FC

2025-04-14 19:51:40 +02:00 · 2025-04-14 19:51:40 +02:00 · 47aa1a3484
commit 47aa1a3484
parent 28dac0c412
71 changed files with 3317 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
 .env
--- a/containers/Bastille/Bastille.md
+++ b/containers/Bastille/Bastille.md
@ -0,0 +1,213 @@
 # Bastille
 This is my guide for getting Bastille BSD up-and-running.
 First make sure that FreeBSD is up-to-date:
 *NOTE* This takes a *long* time on a Raspberry PI. Only do this if you have a lot of time on your hands!
 You may be smart to `tmux` first.
 ```sh
 tmux
 ```
 ```sh
 freebsd-update fetch install
 ```
 ```sh
 reboot
 ```
 After reboot, check again:
 ```sh
 freebsd-update install
 ```
 Verify your version:
 ```sh
 freebsd-version
 ```
 ## Setup
 First we need to make a backup of `pf.conf`, if you already setup pf before, otherwise you can skip this step.
 ```sh
 mv /etc/pf.conf /etc/pf.conf.backup
 ```
 And then
 ```sh
 bastille setup
 ```
 This will setup the loopback interface and create a `/etc/pf.conf`.
 You need to manually add the following to `/etc/pf.conf`, at the bottom, in order to allow http, https and RDP:
 ```
 pass in inet proto tcp from any to any port { 80, 443, 3389 } flags S/SA keep state
 ```
 Then start it:
 ```sh
 service pf start
 ```
 The `bastille setup` will try to configure the wrong config file and complain. We need to fix the zfs stuff manually.
 And change, assuming you created a zpool named `data`.
 For example (WATCH OUT, BELOW COMMAND IS DANGEROUS):
 ```sh
 zpool create -f data /dev/ada0
 ```
 Change bastille.conf
 ```sh
 nvim /usr/local/etc/bastille/bastille.conf
 ```
 ```
 bastille_zfs_enable="YES"                                               
 bastille_zfs_zpool="data"
 ```
 And just in case, run the setup again:
 ```sh
 bastille setup zfs
 ```
 ## Start
 Ok, now start Bastille:
 ```sh
 service bastille restart
 ```
 Bootstrap:
 ```sh
 bastille bootstrap 14.2-RELEASE update
 ```
 ## Create a container
 Figure out your network card:
 ```sh
 ifconfig
 ```
 You don't want the loopback but your real card that connects to the internet. The KVM virtual machine has `vtnet0` and the Raspberry PI has `genet0`, the Lenovo Thinkcentre has `em0`.
 ```sh
 # Lenovo Thinkcentre 
 bastille create alcatraz 14.2-RELEASE 192.168.1.201 em0
 ```
 If you want to have exlusive packages in the jail and not share the host packages, do this:
 ```sh
 bastille pkg alcatraz bootstrap
 bastille pkg alcatraz update
 ```
 Alternatively, you can mount the package cache:
 ```sh
 # Optional
 bastille mount alcatraz /var/cache/pkg/ /var/cache/pkg/ nullfs rw 0 0
 ```
 I like to install my favorites since I use them quite often:
 ```sh
 bastille pkg alcatraz install -y tmux git neovim
 ```
 Test it:
 ```sh
 bastille pkg alcatraz install -y apache24
 bastille sysrc alcatraz apache24_enable=YES
 bastille service alcatraz apache24 start
 ```
 Now go to the ip address with your browser on another machine:
 http://192.168.1.201/
 You should see "It works!"
 Alternatively:
 ```sh
 curl http://192.168.1.201/
 ```
 You should see:
 ```html
 <html><body><h1>It works!</h1></body></html>
 ```
 Now destroy it:
 ```sh
 bastille stop alcatraz
 bastille destroy force alcatraz
 ```
 # Using ports
 ```sh
 bastille create alcatraz 14.2-RELEASE 192.168.1.201 em0
 bastille pkg alcatraz bootstrap
 bastille pkg alcatraz update
 bastille pkg alcatraz install -y git
 bastille cmd alcatraz git clone --depth 1 https://git.FreeBSD.org/ports.git /usr/ports
 ```
 and then go in the console:
 ```sh
 bastille console alcatraz
 ```
 within the console...
 ```sh
 export BATCH=yes
 cd /usr/ports/www/apache24/ && make install clean
 exit
 ```
 enable and start it ...
 ```sh
 bastille sysrc alcatraz apache24_enable=YES
 bastille service alcatraz apache24 start
 ```
 Test it:
 ```sh
 curl http://192.168.1.201/
 ```
 Destroy it:
 ```sh
 bastille destroy force alcatraz
 ```
--- a/containers/Bastille/Caddy.md
+++ b/containers/Bastille/Caddy.md
@ -0,0 +1,42 @@
 # Caddy
 ```sh
 bastille create caddy 14.2-RELEASE 192.168.1.200 genet0
 bastille pkg caddy bootstrap
 bastille pkg caddy update
 bastille pkg caddy install -y caddy
 ```
 After installing Caddy you see some instructions. To reshow them:
 ```sh
 bastille pkg caddy info -D caddy
 ```
 Edit the Caddyfile:
 ```sh
 bastille pkg caddy install -y tmux neovim
 bastille console caddy
 tmux
 nvim /usr/local/etc/caddy/Caddyfile
 ```
 Start the service. 
 ```sh
 bastille service caddy caddy enable
 bastille service caddy caddy start
 ```
 See the logs:
 ```sh
 bastille cmd caddy cat /var/log/caddy/caddy.log
 ```
 To quickly look at the caddyfile:
 ```sh
 bastille cmd caddy cat /usr/local/etc/caddy/Caddyfile
 ```
--- a/containers/Bastille/MariaDB.md
+++ b/containers/Bastille/MariaDB.md
@ -0,0 +1,31 @@
 # MariaDB
 ```sh
 bastille pkg alcatraz install -y mariadb114-server mariadb114-client
 ```
 Repeat the message:
 ```sh
 bastille pkg alcatraz info -D mariadb114-server 
 ```
 Enable and start
 ```sh
 bastille sysrc alcatraz mysql_enable=YES
 bastille service alcatraz mysql-server start
 ```
 Create nextcloud database and user
 ```sh
 bastille cmd alcatraz mysql
 ```
 ```sql
 CREATE DATABASE nextcloud;
 CREATE USER 'nextcloud'@'192.168.1.201' IDENTIFIED BY '1234sys!';
 GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextcloud'@'192.168.1.201';
 FLUSH PRIVILEGES;
 ```
--- a/containers/Bastille/Nextcloud/Nextcloud.md
+++ b/containers/Bastille/Nextcloud/Nextcloud.md
@ -0,0 +1,73 @@
 # Nextcloud
 My standard setup:
 ```sh
 bastille create alcatraz 14.2-RELEASE 192.168.1.201 em0
 bastille mount alcatraz /var/cache/pkg/ /var/cache/pkg/ nullfs rw 0 0
 bastille pkg alcatraz install -y tmux git neovim sudo
 ```
 ## Trying it my way
 ```sh
 bastille pkg alcatraz install -y php83 nextcloud-php83 php83-pecl-APCu php83-extensions sd nginx
 ```
 Repeat the message:
 ```sh
 bastille pkg alcatraz info -D www/nextcloud
 ```
 Additional:
 ```sh
 bastille cmd alcatraz cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini
 bastille cmd alcatraz sd 'memory_limit = 128M' 'memory_limit = -1' /usr/local/etc/php.ini
 ```
 We need to go in and out of the console for this one:
 ```sh
 bastille console alcatraz
 echo 'apc.enable_cli = 1' >> /usr/local/etc/php.ini
 exit
 ```
 Follow the instructions for [MariaDB](../MariaDB.md).
 Now run the installer
 ```sh
 bastille cmd alcatraz sudo -u www php /usr/local/www/nextcloud/occ maintenance:install \
 --database='mysql' --database-host='127.0.0.1' --database-name='nextcloud' \
 --database-user='nextcloud' --database-pass='1234sys!' \
 --admin-user='admin' --admin-pass='1234sys!'
 ```
 You should see:
 ```
 [alcatraz]:
 Nextcloud was successfully installed
 [alcatraz]: 0
 ```
 Edit nginx.conf for nextcloud. 
 ```sh
 bastille cmd alcatraz nvim /usr/local/etc/nginx/nginx.conf
 ```
 Use [this file](./nginx.conf). 
 It's based on: https://docs.nextcloud.com/server/stable/admin_manual/installation/nginx.html#nextcloud-in-the-webroot-of-nginx
 ```sh
 bastille service alcatraz php_fpm enable
 bastille service alcatraz php_fpm start
 bastille service alcatraz nginx enable
 bastille service alcatraz nginx start
 ```
--- a/containers/Bastille/Nextcloud/nginx.conf
+++ b/containers/Bastille/Nextcloud/nginx.conf
@ -0,0 +1,265 @@
 #user  nobody;
 worker_processes  1;
 # This default error log path is compiled-in to make sure configuration parsing
 # errors are logged somewhere, especially during unattended boot when stderr
 # isn't normally logged anywhere. This path will be touched on every nginx
 # start regardless of error log location configured here. See
 # https://trac.nginx.org/nginx/ticket/147 for more info. 
 #
 #error_log  /var/log/nginx/error.log;
 #
 #pid        logs/nginx.pid;
 events {
        worker_connections  1024;
 }
 http {
        include       mime.types;
        default_type  application/octet-stream;
        #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
        #                  '$status $body_bytes_sent "$http_referer" '
        #                  '"$http_user_agent" "$http_x_forwarded_for"';
        #access_log  logs/access.log  main;
        sendfile        on;
        #tcp_nopush     on;
        #keepalive_timeout  0;
        keepalive_timeout  65;
        #gzip  on;
        upstream php-handler {
                server 127.0.0.1:9000;
                #server unix:/var/run/php/php7.4-fpm.sock;
        }
        # Set the `immutable` cache control options only for assets with a cache busting `v` argument
        map $arg_v $asset_immutable {
                "" "";
                default ", immutable";
        }
        #       server {
        #               listen 80;
        #               listen [::]:80;
        #               server_name cloud.example.com;
        #               # enforce https
        #               return 301 https://$server_name:443$request_uri;
        #       }
        server {
                #listen 80;
                #listen [::]:80;
                server_name 192.168.1.201;
                # Path to the root of your installation
                root /usr/local/www/nextcloud;
                # Use Mozilla's guidelines for SSL/TLS settings
                # https://mozilla.github.io/server-side-tls/ssl-config-generator/
                #ssl_certificate     /etc/ssl/nginx/cloud.example.com.crt;
                #ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;
                # Prevent nginx HTTP Server Detection
                server_tokens off;
                # HSTS settings
                # WARNING: Only add the preload option once you read about
                # the consequences in https://hstspreload.org/. This option
                # will add the domain to a hardcoded list that is shipped
                # in all major browsers and getting removed from this list
                # could take several months.
                #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
                # set max upload size and increase upload timeout:
                client_max_body_size 512M;
                client_body_timeout 300s;
                fastcgi_buffers 64 4K;
                # Enable gzip but do not remove ETag headers
                gzip on;
                gzip_vary on;
                gzip_comp_level 4;
                gzip_min_length 256;
                gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
                gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
                # Pagespeed is not supported by Nextcloud, so if your server is built
                # with the `ngx_pagespeed` module, uncomment this line to disable it.
                #pagespeed off;
                # The settings allows you to optimize the HTTP2 bandwidth.
                # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
                # for tuning hints
                client_body_buffer_size 512k;
                # HTTP response headers borrowed from Nextcloud `.htaccess`
                add_header Referrer-Policy                   "no-referrer"       always;
                add_header X-Content-Type-Options            "nosniff"           always;
                add_header X-Frame-Options                   "SAMEORIGIN"        always;
                add_header X-Permitted-Cross-Domain-Policies "none"              always;
                add_header X-Robots-Tag                      "noindex, nofollow" always;
                add_header X-XSS-Protection                  "1; mode=block"     always;
                # Remove X-Powered-By, which is an information leak
                fastcgi_hide_header X-Powered-By;
                # Set .mjs and .wasm MIME types
                # Either include it in the default mime.types list
                # and include that list explicitly or add the file extension
                # only for Nextcloud like below:
                include mime.types;
                types {
                        text/javascript mjs;
                        application/wasm wasm;
                }
                # Specify how to handle directories -- specifying `/index.php$request_uri`
                # here as the fallback means that Nginx always exhibits the desired behaviour
                # when a client requests a path that corresponds to a directory that exists
                # on the server. In particular, if that directory contains an index.php file,
                # that file is correctly served; if it doesn't, then the request is passed to
                # the front-end controller. This consistent behaviour means that we don't need
                # to specify custom rules for certain paths (e.g. images and other assets,
                # `/updater`, `/ocs-provider`), and thus
                # `try_files $uri $uri/ /index.php$request_uri`
                # always provides the desired behaviour.
                index index.php index.html /index.php$request_uri;
                # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
                location = / {
                        if ( $http_user_agent ~ ^DavClnt ) {
                                return 302 /remote.php/webdav/$is_args$args;
                        }
                }
                location = /robots.txt {
                        allow all;
                        log_not_found off;
                        access_log off;
                }
                # Make a regex exception for `/.well-known` so that clients can still
                # access it despite the existence of the regex rule
                # `location ~ /(\.|autotest|...)` which would otherwise handle requests
                # for `/.well-known`.
                location ^~ /.well-known {
                        # The rules in this block are an adaptation of the rules
                        # in `.htaccess` that concern `/.well-known`.
                        location = /.well-known/carddav { return 301 /remote.php/dav/; }
                        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
                        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
                        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
                        # Let Nextcloud's API for `/.well-known` URIs handle all other
                        # requests by passing them to the front-end controller.
                        return 301 /index.php$request_uri;
                }
                # Rules borrowed from `.htaccess` to hide certain paths from clients
                location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
                location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
                # Ensure this block, which passes PHP files to the PHP process, is above the blocks
                # which handle static assets (as seen below). If this block is not declared first,
                # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
                # to the URI, resulting in a HTTP 500 error response.
                location ~ \.php(?:$|/) {
                        # Required for legacy support
                        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
                        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                        set $path_info $fastcgi_path_info;
                        try_files $fastcgi_script_name =404;
                        include fastcgi_params;
                        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                        fastcgi_param PATH_INFO $path_info;
                        fastcgi_param HTTPS on;
                        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
                        fastcgi_param front_controller_active true;     # Enable pretty urls
                        fastcgi_pass php-handler;
                        fastcgi_intercept_errors on;
                        fastcgi_request_buffering off;
                        fastcgi_max_temp_file_size 0;
                }
                # Serve static files
                location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
                        try_files $uri /index.php$request_uri;
                        # HTTP response headers borrowed from Nextcloud `.htaccess`
                        add_header Cache-Control                     "public, max-age=15778463$asset_immutable";
                        add_header Referrer-Policy                   "no-referrer"       always;
                        add_header X-Content-Type-Options            "nosniff"           always;
                        add_header X-Frame-Options                   "SAMEORIGIN"        always;
                        add_header X-Permitted-Cross-Domain-Policies "none"              always;
                        add_header X-Robots-Tag                      "noindex, nofollow" always;
                        add_header X-XSS-Protection                  "1; mode=block"     always;
                        access_log off;     # Optional: Don't log access to assets
                }
                location ~ \.(otf|woff2?)$ {
                        try_files $uri /index.php$request_uri;
                        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
                        access_log off;     # Optional: Don't log access to assets
                }
                # Rule borrowed from `.htaccess`
                location /remote {
                        return 301 /remote.php$request_uri;
                }
                location / {
                        try_files $uri $uri/ /index.php$request_uri;
                }
        }
        # another virtual host using mix of IP-, name-, and port-based configuration
        #
        #server {
        #    listen       8000;
        #    listen       somename:8080;
        #    server_name  somename  alias  another.alias;
        #    location / {
        #        root   html;
        #        index  index.html index.htm;
        #    }
        #}
        # HTTPS server
        #
        #server {
        #    listen       443 ssl;
        #    server_name  localhost;
        #    ssl_certificate      cert.pem;
        #    ssl_certificate_key  cert.key;
        #    ssl_session_cache    shared:SSL:1m;
        #    ssl_session_timeout  5m;
        #    ssl_ciphers  HIGH:!aNULL:!MD5;
        #    ssl_prefer_server_ciphers  on;
        #    location / {
        #        root   html;
        #        index  index.html index.htm;
        #    }
        #}
 }
--- a/containers/Bastille/Postgres.md
+++ b/containers/Bastille/Postgres.md
@ -0,0 +1,54 @@
 # Postgres
 ```sh
 bastille create postgresql 14.2-RELEASE 192.168.1.203 em0
 bastille config postgresql set allow.sysvipc=1
 bastille restart postgresql
 bastille pkg postgresql bootstrap
 bastille pkg postgresql update
 bastille pkg postgresql install -y postgresql15-server postgresql15-client
 bastille service postgresql postgresql enable
 bastille service postgresql postgresql initdb
 bastille service postgresql postgresql start
 ```
 You need to change `/var/db/postgres/data15/postgresql.conf`
 ```sh
 nvim /var/db/postgres/data15/postgresql.conf
 ```
 To listen to the ip address:
 ```
 listen_addresses = '192.168.1.203'
 ```
 And restart.
 We need to allow communications via the jails. Add this to pf.conf on the host:
 ```
 pass in on $ext_if proto tcp from 192.168.1.202 to 192.168.1.203 port 5432
 pass out on $ext_if proto tcp from 192.168.1.203 to 192.168.1.202 port 5432
 ```
 Add a user, for example nextcloud:
 ```sh
 su - postgres
 createuser nextcloud
 createdb nextcloud -O admin
 psql nextcloud
 alter role nextcloud with encrypted password 'yourpassword';
 grant all privileges on database nextcloud to nextcloud;
 exit
 exit
 ```
 Add this to `/var/db/postgres/data15/pg_hba.conf`
 ```
 host    nextcloud       nextcloud       0.0.0.0/0               scram-sha-256
 host    nextcloud       nextcloud       ::/0                    scram-sha-256
 ```
--- a/containers/Bastille/nginx.md
+++ b/containers/Bastille/nginx.md
@ -0,0 +1,10 @@
 # nginx
 ```sh
 bastille create nginx 14.2-RELEASE 192.168.1.200 genet0
 bastille pkg nginx bootstrap
 bastille pkg nginx update
 bastille pkg nginx install -y nginx
 bastille service nginx nginx enable
 bastille service nginx nginx start
 ```
--- a/containers/docker/audiobookshelf/compose.yaml
+++ b/containers/docker/audiobookshelf/compose.yaml
@ -0,0 +1,13 @@
 services:
  audiobookshelf:
    image: ghcr.io/advplyr/audiobookshelf:latest
      # user: 1004:1004
    ports:
      - 13378:80
    volumes:
      - /home/audiobookshelf/audiobookshelf/audiobooks:/audiobooks
      - /home/audiobookshelf/audiobookshelf/podcasts:/podcasts
      - /home/audiobookshelf/audiobookshelf/config:/config
      - /home/audiobookshelf/audiobookshelf/metadata:/metadata
    environment:
      - TZ=Europe/Amsterdam
--- a/containers/docker/httpd/compose.yaml
+++ b/containers/docker/httpd/compose.yaml
@ -0,0 +1,9 @@
 services:
  httpd:
    image: httpd
    restart: always
    ports:
      - 8081:80
    # volumes:
    #   - ./www:/usr/local/apache2/htdocs
--- a/containers/docker/httpd/www/index.html
+++ b/containers/docker/httpd/www/index.html
@ -0,0 +1,8 @@
 <html>
    <head>
        <title>Hello world!</title>
    </head>
    <body>
        <p>Hello world!</p>
    </body>
 </html>
--- a/containers/docker/immich/compose.yaml
+++ b/containers/docker/immich/compose.yaml
@ -0,0 +1,84 @@
 # You need to get the example .env file:
 # wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env
 name: immich
 services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    extends:
      file: hwaccel.transcoding.yml
      service: quicksync # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - /home/immich/external/:/external
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false
  redis:
    container_name: immich_redis
    image: docker.io/redis:6.2-alpine@sha256:eaba718fecd1196d88533de7ba49bf903ad33664a92debb24660a922ecd9cac8
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always
  database:
    container_name: immich_postgres
    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    healthcheck:
      test: >-
        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1;
        Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align
        --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')";
        echo "checksum failure count is $$Chksum";
        [ "$$Chksum" = '0' ] || exit 1
      interval: 5m
      start_interval: 30s
      start_period: 5m
    command: >-
      postgres
      -c shared_preload_libraries=vectors.so
      -c 'search_path="$$user", public, vectors'
      -c logging_collector=on
      -c max_wal_size=2GB
      -c shared_buffers=512MB
      -c wal_compression=on
    restart: always
 volumes:
  model-cache:
--- a/containers/docker/immich/hwaccel.transcoding.yml
+++ b/containers/docker/immich/hwaccel.transcoding.yml
@ -0,0 +1,54 @@
 # Configurations for hardware-accelerated transcoding
 # If using Unraid or another platform that doesn't allow multiple Compose files,
 # you can inline the config for a backend by copying its contents
 # into the immich-microservices service in the docker-compose.yml file.
 # See https://immich.app/docs/features/hardware-transcoding for more info on using hardware transcoding.
 services:
  cpu: {}
  nvenc:
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities:
                - gpu
                - compute
                - video
  quicksync:
    devices:
      - /dev/dri:/dev/dri
  rkmpp:
    security_opt: # enables full access to /sys and /proc, still far better than privileged: true
      - systempaths=unconfined
      - apparmor=unconfined
    group_add:
      - video
    devices:
      - /dev/rga:/dev/rga
      - /dev/dri:/dev/dri
      - /dev/dma_heap:/dev/dma_heap
      - /dev/mpp_service:/dev/mpp_service
      #- /dev/mali0:/dev/mali0 # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
    volumes:
      #- /etc/OpenCL:/etc/OpenCL:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
      #- /usr/lib/aarch64-linux-gnu/libmali.so.1:/usr/lib/aarch64-linux-gnu/libmali.so.1:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
  vaapi:
    devices:
      - /dev/dri:/dev/dri
  vaapi-wsl: # use this for VAAPI if you're running Immich in WSL2
    devices:
      - /dev/dri:/dev/dri
    volumes:
      - /usr/lib/wsl:/usr/lib/wsl
    environment:
      - LIBVA_DRIVER_NAME=d3d12
--- a/containers/docker/jellyfin/compose.yaml
+++ b/containers/docker/jellyfin/compose.yaml
@ -0,0 +1,30 @@
 services:
  jellyfin:
    image: jellyfin/jellyfin
    container_name: jellyfin
    user: 1003:1003
    network_mode: 'host'
    volumes:
      - /home/jellyfin/jellyfin/config:/config
      - /home/jellyfin/jellyfin/cache:/cache
      - type: bind
        source: /home/jellyfin/jellyfin/media
        target: /media
      # - type: bind
      #   source: /path/to/media2
      #   target: /media2
      #   read_only: true
      # Optional - extra fonts to be used during transcoding with subtitle burn-in
      # - type: bind
      #   source: /path/to/fonts
      #   target: /usr/local/share/fonts/custom
      #   read_only: true
    restart: 'unless-stopped'
    # Optional - alternative address used for autodiscovery
    # environment:
    #   - JELLYFIN_PublishedServerUrl=http://example.com
    # Optional - may be necessary for docker healthcheck to pass if running in host network mode
    # extra_hosts:
    #   - 'host.docker.internal:host-gateway'
    devices:
      - "/dev/dri:/dev/dri"                         # Intel QSV
--- a/containers/docker/multitenant/.gitignore
+++ b/containers/docker/multitenant/.gitignore
@ -0,0 +1,3 @@
 infra/nginx-proxy-manager_data/
 infra/portainer_data/
 lemmy/volumes/
--- a/containers/docker/multitenant/README.md
+++ b/containers/docker/multitenant/README.md
@ -0,0 +1,55 @@
 # multitenant
 ## nginx-proxy-manager
 ```sh
 docker network create infra
 ```
 Admin: http://127.0.0.1:81/
 ```
 admin@example.com
 changeme
 ```
 ## Wordpress
 We need to add domain names in our `/etc/hosts` file:
 ```
 127.0.0.1	moni0.codecompost.nl
 127.0.0.1	moni1.codecompost.nl
 ```
 And pass a project name to the docker-compose command:
 ```
 docker-compose -p moni0 up --build --force-recreate -d
 ```
 This will prepend `moni0_` to the containers (and add a `_1` apparently)
 ```
 Creating network "moni0_internal_network" with the default driver
 Creating volume "moni0_wordpress" with default driver
 Creating volume "moni0_db" with default driver
 Creating moni0_db_1        ... done
 Creating moni0_wordpress_1 ... done
 ```
 In the Nginx Proxy Manager, we can add the proxy host:
 ![moni0 wordpress proxy host](moni0_proxy_host.png)
 We can go ahead and start a second wordpress with:
 ```
 docker-compose -p moni1 up --build --force-recreate -d
 ```
 And then you can configure it like this:
 ![Alt text](moni1_proxy_host.png)
 Make sure that `moni1.codecompost.nl` is also in your hosts file, otherwise it won't work!
--- a/containers/docker/multitenant/infra/docker-compose.yml
+++ b/containers/docker/multitenant/infra/docker-compose.yml
@ -0,0 +1,31 @@
 version: '3.8'
 services:
  nginx-proxy-manager:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./nginx-proxy-manager_data/data:/data
      - ./nginx-proxy-manager_data/letsencrypt:/etc/letsencrypt
    networks:
      - infra
 #   portainer: 
 #     image: 'portainer/portainer-ce:latest'
 #     restart: always
 #     ports:
 #       - '8000:8000'
 #       - '9443:9443'
 #     volumes:
 #       - /var/run/docker.sock:/var/run/docker.sock
 #       - ./portainer_data:/data
 #     networks:
 #       - infra
 networks:
  infra:
    external: true
--- a/containers/docker/multitenant/jellyfin/run_with_podman.sh
+++ b/containers/docker/multitenant/jellyfin/run_with_podman.sh
@ -0,0 +1,12 @@
 podman run \
 --detach \
 --label "io.containers.autoupdate=registry" \
 --name jellyfin \
 --publish 8096:8096/tcp \
 --rm \
 --user $(id -u):$(id -g) \
 --userns keep-id \
 --volume jellyfin-cache:/cache:Z \
 --volume jellyfin-config:/config:Z \
 --mount type=bind,source=/home/moni/media/,destination=/media,ro=true,relabel=private \
 docker.io/jellyfin/jellyfin:latest
--- a/containers/docker/multitenant/lemmy/customPostgresql.conf
+++ b/containers/docker/multitenant/lemmy/customPostgresql.conf
@ -0,0 +1,30 @@
 # DB Version: 15
 # OS Type: linux
 # DB Type: web
 # Total Memory (RAM): 8 GB
 # CPUs num: 4
 # Data Storage: ssd
 max_connections = 200
 shared_buffers = 2GB
 effective_cache_size = 6GB
 maintenance_work_mem = 512MB
 checkpoint_completion_target = 0.9
 checkpoint_timeout = 86400
 wal_buffers = 16MB
 default_statistics_target = 100
 random_page_cost = 1.1
 effective_io_concurrency = 200
 work_mem = 5242kB
 min_wal_size = 1GB
 max_wal_size = 30GB
 max_worker_processes = 4
 max_parallel_workers_per_gather = 2
 max_parallel_workers = 4
 max_parallel_maintenance_workers = 2
 # Other custom params
 temp_file_size=1GB
 synchronous_commit=off
 # This one shouldn't be on regularly, because DB migrations often take a long time
 # statement_timeout = 10000
--- a/containers/docker/multitenant/lemmy/docker-compose.yml
+++ b/containers/docker/multitenant/lemmy/docker-compose.yml
@ -0,0 +1,114 @@
 version: "3.7"
 x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "50m"
    max-file: "4"
 services:
  proxy:
    image: nginx:1-alpine
    # ports:
    #   # actual and only port facing any connection from outside
    #   # Note, change the left number if port 1236 is already in use on your system
    #   # You could use port 80 if you won't use a reverse proxy
    #   - "1236:8536"
    volumes:
      - ./nginx_internal.conf:/etc/nginx/nginx.conf:ro,Z
    restart: always
    logging: *default-logging
    depends_on:
      - pictrs
      - lemmy-ui
    networks:
      - lemmy-internal
      - infra
  lemmy:
    image: dessalines/lemmy:latest
    hostname: lemmy
    restart: always
    logging: *default-logging
    environment:
      - RUST_LOG="warn"
      - LEMMY_CORS_ORIGIN=http://lemmy.codecompost.nl
    volumes:
      - ./lemmy.hjson:/config/config.hjson:Z
    depends_on:
      - postgres
      - pictrs
    networks:
      - lemmy-internal
  lemmy-ui:
    image: dessalines/lemmy-ui:latest
    environment:
      - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
      - LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.codecompost.nl
      - LEMMY_UI_HTTPS=true
    volumes:
      - ./volumes/lemmy-ui/extra_themes:/app/extra_themes
    depends_on:
      - lemmy
    restart: always
    logging: *default-logging
    networks:
      - lemmy-internal
  pictrs:
    image: asonix/pictrs:0.4.0-rc.7
    # this needs to match the pictrs url in lemmy.hjson
    hostname: pictrs
    # we can set options to pictrs like this, here we set max. image size and forced format for conversion
    # entrypoint: /sbin/tini -- /usr/local/bin/pict-rs -p /mnt -m 4 --image-format webp
    environment:
      - PICTRS_OPENTELEMETRY_URL=http://otel:4137
      - PICTRS__API_KEY=JmT3cMDL252EJw
      - RUST_LOG=debug
      - RUST_BACKTRACE=full
      - PICTRS__MEDIA__VIDEO_CODEC=vp9
      - PICTRS__MEDIA__GIF__MAX_WIDTH=256
      - PICTRS__MEDIA__GIF__MAX_HEIGHT=256
      - PICTRS__MEDIA__GIF__MAX_AREA=65536
      - PICTRS__MEDIA__GIF__MAX_FRAME_COUNT=400
    user: 991:991
    volumes:
      - ./volumes/pictrs:/mnt:Z
    restart: always
    logging: *default-logging
    deploy:
      resources:
        limits:
          memory: 690m
    networks:
      - lemmy-internal
  postgres:
    image: postgres:15-alpine
    hostname: postgres
    environment:
      - POSTGRES_USER=lemmy
      - POSTGRES_PASSWORD=JmT3cMDL252EJw
      - POSTGRES_DB=lemmy
    volumes:
      - ./volumes/postgres:/var/lib/postgresql/data:Z
      - ./customPostgresql.conf:/etc/postgresql.conf
    restart: always
    logging: *default-logging
    networks:
      - lemmy-internal
  postfix:
    image: mwader/postfix-relay
    environment:
      - POSTFIX_myhostname=codecompost.nl
    restart: "always"
    logging: *default-logging
    networks:
      - lemmy-internal
 networks:
  lemmy-internal:
  infra:
    external: true
--- a/containers/docker/multitenant/lemmy/lemmy.hjson
+++ b/containers/docker/multitenant/lemmy/lemmy.hjson
@ -0,0 +1,19 @@
 {
  # for more info about the config, check out the documentation
  # https://join-lemmy.org/docs/en/administration/configuration.html
  database: {
    host: postgres
    password: "JmT3cMDL252EJw"
  }
  hostname: "lemmy.codecompost.nl"
  pictrs: {
    url: "http://pictrs:8080/"
    api_key: "JmT3cMDL252EJw"
  }
  email: {
    smtp_server: "postfix:25"
    smtp_from_address: "noreply@codecompost.nl"
    tls_type: "none"
  }
 }
--- a/containers/docker/multitenant/lemmy/nginx_internal.conf
+++ b/containers/docker/multitenant/lemmy/nginx_internal.conf
@ -0,0 +1,96 @@
 worker_processes auto;
 events {
    worker_connections 1024;
 }
 http {
    # We construct a string consistent of the "request method" and "http accept header"
    # and then apply soem ~simply regexp matches to that combination to decide on the
    # HTTP upstream we should proxy the request to.
    #
    # Example strings:
    #
    #   "GET:application/activity+json"
    #   "GET:text/html"
    #   "POST:application/activity+json"
    #
    # You can see some basic match tests in this regex101 matching this configuration
    # https://regex101.com/r/vwMJNc/1
    #
    # Learn more about nginx maps here http://nginx.org/en/docs/http/ngx_http_map_module.html
    map "$request_method:$http_accept" $proxpass {
        # If no explicit matches exists below, send traffic to lemmy-ui
        default "http://lemmy-ui";
        # GET/HEAD requests that accepts ActivityPub or Linked Data JSON should go to lemmy.
        #
        # These requests are used by Mastodon and other fediverse instances to look up profile information,
        # discover site information and so on.
        "~^(?:GET|HEAD):.*?application\/(?:activity|ld)\+json" "http://lemmy";
        # All non-GET/HEAD requests should go to lemmy
        #
        # Rather than calling out POST, PUT, DELETE, PATCH, CONNECT and all the verbs manually
        # we simply negate the GET|HEAD pattern from above and accept all possibly $http_accept values
        "~^(?!(GET|HEAD)).*:" "http://lemmy";
    }
    upstream lemmy {
        # this needs to map to the lemmy (server) docker service hostname
        server "lemmy:8536";
    }
    upstream lemmy-ui {
        # this needs to map to the lemmy-ui docker service hostname
        server "lemmy-ui:1234";
    }
    server {
        # this is the port inside docker, not the public one yet
        listen 1236;
        listen 8536;
        # change if needed, this is facing the public web
        server_name localhost;
        server_tokens off;
        gzip on;
        gzip_types text/css application/javascript image/svg+xml;
        gzip_vary on;
        # Upload limit, relevant for pictrs
        client_max_body_size 20M;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        # frontend general requests
        location / {
            proxy_pass $proxpass;
            rewrite ^(.+)/+$ $1 permanent;
            # Send actual client IP upstream
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
        # backend
        location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
            proxy_pass "http://lemmy";
            # proxy common stuff
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            # Send actual client IP upstream
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }
 }
--- a/containers/docker/multitenant/mastodon/.env.production
+++ b/containers/docker/multitenant/mastodon/.env.production
@ -0,0 +1,28 @@
 # Generated with mastodon:setup on 2023-07-06 02:48:24 UTC
 # Some variables in this file will be interpreted differently whether you are
 # using docker-compose or not.
 LOCAL_DOMAIN=mastodon.codecompost.nl
 SINGLE_USER_MODE=true
 SECRET_KEY_BASE=2f845c9336267ad5ddf79ca900d3940990c0a8010c7c3a5321d5cda8e5b9ac32ebcc75ea67396977bb65c7c970f71d123312cd180c6a1e7b12e608eee3d63e27
 OTP_SECRET=e8c4370e30704c85552fd48d766c859323ebd28aaaffa8a9943687b2ac925610eeba1bc9b3a472ae1b684862e7d02ea7d5b69a02624d395626b0cd9fef4aeb2c
 VAPID_PRIVATE_KEY=fHCAaeeQ_HxQBKvw9jzVrTxO9mpoup46luhPmKZsRhI=
 VAPID_PUBLIC_KEY=BKkmTVZwiL4hmqYt91AsWvB4DS38MnFygDumi9jCqjSw3IClXA5WhxCQnYSpGzOKvvrN-Lgy4Fm2Rx5CPhmelS0=
 DB_HOST=moni-mastodon-db-1
 DB_PORT=5432
 DB_NAME=mastodon
 DB_USER=mastodon
 DB_PASS=mastodon
 REDIS_HOST=moni-mastodon-redis-1
 REDIS_PORT=6379
 REDIS_PASSWORD=
 SMTP_SERVER=smtp.mailgun.org
 SMTP_PORT=587
 SMTP_LOGIN=
 SMTP_PASSWORD=
 SMTP_AUTH_METHOD=plain
 SMTP_OPENSSL_VERIFY_MODE=none
 SMTP_ENABLE_STARTTLS=auto
 SMTP_FROM_ADDRESS=Mastodon <notifications@mastodon.codecompost.nl>
 LOCAL_HTTPS=false
--- a/containers/docker/multitenant/mastodon/docker-compose.yml
+++ b/containers/docker/multitenant/mastodon/docker-compose.yml
@ -0,0 +1,137 @@
 version: '3'
 services:
  db:
    restart: always
    image: postgres:14-alpine
    shm_size: 256mb
    networks:
      - internal_network
    healthcheck:
      test: ['CMD', 'pg_isready', '-U', 'postgres']
    volumes:
      - postgres14:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=mastodon
      - POSTGRES_PASSWORD=mastodon
  redis:
    restart: always
    image: redis:7-alpine
    networks:
      - internal_network
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
    volumes:
      - redis:/data
  # es:
  #   restart: always
  #   image: docker.elastic.co/elasticsearch/elasticsearch:7.17.4
  #   environment:
  #     - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Des.enforce.bootstrap.checks=true"
  #     - "xpack.license.self_generated.type=basic"
  #     - "xpack.security.enabled=false"
  #     - "xpack.watcher.enabled=false"
  #     - "xpack.graph.enabled=false"
  #     - "xpack.ml.enabled=false"
  #     - "bootstrap.memory_lock=true"
  #     - "cluster.name=es-mastodon"
  #     - "discovery.type=single-node"
  #     - "thread_pool.write.queue_size=1000"
  #   networks:
  #      - infra
  #      - internal_network
  #   healthcheck:
  #      test: ["CMD-SHELL", "curl --silent --fail localhost:9200/_cluster/health || exit 1"]
  #   volumes:
  #      - ./elasticsearch:/usr/share/elasticsearch/data
  #   ulimits:
  #     memlock:
  #       soft: -1
  #       hard: -1
  #     nofile:
  #       soft: 65536
  #       hard: 65536
  #   ports:
  #     - '127.0.0.1:9200:9200'
  web:
    image: ghcr.io/mastodon/mastodon
    restart: always
    env_file: .env.production
    command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"
    networks:
      - infra
      - internal_network
    healthcheck:
      # prettier-ignore
      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:3000/health || exit 1']
    # ports:
    #   - '127.0.0.1:3000:3000'
    depends_on:
      - db
      - redis
      # - es
    volumes:
      - public_system:/mastodon/public/system
  streaming:
    image: ghcr.io/mastodon/mastodon
    restart: always
    env_file: .env.production
    command: node ./streaming
    networks:
      - infra
      - internal_network
    healthcheck:
      # prettier-ignore
      test: ['CMD-SHELL', 'wget -q --spider --proxy=off localhost:4000/api/v1/streaming/health || exit 1']
    # ports:
    #   - '127.0.0.1:4000:4000'
    depends_on:
      - db
      - redis
  sidekiq:
    image: ghcr.io/mastodon/mastodon
    restart: always
    env_file: .env.production
    command: bundle exec sidekiq
    depends_on:
      - db
      - redis
    networks:
      - infra
      - internal_network
    volumes:
      - public_system:/mastodon/public/system
    healthcheck:
      test: ['CMD-SHELL', "ps aux | grep '[s]idekiq\ 6' || false"]
  ## Uncomment to enable federation with tor instances along with adding the following ENV variables
  ## http_proxy=http://privoxy:8118
  ## ALLOW_ACCESS_TO_HIDDEN_SERVICE=true
  # tor:
  #   image: sirboops/tor
  #   networks:
  #      - infra
  #      - internal_network
  #
  # privoxy:
  #   image: sirboops/privoxy
  #   volumes:
  #     - ./priv-config:/opt/config
  #   networks:
  #     - infra
  #     - internal_network
 networks:
  infra:
    external: true
  internal_network:
 volumes:
  postgres14:
  redis:
  public_system:
--- a/containers/docker/multitenant/moni0_proxy_host.png
+++ b/containers/docker/multitenant/moni0_proxy_host.png
--- a/containers/docker/multitenant/moni1_proxy_host.png
+++ b/containers/docker/multitenant/moni1_proxy_host.png
--- a/containers/docker/multitenant/nextcloud/REAME.md
+++ b/containers/docker/multitenant/nextcloud/REAME.md
@ -0,0 +1,2 @@
 https://github.com/nextcloud/all-in-one
--- a/containers/docker/multitenant/nextcloud/docker-compose.yml
+++ b/containers/docker/multitenant/nextcloud/docker-compose.yml
@ -0,0 +1,17 @@
 services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    ports:
      - 80:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - 8080:8080
      - 8443:8443 
 volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
--- a/containers/docker/multitenant/sites/moni8080/docker-compose.yml
+++ b/containers/docker/multitenant/sites/moni8080/docker-compose.yml
@ -0,0 +1,12 @@
 version: '2'
 services:
  moni8080:
    image: httpd
    networks:
      - npm
    volumes:
      - /home/moni/sites/moni8080:/usr/local/apache2/htdocs/
 networks:
  npm:
    external: true
--- a/containers/docker/multitenant/sites/moni8080/index.html
+++ b/containers/docker/multitenant/sites/moni8080/index.html
@ -0,0 +1,8 @@
 <html>
    <head>
        Moni 8080
    </head>
    <body>
        This is MONI 8080
    </body>
 </html>
--- a/containers/docker/multitenant/sites/moni8081/docker-compose.yml
+++ b/containers/docker/multitenant/sites/moni8081/docker-compose.yml
@ -0,0 +1,12 @@
 version: '2'
 services:
  moni8081:
    image: httpd
    networks:
      - npm
    volumes:
      - /home/moni/sites/moni8081:/usr/local/apache2/htdocs/
 networks:
  npm:
    external: true
--- a/containers/docker/multitenant/sites/moni8081/index.html
+++ b/containers/docker/multitenant/sites/moni8081/index.html
@ -0,0 +1,8 @@
 <html>
    <head>
        Moni 8081
    </head>
    <body>
        This is MONI 8081
    </body>
 </html>
--- a/containers/docker/multitenant/sites/moni8082/index.html
+++ b/containers/docker/multitenant/sites/moni8082/index.html
@ -0,0 +1,8 @@
 <html>
    <head>
        Moni 8082
    </head>
    <body>
        This is MONI 8082
    </body>
 </html>
--- a/containers/docker/multitenant/wordpress/Dockerfile
+++ b/containers/docker/multitenant/wordpress/Dockerfile
@ -0,0 +1,7 @@
 # Not the latest version to be able to test updates
 FROM wordpress:6.0.0 
 WORKDIR /usr/src/wordpress
 RUN set -eux; \
 	find /etc/apache2 -name '*.conf' -type f -exec sed -ri -e "s!/var/www/html!$PWD!g" -e "s!Directory /var/www/!Directory $PWD!g" '{}' +; \
 	cp -s wp-config-docker.php wp-config.php
 RUN echo "define('FS_METHOD','direct');" >> wp-config.php
--- a/containers/docker/multitenant/wordpress/docker-compose.yml
+++ b/containers/docker/multitenant/wordpress/docker-compose.yml
@ -0,0 +1,43 @@
 version: '3.1'
 services:
  wordpress:
    image: wordpress
    restart: always
    # ports:
    #   - 8080:80
    depends_on:
      - db
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: exampleuser
      WORDPRESS_DB_PASSWORD: examplepass
      WORDPRESS_DB_NAME: exampledb
    volumes:
      - wordpress:/var/www/html
    networks:
      - infra
      - internal_network
  db:
    image: mysql:5.7
    restart: always
    environment:
      MYSQL_DATABASE: exampledb
      MYSQL_USER: exampleuser
      MYSQL_PASSWORD: examplepass
      MYSQL_RANDOM_ROOT_PASSWORD: '1'
    volumes:
      - db:/var/lib/mysql
    networks:
      - internal_network
 volumes:
  wordpress:
  db:
 networks:
  infra:
    external: true
  internal_network:
--- a/containers/docker/nextcloud/README.md
+++ b/containers/docker/nextcloud/README.md
@ -0,0 +1,40 @@
 # Disabling SSL
 ```sh
 docker exec -it nextcloud-aio-mastercontainer bash
 ```
 in the container:
 ```sh
 vi /etc/apache2/sites-available/mastercontainer.conf
 ```
 Change the line to disable SSL:
 ```
 SSLEngine off
 ```
 Restart https *within the container*:
 ```sh
 killall httpd
 /usr/sbin/httpd
 ```
 You can exit after that.
 # Run OCC command
 ```sh
 docker exec -it --user www-data nextcloud-aio-nextcloud /var/www/html/occ
 ```
 # Brute force protection
 To add the Caddy Jails container that is running on `192.168.1.200` to the trusted proxies list:
 ```sh
 docker exec --user www-data -it nextcloud-aio-nextcloud php occ config:system:set trusted_proxies 2 --value="192.168.1.200"
 ```
--- a/containers/docker/nextcloud/compose.yaml
+++ b/containers/docker/nextcloud/compose.yaml
@ -0,0 +1,67 @@
 services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    ports:
      # - 80:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - 8080:8080
      # - 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    environment: # Is needed when using any of the options below
      # AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
      APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      SKIP_DOMAIN_VALIDATION: true
      ALLOW_INSECURE_ACCESS: true
      # BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
      # COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
      NEXTCLOUD_DATADIR: /home/nextcloud/nextcloud-data # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
      # NEXTCLOUD_MOUNT: /mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
      # NEXTCLOUD_UPLOAD_LIMIT: 10G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
      # NEXTCLOUD_MAX_TIME: 3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
      # NEXTCLOUD_MEMORY_LIMIT: 512M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
      # NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
      # NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
      # NEXTCLOUD_ADDITIONAL_APKS: imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
      # NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
      NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device in the Nextcloud container. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud
      # NEXTCLOUD_KEEP_DISABLED_APPS: false # Setting this to true will keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed. See https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps
      # TALK_PORT: 3478 # This allows to adjust the port that the talk container is using. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
      # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock'
    # networks: # Is needed when you want to create the nextcloud-aio network with ipv6-support using this file, see the network config at the bottom of the file
      # - nextcloud-aio # Is needed when you want to create the nextcloud-aio network with ipv6-support using this file, see the network config at the bottom of the file
    # security_opt: ["label:disable"] # Is needed when using SELinux
  # # Optional: Caddy reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
  # # You can find further examples here: https://github.com/nextcloud/all-in-one/discussions/588
  # caddy:
  #   image: caddy:alpine
  #   restart: always
  #   container_name: caddy
  #   volumes:
  #     - ./Caddyfile:/etc/caddy/Caddyfile
  #     - ./certs:/certs
  #     - ./config:/config
  #     - ./data:/data
  #     - ./sites:/srv
  #   network_mode: "host"
 volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
 # # Optional: If you need ipv6, follow step 1 and 2 of https://github.com/nextcloud/all-in-one/blob/main/docker-ipv6-support.md first and then uncomment the below config in order to activate ipv6 for the internal nextcloud-aio network.
 # # Please make sure to uncomment also the networking lines of the mastercontainer above in order to actually create the network with docker-compose
 # networks:
 #   nextcloud-aio:
 #     name: nextcloud-aio # This line is not allowed to be changed as otherwise the created network will not be used by the other containers of AIO
 #     driver: bridge
 #     enable_ipv6: true
 #     ipam:
 #       driver: default
 #       config:
 #         - subnet: fd12:3456:789a:2::/64 # IPv6 subnet to use
--- a/containers/docker/nextcloud/restart.sh
+++ b/containers/docker/nextcloud/restart.sh
@ -0,0 +1,13 @@
 docker stop nextcloud-aio-apache && docker start nextcloud-aio-apache
 docker stop nextcloud-aio-notify-push && docker start nextcloud-aio-notify-push
 docker stop nextcloud-aio-nextcloud && docker start nextcloud-aio-nextcloud
 # docker stop nextcloud-aio-docker-socket-proxy && docker start nextcloud-aio-docker-socket-proxy
 docker stop nextcloud-aio-imaginary && docker start nextcloud-aio-imaginary
 # docker stop nextcloud-aio-fulltextsearch && docker start nextcloud-aio-fulltextsearch
 # docker stop nextcloud-aio-clamav && docker start nextcloud-aio-clamav
 docker stop nextcloud-aio-redis && docker start nextcloud-aio-redis
 docker stop nextcloud-aio-database && docker start nextcloud-aio-database
 docker stop nextcloud-aio-talk && docker start nextcloud-aio-talk
 docker stop nextcloud-aio-collabora && docker start nextcloud-aio-collabora
 # docker stop nextcloud-aio-domaincheck # && docker start nextcloud-aio-domaincheck
 # docker stop nextcloud-aio-mastercontainer && docker start nextcloud-aio-mastercontainer
--- a/containers/docker/nextcloud/stop.sh
+++ b/containers/docker/nextcloud/stop.sh
@ -0,0 +1,13 @@
 docker stop nextcloud-aio-apache
 docker stop nextcloud-aio-notify-push
 docker stop nextcloud-aio-nextcloud
 # docker stop nextcloud-aio-docker-socket-proxy
 docker stop nextcloud-aio-imaginary
 # docker stop nextcloud-aio-fulltextsearch
 # docker stop nextcloud-aio-clamav
 docker stop nextcloud-aio-redis
 docker stop nextcloud-aio-database
 docker stop nextcloud-aio-talk
 docker stop nextcloud-aio-collabora
 # docker stop nextcloud-aio-domaincheck
 # docker stop nextcloud-aio-mastercontainer
--- a/containers/docker/photoprism/README.md
+++ b/containers/docker/photoprism/README.md
@ -0,0 +1,3 @@
 ```sh
 docker compose exec photoprism photoprism --help
 ```
--- a/containers/docker/photoprism/docker-compose.yml
+++ b/containers/docker/photoprism/docker-compose.yml
@ -0,0 +1,152 @@
 # Example Docker Compose config file for PhotoPrism (Linux / AMD64)
 #
 # Note:
 # - Running PhotoPrism on a server with less than 4 GB of swap space or setting a memory/swap limit can cause unexpected
 #   restarts ("crashes"), for example, when the indexer temporarily needs more memory to process large files.
 # - If you install PhotoPrism on a public server outside your home network, please always run it behind a secure
 #   HTTPS reverse proxy such as Traefik or Caddy. Your files and passwords will otherwise be transmitted
 #   in clear text and can be intercepted by anyone, including your provider, hackers, and governments:
 #   https://docs.photoprism.app/getting-started/proxies/traefik/
 #
 # Setup Guides:
 # - https://docs.photoprism.app/getting-started/docker-compose/
 # - https://docs.photoprism.app/getting-started/raspberry-pi/
 # - https://www.photoprism.app/kb/activation
 #
 # Troubleshooting Checklists:
 # - https://docs.photoprism.app/getting-started/troubleshooting/
 # - https://docs.photoprism.app/getting-started/troubleshooting/docker/
 # - https://docs.photoprism.app/getting-started/troubleshooting/mariadb/
 #
 # CLI Commands:
 # - https://docs.photoprism.app/getting-started/docker-compose/#command-line-interface
 #
 # All commands may have to be prefixed with "sudo" when not running as root.
 # This will point the home directory shortcut ~ to /root in volume mounts.
 services:
  photoprism:
    ## Use photoprism/photoprism:preview for testing preview builds:
    image: photoprism/photoprism:latest
    ## Don't enable automatic restarts until PhotoPrism has been properly configured and tested!
    ## If the service gets stuck in a restart loop, this points to a memory, filesystem, network, or database issue:
    ## https://docs.photoprism.app/getting-started/troubleshooting/#fatal-server-errors
    # restart: unless-stopped
    stop_grace_period: 10s
    depends_on:
      - mariadb
    security_opt:
      - seccomp:unconfined
      - apparmor:unconfined
    ## Server port mapping in the format "Host:Container". To use a different port, change the host port on
    ## the left-hand side and keep the container port, e.g. "80:2342" (for HTTP) or "443:2342 (for HTTPS):
    ports:
      - "2342:2342"
    ## Before you start the service, please check the following config options (and change them as needed):
    ## https://docs.photoprism.app/getting-started/config-options/
    environment:
      PHOTOPRISM_ADMIN_USER: "admin"                 # admin login username
      PHOTOPRISM_ADMIN_PASSWORD: "5bp3ptdBGM173t"    # initial admin password (8-72 characters)
      PHOTOPRISM_AUTH_MODE: "password"               # authentication mode (public, password)
      PHOTOPRISM_SITE_URL: "http://localhost:2342/"  # server URL in the format "http(s)://domain.name(:port)/(path)"
      PHOTOPRISM_DISABLE_TLS: "false"                # disables HTTPS/TLS even if the site URL starts with https:// and a certificate is available
      PHOTOPRISM_DEFAULT_TLS: "true"                 # defaults to a self-signed HTTPS/TLS certificate if no other certificate is available
      PHOTOPRISM_ORIGINALS_LIMIT: 5000               # file size limit for originals in MB (increase for high-res video)
      PHOTOPRISM_HTTP_COMPRESSION: "gzip"            # improves transfer speed and bandwidth utilization (none or gzip)
      PHOTOPRISM_LOG_LEVEL: "info"                   # log level: trace, debug, info, warning, error, fatal, or panic
      PHOTOPRISM_READONLY: "false"                   # do not modify originals directory (reduced functionality)
      PHOTOPRISM_EXPERIMENTAL: "false"               # enables experimental features
      PHOTOPRISM_DISABLE_CHOWN: "false"              # disables updating storage permissions via chmod and chown on startup
      PHOTOPRISM_DISABLE_WEBDAV: "false"             # disables built-in WebDAV server
      PHOTOPRISM_DISABLE_SETTINGS: "false"           # disables settings UI and API
      PHOTOPRISM_DISABLE_TENSORFLOW: "false"         # disables all features depending on TensorFlow
      PHOTOPRISM_DISABLE_FACES: "false"              # disables face detection and recognition (requires TensorFlow)
      PHOTOPRISM_DISABLE_CLASSIFICATION: "false"     # disables image classification (requires TensorFlow)
      PHOTOPRISM_DISABLE_VECTORS: "false"            # disables vector graphics support
      PHOTOPRISM_DISABLE_RAW: "false"                # disables indexing and conversion of RAW images
      PHOTOPRISM_RAW_PRESETS: "false"                # enables applying user presets when converting RAW images (reduces performance)
      PHOTOPRISM_SIDECAR_YAML: "true"                # creates YAML sidecar files to back up picture metadata
      PHOTOPRISM_BACKUP_ALBUMS: "true"               # creates YAML files to back up album metadata
      PHOTOPRISM_BACKUP_DATABASE: "true"             # creates regular backups based on the configured schedule
      PHOTOPRISM_BACKUP_SCHEDULE: "daily"            # backup SCHEDULE in cron format (e.g. "0 12 * * *" for daily at noon) or at a random time (daily, weekly)
      PHOTOPRISM_INDEX_SCHEDULE: ""                  # indexing SCHEDULE in cron format (e.g. "@every 3h" for every 3 hours; "" to disable)
      PHOTOPRISM_AUTO_INDEX: 300                     # delay before automatically indexing files in SECONDS when uploading via WebDAV (-1 to disable)
      PHOTOPRISM_AUTO_IMPORT: -1                     # delay before automatically importing files in SECONDS when uploading via WebDAV (-1 to disable)
      PHOTOPRISM_DETECT_NSFW: "false"                # automatically flags photos as private that MAY be offensive (requires TensorFlow)
      PHOTOPRISM_UPLOAD_NSFW: "true"                 # allows uploads that MAY be offensive (no effect without TensorFlow)
      # PHOTOPRISM_DATABASE_DRIVER: "sqlite"         # SQLite is an embedded database that does not require a separate database server
      PHOTOPRISM_DATABASE_DRIVER: "mysql"            # MariaDB 10.5.12+ (MySQL successor) offers significantly better performance compared to SQLite
      PHOTOPRISM_DATABASE_SERVER: "mariadb:3306"     # MariaDB database server (hostname:port)
      PHOTOPRISM_DATABASE_NAME: "photoprism"         # MariaDB database schema name
      PHOTOPRISM_DATABASE_USER: "photoprism"         # MariaDB database user name
      PHOTOPRISM_DATABASE_PASSWORD: "insecure"       # MariaDB database user password
      PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
      PHOTOPRISM_SITE_DESCRIPTION: ""                # meta site description
      PHOTOPRISM_SITE_AUTHOR: ""                     # meta site author
      ## Video Transcoding (https://docs.photoprism.app/getting-started/advanced/transcoding/):
      PHOTOPRISM_FFMPEG_ENCODER: "intel"        # H.264/AVC encoder (software, intel, nvidia, apple, raspberry, or vaapi)
      # PHOTOPRISM_FFMPEG_SIZE: "1920"               # video size limit in pixels (720-7680) (default: 3840)
      # PHOTOPRISM_FFMPEG_BITRATE: "32"              # video bitrate limit in Mbit/s (default: 50)
      ## Run/install on first startup (options: update https gpu ffmpeg tensorflow davfs clitools clean):
      # PHOTOPRISM_INIT: "https gpu tensorflow"
      ## Run as a non-root user after initialization (supported: 0, 33, 50-99, 500-600, and 900-1200):
      # PHOTOPRISM_UID: 1000
      # PHOTOPRISM_GID: 1000
      # PHOTOPRISM_UMASK: 0000
    ## Start as non-root user before initialization (supported: 0, 33, 50-99, 500-600, and 900-1200):
    # user: "1000:1000"
    ## Share hardware devices with FFmpeg and TensorFlow (optional):
    devices:
      - "/dev/dri:/dev/dri"                         # Intel QSV
    #  - "/dev/nvidia0:/dev/nvidia0"                 # Nvidia CUDA
    #  - "/dev/nvidiactl:/dev/nvidiactl"
    #  - "/dev/nvidia-modeset:/dev/nvidia-modeset"
    #  - "/dev/nvidia-nvswitchctl:/dev/nvidia-nvswitchctl"
    #  - "/dev/nvidia-uvm:/dev/nvidia-uvm"
    #  - "/dev/nvidia-uvm-tools:/dev/nvidia-uvm-tools"
    #  - "/dev/video11:/dev/video11"                 # Video4Linux Video Encode Device (h264_v4l2m2m)
    working_dir: "/photoprism" # do not change or remove
    ## Storage Folders: "~" is a shortcut for your home directory, "." for the current directory
    volumes:
      # "/host/folder:/photoprism/folder"                # Example
      - "/home/photoprism/Pictures:/photoprism/originals"               # Original media files (DO NOT REMOVE)
      # - "/example/family:/photoprism/originals/family" # *Additional* media folders can be mounted like this
      - "/home/photoprism/Import:/photoprism/import"                  # *Optional* base folder from which files can be imported to originals
      - "/home/photoprism/storage:/photoprism/storage"                  # *Writable* storage folder for cache, database, and sidecar files (DO NOT REMOVE)
  ## MariaDB Database Server (recommended)
  ## see https://docs.photoprism.app/getting-started/faq/#should-i-use-sqlite-mariadb-or-mysql
  mariadb:
    image: mariadb:11
    ## If MariaDB gets stuck in a restart loop, this points to a memory or filesystem issue:
    ## https://docs.photoprism.app/getting-started/troubleshooting/#fatal-server-errors
    restart: unless-stopped
    stop_grace_period: 5s
    security_opt: # see https://github.com/MariaDB/mariadb-docker/issues/434#issuecomment-1136151239
      - seccomp:unconfined
      - apparmor:unconfined
    command: --innodb-buffer-pool-size=512M --transaction-isolation=READ-COMMITTED --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --max-connections=512 --innodb-rollback-on-timeout=OFF --innodb-lock-wait-timeout=120
    ## Never store database files on an unreliable device such as a USB flash drive, an SD card, or a shared network folder:
    volumes:
      - "/home/photoprism/database:/var/lib/mysql" # DO NOT REMOVE
    environment:
      MARIADB_AUTO_UPGRADE: "1"
      MARIADB_INITDB_SKIP_TZINFO: "1"
      MARIADB_DATABASE: "photoprism"
      MARIADB_USER: "photoprism"
      MARIADB_PASSWORD: "insecure"
      MARIADB_ROOT_PASSWORD: "insecure"
  ## Watchtower upgrades services automatically (optional)
  ## see https://docs.photoprism.app/getting-started/updates/#watchtower
  ## activate via "COMPOSE_PROFILES=update docker compose up -d"
  watchtower:
    restart: unless-stopped
    image: containrrr/watchtower
    profiles: ["update"]
    environment:
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_POLL_INTERVAL: 7200 # checks for updates every two hours
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "~/.docker/config.json:/config.json" # optional, for authentication if you have a Docker Hub account
--- a/containers/docker/pinepods/compose.yaml
+++ b/containers/docker/pinepods/compose.yaml
@ -0,0 +1,31 @@
 name: pinepods
 services:
  db:
    image: postgres:latest
    env_file: '.env'
    volumes:
      - /home/pinepods/pinepods/pgdata:/var/lib/postgresql/data
    # Exposing the postgres database port is dumb.
    # ports:
    #   - "5432:5432"
    restart: always
  valkey:
    image: valkey/valkey:8-alpine
    # Exposing a nosql database is expecially dumb.
    # ports:
    #   - "6379:6379"
  pinepods:
    image: madeofpendletonwool/pinepods:latest
    ports:
      - "8040:8040"
    env_file: '.env'
    volumes:
      # Mount the download and backup locations on the server
      - /home/pinepods/pinepods/downloads:/opt/pinepods/downloads
      - /home/pinepods/pinepods/backups:/opt/pinepods/backups
    depends_on:
      - db
      - valkey
--- a/containers/docker/qbittorrent/docker-compose.yml
+++ b/containers/docker/qbittorrent/docker-compose.yml
@ -0,0 +1,42 @@
 # https://github.com/nickkjolsing/dockerMullvadVPN
 name: torrent
 services:
  openvpn-client:
    image: ghcr.io/wfg/openvpn-client # Image on Docker. Shoutout to ghcr.io
    container_name: openvpn-client
    cap_add:
      - NET_ADMIN # Needs to be here
    environment:
      - KILL_SWITCH=on # Turns off internet access if the VPN connection drops
      - SUBNETS=192.168.0.0/24,192.168.1.0/24
    devices:
      - /dev/net/tun
    volumes:
      - /home/jellyfin/mullvad_config_linux_nl_ams:/data/vpn
    ports:
      - 8082:8082
      - 6881:6881
      - 6881:6881/udp
    restart: unless-stopped
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    environment:
      - PUID=1003
      - PGID=1003
      - TZ=Europe/Amsterdam
      - WEBUI_PORT=8082
      - TORRENTING_PORT=6881
    volumes:
      - /home/jellyfin/qbitorrent/appdata:/config
      - /home/jellyfin/qbitorrent/downloads:/downloads #optional
      - /home/jellyfin/jellyfin/media:/media
    # ports:
    #   - 8082:8082
    #   - 6881:6881
    #   - 6881:6881/udp
    network_mode: container:openvpn-client # This uses the port setting of the openvpn
    restart: unless-stopped
--- a/containers/docker/webtop/compose.yaml
+++ b/containers/docker/webtop/compose.yaml
@ -0,0 +1,24 @@
 services:
  webtop:
    image: lscr.io/linuxserver/webtop:fedora-xfce
    container_name: webtop
    security_opt:
      - seccomp:unconfined #optional
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
      - SUBFOLDER=/ #optional
      - TITLE=Webtop #optional
      - CUSTOM_USER=moni
      - PASSWORD=Pd5oBZ3vN31wCkj8
    volumes:
      - /home/moni/webtop/data:/config
      - /var/run/docker.sock:/var/run/docker.sock #optional
    ports:
      - 3000:3000
      - 3001:3001
    devices:
      - /dev/dri:/dev/dri #optional
    shm_size: "1gb" #optional
    restart: unless-stopped
--- a/containers/docker/windows/compose.yaml
+++ b/containers/docker/windows/compose.yaml
@ -0,0 +1,18 @@
 services:
  windows:
    image: dockurr/windows
    container_name: windows
    environment:
      VERSION: "11"
    devices:
      - /dev/kvm
      - /dev/net/tun
    cap_add:
      - NET_ADMIN
    ports:
      - 8006:8006
      - 3389:3389/tcp
      - 3389:3389/udp
    stop_grace_period: 2m
    volumes:
      - /var/win:/storage
--- a/containers/docker/wordpress/docker-compose.yml
+++ b/containers/docker/wordpress/docker-compose.yml
@ -0,0 +1,31 @@
 version: '3.1'
 services:
  wordpress:
    image: wordpress
    restart: always
    ports:
      - 8080:80
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: exampleuser
      WORDPRESS_DB_PASSWORD: examplepass
      WORDPRESS_DB_NAME: exampledb
    volumes:
      - wordpress:/var/www/html
  db:
    image: mysql:8.0
    restart: always
    environment:
      MYSQL_DATABASE: exampledb
      MYSQL_USER: exampleuser
      MYSQL_PASSWORD: examplepass
      MYSQL_RANDOM_ROOT_PASSWORD: '1'
    volumes:
      - db:/var/lib/mysql
 volumes:
  wordpress:
  db:
--- a/homeservers/Backup.md
+++ b/homeservers/Backup.md
@ -0,0 +1,86 @@
 # Syncthing
 ```sh
 sudo systemctl restart syncthing@photoprism.service
 ```
 Admin interface: http://192.168.1.10:8384/
 I have a user called `photoprism` and the password is in Bitwarden
 # Borg Backup to Hetzner Storage Box
 For backup I use [Borg](https://borgbackup.readthedocs.io/). I followed the steps described in this community article:
 * [Install and Configure BorgBackup](https://community.hetzner.com/tutorials/install-and-configure-borgbackup)
 We have two backups in the storage box:
 * `/./borgbackup/photoprism`
 * `/./borgbackup/nextcloud`
 ## Photoprism backup
 This is what I did for Photoprism
 The init script (which is only done once, be careful it will overwrite!):
 ```sh
 # (As root)
 export BORG_RSH='ssh -i /root/.ssh/id_ed25519'
 export BORG_PASSPHRASE="<I GENERATED A PASSPHRASE>"
 borg init --encryption=repokey ssh://u388089@u388089.your-storagebox.de:23/./borgbackup/photoprism
 ```
 It outputs a key which I put in Bitwarden (you need it to decrypt the backup).
 To make a manual backup:
 ```sh
 export BORG_RSH='ssh -i /root/.ssh/id_ed25519'
 export BORG_PASSPHRASE="<SEE BITWARDEN>"
 borg create --stats ssh://u388089@u388089.your-storagebox.de:23/./borgbackup/photoprism::2024_11_24 /home/photoprism/Import/ /home/photoprism/Pictures/
 ```
 The above can be found in Bitwarden, look for "Hetzner Borg Backup Script for Photoprism"
 I also created a bash script in `/usr/local/bin/photoprism_backup.sh` (as mentioned in the article).
 You can find it here in this repo:
 * [photoprism_backup.sh](./scripts/photoprism_backup.sh)
 ## Nextcloud backup
 Ok, this is confusing but Nextcloud uses Borgbackup internally. Go to the [aio interface](http://192.168.1.10:8080/) and you'll notice there are backups to:
 ```
 /root/nextcloudbackup
 ```
 So nextcloud keeps making backups to this directory. Not ideal (TODO: I gotta find a solution for this).
 But I can rclone the data:
 ```sh
 rclone sync -v /root/nextcloudbackup/ hetzner:/cloned_borgbackup/nextcloud
 ```
 For this I also created a script and placed it in `/usr/local/bin`
 [nextcloud_backup.sh](./scripts/nextcloud_backup.sh)
 # Automatic backup
 * [cloud_backup.service](./scripts/cloud_backup.service)
 * [cloud_backup.timer](./scripts/cloud_backup.timer)
 ```sh
 cp -v cloud_backup.service /etc/systemd/system/
 cp -v cloud_backup.timer /etc/systemd/system/
 ```
 ```sh
 systemctl enable cloud_backup.service
 systemctl enable cloud_backup.timer
 ```
--- a/homeservers/Immich.md
+++ b/homeservers/Immich.md
@ -0,0 +1,15 @@
 Compose file:
 [compose.yaml](../containers/docker/immich/compose.yaml)
 For immich I added a dedicated user:
 ```sh
 sudo useradd immich
 ```
 This creates a `/home/immich` directory. We neet to run `cat /etc/passwd` to get the id of the user.
 Unfortunately, I have not been able to use the user id for the containers, so everything is written as root. I'm still using `/home/immich`, but all the files are written there as root. 
 Eventually I might use podman but I don't know enough about it yet to get comfortable with it.
--- a/homeservers/Jellyfin.md
+++ b/homeservers/Jellyfin.md
@ -0,0 +1,21 @@
 # Jellyfin
 Compose file:
 * [compose.yaml](../containers/docker/jellyfin/compose.yaml)
 I made a user names `jellyfin` and put its uid:guid in the compose file. All the files are in the home directory of that user `/home/jellyfin`.
 The user also has the authorized_keys so I can do this:
 ```sh
 ssh jellyfin@192.168.1.10
 ```
 and proceed to add the directories for the media files:
 ```sh
 cd jellyfin/media/tvshows/
 mkdir "Show I Want To Watch (2020)"
 mkdir "Season 01"
 ```
--- a/homeservers/Nextcloud.md
+++ b/homeservers/Nextcloud.md
@ -0,0 +1,22 @@
 # Nextcloud
 I have a dedicated user:
 ```sh
 sudo useradd nextcloud
 ```
 I'm running the Nextcloud All-In-One container. In order to make it easy I have a [stop](../containers/docker/nextcloud/stop.sh) and [restart](../containers/docker/nextcloud/stop.sh) script.
 Nextcloud runs on 
 * https://nextcloud.allisonandmoni.online/
 When you first start it up, you need to first disable the SSL from within the container:
 * [Ugly hack README](../containers/docker/nextcloud/README.md)
 And then go to:
 * http://192.168.1.11:8080
--- a/homeservers/PhotoPrism.md
+++ b/homeservers/PhotoPrism.md
@ -0,0 +1,43 @@
 # Photoprism
 What we are really running on this machine is Photoprism using this [docker-compose](../containers/docker/photoprism/docker-compose.yml) file, like this:
 ```sh
 cd ~/projects/stuff/containers/docker/photoprism
 docker compose up --detach
 ```
 To stop it:
 ```sh
 docker compose down
 ```
 To update it:
 ```sh
 docker compose pull
 ```
 Photoprism is running on: https://photos.allisonandmoni.online/
 I have set up a Systemd service and timer to automatically run the import once an hour. They can be found:
 * [photoprism_import.service](./scripts/photoprism_import.service)
 * [photoprism_import_timer.service](./scripts/photoprism_import_timer.service)
 To install:
 ```sh
 cp -v photoprism_import.service /etc/systemd/system/
 cp -v photoprism_import.timer /etc/systemd/system/
 ```
 Enable:
 ```sh
 systemctl enable photoprism_import.service
 systemctl enable photoprism_import.timer
 ```
 In the `compose.yaml` file you'll notice I have the files stored in `/home/photoprism`. That's because I thought I could run it with podman as a dedicated user. I abandoned that idea and am now running it in Docker instead. The directories `/home/photoprism/Pictures` and `/home/photoprism/Import` are all owned by `root`
--- a/homeservers/README.md
+++ b/homeservers/README.md
@ -0,0 +1,43 @@
 # General
 This file describes the setup of the servers I have running at home, with some instructions.
 At the moment I'm running:
 * Raspberry PI4 8GB: `ssh moni@192.168.1.108`
 * Lenovo Thinkcentre M900, i5-6500T:  `ssh moni@192.168.1.10`, 8GB RAM, 500G SSD
 * Lenovo Thinkcentre M900, i5-6500T:  `ssh moni@192.168.1.11`, 16GB RAM, 126G NVME + 1TB SSD
 For Raspberry PI, see [RPI](./RPI.md). That is where the routing happens.
 For Lenovo Thinkcenter, see below. That is where all the action happens.
 # Lenovo Thinkcentre M900, i5-6500T
 I have two Lenovo Thinkcentres, one with 8GB of ram and 500GB. The other with 16GB of ram and an NVME of 128GB and an SSD of 1GB.
 The idea is to have one in production for all my servers running on `allisonandmoni.online` domain and the other is to play with.
 Right now my OS of choice is AlmaLinux, but that can change with my mood.
 On my production machine I am running Docker.
 You don't need to be root to use it:
 ```sh
 docker ps -a
 ```
 Right now I'm running the following containers:
 * [PhotoPrism](./PhotoPrism.md), reachable by https://photos.allisonandmoni.online
 * [JellyFin](./Jellyfin.md), reachable by https://jellyfin.allisonandmoni.online/
 * [Nextcloud](./Nextcloud.md), reachable by https://nextcloud.allisonandmoni.online/
 * [qBittorrent](./qBittorrent.md), reachable by https://qbittorrent.allisonandmoni.online/
 * [Immich](./Immich.md), reachable by https://photos2.allisonandmoni.online
 # Backup and restore
 I have backup and restore scripts and instructions. See here:
 * [Backup](./Backup.md)
 * [Restore](./Restore.md)
--- a/homeservers/RPI.md
+++ b/homeservers/RPI.md
@ -0,0 +1,53 @@
 # Raspberry PI
 On the Raspberry PI I am running FreeBSD with Bastille which currently has 1 jail:
 ```sh
 sudo bastille list
 ```
 ```
 ID  IP Address      Hostname                      Path
 1   192.168.1.200   caddy                         /usr/local/bastille/jails/caddy/root
 ```
 The ip address 192.168.1.200 is chosen deliberately. On my router (192.168.1.1) I have the following port mappings:
 * 32222 to 192.168.1.108:22 (ssh) - Maps to the Raspberry PI 8 for external access
 * 80 to 192.168.1.200:80 (http) - Maps to the Caddy jail
 * 443 to 192.168.1.200:443 (https) - Maps to the Caddy jail
 * 3478 to 192.168.1.10 (Nextcloud talk) - This is a direct connection to the Lenovo machine.
 To view the Caddy setup in the Caddy jail, run this:
 ```sh
 sudo -i
 bastille console caddy
 cat /usr/local/etc/caddy/Caddyfile
 ```
 Result:
 ```
 www.allisonandmoni.online {
        reverse_proxy 192.168.1.10:8081
 }
 photos.allisonandmoni.online {
        reverse_proxy 192.168.1.10:2342 
 }
 nextcloud.allisonandmoni.online {
        reverse_proxy 192.168.1.10:11000
 }
 jellyfin.allisonandmoni.online {
        reverse_proxy 192.168.1.10:8096
 }
 ```
 As you can see I have setup reverse proxies for www, photos and nextcloud for allisonandmoni.online. 
 The instructions for the caddy setup on my RPI4 can be found in this file:
 * [Caddy on FreeBSD](../os/FreeBSD/Bastille.md#caddy)
--- a/homeservers/Restore.md
+++ b/homeservers/Restore.md
@ -0,0 +1,62 @@
 # Restore
 ## Borg backup
 First we need to install Borg Backup:
 ```sh
 dnf install -y borgbackup
 ```
 ## Hetzner Storage Box
 So I have a Hetzner Storage Box which is reachable by:
 ```sh
 ssh -p23 u388089@u388089.your-storagebox.de
 ```
 There are two subdirectories:
 ```sh
 /borgbackup # This is an actual borg backup of PhotoPrism with history and everything
 /cloned_borgbackup # This is a rclone of a borg backup of nextcloud that happens on my local machine.
 ```
 First, we're going to talk about restoring PhotoPrism
 ## Restore Photoprism
 List:
 ```sh
 export BORG_PASSPHRASE=''
 borg list ssh://u388089@u388089.your-storagebox.de:23/./borgbackup/photoprism
 ```
 (Optional, to see what you have) Mount a snapshot:
 ```sh
 borg mount ssh://u388089@u388089.your-storagebox.de:23/./borgbackup/photoprism::2025-01-14_04:00 /home/moni/borg_restore/
 ```
 Unmount it:
 ```sh
 borg umount /home/moni/borg_restore/
 ```
 Restore a backup
 You might want to tmux first:
 ```sh
 tmux
 ```
 ```sh
 borg --progress --verbose extract ssh://u388089@u388089.your-storagebox.de:23/./borgbackup/photoprism::2025-01-14_04:00 /home/photoprism/Pictures
 ```
 Giving a local target directory is not supported. The restore will be in a subdirectory. So if you're in `/home/moni` it will restore to `/home/moni/home/photoprism/Pictures`. You can't change this behavior.
--- a/homeservers/qBittorrent.md
+++ b/homeservers/qBittorrent.md
@ -0,0 +1,11 @@
 # qBittorrent
 Compose file:
 * [compose.yaml](../containers/docker/qbittorrent/docker-compose.yml)
 qBittorrent uses the same user as jellyfin which writes everything to `/home/jellyfin`
 I also put the `jellyfin` uid:guid into the qbitorrent container. The files are downloaded to the `bittorrent/downloads` subdirtory of `jellyfin` home.
 When I want to watch something I can copy it from the downloads directory to the media directory of jellyfin.
--- a/homeservers/scripts/cloud_backup.service
+++ b/homeservers/scripts/cloud_backup.service
@ -0,0 +1,8 @@
 [Unit]
 Description=Run Cloud Backup
 [Service]
 ExecStart=/bin/bash /usr/local/bin/cloud_backup.sh
 [Install]
 WantedBy=multi-user.target
--- a/homeservers/scripts/cloud_backup.sh
+++ b/homeservers/scripts/cloud_backup.sh
@ -0,0 +1,3 @@
 #!/bin/bash
 /bin/bash /usr/local/bin/photoprism_backup.sh
 /bin/bash /usr/local/bin/nextcloud_backup.sh
--- a/homeservers/scripts/cloud_backup.timer
+++ b/homeservers/scripts/cloud_backup.timer
@ -0,0 +1,9 @@
 [Unit]
 Description=Run PCloud Backup timer
 [Timer]
 OnCalendar=0/4:00:00
 Unit=cloud_backup.service
 [Install]
 WantedBy=timers.target
--- a/homeservers/scripts/nextcloud_backup.sh
+++ b/homeservers/scripts/nextcloud_backup.sh
@ -0,0 +1 @@
 rclone sync /root/nextcloudbackup/ hetzner:/cloned_borgbackup/nextcloud --log-file /var/log/nextcloud_backup.log --log-level INFO
--- a/homeservers/scripts/photoprism_backup.sh
+++ b/homeservers/scripts/photoprism_backup.sh
@ -0,0 +1,59 @@
 #!/usr/bin/env bash
 ##
 ## Set environment variables
 ##
 ## if you don't use the standard SSH key,
 ## you have to specify the path to the key like this
 export BORG_RSH='ssh -i /root/.ssh/id_ed25519'
 ## You can save your borg passphrase in an environment
 ## variable, so you don't need to type it in when using borg
 export BORG_PASSPHRASE=''
 ##
 ## Set some variables
 ##
 LOG='/var/log/photoprism_backup.log'
 export BACKUP_USER='u388089'
 export REPOSITORY_DIR='photoprism'
 ## Tip: If using with a Backup Space you have to use
 ## 'your-storagebox.de' instead of 'your-backup.de'
 export REPOSITORY="ssh://${BACKUP_USER}@${BACKUP_USER}.your-storagebox.de:23/./borgbackup/${REPOSITORY_DIR}"
 ##
 ## Output to a logfile
 ##
 exec > >(tee -i ${LOG})
 exec 2>&1
 echo "###### Backup started: $(date) ######"
 ##
 ## At this place you could perform different tasks
 ## that will take place before the backup, e.g.
 ##
 ## - Create a list of installed software
 ## - Create a database dump
 ##
 ##
 ## Transfer the files into the repository.
 ## In this example the folders root, etc,
 ## var/www and home will be saved.
 ## In addition you find a list of excludes that should not
 ## be in a backup and are excluded by default.
 ##
 echo "Transfer files ..."
 borg create -v --stats                   \
    $REPOSITORY::'{now:%Y-%m-%d_%H:%M}'  \
    /home/photoprism/Import/ \
    /home/photoprism/Pictures/
 echo "###### Backup ended: $(date) ######"
--- a/homeservers/scripts/photoprism_import.service
+++ b/homeservers/scripts/photoprism_import.service
@ -0,0 +1,8 @@
 [Unit]
 Description=Run Photoprism Import
 [Service]
 ExecStart=docker exec photoprism-photoprism-1 photoprism import
 [Install]
 WantedBy=multi-user.target
--- a/homeservers/scripts/photoprism_import.timer
+++ b/homeservers/scripts/photoprism_import.timer
@ -0,0 +1,9 @@
 [Unit]
 Description=Run Photoprism Import script hourly
 [Timer]
 OnCalendar=hourly
 Unit=photoprism_import.service
 [Install]
 WantedBy=timers.target
--- a/laptops/Clevo_Laptop.md
+++ b/laptops/Clevo_Laptop.md
@ -0,0 +1,179 @@
 Clevo laptop which is sold by Tuxedo computers.
 # General
 Set the hostname:
 ```sh
 hostnamectl set-hostname moni-fedora # Fedora
 hostnamectl set-hostname moni-opensuse # openSUSE
 ```
 Install my favorite packages
 ```sh
 zypper install tmux htop neovim git ncdu podman # openSUSE
 dnf install tmux htop neovim git ncdu podman # Fedora
 ```
 # Suspend when laptop lid closed
 On openSUSE:
 On Fedora:
 ```sh
 nvim /usr/lib/systemd/logind.conf # Fedora & openSUSE
 nvim /etc/systemd/logind.conf # Ubuntu
 ```
 Uncomment the lines:
 ```conf
 HandleLidSwitch=suspend
 HandleLidSwitchExternalPower=suspend
 HandleLidSwitchDocked=ignore
 LidSwitchIgnoreInhibited=yes
 ```
 You need to reboot before it takes effect.
 # Wake on suspend
 There is a bug in Linux kernel 6. This article explains this:
 https://bugzilla.redhat.com/show_bug.cgi?id=2162013
 Somehow the touchpad keeps waking up the laptop.
 ```sh
 cat /proc/acpi/wakeup
 ```
 Should return:
 ```
 Device	S-state	  Status   Sysfs node
 GPP0	  S0	*disabled
 GPP1	  S0	*disabled
 GP17	  S0	*enabled   pci:0000:00:08.1
 ```
 ## Temporarily disable
 To temporarily disable it do this:
 ```sh
 echo disabled > /sys/bus/i2c/devices/i2c-FTCS1000:00/power/wakeup
 ```
 ## Persistent settings
 As root:
 ```sh
 nvim /etc/systemd/system/disable-wakeup.service
 ```
 Contents:
 ```
 [Unit]
 Description=Disable wakeup triggers
 [Service]
 Type=oneshot
 ExecStart=/bin/sh -c "echo disabled > /sys/bus/i2c/devices/i2c-FTCS1000\:00/power/wakeup ; echo GP17 > /proc/acpi/wakeup"
 ExecStop=/bin/sh -c "echo disabled > /sys/bus/i2c/devices/i2c-FTCS1000\:00/power/wakeup ; echo GP17 > /proc/acpi/wakeup"
 RemainAfterExit=yes
 [Install]
 WantedBy=multi-user.target
 ```
 Then simply enable and start it:
 ```sh
 systemctl enable disable-wakeup.service
 systemctl start disable-wakeup.service
 ```
 Reboot the laptop and check to see if the systemd unit works:
 ```sh
 systemctl status disable-wakeup.service
 ```
 ```sh
 cat /proc/acpi/wakeup
 cat /sys/bus/i2c/devices/i2c-FTCS1000\:00/power/wakeup
 ```
 Test it by suspending the laptop. You can also use:
 ```sh
 systemctl suspend -i
 ```
 # Tuxedo control center
 Instructions: https://www.tuxedocomputers.com/en/Add-TUXEDO-software-package-sources.tuxedo
 ## On openSUSE
 See instructions on page and then:
 ```sh
 zypper refresh && zypper install tuxedo-control-center
 ```
 ## On Fedora
 ```sh
 nvim /etc/yum.repos.d/tuxedo.repo
 ```
 Contents:
 ```
 [tuxedo]
 name=tuxedo
 baseurl=https://rpm.tuxedocomputers.com/fedora/40/x86_64/base
 enabled=1
 gpgcheck=1
 gpgkey=https://rpm.tuxedocomputers.com/fedora/40/0x54840598.pub.asc
 skip_if_unavailable=False
 ```
 Get the key:
 ```sh
 wget https://rpm.tuxedocomputers.com/fedora/40/0x54840598.pub.asc
 ```
 And install it:
 ```sh
 rpm --import ./0x54840598.pub.asc
 ```
 Now install the control center:
 ```sh
 dnf update
 dnf install tuxedo-control-center
 ```
 You need to reboot before it takes effect.
 # Virtualization
 ```sh
 dnf install @virtualization
 ```
 ```sh
 systemctl enable libvirtd
 systemctl start libvirtd
 ```
--- a/laptops/Ideapad_510.md
+++ b/laptops/Ideapad_510.md
@ -0,0 +1,88 @@
 # Lenovo ideapad 510
 ## Prevent suspend when lid closed
 Add a new file:
 ```sh
 nvim /etc/systemd/logind.conf.d/no-suspend-on-lid.conf
 ```
 Add this:
 ```
 [Login]
 HandleLidSwitch=ignore
 HandleLidSwitchExternalPower=ignore
 HandleLidSwitchDocked=ignore
 ```
 ```sh
 systemctl restart systemd-logind
 ```
 ## Wake-on-lan
 See my network interfaces:
 ```sh
 ip link show
 ```
 ```
 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 54:e1:ad:9d:a8:74 brd ff:ff:ff:ff:ff:ff
 3: wlp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DORMANT group default qlen 1000
    link/ether 52:37:c4:2c:79:38 brd ff:ff:ff:ff:ff:ff permaddr 3c:f8:62:b3:7f:81
 ```
 Enable for the ethernet
 ```sh
 ethtool -s enp1s0 wol g
 ```
 Make it pemanent. Create a systemd unit:
 ```sh
 nvim /etc/systemd/system/wol.service
 ```
 ```
 [Unit]
 Description=Wake-on-LAN
 Requires=network.target
 After=network.target
 [Service]
 ExecStart=/usr/sbin/ethtool -s enp1s0 wol g
 Type=oneshot
 [Install]
 WantedBy=multi-user.target
 ```
 ```sh
 systemctl enable wol.service
 ```
 Check it:
 ```sh
 systemctl start wol.service
 systemctl status wol.service
 ```
 Suspend the laptop:
 ```sh
 systemctl suspend
 ```
 Wake it up again from another machine:
 ```sh
 wakeonlan 54:e1:ad:9d:a8:74
 ```
--- a/laptops/Laptops.md
+++ b/laptops/Laptops.md
@ -0,0 +1,2 @@
 * [Clevo Laptop](Clevo_Laptop.md)
 * [Lenovo ideapad 510](Ideapad_510.md)
--- a/os/AlmaLinux/AlmaLinux.md
+++ b/os/AlmaLinux/AlmaLinux.md
@ -0,0 +1,90 @@
 # General
 Remove the web console and all the other stuff around it:
 ```sh
 dnf -y remove cockpit*
 firewall-cmd --permanent --remove-service=cockpit
 firewall-cmd --reload
 firewall-cmd --list-all
 ```
 Update
 ```sh
 dnf update
 ```
 Set hostname
 ```sh
 hostnamectl set-hostname moni-alma
 ```
 Set up EPEL, follow the instructions: 
 * https://docs.fedoraproject.org/en-US/epel/getting-started/
 And then install my favorites:
 ```sh
 dnf install -y tmux htop ncdu neovim git
 ```
 Install docker:
 ```sh
 dnf -y install dnf-plugins-core
 dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
 dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 systemctl enable --now docker
 ```
 Add the `moni` to the docker group:
 ```sh
 usermod -aG docker moni
 ```
 You need to log out and log back in and then test it:
 ```sh
 # run without sudo
 docker run -it --rm -p 8080:80 httpd:2.4
 ```
 It will run in the foreground because we didn't pass `-d`.
 Open your browser to:
 * http://192.168.1.11:8080
 * or http://192.168.1.10:8080 for the 8GB server
 You can stop the container with CTRL+C. It should clean itself up (`--rm`).
 Cleanup:
 ```sh
 docker image prune --all --force
 ```
 # SSH
 ```sh
 nvim /etc/ssh/sshd_config
 ```
 Uncomment/change these settings:
 ```conf
 PermitRootLogin no
 # PubkeyAuthentication yes <-- This is the detault, so you don't need to change this
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 ```
 Reload:
 ```sh
 sudo systemctl reload sshd
 ```
--- a/os/FreeBSD/FreeBSD_on_Clevo_Laptop.md
+++ b/os/FreeBSD/FreeBSD_on_Clevo_Laptop.md
@ -0,0 +1,280 @@
 # Setup
 Install my favorite packages
 ```sh
 pkg install bash sudo tmux htop neovim git bastille
 ```
 Add "wheel" to the suoers file:
 ```sh
 visudo
 ```
 Change shell
 ```sh
 chsh -s /usr/local/bin/bash
 ```
 Do a system update:
 ```sh
 freebsd-update fetch install
 ```
 # Wifi
 Find out what network cards we have:
 ```sh
 pciconf -lv | grep -A1 -B3 network
 ```
 On my Clevo laptop it looks like this:
 ```
 re0@pci0:2:0:0: class=0x020000 rev=0x15 hdr=0x00 vendor=0x10ec device=0x8168 subvendor=0x1558 subdevice=0xa600
    vendor     = 'Realtek Semiconductor Co., Ltd.'
    device     = 'RTL8111/8168/8211/8411 PCI Express Gigabit Ethernet Controller'
    class      = network
    subclass   = ethernet
 iwlwifi0@pci0:3:0:0:    class=0x028000 rev=0x1a hdr=0x00 vendor=0x8086 device=0x2723 subvendor=0x8086 subdevice=0x0084
    vendor     = 'Intel Corporation'
    device     = 'Wi-Fi 6 AX200'
    class      = network
 nvme0@pci0:4:0:0:       class=0x010802 rev=0x00 hdr=0x00 vendor=0x144d device=0xa809 subvendor=0x144d subdevice=0xa801
 ```
 So we have an Intel Wifi.
 We're going to configure the wireless card iwlwifi0 to the interface wlan0:
 ```sh
 ifconfig wlan0 create wlandev iwlwifi0
 ```
 To make the change persist across reboots:
 ```sh
 sysrc wlans_iwlwifi0="wlan0"
 ```
 We need to set the regulatory domain:
 ```sh
 ifconfig wlan0 regdomain ETSI country NL
 ```
 To scan the networks. I had to run the command twice to see the list:
 ```sh
 ifconfig wlan0 up list scan
 ```
 I see my networks:
 ```
 SSID/MESH ID                      BSSID              CHAN RATE    S:N     INT CAPS
 TMNL-3EF981_24G                   d8:0d:17:b9:b2:f0   11   54M  -37:-96   100 EPS  HTCAP WME ATH RSN WPS
 TMNL-3EF981                       98:0d:67:3e:f9:81   11   54M  -72:-96   100 EP   APCHANREP RSN WPS BSSLOAD HTCAP VHTCAP VHTOPMODE WME
 TMNL-3EF981_5G                    d8:0d:17:b9:b2:f1   64   54M  -42:-96   100 EP   HTCAP VHTCAP VHTOPMODE VHTPWRENV WME ATH RSN WPS
 ```
 I want to connect to `TMNL-3EF981_5G`. We need to edit the `/etc/wpa_supplicant.conf` file:
 ```sh
 nvim /etc/wpa_supplicant.conf
 ```
 The contents. The password need to be set in psk.
 ```
 country=NL
 network={
        ssid="TMNL-3EF981_5G"
        psk="3J6YJHNRG8W7KMMF"
        priority=5
 }
 ```
 To set it to use DHCP:
 ```sh
 sysrc ifconfig_wlan0="WPA SYNCDHCP"
 ```
 For some reason, we need to add the country code in the rc.conf:
 ```sh
 sysrc create_args_wlan0="country NL"
 ```
 Now bring it up!
 ```sh
 service netif restart
 ```
 Restart the laptop to see if it persists.
 For some reason, it won't work (no suprise, wifi is awful in FreeBSD).
 This worked for me after boot
 ```sh
 ifconfig wlan0 down
 ifconfig wlan0 ssid "TMNL-3EF981_5G"
 ifconfig wlan0 regdomain etsi2 country NL
 service netif restart
 ```
 # X11
 https://docs.freebsd.org/en/books/handbook/x11/
 Don't forget to start `tmux`:
 ```sh
 tmux
 ```
 Add `moni` to the `video` group:
 ```sh
 pw groupmod video -m moni
 ```
 And then install, but don't forget to read the messages when the install is complete! Scroll up with tmux
 ```sh
 pkg install xorg
 ```
 This will improve mnuse and touchscreen support:
 ```sh
 sysctl kern.evdev.rcpt_mask=6
 ```
 And add this to `/etc/sysctl.conf` to persist it:
 ```sh
 kern.evdev.rcpt_mask=6
 ```
 # Amd
 ```sh
 pkg install drm-kmod
 ```
 ```sh
 sysrc kld_list+=amdgpu
 ```
 # Kde
 ```sh
 pkg install kde5
 ```
 ```sh
 sysrc dbus_enable="YES"
 ```
 ```sh
 sysctl net.local.stream.recvspace=65536
 sysctl net.local.stream.sendspace=65536
 ```
 ```sh
 pkg install sddm
 sysrc sddm_enable="YES"
 ```
 # Fonts
 ```sh
 pkg install urwfonts
 ```
 But you're not done yet, you need to add a conf file:
 ```sh
 nvim /usr/local/etc/X11/xorg.conf.d/90-fonts.conf
 ```
 With the following:
 ```
 Section "Files"
  FontPath "/usr/local/share/fonts/urwfonts/"
 EndSection
 ```
 # CPU
 Too see your CPU 0
 ```sh
 sysctl dev.cpu.0
 ```
 If you don't see a temperature:
 ```sh
 kldload amdtemp
 ```
 Add it to startup:
 ```sh
 sysrc kld_list+=amdtemp
 ```
 # Linux compatibility
 ```sh
 sysrc linux_enable="YES"
 ```
 ```sh
 service linux start
 ```
 # Final configs
 My `/etc/rc.conf`
 ```
 hostname="moni-freebsd"
 ifconfig_re0="DHCP"
 sshd_enable="YES"
 moused_enable="YES"
 # Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
 dumpdev="AUTO"
 kld_list="amdgpu amdtemp"
 dbus_enable="YES"
 sddm_enable="YES"
 linux_enable="YES"
 create_args_wlan0="country NL"
 wlans_iwlwifi0="wlan0"
 ifconfig_wlan0="WPA SYNCDHCP"
 ```
 My `/etc/sysctl.conf`:
 ```
 #
 #  This file is read when going to multi-user and its contents piped thru
 #  ``sysctl'' to adjust kernel values.  ``man 5 sysctl.conf'' for details.
 #
 # Uncomment this to prevent users from seeing information about processes that
 # are being run under another UID.
 #security.bsd.see_other_uids=0
 kern.evdev.rcpt_mask=6
 ```
--- a/os/FreeBSD/FreeBSD_on_Lenovo_Thinkcentre.md
+++ b/os/FreeBSD/FreeBSD_on_Lenovo_Thinkcentre.md
@ -0,0 +1,111 @@
 # Setup
 First time:
 ```sh
 su -
 ```
 Do a system update:
 ```sh
 freebsd-update fetch install
 ```
 Update
 ```sh
 pkg update
 ```
 Install my favorite packages
 ```sh
 pkg install -y bash sudo tmux htop neovim git ncdu bastille tailscale aria2
 ```
 Add "wheel" to the suoers file:
 ```sh
 visudo
 ```
 Change shell
 ```sh
 chsh -s /usr/local/bin/bash
 ```
 Tailscale
 ```sh
 service tailscaled enable 
 service tailscaled start
 tailscale up
 ```
 # SSH
 ```sh
 nvim /etc/ssh/sshd_config
 ```
 Change this setting:
 ```
 KbdInteractiveAuthentication no
 ```
 That should be it. The config file should have these settings, including the commented lines shown as below:
 ```
 #PermitRootLogin no
 #PubkeyAuthentication yes
 #PasswordAuthentication no
 KbdInteractiveAuthentication no
 #UsePAM yes
 ```
 Test the setting
 ```sh
 sshd -t
 ```
 Reload:
 ```sh
 service sshd reload
 ```
 # PF
 Note, if you're using Bastille, the `/etc/pf.conf` file is going to look different. See [Bastille](../../containers/Bastille/Bastille.md).
 Now we need to get the filewall going.
 ```sh
 nvim /etc/pf.conf
 ```
 Contents:
 ```
 ext_if="em0"
 block in all
 pass in on $ext_if proto tcp to ($ext_if) port ssh
 pass in on $ext_if proto tcp to ($ext_if) port 80
 pass in on $ext_if proto tcp to ($ext_if) port 443
 pass out all keep state
 ```
 ```sh
 sysrc pf_enable=yes
 service pf start
 ```
 If you get the error 'no host key files found` then
 ```sh
 ssh-keygen -A
 ```
--- a/os/FreeBSD/FreeBSD_on_RPI.md
+++ b/os/FreeBSD/FreeBSD_on_RPI.md
@ -0,0 +1,94 @@
 # General
 Default username passwords are:
 ```
 freebsd
 freebsd
 ```
 and
 ```
 root
 root
 ```
 ```sh
 ssh freebsd@192.168.1.108
 ```
 Setup ntpd
 You need to make sure that your date is close to the real time
 ```sh
 date 202406211441
 ```
 Set the timezone
 ```sh
 tzsetup
 ```
 ```sh
 sysrc ntpd_enable=YES
 ```
 Set the time:
 ```sh
 ntpdate -v -b in.pool.ntp.org
 ```
 Start the service
 ```sh
 service ntpd start
 ```
 Update the system
 ```sh
 pkg update
 ```
 Install my favorite packages
 ```sh
 pkg install bash sudo tmux htop neovim git bastille
 ```
 Add "wheel" to the suoers file:
 ```sh
 visudo
 ```
 Change shell
 ```sh
 chsh -s /usr/local/bin/bash
 ```
 Add a user
 ```sh
 adduser
 ```
 Change the hostname
 ```sh
 sysrc hostname="rp4-8"
 ```
 Delete the freebsd user that comes with the standard installation:
 ```sh
 rmuser freebsd
 ```
 * [SSH instructions](FreeBSD_on_Lenovo_Thinkcentre.md#ssh)
 * [PF instructions](FreeBSD_on_Lenovo_Thinkcentre.md#pf). Be careful, the network interface on the PI is called `genet0` not `em0`.
--- a/os/FreeBSD/Storage.md
+++ b/os/FreeBSD/Storage.md
@ -0,0 +1,53 @@
 # Storage
 First we need to know what drives we have:
 ```sh
 geom disk list
 ```
 Show the partitions:
 ```sh
 gpart show
 ```
 In FreeBSD the partitions are named with suffix `pX`, for example `p1`, `p2`, etc.
 To mount the first partition of the external harddrive:
 ```sh
 # directory needs to exist
 mkdir /mnt/usb
 # mount the first partition p1
 mount -t /dev/da0p1 /mnt/usb
 ```
 # ZFS
 The handbook is actually quite comprehensive: 
 * https://docs.freebsd.org/en/books/handbook/zfs/
 In order for ZFS to work, we need to enable it. On the Raspberry PI it is not enabled by default.
 ```sh
 service zfs enable
 service zfs start
 ```
 You need empty space, either an empty partition or drive.
 # Mounting different filesystems (for example, a USB SDD)
 For ext4, see: https://docs.freebsd.org/en/books/handbook/filesystems/index.html#filesystems-linux
 For NTFS, see: https://docs.freebsd.org/en/books/handbook/disks/#using-ntfs
 Take into account that NTFS uses "Slices", not "Partitions" so mounting the external NTFS harddrive on the Raspberry PI looks like this:
 ```sh
 ntfs-3g /dev/da0s1 /mnt/usb
 ```
--- a/ssh.md
+++ b/ssh.md
@ -0,0 +1,4 @@
 ```sh
 eval `ssh-agent -s` && ssh-add -k
 ssh -t -A moni@143.179.250.91 -p 32222 ssh moni@192.168.1.10
 ```
		`@ -0,0 +1 @@`
							`rclone sync /root/nextcloudbackup/ hetzner:/cloned_borgbackup/nextcloud --log-file /var/log/nextcloud_backup.log --log-level INFO`
		`@ -0,0 +1,2 @@`
							`* [Clevo Laptop](Clevo_Laptop.md)`
							`* [Lenovo ideapad 510](Ideapad_510.md)`