WIP: add bws

.idea/alpina.iml

@@ -4,7 +4,7 @@
     <content url="file://$MODULE_DIR$">
       <excludeFolder url="file://$MODULE_DIR$/venv" />
     </content>
-    <orderEntry type="inheritedJdk" />
+    <orderEntry type="jdk" jdkName="Poetry (alpina)" jdkType="Python SDK" />
     <orderEntry type="sourceFolder" forTests="false" />
   </component>
   <component name="PyDocumentationSettings">

.idea/jsonSchemas.xml

@@ -106,6 +106,16 @@
               <option name="applicationDefined" value="true" />
               <option name="patterns">
                 <list>
+                  <Item>
+                    <option name="pattern" value="true" />
+                    <option name="path" value="*/compose.yml" />
+                    <option name="mappingKind" value="Pattern" />
+                  </Item>
+                  <Item>
+                    <option name="pattern" value="true" />
+                    <option name="path" value="*/compose.yml.j2" />
+                    <option name="mappingKind" value="Pattern" />
+                  </Item>
                   <Item>
                     <option name="pattern" value="true" />
                     <option name="path" value="*/docker-compose.yml" />

Makefile

@@ -1,19 +1,23 @@
 .POSIX:
 .PHONY: *
 .EXPORT_ALL_VARIABLES:
+MAKEFLAGS += -r # no use of built-in rules
 
 env ?= staging
 vault_id ?= alpina@contrib/rbw-client.sh
 
-clean_desired ?= false
+playbook_cmd := poetry run ansible-playbook --vault-id ${vault_id} -i inventories/${env}
 
-all: site
+all: site services
 
 setup:
 	poetry install --quiet
 
 site: setup
-	poetry run ansible-playbook --vault-id ${vault_id} -i inventories/${env} --extra-vars "clean_desired_arg=${clean_desired}" site.yml
+	 $(playbook_cmd) site.yml
 
 services: setup
-	poetry run ansible-playbook --vault-id ${vault_id} -i inventories/${env} services.yml
+	$(playbook_cmd) services.yml
+
+clean: setup
+	$(playbook_cmd) clean.yml

clean.yml

@@ -0,0 +1,3 @@
+- hosts: alpina
+  roles:
+    - clean

contrib/bws-client.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+bws secret get --output env "e4fca935-28fa-4ca5-bcc9-b19d018ae606"

contrib/bws_client.py

@@ -0,0 +1,16 @@
+import os
+
+from bitwarden_sdk import BitwardenClient
+
+ACCESS_TOKEN = os.getenv('BWS_ACCESS_TOKEN')
+assert ACCESS_TOKEN is not None, 'BWS_ACCESS_TOKEN environment variable is not set'
+SECRET_ID = 'e4fca935-28fa-4ca5-bcc9-b19d018ae606'
+
+def main():
+    client = BitwardenClient()
+    client.auth().login_access_token(ACCESS_TOKEN)
+    secret = client.secrets().get(SECRET_ID).data.value
+    print(secret, end='')
+
+if __name__ == '__main__':
+    main()

contrib/compose_helpers.j2

@@ -6,23 +6,38 @@ default:
       - subnet: {{ docker_ipv6_subnet | ansible.utils.ipsubnet(80, subnet_index) }}
 {% endmacro %}
 
-{% macro traefik_labels(host, service="", port="", auth=false) %}
+{% macro traefik_labels(host, port='', path_prefix='', auth=false, wildcard=false) %}
+{% set name = host ~ (wildcard * '-*') ~ path_prefix -%}
+{% set tls_base = domain %}
+{% if wildcard -%}
+  {% set tls_base = host ~ '.' ~ domain %}
+{%- endif -%}
+
 traefik.enable=true
-- traefik.http.routers.{{ host }}.rule=Host(`{{ host }}.{{ domain }}`)
+- traefik.http.routers.r-{{ name }}.rule={{ host_rule(host, path_prefix, wildcard) }}
-- traefik.http.routers.{{ host }}.entrypoints=web
+- traefik.http.routers.r-{{ name }}.entrypoints=websecure
-- traefik.http.routers.{{ host }}-tls.rule=Host(`{{ host }}.{{ domain }}`)
+- traefik.http.routers.r-{{ name }}.tls=true
-- traefik.http.routers.{{ host }}-tls.entrypoints=websecure
+- traefik.http.routers.r-{{ name }}.tls.certresolver=letsencrypt
-- traefik.http.routers.{{ host }}-tls.tls=true
+- traefik.http.routers.r-{{ name }}.tls.domains.0.main={{ tls_base }}
-- traefik.http.routers.{{ host }}-tls.tls.certresolver=letsencrypt
+- traefik.http.routers.r-{{ name }}.tls.domains.0.sans=*.{{ tls_base }}
-- traefik.http.routers.{{ host }}-tls.tls.domains.0.main={{ domain }}
-- traefik.http.routers.{{ host }}-tls.tls.domains.0.sans=*.{{ domain }}
-{% if service -%}
-- traefik.http.routers.{{ host }}.service={{ service }}
-{% endif %}
 {% if port -%}
-- traefik.http.services.{{ host }}.loadbalancer.server.port={{ port }}
+- traefik.http.routers.r-{{ name }}.service=svc-{{ name }}
+- traefik.http.services.svc-{{ name }}.loadbalancer.server.port={{ port }}
 {% endif %}
 {% if auth -%}
-- traefik.http.routers.{{ host }}-tls.middlewares=authentik@docker
+- traefik.http.routers.r-{{ name }}.middlewares=authentik@docker
 {% endif %}
 {% endmacro %}
+
+{% macro host_rule(host, path_prefix="", wildcard=false) %}
+{% if wildcard %}
+{# regular a.host prevents warnings from 'No domain found in rule HostRegexp' #}
+{# TODO: figure out this stupidity properly #}
+Host(`a.{{ host }}.{{ domain }}`) || HostRegexp(`^.+\.{{ host }}\.{{ domain | replace('.', '\.') }}$`)
+{%- else %}
+Host(`{{ host }}.{{ domain }}`)
+{%- endif %}
+{% if path_prefix -%}
+ && PathPrefix(`{{ path_prefix }}`)
+{%- endif %}
+{% endmacro %}

group_vars/alpina/vars.yml

@@ -5,12 +5,15 @@ alpina_svc_path: ~/alpina
 base_volume_path: /mnt/dock
 media_volume_path: /mnt/media
 
-traefik_subnet: 172.16.122.0
+docker_ipv6_subnet: "{{ \
+          ansible_default_ipv6.address \
+          | ansible.utils.ipsubnet(64) \
+          | ansible.utils.ipsubnet(72, docker_ipv6_index) \
+        }}"
 
 # Authentik
 authentik_db_password: "{{ vault_authentik_db_password }}"
 authentik_secret_key: "{{ vault_authentik_secret_key }}"
-
 authentik_sendgrid_api_key: "{{ vault_authentik_sendgrid_api_key }}"
 
 auth_grafana_client_secret: "{{ vault_auth_grafana_client_secret }}"
@@ -19,6 +22,9 @@ auth_gitea_client_secret: "{{ vault_auth_gitea_client_secret }}"
 auth_nextcloud_client_secret: "{{ vault_auth_nextcloud_client_secret }}"
 arrstack_password: "{{ vault_arrstack_password }}"
 auth_vpgen_client_secret: "{{ vault_auth_vpgen_client_secret }}"
+auth_pgrok_client_secret: "{{ vault_auth_pgrok_client_secret }}"
+
+auth_default_enrollment_group: vpgen
 
 # Minio
 minio_password: "{{ vault_minio_password }}"
@@ -51,6 +57,8 @@ redis_password: "{{ vault_redis_password }}"
 nextcloud_sendgrid_api_key: "{{ vault_nextcloud_sendgrid_api_key }}"
 
 # VPGen
+vpgen_auth_invite_token: "{{ vault_vpgen_auth_invite_token }}"
+
 vpgen_opnsense_api_url: https://opnsense.cazzzer.com
 vpgen_opnsense_api_key: "{{ vault_vpgen_opnsense_api_key }}"
 vpgen_opnsense_api_secret: "{{ vault_vpgen_opnsense_api_secret }}"
@@ -61,3 +69,9 @@ vpgen_ip_max_index: 100
 vpgen_vpn_endpoint: "{{ vault_vpgen_vpn_endpoint }}"
 vpgen_vpn_dns: "{{ vault_vpgen_vpn_dns }}"
 vpgen_max_clients_per_user: 20
+
+# Woodpecker
+woodpecker_agent_secret: "{{ vault_woopecker_agent_secret }}"
+
+# Pgrok
+pgrok_db_password: "{{ vault_pgrok_db_password }}"

group_vars/alpina/vault.yml

@@ -1,138 +1,158 @@
 $ANSIBLE_VAULT;1.1;AES256
-38376439643766303237356563616337663731366435613930393135383962666435313530663632
+39313964356339363432393662666162343133633033316465636433323339323931303866646635
-3432326162343632613565393737363335306263653032300a643539393562376162333761376631
+3630663865626431396563346365363636383637626263620a633332623365643765386566356336
-62343731316430316638363338343966326635383930623339383339653936343765316439393233
+65356439386565306461313863633835623031656136393039326366623137333536363836316563
-6562323634383363300a323233346338393764623363346139313661386433656337363332656230
+3062356431346539330a366534646239353934363137373662343862393365373835653530336166
-31306233643735333033316139363165373062363334363933396563366234316330646230353261
+34613763626630316431326133366461363030663137366536393764356437323235343438326237
-62326539663337323036346533303031333730373061656563613535376162633138306634626462
+36656234653363623836303863346233616661623135383130663930333365373733663134323234
-37313038356466336138643834643863393333373939616362636365366231383762633030313831
+39666233643733653336386234613563656134396638373561323432313631633166386266323865
-33393139313336623437396161623437323163633362363137626262653462633737373062643735
+66313630333332316662643434646465343861643461373631396538663763633263323738616330
-63353561313639393166306466346134623933323532636438656263663338376337376434356163
+37316561663231366336383539306130396631643839383563643363623362376266356565363434
-64343239616632313566656664393136363337386464613932383961343134363233653039336137
+31306634356162383839613464386664633237343461646132366439613563623732346362363534
-65656566306463313264646163646130323533666464323464643433313030346535346535323264
+39636635396133336330373938366236646237393866316136663537363138636239636638386363
-34356433343739343166383034313935666139663239653662663734343139343035616134303730
+37623131636133343062306139666666393566333665356566313530383033636534383132373765
-39643136623735666333646234346239303337333961343261383834393963386633633030633962
+31303362303237623337323632373161306138353666633462386165633935626536396135363330
-61376132313532643730633865326130666565303631386262396366306565613665363934383335
+62633233316664656166306438653039306564633336616661306366306634333734353866313765
-37376139616165396436663135373932653064656136356662363137653036383537613665393634
+30386236643033303537336562643431306232656162663066643238353662303533616130303335
-38313063656637353630373634316564383362663335356364626161663163323362333937316461
+61643436333063313164353366346564336366663431663636653334326262626635326264653938
-64336636386234623438613766316430353261346339313863306462393335636131363966363038
+37393136336336656538366533626566366365313837383236653762653464666336353862313434
-66393561323335393063663838393466656331323433376461653838313638303564666662636438
+64646431363462643839643937646537306433616565303466626530386366373934376665303638
-38663735616261656338626437336433613730353236636266316536656165303534353538316232
+63653164623231636539643332356162353134646130626365393166373932386530313030336136
-62363063376464323932383261663537393263333266633461326536656533653661303335646431
+30303138373432306665376432646664336461303564333535636463373232303661323336633536
-36616436396137343634373563386439653833306537373735353764346430616231313538636362
+63366363393161613832356362356437666365333062303635363961343739373739343364646331
-30363430613839373761363032316137636432643339383561313637376339323836353161343639
+63383131363430393331666331613965666239393865346234646632353962333531346239333333
-36316665656164396236383538346561306432333637393431393566333566633434393961663330
+39643832386363353461366332366138366134333638666664383434353262376263386531346262
-32383833396238633966393837336564626135653733383863346161663364353062303931303931
+36383365613764363135343765313863306135373062613362313761353165613166613966366363
-39653662373734643037393832643439653437353935666430373337643532346161376661633738
+37616163643230343062336462666233666438643332343963666161333631663532653733376239
-61643431633431666535333463636461613166363238373138306565643533623039353031646634
+37383335623337343761643936333264383766373137393964636138663362643064363666643130
-62383662663435346635373865633731393362623761313834393964623930646364366534333236
+39636639646264303333623036373439636566346437643539656531303534376139613832396638
-35393138346433366435313066633436393561643263343534393034373161343834633261363933
+37373736343538663062633132376164386635333038656338373037633033623238633035333130
-65376636393263663566653436633762643331336139653565663334373561353130653065653935
+65316330393261326139373331386239636230376237386664386134663131343836393464646362
-31616337313764313532303934376236623833363433336335303262643135643339613839623231
+39366434313034383561623664343530633165316438333830346330653730613264656661303061
-37343730616166323239653537313137373136626337333665633134363830626131353030393662
+34393863306465373639306531643534366464393365373264316136653334356530376366303330
-31643366386365353336326133636434303636343637643539653131316133306132643133643364
+31383137306439616362313861396633333430626463326531336533323038333336313337396338
-64636464373564383938663838613031626563613362626435383832346661306562343165643539
+64636161333839366536643662653563613138633331316166333766666537386666616161313531
-66353431393032313262393566353833343632366139656234306561366139633431653133356165
+62363666646635656233363962346333393861303165643130333435613436366131393463663162
-32363332636433626132666462626137653337646234646565303831646330333133353964626461
+34623536316363643539663261373830316638383439326431373866646436616635303466343830
-37333265623865376562663365336339353036346135363062663534643537353331623630356264
+33303362356166333338333265633366353538353135353933383939343562633433333337363564
-66386665333633383534313062623533383239383231333163663565633531666236306465633135
+37366536343066326338313262313830623263356464323565373362356631303538646366373635
-36363164636165343863363866343437636630353863316633623761373232643262623762316162
+31343861626636313530343964656133333031326634333434643037393436313833306133396563
-32613665306535626139366564616362393536336364666663333761383362393631316134373138
+61333636646437623963666265666565623965386364376430666662336365363762316639343939
-32616665363164363639303538373539346239663261373731613464333734326436666433666539
+66303164303161396463363265393966306636616231633838366437626162323465356430643333
-31656264326535626134323231646535656563363231633434636337323538343038303233363765
+66663633353462646334663034373465343432626638383237383330313932663930663962656665
-61393164316237323533313336316530316431653731343261636265393361616464323536333130
+62363133306632613062393830316135333965623963643337336638366236343533323832633564
-65346538306664663566666435393738323832396365363764333637613331356661306535376332
+66643331623263393966343930613430646438386563646235363837376230373365346462633937
-62313533306365373737643835396364363737306631346161353031633531383364636563383237
+37333431346363303630313265626533373662613332383236313736663534306132653635333464
-64633432386565356137333730313736393737303665326531356265376333663636393430386233
+30643761613762353536613531326334336138323934393832393765613533666432616631396337
-33666532616632373061633063656136646533363034363330366231653936396166663134396139
+36373261313236666365656563316330313061336664646230393931616264643864623263333132
-66393131653963386365656364666263666362316136333561326566626562616138383739346139
+33336263663164343962383366333264633735383731613939383333343265366166346534326538
-62343035646435393136656434646138376331346164663562306166646132363230333538323536
+31636136643466623037333334396162333435303062313861626435623134386432333065383865
-38643934613633373734653337666261356639353235326539356264633232343834633062336539
+62343435396233376366656365303966633533633232303763616234396365306338326562363234
-31616536663730656163626437653932313564633938643163313765393731386533323465303831
+65313437396534346661643365363533363133663133613733316331663364326131613464653133
-34353663363862363761643565633635373834623665653131613531373637386361636661376532
+63386535366138636436616666613664663632376430623063343030393631386233346133373466
-64386435643966343034643763393461373961626134346539653865636161333962333463393734
+39386436313566636662306438373932386232353865363736383962353864373132363564393133
-62343838363432396133326235323636613239326139376365353930373835313531326433326234
+38343439313766323035363238336335333063323730396161303634313738663931316262613164
-66396537636162363865663433626230316362343334653735646637613130636436633132663538
+61623939666263323563313131383064386632663132336234373132316430306431636535393663
-64623230303266373965616533346464373661363233613837613765343463306136623063313139
+66653835396431626633616236666365333264306662333865663739623430656563393133393938
-31383039343462363536646636653736316362356565326538636331646235373162663332313961
+37633665633961326162666232386338316432633139386233393834376533326333343435643562
-64623061636638666234623336656365383165626461323561343930316432313632316332306334
+32353664383436633832356662326265613636636534346432356534303061633337313139323138
-61376430303835383934396266303564363230313735366464386134393265326334663633663632
+66303064366636316537333735336232303964333139626161373138373765303464633835623333
-38643034393737303963643733656333316137646435653666353239373738373632383561646333
+66623862343636343134363266666164666432393835316165333465363736643735643134636364
-65363865353362383832643238363332613931343038366563316163303764323936316466666364
+65383037646633613564363436663235616530643631356462383337396437653437613933653739
-31373439383661656336653431666164393833643266656133383137376133636134643137663532
+64396434343839393638363866386234393132396262363637643466333439656464326364393231
-33353531663336346562653339616430333133363232336461353937303435346337363932306133
+39333635643165666331636230333931663561663532326338366136343832613862616466623132
-37623164343462363830323263323664303334633563313439376232303031633633316636383164
+37653139343235656335336566356631663938646631626562363130393031346133326562656366
-66306238333432333635653435383138383339343837346134613630353335656335663062326132
+38623633346632393263663536623131316662646130633533333431666162353834363537633631
-65323638343963623062663638366538363162343230323262616138373239653163623832313366
+36643439313734396365633533303930626431376132656439393838306662363934663764373939
-65323834383631646164316363383636643437346435313030656362653332653635343066666232
+65623136363239636161343162363265313036346332333864366363663933356264663935653762
-39346235383265326262306434383861653138393835663863383032363664323565316165646566
+61306135366562613162616538303334626433633731613530613837323433306235393338613532
-61646238393062373131346536343533663839313831383335316363343465663130633133393436
+35626366613535326363643864663863303734373435636664653931613462336332353334323365
-66333465633636353639663836376561353839613533346164366238353833636534633338313262
+37616539343335386636306138656233396238636137636130663035336365653230666436663030
-30656433376362346333303630643639353262323532666238633764363132303161326638643761
+63653136636162386630656538636338646531336335363737333062383138646538356137353837
-36616131636538613539383935613337643930333334613566393031646630383330656164363361
+61306235303564653065653034633762653466376530653338383362613766313563636232613934
-37306536356164633831626362653364313164356235653464333633313263383032333439626434
+63373466613136663035646134623335383037653231333035323036653264636161623766643332
-65376531396661636661303831393062666362623966353739303330393631323963373564353265
+35323530386333333563373565356130393836343137656361316437343235343235623539333963
-61343862323737336238356231626561396333386264666563356235333339653538626130623936
+36396565336233373433643466643330623434363261643933666332386536323332643466363135
-63326431316538346534313764356333396565666431633833613337323136643137306166623238
+64353464386365313862323032363932656662376464323830326432313737336166373764303034
-66393561333137373964353935323930636237366433613038383761643665363330323865386133
+66343664613839323731643463323239303138303234316564626438663031613763393532376531
-37623339613733353366656637383030623663313639363334656361623035643232626633313864
+30333037386138306466313332346139363238323736656463633038323261363862666433663865
-36346564653766646333613763616163363462613937656534363461376235613064373039326165
+34333464363637313362303863356236376531643161646632303265646337616532323039373562
-32666265383065636232613632333830633439653066653666663261646536663434393535613131
+31316262643764353937336433343630396534653831376231626338643033353939363562636535
-30373062313765663038313534623165653833623330383032363063393239373234636630646561
+62326634396538393564353531343461353137613932386531353362313262653363623633373131
-38633962363530666638666630316434613462656335613236363831313863613030636539356133
+33353861373136663162383439616131303639313931616633333538363436353934636530303461
-66386133383433663964306661636131633236633935633236623530373864646363383534383735
+30346237373331356335656632633632353735386433313934323031646339386631373838366331
-63633165626464333332303331333338313838393832626637626137316338643136336333633930
+35303736373432343361643439316333386233633634393464343164633161643436306637336234
-61346436336635656639616261383666336330333862303139633137373362303033653432613039
+62373136303263323133303839333438633038356161653839333139383633366333616363303766
-35623663353538323761623839623438646363313164356631386364356533346133333334326565
+34313236306462366261336331306634373538316435623963313335383130653732323032663234
-32303837663261386463313535373765356166376165386535623838326431616564346632363732
+65626131353839373137346166633164303462336234666230383664383139323036393732373531
-62373231356530346632373134343865303532326136653731633038353066623435336462303138
+32653034326134626133313363613432663366373739653332376364636139666261353536303437
-37363039343433613939363663623135396636396433653362666164323237393664623564393532
+33626332376361653930356261316162623134303135346235616165323632353538653661393261
-61376463336564396537366365373936333666373432376566323864343735636264643139643063
+37373561616237353133646466313262633632383533656632633431643131333366306662653361
-66396230303336633438666234336434353866323637316334313162363734623763666338336234
+39653066326564383461623035636136613035613962623131633734663262313532653366306530
-39303330343035333864396631323231363134646238323065356138633131323135613133356237
+38366132323030346262366262363231303737646131633931363162383461333262316564383861
-34373562633430613062313261363939373632313838333934303165336562663839663833383763
+32313537323637363163646335333566333463366265323438386230333765396334646436623234
-39316632656561653033613933373861366361353761346539306234366538373461373930306535
+62653233306433643261373262376535616365363065346431333331653164306463643033333930
-66623430343336333033306135303639646566393336663538313430616364653933663536386535
+34383533336536613233663630656561653034333134326563613538613134633038356265343839
-64323962353734356134656361663131376564626461386233643731393664353038626464313763
+36303266303363666335323831613430373536346336333934643338373064646365386365316633
-64396265373737313134613962376334373965353338303363303935353538643561336461393032
+37303565653565653334643463323137366137346538613632343131383235326339333235373562
-37356434343837376534663938366434343063643966643965346465636166363235643635333466
+36326230333734373365376239306664616433373664343462383961366636383263333764646362
-38323664366366663363616664336165653264633437393636363866316262303432356461386330
+32383463343130313931656436613235336561383165613737643835396264616262356431333564
-63326539626363333331366162363230626462656633653866383331333164663734633630353265
+36313965323164393633653330366666393337363831653763343938653464383235623236343332
-63303832376230646136346261383965626633613739616330666232376366613332663839336531
+30653034386136643961323034346262613566373534333464653235636164393931393131316662
-32343031336363663865643165666435623462376130326433316562363530343662366432313031
+65656462623431613239336431313239343762643731663438323333613661343462633038333264
-63626538656633346563663735323030363231643933326337613634376531636235333339373633
+31303435313431373461623564396336386131383565376162386439383562653036373262643662
-66353362333265343964353966383363613336636536393734363363623363316532653533633434
+37326634646233326461633236336364356133383135326638623063313332616539353538663432
-39333162303834353362323362656630343733653336613065333462626637303264653361393462
+31396135396430646635323335323666646265646339333838326261393963383331356334303630
-32336238326535383662636465383832346438333230666662633430303964343236626331623536
+63313465356233363636336136356336366333636261613663663433343535323563663062626361
-65383666316431646538396661386332323037383666336138666135613763363633343934663836
+35323161376466383966343963306237396362323736666331633235383832376364343037656433
-32656362323631303732613235663135633939643165626231373162643963613637626235613365
+33326638396232396666393939303735636337313730363137663839393662613333393061386536
-32326266323431636434633234333730373836373039666137663232323539396364373061393232
+35353132366432623336333331386234326139653435376261366631356538303562383034623338
-30646432666365333336333836313333363537363163383034656136383164663331373632313564
+66353834633161313462663531623762356561393535656535613663393137663436313466633364
-34353731363338323438366464663938393632626530323537306233613866356234323364373766
+33313533343633376638333339653834313231393131363866333961393639393665373638353930
-34326662656263383864613538326536626133386532303932326362376632363631356535393937
+39653831613563313537333137323633613536363536613335363836336339613135346330626335
-33346462336636656165316166363364343330383337636361656438383661333366633532616131
+63323038626462656435343431326663643332363962393863393461336334616637316462363538
-37313033623430663039626131303933316561666233613666636433363537373264653331323136
+33333762393164396435646266376534363861633430643265646662626630643035396466363537
-66663532653233373735326333333738663931343735306262353831303330633136623966316431
+63386233663130373335376334353630386662306563323736623265333230623136356664666639
-39316462313066336536623438626163383139343532313932316435356431323865373035343465
+32316139386165623264616466353765613239313635653635343439666337656335393334323939
-30346237393531353833616136323431376530333635633632666431313938643539363831313539
+66393331653266316330633535636534663436316235373231626664393565303161643730323537
-38396338336136363165323135663836336139623865666631663237616664636233653663383965
+36373063326339326339653232323331663532653337343638653236306263313264323734303465
-39623665656563316334323738323730306631636565393662313536353565383033653365663461
+33363239653634623630393961346139343230363135393830336139386130356239346430306238
-38326432353166376438356238386161396638666131636536356333393563613461373263346538
+61616433343566393962656532333833363036373235386530303237653537363139373962386364
-36656138353762323662363061613764633466303566353338626666646533616137393336333333
+32336231613362353131623263313539623330663632646135313038346161346135353233303965
-30393733316636353266653039346237363830333831383535646531616130353534633062643135
+39356331626465613036376266376264396563373239333834336337383332646536346636623666
-64373533646462313035383236333866313866366130663863363162613234393762646662666233
+31386536343964643433616638386161383935386165363230643131336439623835326136646161
-30653666353333366365343036643462346361303536363935396133343166303339623461376563
+39343035383039396235653364396638656334396231323263636534633932386161616233343063
-39333163636466646534356337656431376663623833303235303534633634386665636162346634
+61373462366235383564313762366334313137363636333732313663356233653133323537663331
-34646665633639663763316339663539663261333436363935316334656330313835616138626237
+64636336663862303335316432393663653436313834323231663730623562373333346634303138
-35623363393532633937653132303635396536646635633062393661616538303631663136363038
+31353662333139626133623564333863363565616466353266343737616163386432636631613136
-35623539303963383063343338653130643233636537356264323238633839303337383665393333
+34313530383934336138336535373562636366653663383238376136376561306532383933336236
-36303330393638643464646535653833626531343634626531396261363139326336623765623039
+62613361613539663030323832666430356138376236383335393538306131333061313339323163
-32613237636366376463343766303964336661363432646436373963626537373137396661633766
+32313131383134663838393462343963623962613638656462356664303132386233363063316266
-63633830663035663764303634643662333464353234646232343066306131336533396435313239
+35656635333861366435396638653934663935306230373962346633613431353461373933316435
-66366630643564313665306130656463633065646430373334336664633264353336376439666137
+35373134643562616662656130396266613365326565666536653732333635346338643435376264
-65366537366462623136353539373961333238373733663837373430663865643334393565333861
+65323237386565363431653930373137633330363764663063393335633638653036623732316464
-35363035343561633164613631633532623164376339633630393633396437333034376339656538
+66373863303364333534316464636130633665383439626531383466313330393233663933666438
-32653030626434326632386635383739663932393331333062656565303939373566653031613839
+36333535636562396361643564343534626436373961636261666135386635316331326164316565
-31363162666330393232646562333833633266643165316464623533623539356339333365623966
+34386565636538633361613235303862303231343664363465373363306461356333363764356163
-65323638396531346261303835373138333262323466656263643737343734303237303638353036
+65396533626238356331346434383435343135326135366235393862663861636361363032613266
-3733
+34633631653261653230396338363762376563613138303533653530636666313864303334626261
+34346436316564663632303634343837303065306530306662343062633738653635653164656465
+36393239373763666131343739303132616366353365636338333263326539343862623462653639
+64616430663033663162306335303230643131633763633635306464346431393237666536343130
+35366231386237666331383132373835616365316665353235623735363530626266366437326537
+32326230306562343830666135326464383834623461643465336131356332376235623735633232
+62663535303661376465303533306530636366356632626137353135336264356266366335396539
+31616661363065366136323061303764366332326362653036353562336561336166316664346661
+63303835626463303731376337366265653931343238316631333032656535376439313335326265
+62383761623437323862643035333832653065396439303738343336653961623563383964326338
+38613464653530373938333737316133353064356362323933383765363566343638303233616233
+63333039363063616464616465313166626262363030326565346461313034633432643232356336
+65306534366234333562333764653539333935613166313065646430343834653833386434613436
+62613033313632623236663731343533643864373139613739336135353833386438353461626336
+64336334646139633633656266633034373461656539633238383531356537396439363233633466
+64663639383166303261303864383137623236643934356665623537363839396565633863376639
+64376131356637333562663731393437653236393366303830323239643736386464326539636234
+61353939356465656465666263336232373733326331623831376539336438373265666135306134
+64303736346431633332633635633839663235373864323664343830393336376336633235373164
+64326335326664376530313838386266613632633764373430643663306434303263613234616438
+6230

inventories/prod/group_vars/all.yml

@@ -1 +0,0 @@
-domain: cazzzer.com

inventories/prod/group_vars/alpina/vars.yml

@@ -1,6 +1,8 @@
 # Environment specific variables (prod)
 
 ---
+domain: cazzzer.com
+
 docker_ipv6_index: 255
 
 # Arrstack VPN
@@ -9,10 +11,16 @@ wg_psk: "{{ vault_wg_psk }}"
 wg_addresses: "{{ vault_wg_addresses }}"
 fw_vpn_input_ports: "{{ vault_fw_vpn_input_ports }}"
 
-# Authentik GitHub OAuth
+# Authentik External OAuth
 github_consumer_key: 32d5cae58d744c56fcc9
 github_consumer_secret: "{{ vault_github_consumer_secret }}"
+google_consumer_key: 606830535764-9vc8mjta87g9974pb7qasp82cpoc1d3a.apps.googleusercontent.com
+google_consumer_secret: "{{ vault_google_consumer_secret }}"
 
 # VPGen
 vpgen_ipv4_starting_addr: 10.18.11.100
 vpgen_ipv6_starting_addr: "{{ vault_vpgen_ipv6_starting_addr }}"
+
+# Woodpecker
+woodpecker_gitea_client_id: 3b7515f3-6005-4512-a2ee-5464dba315f8
+woodpecker_gitea_client_secret: "{{ vault_woodpecker_gitea_client_secret }}"

inventories/prod/group_vars/alpina/vault.yml

@@ -1,24 +1,32 @@
 $ANSIBLE_VAULT;1.1;AES256
-63353634643462306366336162646431616335613961343464626166303837363565393136373433
+36313835643238353932323631323439626432316436346533376365633332313963666433313333
-3663373337303837353564383531393462343064353534370a666333363166636137396634613139
+6134633133636133623130376237373462383164396338380a316463396139653161366536636336
-62313762373332303334666530333731653231663263663930633265333665383661643037303737
+64346664356538366538363239306631326464633635316161663963326635656430326637333963
-3239666139623937390a373066376363663865373266623831653964366565623138643138353866
+6462633236353132300a323062353639646238663737353461633733636530613036316364353864
-35343633323032326331393263316434396335643732363337643262373663646339663836623235
+34326534376639643734303137613866393464306334336566653134333765356361386436323939
-61356534393435303336313636646665366238303539343835343761633230383261333864396465
+35393535303635376162386266396431313739663961643061623037343463303637623130623131
-34336166346261613061616336633166383338623561626662333665323462623064666531633833
+31653761616639613964386432643561376637316435333064343837636463303033333432636234
-34333735343934356365306135386430646539366561666334393065363532393636653031393237
+39323735373161616133396566316266383165343033666530376333626264643531613334363634
-38633437383961376162366430393761366231636437316139373334623964396236643761306363
+35393766623361346461333764666139366632306362613362376133363239656562346263643066
-33653761356632643334333932346664353037366638363835663435363162396333616535363730
+65616538366532346537383432663766366161633234373562623531356339666661346164306563
-61623539363130633330303462613861393965643066303338353531346433363962373761623235
+35343339386631383462656466303563376237386137346437323634626163353464356462346364
-36313838323830333966326331656435653837363530353837636465333434666266373639626534
+35373061636237383335396231326563366230663566333665326338303564326263316630666233
-37663633353962336237316433653763616333333165343630346637346137613338333363653231
+65303930663862313137333630353837363265333532303133306466643462626662613166326132
-36326163343839363936613334373430326531646464626230616634663530343265356166346165
+66346439333739653965346236313766346532356233333164633538326135643662623533646561
-61306263613937626565626165616336626131636234643062306530326235646532313962626438
+65626530386333303362343830653430653866336261623566616362313739303939656364656363
-61363333373034313563373831633339653365663831376463663839333233616635656137333561
+37336331353766633534653936626139303061623531323362346564363665663438646533646166
-36396639393835316133393737313164353939336134623666396265396535353861643263366235
+62376534653562373138656465666133353235313935626534383537643436376665613865303363
-62323137306235633061386630636235613636393033333631633231316337393430383438643462
+62326562396361306131616363363866316232623635353663323537366563333239383636643763
-63343630353134363633383331373437623631333532663536643937616636666433623861643639
+35623366663463303831323730363036306363643364303532326339353633393739306366396331
-63653532626337333136313932396164393733333038396235313133326338356234363363633962
+33313230656431623462376135623438633164323064653866646165643263383832353138633931
-34336562396138333535363165343764363336316238323364326539343738633831636536306139
+66306463346361646561376334613837383762366365666638643434383034376339643239646463
-38653766656430353035396166616133343666303231363039386635363536306531343932656261
+66343461363233626635323535336462666339323032616136396239396534346434623238396330
-623162633233343566376630303538636664
+37653665643366323362313136386231396532323035363963623738346564356435303263303832
+37346532366432363638363330316464366361313461626535616165333433343835393565633766
+32663162386562373035333335303332323136613233613431386265626337653939326435396262
+61303631633838613962346663326232636438393563396230306361333335383462653432383766
+35376662353262303635316635363130383032366530396439613861653037383234363831333562
+37343332646534353838626366623361636261393865363633303631613837323733626264643835
+63376430613234386463336234623062656534643863656434386134616265333666613939393331
+39333166393538306135313431303831623063363533326330633062653333313733653831383736
+613864303461323739336563356161353234

inventories/prod/hosts

@@ -1,2 +1,2 @@
 [alpina]
-debbi.lab.home
+debbi.sys.cazzzer.com

inventories/staging/group_vars/all.yml

@@ -1 +0,0 @@
-domain: lab.cazzzer.com

inventories/staging/group_vars/alpina/vars.yml

@@ -1,6 +1,8 @@
 # Environment specific variables (staging)
 
 ---
+domain: lab.cazzzer.com
+
 docker_ipv6_index: 254
 
 # Arrstack VPN
@@ -9,10 +11,16 @@ wg_psk: "{{ vault_wg_psk }}"
 wg_addresses: "{{ vault_wg_addresses }}"
 fw_vpn_input_ports: "{{ vault_fw_vpn_input_ports }}"
 
-# Authentik GitHub OAuth
+# Authentik External OAuth
 github_consumer_key: dbacb8621c37320eb745
 github_consumer_secret: "{{ vault_github_consumer_secret }}"
+google_consumer_key: 606830535764-pec4b3sa2tohim3u9jl2jmnl1see46q1.apps.googleusercontent.com
+google_consumer_secret: "{{ vault_google_consumer_secret }}"
 
 # VPGen
 vpgen_ipv4_starting_addr: 10.18.11.50
 vpgen_ipv6_starting_addr: "{{ vault_vpgen_ipv6_starting_addr }}"
+
+# Woodpecker
+woodpecker_gitea_client_id: c7122416-b160-498b-8021-8f2837552588
+woodpecker_gitea_client_secret: "{{ vault_woodpecker_gitea_client_secret }}"

inventories/staging/group_vars/alpina/vault.yml

@@ -1,24 +1,32 @@
 $ANSIBLE_VAULT;1.1;AES256
-63633035373836396362626539323363363132366230343762366437326339343535663361633430
+36343339366166383430383235626463376339653331333635623936653135633633353064613634
-3039646662343464303663313631313361306136613461340a313836363237376238343232613463
+3263306161376232356634363532653266366665333364650a636365393465383165306563346132
-36633962613233386261366536333664346132396266383064353065353936653038346534343433
+37653564633630653635353464333939353266396562316663653933373065353536333130383065
-3734333932666436660a346539643637316432343761393635333265656165313464656631653236
+3864353332303164320a316439313164663736636465366539643131303663343861333164613561
-37303637333564383036623664616237313466643836663632363461353462386638326361396535
+37383965373964313535313335643164376164323263613539643933333035323837373662303030
-34353639303734323633306266356134393832366132633132383361336138643961663362616132
+66636465303566313334386435326433653032383962353739643861346161323738636366396239
-65356338353837623531383566363666633565646537353937656463343832613031633630306462
+39623336336234376339343562656362323932383265313161396435346530663330353266323433
-62313335353065323939366536356161653339316265373362376138396636626361643435386234
+66396538313365653963323164306464663565303364386466666636346533633661333634313236
-61633732383963653935363137346466623163396231303430346338323761643237383461303932
+33623936616239613264613730363039366561646535633239633564656166343162303633373366
-36663263633730346362386366663135653735303161383166633631333862303261356132303461
+37656163333838656533363735383332626632353237613666396633363531666366336630613064
-34633432633663623136303337613335643636356530626336366361373736333336366230346265
+66626561663766376531313666663963643766393965653564333062653139336230356330383464
-31396463363639303431386439303163643037376262616437643438323162653134643837363430
+38343562383430303132663964303736623238386562323033623861303432363363373934643332
-66336331636466383063656632306566346531336161653136623938616564333333326566616364
+63363239323664333131306237336134613137653136633932356238343733393632616464366134
-62383935616637656132373664343730653239396634313530633665633736653365366136656265
+33623038363032653134626337663863366663383433633134326239616136656139366535613565
-39343833333836323133376465376164323530643438353234353938663733323433373531636335
+61646330356330396236303566363834613236653733643162666536303435643133346633353632
-64366232613637636537626139656130303663353266363064666464373665336238383763616436
+62386135303262353332643135636164303963616234626132356161663463366434323864626261
-30303032393830333730353837656237666564346430613531653466646534613536353433613634
+33356536626263626261343937386666396561306334346435316262333431353234303836356563
-62653538366638366565633261346431396639663435356531366537353737363761356530643635
+31343566373935396633636133616265346235396333396664333534336162323039623937656336
-61653438346434363834653131646661366338633431303862333732326262626366633034323137
+36656133383966613333646336613039626563353862646238376461373264633233313836333062
-30323636616333356430346365643630366162323133376135366663343265346234346161306431
+30343134363862626630393035643762376435346532306462363437646238333463396230666465
-35383736336664636561623262643162636130366162326536656231653165386230333562383466
+64386365393063613139313164366562643066323461313364393265393638643137386561633530
-66323863656566396639316263376233613162396265373235306662663665613663626565623761
+65643861386531323836306339386462656530383533363831323461303131396666626464303136
-663938383964623436306662666663303330
+64343865616235616366633136393662623862383961323338366435396334653538303830616166
+39636164613466313033643639366635323666666235653633333436613133343962353664313838
+64356466393239666131363964643461346633313030643061643938643232343334313731636463
+37396637643232353539626239306463623237623534366666396164613135356136313534663231
+36613662653237343061316463386231656136383636393034333666633063613731316162333464
+64313866633062623530326233633166343434636639346565346337396461393637383333366435
+62393030383963396638653230613431623837353461313630343333376131616239313164336234
+62323739316536353835613032303438623230626563303934626466303934613566656232323663
+643265386333313065333737613438316532

inventories/staging/hosts

@@ -1,2 +1,2 @@
 [alpina]
-etappi.lab.home
+etappi.sys.cazzzer.com

poetry.lock

@@ -1,28 +1,30 @@
-# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.1.2 and should not be changed by hand.
 
 [[package]]
 name = "ansible"
-version = "10.5.0"
+version = "11.5.0"
 description = "Radically simple IT automation"
 optional = false
-python-versions = ">=3.10"
+python-versions = ">=3.11"
+groups = ["main"]
 files = [
-    {file = "ansible-10.5.0-py3-none-any.whl", hash = "sha256:1d10bddba58f1edd0fe0b8e0387e0fafc519535066bb3c919c33b6ea3ec32a0f"},
+    {file = "ansible-11.5.0-py3-none-any.whl", hash = "sha256:d20bc30f44a35678ca5f05868084f2f52a8bb6f024e85dc80639f6ac4364cc61"},
-    {file = "ansible-10.5.0.tar.gz", hash = "sha256:ba2045031a7d60c203b6e5fe1f8eaddd53ae076f7ada910e636494384135face"},
+    {file = "ansible-11.5.0.tar.gz", hash = "sha256:18a3fc73120a49ade9a9a67eb8f9d4f5009d2106c34ffeb9663ad928b76ed59b"},
 ]
 
 [package.dependencies]
-ansible-core = ">=2.17.5,<2.18.0"
+ansible-core = ">=2.18.5,<2.19.0"
 
 [[package]]
 name = "ansible-core"
-version = "2.17.5"
+version = "2.18.5"
 description = "Radically simple IT automation"
 optional = false
-python-versions = ">=3.10"
+python-versions = ">=3.11"
+groups = ["main"]
 files = [
-    {file = "ansible_core-2.17.5-py3-none-any.whl", hash = "sha256:10f165b475cf2bc8d886e532cadb32c52ee6a533649793101d3166bca9bd3ea3"},
+    {file = "ansible_core-2.18.5-py3-none-any.whl", hash = "sha256:4a1e75a24969d0a650d399bffbaf5a76d7c9b96a21a199a939fe836c3452718d"},
-    {file = "ansible_core-2.17.5.tar.gz", hash = "sha256:ae7f51fd13dc9d57c9bcd43ef23f9c255ca8f18f4b5c0011a4f9b724d92c5a8e"},
+    {file = "ansible_core-2.18.5.tar.gz", hash = "sha256:319304d161770a8a891c07dec8a22c528548a948a7097eaf1a79939395105535"},
 ]
 
 [package.dependencies]
@@ -38,6 +40,7 @@ version = "2.1.0"
 description = "R/W an ansible-vault yaml file"
 optional = false
 python-versions = "*"
+groups = ["main"]
 files = [
     {file = "ansible-vault-2.1.0.tar.gz", hash = "sha256:5ce8fdb5470f1449b76bf07ae2abc56480dad48356ae405c85b686efb64dbd5e"},
 ]
@@ -47,27 +50,46 @@ ansible = "*"
 setuptools = "*"
 
 [package.extras]
-dev = ["black", "flake8", "isort[pyproject]", "pytest"]
+dev = ["black ; python_version >= \"3.6\"", "flake8 ; python_version >= \"3.6\"", "isort[pyproject] ; python_version >= \"3.6\"", "pytest"]
 release = ["twine"]
 
 [[package]]
 name = "attrs"
-version = "24.2.0"
+version = "25.3.0"
 description = "Classes Without Boilerplate"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.8"
+groups = ["dev"]
 files = [
-    {file = "attrs-24.2.0-py3-none-any.whl", hash = "sha256:81921eb96de3191c8258c199618104dd27ac608d9366f5e35d011eae1867ede2"},
+    {file = "attrs-25.3.0-py3-none-any.whl", hash = "sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3"},
-    {file = "attrs-24.2.0.tar.gz", hash = "sha256:5cfb1b9148b5b086569baec03f20d7b6bf3bcacc9a42bebf87ffaaca362f6346"},
+    {file = "attrs-25.3.0.tar.gz", hash = "sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b"},
 ]
 
 [package.extras]
-benchmark = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-codspeed", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
+benchmark = ["cloudpickle ; platform_python_implementation == \"CPython\"", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pympler", "pytest (>=4.3.0)", "pytest-codspeed", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-cov = ["cloudpickle", "coverage[toml] (>=5.3)", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
+cov = ["cloudpickle ; platform_python_implementation == \"CPython\"", "coverage[toml] (>=5.3)", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-dev = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pre-commit", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
+dev = ["cloudpickle ; platform_python_implementation == \"CPython\"", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pre-commit-uv", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-docs = ["cogapp", "furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier (<24.7)"]
+docs = ["cogapp", "furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier"]
-tests = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
+tests = ["cloudpickle ; platform_python_implementation == \"CPython\"", "hypothesis", "mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-xdist[psutil]"]
-tests-mypy = ["mypy (>=1.11.1)", "pytest-mypy-plugins"]
+tests-mypy = ["mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\"", "pytest-mypy-plugins ; platform_python_implementation == \"CPython\" and python_version >= \"3.10\""]
+
+[[package]]
+name = "bitwarden_sdk"
+version = "1.0.0"
+description = "A Bitwarden Client for python"
+optional = false
+python-versions = ">=3.0"
+groups = ["main"]
+files = [
+    {file = "bitwarden_sdk-1.0.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:2fae1101b527ffdceed2f817d16d20076a5949df9fc64184053f09ff79f035f3"},
+]
+
+[package.dependencies]
+dateutils = ">=0.6.6"
+
+[package.source]
+type = "url"
+url = "https://files.pythonhosted.org/packages/dc/3a/42f4ae601947e39a48cb3e23e672fe467bb9ed22ebe869778860cece8c4a/bitwarden_sdk-1.0.0-cp312-cp312-manylinux_2_28_x86_64.whl"
 
 [[package]]
 name = "cffi"
@@ -75,6 +97,8 @@ version = "1.17.1"
 description = "Foreign Function Interface for Python calling C code."
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
+markers = "platform_python_implementation != \"PyPy\""
 files = [
     {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"},
     {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"},
@@ -150,59 +174,87 @@ pycparser = "*"
 
 [[package]]
 name = "cryptography"
-version = "43.0.1"
+version = "44.0.3"
 description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
 optional = false
-python-versions = ">=3.7"
+python-versions = "!=3.9.0,!=3.9.1,>=3.7"
+groups = ["main"]
 files = [
-    {file = "cryptography-43.0.1-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:8385d98f6a3bf8bb2d65a73e17ed87a3ba84f6991c155691c51112075f9ffc5d"},
+    {file = "cryptography-44.0.3-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:962bc30480a08d133e631e8dfd4783ab71cc9e33d5d7c1e192f0b7c06397bb88"},
-    {file = "cryptography-43.0.1-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:27e613d7077ac613e399270253259d9d53872aaf657471473ebfc9a52935c062"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4ffc61e8f3bf5b60346d89cd3d37231019c17a081208dfbbd6e1605ba03fa137"},
-    {file = "cryptography-43.0.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:68aaecc4178e90719e95298515979814bda0cbada1256a4485414860bd7ab962"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:58968d331425a6f9eedcee087f77fd3c927c88f55368f43ff7e0a19891f2642c"},
-    {file = "cryptography-43.0.1-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:de41fd81a41e53267cb020bb3a7212861da53a7d39f863585d13ea11049cf277"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:e28d62e59a4dbd1d22e747f57d4f00c459af22181f0b2f787ea83f5a876d7c76"},
-    {file = "cryptography-43.0.1-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:f98bf604c82c416bc829e490c700ca1553eafdf2912a91e23a79d97d9801372a"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:af653022a0c25ef2e3ffb2c673a50e5a0d02fecc41608f4954176f1933b12359"},
-    {file = "cryptography-43.0.1-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:61ec41068b7b74268fa86e3e9e12b9f0c21fcf65434571dbb13d954bceb08042"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:157f1f3b8d941c2bd8f3ffee0af9b049c9665c39d3da9db2dc338feca5e98a43"},
-    {file = "cryptography-43.0.1-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:014f58110f53237ace6a408b5beb6c427b64e084eb451ef25a28308270086494"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:c6cd67722619e4d55fdb42ead64ed8843d64638e9c07f4011163e46bc512cf01"},
-    {file = "cryptography-43.0.1-cp37-abi3-win32.whl", hash = "sha256:2bd51274dcd59f09dd952afb696bf9c61a7a49dfc764c04dd33ef7a6b502a1e2"},
+    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b424563394c369a804ecbee9b06dfb34997f19d00b3518e39f83a5642618397d"},
-    {file = "cryptography-43.0.1-cp37-abi3-win_amd64.whl", hash = "sha256:666ae11966643886c2987b3b721899d250855718d6d9ce41b521252a17985f4d"},
+    {file = "cryptography-44.0.3-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c91fc8e8fd78af553f98bc7f2a1d8db977334e4eea302a4bfd75b9461c2d8904"},
-    {file = "cryptography-43.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:ac119bb76b9faa00f48128b7f5679e1d8d437365c5d26f1c2c3f0da4ce1b553d"},
+    {file = "cryptography-44.0.3-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:25cd194c39fa5a0aa4169125ee27d1172097857b27109a45fadc59653ec06f44"},
-    {file = "cryptography-43.0.1-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1bbcce1a551e262dfbafb6e6252f1ae36a248e615ca44ba302df077a846a8806"},
+    {file = "cryptography-44.0.3-cp37-abi3-win32.whl", hash = "sha256:3be3f649d91cb182c3a6bd336de8b61a0a71965bd13d1a04a0e15b39c3d5809d"},
-    {file = "cryptography-43.0.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:58d4e9129985185a06d849aa6df265bdd5a74ca6e1b736a77959b498e0505b85"},
+    {file = "cryptography-44.0.3-cp37-abi3-win_amd64.whl", hash = "sha256:3883076d5c4cc56dbef0b898a74eb6992fdac29a7b9013870b34efe4ddb39a0d"},
-    {file = "cryptography-43.0.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:d03a475165f3134f773d1388aeb19c2d25ba88b6a9733c5c590b9ff7bbfa2e0c"},
+    {file = "cryptography-44.0.3-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:5639c2b16764c6f76eedf722dbad9a0914960d3489c0cc38694ddf9464f1bb2f"},
-    {file = "cryptography-43.0.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:511f4273808ab590912a93ddb4e3914dfd8a388fed883361b02dea3791f292e1"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f3ffef566ac88f75967d7abd852ed5f182da252d23fac11b4766da3957766759"},
-    {file = "cryptography-43.0.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:80eda8b3e173f0f247f711eef62be51b599b5d425c429b5d4ca6a05e9e856baa"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:192ed30fac1728f7587c6f4613c29c584abdc565d7417c13904708db10206645"},
-    {file = "cryptography-43.0.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:38926c50cff6f533f8a2dae3d7f19541432610d114a70808f0926d5aaa7121e4"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:7d5fe7195c27c32a64955740b949070f21cba664604291c298518d2e255931d2"},
-    {file = "cryptography-43.0.1-cp39-abi3-win32.whl", hash = "sha256:a575913fb06e05e6b4b814d7f7468c2c660e8bb16d8d5a1faf9b33ccc569dd47"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3f07943aa4d7dad689e3bb1638ddc4944cc5e0921e3c227486daae0e31a05e54"},
-    {file = "cryptography-43.0.1-cp39-abi3-win_amd64.whl", hash = "sha256:d75601ad10b059ec832e78823b348bfa1a59f6b8d545db3a24fd44362a1564cb"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:cb90f60e03d563ca2445099edf605c16ed1d5b15182d21831f58460c48bffb93"},
-    {file = "cryptography-43.0.1-pp310-pypy310_pp73-macosx_10_9_x86_64.whl", hash = "sha256:ea25acb556320250756e53f9e20a4177515f012c9eaea17eb7587a8c4d8ae034"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ab0b005721cc0039e885ac3503825661bd9810b15d4f374e473f8c89b7d5460c"},
-    {file = "cryptography-43.0.1-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c1332724be35d23a854994ff0b66530119500b6053d0bd3363265f7e5e77288d"},
+    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:3bb0847e6363c037df8f6ede57d88eaf3410ca2267fb12275370a76f85786a6f"},
-    {file = "cryptography-43.0.1-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fba1007b3ef89946dbbb515aeeb41e30203b004f0b4b00e5e16078b518563289"},
+    {file = "cryptography-44.0.3-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b0cc66c74c797e1db750aaa842ad5b8b78e14805a9b5d1348dc603612d3e3ff5"},
-    {file = "cryptography-43.0.1-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:5b43d1ea6b378b54a1dc99dd8a2b5be47658fe9a7ce0a58ff0b55f4b43ef2b84"},
+    {file = "cryptography-44.0.3-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:6866df152b581f9429020320e5eb9794c8780e90f7ccb021940d7f50ee00ae0b"},
-    {file = "cryptography-43.0.1-pp39-pypy39_pp73-macosx_10_9_x86_64.whl", hash = "sha256:88cce104c36870d70c49c7c8fd22885875d950d9ee6ab54df2745f83ba0dc365"},
+    {file = "cryptography-44.0.3-cp39-abi3-win32.whl", hash = "sha256:c138abae3a12a94c75c10499f1cbae81294a6f983b3af066390adee73f433028"},
-    {file = "cryptography-43.0.1-pp39-pypy39_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:9d3cdb25fa98afdd3d0892d132b8d7139e2c087da1712041f6b762e4f807cc96"},
+    {file = "cryptography-44.0.3-cp39-abi3-win_amd64.whl", hash = "sha256:5d186f32e52e66994dce4f766884bcb9c68b8da62d61d9d215bfe5fb56d21334"},
-    {file = "cryptography-43.0.1-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:e710bf40870f4db63c3d7d929aa9e09e4e7ee219e703f949ec4073b4294f6172"},
+    {file = "cryptography-44.0.3-pp310-pypy310_pp73-macosx_10_9_x86_64.whl", hash = "sha256:cad399780053fb383dc067475135e41c9fe7d901a97dd5d9c5dfb5611afc0d7d"},
-    {file = "cryptography-43.0.1-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:7c05650fe8023c5ed0d46793d4b7d7e6cd9c04e68eabe5b0aeea836e37bdcec2"},
+    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:21a83f6f35b9cc656d71b5de8d519f566df01e660ac2578805ab245ffd8523f8"},
-    {file = "cryptography-43.0.1.tar.gz", hash = "sha256:203e92a75716d8cfb491dc47c79e17d0d9207ccffcbcb35f598fbe463ae3444d"},
+    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fc3c9babc1e1faefd62704bb46a69f359a9819eb0292e40df3fb6e3574715cd4"},
+    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:e909df4053064a97f1e6565153ff8bb389af12c5c8d29c343308760890560aff"},
+    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:dad80b45c22e05b259e33ddd458e9e2ba099c86ccf4e88db7bbab4b747b18d06"},
+    {file = "cryptography-44.0.3-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:479d92908277bed6e1a1c69b277734a7771c2b78633c224445b5c60a9f4bc1d9"},
+    {file = "cryptography-44.0.3-pp311-pypy311_pp73-macosx_10_9_x86_64.whl", hash = "sha256:896530bc9107b226f265effa7ef3f21270f18a2026bc09fed1ebd7b66ddf6375"},
+    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:9b4d4a5dbee05a2c390bf212e78b99434efec37b17a4bff42f50285c5c8c9647"},
+    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:02f55fb4f8b79c1221b0961488eaae21015b69b210e18c386b69de182ebb1259"},
+    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:dd3db61b8fe5be220eee484a17233287d0be6932d056cf5738225b9c05ef4fff"},
+    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:978631ec51a6bbc0b7e58f23b68a8ce9e5f09721940933e9c217068388789fe5"},
+    {file = "cryptography-44.0.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:5d20cc348cca3a8aa7312f42ab953a56e15323800ca3ab0706b8cd452a3a056c"},
+    {file = "cryptography-44.0.3.tar.gz", hash = "sha256:fe19d8bc5536a91a24a8133328880a41831b6c5df54599a8417b62fe015d3053"},
 ]
 
 [package.dependencies]
 cffi = {version = ">=1.12", markers = "platform_python_implementation != \"PyPy\""}
 
 [package.extras]
-docs = ["sphinx (>=5.3.0)", "sphinx-rtd-theme (>=1.1.1)"]
+docs = ["sphinx (>=5.3.0)", "sphinx-rtd-theme (>=3.0.0) ; python_version >= \"3.8\""]
-docstest = ["pyenchant (>=1.6.11)", "readme-renderer", "sphinxcontrib-spelling (>=4.0.1)"]
+docstest = ["pyenchant (>=3)", "readme-renderer (>=30.0)", "sphinxcontrib-spelling (>=7.3.1)"]
-nox = ["nox"]
+nox = ["nox (>=2024.4.15)", "nox[uv] (>=2024.3.2) ; python_version >= \"3.8\""]
-pep8test = ["check-sdist", "click", "mypy", "ruff"]
+pep8test = ["check-sdist ; python_version >= \"3.8\"", "click (>=8.0.1)", "mypy (>=1.4)", "ruff (>=0.3.6)"]
-sdist = ["build"]
+sdist = ["build (>=1.0.0)"]
 ssh = ["bcrypt (>=3.1.5)"]
-test = ["certifi", "cryptography-vectors (==43.0.1)", "pretend", "pytest (>=6.2.0)", "pytest-benchmark", "pytest-cov", "pytest-xdist"]
+test = ["certifi (>=2024)", "cryptography-vectors (==44.0.3)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
 test-randomorder = ["pytest-randomly"]
 
+[[package]]
+name = "dateutils"
+version = "0.6.12"
+description = "Various utilities for working with date and datetime objects"
+optional = false
+python-versions = "*"
+groups = ["main"]
+files = [
+    {file = "dateutils-0.6.12-py2.py3-none-any.whl", hash = "sha256:f33b6ab430fa4166e7e9cb8b21ee9f6c9843c48df1a964466f52c79b2a8d53b3"},
+    {file = "dateutils-0.6.12.tar.gz", hash = "sha256:03dd90bcb21541bd4eb4b013637e4f1b5f944881c46cc6e4b67a6059e370e3f1"},
+]
+
+[package.dependencies]
+python-dateutil = "*"
+pytz = "*"
+
 [[package]]
 name = "grafanalib"
 version = "0.7.1"
 description = "Library for building Grafana dashboards"
 optional = false
 python-versions = "*"
+groups = ["dev"]
 files = [
     {file = "grafanalib-0.7.1-py3-none-any.whl", hash = "sha256:6fab5d7b837a1f2d1322ef762cd52e565ec0422707a7512765c59f668bdceb58"},
     {file = "grafanalib-0.7.1.tar.gz", hash = "sha256:3d92bb4e92ae78fe4e21c5b252ab51f4fdcacd8523ba5a44545b897b2a375b83"},
@@ -216,13 +268,14 @@ dev = ["flake8", "pytest"]
 
 [[package]]
 name = "jinja2"
-version = "3.1.4"
+version = "3.1.6"
 description = "A very fast and expressive template engine."
 optional = false
 python-versions = ">=3.7"
+groups = ["main"]
 files = [
-    {file = "jinja2-3.1.4-py3-none-any.whl", hash = "sha256:bc5dd2abb727a5319567b7a813e6a2e7318c39f4f487cfe6c89c6f9c7d25197d"},
+    {file = "jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67"},
-    {file = "jinja2-3.1.4.tar.gz", hash = "sha256:4a3aee7acbbe7303aede8e9648d13b8bf88a429282aa6122a993f0ac800cb369"},
+    {file = "jinja2-3.1.6.tar.gz", hash = "sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d"},
 ]
 
 [package.dependencies]
@@ -233,72 +286,73 @@ i18n = ["Babel (>=2.7)"]
 
 [[package]]
 name = "markupsafe"
-version = "3.0.1"
+version = "3.0.2"
 description = "Safely add untrusted strings to HTML/XML markup."
 optional = false
 python-versions = ">=3.9"
+groups = ["main"]
 files = [
-    {file = "MarkupSafe-3.0.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:db842712984e91707437461930e6011e60b39136c7331e971952bb30465bc1a1"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:3ffb4a8e7d46ed96ae48805746755fadd0909fea2306f93d5d8233ba23dda12a"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:67c519635a4f64e495c50e3107d9b4075aec33634272b5db1cde839e07367589"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:48488d999ed50ba8d38c581d67e496f955821dc183883550a6fbc7f1aefdc170"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f31ae06f1328595d762c9a2bf29dafd8621c7d3adc130cbb46278079758779ca"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:80fcbf3add8790caddfab6764bde258b5d09aefbe9169c183f88a7410f0f6dea"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:3341c043c37d78cc5ae6e3e305e988532b072329639007fd408a476642a89fd6"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:cb53e2a99df28eee3b5f4fea166020d3ef9116fdc5764bc5117486e6d1211b25"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-win32.whl", hash = "sha256:db15ce28e1e127a0013dfb8ac243a8e392db8c61eae113337536edb28bdc1f97"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-win32.whl", hash = "sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"},
-    {file = "MarkupSafe-3.0.1-cp310-cp310-win_amd64.whl", hash = "sha256:4ffaaac913c3f7345579db4f33b0020db693f302ca5137f106060316761beea9"},
+    {file = "MarkupSafe-3.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:26627785a54a947f6d7336ce5963569b5d75614619e75193bdb4e06e21d447ad"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:b954093679d5750495725ea6f88409946d69cfb25ea7b4c846eef5044194f583"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:973a371a55ce9ed333a3a0f8e0bcfae9e0d637711534bcb11e130af2ab9334e7"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:244dbe463d5fb6d7ce161301a03a6fe744dac9072328ba9fc82289238582697b"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d98e66a24497637dd31ccab090b34392dddb1f2f811c4b4cd80c230205c074a3"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:ad91738f14eb8da0ff82f2acd0098b6257621410dcbd4df20aaa5b4233d75a50"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:7044312a928a66a4c2a22644147bc61a199c1709712069a344a3fb5cfcf16915"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:a4792d3b3a6dfafefdf8e937f14906a51bd27025a36f4b188728a73382231d91"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-win32.whl", hash = "sha256:fa7d686ed9883f3d664d39d5a8e74d3c5f63e603c2e3ff0abcba23eac6542635"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-win32.whl", hash = "sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d"},
-    {file = "MarkupSafe-3.0.1-cp311-cp311-win_amd64.whl", hash = "sha256:9ba25a71ebf05b9bb0e2ae99f8bc08a07ee8e98c612175087112656ca0f5c8bf"},
+    {file = "MarkupSafe-3.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:8ae369e84466aa70f3154ee23c1451fda10a8ee1b63923ce76667e3077f2b0c4"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:40f1e10d51c92859765522cbd79c5c8989f40f0419614bcdc5015e7b6bf97fc5"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5a4cb365cb49b750bdb60b846b0c0bc49ed62e59a76635095a179d440540c346"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ee3941769bd2522fe39222206f6dd97ae83c442a94c90f2b7a25d847d40f4729"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:62fada2c942702ef8952754abfc1a9f7658a4d5460fabe95ac7ec2cbe0d02abc"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4c2d64fdba74ad16138300815cfdc6ab2f4647e23ced81f59e940d7d4a1469d9"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:fb532dd9900381d2e8f48172ddc5a59db4c445a11b9fab40b3b786da40d3b56b"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0f84af7e813784feb4d5e4ff7db633aba6c8ca64a833f61d8e4eade234ef0c38"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-win32.whl", hash = "sha256:cbf445eb5628981a80f54087f9acdbf84f9b7d862756110d172993b9a5ae81aa"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-win32.whl", hash = "sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30"},
-    {file = "MarkupSafe-3.0.1-cp312-cp312-win_amd64.whl", hash = "sha256:a10860e00ded1dd0a65b83e717af28845bb7bd16d8ace40fe5531491de76b79f"},
+    {file = "MarkupSafe-3.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:e81c52638315ff4ac1b533d427f50bc0afc746deb949210bc85f05d4f15fd772"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:312387403cd40699ab91d50735ea7a507b788091c416dd007eac54434aee51da"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2ae99f31f47d849758a687102afdd05bd3d3ff7dbab0a8f1587981b58a76152a"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c97ff7fedf56d86bae92fa0a646ce1a0ec7509a7578e1ed238731ba13aabcd1c"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a7420ceda262dbb4b8d839a4ec63d61c261e4e77677ed7c66c99f4e7cb5030dd"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:45d42d132cff577c92bfba536aefcfea7e26efb975bd455db4e6602f5c9f45e7"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:4c8817557d0de9349109acb38b9dd570b03cc5014e8aabf1cbddc6e81005becd"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6a54c43d3ec4cf2a39f4387ad044221c66a376e58c0d0e971d47c475ba79c6b5"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-win32.whl", hash = "sha256:c91b394f7601438ff79a4b93d16be92f216adb57d813a78be4446fe0f6bc2d8c"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-win32.whl", hash = "sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313-win_amd64.whl", hash = "sha256:fe32482b37b4b00c7a52a07211b479653b7fe4f22b2e481b9a9b099d8a430f2f"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:17b2aea42a7280db02ac644db1d634ad47dcc96faf38ab304fe26ba2680d359a"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:852dc840f6d7c985603e60b5deaae1d89c56cb038b577f6b5b8c808c97580f1d"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0778de17cff1acaeccc3ff30cd99a3fd5c50fc58ad3d6c0e0c4c58092b859396"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:800100d45176652ded796134277ecb13640c1a537cad3b8b53da45aa96330453"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d06b24c686a34c86c8c1fba923181eae6b10565e4d80bdd7bc1c8e2f11247aa4"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:33d1c36b90e570ba7785dacd1faaf091203d9942bc036118fab8110a401eb1a8"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:beeebf760a9c1f4c07ef6a53465e8cfa776ea6a2021eda0d0417ec41043fe984"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:bbde71a705f8e9e4c3e9e33db69341d040c827c7afa6789b14c6e16776074f5a"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-win32.whl", hash = "sha256:82b5dba6eb1bcc29cc305a18a3c5365d2af06ee71b123216416f7e20d2a84e5b"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-win32.whl", hash = "sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6"},
-    {file = "MarkupSafe-3.0.1-cp313-cp313t-win_amd64.whl", hash = "sha256:730d86af59e0e43ce277bb83970530dd223bf7f2a838e086b50affa6ec5f9295"},
+    {file = "MarkupSafe-3.0.2-cp313-cp313t-win_amd64.whl", hash = "sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:4935dd7883f1d50e2ffecca0aa33dc1946a94c8f3fdafb8df5c330e48f71b132"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:e9393357f19954248b00bed7c56f29a25c930593a77630c719653d51e7669c2a"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:40621d60d0e58aa573b68ac5e2d6b20d44392878e0bfc159012a5787c4e35bc8"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f94190df587738280d544971500b9cafc9b950d32efcb1fba9ac10d84e6aa4e6"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b6a387d61fe41cdf7ea95b38e9af11cfb1a63499af2759444b99185c4ab33f5b"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:8ad4ad1429cd4f315f32ef263c1342166695fad76c100c5d979c45d5570ed58b"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:e24bfe89c6ac4c31792793ad9f861b8f6dc4546ac6dc8f1c9083c7c4f2b335cd"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:2a4b34a8d14649315c4bc26bbfa352663eb51d146e35eef231dd739d54a5430a"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-win32.whl", hash = "sha256:242d6860f1fd9191aef5fae22b51c5c19767f93fb9ead4d21924e0bcb17619d8"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-win32.whl", hash = "sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f"},
-    {file = "MarkupSafe-3.0.1-cp39-cp39-win_amd64.whl", hash = "sha256:93e8248d650e7e9d49e8251f883eed60ecbc0e8ffd6349e18550925e31bd029b"},
+    {file = "MarkupSafe-3.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a"},
-    {file = "markupsafe-3.0.1.tar.gz", hash = "sha256:3e683ee4f5d0fa2dde4db77ed8dd8a876686e3fc417655c2ece9a90576905344"},
+    {file = "markupsafe-3.0.2.tar.gz", hash = "sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0"},
 ]
 
 [[package]]
@@ -307,6 +361,7 @@ version = "1.3.0"
 description = "A network address manipulation library for Python"
 optional = false
 python-versions = ">=3.7"
+groups = ["main"]
 files = [
     {file = "netaddr-1.3.0-py3-none-any.whl", hash = "sha256:c2c6a8ebe5554ce33b7d5b3a306b71bbb373e000bbbf2350dd5213cc56e3dbbe"},
     {file = "netaddr-1.3.0.tar.gz", hash = "sha256:5c3c3d9895b551b763779ba7db7a03487dc1f8e3b385af819af341ae9ef6e48a"},
@@ -317,13 +372,14 @@ nicer-shell = ["ipython"]
 
 [[package]]
 name = "packaging"
-version = "24.1"
+version = "25.0"
 description = "Core utilities for Python packages"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
 files = [
-    {file = "packaging-24.1-py3-none-any.whl", hash = "sha256:5b8f2217dbdbd2f7f384c41c628544e6d52f2d0f53c6d0c3ea61aa5d1d7ff124"},
+    {file = "packaging-25.0-py3-none-any.whl", hash = "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484"},
-    {file = "packaging-24.1.tar.gz", hash = "sha256:026ed72c8ed3fcce5bf8950572258698927fd1dbda10a5e981cdf0ac37f4f002"},
+    {file = "packaging-25.0.tar.gz", hash = "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"},
 ]
 
 [[package]]
@@ -332,17 +388,47 @@ version = "2.22"
 description = "C parser in Python"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
+markers = "platform_python_implementation != \"PyPy\""
 files = [
     {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"},
     {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"},
 ]
 
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+description = "Extensions to the standard Python datetime module"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+groups = ["main"]
+files = [
+    {file = "python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3"},
+    {file = "python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427"},
+]
+
+[package.dependencies]
+six = ">=1.5"
+
+[[package]]
+name = "pytz"
+version = "2025.2"
+description = "World timezone definitions, modern and historical"
+optional = false
+python-versions = "*"
+groups = ["main"]
+files = [
+    {file = "pytz-2025.2-py2.py3-none-any.whl", hash = "sha256:5ddf76296dd8c44c26eb8f4b6f35488f3ccbf6fbbd7adee0b7262d43f0ec2f00"},
+    {file = "pytz-2025.2.tar.gz", hash = "sha256:360b9e3dbb49a209c21ad61809c7fb453643e048b38924c765813546746e81c3"},
+]
+
 [[package]]
 name = "pyyaml"
 version = "6.0.2"
 description = "YAML parser and emitter for Python"
 optional = false
 python-versions = ">=3.8"
+groups = ["main"]
 files = [
     {file = "PyYAML-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086"},
     {file = "PyYAML-6.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf"},
@@ -405,6 +491,7 @@ version = "1.0.1"
 description = "Resolve abstract dependencies into concrete ones"
 optional = false
 python-versions = "*"
+groups = ["main"]
 files = [
     {file = "resolvelib-1.0.1-py2.py3-none-any.whl", hash = "sha256:d2da45d1a8dfee81bdd591647783e340ef3bcb104b54c383f70d422ef5cc7dbf"},
     {file = "resolvelib-1.0.1.tar.gz", hash = "sha256:04ce76cbd63fded2078ce224785da6ecd42b9564b1390793f64ddecbe997b309"},
@@ -418,25 +505,38 @@ test = ["commentjson", "packaging", "pytest"]
 
 [[package]]
 name = "setuptools"
-version = "75.1.0"
+version = "80.6.0"
 description = "Easily download, build, install, upgrade, and uninstall Python packages"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.9"
+groups = ["main"]
 files = [
-    {file = "setuptools-75.1.0-py3-none-any.whl", hash = "sha256:35ab7fd3bcd95e6b7fd704e4a1539513edad446c097797f2985e0e4b960772f2"},
+    {file = "setuptools-80.6.0-py3-none-any.whl", hash = "sha256:3f6586e9196c76f59857319fdca6571efd156a4b57d6069fd774145c4b5655a2"},
-    {file = "setuptools-75.1.0.tar.gz", hash = "sha256:d59a21b17a275fb872a9c3dae73963160ae079f1049ed956880cd7c09b120538"},
+    {file = "setuptools-80.6.0.tar.gz", hash = "sha256:79cf4c44dfd0b5fb890be2dccc3fbd405253ce3baedd2700b54880a75219ea25"},
 ]
 
 [package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)", "ruff (>=0.5.2)"]
+check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.8.0) ; sys_platform != \"cygwin\""]
-core = ["importlib-metadata (>=6)", "importlib-resources (>=5.10.2)", "jaraco.collections", "jaraco.functools", "jaraco.text (>=3.7)", "more-itertools", "more-itertools (>=8.8)", "packaging", "packaging (>=24)", "platformdirs (>=2.6.2)", "tomli (>=2.0.1)", "wheel (>=0.43.0)"]
+core = ["importlib_metadata (>=6) ; python_version < \"3.10\"", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging (>=24.2)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1) ; python_version < \"3.11\"", "wheel (>=0.43.0)"]
 cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "pyproject-hooks (!=1.1)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier", "towncrier (<24.7)"]
 enabler = ["pytest-enabler (>=2.2)"]
-test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "jaraco.test", "packaging (>=23.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"]
+test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"]
-type = ["importlib-metadata (>=7.0.2)", "jaraco.develop (>=7.21)", "mypy (==1.11.*)", "pytest-mypy"]
+type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.14.*)", "pytest-mypy"]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+description = "Python 2 and 3 compatibility utilities"
+optional = false
+python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
+groups = ["main"]
+files = [
+    {file = "six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274"},
+    {file = "six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81"},
+]
 
 [metadata]
-lock-version = "2.0"
+lock-version = "2.1"
-python-versions = "^3.10"
+python-versions = "^3.11, <3.13"
-content-hash = "334448cb0c7d192f0e10987a995ecefca5e136733cce4dd15dcc2238f1c371c8"
+content-hash = "5b094f68aebd417f93bcea68c57476c646cafcf11df1e0d4dc6482c70a6f3412"

pyproject.toml

@@ -6,12 +6,13 @@ authors = ["Iurii Tatishchev <itatishch@gmail.com>"]
 readme = "README.md"
 
 [tool.poetry.dependencies]
-python = "^3.10"
+python = "^3.11, <3.13" # bitwarden-sdk doesn't have a 3.13 wheel yet
-ansible = "^10.1.0"
+ansible = "^11.1.0"
 ansible-vault = "^2.1.0"
 netaddr = "^1.3.0"
+bitwarden-sdk = "^1.0.0"
 
-[tool.poetry.dev-dependencies]
+[tool.poetry.group.dev.dependencies]
 grafanalib = "^0.7.1"
 
 

renovate.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "docker-compose": {
+    "fileMatch": [
+      "(^|/)(?:docker-)?compose[^/]*\\.ya?ml(\\.j2)?$"
+    ]
+  }
+}

roles/alpina/tasks/deploy_compose_stack.yml

@@ -11,7 +11,7 @@
     path: "{{ current_stack_dest }}/{{ item.path }}"
     state: directory
     mode: "755"
-  loop: "{{ lookup('community.general.filetree', current_stack_source) }}"
+  loop: "{{ query('community.general.filetree', current_stack_source) }}"
   when: item.state == "directory"
 
 - name: Generate {{ current_stack_name }} deployment from templates
@@ -19,7 +19,7 @@
     src: "{{ item.src }}"
     dest: "{{ current_stack_dest }}/{{ item.path | regex_replace('\\.j2$', '') }}"
     mode: "644"
-  loop: "{{ lookup('community.general.filetree', current_stack_source) }}"
+  loop: "{{ query('community.general.filetree', current_stack_source) }}"
   when: item.state == "file" and item.path | regex_search('\\.j2$')
 
 - name: Generate {{ current_stack_name }} deployment from static files
@@ -27,7 +27,7 @@
     src: "{{ item.src }}"
     dest: "{{ current_stack_dest }}/{{ item.path }}"
     mode: "644"
-  loop: "{{ lookup('community.general.filetree', current_stack_source) }}"
+  loop: "{{ query('community.general.filetree', current_stack_source) }}"
   when: item.state == "file" and not item.path | regex_search('\\.j2$')
 
 - name: Deploy docker-compose for {{ current_stack_name }}

roles/alpina/tasks/main.yml

@@ -13,23 +13,9 @@
     path: "{{ alpina_svc_path }}"
     mode: "700"
 
-- name: Deploy collection services
-  vars:
-    collection: services
-    stacks:
-      - traefik
-      - monitoring
-      - authentik
-      - minio
-  import_tasks: deploy_collection.yml
-
 - name: Deploy collection apps
   vars:
     collection: apps
     stacks:
-      - gitea
       - nextcloud
-      - jellyfin
-      - arrstack
-      - vpgen
   import_tasks: deploy_collection.yml

roles/alpina/templates/apps/arrstack/compose.yml.j2

@@ -2,8 +2,6 @@
 
 networks:
   {{ helpers.default_network(249) | indent(2) }}
-  traefik_traefik:
-    external: true
 
 services:
   gluetun:
@@ -11,14 +9,13 @@ services:
     container_name: gluetun
     cap_add:
       - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
     sysctls:
       - net.ipv6.conf.all.disable_ipv6=0
     env_file:
       - .env.gluetun
     restart: unless-stopped
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/gluetun:/gluetun
 
@@ -49,9 +46,6 @@ services:
     restart: unless-stopped
     depends_on:
       - qbittorrent
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/config/prowlarr:/config
 
@@ -63,9 +57,6 @@ services:
     restart: unless-stopped
     depends_on:
       - qbittorrent
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/config/sonarr:/config
       - {{ base_volume_path }}/arrstack/downloads:/downloads
@@ -79,9 +70,6 @@ services:
     restart: unless-stopped
     depends_on:
       - qbittorrent
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/arrstack/config/radarr:/config
       - {{ base_volume_path }}/arrstack/downloads:/downloads

roles/alpina/templates/apps/gitea/.env.gitea.j2

@@ -25,5 +25,7 @@ GITEA__security__INTERNAL_TOKEN={{ internal_token }}
 
 GITEA__oauth2__JWT_SECRET={{ jwt_secret }}
 
+GITEA__webhook__ALLOWED_HOST_LIST="external,woodpecker.{{ domain }}"
+
 # Indexer
 GITEA__indexer__REPO_INDEXER_ENABLED=true

roles/alpina/templates/apps/gitea/compose.yml.j2

@@ -2,21 +2,16 @@
 
 networks:
   {{ helpers.default_network(199) | indent(2) }}
-  traefik_traefik:
-    external: true
 
 services:
   server:
-    image: gitea/gitea:1.22
+    image: gitea/gitea
     container_name: gitea_server
     labels:
       - {{ helpers.traefik_labels('gitea', port='3000') | indent(6) }}
     restart: unless-stopped
     env_file:
       - .env.gitea
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/gitea/gitea:/data
     depends_on:
@@ -27,7 +22,5 @@ services:
     restart: unless-stopped
     env_file:
       - .env.db
-    networks:
-      - default
     volumes:
       - {{ base_volume_path }}/gitea/postgres:/var/lib/postgresql/data

roles/alpina/templates/apps/jellyfin/compose.yml.j2

@@ -2,8 +2,6 @@
 
 networks:
   {{ helpers.default_network(197) | indent(2) }}
-  traefik_traefik:
-    external: true
 
 services:
   jellyfin:
@@ -14,9 +12,6 @@ services:
     restart: unless-stopped
     env_file:
       - .env.jellyfin
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/jellyfin/config:/config
       - {{ base_volume_path }}/jellyfin/cache:/cache

roles/alpina/templates/apps/nextcloud/.env.j2

@@ -1 +0,0 @@
-NEXTCLOUD_VERSION=30-apache

roles/alpina/templates/apps/nextcloud/compose.yml.j2

@@ -2,13 +2,10 @@
 
 networks:
   {{ helpers.default_network(198) | indent(2) }}
-  traefik_traefik:
-    external: true
-
 
 services:
   app:
-    image: nextcloud:${NEXTCLOUD_VERSION}
+    image: &nextcloud_image nextcloud:stable-apache
     container_name: nextcloud_app
     labels:
       - {{ helpers.traefik_labels('nc', port='80') | indent(6) }}
@@ -18,40 +15,28 @@ services:
       - redis
     env_file:
       - .env.nextcloud
-    networks:
-      - default
     volumes:
       - {{ base_volume_path }}/nextcloud/nextcloud:/var/www/html
-      - {{ base_volume_path }}/nextcloud/nextcloud_config:/var/www/html/config
+      - {{ base_volume_path }}/nextcloud/nextcloud_config/config.php:/var/www/html/config
       - {{ base_volume_path }}/nextcloud/nextcloud_data:/var/www/html/data
 
   cron:
-    image: nextcloud:${NEXTCLOUD_VERSION}
+    image: *nextcloud_image
     container_name: nextcloud_cron
     restart: unless-stopped
     depends_on:
       - app
     entrypoint: /cron.sh
-    networks:
-      - default
     volumes:
-      - {{ base_volume_path }}/nextcloud/nextcloud:/var/www/html
+      - {{ base_volume_path }}/nextcloud/nextcloud/custom_apps:/var/www/html/custom_apps
-      - {{ base_volume_path }}/nextcloud/nextcloud_config:/var/www/html/config
+      - {{ base_volume_path }}/nextcloud/nextcloud_config/config.php:/var/www/html/config/config.php
       - {{ base_volume_path }}/nextcloud/nextcloud_data:/var/www/html/data
 
   notify_push:
-    image: nextcloud:${NEXTCLOUD_VERSION}
+    image: *nextcloud_image
     container_name: nextcloud_notify_push
-    {# TODO: Refactor this and minio -#}
     labels:
-      - traefik.enable=true
+      - {{ helpers.traefik_labels('nc', port='7867', path_prefix='/push') | indent(6) }}
-      - traefik.http.routers.nc-notify.rule=Host(`nc.{{ domain }}`) && PathPrefix(`/push`)
-      - traefik.http.routers.nc-notify.entrypoints=websecure
-      - traefik.http.routers.nc-notify.tls=true
-      - traefik.http.routers.nc-notify.tls.certresolver=letsencrypt
-      - traefik.http.routers.nc-notify.tls.domains.0.main={{ domain }}
-      - traefik.http.routers.nc-notify.tls.domains.0.sans=*.{{ domain }}
-      - traefik.http.services.nc-notify.loadbalancer.server.port=7867
     restart: unless-stopped
     user: www-data
     env_file:
@@ -68,8 +53,6 @@ services:
     restart: unless-stopped
     env_file:
       - .env.db
-    networks:
-      - default
     volumes:
       - {{ base_volume_path }}/nextcloud/db:/var/lib/postgresql/data
 
@@ -79,8 +62,6 @@ services:
     restart: unless-stopped
     env_file:
       - .env.redis
-    networks:
-      - default
     command:
       - sh
       - -c

roles/alpina/templates/apps/pgrok/compose.yml.j2

@@ -0,0 +1,31 @@
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
+
+networks:
+  {{ helpers.default_network(194) | indent(2) }}
+
+#  https://github.com/pgrok/pgrok/blob/main/docs/admin/docker.md#docker-compose
+services:
+  server:
+    image: ghcr.io/pgrok/pgrokd:latest
+    container_name: pgrok_server
+    labels:
+      - {{ helpers.traefik_labels('pgrok', port='3320') | indent(6) }}
+      - {{ helpers.traefik_labels('pgrok', port='3000', wildcard=true) | indent(6) }}
+    restart: unless-stopped
+    volumes:
+      - ./pgrokd.yml:/var/opt/pgrokd/pgrokd.yml
+    ports:
+      - "2222:2222"
+    depends_on:
+      - db
+
+  db:
+    image: postgres:17-alpine
+    container_name: pgrok_db
+    restart: unless-stopped
+    volumes:
+      - {{ base_volume_path }}/pgrok/postgres:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: pgrok
+      POSTGRES_USER: pgrok
+      POSTGRES_PASSWORD: "{{ pgrok_db_password }}"

roles/alpina/templates/apps/pgrok/pgrokd.yml.j2

@@ -0,0 +1,29 @@
+external_url: "https://pgrok.{{ domain }}"
+web:
+  port: 3320
+proxy:
+  port: 3000
+  scheme: https
+  domain: "pgrok.{{ domain }}"
+sshd:
+  port: 2222
+
+database:
+  host: db
+  port: 5432
+  user: pgrok
+  password: "{{ pgrok_db_password }}"
+  database: pgrok
+
+identity_provider:
+  type: oidc
+  display_name: Authentik
+  issuer: "https://auth.{{ domain }}/application/o/pgrok/"
+  client_id: "pgrok"
+  client_secret: "{{ auth_pgrok_client_secret }}"
+  field_mapping:
+    identifier: "preferred_username"
+    display_name: "name"
+    email: "email"
+# # The required domain name, "field_mapping.email" is required to set for this to work.
+  #  required_domain: "example.com"

roles/alpina/templates/apps/syncthing/compose.yml.j2

@@ -0,0 +1,16 @@
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
+
+networks:
+  {{ helpers.default_network(193) | indent(2) }}
+
+services:
+  syncthing:
+    image: linuxserver/syncthing
+    container_name: syncthing
+    labels:
+      - {{ helpers.traefik_labels('sync', port='8384', auth=true) | indent(6) }}
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - {{ base_volume_path }}/syncthing/config:/config
+      - {{ base_volume_path }}/syncthing/data:/data

roles/alpina/templates/apps/vpgen/.env.vpgen.j2

@@ -1,8 +1,17 @@
 DATABASE_URL=file:/data/vpgen.db
 
-AUTH_DOMAIN=auth.{{ domain }}
+PUBLIC_AUTH_AUTHENTIK_ENABLE=1
-AUTH_CLIENT_ID=vpgen
+AUTH_AUTHENTIK_REQUIRE_INVITE=0
-AUTH_CLIENT_SECRET={{ auth_vpgen_client_secret }}
+AUTH_AUTHENTIK_DOMAIN="auth.{{ domain }}"
+AUTH_AUTHENTIK_CLIENT_ID=vpgen
+AUTH_AUTHENTIK_CLIENT_SECRET="{{ auth_vpgen_client_secret }}"
+
+PUBLIC_AUTH_GOOGLE_ENABLE=1
+AUTH_GOOGLE_REQUIRE_INVITE=1
+AUTH_GOOGLE_CLIENT_ID="{{ google_consumer_key }}"
+AUTH_GOOGLE_CLIENT_SECRET="{{ google_consumer_secret }}"
+
+AUTH_INVITE_TOKEN="{{ vpgen_auth_invite_token }}"
 
 OPNSENSE_API_URL={{ vpgen_opnsense_api_url }}
 OPNSENSE_API_KEY={{ vpgen_opnsense_api_key }}

roles/alpina/templates/apps/woodpecker/compose.yml.j2

@@ -0,0 +1,35 @@
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
+
+networks:
+  {{ helpers.default_network(195) | indent(2) }}
+
+services:
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:v3
+    container_name: woodpecker_server
+    labels:
+      - {{ helpers.traefik_labels('woodpecker', port='8000') | indent(6) }}
+    restart: unless-stopped
+    volumes:
+      - {{ base_volume_path }}/woodpecker/data:/var/lib/woodpecker
+    environment:
+      - WOODPECKER_OPEN=true
+      - WOODPECKER_HOST=https://woodpecker.{{ domain }}
+      - WOODPECKER_GITEA=true
+      - WOODPECKER_GITEA_URL=https://gitea.{{ domain }}
+      - WOODPECKER_GITEA_CLIENT={{ woodpecker_gitea_client_id }}
+      - WOODPECKER_GITEA_SECRET={{ woodpecker_gitea_client_secret }}
+      - WOODPECKER_AGENT_SECRET={{ woodpecker_agent_secret }}
+
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:v3
+    container_name: woodpecker_agent
+    restart: unless-stopped
+    depends_on:
+      - woodpecker-server
+    volumes:
+      - {{ base_volume_path }}/woodpecker/agent_config:/etc/woodpecker
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - WOODPECKER_SERVER=woodpecker-server:9000
+      - WOODPECKER_AGENT_SECRET={{ woodpecker_agent_secret }}

roles/alpina/templates/services/authentik/blueprints/alpina-enrollment-internal.yaml.j2

@@ -0,0 +1,225 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Alpina - Enrollment by Invitation (Internal)
+entries:
+  # Flow for internal enrollment by invitation
+  - identifiers:
+      slug: enrollment-internal-invitation-flow
+    model: authentik_flows.flow
+    id: flow
+    attrs:
+      name: Alpina Enrollment Flow
+      title: Sign Up
+      designation: enrollment
+      authentication: require_unauthenticated
+
+  # Prompt fields
+  - identifiers:
+      name: alpina-enrollment-field-name
+    model: authentik_stages_prompt.prompt
+    id: prompt-field-name
+    attrs:
+      field_key: name
+      label: Name
+      type: text
+      required: true
+      placeholder: Name
+      placeholder_expression: false
+      order: 0
+  - identifiers:
+      name: alpina-enrollment-field-password
+    model: authentik_stages_prompt.prompt
+    id: prompt-field-password
+    attrs:
+      field_key: password
+      label: Password
+      type: password
+      required: true
+      placeholder: Password
+      placeholder_expression: false
+      order: 1
+  - identifiers:
+      name: alpina-enrollment-field-password-repeat
+    model: authentik_stages_prompt.prompt
+    id: prompt-field-password-repeat
+    attrs:
+      field_key: password_repeat
+      label: Password (repeat)
+      type: password
+      required: true
+      placeholder: Password (repeat)
+      placeholder_expression: false
+      order: 2
+
+  # Flow stages
+  - identifiers:
+      name: alpina-enrollment-invitation
+    model: authentik_stages_invitation.invitationstage
+    id: enrollment-invitation
+  - identifiers:
+      name: alpina-enrollment-identification-oauth
+    model: authentik_stages_identification.identificationstage
+    id: enrollment-identification-oauth
+    attrs:
+      user_fields:
+        - email
+      pretend_user_exists: true
+      show_matched_user: false
+      sources:
+        - !Find [authentik_sources_oauth.oauthsource, [slug, github-enrollment]]
+        - !Find [authentik_sources_oauth.oauthsource, [slug, google-enrollment]]
+  - identifiers:
+      name: alpina-enrollment-deny-existing-email
+    model: authentik_stages_deny.denystage
+    id: enrollment-deny-existing-email
+    attrs:
+      deny_message: "An account with this email already exists"
+  - identifiers:
+      name: alpina-enrollment-prompt-name-password
+    model: authentik_stages_prompt.promptstage
+    id: enrollment-prompt-name-password
+    attrs:
+      fields:
+        - !KeyOf prompt-field-name
+        - !KeyOf prompt-field-password
+        - !KeyOf prompt-field-password-repeat
+      validation_policies:
+        - !Find [authentik_policies_password.passwordpolicy, [name, default-password-change-password-policy]]
+  - identifiers:
+      name: alpina-enrollment-user-write
+    model: authentik_stages_user_write.userwritestage
+    id: enrollment-user-write
+    attrs:
+      user_type: internal
+      create_users_group: !Find [authentik_core.group, [name, {{ auth_default_enrollment_group }}]]
+  - identifiers:
+      name: alpina-enrollment-email-verify
+    model: authentik_stages_email.emailstage
+    id: enrollment-email-verify
+    attrs:
+      use_global_settings: true
+      template: email/account_confirmation.html
+      activate_user_on_success: true
+  - identifiers:
+      name: alpina-enrollment-user-login
+    model: authentik_stages_user_login.userloginstage
+    id: enrollment-user-login
+
+  # Policies
+  - identifiers:
+      name: alpina-enrollment-invited-used-policy
+    model: authentik_policies_event_matcher.eventmatcherpolicy
+    id: enrollment-invited-used-policy
+    attrs:
+      action: invitation_used
+  - identifiers:
+      name: alpina-enrollment-unique-email-policy
+    model: authentik_policies_expression.expressionpolicy
+    id: enrollment-unique-email-policy
+    attrs:
+      expression: |
+        # https://docs.goauthentik.io/docs/customize/policies/expression/unique_email
+        from authentik.core.models import User
+        email = request.context["flow_plan"].context["pending_user"].email
+
+        if User.objects.filter(email=email).exists():
+          ak_message("Email address in use")
+          return False
+
+        if request.context["flow_plan"].context.get("prompt_data") is None:
+          request.context["flow_plan"].context["prompt_data"] = {}
+
+        request.context["flow_plan"].context["prompt_data"]["email"] = email
+        request.context["flow_plan"].context["prompt_data"]["username"] = email
+        return True
+
+  - identifiers:
+      name: alpina-enrollment-user-write-add-groups-policy
+    model: authentik_policies_expression.expressionpolicy
+    id: enrollment-user-write-add-groups-policy
+    attrs:
+        expression: |
+          # https://docs.goauthentik.io/docs/add-secure-apps/flows-stages/stages/user_write
+          from authentik.core.models import Group
+          ak_logger.info("Adding groups", request=request, prompt_data=request.context["prompt_data"], invitation=request.context.get("invitation"))
+
+          requested_groups = request.context["prompt_data"].get("alpina_add_groups")
+          if requested_groups is None:
+            return True
+
+          groups = []
+          for group_name in requested_groups:
+            group, _ = Group.objects.get_or_create(name=group_name)
+            groups.append(group)
+
+          # ["groups"] *must* be set to an array of Group objects, names alone are not enough.
+          request.context["flow_plan"].context["groups"] = groups
+          return True
+
+  # Flow stage bindings
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-invitation
+      order: 0
+    model: authentik_flows.flowstagebinding
+    id: enrollment-invitation-binding
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-identification-oauth
+      order: 1
+    model: authentik_flows.flowstagebinding
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-deny-existing-email
+      order: 2
+    model: authentik_flows.flowstagebinding
+    id: enrollment-deny-existing-email-binding
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-prompt-name-password
+      order: 10
+    model: authentik_flows.flowstagebinding
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-user-write
+      order: 20
+    model: authentik_flows.flowstagebinding
+    id: enrollment-user-write-binding
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-email-verify
+      order: 30
+    model: authentik_flows.flowstagebinding
+  - identifiers:
+      target: !KeyOf flow
+      stage: !KeyOf enrollment-user-login
+      order: 100
+    model: authentik_flows.flowstagebinding
+
+  # Stage policy bindings
+  # Log used invitations
+  - identifiers:
+      target: !KeyOf enrollment-invitation-binding
+      policy: !KeyOf enrollment-invited-used-policy
+      order: 0
+    model: authentik_policies.policybinding
+    attrs:
+      negate: true
+  # Deny existing email addresses
+  - identifiers:
+      target: !KeyOf enrollment-deny-existing-email-binding
+      policy: !KeyOf enrollment-unique-email-policy
+      order: 0
+    model: authentik_policies.policybinding
+    attrs:
+      negate: true
+  # Add groups to user from invitation "alpina_add_groups" field
+  # This only work for email sign up, as the invitation flow context isn't
+  # preserved for the default-source-enrollment flow
+  - identifiers:
+      target: !KeyOf enrollment-user-write-binding
+      policy: !KeyOf enrollment-user-write-add-groups-policy
+      order: 0
+    model: authentik_policies.policybinding

roles/alpina/templates/services/authentik/blueprints/alpina-groups.yaml.j2

@@ -38,3 +38,8 @@ entries:
         return {
           "policy": policy,
         }
+
+  - identifiers:
+      name: "vpgen"
+    model: authentik_core.group
+    id: "vpgen"

roles/alpina/templates/services/authentik/blueprints/alpina-oauth-sources.yaml.j2

@@ -0,0 +1,79 @@
+version: 1
+metadata:
+  labels:
+    blueprints.goauthentik.io/instantiate: "true"
+  name: Alpina - External OAuth
+entries:
+  {% set sources = {
+    "GitHub": {
+      "provider_type": "github",
+      "consumer_key": github_consumer_key,
+      "consumer_secret": github_consumer_secret,
+    },
+    "Google": {
+      "provider_type": "google",
+      "consumer_key": google_consumer_key,
+      "consumer_secret": google_consumer_secret,
+    },
+  } -%}
+  {% for source in sources.keys() -%}
+  - identifiers:
+      slug: {{ source | lower }}-auth
+    model: authentik_sources_oauth.oauthsource
+    attrs:
+      provider_type: {{ sources[source]["provider_type"] }}
+      name: {{ source }} (Auth Only)
+      consumer_key: {{ sources[source]["consumer_key"] }}
+      consumer_secret: {{ sources[source]["consumer_secret"] }}
+      user_matching_mode: email_link
+      user_path_template: goauthentik.io/sources/%(slug)s
+      authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
+  - identifiers:
+      slug: {{ source | lower }}-enrollment
+    model: authentik_sources_oauth.oauthsource
+    attrs:
+      provider_type: {{ sources[source]["provider_type"] }}
+      name: {{ source }} (Auth and Enrollment)
+      consumer_key: {{ sources[source]["consumer_key"] }}
+      consumer_secret: {{ sources[source]["consumer_secret"] }}
+      user_matching_mode: email_link
+      user_path_template: goauthentik.io/sources/%(slug)s
+      authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
+      enrollment_flow: !Find [authentik_flows.flow, [slug, default-source-enrollment]]
+  {% endfor %}
+
+  # Modify default source enrollment to use email as username
+  - identifiers:
+      slug: default-source-enrollment
+    model: authentik_flows.flow
+    id: source-enrollment-flow
+    attrs:
+      policy_engine_mode: all
+  - identifiers:
+      name: alpina-email-as-username-policy
+    model: authentik_policies_expression.expressionpolicy
+    id: email-as-username-policy
+    attrs:
+      expression: |
+        # https://docs.goauthentik.io/docs/users-sources/sources/social-logins/google/#username-mapping
+        email = request.context["prompt_data"].get("email")
+        # Direct set username to email
+        request.context["prompt_data"]["username"] = email
+        # Set username to email without domain
+        # request.context["prompt_data"]["username"] = email.split("@")[0]
+        return True
+  - identifiers:
+      policy: !KeyOf email-as-username-policy
+      target: !KeyOf source-enrollment-flow
+    model: authentik_policies.policybinding
+    attrs:
+      order: 0
+
+  # Modify default source enrollment to create internal users
+  # with the internal user type and the users group
+  - identifiers:
+      name: default-source-enrollment-write
+    model: authentik_stages_user_write.userwritestage
+    attrs:
+      user_type: internal
+      create_users_group: !Find [authentik_core.group, [name, {{ auth_default_enrollment_group }}]]

roles/alpina/templates/services/authentik/blueprints/apps-oauth2.yaml.j2

@@ -38,6 +38,13 @@ entries:
       "icon": "https://vpgen."~ domain ~"/favicon.png",
       "client_secret": auth_vpgen_client_secret,
       "ui_group": "Apps",
+      "allowed_for_groups": ["admins", "users", "vpgen"],
+    },
+    "Pgrok": {
+      "redirect_uri": "https://pgrok."~ domain ~"/-/oidc/callback",
+      "icon": "https://pgrok."~ domain ~"/pgrok.svg",
+      "client_secret": auth_pgrok_client_secret,
+      "ui_group": "Apps",
       "allowed_for_groups": ["admins", "users"],
     },
   } -%}

roles/alpina/templates/services/authentik/blueprints/apps-proxy.yaml.j2

@@ -13,6 +13,13 @@ entries:
       "ui_group": "Services",
       "allowed_for_groups": ["admins"],
     },
+    "Syncthing": {
+      "host": "sync",
+      "icon": "https://sync."~ domain ~"/assets/img/favicon-default.png",
+      "unauthenticated_paths": "^/assets/img/favicon-default.png$",
+      "ui_group": "Apps",
+      "allowed_for_groups": ["admins"],
+    },
     "qBit": {
       "host": "qbit",
       "icon": "https://qbit."~ domain ~"/images/qbittorrent-tray.svg",

roles/alpina/templates/services/authentik/blueprints/default-authentication.yaml.j2

@@ -48,7 +48,8 @@ entries:
       passwordless_flow: !Find [authentik_flows.flow, [slug, authentication-passwordless-flow]]
       sources:
         - !Find [authentik_core.source, [slug, authentik-built-in]]
-        - !Find [authentik_sources_oauth.oauthsource, [slug, github]]
+        - !Find [authentik_sources_oauth.oauthsource, [slug, github-auth]]
+        - !Find [authentik_sources_oauth.oauthsource, [slug, google-auth]]
 
     # Enable compatibility mode for the default authentication flow for better autofill support
   - identifiers:

roles/alpina/templates/services/authentik/blueprints/default-enrollment-internal.yaml.j2

@@ -1,152 +0,0 @@
-version: 1
-metadata:
-  labels:
-    blueprints.goauthentik.io/instantiate: "true"
-  name: Alpina - Default Enrollment by Invitation (Internal)
-entries:
-  # Flow for internal enrollment by invitation
-  - identifiers:
-      slug: enrollment-internal-invitation-flow
-    model: authentik_flows.flow
-    id: flow
-    attrs:
-      name: Default enrollment Flow
-      title: Welcome to authentik!
-      designation: enrollment
-      authentication: require_unauthenticated
-
-  # Prompt fields
-  - identifiers:
-      name: default-enrollment-field-username
-    model: authentik_stages_prompt.prompt
-    id: prompt-field-username
-    attrs:
-      field_key: username
-      label: Username
-      type: username
-      required: true
-      placeholder: Username
-      placeholder_expression: false
-      order: 0
-  - identifiers:
-      name: default-enrollment-field-password
-    model: authentik_stages_prompt.prompt
-    id: prompt-field-password
-    attrs:
-      field_key: password
-      label: Password
-      type: password
-      required: true
-      placeholder: Password
-      placeholder_expression: false
-      order: 0
-  - identifiers:
-      name: default-enrollment-field-password-repeat
-    model: authentik_stages_prompt.prompt
-    id: prompt-field-password-repeat
-    attrs:
-      field_key: password_repeat
-      label: Password (repeat)
-      type: password
-      required: true
-      placeholder: Password (repeat)
-      placeholder_expression: false
-      order: 1
-  - identifiers:
-      name: default-enrollment-field-name
-    model: authentik_stages_prompt.prompt
-    id: prompt-field-name
-    attrs:
-      field_key: name
-      label: Name
-      type: text
-      required: true
-      placeholder: Name
-      placeholder_expression: false
-      order: 0
-  - identifiers:
-      name: default-enrollment-field-email
-    model: authentik_stages_prompt.prompt
-    id: prompt-field-email
-    attrs:
-      field_key: email
-      label: Email
-      type: email
-      required: true
-      placeholder: Email
-      placeholder_expression: false
-      order: 1
-
-  # Flow stages
-  - identifiers:
-      name: default-enrollment-invitation
-    model: authentik_stages_invitation.invitationstage
-    id: default-enrollment-invitation
-  - identifiers:
-      name: default-enrollment-prompt-first
-    model: authentik_stages_prompt.promptstage
-    id: default-enrollment-prompt-first
-    attrs:
-      fields:
-        - !KeyOf prompt-field-username
-        - !KeyOf prompt-field-password
-        - !KeyOf prompt-field-password-repeat
-  - identifiers:
-      name: default-enrollment-prompt-second
-    model: authentik_stages_prompt.promptstage
-    id: default-enrollment-prompt-second
-    attrs:
-      fields:
-        - !KeyOf prompt-field-name
-        - !KeyOf prompt-field-email
-  - identifiers:
-      name: default-enrollment-user-write
-    model: authentik_stages_user_write.userwritestage
-    id: default-enrollment-user-write
-    attrs:
-      user_creation_mode: always_create
-      user_type: internal
-  - identifiers:
-      name: default-enrollment-email-verify
-    model: authentik_stages_email.emailstage
-    id: default-enrollment-email-verify
-    attrs:
-      use_global_settings: true
-      template: email/account_confirmation.html
-      activate_user_on_success: true
-  - identifiers:
-      name: default-enrollment-user-login
-    model: authentik_stages_user_login.userloginstage
-    id: default-enrollment-user-login
-
-  # Flow stage bindings
-  - identifiers:
-      target: !KeyOf flow
-      stage: !KeyOf default-enrollment-invitation
-      order: 0
-    model: authentik_flows.flowstagebinding
-  - identifiers:
-      target: !KeyOf flow
-      stage: !KeyOf default-enrollment-prompt-first
-      order: 10
-    model: authentik_flows.flowstagebinding
-  - identifiers:
-      target: !KeyOf flow
-      stage: !KeyOf default-enrollment-prompt-second
-      order: 11
-    model: authentik_flows.flowstagebinding
-  - identifiers:
-      target: !KeyOf flow
-      stage: !KeyOf default-enrollment-user-write
-      order: 20
-    model: authentik_flows.flowstagebinding
-  - identifiers:
-      target: !KeyOf flow
-      stage: !KeyOf default-enrollment-email-verify
-      order: 30
-    model: authentik_flows.flowstagebinding
-  - identifiers:
-      target: !KeyOf flow
-      stage: !KeyOf default-enrollment-user-login
-      order: 100
-    model: authentik_flows.flowstagebinding

roles/alpina/templates/services/authentik/blueprints/github-oauth.yaml.j2

@@ -1,25 +0,0 @@
-version: 1
-metadata:
-  labels:
-    blueprints.goauthentik.io/instantiate: "true"
-  name: Alpina - GitHub OAuth
-entries:
-  - identifiers:
-      slug: github
-    model: authentik_sources_oauth.oauthsource
-    attrs:
-      name: GitHub
-      slug: github
-      access_token_url: https://github.com/login/oauth/access_token
-      additional_scopes: openid read:org
-      authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
-      authorization_url: https://github.com/login/oauth/authorize
-      consumer_key: {{ github_consumer_key }}
-      consumer_secret: {{ github_consumer_secret }}
-      enabled: true
-      enrollment_flow: !Find [authentik_flows.flow, [slug, default-source-enrollment]]
-      policy_engine_mode: any
-      profile_url: https://api.github.com/user
-      provider_type: github
-      user_matching_mode: email_link
-      user_path_template: goauthentik.io/sources/%(slug)s

roles/alpina/templates/services/authentik/compose.yml.j2

@@ -2,8 +2,6 @@
 
 networks:
   {{ helpers.default_network(253) | indent(2) }}
-  traefik_traefik:
-    external: true
 
 services:
   server:
@@ -17,13 +15,11 @@ services:
     restart: unless-stopped
     # Port forward is needed because traefik can't resolve the container name from the host network
     ports:
-      - "9000:9000"
+      - "127.0.0.1:9000:9000"
+      - "[::1]:9000:9000"
     command: server
     env_file:
       - .env.authentik
-    networks:
-      - default
-      - traefik_traefik
 
   worker:
     image: ghcr.io/goauthentik/server:latest

roles/alpina/templates/services/minio/compose.yml.j2

@@ -0,0 +1,19 @@
+{% import 'contrib/compose_helpers.j2' as helpers with context %}
+
+networks:
+  {{ helpers.default_network(252) | indent(2) }}
+
+services:
+  minio:
+    image: minio/minio:latest
+    container_name: minio
+    labels:
+      - {{ helpers.traefik_labels('minio', port='9090') | indent(6) }}
+      - {{ helpers.traefik_labels('s3', port='9000') | indent(6) }}
+      - {{ helpers.traefik_labels('s3', port='9000', wildcard=true) | indent(6) }}
+    restart: unless-stopped
+    command: server --console-address ":9090" /data
+    env_file:
+      - .env.minio
+    volumes:
+      - {{ base_volume_path }}/minio/data:/data

roles/alpina/templates/services/minio/docker-compose.yml.j2

@@ -1,32 +0,0 @@
-{% import 'contrib/compose_helpers.j2' as helpers with context %}
-
-networks:
-  {{ helpers.default_network(252) | indent(2) }}
-  traefik_traefik:
-    external: true
-
-services:
-  minio:
-    image: minio/minio:latest
-    container_name: minio
-    labels:
-      - {{ helpers.traefik_labels('minio', port='9090') | indent(6) }}
-      - traefik.http.routers.minio.service=minio
-      - traefik.http.routers.minio-tls.service=minio
-      - traefik.http.routers.minio-s3.rule=Host(`s3.{{ domain }}`) || HostRegexp(`^.+[.]s3[.]{{ domain }}`)
-      - traefik.http.routers.minio-s3.entrypoints=websecure
-      - traefik.http.routers.minio-s3.tls=true
-      - traefik.http.routers.minio-s3.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-s3.tls.domains.0.main=s3.{{ domain }}
-      - traefik.http.routers.minio-s3.tls.domains.0.sans=*.s3.{{ domain }}
-      - traefik.http.routers.minio-s3.service=minio-s3
-      - traefik.http.services.minio-s3.loadbalancer.server.port=9000
-    restart: unless-stopped
-    command: server --console-address ":9090" /data
-    env_file:
-      - .env.minio
-    networks:
-      - default
-      - traefik_traefik
-    volumes:
-      - {{ base_volume_path }}/minio/data:/data

roles/alpina/templates/services/monitoring/compose.yml.j2

@@ -2,8 +2,6 @@
 
 networks:
   {{ helpers.default_network(251) | indent(2) }}
-  traefik_traefik:
-    external: true
 
 services:
   grafana:
@@ -17,9 +15,6 @@ services:
     restart: unless-stopped
     # Needed to make config files readable (not anymore, TODO: remove)
     user: "{{ remote_uid }}"
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/monitoring/grafana:/var/lib/grafana
       - ./grafana_config/grafana.ini:/etc/grafana/grafana.ini:ro
@@ -27,7 +22,7 @@ services:
 {#      - ./grafana_config:/etc/grafana:ro#}
 
   loki:
-    image: grafana/loki:latest
+    image: grafana/loki:3.4
     container_name: loki
     restart: unless-stopped
     # Needed to make config files readable (not anymore, TODO: remove)
@@ -36,7 +31,8 @@ services:
       - -config.file=/etc/loki/loki-config.yaml
     # Port forward is needed because not possible to resolve the container name from the host network
     ports:
-      - 3100:3100
+      - "127.0.0.1:3100:3100"
+      - "[::1]:3100:3100"
     volumes:
       - {{ base_volume_path }}/monitoring/loki:/loki
       - ./loki_config:/etc/loki:ro
@@ -44,7 +40,7 @@ services:
       - /tmp/loki
 
   promtail:
-    image: grafana/promtail:latest
+    image: grafana/promtail:3.4
     container_name: promtail
     restart: unless-stopped
     command:
@@ -103,9 +99,6 @@ services:
     restart: unless-stopped
     env_file:
       - .env.influxdb
-    networks:
-      - default
-      - traefik_traefik
     volumes:
       - {{ base_volume_path }}/monitoring/influxdb:/var/lib/influxdb2
 

roles/alpina/templates/services/monitoring/grafana_config/dashboards/common.py

@@ -1,27 +1,81 @@
-from grafanalib.core import Template
+from attrs import define
+from grafanalib.core import Template, TimeSeries, Dashboard, HIDE_VARIABLE, Target
 
-# TODO: consider default params for common params like line width, show points, tooltip
+CONF_SUPPORT_LOKI = True
+CONF_SUPPORT_ZFS = True
 
-PrometheusTemplate = Template(
+CONF_DATASOURCE_VAR_PROM = 'prom_datasource'
-    name='datasource',
+CONF_DATASOURCE_VAR_LOKI = 'loki_datasource'
+
+prom_datasource = f'${{{CONF_DATASOURCE_VAR_PROM}}}'
+loki_datasource = f'${{{CONF_DATASOURCE_VAR_LOKI}}}'
+
+prom_template = Template(
+    name=CONF_DATASOURCE_VAR_PROM,
     type='datasource',
     label='Prometheus',
     query='prometheus',
+    hide=HIDE_VARIABLE,
 )
 
-# TODO: this slightly less (clown emoji), normal Target gave me errors in grafana
+loki_template = Template(
+    name=CONF_DATASOURCE_VAR_LOKI,
+    type='datasource',
+    label='Loki',
+    query='loki',
+    hide=HIDE_VARIABLE,
+)
+
+
+@define
+class MyDashboard(Dashboard):
+    """Wrapper class for Dashboard with some default values"""
+    timezone: str = 'browser'
+    sharedCrosshair: bool = True
+
+
+@define
+class MyTimeSeries(TimeSeries):
+    """Wrapper class for TimeSeries with some default values and custom fields"""
+    fillOpacity: int = 10
+    lineWidth: int = 1
+    showPoints: str = 'never'
+    tooltipMode: str = 'multi'
+    maxDataPoints: int = None
+
+    # new fields
+    axisCenteredZero: bool = False
+
+    def to_json_data(self):
+        data = super().to_json_data()
+        data['fieldConfig']['defaults']['custom']['axisCenteredZero'] = self.axisCenteredZero
+        return data
+
+
+@define
+class PromTarget(Target):
+    """Wrapper class for Target with default prometheus datasource"""
+    datasource: str = prom_datasource
+
+
+@define
 class LokiTarget(object):
-    def __init__(self, loki_datasource, expr, legendFormat, refId):
+    """Custom class for Loki Target, because normal Target gave errors in grafana"""
-        self.loki_datasource = loki_datasource
+    expr: str
-        self.expr = expr
+    legendFormat: str
-        self.legendFormat = legendFormat
+    datasource: str = loki_datasource
-        self.refId = refId
+    refId: str = None
+    queryType: str = 'range'
 
     def to_json_data(self):
         return {
-            'datasource': self.loki_datasource,
+            'datasource': self.datasource,
             'expr': self.expr,
             'legendFormat': self.legendFormat,
             'refId': self.refId,
-            'queryType': 'range',
+            'queryType': self.queryType,
         }
+
+
+def filter_none(l: list):
+    return [i for i in l if i is not None]

roles/alpina/templates/services/monitoring/grafana_config/dashboards/containers.dashboard.py

@@ -1,16 +1,10 @@
-from grafanalib.core import (
+from grafanalib.core import GridPos, Templating, Template, Logs
-    Dashboard, TimeSeries,
-    Target, GridPos,
-    Templating, Template, REFRESH_ON_TIME_RANGE_CHANGE, Logs
-)
 from grafanalib.formatunits import BYTES_IEC, SECONDS, BYTES_SEC_IEC
 
-from common import LokiTarget, PrometheusTemplate
+from common import LokiTarget, prom_template, loki_template, MyTimeSeries, MyDashboard, CONF_SUPPORT_LOKI, filter_none, \
+    prom_datasource, PromTarget
 
-prom_datasource='${datasource}'
+dashboard = MyDashboard(
-loki_datasource='loki'
-
-dashboard = Dashboard(
     title='Containers',
     uid='containers',
     description='Data for compose projects from default Prometheus datasource collected by Cadvisor',
@@ -18,8 +12,9 @@ dashboard = Dashboard(
         'linux',
         'docker',
     ],
-    templating=Templating(list=[
+    templating=Templating(list=filter_none([
-        PrometheusTemplate,
+        prom_template,
+        loki_template if CONF_SUPPORT_LOKI else None,
         Template(
             name='compose_project',
             label='Compose Project',
@@ -27,7 +22,6 @@ dashboard = Dashboard(
             query='label_values({__name__=~"container.*"}, container_label_com_docker_compose_project)',
             includeAll=True,
             multi=True,
-            refresh=REFRESH_ON_TIME_RANGE_CHANGE,
         ),
         Template(
             name='container_name',
@@ -36,7 +30,6 @@ dashboard = Dashboard(
             query='label_values({__name__=~"container.*", container_label_com_docker_compose_project=~"$compose_project"}, name)',
             includeAll=True,
             multi=True,
-            refresh=REFRESH_ON_TIME_RANGE_CHANGE,
         ),
         Template(
             name='logs_query',
@@ -44,67 +37,48 @@ dashboard = Dashboard(
             query='',
             type='textbox',
         ),
-    ]),
+    ])),
-    timezone='browser',
+    panels=filter_none([
-    panels=[
+        MyTimeSeries(
-        TimeSeries(
             title='Container Memory Usage',
             unit=BYTES_IEC,
             gridPos=GridPos(h=8, w=12, x=0, y=0),
-            lineWidth=2,
-            fillOpacity=10,
-            showPoints='never',
-            stacking={'mode': 'normal'},
-            tooltipMode='all',
             tooltipSort='desc',
+            stacking={'mode': 'normal'},
             targets=[
-                Target(
+                PromTarget(
-                    datasource=prom_datasource,
                     expr='max by (name) (container_memory_usage_bytes{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"})',
                     legendFormat='{{ name }}',
-                    refId='A',
                 ),
             ],
         ),
-        TimeSeries(
+        MyTimeSeries(
             title='Container CPU Usage',
             unit=SECONDS,
             gridPos=GridPos(h=8, w=12, x=12, y=0),
-            lineWidth=2,
-            fillOpacity=10,
-            showPoints='never',
-            tooltipMode='all',
             tooltipSort='desc',
+            stacking={'mode': 'normal'},
             targets=[
-                Target(
+                PromTarget(
-                    datasource=prom_datasource,
+                    expr='max by (name) (irate(container_cpu_usage_seconds_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
-                    expr='max by (name) (rate(container_cpu_usage_seconds_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
                     legendFormat='{{ name }}',
-                    refId='A',
                 ),
             ],
         ),
-        TimeSeries(
+        MyTimeSeries(
             title='Container Network Traffic',
             unit=BYTES_SEC_IEC,
             gridPos=GridPos(h=8, w=12, x=0, y=8),
-            lineWidth=2,
-            fillOpacity=10,
-            showPoints='never',
-            tooltipMode='all',
             tooltipSort='desc',
+            axisCenteredZero=True,
             targets=[
-                Target(
+                PromTarget(
-                    datasource=prom_datasource,
+                    expr='max by (name) (irate(container_network_receive_bytes_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
-                    expr='max by (name) (rate(container_network_receive_bytes_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
                     legendFormat="rx {{ name }}",
-                    refId='A',
                 ),
-                Target(
+                PromTarget(
-                    datasource=prom_datasource,
+                    expr='-max by (name) (irate(container_network_transmit_bytes_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
-                    expr='-max by (name) (rate(container_network_transmit_bytes_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
                     legendFormat="tx {{ name }}",
-                    refId='B',
                 ),
             ],
         ),
@@ -118,12 +92,10 @@ dashboard = Dashboard(
             dedupStrategy='numbers',
             targets=[
                 LokiTarget(
-                    loki_datasource=loki_datasource,
                     expr='{compose_project=~"$compose_project", container_name=~"$container_name"} |= `$logs_query`',
                     legendFormat='{{ container_name }}',
-                    refId='A',
                 ),
             ],
-        ),
+        ) if CONF_SUPPORT_LOKI else None,
-    ],
+    ]),
 ).auto_panel_ids()

roles/alpina/templates/services/monitoring/grafana_config/dashboards/node.dashboard.py

@@ -1,139 +1,159 @@
-from grafanalib.core import Dashboard, Templating, Template, TimeSeries, PERCENT_UNIT_FORMAT, GridPos, Target
+from grafanalib.core import Templating, Template, GridPos
-from grafanalib.formatunits import BYTES_IEC
+from grafanalib.formatunits import BYTES_IEC, BITS_SEC, PERCENT_UNIT
 
-from common import PrometheusTemplate
+from common import prom_template, MyTimeSeries, MyDashboard, CONF_SUPPORT_ZFS, PromTarget, prom_datasource
-from node_consts import CPU_BASIC_COLORS, MEMORY_BASIC_COLORS
 
-dashboard = Dashboard(
+dashboard = MyDashboard(
     title='Node Exporter',
     uid='node',
     description='Node Exporter (not quite full)',
     tags=[
         'linux',
     ],
-    timezone='browser',
     templating=Templating(list=[
         # Datasource
-        PrometheusTemplate,
+        prom_template,
         # Job
         Template(
             name='job',
             label='Job',
-            dataSource='${datasource}',
+            dataSource=prom_datasource,
             query='label_values(node_uname_info, job)',
         ),
         # Instance
         Template(
             name='instance',
             label='Instance',
-            dataSource='${datasource}',
+            dataSource=prom_datasource,
             query='label_values(node_uname_info{job="$job"}, instance)',
         ),
     ]),
     panels=[
         # CPU Basic
-        TimeSeries(
+        MyTimeSeries(
             title='CPU Basic',
             description='Basic CPU usage info',
-            unit=PERCENT_UNIT_FORMAT,
+            unit=PERCENT_UNIT,
             gridPos=GridPos(h=8, w=12, x=0, y=0),
-            lineWidth=1,
+            stacking={'mode': 'percent'},
-            fillOpacity=30,
-            showPoints='never',
-            stacking={'mode': 'percent', 'group': 'A'},
-            tooltipMode='all',
-            tooltipSort='desc',
             targets=[
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="system"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                     legendFormat='Busy System',
-                    refId='A',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="user"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                     legendFormat='Busy User',
-                    refId='B',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="iowait"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                     legendFormat='Busy Iowait',
-                    refId='C',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode=~".*irq"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                     legendFormat='Busy IRQs',
-                    refId='D',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job",  mode!="idle",mode!="user",mode!="system",mode!="iowait",mode!="irq",mode!="softirq"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                     legendFormat='Busy Other',
-                    refId='E',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="idle"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                     legendFormat='Idle',
-                    refId='F',
                 ),
             ],
-            # Extra JSON for the colors
-            extraJson=CPU_BASIC_COLORS,
         ),
         # Memory Basic
-        TimeSeries(
+        MyTimeSeries(
             title='Memory Basic',
             description='Basic memory usage',
             unit=BYTES_IEC,
             gridPos=GridPos(h=8, w=12, x=12, y=0),
-            lineWidth=1,
+            stacking={'mode': 'normal'},
-            fillOpacity=30,
+            valueMin=0,
-            showPoints='never',
-            stacking={'mode': 'normal', 'group': 'A'},
-            tooltipMode='all',
-            tooltipSort='desc',
             targets=[
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='node_memory_MemTotal_bytes{instance="$instance",job="$job"}',
                     format='time_series',
                     legendFormat='RAM Total',
-                    refId='A',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='node_memory_MemTotal_bytes{instance="$instance",job="$job"} - node_memory_MemFree_bytes{instance="$instance",job="$job"} - (node_memory_Cached_bytes{instance="$instance",job="$job"} + node_memory_Buffers_bytes{instance="$instance",job="$job"} + node_memory_SReclaimable_bytes{instance="$instance",job="$job"})',
                     format='time_series',
                     legendFormat='RAM Used',
-                    refId='B',
+                    hide=CONF_SUPPORT_ZFS,
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
+                    expr='node_memory_MemTotal_bytes{instance="$instance",job="$job"} - node_memory_MemFree_bytes{instance="$instance",job="$job"} - (node_memory_Cached_bytes{instance="$instance",job="$job"} + node_memory_Buffers_bytes{instance="$instance",job="$job"} + node_memory_SReclaimable_bytes{instance="$instance",job="$job"}) - node_zfs_arc_size{instance="$instance",job="$job"}',
+                    format='time_series',
+                    legendFormat='RAM Used',
+                    hide=not CONF_SUPPORT_ZFS,
+                ),
+                PromTarget(
                     expr='node_memory_Cached_bytes{instance="$instance",job="$job"} + node_memory_Buffers_bytes{instance="$instance",job="$job"} + node_memory_SReclaimable_bytes{instance="$instance",job="$job"}',
                     legendFormat='RAM Cache + Buffer',
-                    refId='C',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
+                    expr='node_zfs_arc_size{instance="$instance",job="$job"}',
+                    legendFormat='ZFS Arc',
+                    hide=not CONF_SUPPORT_ZFS,
+                ),
+                PromTarget(
                     expr='node_memory_MemFree_bytes{instance="$instance",job="$job"}',
                     legendFormat='RAM Free',
-                    refId='D',
                 ),
-                Target(
+                PromTarget(
-                    datasource='${datasource}',
                     expr='(node_memory_SwapTotal_bytes{instance="$instance",job="$job"} - node_memory_SwapFree_bytes{instance="$instance",job="$job"})',
                     legendFormat='SWAP Used',
-                    refId='E',
                 ),
             ],
-            # Extra JSON for the colors
+            overrides=[
-            extraJson=MEMORY_BASIC_COLORS,
+                # Prevent total memory from being stacked
+                {
+                    'matcher': {
+                        'id': 'byName',
+                        'options': 'RAM Total'
+                    },
+                    'properties': [
+                        {
+                            'id': 'custom.stacking',
+                            'value': {'mode': 'none'}
+                        }
+                    ]
+                },
+            ],
+        ),
+        # Network Traffic Basic
+        MyTimeSeries(
+            title='Network Traffic Basic',
+            description='Basic network usage info per interface',
+            unit=BITS_SEC,
+            gridPos=GridPos(h=8, w=12, x=0, y=8),
+            tooltipSort='desc',
+            axisCenteredZero=True,
+            targets=[
+                PromTarget(
+                    expr='irate(node_network_receive_bytes_total{instance="$instance",job="$job"}[$__rate_interval]) * 8',
+                    legendFormat='rx {{ device }}',
+                ),
+                PromTarget(
+                    expr='-irate(node_network_transmit_bytes_total{instance="$instance",job="$job"}[$__rate_interval]) * 8',
+                    legendFormat='tx {{ device }}',
+                ),
+            ],
+        ),
+        # Disk Space Basic
+        MyTimeSeries(
+            title='Disk Space Used Basic',
+            description='Disk space used of all filesystems mounted',
+            unit=PERCENT_UNIT,
+            gridPos=GridPos(h=8, w=12, x=12, y=8),
+            targets=[
+                PromTarget(
+                    expr='1 - (node_filesystem_avail_bytes{instance="$instance",job="$job",device!~"rootfs"} / node_filesystem_size_bytes{instance="$instance",job="$job",device!~"rootfs"})',
+                    legendFormat='{{ mountpoint }}',
+                ),
+            ],
         ),
-        # TODO: Network Basic
-        # TODO: Disk Basic
     ],
 ).auto_panel_ids()

roles/alpina/templates/services/monitoring/grafana_config/dashboards/node_consts.py

@@ -1,487 +0,0 @@
-# TODO: Question life decisions (I'm not sure if this is good)
-
-CPU_BASIC_COLORS = {
-    "fieldConfig": {
-        "overrides": [
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Busy Iowait"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#890F02",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Idle"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#052B51",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Busy Iowait"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#890F02",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Idle"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#7EB26D",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Busy System"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#EAB839",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Busy User"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#0A437C",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Busy Other"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#6D1F62",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            }
-        ]
-    },
-}
-
-MEMORY_BASIC_COLORS = {
-    "fieldConfig": {
-        "overrides": [
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Apps"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#629E51",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Buffers"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#614D93",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Cache"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#6D1F62",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Cached"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#511749",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Committed"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#508642",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Free"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#0A437C",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Hardware Corrupted - Amount of RAM that the kernel identified as corrupted / not working"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#CFFAFF",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Inactive"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#584477",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "PageTables"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#0A50A1",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Page_Tables"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#0A50A1",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "RAM_Free"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#E0F9D7",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "SWAP Used"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#BF1B00",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Slab"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#806EB7",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Slab_Cache"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#E0752D",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Swap"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#BF1B00",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Swap Used"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#BF1B00",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Swap_Cache"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#C15C17",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Swap_Free"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#2F575E",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Unused"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#EAB839",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "RAM Total"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#E0F9D7",
-                            "mode": "fixed"
-                        }
-                    },
-                    {
-                        "id": "custom.fillOpacity",
-                        "value": 0
-                    },
-                    {
-                        "id": "custom.stacking",
-                        "value": {
-                            "group": False,
-                            "mode": "normal"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "RAM Cache + Buffer"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#052B51",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "RAM Free"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#7EB26D",
-                            "mode": "fixed"
-                        }
-                    }
-                ]
-            },
-            {
-                "matcher": {
-                    "id": "byName",
-                    "options": "Available"
-                },
-                "properties": [
-                    {
-                        "id": "color",
-                        "value": {
-                            "fixedColor": "#DEDAF7",
-                            "mode": "fixed"
-                        }
-                    },
-                    {
-                        "id": "custom.fillOpacity",
-                        "value": 0
-                    },
-                    {
-                        "id": "custom.stacking",
-                        "value": {
-                            "group": False,
-                            "mode": "normal"
-                        }
-                    }
-                ]
-            }
-        ]
-    }
-}

roles/alpina/templates/services/traefik/compose.yml.j2

@@ -1,18 +1,11 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 
 networks:
-  traefik:
+  {{ helpers.default_network(254) | indent(2) }}
-    internal: true
-    enable_ipv6: true
-    ipam:
-      config:
-        # TODO: Consider removing traefik network, it shouldn't be needed with host networking
-        - subnet: {{ traefik_subnet }}/24
-        - subnet: {{ docker_ipv6_subnet | ansible.utils.ipsubnet(80, 255) }}
 
 services:
   traefik:
-    image: traefik:v3.2
+    image: traefik:v3.4
     container_name: traefik
     restart: unless-stopped
     env_file:
@@ -25,11 +18,8 @@ services:
       - {{ base_volume_path }}/traefik/rules:/rules/extra:ro
       - {{ base_volume_path }}/traefik/acme:/acme
 
-  # This is mostly just so that the traefik network gets created
   whoami:
     image: containous/whoami
     container_name: whoami
     labels:
-      - {{ helpers.traefik_labels('whoami', port=80) | indent(6) }}
+      - {{ helpers.traefik_labels('whoami', port='80') | indent(6) }}
-    networks:
-      - traefik

roles/alpina/templates/services/traefik/traefik.yml.j2

@@ -12,6 +12,16 @@ entryPoints:
     address: ":443"
     http3:
       advertisedPort: 443
+    forwardedHeaders:
+      trustedIPs:
+        # https://www.cloudflare.com/ips-v6
+        - 2400:cb00::/32
+        - 2606:4700::/32
+        - 2803:f800::/32
+        - 2405:b500::/32
+        - 2405:8100::/32
+        - 2a06:98c0::/29
+        - 2c0f:f248::/32
   metrics:
     address: ":8082"
 
@@ -36,7 +46,6 @@ certificatesResolvers:
 providers:
   docker:
     exposedByDefault: false
-    network: traefik_traefik
   file:
     directory: /rules
     watch: true

roles/clean/tasks/main.yml

@@ -0,0 +1,22 @@
+- name: Get list of running Docker containers
+  docker_host_info:
+    containers: yes
+  register: docker_container_list
+
+- name: Stop all running Docker containers
+  docker_container:
+    name: "{{ item }}"
+    state: stopped
+  loop: "{{ docker_container_list.containers | map(attribute='Id') | list }}"
+  async: 300
+  poll: 0
+
+- name: Prune all Docker containers and networks
+  docker_prune:
+    containers: yes
+    networks: yes
+
+- name: Clean alpina directory
+  file:
+    path: "{{ alpina_svc_path }}"
+    state: absent

roles/common/tasks/main.yml

@@ -32,7 +32,7 @@
     state: enabled
     immediate: yes
 
-- name: Allow Web
+- name: Disallow Web
   become: yes
   firewalld:
     service: http
@@ -64,6 +64,22 @@
     state: enabled
     immediate: yes
 
+- name: Allow 2222 tcp for pgrok ssh tunnel
+  become: yes
+  firewalld:
+    port: 2222/tcp
+    permanent: yes
+    state: enabled
+    immediate: yes
+
+- name: Allow Syncthing
+  become: yes
+  firewalld:
+    service: syncthing
+    permanent: yes
+    state: enabled
+    immediate: yes
+
 - name: Reboot if needed
   become: yes
   ansible.builtin.reboot:

roles/docker_host/tasks/main.yml

@@ -1,12 +1,5 @@
-- name: Get IPv6 subnet for Docker
+- name: IPv6 subnet for Docker
-  set_fact:
+  debug:
-    docker_ipv6_subnet: "{{ \
-      ansible_default_ipv6.address \
-      | ansible.utils.ipsubnet(64) \
-      | ansible.utils.ipsubnet(72, docker_ipv6_index) \
-    }}"
-
-- debug:
     var: docker_ipv6_subnet
 
 - name: Configure Docker daemon
@@ -35,33 +28,6 @@
     state: disabled
   register: docker0_firewalld
 
-- name: Get list of running Docker containers
-  docker_host_info:
-    containers: yes
-  register: docker_container_list
-  when: clean_desired is true
-
-- name: Stop all running Docker containers
-  docker_container:
-    name: "{{ item }}"
-    state: stopped
-  loop: "{{ docker_container_list.containers | map(attribute='Id') | list }}"
-  async: 300
-  poll: 0
-  when: clean_desired is true and docker_container_list.containers | length > 0
-
-- name: Prune all Docker containers and networks
-  docker_prune:
-    containers: yes
-    networks: yes
-  when: clean_desired is true
-
-- name: Clean alpina directory
-  file:
-    path: "{{ alpina_svc_path }}"
-    state: absent
-  when: clean_desired is true
-
 - name: Restart Docker daemon
   become: yes
   service:

services.yml

@@ -1,6 +1,5 @@
 - hosts: alpina
   roles:
-    - docker_host
     - alpina
   post_tasks:
     - name: Docker prune objects

site.yml

@@ -1,12 +1,4 @@
-- hosts: all
+- hosts: alpina
   roles:
     - common
-  pre_tasks:
+    - docker_host
-  - name: Set fact for clean desired of docker objects and compose files
-    set_fact:
-      # clean_desired_arg is an extra variable passed to the playbook
-      clean_desired: "{{ clean_desired_arg | bool }}"
-
-
-- name: Install services
-  import_playbook: services.yml