WIP: ZFS backup implementation

2022-10-23 14:29:01 -07:00
96 changed files with 712 additions and 3547 deletions
--- a/.idea/alpina.iml
+++ b/.idea/alpina.iml
@@ -23,8 +23,9 @@
    <option name="TEMPLATE_CONFIGURATION" value="Jinja2" />
    <option name="TEMPLATE_FOLDERS">
      <list>
-        <option value="$MODULE_DIR$/roles/docker_host/templates" />
+        <option value="$MODULE_DIR$/roles/traefik/templates" />
-        <option value="$MODULE_DIR$/roles/alpina/templates" />
+        <option value="$MODULE_DIR$/roles/gitea/templates" />
        <option value="$MODULE_DIR$/roles/nextcloud/templates" />
      </list>
    </option>
  </component>
--- a/.idea/jsonSchemas.xml
+++ b/.idea/jsonSchemas.xml
@@ -3,58 +3,6 @@
  <component name="JsonSchemaMappingsProjectConfiguration">
    <state>
      <map>
        <entry key="Ansible Tasks File">
          <value>
            <SchemaInfo>
              <option name="name" value="Ansible Tasks File" />
              <option name="relativePathToSchema" value="https://raw.githubusercontent.com/ansible/ansible-lint/main/src/ansiblelint/schemas/ansible.json#/$defs/tasks" />
              <option name="applicationDefined" value="true" />
              <option name="patterns">
                <list>
                  <Item>
                    <option name="pattern" value="true" />
                    <option name="path" value="*/tasks/*.yml" />
                    <option name="mappingKind" value="Pattern" />
                  </Item>
                </list>
              </option>
            </SchemaInfo>
          </value>
        </entry>
        <entry key="Authentik Blueprint">
          <value>
            <SchemaInfo>
              <option name="generatedName" value="New Schema" />
              <option name="name" value="Authentik Blueprint" />
              <option name="relativePathToSchema" value="https://goauthentik.io/blueprints/schema.json" />
              <option name="patterns">
                <list>
                  <Item>
                    <option name="directory" value="true" />
                    <option name="path" value="roles/alpina/templates/services/authentik/blueprints" />
                    <option name="mappingKind" value="Directory" />
                  </Item>
                </list>
              </option>
            </SchemaInfo>
          </value>
        </entry>
        <entry key="Loki">
          <value>
            <SchemaInfo>
              <option name="name" value="Loki" />
              <option name="relativePathToSchema" value="https://json.schemastore.org/loki.json" />
              <option name="applicationDefined" value="true" />
              <option name="patterns">
                <list>
                  <Item>
                    <option name="path" value="roles/alpina/templates/services/monitoring/loki_config/loki-config.yaml.j2" />
                  </Item>
                </list>
              </option>
            </SchemaInfo>
          </value>
        </entry>
        <entry key="Traefik v2">
          <value>
            <SchemaInfo>
@@ -64,76 +12,7 @@
              <option name="patterns">
                <list>
                  <Item>
-                    <option name="pattern" value="true" />
+                    <option name="path" value="roles/traefik/templates/traefik.yml.j2" />
                    <option name="path" value="*/traefik.yml.j2" />
                    <option name="mappingKind" value="Pattern" />
                  </Item>
                </list>
              </option>
            </SchemaInfo>
          </value>
        </entry>
        <entry key="Traefik v2 File Provider">
          <value>
            <SchemaInfo>
              <option name="generatedName" value="New Schema" />
              <option name="name" value="Traefik v2 File Provider" />
              <option name="relativePathToSchema" value="https://json.schemastore.org/traefik-v2-file-provider.json" />
              <option name="patterns">
                <list>
                  <Item>
                    <option name="path" value="file://$APPLICATION_CONFIG_DIR$/scratches/scratch.yml" />
                  </Item>
                  <Item>
                    <option name="path" value="file://$APPLICATION_CONFIG_DIR$/scratches/scratch_1.yml" />
                  </Item>
                  <Item>
                    <option name="path" value="file:///run/user/1000/kio-fuse-kipURF/sftp/root@debbi.lab.home/mnt/dock/traefik/rules/hello-world.yml" />
                  </Item>
                  <Item>
                    <option name="path" value="roles/alpina/templates/services/traefik/rules/traefik-dash.yml.j2" />
                  </Item>
                </list>
              </option>
            </SchemaInfo>
          </value>
        </entry>
        <entry key="docker-compose.yml">
          <value>
            <SchemaInfo>
              <option name="name" value="docker-compose.yml" />
              <option name="relativePathToSchema" value="https://raw.githubusercontent.com/compose-spec/compose-spec/master/schema/compose-spec.json" />
              <option name="applicationDefined" value="true" />
              <option name="patterns">
                <list>
                  <Item>
                    <option name="pattern" value="true" />
                    <option name="path" value="*/docker-compose.yml" />
                    <option name="mappingKind" value="Pattern" />
                  </Item>
                  <Item>
                    <option name="pattern" value="true" />
                    <option name="path" value="*/docker-compose.yml.j2" />
                    <option name="mappingKind" value="Pattern" />
                  </Item>
                </list>
              </option>
            </SchemaInfo>
          </value>
        </entry>
        <entry key="prometheus.json">
          <value>
            <SchemaInfo>
              <option name="name" value="prometheus.json" />
              <option name="relativePathToSchema" value="https://json.schemastore.org/prometheus.json" />
              <option name="applicationDefined" value="true" />
              <option name="patterns">
                <list>
                  <Item>
                    <option name="path" value="roles/alpina/collections/services/monitoring/templates/prometheus_config/prometheus.yml.j2" />
                  </Item>
                  <Item>
                    <option name="path" value="roles/alpina/templates/services/monitoring/prometheus_config/prometheus.yml.j2" />
                  </Item>
                </list>
              </option>
--- a/.idea/misc.xml
+++ b/.idea/misc.xml
@@ -1,7 +1,4 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
-  <component name="Black">
+  <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.10 (alpina)" project-jdk-type="Python SDK" />
    <option name="sdkName" value="Poetry (alpina) (2)" />
  </component>
  <component name="ProjectRootManager" version="2" project-jdk-name="Poetry (alpina)" project-jdk-type="Python SDK" />
 </project>
--- a/19
+++ b/19
@@ -1,19 +0,0 @@
 .POSIX:
 .PHONY: *
 .EXPORT_ALL_VARIABLES:
 env ?= staging
 vault_id ?= alpina@contrib/rbw-client.sh
 clean_desired ?= false
 all: site
 setup:
 	poetry install --quiet
 site: setup
 	poetry run ansible-playbook --vault-id ${vault_id} -i inventories/${env} --extra-vars "clean_desired_arg=${clean_desired}" site.yml
 services: setup
 	poetry run ansible-playbook --vault-id ${vault_id} -i inventories/${env} services.yml
--- a/README.md
+++ b/README.md
@@ -1,75 +0,0 @@
 # Alpina
 A home for configuring all of my homelab containers on a Debian Linux machine.
 This assumes a Debian Linux machine with Docker and Docker Compose installed.
 My particular setup is based on a [jailmaker](https://github.com/Jip-Hop/jailmaker) container
 running on top of TrueNAS SCALE, separating all the docker stuff from the appliance.
 # Notes
 ## Monitoring
 The monitoring stack is set up to monitor all the containers and the host.
 This is a work in progress, Grafana is set up with grafanalib, a Python library that generates Grafana dashboards.
 The dashboards are generated from Python scripts in 
 [grafana_config/dashboards](roles/alpina/templates/services/monitoring/grafana_config/dashboards).
 This requires a custom grafana image, which is built from the 
 [Dockerfile](roles/alpina/templates/services/monitoring/Dockerfile).
 This also means it has to be manually rebuilt whenever the dashboards are updated.
 From the services/monitoring directory, run:
 ```bash
 docker compose up -d --build --force-recreate grafana
 ```
 ## IPv6
 The current configuration is designed to work with IPv6. 
 However, because of how (not properly) I'm doing the subnetting 
 from the host's network, NDP doesn't work.
 This means that container IPs are not accessible from other hosts on the local network.
 I simply have a static route on my router to the container subnet, 
 that uses the IP of this host as the gateway.
 This is a limitation of my current ISP, I only have a single /64 subnet for my lab network.
 I'd like to get a /56 or /48, perhaps using Hurricane Electric's tunnel broker.
 *Sigh* ISPs being stingy with the 2^48 prefixes they're afraid of running out of.
 ## Upgrading Postgres
 Upgrading the postgres container for a given stack requires a dump and restore.
 After making a snapshot or backup of postgres data directory,
 in the compose directory for a given stack, run the following commands:
 ```bash
 docker compose down
 docker compose up -d <db_service>
 docker compose exec -it <db_service> pg_dumpall -U <db_user> | tee /tmp/dump.sql
 docker compose down
 rm -r <postgres_data_dir>/*  # as root
 # Edit the docker-compose.yml file to use the new postgres image
 docker compose up -d <db_service>
 # For some reason, compose exec doesn't like the input redirection
 docker exec -i <db_container_name> psql -U <db_user> < /tmp/dump.sql
 docker compose up -d
 rm /tmp/dump.sql
 ```
 Additionally, if upgrading from postgres <= 13, it is necessary to upgrade the
 password hashes. This can be done by running the following command:
 ```bash
 docker compose exec -it <db_service> psql -U <db_user> -c "\password"
 ```
 ## Nextcloud
 Nextcloud requires some additional work to set up notify_push.
 - Initially, comment out the notify_push service in the docker compose.
 - Set up nextcloud and install the Client Push (notify_push) app.
 - Uncomment the notify_push service in the docker compose and `up -d` the stack.
 - ```bash
  docker compose exec app ./occ notify_push:setup https://nc.<domain>/push
  ```
 I should probably get around to automating this at some point.
--- a/contrib/compose_helpers.j2
+++ b/contrib/compose_helpers.j2
@@ -1,28 +0,0 @@
 {% macro default_network(subnet_index) %}
 default:
  enable_ipv6: true
  ipam:
    config:
      - subnet: {{ docker_ipv6_subnet | ansible.utils.ipsubnet(80, subnet_index) }}
 {% endmacro %}
 {% macro traefik_labels(host, service="", port="", auth=false) %}
 traefik.enable=true
 - traefik.http.routers.{{ host }}.rule=Host(`{{ host }}.{{ domain }}`)
 - traefik.http.routers.{{ host }}.entrypoints=web
 - traefik.http.routers.{{ host }}-tls.rule=Host(`{{ host }}.{{ domain }}`)
 - traefik.http.routers.{{ host }}-tls.entrypoints=websecure
 - traefik.http.routers.{{ host }}-tls.tls=true
 - traefik.http.routers.{{ host }}-tls.tls.certresolver=letsencrypt
 - traefik.http.routers.{{ host }}-tls.tls.domains.0.main={{ domain }}
 - traefik.http.routers.{{ host }}-tls.tls.domains.0.sans=*.{{ domain }}
 {% if service -%}
 - traefik.http.routers.{{ host }}.service={{ service }}
 {% endif %}
 {% if port -%}
 - traefik.http.services.{{ host }}.loadbalancer.server.port={{ port }}
 {% endif %}
 {% if auth -%}
 - traefik.http.routers.{{ host }}-tls.middlewares=authentik@docker
 {% endif %}
 {% endmacro %}
--- a/group_vars/alpina/vars.yml
+++ b/group_vars/alpina/vars.yml
@@ -1,63 +0,0 @@
 # Shared variables between environments
 ---
 alpina_svc_path: ~/alpina
 base_volume_path: /mnt/dock
 media_volume_path: /mnt/media
 traefik_subnet: 172.16.122.0
 # Authentik
 authentik_db_password: "{{ vault_authentik_db_password }}"
 authentik_secret_key: "{{ vault_authentik_secret_key }}"
 authentik_sendgrid_api_key: "{{ vault_authentik_sendgrid_api_key }}"
 auth_grafana_client_secret: "{{ vault_auth_grafana_client_secret }}"
 auth_minio_client_secret: "{{ vault_auth_minio_client_secret }}"
 auth_gitea_client_secret: "{{ vault_auth_gitea_client_secret }}"
 auth_nextcloud_client_secret: "{{ vault_auth_nextcloud_client_secret }}"
 arrstack_password: "{{ vault_arrstack_password }}"
 auth_vpgen_client_secret: "{{ vault_auth_vpgen_client_secret }}"
 # Minio
 minio_password: "{{ vault_minio_password }}"
 # Monitoring
 influxdb_admin_password: "{{ vault_influxdb_admin_password }}"
 influxdb_admin_token: "{{ vault_influxdb_admin_token }}"
 # Traefik
 acme_email: "{{ vault_acme_email }}"
 cloudflare_api_token: "{{ vault_cloudflare_api_token }}"
 # Arrstack
 wg_peer_pubkey: "{{ vault_wg_peer_pubkey }}"
 vpn_server_names: "{{ vault_vpn_server_names }}"
 # Gitea
 gitea_db_password: "{{ vault_gitea_db_password }}"
 gitea_sendgrid_api_key: "{{ vault_gitea_sendgrid_api_key }}"
 ## Security
 secret_key: "{{ vault_secret_key }}"
 internal_token: "{{ vault_internal_token }}"
 jwt_secret: "{{ vault_jwt_secret }}"
 # Jellyfin
 # Nextcloud
 nextcloud_db_password: "{{ vault_nextcloud_db_password }}"
 redis_password: "{{ vault_redis_password }}"
 nextcloud_sendgrid_api_key: "{{ vault_nextcloud_sendgrid_api_key }}"
 # VPGen
 vpgen_opnsense_api_url: https://opnsense.cazzzer.com
 vpgen_opnsense_api_key: "{{ vault_vpgen_opnsense_api_key }}"
 vpgen_opnsense_api_secret: "{{ vault_vpgen_opnsense_api_secret }}"
 vpgen_opnsense_wg_ifname: wg2
 vpgen_ipv6_client_prefix_size: 112
 vpgen_ip_max_index: 100
 vpgen_vpn_endpoint: "{{ vault_vpgen_vpn_endpoint }}"
 vpgen_vpn_dns: "{{ vault_vpgen_vpn_dns }}"
 vpgen_max_clients_per_user: 20
--- a/group_vars/alpina/vault.yml
+++ b/group_vars/alpina/vault.yml
@@ -1,138 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 38376439643766303237356563616337663731366435613930393135383962666435313530663632
 3432326162343632613565393737363335306263653032300a643539393562376162333761376631
 62343731316430316638363338343966326635383930623339383339653936343765316439393233
 6562323634383363300a323233346338393764623363346139313661386433656337363332656230
 31306233643735333033316139363165373062363334363933396563366234316330646230353261
 62326539663337323036346533303031333730373061656563613535376162633138306634626462
 37313038356466336138643834643863393333373939616362636365366231383762633030313831
 33393139313336623437396161623437323163633362363137626262653462633737373062643735
 63353561313639393166306466346134623933323532636438656263663338376337376434356163
 64343239616632313566656664393136363337386464613932383961343134363233653039336137
 65656566306463313264646163646130323533666464323464643433313030346535346535323264
 34356433343739343166383034313935666139663239653662663734343139343035616134303730
 39643136623735666333646234346239303337333961343261383834393963386633633030633962
 61376132313532643730633865326130666565303631386262396366306565613665363934383335
 37376139616165396436663135373932653064656136356662363137653036383537613665393634
 38313063656637353630373634316564383362663335356364626161663163323362333937316461
 64336636386234623438613766316430353261346339313863306462393335636131363966363038
 66393561323335393063663838393466656331323433376461653838313638303564666662636438
 38663735616261656338626437336433613730353236636266316536656165303534353538316232
 62363063376464323932383261663537393263333266633461326536656533653661303335646431
 36616436396137343634373563386439653833306537373735353764346430616231313538636362
 30363430613839373761363032316137636432643339383561313637376339323836353161343639
 36316665656164396236383538346561306432333637393431393566333566633434393961663330
 32383833396238633966393837336564626135653733383863346161663364353062303931303931
 39653662373734643037393832643439653437353935666430373337643532346161376661633738
 61643431633431666535333463636461613166363238373138306565643533623039353031646634
 62383662663435346635373865633731393362623761313834393964623930646364366534333236
 35393138346433366435313066633436393561643263343534393034373161343834633261363933
 65376636393263663566653436633762643331336139653565663334373561353130653065653935
 31616337313764313532303934376236623833363433336335303262643135643339613839623231
 37343730616166323239653537313137373136626337333665633134363830626131353030393662
 31643366386365353336326133636434303636343637643539653131316133306132643133643364
 64636464373564383938663838613031626563613362626435383832346661306562343165643539
 66353431393032313262393566353833343632366139656234306561366139633431653133356165
 32363332636433626132666462626137653337646234646565303831646330333133353964626461
 37333265623865376562663365336339353036346135363062663534643537353331623630356264
 66386665333633383534313062623533383239383231333163663565633531666236306465633135
 36363164636165343863363866343437636630353863316633623761373232643262623762316162
 32613665306535626139366564616362393536336364666663333761383362393631316134373138
 32616665363164363639303538373539346239663261373731613464333734326436666433666539
 31656264326535626134323231646535656563363231633434636337323538343038303233363765
 61393164316237323533313336316530316431653731343261636265393361616464323536333130
 65346538306664663566666435393738323832396365363764333637613331356661306535376332
 62313533306365373737643835396364363737306631346161353031633531383364636563383237
 64633432386565356137333730313736393737303665326531356265376333663636393430386233
 33666532616632373061633063656136646533363034363330366231653936396166663134396139
 66393131653963386365656364666263666362316136333561326566626562616138383739346139
 62343035646435393136656434646138376331346164663562306166646132363230333538323536
 38643934613633373734653337666261356639353235326539356264633232343834633062336539
 31616536663730656163626437653932313564633938643163313765393731386533323465303831
 34353663363862363761643565633635373834623665653131613531373637386361636661376532
 64386435643966343034643763393461373961626134346539653865636161333962333463393734
 62343838363432396133326235323636613239326139376365353930373835313531326433326234
 66396537636162363865663433626230316362343334653735646637613130636436633132663538
 64623230303266373965616533346464373661363233613837613765343463306136623063313139
 31383039343462363536646636653736316362356565326538636331646235373162663332313961
 64623061636638666234623336656365383165626461323561343930316432313632316332306334
 61376430303835383934396266303564363230313735366464386134393265326334663633663632
 38643034393737303963643733656333316137646435653666353239373738373632383561646333
 65363865353362383832643238363332613931343038366563316163303764323936316466666364
 31373439383661656336653431666164393833643266656133383137376133636134643137663532
 33353531663336346562653339616430333133363232336461353937303435346337363932306133
 37623164343462363830323263323664303334633563313439376232303031633633316636383164
 66306238333432333635653435383138383339343837346134613630353335656335663062326132
 65323638343963623062663638366538363162343230323262616138373239653163623832313366
 65323834383631646164316363383636643437346435313030656362653332653635343066666232
 39346235383265326262306434383861653138393835663863383032363664323565316165646566
 61646238393062373131346536343533663839313831383335316363343465663130633133393436
 66333465633636353639663836376561353839613533346164366238353833636534633338313262
 30656433376362346333303630643639353262323532666238633764363132303161326638643761
 36616131636538613539383935613337643930333334613566393031646630383330656164363361
 37306536356164633831626362653364313164356235653464333633313263383032333439626434
 65376531396661636661303831393062666362623966353739303330393631323963373564353265
 61343862323737336238356231626561396333386264666563356235333339653538626130623936
 63326431316538346534313764356333396565666431633833613337323136643137306166623238
 66393561333137373964353935323930636237366433613038383761643665363330323865386133
 37623339613733353366656637383030623663313639363334656361623035643232626633313864
 36346564653766646333613763616163363462613937656534363461376235613064373039326165
 32666265383065636232613632333830633439653066653666663261646536663434393535613131
 30373062313765663038313534623165653833623330383032363063393239373234636630646561
 38633962363530666638666630316434613462656335613236363831313863613030636539356133
 66386133383433663964306661636131633236633935633236623530373864646363383534383735
 63633165626464333332303331333338313838393832626637626137316338643136336333633930
 61346436336635656639616261383666336330333862303139633137373362303033653432613039
 35623663353538323761623839623438646363313164356631386364356533346133333334326565
 32303837663261386463313535373765356166376165386535623838326431616564346632363732
 62373231356530346632373134343865303532326136653731633038353066623435336462303138
 37363039343433613939363663623135396636396433653362666164323237393664623564393532
 61376463336564396537366365373936333666373432376566323864343735636264643139643063
 66396230303336633438666234336434353866323637316334313162363734623763666338336234
 39303330343035333864396631323231363134646238323065356138633131323135613133356237
 34373562633430613062313261363939373632313838333934303165336562663839663833383763
 39316632656561653033613933373861366361353761346539306234366538373461373930306535
 66623430343336333033306135303639646566393336663538313430616364653933663536386535
 64323962353734356134656361663131376564626461386233643731393664353038626464313763
 64396265373737313134613962376334373965353338303363303935353538643561336461393032
 37356434343837376534663938366434343063643966643965346465636166363235643635333466
 38323664366366663363616664336165653264633437393636363866316262303432356461386330
 63326539626363333331366162363230626462656633653866383331333164663734633630353265
 63303832376230646136346261383965626633613739616330666232376366613332663839336531
 32343031336363663865643165666435623462376130326433316562363530343662366432313031
 63626538656633346563663735323030363231643933326337613634376531636235333339373633
 66353362333265343964353966383363613336636536393734363363623363316532653533633434
 39333162303834353362323362656630343733653336613065333462626637303264653361393462
 32336238326535383662636465383832346438333230666662633430303964343236626331623536
 65383666316431646538396661386332323037383666336138666135613763363633343934663836
 32656362323631303732613235663135633939643165626231373162643963613637626235613365
 32326266323431636434633234333730373836373039666137663232323539396364373061393232
 30646432666365333336333836313333363537363163383034656136383164663331373632313564
 34353731363338323438366464663938393632626530323537306233613866356234323364373766
 34326662656263383864613538326536626133386532303932326362376632363631356535393937
 33346462336636656165316166363364343330383337636361656438383661333366633532616131
 37313033623430663039626131303933316561666233613666636433363537373264653331323136
 66663532653233373735326333333738663931343735306262353831303330633136623966316431
 39316462313066336536623438626163383139343532313932316435356431323865373035343465
 30346237393531353833616136323431376530333635633632666431313938643539363831313539
 38396338336136363165323135663836336139623865666631663237616664636233653663383965
 39623665656563316334323738323730306631636565393662313536353565383033653365663461
 38326432353166376438356238386161396638666131636536356333393563613461373263346538
 36656138353762323662363061613764633466303566353338626666646533616137393336333333
 30393733316636353266653039346237363830333831383535646531616130353534633062643135
 64373533646462313035383236333866313866366130663863363162613234393762646662666233
 30653666353333366365343036643462346361303536363935396133343166303339623461376563
 39333163636466646534356337656431376663623833303235303534633634386665636162346634
 34646665633639663763316339663539663261333436363935316334656330313835616138626237
 35623363393532633937653132303635396536646635633062393661616538303631663136363038
 35623539303963383063343338653130643233636537356264323238633839303337383665393333
 36303330393638643464646535653833626531343634626531396261363139326336623765623039
 32613237636366376463343766303964336661363432646436373963626537373137396661633766
 63633830663035663764303634643662333464353234646232343066306131336533396435313239
 66366630643564313665306130656463633065646430373334336664633264353336376439666137
 65366537366462623136353539373961333238373733663837373430663865643334393565333861
 35363035343561633164613631633532623164376339633630393633396437333034376339656538
 32653030626434326632386635383739663932393331333062656565303939373566653031613839
 31363162666330393232646562333833633266643165316464623533623539356339333365623966
 65323638396531346261303835373138333262323466656263643737343734303237303638353036
 3733
--- a/group_vars/docker_hosts.yml
+++ b/group_vars/docker_hosts.yml
@@ -0,0 +1,2 @@
 ---
 my_svc_path: ~/services
--- a/inventories/prod/group_vars/alpina/vars.yml
+++ b/inventories/prod/group_vars/alpina/vars.yml
@@ -1,20 +0,0 @@
 # Environment specific variables (prod)
 ---
 docker_ipv6_index: 255
 # Arrstack VPN
 wg_privkey: "{{ vault_wg_privkey }}"
 wg_psk: "{{ vault_wg_psk }}"
 wg_addresses: "{{ vault_wg_addresses }}"
 fw_vpn_input_ports: "{{ vault_fw_vpn_input_ports }}"
 # Authentik External OAuth
 github_consumer_key: 32d5cae58d744c56fcc9
 github_consumer_secret: "{{ vault_github_consumer_secret }}"
 google_consumer_key: 606830535764-9vc8mjta87g9974pb7qasp82cpoc1d3a.apps.googleusercontent.com
 google_consumer_secret: "{{ vault_google_consumer_secret }}"
 # VPGen
 vpgen_ipv4_starting_addr: 10.18.11.100
 vpgen_ipv6_starting_addr: "{{ vault_vpgen_ipv6_starting_addr }}"
--- a/inventories/prod/group_vars/alpina/vault.yml
+++ b/inventories/prod/group_vars/alpina/vault.yml
@@ -1,27 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 64376262343730306465343137353235393430646535633031646432363631643061656336313962
 6661643832613835353937313832393762613430616338360a356137373036343037316635666366
 62643132656233663933353239653438316238353363326539353038383436613038356137643836
 6265373939326266640a376162333266313333653339383533303639393932373266356361313763
 65346235626430323232393161643932316161383564393663343039626431366130353066636265
 63643639383162326235373636393435316338393431393166663835623739356562633435373438
 30393630623261353134313038643464306637383738303163353937316261313263613264393939
 37363037616230623732663866656665666664393835313836393237303234303866393437393833
 34376335353133613938663861323062623763323463316563363439623030653033373538323436
 38333863353333323364396431373030386636366330323562663831376531333661613337303835
 35643464396332333436633036326563613863636238353837643965303862636665303362336162
 34623430353061613364643436343736613734326332316465356333626534303166636638336236
 36613362666337616635316330396635616165346666396465303861386162353836333332663931
 64663838646332316363376339666632336238613365636666623137663564313665363461393163
 35303735613734393439376339396466643065316432383236393633376461316534623535396464
 62386464396534333561323539646336623464623033333835356439353632373033373736393134
 30666435306632336433383562303238363361313735323439366638333033653761393061303130
 36633536356264376366383335623534323436383361373037383931313766353534363663336462
 39353064306439306135623863643163393762333366303665623432386462333466626535613464
 65613031666530303163353534323032396264666464303639383038343537303839633831373039
 61323437313737623530663532626530613935353431306138623239386136323334636163343432
 65633933643630643634336639393866353739653638656366356163343132656666336232643731
 65363639623262613132646366353235626237646532373233626162643434396362313033653637
 36333035646634616138313863386637346466393262363833313135343964666630623736343666
 64373638333066343666306334366332366530623138306636633166613739363635303138633434
 3439326265613564666639363362643037653733393336363232
--- a/inventories/prod/hosts
+++ b/inventories/prod/hosts
@@ -1,2 +1,2 @@
-[alpina]
+[docker_hosts]
-debbi.lab.home
+root@alpina.lab.home
--- a/inventories/staging/group_vars/alpina/vars.yml
+++ b/inventories/staging/group_vars/alpina/vars.yml
@@ -1,20 +0,0 @@
 # Environment specific variables (staging)
 ---
 docker_ipv6_index: 254
 # Arrstack VPN
 wg_privkey: "{{ vault_wg_privkey }}"
 wg_psk: "{{ vault_wg_psk }}"
 wg_addresses: "{{ vault_wg_addresses }}"
 fw_vpn_input_ports: "{{ vault_fw_vpn_input_ports }}"
 # Authentik External OAuth
 github_consumer_key: dbacb8621c37320eb745
 github_consumer_secret: "{{ vault_github_consumer_secret }}"
 google_consumer_key: 606830535764-pec4b3sa2tohim3u9jl2jmnl1see46q1.apps.googleusercontent.com
 google_consumer_secret: "{{ vault_google_consumer_secret }}"
 # VPGen
 vpgen_ipv4_starting_addr: 10.18.11.50
 vpgen_ipv6_starting_addr: "{{ vault_vpgen_ipv6_starting_addr }}"
--- a/inventories/staging/group_vars/alpina/vault.yml
+++ b/inventories/staging/group_vars/alpina/vault.yml
@@ -1,27 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 66646463303166643563376162636432643963336537343738383763653232316661383864373761
 3539643230626437623736353630663865376630663765650a666266663366393833396461303665
 61663961623036383039323239333361396564343836363662326237666464363439643336613336
 6562666639313461330a613831316232623963396136343638643133376430373634316133653432
 65633339623833303866343130386433633065326466333636353362306362663830333934393364
 35613338316631333438623230623131626431633930313664616237396666326665633965373333
 33636234666561656333623836633562363130346665623839353734616437303562623530613432
 31313037366232613335613262336334393966326139633332613733326335383130316265613038
 35366162623737666331636435643234383634663964666465666563396262336134306636343830
 30373831393232373664666564316134316266376134323538366130383962396566386161303461
 31336333633135323631373763346631656132346334356233303630643166323565393736336236
 39343231313132316663613734323833303935333162643862623632316662653736303266336635
 37316435633464343761656262326538633730616239366330363736323761653061306139623335
 33363066383636633461353534396433653161393132313034373165653563646234653764306539
 32653239613566653762613364653863313334653437646166643537633530613463653966383538
 37343834326162393739333066623066613566313265626562333537366230393938613931366638
 36316364383361366461396136353063363233353865373062643963646266643763363938376265
 34623333316264383035373266313437353161666537376535333830616435383830366166316136
 33643132316534383466343366303764633031353961363033663662636364613132343862653066
 39376136323662383866666136656361396263666338623133346436353938316464346363303761
 39656133653736646137396437396133373765376337623832653232383531663930663037323462
 66373630633737356138333532333265393964313739336363663265613363636464623232316539
 37353164393965616363346666303330613438306136363037313065666662656535356437663262
 37306264626431396336326362653764316536396366393533336164663861366462653964656465
 64366139333535383065643033343632323837633036323439376134373966613739626261376436
 3133326138613735316230353965656239303263386638373339
--- a/inventories/staging/hosts
+++ b/inventories/staging/hosts
@@ -1,2 +1,2 @@
-[alpina]
+[docker_hosts]
-etappi.lab.home
+root@etapp.lab.home
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,442 +0,0 @@
 # This file is automatically @generated by Poetry 1.8.4 and should not be changed by hand.
 [[package]]
 name = "ansible"
 version = "10.7.0"
 description = "Radically simple IT automation"
 optional = false
 python-versions = ">=3.10"
 files = [
    {file = "ansible-10.7.0-py3-none-any.whl", hash = "sha256:0089f08e047ceb70edd011be009f5c6273add613fbe491e9697c0556c989d8ea"},
    {file = "ansible-10.7.0.tar.gz", hash = "sha256:59d29e3de1080e740dfa974517d455217601b16d16880314d9be26145c68dc22"},
 ]
 [package.dependencies]
 ansible-core = ">=2.17.7,<2.18.0"
 [[package]]
 name = "ansible-core"
 version = "2.17.7"
 description = "Radically simple IT automation"
 optional = false
 python-versions = ">=3.10"
 files = [
    {file = "ansible_core-2.17.7-py3-none-any.whl", hash = "sha256:64d4f0a006687a5621aa80dca54fd0c5ae75145b7aac8c1b8d7f07a1399c4705"},
    {file = "ansible_core-2.17.7.tar.gz", hash = "sha256:3aaab735d6c4e2d6239bc326800dc0ecda2a1490caa8455b41084ec0bc54dacf"},
 ]
 [package.dependencies]
 cryptography = "*"
 jinja2 = ">=3.0.0"
 packaging = "*"
 PyYAML = ">=5.1"
 resolvelib = ">=0.5.3,<1.1.0"
 [[package]]
 name = "ansible-vault"
 version = "2.1.0"
 description = "R/W an ansible-vault yaml file"
 optional = false
 python-versions = "*"
 files = [
    {file = "ansible-vault-2.1.0.tar.gz", hash = "sha256:5ce8fdb5470f1449b76bf07ae2abc56480dad48356ae405c85b686efb64dbd5e"},
 ]
 [package.dependencies]
 ansible = "*"
 setuptools = "*"
 [package.extras]
 dev = ["black", "flake8", "isort[pyproject]", "pytest"]
 release = ["twine"]
 [[package]]
 name = "attrs"
 version = "24.3.0"
 description = "Classes Without Boilerplate"
 optional = false
 python-versions = ">=3.8"
 files = [
    {file = "attrs-24.3.0-py3-none-any.whl", hash = "sha256:ac96cd038792094f438ad1f6ff80837353805ac950cd2aa0e0625ef19850c308"},
    {file = "attrs-24.3.0.tar.gz", hash = "sha256:8f5c07333d543103541ba7be0e2ce16eeee8130cb0b3f9238ab904ce1e85baff"},
 ]
 [package.extras]
 benchmark = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-codspeed", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
 cov = ["cloudpickle", "coverage[toml] (>=5.3)", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
 dev = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pre-commit-uv", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
 docs = ["cogapp", "furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier (<24.7)"]
 tests = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"]
 tests-mypy = ["mypy (>=1.11.1)", "pytest-mypy-plugins"]
 [[package]]
 name = "cffi"
 version = "1.17.1"
 description = "Foreign Function Interface for Python calling C code."
 optional = false
 python-versions = ">=3.8"
 files = [
    {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"},
    {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"},
    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"},
    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"},
    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"},
    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"},
    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"},
    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"},
    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"},
    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"},
    {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"},
    {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"},
    {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"},
    {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"},
    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"},
    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"},
    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"},
    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"},
    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"},
    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"},
    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"},
    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"},
    {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"},
    {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"},
    {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"},
    {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"},
    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"},
    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"},
    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"},
    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"},
    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"},
    {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"},
    {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"},
    {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"},
    {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"},
    {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"},
    {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"},
    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"},
    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"},
    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"},
    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"},
    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"},
    {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"},
    {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"},
    {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"},
    {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"},
    {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"},
    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"},
    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"},
    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"},
    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"},
    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"},
    {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"},
    {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"},
    {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"},
    {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"},
    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"},
    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"},
    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"},
    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"},
    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"},
    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"},
    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"},
    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"},
    {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"},
    {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"},
    {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"},
 ]
 [package.dependencies]
 pycparser = "*"
 [[package]]
 name = "cryptography"
 version = "44.0.0"
 description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
 optional = false
 python-versions = "!=3.9.0,!=3.9.1,>=3.7"
 files = [
    {file = "cryptography-44.0.0-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:84111ad4ff3f6253820e6d3e58be2cc2a00adb29335d4cacb5ab4d4d34f2a123"},
    {file = "cryptography-44.0.0-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b15492a11f9e1b62ba9d73c210e2416724633167de94607ec6069ef724fad092"},
    {file = "cryptography-44.0.0-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:831c3c4d0774e488fdc83a1923b49b9957d33287de923d58ebd3cec47a0ae43f"},
    {file = "cryptography-44.0.0-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:761817a3377ef15ac23cd7834715081791d4ec77f9297ee694ca1ee9c2c7e5eb"},
    {file = "cryptography-44.0.0-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3c672a53c0fb4725a29c303be906d3c1fa99c32f58abe008a82705f9ee96f40b"},
    {file = "cryptography-44.0.0-cp37-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:4ac4c9f37eba52cb6fbeaf5b59c152ea976726b865bd4cf87883a7e7006cc543"},
    {file = "cryptography-44.0.0-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ed3534eb1090483c96178fcb0f8893719d96d5274dfde98aa6add34614e97c8e"},
    {file = "cryptography-44.0.0-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:f3f6fdfa89ee2d9d496e2c087cebef9d4fcbb0ad63c40e821b39f74bf48d9c5e"},
    {file = "cryptography-44.0.0-cp37-abi3-win32.whl", hash = "sha256:eb33480f1bad5b78233b0ad3e1b0be21e8ef1da745d8d2aecbb20671658b9053"},
    {file = "cryptography-44.0.0-cp37-abi3-win_amd64.whl", hash = "sha256:abc998e0c0eee3c8a1904221d3f67dcfa76422b23620173e28c11d3e626c21bd"},
    {file = "cryptography-44.0.0-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:660cb7312a08bc38be15b696462fa7cc7cd85c3ed9c576e81f4dc4d8b2b31591"},
    {file = "cryptography-44.0.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1923cb251c04be85eec9fda837661c67c1049063305d6be5721643c22dd4e2b7"},
    {file = "cryptography-44.0.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:404fdc66ee5f83a1388be54300ae978b2efd538018de18556dde92575e05defc"},
    {file = "cryptography-44.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:c5eb858beed7835e5ad1faba59e865109f3e52b3783b9ac21e7e47dc5554e289"},
    {file = "cryptography-44.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:f53c2c87e0fb4b0c00fa9571082a057e37690a8f12233306161c8f4b819960b7"},
    {file = "cryptography-44.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:9e6fc8a08e116fb7c7dd1f040074c9d7b51d74a8ea40d4df2fc7aa08b76b9e6c"},
    {file = "cryptography-44.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:d2436114e46b36d00f8b72ff57e598978b37399d2786fd39793c36c6d5cb1c64"},
    {file = "cryptography-44.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a01956ddfa0a6790d594f5b34fc1bfa6098aca434696a03cfdbe469b8ed79285"},
    {file = "cryptography-44.0.0-cp39-abi3-win32.whl", hash = "sha256:eca27345e1214d1b9f9490d200f9db5a874479be914199194e746c893788d417"},
    {file = "cryptography-44.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:708ee5f1bafe76d041b53a4f95eb28cdeb8d18da17e597d46d7833ee59b97ede"},
    {file = "cryptography-44.0.0-pp310-pypy310_pp73-macosx_10_9_x86_64.whl", hash = "sha256:37d76e6863da3774cd9db5b409a9ecfd2c71c981c38788d3fcfaf177f447b731"},
    {file = "cryptography-44.0.0-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:f677e1268c4e23420c3acade68fac427fffcb8d19d7df95ed7ad17cdef8404f4"},
    {file = "cryptography-44.0.0-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:f5e7cb1e5e56ca0933b4873c0220a78b773b24d40d186b6738080b73d3d0a756"},
    {file = "cryptography-44.0.0-pp310-pypy310_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:8b3e6eae66cf54701ee7d9c83c30ac0a1e3fa17be486033000f2a73a12ab507c"},
    {file = "cryptography-44.0.0-pp310-pypy310_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:be4ce505894d15d5c5037167ffb7f0ae90b7be6f2a98f9a5c3442395501c32fa"},
    {file = "cryptography-44.0.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:62901fb618f74d7d81bf408c8719e9ec14d863086efe4185afd07c352aee1d2c"},
    {file = "cryptography-44.0.0.tar.gz", hash = "sha256:cd4e834f340b4293430701e772ec543b0fbe6c2dea510a5286fe0acabe153a02"},
 ]
 [package.dependencies]
 cffi = {version = ">=1.12", markers = "platform_python_implementation != \"PyPy\""}
 [package.extras]
 docs = ["sphinx (>=5.3.0)", "sphinx-rtd-theme (>=3.0.0)"]
 docstest = ["pyenchant (>=3)", "readme-renderer (>=30.0)", "sphinxcontrib-spelling (>=7.3.1)"]
 nox = ["nox (>=2024.4.15)", "nox[uv] (>=2024.3.2)"]
 pep8test = ["check-sdist", "click (>=8.0.1)", "mypy (>=1.4)", "ruff (>=0.3.6)"]
 sdist = ["build (>=1.0.0)"]
 ssh = ["bcrypt (>=3.1.5)"]
 test = ["certifi (>=2024)", "cryptography-vectors (==44.0.0)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
 test-randomorder = ["pytest-randomly"]
 [[package]]
 name = "grafanalib"
 version = "0.7.1"
 description = "Library for building Grafana dashboards"
 optional = false
 python-versions = "*"
 files = [
    {file = "grafanalib-0.7.1-py3-none-any.whl", hash = "sha256:6fab5d7b837a1f2d1322ef762cd52e565ec0422707a7512765c59f668bdceb58"},
    {file = "grafanalib-0.7.1.tar.gz", hash = "sha256:3d92bb4e92ae78fe4e21c5b252ab51f4fdcacd8523ba5a44545b897b2a375b83"},
 ]
 [package.dependencies]
 attrs = ">=15.2.0"
 [package.extras]
 dev = ["flake8", "pytest"]
 [[package]]
 name = "jinja2"
 version = "3.1.5"
 description = "A very fast and expressive template engine."
 optional = false
 python-versions = ">=3.7"
 files = [
    {file = "jinja2-3.1.5-py3-none-any.whl", hash = "sha256:aba0f4dc9ed8013c424088f68a5c226f7d6097ed89b246d7749c2ec4175c6adb"},
    {file = "jinja2-3.1.5.tar.gz", hash = "sha256:8fefff8dc3034e27bb80d67c671eb8a9bc424c0ef4c0826edbff304cceff43bb"},
 ]
 [package.dependencies]
 MarkupSafe = ">=2.0"
 [package.extras]
 i18n = ["Babel (>=2.7)"]
 [[package]]
 name = "markupsafe"
 version = "3.0.2"
 description = "Safely add untrusted strings to HTML/XML markup."
 optional = false
 python-versions = ">=3.9"
 files = [
    {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-win32.whl", hash = "sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"},
    {file = "MarkupSafe-3.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-win32.whl", hash = "sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d"},
    {file = "MarkupSafe-3.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-win32.whl", hash = "sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30"},
    {file = "MarkupSafe-3.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-win32.whl", hash = "sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1"},
    {file = "MarkupSafe-3.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-win32.whl", hash = "sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6"},
    {file = "MarkupSafe-3.0.2-cp313-cp313t-win_amd64.whl", hash = "sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-win32.whl", hash = "sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f"},
    {file = "MarkupSafe-3.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a"},
    {file = "markupsafe-3.0.2.tar.gz", hash = "sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0"},
 ]
 [[package]]
 name = "netaddr"
 version = "1.3.0"
 description = "A network address manipulation library for Python"
 optional = false
 python-versions = ">=3.7"
 files = [
    {file = "netaddr-1.3.0-py3-none-any.whl", hash = "sha256:c2c6a8ebe5554ce33b7d5b3a306b71bbb373e000bbbf2350dd5213cc56e3dbbe"},
    {file = "netaddr-1.3.0.tar.gz", hash = "sha256:5c3c3d9895b551b763779ba7db7a03487dc1f8e3b385af819af341ae9ef6e48a"},
 ]
 [package.extras]
 nicer-shell = ["ipython"]
 [[package]]
 name = "packaging"
 version = "24.2"
 description = "Core utilities for Python packages"
 optional = false
 python-versions = ">=3.8"
 files = [
    {file = "packaging-24.2-py3-none-any.whl", hash = "sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759"},
    {file = "packaging-24.2.tar.gz", hash = "sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f"},
 ]
 [[package]]
 name = "pycparser"
 version = "2.22"
 description = "C parser in Python"
 optional = false
 python-versions = ">=3.8"
 files = [
    {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"},
    {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"},
 ]
 [[package]]
 name = "pyyaml"
 version = "6.0.2"
 description = "YAML parser and emitter for Python"
 optional = false
 python-versions = ">=3.8"
 files = [
    {file = "PyYAML-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086"},
    {file = "PyYAML-6.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf"},
    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237"},
    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b"},
    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed"},
    {file = "PyYAML-6.0.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180"},
    {file = "PyYAML-6.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68"},
    {file = "PyYAML-6.0.2-cp310-cp310-win32.whl", hash = "sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99"},
    {file = "PyYAML-6.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e"},
    {file = "PyYAML-6.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774"},
    {file = "PyYAML-6.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee"},
    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c"},
    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317"},
    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85"},
    {file = "PyYAML-6.0.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4"},
    {file = "PyYAML-6.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e"},
    {file = "PyYAML-6.0.2-cp311-cp311-win32.whl", hash = "sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5"},
    {file = "PyYAML-6.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44"},
    {file = "PyYAML-6.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab"},
    {file = "PyYAML-6.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725"},
    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5"},
    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425"},
    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476"},
    {file = "PyYAML-6.0.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48"},
    {file = "PyYAML-6.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b"},
    {file = "PyYAML-6.0.2-cp312-cp312-win32.whl", hash = "sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4"},
    {file = "PyYAML-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8"},
    {file = "PyYAML-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba"},
    {file = "PyYAML-6.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1"},
    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133"},
    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484"},
    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5"},
    {file = "PyYAML-6.0.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc"},
    {file = "PyYAML-6.0.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652"},
    {file = "PyYAML-6.0.2-cp313-cp313-win32.whl", hash = "sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183"},
    {file = "PyYAML-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563"},
    {file = "PyYAML-6.0.2-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a"},
    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5"},
    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d"},
    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083"},
    {file = "PyYAML-6.0.2-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706"},
    {file = "PyYAML-6.0.2-cp38-cp38-win32.whl", hash = "sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a"},
    {file = "PyYAML-6.0.2-cp38-cp38-win_amd64.whl", hash = "sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff"},
    {file = "PyYAML-6.0.2-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d"},
    {file = "PyYAML-6.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f"},
    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290"},
    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12"},
    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19"},
    {file = "PyYAML-6.0.2-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e"},
    {file = "PyYAML-6.0.2-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725"},
    {file = "PyYAML-6.0.2-cp39-cp39-win32.whl", hash = "sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631"},
    {file = "PyYAML-6.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8"},
    {file = "pyyaml-6.0.2.tar.gz", hash = "sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e"},
 ]
 [[package]]
 name = "resolvelib"
 version = "1.0.1"
 description = "Resolve abstract dependencies into concrete ones"
 optional = false
 python-versions = "*"
 files = [
    {file = "resolvelib-1.0.1-py2.py3-none-any.whl", hash = "sha256:d2da45d1a8dfee81bdd591647783e340ef3bcb104b54c383f70d422ef5cc7dbf"},
    {file = "resolvelib-1.0.1.tar.gz", hash = "sha256:04ce76cbd63fded2078ce224785da6ecd42b9564b1390793f64ddecbe997b309"},
 ]
 [package.extras]
 examples = ["html5lib", "packaging", "pygraphviz", "requests"]
 lint = ["black", "flake8", "isort", "mypy", "types-requests"]
 release = ["build", "towncrier", "twine"]
 test = ["commentjson", "packaging", "pytest"]
 [[package]]
 name = "setuptools"
 version = "75.6.0"
 description = "Easily download, build, install, upgrade, and uninstall Python packages"
 optional = false
 python-versions = ">=3.9"
 files = [
    {file = "setuptools-75.6.0-py3-none-any.whl", hash = "sha256:ce74b49e8f7110f9bf04883b730f4765b774ef3ef28f722cce7c273d253aaf7d"},
    {file = "setuptools-75.6.0.tar.gz", hash = "sha256:8199222558df7c86216af4f84c30e9b34a61d8ba19366cc914424cdbd28252f6"},
 ]
 [package.extras]
 check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)", "ruff (>=0.7.0)"]
 core = ["importlib_metadata (>=6)", "jaraco.collections", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging", "packaging (>=24.2)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1)", "wheel (>=0.43.0)"]
 cover = ["pytest-cov"]
 doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "pyproject-hooks (!=1.1)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier", "towncrier (<24.7)"]
 enabler = ["pytest-enabler (>=2.2)"]
 test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"]
 type = ["importlib_metadata (>=7.0.2)", "jaraco.develop (>=7.21)", "mypy (>=1.12,<1.14)", "pytest-mypy"]
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.10"
 content-hash = "334448cb0c7d192f0e10987a995ecefca5e136733cce4dd15dcc2238f1c371c8"
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,20 +0,0 @@
 [tool.poetry]
 name = "alpina"
 version = "0.1.0"
 description = ""
 authors = ["Iurii Tatishchev <itatishch@gmail.com>"]
 readme = "README.md"
 [tool.poetry.dependencies]
 python = "^3.10"
 ansible = "^10.1.0"
 ansible-vault = "^2.1.0"
 netaddr = "^1.3.0"
 [tool.poetry.dev-dependencies]
 grafanalib = "^0.7.1"
 [build-system]
 requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
--- a/requirements.txt
+++ b/requirements.txt
@@ -0,0 +1 @@
 ansible==6.0.0
--- a/roles/alpina/tasks/deploy_collection.yml
+++ b/roles/alpina/tasks/deploy_collection.yml
@@ -1,15 +0,0 @@
 - name: Ensure {{ collection }} collection directory exists
  file:
    path: "{{ alpina_svc_path }}/{{ collection }}"
    state: directory
    mode: "700"
 - name: Deploy docker compose stacks for {{ collection }}
  vars:
    current_stack_name: "{{ stack }}"
    current_stack_dest: "{{ alpina_svc_path }}/{{ collection }}/{{ stack }}"
    current_stack_source: "{{ role_path }}/templates/{{ collection }}/{{ stack }}"
  include_tasks: deploy_compose_stack.yml
  loop: "{{ stacks }}"
  loop_control:
    loop_var: stack
--- a/roles/alpina/tasks/deploy_compose_stack.yml
+++ b/roles/alpina/tasks/deploy_compose_stack.yml
@@ -1,42 +0,0 @@
 # https://stackoverflow.com/questions/41667864/can-the-templates-module-handle-multiple-templates-directories
 - name: Ensure {{ stack }} stack directory exists
  file:
    path: "{{ current_stack_dest }}"
    state: directory
    mode: "700"
 - name: Ensure directory structure exists
  file:
    path: "{{ current_stack_dest }}/{{ item.path }}"
    state: directory
    mode: "755"
  loop: "{{ lookup('community.general.filetree', current_stack_source) }}"
  when: item.state == "directory"
 - name: Generate {{ current_stack_name }} deployment from templates
  template:
    src: "{{ item.src }}"
    dest: "{{ current_stack_dest }}/{{ item.path | regex_replace('\\.j2$', '') }}"
    mode: "644"
  loop: "{{ lookup('community.general.filetree', current_stack_source) }}"
  when: item.state == "file" and item.path | regex_search('\\.j2$')
 - name: Generate {{ current_stack_name }} deployment from static files
  copy:
    src: "{{ item.src }}"
    dest: "{{ current_stack_dest }}/{{ item.path }}"
    mode: "644"
  loop: "{{ lookup('community.general.filetree', current_stack_source) }}"
  when: item.state == "file" and not item.path | regex_search('\\.j2$')
 - name: Deploy docker-compose for {{ current_stack_name }}
  community.docker.docker_compose_v2:
    project_src: "{{ current_stack_dest }}"
    state: present
    pull: always
    remove_orphans: yes
  register: docker_compose_output
 # - debug:
 #     var: docker_compose_output
--- a/roles/alpina/tasks/main.yml
+++ b/roles/alpina/tasks/main.yml
@@ -1,35 +0,0 @@
 - name: Register uid of remote user
  command: id -u
  register: remote_uid_command
  changed_when: false
 - name: Set fact for uid
  set_fact:
    remote_uid: "{{ remote_uid_command.stdout }}"
 - name: Ensure alpina directory exists
  file:
    state: directory
    path: "{{ alpina_svc_path }}"
    mode: "700"
 - name: Deploy collection services
  vars:
    collection: services
    stacks:
      - traefik
      - monitoring
      - authentik
      - minio
  import_tasks: deploy_collection.yml
 - name: Deploy collection apps
  vars:
    collection: apps
    stacks:
      - gitea
      - nextcloud
      - jellyfin
      - arrstack
      - vpgen
  import_tasks: deploy_collection.yml
--- a/roles/alpina/templates/apps/arrstack/.env.gluetun.j2
+++ b/roles/alpina/templates/apps/arrstack/.env.gluetun.j2
@@ -1,33 +0,0 @@
 ## ProtonVPN OpenVPN
 #VPN_SERVICE_PROVIDER=protonvpn
 #OPENVPN_USER=+pmp
 #OPENVPN_PASSWORD=
 #SERVER_HOSTNAMES=node-us-160.protonvpn.net,node-us-161.protonvpn.net
 #VPN_PORT_FORWARDING=on
 ## ProtonVPN WireGuard
 #VPN_SERVICE_PROVIDER=custom
 #VPN_TYPE=wireguard
 #VPN_ENDPOINT_IP=
 #VPN_ENDPOINT_PORT=
 #WIREGUARD_PUBLIC_KEY=
 #WIREGUARD_PRIVATE_KEY=
 #WIREGUARD_PRESHARED_KEY=
 #WIREGUARD_ADDRESSES=
 #VPN_DNS_ADDRESS=
 #VPN_PORT_FORWARDING=on
 #VPN_PORT_FORWARDING_PROVIDER=protonvpn
 ## AirVPN
 VPN_SERVICE_PROVIDER=airvpn
 VPN_TYPE=wireguard
 SERVER_NAMES={{ vpn_server_names }}
 WIREGUARD_PUBLIC_KEY={{ wg_peer_pubkey }}
 WIREGUARD_PRIVATE_KEY={{ wg_privkey }}
 WIREGUARD_PRESHARED_KEY={{ wg_psk }}
 WIREGUARD_ADDRESSES={{ wg_addresses }}
 FIREWALL_VPN_INPUT_PORTS={{ fw_vpn_input_ports }}
 UPDATER_PERIOD=24h
 #FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8,{{ docker_ipv6_subnet }}
--- a/roles/alpina/templates/apps/arrstack/docker-compose.yml.j2
+++ b/roles/alpina/templates/apps/arrstack/docker-compose.yml.j2
@@ -1,88 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(249) | indent(2) }}
  traefik_traefik:
    external: true
 services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
    env_file:
      - .env.gluetun
    restart: unless-stopped
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/gluetun:/gluetun
  qbittorrent:
    image: linuxserver/qbittorrent:latest
    container_name: qbittorrent
    labels:
      - {{ helpers.traefik_labels('qbit', port='8080', auth=true) | indent(6) }}
    restart: unless-stopped
    environment:
      {#  Keeping this for debugging purposes  -#}
      - DOCKER_MODS=linuxserver/mods:universal-package-install
    network_mode: service:gluetun
    volumes:
      - {{ base_volume_path }}/arrstack/config/qbittorrent:/config
      - {{ base_volume_path }}/arrstack/downloads:/downloads
      - {{ media_volume_path }}/Plex:/media/Plex
      - {{ media_volume_path }}/iso-img:/media/iso-img
    depends_on:
      gluetun:
        condition: service_healthy
  prowlarr:
    image: linuxserver/prowlarr:latest
    container_name: prowlarr
    labels:
      - {{ helpers.traefik_labels('prowlarr', port='9696', auth=true) | indent(6) }}
    restart: unless-stopped
    depends_on:
      - qbittorrent
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/config/prowlarr:/config
  sonarr:
    image: linuxserver/sonarr:latest
    container_name: sonarr
    labels:
      - {{ helpers.traefik_labels('sonarr', port='8989', auth=true) | indent(6) }}
    restart: unless-stopped
    depends_on:
      - qbittorrent
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/config/sonarr:/config
      - {{ base_volume_path }}/arrstack/downloads:/downloads
      - {{ media_volume_path }}/Plex:/media/Plex
  radarr:
    image: linuxserver/radarr:latest
    container_name: radarr
    labels:
      - {{ helpers.traefik_labels('radarr', port='7878', auth=true) | indent(6) }}
    restart: unless-stopped
    depends_on:
      - qbittorrent
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/arrstack/config/radarr:/config
      - {{ base_volume_path }}/arrstack/downloads:/downloads
      - {{ media_volume_path }}/Plex:/media/Plex
--- a/roles/alpina/templates/apps/gitea/.env.db.j2
+++ b/roles/alpina/templates/apps/gitea/.env.db.j2
@@ -1,3 +0,0 @@
 POSTGRES_USER=gitea
 POSTGRES_DB=gitea
 POSTGRES_PASSWORD={{ gitea_db_password }}
--- a/roles/alpina/templates/apps/gitea/.env.gitea.j2
+++ b/roles/alpina/templates/apps/gitea/.env.gitea.j2
@@ -1,29 +0,0 @@
 GITEA____APP_NAME=CazGitea
 # Database
 GITEA__database__DB_TYPE=postgres
 GITEA__database__HOST=db:5432
 GITEA__database__NAME=gitea
 GITEA__database__USER=gitea
 GITEA__database__PASSWD={{ gitea_db_password }}
 # Server
 GITEA__server__ROOT_URL=https://gitea.{{ domain }}/
 GITEA__server__DISABLE_SSH=true
 # Mail
 GITEA__mailer__ENABLED=true
 GITEA__mailer__SMTP_ADDR=smtp.sendgrid.net
 GITEA__mailer__SMTP_PORT=587
 GITEA__mailer__FROM=gitea@cazzzer.com
 GITEA__mailer__USER=apikey
 GITEA__mailer__PASSWD={{ gitea_sendgrid_api_key }}
 # Security
 GITEA__security__SECRET_KEY={{ secret_key }}
 GITEA__security__INTERNAL_TOKEN={{ internal_token }}
 GITEA__oauth2__JWT_SECRET={{ jwt_secret }}
 # Indexer
 GITEA__indexer__REPO_INDEXER_ENABLED=true
--- a/roles/alpina/templates/apps/jellyfin/.env.jellyfin.j2
+++ b/roles/alpina/templates/apps/jellyfin/.env.jellyfin.j2
@@ -1 +0,0 @@
 JELLYFIN_PublishedServerUrl=https://jellyfin.{{ domain }}
--- a/roles/alpina/templates/apps/jellyfin/docker-compose.yml.j2
+++ b/roles/alpina/templates/apps/jellyfin/docker-compose.yml.j2
@@ -1,28 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(197) | indent(2) }}
  traefik_traefik:
    external: true
 services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin_jellyfin
    labels:
      - {{ helpers.traefik_labels('jellyfin', port='8096') | indent(6) }}
    restart: unless-stopped
    env_file:
      - .env.jellyfin
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/jellyfin/config:/config
      - {{ base_volume_path }}/jellyfin/cache:/cache
      - {{ media_volume_path }}/Plex/media:/data/media:ro
      - {{ media_volume_path }}/other_videos:/data/other_videos:ro
    tmpfs:
      - /tmp/transcodes
    devices:
      - /dev/dri:/dev/dri
--- a/roles/alpina/templates/apps/nextcloud/.env.j2
+++ b/roles/alpina/templates/apps/nextcloud/.env.j2
@@ -1 +0,0 @@
 NEXTCLOUD_VERSION=30-apache
--- a/roles/alpina/templates/apps/nextcloud/.env.nextcloud.j2
+++ b/roles/alpina/templates/apps/nextcloud/.env.nextcloud.j2
@@ -1,24 +0,0 @@
 POSTGRES_DB=nextcloud
 POSTGRES_USER=nextcloud
 POSTGRES_PASSWORD={{ nextcloud_db_password }}
 POSTGRES_HOST=db
 NEXTCLOUD_TRUSTED_DOMAINS=nc.{{ domain }}
 REDIS_HOST=redis
 REDIS_HOST_PASSWORD={{ redis_password }}
 SMTP_HOST=smtp.sendgrid.net
 SMTP_SECURE=tls
 SMTP_PORT=587
 SMTP_AUTHTYPE=LOGIN
 SMTP_NAME=apikey
 SMTP_PASSWORD={{ nextcloud_sendgrid_api_key }}
 MAIL_FROM_ADDRESS=nc
 MAIL_DOMAIN=cazzzer.com
 # host IPv4 and IPv6 addresses, loopback for notify_push
 TRUSTED_PROXIES={{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }} {{ hostvars[inventory_hostname]['ansible_default_ipv6']['address'] }} 127.0.0.1 ::1
 OVERWRITEHOST=nc.{{ domain }}
 OVERWRITEPROTOCOL=https
 OVERWRITECLIURL=https://nc.{{ domain }}
--- a/roles/alpina/templates/apps/nextcloud/.env.notify_push.j2
+++ b/roles/alpina/templates/apps/nextcloud/.env.notify_push.j2
@@ -1,4 +0,0 @@
 DATABASE_URL=postgres://nextcloud:{{ nextcloud_db_password }}@db/nextcloud
 DATABASE_PREFIX=oc_
 REDIS_URL=redis://:{{ redis_password }}@redis
 NEXTCLOUD_URL=http://localhost
--- a/roles/alpina/templates/apps/nextcloud/.env.redis.j2
+++ b/roles/alpina/templates/apps/nextcloud/.env.redis.j2
@@ -1 +0,0 @@
 REDIS_PASSWORD={{ redis_password }}
--- a/roles/alpina/templates/apps/nextcloud/docker-compose.yml.j2
+++ b/roles/alpina/templates/apps/nextcloud/docker-compose.yml.j2
@@ -1,87 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(198) | indent(2) }}
  traefik_traefik:
    external: true
 services:
  app:
    image: nextcloud:${NEXTCLOUD_VERSION}
    container_name: nextcloud_app
    labels:
      - {{ helpers.traefik_labels('nc', port='80') | indent(6) }}
    restart: unless-stopped
    depends_on:
      - db
      - redis
    env_file:
      - .env.nextcloud
    networks:
      - default
    volumes:
      - {{ base_volume_path }}/nextcloud/nextcloud:/var/www/html
      - {{ base_volume_path }}/nextcloud/nextcloud_config:/var/www/html/config
      - {{ base_volume_path }}/nextcloud/nextcloud_data:/var/www/html/data
  cron:
    image: nextcloud:${NEXTCLOUD_VERSION}
    container_name: nextcloud_cron
    restart: unless-stopped
    depends_on:
      - app
    entrypoint: /cron.sh
    networks:
      - default
    volumes:
      - {{ base_volume_path }}/nextcloud/nextcloud:/var/www/html
      - {{ base_volume_path }}/nextcloud/nextcloud_config:/var/www/html/config
      - {{ base_volume_path }}/nextcloud/nextcloud_data:/var/www/html/data
  notify_push:
    image: nextcloud:${NEXTCLOUD_VERSION}
    container_name: nextcloud_notify_push
    {# TODO: Refactor this and minio -#}
    labels:
      - traefik.enable=true
      - traefik.http.routers.nc-notify.rule=Host(`nc.{{ domain }}`) && PathPrefix(`/push`)
      - traefik.http.routers.nc-notify.entrypoints=websecure
      - traefik.http.routers.nc-notify.tls=true
      - traefik.http.routers.nc-notify.tls.certresolver=letsencrypt
      - traefik.http.routers.nc-notify.tls.domains.0.main={{ domain }}
      - traefik.http.routers.nc-notify.tls.domains.0.sans=*.{{ domain }}
      - traefik.http.services.nc-notify.loadbalancer.server.port=7867
    restart: unless-stopped
    user: www-data
    env_file:
      - .env.notify_push
    network_mode: service:app
    entrypoint:
      - /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push
    volumes:
      - {{ base_volume_path }}/nextcloud/nextcloud:/var/www/html
  db:
    image: postgres:16-alpine
    container_name: nextcloud_db
    restart: unless-stopped
    env_file:
      - .env.db
    networks:
      - default
    volumes:
      - {{ base_volume_path }}/nextcloud/db:/var/lib/postgresql/data
  redis:
    image: redis:alpine
    container_name: nextcloud_redis
    restart: unless-stopped
    env_file:
      - .env.redis
    networks:
      - default
    command:
      - sh
      - -c
      - redis-server --requirepass $$REDIS_PASSWORD
--- a/roles/alpina/templates/apps/vpgen/.env.vpgen.j2
+++ b/roles/alpina/templates/apps/vpgen/.env.vpgen.j2
@@ -1,20 +0,0 @@
 DATABASE_URL=file:/data/vpgen.db
 AUTH_DOMAIN=auth.{{ domain }}
 AUTH_CLIENT_ID=vpgen
 AUTH_CLIENT_SECRET={{ auth_vpgen_client_secret }}
 OPNSENSE_API_URL={{ vpgen_opnsense_api_url }}
 OPNSENSE_API_KEY={{ vpgen_opnsense_api_key }}
 OPNSENSE_API_SECRET={{ vpgen_opnsense_api_secret }}
 OPNSENSE_WG_IFNAME={{ vpgen_opnsense_wg_ifname }}
 IPV4_STARTING_ADDR={{ vpgen_ipv4_starting_addr }}
 IPV6_STARTING_ADDR={{ vpgen_ipv6_starting_addr }}
 IPV6_CLIENT_PREFIX_SIZE={{ vpgen_ipv6_client_prefix_size }}
 IP_MAX_INDEX={{ vpgen_ip_max_index }}
 VPN_ENDPOINT={{ vpgen_vpn_endpoint }}
 VPN_DNS={{ vpgen_vpn_dns }}
 MAX_CLIENTS_PER_USER={{ vpgen_max_clients_per_user }}
 ORIGIN=https://vpgen.{{ domain }}
--- a/roles/alpina/templates/apps/vpgen/docker-compose.yml.j2
+++ b/roles/alpina/templates/apps/vpgen/docker-compose.yml.j2
@@ -1,16 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(196) | indent(2) }}
 services:
  vpgen:
    image: gitea.cazzzer.com/cazzzer/vpgen:develop
    container_name: vpgen
    labels:
      - {{ helpers.traefik_labels('vpgen', port='3000') | indent(6) }}
    restart: unless-stopped
    env_file:
      - .env.vpgen
    volumes:
      - {{ base_volume_path }}/vpgen:/data
--- a/roles/alpina/templates/services/authentik/.env.authentik.j2
+++ b/roles/alpina/templates/services/authentik/.env.authentik.j2
@@ -1,21 +0,0 @@
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
 AUTHENTIK_REDIS__HOST=redis
 AUTHENTIK_POSTGRESQL__HOST=postgres
 AUTHENTIK_POSTGRESQL__USER=authentik
 AUTHENTIK_POSTGRESQL__NAME=authentik
 AUTHENTIK_POSTGRESQL__PASSWORD={{ authentik_db_password }}
 AUTHENTIK_SECRET_KEY={{ authentik_secret_key }}
 AUTHENTIK_EMAIL__HOST=smtp.sendgrid.net
 AUTHENTIK_EMAIL__PORT=587
 AUTHENTIK_EMAIL__USERNAME=apikey
 AUTHENTIK_EMAIL__PASSWORD={{ authentik_sendgrid_api_key }}
 AUTHENTIK_EMAIL__USE_TLS=true
 AUTHENTIK_EMAIL__TIMEOUT=10
 AUTHENTIK_EMAIL__FROM=auth@cazzzer.com
 AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL=false
 AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME=false
--- a/roles/alpina/templates/services/authentik/.env.db.j2
+++ b/roles/alpina/templates/services/authentik/.env.db.j2
@@ -1,3 +0,0 @@
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik
 POSTGRES_PASSWORD={{ authentik_db_password }}
--- a/roles/alpina/templates/services/authentik/blueprints/alpina-enrollment-internal.yaml.j2
+++ b/roles/alpina/templates/services/authentik/blueprints/alpina-enrollment-internal.yaml.j2
@@ -1,225 +0,0 @@
 version: 1
 metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "true"
  name: Alpina - Enrollment by Invitation (Internal)
 entries:
  # Flow for internal enrollment by invitation
  - identifiers:
      slug: enrollment-internal-invitation-flow
    model: authentik_flows.flow
    id: flow
    attrs:
      name: Alpina Enrollment Flow
      title: Sign Up
      designation: enrollment
      authentication: require_unauthenticated
  # Prompt fields
  - identifiers:
      name: alpina-enrollment-field-name
    model: authentik_stages_prompt.prompt
    id: prompt-field-name
    attrs:
      field_key: name
      label: Name
      type: text
      required: true
      placeholder: Name
      placeholder_expression: false
      order: 0
  - identifiers:
      name: alpina-enrollment-field-password
    model: authentik_stages_prompt.prompt
    id: prompt-field-password
    attrs:
      field_key: password
      label: Password
      type: password
      required: true
      placeholder: Password
      placeholder_expression: false
      order: 1
  - identifiers:
      name: alpina-enrollment-field-password-repeat
    model: authentik_stages_prompt.prompt
    id: prompt-field-password-repeat
    attrs:
      field_key: password_repeat
      label: Password (repeat)
      type: password
      required: true
      placeholder: Password (repeat)
      placeholder_expression: false
      order: 2
  # Flow stages
  - identifiers:
      name: alpina-enrollment-invitation
    model: authentik_stages_invitation.invitationstage
    id: enrollment-invitation
  - identifiers:
      name: alpina-enrollment-identification-oauth
    model: authentik_stages_identification.identificationstage
    id: enrollment-identification-oauth
    attrs:
      user_fields:
        - email
      pretend_user_exists: true
      show_matched_user: false
      sources:
        - !Find [authentik_sources_oauth.oauthsource, [slug, github-enrollment]]
        - !Find [authentik_sources_oauth.oauthsource, [slug, google-enrollment]]
  - identifiers:
      name: alpina-enrollment-deny-existing-email
    model: authentik_stages_deny.denystage
    id: enrollment-deny-existing-email
    attrs:
      deny_message: "An account with this email already exists"
  - identifiers:
      name: alpina-enrollment-prompt-name-password
    model: authentik_stages_prompt.promptstage
    id: enrollment-prompt-name-password
    attrs:
      fields:
        - !KeyOf prompt-field-name
        - !KeyOf prompt-field-password
        - !KeyOf prompt-field-password-repeat
      validation_policies:
        - !Find [authentik_policies_password.passwordpolicy, [name, default-password-change-password-policy]]
  - identifiers:
      name: alpina-enrollment-user-write
    model: authentik_stages_user_write.userwritestage
    id: enrollment-user-write
    attrs:
      user_creation_mode: always_create
      user_type: internal
  - identifiers:
      name: alpina-enrollment-email-verify
    model: authentik_stages_email.emailstage
    id: enrollment-email-verify
    attrs:
      use_global_settings: true
      template: email/account_confirmation.html
      activate_user_on_success: true
  - identifiers:
      name: alpina-enrollment-user-login
    model: authentik_stages_user_login.userloginstage
    id: enrollment-user-login
  # Policies
  - identifiers:
      name: alpina-enrollment-invited-used-policy
    model: authentik_policies_event_matcher.eventmatcherpolicy
    id: enrollment-invited-used-policy
    attrs:
      action: invitation_used
  - identifiers:
      name: alpina-enrollment-unique-email-policy
    model: authentik_policies_expression.expressionpolicy
    id: enrollment-unique-email-policy
    attrs:
      expression: |
        # https://docs.goauthentik.io/docs/customize/policies/expression/unique_email
        from authentik.core.models import User
        email = request.context["flow_plan"].context["pending_user"].email
        if User.objects.filter(email=email).exists():
          ak_message("Email address in use")
          return False
        if request.context["flow_plan"].context.get("prompt_data") is None:
          request.context["flow_plan"].context["prompt_data"] = {}
        request.context["flow_plan"].context["prompt_data"]["email"] = email
        request.context["flow_plan"].context["prompt_data"]["username"] = email
        return True
  - identifiers:
      name: alpina-enrollment-user-write-add-groups-policy
    model: authentik_policies_expression.expressionpolicy
    id: enrollment-user-write-add-groups-policy
    attrs:
        expression: |
          # https://docs.goauthentik.io/docs/add-secure-apps/flows-stages/stages/user_write
          from authentik.core.models import Group
          ak_logger.info("Adding groups", request=request, prompt_data=request.context["prompt_data"], invitation=request.context.get("invitation"))
          requested_groups = request.context["prompt_data"].get("alpina_add_groups")
          if requested_groups is None:
            return True
          groups = []
          for group_name in requested_groups:
            group, _ = Group.objects.get_or_create(name=group_name)
            groups.append(group)
          # ["groups"] *must* be set to an array of Group objects, names alone are not enough.
          request.context["flow_plan"].context["groups"] = groups
          return True
  # Flow stage bindings
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-invitation
      order: 0
    model: authentik_flows.flowstagebinding
    id: enrollment-invitation-binding
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-identification-oauth
      order: 1
    model: authentik_flows.flowstagebinding
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-deny-existing-email
      order: 2
    model: authentik_flows.flowstagebinding
    id: enrollment-deny-existing-email-binding
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-prompt-name-password
      order: 10
    model: authentik_flows.flowstagebinding
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-user-write
      order: 20
    model: authentik_flows.flowstagebinding
    id: enrollment-user-write-binding
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-email-verify
      order: 30
    model: authentik_flows.flowstagebinding
  - identifiers:
      target: !KeyOf flow
      stage: !KeyOf enrollment-user-login
      order: 100
    model: authentik_flows.flowstagebinding
  # Stage policy bindings
  # Log used invitations
  - identifiers:
      target: !KeyOf enrollment-invitation-binding
      policy: !KeyOf enrollment-invited-used-policy
      order: 0
    model: authentik_policies.policybinding
    attrs:
      negate: true
  # Deny existing email addresses
  - identifiers:
      target: !KeyOf enrollment-deny-existing-email-binding
      policy: !KeyOf enrollment-unique-email-policy
      order: 0
    model: authentik_policies.policybinding
    attrs:
      negate: true
  # Add groups to user from invitation "alpina_add_groups" field
  # This only work for email sign up, as the invitation flow context isn't
  # preserved for the default-source-enrollment flow
  - identifiers:
      target: !KeyOf enrollment-user-write-binding
      policy: !KeyOf enrollment-user-write-add-groups-policy
      order: 0
    model: authentik_policies.policybinding
--- a/roles/alpina/templates/services/authentik/blueprints/alpina-groups.yaml.j2
+++ b/roles/alpina/templates/services/authentik/blueprints/alpina-groups.yaml.j2
@@ -1,40 +0,0 @@
 version: 1
 metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "true"
  name: Alpina - Default Groups
 entries:
  - identifiers:
      name: "admins"
    model: authentik_core.group
    id: "admins"
    attrs:
      is_superuser: true
  - identifiers:
      name: "users"
    model: authentik_core.group
    id: "users"
  - identifiers:
      name: "arrstack"
    model: authentik_core.group
    id: "arrstack"
    attrs:
      arrstack_username: "arr"
      arrstack_password: "{{ arrstack_password }}"
  - identifiers:
      scope_name: "minio"
    model: authentik_providers_oauth2.scopemapping
    id: "scope-minio"
    attrs:
      name: "Minio Policy"
      expression: |
        policy = "default"
        if ak_is_group_member(request.user, name="admins"):
            policy = "consoleAdmin"
        return {
          "policy": policy,
        }
--- a/roles/alpina/templates/services/authentik/blueprints/alpina-oauth-sources.yaml.j2
+++ b/roles/alpina/templates/services/authentik/blueprints/alpina-oauth-sources.yaml.j2
@@ -1,79 +0,0 @@
 version: 1
 metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "true"
  name: Alpina - External OAuth
 entries:
  {% set sources = {
    "GitHub": {
      "provider_type": "github",
      "consumer_key": github_consumer_key,
      "consumer_secret": github_consumer_secret,
    },
    "Google": {
      "provider_type": "google",
      "consumer_key": google_consumer_key,
      "consumer_secret": google_consumer_secret,
    },
  } -%}
  {% for source in sources.keys() -%}
  - identifiers:
      slug: {{ source | lower }}-auth
    model: authentik_sources_oauth.oauthsource
    attrs:
      provider_type: {{ sources[source]["provider_type"] }}
      name: {{ source }} (Auth Only)
      consumer_key: {{ sources[source]["consumer_key"] }}
      consumer_secret: {{ sources[source]["consumer_secret"] }}
      user_matching_mode: email_link
      user_path_template: goauthentik.io/sources/%(slug)s
      authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
  - identifiers:
      slug: {{ source | lower }}-enrollment
    model: authentik_sources_oauth.oauthsource
    attrs:
      provider_type: {{ sources[source]["provider_type"] }}
      name: {{ source }} (Auth and Enrollment)
      consumer_key: {{ sources[source]["consumer_key"] }}
      consumer_secret: {{ sources[source]["consumer_secret"] }}
      user_matching_mode: email_link
      user_path_template: goauthentik.io/sources/%(slug)s
      authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
      enrollment_flow: !Find [authentik_flows.flow, [slug, default-source-enrollment]]
  {% endfor %}
  # Modify default source enrollment to use email as username
  - identifiers:
      slug: default-source-enrollment
    model: authentik_flows.flow
    id: source-enrollment-flow
    attrs:
      policy_engine_mode: all
  - identifiers:
      name: alpina-email-as-username-policy
    model: authentik_policies_expression.expressionpolicy
    id: email-as-username-policy
    attrs:
      expression: |
        # https://docs.goauthentik.io/docs/users-sources/sources/social-logins/google/#username-mapping
        email = request.context["prompt_data"].get("email")
        # Direct set username to email
        request.context["prompt_data"]["username"] = email
        # Set username to email without domain
        # request.context["prompt_data"]["username"] = email.split("@")[0]
        return True
  - identifiers:
      policy: !KeyOf email-as-username-policy
      target: !KeyOf source-enrollment-flow
    model: authentik_policies.policybinding
    attrs:
      order: 0
  # Modify default source enrollment to create internal users
  # with the internal user type and the users group
  - identifiers:
      name: default-source-enrollment-write
    model: authentik_stages_user_write.userwritestage
    attrs:
      user_type: internal
      group: !Find [authentik_core.group, [name, users]]
--- a/roles/alpina/templates/services/authentik/blueprints/apps-oauth2.yaml.j2
+++ b/roles/alpina/templates/services/authentik/blueprints/apps-oauth2.yaml.j2
@@ -1,91 +0,0 @@
 version: 1
 metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "true"
  name: Alpina - OAuth2 Apps
 entries:
  {% set apps = {
    "Grafana": {
      "redirect_uri": "https://grafana."~ domain ~"/login/generic_oauth",
      "icon": "https://grafana."~ domain ~"/public/img/grafana_icon.svg",
      "client_secret": auth_grafana_client_secret,
      "ui_group": "Services",
      "allowed_for_groups": ["admins"],
    },
    "Minio": {
      "redirect_uri": "https://minio."~ domain ~"/oauth_callback",
      "icon": "https://minio."~ domain ~"/logo192.png",
      "client_secret": auth_minio_client_secret,
      "ui_group": "Services",
      "allowed_for_groups": ["admins"],
    },
    "Gitea": {
      "redirect_uri": "https://gitea."~ domain ~"/user/oauth2/Authentik/callback",
      "icon": "https://gitea."~ domain ~"/assets/img/logo.svg",
      "client_secret": auth_gitea_client_secret,
      "ui_group": "Apps",
      "allowed_for_groups": ["admins", "users"],
    },
    "Nextcloud": {
      "redirect_uri": "https://nc."~ domain ~"/apps/sociallogin/custom_oidc/authentik",
      "icon": "https://nc."~ domain ~"/apps/theming/favicon",
      "client_secret": auth_nextcloud_client_secret,
      "ui_group": "Apps",
      "allowed_for_groups": ["admins", "users"],
    },
    "VPGen": {
      "redirect_uri": "https://vpgen."~ domain ~"/auth/authentik/callback",
      "icon": "https://vpgen."~ domain ~"/favicon.png",
      "client_secret": auth_vpgen_client_secret,
      "ui_group": "Apps",
      "allowed_for_groups": ["admins", "users"],
    },
  } -%}
  {% for app in apps.keys() -%}
  - identifiers:
      name: {{ app }}
    model: authentik_providers_oauth2.oauth2provider
    id: {{ app }}
    attrs:
      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
      invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
      client_type: confidential
      client_id: {{ app | lower }}
      client_secret: {{ apps[app]["client_secret"] }}
      property_mappings:
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
        {% if app == "Minio" -%}
        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, minio]]
        {%- endif %}
      redirect_uris:
        - matching_mode: strict
          url: {{ apps[app]["redirect_uri"] }}
      # Necessary for JWKS to be generated correctly
      signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
  - identifiers:
      slug: {{ app | lower }}
    model: authentik_core.application
    id: app-{{ app }}
    attrs:
      name: {{ app }}
      group: "{{ apps[app]["ui_group"] }}"
      meta_description: "Hello, I'm {{ app }}!"
      meta_publisher: Alpina
      icon: "{{ apps[app]["icon"] }}"
      open_in_new_tab: true
      provider: !KeyOf {{ app }}
  {% for group in apps[app]["allowed_for_groups"] -%}
  - identifiers:
      group: !Find [authentik_core.group, [name, {{ group }}]]
      target: !KeyOf app-{{ app }}
    model: authentik_policies.policybinding
    attrs:
      order: 10
  {% endfor %}
  {% endfor %}
--- a/roles/alpina/templates/services/authentik/blueprints/apps-proxy.yaml.j2
+++ b/roles/alpina/templates/services/authentik/blueprints/apps-proxy.yaml.j2
@@ -1,88 +0,0 @@
 version: 1
 metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "true"
  name: Alpina - Proxied Apps
 entries:
  # TODO: Possibly refactor this into a jinja macro (?)
  {% set apps = {
    "Uptime Kuma": {
      "host": "uptime",
      "icon": "https://uptime."~ domain ~"/icon.svg",
      "unauthenticated_paths": "^/icon.svg$",
      "ui_group": "Services",
      "allowed_for_groups": ["admins"],
    },
    "qBit": {
      "host": "qbit",
      "icon": "https://qbit."~ domain ~"/images/qbittorrent-tray.svg",
      "unauthenticated_paths": "^/images/qbittorrent-tray.svg$",
      "ui_group": "Arrstack",
      "allowed_for_groups": ["arrstack"],
    },
    "Prowlarr": {
      "host": "prowlarr",
      "icon": "https://prowlarr."~ domain ~"/Content/Images/logo.svg",
      "unauthenticated_paths": "^/Content/Images/logo.svg$",
      "ui_group": "Arrstack",
      "allowed_for_groups": ["arrstack"],
    },
    "Sonarr": {
      "host": "sonarr",
      "icon": "https://sonarr."~ domain ~"/Content/Images/logo.svg",
      "unauthenticated_paths": "^/Content/Images/logo.svg$",
      "ui_group": "Arrstack",
      "allowed_for_groups": ["arrstack"],
    },
    "Radarr": {
      "host": "radarr",
      "icon": "https://radarr."~ domain ~"/Content/Images/logo.svg",
      "unauthenticated_paths": "^/Content/Images/logo.svg$",
      "ui_group": "Arrstack",
      "allowed_for_groups": ["arrstack"],
    },
  } -%}
  {% for app in apps.keys() -%}
  - identifiers:
      name: {{ app }}
    model: authentik_providers_proxy.proxyprovider
    id: {{ app }}
    attrs:
      authorization_flow: !Find [authentik_flows.flow, [ slug, default-provider-authorization-implicit-consent ] ]
      mode: forward_single
      external_host: "https://{{ apps[app]["host"] }}.{{ domain }}/"
      skip_path_regex: "{{ apps[app]["unauthenticated_paths"] }}"
  - identifiers:
      slug: {{ app | lower | replace(" ", "-") }}
    model: authentik_core.application
    id: app-{{ app }}
    attrs:
      name: {{ app }}
      group: {{ apps[app]["ui_group"] }}
      meta_description: "Hello, I'm {{ app }}!"
      meta_publisher: Alpina
      icon: "{{ apps[app]["icon"] }}"
      open_in_new_tab: true
      provider: !KeyOf {{ app }}
  {% for group in apps[app]["allowed_for_groups"] -%}
  - identifiers:
      group: !Find [authentik_core.group, [name, {{ group }}]]
      target: !KeyOf app-{{ app }}
    model: authentik_policies.policybinding
    attrs:
      order: 10
  {% endfor %}
  {% endfor %}
  - identifiers:
      managed: goauthentik.io/outposts/embedded
      name: authentik Embedded Outpost
    model: authentik_outposts.outpost
    attrs:
      providers:
      {% for app in apps.keys() -%}
        - !KeyOf {{ app }}
      {% endfor %}
--- a/roles/alpina/templates/services/authentik/blueprints/default-authentication.yaml.j2
+++ b/roles/alpina/templates/services/authentik/blueprints/default-authentication.yaml.j2
@@ -1,59 +0,0 @@
 version: 1
 metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "true"
  name: Alpina - Default Authentication Modifications
 entries:
    # Add a new flow for passwordless WebAuthn authentication
  - identifiers:
      slug: authentication-passwordless-flow
    model: authentik_flows.flow
    attrs:
      designation: authentication
      name: WebAuthn Authentication Flow
      title: Sign in with a passkey
    # Add a new stage to the flow to validate just WebAuthn devices
  - identifiers:
      name: webauthn-validation
    model: authentik_stages_authenticator_validate.authenticatorvalidatestage
    attrs:
      device_classes:
        - webauthn
      not_configured_action: deny
      webauthn_user_verification: required
    # Stage bindings for passwordless flow,
    # 1. Validate WebAuthn key
  - identifiers:
      order: 10
      stage: !Find [authentik_stages_authenticator_validate.authenticatorvalidatestage, [name, webauthn-validation]]
      target: !Find [authentik_flows.flow, [slug, authentication-passwordless-flow]]
    model: authentik_flows.flowstagebinding
    # 2. Finish authenticating user
  - identifiers:
      order: 100
      stage: !Find [authentik_stages_user_login.userloginstage, [name, default-authentication-login]]
      target: !Find [authentik_flows.flow, [slug, authentication-passwordless-flow]]
    model: authentik_flows.flowstagebinding
    # Some modifications to the default identification stage
  - identifiers:
      name: default-authentication-identification
    model: authentik_stages_identification.identificationstage
    attrs:
      # Allow username and password fields to be on the same page
      password_stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
      # Add a button to use the passwordless WebAuthn flow
      passwordless_flow: !Find [authentik_flows.flow, [slug, authentication-passwordless-flow]]
      sources:
        - !Find [authentik_core.source, [slug, authentik-built-in]]
        - !Find [authentik_sources_oauth.oauthsource, [slug, github-auth]]
        - !Find [authentik_sources_oauth.oauthsource, [slug, google-auth]]
    # Enable compatibility mode for the default authentication flow for better autofill support
  - identifiers:
      slug: default-authentication-flow
    model: authentik_flows.flow
    attrs:
      compatibility_mode: true
--- a/roles/alpina/templates/services/authentik/docker-compose.yml.j2
+++ b/roles/alpina/templates/services/authentik/docker-compose.yml.j2
@@ -1,66 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(253) | indent(2) }}
  traefik_traefik:
    external: true
 services:
  server:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik_server
    labels:
      - {{ helpers.traefik_labels('auth', port='9000') | indent(6) }}
      - traefik.http.middlewares.authentik.forwardauth.address=http://localhost:9000/outpost.goauthentik.io/auth/traefik
      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=Authorization,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
    restart: unless-stopped
    # Port forward is needed because traefik can't resolve the container name from the host network
    ports:
      - "9000:9000"
    command: server
    env_file:
      - .env.authentik
    networks:
      - default
      - traefik_traefik
  worker:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik_worker
    restart: unless-stopped
    command: worker
    env_file:
      - .env.authentik
    volumes:
      - ./blueprints:/blueprints/alpina
      - {{ base_volume_path }}/authentik/certs:/certs
  postgres:
    image: postgres:16-alpine
    container_name: authentik_postgres
    restart: unless-stopped
    env_file:
      - .env.db
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - {{ base_volume_path }}/authentik/postgres:/var/lib/postgresql/data
  redis:
    image: redis:alpine
    container_name: authentik_redis
    restart: unless-stopped
    command: --save 60 1 --loglevel warning
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - {{ base_volume_path }}/authentik/redis:/data
--- a/roles/alpina/templates/services/minio/.env.minio.j2
+++ b/roles/alpina/templates/services/minio/.env.minio.j2
@@ -1,20 +0,0 @@
 MINIO_ROOT_USER=minio
 MINIO_ROOT_PASSWORD={{ minio_password }}
 MINIO_DOMAIN=s3.{{ domain }}
 MINIO_SERVER_URL=https://s3.{{ domain }}
 MINIO_BROWSER_REDIRECT_URL=https://minio.{{ domain }}
 # https://min.io/docs/minio/linux/reference/minio-server/settings/iam/openid.html
 MINIO_IDENTITY_OPENID_CONFIG_URL=https://auth.{{ domain }}/application/o/minio/.well-known/openid-configuration
 MINIO_IDENTITY_OPENID_CLIENT_ID=minio
 MINIO_IDENTITY_OPENID_CLIENT_SECRET={{ auth_minio_client_secret }}
 # defaults to "policy"
 #MINIO_IDENTITY_OPENID_CLAIM_NAME=policy
 MINIO_IDENTITY_OPENID_DISPLAY_NAME=Authentik
 # no need to specify scopes,
 # as it defaults to the ones advertised at the discovery url
 #MINIO_IDENTITY_OPENID_SCOPES=openid,profile,email,minio
 #MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC=off
 #MINIO_IDENTITY_OPENID_CLAIM_USERINFO=on
 #MINIO_IDENTITY_OPENID_COMMENT=
--- a/roles/alpina/templates/services/minio/docker-compose.yml.j2
+++ b/roles/alpina/templates/services/minio/docker-compose.yml.j2
@@ -1,32 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(252) | indent(2) }}
  traefik_traefik:
    external: true
 services:
  minio:
    image: minio/minio:latest
    container_name: minio
    labels:
      - {{ helpers.traefik_labels('minio', port='9090') | indent(6) }}
      - traefik.http.routers.minio.service=minio
      - traefik.http.routers.minio-tls.service=minio
      - traefik.http.routers.minio-s3.rule=Host(`s3.{{ domain }}`) || HostRegexp(`^.+[.]s3[.]{{ domain }}`)
      - traefik.http.routers.minio-s3.entrypoints=websecure
      - traefik.http.routers.minio-s3.tls=true
      - traefik.http.routers.minio-s3.tls.certresolver=letsencrypt
      - traefik.http.routers.minio-s3.tls.domains.0.main=s3.{{ domain }}
      - traefik.http.routers.minio-s3.tls.domains.0.sans=*.s3.{{ domain }}
      - traefik.http.routers.minio-s3.service=minio-s3
      - traefik.http.services.minio-s3.loadbalancer.server.port=9000
    restart: unless-stopped
    command: server --console-address ":9090" /data
    env_file:
      - .env.minio
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/minio/data:/data
--- a/roles/alpina/templates/services/monitoring/.env.influxdb.j2
+++ b/roles/alpina/templates/services/monitoring/.env.influxdb.j2
@@ -1,7 +0,0 @@
 DOCKER_INFLUXDB_INIT_MODE=setup
 DOCKER_INFLUXDB_INIT_ORG=home
 DOCKER_INFLUXDB_INIT_BUCKET=influx
 DOCKER_INFLUXDB_INIT_USERNAME=CaZzzer
 DOCKER_INFLUXDB_INIT_PASSWORD={{ influxdb_admin_password }}
 DOCKER_INFLUXDB_INIT_ADMIN_TOKEN={{ influxdb_admin_token }}
 DOCKER_INFLUXDB_INIT_RETENTION=1w
--- a/roles/alpina/templates/services/monitoring/Dockerfile
+++ b/roles/alpina/templates/services/monitoring/Dockerfile
@@ -1,17 +0,0 @@
 FROM python:3-alpine AS builder
 RUN pip install grafanalib
 COPY ./grafana_config/dashboards /dashboards
 # Required for grafanalib to find the shared python files like common.py
 # https://github.com/weaveworks/grafanalib/issues/58
 ENV PYTHONPATH=/dashboards
 RUN generate-dashboards /dashboards/*.dashboard.py
 FROM grafana/grafana:latest
 #COPY ./grafana_config /etc/grafana
 COPY ./grafana_config/dashboards/*.yaml /etc/grafana/provisioning/dashboards
 COPY --from=builder /dashboards/*.json /etc/grafana/provisioning/dashboards
--- a/roles/alpina/templates/services/monitoring/docker-compose.yml.j2
+++ b/roles/alpina/templates/services/monitoring/docker-compose.yml.j2
@@ -1,119 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  {{ helpers.default_network(251) | indent(2) }}
  traefik_traefik:
    external: true
 services:
  grafana:
 {#    image: grafana/grafana:latest#}
    build:
      context: .
      dockerfile: Dockerfile
    container_name: grafana
    labels:
      - {{ helpers.traefik_labels('grafana', port='3000') | indent(6) }}
    restart: unless-stopped
    # Needed to make config files readable (not anymore, TODO: remove)
    user: "{{ remote_uid }}"
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/monitoring/grafana:/var/lib/grafana
      - ./grafana_config/grafana.ini:/etc/grafana/grafana.ini:ro
      - ./grafana_config/datasources:/etc/grafana/provisioning/datasources:ro
 {#      - ./grafana_config:/etc/grafana:ro#}
  loki:
    image: grafana/loki:latest
    container_name: loki
    restart: unless-stopped
    # Needed to make config files readable (not anymore, TODO: remove)
    user: "{{ remote_uid }}"
    command:
      - -config.file=/etc/loki/loki-config.yaml
    # Port forward is needed because not possible to resolve the container name from the host network
    ports:
      - 3100:3100
    volumes:
      - {{ base_volume_path }}/monitoring/loki:/loki
      - ./loki_config:/etc/loki:ro
    tmpfs:
      - /tmp/loki
  promtail:
    image: grafana/promtail:latest
    container_name: promtail
    restart: unless-stopped
    command:
      - -config.file=/etc/promtail/promtail-config.yaml
    ports:
      - 514:514
    volumes:
        - ./promtail_config:/etc/promtail:ro
        - /var/log:/var/log:ro
    tmpfs:
      - /tmp
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    # Needed to make config files readable (not anymore, TODO: remove)
    user: "{{ remote_uid }}"
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.retention.time=30d
    volumes:
      - ./prometheus_config:/etc/prometheus:ro
      - {{ base_volume_path }}/monitoring/prometheus_configs:/etc/prometheus/extra:ro
      - {{ base_volume_path }}/monitoring/prometheus:/prometheus
  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    network_mode: host
    pid: host
    volumes:
      - /:/host:ro,rslave
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    restart: unless-stopped
    command:
      - --docker_only=true
      - --store_container_labels=false
      - --whitelisted_container_labels=com.docker.compose.project,com.docker.compose.service
      - --enable_metrics=cpu,cpuLoad,diskIO,memory,network,oom_event,process
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
  influxdb:
    image: influxdb:2.7-alpine
    container_name: influxdb
    labels:
      - {{ helpers.traefik_labels('influxdb', port='8086') | indent(6) }}
    restart: unless-stopped
    env_file:
      - .env.influxdb
    networks:
      - default
      - traefik_traefik
    volumes:
      - {{ base_volume_path }}/monitoring/influxdb:/var/lib/influxdb2
  uptime-kuma:
    image: louislam/uptime-kuma:1
    container_name: uptime-kuma
    labels:
      - {{ helpers.traefik_labels('uptime', port='3001', auth=true) | indent(6) }}
    restart: unless-stopped
    volumes:
      - {{ base_volume_path }}/monitoring/uptime-kuma:/app/data
--- a/roles/alpina/templates/services/monitoring/grafana_config/dashboards/alpina.yaml
+++ b/roles/alpina/templates/services/monitoring/grafana_config/dashboards/alpina.yaml
@@ -1,9 +0,0 @@
 apiVersion: 1
 providers:
  - name: "Grafana"
    org_id: 1
    folder: "Alpina"
    type: "file"
    options:
      path: "/etc/grafana/provisioning/dashboards"
--- a/roles/alpina/templates/services/monitoring/grafana_config/dashboards/common.py
+++ b/roles/alpina/templates/services/monitoring/grafana_config/dashboards/common.py
@@ -1,27 +0,0 @@
 from grafanalib.core import Template
 # TODO: consider default params for common params like line width, show points, tooltip
 PrometheusTemplate = Template(
    name='datasource',
    type='datasource',
    label='Prometheus',
    query='prometheus',
 )
 # TODO: this slightly less (clown emoji), normal Target gave me errors in grafana
 class LokiTarget(object):
    def __init__(self, loki_datasource, expr, legendFormat, refId):
        self.loki_datasource = loki_datasource
        self.expr = expr
        self.legendFormat = legendFormat
        self.refId = refId
    def to_json_data(self):
        return {
            'datasource': self.loki_datasource,
            'expr': self.expr,
            'legendFormat': self.legendFormat,
            'refId': self.refId,
            'queryType': 'range',
        }
--- a/roles/alpina/templates/services/monitoring/grafana_config/dashboards/containers.dashboard.py
+++ b/roles/alpina/templates/services/monitoring/grafana_config/dashboards/containers.dashboard.py
@@ -1,129 +0,0 @@
 from grafanalib.core import (
    Dashboard, TimeSeries,
    Target, GridPos,
    Templating, Template, REFRESH_ON_TIME_RANGE_CHANGE, Logs
 )
 from grafanalib.formatunits import BYTES_IEC, SECONDS, BYTES_SEC_IEC
 from common import LokiTarget, PrometheusTemplate
 prom_datasource='${datasource}'
 loki_datasource='loki'
 dashboard = Dashboard(
    title='Containers',
    uid='containers',
    description='Data for compose projects from default Prometheus datasource collected by Cadvisor',
    tags=[
        'linux',
        'docker',
    ],
    templating=Templating(list=[
        PrometheusTemplate,
        Template(
            name='compose_project',
            label='Compose Project',
            dataSource=prom_datasource,
            query='label_values({__name__=~"container.*"}, container_label_com_docker_compose_project)',
            includeAll=True,
            multi=True,
            refresh=REFRESH_ON_TIME_RANGE_CHANGE,
        ),
        Template(
            name='container_name',
            label='Container',
            dataSource=prom_datasource,
            query='label_values({__name__=~"container.*", container_label_com_docker_compose_project=~"$compose_project"}, name)',
            includeAll=True,
            multi=True,
            refresh=REFRESH_ON_TIME_RANGE_CHANGE,
        ),
        Template(
            name='logs_query',
            label='Log Search',
            query='',
            type='textbox',
        ),
    ]),
    timezone='browser',
    panels=[
        TimeSeries(
            title='Container Memory Usage',
            unit=BYTES_IEC,
            gridPos=GridPos(h=8, w=12, x=0, y=0),
            lineWidth=2,
            fillOpacity=10,
            showPoints='never',
            stacking={'mode': 'normal'},
            tooltipMode='all',
            tooltipSort='desc',
            targets=[
                Target(
                    datasource=prom_datasource,
                    expr='max by (name) (container_memory_usage_bytes{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"})',
                    legendFormat='{{ name }}',
                    refId='A',
                ),
            ],
        ),
        TimeSeries(
            title='Container CPU Usage',
            unit=SECONDS,
            gridPos=GridPos(h=8, w=12, x=12, y=0),
            lineWidth=2,
            fillOpacity=10,
            showPoints='never',
            tooltipMode='all',
            tooltipSort='desc',
            targets=[
                Target(
                    datasource=prom_datasource,
                    expr='max by (name) (rate(container_cpu_usage_seconds_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
                    legendFormat='{{ name }}',
                    refId='A',
                ),
            ],
        ),
        TimeSeries(
            title='Container Network Traffic',
            unit=BYTES_SEC_IEC,
            gridPos=GridPos(h=8, w=12, x=0, y=8),
            lineWidth=2,
            fillOpacity=10,
            showPoints='never',
            tooltipMode='all',
            tooltipSort='desc',
            targets=[
                Target(
                    datasource=prom_datasource,
                    expr='max by (name) (rate(container_network_receive_bytes_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
                    legendFormat="rx {{ name }}",
                    refId='A',
                ),
                Target(
                    datasource=prom_datasource,
                    expr='-max by (name) (rate(container_network_transmit_bytes_total{name=~"$container_name", container_label_com_docker_compose_project=~"$compose_project"}[$__rate_interval]))',
                    legendFormat="tx {{ name }}",
                    refId='B',
                ),
            ],
        ),
        Logs(
            title='',
            gridPos=GridPos(h=8, w=12, x=12, y=8),
            showLabels=True,
            showCommonLabels=True,
            wrapLogMessages=True,
            prettifyLogMessage=True,
            dedupStrategy='numbers',
            targets=[
                LokiTarget(
                    loki_datasource=loki_datasource,
                    expr='{compose_project=~"$compose_project", container_name=~"$container_name"} |= `$logs_query`',
                    legendFormat='{{ container_name }}',
                    refId='A',
                ),
            ],
        ),
    ],
 ).auto_panel_ids()
--- a/roles/alpina/templates/services/monitoring/grafana_config/dashboards/node.dashboard.py
+++ b/roles/alpina/templates/services/monitoring/grafana_config/dashboards/node.dashboard.py
@@ -1,139 +0,0 @@
 from grafanalib.core import Dashboard, Templating, Template, TimeSeries, PERCENT_UNIT_FORMAT, GridPos, Target
 from grafanalib.formatunits import BYTES_IEC
 from common import PrometheusTemplate
 from node_consts import CPU_BASIC_COLORS, MEMORY_BASIC_COLORS
 dashboard = Dashboard(
    title='Node Exporter',
    uid='node',
    description='Node Exporter (not quite full)',
    tags=[
        'linux',
    ],
    timezone='browser',
    templating=Templating(list=[
        # Datasource
        PrometheusTemplate,
        # Job
        Template(
            name='job',
            label='Job',
            dataSource='${datasource}',
            query='label_values(node_uname_info, job)',
        ),
        # Instance
        Template(
            name='instance',
            label='Instance',
            dataSource='${datasource}',
            query='label_values(node_uname_info{job="$job"}, instance)',
        ),
    ]),
    panels=[
        # CPU Basic
        TimeSeries(
            title='CPU Basic',
            description='Basic CPU usage info',
            unit=PERCENT_UNIT_FORMAT,
            gridPos=GridPos(h=8, w=12, x=0, y=0),
            lineWidth=1,
            fillOpacity=30,
            showPoints='never',
            stacking={'mode': 'percent', 'group': 'A'},
            tooltipMode='all',
            tooltipSort='desc',
            targets=[
                Target(
                    datasource='${datasource}',
                    expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="system"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                    legendFormat='Busy System',
                    refId='A',
                ),
                Target(
                    datasource='${datasource}',
                    expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="user"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                    legendFormat='Busy User',
                    refId='B',
                ),
                Target(
                    datasource='${datasource}',
                    expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="iowait"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                    legendFormat='Busy Iowait',
                    refId='C',
                ),
                Target(
                    datasource='${datasource}',
                    expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode=~".*irq"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                    legendFormat='Busy IRQs',
                    refId='D',
                ),
                Target(
                    datasource='${datasource}',
                    expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job",  mode!="idle",mode!="user",mode!="system",mode!="iowait",mode!="irq",mode!="softirq"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                    legendFormat='Busy Other',
                    refId='E',
                ),
                Target(
                    datasource='${datasource}',
                    expr='sum(irate(node_cpu_seconds_total{instance="$instance",job="$job", mode="idle"}[$__rate_interval])) / scalar(count(count(node_cpu_seconds_total{instance="$instance",job="$job"}) by (cpu)))',
                    legendFormat='Idle',
                    refId='F',
                ),
            ],
            # Extra JSON for the colors
            extraJson=CPU_BASIC_COLORS,
        ),
        # Memory Basic
        TimeSeries(
            title='Memory Basic',
            description='Basic memory usage',
            unit=BYTES_IEC,
            gridPos=GridPos(h=8, w=12, x=12, y=0),
            lineWidth=1,
            fillOpacity=30,
            showPoints='never',
            stacking={'mode': 'normal', 'group': 'A'},
            tooltipMode='all',
            tooltipSort='desc',
            targets=[
                Target(
                    datasource='${datasource}',
                    expr='node_memory_MemTotal_bytes{instance="$instance",job="$job"}',
                    format='time_series',
                    legendFormat='RAM Total',
                    refId='A',
                ),
                Target(
                    datasource='${datasource}',
                    expr='node_memory_MemTotal_bytes{instance="$instance",job="$job"} - node_memory_MemFree_bytes{instance="$instance",job="$job"} - (node_memory_Cached_bytes{instance="$instance",job="$job"} + node_memory_Buffers_bytes{instance="$instance",job="$job"} + node_memory_SReclaimable_bytes{instance="$instance",job="$job"})',
                    format='time_series',
                    legendFormat='RAM Used',
                    refId='B',
                ),
                Target(
                    datasource='${datasource}',
                    expr='node_memory_Cached_bytes{instance="$instance",job="$job"} + node_memory_Buffers_bytes{instance="$instance",job="$job"} + node_memory_SReclaimable_bytes{instance="$instance",job="$job"}',
                    legendFormat='RAM Cache + Buffer',
                    refId='C',
                ),
                Target(
                    datasource='${datasource}',
                    expr='node_memory_MemFree_bytes{instance="$instance",job="$job"}',
                    legendFormat='RAM Free',
                    refId='D',
                ),
                Target(
                    datasource='${datasource}',
                    expr='(node_memory_SwapTotal_bytes{instance="$instance",job="$job"} - node_memory_SwapFree_bytes{instance="$instance",job="$job"})',
                    legendFormat='SWAP Used',
                    refId='E',
                ),
            ],
            # Extra JSON for the colors
            extraJson=MEMORY_BASIC_COLORS,
        ),
        # TODO: Network Basic
        # TODO: Disk Basic
    ],
 ).auto_panel_ids()
--- a/roles/alpina/templates/services/monitoring/grafana_config/dashboards/node_consts.py
+++ b/roles/alpina/templates/services/monitoring/grafana_config/dashboards/node_consts.py
@@ -1,487 +0,0 @@
 # TODO: Question life decisions (I'm not sure if this is good)
 CPU_BASIC_COLORS = {
    "fieldConfig": {
        "overrides": [
            {
                "matcher": {
                    "id": "byName",
                    "options": "Busy Iowait"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#890F02",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Idle"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#052B51",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Busy Iowait"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#890F02",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Idle"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#7EB26D",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Busy System"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#EAB839",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Busy User"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#0A437C",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Busy Other"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#6D1F62",
                            "mode": "fixed"
                        }
                    }
                ]
            }
        ]
    },
 }
 MEMORY_BASIC_COLORS = {
    "fieldConfig": {
        "overrides": [
            {
                "matcher": {
                    "id": "byName",
                    "options": "Apps"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#629E51",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Buffers"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#614D93",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Cache"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#6D1F62",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Cached"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#511749",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Committed"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#508642",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Free"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#0A437C",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Hardware Corrupted - Amount of RAM that the kernel identified as corrupted / not working"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#CFFAFF",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Inactive"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#584477",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "PageTables"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#0A50A1",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Page_Tables"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#0A50A1",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "RAM_Free"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#E0F9D7",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "SWAP Used"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#BF1B00",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Slab"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#806EB7",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Slab_Cache"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#E0752D",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Swap"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#BF1B00",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Swap Used"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#BF1B00",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Swap_Cache"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#C15C17",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Swap_Free"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#2F575E",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Unused"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#EAB839",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "RAM Total"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#E0F9D7",
                            "mode": "fixed"
                        }
                    },
                    {
                        "id": "custom.fillOpacity",
                        "value": 0
                    },
                    {
                        "id": "custom.stacking",
                        "value": {
                            "group": False,
                            "mode": "normal"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "RAM Cache + Buffer"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#052B51",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "RAM Free"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#7EB26D",
                            "mode": "fixed"
                        }
                    }
                ]
            },
            {
                "matcher": {
                    "id": "byName",
                    "options": "Available"
                },
                "properties": [
                    {
                        "id": "color",
                        "value": {
                            "fixedColor": "#DEDAF7",
                            "mode": "fixed"
                        }
                    },
                    {
                        "id": "custom.fillOpacity",
                        "value": 0
                    },
                    {
                        "id": "custom.stacking",
                        "value": {
                            "group": False,
                            "mode": "normal"
                        }
                    }
                ]
            }
        ]
    }
 }
--- a/roles/alpina/templates/services/monitoring/grafana_config/datasources/alpina.yaml.j2
+++ b/roles/alpina/templates/services/monitoring/grafana_config/datasources/alpina.yaml.j2
@@ -1,29 +0,0 @@
 apiVersion: 1
 datasources:
  - name: Loki
    type: loki
    access: proxy
    uid: loki
    url: http://loki:3100
    editable: false
  - name: Prometheus
    type: prometheus
    access: proxy
    uid: prometheus
    url: http://prometheus:9090
    editable: false
  - name: InfluxDB
    type: influxdb
    access: proxy
    uid: influxdb
    url: http://influxdb:8086
    jsonData:
      version: Flux
      organization: home
      defaultBucket: influx
    secureJsonData:
      token: {{ influxdb_admin_token }}
    editable: false
--- a/roles/alpina/templates/services/monitoring/grafana_config/grafana.ini.j2
+++ b/roles/alpina/templates/services/monitoring/grafana_config/grafana.ini.j2
@@ -1,34 +0,0 @@
 [server]
 domain = grafana.{{ domain }}
 root_url = https://%(domain)s/
 ;[security]
 ;admin_user =
 ;admin_email =
 ;admin_password =
 ; https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/generic-oauth/
 [auth]
 disable_login_form = true
 signout_redirect_url = https://auth.{{ domain }}/application/o/grafana/end-session/
 [auth.generic_oauth]
 name = Authentik
 enabled = true
 allow_sign_up = true
 client_id = grafana
 client_secret = {{ auth_grafana_client_secret }}
 scopes = openid profile email
 auth_url = https://auth.{{ domain }}/application/o/authorize/
 token_url = https://auth.{{ domain }}/application/o/token/
 api_url = https://auth.{{ domain }}/application/o/userinfo/
 email_attribute_path = email
 login_attribute_path = preferred_username
 name_attribute_path = name
 # Optionally map user groups to Grafana roles
 allow_assign_grafana_admin = true
 role_attribute_path = contains(groups[*], 'admins') && 'GrafanaAdmin' || 'Viewer'
--- a/roles/alpina/templates/services/monitoring/loki_config/loki-config.yaml.j2
+++ b/roles/alpina/templates/services/monitoring/loki_config/loki-config.yaml.j2
@@ -1,30 +0,0 @@
 auth_enabled: false
 server:
  http_listen_port: 3100
 common:
  path_prefix: /loki
  # TODO: Consider setting up S3 for storage
  storage:
    filesystem:
      chunks_directory: /loki/chunks
      rules_directory: /loki/rules
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory
 schema_config:
  configs:
    - from: 2024-10-18
      index:
        period: 24h
        prefix: index_
      object_store: filesystem
      schema: v13
      store: tsdb
 # TODO: Figure this out
 # ruler:
 #   alertmanager_url: http://localhost:9093
--- a/roles/alpina/templates/services/monitoring/prometheus_config/prometheus.yml.j2
+++ b/roles/alpina/templates/services/monitoring/prometheus_config/prometheus.yml.j2
@@ -1,39 +0,0 @@
 global:
  scrape_interval: 15s
  evaluation_interval: 15s
  external_labels:
    monitor: "{{ ansible_host }}"
 scrape_configs:
  - job_name: "prometheus"
    static_configs:
      - targets: ["localhost:9090"]
  - job_name: "node"
    static_configs:
      - targets: ["{{ ansible_host }}:9100"]
  - job_name: "cadvisor"
    static_configs:
      - targets: ["cadvisor:8080"]
  - job_name: "traefik"
    static_configs:
      - targets: ["{{ ansible_host }}:8082"]
  - job_name: "loki"
    static_configs:
      - targets: ["loki:3100"]
  - job_name: "promtail"
    static_configs:
      - targets: ["promtail:9080"]
 rule_files:
  - "/etc/prometheus/extra/rules/*.yml"
  - "/etc/prometheus/extra/rules/*.json"
 scrape_config_files:
  - "/etc/prometheus/extra/scrape_configs/*.yml"
  - "/etc/prometheus/extra/scrape_configs/*.json"
--- a/roles/alpina/templates/services/monitoring/promtail_config/promtail-config.yaml
+++ b/roles/alpina/templates/services/monitoring/promtail_config/promtail-config.yaml
@@ -1,48 +0,0 @@
 server:
  http_listen_port: 9080
  grpc_listen_port: 0
 positions:
  filename: /tmp/positions.yaml
 clients:
  - url: http://loki:3100/loki/api/v1/push
 scrape_configs:
  # local machine logs
  - job_name: local
    static_configs:
    - targets:
        - localhost
      labels:
        job: varlogs
        __path__: /var/log/*log
  # syslog target
  - job_name: syslog
    syslog:
      listen_address: "0.0.0.0:514" # make sure you also expose this port on the container
      idle_timeout: 60s
      label_structured_data: yes
      labels:
        job: "syslog"
    relabel_configs:
      - source_labels: ['__syslog_message_hostname']
        target_label: 'host'
      - source_labels: ['__syslog_message_facility']
        target_label: 'facility'
      - source_labels: ['__syslog_message_severity']
        target_label: 'severity'
      - source_labels: ['__syslog_message_app_name']
        target_label: 'app_name'
 ## docker logs
 #- job_name: docker
 #  pipeline_stages:
 #    - docker: {}
 #  static_configs:
 #    - labels:
 #        job: docker
 #        __path__: /var/lib/docker/containers/*/*-json.log
--- a/roles/alpina/templates/services/traefik/.env.traefik.j2
+++ b/roles/alpina/templates/services/traefik/.env.traefik.j2
@@ -1 +0,0 @@
 CF_DNS_API_TOKEN={{ cloudflare_api_token }}
--- a/roles/alpina/templates/services/traefik/docker-compose.yml.j2
+++ b/roles/alpina/templates/services/traefik/docker-compose.yml.j2
@@ -1,35 +0,0 @@
 {% import 'contrib/compose_helpers.j2' as helpers with context %}
 networks:
  traefik:
    internal: true
    enable_ipv6: true
    ipam:
      config:
        # TODO: Consider removing traefik network, it shouldn't be needed with host networking
        - subnet: {{ traefik_subnet }}/24
        - subnet: {{ docker_ipv6_subnet | ansible.utils.ipsubnet(80, 255) }}
 services:
  traefik:
    image: traefik:v3.2
    container_name: traefik
    restart: unless-stopped
    env_file:
      - .env.traefik
    network_mode: host
    volumes:
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./rules:/rules:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - {{ base_volume_path }}/traefik/rules:/rules/extra:ro
      - {{ base_volume_path }}/traefik/acme:/acme
  # This is mostly just so that the traefik network gets created
  whoami:
    image: containous/whoami
    container_name: whoami
    labels:
      - {{ helpers.traefik_labels('whoami', port=80) | indent(6) }}
    networks:
      - traefik
--- a/roles/alpina/templates/services/traefik/rules/traefik-dash.yml.j2
+++ b/roles/alpina/templates/services/traefik/rules/traefik-dash.yml.j2
@@ -1,25 +0,0 @@
 http:
  routers:
    traefik-dash:
      rule: "Host(`traefik.{{ domain }}`)"
      entryPoints:
        - web
      service: traefik-dash
    traefik-dash-tls:
      rule: "Host(`traefik.{{ domain }}`)"
      entryPoints:
        - websecure
      service: traefik-dash
      tls:
        certResolver: letsencrypt
        domains:
          - main: "{{ domain }}"
            sans:
              - "*.{{ domain }}"
  services:
    traefik-dash:
      loadBalancer:
        servers:
          - url: "http://localhost:8080"
--- a/roles/alpina/templates/services/traefik/traefik.yml.j2
+++ b/roles/alpina/templates/services/traefik/traefik.yml.j2
@@ -1,42 +0,0 @@
 api:
  insecure: true
 log:
  level: INFO
 accessLog:
 entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    http3:
      advertisedPort: 443
  metrics:
    address: ":8082"
 metrics:
  prometheus:
    entryPoint: metrics
 certificatesResolvers:
  letsencrypt:
    acme:
      email: {{ acme_email }}
      storage: "/acme/acme.json"
      keyType: "EC384"
      dnsChallenge:
        provider: "cloudflare"
        delayBeforeCheck: 10
        resolvers:
          - 1.1.1.1
          - 8.8.8.8
          - 9.9.9.9
 providers:
  docker:
    exposedByDefault: false
    network: traefik_traefik
  file:
    directory: /rules
    watch: true
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -1,70 +1,44 @@
- name: Install Debian packages
+- name: Upgrade alpine packages
-  become: yes
+  community.general.apk:
-  ansible.builtin.apt:
+    upgrade: yes
    name:
     - docker-ce
     - docker-compose-plugin
     - firewalld
    state: latest
 - name: Upgrade Debian packages
  become: yes
  ansible.builtin.apt:
    upgrade: dist
    update_cache: yes
-    cache_valid_time: 3600
+  register: apk_upgrades
    autoremove: yes
    state: latest
  register: apt_upgrades
- name: Ensure firewalld is running
+- name: Install alpine packages
-  become: yes
+  community.general.apk:
    name:
      - qemu-guest-agent
      - dhcpcd
      - python3
      - fish
      - docker
      - docker-compose
      - docker-fish-completion
      - docker-compose-fish-completion
      - zfs
      - zfs-auto-snapshot
    state: latest
    update_cache: yes
  register: apk_installs
 - name: Enable qemu-guest-agent service
  service:
-    name: firewalld
+    name: qemu-guest-agent
-    state: started
+    runlevel: boot
    enabled: yes
- name: Allow SSH
+- name: Enable zfs-import service
-  become: yes
+  service:
-  firewalld:
+    name: zfs-import
-    service: ssh
+    runlevel: sysinit
-    permanent: yes
+    enabled: yes
    state: enabled
    immediate: yes
- name: Allow Web
+- name: Enable zfs-mount service
-  become: yes
+  service:
-  firewalld:
+    name: zfs-mount
-    service: http
+    runlevel: sysinit
-    permanent: yes
+    enabled: yes
    state: disabled
    immediate: yes
 - name: Allow Web Secure
  become: yes
  firewalld:
    service: https
    permanent: yes
    state: enabled
    immediate: yes
 - name: Allow 443 udp for http3
  become: yes
  firewalld:
    port: 443/udp
    permanent: yes
    state: enabled
    immediate: yes
 - name: Allow 514 tcp for syslog
  become: yes
  firewalld:
    port: 514/tcp
    permanent: yes
    state: enabled
    immediate: yes
 - name: Reboot if needed
-  become: yes
+  reboot:
-  ansible.builtin.reboot:
+  when: apk_upgrades.changed or apk_installs.changed
  when: apt_upgrades.changed
--- a/roles/common/templates/zfs-send-daily
+++ b/roles/common/templates/zfs-send-daily
@@ -0,0 +1,13 @@
 #!/bin/sh
 destination_connection=ssh root@truenas.lab.home
 destination_dataset=Mass-Storage-New/Backup
 # Wait for zfs-auto-snapshot
 sleep 1
 dataset="dock/volumes"
 latest_snap=$(zfs list -t snap -Hp -o name -S creation $dataset | head -1 | tr -d '\n')
 zfs send $latest_snap | $destination_connection zfs recv -o encry
--- a/roles/common/templates/zfsbackup/Dockerfile
+++ b/roles/common/templates/zfsbackup/Dockerfile
@@ -0,0 +1,7 @@
 FROM python:3.10-alpine
 RUN \
    apk add openssh && \
    pip install zfs-autobackup && \
    ln -s /run-backup.sh /etc/periodic/daily/
 COPY ["cron.sh", "run-backup.sh", "/"]
 CMD ["/cron.sh"]
--- a/roles/common/templates/zfsbackup/cron.sh
+++ b/roles/common/templates/zfsbackup/cron.sh
@@ -0,0 +1,4 @@
 #!/bin/sh
 set -eu
 exec busybox crond -f -l 0 -L /dev/stdout
--- a/roles/common/templates/zfsbackup/run-backup.sh
+++ b/roles/common/templates/zfsbackup/run-backup.sh
@@ -0,0 +1,29 @@
 #!/bin/sh
 set -eu
 echo "running backup job"
 date -Iminutes
 if [ ! -d ~/.ssh ]; then echo "error: $(realpath ~/.ssh) directory does not exist"; exit 1; fi
 host_ip=$(ip r | head -1 | cut -d' ' -f3 | tr -d '\n')
 host=root@"$host_ip"
 remote=root@truenas.lab.home
 if ! ssh -q "$host" exit; then echo "error: not able to ssh into host of container $host"; exit 1; fi
 if ! ssh -q "$remote" exit; then echo "error: not able to ssh into backup remote $remote"; exit 1; fi
 hostname=$(ssh "$host" hostname | tr -d '\n')
 remote_dataset=Mass-Storage-New/Backup/$hostname
 zfs_prop_name="nas" # autobackup:nas = true
 zfs-autobackup \
 --snapshot-format "{}_%Y-%m-%d_%H-%M_%S" \
 --encrypt \
 --ssh-source "$host" \
 --ssh-target "$remote" \
 "$zfs_prop_name" \
 "$remote_dataset"
 echo "ran backup job"
 date -Iminutes
--- a/roles/docker_host/tasks/main.yml
+++ b/roles/docker_host/tasks/main.yml
@@ -1,70 +1,5 @@
- name: Get IPv6 subnet for Docker
+- name: Create my service directory
  set_fact:
    docker_ipv6_subnet: "{{ \
      ansible_default_ipv6.address \
      | ansible.utils.ipsubnet(64) \
      | ansible.utils.ipsubnet(72, docker_ipv6_index) \
    }}"
 - debug:
    var: docker_ipv6_subnet
 - name: Configure Docker daemon
  become: yes
  template:
    src: "daemon.json.j2"
    dest: "/etc/docker/daemon.json"
    owner: root
    group: root
    mode: "0644"
  register: docker_daemon_config
 - name: Install Docker loki plugin for logs
  community.docker.docker_plugin:
    plugin_name: grafana/loki-docker-driver:latest
    alias: loki
    state: enable
 - name: Remove docker0 from firewalld trusted zone
  become: yes
  firewalld:
    zone: trusted
    interface: docker0
    permanent: yes
    immediate: yes
    state: disabled
  register: docker0_firewalld
 - name: Get list of running Docker containers
  docker_host_info:
    containers: yes
  register: docker_container_list
  when: clean_desired is true
 - name: Stop all running Docker containers
  docker_container:
    name: "{{ item }}"
    state: stopped
  loop: "{{ docker_container_list.containers | map(attribute='Id') | list }}"
  async: 300
  poll: 0
  when: clean_desired is true and docker_container_list.containers | length > 0
 - name: Prune all Docker containers and networks
  docker_prune:
    containers: yes
    networks: yes
  when: clean_desired is true
 - name: Clean alpina directory
  file:
-    path: "{{ alpina_svc_path }}"
+    state: directory
-    state: absent
+    path: "{{ my_svc_path }}"
-  when: clean_desired is true
+    mode: "700"
 - name: Restart Docker daemon
  become: yes
  service:
    name: docker
    state: restarted
  when: docker_daemon_config.changed or docker0_firewalld.changed
--- a/roles/docker_host/templates/daemon.json.j2
+++ b/roles/docker_host/templates/daemon.json.j2
@@ -1,10 +0,0 @@
 {
    "ipv6": true,
    "fixed-cidr-v6": "{{ docker_ipv6_subnet | ansible.utils.ipsubnet(80, 0) }}",
    "log-driver": "loki",
    "log-opts": {
        "loki-url": "http://localhost:3100/loki/api/v1/push",
        "loki-batch-size": "400",
        "loki-retries": "5"
    }
 }
--- a/roles/gitea/tasks/main.yml
+++ b/roles/gitea/tasks/main.yml
@@ -0,0 +1,33 @@
 # https://stackoverflow.com/questions/41667864/can-the-templates-module-handle-multiple-templates-directories
 - name: Ensure service directory exists
  file:
    path: "{{ current_svc_path }}"
    state: directory
    mode: "500"
 - name: Ensure directory structure exists
  file:
    path: "{{ current_svc_path }}/{{ item.path }}"
    state: directory
    mode: "500"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "directory"
 - name: Include app config variables
  include_vars:
    file: "{{ role_path }}/vars/app_config.yml"
 - name: Generate {{ current_svc_name }} deployment from templates
  template:
    src: "{{ item.src }}"
    dest: "{{ current_svc_path }}/{{ item.path | regex_replace('\\.j2$', '') }}"
    mode: "400"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "file"
 - name: Deploy docker-compose for {{ current_svc_name }}
  community.docker.docker_compose:
    project_src: "{{ current_svc_path }}"
    state: present
--- a/roles/gitea/templates/.env.db.j2
+++ b/roles/gitea/templates/.env.db.j2
@@ -0,0 +1,3 @@
 POSTGRES_USER=gitea
 POSTGRES_DB=gitea
 POSTGRES_PASSWORD="{{ db_password }}"
--- a/roles/gitea/templates/.env.gitea.j2
+++ b/roles/gitea/templates/.env.gitea.j2
@@ -0,0 +1,25 @@
 GITEA____APP_NAME=CazGitea
 # Database
 GITEA__database__DB_TYPE=postgres
 GITEA__database__HOST=db:5432
 GITEA__database__NAME="{{ db_user }}"
 GITEA__database__USER="{{ db_name }}"
 GITEA__database__PASSWD="{{ db_password }}"
 # Server
 GITEA__server__ROOT_URL=https://gitea.cazzzer.com/
 GITEA__server__DISABLE_SSH=true
 # Mail
 GITEA__mailer__ENABLED=true
 GITEA__mailer__HOST=smtp.sendgrid.net:587
 GITEA__mailer__FROM=gitea@cazzzer.com
 GITEA__mailer__USER=apikey
 GITEA__mailer__PASSWD="{{ sendgrid_api_key }}"
 # Security
 GITEA__security__SECRET_KEY="{{ secret_key }}"
 GITEA__security__INTERNAL_TOKEN="{{ internal_token }}"
 GITEA__oauth2__JWT_SECRET="{{ jwt_secret }}"
--- a/roles/alpina/templates/apps/gitea/docker-compose.yml.j2
+++ b/roles/alpina/templates/apps/gitea/docker-compose.yml.j2
@@ -1,16 +1,22 @@
-{% import 'contrib/compose_helpers.j2' as helpers with context %}
+version: "3.9"
 networks:
-  {{ helpers.default_network(199) | indent(2) }}
+  default:
  traefik_traefik:
    external: true
 volumes:
  gitea:
  postgres:
 services:
  server:
-    image: gitea/gitea:1.22
+    image: gitea/gitea:1.17.2
    container_name: gitea_server
    labels:
-      - {{ helpers.traefik_labels('gitea', port='3000') | indent(6) }}
+      - traefik.enable=true
      - traefik.http.routers.gitea.rule=Host(`gitea.{{ domain }}`)
      - traefik.http.services.gitea.loadbalancer.server.port=3000
    restart: unless-stopped
    env_file:
      - .env.gitea
@@ -18,11 +24,11 @@ services:
      - default
      - traefik_traefik
    volumes:
-      - {{ base_volume_path }}/gitea/gitea:/data
+      - gitea:/data
    depends_on:
      - db
  db:
-    image: postgres:16-alpine
+    image: postgres:14-alpine
    container_name: gitea_db
    restart: unless-stopped
    env_file:
@@ -30,4 +36,4 @@ services:
    networks:
      - default
    volumes:
-      - {{ base_volume_path }}/gitea/postgres:/var/lib/postgresql/data
+      - postgres:/var/lib/postgresql/data
--- a/roles/gitea/vars/app_config.yml
+++ b/roles/gitea/vars/app_config.yml
@@ -0,0 +1,27 @@
 $ANSIBLE_VAULT;1.2;AES256;alpina
 35303032386566343430633238343936366234333434343763666231666232633539303232383534
 3035346233346162373939333531613535353232626531640a646537616163353736653161326265
 31336530316335623335353661373834613264326436303933326135396166346562343136353931
 6439383039346465300a366266393130356630316630333336616565366562613038393239623738
 65626664643630353236333932373337333363626337386163613464306638633964663264363964
 30373661393531306662323134626664656233323762393037356434353066343830333033316365
 65616636613437663737306263373066306361376630616331663031346434336663393862316464
 62343339663461353934323063653566303932656264363562333136353665336263646230323832
 35376666303531383961646234663230663634393135326664386665633538616233613866373965
 64363361313232316336376631646662376565353536316438306361306261663532386564616566
 61663534393035343233326562303863646165346538393761326335376165623964396130393831
 64333665313461666335383134613831376138393061343238643661366439636534626265323865
 35393035336632653038623438626366373733626331633866373935616531623664303063376562
 31356332346164663364636235333461383437623161343338643839323765336237633266633864
 64363234646533616439313638363865373364623637636537623666383664656630333533303233
 64383734366666633832393230663739333435666138636462336332373061346239306136336263
 39643666303863303035313738343664636536663939616335303834333834363739303938646665
 66303637633239373461393434313036316563313132356432633337666537616363373830313034
 61313538633663653230643262613333306361666131663036643162343966313365653566393235
 36623832663034373734653664613038363137366437326565373761663963636336393536386435
 30393831326134376639366661653439616138643438646363343632346131306532663439396534
 32383661306539306635336262383563376561303862396532633362666266313562623336383235
 36366565633734633639653239306331333237353233326563653930653739316230666362323931
 39663931376562653530323434656436353166393836643238643632396430353034333034333665
 62323338373839383132323537353431636537616366393965643463316164323034316536383961
 6164333537633631646663333463306236613038326339643439
--- a/roles/gitea/vars/main.yml
+++ b/roles/gitea/vars/main.yml
@@ -0,0 +1,5 @@
 ---
 current_svc_name: gitea
 current_svc_path: "{{ my_svc_path }}/{{ current_svc_name }}"
 templates_source: "{{ role_path }}/templates"
--- a/roles/jellyfin/tasks/main.yml
+++ b/roles/jellyfin/tasks/main.yml
@@ -0,0 +1,33 @@
 # https://stackoverflow.com/questions/41667864/can-the-templates-module-handle-multiple-templates-directories
 - name: Ensure service directory exists
  file:
    path: "{{ current_svc_path }}"
    state: directory
    mode: "500"
 - name: Ensure directory structure exists
  file:
    path: "{{ current_svc_path }}/{{ item.path }}"
    state: directory
    mode: "500"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "directory"
 - name: Include app config variables
  include_vars:
    file: "{{ role_path }}/vars/app_config.yml"
 - name: Generate {{ current_svc_name }} deployment from templates
  template:
    src: "{{ item.src }}"
    dest: "{{ current_svc_path }}/{{ item.path | regex_replace('\\.j2$', '') }}"
    mode: "400"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "file"
 - name: Deploy docker-compose for {{ current_svc_name }}
  community.docker.docker_compose:
    project_src: "{{ current_svc_path }}"
    state: present
--- a/roles/jellyfin/templates/.env.jellyfin.j2
+++ b/roles/jellyfin/templates/.env.jellyfin.j2
@@ -0,0 +1 @@
 JELLYFIN_PublishedServerUrl="https://jellyfin.{{ domain }}"
--- a/roles/jellyfin/templates/docker-compose.yml.j2
+++ b/roles/jellyfin/templates/docker-compose.yml.j2
@@ -0,0 +1,35 @@
 version: "3.9"
 networks:
  default:
  traefik_traefik:
    external: true
 volumes:
  config:
  cache:
  media:
    driver: local
    driver_opts:
      type: nfs
      o: "addr=truenas.lab.home,nfsvers=4,ro,noatime"
      device: ":/mnt/Mass-Storage-New/JailStorage/Plex"
 services:
  jellyfin:
    image: jellyfin/jellyfin:10.8.5
    container_name: jellyfin_jellyfin
    labels:
      - traefik.enable=true
      - traefik.http.routers.jellyfin.rule=Host(`jellyfin.{{ domain }}`)
      - traefik.http.services.jellyfin.loadbalancer.server.port=8096
    restart: unless-stopped
    env_file:
      - .env.jellyfin
    networks:
      - default
      - traefik_traefik
    volumes:
      - config:/config
      - cache:/cache
      - media:/data/media
--- a/roles/jellyfin/vars/app_config.yml
+++ b/roles/jellyfin/vars/app_config.yml
@@ -0,0 +1,6 @@
 $ANSIBLE_VAULT;1.2;AES256;alpina
 61626665353536663033663661393434616339396434383530306265363837313839303939623465
 3634333839333530383464613966326238363738663637360a343837623832343232316565346131
 66663831356162653363383131396665326531363430656539333866313031306537343864343262
 3730643765633232620a643734623336646565663266656262343162613239306166386665333139
 6366
--- a/roles/jellyfin/vars/main.yml
+++ b/roles/jellyfin/vars/main.yml
@@ -0,0 +1,5 @@
 ---
 current_svc_name: jellyfin
 current_svc_path: "{{ my_svc_path }}/{{ current_svc_name }}"
 templates_source: "{{ role_path }}/templates"
--- a/roles/nextcloud/tasks/main.yml
+++ b/roles/nextcloud/tasks/main.yml
@@ -0,0 +1,33 @@
 # https://stackoverflow.com/questions/41667864/can-the-templates-module-handle-multiple-templates-directories
 - name: Ensure service directory exists
  file:
    path: "{{ current_svc_path }}"
    state: directory
    mode: "500"
 - name: Ensure directory structure exists
  file:
    path: "{{ current_svc_path }}/{{ item.path }}"
    state: directory
    mode: "500"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "directory"
 - name: Include app config variables
  include_vars:
    file: "{{ role_path }}/vars/app_config.yml"
 - name: Generate {{ current_svc_name }} deployment from templates
  template:
    src: "{{ item.src }}"
    dest: "{{ current_svc_path }}/{{ item.path | regex_replace('\\.j2$', '') }}"
    mode: "400"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "file"
 - name: Deploy docker-compose for {{ current_svc_name }}
  community.docker.docker_compose:
    project_src: "{{ current_svc_path }}"
    state: present
--- a/roles/alpina/templates/apps/nextcloud/.env.db.j2
+++ b/roles/alpina/templates/apps/nextcloud/.env.db.j2
@@ -1,3 +1,3 @@
 POSTGRES_USER=nextcloud
 POSTGRES_DB=nextcloud
-POSTGRES_PASSWORD={{ nextcloud_db_password }}
+POSTGRES_PASSWORD="{{ db_password }}"
--- a/roles/nextcloud/templates/.env.nextcloud.j2
+++ b/roles/nextcloud/templates/.env.nextcloud.j2
@@ -0,0 +1,18 @@
 POSTGRES_DB=nextcloud
 POSTGRES_USER=nextcloud
 POSTGRES_PASSWORD="{{ db_password }}"
 POSTGRES_HOST=db
 NEXTCLOUD_TRUSTED_DOMAINS=nc.cazzzer.com
 REDIS_HOST=redis
 REDIS_HOST_PASSWORD="{{ redis_password }}"
 SMTP_HOST=smtp.sendgrid.net
 SMTP_SECURE=tls
 SMTP_PORT=587
 SMTP_AUTHTYPE=LOGIN
 SMTP_NAME=apikey
 SMTP_PASSWORD="{{ sendgrid_api_key }}"
 MAIL_FROM_ADDRESS=nc
 MAIL_DOMAIN=cazzzer.com
--- a/roles/nextcloud/templates/.env.redis.j2
+++ b/roles/nextcloud/templates/.env.redis.j2
@@ -0,0 +1 @@
 REDIS_PASSWORD="{{ redis_password }}"
--- a/roles/nextcloud/templates/docker-compose.yml.j2
+++ b/roles/nextcloud/templates/docker-compose.yml.j2
@@ -0,0 +1,96 @@
 version: "3.9"
 networks:
  default:
  traefik_traefik:
    external: true
 volumes:
  nextcloud:
  nextcloud_config:
  nextcloud_data:
  db:
 services:
  app:
    image: nextcloud:24-fpm-alpine
    container_name: nextcloud_app
    restart: unless-stopped
    depends_on:
      - db
      - redis
    env_file:
      - .env.nextcloud
    networks:
      - default
    volumes:
      - nextcloud:/var/www/html
      - nextcloud_config:/var/www/html/config
      - nextcloud_data:/var/www/html/data
  cron:
    image: nextcloud:24-fpm-alpine
    container_name: nextcloud_cron
    restart: unless-stopped
    depends_on:
      - app
    entrypoint: /cron.sh
    networks:
      - default
    volumes_from:
      - app
  notify_push:
    image: nextcloud:24-fpm-alpine
    container_name: nextcloud_notify_push
    restart: unless-stopped
    depends_on:
      - app
    entrypoint:
      - /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push
      - /var/www/html/config/config.php
    networks:
      - default
    volumes_from:
      - app
  db:
    image: postgres:13-alpine
    container_name: nextcloud_db
    restart: unless-stopped
    env_file:
      - .env.db
    networks:
      - default
    volumes:
      - db:/var/lib/postgresql/data
  redis:
    image: redis:7-alpine
    container_name: nextcloud_redis
    restart: unless-stopped
    env_file:
      - .env.redis
    networks:
      - default
    command:
      - sh
      - -c
      - redis-server --requirepass $$REDIS_PASSWORD
  web:
    image: nginx:1.23-alpine
    container_name: nextcloud_web
    labels:
      - traefik.enable=true
      - traefik.http.routers.nextcloud.rule=Host(`nc.{{ domain }}`)
    restart: unless-stopped
    links:
      - app
    networks:
      - traefik_traefik
      - default
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
    volumes_from:
      - app
--- a/roles/nextcloud/templates/nginx.conf.j2
+++ b/roles/nextcloud/templates/nginx.conf.j2
@@ -0,0 +1,182 @@
 # https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf
 worker_processes auto;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 events {
    worker_connections  1024;
 }
 http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    #tcp_nopush     on;
    # Prevent nginx HTTP Server Detection
    server_tokens   off;
    keepalive_timeout  65;
    upstream php-handler {
        server app:9000;
    }
    server {
        listen 80;
        # HSTS settings
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
        # set max upload size
        client_max_body_size 512M;
        fastcgi_buffers 64 4K;
        # Enable gzip but do not remove ETag headers
        gzip on;
        gzip_vary on;
        gzip_comp_level 4;
        gzip_min_length 256;
        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
        # Pagespeed is not supported by Nextcloud, so if your server is built
        # with the `ngx_pagespeed` module, uncomment this line to disable it.
        #pagespeed off;
        # HTTP response headers borrowed from Nextcloud `.htaccess`
        add_header Referrer-Policy                      "no-referrer"   always;
        add_header X-Content-Type-Options               "nosniff"       always;
        add_header X-Download-Options                   "noopen"        always;
        add_header X-Frame-Options                      "SAMEORIGIN"    always;
        add_header X-Permitted-Cross-Domain-Policies    "none"          always;
        add_header X-Robots-Tag                         "none"          always;
        add_header X-XSS-Protection                     "1; mode=block" always;
        # Remove X-Powered-By, which is an information leak
        fastcgi_hide_header X-Powered-By;
        # Path to the root of your installation
        root /var/www/html;
        # Specify how to handle directories -- specifying `/index.php$request_uri`
        # here as the fallback means that Nginx always exhibits the desired behaviour
        # when a client requests a path that corresponds to a directory that exists
        # on the server. In particular, if that directory contains an index.php file,
        # that file is correctly served; if it doesn't, then the request is passed to
        # the front-end controller. This consistent behaviour means that we don't need
        # to specify custom rules for certain paths (e.g. images and other assets,
        # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
        # `try_files $uri $uri/ /index.php$request_uri`
        # always provides the desired behaviour.
        index index.php index.html /index.php$request_uri;
        # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
        location = / {
            if ( $http_user_agent ~ ^DavClnt ) {
                return 302 /remote.php/webdav/$is_args$args;
            }
        }
        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }
        # Make a regex exception for `/.well-known` so that clients can still
        # access it despite the existence of the regex rule
        # `location ~ /(\.|autotest|...)` which would otherwise handle requests
        # for `/.well-known`.
        location ^~ /.well-known {
            # The rules in this block are an adaptation of the rules
            # in `.htaccess` that concern `/.well-known`.
            location = /.well-known/carddav { return 301 /remote.php/dav/; }
            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
            location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
            location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
            # Let Nextcloud's API for `/.well-known` URIs handle all other
            # requests by passing them to the front-end controller.
            return 301 /index.php$request_uri;
        }
        # Rules borrowed from `.htaccess` to hide certain paths from clients
        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
        # which handle static assets (as seen below). If this block is not declared first,
        # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
        # to the URI, resulting in a HTTP 500 error response.
        location ~ \.php(?:$|/) {
            # Required for legacy support
            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            set $path_info $fastcgi_path_info;
            try_files $fastcgi_script_name =404;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $path_info;
            #fastcgi_param HTTPS on;
            fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
            fastcgi_param front_controller_active true;     # Enable pretty urls
            fastcgi_pass php-handler;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
        }
        location ~ \.(?:css|js|svg|gif)$ {
            try_files $uri /index.php$request_uri;
            expires 6M;         # Cache-Control policy borrowed from `.htaccess`
            access_log off;     # Optional: Don't log access to assets
        }
        location ~ \.woff2?$ {
            try_files $uri /index.php$request_uri;
            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
            access_log off;     # Optional: Don't log access to assets
        }
        # Rule borrowed from `.htaccess`
        location /remote {
            return 301 /remote.php$request_uri;
        }
        location / {
            try_files $uri $uri/ /index.php$request_uri;
        }
        location ^~ /push/ {
            proxy_pass http://notify_push:7867/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }
 }
--- a/roles/nextcloud/vars/app_config.yml
+++ b/roles/nextcloud/vars/app_config.yml
@@ -0,0 +1,14 @@
 $ANSIBLE_VAULT;1.2;AES256;alpina
 65313636646233613364363933616361346639653939346337303832646339316632383966666237
 3766396134383434613534373937663162393134306536300a626139373732393037346630333838
 63663439353238643532316231623866396434303034313130386635623363353263626362376334
 3933346434633662320a386432373465646432343338666561366161646335636232353133393933
 65313364666564353039626238383033343765323730316633356139326666623135326131353864
 32386237643538636538356261393164633137636235346564393930346539623731386633336339
 31303466653936343166366164383134306232613236663735623834393963306331376435616365
 31313866383730393063353335626164303632636331303830636530656131636139376633623439
 63663639323964623231343066373538633336353561646230363363643762393634643435306164
 31366364326237636365336363343264343562353337303235633034383635373934376334353336
 61373065386639643064303431623162373665363937353832313561386134613834613935653964
 64656339316165313936333736643030356366663162316462636662326134396539356262666536
 64336133393937396330353234316563356337623733326264363333373536633833
--- a/roles/nextcloud/vars/main.yml
+++ b/roles/nextcloud/vars/main.yml
@@ -0,0 +1,6 @@
 ---
 # vars file for roles/nextcloud/
 current_svc_name: nextcloud
 current_svc_path: "{{ my_svc_path }}/{{ current_svc_name }}"
 templates_source: "{{ role_path }}/templates"
--- a/roles/traefik/tasks/main.yml
+++ b/roles/traefik/tasks/main.yml
@@ -0,0 +1,33 @@
 # https://stackoverflow.com/questions/41667864/can-the-templates-module-handle-multiple-templates-directories
 - name: Ensure service directory exists
  file:
    path: "{{ current_svc_path }}"
    state: directory
    mode: "500"
 - name: Ensure directory structure exists
  file:
    path: "{{ current_svc_path }}/{{ item.path }}"
    state: directory
    mode: "500"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "directory"
 #- name: Include app config variables
 #  include_vars:
 #    file: "{{ role_path }}/vars/app_config.yml"
 - name: Generate {{ current_svc_name }} deployment from templates
  template:
    src: "{{ item.src }}"
    dest: "{{ current_svc_path }}/{{ item.path | regex_replace('\\.j2$', '') }}"
    mode: "400"
  with_community.general.filetree: "{{ templates_source }}"
  when: item.state == "file"
 - name: Deploy docker-compose for {{ current_svc_name }}
  community.docker.docker_compose:
    project_src: "{{ current_svc_path }}"
    state: present
--- a/roles/traefik/templates/.env.traefik.j2
+++ b/roles/traefik/templates/.env.traefik.j2
--- a/roles/traefik/templates/docker-compose.yml.j2
+++ b/roles/traefik/templates/docker-compose.yml.j2
@@ -0,0 +1,20 @@
 version: "3.9"
 networks:
  traefik:
 services:
  traefik:
    image: traefik:v2.8
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "8080:8080"
    env_file:
      - .env.traefik
    networks:
      - traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
--- a/roles/traefik/templates/traefik.yml.j2
+++ b/roles/traefik/templates/traefik.yml.j2
@@ -0,0 +1,7 @@
 api:
  insecure: true
 providers:
  docker:
    exposedByDefault: false
    network: traefik_traefik
--- a/roles/alpina/templates/services/monitoring/prometheus_config/extra/.gitkeep
+++ b/roles/alpina/templates/services/monitoring/prometheus_config/extra/.gitkeep
--- a/roles/traefik/vars/main.yml
+++ b/roles/traefik/vars/main.yml
@@ -0,0 +1,5 @@
 ---
 current_svc_name: traefik
 current_svc_path: "{{ my_svc_path }}/{{ current_svc_name }}"
 templates_source: "{{ role_path }}/templates"
--- a/services.yml
+++ b/services.yml
@@ -1,15 +1,7 @@
- hosts: alpina
+- hosts: docker_hosts
  roles:
    - docker_host
-    - alpina
+    - traefik
-  post_tasks:
+    - nextcloud
-    - name: Docker prune objects
+    - role: gitea
-      docker_prune:
+
        containers: true
        # Keep images for building grafana
        images: true
        images_filters:
          until: "720h"
        networks: true
        volumes: true
        builder_cache: false
--- a/site.yml
+++ b/site.yml
@@ -1,12 +1,6 @@
 - hosts: all
  roles:
    - common
  pre_tasks:
  - name: Set fact for clean desired of docker objects and compose files
    set_fact:
      # clean_desired_arg is an extra variable passed to the playbook
      clean_desired: "{{ clean_desired_arg | bool }}"
 - name: Install services
  import_playbook: services.yml
`@@ -1,2 +1,2 @@`
	`[alpina]`	`[docker_hosts]`
	`debbi.lab.home`	`root@alpina.lab.home`
		`@@ -1 +0,0 @@`
			`JELLYFIN_PublishedServerUrl=https://jellyfin.{{ domain }}`
		`@@ -1 +0,0 @@`
			`CF_DNS_API_TOKEN={{ cloudflare_api_token }}`
		`@@ -0,0 +1 @@`
							`JELLYFIN_PublishedServerUrl="https://jellyfin.{{ domain }}"`