +++ b/apps/torbox-manager/compose.yaml @@ -49,7 +49,7 @@ services: restart: unless-stopped labels: - "traefik.enable=true" - - "traefik.http.routers.tbm.rule=Host(`${TBM_HOSTNAME?}`)" + - "traefik.http.routers.tbm.rule=Host(`${TORBOX_MANAGER_HOSTNAME?}`)" - "traefik.http.routers.tbm.entrypoints=websecure" - "traefik.http.routers.tbm.tls.certresolver=letsencrypt" - "traefik.http.routers.tbm.middlewares=authelia@docker" diff --git a/apps/traefik/.env b/apps/traefik/.env index 0db115f..f8527ee 100644 --- a/apps/traefik/.env +++ b/apps/traefik/.env @@ -1,5 +1,2 @@ -# Email provided to Let's Encrypt for notifications -LETSENCRYPT_EMAIL= -TRAEFIK_HOSTNAME= # https://www.authelia.com/integration/proxies/traefik/#trusted-proxies TRUSTED_IPS=192.168.1.1 \ No newline at end of file diff --git a/apps/traefik/compose.yaml b/apps/traefik/compose.yaml index 60a876d..3ebdb47 100644 --- a/apps/traefik/compose.yaml +++ b/apps/traefik/compose.yaml @@ -60,3 +60,7 @@ services: depends_on: authelia: condition: service_healthy + profiles: + - traefik + - required + - all diff --git a/apps/uptime-kuma/.env b/apps/uptime-kuma/.env deleted file mode 100644 index 4b7d592..0000000 --- a/apps/uptime-kuma/.env +++ /dev/null @@ -1 +0,0 @@ -UPTIME_KUMA_HOSTNAME= diff --git a/apps/uptime-kuma/compose.yaml b/apps/uptime-kuma/compose.yaml index cb19abd..9fff5f1 100644 --- a/apps/uptime-kuma/compose.yaml +++ b/apps/uptime-kuma/compose.yaml @@ -17,3 +17,6 @@ services: volumes: - ${DOCKER_DATA_DIR}/uptime-kuma:/app/data - /var/run/docker.sock:/var/run/docker.sock + profiles: + - uptime-kuma + - all diff --git a/apps/vaultwarden/.env b/apps/vaultwarden/.env index c5d1414..0618e90 100644 --- a/apps/vaultwarden/.env +++ b/apps/vaultwarden/.env @@ -1,5 +1,4 @@ -VAULTWARDEN_HOSTNAME= VAULTWARDEN_ADMIN_TOKEN= # Whether to allow signups or not. Set to true to allow signups, false to disable signups. # You can set it to false after you have created your account. -VAULTWARDEN_SIGNUPS_ALLOWED=true +VAULTWARDEN_SIGNUPS_ALLOWED=true \ No newline at end of file diff --git a/apps/watchtower/compose.yaml b/apps/watchtower/compose.yaml index 0e5f385..2023dbf 100644 --- a/apps/watchtower/compose.yaml +++ b/apps/watchtower/compose.yaml @@ -30,3 +30,6 @@ services: {{- end -}} volumes: - /var/run/docker.sock:/var/run/docker.sock + profiles: + - watchtower + - all diff --git a/apps/zilean/.env b/apps/zilean/.env deleted file mode 100644 index 342ec85..0000000 --- a/apps/zilean/.env +++ /dev/null @@ -1 +0,0 @@ -ZILEAN_HOSTNAME= \ No newline at end of file diff --git a/apps/zipline/.env b/apps/zipline/.env index 70a72df..060d5c1 100644 --- a/apps/zipline/.env +++ b/apps/zipline/.env @@ -12,7 +12,6 @@ # Most of the configuration for Zipline is done through the web interface. # # Within the server settings -# Set the 'Default domain' under 'Core' to the value you set for ZIPLINE_HOSTNAME +# Set the 'Default domain' under 'Core' to the value you set for ZIPLINE_HOSTNAME in the root .env which is zipline.${DOMAIN} by default # Also enable Return HTTPS URLs -ZIPLINE_HOSTNAME= ZIPLINE_CORE_SECRET= \ No newline at end of file diff --git a/apps/zurg/.env b/apps/zurg/.env index aa144d3..2012986 100644 --- a/apps/zurg/.env +++ b/apps/zurg/.env @@ -16,6 +16,3 @@ ZURG_CONFIG_VERSION=v0.9 # To pull from a private repo, you can run the following command after creating a github token (classic) with the read:packages scope: # echo "${GITHUB_TOKEN}" | docker login ghcr.io -u "${GITHUB_USERNAME}" --password-stdin && docker pull ghcr.io/debridmediamanager/zurg:${ZURG_VERSION} # (replace ${GITHUB_TOKEN} and ${GITHUB_USERNAME} with your github token and username respectively, and ${ZURG_VERSION} with the version you want to pull) - - -ZURG_HOSTNAME= diff --git a/data/authelia/config/configuration.yml b/data/authelia/config/configuration.yml index c691c2e..6f5cd8f 100644 --- a/data/authelia/config/configuration.yml +++ b/data/authelia/config/configuration.yml @@ -720,18 +720,18 @@ access_control: default_policy: 'deny' rules: - ## Rules for stremio addon subdomains - ## Protect certain pages (e.g /configure) only - ## but leave api routes unprotected so apps can use them. - - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_SUBDOMAINS" }}).{{ env "TEMPLATE_DOMAIN" }}$' + ## Apply page specific protection to stremio addons after escaping dots and replacing commans with pipes in the + ## comma separated list of hostnames defined in the environment variable TEMPLATE_STREMIO_ADDON_HOSTNAMES. + ## This ensures that addons are still usable while protecting important pages. + - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_HOSTNAMES" | replace "," "|" | replace "." "\\." }})$' resources: - '.*?/configure($|/.*$|\?.*$)' # rule for prtecting any resource that has the component somewhere in the path - '.*?/(stremio|sidekick|admin|watch)($|\?.*$)' # rule for protecting any resource that ends with the component. - '^/$' # rule for protecting the root path policy: 'two_factor' - - - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_SUBDOMAINS" }}).{{ env "TEMPLATE_DOMAIN" }}$' + ## ensure other resources for stremio addons bypass authentication + - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_HOSTNAMES" | replace "," "|" | replace "." "\\." }})$' policy: 'bypass' - domain: '*.{{ env "TEMPLATE_DOMAIN" }}'