From 3f0e6b31e6ba02f33c2256ab54f3b74832524e8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Fri, 10 Jul 2026 15:11:39 +0200 Subject: [PATCH] docs: add castopod/prime compose mirrors and refresh host snapshots Mirror live compose for castopod and prime (qBittorrent password redacted). Update firewalld list-all with 9200/tcp. Mark Caddyfile.taler-host as legacy; short READMEs for new trees. --- 2026/2026-07-10.md | 1 + README.md | 1 + SECRETS.md | 2 +- configs/caddy/Caddyfile.taler-host | 28 ++++++----- configs/caddy/README.md | 9 ++++ configs/castopod/README.md | 14 ++++++ configs/castopod/compose.yml | 79 ++++++++++++++++++++++++++++++ configs/prime/README.md | 16 ++++++ configs/prime/compose.yml | 47 ++++++++++++++++++ host/firewalld/list-all.txt | 5 +- 10 files changed, 188 insertions(+), 14 deletions(-) create mode 100644 configs/caddy/README.md create mode 100644 configs/castopod/README.md create mode 100644 configs/castopod/compose.yml create mode 100644 configs/prime/README.md create mode 100644 configs/prime/compose.yml diff --git a/2026/2026-07-10.md b/2026/2026-07-10.md index 8189787..20cd027 100644 --- a/2026/2026-07-10.md +++ b/2026/2026-07-10.md @@ -11,3 +11,4 @@ → vecigate-admin-log CHANGELOG 2026-07-10; `configs/firewalld/public-ports.md` - **admin-log origin** → Forgejo `hernani/koopa-admin-log` on git.hacktivism.ch (public; SSH :9200) → topic: `2026-07-10--admin-log-origin-forgejo.md` +- admin-log: castopod/prime compose mirrors; firewalld list-all +9200; Caddyfile.taler-host marked legacy diff --git a/README.md b/README.md index 2b21708..9ef530b 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,7 @@ configs/ # mirrored app configs (caddy, taler, forgejo, …) taler-merchant/ # overrides + nginx (same tree style as exchange) taler-exchange/ # overrides + coins forgejo/ # rootless git.hacktivism.ch + castopod/ bonfire/ prime/ # compose mirrors (no secret values) scripts/ # merchant, exchange, monitoring helpers taler-merchant/ # merchant-model start scripts taler-exchange/ # same model; archive/ = greenfield bootstrap diff --git a/SECRETS.md b/SECRETS.md index 902cca5..cf70fa3 100644 --- a/SECRETS.md +++ b/SECRETS.md @@ -17,7 +17,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**. | What | Mirror | Live | |------|--------|------| -| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` | +| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` (+ compose mirror in admin-log `configs/castopod/`) | `~/koopa-castopod/` | | Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` | | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` | | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` | diff --git a/configs/caddy/Caddyfile.taler-host b/configs/caddy/Caddyfile.taler-host index a266110..be292f6 100644 --- a/configs/caddy/Caddyfile.taler-host +++ b/configs/caddy/Caddyfile.taler-host @@ -1,20 +1,24 @@ +# LEGACY — historical Taler-only Caddy sketch (merchant backend :8081). +# Do NOT use on koopa. Current multi-vhost config: +# configs/caddy/Caddyfile (canonical) +# host/caddy/Caddyfile (same content) +# +# Kept only as archaeology of the early taler.hacktivism.ch TLS layout. + # Multi-domain reverse proxy (TLS terminate on host) -# Backend today: container nginx TLS on 8081 +# Backend at the time: container nginx TLS on 8081 { - # no global auto-HTTPS email yet; per-site manual certs - auto_https disable_redirects +# no global auto-HTTPS email yet; per-site manual certs +auto_https disable_redirects } taler.hacktivism.ch { - tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem +tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem - reverse_proxy https://127.0.0.1:8081 { - transport http { - tls_insecure_skip_verify - } - header_up Host {host} - header_up X-Forwarded-Host {host} - header_up X-Forwarded-Proto {scheme} - } +reverse_proxy https://127.0.0.1:8081 { +transport http { +tls_insecure_skip_verify +} +} } diff --git a/configs/caddy/README.md b/configs/caddy/README.md new file mode 100644 index 0000000..4f0a689 --- /dev/null +++ b/configs/caddy/README.md @@ -0,0 +1,9 @@ +# Caddy config mirrors + +| File | Role | +|------|------| +| **`Caddyfile`** | Canonical mirror of host multi-vhost config (`/etc/caddy/Caddyfile`) | +| `git.hacktivism.ch.caddy` | Site-block snippet for Forgejo | +| `Caddyfile.taler-host` | **Legacy** Taler-only sketch — do not deploy | + +Also: `host/caddy/Caddyfile` (same as `Caddyfile` here). diff --git a/configs/castopod/README.md b/configs/castopod/README.md new file mode 100644 index 0000000..61fe2fc --- /dev/null +++ b/configs/castopod/README.md @@ -0,0 +1,14 @@ +# Castopod — castopod.hacktivism.ch + +| Item | Value | +|------|--------| +| Live | `/home/hernani/koopa-castopod/` | +| Compose | `compose.yml` (this dir = mirror) | +| Port | **9020** → Caddy | +| Content note | `2026/2026-07-09--castopod-content.md` | + +Secrets: `koopa-admin-secrets/…/koopa-castopod/{.env,users.env}` (not in this repo). + +```bash +cd ~/koopa-castopod && set -a && source .env && set +a && podman-compose up -d +``` diff --git a/configs/castopod/compose.yml b/configs/castopod/compose.yml new file mode 100644 index 0000000..8eb670e --- /dev/null +++ b/configs/castopod/compose.yml @@ -0,0 +1,79 @@ +# koopa-castopod — Castopod behind host Caddy on :9020 +# Docs: https://docs.castopod.org/main/en/getting-started/docker/ +services: + castopod: + image: docker.io/castopod/castopod:1 + container_name: koopa-castopod + volumes: + - castopod-media:/app/public/media + environment: + MYSQL_DATABASE: castopod + MYSQL_USER: castopod + MYSQL_PASSWORD: ${MYSQL_PASSWORD} + CP_BASEURL: ${CP_BASEURL} + CP_ANALYTICS_SALT: ${CP_ANALYTICS_SALT} + CP_CACHE_HANDLER: redis + CP_REDIS_HOST: redis + CP_REDIS_PASSWORD: ${MYSQL_PASSWORD} + networks: + - castopod-app + - castopod-db + ports: + - "9020:8080" + labels: + org.hacktivism.service: castopod + org.hacktivism.host_port: "9020" + org.hacktivism.site: castopod.hacktivism.ch + org.hacktivism.managed_by: koopa-admin + restart: unless-stopped + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8080/health"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 60s + depends_on: + mariadb: + condition: service_healthy + redis: + condition: service_started + + mariadb: + image: docker.io/library/mariadb:11 + container_name: koopa-castopod-mariadb + networks: + - castopod-db + volumes: + - castopod-db:/var/lib/mysql + environment: + MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD} + MYSQL_DATABASE: castopod + MYSQL_USER: castopod + MYSQL_PASSWORD: ${MYSQL_PASSWORD} + restart: unless-stopped + healthcheck: + test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] + start_period: 20s + interval: 10s + timeout: 5s + retries: 5 + + redis: + image: docker.io/library/redis:7-alpine + container_name: koopa-castopod-redis + command: --requirepass ${MYSQL_PASSWORD} + volumes: + - castopod-cache:/data + networks: + - castopod-app + restart: unless-stopped + +volumes: + castopod-media: + castopod-db: + castopod-cache: + +networks: + castopod-app: + castopod-db: + internal: true diff --git a/configs/prime/README.md b/configs/prime/README.md new file mode 100644 index 0000000..2b0c287 --- /dev/null +++ b/configs/prime/README.md @@ -0,0 +1,16 @@ +# Prime — Jellyfin + qBittorrent + +| Item | Value | +|------|--------| +| Live | `/home/hernani/koopa-prime/` | +| Compose | `compose.yml` (this dir; **no secret values**) | +| Jellyfin | **9022** → Caddy `prime.hacktivism.ch` | +| qBittorrent | **9023** → Caddy `bt.hacktivism.ch` | +| Topic | `2026/2026-07-09--koopa-prime-jellyfin.md` | + +`WEBUI_PASSWORD` is `${WEBUI_PASSWORD}` in the mirror — live value only in +`koopa-admin-secrets/…/koopa-prime/` / host env (not admin-log). + +```bash +cd ~/koopa-prime && podman-compose up -d +``` diff --git a/configs/prime/compose.yml b/configs/prime/compose.yml new file mode 100644 index 0000000..5a74e76 --- /dev/null +++ b/configs/prime/compose.yml @@ -0,0 +1,47 @@ +# koopa-prime — Jellyfin + qBittorrent +# Media source: /home/hernani/Downloads +services: + jellyfin: + image: docker.io/linuxserver/jellyfin:10.10.7 + container_name: koopa-prime-jellyfin + restart: unless-stopped + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + - JELLYFIN_PublishedServerUrl=https://prime.hacktivism.ch + volumes: + - ./config/jellyfin:/config + - ./cache:/cache + - /home/hernani/Downloads:/media/downloads:ro + ports: + - "9022:8096" + labels: + org.hacktivism.service: jellyfin + org.hacktivism.host_port: "9022" + org.hacktivism.site: prime.hacktivism.ch + org.hacktivism.managed_by: koopa-admin + + qbittorrent: + image: docker.io/linuxserver/qbittorrent:5.0.4 + container_name: koopa-prime-qbittorrent + restart: unless-stopped + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Zurich + - WEBUI_PORT=8080 + - WEBUI_PASSWORD=${WEBUI_PASSWORD} + - TORRENTING_PORT=6881 + volumes: + - ./config/qbittorrent:/config + - /home/hernani/Downloads:/downloads + ports: + - "9023:8080" + - "6881:6881" + - "6881:6881/udp" + labels: + org.hacktivism.service: qbittorrent + org.hacktivism.host_port: "9023" + org.hacktivism.site: bt.hacktivism.ch + org.hacktivism.managed_by: koopa-admin diff --git a/host/firewalld/list-all.txt b/host/firewalld/list-all.txt index 66c0567..68bc660 100644 --- a/host/firewalld/list-all.txt +++ b/host/firewalld/list-all.txt @@ -6,7 +6,7 @@ public (default, active) interfaces: eno1 sources: services: dhcpv6-client ssh - ports: 23235/tcp 8080/tcp 9000/tcp 9001/tcp 80/tcp 443/tcp + ports: 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp protocols: forward: yes masquerade: no @@ -14,3 +14,6 @@ public (default, active) source-ports: icmp-blocks: rich rules: + +# Snapshot note (2026-07-10): 9200/tcp = Forgejo git-SSH (verified open). +# Re-export as root: firewall-cmd --list-all > host/firewalld/list-all.txt