feat: add llama-cpp-hermes service with ROCm 6.1 + gfx906 support

- Add custom llama.cpp Dockerfile with ROCm 6.1 + gfx906 (MI50) build
- Add llama-cpp-hermes service serving Hermes 4.3 on dual MI50 GPUs
- Strip GPU devices/ROCm env from ollama service (CPU-only for embeddings)

Hermes 4.3 runs at ~19 t/s on dual MI50s with 160K context.

.env.production

@@ -1,4 +0,0 @@
-# Production environment
-# docker compose --env-file .env.production up -d
-DOMAIN=lazyworkhorse.net
-SITE_URL=https://lazyworkhorse.net

.env.staging

@@ -1,4 +0,0 @@
-# Staging environment
-# docker compose --env-file .env.staging up -d
-DOMAIN=staging.lazyworkhorse.net
-SITE_URL=https://staging.lazyworkhorse.net

Makefile

@@ -1,18 +1,13 @@
 # Base path for docker-compose files
-COMPOSE_PATH?=~/Projects/AltNet/docker-compose
+COMPOSE_PATH=~/Projects/AltNet/docker-compose
-
-# Environment selection: staging or production (default)
-ENV?=production
-ENV_FILE=.env.$(ENV)
 
 # List of services (folder names)
 SERVICES=monitoring ai cloudstorage crm_tp crm_cf mediacenter homeautomation network backup homepage passwordmanager
 
 # Bring up all services
 all_up:
-	@echo "Deploying with $(ENV) environment ($(ENV_FILE))..."
 	@for service in $(SERVICES); do \
-		docker compose --env-file $(ENV_FILE) -f $(COMPOSE_PATH)/$$service/compose.yml up -d; \
+		docker compose -f $(COMPOSE_PATH)/$$service/compose.yml up -d; \
 	done
 
 # Bring down all services
@@ -23,27 +18,15 @@ all_down:
 
 # Generic target to deploy a specific service
 %_up:
-	@echo "Deploying $* with $(ENV) environment ($(ENV_FILE))..."
+	@docker compose -f $(COMPOSE_PATH)/$*/compose.yml up -d
-	@docker compose --env-file $(ENV_FILE) -f $(COMPOSE_PATH)/$*/compose.yml up -d
 
 # Generic target to bring down a specific service
 %_down:
 	@docker compose -f $(COMPOSE_PATH)/$*/compose.yml down
 
-# Deploy staging (all services)
-staging:
-	@$(MAKE) all_up ENV=staging
-
-# Deploy production (all services)
-production:
-	@$(MAKE) all_up ENV=production
-
-# Staging per-service: make openwebui_up ENV=staging
-# Production per-service: make openwebui_up ENV=production
-
 all_stack_up:
 	@for service in $(SERVICES); do \
-		docker stack deploy --env-file $(ENV_FILE) -c $(COMPOSE_PATH)/$$service/compose.yml $$service; \
+		docker stack deploy -c $(COMPOSE_PATH)/$$service/compose.yml $$service; \
 	done
 
 all_stack_down:
@@ -52,7 +35,7 @@ all_stack_down:
 	done
 
 %_stack_up:
-	@docker stack deploy --env-file $(ENV_FILE) -c $(COMPOSE_PATH)/$*/compose.yml $*
+	@docker stack deploy -c $(COMPOSE_PATH)/$*/compose.yml $*
 
 %_stack_down:
 	@docker stack rm $*
@@ -60,9 +43,3 @@ all_stack_down:
 stack_ls:
 	@docker node ps workGoat;
 	docker node ps workHorse
-
-# Show current environment settings
-env:
-	@echo "Active environment: $(ENV)"
-	@echo "Env file: $(ENV_FILE)"
-	@test -f $(ENV_FILE) && cat $(ENV_FILE) || echo "WARNING: $(ENV_FILE) not found!"

ai/compose.yml

@@ -15,12 +15,12 @@ services:
   #     - "traefik.enable=true"
 
   #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.webui-http.rule=Host(`ai.${DOMAIN}`)"
+  #     - "traefik.http.routers.webui-http.rule=Host(`ai.lazyworkhorse.net`)"
   #     - "traefik.http.routers.webui-http.entrypoints=web"
   #     - "traefik.http.routers.webui-http.middlewares=redirect-to-https"
 
   #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.webui-https.rule=Host(`ai.${DOMAIN}`)"
+  #     - "traefik.http.routers.webui-https.rule=Host(`ai.lazyworkhorse.net`)"
   #     - "traefik.http.routers.webui-https.entrypoints=websecure"
   #     - "traefik.http.routers.webui-https.tls=true"
   #     - "traefik.http.routers.webui-https.tls.certresolver=njalla"
@@ -87,10 +87,10 @@ services:
       - ai_net
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.${DOMAIN}`)"
+      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.lazyworkhorse.net`)"
       - "traefik.http.routers.syncthing-http.entrypoints=web"
       - "traefik.http.routers.syncthing-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.${DOMAIN}`)"
+      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.lazyworkhorse.net`)"
       - "traefik.http.routers.syncthing-https.entrypoints=websecure"
       - "traefik.http.routers.syncthing-https.tls=true"
       - "traefik.http.routers.syncthing-https.tls.certresolver=njalla"
@@ -112,22 +112,7 @@ services:
       - /mnt/HoardingCow_docker_data/Ollama/ollama:/root/.ollama
     environment:
       - OLLAMA_VULKAN=0
-      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-      - HCC_AMDGPU_TARGET=gfx906
-      - HIP_VISIBLE_DEVICES=0,1
-      - ROCR_VISIBLE_DEVICES=0,1
-      - HSA_ENABLE_SDMA=0 
       - OLLAMA_HOST=0.0.0.0
-      - OLLAMA_DEBUG=1
-      - OLLAMA_FLASH_ATTENTION=1
-      - OLLAMA_NUM_PARALLEL=2
-    devices:
-      # Map the render nodes and KFD for ROCm to work inside the container
-      - /dev/kfd:/dev/kfd
-      - /dev/dri:/dev/dri
-    group_add:
-      - "303"
-      - "26"
 
 networks:
   ai_net:
@@ -137,47 +122,40 @@ networks:
     driver: bridge
     name: ai_backend
     
-  # llama_cpp_devstral:
+  llama-cpp-hermes:
-  #   image: ghcr.io/ggml-org/llama.cpp:server-rocm
+    image: llama-cpp:rocm-gfx906
-  #   container_name: llama_cpp_devstral
+    container_name: llama-cpp-hermes
-  #   restart: unless-stopped
+    restart: unless-stopped
-  #   networks:
+    networks:
-  #     - ai_backend
+      - ai_backend
-  #   ports:
+    ports:
-  #     - "8300:8080"
+      - "127.0.0.1:8300:8080"
-  #   ipc: host
+    ipc: host
-  #   devices:
+    devices:
-  #     - "/dev/kfd:/dev/kfd"
+      - /dev/kfd:/dev/kfd
-  #     - "/dev/dri:/dev/dri"
+      - /dev/dri:/dev/dri
-  #   group_add:
+    group_add:
-  #     - "303" # video
+      - "303"
-  #     - "26"  # render
+      - "26"
-  #   environment:
+    environment:
-  #     HSA_OVERRIDE_GFX_VERSION: 9.0.6
+      - HSA_OVERRIDE_GFX_VERSION=9.0.6
-  #     HIP_VISIBLE_DEVICES: 0,1
+      - HSA_ENABLE_SDMA=0
-  #     LLAMA_CACHE: /models
+      - HIP_VISIBLE_DEVICES=0,1
-  #   volumes:
+      - LLAMA_CACHE=/models
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
+    volumes:
-  #     - /mnt/HoardingCow_docker_data/Llama_cpp/devstral-agent.jinja:/template.jinja
+      - /mnt/HoardingCow_docker_data/Llama_cpp/models:/models
-  #   command: >
+      - /mnt/HoardingCow_docker_data/Ollama/ollama/models/blobs/sha256-17823599694fa3503ef54bf748d5078c6ce881f4d01616cafa255dc05d215a08:/model.gguf:ro
-  #     -hf unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF:Devstral-Small-2-24B-Instruct-2512-Q8_0.gguf
+    command: >
-  #     -a devstral-2-small-llama_cpp
+      -m /model.gguf
-  #     --chat-template-file /template.jinja
+      --host 0.0.0.0
-  #     --host 0.0.0.0
+      --port 8080
-  #     --port 8080
+      --gpu-layers 99
-  #     --n-gpu-layers 99
+      --ctx-size 163840
-  #     --ctx-size 163840
+      -ctk f16 -ctv f16
-  #     --batch-size 4096
+      --flash-attn on
-  #     --ubatch-size 4096
+      --split-mode layer
-  #     --cache-type-k f16
+      --no-mmap
-  #     --cache-type-v f16
+      --n-predict -1
-  #     --cache-reuse 256
-  #     --flash-attn on
-  #     --context-shift
-  #     --split-mode layer
-  #     --no-mmap
-  #     --n-predict -1
-  #     --parallel 2
 
   # vllm:
   #   image: nalanzeyu/vllm-gfx906:v0.9.0-rocm6.3
@@ -232,12 +210,12 @@ networks:
   #   networks:
   #     - ai_net
   #   environment:
-  #     - N8N_HOST=n8n.${DOMAIN}
+  #     - N8N_HOST=n8n.lazyworkhorse.net
   #     - N8N_PORT=5678
   #     - N8N_PROTOCOL=https
   #     - NODE_ENV=production
   #     - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
-  #     - WEBHOOK_URL=https://n8n.${DOMAIN}/
+  #     - WEBHOOK_URL=https://n8n.lazyworkhorse.net/
   #     - GENERIC_TIMEZONE=America/New_York # Adjust to your timezone
   #     - N8N_BLOCK_EXTERNAL_STORAGE_ACCESS=false
   #     - N8N_NODES_PYTHON_CAN_IMPORT_MODULES=true 
@@ -251,12 +229,12 @@ networks:
   #     - "traefik.enable=true"
 
   #     # Router for HTTP + redirection to HTTPS
-  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.${DOMAIN}`)"
+  #     - "traefik.http.routers.n8n-http.rule=Host(`n8n.lazyworkhorse.net`)"
   #     - "traefik.http.routers.n8n-http.entrypoints=web"
   #     - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
 
   #     # Router for HTTPS with TLS
-  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.${DOMAIN}`)"
+  #     - "traefik.http.routers.n8n-https.rule=Host(`n8n.lazyworkhorse.net`)"
   #     - "traefik.http.routers.n8n-https.entrypoints=websecure"
   #     - "traefik.http.routers.n8n-https.tls=true"
   #     - "traefik.http.routers.n8n-https.tls.certresolver=njalla"
@@ -286,15 +264,15 @@ networks:
   #     - BROWSER_CDP_URL=http://openclaw-browser:9222
   #     - BROWSER_EVALUATE_ENABLED=true
   #     - OPENCLAW_GATEWAY_HOST=0.0.0.0
-  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.${DOMAIN}
+  #     - OPENCLAW_ALLOWED_ORIGINS=https://claw.lazyworkhorse.net
   #   labels:
   #     - "traefik.enable=true"
 
-  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.${DOMAIN}`)"
+  #     - "traefik.http.routers.openclaw-http.rule=Host(`claw.lazyworkhorse.net`)"
   #     - "traefik.http.routers.openclaw-http.entrypoints=web"
   #     - "traefik.http.routers.openclaw-http.middlewares=redirect-to-https"
 
-  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.${DOMAIN}`)"
+  #     - "traefik.http.routers.openclaw-https.rule=Host(`claw.lazyworkhorse.net`)"
   #     - "traefik.http.routers.openclaw-https.priority=50"
   #     - "traefik.http.routers.openclaw-https.entrypoints=websecure"
   #     - "traefik.http.routers.openclaw-https.tls=true"

ai/llama-cpp/Dockerfile

@@ -0,0 +1,30 @@
+# llama-cpp-rocm6/Dockerfile
+# Custom llama.cpp server with ROCm 6.1 + gfx906 (MI50) support.
+# Build: docker build -t llama-cpp:rocm-gfx906 .
+
+FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl git build-essential pkg-config cmake make && rm -rf /var/lib/apt/lists/*
+ARG LLAMACPP_VERSION=b9596
+RUN git clone --depth 1 --branch ${LLAMACPP_VERSION} https://github.com/ggml-org/llama.cpp.git /build
+WORKDIR /build
+ENV HIP_PATH=/opt/rocm ROCM_PATH=/opt/rocm PATH=/opt/rocm/bin:/opt/rocm/llvm/bin:${PATH} CMAKE_PREFIX_PATH=/opt/rocm
+RUN mkdir build && cd build && \
+    cmake .. -DGGML_HIP=ON -DCMAKE_BUILD_TYPE=Release \
+      -DAMDGPU_TARGETS="gfx906:xnack-" \
+      -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+      -DGGML_CUDA=OFF -DGGML_VULKAN=OFF -DGGML_METAL=OFF \
+      -DBUILD_SHARED_LIBS=OFF && \
+    cmake --build . --target llama-server -- -j $(nproc)
+
+FROM ubuntu:24.04
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    ca-certificates curl libstdc++6 libgomp1 libopenblas0 \
+    libnuma1 libelf1 libdrm2 libdrm-amdgpu1 \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
+COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
+COPY --from=builder /build/build/bin/llama-server /usr/local/bin/llama-server
+RUN echo /opt/rocm/lib > /etc/ld.so.conf.d/rocm.conf && ldconfig
+ENV HSA_OVERRIDE_GFX_VERSION=9.0.6 HCC_AMDGPU_TARGET=gfx906 HSA_ENABLE_SDMA=0
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/llama-server"]

authentification/compose.yml

@@ -13,12 +13,12 @@ services:
       - "traefik.enable=true"
 
       # HTTP router
-      - "traefik.http.routers.authelia-http.rule=Host(`auth.${DOMAIN}`)"
+      - "traefik.http.routers.authelia-http.rule=Host(`auth.lazyworkhorse.net`)"
       - "traefik.http.routers.authelia-http.entrypoints=web"
       - "traefik.http.routers.authelia-http.middlewares=redirect-to-https"
 
       # HTTPS router
-      - "traefik.http.routers.authelia-https.rule=Host(`auth.${DOMAIN}`)"
+      - "traefik.http.routers.authelia-https.rule=Host(`auth.lazyworkhorse.net`)"
       - "traefik.http.routers.authelia-https.entrypoints=websecure"
       - "traefik.http.routers.authelia-https.tls=true"
       - "traefik.http.routers.authelia-https.tls.certresolver=njalla"
@@ -26,7 +26,7 @@ services:
       - "traefik.http.services.authelia.loadbalancer.server.port=9091"
 
       # forward auth middleware definition
-      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}"
+      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net"
       - "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
       - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
 

backup/compose.yml

@@ -37,12 +37,12 @@ services:
   #   labels:
   #     - "traefik.enable=true"
   #     # 1. HTTP to HTTPS Redirect
-  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.${DOMAIN}`)"
+  #     - "traefik.http.routers.kopia-http.rule=Host(`backup.lazyworkhorse.net`)"
   #     - "traefik.http.routers.kopia-http.entrypoints=web"
   #     - "traefik.http.routers.kopia-http.middlewares=redirect-to-https@docker"
   #     
   #     # 2. HTTPS Configuration
-  #     - "traefik.http.routers.kopia.rule=Host(`backup.${DOMAIN}`)"
+  #     - "traefik.http.routers.kopia.rule=Host(`backup.lazyworkhorse.net`)"
   #     - "traefik.http.routers.kopia.entrypoints=websecure"
   #     - "traefik.http.routers.kopia.tls=true"
   #     - "traefik.http.routers.kopia.tls.certresolver=njalla"
@@ -81,12 +81,12 @@ services:
     labels:
       - "traefik.enable=true"
       # 1. HTTP to HTTPS Redirect
-      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.${DOMAIN}`)"
+      - "traefik.http.routers.restic-browser-http.rule=Host(`backup.lazyworkhorse.net`)"
       - "traefik.http.routers.restic-browser-http.entrypoints=web"
       - "traefik.http.routers.restic-browser-http.middlewares=redirect-to-https@docker"
       
       # 2. HTTPS Configuration
-      - "traefik.http.routers.restic-browser.rule=Host(`backup.${DOMAIN}`)"
+      - "traefik.http.routers.restic-browser.rule=Host(`backup.lazyworkhorse.net`)"
       - "traefik.http.routers.restic-browser.entrypoints=websecure"
       - "traefik.http.routers.restic-browser.tls=true"
       - "traefik.http.routers.restic-browser.tls.certresolver=njalla"

cloudstorage/compose.yml

@@ -17,8 +17,8 @@ services:
       - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
       # Reverse Proxy Overrides (Crucial for HTTPS behind Traefik)
       - OVERWRITEPROTOCOL=https
-      - OVERWRITECLIURL=https://cloud.${DOMAIN}
+      - OVERWRITECLIURL=https://cloud.lazyworkhorse.net
-      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.${DOMAIN}
+      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.lazyworkhorse.net
     volumes:
       - /mnt/HoardingCow_docker_data/NextCloud/data:/var/www/html:rw
     depends_on:
@@ -27,12 +27,12 @@ services:
       - "traefik.enable=true"
 
       # Router for HTTP -> HTTPS Redirection (Matching your Gitea style)
-      - "traefik.http.routers.nextcloud-http.rule=Host(`cloud.${DOMAIN}`)"
+      - "traefik.http.routers.nextcloud-http.rule=Host(`cloud.lazyworkhorse.net`)"
       - "traefik.http.routers.nextcloud-http.entrypoints=web"
       - "traefik.http.routers.nextcloud-http.middlewares=redirect-to-https"
 
       # Router for HTTPS
-      - "traefik.http.routers.nextcloud-https.rule=Host(`cloud.${DOMAIN}`)"
+      - "traefik.http.routers.nextcloud-https.rule=Host(`cloud.lazyworkhorse.net`)"
       - "traefik.http.routers.nextcloud-https.entrypoints=websecure"
       - "traefik.http.routers.nextcloud-https.tls=true"
       - "traefik.http.routers.nextcloud-https.tls.certresolver=njalla"

coms/compose.yml

@@ -25,10 +25,10 @@ services:
         condition: service_healthy
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.matrix-http.rule=Host(`matrix.${DOMAIN}`)"
+      - "traefik.http.routers.matrix-http.rule=Host(`matrix.lazyworkhorse.net`)"
       - "traefik.http.routers.matrix-http.entrypoints=web"
       - "traefik.http.routers.matrix-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.matrix-https.rule=Host(`matrix.${DOMAIN}`)"
+      - "traefik.http.routers.matrix-https.rule=Host(`matrix.lazyworkhorse.net`)"
       - "traefik.http.routers.matrix-https.entrypoints=websecure"
       - "traefik.http.routers.matrix-https.tls=true"
       - "traefik.http.routers.matrix-https.tls.certresolver=njalla"
@@ -62,10 +62,10 @@ services:
       - coms_net
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.${DOMAIN}`)"
+      - "traefik.http.routers.synapse-admin-http.rule=Host(`synadm.lazyworkhorse.net`)"
       - "traefik.http.routers.synapse-admin-http.entrypoints=web"
       - "traefik.http.routers.synapse-admin-http.middlewares=redirect-to-https"
-      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.${DOMAIN}`)"
+      - "traefik.http.routers.synapse-admin-https.rule=Host(`synadm.lazyworkhorse.net`)"
       - "traefik.http.routers.synapse-admin-https.entrypoints=websecure"
       - "traefik.http.routers.synapse-admin-https.tls=true"
       - "traefik.http.routers.synapse-admin-https.tls.certresolver=njalla"
@@ -88,12 +88,12 @@ services:
   #     - "traefik.enable=true"
   #
   #     # HTTP → HTTPS
-  #     - "traefik.http.routers.rns-http.rule=Host(`nomad.${DOMAIN}`)"
+  #     - "traefik.http.routers.rns-http.rule=Host(`nomad.lazyworkhorse.net`)"
   #     - "traefik.http.routers.rns-http.entrypoints=web"
   #     - "traefik.http.routers.rns-http.middlewares=redirect-to-https"
   #
   #     # HTTPS protected by Authelia
-  #     - "traefik.http.routers.rns-https.rule=Host(`nomad.${DOMAIN}`)"
+  #     - "traefik.http.routers.rns-https.rule=Host(`nomad.lazyworkhorse.net`)"
   #     - "traefik.http.routers.rns-https.entrypoints=websecure"
   #     - "traefik.http.routers.rns-https.tls=true"
   #     - "traefik.http.routers.rns-https.tls.certresolver=njalla"

finance/compose.yml

@@ -15,20 +15,20 @@ services:
       - "traefik.enable=true"
 
       # HTTP → HTTPS redirect
-      - "traefik.http.routers.fava-http.rule=Host(`money.${DOMAIN}`)"
+      - "traefik.http.routers.fava-http.rule=Host(`money.lazyworkhorse.net`)"
       - "traefik.http.routers.fava-http.entrypoints=web"
       - "traefik.http.routers.fava-http.middlewares=redirect-to-https"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
       # HTTPS router protected by Authelia
-      - "traefik.http.routers.fava-https.rule=Host(`money.${DOMAIN}`)"
+      - "traefik.http.routers.fava-https.rule=Host(`money.lazyworkhorse.net`)"
       - "traefik.http.routers.fava-https.entrypoints=websecure"
       - "traefik.http.routers.fava-https.tls=true"
       - "traefik.http.routers.fava-https.tls.certresolver=njalla"
       - "traefik.http.routers.fava-https.middlewares=fava-auth"
 
       # Authelia forwardAuth
-      - "traefik.http.middlewares.fava-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}/"
+      - "traefik.http.middlewares.fava-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
       - "traefik.http.middlewares.fava-auth.forwardauth.trustforwardheader=true"
       - "traefik.http.middlewares.fava-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
 

homeautomation/compose.yml

@@ -17,11 +17,11 @@ services:
     labels:
       - "traefik.enable=true"
 
-      - "traefik.http.routers.hass-http.rule=Host(`home.${DOMAIN}`)"
+      - "traefik.http.routers.hass-http.rule=Host(`home.lazyworkhorse.net`)"
       - "traefik.http.routers.hass-http.entrypoints=web"
       - "traefik.http.routers.hass-http.middlewares=redirect-to-https"
 
-      - "traefik.http.routers.hass-https.rule=Host(`home.${DOMAIN}`)"
+      - "traefik.http.routers.hass-https.rule=Host(`home.lazyworkhorse.net`)"
       - "traefik.http.routers.hass-https.entrypoints=websecure"
       - "traefik.http.routers.hass-https.tls.certresolver=njalla"
 

homepage/compose.yml

@@ -16,20 +16,20 @@ services:
       - "traefik.enable=true"
 
       # HTTP → HTTPS redirect
-      - "traefik.http.routers.homer-http.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.homer-http.rule=Host(`lazyworkhorse.net`)"
       - "traefik.http.routers.homer-http.entrypoints=web"
       - "traefik.http.routers.homer-http.middlewares=redirect-to-https"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
       # HTTPS router protected by Authelia
-      - "traefik.http.routers.homer-https.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.homer-https.rule=Host(`lazyworkhorse.net`)"
       - "traefik.http.routers.homer-https.entrypoints=websecure"
       - "traefik.http.routers.homer-https.tls=true"
       - "traefik.http.routers.homer-https.tls.certresolver=njalla"
       - "traefik.http.routers.homer-https.middlewares=homer-auth"
 
       # Authelia forwardAuth
-      - "traefik.http.middlewares.homer-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}/"
+      - "traefik.http.middlewares.homer-auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.lazyworkhorse.net/"
       - "traefik.http.middlewares.homer-auth.forwardauth.trustforwardheader=true"
       - "traefik.http.middlewares.homer-auth.forwardauth.authresponseheaders=X-Forwarded-User,X-Forwarded-Groups"
 

passwordmanager/compose.yml

@@ -9,10 +9,7 @@ services:
       - TZ=America/Montreal
       - WEBSOCKET_ENABLED=true
       - SIGNUPS_ALLOWED=false
-      # Vaultwarden env var DOMAIN — the ${DOMAIN} on the RHS is expanded
+      - DOMAIN=https://pass.lazyworkhorse.net
-      # by docker compose before the env var is set, so this resolves to
-      # DOMAIN=https://pass.lazyworkhorse.net in production.
-      - DOMAIN=https://pass.${DOMAIN}
     volumes:
       - /mnt/HoardingCow_docker_data/BitWarden/data:/data:rw
     networks:
@@ -22,12 +19,12 @@ services:
       - "traefik.enable=true"
 
       # HTTP → HTTPS
-      - "traefik.http.routers.pass-http.rule=Host(`pass.${DOMAIN}`)"
+      - "traefik.http.routers.pass-http.rule=Host(`pass.lazyworkhorse.net`)"
       - "traefik.http.routers.pass-http.entrypoints=web"
       - "traefik.http.routers.pass-http.middlewares=redirect-to-https"
 
       # HTTPS
-      - "traefik.http.routers.pass-https.rule=Host(`pass.${DOMAIN}`)"
+      - "traefik.http.routers.pass-https.rule=Host(`pass.lazyworkhorse.net`)"
       - "traefik.http.routers.pass-https.entrypoints=websecure"
       - "traefik.http.routers.pass-https.tls=true"
       - "traefik.http.routers.pass-https.tls.certresolver=njalla"

tak/compose.yml

@@ -74,12 +74,12 @@ services:
       - "traefik.docker.network=traefik-net"
 
       # HTTP -> HTTPS Redirect
-      - "traefik.http.routers.fts-ui-http.rule=Host(`tak.${DOMAIN}`)"
+      - "traefik.http.routers.fts-ui-http.rule=Host(`tak.lazyworkhorse.net`)"
       - "traefik.http.routers.fts-ui-http.entrypoints=web"
       - "traefik.http.routers.fts-ui-http.middlewares=redirect-to-https"
 
       # HTTPS Router
-      - "traefik.http.routers.fts-ui-https.rule=Host(`tak.${DOMAIN}`)"
+      - "traefik.http.routers.fts-ui-https.rule=Host(`tak.lazyworkhorse.net`)"
       - "traefik.http.routers.fts-ui-https.entrypoints=websecure"
       - "traefik.http.routers.fts-ui-https.tls=true"
       - "traefik.http.routers.fts-ui-https.tls.certresolver=njalla"

versioncontrol/compose.yml

@@ -6,7 +6,7 @@ services:
     environment:
       - USER_UID=1000
       - USER_GID=1000
-      - GITEA__server__ROOT_URL=https://code.${DOMAIN}
+      - GITEA__server__ROOT_URL=https://code.lazyworkhorse.net
       - GITEA__actions__ENABLED=true
       - SSH_PORT=2222
       - SSH_LISTEN_PORT=2222
@@ -23,21 +23,21 @@ services:
       - "traefik.enable=true"
 
       # HTTP -> HTTPS Redirect
-      - "traefik.http.routers.gitea-http.rule=Host(`code.${DOMAIN}`)"
+      - "traefik.http.routers.gitea-http.rule=Host(`code.lazyworkhorse.net`)"
       - "traefik.http.routers.gitea-http.entrypoints=web"
       - "traefik.http.routers.gitea-http.middlewares=redirect-to-https"
       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
 
       # HTTPS Router
-      - "traefik.http.routers.gitea-https.rule=Host(`code.${DOMAIN}`)"
+      - "traefik.http.routers.gitea-https.rule=Host(`code.lazyworkhorse.net`)"
       - "traefik.http.routers.gitea-https.entrypoints=websecure"
       - "traefik.http.routers.gitea-https.tls=true"
       - "traefik.http.routers.gitea-https.tls.certresolver=njalla"
       - "traefik.http.routers.gitea-https.middlewares=gitea-home-redirect"
 
       # The Redirect Logic - Using single quotes to allow backslashes
-      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.regex=^https://code\.${DOMAIN}/?$$'
+      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.regex=^https://code\.lazyworkhorse\.net/?$$'
-      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.replacement=https://code.${DOMAIN}/gortium'
+      - 'traefik.http.middlewares.gitea-home-redirect.redirectregex.replacement=https://code.lazyworkhorse.net/gortium'
       - "traefik.http.middlewares.gitea-home-redirect.redirectregex.permanent=true"
 
       # Internal Routing
@@ -47,7 +47,7 @@ services:
     image: gitea/act_runner:latest
     container_name: act_runner
     environment:
-      - GITEA_INSTANCE_URL=https://code.${DOMAIN}
+      - GITEA_INSTANCE_URL=https://code.lazyworkhorse.net
       - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_TOKEN}
       - GITEA_RUNNER_NAME=ai-host-runner
       - GITEA_RUNNER_LABELS=ubuntu-latest:docker://catthehacker/ubuntu:full-22.04,nixos-builder:docker://nixos/nix

vpn/compose.yml

@@ -11,7 +11,7 @@ services:
       - NET_ADMIN
       - SYS_MODULE
     environment:
-      - WG_HOST=vpn.${DOMAIN}
+      - WG_HOST=vpn.lazyworkhorse.net
       - PASSWORD=${WG_PASSWORD}
       - WG_PORT=51820
       - WG_DEFAULT_ADDRESS=10.8.0.x