commit 937d76305bd9dbb2e27431f9f16596de31f3764d
parent de48a8332122d81b663a37c60d97d915e88ff1af
Author: Jack Sangdahl <jack@pngu.org>
Date: Thu, 6 Nov 2025 11:48:43 -0700
Migrate away from host Caddy configuration to shared network, cgit container
Diffstat:
15 files changed, 159 insertions(+), 82 deletions(-)
diff --git a/agendav/compose.yaml b/agendav/compose.yaml
@@ -3,14 +3,18 @@ services:
image: ghcr.io/nagimov/agendav-docker:latest
container_name: agendav
restart: unless-stopped
- ports:
- - 11006:8080
environment:
AGENDAV_SERVER_NAME: localhost
AGENDAV_TITLE: calendar
AGENDAV_FOOTER: hosted by pngu.org
- AGENDAV_CALDAV_SERVER: https://baikal.pngu.org/dav.php
+ AGENDAV_CALDAV_SERVER: https://baikal.pngu.org/cal.php
AGENDAV_CALDAV_PUBLIC_URL: https://baikal.pngu.org
AGENDAV_TIMEZONE: America/Denver
AGENDAV_LANG: en
AGENDAV_LOG_DIR: /tmp/
+ networks:
+ - caddybridge
+
+networks:
+ caddybridge:
+ external: true
diff --git a/baikal/compose.yaml b/baikal/compose.yaml
@@ -3,13 +3,14 @@ services:
image: ckulka/baikal:nginx
container_name: baikal
restart: unless-stopped
- ports:
- - 11002:80
depends_on:
- db
volumes:
- config:/var/www/baikal/config
- data:/var/www/baikal/Specific
+ networks:
+ - caddybridge
+ - baikal_dbnet
db:
image: mariadb
@@ -23,8 +24,16 @@ services:
MARIADB_PASSWORD: ${MARIADB_PASSWORD}
volumes:
- db:/var/lib/mysql
+ networks:
+ - baikal_dbnet
volumes:
config:
data:
db:
+
+networks:
+ caddybridge:
+ external: true
+ baikal_dbnet:
+ internal: true
diff --git a/caddy/Caddyfile b/caddy/Caddyfile
@@ -1,5 +1,9 @@
{
email jack@pngu.org
+ servers {
+ trusted_proxies static 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22 103.31.4.0/22 141.101.64.0/18 108.162.192.0/18 190.93.240.0/20 188.114.96.0/20 197.234.240.0/22 198.41.128.0/17 162.158.0.0/15 104.16.0.0/13 104.24.0.0/14 172.64.0.0/13 131.0.72.0/22 2400:cb00::/32 2606:4700::/32 2803:f800::/32 2405:b500::/32 2405:8100::/32 2a06:98c0::/29 2c0f:f248::/32
+ client_ip_headers CF-Connecting-IP
+ }
}
www.pngu.org, pngu.org {
@@ -16,49 +20,46 @@ www.pngu.org, pngu.org {
}
vault.pngu.org {
- encode zstd gzip
- reverse_proxy 172.17.0.1:11001
+ encode zstd gzip
+ reverse_proxy vaultwarden:80
}
baikal.pngu.org {
encode zstd gzip
- reverse_proxy 172.17.0.1:11002
+ reverse_proxy baikal:80
}
uptime.pngu.org {
encode zstd gzip
- reverse_proxy 172.17.0.1:11003
+ reverse_proxy kuma:3001
redir / /status/default
}
+stalwart.pngu.org {
+ encode zstd gzip
+ reverse_proxy stalwart:8080
+}
+
mail.pngu.org {
encode zstd gzip
- reverse_proxy 172.17.0.1:8443
+ reverse_proxy stalwart:8443
}
webmail.pngu.org {
encode zstd gzip
- reverse_proxy 172.17.0.1:11005
+ reverse_proxy roundcube:80
}
calendar.pngu.org {
encode zstd gzip
- reverse_proxy 172.17.0.1:11006
+ reverse_proxy agendav:8080
}
git.pngu.org {
- reverse_proxy unix//run/fcgiwrap.socket {
- transport fastcgi {
- env SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi
- }
- }
- handle_path /cgit.css {
- root * /usr/share/cgit/cgit.css
- file_server
- }
- handle_path /pingu.png {
- root * /usr/share/misc_src/pingu.png
- file_server
- }
encode zstd gzip
+ reverse_proxy http://anubis:3000 {
+ header_up X-Forwarded-For {client_ip}
+ header_up X-Real-IP {client_ip}
+ header_up X-Http-Version {http.request.proto}
+ }
}
diff --git a/caddy/compose.yaml b/caddy/compose.yaml
@@ -3,16 +3,29 @@ services:
image: caddy:latest
container_name: caddy
restart: unless-stopped
- network_mode: host
+ ports:
+ - 80:80
+ - 443:443
volumes:
- - Caddyfile:/etc/caddy/Caddyfile
- - site:/srv
- - data:/data
- - config:/config
- - /run/fcgiwrap.socket:/run/fcgiwrap.socket
- - /usr/share/cgit:/usr/share/cgit
- - /usr/share/misc_src:/usr/share/misc_src
+ - ./Caddyfile:/etc/caddy/Caddyfile
+ - ./site:/srv
+ - ./data:/data
+ - ./config:/config
+ networks:
+ - caddybridge
-volumes:
- data:
- config:
+ anubis:
+ image: ghcr.io/techarohq/anubis:latest
+ container_name: anubis
+ restart: unless-stopped
+ environment:
+ BIND: ":3000"
+ SERVE_ROBOTS_TXT: true
+ DIFFICULTY: 4
+ TARGET: http://cgit:80
+ networks:
+ - caddybridge
+
+networks:
+ caddybridge:
+ external: true
diff --git a/cgit/Dockerfile b/cgit/Dockerfile
@@ -0,0 +1,3 @@
+FROM woahbase/alpine-cgit:latest
+
+RUN apk add --no-cache py3-pygments highlight
diff --git a/cgit/cgitrc b/cgit/cgitrc
@@ -1,9 +1,9 @@
# cgit config
+virtual-root=/
cache-root=/var/cache/cgit
-css=/cgit.css
logo=/pingu.png
+favicon=/pingu.ico
logo-link=https://github.com/waffle87
-virtual-root=/
source-filter=/usr/lib/cgit/filters/syntax-highlighting.sh
about-filter=/usr/lib/cgit/filters/about-formatting.sh
remove-suffix=1
@@ -15,7 +15,6 @@ enable-log-filecount=1
enable-log-linecount=1
enable-remote-branches=1
enable-git-config=1
-footer=none
branch-sort=age
root-title=jack's git repositories
root-desc=mirrored to github.com/waffle87
diff --git a/cgit/cgitrepos b/cgit/cgitrepos
@@ -1,75 +1,79 @@
repo.url=aoc
-repo.path=/var/lib/git/repositories/aoc.git
+repo.path=/repositories/aoc.git
repo.desc=Advent of Code
repo.url=chipdev
-repo.path=/var/lib/git/repositories/chipdev.git
+repo.path=/repositories/chipdev.git
repo.desc=chipdev.io Solutions (0x6A73)
repo.url=cryptopals
-repo.path=/var/lib/git/repositories/cryptopals.git
+repo.path=/repositories/cryptopals.git
repo.desc=Cryptopals Challenges
repo.url=csci3155
-repo.path=/var/lib/git/repositories/csci3155.git
+repo.path=/repositories/csci3155.git
repo.desc=CSCI3155 Coursework
repo.url=csci3753
-repo.path=/var/lib/git/repositories/csci3753.git
+repo.path=/repositories/csci3753.git
repo.desc=CSCI3753 Coursework
repo.url=cses
-repo.path=/var/lib/git/repositories/cses.git
+repo.path=/repositories/cses.git
repo.desc=CSES Solutions (0x6A73)
repo.url=dots
-repo.path=/var/lib/git/repositories/dots.git
+repo.path=/repositories/dots.git
repo.desc=Laptop & Desktop dotfiles
repo.url=ecen5273
-repo.path=/var/lib/git/repositories/ecen5273.git
+repo.path=/repositories/ecen5273.git
repo.desc=ECEN5273 Coursework
repo.url=leetcode
-repo.path=/var/lib/git/repositories/leetcode.git
+repo.path=/repositories/leetcode.git
repo.desc=Leetcode Solutions (0x6A73)
repo.url=protoncrkbd
-repo.path=/var/lib/git/repositories/protoncrkbd.git
+repo.path=/repositories/protoncrkbd.git
repo.desc=Proton-C compatible crkbd PCB
repo.url=pseusplit
-repo.path=/var/lib/git/repositories/pseusplit.git
+repo.path=/repositories/pseusplit.git
repo.desc=Integrated STM32G0B1 Keyboard PCB
repo.url=qmk_firmware
-repo.path=/var/lib/git/repositories/qmk_firmware.git
+repo.path=/repositories/qmk_firmware.git
repo.desc=Open-source keyboard firmware for Atmel AVR and Arm USB families
repo.url=qmk_me
-repo.path=/var/lib/git/repositories/qmk_me.git
+repo.path=/repositories/qmk_me.git
repo.desc=QMK Firmware userspace, keyboards, & keymaps
repo.url=server
-repo.path=/var/lib/git/repositories/server.git
+repo.path=/repositories/server.git
repo.desc=Server Configuration
repo.url=site
-repo.path=/var/lib/git/repositories/site.git
+repo.path=/repositories/site.git
repo.desc=Website Content
repo.url=st
-repo.path=/var/lib/git/repositories/st.git
+repo.path=/repositories/st.git
repo.desc=Simple Terminal
repo.url=sweep
-repo.path=/var/lib/git/repositories/sweep.git
+repo.path=/repositories/sweep.git
repo.desc=Integrated RP2040 Sweep Keyboard PCB
repo.url=synacor_challenge
-repo.path=/var/lib/git/repositories/synacor_challenge.git
+repo.path=/repositories/synacor_challenge.git
repo.desc=OSCON Synacor Challenge
+repo.url=unzahl
+repo.path=/repositories/unzahl.git
+repo.desc=Integrated STM32G431 Le Chiffre Keyboard PCB
+
repo.url=zmk_build
-repo.path=/var/lib/git/repositories/zmk_build.git
+repo.path=/repositories/zmk_build.git
repo.desc=ZMK code & build repository
diff --git a/cgit/compose.yaml b/cgit/compose.yaml
@@ -0,0 +1,17 @@
+services:
+ cgit:
+ build: .
+ container_name: cgit
+ restart: unless-stopped
+ volumes:
+ - /var/lib/git/repositories:/repositories:ro
+ - ./cgitrc:/etc/cgitrc
+ - ./cgitrepos:/etc/cgitrepos
+ - ./cache:/var/cache/cgit
+ - ./static:/var/www/localhost/htdocs/cgit
+ networks:
+ - caddybridge
+
+networks:
+ caddybridge:
+ external: true
diff --git a/cgit/static/pingu.ico b/cgit/static/pingu.ico
Binary files differ.
diff --git a/cgit/static/pingu.png b/cgit/static/pingu.png
Binary files differ.
diff --git a/kuma/compose.yaml b/kuma/compose.yaml
@@ -5,8 +5,6 @@ services:
restart: unless-stopped
volumes:
- data:/app/data
- ports:
- - 11003:3001
depends_on:
- db
environment:
@@ -16,6 +14,9 @@ services:
UPTIME_KUMA_DB_NAME: kuma
UPTIME_KUMA_DB_USERNAME: kuma_user
UPTIME_KUMA_DB_PASSWORD: ${MARIADB_PASSWORD}
+ networks:
+ - caddybridge
+ - kuma_dbnet
db:
image: mariadb
@@ -28,7 +29,15 @@ services:
MARIADB_PASSWORD: ${MARIADB_PASSWORD}
volumes:
- db:/var/lib/mysql
+ networks:
+ - kuma_dbnet
volumes:
data:
db:
+
+networks:
+ caddybridge:
+ external: true
+ kuma_dbnet:
+ internal: true
diff --git a/ls_cron.sh b/ls_cron.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+getent passwd | awk -F: '{ print $1 }' | xargs -I% sh -c 'crontab -l -u % | sed "/^$/d; /^#/d; s/^/% /"' 2>/dev/null
+echo
+cat /etc/crontab /etc/anacrontab 2>/dev/null | sed '/^$/d; /^#/d;'
+echo
+run-parts --list /etc/cron.hourly;
+run-parts --list /etc/cron.daily;
+run-parts --list /etc/cron.weekly;
+run-parts --list /etc/cron.monthly;
diff --git a/roundcube/compose.yaml b/roundcube/compose.yaml
@@ -5,8 +5,6 @@ services:
restart: unless-stopped
volumes:
- www:/var/www/html
- ports:
- - 11005:80
depends_on:
- db
environment:
@@ -17,7 +15,9 @@ services:
ROUNDCUBEMAIL_DB_PASSWORD: ${MARIADB_PASSWORD}
ROUNDCUBEMAIL_DEFAULT_HOST: tls://mail.pngu.org
ROUNDCUBEMAIL_SMTP_SERVER: tls://mail.pngu.org
- ROUNDCUBEMAIL_PLUGINS: acl, archive, autologon, debug_logger, filesystem_attachments, help, hide_blockquote, http_authentication, identicon, identity_select, jqueryui, krb_authentication, markasjunk, newmail_notifier, password, reconnect, show_additional_headers, subscriptions_option, userinfo, virtuser_file, zipdownload
+ networks:
+ - caddybridge
+ - roundcube_dbnet
db:
image: mariadb
@@ -31,7 +31,15 @@ services:
MARIADB_PASSWORD: ${MARIADB_PASSWORD}
volumes:
- db:/var/lib/mysql
+ networks:
+ - roundcube_dbnet
volumes:
www:
db:
+
+networks:
+ caddybridge:
+ external: true
+ roundcube_dbnet:
+ internal: true
diff --git a/stalwart/compose.yaml b/stalwart/compose.yaml
@@ -5,6 +5,7 @@ services:
restart: unless-stopped
ports:
- 8443:8443
+ - 8080:8080
- 25:25
- 587:587
- 465:465
@@ -13,21 +14,10 @@ services:
- 110:110
- 995:995
volumes:
- - data:/opt/stalwart-mail
+ - /var/lib/stalwart-mail:/opt/stalwart-mail
+ networks:
+ - caddybridge
- db:
- image: mariadb
- container_name: stalwart_db
- restart: unless-stopped
- env_file: .env
- environment:
- MYSQL_RANDOM_ROOT_PASSWORD: yes
- MARIADB_DATABASE: stalwart
- MARIADB_USER: stalwart_user
- MARIADB_PASSWORD: ${MARIADB_PASSWORD}
- volumes:
- - db:/var/lib/mysql
-
-volumes:
- data:
- db:
+networks:
+ caddybridge:
+ external: true
diff --git a/vaultwarden/compose.yaml b/vaultwarden/compose.yaml
@@ -5,8 +5,6 @@ services:
restart: unless-stopped
volumes:
- data:/data
- ports:
- - 11001:80
depends_on:
- db
environment:
@@ -15,6 +13,11 @@ services:
DATABASE_URL: mysql://vaultwarden_user:${MARIADB_PASSWORD}@db/vaultwarden
ADMIN_TOKEN: ${ADMIN_TOKEN}
RUST_BACKTRACE: 1
+ ROCKET_ADDRESS: 0.0.0.0
+ ROCKET_PORT: 80
+ networks:
+ - caddybridge
+ - vaultwarden_dbnet
db:
image: mariadb
@@ -28,7 +31,15 @@ services:
MARIADB_PASSWORD: ${MARIADB_PASSWORD}
volumes:
- db:/var/lib/mysql
+ networks:
+ - vaultwarden_dbnet
volumes:
data:
db:
+
+networks:
+ caddybridge:
+ external: true
+ vaultwarden_dbnet:
+ internal: true
