added some more container services

dependent/compose.yml

@@ -12,6 +12,9 @@ volumes:
   tailscale-lib:
   redis-data:
   mysql-lib:
+  opengist-data:
+  stash-cache:
+  stash-blobs:
 secrets:
   headscale.key:
     file: ~/.podsecrets/headscale.key
@@ -23,6 +26,10 @@ secrets:
     file: ~/.podsecrets/email.pass
   redis.pass:
     file: ~/.podsecrets/redis.pass
+  aria.token:
+    file: ~/.podsecrets/aria.token
+  # opengist.secret:
+  #   file: ~/.podsecrets/opengist.secret
 
 services:
   # @NOTE https://oneuptime.com/blog/post/2026-03-18-use-podman-containers-wireguard-vpn/view
@@ -38,125 +45,42 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - /lib/modules:/lib/modules:ro
-      - ~/.wg/containerized:/config/wg-confs:Z
+      - ~/.wg/authorized_clients.d:/config/wg_confs:Z
     networks:
       - wg
     hostname: wgnet
     ports:
       - 51820:51820/udp
+      - 80:80
+      - 443:443
+      - 443:443/udp
+      - 6379:6379
+      - 3306:3306
+      - 8999:8999
+      - ${FORGEJO_SSH_PORT:-2121}:${FORGEJO_SSH_PORT:-2121}
+      - ${OG_SSH_PORT:-2323}:${OG_SSH_PORT:-2323}
     sysctls:
       - net.ipv4.ip_forward=1
       - net.ipv4.conf.all.src_valid_mark=1
       - net.ipv6.conf.all.forwarding=1
-      - net.ipv6.conf.all.src_valid_mark=1
+    environment:
+      PUID: 1000
+      PGID: 1000
     env_file:
-      - ~/.all.env
+      - ${HOME}/.all.env
+      - ${HOME}/.forgejo.env
+      - ${HOME}/.opengist.env
     labels:
       glance.name: Wireguard
       glance.id: wireguard
       glance.icon: "si:wireguard"
       glance.description: VPN client connection
 
-  # @NOTE https://tailscale.com/docs/features/containers/docker
-  # @NOTE https://tailscale.com/blog/docker-tailscale-guide
-  tailclient:
-    image: tailscale/tailscale:latest
-    container_name: tailclient
-    cap_add:
-      - SYS_MODULE
-      - NET_ADMIN
-    restart: unless-stopped
-    devices:
-      - /dev/net/tun:/dev/net/tun
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - /lib/modules:/lib/modules:ro
-      - "tailscale-lib:/var/lib/tailscale"
-      - ~/.config/tailscale:/config:Z
-    networks:
-      - hs
-    hostname: tailnet
-    env_file:
-      - ~/.all.env
-      - ~/.tailscale.env
-    environment:
-      TS_AUTHKEY_FILE: /run/secrets/headscale.key
-      TS_SERVE_CONFIG: /config/${TS_SERVE_CONFIG_BASENAME:?Provide a basename for the Tailscale Serve configuration file}.json
-      TS_EXTRA_ARGS: "--advertise-tags=tag:container"
-      TS_STATE_DIR: /var/lib/tailscale
-    secrets:
-        - headscale.key
-
   # @TODO make subsequent containers have 'network_mode' attrbute set to value 'service:wgclient'/'service:tailclient'
   #   OR make subsequent containers have 'networks' attribute set to list value with 'container:wgclient'/'contaner:tailclient' item
 
-  # @NOTE https://hub.docker.com/_/caddy/
-  # @NOTE https://blog.genxnotes.com/en/tech/how-to-move-the-hugo-public-folder-outside-the-project-root/
-  # @NOTE https://www.turtlestoffel.com/My-Quartz-Configuration#explorer-component-with-custom-content-folder
-  revproxy0:
-    image: caddy:latest
-    container_name: revproxy0
-    cap_add:
-      - NET_ADMIN
-    restart: unless-stopped
-    expose:
-      - 80
-      - 443
-      - 443/udp
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - ~/.config/caddy:/etc/caddy:Z
-      - ~/srv/${SERVER_FQDN}:/srv/${SERVER_FQDN}:z
-      - ~/srv/acme.${SERVER_FQDN}:/srv/acme.${SERVER_FQDN}:ro,z
-      - ~/srv/notes.${SERVER_FQDN}:/srv/notes.${SERVER_FQDN}:z
-      - ~/srv/blog.${SERVER_FQDN}:/srv/blog.${SERVER_FQDN}:z
-      - ~/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:ro,z
-      - "caddy-share:/usr/share/caddy"
-      - "caddy-data:/data:z"
-      - ~/.caddy:/config:Z
-    networks:
-      - "container:wgclient"
-    depends_on:
-      - wgclient
-    env_file:
-      - ~/.all.env
-      - ~/.nextcloud.env
-    labels:
-      glance.name: Caddy
-      glance.id: caddy
-      glance.icon: "si:caddy"
-      glance.url: "${SERVER_FQDN_SCHEME}://${SERVER_FQDN}"
-      glance.description: HTTPS reverse proxy server
-
-  # @NOTE https://github.com/nbraun1/certbot
-  sslcerts:
-    image: nbraun1/certbot
-    container_name: sslcerts
-    restart: on-failure
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - ~/.config/letsencrypt:/etc/letsencrypt:z
-      - "certbot-lib:/var/lib/letsencrypt"
-      - ~/srv/acme.${SERVER_FQDN}:/srv/acme.${SERVER_FQDN}:z
-    networks:
-      - "container:wgclient"
-    depends_on:
-      - revproxy0
-      - wgclient
-    env_file:
-      - ~/.all.env
-      - ~/.certbot.env
-    environment:
-      EMAIL: ${CERTBOT_EMAIL:?Provide an email for certificate process}
-      DOMAINS: ${CERTBOT_CHALLENGED_DOMAINS:-"${SERVER_FQDN},*.${SERVER_FQDN}"}
-      AUTHENTICATOR: ${CERTBOT_AUTHENTICATOR:?Specify preferred challenge}
-      WEBROOT_PATH: ${SERVER_WEBROOT_PATH:?Specify the web root of webserver or main web root of reverse proxy server}
-      ISSUANCE_TIMEOUT: 300
-      CRON: ${CERTBOT_CRON:Provide CRON expression for renewal purposes}
-    # entrypoint: ["certonly"]
-
   cache0:
-    image: redis:trixie
+    image: docker.io/redis:trixie
     container_name: cache0
     restart: unless-stopped
     expose:
@@ -164,14 +88,11 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - "redis-data:/data:z"
-      - ~/.config/redis:/etc/redis:Z
+    network_mode: "container:wgclient"
-    networks:
-      - "container:wgclient"
-    depends_on:
-      - wgclient
     env_file:
-      - ~/.all.env
+      - ${HOME}/.all.env
-    entrypoint: ["redis-server", "--save 60 1", "--loglevel warning", "/etc/redis/redis.conf"]
+    environment:
+      REDIS_ARGS: ${REDIS_PARAMS}
     labels:
       glance.name: Redis
       glance.id: redis
@@ -180,7 +101,7 @@ services:
 
   # @NOTE https://hub.docker.com/_/mysql
   db0:
-    image: mysql:lts
+    image: docker.io/mysql:lts
     container_name: db0
     restart: unless-stopped
     expose:
@@ -189,15 +110,12 @@ services:
       - /etc/localtime:/etc/localtime:ro
       # @TODO use Ansible to adjust/edit configuration below
       # @NOTE https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html
-      - ~/.config/mysql/sql.cnf:/etc/my.cnf:Z
+      - ~/.config/mysql:/etc/mysql/conf.d:Z
       - mysql-lib:/var/lib/mysql
-    networks:
+    network_mode: "container:wgclient"
-      - "container:wgclient"
-    depends_on:
-      - wgclient
     env_file:
-      - ~/.all.env
+      - ${HOME}/.all.env
-      - ~/.mysql.env
+      - ${HOME}/.mysql.env
     environment:
       MYSQL_ROOT_PASSWORD_FILE: /run/secrets/root-mysql.pass
       MYSQL_USER: ${MYSQL_DB_USER:-admin}
@@ -216,7 +134,7 @@ services:
 
   # @NOTE https://hub.docker.com/_/nextcloud
   cloud:
-    image: nextcloud:stable-fpm
+    image: docker.io/nextcloud:stable-fpm
     container_name: cloud
     restart: unless-stopped
     expose:
@@ -224,40 +142,34 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - ~/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:/var/www/html:z
-    networks:
+    network_mode: "container:wgclient"
-      - "container:wgclient"
-    depends_on:
-      - cache0
-      - db0
-      - revproxy0
-      - wgclient
     env_file:
-      - ~/.all.env
+      - ${HOME}/.all.env
-      - ~/.email.env
+      - ${HOME}/.email.env
-      - ~/.mysql.env
+      - ${HOME}/.mysql.env
-      - ~/.nextcloud.env
+      - ${HOME}/.nextcloud.env
     environment:
       REDIS_HOST: cache0
       REDIS_HOST_PASSWORD_FILE: /run/secrets/redis.pass
-      MYSQL_HOST: "${MYSQL_DB_HOST:?Enter the container name, hostname or public FQDN of your DBMS}:3306"
+      MYSQL_HOST: "${MYSQL_DB_HOST}:3306"
       MYSQL_DATABASE: ${NEXTCLOUD_DB_NAME:-nextcloud}
       MYSQL_USER: ${MYSQL_DB_USER:-admin}
       MYSQL_PASSWORD_FILE: /run/secrets/user-mysql.pass
-      SMTP_HOST: ${EMAIL_SMTP_HOST:?Enter an SMTP host for sending adminstrative emails}
+      SMTP_HOST: ${EMAIL_SMTP_HOST}
       SMTP_PORT: ${EMAIL_SMTP_PORT:-465}
       SMTP_SECURE: ${EMAIL_SMTP_SECURE:-ssl}
       SMTP_AUTHTYPE: ${EMAIL_SMTP_AUTHTYPE:-LOGIN}
-      SMTP_NAME: ${EMAIL_SMTP_USERNAME:?Enter the email handle for loggng in to email server}
+      SMTP_NAME: ${EMAIL_SMTP_USERNAME}
       SMTP_PASSWORD_FILE: /run/secrets/email.pass
       MAIL_FROM_ADDRESS: ${EMAIL_SMTP_USER_ALIAS:-admin}
-      MAIL_DOMAIN: ${EMAIL_SMTP_EMAIL_ALIAS:?Enter the hostname or public FQDN of your email handle}
+      MAIL_DOMAIN: ${EMAIL_SMTP_EMAIL_ALIAS}
       # @NOTE https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html
       APACHE_DISABLE_REWRITE_IP: ${NEXTCLOUD_APACHE_DISABLE_REWRITE_IP:-1}
-      TRUSTED_PROXIES: ${NEXTCLOUD_TRUSTED_PROXIES:?Enter space-separated list of trusted proxy addresses}
+      TRUSTED_PROXIES: ${NEXTCLOUD_TRUSTED_PROXIES}
       NEXTCLOUD_TRUSTED_DOMAINS: ${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}
       # OVERWRITEHOST: ${NEXTCLOUD_HOST_REWRITE:?Enter the hostname or public FQDN for this server}
-      OVERWRITECLIURL: ${NEXTCLOUD_URL_REWRITE:?Enter the hostname or public FQDN with correspondent prefixd URL scheme for this server}
+      OVERWRITECLIURL: ${NEXTCLOUD_URL_REWRITE}
-      OVERWRITEPROTOCOL: ${NEXTCLOUD_PROTOCOL_REWRITE:?Enter the URL scheme protocol preferred}
+      OVERWRITEPROTOCOL: ${NEXTCLOUD_PROTOCOL_REWRITE}
     secrets:
         - "user-mysql.pass"
         - email.pass
@@ -274,115 +186,523 @@ services:
   # @NOTE https://docs.gitea.com/administration/reverse-proxies
   # @NOTE https://docs.gitea.com/administration/config-cheat-sheet
   forge:
-    image: docker.gitea.com/gitea:1.26.4
+    image: codeberg.org/forgejo/forgejo:16
     container_name: forge
     restart: unless-stopped
     volumes:
-      - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
-      - ~/.config/gitea:/data:z
+      - ~/.config/forgejo:/data:z
     expose:
       - 3000
-      - ${GITEA_SSH_PORT:-2222}
+      - ${FORGEJO_SSH_PORT:-2121}
-    networks:
+    network_mode: "container:wgclient"
-      - "container:wgclient"
-    depends_on:
-      - db0
-      - revproxy0
-      - wgclient
     env_file:
-      - ~/.all.env
+      - ${HOME}/.all.env
-      - ~/.email.env
+      - ${HOME}/.email.env
-      - ~/.mysql.env
+      - ${HOME}/.mysql.env
-      - ~/.gitea.env
+      - ${HOME}/.forgejo.env
     environment:
-      GITEA_DEFAULT_RUN_USER: ${GITEA_MODE:-dev}
+      USER_UID: 1000
-      GITEA_DEFAULT_APP_NAME: ${GITEA_NAME:?Enter a name or title for Gitea website}
+      USER_GID: 1000
-      GITEA_server_PROTOCOL: http
+      FORGEJO__RUN_USER: ${FORGEJO_MODE:-dev}
-      GITEA_server_DOMAIN: ${GITEA_SUBDOMAIN}.${SERVER_FQDN}
+      FORGEJO__APP_NAME: ${FORGEJO_NAME}
+      FORGEJO__APP_SLOGAN: ${FORGEJO_SLOGAN}
+      FORGEJO__ui.meta_AUTHOR: ${SERVER_FQDN%.*}
+      FORGEJO__ui.meta_DESCRIPTION: ${FORGEJO_DESC}
+      FORGEJO__server_PROTOCOL: ${FORGEJO_PROTOCOL}
+      FORGEJO__server_DOMAIN: ${FORGEJO_SUBDOMAIN}.${SERVER_FQDN}
       # @NOTE https://gist.github.com/erik-toth/087262f19941da9bf4c2ce449fe98a47
-      GITEA_server_SSH_PORT: ${GITEA_SSH_PORT:-2222}
+      FORGEJO__server_SSH_PORT: ${FORGEJO_SSH_PORT:-2323}
-      GITEA_server_SSH_EXPOSE_ANONYMOUS: "false"
+      FORGEJO__server_SSH_EXPOSE_ANONYMOUS: false
-      GITEA_server_START_SSH_SERVER: "false"
+      FORGEJO__server_START_SSH_SERVER: false
-      GITEA_server_LANDING_PAGE: ${GITEA_LANDING:-explore}
+      FORGEJO__server_SSH_AUTHORIZED_KEYS_BACKUP: true
-      GITEA_admin_DEFAULT_EMAIL_NOTIFICATIONS: onmention
+      FORGEJO__server_LANDING_PAGE: ${FORGEJO_LANDING:-explore}
-      GITEA_security_REVERSE_PROXY_TRUSTED_PROXIES: ${GITEA_TRUSTED_PROXIES:?Enter comma-separated list of trusted proxy addresses}
+      FORGEJO__admin_DEFAULT_EMAIL_NOTIFICATIONS: onmention
-      GITEA_security_PASSWORD_COMPLEXITY: lower,upper,digit,spec
+      FORGEJO__security_REVERSE_PROXY_TRUSTED_PROXIES: ${FORGEJO_TRUSTED_PROXIES}
-      GITEA_security_PASSWORD_CHECK_PWN: "true"
+      FORGEJO__security_PASSWORD_COMPLEXITY: lower,upper,digit,spec
-      GITEA_service_REGISTER_EMAIL_CONFIRM: "true"
+      FORGEJO__security_PASSWORD_CHECK_PWN: true
-      GITEA_service_DISABLE_REGISTRATION: ${GITEA_PROHIBIT_REGISTRATION:-true}
+      FORGEJO__security_GLOBAL_TWO_FACTOR_REQUIREMENT: true
-      GITEA_service_DEFAULT_KEEP_EMAIL_PRIVATE: "true"
+      FORGEJO__service_REGISTER_EMAIL_CONFIRM: true
-      GITEA_service_ENABLE_NOTIFY_MAIL: "true"
+      FORGEJO__service_DEFAULT_KEEP_EMAIL_PRIVATE: true
-      GITEA_picture_REPOSITORY_AVATAR_FALLBACK: image
+      FORGEJO__service_DISABLE_REGISTRATION: ${FORGEJO_PROHIBIT_REGISTRATION:-true}
-      GITEA_picture_REPOSITORY_AVATAR_FALLBACK_IMAGE: img/repo_default.svg
+      FORGEJO__service_ENABLE_NOTIFY_MAIL: true
-      GITEA_log_MODE: file
+      FORGEJO__security_ENABLE_CAPTCHA: true
-      GITEA_log_ENABLE_SSH_LOG: "true"
+      FORGEJO__picture_REPOSITORY_AVATAR_FALLBACK: image
-      GITEA_mailer_ENABLED: "true"
+      # FORGEJO__picture_REPOSITORY_AVATAR_FALLBACK_IMAGE: img/repo_default.svg
-      GITEA_mailer_PROTOCOL: ${EMAIL_SEND_PROTOCOL:-smtp}s
+      FORGEJO__picture_ENABLE_FEDERATED_AVATAR: true
-      GITEA_mailer_SMTP_ADDR: ${EMAIL_SMTP_HOST:?Enter an SMTP host for sending adminstrative emails}
+      FORGEJO__log_MODE: file
-      GITEA_mailer_SMTP_PORT: ${EMAIL_SMTP_PORT:-465}
+      FORGEJO__mailer_ENABLED: true
-      GITEA_mailer_USER: ${EMAIL_SMTP_USERNAME:?Enter the email handle for loggng in to email server}
+      FORGEJO__mailer_PROTOCOL: ${EMAIL_SEND_PROTOCOL:-smtp}s
-      GITEA_mailer_PASSWD_FILE: /run/secrets/email.pass
+      FORGEJO__mailer_SMTP_ADDR: ${EMAIL_SMTP_HOST}
-      GITEA_mailer_FROM: ${EMAIL_SMTP_USER_ALIAS:-admin}@${EMAIL_SMTP_EMAIL_ALIAS:?Enter the hostname or public FQDN of your email handle}
+      FORGEJO__mailer_SMTP_PORT: ${EMAIL_SMTP_PORT:-465}
-      GITEA_database_DB_TYPE: ${GITEA_DB_TYPE:-mysql}
+      FORGEJO__mailer_USER: ${EMAIL_SMTP_USERNAME}
-      GITEA_database_HOST: "${MYSQL_DB_HOST:?Enter the container name, hostname or public FQDN of your DBMS}:3306"
+      FORGEJO__mailer_PASSWD_URI: file:/run/secrets/email.pass
-      GITEA_database_NAME: ${GITEA_DB_NAME:-gitea}
+      FORGEJO__mailer_FROM: "\"${SERVER_FQDN%.*} Administrator\" <${EMAIL_SMTP_USER_ALIAS:-admin}@${EMAIL_SMTP_EMAIL_ALIAS}>"
-      GITEA_database_USER: ${MYSQL_DB_USER:-admin}
+      FORGEJO__database_DB_TYPE: ${FORGEJO_DB_TYPE:-mysql}
-      GITEA_database_PASSWD_FILE: /run/secrets/user-mysql.pass 
+      FORGEJO__database_HOST: "${MYSQL_DB_HOST}:3306"
-      GITEA_repository_DEFAULT_BRANCH: main
+      FORGEJO__database_NAME: ${FORGEJO_DB_NAME:-forgejo}
-      GITEA_repository_DEFAULT_PRIVATE: private
+      FORGEJO__database_USER: ${MYSQL_DB_USER:-admin}
-      GITEA_repository_ORG_MAX_CREATION_LIMIT: 75
+      FORGEJO__database_PASSWD_URI: file:/run/secrets/user-mysql.pass
-      GITEA_repository_ENABLE_PUSH_CREATE_USER: "true"
+      FORGEJO__repository_DEFAULT_BRANCH: main
-      GITEA_repository_DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH: "true"
+      FORGEJO__repository_DEFAULT_PRIVATE: private
-      GITEA_repository.issue_MAX_PINNED: 6
+      FORGEJO__repository_ENABLE_PUSH_CREATE_USER: true
-      GITEA_federation_ENABLED: "true"
+      FORGEJO__repository_DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH: true
+      FORGEJO__repository.issue_MAX_PINNED: 6
+      FORGEJO__repository.issue_LOCK_REASON: ${FORGEJO_LOCK_REASONS}
+      FORGEJO__federation_ENABLED: true
+      FORGEJO__cors_ENABLED: true
+      FORGEJO__cors_ALLOW_DOMAIN: "${FORGEJO_PROTOCOL}://${SERVER_FQDN} ${FORGEJO_PROTOCOL}://${OG_SUBDOMAIN}.${SERVER_FQDN}"
+      FORGEJO__cors_ALLOW_CREDENTIALS: true
+      FORGEJO__ui_SHOW_USER_EMAIL: false
+      FORGEJO__ui_ONLY_SHOW_RELEVANT_REPOS: true
+      FORGEJO__project_PROJECT_BOARD_BASIC_KANBAN_TYPE: ${FORGEJO_KANBAN_COLUMNS}
+      FORGEJO__project_PROJECT_BOARD_BUG_TRIAGE_TYPE: ${FORGEJO_TRIAGE_CATEGORIES}
+      FORGEJO__migrations_ALLOW_DOMAINS: "*.${SERVER_FQDN},*.bebopfederation.org,github.com,*.github.com,gitlab.com,*.gitlab.com,codeberg.org,*.codeberg.org,sr.ht,*.sr.ht"
+      FORGEJO__moderation_ENABLED: true
+      FORGEJO__repository.editor_LINE_WRAP_EXTENSIONS: .txt,.md,.markdown,.mdown,.mkd,.livemd
     secrets:
       - "user-mysql.pass"
       - email.pass
     labels:
-      glance.name: Gitea
+      glance.name: ForgeJO
-      glance.id: gitea
+      glance.id: forgejo
-      glance.icon: "si:gitea"
+      glance.icon: "si:forgejo"
-      glance.url: "${SERVER_FQDN_SCHEME}://${GITEA_SUBDOMAIN}.${SERVER_FQDN}"
+      glance.url: "${SERVER_FQDN_SCHEME}://${FORGEJO_SUBDOMAIN}.${SERVER_FQDN}"
       glance.description: Git version control forge server
 
-  glance:
+  gist:
-    image: glanceapp/glance
+    image: ghcr.io/thomiceli/opengist:1
-    container_name: glance
+    container_name: gist
     restart: unless-stopped
-    expose:
-      - 8181
     volumes:
       - /etc/localtime:/etc/localtime:ro
-      # Optionally, also mount docker socket if you want to use the docker containers widget
+      - opengist-data:/opengist:z
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+    expose:
+      - 6157
+      - ${OG_SSH_PORT:-2323}
+    network_mode: "container:wgclient"
+    env_file:
+      - ${HOME}/.all.env
+      - ${HOME}/.opengist.env
+      - ${HOME}/.mysql.env
+    environment:
+      OG_OPENGIST_HOME: /opengist
+      OG_LOG_OUTPUT: file
+      OG_GIT_DEFAULT_BRANCH: main
+      OG_HTTP_GIT_ENABLED: true
+      OG_EXTERNAL_URL: "${SERVER_FQDN_SCHEME}://${OG_SUBDOMAIN}.${SERVER_FQDN}"
+      OG_CUSTOM_NAME: ${OG_NAME}
+    secrets:
+      - "user-mysql.pass"
+      # - opengist.secret
+    labels:
+      glance.name: OpenGist
+      glance.id: opengist
+      glance.icon: "si:opengist"
+      glance.url: "${SERVER_FQDN_SCHEME}://${OG_SUBDOMAIN}.${SERVER_FQDN}"
+      glance.description: Pastebin server
+
+  # @TODO below in need of skato-ansible integration
+  forum:
+    # build: ../builds/nodebb
+    image: ghcr.io/nodebb/nodebb:latest
+    container_name: forum
+    restart: unless-stopped
+    expose:
+      - 4567
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/nodebb:/opt/config:Z
+      - ~/.local/nodebb:/usr/src/app:z # @NOTE where setup.json for nodeBB goes
+    env_file:
+      - ${HOME}/.all.env
+    labels:
+      glance.name: NodeBB
+      glance.id: nodebb
+      glance.icon: "si:nodebb"
+      glance.url: "${SERVER_FQDN_SCHEME}://${NODEBB_SUBDOMAIN}.${SERVER_FQDN}"
+      glance.description: Synchronized video playback server
+
+  # @NOTE https://hub.docker.com/_/caddy/
+  # @NOTE https://blog.genxnotes.com/en/tech/how-to-move-the-hugo-public-folder-outside-the-project-root/
+  # @NOTE https://www.turtlestoffel.com/My-Quartz-Configuration#explorer-component-with-custom-content-folder
+  revproxy0:
+    image: docker.io/caddy:latest
+    container_name: revproxy0
+    cap_add:
+      - NET_ADMIN
+    restart: unless-stopped
+    expose:
+      - 80
+      - 443
+      - 443/udp
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/caddy:/etc/caddy:Z
+      - ~/srv/${SERVER_FQDN}:/srv/${SERVER_FQDN}:z
+      - ~/srv/notes.${SERVER_FQDN}:/srv/notes.${SERVER_FQDN}:z
+      - ~/srv/blog.${SERVER_FQDN}:/srv/blog.${SERVER_FQDN}:z
+      - ~/srv/certbot.${SERVER_FQDN}:/srv/certbot.${SERVER_FQDN}:ro,z
+      - ~/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:z
+      - "caddy-share:/usr/share/caddy"
+      - "caddy-data:/data"
+      - ~/.caddy:/config:Z
+    volumes_from:
+      - cloud:ro
+    network_mode: "container:wgclient"
+    env_file:
+      - ${HOME}/.all.env
+    labels:
+      glance.name: Caddy
+      glance.id: caddy
+      glance.icon: "si:caddy"
+      glance.url: "${SERVER_FQDN_SCHEME}://${SERVER_FQDN}"
+      glance.description: HTTPS reverse proxy server
+
+  # @NOTE https://github.com/nbraun1/certbot
+  sslcerts:
+    image: docker.io/nbraun1/certbot:v1.2.0
+    container_name: sslcerts
+    restart: on-failure
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/letsencrypt:/etc/letsencrypt:z
+      - "certbot-lib:/var/lib/letsencrypt"
+    volumes_from:
+      - revproxy0:rw
+    network_mode: "container:wgclient"
+    env_file:
+      - ${HOME}/.all.env
+      - ${HOME}/.certbot.env
+    environment:
+      EMAIL: ${CERTBOT_EMAIL}
+      DOMAINS: ${CERTBOT_CHALLENGED_DOMAINS:-"${SERVER_FQDN},*.${SERVER_FQDN}"}
+      AUTHENTICATOR: ${CERTBOT_AUTHENTICATOR}
+      WEBROOT_PATH: ${SERVER_WEBROOT_PATH}
+      ISSUANCE_TIMEOUT: 300
+      CRON: ${CERTBOT_CRON}
+    # entrypoint: ["certonly"]
+
+  # @TODO all below until tailclient in need of skato-ansible integration
+  syncplay:
+    image: docker.io/dnomd343/syncplay:latest
+    container_name: syncplay
+    restart: always
+    expose:
+      - 8999
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/letsencrypt:/certs:z
+      - ~/.config/syncplay:/data:Z
+    network_mode: "container:wgclient"
+    env_file:
+      - ${HOME}/.all.env
+      - ${HOME}/.syncplay.env
+    environment:
+      PASSWORD: ${SYNCPLAY_PASSWORD}
+      MOTD: ${SYNCPLAY_MOTD}
+      SALT: ${SYNCPLAY_SALT}
+      PERSISTENT: ON
+      ENABLE_TLS: ${SYNCPLAY_TLS}
+      PERMANENT_ROOMS: "seasonal_live-action seasonal_anime annual_features shorts"
+      LISTEN_IPV4: "127.0.0.1"
+      LISTEN_IPV6: "::1"
+    labels:
+      glance.name: SyncPlay
+      glance.id: syncplay
+      glance.icon: "si:syncplay"
+      glance.url: "${SERVER_FQDN_SCHEME}://${SYNCPLAY_SUBDOMAIN}.${SERVER_FQDN}"
+      glance.description: Synchronized video playback server
+
+  # @NOTE https://tailscale.com/docs/features/containers/docker
+  # @NOTE https://tailscale.com/blog/docker-tailscale-guide
+  tailclient:
+    image: docker.io/tailscale/tailscale:latest
+    container_name: tailclient
+    cap_add:
+      - SYS_MODULE
+      - NET_ADMIN
+    restart: unless-stopped
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    ports:
+      - 8080:8080
+      - 1700:1700
+      - 6800:6800
+      - 6940:6940
+      - 6940:6940/udp
+      - 6880:6880
+      - 5050:5050
+      - 5030:5030
+      - 50300:50300
+      - 9283:80
+      - 5000:5000
+      # - ${STASH_LISTEN_PORT:-9999}:${STASH_LISTEN_PORT:-9999}
+      # - ${ACTUAL_LISTEN_PORT:-5006}:${ACTUAL_LISTEN_PORT:-5006}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /lib/modules:/lib/modules:ro
+      - "tailscale-lib:/var/lib/tailscale"
+      - ~/.config/tailscale:/config:Z
+    networks:
+      - hs
+    hostname: tailnet
+    env_file:
+      - ${HOME}/.all.env
+      # - ${HOME}/.actual.env
+      # - ${HOME}/.stash.env
+      # - ${HOME}/.tailscale.env
+    environment:
+      TS_AUTHKEY_FILE: /run/secrets/headscale.key
+      TS_SERVE_CONFIG: /config/conf.json
+      TS_EXTRA_ARGS: "--advertise-tags=tag:container"
+      TS_STATE_DIR: /var/lib/tailscale
+    secrets:
+        - headscale.key
+
+  dash:
+    image: docker.io/glanceapp/glance:latest
+    container_name: dash
+    restart: unless-stopped
+    expose:
+      - 8080
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
       # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance
       - ~/.config/glance:/app/config:Z # @NOTE internal container server port is changed via 'glance.yml' config file; default is 8080
       - ~/.local/glance:/app/assets:Z
-    networks:
+    network_mode: "container:tailclient"
-      - "container:tailclient"
-    depends_on:
-      - tailclient
     # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#environment-variables
-    environment:
-      PORT: ${GLANCE_PORT:-8181}
     labels:
       glance.name: Self
       glance.id: self
       glance.icon: "si:glance"
-      glance.url: "${SERVER_MAGICDN_SCHEME}://${SERVER_MAGICDN}"
+      # glance.url: "${SERVER_MAGICDN_SCHEME}://${SERVER_MAGICDN}"
       glance.description: Dashboard
 
+  surge:
+    image: ghcr.io/surgedm/surge
+    container_name: surge
+    restart: unless-stopped
+    user: "${UID:-1000}:${GID:-1000}"
+    expose:
+      - 1700
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.local/surge:/root/.local/state/surge:Z # token file goes in here
+      - ~/downloads:/downloads:z
+      - ~/media:/media:z
+      - ~/.xxx:/.xxx:z
+    network_mode: "container:tailclient"
+    labels:
+      glance.name: SurgeDM
+      glance.id: surge
+      glance.description: Download manager
+    logging:
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  aria:
+    image: docker.io/p3terx/aria2-pro:latest
+    container_name: aria
+    restart: unless-stopped
+    expose:
+      - ${ARIA_RPC_LISTEN_PORT:-6800}
+      - ${ARIA_TRNT_LISTEN_PORT:-6940}
+      - ${ARIA_TRNT_LISTEN_PORT:-6940}/udp
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.aria2:/config:Z
+      - ~/downloads:/downloads:z
+      - ~/media:/media:z
+      - ~/.xxx:/.xxx:z
+    network_mode: "container:tailclient"
+    env_file:
+      - ${HOME}/.aria.env
+    environment:
+      PUID: 1000
+      PGID: 1000
+      # UMASK_SET: 022
+      # RPC_PORT: ${ARIA_RPC_LISTEN_PORT:-6800}
+      # RPC_SECRET_FILE: /run/secrets/aria.token
+      # LISTEN_PORT: ${ARIA_TRNT_LISTEN_PORT:-6940}
+    labels:
+      glance.name: Aria2
+      glance.id: aria
+      glance.description: Download manager
+    logging:
+      options:
+        max-size: "1m"
+  
+  ariang:
+    image: docker.io/p3terx/ariang:latest
+    container_name: ariang
+    restart: unless-stopped
+    expose:
+      - 6880
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+    network_mode: "container:tailclient"
+    labels:
+      glance.name: AriaNG
+      glance.id: ariang
+      glance.description: Aria Web UI
+    logging:
+      options:
+        max-size: "1m"
+
+  flexget:
+    image: docker.io/flexget/flexget:latest
+    container_name: flexget
+    expose:
+      - 5050
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.flexget:/config:Z
+      - ~/downloads:/downloads:z
+      - ~/media:/media:z
+      - ~/.xxx:/.xxx:z
+    network_mode: "container:tailclient"
+    labels:
+      glance.name: FlexGet
+      glance.id: flexget
+      glance.description: Download automator
+    command:
+      - daemon
+      - start
+      - "--autoreload-config"
+
+  soulseek:
+    image: docker.io/slskd/slskd:latest
+    container_name: soulseek
+    restart: unless-stopped
+    expose:
+      - 5030
+      - 50300
+    network_mode: "container:tailclient"
+    environment:
+      SLSKD_REMOTE_CONFIGURATION: true
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.local/slskd:/app:Z
+      - ~/downloads:/downloads:z
+      - ~/media:/media:z
+      - ~/.xxx:/.xxx:z
+    labels:
+      glance.name: SoulSeek
+      glance.id: soulseek
+      glance.description: File-sharing client
+
+  # @TODO all below in need of skato-ansible integration
+  grocy:
+    image: lscr.io/linuxserver/grocy:latest
+    container_name: grocy
+    restart: unless-stopped
+    expose:
+      - 80 # 9283
+    network_mode: "container:tailclient"
+    environment:
+      PUID: 1000
+      PGID: 1000
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/grocy:/config:Z
+    labels:
+      glance.name: Grocy
+      glance.id: grocy
+      glance.description: Home economy manager
+
+  budget:
+    image: docker.io/actualbudget/actual-server:latest
+    container_name: budget
+    restart: unless-stopped
+    expose:
+      - ${ACTUAL_LISTEN_PORT:-5006}
+    network_mode: "container:tailclient"
+    env_file:
+      - ${HOME}/.actual.env
+    environment:
+      # ACTUAL_HTTPS_KEY: /data/selfhost.key
+      # ACTUAL_HTTPS_CERT: /data/selfhost.crt
+      ACTUAL_PORT: ${ACTUAL_LISTEN_PORT:-5006}
+      # ACTUAL_UPLOAD_FILE_SYNC_SIZE_LIMIT_MB: 20
+      # ACTUAL_UPLOAD_SYNC_ENCRYPTED_FILE_SYNC_SIZE_LIMIT_MB: 50
+      # ACTUAL_UPLOAD_FILE_SIZE_LIMIT_MB: 20
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.local/actual:/data:Z
+    labels:
+      glance.name: Actual
+      glance.id: actual
+      glance.description: Financial budgeting server
+
+  reader:
+    image: docker.io/jvmilazz0/kavita:latest
+    container_name: reader
+    restart: unless-stopped
+    expose:
+      - 5000
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/downloads:/downloads:z,ro
+      - ~/media:/media:z,ro
+      - ~/.xxx:/.xxx:z,ro
+      - ~/.config/kavita:/kavita
+    labels:
+      glance.name: Kavita
+      glance.id: kavita
+      glance.description: Ebook catalogue and reader
+
+  stash:
+    image: docker.io/stashapp/stash:latest
+    container_name: stash
+    restart: unless-stopped
+    expose:
+      - ${STASH_LISTEN_PORT:-9999}
+    network_mode: "container:tailclient"
+    logging:
+      driver: "json-file"
+      options:
+        max-file: "10"
+        max-size: "2m"
+    env_file:
+      - ${HOME}/.stash.env
+    environment:
+      - STASH_STASH=/data/
+      - STASH_GENERATED=/generated/
+      - STASH_METADATA=/metadata/
+      - STASH_CACHE=/cache/
+      - STASH_PORT=${STASH_LISTEN_PORT:-9999}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ~/.config/stash:/root/.stash:Z
+      - ~/.xxx:/data:z,ro
+      - ~/downloads:/downloads:z,ro
+      - ~/.local/stash/metadata:/metadata:z
+      - ~/.local/stash/generated:/generated:Z
+      - stash-cache:/cache:Z
+      - stash-blobs:/blobs:Z
+    labels:
+      glance.name: Stash
+      glance.id: stash
+      glance.description: NSFW media streamer
+
 # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#docker-containers
 # @TODO apply labels to each container that allows it to show up in Glance dashboard
 
 # @NOTE The following is a list of additional public-facing container services to add
-# - https://opengist.io/, https://opengist.io/docs/installation/docker.html
+# - http://www.proftpd.org/, https://hub.docker.com/r/instantlinux/proftpd
+# - https://burp.grke.org/, https://hub.docker.com/r/pschiffe/burp-server
+# - https://rsync.samba.org/, https://hub.docker.com/r/vimagick/rsyncd
 # - https://shlink.io/, https://shlink.io/documentation/install-docker-image/
 # - https://www.funkwhale.audio/, https://docs.funkwhale.audio/administrator/installation/docker.html
 # - https://join-lemmy.org/, https://join-lemmy.org/docs/administration/install_docker.html
+# - https://nodebb.org/, https://docs.nodebb.org/installing/cloud/docker/
 # - https://joinbookwyrm.com/, https://docs.joinbookwyrm.com/install-prod.html
+# - https://github.com/FuzzyGrim/Yamtrack
 # - https://misskey-hub.net/en/, https://misskey-hub.net/en/docs/for-admin/install/guides/docker/
+# - https://akkoma.social/, https://docs.akkoma.dev/stable/
 # - https://hub.docker.com/r/instantlinux/proftpd
 # - https://prosody.im/, https://prosody.im/download/
 # - https://element-hq.github.io/synapse/latest/setup/installation.html
@@ -390,8 +710,17 @@ services:
 # - https://hub.docker.com/r/dnomd343/syncplay
 # - https://hub.docker.com/r/p3terx/aria2-pro
 # - https://github.com/SurgeDM/Surge#5-server-mode-with-docker-compose
+# - https://www.bookstackapp.com/, https://www.bookstackapp.com/docs/admin/installation/#docker
+# - https://moodle.org/
+# - https://asciinema.org/
+# - https://isso-comments.de/
+# - https://shibumi.dev/posts/how-to-setup-your-own-wkd-server/
+# - https://dario.griffo.io/posts/ultimate-guide-debian-repository-hosting/
+# - https://gitlab.com/fdroid/docker-executable-fdroidserver
+# - https://papis.readthedocs.io/en/latest/, https://github.com/papis/papis
 
 # @NOTE The following is a list of additional private container services to add
+# - https://www.keycloak.org/, https://www.keycloak.org/server/containers
 # - https://tasktrove.io/, https://docs.tasktrove.io/installation#option-2-docker-compose
 # - https://github.com/dohsimpson/HabitTrove, https://github.com/dohsimpson/HabitTrove#docker-deployment
 # - https://grocy.info/, https://hub.docker.com/r/linuxserver/grocy
@@ -400,7 +729,14 @@ services:
 # - https://sugoi.gitbook.io/lanraragi, https://sugoi.gitbook.io/lanraragi/installing-lanraragi/docker
 # - https://komga.org/, https://komga.org/docs/installation/docker
 # - https://github.com/janeczku/calibre-web, https://hub.docker.com/r/linuxserver/calibre-web
+# - https://www.kavitareader.com/, https://wiki.kavitareader.com/installation/docker/
 # - https://immich.app/, https://docs.immich.app/install/docker-compose
 # - https://papra.app/en/, https://docs.papra.app/self-hosting/using-docker-compose/
 # - https://stashapp.cc/, https://docs.stashapp.cc/installation/docker/
+# - https://droposs.org/, https://droposs.org/docs/admin/quickstart/
 # - https://jellyfin.org/, https://jellyfin.org/docs/general/installation/container
+# - https://docs.paperless-ngx.com/, https://docs.paperless-ngx.com/setup/#docker
+# - https://atomicserver.eu/, https://docs.atomicdata.dev/atomic-data-overview
+# - https://github.com/sassanix/warracker
+# - https://github.com/cmintey/wishlist
+# - https://ghostfolio.com