init

hosts/ps08rp/portainer-agent/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+    portainer:
+        container_name: portainer-agent
+        image: portainer/agent:latest
+        ports:
+            - 9001:9001
+        privileged: true
+        restart: always
+        volumes:
+            - /var/lib/docker/volumes:/var/lib/docker/volumes
+            - /var/run/docker.sock:/var/run/docker.sock

hosts/ps08rp/tailscale/.env

@@ -0,0 +1,4 @@
+TS_AUTHKEY=""
+TS_HOSTNAME=ps08rp
+TS_ROUTES=192.168.1.0/24
+TS_STATE_DIR=/var/lib/tailscale

hosts/ps08rp/tailscale/docker-compose.yml

@@ -0,0 +1,24 @@
+services:
+    tailscaled:
+        cap_add:
+            - NET_ADMIN
+            - NET_RAW
+        container_name: tailscaled
+        env_file:
+            - .env
+        hostname: ps08rp
+        image: tailscale/tailscale:stable
+        network_mode: host
+        privileged: true
+        restart: always
+        volumes:
+            - tailscale:/var/lib/tailscale
+            - /dev/net/tun:/dev/net/tun
+
+volumes:
+    tailscale:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/tailscale

hosts/ps08rp/technitium/.env

@@ -0,0 +1,3 @@
+DNS_SERVER_DOMAIN=alexlebens.net
+DNS_SERVER_ADMIN_PASSWORD=""
+DNS_SERVER_FORWARDERS=1.1.1.1, 1.0.0.1

hosts/ps08rp/technitium/docker-compose.yaml

@@ -0,0 +1,37 @@
+services:
+    technitium:
+        container_name: technitium
+        env_file:
+            - .env
+        image: technitium/dns-server:latest
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.technitium.entrypoints: websecure
+            traefik.http.routers.technitium.rule: Host(`technitium-ps08rp.alexlebens.net`)
+            traefik.http.routers.technitium.service: technitium
+            traefik.http.services.technitium.loadbalancer.server.port: 5380
+        networks:
+            traefik: null
+        ports:
+            - 53:53/udp
+            - 53:53/tcp
+            - 67:67/udp
+        restart: always
+        sysctls:
+            - net.ipv4.ip_local_port_range=1024 65000
+        volumes:
+            - config:/etc/dns
+
+networks:
+    traefik:
+        name: traefik
+        external: true
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/technitium/config

hosts/ps08rp/traefik/.env

@@ -0,0 +1,3 @@
+CF_API_EMAIL=alexanderlebens@gmail.com
+CF_API_KEY=""
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

hosts/ps08rp/traefik/docker-compose.yaml

@@ -0,0 +1,45 @@
+services:
+    traefik:
+        command: traefik
+        container_name: traefik
+        env_file:
+            - .env
+        image: docker.io/traefik:v3.0
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.dashboard.entrypoints: websecure
+            traefik.http.routers.dashboard.rule: (Host(`traefik-ps08rp.alexlebens.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
+            traefik.http.routers.dashboard.service: api@internal
+            traefik.http.routers.dashboard.tls: true
+            traefik.http.routers.dashboard.tls.certresolver: cloudflare
+        networks:
+            traefik: null
+        ports:
+            - 80:80
+            - 443:443
+        privileged: true
+        restart: always
+        volumes:
+            - config:/etc/traefik
+            - log:/log
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+
+networks:
+    traefik:
+        name: traefik
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/traefik/config
+
+    log:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/traefik/log

hosts/ps08rp/traefik/traefik_config/conf/iplocal.yml

@@ -0,0 +1,15 @@
+http:
+  middlewares:
+    ip-local:
+      IPAllowList:
+        sourceRange:
+          - "192.168.1.1/16"
+          - "172.27.0.0/16"
+
+tcp:
+  middlewares:
+    ip-local:
+      IPAllowList:
+        sourceRange:
+          - "192.168.1.1/16"
+          - "172.27.0.0/16"

hosts/ps08rp/traefik/traefik_config/conf/metrics.yml

@@ -0,0 +1,8 @@
+http:
+  routers:
+    prometheus:
+      rule: "(Host(`traefik-ps08rp.alexlebens.net`) && Path(`/metrics`))"
+      entryPoints: websecure
+      service: prometheus@internal
+      middlewares:
+        - "ip-local@file"

hosts/ps08rp/traefik/traefik_config/traefik.yml

@@ -0,0 +1,113 @@
+################################################################
+# Global
+################################################################
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+
+################################################################
+# EntryPoints
+################################################################
+
+entryPoints:
+  web:
+    address: :80
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+
+  websecure:
+    address: :443
+    forwardedHeaders:
+      trustedIPs:
+        - "192.168.1.1/16"
+    proxyProtocol:
+      trustedIPs:
+        - "192.168.1.1/16"
+    http:
+      tls:
+        options: default
+        certResolver: cloudflare
+        domains:
+          - main: "*.alexlebens.net"
+            sans:
+              - "alexlebens.net"
+      middlewares:
+        - ip-local@file
+
+################################################################
+# Certificate Resolvers
+################################################################
+
+certificatesResolvers:
+  cloudflare:
+    acme:
+      email: alexanderlebens@gmail.com
+      storage: /etc/traefik/acme/acme.json
+      preferredChain: "ISRG Root X1"
+      dnsChallenge:
+        provider: cloudflare
+        delayBeforeCheck: "3"
+        resolvers:
+          - "1.1.1.1"
+          - "1.0.0.1"
+
+################################################################
+# Traefik logs
+################################################################
+
+log:
+  level: INFO
+
+################################################################
+# Access logs
+################################################################
+
+accessLog: {}
+
+################################################################
+# API and Dashboard
+################################################################
+
+api:
+  insecure: false
+  dashboard: true
+
+################################################################
+# Ping
+################################################################
+
+# ping:
+
+################################################################
+# Metrics
+################################################################
+
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+    addRoutersLabels: true
+    addServicesLabels: true
+    buckets:
+      - 0.1
+      - 0.3
+      - 1.2
+      - 5.0
+    entryPoint: websecure
+    manualRouting: true
+
+################################################################
+# Providers
+################################################################
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+
+  file:
+    directory: "/etc/traefik/conf"
+    watch: true

hosts/ps08rp/watchtower/.env

@@ -0,0 +1,5 @@
+TZ=US/Central
+WATCHTOWER_HTTP_API_METRICS=true
+WATCHTOWER_HTTP_API_TOKEN=token
+WATCHTOWER_CLEANUP=true
+WATCHTOWER_POLL_INTERVAL=3600

hosts/ps08rp/watchtower/docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+    watchtower:
+        container_name: watchtower
+        env_file:
+            - .env
+        image: containrrr/watchtower:latest
+        privileged: true
+        restart: always
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock

hosts/ps09rp/portainer-agent/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+    portainer:
+        container_name: portainer-agent
+        image: portainer/agent:latest
+        ports:
+            - 9001:9001
+        privileged: true
+        restart: always
+        volumes:
+            - /var/lib/docker/volumes:/var/lib/docker/volumes
+            - /var/run/docker.sock:/var/run/docker.sock

hosts/ps09rp/tailscale/.env

@@ -0,0 +1,11 @@
+TS_AUTHKEY=""
+TS_HOSTNAME=ps09rp
+TS_ROUTES=192.168.1.0/24
+TS_STATE_DIR=/var/lib/tailscale
+
+
+
+
+
+
+

hosts/ps09rp/tailscale/docker-compose.yml

@@ -0,0 +1,24 @@
+services:
+    tailscaled:
+        cap_add:
+            - NET_ADMIN
+            - NET_RAW
+        container_name: tailscaled
+        env_file:
+            - .env
+        hostname: ps09rp
+        image: tailscale/tailscale:stable
+        network_mode: host
+        privileged: true
+        restart: always
+        volumes:
+            - tailscale:/var/lib/tailscale
+            - /dev/net/tun:/dev/net/tun
+
+volumes:
+    tailscale:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/tailscale

hosts/ps09rp/technitium/.env

@@ -0,0 +1,3 @@
+DNS_SERVER_DOMAIN=alexlebens.net
+DNS_SERVER_ADMIN_PASSWORD=""
+DNS_SERVER_FORWARDERS=1.1.1.1, 1.0.0.1

hosts/ps09rp/technitium/docker-compose.yaml

@@ -0,0 +1,37 @@
+services:
+    technitium:
+        container_name: technitium
+        env_file:
+            - .env
+        image: technitium/dns-server:latest
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.technitium.entrypoints: websecure
+            traefik.http.routers.technitium.rule: Host(`technitium-ps09rp.alexlebens.net`)
+            traefik.http.routers.technitium.service: technitium
+            traefik.http.services.technitium.loadbalancer.server.port: 5380
+        networks:
+            traefik: null
+        ports:
+            - 53:53/udp
+            - 53:53/tcp
+            - 67:67/udp
+        restart: always
+        sysctls:
+            - net.ipv4.ip_local_port_range=1024 65000
+        volumes:
+            - config:/etc/dns
+
+networks:
+    traefik:
+        name: traefik
+        external: true
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/technitium/config

hosts/ps09rp/traefik/.env

@@ -0,0 +1,3 @@
+CF_API_EMAIL=alexanderlebens@gmail.com
+CF_API_KEY=""
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

hosts/ps09rp/traefik/docker-compose.yaml

@@ -0,0 +1,45 @@
+services:
+    traefik:
+        command: traefik
+        container_name: traefik
+        env_file:
+            - .env
+        image: docker.io/traefik:v3.0
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.dashboard.entrypoints: websecure
+            traefik.http.routers.dashboard.rule: (Host(`traefik-ps09rp.alexlebens.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
+            traefik.http.routers.dashboard.service: api@internal
+            traefik.http.routers.dashboard.tls: true
+            traefik.http.routers.dashboard.tls.certresolver: cloudflare
+        networks:
+            traefik: null
+        ports:
+            - 80:80
+            - 443:443
+        privileged: true
+        restart: always
+        volumes:
+            - config:/etc/traefik
+            - log:/log
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+
+networks:
+    traefik:
+        name: traefik
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/traefik/config
+
+    log:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /opt/traefik/log

hosts/ps09rp/traefik/traefik_config/conf/iplocal.yml

@@ -0,0 +1,15 @@
+http:
+  middlewares:
+    ip-local:
+      IPAllowList:
+        sourceRange:
+          - "192.168.1.1/16"
+          - "172.27.0.0/16"
+
+tcp:
+  middlewares:
+    ip-local:
+      IPAllowList:
+        sourceRange:
+          - "192.168.1.1/16"
+          - "172.27.0.0/16"

hosts/ps09rp/traefik/traefik_config/conf/metrics.yml

@@ -0,0 +1,8 @@
+http:
+  routers:
+    prometheus:
+      rule: "(Host(`traefik-ps09rp.alexlebens.net`) && Path(`/metrics`))"
+      entryPoints: websecure
+      service: prometheus@internal
+      middlewares:
+        - "ip-local@file"

hosts/ps09rp/traefik/traefik_config/traefik.yml

@@ -0,0 +1,113 @@
+################################################################
+# Global
+################################################################
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+
+################################################################
+# EntryPoints
+################################################################
+
+entryPoints:
+  web:
+    address: :80
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+
+  websecure:
+    address: :443
+    forwardedHeaders:
+      trustedIPs:
+        - "192.168.1.1/16"
+    proxyProtocol:
+      trustedIPs:
+        - "192.168.1.1/16"
+    http:
+      tls:
+        options: default
+        certResolver: cloudflare
+        domains:
+          - main: "*.alexlebens.net"
+            sans:
+              - "alexlebens.net"
+      middlewares:
+        - ip-local@file
+
+################################################################
+# Certificate Resolvers
+################################################################
+
+certificatesResolvers:
+  cloudflare:
+    acme:
+      email: alexanderlebens@gmail.com
+      storage: /etc/traefik/acme/acme.json
+      preferredChain: "ISRG Root X1"
+      dnsChallenge:
+        provider: cloudflare
+        delayBeforeCheck: "3"
+        resolvers:
+          - "1.1.1.1"
+          - "1.0.0.1"
+
+################################################################
+# Traefik logs
+################################################################
+
+log:
+  level: INFO
+
+################################################################
+# Access logs
+################################################################
+
+accessLog: {}
+
+################################################################
+# API and Dashboard
+################################################################
+
+api:
+  insecure: false
+  dashboard: true
+
+################################################################
+# Ping
+################################################################
+
+# ping:
+
+################################################################
+# Metrics
+################################################################
+
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+    addRoutersLabels: true
+    addServicesLabels: true
+    buckets:
+      - 0.1
+      - 0.3
+      - 1.2
+      - 5.0
+    entryPoint: websecure
+    manualRouting: true
+
+################################################################
+# Providers
+################################################################
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+
+  file:
+    directory: "/etc/traefik/conf"
+    watch: true

hosts/ps09rp/watchtower/.env

@@ -0,0 +1,5 @@
+TZ=US/Central
+WATCHTOWER_HTTP_API_METRICS=true
+WATCHTOWER_HTTP_API_TOKEN=token
+WATCHTOWER_CLEANUP=true
+WATCHTOWER_POLL_INTERVAL=3600

hosts/ps09rp/watchtower/docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+    watchtower:
+        container_name: watchtower
+        env_file:
+            - .env
+        image: containrrr/watchtower:latest
+        privileged: true
+        restart: always
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock

hosts/ps10rp/cloudflare-ddns/.env

@@ -0,0 +1,3 @@
+API_KEY=""
+ZONE=lebens-home.net
+PROXIED=false

hosts/ps10rp/cloudflare-ddns/docker-compose.yml

@@ -0,0 +1,6 @@
+services:
+    cloudflare_ddns:
+        container_name: cloudflare_ddns
+        env_file:
+            - .env
+        image: docker.io/oznu/cloudflare-ddns:latest

hosts/ps10rp/gitea/.env

@@ -0,0 +1,8 @@
+USER_UID=1000
+USER_GID=1000
+GITEA__database__DB_TYPE=postgres
+GITEA__database__HOST=gitea-postgres:5432
+GITEA__database__NAME=gitea
+GITEA__database__USER=gitea
+GITEA__database__PASSWD=""
+GITEA__webhook__ALLOWED_HOST_LIST="*.lebens-home.net, 192.168.*.*, 172.27.*.*"

hosts/ps10rp/gitea/.postgresql.env

@@ -0,0 +1,3 @@
+POSTGRES_USER=gitea
+POSTGRES_PASSWORD=""
+POSTGRES_DB=gitea

hosts/ps10rp/gitea/docker-compose.yml

@@ -0,0 +1,51 @@
+services:
+    gitea:
+        container_name: gitea
+        depends_on:
+            - postgres
+        env_file:
+            - .env
+        image: docker.io/gitea/gitea:latest
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.gitea.entrypoints: websecure
+            traefik.http.routers.gitea.rule: Host(`gitea.lebens-home.net`)
+            traefik.http.routers.gitea.service: gitea
+            traefik.http.services.gitea.loadbalancer.server.port: 3000
+        networks:
+            traefik: null
+        volumes:
+            - gitea_data:/data
+            - /etc/timezone:/etc/timezone:ro
+            - /etc/localtime:/etc/localtime:ro
+
+    postgresql:
+        container_name: gitea-postgresql
+        env_file:
+            - .postgresql.env
+        image: docker.io/postgres:16
+        networks:
+            traefik: null
+        volumes:
+            - postgressql:/var/lib/postgresql/data
+
+networks:
+    traefik:
+        name: traefik
+        external: true
+
+volumes:
+    postgressql:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/gitea/postgresql
+
+    gitea_data:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/gitea/data

hosts/ps10rp/homepage/Files/homepage_config/bookmarks.yaml

@@ -0,0 +1 @@
+---

hosts/ps10rp/homepage/Files/homepage_config/docker.yaml

@@ -0,0 +1,4 @@
+---
+ps10rp-docker:
+  host: homepage-dockerproxy
+  port: 2375

hosts/ps10rp/homepage/Files/homepage_config/services.yaml

@@ -0,0 +1,33 @@
+---
+- Applications:
+    - Gitea:
+        icon: gitea.png
+        description: Code repository
+        href: https://gitea.lebens-home.net
+        siteMonitor: http://gitea:3000
+        statusStyle: dot
+        server: ps10rp-docker
+        container: gitea
+    - Pi-hole:
+        icon: pi-hole.png
+        description: DNS based ad blocker
+        href: https://pihole.lebens-home.net/admin
+        siteMonitor: http://pihole:8080/admin
+        statusStyle: dot
+        server: ps10rp-docker
+        container: pihole
+        widget:
+          type: pihole
+          url: http://pihole:8080
+          key: ""
+    - Traefik:
+        icon: traefik.png
+        description: Reverse proxy
+        href: https://traefik-ps10rp.lebens-home.net/dashboard/#
+        siteMonitor: https://traefik-ps10rp.lebens-home.net/dashboard/#/
+        statusStyle: dot
+        server: ps10rp-docker
+        container: traefik
+        widget:
+          type: traefik
+          url: https://traefik-ps10rp.lebens-home.net

hosts/ps10rp/homepage/Files/homepage_config/settings.yaml

@@ -0,0 +1,9 @@
+---
+favicon: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/icon_white.png
+headerStyle: clean
+hideVersion: true
+color: slate
+background:
+  image: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/background.jpg
+theme: dark
+disableCollapse: true

hosts/ps10rp/homepage/Files/homepage_config/widgets.yaml

@@ -0,0 +1,15 @@
+---
+- logo:
+    icon: https://alexlebens-dev.nyc3.digitaloceanspaces.com/cl02do/assets/icon_white.png
+- datetime:
+    text_size: xl
+    format:
+      dateStyle: long
+      timeStyle: short
+      hour12: true
+- openmeteo:
+    label: Stacy
+    latitude: 45.398
+    longitude: -92.9874
+    units: imperial
+    cache: 5

hosts/ps10rp/homepage/docker-compose.yml

@@ -0,0 +1,56 @@
+services:
+    homepage:
+        container_name: homepage
+        image: ghcr.io/benphelps/homepage:latest
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.homepage.entrypoints: websecure
+            traefik.http.routers.homepage.rule: Host(`www.lebens-home.net`)
+            traefik.http.routers.homepage.service: homepage
+            traefik.http.services.homepage.loadbalancer.server.port: 3000
+        networks:
+            traefik: null
+        volumes:
+            - config:/app/config
+            - images:/app/public/images
+            - icons:/app/public/icons
+
+    dockerproxy:
+        container_name: homepage-dockerproxy
+        environment:
+            - CONTAINERS=1
+            - POST=0
+        image: ghcr.io/tecnativa/docker-socket-proxy:latest
+        networks:
+            traefik: null
+        privileged: true
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+
+networks:
+    traefik:
+        name: traefik
+        external: true
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/homepage/config
+
+    images:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/homepage/images
+
+    icons:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/homepage/icons

hosts/ps10rp/pihole/.env

@@ -0,0 +1,5 @@
+TZ=US/Central
+WEBPASSWORD=""
+RATE_LIMIT=0/0
+FTLCONF_MAXDBDAYS=14
+WEB_PORT=8080

hosts/ps10rp/pihole/.exporter.env

@@ -0,0 +1,6 @@
+PIHOLE_HOSTNAME=pihole
+PIHOLE_API_TOKEN=""
+PIHOLE_PROTOCOL=http
+PIHOLE_PORT=8080
+INTERVAL=90s
+PORT=9617

hosts/ps10rp/pihole/docker-compose.yml

@@ -0,0 +1,61 @@
+services:
+    pihole:
+        container_name: pihole
+        env_file:
+            - .env
+        image: docker.io/pihole/pihole:latest
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.pihole.entrypoints: websecure
+            traefik.http.routers.pihole.rule: Host(`pihole.lebens-home.net`)
+            traefik.http.routers.pihole.service: pihole
+            traefik.http.services.pihole.loadbalancer.server.port: 8080
+        networks:
+            traefik: null
+        ports:
+            - 53:53/tcp
+            - 53:53/udp
+            - 8080:8080            
+        privileged: true
+        volumes:
+            - config:/etc/pihole
+            - dnsmasq:/etc/dnsmasq.d
+            - logs:/var/log
+
+    pihole_exporter:
+        container_name: pihole-exporter
+        depends_on:
+            - pihole
+        env_file:
+            - .exporter.env
+        image: docker.io/ekofr/pihole-exporter:latest
+        networks:
+            traefik: null
+
+networks:
+    traefik:
+        name: traefik
+        external: true
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/pihole/config
+
+    dnsmasq:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/pihole/dnsmasq
+
+    logs:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/pihole/logs

hosts/ps10rp/portainer-agent/docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+    portainer:
+        container_name: portainer-agent
+        image: docker.io/portainer/agent:latest
+        ports:
+            - 9001:9001
+        privileged: true
+        volumes:
+            - /var/lib/docker/volumes:/var/lib/docker/volumes
+            - /var/run/docker.sock:/var/run/docker.sock

hosts/ps10rp/tailscale/.env

@@ -0,0 +1,4 @@
+TS_AUTHKEY=""
+TS_HOSTNAME=ps10rp
+TS_ROUTES=192.168.5.0/24
+TS_STATE_DIR=/var/lib/tailscale

hosts/ps10rp/tailscale/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+    tailscaled:
+        cap_add:
+            - NET_ADMIN
+            - NET_RAW
+        container_name: tailscaled
+        env_file:
+            - .env
+        hostname: ps10rp
+        image: docker.io/tailscale/tailscale:stable
+        network_mode: host
+        privileged: true
+        volumes:
+            - tailscale:/var/lib/tailscale
+            - /dev/net/tun:/dev/net/tun
+
+volumes:
+    tailscale:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/tailscale

hosts/ps10rp/traefik/.env

@@ -0,0 +1,3 @@
+CF_API_EMAIL=alexanderlebens@gmail.com
+CF_API_KEY=""
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

hosts/ps10rp/traefik/docker-compose.yaml

@@ -0,0 +1,44 @@
+services:
+    traefik:
+        command: traefik
+        container_name: traefik
+        env_file:
+            - .env
+        image: docker.io/traefik:v3.0
+        labels:
+            traefik.docker.network: traefik
+            traefik.enable: true
+            traefik.http.routers.dashboard.entrypoints: websecure
+            traefik.http.routers.dashboard.rule: (Host(`traefik-ps10rp.lebens-home.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
+            traefik.http.routers.dashboard.service: api@internal
+            traefik.http.routers.dashboard.tls: true
+            traefik.http.routers.dashboard.tls.certresolver: cloudflare
+        networks:
+            traefik: null
+        ports:
+            - 80:80
+            - 443:443
+        privileged: true
+        volumes:
+            - config:/etc/traefik
+            - log:/log
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+
+networks:
+    traefik:
+        name: traefik
+
+volumes:
+    config:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/traefik/config
+
+    log:
+        driver: local
+        driver_opts:
+            type: none
+            o: bind
+            device: /mnt/data/containers/traefik/log

hosts/ps10rp/traefik/traefik_config/conf/iplocal.yml

@@ -0,0 +1,15 @@
+http:
+  middlewares:
+    ip-local:
+      IPAllowList:
+        sourceRange:
+          - "192.168.1.1/16"
+          - "172.27.0.0/16"
+
+tcp:
+  middlewares:
+    ip-local:
+      IPAllowList:
+        sourceRange:
+          - "192.168.1.1/16"
+          - "172.27.0.0/16"

hosts/ps10rp/traefik/traefik_config/conf/metrics.yml

@@ -0,0 +1,8 @@
+http:
+  routers:
+    prometheus:
+      rule: "(Host(`traefik-ps10rp.alexlebens.net`) && Path(`/metrics`))"
+      entryPoints: websecure
+      service: prometheus@internal
+      middlewares:
+        - "ip-local@file"

hosts/ps10rp/traefik/traefik_config/traefik.yml

@@ -0,0 +1,113 @@
+################################################################
+# Global
+################################################################
+
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+
+################################################################
+# EntryPoints
+################################################################
+
+entryPoints:
+  web:
+    address: :80
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+
+  websecure:
+    address: :443
+    forwardedHeaders:
+      trustedIPs:
+        - "192.168.1.1/16"
+    proxyProtocol:
+      trustedIPs:
+        - "192.168.1.1/16"
+    http:
+      tls:
+        options: default
+        certResolver: cloudflare
+        domains:
+          - main: "*.lebens-home.net"
+            sans:
+              - "lebens-home.net"
+      middlewares:
+        - ip-local@file
+
+################################################################
+# Certificate Resolvers
+################################################################
+
+certificatesResolvers:
+  cloudflare:
+    acme:
+      email: alexanderlebens@gmail.com
+      storage: /etc/traefik/acme/acme.json
+      preferredChain: "ISRG Root X1"
+      dnsChallenge:
+        provider: cloudflare
+        delayBeforeCheck: "3"
+        resolvers:
+          - "1.1.1.1"
+          - "1.0.0.1"
+
+################################################################
+# Traefik logs
+################################################################
+
+log:
+  level: INFO
+
+################################################################
+# Access logs
+################################################################
+
+accessLog: {}
+
+################################################################
+# API and Dashboard
+################################################################
+
+api:
+  insecure: false
+  dashboard: true
+
+################################################################
+# Ping
+################################################################
+
+# ping:
+
+################################################################
+# Metrics
+################################################################
+
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+    addRoutersLabels: true
+    addServicesLabels: true
+    buckets:
+      - 0.1
+      - 0.3
+      - 1.2
+      - 5.0
+    entryPoint: websecure
+    manualRouting: true
+
+################################################################
+# Providers
+################################################################
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+
+  file:
+    directory: "/etc/traefik/conf"
+    watch: true

hosts/ps10rp/watchtower/.env

@@ -0,0 +1,5 @@
+TZ=US/Central
+WATCHTOWER_HTTP_API_METRICS=true
+WATCHTOWER_HTTP_API_TOKEN=token
+WATCHTOWER_CLEANUP=true
+WATCHTOWER_POLL_INTERVAL=3600

hosts/ps10rp/watchtower/docker-compose.yml

@@ -0,0 +1,9 @@
+services:
+    watchtower:
+        container_name: watchtower
+        env_file:
+            - .env
+        image: docker.io/containrrr/watchtower:latest
+        privileged: true
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock