docs: add castopod/prime compose mirrors and refresh host snapshots
Mirror live compose for castopod and prime (qBittorrent password redacted). Update firewalld list-all with 9200/tcp. Mark Caddyfile.taler-host as legacy; short READMEs for new trees.
This commit is contained in:
Hernâni Marques
parent
ea713cab91
commit
0ca56c6635
10 changed files with 188 additions and 14 deletions
|
|
@ -11,3 +11,4 @@
|
|||
→ vecigate-admin-log CHANGELOG 2026-07-10; `configs/firewalld/public-ports.md`
|
||||
- **admin-log origin** → Forgejo `hernani/koopa-admin-log` on git.hacktivism.ch (public; SSH :9200)
|
||||
→ topic: `2026-07-10--admin-log-origin-forgejo.md`
|
||||
- admin-log: castopod/prime compose mirrors; firewalld list-all +9200; Caddyfile.taler-host marked legacy
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@ configs/ # mirrored app configs (caddy, taler, forgejo, …)
|
|||
taler-merchant/ # overrides + nginx (same tree style as exchange)
|
||||
taler-exchange/ # overrides + coins
|
||||
forgejo/ # rootless git.hacktivism.ch
|
||||
castopod/ bonfire/ prime/ # compose mirrors (no secret values)
|
||||
scripts/ # merchant, exchange, monitoring helpers
|
||||
taler-merchant/ # merchant-model start scripts
|
||||
taler-exchange/ # same model; archive/ = greenfield bootstrap
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
|
|||
|
||||
| What | Mirror | Live |
|
||||
|------|--------|------|
|
||||
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
|
||||
| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` |
|
||||
| Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
|
||||
| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
|
||||
| Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
|
||||
|
|
|
|||
|
|
@ -1,20 +1,24 @@
|
|||
# LEGACY — historical Taler-only Caddy sketch (merchant backend :8081).
|
||||
# Do NOT use on koopa. Current multi-vhost config:
|
||||
# configs/caddy/Caddyfile (canonical)
|
||||
# host/caddy/Caddyfile (same content)
|
||||
#
|
||||
# Kept only as archaeology of the early taler.hacktivism.ch TLS layout.
|
||||
|
||||
# Multi-domain reverse proxy (TLS terminate on host)
|
||||
# Backend today: container nginx TLS on 8081
|
||||
# Backend at the time: container nginx TLS on 8081
|
||||
|
||||
{
|
||||
# no global auto-HTTPS email yet; per-site manual certs
|
||||
auto_https disable_redirects
|
||||
# no global auto-HTTPS email yet; per-site manual certs
|
||||
auto_https disable_redirects
|
||||
}
|
||||
|
||||
taler.hacktivism.ch {
|
||||
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
|
||||
tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
|
||||
|
||||
reverse_proxy https://127.0.0.1:8081 {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
header_up Host {host}
|
||||
header_up X-Forwarded-Host {host}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
reverse_proxy https://127.0.0.1:8081 {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
9
configs/caddy/README.md
Normal file
9
configs/caddy/README.md
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
# Caddy config mirrors
|
||||
|
||||
| File | Role |
|
||||
|------|------|
|
||||
| **`Caddyfile`** | Canonical mirror of host multi-vhost config (`/etc/caddy/Caddyfile`) |
|
||||
| `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo |
|
||||
| `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy |
|
||||
|
||||
Also: `host/caddy/Caddyfile` (same as `Caddyfile` here).
|
||||
14
configs/castopod/README.md
Normal file
14
configs/castopod/README.md
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# Castopod — castopod.hacktivism.ch
|
||||
|
||||
| Item | Value |
|
||||
|------|--------|
|
||||
| Live | `/home/hernani/koopa-castopod/` |
|
||||
| Compose | `compose.yml` (this dir = mirror) |
|
||||
| Port | **9020** → Caddy |
|
||||
| Content note | `2026/2026-07-09--castopod-content.md` |
|
||||
|
||||
Secrets: `koopa-admin-secrets/…/koopa-castopod/{.env,users.env}` (not in this repo).
|
||||
|
||||
```bash
|
||||
cd ~/koopa-castopod && set -a && source .env && set +a && podman-compose up -d
|
||||
```
|
||||
79
configs/castopod/compose.yml
Normal file
79
configs/castopod/compose.yml
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
# koopa-castopod — Castopod behind host Caddy on :9020
|
||||
# Docs: https://docs.castopod.org/main/en/getting-started/docker/
|
||||
services:
|
||||
castopod:
|
||||
image: docker.io/castopod/castopod:1
|
||||
container_name: koopa-castopod
|
||||
volumes:
|
||||
- castopod-media:/app/public/media
|
||||
environment:
|
||||
MYSQL_DATABASE: castopod
|
||||
MYSQL_USER: castopod
|
||||
MYSQL_PASSWORD: ${MYSQL_PASSWORD}
|
||||
CP_BASEURL: ${CP_BASEURL}
|
||||
CP_ANALYTICS_SALT: ${CP_ANALYTICS_SALT}
|
||||
CP_CACHE_HANDLER: redis
|
||||
CP_REDIS_HOST: redis
|
||||
CP_REDIS_PASSWORD: ${MYSQL_PASSWORD}
|
||||
networks:
|
||||
- castopod-app
|
||||
- castopod-db
|
||||
ports:
|
||||
- "9020:8080"
|
||||
labels:
|
||||
org.hacktivism.service: castopod
|
||||
org.hacktivism.host_port: "9020"
|
||||
org.hacktivism.site: castopod.hacktivism.ch
|
||||
org.hacktivism.managed_by: koopa-admin
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
start_period: 60s
|
||||
depends_on:
|
||||
mariadb:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_started
|
||||
|
||||
mariadb:
|
||||
image: docker.io/library/mariadb:11
|
||||
container_name: koopa-castopod-mariadb
|
||||
networks:
|
||||
- castopod-db
|
||||
volumes:
|
||||
- castopod-db:/var/lib/mysql
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
|
||||
MYSQL_DATABASE: castopod
|
||||
MYSQL_USER: castopod
|
||||
MYSQL_PASSWORD: ${MYSQL_PASSWORD}
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
||||
start_period: 20s
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
redis:
|
||||
image: docker.io/library/redis:7-alpine
|
||||
container_name: koopa-castopod-redis
|
||||
command: --requirepass ${MYSQL_PASSWORD}
|
||||
volumes:
|
||||
- castopod-cache:/data
|
||||
networks:
|
||||
- castopod-app
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
castopod-media:
|
||||
castopod-db:
|
||||
castopod-cache:
|
||||
|
||||
networks:
|
||||
castopod-app:
|
||||
castopod-db:
|
||||
internal: true
|
||||
16
configs/prime/README.md
Normal file
16
configs/prime/README.md
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
# Prime — Jellyfin + qBittorrent
|
||||
|
||||
| Item | Value |
|
||||
|------|--------|
|
||||
| Live | `/home/hernani/koopa-prime/` |
|
||||
| Compose | `compose.yml` (this dir; **no secret values**) |
|
||||
| Jellyfin | **9022** → Caddy `prime.hacktivism.ch` |
|
||||
| qBittorrent | **9023** → Caddy `bt.hacktivism.ch` |
|
||||
| Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` |
|
||||
|
||||
`WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in
|
||||
`koopa-admin-secrets/…/koopa-prime/` / host env (not admin-log).
|
||||
|
||||
```bash
|
||||
cd ~/koopa-prime && podman-compose up -d
|
||||
```
|
||||
47
configs/prime/compose.yml
Normal file
47
configs/prime/compose.yml
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
# koopa-prime — Jellyfin + qBittorrent
|
||||
# Media source: /home/hernani/Downloads
|
||||
services:
|
||||
jellyfin:
|
||||
image: docker.io/linuxserver/jellyfin:10.10.7
|
||||
container_name: koopa-prime-jellyfin
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=Europe/Zurich
|
||||
- JELLYFIN_PublishedServerUrl=https://prime.hacktivism.ch
|
||||
volumes:
|
||||
- ./config/jellyfin:/config
|
||||
- ./cache:/cache
|
||||
- /home/hernani/Downloads:/media/downloads:ro
|
||||
ports:
|
||||
- "9022:8096"
|
||||
labels:
|
||||
org.hacktivism.service: jellyfin
|
||||
org.hacktivism.host_port: "9022"
|
||||
org.hacktivism.site: prime.hacktivism.ch
|
||||
org.hacktivism.managed_by: koopa-admin
|
||||
|
||||
qbittorrent:
|
||||
image: docker.io/linuxserver/qbittorrent:5.0.4
|
||||
container_name: koopa-prime-qbittorrent
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=Europe/Zurich
|
||||
- WEBUI_PORT=8080
|
||||
- WEBUI_PASSWORD=${WEBUI_PASSWORD}
|
||||
- TORRENTING_PORT=6881
|
||||
volumes:
|
||||
- ./config/qbittorrent:/config
|
||||
- /home/hernani/Downloads:/downloads
|
||||
ports:
|
||||
- "9023:8080"
|
||||
- "6881:6881"
|
||||
- "6881:6881/udp"
|
||||
labels:
|
||||
org.hacktivism.service: qbittorrent
|
||||
org.hacktivism.host_port: "9023"
|
||||
org.hacktivism.site: bt.hacktivism.ch
|
||||
org.hacktivism.managed_by: koopa-admin
|
||||
|
|
@ -6,7 +6,7 @@ public (default, active)
|
|||
interfaces: eno1
|
||||
sources:
|
||||
services: dhcpv6-client ssh
|
||||
ports: 23235/tcp 8080/tcp 9000/tcp 9001/tcp 80/tcp 443/tcp
|
||||
ports: 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp
|
||||
protocols:
|
||||
forward: yes
|
||||
masquerade: no
|
||||
|
|
@ -14,3 +14,6 @@ public (default, active)
|
|||
source-ports:
|
||||
icmp-blocks:
|
||||
rich rules:
|
||||
|
||||
# Snapshot note (2026-07-10): 9200/tcp = Forgejo git-SSH (verified open).
|
||||
# Re-export as root: firewall-cmd --list-all > host/firewalld/list-all.txt
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue