Merge remote-tracking branch 'origin/feat/wireguard-vpn' into HEAD

ai/Dockerfile

@@ -0,0 +1,71 @@
+FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source
+FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source
+FROM debian:13.4
+
+# Disable Python stdout buffering to ensure logs are printed immediately
+ENV PYTHONUNBUFFERED=1
+
+# Store Playwright browsers outside the volume mount so the build-time
+# install survives the /opt/data volume overlay at runtime.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
+
+# Install system dependencies in one layer, clear APT cache
+# tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.)
+# that would otherwise accumulate when hermes runs as PID 1. See #15012.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
+        curl poppler-utils imagemagick \
+        chromium xvfb fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \
+        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
+        qemu-user-static binfmt-support qemu-user-binfmt \
+        emacs-nox \
+        libportaudio2 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime
+RUN useradd -u 10000 -m -d /opt/data hermes
+
+COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/
+COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
+
+WORKDIR /opt/hermes
+
+# ---------- Layer-cached dependency install ----------
+# Copy only package manifests first so npm install + Playwright are cached
+# unless the lockfiles themselves change.
+COPY package.json package-lock.json ./
+COPY web/package.json web/package-lock.json web/
+
+RUN npm install --prefer-offline --no-audit && \
+    npx playwright install --with-deps chromium --only-shell && \
+    (cd web && npm install --prefer-offline --no-audit) && \
+    npm cache clean --force
+
+# ---------- Source code ----------
+# .dockerignore excludes node_modules, so the installs above survive.
+COPY --chown=hermes:hermes . .
+
+# Build web dashboard (Vite outputs to hermes_cli/web_dist/)
+RUN cd web && npm run build
+
+# ---------- Permissions ----------
+# Make install dir world-readable so any HERMES_UID can read it at runtime.
+# The venv needs to be traversable too.
+USER root
+RUN chmod -R a+rX /opt/hermes
+# Start as root so the entrypoint can usermod/groupmod + gosu.
+# If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000).
+
+# ---------- Python virtualenv ----------
+RUN uv venv && \
+    uv pip install --no-cache-dir -e ".[all]" && \
+    uv pip install --no-cache-dir sounddevice numpy faster-whisper
+
+# ---------- Runtime ----------
+ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist
+ENV HERMES_HOME=/opt/data
+ENV PATH="/opt/data/.local/bin:${PATH}"
+VOLUME [ "/opt/data" ]
+ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]

ai/compose.yml

@@ -1,31 +1,100 @@
+version: "3.8"
 services:
 
-  webui:
+  # webui:
-    image: ghcr.io/open-webui/open-webui:main
+  #   image: ghcr.io/open-webui/open-webui:main
-    volumes:
+  #   volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #     - /mnt/HoardingCow_docker_data/Ollama/open-webui:/app/backend/data
+  #   restart: always
+  #   environment:
+  #     - OLLAMA_API_BASE_URL=http://ollama:11434/api
+  #   networks:
+  #     - ai_net
+  #     - ai_backend
+  #   labels:
+  #     - "traefik.enable=true"
+
+  #     # Router for HTTP + redirection to HTTPS
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-http.entrypoints=web"
+  #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+
+  #     # Router for HTTPS with TLS
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.webui-https.entrypoints=websecure"
+  #     - "traefik.http.routers.webui-https.tls=true"
+  #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+
+  hermes:
+    build: ./
+    container_name: hermes
+    restart: always
+    # Gateway run enables the internal API server on port 8642
+    command: gateway run
     environment:
-      - OLLAMA_API_BASE_URL=http://ollama:11434/api
+      - OLLAMA_HOST=http://ollama:11434
+      - API_SERVER_ENABLED=true
+      - API_SERVER_PORT=8642
+      - API_SERVER_HOST=0.0.0.0
+      - API_SERVER_KEY=hermes_local_key
+      - GATEWAY_ALLOW_ALL_USERS=true
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+    volumes:
+      - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
+    devices:
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
     networks:
-      - traefik-net
+      - ai_backend
-    labels:
-      - "traefik.enable=true"
 
-      # Router for HTTP + redirection to HTTPS
+  ollama:
-      - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
+    image: ollama/ollama:latest
-      - "traefik.http.routers.webui-http.entrypoints=web"
+    container_name: ollama
-      - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
+    privileged: true
+    tty: true
+    restart: always 
+    ports:
+      - "127.0.0.1:11434:11434"
+    networks:
+      - ai_backend
+    volumes:
+      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
+    environment:
+      - OLLAMA_VULKAN=0
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
+      - HCC_AMDGPU_TARGET=gfx906
+      - HIP_VISIBLE_DEVICES=0,1
+      - ROCR_VISIBLE_DEVICES=0,1
+      - HSA_ENABLE_SDMA=0 
+      - OLLAMA_HOST=0.0.0.0
+      - OLLAMA_DEBUG=1
+      - OLLAMA_FLASH_ATTENTION=0
+      - OLLAMA_NUM_PARALLEL=2
+    devices:
+      # Map the render nodes and KFD for ROCm to work inside the container
+      - /dev/kfd:/dev/kfd
+      - /dev/dri:/dev/dri
+    group_add:
+      - "303"
+      - "26"
 
-      # Router for HTTPS with TLS
+networks:
-      - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
+  ai_net:
-      - "traefik.http.routers.webui-https.entrypoints=websecure"
+    external: true
-      - "traefik.http.routers.webui-https.tls=true"
+    name: ai_net
-      - "traefik.http.routers.webui-https.tls.certresolver=njalla"
+  ai_backend:
+    driver: bridge
+    name: ai_backend
     
   # llama_cpp_devstral:
   #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
   #   container_name: llama_cpp_devstral
   #   restart: unless-stopped
+  #   networks:
+  #     - ai_backend
   #   ports:
   #     - "8300:8080"
   #   ipc: host
@@ -70,7 +139,7 @@ services:
   #   init: true
   #   shm_size: '2g' 
   #   networks:
-  #     - traefik-net
+  #     - ai_backend
   #   ports:
   #     - "8300:8000"
   #   devices:
@@ -108,43 +177,12 @@ services:
   #     - /mnt/HoardingCow_docker_data/vllm/models:/root/.cache/huggingface
   #   restart: unless-stopped
 
-  ollama:
-    image: ollama/ollama:latest
-    container_name: ollama
-    privileged: true
-    tty: true
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:11434:11434"
-    networks:
-      - traefik-net
-    volumes:
-      - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
-    environment:
-      - OLLAMA_VULKAN=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0 
-      - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=0
-      - OLLAMA_NUM_PARALLEL=2
-    devices:
-      # Map the render nodes and KFD for ROCm to work inside the container
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
-
   # n8n:
   #   image: n8nio/n8n:latest
   #   container_name: n8n
   #   restart: unless-stopped
   #   networks:
-  #     - traefik-net
+  #     - ai_net
   #   environment:
   #     - N8N_HOST=n8n.lazyworkhorse.net
   #     - N8N_PORT=5678
@@ -178,61 +216,78 @@ services:
   #     # Service Loadbalancer (n8n default port)
   #     - "traefik.http.services.n8n.loadbalancer.server.port=5678"
 
-  openclaw:
+  # openclaw:
-    image: coollabsio/openclaw:latest
+  #   image: coollabsio/openclaw:latest
-    container_name: openclaw
+  #   container_name: openclaw
-    restart: unless-stopped
+  #   restart: unless-stopped
-    expose:
+  #   expose:
-      - "8080"  # WebUI
+  #     - "8080"  # WebUI
-      - "18789" # Gateway/WebSocket
+  #     - "18789" # Gateway/WebSocket
-      - "8788"  # Nextcloud Webhook
+  #     - "8788"  # Nextcloud Webhook
-    networks:
+  #   networks:
-      - traefik-net
+  #     - ai_net
-    volumes:
+  #     - ai_backend
-      - /mnt/HoardingCow_docker_data/openclaw/data:/data
+  #   volumes:
-      - /home/gortium/infra:/data/workspace/infra
+  #     - /mnt/HoardingCow_docker_data/openclaw/data:/data
-    environment:
+  #     - /home/gortium/infra:/data/workspace/infra
-      - TZ=America/Toronto
+  #   environment:
-      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
+  #     - TZ=America/Toronto
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+  #     - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
-      # Point to the sidecar browser
+  #     - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
-      - BROWSER_CDP_URL=http://openclaw-browser:9222
+  #     # Point to the sidecar browser
-      - BROWSER_EVALUATE_ENABLED=true
+  #     - BROWSER_CDP_URL=http://openclaw-browser:9222
-      - OPENCLAW_GATEWAY_HOST=0.0.0.0
+  #     - BROWSER_EVALUATE_ENABLED=true
-      - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
+  #   labels:
+  #     - "traefik.enable=true"
 
-    labels:
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
-      - "traefik.enable=true"
+  #     - "traefik.http.routers.openclaw-http.entrypoints=web"
+  #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
 
-      - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
-      - "traefik.http.routers.openclaw-http.entrypoints=web"
+  #     - "traefik.http.routers.openclaw-https.priority=50"
-      - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
+  #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
+  #     - "traefik.http.routers.openclaw-https.tls=true"
+  #     - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
+  #     - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #   depends_on:
+  #     - openclaw-browser
 
-      - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
+  # openclaw-browser:
-      - "traefik.http.routers.openclaw-https.priority=50"
+  #   image: ghcr.io/browserless/chromium:latest
-      - "traefik.http.routers.openclaw-https.entrypoints=websecure"
+  #   restart: always
-      - "traefik.http.routers.openclaw-https.tls=true"
+  #   expose:
-      - "traefik.http.routers.openclaw-https.tls.certresolver=njalla"
+  #     - "3000"
-      - "traefik.http.services.openclaw.loadbalancer.server.port=8080"
+  #   environment:
+  #     - MAX_CONCURRENT_SESSIONS=10
+  #     - CONNECTION_TIMEOUT=300000
+  #     - PREBOOT_CHROME=true
+  #     - DEMO_MODE=false
+  #   networks:
+  #     ai_backend:
+  #       aliases:
+  #         - browser
 
-    depends_on:
+  # openclaw-ssh:
-      - openclaw-browser
+  #   image: linuxserver/openssh-server:latest
-
+  #   container_name: openclaw-ssh
-  openclaw-browser:
+  #   environment:
-    image: ghcr.io/browserless/chromium:latest
+  #     - PUID=1000
-    restart: always
+  #     - PGID=1000
-    expose:
+  #     - PUBLIC_KEY_FILE=/config/ssh/authorized_keys
-      - "3000"
+  #     - SUDO_ACCESS=false
-    environment:
+  #     - PASSWORD_ACCESS=false
-      - MAX_CONCURRENT_SESSIONS=10
+  #   volumes:
-      - CONNECTION_TIMEOUT=300000
+  #     - /mnt/HoardingCow_docker_data/openclaw/ssh-config:/config
-      - PREBOOT_CHROME=true
+  #     - /home/gortium/infra:/data/workspace/infra:ro
-      - DEMO_MODE=false
+  #   restart: unless-stopped
-    networks:
+  #   networks:
-      traefik-net:
+  #     - ai_backend
-        aliases:
+  #   labels:
-          - browser
+  #     - "traefik.enable=true"
-
+  #     - "traefik.tcp.routers.openclaw-ssh.rule=HostSNI(*)"
-networks:
+  #     - "traefik.tcp.routers.openclaw-ssh.entrypoints=sshnode"
-  traefik-net:
+  #     - "traefik.tcp.routers.openclaw-ssh.tls.passthrough=false"
-    external: true
+  #     - "traefik.tcp.services.openclaw-ssh.loadbalancer.server.port=2222"

authentification/compose.yml

@@ -7,8 +7,8 @@ services:
     volumes:
       - /mnt/HoardingCow_docker_data/Authelia:/config
     networks:
-      - traefik-net
+      - auth_net
-    restart: unless-stopped
+    restart: always 
     labels:
       - "traefik.enable=true"
 
@@ -31,5 +31,6 @@ services:
       - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
 
 networks:
-  traefik-net:
+  auth_net:
     external: true
+    name: auth_net

backup/compose.yml

@@ -1,55 +1,100 @@
 version: "3.8"
 
 services:
-  kopia:
+  # kopia:
-    image: kopia/kopia:latest
+  #   image: kopia/kopia:latest
-    container_name: kopia
+  #   container_name: kopia
-    restart: unless-stopped
+  #   restart: unless-stopped
-    # We explicitly run as root (0:0) to solve the CHDIR issue, 
+  #   # We explicitly run as root (0:0) to solve the CHDIR issue, 
-    # OR we make sure the host folders match UID 1000.
+  #   # OR we make sure the host folders match UID 1000.
+  #   user: "0:0" 
+  #   command:
+  #     - server
+  #     - start
+  #     - --address=0.0.0.0:51515
+  #     - --server-username=${KOPIA_SERVER_USER}
+  #     - --server-password=${KOPIA_SERVER_PASSWORD}
+  #     - --config-file=/app/config/repository.config
+  #     - --disable-csrf-token-checks
+  #     - --insecure
+  #   environment:
+  #     - TZ=America/Montreal
+  #     - KOPIA_PASSWORD=${KOPIA_PASSWORD}
+  #     - USER=${KOPIA_USER}
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Kopia/config:/app/config
+  #     - /mnt/HoardingCow_docker_data/Kopia/cache:/app/cache
+  #     - /mnt/HoardingCow_docker_data/Kopia/repository:/repository
+  #     # Required if you want to use the 'Mount' feature later
+  #     - /tmp:/tmp:shared
+  #     # Required for mounting backups as drives
+  #   cap_add:
+  #     - SYS_ADMIN
+  #   devices:
+  #     - /dev/fuse:/dev/fuse
+  #   networks:
+  #     - traefik-net
+  #   labels:
+  #     - "traefik.enable=true"
+  #     # 1. HTTP to HTTPS Redirect
+  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia-http.entrypoints=web"
+  #     - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
+  #     
+  #     # 2. HTTPS Configuration
+  #     - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
+  #     - "traefik.http.routers.kopia.entrypoints=websecure"
+  #     - "traefik.http.routers.kopia.tls=true"
+  #     - "traefik.http.routers.kopia.tls.certresolver=njalla"
+  #     
+  #     # 3. Backend Service Config
+  #     - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+
+  restic-server:
+    image: restic/restic:latest
+    container_name: restic-server
+    restart: always 
     user: "0:0"
-    command:
+    command: ["server", "--listen", ":8080", "--repo", "/data", "--tls-cert", "", "--tls-key", ""]
-      - server
-      - start
-      - --address=0.0.0.0:51515
-      - --server-username=${KOPIA_SERVER_USER}
-      - --server-password=${KOPIA_SERVER_PASSWORD}
-      - --config-file=/app/config/repository.config
-      - --disable-csrf-token-checks
-      - --insecure
     environment:
       - TZ=America/Montreal
-      - KOPIA_PASSWORD=${KOPIA_PASSWORD}
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
-      - USER=${KOPIA_USER}
     volumes:
-      - /mnt/HoardingCow_docker_data/Kopia/config:/app/config
+      - /mnt/HoardingCow_docker_data/Restic/data:/data
-      - /mnt/HoardingCow_docker_data/Kopia/cache:/app/cache
+      # Mount paths to backup (adjust as needed)
-      - /mnt/HoardingCow_docker_data/Kopia/repository:/repository
+      - /mnt/HoardingCow_docker_data:/source:ro
-      # Required if you want to use the 'Mount' feature later
-      - /tmp:/tmp:shared
-      # Required for mounting backups as drives
-    cap_add:
-      - SYS_ADMIN
-    devices:
-      - /dev/fuse:/dev/fuse
     networks:
-      - traefik-net
+      - backup_net
+    labels:
+      - "traefik.enable=false" # Internal only, accessed by restic-browser
+
+  restic-browser:
+    image: embergarage/restic-browser:latest
+    container_name: restic-browser
+    restart: always 
+    environment:
+      - TZ=America/Montreal
+      - RESTIC_REPOSITORY=http://restic-server:8080
+      - RESTIC_PASSWORD=${RESTIC_PASSWORD}
+    networks:
+      - backup_net
     labels:
       - "traefik.enable=true"
       # 1. HTTP to HTTPS Redirect
-      - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
+      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
-      - "traefik.http.routers.kopia-http.entrypoints=web"
+      - "traefik.http.routers.restic-browser-http.entrypoints=web"
-      - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
+      - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
       
       # 2. HTTPS Configuration
-      - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
+      - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
-      - "traefik.http.routers.kopia.entrypoints=websecure"
+      - "traefik.http.routers.restic-browser.entrypoints=websecure"
-      - "traefik.http.routers.kopia.tls=true"
+      - "traefik.http.routers.restic-browser.tls=true"
-      - "traefik.http.routers.kopia.tls.certresolver=njalla"
+      - "traefik.http.routers.restic-browser.tls.certresolver=njalla"
       
       # 3. Backend Service Config
-      - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+      - "traefik.http.services.restic-browser.loadbalancer.server.port=8000"
 
 networks:
-  traefik-net:
+  backup_net:
     external: true
+    name: backup_net

cloudstorage/compose.yml

@@ -5,7 +5,7 @@ services:
     container_name: nextcloud
     restart: always
     networks:
-      - traefik-net
+      - cloud_net
     environment:
       - PUID=1000
       - PGID=1000
@@ -51,7 +51,7 @@ services:
     container_name: nextcloud_cron
     restart: always 
     networks:
-      - traefik-net
+      - cloud_net
     entrypoint: /cron.sh
     volumes:
       - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
@@ -61,9 +61,9 @@ services:
   nextcloud_mariadb:
     image: mariadb:latest
     container_name: nextcloud_mariadb
-    restart: always
+    restart: unless-stopped
     networks:
-      - traefik-net
+      - cloud_internal
     environment:
       - MYSQL_RANDOM_ROOT_PASSWORD=yes
       - MYSQL_USER=nextcloud
@@ -74,5 +74,9 @@ services:
     # command: ["--innodb-force-recovery=6"]
 
 networks:
-  traefik-net:
+  cloud_net:
     external: true
+    name: cloud_net
+  cloud_internal:
+    driver: bridge
+    name: cloud_internal

coms/compose.yml

@@ -1,15 +1,75 @@
 version: "3.9"
 services:
-  nomadnet:
+  # nomadnet:
-    image: ghcr.io/markqvist/nomadnet:master
+  #   image: ghcr.io/markqvist/nomadnet:master
-    container_name: nomadnet
+  #   container_name: nomadnet
-    restart: unless-stopped
+  #   restart: always
+  #   volumes:
+  #     - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
+  #     - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
+  #   # Reticulum transport must be reachable directly (NOT through Traefik)
+  #   ports:
+  #     - "4242:4242"
+
+  synapse:
+    image: ghcr.io/element-hq/synapse:latest
+    container_name: synapse
+    restart: always
     volumes:
-      - /mnt/HoardingCow_docker_data/Nomadnet:/root/.nomadnetwork
+      - /mnt/HoardingCow_docker_data/Matrix/data:/data
-      - /mnt/HoardingCow_docker_data/Reticulum:/root/.reticulum
+    networks:
-    # Reticulum transport must be reachable directly (NOT through Traefik)
+      - coms_net
-    ports:
+      - coms_backend
-      - "4242:4242"
+    depends_on:
+      synapse-db:
+        condition: service_healthy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.matrix-http.rule=Host(`matrix.lazyworkhorse.net`)"
+      - "traefik.http.routers.matrix-http.entrypoints=web"
+      - "traefik.http.routers.matrix-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.matrix-https.rule=Host(`matrix.lazyworkhorse.net`)"
+      - "traefik.http.routers.matrix-https.entrypoints=websecure"
+      - "traefik.http.routers.matrix-https.tls=true"
+      - "traefik.http.routers.matrix-https.tls.certresolver=njalla"
+      - "traefik.http.services.matrix-https.loadbalancer.server.port=8008"
+      - "traefik.docker.network=coms_net"
+
+  synapse-db:
+    image: postgres:17-alpine
+    container_name: synapse-db
+    restart: always
+    environment:
+      - POSTGRES_USER=synapse
+      - POSTGRES_PASSWORD=${SYNAPSE_DB_PASSWORD}
+      - POSTGRES_DB=synapse
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - /mnt/HoardingCow_docker_data/Matrix/db:/var/lib/postgresql/data
+    networks:
+      - coms_backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      
+  synapse-admin:
+    image: awesometechnologies/synapse-admin:latest
+    container_name: synapse-admin
+    restart: always
+    networks:
+      - coms_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.lazyworkhorse.net`)"
+      - "traefik.http.routers.synapse-admin-http.entrypoints=web"
+      - "traefik.http.routers.synapse-admin-http.middlewares=redirect-to-https"
+      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.lazyworkhorse.net`)"
+      - "traefik.http.routers.synapse-admin-https.entrypoints=websecure"
+      - "traefik.http.routers.synapse-admin-https.tls=true"
+      - "traefik.http.routers.synapse-admin-https.tls.certresolver=njalla"
+      - "traefik.http.services.synapse-admin.loadbalancer.server.port=80"
 
   # rbrowser:
   #   build: 
@@ -42,5 +102,9 @@ services:
   #     - "traefik.http.services.rns.loadbalancer.server.port=5000"
 
 networks:
-  traefik-net:
+  coms_net:
     external: true
+    name: coms_net
+  coms_backend:
+    driver: bridge
+    name: coms_backend

finance/compose.yml

@@ -4,18 +4,13 @@ services:
   fava:
     image: yegle/fava
     container_name: fava
-
     environment:
       - BEANCOUNT_FILE=/data/beancount_finance_vault/ledger/main/tpouplier.beancount
-
     volumes:
       - /mnt/HoardingCow_docker_data/Fava:/data
-
     networks:
-      - traefik-net
+      - finance_net
-
+    restart: always
-    restart: unless-stopped
-
     labels:
       - "traefik.enable=true"
 
@@ -41,5 +36,5 @@ services:
       - "traefik.http.services.fava.loadbalancer.server.port=5000"
 
 networks:
-  traefik-net:
+  finance_net:
     external: true

homeautomation/compose.yml

@@ -3,7 +3,7 @@ services:
   homeassistant:
     image: ghcr.io/home-assistant/home-assistant:stable
     container_name: homeassistant
-    restart: unless-stopped
+    restart: always
     privileged: true
     # Was needed for someting.. but dont remember. Deactivated for now.
     # network_mode: host  # Discovery (mDNS/Bluetooth) requires this
@@ -12,7 +12,8 @@ services:
     volumes:
       - /mnt/HoardingCow_docker_data/Home_Assistant:/config:rw
     networks:
-      - traefik-net
+      - home_auto_net
+      - home_auto_backend
     labels:
       - "traefik.enable=true"
 
@@ -33,7 +34,7 @@ services:
     volumes:
       - /mnt/HoardingCow_docker_data/Mosquitto:/mosquitto
     networks:
-      - traefik-net
+      - home_auto_backend
     # ports:
     #   - 1883:1883
     #   - 9001:9001
@@ -42,7 +43,7 @@ services:
     image: registry.gitlab.com/hydroqc/hydroqc2mqtt:1.3.0
     restart: always
     networks:
-      - traefik-net
+      - home_auto_backend
     environment:
       MQTT_USERNAME: hass
       MQTT_PASSWORD: ${MQTT_PASSWORD}
@@ -87,5 +88,8 @@ services:
   #   restart: unless-stopped
 
 networks:
-  traefik-net:
+  home_auto_net:
     external: true
+  home_auto_backend:
+    driver: bridge
+    name: home_auto_backend

homepage/compose.yml

@@ -9,9 +9,9 @@ services:
       - PORT=8080
     volumes:
       - /mnt/HoardingCow_docker_data/Homer/assets:/www/assets:rw
-    restart: unless-stopped
+    restart: always
     networks:
-      - traefik-net
+      - homepage_net
     labels:
       - "traefik.enable=true"
 
@@ -37,5 +37,5 @@ services:
       - "traefik.http.services.homer.loadbalancer.server.port=8080"
 
 networks:
-  traefik-net:
+  homepage_net:
     external: true

network/compose.yml

@@ -7,6 +7,7 @@ services:
     command:
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.sshnode.address=:2425"
 
       - "--certificatesresolvers.njalla.acme.email=thierrypouplier@gmail.com"
       - "--certificatesresolvers.njalla.acme.storage=/letsencrypt/acme.json"
@@ -25,13 +26,24 @@ services:
       - /mnt/HoardingCow_docker_data/Traefik:/letsencrypt
     restart: unless-stopped
     networks:
-      - traefik-net
+      - traefik_backend
+      - ai_net
+      - auth_net
+      - backup_net
+      - cloud_net
+      - coms_net
+      - finance_net
+      - home_auto_net
+      - homepage_net
+      - passman_net
+      - tak_net
+      - vc_net
 
   ddns-updater:
     image: qmcgaw/ddns-updater
     container_name: ddns-updater
     networks:
-      - traefik-net
+      - traefik_backend
     ports:
       - 8000:8000/tcp
     volumes:
@@ -63,9 +75,42 @@ services:
     restart: unless-stopped
 
 networks:
-  traefik-net:
+  traefik_backend:
     driver: bridge
-    name: traefik-net
+    name: traefik_backend
+  ai_net:
+    external: true
+    name: ai_net
+  auth_net:
+    external: true
+    name: auth_net
+  backup_net:
+    external: true
+    name: backup_net
+  cloud_net:
+    external: true
+    name: cloud_net
+  coms_net:
+    external: true
+    name: coms_net
+  finance_net:
+    external: true
+    name: finance_net
+  home_auto_net:
+    external: true
+    name: home_auto_net
+  homepage_net:
+    external: true
+    name: homepage_net
+  passman_net:
+    external: true
+    name: passman_net
+  tak_net:
+    external: true
+    name: tak_net
+  vc_net:
+    external: true
+    name: vc_net
 
   # duckdns:
   #   environment:

passwordmanager/compose.yml

@@ -13,8 +13,8 @@ services:
     volumes:
       - /mnt/HoardingCow_docker_data/BitWarden/data:/data:rw
     networks:
-      - traefik-net
+      - passman_net
-    restart: unless-stopped
+    restart: always
     labels:
       - "traefik.enable=true"
 
@@ -32,5 +32,5 @@ services:
       # Internal service
       - "traefik.http.services.pass.loadbalancer.server.port=80"
 networks:
-  traefik-net:
+  passman_net:
     external: true

tak/compose.yml

@@ -3,9 +3,9 @@ services:
     image: ghcr.io/freetakteam/freetakserver:master
     container_name: freetakserver
     hostname: freetakserver
-    restart: unless-stopped
+    restart: always
     networks:
-      - traefik-net
+      - tak_backend
     volumes:
       - /mnt/HoardingCow_docker_data/TAK/fts_data:/opt/fts:z,rw
     ports:
@@ -50,9 +50,9 @@ services:
     image: ghcr.io/freetakteam/ui:latest
     container_name: freetakserver-ui
     hostname: freetakserver-ui
-    restart: unless-stopped
+    restart: always
     networks:
-      - traefik-net
+      - tak_net
     ports:
       - 5000:5000
     volumes:
@@ -91,5 +91,8 @@ services:
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
 networks:
-  traefik-net:
+  tak_net:
     external: true
+  tak_backend:
+    driver: bridge
+    name: tak_backend

versioncontrol/compose.yml

@@ -12,8 +12,8 @@ services:
     volumes:
       - /mnt/HoardingCow_docker_data/Gitea:/data
     networks:
-      - traefik-net
+      - vc_net
-    restart: unless-stopped
+    restart: always
     ports:
       - "2222:2222"
     labels:
@@ -41,5 +41,5 @@ services:
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
 networks:
-  traefik-net:
+  vc_net:
     external: true

vpn/compose.yml

@@ -0,0 +1,35 @@
+version: "3.8"
+
+services:
+  wireguard:
+    image: weejewel/wg-easy:latest
+    container_name: wireguard
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    environment:
+      - WG_HOST=vpn.lazyworkhorse.net
+      - PASSWORD=${WG_PASSWORD}
+      - WG_PORT=51820
+      - WG_DEFAULT_ADDRESS=10.8.0.x
+      - WG_DEFAULT_DNS=1.1.1.1,8.8.8.8
+      - WG_ALLOWED_IPS=0.0.0.0/0, ::/0
+      - WG_PERSISTENT_KEEPALIVE=25
+      - UI_TRAFFIC_STATS=true
+      - UI_CHART_TYPE=0
+    ports:
+      - "51820:51820/udp"
+      - "51821:51821/tcp"
+    volumes:
+      - /mnt/HoardingCow_docker_data/WireGuard:/etc/wireguard:rw
+    sysctls:
+      - net.ipv4.conf.all.src_valid_mark=1
+      - net.ipv4.ip_forward=1
+    restart: unless-stopped
+    networks:
+      - vpn_net
+
+networks:
+  vpn_net:
+    external: true
+    name: vpn_net