Merge remote-tracking branch 'origin/feat/wireguard-vpn' into HEAD

You can really get stuck if the flake need the service that is down because the flake is badly configured because you cannot change it because the flake wont build because................

ai/Dockerfile

@@ -0,0 +1,71 @@
+FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source
+FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source
+FROM debian:13.4
+
+# Disable Python stdout buffering to ensure logs are printed immediately
+ENV PYTHONUNBUFFERED=1
+
+# Store Playwright browsers outside the volume mount so the build-time
+# install survives the /opt/data volume overlay at runtime.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
+
+# Install system dependencies in one layer, clear APT cache
+# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
+# that would otherwise accumulate when hermes runs as PID 1. See #15012.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        curl poppler-utils imagemagick \
+        chromium xvfb fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \
+        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
+        qemu-user-static binfmt-support qemu-user-binfmt \
+        emacs-nox \
+        libportaudio2 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
+RUN useradd -u 10000 -m -d /opt/data hermes
+
+COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
+COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
+
+WORKDIR /opt/hermes
+
+# ---------- Layer-cached dependency install ----------
+# Copy only package manifests first so npm install + Playwright are cached
+# unless the lockfiles themselves change.
+COPY package.json package-lock.json ./
+COPY web/package.json web/package-lock.json web/
+
+RUN npm install --prefer-offline --no-audit && \
+    npx playwright install --with-deps chromium --only-shell && \
+    (cd web && npm install --prefer-offline --no-audit) && \
+    npm cache clean --force
+
+# ---------- Source code ----------
+# .dockerignore excludes node_modules, so the installs above survive.
+COPY --chown=hermes:hermes . .
+
+# Build web dashboard (Vite outputs to hermes_cli/web_dist/)
+RUN cd web && npm run build
+
+# ---------- Permissions ----------
+# Make install dir world-readable so any HERMES_UID can read it at runtime.
+# The venv needs to be traversable too.
+USER root
+RUN chmod -R a+rX /opt/hermes
+# Start as root so the entrypoint can usermod/groupmod + gosu.
+# If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000).
+
+# ---------- Python virtualenv ----------
+RUN uv venv && \
+    uv pip install --no-cache-dir -e ".[all]" && \
+    uv pip install --no-cache-dir sounddevice numpy faster-whisper
+
+# ---------- Runtime ----------
+ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist
+ENV HERMES_HOME=/opt/data
+ENV PATH="/opt/data/.local/bin:${PATH}"
+VOLUME [ "/opt/data" ]
+ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]

ai/compose.yml

@@ -0,0 +1,293 @@
+version: "3.8"
+services:
+
+  # webui:
+  #   image: ghcr.io/open-webui/open-webui:main
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #   restart: always
+  #   environment:
+  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.entrypoints=web"
+  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
+  #     - "traefik.http.routers.webui-https.tls=true"
+  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+
+  hermes:
+    build: ./
+    container_name: hermes
+    restart: always
+    # Gateway run enables the internal API server on port 8642
+    command: gateway run
+    environment:
+      - OLLAMA_HOST=http://ollama:11434
+      - API_SERVER_ENABLED=true
+      - API_SERVER_PORT=8642
+      - API_SERVER_HOST=0.0.0.0
+      - API_SERVER_KEY=hermes_local_key
+      - GATEWAY_ALLOW_ALL_USERS=true
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+    volumes:
+      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    devices:
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+    networks:
+      - ai_backend
+
+  ollama:
+    image: ollama/ollama:latest
+    container_name: ollama
+    privileged: true
+    tty: true
+    restart: always 
+    ports:
+      - "127.0.0.1:11434:11434"
+    networks:
+      - ai_backend
+    volumes:
+      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+    environment:
+      - OLLAMA_VULKAN=0
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0 
+      - OLLAMA_HOST=0.0.0.0
+      - OLLAMA_DEBUG=1
+      - OLLAMA_FLASH_ATTENTION=0
+      - OLLAMA_NUM_PARALLEL=2
+    devices:
+      # Map the render nodes and KFD for ROCm to work inside the container
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
+
+networks:
+  ai_net:
+    external: true
+    name: ai_net
+  ai_backend:
+    driver: bridge
+    name: ai_backend
+    
+  # llama_cpp_devstral:
+  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
+  #   container_name: llama_cpp_devstral
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   ports:
+  #     - "8300:8080"
+  #   ipc: host
+  #   devices:
+  #     - "/dev/kfd:/dev/kfd"
+  #     - "/dev/dri:/dev/dri"
+  #   group_add:
+  #     - "303" # video
+  #     - "26"  # render
+  #   environment:
+  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+  #     HIP_VISIBLE_DEVICES: 0,1
+  #     LLAMA_CACHE: /models
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
+  #   command: >
+  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
+  #     -a devstral-2-small-llama_cpp
+  #     --chat-template-file /template.jinja
+  #     --host 0.0.0.0
+  #     --port 8080
+  #     --n-gpu-layers 99
+  #     --ctx-size 163840
+  #     --batch-size 4096
+  #     --ubatch-size 4096
+  #     --cache-type-k f16
+  #     --cache-type-v f16
+  #     --cache-reuse 256
+  #     --flash-attn on
+  #     --context-shift
+  #     --split-mode layer
+  #     --no-mmap
+  #     --n-predict -1
+  #     --parallel 2
+
+  # vllm:
+  #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
+  #   container_name: vllm
+  #   # Required for multi-GPU communication (NCCL)
+  #   ipc: host 
+  #   init: true
+  #   shm_size: '2g' 
+  #   networks:
+  #     - ai_backend
+  #   ports:
+  #     - "8300:8000"
+  #   devices:
+  #     - "/dev/kfd:/dev/kfd"
+  #     - "/dev/dri:/dev/dri"
+  #   group_add:
+  #     - "303"
+  #     - "26"
+  #   environment:
+  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+  #     HSA_ENABLE_SDMA: 0
+  #     HIP_VISIBLE_DEVICES: 0,1
+  #     NCCL_P2P_DISABLE: 1
+  #     VLLM_WORKER_MULTIPROC_METHOD: spawn
+  #     VLLM_USE_TRITON_FLASH_ATTN: 0
+  #     VLLM_USE_ROCM_CUSTOM_PAGED_ATTN: 0
+  #     VLLM_ATTENTION_BACKEND: ROPE_NAIVE
+  #     VLLM_SKIP_WARMUP: 1
+  #     VLLM_USE_V1: 0
+  #     HF_TOKEN: ${HF_TOKEN}
+  #   command: >
+  #     vllm serve "mistralai/Devstral-Small-2-24B-Instruct-2512" 
+  #     --tensor-parallel-size 2
+  #     --max-model-len 8192
+  #     --gpu-memory-utilization 0.90
+  #     --tokenizer_mode mistral
+  #     --config_format auto
+  #     --load-format auto
+  #     --enforce-eager
+  #     --disable-custom-all-reduce
+  #     --trust-remote-code
+  #     --task generate
+  #     --block-size 16
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
+  #   restart: unless-stopped
+
+  # n8n:
+  #   image: n8nio/n8n:latest
+  #   container_name: n8n
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_net
+  #   environment:
+  #     - N8N_HOST=n8n.lazyworkhorse.net
+  #     - N8N_PORT=5678
+  #     - N8N_PROTOCOL=https
+  #     - NODE_ENV=production
+  #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
+  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
+  #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
+  #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
+  #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
+  #     - N8N_NATIVE_PYTHON_RUNNER=true
+  #     - N8N_PYTHON_ALLOW_STDLIB=uuid,re,os,json
+  #     - N8N_PYTHON_ALLOW_EXTERNAL=requests,pandas
+  #     - NODE_FUNCTION_ALLOW_EXTERNAL=uuid,requests
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/n8n:/home/node/.n8n
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-http.entrypoints=web"
+  #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
+  #     - "traefik.http.routers.n8n-https.tls=true"
+  #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
+
+  #     # Service Loadbalancer (n8n default port)
+  #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+  # openclaw:
+  #   image: coollabsio/openclaw:latest
+  #   container_name: openclaw
+  #   restart: unless-stopped
+  #   expose:
+  #     - "8080"  # WebUI
+  #     - "18789" # Gateway/WebSocket
+  #     - "8788"  # Nextcloud Webhook
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
+  #     - /home/gortium/infra:/data/workspace/infra
+  #   environment:
+  #     - TZ=America/Toronto
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
+  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     # Point to the sidecar browser
+  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
+  #     - BROWSER_EVALUATE_ENABLED=true
+  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
+  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
+
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-https.priority=50"
+  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
+  #     - "traefik.http.routers.openclaw-https.tls=true"
+  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
+  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #   depends_on:
+  #     - openclaw-browser
+
+  # openclaw-browser:
+  #   image: ghcr.io/browserless/chromium:latest
+  #   restart: always
+  #   expose:
+  #     - "3000"
+  #   environment:
+  #     - MAX_CONCURRENT_SESSIONS=10
+  #     - CONNECTION_TIMEOUT=300000
+  #     - PREBOOT_CHROME=true
+  #     - DEMO_MODE=false
+  #   networks:
+  #     ai_backend:
+  #       aliases:
+  #         - browser
+
+  # openclaw-ssh:
+  #   image: linuxserver/openssh-server:latest
+  #   container_name: openclaw-ssh
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
+  #     - SUDO_ACCESS=false
+  #     - PASSWORD_ACCESS=false
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
+  #     - /home/gortium/infra:/data/workspace/infra:ro
+  #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
+  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
+  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
+  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"

authentification/compose.yml

@@ -0,0 +1,36 @@
+version: "3.8"
+
+services:
+  authelia:
+    image: authelia/authelia:latest
+    container_name: authelia
+    volumes:
+      - /mnt/HoardingCow_docker_data/Authelia:/config
+    networks:
+      - auth_net
+    restart: always 
+    labels:
+      - "traefik.enable=true"
+
+      # HTTP router
+      - "traefik.http.routers.authelia-http.rule=Host(`auth.lazyworkhorse.net`)"
+      - "traefik.http.routers.authelia-http.entrypoints=web"
+      - "traefik.http.routers.authelia-http.middlewares=redirect-to-https"
+
+      # HTTPS router
+      - "traefik.http.routers.authelia-https.rule=Host(`auth.lazyworkhorse.net`)"
+      - "traefik.http.routers.authelia-https.entrypoints=websecure"
+      - "traefik.http.routers.authelia-https.tls=true"
+      - "traefik.http.routers.authelia-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.authelia.loadbalancer.server.port=9091"
+
+      # forward auth middleware definition
+      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net"
+      - "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
+
+networks:
+  auth_net:
+    external: true
+    name: auth_net

backup/compose.yml

@@ -0,0 +1,100 @@
+version: "3.8"
+
+services:
+  # kopia:
+  #   image: kopia/kopia:latest
+  #   container_name: kopia
+  #   restart: unless-stopped
+  #   # We explicitly run as root (0:0) to solve the CHDIR issue, 
+  #   # OR we make sure the host folders match UID 1000.
+  #   user: "0:0" 
+  #   command:
+  #     - server
+  #     - start
+  #     - --address=0.0.0.0:51515
+  #     - --server-username=${KOPIA_SERVER_USER}
+  #     - --server-password=${KOPIA_SERVER_PASSWORD}
+  #     - --config-file=/app/config/repository.config
+  #     - --disable-csrf-token-checks
+  #     - --insecure
+  #   environment:
+  #     - TZ=America/Montreal
+  #     - KOPIA_PASSWORD=${KOPIA_PASSWORD}
+  #     - USER=${KOPIA_USER}
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Kopia/config:/app/config
+  #     - /mnt/HoardingCow_docker_data/Kopia/cache:/app/cache
+  #     - /mnt/HoardingCow_docker_data/Kopia/repository:/repository
+  #     # Required if you want to use the 'Mount' feature later
+  #     - /tmp:/tmp:shared
+  #     # Required for mounting backups as drives
+  #   cap_add:
+  #     - SYS_ADMIN
+  #   devices:
+  #     - /dev/fuse:/dev/fuse
+  #   networks:
+  #     - traefik-net
+  #   labels:
+  #     - "traefik.enable=true"
+  #     # 1. HTTP to HTTPS Redirect
+  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia-http.entrypoints=web"
+  #     - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
+  #     
+  #     # 2. HTTPS Configuration
+  #     - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia.entrypoints=websecure"
+  #     - "traefik.http.routers.kopia.tls=true"
+  #     - "traefik.http.routers.kopia.tls.certresolver=njalla"
+  #     
+  #     # 3. Backend Service Config
+  #     - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+
+  restic-server:
+    image: restic/restic:latest
+    container_name: restic-server
+    restart: always 
+    user: "0:0"
+    command: ["server", "--listen", ":8080", "--repo", "/data", "--tls-cert", "", "--tls-key", ""]
+    environment:
+      - TZ=America/Montreal
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
+    volumes:
+      - /mnt/HoardingCow_docker_data/Restic/data:/data
+      # Mount paths to backup (adjust as needed)
+      - /mnt/HoardingCow_docker_data:/source:ro
+    networks:
+      - backup_net
+    labels:
+      - "traefik.enable=false" # Internal only, accessed by restic-browser
+
+  restic-browser:
+    image: embergarage/restic-browser:latest
+    container_name: restic-browser
+    restart: always 
+    environment:
+      - TZ=America/Montreal
+      - RESTIC_REPOSITORY=http://restic-server:8080
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
+    networks:
+      - backup_net
+    labels:
+      - "traefik.enable=true"
+      # 1. HTTP to HTTPS Redirect
+      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
+      - "traefik.http.routers.restic-browser-http.entrypoints=web"
+      - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
+      
+      # 2. HTTPS Configuration
+      - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
+      - "traefik.http.routers.restic-browser.entrypoints=websecure"
+      - "traefik.http.routers.restic-browser.tls=true"
+      - "traefik.http.routers.restic-browser.tls.certresolver=njalla"
+      
+      # 3. Backend Service Config
+      - "traefik.http.services.restic-browser.loadbalancer.server.port=8000"
+
+networks:
+  backup_net:
+    external: true
+    name: backup_net

cloudstorage/compose.yml

@@ -0,0 +1,82 @@
+version: "3.9"
+services:
+  nextcloud:
+    image: nextcloud:latest
+    container_name: nextcloud
+    restart: always
+    networks:
+      - cloud_net
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=America/Toronto
+      # Database connection
+      - MYSQL_HOST=nextcloud_mariadb
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
+      # Reverse Proxy Overrides (Crucial for HTTPS behind Traefik)
+      - OVERWRITEPROTOCOL=https
+      - OVERWRITECLIURL=https://cloud.lazyworkhorse.net
+      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.lazyworkhorse.net
+    volumes:
+      - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
+    depends_on:
+      - nextcloud_mariadb
+    labels:
+      - "traefik.enable=true"
+
+      # Router for HTTP -> HTTPS Redirection (Matching your Gitea style)
+      - "traefik.http.routers.nextcloud-http.rule=Host(`cloud.lazyworkhorse.net`)"
+      - "traefik.http.routers.nextcloud-http.entrypoints=web"
+      - "traefik.http.routers.nextcloud-http.middlewares=redirect-to-https"
+
+      # Router for HTTPS
+      - "traefik.http.routers.nextcloud-https.rule=Host(`cloud.lazyworkhorse.net`)"
+      - "traefik.http.routers.nextcloud-https.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud-https.tls=true"
+      - "traefik.http.routers.nextcloud-https.tls.certresolver=njalla"
+
+      # Middlewares: Redirection + Nextcloud DAV fixes
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      - "traefik.http.middlewares.nextcloud-dav.redirectregex.permanent=true"
+      - "traefik.http.middlewares.nextcloud-dav.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
+      - "traefik.http.middlewares.nextcloud-dav.redirectregex.replacement=https://$$1/remote.php/dav/"
+      
+      # Apply both redirection and DAV fixes
+      - "traefik.http.routers.nextcloud-https.middlewares=nextcloud-dav"
+
+  nextcloud_cron:
+    image: nextcloud:latest
+    container_name: nextcloud_cron
+    restart: always 
+    networks:
+      - cloud_net
+    entrypoint: /cron.sh
+    volumes:
+      - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
+    depends_on:
+      - nextcloud
+
+  nextcloud_mariadb:
+    image: mariadb:latest
+    container_name: nextcloud_mariadb
+    restart: unless-stopped
+    networks:
+      - cloud_internal
+    environment:
+      - MYSQL_RANDOM_ROOT_PASSWORD=yes
+      - MYSQL_USER=nextcloud
+      - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
+      - MYSQL_DATABASE=nextcloud
+    volumes:
+      - /mnt/HoardingCow_docker_data/NextCloud/database:/var/lib/mysql:rw
+    # command: ["--innodb-force-recovery=6"]
+
+networks:
+  cloud_net:
+    external: true
+    name: cloud_net
+  cloud_internal:
+    driver: bridge
+    name: cloud_internal

coms/compose.yml

@@ -0,0 +1,110 @@
+version: "3.9"
+services:
+  # nomadnet:
+  #   image: ghcr.io/markqvist/nomadnet:master
+  #   container_name: nomadnet
+  #   restart: always
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
+  #     - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
+  #   # Reticulum transport must be reachable directly (NOT through Traefik)
+  #   ports:
+  #     - "4242:4242"
+
+  synapse:
+    image: ghcr.io/element-hq/synapse:latest
+    container_name: synapse
+    restart: always
+    volumes:
+      - /mnt/HoardingCow_docker_data/Matrix/data:/data
+    networks:
+      - coms_net
+      - coms_backend
+    depends_on:
+      synapse-db:
+        condition: service_healthy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.matrix-http.rule=Host(`matrix.lazyworkhorse.net`)"
+      - "traefik.http.routers.matrix-http.entrypoints=web"
+      - "traefik.http.routers.matrix-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.matrix-https.rule=Host(`matrix.lazyworkhorse.net`)"
+      - "traefik.http.routers.matrix-https.entrypoints=websecure"
+      - "traefik.http.routers.matrix-https.tls=true"
+      - "traefik.http.routers.matrix-https.tls.certresolver=njalla"
+      - "traefik.http.services.matrix-https.loadbalancer.server.port=8008"
+      - "traefik.docker.network=coms_net"
+
+  synapse-db:
+    image: postgres:17-alpine
+    container_name: synapse-db
+    restart: always
+    environment:
+      - POSTGRES_USER=synapse
+      - POSTGRES_PASSWORD=${SYNAPSE_DB_PASSWORD}
+      - POSTGRES_DB=synapse
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - /mnt/HoardingCow_docker_data/Matrix/db:/var/lib/postgresql/data
+    networks:
+      - coms_backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      
+  synapse-admin:
+    image: awesometechnologies/synapse-admin:latest
+    container_name: synapse-admin
+    restart: always
+    networks:
+      - coms_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.lazyworkhorse.net`)"
+      - "traefik.http.routers.synapse-admin-http.entrypoints=web"
+      - "traefik.http.routers.synapse-admin-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.lazyworkhorse.net`)"
+      - "traefik.http.routers.synapse-admin-https.entrypoints=websecure"
+      - "traefik.http.routers.synapse-admin-https.tls=true"
+      - "traefik.http.routers.synapse-admin-https.tls.certresolver=njalla"
+      - "traefik.http.services.synapse-admin.loadbalancer.server.port=80"
+
+  # rbrowser:
+  #   build: 
+  #     context: https://github.com/fr33n0w/rBrowser.git#main
+  #   container_name: rbrowser
+  #   restart: unless-stopped
+  #   user: "1000:1000"
+  #   depends_on:
+  #     - nomadnet
+  #   volumes:
+  #     # share Reticulum identity + network state
+  #     - /mnt/HoardingCow_docker_data/Reticulum:/home/appuser/.reticulum
+  #   networks:
+  #     - traefik-net
+  #   labels:
+  #     - "traefik.enable=true"
+  #
+  #     # HTTP → HTTPS
+  #     - "traefik.http.routers.rns-http.rule=Host(`nomad.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.rns-http.entrypoints=web"
+  #     - "traefik.http.routers.rns-http.middlewares=redirect-to-https"
+  #
+  #     # HTTPS protected by Authelia
+  #     - "traefik.http.routers.rns-https.rule=Host(`nomad.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.rns-https.entrypoints=websecure"
+  #     - "traefik.http.routers.rns-https.tls=true"
+  #     - "traefik.http.routers.rns-https.tls.certresolver=njalla"
+  #     - "traefik.http.routers.rns-https.middlewares=authelia-auth"
+  #
+  #     - "traefik.http.services.rns.loadbalancer.server.port=5000"
+
+networks:
+  coms_net:
+    external: true
+    name: coms_net
+  coms_backend:
+    driver: bridge
+    name: coms_backend

finance/compose.yml

@@ -0,0 +1,40 @@
+version: "3.9"
+
+services:
+  fava:
+    image: yegle/fava
+    container_name: fava
+    environment:
+      - BEANCOUNT_FILE=/data/beancount_finance_vault/ledger/main/tpouplier.beancount
+    volumes:
+      - /mnt/HoardingCow_docker_data/Fava:/data
+    networks:
+      - finance_net
+    restart: always
+    labels:
+      - "traefik.enable=true"
+
+      # HTTP → HTTPS redirect
+      - "traefik.http.routers.fava-http.rule=Host(`money.lazyworkhorse.net`)"
+      - "traefik.http.routers.fava-http.entrypoints=web"
+      - "traefik.http.routers.fava-http.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
+      # HTTPS router protected by Authelia
+      - "traefik.http.routers.fava-https.rule=Host(`money.lazyworkhorse.net`)"
+      - "traefik.http.routers.fava-https.entrypoints=websecure"
+      - "traefik.http.routers.fava-https.tls=true"
+      - "traefik.http.routers.fava-https.tls.certresolver=njalla"
+      - "traefik.http.routers.fava-https.middlewares=fava-auth"
+
+      # Authelia forwardAuth
+      - "traefik.http.middlewares.fava-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
+      - "traefik.http.middlewares.fava-auth.forwardauth.trustforwardheader=true"
+      - "traefik.http.middlewares.fava-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
+
+      # Internal port
+      - "traefik.http.services.fava.loadbalancer.server.port=5000"
+
+networks:
+  finance_net:
+    external: true

homeautomation/compose.yml

@@ -0,0 +1,95 @@
+services:
+
+  homeassistant:
+    image: ghcr.io/home-assistant/home-assistant:stable
+    container_name: homeassistant
+    restart: always
+    privileged: true
+    # Was needed for someting.. but dont remember. Deactivated for now.
+    # network_mode: host  # Discovery (mDNS/Bluetooth) requires this
+    environment:
+      - TZ=America/Toronto
+    volumes:
+      - /mnt/HoardingCow_docker_data/Home_Assistant:/config:rw
+    networks:
+      - home_auto_net
+      - home_auto_backend
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.hass-http.rule=Host(`home.lazyworkhorse.net`)"
+      - "traefik.http.routers.hass-http.entrypoints=web"
+      - "traefik.http.routers.hass-http.middlewares=redirect-to-https"
+
+      - "traefik.http.routers.hass-https.rule=Host(`home.lazyworkhorse.net`)"
+      - "traefik.http.routers.hass-https.entrypoints=websecure"
+      - "traefik.http.routers.hass-https.tls.certresolver=njalla"
+
+      - "traefik.http.services.hass.loadbalancer.server.port=8123"
+      - "traefik.http.services.hass.loadbalancer.server.scheme=http"
+      # Trusted proxy defined in configuration.yml
+
+  mosquitto:
+    image: eclipse-mosquitto
+    volumes:
+      - /mnt/HoardingCow_docker_data/Mosquitto:/mosquitto
+    networks:
+      - home_auto_backend
+    # ports:
+    #   - 1883:1883
+    #   - 9001:9001
+
+  hydroqc2mqtt:
+    image: registry.gitlab.com/hydroqc/hydroqc2mqtt:1.3.0
+    restart: always
+    networks:
+      - home_auto_backend
+    environment:
+      MQTT_USERNAME: hass
+      MQTT_PASSWORD: ${MQTT_PASSWORD}
+      MQTT_HOST: 192.168.1.3
+      MQTT_PORT: 1883
+      HQ2M_CONTRACTS_0_NAME: maison
+      HQ2M_CONTRACTS_0_USERNAME: thierrypouplier@gmail.com
+      HQ2M_CONTRACTS_0_PASSWORD: ${HQ2M_CONTRACTS_0_PASSWORD}
+      HQ2M_CONTRACTS_0_CUSTOMER: ${HQ2M_CONTRACTS_0_CUSTOMER}
+      HQ2M_CONTRACTS_0_ACCOUNT: ${HQ2M_CONTRACTS_0_ACCOUNT}
+      HQ2M_CONTRACTS_0_CONTRACT: ${HQ2M_CONTRACTS_0_CONTRACT} 
+      HQ2M_CONTRACTS_0_RATE: 'D'
+      HQ2M_CONTRACTS_0_RATE_OPTION: 'NONE'
+      HQ2M_CONTRACTS_0_SYNC_HOURLY_CONSUMPTION_ENABLED: "true"
+      HQ2M_CONTRACTS_0_HOME_ASSISTANT_WEBSOCKET_URL: http://homeassistant:8123/api/websocket
+      HQ2M_CONTRACTS_0_HOME_ASSISTANT_TOKEN: ${HQ2M_CONTRACTS_0_HOME_ASSISTANT_TOKEN}
+
+  # grocy:
+  #   entrypoint:
+  #     - /init
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - TZ=America/Toronto
+  #   image: lscr.io/linuxserver/grocy
+  #   ports:
+  #     - 9283:80/tcp
+  #   restart: unless-stopped
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Grocy/config:/config:rw
+
+  # node-red:
+  #   image: nodered/node-red:latest
+  #   environment:
+  #     - NODE_RED_UID=1000
+  #     - NODE_RED_GID=1000
+  #     - TZ=UTC
+  #   ports:
+  #     - "1880:1880"
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Node-Red/data:/data
+  #   restart: unless-stopped
+
+networks:
+  home_auto_net:
+    external: true
+  home_auto_backend:
+    driver: bridge
+    name: home_auto_backend

homepage/compose.yml

@@ -0,0 +1,41 @@
+services:
+  homer:
+    image: b4bz/homer
+    container_name: homer
+    environment:
+      - UID=1000
+      - GID=1000
+      - TZ=America/Toronto
+      - PORT=8080
+    volumes:
+      - /mnt/HoardingCow_docker_data/Homer/assets:/www/assets:rw
+    restart: always
+    networks:
+      - homepage_net
+    labels:
+      - "traefik.enable=true"
+
+      # HTTP → HTTPS redirect
+      - "traefik.http.routers.homer-http.rule=Host(`lazyworkhorse.net`)"
+      - "traefik.http.routers.homer-http.entrypoints=web"
+      - "traefik.http.routers.homer-http.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
+      # HTTPS router protected by Authelia
+      - "traefik.http.routers.homer-https.rule=Host(`lazyworkhorse.net`)"
+      - "traefik.http.routers.homer-https.entrypoints=websecure"
+      - "traefik.http.routers.homer-https.tls=true"
+      - "traefik.http.routers.homer-https.tls.certresolver=njalla"
+      - "traefik.http.routers.homer-https.middlewares=homer-auth"
+
+      # Authelia forwardAuth
+      - "traefik.http.middlewares.homer-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
+      - "traefik.http.middlewares.homer-auth.forwardauth.trustforwardheader=true"
+      - "traefik.http.middlewares.homer-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
+
+      # Internal port
+      - "traefik.http.services.homer.loadbalancer.server.port=8080"
+
+networks:
+  homepage_net:
+    external: true

network/compose.yml

@@ -7,6 +7,7 @@ services:
     command:
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.sshnode.address=:2425"
 
       - "--certificatesresolvers.njalla.acme.email=thierrypouplier@gmail.com"
       - "--certificatesresolvers.njalla.acme.storage=/letsencrypt/acme.json"
@@ -25,13 +26,24 @@ services:
       - /mnt/HoardingCow_docker_data/Traefik:/letsencrypt
     restart: unless-stopped
     networks:
-      - traefik-net
+      - traefik_backend
+      - ai_net
+      - auth_net
+      - backup_net
+      - cloud_net
+      - coms_net
+      - finance_net
+      - home_auto_net
+      - homepage_net
+      - passman_net
+      - tak_net
+      - vc_net
 
   ddns-updater:
     image: qmcgaw/ddns-updater
     container_name: ddns-updater
     networks:
-      - traefik-net
+      - traefik_backend
     ports:
       - 8000:8000/tcp
     volumes:
@@ -63,9 +75,42 @@ services:
     restart: unless-stopped
 
 networks:
-  traefik-net:
+  traefik_backend:
     driver: bridge
-    name: traefik-net
+    name: traefik_backend
+  ai_net:
+    external: true
+    name: ai_net
+  auth_net:
+    external: true
+    name: auth_net
+  backup_net:
+    external: true
+    name: backup_net
+  cloud_net:
+    external: true
+    name: cloud_net
+  coms_net:
+    external: true
+    name: coms_net
+  finance_net:
+    external: true
+    name: finance_net
+  home_auto_net:
+    external: true
+    name: home_auto_net
+  homepage_net:
+    external: true
+    name: homepage_net
+  passman_net:
+    external: true
+    name: passman_net
+  tak_net:
+    external: true
+    name: tak_net
+  vc_net:
+    external: true
+    name: vc_net
 
   # duckdns:
   #   environment:
@@ -73,7 +118,7 @@ networks:
   #     - PGID=1000
   #     - TZ=America/Toronto
   #     - SUBDOMAINS=aziworkhorse
-  #     - TOKEN=$[DUCKDNS_TOKEN]
+  #     - TOKEN=${DUCKDNS_TOKEN}
   #   image: lscr.io/linuxserver/duckdns
   #   labels:
   #     - "traefik.enable=false"

passwordmanager/compose.yml

@@ -13,32 +13,24 @@ services:
     volumes:
       - /mnt/HoardingCow_docker_data/BitWarden/data:/data:rw
     networks:
-      - traefik-net
+      - passman_net
-    restart: unless-stopped
+    restart: always
     labels:
       - "traefik.enable=true"
 
-      # Router for HTTP + redirection to HTTPS
+      # HTTP → HTTPS
-      - "traefik.http.routers.bitwarden-http.rule=Host(`pass.lazyworkhorse.net`)"
+      - "traefik.http.routers.pass-http.rule=Host(`pass.lazyworkhorse.net`)"
-      - "traefik.http.routers.bitwarden-http.entrypoints=web"
+      - "traefik.http.routers.pass-http.entrypoints=web"
-      - "traefik.http.routers.bitwarden-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.pass-http.middlewares=redirect-to-https"
 
-      # Router for HTTPS with TLS
+      # HTTPS
-      - "traefik.http.routers.bitwarden-https.rule=Host(`pass.lazyworkhorse.net`)"
+      - "traefik.http.routers.pass-https.rule=Host(`pass.lazyworkhorse.net`)"
-      - "traefik.http.routers.bitwarden-https.entrypoints=websecure"
+      - "traefik.http.routers.pass-https.entrypoints=websecure"
-      - "traefik.http.routers.bitwarden-https.tls=true"
+      - "traefik.http.routers.pass-https.tls=true"
-      - "traefik.http.routers.bitwarden-https.tls.certresolver=njalla"
+      - "traefik.http.routers.pass-https.tls.certresolver=njalla"
-
-      # Wildcard
-      # - "traefik.http.routers.bitwarden-https.tls.domains[0].main=lazyworkhorse.net"
-      # - "traefik.http.routers.bitwarden-https.tls.domains[0].sans=*.lazyworkhorse.net"
-
-      # Middleware for redirect HTTP -> HTTPS
-      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
-
-      # Websocket support (port 80 du container)
-      - "traefik.http.services.bitwarden.loadbalancer.server.port=80"
 
+      # Internal service
+      - "traefik.http.services.pass.loadbalancer.server.port=80"
 networks:
-  traefik-net:
+  passman_net:
     external: true

tak/compose.yml

@@ -0,0 +1,98 @@
+services:
+  freetakserver:
+    image: ghcr.io/freetakteam/freetakserver:master
+    container_name: freetakserver
+    hostname: freetakserver
+    restart: always
+    networks:
+      - tak_backend
+    volumes:
+      - /mnt/HoardingCow_docker_data/TAK/fts_data:/opt/fts:z,rw
+    ports:
+      - 8087:8087
+      - 8089:8089
+      - 8443:8443
+      - 9000:9000
+      - 19023:19023
+    environment:
+      FTS_FED_PASSWORD: "${FTS_FED_PASSWORD}"
+      FTS_CLIENT_CERT_PASSWORD: "${FTS_CLIENT_CERT_PASSWORD}"
+      FTS_WEBSOCKET_KEY: "${FTS_WEBSOCKET_KEY}"
+      FTS_SECRET_KEY: "${FTS_SECRET_KEY}"
+      FTS_CONNECTION_MESSAGE: "Welcome to FreeTAKServer. The Parrot is not dead. It's just resting"
+      FTS_COT_PORT: 8087
+      FTS_SSLCOT_PORT: 8089
+      FTS_API_PORT: 19023
+      FTS_FED_PORT: 9000
+      FTS_DP_ADDRESS: 'freetakserver'
+      FTS_USER_ADDRESS: 'freetakserver'
+      FTS_API_ADDRESS: 'freetakserver'
+      FTS_ROUTING_PROXY_SUBSCRIBE_PORT: 19030
+      FTS_ROUTING_PROXY_SUBSCRIBE_IP: 'freetakserver'
+      FTS_ROUTING_PROXY_PUBLISHER_PORT: 19032
+      FTS_ROUTING_PROXY_PUBLISHER_IP: 'freetakserver'
+      FTS_ROUTING_PROXY_SERVER_PORT: 19031
+      FTS_ROUTING_PROXY_SERVER_IP: 'freetakserver'
+      FTS_INTEGRATION_MANAGER_PULLER_PORT: 19033
+      FTS_INTEGRATION_MANAGER_PULLER_ADDRESS: 'freetakserver'
+      FTS_INTEGRATION_MANAGER_PUBLISHER_PORT: 19034
+      FTS_INTEGRATION_MANAGER_PUBLISHER_ADDRESS: 'freetakserver'
+      FTS_OPTIMIZE_API: "True"
+      FTS_DATA_RECEPTION_BUFFER: 1024
+      FTS_MAX_RECEPTION_TIME: 4
+      FTS_NUM_ROUTING_WORKERS: 3
+      FTS_COT_TO_DB: "True"
+      FTS_MAINLOOP_DELAY: 100
+      FTS_EMERGENCY_RADIUS: 0
+      FTS_LOG_LEVEL: "info"
+
+  freetakserver-ui:
+    image: ghcr.io/freetakteam/ui:latest
+    container_name: freetakserver-ui
+    hostname: freetakserver-ui
+    restart: always
+    networks:
+      - tak_net
+    ports:
+      - 5000:5000
+    volumes:
+      - /mnt/HoardingCow_docker_data/TAK/fts_ui_data:/home/freetak/data:z,rw
+    environment:
+      FTS_IP: "freetakserver" 
+      FTS_API_PORT: 19023
+      FTS_API_PROTO: 'http'
+      FTS_UI_EXPOSED_IP: 'freetakserver-ui'
+      FTS_MAP_EXPOSED_IP: '127.0.0.1'
+      FTS_MAP_PORT: 8000
+      FTS_MAP_PROTO: 'http'
+      FTS_UI_PORT: 5000
+      FTS_UI_WSKEY: "${FTS_WEBSOCKET_KEY}"
+      FTS_API_KEY: 'Bearer token'
+      FTS_UI_SQLALCHEMY_DATABASE_URI: 'sqlite:////home/freetak/data/FTSServer-UI.db'
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-net"
+
+      # HTTP -> HTTPS Redirect
+      - "traefik.http.routers.fts-ui-http.rule=Host(`tak.lazyworkhorse.net`)"
+      - "traefik.http.routers.fts-ui-http.entrypoints=web"
+      - "traefik.http.routers.fts-ui-http.middlewares=redirect-to-https"
+
+      # HTTPS Router
+      - "traefik.http.routers.fts-ui-https.rule=Host(`tak.lazyworkhorse.net`)"
+      - "traefik.http.routers.fts-ui-https.entrypoints=websecure"
+      - "traefik.http.routers.fts-ui-https.tls=true"
+      - "traefik.http.routers.fts-ui-https.tls.certresolver=njalla"
+      
+      # Service & Port
+      - "traefik.http.services.fts-ui.loadbalancer.server.port=5000"
+
+      # Reuse your existing redirect middleware
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
+networks:
+  tak_net:
+    external: true
+  tak_backend:
+    driver: bridge
+    name: tak_backend

versioncontrol/compose.yml

@@ -7,34 +7,39 @@ services:
       - USER_UID=1000
       - USER_GID=1000
       - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
+      - SSH_PORT=2222
+      - SSH_LISTEN_PORT=2222
     volumes:
       - /mnt/HoardingCow_docker_data/Gitea:/data
     networks:
-      - traefik-net
+      - vc_net
-    restart: unless-stopped
+    restart: always
+    ports:
+      - "2222:2222"
     labels:
       - "traefik.enable=true"
 
-      # Router for HTTP + redirection to HTTPS
+      # HTTP -> HTTPS Redirect
       - "traefik.http.routers.gitea-http.rule=Host(`code.lazyworkhorse.net`)"
       - "traefik.http.routers.gitea-http.entrypoints=web"
       - "traefik.http.routers.gitea-http.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
-      # Router for HTTPS with TLS
+      # HTTPS Router
       - "traefik.http.routers.gitea-https.rule=Host(`code.lazyworkhorse.net`)"
       - "traefik.http.routers.gitea-https.entrypoints=websecure"
       - "traefik.http.routers.gitea-https.tls=true"
       - "traefik.http.routers.gitea-https.tls.certresolver=njalla"
+      - "traefik.http.routers.gitea-https.middlewares=gitea-home-redirect"
 
-      # Wildcard
+      # The Redirect Logic - Using single quotes to allow backslashes
-      # - "traefik.http.routers.gitea-https.tls.domains[0].main=lazyworkhorse.net"
+      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.regex=^https://code\.lazyworkhorse\.net/?$$'
-      # - "traefik.http.routers.gitea-https.tls.domains[0].sans=*.lazyworkhorse.net"
+      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.replacement=https://code.lazyworkhorse.net/gortium'
-
+      - "traefik.http.middlewares.gitea-home-redirect.redirectregex.permanent=true"
-      # Middleware for redirect HTTP -> HTTPS
-      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
+      # Internal Routing
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
 networks:
-  traefik-net:
+  vc_net:
     external: true

vpn/compose.yml

@@ -0,0 +1,35 @@
+version: "3.8"
+
+services:
+  wireguard:
+    image: weejewel/wg-easy:latest
+    container_name: wireguard
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    environment:
+      - WG_HOST=vpn.lazyworkhorse.net
+      - PASSWORD=${WG_PASSWORD}
+      - WG_PORT=51820
+      - WG_DEFAULT_ADDRESS=10.8.0.x
+      - WG_DEFAULT_DNS=1.1.1.1,8.8.8.8
+      - WG_ALLOWED_IPS=0.0.0.0/0, ::/0
+      - WG_PERSISTENT_KEEPALIVE=25
+      - UI_TRAFFIC_STATS=true
+      - UI_CHART_TYPE=0
+    ports:
+      - "51820:51820/udp"
+      - "51821:51821/tcp"
+    volumes:
+      - /mnt/HoardingCow_docker_data/WireGuard:/etc/wireguard:rw
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+    restart: unless-stopped
+    networks:
+      - vpn_net
+
+networks:
+  vpn_net:
+    external: true
+    name: vpn_net